[Web] Add User ACL to manage SOGo access

.github/workflows/close_old_issues_and_prs.yml

@@ -14,7 +14,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Mark/Close Stale Issues and Pull Requests 🗑️
-        uses: actions/stale@v11.0.0
+        uses: actions/stale@v10.2.0
         with:
           repo-token: ${{ secrets.STALE_ACTION_PAT }}
           days-before-stale: 60

.github/workflows/image_builds.yml

@@ -27,7 +27,7 @@ jobs:
           - "watchdog-mailcow"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
       - name: Setup Docker
         run: |
           curl -sSL https://get.docker.com/ | CHANNEL=stable sudo sh

.github/workflows/pr_to_nightly.yml

@@ -8,11 +8,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
       - name: Run the Action
-        uses: devops-infra/action-pull-request@v1.4.0
+        uses: devops-infra/action-pull-request@v1.0.2
         with:
           github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }}
           title: Automatic PR to nightly from ${{ github.event.repository.updated_at}}

.github/workflows/rebuild_backup_image.yml

@@ -13,7 +13,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4

.github/workflows/update_postscreen_access_list.yml

@@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@v6
 
     - name: Generate postscreen_access.cidr
       run: |

.gitignore

@@ -64,8 +64,6 @@ data/web/templates/cache/*
 !data/web/templates/cache/.gitkeep
 data/web/.well-known/acme-challenge
 data/web/css/build/0081-custom-mailcow.css
-data/web/css/themes/*/
-!data/web/css/themes/servercow/
 data/web/inc/vars.local.inc.php
 data/web/inc/app_info.inc.php
 data/web/nextcloud*/
@@ -78,6 +76,4 @@ refresh_images.sh
 update_diffs/
 create_cold_standby.sh
 !data/conf/nginx/mailcow_auth.conf
-data/conf/postfix/postfix-tlspol
-tests/php/vendor/
-tests/php/.phpunit.cache/
+data/conf/postfix/postfix-tlspol

README.md

@@ -23,15 +23,10 @@ A big thank you to everyone supporting us on GitHub Sponsors—your contribution
   <a href="https://www.maehdros.com/" target=_blank><img
     src="https://avatars.githubusercontent.com/u/173894712" height="58"
   /></a>
-  <a href="https://garske-systems.de/" target=_blank><img
-    src="https://garske-systems.de/img/logo_min.png" height="58"
-  /></a>
 
 ### 50$/Month Sponsors
   <a href="https://github.com/vnukhr" target=_blank><img
     src="https://avatars.githubusercontent.com/u/7805987?s=52&v=4" height="58"
-  /></a><a href="https://github.com/humiico" target=_blank><img
-    src="https://avatars.githubusercontent.com/u/110134705?s=52&v=4" height="58"
   /></a>
 
 ## Info, documentation and support

_modules/scripts/new_options.sh

@@ -111,16 +111,16 @@ adapt_new_options() {
             echo "SQL_PORT=127.0.0.1:13306" >> mailcow.conf
             ;;
         API_KEY)
-            echo '# Read-write service API key, shown read-only in the web UI' >> mailcow.conf
+            echo '# Create or override API key for web UI' >> mailcow.conf
             echo "#API_KEY=" >> mailcow.conf
             ;;
         API_KEY_READ_ONLY)
-            echo '# Read-only service API key, shown read-only in the web UI' >> mailcow.conf
+            echo '# Create or override read-only API key for web UI' >> mailcow.conf
             echo "#API_KEY_READ_ONLY=" >> mailcow.conf
             ;;
         API_ALLOW_FROM)
-            echo '# Must be set for API_KEY and API_KEY_READ_ONLY to be active' >> mailcow.conf
-            echo '# Comma separated list of IPs/networks' >> mailcow.conf
+            echo '# Must be set for API_KEY to be active' >> mailcow.conf
+            echo '# IPs only, no networks (networks can be set via UI)' >> mailcow.conf
             echo "#API_ALLOW_FROM=" >> mailcow.conf
             ;;
         SNAT_TO_SOURCE)

data/Dockerfiles/acme/acme.sh

@@ -249,45 +249,14 @@ while true; do
   done <<< "${SQL_DOMAINS}"
 
   if [[ ${ONLY_MAILCOW_HOSTNAME} != "y" ]]; then
-  # Fetch all domains with an active MTA-STS policy once.
-  unset MTA_STS_ACTIVE_DOMAINS
-  declare -A MTA_STS_ACTIVE_DOMAINS
-  if [[ ${AUTODISCOVER_SAN} == "y" ]]; then
-    SQL_MTA_STS_DOMAINS=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT domain FROM mta_sts WHERE active = 1" -Bs)
-    if [[ $? -eq 0 ]]; then
-      while read mta_sts_domain; do
-        if [[ -z "${mta_sts_domain}" ]]; then
-          # ignore empty lines
-          continue
-        fi
-        MTA_STS_ACTIVE_DOMAINS["${mta_sts_domain}"]=1
-      done <<< "${SQL_MTA_STS_DOMAINS}"
-    fi
-  fi
   for SQL_DOMAIN in "${SQL_DOMAIN_ARR[@]}"; do
     unset VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
     declare -a VALIDATED_CONFIG_DOMAINS_SUBDOMAINS
     for SUBDOMAIN in "${ADDITIONAL_WC_ARR[@]}"; do
-      FULL_SUBDOMAIN="${SUBDOMAIN}.${SQL_DOMAIN}"
-
-      # Skip mta-sts subdomain unless MTA-STS is enabled (active) for this domain
-      if [[ "${SUBDOMAIN}" == "mta-sts" && -z "${MTA_STS_ACTIVE_DOMAINS[${SQL_DOMAIN}]}" ]]; then
-        log_f "MTA-STS is not enabled for ${SQL_DOMAIN} - skipping mta-sts subdomain certificate"
-        continue
-      fi
-
-      # Skip if subdomain matches MAILCOW_HOSTNAME
-      if [[ "${FULL_SUBDOMAIN}" == "${MAILCOW_HOSTNAME}" ]]; then
-        continue
-      fi
-      # Skip if subdomain is covered by a wildcard in ADDITIONAL_SAN
-      if is_covered_by_wildcard "${FULL_SUBDOMAIN}"; then
-        log_f "Subdomain '${FULL_SUBDOMAIN}' is covered by wildcard - skipping explicit subdomain"
-        continue
-      fi
-      # Validate and add subdomain
-      if check_domain "${FULL_SUBDOMAIN}"; then
-        VALIDATED_CONFIG_DOMAINS_SUBDOMAINS+=("${FULL_SUBDOMAIN}")
+      if [[  "${SUBDOMAIN}.${SQL_DOMAIN}" != "${MAILCOW_HOSTNAME}" ]]; then
+        if check_domain "${SUBDOMAIN}.${SQL_DOMAIN}"; then
+          VALIDATED_CONFIG_DOMAINS_SUBDOMAINS+=("${SUBDOMAIN}.${SQL_DOMAIN}")
+        fi
       fi
     done
     VALIDATED_CONFIG_DOMAINS+=("${VALIDATED_CONFIG_DOMAINS_SUBDOMAINS[*]}")
@@ -304,10 +273,7 @@ while true; do
         fi
         # Only add mta-sts subdomain for alias domains
         if [[ "mta-sts.${alias_domain}" != "${MAILCOW_HOSTNAME}" ]]; then
-          # Skip if mta-sts subdomain is covered by a wildcard
-          if is_covered_by_wildcard "mta-sts.${alias_domain}"; then
-            log_f "Alias domain mta-sts subdomain 'mta-sts.${alias_domain}' is covered by wildcard - skipping"
-          elif check_domain "mta-sts.${alias_domain}"; then
+          if check_domain "mta-sts.${alias_domain}"; then
             VALIDATED_CONFIG_DOMAINS+=("mta-sts.${alias_domain}")
           fi
         fi
@@ -342,31 +308,13 @@ while true; do
   done
   fi
 
-  # Check if MAILCOW_HOSTNAME is covered by a wildcard in ADDITIONAL_SAN
-  MAILCOW_HOSTNAME_COVERED=0
-  if [[ ! -z ${VALIDATED_MAILCOW_HOSTNAME} ]]; then
-    if is_covered_by_wildcard "${VALIDATED_MAILCOW_HOSTNAME}"; then
-      MAILCOW_PARENT_DOMAIN=$(echo ${VALIDATED_MAILCOW_HOSTNAME} | cut -d. -f2-)
-      log_f "MAILCOW_HOSTNAME '${VALIDATED_MAILCOW_HOSTNAME}' is covered by wildcard '*.${MAILCOW_PARENT_DOMAIN}' - skipping explicit hostname"
-      MAILCOW_HOSTNAME_COVERED=1
-    fi
-  fi
-
   # Unique domains for server certificate
   if [[ ${ENABLE_SSL_SNI} == "y" ]]; then
     # create certificate for server name and fqdn SANs only
-    if [[ ${MAILCOW_HOSTNAME_COVERED} == "1" ]]; then
-      SERVER_SAN_VALIDATED=($(echo ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
-    else
-      SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
-    fi
+    SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
   else
     # create certificate for all domains, including all subdomains from other domains [*]
-    if [[ ${MAILCOW_HOSTNAME_COVERED} == "1" ]]; then
-      SERVER_SAN_VALIDATED=($(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
-    else
-      SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
-    fi
+    SERVER_SAN_VALIDATED=(${VALIDATED_MAILCOW_HOSTNAME} $(echo ${VALIDATED_CONFIG_DOMAINS[*]} ${ADDITIONAL_VALIDATED_SAN[*]} | xargs -n1 | sort -u | xargs))
   fi
   if [[ ! -z ${SERVER_SAN_VALIDATED[*]} ]]; then
     CERT_NAME=${SERVER_SAN_VALIDATED[0]}

data/Dockerfiles/acme/functions.sh

@@ -135,32 +135,3 @@ verify_challenge_path(){
     return 1
   fi
 }
-
-# Check if a domain is covered by a wildcard (*.example.com) in ADDITIONAL_SAN
-# Usage: is_covered_by_wildcard "subdomain.example.com"
-# Returns: 0 if covered, 1 if not covered
-# Note: Only returns 0 (covered) when DNS-01 challenge is enabled,
-#       as wildcards cannot be validated with HTTP-01 challenge
-is_covered_by_wildcard() {
-  local DOMAIN=$1
-
-  # Only skip if DNS challenge is enabled (wildcards require DNS-01)
-  if [[ ${ACME_DNS_CHALLENGE} != "y" ]]; then
-    return 1
-  fi
-
-  # Return early if no ADDITIONAL_SAN is set
-  if [[ -z ${ADDITIONAL_SAN} ]]; then
-    return 1
-  fi
-
-  # Extract parent domain (e.g., mail.example.com -> example.com)
-  local PARENT_DOMAIN=$(echo ${DOMAIN} | cut -d. -f2-)
-
-  # Check if ADDITIONAL_SAN contains a wildcard for this parent domain
-  if [[ "${ADDITIONAL_SAN}" == *"*.${PARENT_DOMAIN}"* ]]; then
-    return 0  # Covered by wildcard
-  fi
-
-  return 1  # Not covered
-}

data/Dockerfiles/clamd/Dockerfile

@@ -1,7 +1,7 @@
-FROM alpine:3.24 AS builder
+FROM alpine:3.21 AS builder
 
 WORKDIR /src
-ENV CLAMD_VERSION=1.4.6
+ENV CLAMD_VERSION=1.4.2
 
 RUN apk upgrade --no-cache \
   && apk add --update --no-cache \
@@ -68,7 +68,7 @@ RUN wget -P /src https://www.clamav.net/downloads/production/clamav-${CLAMD_VERS
   "/clamav/etc/clamav/clamav-milter.conf.sample" > "/clamav/etc/clamav/clamav-milter.conf" || exit 1
 
 
-FROM alpine:3.24
+FROM alpine:3.21
 
 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"
 

data/Dockerfiles/dockerapi/modules/DockerApi.py

@@ -412,63 +412,6 @@ class DockerApi:
 
         sogo_return = container.exec_run(["/bin/bash", "-c", f"sogo-tool rename-user '{old_username}' '{new_username}'"], user='sogo')
         return self.exec_run_handler('generic', sogo_return)
-  # api call: container_post - post_action: exec - cmd: sogo - task: subscribe
-  # Subscribes users to a folder of the owner, or unsubscribes them; values are passed as environment and
-  # arguments, never through the shell
-  def container_post__exec__sogo__subscribe(self, request_json, **kwargs):
-    if 'container_id' in kwargs:
-      filters = {"id": kwargs['container_id']}
-    elif 'container_name' in kwargs:
-      filters = {"name": kwargs['container_name']}
-
-    for container in self.sync_docker_client.containers.list(filters=filters):
-      owner = str(request_json.get('owner', ''))
-      folder = str(request_json.get('folder', ''))
-      users = [str(user) for user in request_json.get('users', []) if str(user)]
-      if not owner or not users or not re.match(r'^(Calendar|Contacts)/[A-Za-z0-9._-]+$', folder):
-        return Response(content=json.dumps({ 'type': 'danger', 'msg': 'owner, folder and users required' }, indent=4), media_type="application/json")
-      script = 'for user in "$@"; do sogo-tool manage-acl "$SOGO_ACTION" "$SOGO_OWNER" "$SOGO_FOLDER" "$user" || exit 1; done'
-      subscribe_return = container.exec_run(["/bin/bash", "-c", script, "subscribe"] + users, user='sogo',
-        environment={ 'SOGO_ACTION': 'unsubscribe' if request_json.get('unsubscribe') else 'subscribe', 'SOGO_OWNER': owner, 'SOGO_FOLDER': folder })
-      return self.exec_run_handler('generic', subscribe_return)
-  # api call: container_post - post_action: exec - cmd: sogo - task: init_user
-  # Creates the personal folders of users that never logged in to SOGo (e.g. shared mailboxes)
-  def container_post__exec__sogo__init_user(self, request_json, **kwargs):
-    if 'container_id' in kwargs:
-      filters = {"id": kwargs['container_id']}
-    elif 'container_name' in kwargs:
-      filters = {"name": kwargs['container_name']}
-
-    for container in self.sync_docker_client.containers.list(filters=filters):
-      users = [str(user) for user in request_json.get('users', []) if str(user)]
-      if not users:
-        return Response(content=json.dumps({ 'type': 'danger', 'msg': 'users required' }, indent=4), media_type="application/json")
-      init_return = container.exec_run(["/bin/bash", "-c", 'for user in "$@"; do sogo-tool init-user "$user" || exit 1; done', "init_user"] + users, user='sogo')
-      return self.exec_run_handler('generic', init_return)
-  # api call: container_post - post_action: exec - cmd: doveadm - task: subscribe_shared
-  # Subscribes users to every folder of a mailbox shared with them (Shared/<owner>/...), or unsubscribes them
-  def container_post__exec__doveadm__subscribe_shared(self, request_json, **kwargs):
-    if 'container_id' in kwargs:
-      filters = {"id": kwargs['container_id']}
-    elif 'container_name' in kwargs:
-      filters = {"name": kwargs['container_name']}
-
-    for container in self.sync_docker_client.containers.list(filters=filters):
-      owner = str(request_json.get('owner', ''))
-      users = [str(user) for user in request_json.get('users', []) if str(user)]
-      if not owner or not users or any(c in owner for c in '/*%'):
-        return Response(content=json.dumps({ 'type': 'danger', 'msg': 'owner and users required' }, indent=4), media_type="application/json")
-      if request_json.get('unsubscribe'):
-        # Without access the user no longer sees the folders, their names come from the owner
-        script = ('set -o pipefail; for user in "$@"; do doveadm mailbox list -u "$SUB_OWNER" | while IFS= read -r folder; do '
-          'case "$folder" in Shared|Shared/*) continue;; esac; doveadm mailbox unsubscribe -u "$user" "Shared/$SUB_OWNER/$folder" || exit 1; '
-          'done || exit 1; done')
-      else:
-        # No visible folder means no access yet (ACL, auth cache): fail, so the subscription is retried
-        script = ('for user in "$@"; do folders=$(doveadm mailbox list -u "$user" "Shared/$SUB_OWNER/*") && [ -n "$folders" ] || exit 1; '
-          'while IFS= read -r folder; do doveadm mailbox subscribe -u "$user" "$folder" || exit 1; done <<< "$folders"; done')
-      subscribe_return = container.exec_run(["/bin/bash", "-c", script, "subscribe_shared"] + users, environment={ 'SUB_OWNER': owner })
-      return self.exec_run_handler('generic', subscribe_return)
   # api call: container_post - post_action: exec - cmd: doveadm - task: get_acl
   def container_post__exec__doveadm__get_acl(self, request_json, **kwargs):
     if 'container_id' in kwargs:
@@ -496,8 +439,7 @@ class DockerApi:
           if len(acls) >= 2:
             for acl in acls[1:]:
               user_id, rights = acl.split(maxsplit=1)
-              # user=<name> as plain name, other identifiers (group=...) keep their type
-              user_id = user_id.split('=', 1)[1] if user_id.startswith('user=') else user_id
+              user_id = user_id.split('=')[1]
               mailbox_seen.append(mailbox)
               formatted_acls.append({ 'user': id, 'id': user_id, 'mailbox': mailbox, 'rights': rights.split() })
         elif "Shared" in shared_folder and "/" in shared_folder:
@@ -534,7 +476,7 @@ class DockerApi:
       id = request_json['id'].replace("'", "'\\''")
 
       if user and mailbox and id:
-        acl_delete_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl delete -u '{user}' '{mailbox}' '{self.acl_identifier(id)}'"])
+        acl_delete_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl delete -u '{user}' '{mailbox}' 'user={id}'"])
         return self.exec_run_handler('generic', acl_delete_return)
   # api call: container_post - post_action: exec - cmd: doveadm - task: set_acl
   def container_post__exec__doveadm__set_acl(self, request_json, **kwargs):
@@ -568,50 +510,8 @@ class DockerApi:
           rights += right + " "
 
       if user and mailbox and id and rights:
-        acl_set_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl set -u '{user}' '{mailbox}' '{self.acl_identifier(id)}' {rights}"])
+        acl_set_return = container.exec_run(["/bin/bash", "-c", f"doveadm acl set -u '{user}' '{mailbox}' 'user={id}' {rights}"])
         return self.exec_run_handler('generic', acl_set_return)
-  # api call: container_post - post_action: exec - cmd: doveadm - task: set_acl_all
-  # Sets the rights of an identifier on every folder of a mailbox, no rights = delete; values are passed as
-  # environment, never through the shell
-  def container_post__exec__doveadm__set_acl_all(self, request_json, **kwargs):
-    if 'container_id' in kwargs:
-      filters = {"id": kwargs['container_id']}
-    elif 'container_name' in kwargs:
-      filters = {"name": kwargs['container_name']}
-
-    for container in self.sync_docker_client.containers.list(filters=filters):
-      user = request_json.get('user', '')
-      id = self.acl_identifier(request_json.get('id', ''))
-      rights = [right.lower() for right in request_json.get('rights', []) if right.lower() in self.acl_rights]
-      if not user or id in ('user=', 'group='):
-        return Response(content=json.dumps({ 'type': 'danger', 'msg': 'user and id required' }, indent=4), media_type="application/json")
-      action = 'doveadm acl set -u "$ACL_USER" "$folder" "$ACL_ID" $ACL_RIGHTS' if rights else 'doveadm acl delete -u "$ACL_USER" "$folder" "$ACL_ID"'
-      script = ('set -o pipefail; doveadm mailbox list -u "$ACL_USER" | while IFS= read -r folder; do '
-        'case "$folder" in Shared/*) continue;; esac; ' + action + ' || exit 1; done && doveadm acl recalc -u "$ACL_USER"')
-      acl_return = container.exec_run(["/bin/bash", "-c", script],
-        environment={ 'ACL_USER': user, 'ACL_ID': id, 'ACL_RIGHTS': ' '.join(rights) })
-      return self.exec_run_handler('generic', acl_return)
-  # api call: container_post - post_action: exec - cmd: doveadm - task: auth_cache_flush
-  # Drops cached userdb results (e.g. acl_groups) of the given users, all users if none are given
-  def container_post__exec__doveadm__auth_cache_flush(self, request_json, **kwargs):
-    if 'container_id' in kwargs:
-      filters = {"id": kwargs['container_id']}
-    elif 'container_name' in kwargs:
-      filters = {"name": kwargs['container_name']}
-
-    for container in self.sync_docker_client.containers.list(filters=filters):
-      users = [str(user) for user in request_json.get('users', []) if str(user)]
-      flush_return = container.exec_run(["doveadm", "auth", "cache", "flush"] + users)
-      return self.exec_run_handler('generic', flush_return)
-
-  # Rights doveadm acl set accepts from the API
-  acl_rights = ["admin", "create", "delete", "expunge", "insert", "lookup", "post", "read", "write", "write-deleted", "write-seen"]
-
-  # ACL identifier for doveadm: "user=<name>" for a plain name, "user=..." / "group=..." as given
-  def acl_identifier(self, id):
-    if id.startswith('user=') or id.startswith('group='):
-      return id
-    return 'user=' + id
 
 
   # Collect host stats

data/Dockerfiles/dovecot/Dockerfile

@@ -68,6 +68,7 @@ RUN addgroup -g 5000 vmail \
   perl-package-stash-xs \
   perl-par-packer \
   perl-parse-recdescent \
+  perl-lockfile-simple \
   libproc2 \
   perl-readonly \
   perl-regexp-common \
@@ -119,7 +120,7 @@ COPY clean_q_aged.sh /usr/local/bin/clean_q_aged.sh
 COPY syslog-ng.conf /etc/syslog-ng/syslog-ng.conf
 COPY syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng-redis_slave.conf
 COPY imapsync /usr/local/bin/imapsync
-COPY imapsync_runner.py /usr/local/bin/imapsync_runner.py
+COPY imapsync_runner.pl /usr/local/bin/imapsync_runner.pl
 COPY report-spam.sieve /usr/lib/dovecot/sieve/report-spam.sieve
 COPY report-ham.sieve /usr/lib/dovecot/sieve/report-ham.sieve
 COPY rspamd-pipe-ham /usr/lib/dovecot/sieve/rspamd-pipe-ham

data/Dockerfiles/dovecot/docker-entrypoint.sh

@@ -127,8 +127,7 @@ cat <<EOF > /etc/dovecot/sql/dovecot-dict-sql-userdb.conf
 # Autogenerated by mailcow
 driver = mysql
 connect = "host=/var/run/mysqld/mysqld.sock dbname=${DBNAME} user=${DBUSER} password=${DBPASS}"
-# acl_groups: active mailbox groups of the user, IMAP grants are ACLs on group=mcg_<id>
-user_query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%d/%n/${MAILDIR_SUB}:VOLATILEDIR=/var/volatile/%u:INDEX=/var/vmail_index/%u') AS mail, '%s' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule, (SELECT GROUP_CONCAT(CONCAT('mcg_', gm.group_id)) FROM mailbox_group_member gm JOIN mailbox_group g ON g.id = gm.group_id AND g.active = 1 WHERE gm.username = mailbox.username) AS acl_groups FROM mailbox WHERE username = '%u' AND (active = '1' OR active = '2')
+user_query = SELECT CONCAT(JSON_UNQUOTE(JSON_VALUE(attributes, '$.mailbox_format')), mailbox_path_prefix, '%d/%n/${MAILDIR_SUB}:VOLATILEDIR=/var/volatile/%u:INDEX=/var/vmail_index/%u') AS mail, '%s' AS protocol, 5000 AS uid, 5000 AS gid, concat('*:bytes=', quota) AS quota_rule FROM mailbox WHERE username = '%u' AND (active = '1' OR active = '2')
 iterate_query = SELECT username FROM mailbox WHERE active = '1' OR active = '2';
 EOF
 
@@ -280,7 +279,7 @@ chmod g+rw /dev/console
 chown root:tty /dev/console
 chmod +x /usr/lib/dovecot/sieve/rspamd-pipe-ham \
   /usr/lib/dovecot/sieve/rspamd-pipe-spam \
-  /usr/local/bin/imapsync_runner.py \
+  /usr/local/bin/imapsync_runner.pl \
   /usr/local/bin/imapsync \
   /usr/local/bin/trim_logs.sh \
   /usr/local/bin/sa-rules.sh \
@@ -305,15 +304,6 @@ IMAPSYNC_TABLE=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DB
 # Envsubst maildir_gc
 echo "$(envsubst < /usr/local/bin/maildir_gc.sh)" > /usr/local/bin/maildir_gc.sh
 
-# Wait for updated schema (DB_VERSION from docker-compose.yml), the userdb query reads tables the init_db of php-fpm creates on updates
-DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
-while [[ "${DBV_NOW}" != "${DB_VERSION}" ]]; do
-  echo "Waiting for schema update..."
-  sleep 5
-  DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
-done
-echo "DB schema is ${DBV_NOW}"
-
 # GUID generation
 while [[ ${VERSIONS_OK} != 'OK' ]]; do
   if [[ ! -z $(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -B -e "SELECT 'OK' FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = \"${DBNAME}\" AND TABLE_NAME = 'versions'") ]]; then

data/Dockerfiles/dovecot/imapsync_runner.pl

@@ -0,0 +1,196 @@
+#!/usr/bin/perl
+
+use DBI;
+use LockFile::Simple qw(lock trylock unlock);
+use Proc::ProcessTable;
+use Data::Dumper qw(Dumper);
+use IPC::Run 'run';
+use File::Temp;
+use Try::Tiny;
+use sigtrap 'handler' => \&sig_handler, qw(INT TERM KILL QUIT);
+
+sub trim { my $s = shift; $s =~ s/^\s+|\s+$//g; return $s };
+my $t = Proc::ProcessTable->new;
+my $imapsync_running = grep { $_->{cmndline} =~ /imapsync\s/i } @{$t->table};
+if ($imapsync_running ge 1)
+{
+  print "imapsync is active, exiting...";
+  exit;
+}
+
+sub qqw($) {
+  my @params = ();
+  my @values = split(/(?=--)/, $_[0]);
+  foreach my $val (@values) {
+    my @tmpparam = split(/ /, $val, 2);
+    foreach my $tmpval (@tmpparam) {
+        if ($tmpval ne '') {
+          push @params, $tmpval;
+        }
+    }
+  }
+  foreach my $val (@params) {
+    $val=trim($val);
+  }
+  return @params;
+}
+
+$run_dir="/tmp";
+$dsn = 'DBI:mysql:database=' . $ENV{'DBNAME'} . ';mysql_socket=/var/run/mysqld/mysqld.sock';
+$lock_file = $run_dir . "/imapsync_busy";
+$lockmgr = LockFile::Simple->make(-autoclean => 1, -max => 1);
+$lockmgr->lock($lock_file) || die "can't lock ${lock_file}";
+$dbh = DBI->connect($dsn, $ENV{'DBUSER'}, $ENV{'DBPASS'}, {
+  mysql_auto_reconnect => 1,
+  mysql_enable_utf8mb4 => 1
+});
+$dbh->do("UPDATE imapsync SET is_running = 0");
+
+sub sig_handler {
+  # Send die to force exception in "run"
+  die "sig_handler received signal, preparing to exit...\n";
+};
+
+open my $file, '<', "/etc/sogo/sieve.creds"; 
+my $creds = <$file>; 
+close $file;
+my ($master_user, $master_pass) = split /:/, $creds;
+my $sth = $dbh->prepare("SELECT id,
+  user1,
+  user2,
+  host1,
+  authmech1,
+  password1,
+  exclude,
+  port1,
+  enc1,
+  delete2duplicates,
+  maxage,
+  subfolder2,
+  delete1,
+  delete2,
+  automap,
+  skipcrossduplicates,
+  maxbytespersecond,
+  custom_params,
+  subscribeall,
+  timeout1,
+  timeout2,
+  dry
+    FROM imapsync
+      WHERE active = 1
+        AND is_running = 0
+        AND (
+          UNIX_TIMESTAMP(NOW()) - UNIX_TIMESTAMP(last_run) > mins_interval * 60
+          OR
+          last_run IS NULL)
+  ORDER BY last_run");
+
+$sth->execute();
+my $row;
+
+while ($row = $sth->fetchrow_arrayref()) {
+
+  $id                  = @$row[0];
+  $user1               = @$row[1];
+  $user2               = @$row[2];
+  $host1               = @$row[3];
+  $authmech1           = @$row[4];
+  $password1           = @$row[5];
+  $exclude             = @$row[6];
+  $port1               = @$row[7];
+  $enc1                = @$row[8];
+  $delete2duplicates   = @$row[9];
+  $maxage              = @$row[10];
+  $subfolder2          = @$row[11];
+  $delete1             = @$row[12];
+  $delete2             = @$row[13];
+  $automap             = @$row[14];
+  $skipcrossduplicates = @$row[15];
+  $maxbytespersecond   = @$row[16];
+  $custom_params       = @$row[17];
+  $subscribeall        = @$row[18];
+  $timeout1            = @$row[19];
+  $timeout2            = @$row[20];
+  $dry                 = @$row[21];
+
+  if ($enc1 eq "TLS") { $enc1 = "--tls1"; } elsif ($enc1 eq "SSL") { $enc1 = "--ssl1"; } else { undef $enc1; }
+
+  my $template = $run_dir . '/imapsync.XXXXXXX';
+  my $passfile1 = File::Temp->new(TEMPLATE => $template);
+  my $passfile2 = File::Temp->new(TEMPLATE => $template);
+  
+  binmode( $passfile1, ":utf8" );
+  
+  print $passfile1 "$password1\n";
+  print $passfile2 trim($master_pass) . "\n";
+
+  my @custom_params_a = qqw($custom_params);
+  my $custom_params_ref = \@custom_params_a;
+
+  my $generated_cmds = [ "/usr/local/bin/imapsync",
+  "--tmpdir", "/tmp",
+  "--nofoldersizes",
+  "--addheader",
+  ($timeout1 le "0" ? () : ('--timeout1', $timeout1)),
+  ($timeout2 le "0" ? () : ('--timeout2', $timeout2)),
+  ($exclude eq "" ? () : ("--exclude", $exclude)),
+  ($subfolder2 eq "" ? () : ('--subfolder2', $subfolder2)),
+  ($maxage eq "0" ? () : ('--maxage', $maxage)),
+  ($maxbytespersecond eq "0" ? () : ('--maxbytespersecond', $maxbytespersecond)),
+  ($delete2duplicates ne "1" ? () : ('--delete2duplicates')),
+  ($subscribeall  ne "1" ? () : ('--subscribeall')),
+  ($delete1 ne "1" ? () : ('--delete')),
+  ($delete2 ne "1" ? () : ('--delete2')),
+  ($automap ne "1" ? () : ('--automap')),
+  ($skipcrossduplicates ne "1" ? () : ('--skipcrossduplicates')),
+  (!defined($enc1) ? () : ($enc1)),
+  "--host1", $host1,
+  "--user1", $user1,
+  "--passfile1", $passfile1->filename,
+  "--port1", $port1,
+  "--host2", "localhost",
+  "--user2", $user2 . '*' . trim($master_user),
+  "--passfile2", $passfile2->filename,
+  ($dry eq "1" ? ('--dry') : ()),
+  '--no-modulesversion',
+  '--noreleasecheck'];
+
+  try {
+    $is_running = $dbh->prepare("UPDATE imapsync SET is_running = 1, success = NULL, exit_status = NULL WHERE id = ?");
+    $is_running->bind_param( 1, ${id} );
+    $is_running->execute();
+
+    run [@$generated_cmds, @$custom_params_ref], '&>', \my $stdout;
+
+    # check exit code and status
+    ($exit_code, $exit_status) = ($stdout =~ m/Exiting\swith\sreturn\svalue\s(\d+)\s\(([^:)]+)/);
+
+    $success = 0;
+    if (defined $exit_code && $exit_code == 0) {
+      $success = 1;
+    }
+
+    $update = $dbh->prepare("UPDATE imapsync SET returned_text = ?, success = ?, exit_status = ? WHERE id = ?");
+    $update->bind_param( 1, ${stdout} );
+    $update->bind_param( 2, ${success} );
+    $update->bind_param( 3, ${exit_status} );
+    $update->bind_param( 4, ${id} );
+    $update->execute();
+  } catch {
+    $update = $dbh->prepare("UPDATE imapsync SET returned_text = 'Could not start or finish imapsync', success = 0 WHERE id = ?");
+    $update->bind_param( 1, ${id} );
+    $update->execute();
+  } finally {
+    $update = $dbh->prepare("UPDATE imapsync SET last_run = NOW(), is_running = 0 WHERE id = ?");
+    $update->bind_param( 1, ${id} );
+    $update->execute();
+  };
+
+
+}
+
+$sth->finish();
+$dbh->disconnect();
+
+$lockmgr->unlock($lock_file);

data/Dockerfiles/dovecot/imapsync_runner.py

@@ -1,331 +0,0 @@
-#!/usr/bin/python3
-
-import fcntl
-import json
-import os
-import re
-import signal
-import subprocess
-import sys
-import tempfile
-import time
-import MySQLdb
-import MySQLdb.cursors
-
-run_dir = '/tmp'
-# Max size of imapsync output stored in returned_text (the tail holds the summary)
-max_output = 16 * 1024 * 1024
-lock_file = run_dir + '/imapsync_busy.lock'
-# An OAuth run needs a token valid this long at start (half the lifetime for short-lived tokens)
-token_min_valid = 900
-# Refreshed tokens are written to the token files of running jobs this often, imapsync re-reads them on reconnect
-token_sync_interval = 60
-
-# Next due job: higher prio first, never-run jobs first, then oldest run
-next_sql = """SELECT i.id, i.user1, i.user2, i.password1, i.exclude, i.delete2duplicates, i.maxage,
-  i.subfolder2, i.delete1, i.delete2, i.automap, i.skipcrossduplicates, i.maxbytespersecond, i.custom_params,
-  i.subscribeall, i.timeout1, i.timeout2, i.dry, i.source_id,
-  s.host1, s.port1, s.enc1, s.auth_type, s.oauth_flow
-    FROM imapsync i JOIN imapsync_source s ON i.source_id = s.id
-      WHERE i.active = 1
-        AND s.active = 1
-        AND i.is_running = 0
-        AND (UNIX_TIMESTAMP(NOW()) - UNIX_TIMESTAMP(i.last_run) > i.mins_interval * 60 OR i.last_run IS NULL)
-        {skip}
-  ORDER BY i.prio DESC, i.last_run IS NOT NULL, i.last_run ASC, i.id ASC
-  LIMIT 1"""
-# Atomic claim, a job is only started when this flips is_running 0 -> 1
-claim_sql = """UPDATE imapsync SET is_running = 1, success = NULL, exit_status = NULL
-  WHERE id = %s AND is_running = 0 AND active = 1"""
-# Access token: client_credentials share the source token, authorization_code use the token of
-# source + local mailbox (user2) + remote user (user1). issued/error describe the last refresh.
-source_token_sql = """SELECT oauth_access_token AS access_token, oauth_token_expires AS token_expires,
-  UNIX_TIMESTAMP(oauth_last_refresh_attempt) AS issued, oauth_last_refresh_error AS error
-  FROM imapsync_source WHERE id = %s"""
-user_token_sql = """SELECT access_token, token_expires, UNIX_TIMESTAMP(oauth_last_refresh_attempt) AS issued,
-  last_refresh_error AS error FROM imapsync_source_oauth_token
-  WHERE source_id = %s AND owner = %s AND username = %s"""
-
-conn = None
-# Popen => job of running workers
-running = {}
-# Jobs released without a run (token not ready), skipped for the rest of this runner round
-deferred = set()
-stopping = False
-
-def num(value):
-  try:
-    return int(value)
-  except (TypeError, ValueError):
-    return 0
-
-def unlink(files):
-  for path in files:
-    try:
-      os.unlink(path)
-    except OSError:
-      pass
-
-def imapsync_running():
-  for pid in filter(str.isdigit, os.listdir('/proc')):
-    try:
-      with open('/proc/' + pid + '/cmdline', 'rb') as f:
-        cmdline = f.read().replace(b'\0', b' ')
-    except OSError:
-      continue
-    if re.search(rb'imapsync\s', cmdline, re.I):
-      return True
-  return False
-
-def connect():
-  return MySQLdb.connect(unix_socket='/var/run/mysqld/mysqld.sock', user=os.environ['DBUSER'],
-    passwd=os.environ['DBPASS'], db=os.environ['DBNAME'], charset='utf8mb4', autocommit=True)
-
-# Reconnect when the server dropped the connection (syncs can outlast wait_timeout)
-def query(sql, args=None):
-  global conn
-  try:
-    conn.ping()
-  except MySQLdb.Error:
-    conn = connect()
-  cur = conn.cursor(MySQLdb.cursors.DictCursor)
-  cur.execute(sql, args)
-  return cur
-
-# Store a result and release the job
-def finish_job(job_id, text, success, exit_status):
-  try:
-    query("UPDATE imapsync SET returned_text = %s, success = %s, exit_status = %s, last_run = NOW(), is_running = 0 WHERE id = %s",
-      (text, success, exit_status, job_id))
-  except MySQLdb.Error:
-    query("UPDATE imapsync SET success = 0, last_run = NOW(), is_running = 0 WHERE id = %s", (job_id,))
-
-# Release a job without a run; last_run stays, so the next runner round retries it
-def defer_job(job_id, text, exit_status):
-  query("UPDATE imapsync SET returned_text = %s, success = 0, exit_status = %s, is_running = 0 WHERE id = %s",
-    (text, exit_status, job_id))
-  deferred.add(job_id)
-
-def oauth_token(j):
-  if j['oauth_flow'] == 'authorization_code':
-    return query(user_token_sql, (j['source_id'], j['user2'], j['user1'])).fetchone() or {}
-  return query(source_token_sql, (j['source_id'],)).fetchone() or {}
-
-# Valid for token_min_valid, or half the lifetime of a short-lived token (known when its last refresh succeeded)
-def token_ready(row):
-  token, expires, issued = row.get('access_token'), row.get('token_expires'), row.get('issued')
-  if not token or expires is None:
-    return False
-  need = token_min_valid
-  if issued and not row.get('error') and expires > int(issued):
-    need = min(need, (expires - int(issued)) // 2)
-  return expires - time.time() >= need
-
-# Write a refreshed token over the token file of a running job (atomic, same path)
-def sync_token_file(oauth):
-  token = oauth_token(oauth['job']).get('access_token')
-  if not token or token == oauth['token']:
-    return
-  fd, tmp = tempfile.mkstemp(prefix='imapsync.', dir=run_dir)
-  try:
-    with os.fdopen(fd, 'w', encoding='utf-8') as f:
-      f.write(token + '\n')
-    os.replace(tmp, oauth['file'])
-    oauth['token'] = token
-  except OSError:
-    unlink([tmp])
-
-# Max concurrent imapsync processes and global per-process bandwidth cap in bytes/s (0 = off),
-# re-read before every claim round so changes apply to long runs
-def read_settings():
-  settings = {r['name']: r['value'] for r in query("SELECT name, value FROM imapsync_settings")}
-  return max(num(settings.get('max_parallel')), 1), max(num(settings.get('max_bytes_per_second')), 0)
-
-# Build temp files and argv for a claimed job. Returns None when the job was finished without running imapsync.
-def prepare_job(j, global_bw, files):
-  def tmpfile(content):
-    fd, path = tempfile.mkstemp(prefix='imapsync.', dir=run_dir)
-    files.append(path)
-    with os.fdopen(fd, 'w', encoding='utf-8') as f:
-      f.write(content)
-    return path
-
-  auth_type = j['auth_type'] or 'PLAIN'
-  oauth = None
-  if auth_type == 'XOAUTH2':
-    row = oauth_token(j)
-    if not token_ready(row):
-      defer_job(j['id'], "OAuth access token for the configured source is missing or expires too soon; refresh cron will retry.",
-        'OAUTH_TOKEN_NOT_READY')
-      return None
-    oauth = {'job': j, 'token': row['access_token'], 'file': tmpfile(row['access_token'] + '\n')}
-    auth_args = ['--authmech1', 'XOAUTH2', '--oauthaccesstoken1', oauth['file']]
-  else:
-    auth_args = ['--passfile1', tmpfile(j['password1'] + '\n')]
-    # imapsync auto-picks PLAIN, only pass --authmech1 for LOGIN/CRAM-MD5
-    if auth_type != 'PLAIN':
-      auth_args += ['--authmech1', auth_type]
-
-  # Custom params: JSON array of {o,v}, validated by the backend on write. One argv token per pair,
-  # "--opt" or "--opt=value" (value glued to its option, no shell)
-  custom_params = []
-  try:
-    pairs = json.loads(j['custom_params'] or '[]')
-  except ValueError:
-    pairs = []
-  for p in pairs if isinstance(pairs, list) else []:
-    if not isinstance(p, dict) or not isinstance(p.get('o'), str) or not re.fullmatch(r'[a-z0-9]+', p['o']):
-      continue
-    value = '' if p.get('v') is None else str(p['v'])
-    custom_params.append('--' + p['o'] if value == '' else '--' + p['o'] + '=' + value)
-
-  # Effective per-process bandwidth cap (bytes/s): per-job value, capped by the global limit
-  eff_bw = num(j['maxbytespersecond'])
-  if global_bw > 0 and (eff_bw <= 0 or eff_bw > global_bw):
-    eff_bw = global_bw
-
-  # --nolog: the output is stored in returned_text, imapsync's own log dir would be the (read-only) cwd
-  cmd = ['/usr/local/bin/imapsync', '--tmpdir', '/tmp', '--nolog', '--nofoldersizes', '--addheader']
-  if num(j['timeout1']) > 0:
-    cmd += ['--timeout1', str(j['timeout1'])]
-  if num(j['timeout2']) > 0:
-    cmd += ['--timeout2', str(j['timeout2'])]
-  if j['exclude']:
-    cmd += ['--exclude', j['exclude']]
-  if j['subfolder2']:
-    cmd += ['--subfolder2', j['subfolder2']]
-  if num(j['maxage']) != 0:
-    cmd += ['--maxage', str(j['maxage'])]
-  if eff_bw > 0:
-    cmd += ['--maxbytespersecond', str(eff_bw)]
-  for col, opt in (('delete2duplicates', '--delete2duplicates'), ('subscribeall', '--subscribeall'),
-      ('delete1', '--delete1'), ('delete2', '--delete2'), ('automap', '--automap'),
-      ('skipcrossduplicates', '--skipcrossduplicates')):
-    if j[col] == 1:
-      cmd.append(opt)
-  enc1 = {'TLS': '--tls1', 'SSL': '--ssl1'}.get(j['enc1'])
-  if enc1:
-    cmd.append(enc1)
-  cmd += ['--host1', j['host1'], '--user1', j['user1']] + auth_args + ['--port1', str(j['port1'])]
-  cmd += ['--host2', 'localhost', '--user2', j['user2'] + '*' + master_user, '--passfile2', tmpfile(master_pass + '\n')]
-  if j['dry'] == 1:
-    cmd.append('--dry')
-  cmd += ['--no-modulesversion', '--noreleasecheck'] + custom_params
-
-  return {'id': j['id'], 'files': files, 'outfile': tmpfile(''), 'cmd': cmd, 'oauth': oauth}
-
-# Worker: imapsync with output to a file, no inherited fds (DB socket, lock)
-def start_job(job):
-  with open(job['outfile'], 'wb') as out:
-    return subprocess.Popen(job['cmd'], stdin=subprocess.DEVNULL, stdout=out, stderr=subprocess.STDOUT)
-
-# Store the result of a finished worker and remove its temp files
-def reap_job(job):
-  stdout = b''
-  try:
-    with open(job['outfile'], 'rb') as f:
-      size = os.fstat(f.fileno()).st_size
-      if size > max_output:
-        f.seek(size - max_output)
-        stdout = b'[output truncated, last %d bytes]\n' % max_output
-      stdout += f.read()
-  except OSError:
-    pass
-  unlink(job['files'])
-  text = stdout.decode('utf-8', 'replace')
-  # Last match: the echoed command line at the top may contain user controlled values
-  m = re.findall(r'Exiting\swith\sreturn\svalue\s(\d+)\s\(([^:)]+)', text)
-  exit_code, exit_status = m[-1] if m else (None, None)
-  if exit_code is None:
-    text = 'Could not start or finish imapsync\n' + text
-  finish_job(job['id'], text, 1 if exit_code is not None and int(exit_code) == 0 else 0, exit_status)
-
-# Stop claiming new jobs, pass the signal on to the running imapsync processes
-def stop(signum, frame):
-  global stopping
-  stopping = True
-  for proc in list(running):
-    proc.send_signal(signal.SIGTERM)
-
-# Released by the kernel when the process ends, a crashed run leaves no stale lock
-lock_fd = os.open(lock_file, os.O_RDWR | os.O_CREAT, 0o600)
-try:
-  fcntl.flock(lock_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
-except OSError:
-  sys.exit("can't lock " + lock_file)
-
-if imapsync_running():
-  print('imapsync is active, exiting...')
-  sys.exit(0)
-
-for sig in (signal.SIGINT, signal.SIGTERM, signal.SIGQUIT):
-  signal.signal(sig, stop)
-
-conn = connect()
-# Stale flags from crashed runs, safe only here: under the lock and with no imapsync running
-query("UPDATE imapsync SET is_running = 0")
-
-with open('/etc/sogo/sieve.creds') as f:
-  master_user, master_pass = [s.strip() for s in f.readline().split(':', 1)]
-
-# Worker pool: keep up to max_parallel workers busy, claim the next due job whenever a slot is free
-# (after every worker exit and at least every 10 seconds while workers run)
-last_token_sync = time.monotonic()
-try:
-  while True:
-    for proc, job in list(running.items()):
-      if proc.poll() is not None:
-        del running[proc]
-        reap_job(job)
-
-    if time.monotonic() - last_token_sync >= token_sync_interval:
-      last_token_sync = time.monotonic()
-      for job in running.values():
-        if job['oauth']:
-          try:
-            sync_token_file(job['oauth'])
-          except MySQLdb.Error as e:
-            print('imapsync job %d: %s' % (job['id'], e), file=sys.stderr)
-
-    max_parallel, global_bw = read_settings()
-    # Deferred and finished jobs drop out of next_sql, only failed claims are capped
-    failed_claims = 0
-    while not stopping and len(running) < max_parallel and failed_claims < 100:
-      skip = ('AND i.id NOT IN (%s)' % ', '.join(['%s'] * len(deferred))) if deferred else ''
-      j = query(next_sql.format(skip=skip), tuple(deferred) or None).fetchone()
-      if not j:
-        break
-      if query(claim_sql, (j['id'],)).rowcount != 1:
-        failed_claims += 1
-        continue
-
-      files = []
-      try:
-        job = prepare_job(j, global_bw, files)
-      except Exception as e:
-        print('imapsync job %d: %s' % (j['id'], e), file=sys.stderr)
-        finish_job(j['id'], 'Could not start or finish imapsync', 0, None)
-        job = None
-      if not job:
-        unlink(files)
-        continue
-      try:
-        running[start_job(job)] = job
-      except OSError as e:
-        # Release the claim, the job is picked up again later
-        print('imapsync job %d: %s' % (j['id'], e), file=sys.stderr)
-        unlink(files)
-        query("UPDATE imapsync SET is_running = 0 WHERE id = %s", (j['id'],))
-        break
-
-    if not running:
-      break
-    # A worker exit ends the wait early
-    for _ in range(50):
-      if any(proc.poll() is not None for proc in running):
-        break
-      time.sleep(0.2)
-finally:
-  # Never leave password/token files behind
-  for job in running.values():
-    unlink(job['files'])

data/Dockerfiles/dovecot/quarantine_notify.py

@@ -47,7 +47,7 @@ try:
   if max_score == "":
     max_score = 9999.0
 
-  def query_mysql(query, params = None, headers = True, update = False):
+  def query_mysql(query, headers = True, update = False):
     while True:
       try:
         cnx = MySQLdb.connect(user=os.environ.get('DBUSER'), password=os.environ.get('DBPASS'), database=os.environ.get('DBNAME'), charset="utf8mb4", collation="utf8mb4_general_ci")
@@ -57,10 +57,7 @@ try:
       else:
         break
     cur = cnx.cursor()
-    if params:
-      cur.execute(query, params)
-    else:
-      cur.execute(query)
+    cur.execute(query)
     if not update:
       result = []
       columns = tuple( [d[0] for d in cur.description] )
@@ -79,7 +76,7 @@ try:
 
   def notify_rcpt(rcpt, msg_count, quarantine_acl, category):
     if category == "add_header": category = "add header"
-    meta_query = query_mysql('SELECT `qhash`, id, subject, score, sender, created, action FROM quarantine WHERE notified = 0 AND rcpt = %s AND score < %s AND (action = %s OR "all" = %s)', (rcpt, max_score, category, category))
+    meta_query = query_mysql('SELECT `qhash`, id, subject, score, sender, created, action FROM quarantine WHERE notified = 0 AND rcpt = "%s" AND score < %f AND (action = "%s" OR "all" = "%s")' % (rcpt, max_score, category, category))
     print("%s: %d of %d messages qualify for notification" % (rcpt, len(meta_query), msg_count))
     if len(meta_query) == 0:
       return
@@ -133,7 +130,7 @@ try:
             server.sendmail(msg['From'], [str(redirect)] + [str(bcc)], text)
         server.quit()
         for res in meta_query:
-         query_mysql('UPDATE quarantine SET notified = 1 WHERE id = %s', (res['id'],), update = True)
+         query_mysql('UPDATE quarantine SET notified = 1 WHERE id = "%d"' % (res['id']), update = True)
         r.hset('Q_LAST_NOTIFIED', record['rcpt'], time_now)
         break
       except Exception as ex:
@@ -141,7 +138,7 @@ try:
         print('%s'  % (ex))
         time.sleep(3)
 
-  records = query_mysql('SELECT IFNULL(user_acl.quarantine, 0) AS quarantine_acl, count(id) AS counter, rcpt FROM quarantine LEFT OUTER JOIN user_acl ON user_acl.username = rcpt WHERE notified = 0 AND score < %s AND rcpt in (SELECT username FROM mailbox) GROUP BY rcpt', (max_score,))
+  records = query_mysql('SELECT IFNULL(user_acl.quarantine, 0) AS quarantine_acl, count(id) AS counter, rcpt FROM quarantine LEFT OUTER JOIN user_acl ON user_acl.username = rcpt WHERE notified = 0 AND score < %f AND rcpt in (SELECT username FROM mailbox) GROUP BY rcpt' % (max_score))
 
   for record in records:
     attrs = ''
@@ -159,7 +156,7 @@ try:
     except Exception as ex:
       print('Could not determine last notification for %s, assuming never' % (record['rcpt']))
       last_notification = 0
-    attrs_json = query_mysql('SELECT attributes FROM mailbox WHERE username = %s', (record['rcpt'],))
+    attrs_json = query_mysql('SELECT attributes FROM mailbox WHERE username = "%s"' % (record['rcpt']))
     attrs = attrs_json[0]['attributes']
     if isinstance(attrs, str):
       # if attr is str then just load it

data/Dockerfiles/netfilter/docker-entrypoint.sh

@@ -17,8 +17,8 @@ if [ $nftables_found -gt $iptables_found ]; then
 fi
 
 if [ $nftables_found -eq 0 ] && [ $nftables_found -eq $iptables_found ]; then
-  nftables_lines=$(nft list ruleset 2>/dev/null | wc -l)
-  iptables_lines=$(iptables-save 2>/dev/null | wc -l)
+  nftables_lines=$(nft list ruleset | wc -l)
+  iptables_lines=$(iptables-save | wc -l)
   if [ $nftables_lines -gt $iptables_lines ]; then
     backend=nftables
   else

data/Dockerfiles/netfilter/main.py

@@ -1,57 +1,548 @@
-#!/usr/bin/env python3
-
-import os
-import sys
-import time
-import signal
-import redis
-from modules.Logger import Logger
-from modules.Netfilter import Netfilter
-
-chain_name = "MAILCOW"
-
-def connect_redis(logger):
-  if os.getenv('REDIS_SLAVEOF_IP', ''):
-    host, port = os.getenv('REDIS_SLAVEOF_IP'), os.getenv('REDIS_SLAVEOF_PORT', '')
-  else:
-    host, port = os.getenv('IPV4_NETWORK', '172.22.1') + '.249', 6379
-  while True:
-    try:
-      # log lines are not always valid UTF-8
-      r = redis.StrictRedis(host=host, port=port, db=0, password=os.environ['REDISPASS'], decode_responses=True,
-                            encoding_errors='replace', socket_connect_timeout=5, socket_timeout=30)
-      r.ping()
-      return r
-    except Exception as ex:
-      logger.logWarn('Redis connection failed: %s - trying again in 3 seconds' % ex)
-      time.sleep(3)
-
-if __name__ == '__main__':
-  logger = Logger()
-
-  backend = sys.argv[1]
-  if backend == "nftables":
-    from modules.NFTables import NFTables
-    logger.logInfo('Using NFTables backend')
-    tables = NFTables(chain_name, logger)
-  else:
-    from modules.IPTables import IPTables
-    logger.logInfo('Using IPTables backend')
-    logger.logWarn(
-        "DEPRECATION: iptables-legacy is deprecated and will be removed in future releases. "
-        "Please switch to nftables on your host to ensure complete compatibility."
-    )
-    time.sleep(5)
-    tables = IPTables(chain_name, logger)
-
-  r = connect_redis(logger)
-  logger.set_redis(r)
-
-  netfilter = Netfilter(r, tables, logger, os.environ)
-  signal.signal(signal.SIGTERM, lambda signum, frame: netfilter.stop.set())
-  signal.signal(signal.SIGINT, lambda signum, frame: netfilter.stop.set())
-
-  netfilter.setup()
-  netfilter.run()
-  netfilter.shutdown()
-  sys.exit(0)
+#!/usr/bin/env python3
+
+DEBUG = False
+
+import re
+import os
+import sys
+import time
+import atexit
+import signal
+import ipaddress
+from collections import Counter
+from random import randint
+from threading import Thread
+from threading import Lock
+import redis
+import json
+import dns.resolver
+import dns.exception
+import uuid
+from modules.Logger import Logger
+from modules.IPTables import IPTables
+from modules.NFTables import NFTables
+
+def logdebug(msg):
+  if DEBUG:
+    logger.logInfo("DEBUG: %s" % msg)
+
+# Globals
+WHITELIST = []
+BLACKLIST = []
+bans = {}
+quit_now = False
+exit_code = 0
+lock = Lock()
+chain_name = "MAILCOW"
+r = None
+pubsub = None
+clear_before_quit = False
+
+def refreshF2boptions():
+  global f2boptions
+  global quit_now
+  global exit_code
+  f2boptions = {}
+
+  if not r.get('F2B_OPTIONS'):
+    f2boptions['ban_time'] = r.get('F2B_BAN_TIME')
+    f2boptions['max_ban_time'] = r.get('F2B_MAX_BAN_TIME')
+    f2boptions['ban_time_increment'] = r.get('F2B_BAN_TIME_INCREMENT')
+    f2boptions['max_attempts'] = r.get('F2B_MAX_ATTEMPTS')
+    f2boptions['retry_window'] = r.get('F2B_RETRY_WINDOW')
+    f2boptions['netban_ipv4'] = r.get('F2B_NETBAN_IPV4')
+    f2boptions['netban_ipv6'] = r.get('F2B_NETBAN_IPV6')
+  else:
+    try:
+      f2boptions = json.loads(r.get('F2B_OPTIONS'))
+    except ValueError as e:
+      logger.logCrit(
+        'Error loading F2B options: F2B_OPTIONS is not json. Exception: %s' % e)
+      quit_now = True
+      exit_code = 2
+
+  verifyF2boptions(f2boptions)
+  r.set('F2B_OPTIONS', json.dumps(f2boptions, ensure_ascii=False))
+
+def verifyF2boptions(f2boptions):
+  verifyF2boption(f2boptions, 'ban_time', 1800)
+  verifyF2boption(f2boptions, 'max_ban_time', 10000)
+  verifyF2boption(f2boptions, 'ban_time_increment', True)
+  verifyF2boption(f2boptions, 'max_attempts', 10)
+  verifyF2boption(f2boptions, 'retry_window', 600)
+  verifyF2boption(f2boptions, 'netban_ipv4', 32)
+  verifyF2boption(f2boptions, 'netban_ipv6', 128)
+  verifyF2boption(f2boptions, 'banlist_id', str(uuid.uuid4()))
+  verifyF2boption(f2boptions, 'manage_external', 0)
+
+def verifyF2boption(f2boptions, f2boption, f2bdefault):
+  f2boptions[f2boption] = f2boptions[f2boption] if f2boption in f2boptions and f2boptions[f2boption] is not None else f2bdefault
+
+def refreshF2bregex():
+  global f2bregex
+  global quit_now
+  global exit_code
+  if not r.get('F2B_REGEX'):
+    f2bregex = {}
+    f2bregex[1] = r'mailcow UI: Invalid password for .+ by ([0-9a-f\.:]+)'
+    f2bregex[2] = r'Rspamd UI: Invalid password by ([0-9a-f\.:]+)'
+    f2bregex[3] = r'warning: .*\[([0-9a-f\.:]+)\]: SASL .+ authentication failed: (?!.*Connection lost to authentication server).+'
+    f2bregex[4] = r'warning: non-SMTP command from .*\[([0-9a-f\.:]+)]:.+'
+    f2bregex[5] = r'NOQUEUE: reject: RCPT from \[([0-9a-f\.:]+)].+Protocol error.+'
+    f2bregex[6] = r'\w+\([^,]+,([0-9a-f\.:]+),<[^>]+>\): Password mismatch \(SHA1 of given password: [a-f0-9]+\)'
+    f2bregex[7] = r'\w+\([^,]+,([0-9a-f\.:]+),<[^>]+>\): unknown user \(SHA1 of given password: [a-f0-9]+\)'
+    f2bregex[8] = r'SOGo.+ Login from \'([0-9a-f\.:]+)\' for user .+ might not have worked'
+    f2bregex[9] = r'([0-9a-f\.:]+) \"GET \/SOGo\/.* HTTP.+\" 403 .+'
+    r.set('F2B_REGEX', json.dumps(f2bregex, ensure_ascii=False))
+  else:
+    try:
+      f2bregex = {}
+      f2bregex = json.loads(r.get('F2B_REGEX'))
+    except ValueError:
+      logger.logCrit('Error loading F2B options: F2B_REGEX is not json')
+      quit_now = True
+      exit_code = 2
+
+def get_ip(address):
+  ip = ipaddress.ip_address(address)
+  if type(ip) is ipaddress.IPv6Address and ip.ipv4_mapped:
+    ip = ip.ipv4_mapped
+  if ip.is_private or ip.is_loopback:
+    return False
+
+  return ip
+
+def ban(address):
+  global f2boptions
+  global lock
+  logdebug("ban() called with address=%s" % address)
+  refreshF2boptions()
+  MAX_ATTEMPTS = int(f2boptions['max_attempts'])
+  RETRY_WINDOW = int(f2boptions['retry_window'])
+  NETBAN_IPV4 = '/' + str(f2boptions['netban_ipv4'])
+  NETBAN_IPV6 = '/' + str(f2boptions['netban_ipv6'])
+
+  ip = get_ip(address)
+  if not ip:
+    logdebug("No valid IP -- skipping ban()")
+    return
+  address = str(ip)
+  self_network = ipaddress.ip_network(address)
+
+  with lock:
+    temp_whitelist = set(WHITELIST)
+    logdebug("Checking if %s overlaps with any WHITELIST entries" % self_network)
+    if temp_whitelist:
+      for wl_key in temp_whitelist:
+        wl_net = ipaddress.ip_network(wl_key, False)
+        logdebug("Checking overlap between %s and %s" % (self_network, wl_net))
+        if wl_net.overlaps(self_network):
+          logger.logInfo(
+            'Address %s is allowlisted by rule %s' % (self_network, wl_net))
+          return
+
+  net = ipaddress.ip_network(
+    (address + (NETBAN_IPV4 if type(ip) is ipaddress.IPv4Address else NETBAN_IPV6)), strict=False)
+  net = str(net)
+  logdebug("Ban net: %s" % net)
+
+  if not net in bans:
+    bans[net] = {'attempts': 0, 'last_attempt': 0, 'ban_counter': 0}
+    logdebug("Initing new ban counter for %s" % net)
+
+  current_attempt = time.time()
+  logdebug("Current attempt ts=%s, previous: %s, retry_window: %s" %
+           (current_attempt, bans[net]['last_attempt'], RETRY_WINDOW))
+  if current_attempt - bans[net]['last_attempt'] > RETRY_WINDOW:
+    bans[net]['attempts'] = 0
+    logdebug("Ban counter for %s reset as window expired" % net)
+
+  bans[net]['attempts'] += 1
+  bans[net]['last_attempt'] = current_attempt
+  logdebug("%s attempts now %d" % (net, bans[net]['attempts']))
+
+  if bans[net]['attempts'] >= MAX_ATTEMPTS:
+    cur_time = int(round(time.time()))
+    NET_BAN_TIME = calcNetBanTime(bans[net]['ban_counter'])
+    logger.logCrit('Banning %s for %d minutes' % (net, NET_BAN_TIME / 60 ))
+    if type(ip) is ipaddress.IPv4Address and int(f2boptions['manage_external']) != 1:
+      with lock:
+        logdebug("Calling tables.banIPv4(%s)" % net)
+        tables.banIPv4(net)
+    elif int(f2boptions['manage_external']) != 1:
+      with lock:
+        logdebug("Calling tables.banIPv6(%s)" % net)
+        tables.banIPv6(net)
+
+    logdebug("Updating F2B_ACTIVE_BANS[%s]=%d" %
+              (net, cur_time + NET_BAN_TIME))
+    r.hset('F2B_ACTIVE_BANS', '%s' % net, cur_time + NET_BAN_TIME)
+  else:
+    logger.logWarn('%d more attempts in the next %d seconds until %s is banned' % (
+      MAX_ATTEMPTS - bans[net]['attempts'], RETRY_WINDOW, net))
+
+def unban(net):
+  global lock
+  logdebug("Calling unban() with net=%s" % net)
+  if not net in bans:
+    logger.logInfo(
+      '%s is not banned, skipping unban and deleting from queue (if any)' % net)
+    r.hdel('F2B_QUEUE_UNBAN', '%s' % net)
+    return
+  logger.logInfo('Unbanning %s' % net)
+  if type(ipaddress.ip_network(net)) is ipaddress.IPv4Network:
+    with lock:
+      logdebug("Calling tables.unbanIPv4(%s)" % net)
+      tables.unbanIPv4(net)
+  else:
+    with lock:
+      logdebug("Calling tables.unbanIPv6(%s)" % net)
+      tables.unbanIPv6(net)
+  r.hdel('F2B_ACTIVE_BANS', '%s' % net)
+  r.hdel('F2B_QUEUE_UNBAN', '%s' % net)
+  if net in bans:
+    logdebug("Unban for %s, setting attempts=0, ban_counter+=1" % net)
+    bans[net]['attempts'] = 0
+    bans[net]['ban_counter'] += 1
+
+def permBan(net, unban=False):
+  global f2boptions
+  global lock
+
+  is_unbanned = False
+  is_banned = False
+  if type(ipaddress.ip_network(net, strict=False)) is ipaddress.IPv4Network:
+    with lock:
+      if unban:
+        is_unbanned = tables.unbanIPv4(net)
+      elif int(f2boptions['manage_external']) != 1:
+        is_banned = tables.banIPv4(net)
+  else:
+    with lock:
+      if unban:
+        is_unbanned = tables.unbanIPv6(net)
+      elif int(f2boptions['manage_external']) != 1:
+        is_banned = tables.banIPv6(net)
+
+
+  if is_unbanned:
+    r.hdel('F2B_PERM_BANS', '%s' % net)
+    logger.logCrit('Removed host/network %s from denylist' % net)
+  elif is_banned:
+    r.hset('F2B_PERM_BANS', '%s' % net, int(round(time.time())))
+    logger.logCrit('Added host/network %s to denylist' % net)
+
+def clear():
+  global lock
+  logger.logInfo('Clearing all bans')
+  for net in bans.copy():
+    logdebug("Unbanning net: %s" % net)
+    unban(net)
+  with lock:
+    logdebug("Clearing IPv4/IPv6 table")
+    tables.clearIPv4Table()
+    tables.clearIPv6Table()
+    try:
+      if r is not None:
+        r.delete('F2B_ACTIVE_BANS')
+        r.delete('F2B_PERM_BANS')
+    except Exception as ex:
+      logger.logWarn('Error clearing redis keys F2B_ACTIVE_BANS and F2B_PERM_BANS: %s' % ex)
+
+def watch():
+  global pubsub
+  global quit_now
+  global exit_code
+
+  logger.logInfo('Watching Redis channel F2B_CHANNEL')
+  pubsub.subscribe('F2B_CHANNEL')
+
+  while not quit_now:
+    try:
+      for item in pubsub.listen():
+        refreshF2bregex()
+        for rule_id, rule_regex in f2bregex.items():
+          if item['data'] and item['type'] == 'message':
+            try:
+              result = re.search(rule_regex, item['data'])
+            except re.error:
+              result = False
+            if result:
+              addr = result.group(1)
+              ip = ipaddress.ip_address(addr)
+              if ip.is_private or ip.is_loopback:
+                continue
+              logger.logWarn('%s matched rule id %s (%s)' % (addr, rule_id, item['data']))
+              ban(addr)
+    except Exception as ex:
+      logger.logWarn('Error reading log line from pubsub: %s' % ex)
+      pubsub = None
+      quit_now = True
+      exit_code = 2
+
+def snat4(snat_target):
+  global lock
+  global quit_now
+
+  while not quit_now:
+    time.sleep(10)
+    with lock:
+      tables.snat4(snat_target, os.getenv('IPV4_NETWORK', '172.22.1') + '.0/24')
+
+def snat6(snat_target):
+  global lock
+  global quit_now
+
+  while not quit_now:
+    time.sleep(10)
+    with lock:
+      tables.snat6(snat_target, os.getenv('IPV6_NETWORK', 'fd4d:6169:6c63:6f77::/64'))
+
+def autopurge():
+  global f2boptions
+  logdebug("autopurge thread started")
+  while not quit_now:
+    logdebug("autopurge tick")
+    time.sleep(10)
+    refreshF2boptions()
+    MAX_ATTEMPTS = int(f2boptions['max_attempts'])
+    QUEUE_UNBAN = r.hgetall('F2B_QUEUE_UNBAN')
+    logdebug("QUEUE_UNBAN: %s" % QUEUE_UNBAN)
+    if QUEUE_UNBAN:
+      for net in QUEUE_UNBAN:
+        logdebug("Autopurge: unbanning queued net: %s" % net)
+        unban(str(net))
+    # Only check expiry for actively banned IPs:
+    active_bans = r.hgetall('F2B_ACTIVE_BANS')
+    now = time.time()
+    for net_str, expire_str in active_bans.items():
+      logdebug("Checking ban expiry for (actively banned): %s" % net_str)
+      # Defensive: always process if timer missing or expired
+      try:
+        expire = float(expire_str)
+      except Exception:
+        logdebug("Invalid expire time for %s; unbanning" % net_str)
+        unban(net_str)
+        continue
+      time_left = expire - now
+      logdebug("Time left for %s: %.1f seconds" % (net_str, time_left))
+      if time_left <= 0:
+        logdebug("Ban expired for %s" % net_str)
+        unban(net_str)
+
+def mailcowChainOrder():
+  global lock
+  global quit_now
+  global exit_code
+  while not quit_now:
+    time.sleep(10)
+    with lock:
+      quit_now, exit_code = tables.checkIPv4ChainOrder()
+      if quit_now: return
+      quit_now, exit_code = tables.checkIPv6ChainOrder()
+
+def calcNetBanTime(ban_counter):
+  global f2boptions
+
+  BAN_TIME = int(f2boptions['ban_time'])
+  MAX_BAN_TIME = int(f2boptions['max_ban_time'])
+  BAN_TIME_INCREMENT = bool(f2boptions['ban_time_increment'])
+  NET_BAN_TIME = BAN_TIME if not BAN_TIME_INCREMENT else BAN_TIME * 2 ** ban_counter
+  NET_BAN_TIME = max([BAN_TIME, min([NET_BAN_TIME, MAX_BAN_TIME])])
+  return NET_BAN_TIME
+
+def isIpNetwork(address):
+  try:
+    ipaddress.ip_network(address, False)
+  except ValueError:
+    return False
+  return True
+
+def genNetworkList(list):
+  resolver = dns.resolver.Resolver()
+  hostnames = []
+  networks = []
+  for key in list:
+    if isIpNetwork(key):
+      networks.append(key)
+    else:
+      hostnames.append(key)
+  for hostname in hostnames:
+    hostname_ips = []
+    for rdtype in ['A', 'AAAA']:
+      try:
+        answer = resolver.resolve(qname=hostname, rdtype=rdtype, lifetime=3)
+      except dns.exception.Timeout:
+        logger.logInfo('Hostname %s timedout on resolve' % hostname)
+        break
+      except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
+        continue
+      except dns.exception.DNSException as dnsexception:
+        logger.logInfo('%s' % dnsexception)
+        continue
+      for rdata in answer:
+        hostname_ips.append(rdata.to_text())
+    networks.extend(hostname_ips)
+  return set(networks)
+
+def whitelistUpdate():
+  global lock
+  global quit_now
+  global WHITELIST
+  while not quit_now:
+    start_time = time.time()
+    list = r.hgetall('F2B_WHITELIST')
+    new_whitelist = []
+    if list:
+      new_whitelist = genNetworkList(list)
+    with lock:
+      if Counter(new_whitelist) != Counter(WHITELIST):
+        WHITELIST = new_whitelist
+        logger.logInfo('Allowlist was changed, it has %s entries' % len(WHITELIST))
+    time.sleep(60.0 - ((time.time() - start_time) % 60.0))
+
+def blacklistUpdate():
+  global quit_now
+  global BLACKLIST
+  while not quit_now:
+    start_time = time.time()
+    list = r.hgetall('F2B_BLACKLIST')
+    new_blacklist = []
+    if list:
+      new_blacklist = genNetworkList(list)
+    if Counter(new_blacklist) != Counter(BLACKLIST):
+      addban = set(new_blacklist).difference(BLACKLIST)
+      delban = set(BLACKLIST).difference(new_blacklist)
+      BLACKLIST = new_blacklist
+      logger.logInfo('Denylist was changed, it has %s entries' % len(BLACKLIST))
+      if addban:
+        for net in addban:
+          permBan(net=net)
+      if delban:
+        for net in delban:
+          permBan(net=net, unban=True)
+    time.sleep(60.0 - ((time.time() - start_time) % 60.0))
+
+def sigterm_quit(signum, frame):
+  global clear_before_quit
+  logdebug("SIGTERM received, setting clear_before_quit to True and exiting")
+  clear_before_quit = True
+  sys.exit(exit_code)
+
+def before_quit():
+  logdebug("before_quit called, clear_before_quit=%s" % clear_before_quit)
+  if clear_before_quit:
+    clear()
+  if pubsub is not None:
+    pubsub.unsubscribe()
+
+if __name__ == '__main__':
+  logger = Logger()
+  logdebug("Sys.argv: %s" % sys.argv)
+  atexit.register(before_quit)
+  signal.signal(signal.SIGTERM, sigterm_quit)
+
+  backend = sys.argv[1]
+  logdebug("Backend: %s" % backend)
+  if backend == "nftables":
+    logger.logInfo('Using NFTables backend')
+    tables = NFTables(chain_name, logger)
+  else:
+    logger.logInfo('Using IPTables backend')
+    logger.logWarn(
+        "DEPRECATION: iptables-legacy is deprecated and will be removed in future releases. "
+        "Please switch to nftables on your host to ensure complete compatibility."
+    )
+    time.sleep(5)
+    tables = IPTables(chain_name, logger)
+
+  clear()
+  logger.logInfo("Initializing mailcow netfilter chain")
+  tables.initChainIPv4()
+  tables.initChainIPv6()
+
+  if os.getenv("DISABLE_NETFILTER_ISOLATION_RULE", "").lower() in ("y", "yes"):
+    logger.logInfo(f"Skipping {chain_name} isolation")
+  else:
+    logger.logInfo(f"Setting {chain_name} isolation")
+    tables.create_mailcow_isolation_rule("br-mailcow", [3306, 6379, 8983, 12345], os.getenv("MAILCOW_REPLICA_IP"))
+
+  # connect to redis
+  while True:
+    try:
+      redis_slaveof_ip = os.getenv('REDIS_SLAVEOF_IP', '')
+      redis_slaveof_port = os.getenv('REDIS_SLAVEOF_PORT', '')
+      logdebug(
+        "Connecting redis (SLAVEOF_IP:%s, PORT:%s)" % (redis_slaveof_ip, redis_slaveof_port))
+      if "".__eq__(redis_slaveof_ip):
+        r = redis.StrictRedis(
+          host=os.getenv('IPV4_NETWORK', '172.22.1') + '.249', decode_responses=True, port=6379, db=0, password=os.environ['REDISPASS'])
+      else:
+        r = redis.StrictRedis(
+          host=redis_slaveof_ip, decode_responses=True, port=redis_slaveof_port, db=0, password=os.environ['REDISPASS'])
+      r.ping()
+      pubsub = r.pubsub()
+    except Exception as ex:
+      logdebug(
+        'Redis connection failed: %s - trying again in 3 seconds' % (ex))
+      time.sleep(3)
+    else:
+      break
+  logger.set_redis(r)
+  logdebug("Redis connection established, setting up F2B keys")
+
+  if r.exists('F2B_LOG'):
+    logdebug("Renaming F2B_LOG to NETFILTER_LOG")
+    r.rename('F2B_LOG', 'NETFILTER_LOG')
+  r.delete('F2B_ACTIVE_BANS')
+  r.delete('F2B_PERM_BANS')
+
+  refreshF2boptions()
+
+  watch_thread = Thread(target=watch)
+  watch_thread.daemon = True
+  watch_thread.start()
+
+  if os.getenv('SNAT_TO_SOURCE') and os.getenv('SNAT_TO_SOURCE') != 'n':
+    try:
+      snat_ip = os.getenv('SNAT_TO_SOURCE')
+      snat_ipo = ipaddress.ip_address(snat_ip)
+      if type(snat_ipo) is ipaddress.IPv4Address:
+        snat4_thread = Thread(target=snat4, args=(snat_ip,))
+        snat4_thread.daemon = True
+        snat4_thread.start()
+    except ValueError:
+      print(os.getenv('SNAT_TO_SOURCE') + ' is not a valid IPv4 address')
+
+  if os.getenv('SNAT6_TO_SOURCE') and os.getenv('SNAT6_TO_SOURCE') != 'n':
+    try:
+      snat_ip = os.getenv('SNAT6_TO_SOURCE')
+      snat_ipo = ipaddress.ip_address(snat_ip)
+      if type(snat_ipo) is ipaddress.IPv6Address:
+        snat6_thread = Thread(target=snat6,args=(snat_ip,))
+        snat6_thread.daemon = True
+        snat6_thread.start()
+    except ValueError:
+      print(os.getenv('SNAT6_TO_SOURCE') + ' is not a valid IPv6 address')
+
+  autopurge_thread = Thread(target=autopurge)
+  autopurge_thread.daemon = True
+  autopurge_thread.start()
+
+  mailcowchainwatch_thread = Thread(target=mailcowChainOrder)
+  mailcowchainwatch_thread.daemon = True
+  mailcowchainwatch_thread.start()
+
+  blacklistupdate_thread = Thread(target=blacklistUpdate)
+  blacklistupdate_thread.daemon = True
+  blacklistupdate_thread.start()
+
+  whitelistupdate_thread = Thread(target=whitelistUpdate)
+  whitelistupdate_thread.daemon = True
+  whitelistupdate_thread.start()
+
+  while not quit_now:
+    time.sleep(0.5)
+
+  logdebug("Exiting with code %s" % exit_code)
+  sys.exit(exit_code)

data/Dockerfiles/netfilter/modules/BanManager.py

@@ -1,236 +0,0 @@
-import ipaddress
-import time
-
-
-class BanManager:
-  """Failed attempts and automatic bans (Redis F2B_ACTIVE_BANS: network => expiry), the denylist (F2B_PERM_BANS)
-  and the allowlist. Every firewall change runs under lock, which also guards the other firewall work of netfilter
-  (chains, SNAT), because the backends must not run in parallel."""
-
-  # Seconds failed logins of an address are not counted after the auth backend was unavailable for it
-  EXCUSE_TIME = 60
-
-  def __init__(self, r, tables, options, logger, lock, clock=time.time):
-    self.r = r
-    self.tables = tables
-    self.options = options
-    self.logger = logger
-    self.lock = lock
-    self.clock = clock
-    self.counters = {}
-    self.banned = set()
-    self.denied = {}
-    self.allowlist = []
-    self.excused = {}
-
-  def excuse(self, ip):
-    """The auth backend could not check a login of ip: its failed logins are not counted for EXCUSE_TIME"""
-    with self.lock:
-      now = self.clock()
-      if self.excused.get(ip, 0) <= now:
-        self.logger.logWarn('Auth backend unavailable for %s, its failed logins of the next %d seconds are not counted' % (
-          ip, self.EXCUSE_TIME))
-      self.excused[ip] = now + self.EXCUSE_TIME
-
-  def attempt(self, ip):
-    """Counts a failed attempt of ip and bans its network after max_attempts within retry_window"""
-    options = self.options.values
-    prefix = options['netban_ipv4'] if ip.version == 4 else options['netban_ipv6']
-    net = str(ipaddress.ip_network('%s/%d' % (ip, prefix), strict=False))
-    with self.lock:
-      now = self.clock()
-      allowed = self.allowed_by(ip)
-      if allowed is not None:
-        self.logger.logInfo('Address %s is allowlisted by rule %s' % (ip, allowed))
-        return
-      if self.excused.get(ip, 0) > now:
-        self.logger.logInfo('Not counting the failed login of %s, the auth backend was unavailable' % ip)
-        return
-      if net in self.banned:
-        # log lines of connections from before the ban
-        return
-      counter = self.counter(net)
-      if now - counter['last_attempt'] > options['retry_window']:
-        counter['attempts'] = 0
-      counter['attempts'] += 1
-      counter['last_attempt'] = now
-      if counter['attempts'] < options['max_attempts']:
-        self.logger.logWarn('%d more attempts in the next %d seconds until %s is banned' % (
-          options['max_attempts'] - counter['attempts'], options['retry_window'], net))
-        return
-
-      ban_time = self.options.ban_time(counter['ban_counter'])
-      self.logger.logCrit('Banning %s for %d minutes' % (net, ban_time / 60))
-      # Redis first: a firewall rule without expiry would never be lifted
-      self.r.hset('F2B_ACTIVE_BANS', net, int(round(now + ban_time)))
-      self.banned.add(net)
-      if options['manage_external'] != 1:
-        self.apply([net])
-
-  def unban(self, net):
-    """Lifts the automatic ban of a network; the rule stays while the denylist bans the same network"""
-    with self.lock:
-      normalized = self.normalize(net)
-      if normalized is None:
-        self.logger.logWarn('Removing invalid network %s from the active bans' % net)
-      else:
-        self.logger.logInfo('Unbanning %s' % net)
-        if normalized not in self.denied:
-          self.remove([normalized])
-      self.r.hdel('F2B_ACTIVE_BANS', net)
-      self.r.hdel('F2B_QUEUE_UNBAN', net)
-      if net in self.banned:
-        self.banned.discard(net)
-        counter = self.counter(net)
-        counter['attempts'] = 0
-        counter['ban_counter'] += 1
-
-  def unban_queued(self, entry):
-    """Unban request of the UI: a banned network, or a network that contains banned ones (allowlisting)"""
-    network = self.network(entry)
-    if network is None:
-      self.logger.logWarn('Removing invalid network %s from the unban queue' % entry)
-      self.r.hdel('F2B_QUEUE_UNBAN', entry)
-      return
-    with self.lock:
-      banned = set(self.r.hkeys('F2B_ACTIVE_BANS')) | self.banned
-      targets = [net for net in banned if self.overlaps(net, network)]
-      for net in targets:
-        self.unban(net)
-      if not targets and str(network) not in self.denied:
-        # a rule without known ban, e.g. left by an older netfilter
-        if self.remove([str(network)]):
-          self.logger.logInfo('Unbanning %s' % network)
-        else:
-          self.logger.logInfo('%s is not banned, removing it from the unban queue' % network)
-      self.r.hdel('F2B_QUEUE_UNBAN', entry)
-
-  def purge(self):
-    """Processes the unban queue of the UI and lifts expired bans"""
-    for entry in self.r.hkeys('F2B_QUEUE_UNBAN'):
-      self.unban_queued(entry)
-    now = self.clock()
-    for net, expires in self.r.hgetall('F2B_ACTIVE_BANS').items():
-      try:
-        expired = self.network(net) is None or float(expires) <= now
-      except (TypeError, ValueError):
-        expired = True
-      if expired:
-        self.unban(net)
-    with self.lock:
-      # bans whose Redis entry is gone, e.g. deleted by hand
-      for net in self.banned - set(self.r.hkeys('F2B_ACTIVE_BANS')):
-        self.unban(net)
-    self.forget_idle(now)
-
-  def restore(self):
-    """Applies the unexpired automatic bans of Redis again after a start of netfilter and drops the expired ones"""
-    now = self.clock()
-    restored = []
-    with self.lock:
-      for net, expires in self.r.hgetall('F2B_ACTIVE_BANS').items():
-        try:
-          valid = self.network(net) is not None and float(expires) > now
-        except (TypeError, ValueError):
-          valid = False
-        if not valid:
-          self.r.hdel('F2B_ACTIVE_BANS', net)
-          continue
-        self.banned.add(net)
-        self.counter(net)
-        restored.append(net)
-      if restored and self.options.values['manage_external'] != 1:
-        self.apply(restored)
-    if restored:
-      self.logger.logInfo('Restored %d active bans' % len(restored))
-
-  def reapply(self):
-    """Applies all bans again, e.g. after the MAILCOW chain had to be recreated"""
-    with self.lock:
-      if self.options.values['manage_external'] != 1:
-        self.apply(list(self.banned) + list(self.denied))
-
-  def set_denylist(self, entries):
-    """Bans the networks of the denylist permanently and lifts the bans of removed entries"""
-    networks = {}
-    for entry in entries:
-      net = self.normalize(entry)
-      if net is None:
-        self.logger.logWarn('Skipping invalid denylist entry %s' % entry)
-        continue
-      networks[net] = entry
-    with self.lock:
-      if networks.keys() == self.denied.keys():
-        return
-      self.logger.logInfo('Denylist was changed, it has %d entries' % len(networks))
-      added = [net for net in networks if net not in self.denied]
-      removed = [net for net in self.denied if net not in networks]
-      if added and self.options.values['manage_external'] != 1:
-        self.apply(added)
-      for net in added:
-        self.r.hset('F2B_PERM_BANS', networks[net], int(round(self.clock())))
-        self.logger.logCrit('Added host/network %s to denylist' % networks[net])
-      # an automatic ban of the same network keeps its rule
-      auto_banned = {self.normalize(net) for net in self.banned}
-      self.remove([net for net in removed if net not in auto_banned])
-      for net in removed:
-        self.r.hdel('F2B_PERM_BANS', self.denied[net])
-        self.logger.logCrit('Removed host/network %s from denylist' % self.denied[net])
-      self.denied = networks
-
-  def set_allowlist(self, entries):
-    networks = []
-    for entry in entries:
-      network = self.network(entry)
-      if network is None:
-        self.logger.logWarn('Skipping invalid allowlist entry %s' % entry)
-        continue
-      networks.append(network)
-    with self.lock:
-      if set(networks) != set(self.allowlist):
-        self.allowlist = networks
-        self.logger.logInfo('Allowlist was changed, it has %d entries' % len(networks))
-
-  def allowed_by(self, ip):
-    address = ipaddress.ip_network(ip)
-    for network in self.allowlist:
-      if network.version == address.version and network.overlaps(address):
-        return network
-    return None
-
-  def counter(self, net):
-    return self.counters.setdefault(net, {'attempts': 0, 'last_attempt': 0.0, 'ban_counter': 0})
-
-  def forget_idle(self, now):
-    """Drops counters of networks that were never banned and had no attempt within the retry window"""
-    window = self.options.values['retry_window']
-    with self.lock:
-      for net in [net for net, counter in self.counters.items()
-                  if net not in self.banned and counter['ban_counter'] == 0 and now - counter['last_attempt'] > window]:
-        del self.counters[net]
-      for ip in [ip for ip, until in self.excused.items() if until <= now]:
-        del self.excused[ip]
-
-  def apply(self, nets):
-    for net in self.tables.ban(nets):
-      self.logger.logWarn('Could not add the firewall rule for %s' % net)
-
-  def remove(self, nets):
-    return self.tables.unban(nets) if nets else []
-
-  @staticmethod
-  def network(entry):
-    try:
-      return ipaddress.ip_network(entry, strict=False)
-    except (TypeError, ValueError):
-      return None
-
-  @classmethod
-  def normalize(cls, entry):
-    network = cls.network(entry)
-    return str(network) if network is not None else None
-
-  @classmethod
-  def overlaps(cls, net, network):
-    other = cls.network(net)
-    return other is not None and other.version == network.version and other.overlaps(network)

data/Dockerfiles/netfilter/modules/IPTables.py

@@ -1,7 +1,6 @@
 import iptc
 import time
-import ipaddress
-import contextlib
+import os
 
 class IPTables:
   def __init__(self, chain_name, logger):
@@ -9,10 +8,62 @@ class IPTables:
     self.logger = logger
 
   def initChainIPv4(self):
-    self.init_chain(iptc.Table(iptc.Table.FILTER))
+    if not iptc.Chain(iptc.Table(iptc.Table.FILTER), self.chain_name) in iptc.Table(iptc.Table.FILTER).chains:
+      iptc.Table(iptc.Table.FILTER).create_chain(self.chain_name)
+    for c in ['FORWARD', 'INPUT']:
+      chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), c)
+      rule = iptc.Rule()
+      rule.src = '0.0.0.0/0'
+      rule.dst = '0.0.0.0/0'
+      target = iptc.Target(rule, self.chain_name)
+      rule.target = target
+      if rule not in chain.rules:
+        chain.insert_rule(rule)
 
   def initChainIPv6(self):
-    self.init_chain(iptc.Table6(iptc.Table6.FILTER))
+    if not iptc.Chain(iptc.Table6(iptc.Table6.FILTER), self.chain_name) in iptc.Table6(iptc.Table6.FILTER).chains:
+      iptc.Table6(iptc.Table6.FILTER).create_chain(self.chain_name)
+    for c in ['FORWARD', 'INPUT']:
+      chain = iptc.Chain(iptc.Table6(iptc.Table6.FILTER), c)
+      rule = iptc.Rule6()
+      rule.src = '::/0'
+      rule.dst = '::/0'
+      target = iptc.Target(rule, self.chain_name)
+      rule.target = target
+      if rule not in chain.rules:
+        chain.insert_rule(rule)
+
+  def checkIPv4ChainOrder(self):
+    filter_table = iptc.Table(iptc.Table.FILTER)
+    filter_table.refresh()
+    return self.checkChainOrder(filter_table)
+
+  def checkIPv6ChainOrder(self):
+    filter_table = iptc.Table6(iptc.Table6.FILTER)
+    filter_table.refresh()
+    return self.checkChainOrder(filter_table)
+
+  def checkChainOrder(self, filter_table):
+    err = False
+    exit_code = None
+
+    forward_chain = iptc.Chain(filter_table, 'FORWARD')
+    input_chain = iptc.Chain(filter_table, 'INPUT')
+    for chain in [forward_chain, input_chain]:
+      target_found = False
+      for position, item in enumerate(chain.rules):
+        if item.target.name == self.chain_name:
+          target_found = True
+          if position > 2:
+            self.logger.logCrit('Error in %s chain: %s target not found, restarting container' % (chain.name, self.chain_name))
+            err = True
+            exit_code = 2
+      if not target_found:
+        self.logger.logCrit('Error in %s chain: %s target not found, restarting container' % (chain.name, self.chain_name))
+        err = True
+        exit_code = 2
+
+    return err, exit_code
 
   def clearIPv4Table(self):
     self.clearTable(iptc.Table(iptc.Table.FILTER))
@@ -20,133 +71,68 @@ class IPTables:
   def clearIPv6Table(self):
     self.clearTable(iptc.Table6(iptc.Table6.FILTER))
 
-  @contextlib.contextmanager
-  def transaction(self, table):
-    # One commit for all changes, autocommit rewrites the whole table for every change
-    table.autocommit = False
-    table.refresh()
-    try:
-      yield
-      table.commit()
-    finally:
-      table.refresh()
-      table.autocommit = True
-
-  def new_rule(self, table):
-    return iptc.Rule6() if isinstance(table, iptc.Table6) else iptc.Rule()
-
-  def family(self, table):
-    return 'IPv6' if isinstance(table, iptc.Table6) else 'IPv4'
-
-  def init_chain(self, filter_table):
-    # Empty MAILCOW chain with one jump at the top of the input and forward chains
-    filter_table.refresh()
-    if filter_table.is_chain(self.chain_name):
-      filter_table.flush_entries(self.chain_name)
-    else:
-      filter_table.create_chain(self.chain_name)
-    self.ensure_jumps(filter_table)
-
-  def ensure_chains(self):
-    # Recreates missing MAILCOW chains and moves the jumps back to the top, True if a chain was recreated
-    recreated = False
-    for filter_table in [iptc.Table(iptc.Table.FILTER), iptc.Table6(iptc.Table6.FILTER)]:
-      filter_table.refresh()
-      if not filter_table.is_chain(self.chain_name):
-        filter_table.create_chain(self.chain_name)
-        self.logger.logWarn(f'MAILCOW {self.family(filter_table)} chain was missing and has been recreated')
-        recreated = True
-      self.ensure_jumps(filter_table)
-    return recreated
-
-  def ensure_jumps(self, filter_table):
-    # Exactly one jump to MAILCOW as first rule: docker inserts its jump (DOCKER-USER) at the top
-    for name in ['INPUT', 'FORWARD']:
-      chain = iptc.Chain(filter_table, name)
-      positions = [position for position, rule in enumerate(chain.rules) if rule.target.name == self.chain_name]
-      if positions == [0]: continue
-
-      with self.transaction(filter_table):
-        for rule in [rule for rule in chain.rules if rule.target.name == self.chain_name]:
-          chain.delete_rule(rule)
-        rule = self.new_rule(filter_table)
-        rule.target = iptc.Target(rule, self.chain_name)
-        chain.insert_rule(rule)
-      if positions:
-        self.logger.logInfo(f'Moved MAILCOW jump to the top of the {self.family(filter_table)} {name} chain, it was at position {positions[0] + 1}')
-      else:
-        self.logger.logInfo(f'Added MAILCOW jump to the {self.family(filter_table)} {name} chain')
-
   def clearTable(self, filter_table):
-    try:
-      with self.transaction(filter_table):
-        if not filter_table.is_chain(self.chain_name):
-          return
-        for chain in filter_table.chains:
-          for rule in chain.rules:
-            if rule.target.name == self.chain_name:
-              chain.delete_rule(rule)
-        filter_table.flush_entries(self.chain_name)
-        filter_table.delete_chain(self.chain_name)
-      self.logger.logInfo(f'Clear completed: {self.family(filter_table)}')
-    except Exception as ex:
-      self.logger.logWarn(f'Error clearing the {self.family(filter_table)} MAILCOW chain: {ex}')
+    filter_table.autocommit = False
+    forward_chain = iptc.Chain(filter_table, "FORWARD")
+    input_chain = iptc.Chain(filter_table, "INPUT")
+    mailcow_chain = iptc.Chain(filter_table, self.chain_name)
+    if mailcow_chain in filter_table.chains:
+      for rule in mailcow_chain.rules:
+        mailcow_chain.delete_rule(rule)
+      for rule in forward_chain.rules:
+        if rule.target.name == self.chain_name:
+          forward_chain.delete_rule(rule)
+      for rule in input_chain.rules:
+        if rule.target.name == self.chain_name:
+          input_chain.delete_rule(rule)
+      filter_table.delete_chain(self.chain_name)
+    filter_table.commit()
+    filter_table.refresh()
+    filter_table.autocommit = True
 
-  def ban_rule_network(self, rule):
-    # Source network of a ban rule, None for every other rule
-    if rule.target.name not in ('REJECT', 'DROP') or rule.matches or rule.in_interface or rule.out_interface:
-      return None
-    try:
-      return ipaddress.ip_network(rule.src, strict=False)
-    except ValueError:
-      return None
+  def banIPv4(self, source):
+    chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), self.chain_name)
+    rule = iptc.Rule()
+    rule.src = source
+    target = iptc.Target(rule, "REJECT")
+    rule.target = target
+    if rule in chain.rules:
+      return False
+    chain.insert_rule(rule)
+    return True
 
-  def split_tables(self, sources):
-    networks = {4: [], 6: []}
-    for source in sources:
-      network = ipaddress.ip_network(source, strict=False)
-      networks[network.version].append(network)
-    tables = [(iptc.Table(iptc.Table.FILTER), networks[4]), (iptc.Table6(iptc.Table6.FILTER), networks[6])]
-    return [(table, table_networks) for table, table_networks in tables if table_networks]
+  def banIPv6(self, source):
+    chain = iptc.Chain(iptc.Table6(iptc.Table6.FILTER), self.chain_name)
+    rule = iptc.Rule6()
+    rule.src = source
+    target = iptc.Target(rule, "REJECT")
+    rule.target = target
+    if rule in chain.rules:
+      return False
+    chain.insert_rule(rule)
+    return True
 
-  def ban(self, sources):
-    # One REJECT rule per network, existing rules are kept. Returns the networks that could not be banned
-    failed = []
-    for filter_table, networks in self.split_tables(sources):
-      try:
-        with self.transaction(filter_table):
-          chain = iptc.Chain(filter_table, self.chain_name)
-          existing = {self.ban_rule_network(rule) for rule in chain.rules}
-          for network in dict.fromkeys(networks):
-            if network in existing: continue
-            rule = self.new_rule(filter_table)
-            rule.src = str(network)
-            rule.target = iptc.Target(rule, "REJECT")
-            chain.insert_rule(rule)
-      except Exception as ex:
-        self.logger.logWarn(f'iptables: {ex}')
-        failed += networks
-    return [str(network) for network in failed]
+  def unbanIPv4(self, source):
+    chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), self.chain_name)
+    rule = iptc.Rule()
+    rule.src = source
+    target = iptc.Target(rule, "REJECT")
+    rule.target = target
+    if rule not in chain.rules: 
+      return False
+    chain.delete_rule(rule)
+    return True
 
-  def unban(self, sources):
-    # Removes every rule of the networks, also duplicates of older versions. Returns the unbanned networks
-    removed = []
-    for filter_table, networks in self.split_tables(sources):
-      targets = set(networks)
-      try:
-        with self.transaction(filter_table):
-          chain = iptc.Chain(filter_table, self.chain_name)
-          found = set()
-          for rule in chain.rules:
-            network = self.ban_rule_network(rule)
-            if network in targets:
-              chain.delete_rule(rule)
-              found.add(network)
-      except Exception as ex:
-        self.logger.logWarn(f'iptables: {ex}')
-        continue
-      removed += found
-    return [str(network) for network in removed]
+  def unbanIPv6(self, source):
+    chain = iptc.Chain(iptc.Table6(iptc.Table6.FILTER), self.chain_name)
+    rule = iptc.Rule6()
+    rule.src = source
+    target = iptc.Target(rule, "REJECT")
+    rule.target = target
+    if rule not in chain.rules:
+      return False
+    chain.delete_rule(rule)
+    return True
 
   def snat4(self, snat_target, source):
     try:
@@ -202,7 +188,7 @@ class IPTables:
           if item == new_rule:
             if position != 0:
               chain.delete_rule(new_rule)
-
+    
       table.commit()
       table.autocommit = True
     except:
@@ -229,9 +215,7 @@ class IPTables:
 
   def create_mailcow_isolation_rule(self, _interface:str, _dports:list, _allow:str = ""):
     try:
-      table = iptc.Table(iptc.Table.FILTER)
-      table.refresh()
-      chain = iptc.Chain(table, self.chain_name)
+      chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), self.chain_name)
 
       # insert mailcow isolation rule
       rule = iptc.Rule()
@@ -247,7 +231,7 @@ class IPTables:
       chain.insert_rule(rule, position=0)
 
       # insert mailcow isolation exception rule
-      if _allow:
+      if _allow != "":
         rule = iptc.Rule()
         rule.src = _allow
         rule.in_interface = f'!{_interface}'
@@ -265,4 +249,4 @@ class IPTables:
       return True
     except Exception as e:
       self.logger.logCrit(f"Error adding {self.chain_name} isolation: {e}")
-      return False
+      return False

data/Dockerfiles/netfilter/modules/NFTables.py

@@ -1,9 +1,8 @@
 import nftables
 import ipaddress
+import os
 
 class NFTables:
-  ISOLATION_COMMENTS = ('mailcow isolation', 'mailcow isolation allow')
-
   def __init__(self, chain_name, logger):
     self.chain_name = chain_name
     self.logger = logger
@@ -13,15 +12,41 @@ class NFTables:
     self.nft.set_handle_output(True)
     self.nft_chain_names = {'ip': {'filter': {'input': '', 'forward': ''}, 'nat': {'postrouting': ''} },
                             'ip6': {'filter': {'input': '', 'forward': ''}, 'nat': {'postrouting': ''} } }
-    self.mailcow_chains = set()
 
     self.search_current_chains()
 
   def initChainIPv4(self):
-    self.init_chain("ip")
+    self.insert_mailcow_chains("ip")
 
   def initChainIPv6(self):
-    self.init_chain("ip6")
+    self.insert_mailcow_chains("ip6")
+
+  def checkIPv4ChainOrder(self):
+    return self.checkChainOrder("ip")
+
+  def checkIPv6ChainOrder(self):
+    return self.checkChainOrder("ip6")
+
+  def checkChainOrder(self, filter_table):
+    err = False
+    exit_code = None
+
+    for chain in ['input', 'forward']:
+      chain_position = self.check_mailcow_chains(filter_table, chain)
+      if chain_position is None: continue
+
+      if chain_position is False:
+        self.logger.logCrit(f'MAILCOW target not found in {filter_table} {chain} table, restarting container to fix it...')
+        err = True
+        exit_code = 2
+
+      if chain_position > 0:
+        chain_position += 1
+        self.logger.logCrit(f'MAILCOW target is in position {chain_position} in the {filter_table} {chain} table, restarting container to fix it...')
+        err = True
+        exit_code = 2
+
+    return err, exit_code
 
   def clearIPv4Table(self):
     self.clearTable("ip")
@@ -29,19 +54,84 @@ class NFTables:
   def clearIPv6Table(self):
     self.clearTable("ip6")
 
+  def clearTable(self, _family):
+    is_empty_dict = True
+    json_command = self.get_base_dict()
+    chain_handle = self.get_chain_handle(_family, "filter", self.chain_name)
+    # if no handle, the chain doesn't exists
+    if chain_handle is not None:
+      is_empty_dict = False
+      # flush chain
+      mailcow_chain = {'family': _family, 'table': 'filter', 'name': self.chain_name}
+      flush_chain = {'flush': {'chain': mailcow_chain}}
+      json_command["nftables"].append(flush_chain)
+
+    # remove rule in forward chain
+    # remove rule in input chain
+    chains_family = [self.nft_chain_names[_family]['filter']['input'],
+                    self.nft_chain_names[_family]['filter']['forward'] ]
+
+    for chain_base in chains_family:
+      if not chain_base: continue
+
+      rules_handle = self.get_rules_handle(_family, "filter", chain_base)
+      if rules_handle is not None:
+        for r_handle in rules_handle:
+          is_empty_dict = False
+          mailcow_rule = {'family':_family,
+                          'table': 'filter',
+                          'chain': chain_base,
+                          'handle': r_handle }
+          delete_rules = {'delete': {'rule': mailcow_rule} }
+          json_command["nftables"].append(delete_rules)
+
+    # remove chain
+    # after delete all rules referencing this chain
+    if chain_handle is not None:
+      mc_chain_handle = {'family':_family,
+                        'table': 'filter',
+                        'name': self.chain_name,
+                        'handle': chain_handle }
+      delete_chain = {'delete': {'chain': mc_chain_handle} }
+      json_command["nftables"].append(delete_chain)
+
+    if is_empty_dict == False:
+      if self.nft_exec_dict(json_command):
+        self.logger.logInfo(f"Clear completed: {_family}")
+
+  def banIPv4(self, source):
+    ban_dict = self.get_ban_ip_dict(source, "ip")
+    return self.nft_exec_dict(ban_dict)
+
+  def banIPv6(self, source):
+    ban_dict = self.get_ban_ip_dict(source, "ip6")
+    return self.nft_exec_dict(ban_dict)
+
+  def unbanIPv4(self, source):
+    unban_dict = self.get_unban_ip_dict(source, "ip")
+    if not unban_dict:
+      return False
+    return self.nft_exec_dict(unban_dict)
+
+  def unbanIPv6(self, source):
+    unban_dict = self.get_unban_ip_dict(source, "ip6")
+    if not unban_dict:
+      return False
+    return self.nft_exec_dict(unban_dict)
+
   def snat4(self, snat_target, source):
     self.snat_rule("ip", snat_target, source)
 
   def snat6(self, snat_target, source):
     self.snat_rule("ip6", snat_target, source)
 
-  def nft_exec_dict(self, query: dict, quiet: bool = False):
+
+  def nft_exec_dict(self, query: dict):
     if not query: return False
 
     rc, output, error = self.nft.json_cmd(query)
     if rc != 0:
-      if not quiet:
-        self.logger.logWarn(f"nftables: {str(error).strip() or f'error {rc}'}")
+      #self.logger.logCrit(f"Nftables Error: {error}")
       return False
 
     # Prevent returning False or empty string on commands that do not produce output
@@ -54,165 +144,118 @@ class NFTables:
     return {'nftables': [{ 'metainfo': { 'json_schema_version': 1} } ] }
 
   def search_current_chains(self):
-    nft_chain_names = {'ip': {'filter': {'input': '', 'forward': ''}, 'nat': {'postrouting': ''} },
-                       'ip6': {'filter': {'input': '', 'forward': ''}, 'nat': {'postrouting': ''} } }
     nft_chain_priority = {'ip': {'filter': {'input': None, 'forward': None}, 'nat': {'postrouting': None} },
-                          'ip6': {'filter': {'input': None, 'forward': None}, 'nat': {'postrouting': None} } }
-    mailcow_chains = set()
+                      'ip6': {'filter': {'input': None, 'forward': None}, 'nat': {'postrouting': None} } }
 
     # Command: 'nft list chains'
     _list = {'list' : {'chains': 'null'} }
     command = self.get_base_dict()
     command['nftables'].append(_list)
     kernel_ruleset = self.nft_exec_dict(command)
-    if not kernel_ruleset:
-      return
+    if kernel_ruleset:
+      for _object in kernel_ruleset['nftables']:
+        chain = _object.get("chain")
+        if not chain: continue
 
-    for _object in kernel_ruleset['nftables']:
+        _family = chain['family']
+        _table = chain['table']
+        _hook = chain.get("hook")
+        _priority = chain.get("prio")
+        _name = chain['name']
+
+        if _family not in self.nft_chain_names: continue
+        if _table not in self.nft_chain_names[_family]: continue
+        if _hook not in self.nft_chain_names[_family][_table]: continue
+        if _priority is None: continue
+
+        _saved_priority = nft_chain_priority[_family][_table][_hook]
+        if _saved_priority is None or _priority < _saved_priority:
+          # at this point, we know the chain has:
+          # hook and priority set
+          # and it has the lowest priority
+          nft_chain_priority[_family][_table][_hook] = _priority
+          self.nft_chain_names[_family][_table][_hook] = _name
+
+  def search_for_chain(self, kernel_ruleset: dict, chain_name: str):
+    found = False
+    for _object in kernel_ruleset["nftables"]:
       chain = _object.get("chain")
-      if not chain: continue
-
-      _family = chain['family']
-      _table = chain['table']
-      _hook = chain.get("hook")
-      _priority = chain.get("prio")
-      _name = chain['name']
-
-      if _family not in nft_chain_names: continue
-      if _table not in nft_chain_names[_family]: continue
-      if _table == 'filter' and _name == self.chain_name:
-        mailcow_chains.add(_family)
-      if _hook not in nft_chain_names[_family][_table]: continue
-      if _priority is None: continue
-
-      _saved_priority = nft_chain_priority[_family][_table][_hook]
-      if _saved_priority is None or _priority < _saved_priority:
-        # at this point, we know the chain has:
-        # hook and priority set
-        # and it has the lowest priority
-        nft_chain_priority[_family][_table][_hook] = _priority
-        nft_chain_names[_family][_table][_hook] = _name
-
-    self.nft_chain_names = nft_chain_names
-    self.mailcow_chains = mailcow_chains
-
-  def has_filter_chains(self, _family: str):
-    # no base chains: the filter table does not exist, e.g. ip6 if docker has ipv6 disabled
-    return any(self.nft_chain_names[_family]['filter'].values())
-
-  def list_rules(self, _family: str, _table: str, _chain: str):
-    # Command: 'nft list chain {family} {table} {chain}', None if the chain does not exist
-    _list = {'list': {'chain': {'family': _family, 'table': _table, 'name': _chain}}}
-    command = self.get_base_dict()
-    command['nftables'].append(_list)
-    kernel_ruleset = self.nft_exec_dict(command, quiet=True)
-    if not kernel_ruleset or not isinstance(kernel_ruleset, dict):
-      return None
-    return [_object["rule"] for _object in kernel_ruleset["nftables"] if _object.get("rule")]
+      if not chain:
+        continue
+      ch_name = chain.get("name")
+      if ch_name == chain_name:
+        found = True
+        break
+    return found
 
   def get_chain_dict(self, _family: str, _name: str):
-    # nft (add | create) chain [<family>] <table> <name>
+    # nft (add | create) chain [<family>] <table> <name> 
     _chain_opts = {'family': _family, 'table': 'filter', 'name': _name  }
     _add = {'add': {'chain': _chain_opts} }
     final_chain = self.get_base_dict()
     final_chain["nftables"].append(_add)
     return final_chain
 
-  def get_mailcow_jump_rule(self, _family: str, _chain: str):
-    _expr_opt = [{'counter': {'family': _family, 'table': 'filter', 'packets': 0, 'bytes': 0}},
-                 {'jump': {'target': self.chain_name}}]
+  def get_mailcow_jump_rule_dict(self, _family: str, _chain: str):
+    _jump_rule = self.get_base_dict()
+    _expr_opt=[]
+    _expr_counter = {'family': _family, 'table': 'filter', 'packets': 0, 'bytes': 0}
+    _counter_dict = {'counter': _expr_counter}
+    _expr_opt.append(_counter_dict)
+
+    _jump_opts = {'jump': {'target': self.chain_name} }
+
+    _expr_opt.append(_jump_opts)
+
     _rule_params = {'family': _family,
                     'table': 'filter',
                     'chain': _chain,
                     'expr': _expr_opt,
                     'comment': "mailcow" }
-    return {'insert': {'rule': _rule_params} }
 
-  def is_mailcow_jump(self, rule: dict):
-    # by target, jumps restored by iptables-restore carry no nft comment
-    return any(isinstance(expr, dict) and isinstance(expr.get('jump'), dict) and expr['jump'].get('target') == self.chain_name
-               for expr in rule.get('expr', []))
+    _add_rule = {'insert': {'rule': _rule_params} }
 
-  def init_chain(self, _family: str):
-    # Empty MAILCOW chain with one jump at the top of the input and forward chains
-    if not self.has_filter_chains(_family): return
+    _jump_rule["nftables"].append(_add_rule)
 
-    if self.list_rules(_family, 'filter', self.chain_name) is None:
-      if self.nft_exec_dict(self.get_chain_dict(_family, self.chain_name)):
-        self.logger.logInfo(f"MAILCOW {_family} chain created successfully.")
-    else:
-      flush_chain = {'flush': {'chain': {'family': _family, 'table': 'filter', 'name': self.chain_name}}}
-      command = self.get_base_dict()
-      command['nftables'].append(flush_chain)
-      self.nft_exec_dict(command)
+    return _jump_rule
 
-    self.ensure_jumps(_family)
-
-  def ensure_chains(self):
-    # Recreates missing MAILCOW chains and moves the jumps back to the top, True if a chain was recreated
-    self.search_current_chains()
-    recreated = False
-    for _family in ['ip', 'ip6']:
-      if not self.has_filter_chains(_family): continue
-
-      if _family not in self.mailcow_chains:
-        if self.nft_exec_dict(self.get_chain_dict(_family, self.chain_name)):
-          self.logger.logWarn(f"MAILCOW {_family} chain was missing and has been recreated")
-          recreated = True
-      self.ensure_jumps(_family)
-    return recreated
-
-  def ensure_jumps(self, _family: str):
-    # Exactly one jump to MAILCOW as first rule: docker inserts its jumps (DOCKER-USER, DOCKER-FORWARD) at the top
-    for hook in ['input', 'forward']:
-      base_chain = self.nft_chain_names[_family]['filter'][hook]
-      if not base_chain: continue
-
-      rules = self.list_rules(_family, 'filter', base_chain)
-      if rules is None: continue
-
-      positions = [position for position, rule in enumerate(rules) if self.is_mailcow_jump(rule)]
-      if positions == [0]: continue
-
-      # delete and insert in one transaction, the chain is never without jump
-      command = self.get_base_dict()
-      for position in positions:
-        _rule_opts = {'family': _family, 'table': 'filter', 'chain': base_chain, 'handle': rules[position]['handle']}
-        command['nftables'].append({'delete': {'rule': _rule_opts}})
-      command['nftables'].append(self.get_mailcow_jump_rule(_family, base_chain))
-      if self.nft_exec_dict(command):
-        if positions:
-          self.logger.logInfo(f"Moved MAILCOW jump to the top of the {_family} {base_chain} chain, it was at position {positions[0] + 1}")
-        else:
-          self.logger.logInfo(f"Added MAILCOW jump to the {_family} {base_chain} chain")
-
-  def clearTable(self, _family: str):
-    # Jumps first, the chain can only be deleted without references. Separate steps, so one failing step
-    # does not roll back the others
-    _list = {'list': {'table': {'family': _family, 'name': 'filter'}}}
+  def insert_mailcow_chains(self, _family: str):
+    nft_input_chain = self.nft_chain_names[_family]['filter']['input']
+    nft_forward_chain = self.nft_chain_names[_family]['filter']['forward']
+    # Command: 'nft list table <family> filter'
+    _table_opts = {'family': _family, 'name': 'filter'}
+    _list = {'list': {'table': _table_opts} }
     command = self.get_base_dict()
     command['nftables'].append(_list)
-    kernel_ruleset = self.nft_exec_dict(command, quiet=True)
-    if not kernel_ruleset or not isinstance(kernel_ruleset, dict):
-      return
+    kernel_ruleset = self.nft_exec_dict(command)
+    if kernel_ruleset:
+      # chain
+      if not self.search_for_chain(kernel_ruleset, self.chain_name):
+        cadena = self.get_chain_dict(_family, self.chain_name)
+        if self.nft_exec_dict(cadena):
+          self.logger.logInfo(f"MAILCOW {_family} chain created successfully.")
 
-    delete_jumps = self.get_base_dict()
-    for _object in kernel_ruleset["nftables"]:
-      rule = _object.get("rule")
-      if rule and self.is_mailcow_jump(rule):
-        _rule_opts = {'family': _family, 'table': 'filter', 'chain': rule['chain'], 'handle': rule['handle']}
-        delete_jumps['nftables'].append({'delete': {'rule': _rule_opts}})
-    if len(delete_jumps['nftables']) > 1:
-      self.nft_exec_dict(delete_jumps)
+      input_jump_found, forward_jump_found = False, False
 
-    if self.list_rules(_family, 'filter', self.chain_name) is None:
-      return
-    mailcow_chain = {'family': _family, 'table': 'filter', 'name': self.chain_name}
-    command = self.get_base_dict()
-    command['nftables'].append({'flush': {'chain': mailcow_chain}})
-    command['nftables'].append({'delete': {'chain': mailcow_chain}})
-    if self.nft_exec_dict(command):
-      self.logger.logInfo(f"Clear completed: {_family}")
+      for _object in kernel_ruleset["nftables"]:
+        if not _object.get("rule"):
+          continue
+
+        rule = _object["rule"]
+        if nft_input_chain and rule["chain"] == nft_input_chain:
+          if rule.get("comment") and rule["comment"] == "mailcow":
+            input_jump_found = True
+        if nft_forward_chain and rule["chain"] == nft_forward_chain:
+          if rule.get("comment") and rule["comment"] == "mailcow":
+            forward_jump_found = True
+
+      if not input_jump_found:
+        command = self.get_mailcow_jump_rule_dict(_family, nft_input_chain)
+        self.nft_exec_dict(command)
+
+      if not forward_jump_found:
+        command = self.get_mailcow_jump_rule_dict(_family, nft_forward_chain)
+        self.nft_exec_dict(command)
 
   def delete_nat_rule(self, _family:str, _chain: str, _handle:str):
     delete_command = self.get_base_dict()
@@ -242,14 +285,23 @@ class NFTables:
     # no postrouting chain, may occur if docker has ipv6 disabled.
     if not chain_name: return
 
-    rules = self.list_rules(_family, 'nat', chain_name)
-    if rules is None:
+    # Command: nft list chain <family> nat <chain_name>
+    _chain_opts = {'family': _family, 'table': 'nat', 'name': chain_name}
+    _list = {'list':{'chain': _chain_opts} }
+    command = self.get_base_dict()
+    command['nftables'].append(_list)
+    kernel_ruleset = self.nft_exec_dict(command)
+    if not kernel_ruleset:
       return
 
     rule_position = 0
     rule_handle = None
     rule_found = False
-    for rule in rules:
+    for _object in kernel_ruleset["nftables"]:
+      if not _object.get("rule"):
+        continue
+
+      rule = _object["rule"]
       if not rule.get("comment") or not rule["comment"] == "mailcow":
         rule_position +=1
         continue
@@ -262,28 +314,23 @@ class NFTables:
     target_net = ipaddress.ip_network(snat_target, strict=False)
 
     if rule_found:
-      try:
-        saddr_ip = rule["expr"][0]["match"]["right"]["prefix"]["addr"]
-        saddr_len = int(rule["expr"][0]["match"]["right"]["prefix"]["len"])
+      saddr_ip = rule["expr"][0]["match"]["right"]["prefix"]["addr"]
+      saddr_len = int(rule["expr"][0]["match"]["right"]["prefix"]["len"])
 
-        daddr_ip = rule["expr"][1]["match"]["right"]["prefix"]["addr"]
-        daddr_len = int(rule["expr"][1]["match"]["right"]["prefix"]["len"])
+      daddr_ip = rule["expr"][1]["match"]["right"]["prefix"]["addr"]
+      daddr_len = int(rule["expr"][1]["match"]["right"]["prefix"]["len"])
 
-        target_ip = rule["expr"][3]["snat"]["addr"]
+      target_ip = rule["expr"][3]["snat"]["addr"]
 
-        saddr_net = ipaddress.ip_network(saddr_ip + '/' + str(saddr_len), strict=False)
-        daddr_net = ipaddress.ip_network(daddr_ip + '/' + str(daddr_len), strict=False)
-        current_target_net = ipaddress.ip_network(target_ip, strict=False)
+      saddr_net = ipaddress.ip_network(saddr_ip + '/' + str(saddr_len), strict=False)
+      daddr_net = ipaddress.ip_network(daddr_ip + '/' + str(daddr_len), strict=False)
+      current_target_net = ipaddress.ip_network(target_ip, strict=False)
 
-        match = all((
-                  dest_net == saddr_net,
-                  dest_net == daddr_net,
-                  target_net == current_target_net
-                ))
-      except (KeyError, IndexError, TypeError, ValueError):
-        # rule of another format, replace it
-        saddr_net = dest_net
-        match = False
+      match = all((
+                dest_net == saddr_net,
+                dest_net == daddr_net,
+                target_net == current_target_net
+              ))
       try:
         if rule_position == 0:
           if not match:
@@ -330,13 +377,49 @@ class NFTables:
       except:
         self.logger.logCrit(f"Error running SNAT on {_family}, retrying...")
 
+  def get_chain_handle(self, _family: str, _table: str, chain_name: str):
+    chain_handle = None
+    # Command: 'nft list chains {family}'
+    _list = {'list': {'chains': {'family': _family} } }
+    command = self.get_base_dict()
+    command['nftables'].append(_list)
+    kernel_ruleset = self.nft_exec_dict(command)
+    if kernel_ruleset:
+      for _object in kernel_ruleset["nftables"]:
+        if not _object.get("chain"):
+          continue
+        chain = _object["chain"]
+        if chain["family"] == _family and chain["table"] == _table and chain["name"] == chain_name:
+          chain_handle = chain["handle"]
+          break
+    return chain_handle
+
   def get_rules_handle(self, _family: str, _table: str, chain_name: str, _comment_filter = "mailcow"):
-    rules = self.list_rules(_family, _table, chain_name) or []
-    return [rule["handle"] for rule in rules if rule.get("comment") == _comment_filter]
+    rule_handle = []
+    # Command: 'nft list chain {family} {table} {chain_name}'
+    _chain_opts = {'family': _family, 'table': _table, 'name': chain_name}
+    _list = {'list': {'chain': _chain_opts} }
+    command = self.get_base_dict()
+    command['nftables'].append(_list)
+
+    kernel_ruleset = self.nft_exec_dict(command)
+    if kernel_ruleset:
+      for _object in kernel_ruleset["nftables"]:
+        if not _object.get("rule"):
+          continue
+
+        rule = _object["rule"]
+        if rule["family"] == _family and rule["table"] == _table and rule["chain"] == chain_name:
+          if rule.get("comment") and rule["comment"] == _comment_filter:
+            rule_handle.append(rule["handle"])
+    return rule_handle
+
+  def get_ban_ip_dict(self, ipaddr: str, _family: str):
+    json_command = self.get_base_dict()
 
-  def get_ban_rule(self, network, _family: str):
     expr_opt = []
-    right_dict = {'prefix': {'addr': str(network.network_address), 'len': int(network.prefixlen) } }
+    ipaddr_net = ipaddress.ip_network(ipaddr, strict=False)
+    right_dict = {'prefix': {'addr': str(ipaddr_net.network_address), 'len': int(ipaddr_net.prefixlen) } }
 
     left_dict = {'payload': {'protocol': _family, 'field': 'saddr'} }
     match_dict = {'op': '==', 'left': left_dict, 'right': right_dict }
@@ -349,115 +432,228 @@ class NFTables:
 
     rule_dict = {'family': _family, 'table': "filter", 'chain': self.chain_name, 'expr': expr_opt}
 
-    return {'insert': {'rule': rule_dict} }
+    base_dict = {'insert': {'rule': rule_dict} }
+    json_command["nftables"].append(base_dict)
 
-  def ban_rule_network(self, rule: dict, _family: str):
-    # Source network of a ban rule (saddr match and drop), None for every other rule
-    if rule.get("comment") in self.ISOLATION_COMMENTS:
-      return None
-    exprs = [expr for expr in rule.get("expr", []) if isinstance(expr, dict)]
-    if not any('drop' in expr or 'reject' in expr for expr in exprs):
-      return None
-    for expr in exprs:
-      match = expr.get("match")
-      if not isinstance(match, dict) or match.get("op") != "==":
-        continue
-      left = match.get("left")
-      payload = left.get("payload") if isinstance(left, dict) else None
-      if not isinstance(payload, dict) or payload.get("protocol") != _family or payload.get("field") != "saddr":
-        continue
-      right = match.get("right")
-      try:
-        if isinstance(right, dict) and isinstance(right.get("prefix"), dict):
-          return ipaddress.ip_network(f'{right["prefix"]["addr"]}/{right["prefix"]["len"]}', strict=False)
-        if isinstance(right, str):
-          return ipaddress.ip_network(right, strict=False)
-      except (KeyError, ValueError):
-        return None
-    return None
+    return json_command
 
-  def split_families(self, sources):
-    families = {}
-    for source in sources:
-      network = ipaddress.ip_network(source, strict=False)
-      families.setdefault('ip' if network.version == 4 else 'ip6', []).append(network)
-    return families
+  def get_unban_ip_dict(self, ipaddr:str, _family: str):
+    json_command = self.get_base_dict()
+    # Command: 'nft list chain {s_family} filter  MAILCOW'
+    _chain_opts = {'family': _family, 'table': 'filter', 'name': self.chain_name}
+    _list = {'list': {'chain': _chain_opts} }
+    command = self.get_base_dict()
+    command['nftables'].append(_list)
+    kernel_ruleset = self.nft_exec_dict(command)
+    rule_handle = None
+    if kernel_ruleset:
+      for _object in kernel_ruleset["nftables"]:
+        if not _object.get("rule"):
+          continue
 
-  def ban(self, sources):
-    # One drop rule per network, existing rules are kept. Returns the networks that could not be banned
-    failed = []
-    for _family, networks in self.split_families(sources).items():
-      rules = self.list_rules(_family, 'filter', self.chain_name)
-      if rules is None:
-        failed += networks
-        continue
-      existing = {self.ban_rule_network(rule, _family) for rule in rules}
-      missing = [network for network in dict.fromkeys(networks) if network not in existing]
-      if not missing: continue
+        rule = _object["rule"]["expr"][0]["match"]
+        if not "payload" in rule["left"]:
+          continue
+        left_opt = rule["left"]["payload"]
+        if not left_opt["protocol"] == _family:
+          continue
+        if not left_opt["field"] =="saddr":
+          continue
 
-      command = self.get_base_dict()
-      for network in missing:
-        command['nftables'].append(self.get_ban_rule(network, _family))
-      if not self.nft_exec_dict(command):
-        failed += missing
-    return [str(network) for network in failed]
+        # ip currently banned
+        rule_right = rule["right"]
+        if isinstance(rule_right, dict):
+          current_rule_ip = rule_right["prefix"]["addr"] + '/' + str(rule_right["prefix"]["len"])
+        else:
+          current_rule_ip = rule_right
+        current_rule_net = ipaddress.ip_network(current_rule_ip)
 
-  def unban(self, sources):
-    # Removes every rule of the networks, also duplicates of older versions. Returns the unbanned networks
-    removed = []
-    for _family, networks in self.split_families(sources).items():
-      rules = self.list_rules(_family, 'filter', self.chain_name)
-      if not rules: continue
+        # ip to ban
+        candidate_net = ipaddress.ip_network(ipaddr, strict=False)
 
-      targets = set(networks)
-      command = self.get_base_dict()
-      found = set()
-      for rule in rules:
-        network = self.ban_rule_network(rule, _family)
-        if network in targets:
-          _rule_opts = {'family': _family, 'table': 'filter', 'chain': self.chain_name, 'handle': rule['handle']}
-          command['nftables'].append({'delete': {'rule': _rule_opts}})
-          found.add(network)
-      if found and self.nft_exec_dict(command):
-        removed += found
-    return [str(network) for network in removed]
+        if current_rule_net == candidate_net:
+          rule_handle = _object["rule"]["handle"]
+          break
+
+      if rule_handle is not None:
+        mailcow_rule = {'family': _family, 'table': 'filter', 'chain': self.chain_name, 'handle': rule_handle}
+        delete_rule = {'delete': {'rule': mailcow_rule} }
+        json_command["nftables"].append(delete_rule)
+      else:
+        return False
+
+    return json_command
+
+  def check_mailcow_chains(self, family: str, chain: str):
+    position = 0
+    rule_found = False
+    chain_name = self.nft_chain_names[family]['filter'][chain]
+
+    if not chain_name: return None
+
+    _chain_opts = {'family': family, 'table': 'filter', 'name': chain_name}
+    _list = {'list': {'chain': _chain_opts}}
+    command = self.get_base_dict()
+    command['nftables'].append(_list)
+    kernel_ruleset = self.nft_exec_dict(command)
+    if kernel_ruleset:
+      for _object in kernel_ruleset["nftables"]:
+        if not _object.get("rule"):
+          continue
+        rule = _object["rule"]
+        if rule.get("comment") and rule["comment"] == "mailcow":
+          rule_found = True
+          break
+
+        position+=1
+
+    return position if rule_found else False
 
   def create_mailcow_isolation_rule(self, _interface:str, _dports:list, _allow:str = ""):
-    # One rule per port: iptables-nft cannot show an anonymous set, a host that saves and restores the ruleset
-    # with iptables-save (e.g. netfilter-persistent) would get a drop for all ports
-    for comment in self.ISOLATION_COMMENTS:
-      for handle in self.get_rules_handle("ip", "filter", self.chain_name, comment):
-        self.delete_filter_rule("ip", self.chain_name, handle)
+    family = "ip"
+    table = "filter"
+    comment_filter_drop = "mailcow isolation"
+    comment_filter_allow = "mailcow isolation allow"
+    json_command = self.get_base_dict()
 
-    if not self.nft_exec_dict(self.get_isolation_dict(_interface, _dports, self.ISOLATION_COMMENTS[0], {"drop": None})):
+    # Delete old mailcow isolation rules
+    handles = self.get_rules_handle(family, table, self.chain_name, comment_filter_drop)
+    for handle in handles:
+      self.delete_filter_rule(family, self.chain_name, handle)
+    handles = self.get_rules_handle(family, table, self.chain_name, comment_filter_allow)
+    for handle in handles:
+      self.delete_filter_rule(family, self.chain_name, handle)
+
+    # insert mailcow isolation rule
+    _match_dict_drop = [
+      {
+        "match": {
+          "op": "!=",
+          "left": {
+            "meta": {
+              "key": "iifname"
+            }
+          },
+          "right": _interface
+        }
+      },
+      {
+        "match": {
+          "op": "==",
+          "left": {
+            "meta": {
+              "key": "oifname"
+            }
+          },
+          "right": _interface
+        }
+      },
+      {
+        "match": {
+          "op": "==",
+          "left": {
+            "payload": {
+              "protocol": "tcp",
+              "field": "dport"
+            }
+          },
+          "right": {
+            "set": _dports
+          }
+        }
+      },
+      {
+        "counter": {
+          "packets": 0,
+          "bytes": 0
+        }
+      },
+      {
+        "drop": None
+      }
+    ]
+    rule_drop = { "insert": { "rule": {
+      "family": family,
+      "table": table,
+      "chain": self.chain_name,
+      "comment": comment_filter_drop,
+      "expr": _match_dict_drop
+    }}}
+    json_command["nftables"].append(rule_drop)
+
+    # insert mailcow isolation allow rule
+    if _allow != "":
+      _match_dict_allow = [
+        {
+          "match": {
+            "op": "==",
+            "left": {
+              "payload": {
+                "protocol": "ip",
+                "field": "saddr"
+              }
+            },
+            "right": _allow
+          }
+        },
+        {
+          "match": {
+            "op": "!=",
+            "left": {
+              "meta": {
+                "key": "iifname"
+              }
+            },
+            "right": _interface
+          }
+        },
+        {
+          "match": {
+            "op": "==",
+            "left": {
+              "meta": {
+                "key": "oifname"
+              }
+            },
+            "right": _interface
+          }
+        },
+        {
+          "match": {
+            "op": "==",
+            "left": {
+              "payload": {
+                "protocol": "tcp",
+                "field": "dport"
+              }
+            },
+            "right": {
+              "set": _dports
+            }
+          }
+        },
+        {
+          "counter": {
+            "packets": 0,
+            "bytes": 0
+          }
+        },
+        {
+          "accept": None
+        }
+      ]
+      rule_allow = { "insert": { "rule": {
+        "family": family,
+        "table": table,
+        "chain": self.chain_name,
+        "comment": comment_filter_allow,
+        "expr": _match_dict_allow
+      }}}
+      json_command["nftables"].append(rule_allow)
+
+    success = self.nft_exec_dict(json_command)
+    if success == False:
       self.logger.logCrit(f"Error adding {self.chain_name} isolation")
       return False
 
-    # separate, an invalid address must not prevent the drop rules. Inserted last, so they are above them
-    if _allow and not self.nft_exec_dict(self.get_isolation_dict(_interface, _dports, self.ISOLATION_COMMENTS[1], {"accept": None}, _allow)):
-      self.logger.logCrit(f"Error adding {self.chain_name} isolation exception for {_allow}")
-      return False
-
-    return True
-
-  def get_isolation_dict(self, _interface:str, _dports:list, _comment:str, _verdict:dict, _saddr:str = ""):
-    json_command = self.get_base_dict()
-    for port in _dports:
-      expr = []
-      if _saddr:
-        expr.append({"match": {"op": "==", "left": {"payload": {"protocol": "ip", "field": "saddr"}}, "right": _saddr}})
-      expr += [
-        {"match": {"op": "!=", "left": {"meta": {"key": "iifname"}}, "right": _interface}},
-        {"match": {"op": "==", "left": {"meta": {"key": "oifname"}}, "right": _interface}},
-        {"match": {"op": "==", "left": {"payload": {"protocol": "tcp", "field": "dport"}}, "right": int(port)}},
-        {"counter": {"packets": 0, "bytes": 0}},
-        _verdict
-      ]
-      json_command["nftables"].append({"insert": {"rule": {
-        "family": "ip",
-        "table": "filter",
-        "chain": self.chain_name,
-        "comment": _comment,
-        "expr": expr
-      }}})
-    return json_command
+    return True

data/Dockerfiles/netfilter/modules/Netfilter.py

@@ -1,200 +0,0 @@
-import ipaddress
-import threading
-import dns.exception
-import dns.resolver
-from modules.BanManager import BanManager
-from modules.Options import Options
-from modules.Regexes import Regexes
-
-
-class Netfilter:
-  """Runs the workers of netfilter. Every worker is a loop that logs errors and goes on, so neither a broken log
-  line nor a Redis restart can stop the expiry of bans."""
-
-  ISOLATION_INTERFACE = 'br-mailcow'
-  ISOLATION_PORTS = [3306, 6379, 8983, 12345]
-
-  def __init__(self, r, tables, logger, env):
-    self.r = r
-    self.tables = tables
-    self.logger = logger
-    self.env = env
-    # reentrant, bans.reapply() runs within the chain check
-    self.lock = threading.RLock()
-    self.stop = threading.Event()
-    self.options = Options(logger)
-    self.regexes = Regexes(logger)
-    self.bans = BanManager(r, tables, self.options, logger, self.lock)
-    self.snat4_target = self.snat_target('SNAT_TO_SOURCE', 4)
-    self.snat6_target = self.snat_target('SNAT6_TO_SOURCE', 6)
-    self.resolved = {}
-    self.workers = {
-      'watch': (self.watch, 3),
-      'purge': (self.purge, 10),
-      'chains': (self.check_chains, 10),
-      'lists': (self.update_lists, 60),
-    }
-    if self.snat4_target or self.snat6_target:
-      self.workers['snat'] = (self.snat, 10)
-    self.threads = {}
-
-  def setup(self):
-    if self.r.exists('F2B_LOG'):
-      self.r.rename('F2B_LOG', 'NETFILTER_LOG')
-    # filled again by the lists worker
-    self.r.delete('F2B_PERM_BANS')
-    self.options.refresh(self.r)
-    self.regexes.refresh(self.r)
-    with self.lock:
-      self.tables.clearIPv4Table()
-      self.tables.clearIPv6Table()
-      self.logger.logInfo('Initializing mailcow netfilter chain')
-      self.tables.initChainIPv4()
-      self.tables.initChainIPv6()
-      self.isolate()
-    self.bans.restore()
-
-  def run(self):
-    for name in self.workers:
-      self.start(name)
-    while not self.stop.wait(5):
-      for name, thread in list(self.threads.items()):
-        if not thread.is_alive():
-          self.logger.logCrit('Worker %s stopped unexpectedly, restarting it' % name)
-          self.start(name)
-
-  def shutdown(self):
-    """Removes the firewall rules, the active bans stay in Redis and are restored on the next start"""
-    self.stop.set()
-    for thread in self.threads.values():
-      thread.join(timeout=5)
-    with self.lock:
-      self.logger.logInfo('Clearing all bans')
-      self.tables.clearIPv4Table()
-      self.tables.clearIPv6Table()
-    try:
-      self.r.delete('F2B_PERM_BANS')
-    except Exception as ex:
-      self.logger.logWarn('Error clearing redis key F2B_PERM_BANS: %s' % ex)
-
-  def start(self, name):
-    task, interval = self.workers[name]
-    thread = threading.Thread(target=self.loop, args=(name, task, interval), name=name, daemon=True)
-    self.threads[name] = thread
-    thread.start()
-
-  def loop(self, name, task, interval):
-    while not self.stop.is_set():
-      try:
-        task()
-      except Exception as ex:
-        self.logger.logWarn('Error in worker %s: %s' % (name, ex))
-      self.stop.wait(interval)
-
-  def watch(self):
-    pubsub = self.r.pubsub(ignore_subscribe_messages=True)
-    try:
-      pubsub.subscribe('F2B_CHANNEL')
-      self.logger.logInfo('Watching Redis channel F2B_CHANNEL')
-      while not self.stop.is_set():
-        message = pubsub.get_message(timeout=1.0)
-        if message and message['type'] == 'message' and message['data']:
-          self.handle_line(message['data'])
-    finally:
-      try:
-        pubsub.close()
-      except Exception:
-        pass
-
-  def handle_line(self, line):
-    # a broken line must not end the watcher
-    try:
-      excused = Regexes.temporary_failure(line)
-      if excused is not None:
-        ip = Regexes.parse_ip(excused)
-        if self.external(ip):
-          self.bans.excuse(ip)
-        return
-      result = self.regexes.match(line)
-      if result is None:
-        return
-      rule_id, address = result
-      ip = Regexes.parse_ip(address)
-      if ip is None:
-        self.logger.logWarn('Rule id %s matched an invalid address %s (%s)' % (rule_id, address, line))
-        return
-      if not self.external(ip):
-        return
-      self.logger.logWarn('%s matched rule id %s (%s)' % (ip, rule_id, line))
-      self.bans.attempt(ip)
-    except Exception as ex:
-      self.logger.logWarn('Error processing log line %r: %s' % (line, ex))
-
-  @staticmethod
-  def external(ip):
-    # private and loopback addresses are never banned
-    return ip is not None and not (ip.is_private or ip.is_loopback)
-
-  def purge(self):
-    self.options.refresh(self.r)
-    self.regexes.refresh(self.r)
-    self.bans.purge()
-
-  def check_chains(self):
-    with self.lock:
-      if self.tables.ensure_chains():
-        self.isolate()
-        self.bans.reapply()
-
-  def snat(self):
-    with self.lock:
-      if self.snat4_target:
-        self.tables.snat4(self.snat4_target, self.env.get('IPV4_NETWORK', '172.22.1') + '.0/24')
-      if self.snat6_target:
-        self.tables.snat6(self.snat6_target, self.env.get('IPV6_NETWORK', 'fd4d:6169:6c63:6f77::/64'))
-
-  def update_lists(self):
-    self.bans.set_allowlist(self.resolve(self.r.hkeys('F2B_WHITELIST')))
-    self.bans.set_denylist(self.resolve(self.r.hkeys('F2B_BLACKLIST')))
-
-  def isolate(self):
-    if self.env.get('DISABLE_NETFILTER_ISOLATION_RULE', '').lower() in ('y', 'yes'):
-      self.logger.logInfo('Skipping MAILCOW isolation')
-      return
-    self.logger.logInfo('Setting MAILCOW isolation')
-    self.tables.create_mailcow_isolation_rule(self.ISOLATION_INTERFACE, self.ISOLATION_PORTS, self.env.get('MAILCOW_REPLICA_IP', ''))
-
-  def resolve(self, entries):
-    """Networks of the entries; hostnames are resolved, on DNS errors to their last known addresses"""
-    resolver = dns.resolver.Resolver()
-    networks = set()
-    for entry in entries:
-      if BanManager.network(entry) is not None:
-        networks.add(entry)
-        continue
-      addresses = set()
-      for rdtype in ['A', 'AAAA']:
-        try:
-          answer = resolver.resolve(qname=entry, rdtype=rdtype, lifetime=3)
-        except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
-          continue
-        except dns.exception.DNSException as ex:
-          self.logger.logInfo('Could not resolve %s: %s' % (entry, ex))
-          addresses = self.resolved.get(entry, set())
-          break
-        addresses.update(rdata.to_text() for rdata in answer)
-      self.resolved[entry] = addresses
-      networks |= addresses
-    return networks
-
-  def snat_target(self, name, version):
-    value = self.env.get(name, '')
-    if not value or value == 'n':
-      return None
-    try:
-      if ipaddress.ip_address(value).version == version:
-        return value
-    except ValueError:
-      pass
-    self.logger.logWarn('%s is not a valid IPv%d address' % (value, version))
-    return None

data/Dockerfiles/netfilter/modules/Options.py

@@ -1,120 +0,0 @@
-import json
-import uuid
-
-
-class Options:
-  """Fail2ban options of the mailcow UI (Redis F2B_OPTIONS). The values are replaced as a whole and never changed
-  in place, so a thread that took them (options.values) keeps a consistent set."""
-
-  DEFAULTS = {
-    'ban_time': 1800,
-    'max_ban_time': 10000,
-    'ban_time_increment': True,
-    'max_attempts': 10,
-    'retry_window': 600,
-    'netban_ipv4': 32,
-    'netban_ipv6': 128,
-    'manage_external': 0,
-  }
-  # Single keys of old installations, read while F2B_OPTIONS does not exist
-  LEGACY_KEYS = {
-    'ban_time': 'F2B_BAN_TIME',
-    'max_ban_time': 'F2B_MAX_BAN_TIME',
-    'ban_time_increment': 'F2B_BAN_TIME_INCREMENT',
-    'max_attempts': 'F2B_MAX_ATTEMPTS',
-    'retry_window': 'F2B_RETRY_WINDOW',
-    'netban_ipv4': 'F2B_NETBAN_IPV4',
-    'netban_ipv6': 'F2B_NETBAN_IPV6',
-  }
-
-  def __init__(self, logger):
-    self.logger = logger
-    self.values = self.normalize({})
-
-  def refresh(self, r):
-    """Reads the options of the UI; options it lacks are added to Redis once, existing ones are never overwritten"""
-    raw = r.get('F2B_OPTIONS')
-    if raw:
-      try:
-        stored = json.loads(raw)
-      except ValueError as ex:
-        self.logger.logWarn('F2B_OPTIONS is no valid JSON, keeping the current options: %s' % ex)
-        return
-      if not isinstance(stored, dict):
-        self.logger.logWarn('F2B_OPTIONS is no JSON object, keeping the current options')
-        return
-    else:
-      stored = {key: r.get(name) for key, name in self.LEGACY_KEYS.items()}
-      stored = {key: value for key, value in stored.items() if value is not None}
-
-    values = self.normalize(stored)
-    self.values = values
-    # First start or old installation: store the complete set, else only what the UI has not saved yet
-    missing = {key: value for key, value in values.items() if not raw or stored.get(key) is None}
-    if missing:
-      self.add_missing(r, missing)
-
-  def ban_time(self, ban_counter):
-    """Seconds of the next ban of a network that was banned ban_counter times before"""
-    values = self.values
-    ban_time = values['ban_time']
-    if values['ban_time_increment']:
-      # the exponent is capped, max_ban_time limits the result anyway
-      ban_time = ban_time * 2 ** min(ban_counter, 32)
-    return max(values['ban_time'], min(ban_time, values['max_ban_time']))
-
-  @classmethod
-  def normalize(cls, stored):
-    values = dict(stored)
-    for key, default in cls.DEFAULTS.items():
-      if isinstance(default, bool):
-        values[key] = cls.to_bool(stored.get(key), default)
-      else:
-        values[key] = cls.to_int(stored.get(key), default)
-    values['ban_time'] = max(1, values['ban_time'])
-    values['max_ban_time'] = max(1, values['max_ban_time'])
-    values['max_attempts'] = max(1, values['max_attempts'])
-    values['retry_window'] = max(1, values['retry_window'])
-    # A short prefix would ban whole regions or everything (/0)
-    values['netban_ipv4'] = min(32, max(8, values['netban_ipv4']))
-    values['netban_ipv6'] = min(128, max(8, values['netban_ipv6']))
-    values['manage_external'] = 1 if values['manage_external'] == 1 else 0
-    if not values.get('banlist_id'):
-      values['banlist_id'] = str(uuid.uuid4())
-    return values
-
-  @staticmethod
-  def to_int(value, default):
-    try:
-      return int(value)
-    except (TypeError, ValueError):
-      return default
-
-  @staticmethod
-  def to_bool(value, default):
-    if isinstance(value, bool):
-      return value
-    if isinstance(value, (int, float)):
-      return value != 0
-    if isinstance(value, str):
-      return value.strip().lower() in ('1', 'true', 'yes', 'on')
-    return default
-
-  def add_missing(self, r, missing):
-    # WATCH keeps a save of the UI between reading and writing
-    def fill(pipe):
-      raw = pipe.get('F2B_OPTIONS')
-      current = json.loads(raw) if raw else {}
-      if not isinstance(current, dict):
-        return
-      added = {key: value for key, value in missing.items() if current.get(key) is None}
-      if not added:
-        return
-      current.update(added)
-      pipe.multi()
-      pipe.set('F2B_OPTIONS', json.dumps(current, ensure_ascii=False))
-
-    try:
-      r.transaction(fill, 'F2B_OPTIONS')
-    except Exception as ex:
-      self.logger.logWarn('Could not add default options to F2B_OPTIONS: %s' % ex)

data/Dockerfiles/netfilter/modules/Regexes.py

@@ -1,88 +0,0 @@
-import ipaddress
-import json
-import re
-
-
-class Regexes:
-  """Rules for log lines (Redis F2B_REGEX): rule id => regex whose first group captures the client address"""
-
-  DEFAULTS = {
-    1: r'mailcow UI: Invalid password for .+ by ([0-9a-f\.:]+)',
-    2: r'Rspamd UI: Invalid password by ([0-9a-f\.:]+)',
-    3: r'warning: .*\[([0-9a-f\.:]+)\]: SASL .+ authentication failed: (?!.*Connection lost to authentication server).+',
-    4: r'warning: non-SMTP command from .*\[([0-9a-f\.:]+)]:.+',
-    5: r'NOQUEUE: reject: RCPT from \[([0-9a-f\.:]+)].+Protocol error.+',
-    6: r'\w+\([^,]+,([0-9a-f\.:]+),<[^>]+>\): Password mismatch \(SHA1 of given password: [a-f0-9]+\)',
-    7: r'\w+\([^,]+,([0-9a-f\.:]+),<[^>]+>\): unknown user \(SHA1 of given password: [a-f0-9]+\)',
-    8: r'SOGo.+ Login from \'([0-9a-f\.:]+)\' for user .+ might not have worked',
-    9: r'([0-9a-f\.:]+) \"GET \/SOGo\/.* HTTP.+\" 403 .+',
-  }
-  # Dovecot could not ask the auth backend (identity provider down, mailcowauth.php unreachable). Postfix logs
-  # such a temporary failure like a wrong password, so failed logins of the address are not counted for a while.
-  TEMPORARY_FAILURE = re.compile(r'lua\([^,]+,([0-9a-f\.:]+)(?:,<[^>]+>)?\): passdb-lua: Upstream (?:unavailable|unreachable)')
-
-  def __init__(self, logger):
-    self.logger = logger
-    self.rules = []
-    self.source = None
-
-  def refresh(self, r):
-    """Compiles the rules of the UI again when they changed; invalid rules are skipped"""
-    raw = r.get('F2B_REGEX')
-    if not raw:
-      raw = json.dumps(self.DEFAULTS, ensure_ascii=False)
-      r.set('F2B_REGEX', raw, nx=True)
-    if raw == self.source:
-      return
-    try:
-      stored = json.loads(raw)
-    except ValueError as ex:
-      self.logger.logWarn('F2B_REGEX is no valid JSON, keeping the current rules: %s' % ex)
-      return
-    if not isinstance(stored, dict):
-      self.logger.logWarn('F2B_REGEX is no JSON object, keeping the current rules')
-      return
-
-    rules = []
-    for rule_id, regex in sorted(stored.items(), key=lambda item: self.sort_key(item[0])):
-      try:
-        rules.append((str(rule_id), re.compile(regex)))
-      except (re.error, TypeError) as ex:
-        self.logger.logWarn('Skipping regex of rule id %s: %s' % (rule_id, ex))
-    self.rules = rules
-    self.source = raw
-
-  def match(self, line):
-    """(rule id, captured address) of the first rule that matches the line, None if no rule matches"""
-    for rule_id, regex in self.rules:
-      result = regex.search(line)
-      if result and result.lastindex and result.group(1):
-        return rule_id, result.group(1)
-    return None
-
-  @classmethod
-  def temporary_failure(cls, line):
-    """Address of a login that failed because the auth backend was unavailable, None for other lines"""
-    result = cls.TEMPORARY_FAILURE.search(line)
-    return result.group(1) if result else None
-
-  @staticmethod
-  def parse_ip(text):
-    """IP address of a captured address, IPv4-mapped IPv6 as IPv4; a trailing colon (e.g. "1.2.3.4:") is
-    tolerated. None if the text is no address."""
-    for candidate in (text, text.rstrip(':')):
-      try:
-        ip = ipaddress.ip_address(candidate)
-      except ValueError:
-        continue
-      if ip.version == 6 and ip.ipv4_mapped:
-        return ip.ipv4_mapped
-      return ip
-    return None
-
-  @staticmethod
-  def sort_key(rule_id):
-    try:
-      return (0, int(rule_id))
-    except (TypeError, ValueError):
-      return (1, str(rule_id))

data/Dockerfiles/nginx/Dockerfile

@@ -1,4 +1,4 @@
-FROM nginx:1.30.6-alpine
+FROM nginx:alpine
 LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"
 
 ENV PIP_BREAK_SYSTEM_PACKAGES=1

data/Dockerfiles/phpfpm/Dockerfile

@@ -1,4 +1,4 @@
-FROM php:8.2-fpm-alpine3.24
+FROM php:8.2-fpm-alpine3.21
 
 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"
 
@@ -7,13 +7,13 @@ ARG APCU_PECL_VERSION=5.1.28
 # renovate: datasource=github-tags depName=Imagick/imagick versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG IMAGICK_PECL_VERSION=3.8.1
 # renovate: datasource=github-tags depName=php/pecl-mail-mailparse versioning=semver-coerced extractVersion=^v(?<version>.*)$
-ARG MAILPARSE_PECL_VERSION=3.2.0
+ARG MAILPARSE_PECL_VERSION=3.1.9
 # renovate: datasource=github-tags depName=php-memcached-dev/php-memcached versioning=semver-coerced extractVersion=^v(?<version>.*)$
 ARG MEMCACHED_PECL_VERSION=3.4.0
 # renovate: datasource=github-tags depName=phpredis/phpredis versioning=semver-coerced extractVersion=(?<version>.*)$
 ARG REDIS_PECL_VERSION=6.3.0
 # renovate: datasource=github-tags depName=composer/composer versioning=semver-coerced extractVersion=(?<version>.*)$
-ARG COMPOSER_VERSION=2.10.2
+ARG COMPOSER_VERSION=2.9.5
 
 RUN apk add -U --no-cache autoconf \
   aspell-dev \
@@ -47,7 +47,6 @@ RUN apk add -U --no-cache autoconf \
   libressl-dev \
   librsvg \
   libtool \
-  libwebp \
   libwebp-dev \
   libxml2-dev \
   libxpm \
@@ -64,16 +63,13 @@ RUN apk add -U --no-cache autoconf \
   samba-client \
   zlib-dev \
   tzdata \
-  && docker-php-source extract \
-  # PECL extensions from their GitHub tags (pecl.php.net is not reliable enough for builds)
-  && mkdir -p /usr/src/php/ext/apcu /usr/src/php/ext/imagick /usr/src/php/ext/mailparse /usr/src/php/ext/memcached /usr/src/php/ext/redis \
-  && curl -fsSL https://github.com/krakjoe/apcu/archive/refs/tags/v${APCU_PECL_VERSION}.tar.gz | tar -xz --strip-components=1 -C /usr/src/php/ext/apcu \
-  && curl -fsSL https://github.com/Imagick/imagick/archive/refs/tags/${IMAGICK_PECL_VERSION}.tar.gz | tar -xz --strip-components=1 -C /usr/src/php/ext/imagick \
-  && sed -i "s/@PACKAGE_VERSION@/${IMAGICK_PECL_VERSION}/" /usr/src/php/ext/imagick/php_imagick.h \
-  && curl -fsSL https://github.com/php/pecl-mail-mailparse/archive/refs/tags/v${MAILPARSE_PECL_VERSION}.tar.gz | tar -xz --strip-components=1 -C /usr/src/php/ext/mailparse \
-  && curl -fsSL https://github.com/php-memcached-dev/php-memcached/archive/refs/tags/v${MEMCACHED_PECL_VERSION}.tar.gz | tar -xz --strip-components=1 -C /usr/src/php/ext/memcached \
-  && curl -fsSL https://github.com/phpredis/phpredis/archive/refs/tags/${REDIS_PECL_VERSION}.tar.gz | tar -xz --strip-components=1 -C /usr/src/php/ext/redis \
-  && docker-php-ext-install -j 4 apcu imagick mailparse memcached redis \
+  && pecl install APCu-${APCU_PECL_VERSION} \
+  && pecl install imagick-${IMAGICK_PECL_VERSION} \
+  && pecl install mailparse-${MAILPARSE_PECL_VERSION} \
+  && pecl install memcached-${MEMCACHED_PECL_VERSION} \
+  && pecl install redis-${REDIS_PECL_VERSION} \
+  && docker-php-ext-enable apcu imagick memcached mailparse redis \
+  && pecl clear-cache \
   && docker-php-ext-configure intl \
   && docker-php-ext-configure exif \
   && docker-php-ext-configure gd --with-freetype=/usr/include/ \  
@@ -87,7 +83,6 @@ RUN apk add -U --no-cache autoconf \
   && curl --silent --show-error https://getcomposer.org/installer | php -- --version=${COMPOSER_VERSION} \
   && mv composer.phar /usr/local/bin/composer \
   && chmod +x /usr/local/bin/composer \
-  && docker-php-source delete \
   && apk del --purge autoconf \
     aspell-dev \
     cyrus-sasl-dev \

data/Dockerfiles/phpfpm/docker-entrypoint.sh

@@ -1,5 +1,7 @@
 #!/bin/bash
 
+function array_by_comma { local IFS=","; echo "$*"; }
+
 # Wait for containers
 while ! mariadb-admin status --ssl=false --socket=/var/run/mysqld/mysqld.sock -u${DBUSER} -p${DBPASS} --silent; do
   echo "Waiting for SQL..."
@@ -130,6 +132,33 @@ if [[ "${MASTER}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
   done
   fi
 
+  # Set API options if env vars are not empty
+  if [[ ${API_ALLOW_FROM} != "invalid" ]] && [[ ! -z ${API_ALLOW_FROM} ]]; then
+    IFS=',' read -r -a API_ALLOW_FROM_ARR <<< "${API_ALLOW_FROM}"
+    declare -a VALIDATED_API_ALLOW_FROM_ARR
+    REGEX_IP6='^([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}(/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?$'
+    REGEX_IP4='^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+(/([0-9]|[1-2][0-9]|3[0-2]))?$'
+    for IP in "${API_ALLOW_FROM_ARR[@]}"; do
+      if [[ ${IP} =~ ${REGEX_IP6} ]] || [[ ${IP} =~ ${REGEX_IP4} ]]; then
+        VALIDATED_API_ALLOW_FROM_ARR+=("${IP}")
+      fi
+    done
+    VALIDATED_IPS=$(array_by_comma ${VALIDATED_API_ALLOW_FROM_ARR[*]})
+    if [[ ! -z ${VALIDATED_IPS} ]]; then
+      if [[ ${API_KEY} != "invalid" ]] && [[ ! -z ${API_KEY} ]]; then
+        mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
+DELETE FROM api WHERE access = 'rw';
+INSERT INTO api (api_key, active, allow_from, access) VALUES ("${API_KEY}", "1", "${VALIDATED_IPS}", "rw");
+EOF
+      fi
+      if [[ ${API_KEY_READ_ONLY} != "invalid" ]] && [[ ! -z ${API_KEY_READ_ONLY} ]]; then
+        mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF
+DELETE FROM api WHERE access = 'ro';
+INSERT INTO api (api_key, active, allow_from, access) VALUES ("${API_KEY_READ_ONLY}", "1", "${VALIDATED_IPS}", "ro");
+EOF
+      fi
+    fi
+  fi
 
   # Create events (master only, STATUS for event on slave will be SLAVESIDE_DISABLED)
   mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} << EOF

data/Dockerfiles/postfix-tlspol/Dockerfile

@@ -1,17 +1,17 @@
-FROM golang:1.26-trixie AS builder
+FROM golang:1.25-bookworm AS builder
 WORKDIR /src
 
 ENV CGO_ENABLED=0 \
     GO111MODULE=on \
 		NOOPT=1 \
-    VERSION=1.14.0
+    VERSION=1.8.22
 
 RUN git clone --branch v${VERSION} https://github.com/Zuplu/postfix-tlspol && \
     cd /src/postfix-tlspol && \
     scripts/build.sh build-only
 
 
-FROM debian:trixie-slim
+FROM debian:bookworm-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 
 ARG DEBIAN_FRONTEND=noninteractive

data/Dockerfiles/postfix-tlspol/syslog-ng-redis_slave.conf

@@ -1,4 +1,4 @@
-@version: 4.8
+@version: 3.38
 @include "scl.conf"
 options {
   chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
   dns_cache(no);
   use_fqdn(no);
   owner("root"); group("adm"); perm(0640);
-  stats(freq(0));
+  stats_freq(0);
   bad_hostname("^gconfd$");
 };
 source s_src {

data/Dockerfiles/postfix-tlspol/syslog-ng.conf

@@ -1,4 +1,4 @@
-@version: 4.8
+@version: 3.38
 @include "scl.conf"
 options {
   chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
   dns_cache(no);
   use_fqdn(no);
   owner("root"); group("adm"); perm(0640);
-  stats(freq(0));
+  stats_freq(0);
   bad_hostname("^gconfd$");
 };
 source s_src {

data/Dockerfiles/postfix/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:trixie-slim
+FROM debian:bookworm-slim
 
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 

data/Dockerfiles/postfix/syslog-ng-redis_slave.conf

@@ -1,4 +1,4 @@
-@version: 4.8
+@version: 3.38
 @include "scl.conf"
 options {
   chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
   dns_cache(no);
   use_fqdn(no);
   owner("root"); group("adm"); perm(0640);
-  stats(freq(0));
+  stats_freq(0);
   bad_hostname("^gconfd$");
 };
 source s_src {

data/Dockerfiles/postfix/syslog-ng.conf

@@ -1,4 +1,4 @@
-@version: 4.8
+@version: 3.38
 @include "scl.conf"
 options {
   chain_hostnames(off);
@@ -7,7 +7,7 @@ options {
   dns_cache(no);
   use_fqdn(no);
   owner("root"); group("adm"); perm(0640);
-  stats(freq(0));
+  stats_freq(0);
   bad_hostname("^gconfd$");
 };
 source s_src {

data/Dockerfiles/rspamd/Dockerfile

@@ -2,7 +2,7 @@ FROM debian:trixie-slim
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 
 ARG DEBIAN_FRONTEND=noninteractive
-ARG RSPAMD_VER=rspamd_4.2.1-1~b7a16ae
+ARG RSPAMD_VER=rspamd_3.14.3-1~236eb65
 ARG CODENAME=trixie
 ENV LC_ALL=C
 

data/Dockerfiles/sogo/Dockerfile

@@ -1,6 +1,6 @@
 # SOGo built from source to enable security patch application
 # Repository: https://github.com/Alinto/sogo
-# Version: SOGo-5.12.12
+# Version: SOGo-5.12.4
 #
 # Applied security patches:
 # -
@@ -12,8 +12,8 @@ FROM debian:bookworm
 LABEL maintainer="The Infrastructure Company GmbH <info@servercow.de>"
 
 ARG DEBIAN_FRONTEND=noninteractive
-ARG SOGO_VERSION=SOGo-5.12.12
-ARG SOPE_VERSION=SOPE-5.12.12
+ARG SOGO_VERSION=SOGo-5.12.5
+ARG SOPE_VERSION=SOPE-5.12.5
 # Security patches to apply (space-separated commit hashes)
 ARG SOGO_SECURITY_PATCHES=""
 # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?<version>.*)$

data/Dockerfiles/sogo/bootstrap-sogo.sh

@@ -13,11 +13,13 @@ do
   sleep 3
 done
 
-# Wait for updated schema (DB_VERSION from docker-compose.yml)
+# Wait for updated schema
 DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
-while [[ "${DBV_NOW}" != "${DB_VERSION}" ]]; do
+DBV_NEW=$(grep -oE '\$db_version = .*;' init_db.inc.php | sed 's/$db_version = //g;s/;//g' | cut -d \" -f2)
+while [[ "${DBV_NOW}" != "${DBV_NEW}" ]]; do
   echo "Waiting for schema update..."
   DBV_NOW=$(mariadb --skip-ssl --socket=/var/run/mysqld/mysqld.sock -u ${DBUSER} -p${DBPASS} ${DBNAME} -e "SELECT version FROM versions WHERE application = 'db_schema';" -BN)
+  DBV_NEW=$(grep -oE '\$db_version = .*;' init_db.inc.php | sed 's/$db_version = //g;s/;//g' | cut -d \" -f2)
   sleep 5
 done
 echo "DB schema is ${DBV_NOW}"

data/Dockerfiles/unbound/Dockerfile

@@ -2,15 +2,11 @@ FROM alpine:3.23
 
 LABEL maintainer = "The Infrastructure Company GmbH <info@servercow.de>"
 
-# install unbound from alpine:edge to get security patches
-# minimum version is pinned
-RUN apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/main "unbound>=1.26.1-r0"
-
-# install other packages from regular alpine stable repo
 RUN apk add --update --no-cache \
 	curl \
 	bind-tools \
 	coreutils \
+	unbound \
 	bash \
 	openssl \
 	drill \

data/conf/dovecot/auth/mailcowauth.php

@@ -101,16 +101,7 @@ if ($result === false){
   // Init Identity Provider
   $iam_provider = identity_provider('init');
   $iam_settings = identity_provider('get');
-  try {
-    $result = user_login($post['username'], $post['password'], array('is_internal' => true, 'service' => $post['service']));
-  } catch (\Mailcow\Auth\IdpUnavailable $e) {
-    // temporary failure for Dovecot, no failed login
-    error_log("MAILCOWAUTH: Identity provider unavailable for user " . $post['username'] . " with service " . $post['service'] . " from IP " . $post['real_rip'] . ": " . $e->getMessage());
-    http_response_code(503); // Service Unavailable
-    echo json_encode($return);
-    session_destroy();
-    exit;
-  }
+  $result = user_login($post['username'], $post['password'], array('is_internal' => true, 'service' => $post['service']));
   if ($result) {
     error_log('MAILCOWAUTH: User auth for user ' . $post['username'] . " with service " . $post['service'] . " from IP " . $post['real_rip']);
     set_sasl_log($post['username'], $post['real_rip'], $post['service']);

data/conf/dovecot/auth/passwd-verify.lua

@@ -32,23 +32,8 @@ function auth_password_verify(request, password)
   -- Returning PASSDB_RESULT_PASSWORD_MISMATCH will reset the user's auth cache entry.
   -- Returning PASSDB_RESULT_INTERNAL_FAILURE keeps the existing cache entry,
   -- even if the TTL has expired. Useful to avoid cache eviction during backend issues.
-
-  -- On a network-level failure (nginx unreachable, DNS failure, timeout) https.request
-  -- returns nil plus an error string, so c is not a numeric HTTP status code. Treat this
-  -- as a backend outage and keep the cache entry, rather than wiping it as a mismatch.
-  if type(c) ~= "number" then
-    dovecot.i_info("HTTP request to auth backend failed with " .. tostring(c) .. " for user " .. request.user)
-    return dovecot.auth.PASSDB_RESULT_INTERNAL_FAILURE, "Upstream unreachable"
-  end
-
-  -- 5xx: the backend or the identity provider cannot answer, a temporary failure and no failed login
-  if c >= 500 then
-    dovecot.i_info("HTTP request to auth backend failed with " .. tostring(c) .. " for user " .. request.user)
-    return dovecot.auth.PASSDB_RESULT_INTERNAL_FAILURE, "Upstream unavailable"
-  end
-
   if c ~= 200 and c ~= 401 then
-    dovecot.i_info("HTTP request failed with " .. tostring(c) .. " for user " .. request.user)
+    dovecot.i_info("HTTP request failed with " .. c .. " for user " .. request.user)
     return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "Upstream error"
   end
 

data/conf/dovecot/dovecot.conf

@@ -67,11 +67,9 @@ passdb {
 }
 # check for regular password - if empty (e.g. force-passwd-reset), previous pass=yes passdbs also fail
 # a return of the following passdb is mandatory
-# cache_key with password: the lua default (%u) would let a temporary failure fall back to the negative entry
-# of a passdb lookup (master logins) and log "unknown user", which netfilter counts as failed login
 passdb {
   driver = lua
-  args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes cache_key=%s:%u:%w
+  args = file=/etc/dovecot/auth/passwd-verify.lua blocking=yes
 }
 # Set doveadm_password=your-secret-password in data/conf/dovecot/extra.conf (create if missing)
 service doveadm {

data/conf/dovecot/global_sieve_before

@@ -1,3 +1,13 @@
 # global_sieve_before script
 # global_sieve_before -> user sieve_before (mailcow UI) -> user sieve_after (mailcow UI) -> global_sieve_after
 
+require ["mailbox", "fileinto"];
+
+if header :contains ["Chat-Version"] [""] {
+  if mailboxexists "DeltaChat" {
+    fileinto "DeltaChat";
+  } else {
+    fileinto :create "DeltaChat";
+  }
+  stop;
+}

data/conf/nginx/templates/nginx.conf.j2

@@ -42,19 +42,12 @@ http {
         https https;
     }
 
-    map $server_port $sogo_auth_internal {
-        65510   "1";
-        default "";
-    }
-
     {% if HTTP_REDIRECT %}
     # HTTP to HTTPS redirect
     server {
         root /web;
         listen {{ HTTP_PORT }} default_server;
-        {% if ENABLE_IPV6 %}
         listen [::]:{{ HTTP_PORT }} default_server;
-        {%endif%}
 
         server_name {{ MAILCOW_HOSTNAME }} autodiscover.* autoconfig.* mta-sts.* {{ ADDITIONAL_SERVER_NAMES | join(' ') }};
 

data/conf/nginx/templates/sites-default.conf.j2

@@ -116,9 +116,6 @@ location ~ \.php$ {
     include /etc/nginx/fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
     fastcgi_param PATH_INFO $fastcgi_path_info;
-    fastcgi_param HTTP_X_REAL_IP $remote_addr;
-    # trusted internal-auth marker; empty for external clients (see nginx.conf map)
-    fastcgi_param SOGO_AUTH_INTERNAL $sogo_auth_internal;
     fastcgi_read_timeout 3600;
     fastcgi_send_timeout 3600;
 }

data/conf/phpfpm/crons/group-grants.php

@@ -1,65 +0,0 @@
-<?php
-
-require_once(__DIR__ . '/../web/inc/vars.inc.php');
-if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
-  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
-}
-require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
-
-$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
-$opt = [
-  PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-  PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
-  PDO::ATTR_EMULATE_PREPARES   => false,
-];
-try {
-  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
-} catch (PDOException $e) {
-  fwrite(STDERR, "DB connect failed: " . $e->getMessage() . "\n");
-  exit(1);
-}
-
-$redis = new Redis();
-try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
-  } else {
-    $redis->connect('redis-mailcow', 6379);
-  }
-  $redis->auth(getenv("REDISPASS"));
-} catch (Exception $e) {
-  fwrite(STDERR, "Redis connect failed: " . $e->getMessage() . "\n");
-  exit(1);
-}
-
-function logMsg($priority, $message, $task = "Group Shares") {
-  global $redis;
-  $redis->lPush('CRON_LOG', json_encode(array(
-    "time" => time(),
-    "priority" => $priority,
-    "task" => $task,
-    "message" => $message,
-  )));
-}
-
-require_once __DIR__ . '/../web/inc/functions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.docker.inc.php';
-
-// One run at a time, released when the process ends
-$lock = fopen('/tmp/group-grants.lock', 'c');
-if ($lock === false || !flock($lock, LOCK_EX | LOCK_NB)) {
-  exit(0);
-}
-
-$sharing = \Mailcow\MailboxGroup\MailboxGroupModule::create($pdo, \Mailcow\Core\Context::system())->sharing;
-
-// Every minute: subscriptions of changed groups; failed ones are retried and logged by the full run
-if ((int)date('i') % 15 !== 0) {
-  $sharing->syncSubscriptions();
-  exit(0);
-}
-
-// Every 15 minutes: IMAP ACLs on new top-level folders and failed grants, SOGo grants of owners that opened SOGo meanwhile
-foreach ($sharing->reconcile() as $warning) {
-  logMsg("warning", $warning[0] . ": " . html_entity_decode(implode(", ", array_slice($warning, 1))));
-}

data/conf/phpfpm/crons/identity-sync.php

@@ -1,95 +0,0 @@
-<?php
-
-require_once(__DIR__ . '/../web/inc/vars.inc.php');
-if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
-  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
-}
-require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
-
-$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
-$opt = [
-  PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-  PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
-  PDO::ATTR_EMULATE_PREPARES   => false,
-];
-try {
-  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
-} catch (PDOException $e) {
-  fwrite(STDERR, "DB connect failed: " . $e->getMessage() . "\n");
-  exit(1);
-}
-
-$redis = new Redis();
-try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
-  } else {
-    $redis->connect('redis-mailcow', 6379);
-  }
-  $redis->auth(getenv("REDISPASS"));
-} catch (Exception $e) {
-  fwrite(STDERR, "Redis connect failed: " . $e->getMessage() . "\n");
-  exit(1);
-}
-
-function logMsg($priority, $message, $task = "Identity Sync") {
-  global $redis;
-  $redis->lPush('CRON_LOG', json_encode(array(
-    "time" => time(),
-    "priority" => $priority,
-    "task" => $task,
-    "message" => $message,
-  )));
-}
-
-require_once __DIR__ . '/../web/inc/functions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.auth.inc.php';
-require_once __DIR__ . '/../web/inc/sessions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php';
-require_once __DIR__ . '/../web/inc/functions.ratelimit.inc.php';
-require_once __DIR__ . '/../web/inc/functions.acl.inc.php';
-
-// The legacy mailbox functions run as admin
-$_SESSION['mailcow_cc_username'] = "admin";
-$_SESSION['mailcow_cc_role'] = "admin";
-$_SESSION['acl']['tls_policy'] = "1";
-$_SESSION['acl']['quarantine_notification'] = "1";
-$_SESSION['acl']['quarantine_category'] = "1";
-$_SESSION['acl']['ratelimit'] = "1";
-$_SESSION['acl']['sogo_access'] = "1";
-$_SESSION['acl']['protocol_access'] = "1";
-$_SESSION['acl']['mailbox_relayhost'] = "1";
-$_SESSION['acl']['unlimited_quota'] = "1";
-
-// One run at a time, released when the process ends
-$lock = fopen('/tmp/identity-sync.lock', 'c');
-if ($lock === false || !flock($lock, LOCK_EX | LOCK_NB)) {
-  exit(0);
-}
-
-// Users, offboarding and groups of Keycloak or LDAP; requested runs first, else every sync_interval minutes.
-// The IdP is only contacted when a run is due.
-$iam_settings = identity_provider('get');
-$identity = \Mailcow\Identity\IdentityModule::create($pdo, \Mailcow\Core\Context::system(), $iam_settings, function () {
-  return identity_provider('init');
-});
-$run = $identity->sync->runDue();
-if ($run !== null) {
-  $summary = $run['summary'];
-  if ($run['status'] == 'error') {
-    logMsg("err", ucfirst($run['mode']) . " failed: " . $summary['error']);
-  } else {
-    $counts = array();
-    foreach ($summary['counts'] as $key => $count) {
-      if ($count > 0) $counts[] = $key . "=" . $count;
-    }
-    logMsg(($run['status'] == 'blocked') ? "warning" : "info", ucfirst($run['mode']) . " " . $run['status'] . ": " . (empty($counts) ? "no changes" : implode(", ", $counts)));
-    foreach ($summary['details']['conflicts'] as $conflict) {
-      logMsg("warning", $conflict);
-    }
-    foreach ($summary['errors'] ?? array() as $error) {
-      logMsg("err", $error);
-    }
-  }
-}
-session_destroy();

data/conf/phpfpm/crons/imapsync-oauth-refresh.php

@@ -1,73 +0,0 @@
-<?php
-
-require_once(__DIR__ . '/../web/inc/vars.inc.php');
-if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
-  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
-}
-require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
-
-$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
-$opt = [
-  PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-  PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
-  PDO::ATTR_EMULATE_PREPARES   => false,
-];
-try {
-  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
-} catch (PDOException $e) {
-  fwrite(STDERR, "DB connect failed: " . $e->getMessage() . "\n");
-  exit(1);
-}
-
-$redis = new Redis();
-try {
-  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
-    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
-  } else {
-    $redis->connect('redis-mailcow', 6379);
-  }
-  $redis->auth(getenv("REDISPASS"));
-} catch (Exception $e) {
-  fwrite(STDERR, "Redis connect failed: " . $e->getMessage() . "\n");
-  exit(1);
-}
-
-function logMsg($priority, $message, $task = "imapsync OAuth refresh") {
-  global $redis;
-  $redis->lPush('CRON_LOG', json_encode(array(
-    "time" => time(),
-    "priority" => $priority,
-    "task" => $task,
-    "message" => $message,
-  )));
-}
-
-require_once __DIR__ . '/../web/inc/functions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.auth.inc.php';
-require_once __DIR__ . '/../web/inc/sessions.inc.php';
-require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php';
-
-// File-lock to prevent concurrent runs
-$lock_file = '/tmp/imapsync-oauth-refresh.lock';
-if (file_exists($lock_file)) {
-  $pid = (int)trim(@file_get_contents($lock_file));
-  if ($pid > 0 && posix_kill($pid, 0)) {
-    logMsg("info", "Previous refresh still running (pid=$pid), exiting");
-    exit(0);
-  }
-  @unlink($lock_file);
-}
-file_put_contents($lock_file, getmypid());
-
-try {
-  // client_credentials source tokens, unused per-user tokens (1 day grace), authorization_code per-user tokens;
-  // failing tokens are retried 15 minutes after their last attempt (C2), errors are sanitized
-  $imapsync = \Mailcow\Imapsync\ImapsyncModule::create($pdo, \Mailcow\Core\Context::system(), [
-    'hostname' => (string)getenv('MAILCOW_HOSTNAME'),
-  ]);
-  foreach ($imapsync->oauth->refreshDue() as $e) {
-    logMsg($e['priority'], $e['message']);
-  }
-} finally {
-  @unlink($lock_file);
-}

data/conf/phpfpm/crons/keycloak-sync.php

@@ -0,0 +1,231 @@
+<?php
+
+require_once(__DIR__ . '/../web/inc/vars.inc.php');
+if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
+  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
+}
+require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
+
+// Init database
+//$dsn = $database_type . ':host=' . $database_host . ';dbname=' . $database_name;
+$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
+$opt = [
+    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+    PDO::ATTR_EMULATE_PREPARES   => false,
+];
+try {
+  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
+}
+catch (PDOException $e) {
+  logMsg("err", $e->getMessage());
+  session_destroy();
+  exit;
+}
+
+// Init Redis
+$redis = new Redis();
+try {
+  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
+    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
+  }
+  else {
+    $redis->connect('redis-mailcow', 6379);
+  }
+  $redis->auth(getenv("REDISPASS"));
+}
+catch (Exception $e) {
+  echo "Exiting: " . $e->getMessage();
+  session_destroy();
+  exit;
+}
+
+function logMsg($priority, $message, $task = "Keycloak Sync") {
+  global $redis;
+
+  $finalMsg = array(
+    "time" => time(),
+    "priority" => $priority,
+    "task" => $task,
+    "message" => $message
+  );
+  $redis->lPush('CRON_LOG', json_encode($finalMsg));
+}
+
+// Load core functions first
+require_once __DIR__ . '/../web/inc/functions.inc.php';
+require_once __DIR__ . '/../web/inc/functions.auth.inc.php';
+require_once __DIR__ . '/../web/inc/sessions.inc.php';
+require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php';
+require_once __DIR__ . '/../web/inc/functions.ratelimit.inc.php';
+require_once __DIR__ . '/../web/inc/functions.acl.inc.php';
+
+$_SESSION['mailcow_cc_username'] = "admin";
+$_SESSION['mailcow_cc_role'] = "admin";
+$_SESSION['acl']['tls_policy'] = "1";
+$_SESSION['acl']['quarantine_notification'] = "1";
+$_SESSION['acl']['quarantine_category'] = "1";
+$_SESSION['acl']['ratelimit'] = "1";
+$_SESSION['acl']['sogo_redirection'] = "1";
+$_SESSION['acl']['protocol_access'] = "1";
+$_SESSION['acl']['mailbox_relayhost'] = "1";
+$_SESSION['acl']['unlimited_quota'] = "1";
+
+$iam_settings = identity_provider('get');
+if ($iam_settings['authsource'] != "keycloak" || (intval($iam_settings['periodic_sync']) != 1 && intval($iam_settings['import_users']) != 1)) {
+  session_destroy();
+  exit;
+}
+
+// Set pagination variables
+$start = 0;
+$max = 100;
+
+// lock sync if already running
+$lock_file = '/tmp/iam-sync.lock';
+if (file_exists($lock_file)) {
+  $lock_file_parts = explode("\n", file_get_contents($lock_file));
+  $pid = $lock_file_parts[0];
+  if (count($lock_file_parts) > 1){
+    $last_execution = $lock_file_parts[1];
+    $elapsed_time = (time() - $last_execution) / 60;
+    if ($elapsed_time < intval($iam_settings['sync_interval'])) {
+      logMsg("warning", "Sync not ready (".number_format((float)$elapsed_time, 2, '.', '')."min / ".$iam_settings['sync_interval']."min)");
+      session_destroy();
+      exit;
+    }
+  }
+
+  if (posix_kill($pid, 0)) {
+    logMsg("warning", "Sync is already running");
+    session_destroy();
+    exit;
+  } else {
+    unlink($lock_file);
+  }
+}
+$lock_file_handle = fopen($lock_file, 'w');
+fwrite($lock_file_handle, getmypid());
+fclose($lock_file_handle);
+
+// Init Keycloak Provider
+$iam_provider = identity_provider('init');
+
+// Loop until all users have been retrieved
+while (true) {
+  // Get admin access token
+  $admin_token = identity_provider("get-keycloak-admin-token");
+
+  // Make the API request to retrieve the users
+  $url = "{$iam_settings['server_url']}/admin/realms/{$iam_settings['realm']}/users?first=$start&max=$max";
+  $ch = curl_init();
+  curl_setopt($ch, CURLOPT_URL, $url);
+  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+  curl_setopt($ch, CURLOPT_HTTPHEADER, [
+    "Content-Type: application/json",
+    "Authorization: Bearer " . $admin_token
+  ]);
+  $response = curl_exec($ch);
+  $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+  curl_close($ch);
+
+  if ($code != 200){
+    logMsg("err", "Received HTTP {$code}");
+    session_destroy();
+    exit;
+  }
+  try {
+    $response = json_decode($response, true);
+  } catch (Exception $e) {
+    logMsg("err", $e->getMessage());
+    break;
+  }
+  if (!is_array($response)){
+    logMsg("err", "Received malformed response from keycloak api");
+    break;
+  }
+  if (count($response) == 0) {
+    break;
+  }
+
+  // Process the batch of users
+  foreach ($response as $user) {
+    if (empty($user['email'])){
+      logMsg("warning", "No email address in keycloak found for user " . $user['name']);
+      continue;
+    }
+
+    // try get mailbox user
+    $stmt = $pdo->prepare("SELECT
+      mailbox.*,
+      domain.active AS d_active
+      FROM `mailbox`
+      INNER JOIN domain on mailbox.domain = domain.domain
+      WHERE `kind` NOT REGEXP 'location|thing|group'
+        AND `username` = :user");
+    $stmt->execute(array(':user' => $user['email']));
+    $row = $stmt->fetch(PDO::FETCH_ASSOC);
+
+    // check if matching attribute mapping exists
+    $user_template = $user['attributes']['mailcow_template'][0];
+    $mapper_key = array_search($user_template, $iam_settings['mappers']);
+
+    $_SESSION['access_all_exception'] = '1';
+    if (!$row && intval($iam_settings['import_users']) == 1){
+      if ($mapper_key === false){
+        if (!empty($iam_settings['default_template'])) {
+          $mbox_template = $iam_settings['default_template'];
+          logMsg("warning", "Using default template for user " . $user['email']);
+        } else {
+          logMsg("warning", "No matching attribute mapping found for user " . $user['email']);
+          continue;
+        }
+      } else {
+        $mbox_template = $iam_settings['templates'][$mapper_key];
+      }
+      // mailbox user does not exist, create...
+      logMsg("info", "Creating user " . $user['email']);
+      $create_res = mailbox('add', 'mailbox_from_template', array(
+        'domain' => explode('@', $user['email'])[1],
+        'local_part' => explode('@', $user['email'])[0],
+        'name' => $user['firstName'] . " " . $user['lastName'],
+        'authsource' => 'keycloak',
+        'template' => $mbox_template
+      ));
+      if (!$create_res){
+        logMsg("err", "Could not create user " . $user['email']);
+        continue;
+      }
+    } else if ($row && intval($iam_settings['periodic_sync']) == 1 && $row['authsource'] == "keycloak") {
+      if ($mapper_key === false){
+        logMsg("warning", "No matching attribute mapping found for user " . $user['email']);
+        continue;
+      }
+      $mbox_template = $iam_settings['templates'][$mapper_key];
+      // mailbox user does exist, sync attribtues...
+      logMsg("info", "Syncing attributes for user " . $user['email']);
+      mailbox('edit', 'mailbox_from_template', array(
+        'username' => $user['email'],
+        'name' => $user['firstName'] . " " . $user['lastName'],
+        'template' => $mbox_template
+      ));
+    } else {
+      // skip mailbox user
+      logMsg("info", "Skipping user " . $user['email']);
+    }
+    $_SESSION['access_all_exception'] = '0';
+
+    sleep(0.025);
+  }
+
+  // Update the pagination variables for the next batch
+  $start += $max;
+  sleep(1);
+}
+
+logMsg("info", "DONE!");
+// add last execution time to lock file
+$lock_file_handle = fopen($lock_file, 'w');
+fwrite($lock_file_handle, getmypid() . "\n" . time());
+fclose($lock_file_handle);
+session_destroy();

data/conf/phpfpm/crons/ldap-sync.php

@@ -0,0 +1,198 @@
+<?php
+
+require_once(__DIR__ . '/../web/inc/vars.inc.php');
+if (file_exists(__DIR__ . '/../web/inc/vars.local.inc.php')) {
+  include_once(__DIR__ . '/../web/inc/vars.local.inc.php');
+}
+require_once __DIR__ . '/../web/inc/lib/vendor/autoload.php';
+
+// Init database
+//$dsn = $database_type . ':host=' . $database_host . ';dbname=' . $database_name;
+$dsn = $database_type . ":unix_socket=" . $database_sock . ";dbname=" . $database_name;
+$opt = [
+    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+    PDO::ATTR_EMULATE_PREPARES   => false,
+];
+try {
+  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
+}
+catch (PDOException $e) {
+  logMsg("err", $e->getMessage());
+  session_destroy();
+  exit;
+}
+
+// Init Redis
+$redis = new Redis();
+try {
+  if (!empty(getenv('REDIS_SLAVEOF_IP'))) {
+    $redis->connect(getenv('REDIS_SLAVEOF_IP'), getenv('REDIS_SLAVEOF_PORT'));
+  }
+  else {
+    $redis->connect('redis-mailcow', 6379);
+  }
+  $redis->auth(getenv("REDISPASS"));
+}
+catch (Exception $e) {
+  echo "Exiting: " . $e->getMessage();
+  session_destroy();
+  exit;
+}
+
+function logMsg($priority, $message, $task = "LDAP Sync") {
+  global $redis;
+
+  $finalMsg = array(
+    "time" => time(),
+    "priority" => $priority,
+    "task" => $task,
+    "message" => $message
+  );
+  $redis->lPush('CRON_LOG', json_encode($finalMsg));
+}
+
+// Load core functions first
+require_once __DIR__ . '/../web/inc/functions.inc.php';
+require_once __DIR__ . '/../web/inc/functions.auth.inc.php';
+require_once __DIR__ . '/../web/inc/sessions.inc.php';
+require_once __DIR__ . '/../web/inc/functions.mailbox.inc.php';
+require_once __DIR__ . '/../web/inc/functions.ratelimit.inc.php';
+require_once __DIR__ . '/../web/inc/functions.acl.inc.php';
+
+$_SESSION['mailcow_cc_username'] = "admin";
+$_SESSION['mailcow_cc_role'] = "admin";
+$_SESSION['acl']['tls_policy'] = "1";
+$_SESSION['acl']['quarantine_notification'] = "1";
+$_SESSION['acl']['quarantine_category'] = "1";
+$_SESSION['acl']['ratelimit'] = "1";
+$_SESSION['acl']['sogo_redirection'] = "1";
+$_SESSION['acl']['protocol_access'] = "1";
+$_SESSION['acl']['mailbox_relayhost'] = "1";
+$_SESSION['acl']['unlimited_quota'] = "1";
+
+$iam_settings = identity_provider('get');
+if ($iam_settings['authsource'] != "ldap" || (intval($iam_settings['periodic_sync']) != 1 && intval($iam_settings['import_users']) != 1)) {
+  session_destroy();
+  exit;
+}
+
+// Set pagination variables
+$start = 0;
+$max = 100;
+
+// lock sync if already running
+$lock_file = '/tmp/iam-sync.lock';
+if (file_exists($lock_file)) {
+  $lock_file_parts = explode("\n", file_get_contents($lock_file));
+  $pid = $lock_file_parts[0];
+  if (count($lock_file_parts) > 1){
+    $last_execution = $lock_file_parts[1];
+    $elapsed_time = (time() - $last_execution) / 60;
+    if ($elapsed_time < intval($iam_settings['sync_interval'])) {
+      logMsg("warning", "Sync not ready (".number_format((float)$elapsed_time, 2, '.', '')."min / ".$iam_settings['sync_interval']."min)");
+      session_destroy();
+      exit;
+    }
+  }
+
+  if (posix_kill($pid, 0)) {
+    logMsg("warning", "Sync is already running");
+    session_destroy();
+    exit;
+  } else {
+    unlink($lock_file);
+  }
+}
+$lock_file_handle = fopen($lock_file, 'w');
+fwrite($lock_file_handle, getmypid());
+fclose($lock_file_handle);
+
+// Init Provider
+$iam_provider = identity_provider('init');
+
+// Get ldap users
+$ldap_query = $iam_provider->query();
+if (!empty($iam_settings['filter'])) {
+  $ldap_query = $ldap_query->rawFilter($iam_settings['filter']);
+}
+$response = $ldap_query->where($iam_settings['username_field'], "*")
+  ->where($iam_settings['attribute_field'], "*")
+  ->select([$iam_settings['username_field'], $iam_settings['attribute_field'], 'displayname'])
+  ->paginate($max);
+
+// Process the users
+foreach ($response as $user) {
+  // try get mailbox user
+  $stmt = $pdo->prepare("SELECT
+    mailbox.*,
+    domain.active AS d_active
+    FROM `mailbox`
+    INNER JOIN domain on mailbox.domain = domain.domain
+    WHERE `kind` NOT REGEXP 'location|thing|group'
+      AND `username` = :user");
+  $stmt->execute(array(':user' => $user[$iam_settings['username_field']][0]));
+  $row = $stmt->fetch(PDO::FETCH_ASSOC);
+
+  // check if matching attribute mapping exists
+  $user_template = $user[$iam_settings['attribute_field']][0];
+  $mapper_key = array_search($user_template, $iam_settings['mappers']);
+
+  if (empty($user[$iam_settings['username_field']][0])){
+    logMsg("warning", "Skipping user " . $user['displayname'][0] . " due to empty LDAP ". $iam_settings['username_field'] . " property.");
+    continue;
+  }
+
+  $_SESSION['access_all_exception'] = '1';
+  if (!$row && intval($iam_settings['import_users']) == 1){
+    if ($mapper_key === false){
+      if (!empty($iam_settings['default_template'])) {
+        $mbox_template = $iam_settings['default_template'];
+      } else {
+        logMsg("warning", "No matching attribute mapping found for user " . $user[$iam_settings['username_field']][0]);
+        continue;
+      }
+    } else {
+      $mbox_template = $iam_settings['templates'][$mapper_key];
+    }
+    // mailbox user does not exist, create...
+    logMsg("info", "Creating user " .  $user[$iam_settings['username_field']][0]);
+    $create_res = mailbox('add', 'mailbox_from_template', array(
+      'domain' => explode('@',  $user[$iam_settings['username_field']][0])[1],
+      'local_part' => explode('@',  $user[$iam_settings['username_field']][0])[0],
+      'name' => $user['displayname'][0],
+      'authsource' => 'ldap',
+      'template' => $mbox_template
+    ));
+    if (!$create_res){
+      logMsg("err", "Could not create user " . $user[$iam_settings['username_field']][0]);
+      continue;
+    }
+  } else if ($row && intval($iam_settings['periodic_sync']) == 1 && $row['authsource'] == "ldap") {
+    if ($mapper_key === false){
+      logMsg("warning", "No matching attribute mapping found for user " . $user[$iam_settings['username_field']][0]);
+      continue;
+    }
+    $mbox_template = $iam_settings['templates'][$mapper_key];
+    // mailbox user does exist, sync attribtues...
+    logMsg("info", "Syncing attributes for user " . $user[$iam_settings['username_field']][0]);
+    mailbox('edit', 'mailbox_from_template', array(
+      'username' =>  $user[$iam_settings['username_field']][0],
+      'name' => $user['displayname'][0],
+      'template' => $mbox_template
+    ));
+  } else {
+    // skip mailbox user
+    logMsg("info", "Skipping user " .  $user[$iam_settings['username_field']][0]);
+  }
+  $_SESSION['access_all_exception'] = '0';
+
+  sleep(0.025);
+}
+
+logMsg("info", "DONE!");
+// add last execution time to lock file
+$lock_file_handle = fopen($lock_file, 'w');
+fwrite($lock_file_handle, getmypid() . "\n" . time());
+fclose($lock_file_handle);
+session_destroy();

data/conf/phpfpm/php-conf.d/other.ini

@@ -1,5 +1,3 @@
 max_execution_time = 3600
 max_input_time = 3600
 memory_limit = 512M
-; not used by mailcow, disabled as hardening (PHP security release 2026-10-21)
-session.upload_progress.enabled = Off

data/conf/postfix/main.cf

@@ -37,7 +37,7 @@ postscreen_access_list = permit_mynetworks,
   cidr:/opt/postfix/conf/postscreen_access.cidr,
   tcp:127.0.0.1:10027
 postscreen_bare_newline_enable = no
-postscreen_denylist_action = drop
+postscreen_blacklist_action = drop
 postscreen_cache_cleanup_interval = 24h
 postscreen_cache_map = proxy:btree:$data_directory/postscreen_cache
 postscreen_dnsbl_action = enforce
@@ -107,6 +107,8 @@ smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch,
   reject_unknown_sender_domain
 smtpd_soft_error_limit = 3
 smtpd_tls_auth_only = yes
+smtpd_tls_dh1024_param_file = /etc/ssl/mail/dhparams.pem
+smtpd_tls_eecdh_grade = auto
 smtpd_tls_exclude_ciphers = ECDHE-RSA-RC4-SHA, RC4, aNULL, DES-CBC3-SHA, ECDHE-RSA-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA
 smtpd_tls_loglevel = 1
 
@@ -150,7 +152,7 @@ smtp_sasl_auth_enable = yes
 smtp_sasl_password_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sasl_passwd_maps_sender_dependent.cf
 smtp_sasl_security_options =
 smtp_sasl_mechanism_filter = plain, login
-smtp_tls_policy_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_policy_override_maps.cf socketmap:inet:postfix-tlspol:8642:QUERYwithTLSRPT
+smtp_tls_policy_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_policy_override_maps.cf socketmap:inet:postfix-tlspol:8642:QUERY
 smtp_header_checks = pcre:/opt/postfix/conf/anonymize_headers.pcre
 mail_name = Postcow
 # local_transport map catches local destinations and prevents routing local dests when the next map would route "*"

data/conf/postfix/master.cf

@@ -29,6 +29,7 @@ smtps    inet  n       -       n       -       -       smtpd
 # TLS protocol can be modified by setting submission_smtpd_tls_mandatory_protocols in extra.cf
 submission inet n       -       n       -       -       smtpd
   -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
+  -o smtpd_enforce_tls=yes
   -o smtpd_tls_security_level=encrypt
   -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols
   -o tls_preempt_cipherlist=yes
@@ -37,6 +38,7 @@ submission inet n       -       n       -       -       smtpd
 10587      inet n       -       n       -       -       smtpd
   -o smtpd_upstream_proxy_protocol=haproxy
   -o smtpd_client_restrictions=permit_mynetworks,permit_sasl_authenticated,reject
+  -o smtpd_enforce_tls=yes
   -o smtpd_tls_security_level=encrypt
   -o smtpd_tls_mandatory_protocols=$submission_smtpd_tls_mandatory_protocols
   -o tls_preempt_cipherlist=yes

data/conf/postfix/postscreen_access.cidr

@@ -1,8 +1,7 @@
-# Whitelist generated by Postwhite v3.4 on Thu Oct  1 00:35:20 UTC 2026
+# Whitelist generated by Postwhite v3.4 on Sun Mar  1 00:29:01 UTC 2026
 # https://github.com/stevejenkins/postwhite/
-# 2246 total rules
+# 2174 total rules
 2a00:1450:4000::/36	permit
-2a00:1450:4864::/56	permit
 2a01:111:f400::/48	permit
 2a01:111:f403:2800::/53	permit
 2a01:111:f403:8000::/51	permit
@@ -29,15 +28,11 @@
 2a01:b747:3004:200::/56	permit
 2a01:b747:3005:200::/56	permit
 2a01:b747:3006:200::/56	permit
-2a01:b747:3007::/56	permit
 2a02:a60:0:5::/64	permit
 2a0f:f640::/56	permit
 2c0f:fb50:4000::/36	permit
-2c0f:fb50:4864::/56	permit
-2.207.151.32/27	permit
 2.207.151.53	permit
 2.207.217.30	permit
-2.207.223.160/27	permit
 3.64.237.68	permit
 3.65.3.180	permit
 3.70.123.177	permit
@@ -58,14 +53,13 @@
 8.25.196.0/23	permit
 8.36.116.0/24	permit
 8.39.54.0/23	permit
-8.39.54.240/29	permit
 8.39.54.250/31	permit
 8.39.144.0/24	permit
 8.40.222.0/23	permit
-8.40.222.240/29	permit
 8.40.222.250/31	permit
-8.47.10.9	permit
 12.130.86.238	permit
+13.107.213.51	permit
+13.107.246.51	permit
 13.108.16.0/20	permit
 13.110.208.0/21	permit
 13.110.209.0/24	permit
@@ -125,6 +119,7 @@
 23.249.208.0/20	permit
 23.251.224.0/19	permit
 23.253.141.0/24	permit
+23.253.182.0/23	permit
 23.253.182.103	permit
 23.253.183.145	permit
 23.253.183.146	permit
@@ -146,7 +141,24 @@
 27.123.206.80/28	permit
 31.47.251.17	permit
 31.186.239.0/24	permit
-34.2.64.0/19	permit
+34.2.64.0/22	permit
+34.2.68.0/23	permit
+34.2.70.0/23	permit
+34.2.71.64/26	permit
+34.2.72.0/22	permit
+34.2.75.0/26	permit
+34.2.78.0/23	permit
+34.2.80.0/23	permit
+34.2.82.0/23	permit
+34.2.84.0/24	permit
+34.2.84.64/26	permit
+34.2.85.0/24	permit
+34.2.85.64/26	permit
+34.2.86.0/23	permit
+34.2.88.0/23	permit
+34.2.90.0/23	permit
+34.2.92.0/23	permit
+34.2.94.0/23	permit
 34.70.158.162	permit
 34.74.74.140	permit
 34.83.159.189	permit
@@ -173,7 +185,6 @@
 35.205.92.9	permit
 35.228.216.85	permit
 35.242.169.159	permit
-37.187.220.204	permit
 37.188.97.188	permit
 37.218.248.47	permit
 37.218.249.47	permit
@@ -247,8 +258,8 @@
 46.228.39.112/31	permit
 46.243.88.174	permit
 46.243.88.175	permit
-46.243.88.176/30	permit
-46.243.95.96/27	permit
+46.243.88.176	permit
+46.243.88.177	permit
 46.243.95.179	permit
 46.243.95.180	permit
 50.16.246.183	permit
@@ -266,8 +277,6 @@
 50.56.130.221	permit
 50.56.130.222	permit
 50.112.246.219	permit
-50.152.146.25	permit
-51.83.17.38	permit
 52.1.14.157	permit
 52.5.230.59	permit
 52.6.74.205	permit
@@ -358,9 +367,7 @@
 64.127.115.252	permit
 64.132.88.0/23	permit
 64.132.92.0/24	permit
-64.181.136.241	permit
 64.181.194.190	permit
-64.181.213.254	permit
 64.207.219.7	permit
 64.207.219.8	permit
 64.207.219.9	permit
@@ -446,11 +453,7 @@
 66.218.75.252/31	permit
 66.218.75.254	permit
 66.220.144.128/25	permit
-66.220.144.178	permit
-66.220.144.179	permit
 66.220.155.0/24	permit
-66.220.155.178	permit
-66.220.155.179	permit
 66.220.157.0/25	permit
 66.231.80.0/20	permit
 66.240.227.0/24	permit
@@ -515,8 +518,6 @@
 69.162.98.0/24	permit
 69.169.224.0/20	permit
 69.171.232.0/24	permit
-69.171.232.180	permit
-69.171.232.181	permit
 69.171.244.0/23	permit
 70.42.149.35	permit
 72.3.185.0/24	permit
@@ -638,8 +639,6 @@
 77.238.189.148/30	permit
 79.135.106.0/24	permit
 79.135.107.0/24	permit
-80.225.160.128/25	permit
-81.88.38.0/23	permit
 81.169.146.243	permit
 81.169.146.245	permit
 81.169.146.246	permit
@@ -658,9 +657,6 @@
 82.165.159.45	permit
 82.165.159.130	permit
 82.165.159.131	permit
-84.8.68.0/25	permit
-84.8.192.128/25	permit
-84.8.224.128/25	permit
 85.9.206.169	permit
 85.9.210.45	permit
 85.158.136.0/21	permit
@@ -724,7 +720,6 @@
 96.43.148.64/28	permit
 96.43.148.64/31	permit
 96.43.151.64/28	permit
-98.77.0.0/16	permit
 98.97.248.0/21	permit
 98.136.44.181	permit
 98.136.44.182/31	permit
@@ -1220,6 +1215,8 @@
 104.43.243.237	permit
 104.44.112.128/25	permit
 104.47.0.0/17	permit
+104.130.96.0/28	permit
+104.130.122.0/23	permit
 106.10.144.64/27	permit
 106.10.144.100/31	permit
 106.10.144.103	permit
@@ -1372,7 +1369,6 @@
 117.120.16.0/21	permit
 119.42.242.52/31	permit
 119.42.242.156	permit
-121.244.91.31	permit
 121.244.91.48	permit
 121.244.91.52	permit
 122.15.156.182	permit
@@ -1412,20 +1408,6 @@
 129.146.88.28	permit
 129.146.147.105	permit
 129.146.236.58	permit
-129.148.135.0/25	permit
-129.148.148.0/25	permit
-129.148.164.0/25	permit
-129.148.180.0/25	permit
-129.148.215.0/25	permit
-129.149.6.0/25	permit
-129.149.22.0/25	permit
-129.149.38.0/25	permit
-129.149.52.0/25	permit
-129.149.68.0/25	permit
-129.149.84.0/25	permit
-129.149.100.0/25	permit
-129.149.118.0/25	permit
-129.149.126.0/25	permit
 129.151.67.221	permit
 129.153.62.216	permit
 129.153.104.71	permit
@@ -1438,21 +1420,18 @@
 129.159.22.159	permit
 129.159.87.137	permit
 129.213.195.191	permit
-130.35.116.0/25	permit
 130.61.9.72	permit
 130.162.39.83	permit
-130.162.194.23	permit
 130.248.172.0/24	permit
 130.248.173.0/24	permit
-131.186.12.0/25	permit
 131.253.30.0/24	permit
 131.253.121.0/26	permit
 132.145.13.209	permit
 132.226.26.225	permit
 132.226.49.32	permit
 132.226.56.24	permit
-134.98.248.128/25	permit
-134.128.64.0/18	permit
+134.128.64.0/19	permit
+134.128.96.0/19	permit
 134.170.27.8	permit
 134.170.113.0/26	permit
 134.170.141.64/26	permit
@@ -1481,10 +1460,6 @@
 136.147.182.0/24	permit
 136.147.224.0/20	permit
 136.179.50.206	permit
-136.248.224.128/25	permit
-136.248.232.128/25	permit
-138.1.108.0/25	permit
-138.1.170.0/24	permit
 139.60.152.0/22	permit
 139.138.35.44	permit
 139.138.46.121	permit
@@ -1493,7 +1468,6 @@
 139.138.57.55	permit
 139.138.58.119	permit
 139.167.79.86	permit
-139.177.108.0/25	permit
 139.180.17.0/24	permit
 140.238.148.191	permit
 141.148.55.217	permit
@@ -1524,14 +1498,14 @@
 146.20.14.105	permit
 146.20.14.106	permit
 146.20.14.107	permit
+146.20.112.0/26	permit
+146.20.113.0/24	permit
+146.20.191.0/24	permit
 146.20.215.0/24	permit
 146.20.215.182	permit
 146.88.28.0/24	permit
 146.148.116.76	permit
 147.154.32.0/25	permit
-147.154.63.0/24	permit
-147.154.126.0/24	permit
-147.154.191.0/24	permit
 147.243.1.47	permit
 147.243.1.48	permit
 147.243.1.153	permit
@@ -1539,23 +1513,16 @@
 147.243.128.26	permit
 148.105.0.0/16	permit
 148.105.8.0/21	permit
-148.116.32.128/25	permit
 149.72.0.0/16	permit
 149.72.234.184	permit
 149.72.248.236	permit
 149.97.173.180	permit
-149.118.160.128/25	permit
 150.136.21.199	permit
-150.171.109.178	permit
 150.230.98.160	permit
 151.145.38.14	permit
 152.67.105.195	permit
-152.69.165.251	permit
 152.69.200.236	permit
 152.70.155.126	permit
-155.248.135.128/25	permit
-155.248.140.0/25	permit
-155.248.148.0/25	permit
 155.248.208.51	permit
 155.248.220.138	permit
 155.248.234.149	permit
@@ -1564,16 +1531,10 @@
 157.58.30.128/25	permit
 157.58.196.96/29	permit
 157.58.249.3	permit
-157.137.32.128/25	permit
-157.137.96.128/25	permit
 157.151.208.65	permit
 157.255.1.64/29	permit
 158.101.211.207	permit
 158.247.16.0/20	permit
-158.247.100.0/25	permit
-159.13.4.0/25	permit
-159.13.33.181	permit
-159.26.176.0/20	permit
 159.92.154.0/24	permit
 159.92.155.0/24	permit
 159.92.157.0/24	permit
@@ -1601,15 +1562,12 @@
 159.183.121.182	permit
 159.183.129.172	permit
 160.1.62.192	permit
-161.33.94.110	permit
-161.33.228.244	permit
 161.38.192.0/20	permit
 161.38.204.0/22	permit
 161.71.32.0/19	permit
 161.71.64.0/20	permit
 162.88.4.0/23	permit
 162.88.8.0/24	permit
-162.88.24.0/23	permit
 162.88.24.0/24	permit
 162.88.25.0/24	permit
 162.88.36.0/24	permit
@@ -1627,13 +1585,11 @@
 164.152.23.32	permit
 164.152.25.241	permit
 164.177.132.168/30	permit
-165.1.100.0/25	permit
 165.173.128.0/24	permit
-165.173.180.0/24	permit
+165.173.180.1	permit
 165.173.180.250/31	permit
-165.173.182.0/24	permit
 165.173.182.250/31	permit
-165.173.189.205	permit
+166.78.68.0/22	permit
 166.78.68.221	permit
 166.78.69.169	permit
 166.78.69.170	permit
@@ -1651,12 +1607,9 @@
 167.89.75.126	permit
 167.89.75.136	permit
 167.89.75.164	permit
+167.89.101.2	permit
+167.89.101.192/28	permit
 167.220.67.232/29	permit
-168.107.248.128/25	permit
-168.110.160.128/25	permit
-168.110.248.128/25	permit
-168.129.184.128/25	permit
-168.129.248.128/25	permit
 168.138.5.36	permit
 168.138.73.51	permit
 168.138.77.31	permit
@@ -1673,7 +1626,6 @@
 169.148.144.0/25	permit
 169.148.144.10	permit
 169.148.146.0/23	permit
-169.148.174.10	permit
 169.148.175.3	permit
 169.148.179.3	permit
 169.148.188.0/24	permit
@@ -1692,7 +1644,6 @@
 173.203.81.39	permit
 173.224.161.128/25	permit
 173.224.165.0/26	permit
-173.224.166.48/28	permit
 174.36.84.8/29	permit
 174.36.84.16/29	permit
 174.36.84.32/29	permit
@@ -1707,8 +1658,6 @@
 175.41.215.51	permit
 176.32.105.0/24	permit
 176.32.127.0/24	permit
-176.94.34.32/27	permit
-176.94.34.64/27	permit
 178.236.10.128/26	permit
 182.50.76.0/22	permit
 182.50.78.64/28	permit
@@ -1790,36 +1739,26 @@
 188.125.85.234/31	permit
 188.125.85.236/31	permit
 188.125.85.238	permit
+188.165.51.139	permit
 188.172.128.0/20	permit
 192.0.64.0/18	permit
-192.9.166.184	permit
 192.18.139.154	permit
 192.18.145.36	permit
 192.18.152.58	permit
-192.22.32.128/25	permit
-192.22.96.128/25	permit
-192.22.160.128/25	permit
-192.22.224.128/25	permit
 192.28.128.0/18	permit
-192.29.24.0/25	permit
-192.29.44.0/25	permit
-192.29.72.0/25	permit
-192.29.88.0/25	permit
 192.29.103.128/25	permit
-192.29.134.0/25	permit
-192.29.151.128/25	permit
-192.29.172.0/25	permit
-192.29.178.0/25	permit
-192.29.200.0/25	permit
-192.29.216.0/25	permit
-192.29.232.0/25	permit
-192.29.248.0/25	permit
 192.30.252.0/22	permit
 192.161.144.0/20	permit
 192.162.87.0/24	permit
+192.237.158.0/23	permit
 192.237.159.42	permit
 192.237.159.43	permit
 192.254.112.0/20	permit
+192.254.112.60	permit
+192.254.112.98/31	permit
+192.254.113.10	permit
+192.254.113.101	permit
+192.254.114.176	permit
 193.109.254.0/23	permit
 193.122.128.100	permit
 193.123.56.63	permit
@@ -1859,6 +1798,7 @@
 198.21.0.0/21	permit
 198.37.144.0/20	permit
 198.37.152.186	permit
+198.61.254.0/23	permit
 198.61.254.21	permit
 198.61.254.231	permit
 198.178.234.57	permit
@@ -1945,7 +1885,6 @@
 204.14.232.0/21	permit
 204.14.232.64/28	permit
 204.14.234.64/28	permit
-204.75.18.128/27	permit
 204.75.142.0/24	permit
 204.92.114.187	permit
 204.92.114.203	permit
@@ -1953,9 +1892,7 @@
 204.141.32.0/23	permit
 204.141.42.0/23	permit
 204.216.164.202	permit
-204.220.90.0/23	permit
-204.220.92.0/22	permit
-204.220.160.0/20	permit
+204.220.160.0/21	permit
 204.220.168.0/21	permit
 204.220.176.0/20	permit
 204.220.181.105	permit
@@ -1990,9 +1927,6 @@
 207.211.30.128/25	permit
 207.211.31.0/25	permit
 207.211.41.113	permit
-207.211.132.0/25	permit
-207.211.147.87	permit
-207.211.159.110	permit
 207.218.90.0/24	permit
 207.218.90.122	permit
 207.250.68.0/24	permit
@@ -2000,8 +1934,6 @@
 208.43.21.28/30	permit
 208.43.21.64/29	permit
 208.43.21.72/30	permit
-208.56.9.224	permit
-208.56.13.196	permit
 208.64.132.0/22	permit
 208.71.40.63	permit
 208.71.40.64/31	permit
@@ -2028,7 +1960,6 @@
 208.71.42.214	permit
 208.72.249.240/29	permit
 208.75.120.0/22	permit
-208.76.62.0/23	permit
 208.76.62.0/24	permit
 208.76.63.0/24	permit
 208.82.237.96/29	permit
@@ -2042,6 +1973,7 @@
 209.43.22.0/28	permit
 209.46.117.168	permit
 209.46.117.179	permit
+209.61.151.0/24	permit
 209.61.151.236	permit
 209.61.151.249	permit
 209.61.151.251	permit
@@ -2188,7 +2120,6 @@
 216.136.168.80/28	permit
 216.139.64.0/19	permit
 216.145.221.0/24	permit
-216.146.32.0/23	permit
 216.146.32.0/24	permit
 216.146.33.0/24	permit
 216.198.0.0/18	permit
@@ -2209,7 +2140,6 @@
 223.165.120.0/23	permit
 2001:0868:0100:0600::/64	permit
 2001:4860:4000::/36	permit
-2001:4860:4864::/56	permit
 2001:748:100:40::2:0/112	permit
 2001:748:400:1300::3	permit
 2001:748:400:1300::4	permit
@@ -2227,13 +2157,10 @@
 2001:748:400:3301::3	permit
 2001:748:400:3301::4	permit
 2404:6800:4000::/36	permit
-2404:6800:4864::/56	permit
-2603:1061:14:1d0::1	permit
 2607:13c0:0001:0000:0000:0000:0000:7000/116	permit
 2607:13c0:0002:0000:0000:0000:0000:1000/116	permit
 2607:13c0:0004:0000:0000:0000:0000:0000/116	permit
 2607:f8b0:4000::/36	permit
-2607:f8b0:4864::/56	permit
 2620:109:c003:104::/64	permit
 2620:109:c003:104::215	permit
 2620:109:c006:104::/64	permit
@@ -2245,7 +2172,8 @@
 2620:10d:c09c:400::8:1	permit
 2620:119:50c0:207::/64	permit
 2620:119:50c0:207::215	permit
+2620:1ec:46::51	permit
+2620:1ec:bdf::51	permit
 2800:3f0:4000::/36	permit
-2800:3f0:4864::/56	permit
 49.12.4.251 permit # checks.mailcow.email
 2a01:4f8:c17:7906::10 permit # checks.mailcow.email

data/conf/rspamd/local.d/metadata_exporter.conf

@@ -3,7 +3,8 @@ rules {
     backend = "http";
     url = "http://nginx:9081/pipe.php";
     selector = "reject_no_global_bl";
-    formatter = "multipart";
+    formatter = "default";
+    meta_headers = true;
   }
 	RLINFO {
 		backend = "http";
@@ -15,7 +16,8 @@ rules {
     backend = "http";
     url = "http://nginx:9081/pushover.php";
     selector = "mailcow_rcpt";
-    formatter = "multipart";
+    formatter = "json";
+    meta_headers = true;
   }
 }
 

data/conf/rspamd/lua/rspamd.local.lua

@@ -856,8 +856,6 @@ rspamd_config:register_symbol({
 
             local seen_cte
             local newline_s = newline(task)
-            -- use the CTE add_text_footer actually applied
-            local new_cte = rewrite.new_cte or 'quoted-printable'
 
             local function rewrite_ct_cb(name, hdr)
               if rewrite.need_rewrite_ct then
@@ -879,13 +877,13 @@ rspamd_config:register_symbol({
                   return
                 elseif name:lower() == 'content-transfer-encoding' then
                   out[#out + 1] = string.format('%s: %s',
-                      'Content-Transfer-Encoding', new_cte)
+                      'Content-Transfer-Encoding', 'quoted-printable')
                   -- update Content-Transfer-Encoding header
                   task:set_milter_reply({
                     remove_headers = {['Content-Transfer-Encoding'] = 0},
                   })
                   task:set_milter_reply({
-                    add_headers = {['Content-Transfer-Encoding'] = new_cte}
+                    add_headers = {['Content-Transfer-Encoding'] = 'quoted-printable'}
                   })
                   seen_cte = true
                   return
@@ -897,7 +895,7 @@ rspamd_config:register_symbol({
             task:headers_foreach(rewrite_ct_cb, {full = true})
 
             if not seen_cte and rewrite.need_rewrite_ct then
-              out[#out + 1] = string.format('%s: %s', 'Content-Transfer-Encoding', new_cte)
+              out[#out + 1] = string.format('%s: %s', 'Content-Transfer-Encoding', 'quoted-printable')
             end
 
             -- End of headers
@@ -916,7 +914,7 @@ rspamd_config:register_symbol({
                 out_parts[#out_parts + 1] = o
                 out_parts[#out_parts + 1] = newline_s
               else
-                local removePrefix = "--\x0D\x0AContent-"
+                local removePrefix = "--\x0D\x0AContent-Type"
                 if string.lower(string.sub(tostring(o[1]), 1, string.len(removePrefix))) == string.lower(removePrefix) then
                   o[1] = string.sub(tostring(o[1]), string.len("--\x0D\x0A") + 1)
                 end

data/conf/rspamd/meta_exporter/pipe.php

@@ -32,42 +32,47 @@ function parse_email($email) {
   $a = strrpos($email, '@');
   return array('local' => substr($email, 0, $a), 'domain' => substr(substr($email, $a), 1));
 }
-// rspamd metadata_exporter (multipart formatter):
-//   - $_POST['metadata']        JSON with the rspamd metadata
-//   - $_FILES['message']        raw RFC822 message
-if (empty($_POST['metadata']) || !isset($_FILES['message']) || $_FILES['message']['error'] !== UPLOAD_ERR_OK) {
-  error_log("QUARANTINE: missing multipart parts from rspamd" . PHP_EOL);
-  http_response_code(400);
-  exit;
+if (!function_exists('getallheaders'))  {
+  function getallheaders() {
+    if (!is_array($_SERVER)) {
+      return array();
+    }
+    $headers = array();
+    foreach ($_SERVER as $name => $value) {
+      if (substr($name, 0, 5) == 'HTTP_') {
+        $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
+      }
+    }
+    return $headers;
+  }
 }
 
-$meta = json_decode($_POST['metadata'], true);
-if (!is_array($meta)) {
-  error_log("QUARANTINE: cannot decode metadata JSON" . PHP_EOL);
-  http_response_code(400);
-  exit;
-}
-
-$raw_data_content = file_get_contents($_FILES['message']['tmp_name']);
+$raw_data_content = file_get_contents('php://input');
 $raw_data = mb_convert_encoding($raw_data_content, 'HTML-ENTITIES', "UTF-8");
-$raw_size = (int)$_FILES['message']['size'];
+$headers = getallheaders();
 
-$qid      = $meta['qid']     ?? 'unknown';
-$subject  = $meta['subject'] ?? '';
-$score    = $meta['score']   ?? 0;
-$rcpts    = $meta['rcpt']    ?? array();
-$user     = $meta['user']    ?? 'unknown';
-$ip       = $meta['ip']      ?? 'unknown';
-$action   = $meta['action']  ?? 'no action';
-$sender   = $meta['from']    ?? '';
-$symbols  = json_encode($meta['symbols'] ?? array());
-$fuzzy    = json_encode(is_array($meta['fuzzy'] ?? null) ? $meta['fuzzy'] : array());
+$qid      = $headers['X-Rspamd-Qid'];
+$fuzzy    = $headers['X-Rspamd-Fuzzy'];
+$subject  = iconv_mime_decode($headers['X-Rspamd-Subject']);
+$score    = $headers['X-Rspamd-Score'];
+$rcpts    = $headers['X-Rspamd-Rcpt'];
+$user     = $headers['X-Rspamd-User'];
+$ip       = $headers['X-Rspamd-Ip'];
+$action   = $headers['X-Rspamd-Action'];
+$sender   = $headers['X-Rspamd-From'];
+$symbols  = $headers['X-Rspamd-Symbols'];
+
+$raw_size = (int)$_SERVER['CONTENT_LENGTH'];
 
 if (empty($sender)) {
   error_log("QUARANTINE: Unknown sender, assuming empty-env-from@localhost" . PHP_EOL);
   $sender = 'empty-env-from@localhost';
 }
 
+if ($fuzzy == 'unknown') {
+  $fuzzy = '[]';
+}
+
 try {
   $max_size = (int)$redis->Get('Q_MAX_SIZE');
   if (($max_size * 1048576) < $raw_size) {
@@ -89,7 +94,7 @@ catch (RedisException $e) {
 $rcpt_final_mailboxes = array();
 
 // Loop through all rcpts
-foreach ($rcpts as $rcpt) {
+foreach (json_decode($rcpts, true) as $rcpt) {
   // Remove tag
   $rcpt = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $rcpt);
 
@@ -153,12 +158,12 @@ foreach ($rcpts as $rcpt) {
 
       // Loop through all found gotos
       foreach ($gotos_array as $index => &$goto) {
-        error_log("RCPT RESOLVER: http pipe: query " . $goto . " as username from mailbox" . PHP_EOL);
+        error_log("RCPT RESOVLER: http pipe: query " . $goto . " as username from mailbox" . PHP_EOL);
         $stmt = $pdo->prepare("SELECT `username` FROM `mailbox` WHERE `username` = :goto AND (`active`= '1' OR `active`= '2');");
         $stmt->execute(array(':goto' => $goto));
         $username = $stmt->fetch(PDO::FETCH_ASSOC)['username'];
         if (!empty($username)) {
-          error_log("RCPT RESOLVER: http pipe: mailbox found: " . $username . PHP_EOL);
+          error_log("RCPT RESOVLER: http pipe: mailbox found: " . $username . PHP_EOL);
           // Current goto is a mailbox, save to rcpt_final_mailboxes if not a duplicate
           if (!in_array($username, $rcpt_final_mailboxes)) {
             $rcpt_final_mailboxes[] = $username;
@@ -167,21 +172,21 @@ foreach ($rcpts as $rcpt) {
         else {
           $parsed_goto = parse_email($goto);
           if (!$redis->hGet('DOMAIN_MAP', $parsed_goto['domain'])) {
-            error_log("RCPT RESOLVER:" . $goto . " is not a mailcow handled mailbox or alias address" . PHP_EOL);
+            error_log("RCPT RESOVLER:" . $goto . " is not a mailcow handled mailbox or alias address" . PHP_EOL);
           }
           else {
             $stmt = $pdo->prepare("SELECT `goto` FROM `alias` WHERE `address` = :goto AND `active` = '1'");
             $stmt->execute(array(':goto' => $goto));
             $goto_branch = $stmt->fetch(PDO::FETCH_ASSOC)['goto'];
             if ($goto_branch) {
-              error_log("RCPT RESOLVER: http pipe: goto address " . $goto . " is an alias branch for " . $goto_branch . PHP_EOL);
+              error_log("RCPT RESOVLER: http pipe: goto address " . $goto . " is an alias branch for " . $goto_branch . PHP_EOL);
               $goto_branch_array = explode(',', $goto_branch);
             } else {
               $stmt = $pdo->prepare("SELECT `target_domain` FROM `alias_domain` WHERE `alias_domain` = :domain AND `active` = '1'");
               $stmt->execute(array(':domain' => $parsed_goto['domain']));
               $goto_branch = $stmt->fetch(PDO::FETCH_ASSOC)['target_domain'];
               if ($goto_branch) {
-                error_log("RCPT RESOLVER: http pipe: goto domain " . $parsed_goto['domain'] . " is a domain alias branch for " . $goto_branch . PHP_EOL);
+                error_log("RCPT RESOVLER: http pipe: goto domain " . $parsed_goto['domain'] . " is a domain alias branch for " . $goto_branch . PHP_EOL);
                 $goto_branch_array = array($parsed_goto['local'] . '@' . $goto_branch);
               }
             }
@@ -203,11 +208,11 @@ foreach ($rcpts as $rcpt) {
       // Force exit if loop cannot be solved
       // Postfix does not allow for alias loops, so this should never happen.
       $loop_c++;
-      error_log("RCPT RESOLVER: http pipe: goto array count on loop #". $loop_c . " is " . count($gotos_array) . PHP_EOL);
+      error_log("RCPT RESOVLER: http pipe: goto array count on loop #". $loop_c . " is " . count($gotos_array) . PHP_EOL);
     }
   }
   catch (PDOException $e) {
-    error_log("RCPT RESOLVER: " . $e->getMessage() . PHP_EOL);
+    error_log("RCPT RESOVLER: " . $e->getMessage() . PHP_EOL);
     http_response_code(502);
     exit;
   }

data/conf/rspamd/meta_exporter/pushover.php

@@ -32,46 +32,50 @@ function parse_email($email) {
   $a = strrpos($email, '@');
   return array('local' => substr($email, 0, $a), 'domain' => substr(substr($email, $a), 1));
 }
-// rspamd metadata_exporter (multipart formatter): metadata JSON arrives as $_POST['metadata'].
-if (empty($_POST['metadata'])) {
-  error_log("NOTIFY: missing metadata part from rspamd" . PHP_EOL);
-  http_response_code(400);
-  exit;
+if (!function_exists('getallheaders'))  {
+  function getallheaders() {
+    if (!is_array($_SERVER)) {
+      return array();
+    }
+    $headers = array();
+    foreach ($_SERVER as $name => $value) {
+      if (substr($name, 0, 5) == 'HTTP_') {
+        $headers[str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($name, 5)))))] = $value;
+      }
+    }
+    return $headers;
+  }
 }
 
-$meta = json_decode($_POST['metadata'], true);
-if (!is_array($meta)) {
-  error_log("NOTIFY: cannot decode metadata JSON" . PHP_EOL);
-  http_response_code(400);
-  exit;
-}
+$headers = getallheaders();
+$json_body = json_decode(file_get_contents('php://input'));
 
-$qid      = $meta['qid']    ?? 'unknown';
-$rcpts    = $meta['rcpt']   ?? array();
-$sender   = $meta['from']   ?? '';
-$ip       = $meta['ip']     ?? 'unknown';
-$subject  = $meta['subject'] ?? '';
-$messageid= $meta['message_id'] ?? '';
+$qid      = $headers['X-Rspamd-Qid'];
+$rcpts    = $headers['X-Rspamd-Rcpt'];
+$sender   = $headers['X-Rspamd-From'];
+$ip       = $headers['X-Rspamd-Ip'];
+$subject  = iconv_mime_decode($headers['X-Rspamd-Subject']);
+$messageid= $json_body->message_id;
 $priority = 0;
 
-$symbols_array = $meta['symbols'] ?? array();
+$symbols_array = json_decode($headers['X-Rspamd-Symbols'], true);
 if (is_array($symbols_array)) {
   foreach ($symbols_array as $symbol) {
-    if (($symbol['name'] ?? null) == 'HAS_X_PRIO_ONE') {
+    if ($symbol['name'] == 'HAS_X_PRIO_ONE') {
       $priority = 1;
       break;
     }
   }
 }
 
-$sender_address = $meta['header_from'][0] ?? '';
+$sender_address = $json_body->header_from[0];
 $sender_name = '-';
 if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $sender_address, $matches)) {
 	$sender_address = $matches['address'];
   $sender_name =  trim($matches['name'], '"\' ');
 }
 
-$to_address = $meta['header_to'][0] ?? '';
+$to_address = $json_body->header_to[0];
 $to_name = '-';
 if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $to_address, $matches)) {
 	$to_address = $matches['address'];
@@ -81,7 +85,7 @@ if (preg_match('/(?<name>.*?)<(?<address>.*?)>/i', $to_address, $matches)) {
 $rcpt_final_mailboxes = array();
 
 // Loop through all rcpts
-foreach ($rcpts as $rcpt) {
+foreach (json_decode($rcpts, true) as $rcpt) {
   // Remove tag
   $rcpt = preg_replace('/^(.*?)\+.*(@.*)$/', '$1$2', $rcpt);
 
@@ -139,12 +143,12 @@ foreach ($rcpts as $rcpt) {
 
       // Loop through all found gotos
       foreach ($gotos_array as $index => &$goto) {
-        error_log("RCPT RESOLVER: http pipe: query " . $goto . " as username from mailbox" . PHP_EOL);
+        error_log("RCPT RESOVLER: http pipe: query " . $goto . " as username from mailbox" . PHP_EOL);
         $stmt = $pdo->prepare("SELECT `username` FROM `mailbox` WHERE `username` = :goto AND (`active`= '1' OR `active`= '2');");
         $stmt->execute(array(':goto' => $goto));
         $username = $stmt->fetch(PDO::FETCH_ASSOC)['username'];
         if (!empty($username)) {
-          error_log("RCPT RESOLVER: http pipe: mailbox found: " . $username . PHP_EOL);
+          error_log("RCPT RESOVLER: http pipe: mailbox found: " . $username . PHP_EOL);
           // Current goto is a mailbox, save to rcpt_final_mailboxes if not a duplicate
           if (!in_array($username, $rcpt_final_mailboxes)) {
             $rcpt_final_mailboxes[] = $username;
@@ -153,21 +157,21 @@ foreach ($rcpts as $rcpt) {
         else {
           $parsed_goto = parse_email($goto);
           if (!$redis->hGet('DOMAIN_MAP', $parsed_goto['domain'])) {
-            error_log("RCPT RESOLVER:" . $goto . " is not a mailcow handled mailbox or alias address" . PHP_EOL);
+            error_log("RCPT RESOVLER:" . $goto . " is not a mailcow handled mailbox or alias address" . PHP_EOL);
           }
           else {
             $stmt = $pdo->prepare("SELECT `goto` FROM `alias` WHERE `address` = :goto AND `active` = '1'");
             $stmt->execute(array(':goto' => $goto));
             $goto_branch = $stmt->fetch(PDO::FETCH_ASSOC)['goto'];
             if ($goto_branch) {
-              error_log("RCPT RESOLVER: http pipe: goto address " . $goto . " is an alias branch for " . $goto_branch . PHP_EOL);
+              error_log("RCPT RESOVLER: http pipe: goto address " . $goto . " is an alias branch for " . $goto_branch . PHP_EOL);
               $goto_branch_array = explode(',', $goto_branch);
             } else {
               $stmt = $pdo->prepare("SELECT `target_domain` FROM `alias_domain` WHERE `alias_domain` = :domain AND `active` = '1'");
               $stmt->execute(array(':domain' => $parsed_goto['domain']));
               $goto_branch = $stmt->fetch(PDO::FETCH_ASSOC)['target_domain'];
               if ($goto_branch) {
-                error_log("RCPT RESOLVER: http pipe: goto domain " . $parsed_goto['domain'] . " is a domain alias branch for " . $goto_branch . PHP_EOL);
+                error_log("RCPT RESOVLER: http pipe: goto domain " . $parsed_goto['domain'] . " is a domain alias branch for " . $goto_branch . PHP_EOL);
                 $goto_branch_array = array($parsed_goto['local'] . '@' . $goto_branch);
               }
             }
@@ -189,11 +193,11 @@ foreach ($rcpts as $rcpt) {
       // Force exit if loop cannot be solved
       // Postfix does not allow for alias loops, so this should never happen.
       $loop_c++;
-      error_log("RCPT RESOLVER: http pipe: goto array count on loop #". $loop_c . " is " . count($gotos_array) . PHP_EOL);
+      error_log("RCPT RESOVLER: http pipe: goto array count on loop #". $loop_c . " is " . count($gotos_array) . PHP_EOL);
     }
   }
   catch (PDOException $e) {
-    error_log("RCPT RESOLVER: " . $e->getMessage() . PHP_EOL);
+    error_log("RCPT RESOVLER: " . $e->getMessage() . PHP_EOL);
     http_response_code(502);
     exit;
   }

data/web/admin/mailbox.php

@@ -9,8 +9,6 @@ $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
 
 
 
-$js_minifier->add('/web/js/site/imapsync.js');
-$js_minifier->add('/web/js/site/groups.js');
 $js_minifier->add('/web/js/site/mailbox.js');
 $js_minifier->add('/web/js/presets/sieveMailbox.js');
 $js_minifier->add('/web/js/site/pwgen.js');
@@ -40,12 +38,10 @@ $template_data = [
   'global_filters' => mailbox('get', 'global_filter_details'),
   'domains' => $domains,
   'mailboxes' => $mailboxes,
-  'mbox_templates' => mailbox('get', 'mailbox_templates'),
   'lang_mailbox' => json_encode($lang['mailbox']),
   'lang_rl' => json_encode($lang['ratelimit']),
   'lang_edit' => json_encode($lang['edit']),
   'lang_datatables' => json_encode($lang['datatables']),
-  'imapsync_redirect_uri' => \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->oauth->redirectUri(),
 ];
 
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/footer.inc.php';

data/web/admin/system.php

@@ -12,7 +12,6 @@ $fido2_data = fido2(array("action" => "get_friendly_names"));
 $js_minifier->add('/web/js/site/admin.js');
 $js_minifier->add('/web/js/presets/rspamd.js');
 $js_minifier->add('/web/js/site/pwgen.js');
-$js_minifier->add('/web/js/site/identity.js');
 
 // all domains
 $domains = mailbox('get', 'domains');
@@ -94,6 +93,10 @@ $template_data = [
   'tfa_id' => @$_SESSION['tfa_id'],
   'fido2_cid' => @$_SESSION['fido2_cid'],
   'fido2_data' => $fido2_data,
+  'api' => [
+    'ro' => admin_api('ro', 'get'),
+    'rw' => admin_api('rw', 'get'),
+  ],
   'dkim_domains' => $dkim_domains,
   'dkim_domains_with_keys' => $dkim_domains_with_keys,
   'dkim_blind_domains' => $dkim_blind_domains,
@@ -112,10 +115,7 @@ $template_data = [
   'logo_dark_specs' => customize('get', 'main_logo_dark_specs'),
   'ip_check' => customize('get', 'ip_check'),
   'custom_login' => customize('get', 'custom_login'),
-  'ui_themes' => customize('get', 'ui_themes'),
-  'ui_theme' => customize('get', 'ui_theme'),
   'password_complexity' => password_complexity('get'),
-  'imapsync_settings' => \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->api->getSettings(),
   'show_rspamd_global_filters' => @$_SESSION['show_rspamd_global_filters'],
   'cors_settings' => $cors_settings,
   'is_https' => isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on',

data/web/css/build/003-bootstrap-select.css

@@ -1,10 +1,10 @@
-/*!
- * Bootstrap-select v1.14.0-beta3 (https://developer.snapappointments.com/bootstrap-select)
- *
- * Copyright 2012-2022 SnapAppointments, LLC
- * Licensed under MIT (https://github.com/snapappointments/bootstrap-select/blob/master/LICENSE)
- */
-
+/*!
+ * Bootstrap-select v1.14.0-beta2 (https://developer.snapappointments.com/bootstrap-select)
+ *
+ * Copyright 2012-2021 SnapAppointments, LLC
+ * Licensed under MIT (https://github.com/snapappointments/bootstrap-select/blob/master/LICENSE)
+ */
+
 @-webkit-keyframes bs-notify-fadeOut {
   0% {
     opacity: 0.9;
@@ -35,7 +35,8 @@ select.selectpicker {
   display: none !important;
 }
 .bootstrap-select {
-  width: 220px;
+  width: 220px \0;
+  /*IE9 and below*/
   vertical-align: middle;
 }
 .bootstrap-select > .dropdown-toggle {

data/web/css/build/013-datatables.css

@@ -17,15 +17,15 @@ table.dataTable>tbody>tr.child ul.dtr-details>li {
 }
 table.dataTable.dtr-inline.collapsed>tbody>tr>td.dtr-control:before:hover, 
 table.dataTable.dtr-inline.collapsed>tbody>tr>th.dtr-control:before:hover {
-    background-color: var(--mc-dtr-hover-bg);
+    background-color: #5e5e5e;
 }
 table.dataTable.dtr-inline.collapsed>tbody>tr>td.dtr-control:before, 
 table.dataTable.dtr-inline.collapsed>tbody>tr>th.dtr-control:before,
 table.dataTable td.dt-control:before {
-    background-color: var(--mc-dtr-bg) !important;
-    border: 1.5px solid var(--mc-dtr-border) !important;
+    background-color: #979797 !important;
+    border: 1.5px solid #616161 !important;
     border-radius: 2px !important;
-    color: var(--mc-dtr-color);
+    color: #fff;
     height: 1em;
     width: 1em;
     line-height: 1.25em;
@@ -37,7 +37,7 @@ table.dataTable td.dt-control:before {
 table.dataTable.dtr-inline.collapsed>tbody>tr.parent>td.dtr-control:before, 
 table.dataTable.dtr-inline.collapsed>tbody>tr.parent>th.dtr-control:before,
 table.dataTable td.dt-control:before {
-    background-color: var(--mc-dtr-active-bg) !important;
+    background-color: #979797 !important;
 }
 table.dataTable.table-striped>tbody>tr>td {
     vertical-align: middle;

data/web/css/build/014-mailcow.css

@@ -34,44 +34,11 @@
        url('/fonts/noto-sans-v12-latin_greek_cyrillic-700italic.woff') format('woff');
 }
 
-/* theme tokens, override in css/themes/<name>/theme.css */
-:root {
-  --mc-font-family: "Noto Sans","Helvetica Neue",Helvetica,Arial,sans-serif;
-  --mc-font-size: 10.5pt;
-  --mc-body-bg: #fbfbfb;
-  --mc-primary: #0F688D;
-  --mc-primary-border: #0d526d;
-  --mc-info: #148DBC;
-  --mc-info-border: #127ea8;
-  --mc-border: #dfdfdf;
-  --mc-surface: #fff;
-  --mc-surface-alt: #f7f7f7;
-  --mc-muted: #959595;
-  --mc-hr: #ccc;
-  --mc-progress-bg: #d5d5d5;
-  --mc-placeholder: rgb(137 137 137);
-  --mc-btn-outline-color: #000000;
-  --mc-btn-outline-border: #cfcfcf;
-  --mc-btn-outline-hover-bg: #f0f0f0;
-  --mc-btn-outline-active-bg: #f0f0f0;
-  --mc-btn-light-active-color: #fff;
-  --mc-btn-light-active-bg: #555;
-  --mc-btn-light-active-border: #4d4d4d;
-  --mc-dtr-bg: #979797;
-  --mc-dtr-border: #616161;
-  --mc-dtr-color: #fff;
-  --mc-dtr-hover-bg: #5e5e5e;
-  --mc-dtr-active-bg: #979797;
-  --mc-login-user: #28b62c;
-  --mc-login-domainadmin: #ffc107;
-  --mc-login-admin: #ff4136;
-}
-
 body {
   min-height: 100vh;
   display: flex;
   flex-direction: column;
-  background-color: var(--mc-body-bg);
+  background-color: #fbfbfb;
 }
 #maxmsgsize { min-width: 80px; }
 #slider1 .slider-selection {
@@ -119,17 +86,17 @@ body {
   max-height: 1000px
 }
 .nav-tabs .nav-link, .nav-tabs .nav-link.disabled, .nav-tabs .nav-link.disabled:hover, .nav-tabs .nav-link.disabled:focus {
-  border-color: var(--mc-border);
+  border-color: #dfdfdf;
 }
 .nav-tabs .nav-link.active, .nav-tabs .nav-item.show .nav-link {
-  border-color: var(--mc-border);
-  border-bottom: 1px solid var(--mc-surface);
+  border-color: #dfdfdf;
+  border-bottom: 1px solid #ffffff;
 }
 .nav-tabs .nav-link:hover, .nav-tabs .nav-link:focus {
-  border-color: var(--mc-border);
+  border-color: #dfdfdf;
 }
 .nav-tabs {
-  border-bottom: 1px solid var(--mc-border);
+  border-bottom: 1px solid #dfdfdf;
 }
 .bi {
   display: inline-block;
@@ -197,13 +164,13 @@ body.modal-open {
   padding-right: inherit !important;
 }
 body {
-  font-family: var(--mc-font-family);
-  font-size: var(--mc-font-size);
+  font-family: "Noto Sans","Helvetica Neue",Helvetica,Arial,sans-serif;
+  font-size: 10.5pt;
   line-height: 1.5;
 }
 html {
-  font-family: var(--mc-font-family);
-  font-size: var(--mc-font-size);
+  font-family: "Noto Sans","Helvetica Neue",Helvetica,Arial,sans-serif;
+  font-size: 10.5pt;
   line-height: 1.5;
 }
 #mailcow-alert {
@@ -239,7 +206,7 @@ legend {
   cursor: not-allowed;
 }
 .overlay {
-  background: var(--mc-surface);
+  background: #fff;
   position: absolute;
   z-index: 10000;
   top: 0; right: 0; bottom: 0; left: 0;
@@ -248,6 +215,9 @@ legend {
 .bootstrap-select.btn-group .no-results {
   display: none;
 }
+.bootstrap-select>.dropdown-toggle.bs-placeholder.btn-secondary {
+  color: rgb(197, 197, 197) !important;
+}
 .haveibeenpwned {
   cursor: pointer;
   -webkit-user-select: none;
@@ -269,7 +239,7 @@ legend {
 .footer {
   margin-top: 27px;
   margin-bottom: 20px;
-  color: var(--mc-muted);
+  color: #959595;
   display: flex;
   flex-direction: column;
 }
@@ -367,7 +337,7 @@ code {
   overflow-x: auto!important;
 }
 .well {
-  border: 1px solid var(--mc-border);
+  border: 1px solid #dfdfdf;
   background-color: #f9f9f9;
   padding: 10px;
 }
@@ -386,47 +356,47 @@ button[aria-expanded='true'] > .caret {
 }
 
 .list-group-details {
-  background: var(--mc-surface);
+  background: #fff;
 }
 .list-group-header {
-  background: var(--mc-surface-alt);
+  background: #f7f7f7;
 }
 
 
 .bg-primary, .alert-primary, .btn-primary {
-  background-color: var(--mc-primary) !important;
-  border-color: var(--mc-primary-border) !important;
+  background-color: #0F688D !important;
+  border-color: #0d526d !important;
 }
 .bg-info, .alert-info, .btn-info {
-  background-color: var(--mc-info) !important;
-  border-color: var(--mc-info-border) !important;
+  background-color: #148DBC !important;
+  border-color: #127ea8 !important;
 }
 
 .bootstrap-select>.dropdown-toggle.bs-placeholder.btn-secondary {
-  color: var(--mc-placeholder) !important;
+  color: rgb(137 137 137)!important;
 }
 
 .progress {
   height: 16px;
-  background-color: var(--mc-progress-bg);
+  background-color: #d5d5d5;
 }
 
 
 .btn-outline-secondary:hover {
-    background-color: var(--mc-btn-outline-hover-bg);
+    background-color: #f0f0f0;
 }
 .btn.btn-outline-secondary {
-  color: var(--mc-btn-outline-color) !important;
-  border-color: var(--mc-btn-outline-border) !important;
+  color: #000000 !important;
+  border-color: #cfcfcf !important;
 }
 .btn-check:checked+.btn-outline-secondary, .btn-check:active+.btn-outline-secondary, .btn-outline-secondary:active, .btn-outline-secondary.active, .btn-outline-secondary.dropdown-toggle.show {
-    background-color: var(--mc-btn-outline-active-bg) !important;
+    background-color: #f0f0f0 !important;
 }
 .btn-check:checked+.btn-light, .btn-check:active+.btn-light, .btn-light:active, .btn-light.active, .show>.btn-light.dropdown-toggle {
-    color: var(--mc-btn-light-active-color);
-    background-color: var(--mc-btn-light-active-bg);
+    color: #fff;
+    background-color: #555;
     background-image: none;
-    border-color: var(--mc-btn-light-active-border);
+    border-color: #4d4d4d;
 }
 .btn-check:checked+.btn-light:focus, .btn-check:active+.btn-light:focus, .btn-light:active:focus, .btn-light.active:focus, .show>.btn-light.dropdown-toggle:focus,
 .btn-check:focus+.btn-light, .btn-light:focus {
@@ -442,26 +412,6 @@ button[aria-expanded='true'] > .caret {
     text-decoration: none;
 }
 
-/* role marker on login pages, header icons differ too (color blindness) */
-.login-card::before {
-  content: "";
-  display: block;
-  height: 5px;
-  background: var(--mc-login-color);
-  border-radius: inherit;
-  border-bottom-left-radius: 0;
-  border-bottom-right-radius: 0;
-}
-.login-user {
-  --mc-login-color: var(--mc-login-user);
-}
-.login-domainadmin {
-  --mc-login-color: var(--mc-login-domainadmin);
-}
-.login-admin {
-  --mc-login-color: var(--mc-login-admin);
-}
-
 .hr-title {
   display: flex;
   align-items: center;
@@ -473,7 +423,7 @@ button[aria-expanded='true'] > .caret {
 .hr-title::after {
   content: "";
   flex: 1;
-  border-bottom: 1px solid var(--mc-hr);
+  border-bottom: 1px solid #ccc;
 }
 
 .hr-title:not(:empty)::before {

data/web/css/themes/mailcow-darkmode.css

@@ -1,103 +1,62 @@
-/* theme tokens, override in css/themes/<name>/dark.css */
-:root {
-    --mc-body-bg: #1c1c1e;
-    --mc-body-color: #f2f2f7;
-    --mc-surface: #2c2c2e;
-    --mc-surface-alt: #282828;
-    --mc-text: #ccc;
-    --mc-text-soft: #bbb;
-    --mc-muted: #8e8e93;
-    --mc-border: #555;
-    --mc-tab-border: #444444;
-    --mc-link: #6fc7e9;
-    --mc-link-hover: #3daedb;
-    --mc-btn-bg: #5e5e5e;
-    --mc-btn-border: #4c4c4e;
-    --mc-input-bg: #424242;
-    --mc-input-color: #e2e2e2;
-    --mc-input-border: #999;
-    --mc-dropdown-bg: #424242;
-    --mc-table-bg: #3a3a3a;
-    --mc-table-stripe: #282828;
-    --mc-table-stripe-row: #424242;
-    --mc-table-hover: #343434;
-    --mc-table-border: #5c5c5c;
-    --mc-progress-bg: #555;
-    --mc-placeholder: #d4d4d4;
-    --mc-btn-outline-color: #e0e0e0;
-    --mc-btn-outline-border: #7a7a7a;
-    --mc-btn-outline-hover-bg: #5c5c5c;
-    --mc-btn-outline-active-bg: #7a7a7a;
-    --mc-btn-light-active-color: #f2f2f7;
-    --mc-btn-light-active-bg: #242424;
-    --mc-btn-light-active-border: #1c1c1e;
-    --mc-btn-dark-bg: #242424;
-    --mc-input-disabled-bg: #6e6e6e;
-    --mc-input-disabled-color: #a8a8a8;
-    --mc-list-header-bg: #444;
-    --mc-list-details-bg: #555;
-    --mc-chip-bg: #444;
-    --mc-table-child-bg: #414141;
-    --mc-dtr-bg: #7a7a7a;
-    --mc-dtr-border: #5c5c5c;
-    --mc-dtr-color: #e0e0e0;
-    --mc-dtr-hover-bg: #7a7a7a;
-    --mc-dtr-active-bg: #949494;
-}
-
 body {
-    background-color: var(--mc-body-bg);
-    color: var(--mc-body-color);
+    background-color: #1c1c1e;
+    color: #f2f2f7;
 }
 
 .card {
-    border: 1px solid var(--mc-surface);
-    background-color: var(--mc-surface);
+    border: 1px solid #2c2c2e;
+    background-color: #2c2c2e;
 }
 
 legend {
-    color: var(--mc-body-color);
+    color: #f2f2f7;
 }
 
 .card-header {
-    color: var(--mc-muted);
-    background-color: var(--mc-body-bg);
+    color: #8e8e93;
+    background-color: #1c1c1e;
     border-color: transparent;
 }
 
 .card-body {
-    --bs-card-color: var(--mc-text-soft);
+    --bs-card-color: #bbb;
 }
 
 .btn-secondary, .paginate_button, .page-link, .btn-light {
-    color: var(--mc-body-color) !important;
-    background-color: var(--mc-btn-bg) !important;
-    border-color: var(--mc-btn-border) !important;
+    color: #f2f2f7 !important;
+    background-color: #5e5e5e !important;
+    border-color: #4c4c4e !important;
 }
 
 .btn-dark {
-    color: var(--mc-body-color) !important;
-    background-color: var(--mc-btn-dark-bg) !important;
-    border-color: var(--mc-body-bg) !important;
+    color: #f2f2f7 !important;
+    background-color: #242424 !important;
+    border-color: #1c1c1e !important;
+}
+
+.btn-secondary:focus, .btn-secondary:hover, .btn-group.open .dropdown-toggle.btn-secondary {
+    background-color: #444444;
+    border-color: #4c4c4e !important;
+    color: #f2f2f7;
 }
 
 .btn-check:checked+.btn-secondary, .btn-check:active+.btn-secondary, .btn-secondary:active, .btn-secondary.active, .show>.btn-secondary.dropdown-toggle {
-    border-color: var(--mc-btn-bg) !important;
+    border-color: #5e5e5e !important;
 }
 
 .alert-secondary {
-    color: var(--mc-body-color) !important;
-    background-color: var(--mc-btn-bg) !important;
-    border-color: var(--mc-btn-border) !important;
+    color: #f2f2f7 !important;
+    background-color: #5e5e5e !important;
+    border-color: #4c4c4e !important;
 }
 
 .bg-secondary {
-    color: var(--mc-body-color) !important;
-    background-color: var(--mc-btn-bg) !important;
+    color: #f2f2f7 !important;
+    background-color: #5e5e5e !important;
 }
 
 .alert-secondary, .alert-secondary a, .alert-secondary .alert-link {
-    color: var(--mc-body-color);
+    color: #f2f2f7;
 }
 
 .page-item.active .page-link {
@@ -106,18 +65,18 @@ legend {
 }
 
 .btn-secondary:focus, .btn-secondary:hover, .btn-group.open .dropdown-toggle.btn-secondary {
-    background-color: var(--mc-btn-bg);
-    border-color: var(--mc-btn-border) !important;
-    color: var(--mc-body-color);
+    background-color: #5e5e5e;
+    border-color: #4c4c4e !important;
+    color: #f2f2f7;
 }
 
 .btn-secondary:disabled, .btn-secondary.disabled {
-    border-color: var(--mc-btn-bg) !important;
+    border-color: #5e5e5e !important;
 }
 
 .modal-content {
-    --bs-modal-color: var(--mc-text-soft);
-    background-color: var(--mc-surface);
+    --bs-modal-color: #bbb;
+    background-color: #2c2c2e;
 }
 
 .modal-header {
@@ -125,7 +84,7 @@ legend {
 }
 
 .modal-title {
-    color: var(--mc-text-soft);
+    color: #bbb;
 }
 
 .modal .btn-close {
@@ -133,12 +92,12 @@ legend {
 }
 
 .navbar.bg-light {
-    background-color: var(--mc-body-bg) !important;
-    border-color: var(--mc-surface);
+    background-color: #1c1c1e !important;
+    border-color: #2c2c2e;
 }
 
 .nav-link {
-    color: var(--mc-muted) !important;
+    color: #8e8e93 !important;
 }
 
 .nav-tabs .nav-link.active, .nav-tabs .nav-item.show .nav-link {
@@ -146,23 +105,23 @@ legend {
 }
 
 .nav-tabs, .nav-tabs .nav-link {
-    border-color: var(--mc-tab-border) !important;
+    border-color: #444444 !important;
 }
 
 .nav-tabs .nav-link:not(.disabled):hover, .nav-tabs .nav-link:not(.disabled):focus, .nav-tabs .nav-link.active {
-    border-bottom-color: var(--mc-body-bg) !important;
+    border-bottom-color: #1c1c1e !important;
 }
 
 .card .nav-tabs .nav-link:not(.disabled):hover, .card .nav-tabs .nav-link:not(.disabled):focus, .card .nav-tabs .nav-link.active {
-    border-bottom-color: var(--mc-surface) !important;
+    border-bottom-color: #2c2c2e !important;
 }
 
 .table, .table-striped>tbody>tr:nth-of-type(odd)>*, tbody tr {
-    color: var(--mc-body-color) !important;
+    color: #f2f2f7 !important;
 }
 
 .dropdown-menu {
-    background-color: var(--mc-dropdown-bg);
+    background-color: #424242;
     border: 1px solid #282828;
 }
 .dropdown-menu>li>a:focus, .dropdown-menu>li>a:hover {
@@ -173,79 +132,79 @@ legend {
     color: #fff;
 }
 .bootstrap-select>.dropdown-toggle.bs-placeholder, .bootstrap-select>.dropdown-toggle.bs-placeholder.btn-secondary {
-    color: var(--mc-placeholder) !important;
+    color: #d4d4d4 !important;
 }
 tbody tr {
-    color: var(--mc-text);
+    color: #ccc;
 }
 .navbar-default .navbar-nav>.open>a, .navbar-default .navbar-nav>.open>a:focus, .navbar-default .navbar-nav>.open>a:hover {
-    color: var(--mc-text);
+    color: #ccc;
 }
 .navbar-default .navbar-nav>.active>a, .navbar-default .navbar-nav>.active>a:focus, .navbar-default .navbar-nav>.active>a:hover {
-    color: var(--mc-text);
+    color: #ccc;
 }
 .list-group-item {
-    background-color: var(--mc-surface-alt);
-    border: 1px solid var(--mc-border);
+    background-color: #282828;
+    border: 1px solid #555;
 }
 .table-striped>tbody>tr:nth-of-type(odd) {
-    background-color: var(--mc-table-stripe-row);
+    background-color: #424242;
 }
 table.dataTable>tbody>tr.child ul.dtr-details>li {
     border-bottom: 1px solid rgba(255, 255, 255, 0.13);
 }
 .label.label-last-login {
-    color: var(--mc-text) !important;
+    color: #ccc !important;
     background-color: #555 !important;
 }
 .progress {
-    background-color: var(--mc-progress-bg);
+    background-color: #555;
 }
 .h1, .h2, .h3, .h4, .h5, .h6, h1, h2, h3, h4, h5, h6 {
-    color: var(--mc-text);
+    color: #ccc;
 }
 div.numberedtextarea-number {
     color: #999;
 }
 .well {
-    border: 1px solid var(--mc-border);
-    background-color: var(--mc-surface-alt);
+    border: 1px solid #555;
+    background-color: #282828;
 }
 pre {
-    color: var(--mc-text);
-    background-color: var(--mc-surface-alt);
-    border: 1px solid var(--mc-border);
+    color: #ccc;
+    background-color: #282828;
+    border: 1px solid #555;
 }
 .form-control {
     background-color: transparent;
 }
 input.form-control, textarea.form-control {
-    color: var(--mc-input-color) !important;
-    background-color: var(--mc-input-bg) !important;
-    border: 1px solid var(--mc-input-border);
+    color: #e2e2e2 !important;
+    background-color: #424242 !important;
+    border: 1px solid #999;
 }
 input.form-control:focus, textarea.form-control {
-    background-color: var(--mc-input-bg) !important;
+    background-color: #424242 !important;
 }
 input.form-control:disabled, textarea.form-disabled {
-    color: var(--mc-input-disabled-color) !important;
-    background-color: var(--mc-input-disabled-bg) !important;
+    color: #a8a8a8 !important;
+    background-color: #6e6e6e !important;
 }
 .input-group-addon {
-    color: var(--mc-text);
-    background-color: var(--mc-input-bg) !important;
-    border: 1px solid var(--mc-input-border);
+    color: #ccc;
+    background-color: #424242 !important;
+    border: 1px solid #999;
 }
 .input-group-text {
-    color: var(--mc-text);
+    color: #ccc;
     background-color: #1c1c1c;
 }
 
 .list-group-item {
-    color: var(--mc-text);
+    color: #ccc;
 }
 .dropdown-item {
-    color: var(--mc-text);
+    color: #ccc;
 }
 .dropdown-item:hover {
     color: #616161 !important;
@@ -255,9 +214,9 @@ input.form-control:disabled, textarea.form-disabled {
     background-color: #007aff;
 }
 .form-select {
-    color: var(--mc-input-color)!important;
-    background-color: var(--mc-input-bg)!important;
-    border: 1px solid var(--mc-input-border);
+    color: #e2e2e2!important;
+    background-color: #424242!important;
+    border: 1px solid #999;
 }
 
 .responsive-tabs .card-header button[data-bs-toggle="collapse"] {
@@ -281,15 +240,15 @@ input.form-control:disabled, textarea.form-disabled {
 
 
 a {
-    color: var(--mc-link);
+    color: #6fc7e9;
     text-decoration: underline;
 }
 a:hover {
-    color: var(--mc-link-hover);
+    color: #3daedb;
 }
 
 .breadcrumb-item.active {
-    color: var(--mc-text);
+    color: #ccc;
 }
 
 
@@ -314,11 +273,11 @@ a:hover {
     background-color: #3a3a3a;
 }
 .accordion-button {
-    color: var(--mc-text-soft);
+    color: #bbb;
     background-color: #2c2c2c;
 }
 .accordion-button:not(.collapsed) {
-    color: var(--mc-link);
+    color: #6fc7e9;
     background-color: #2c2c2c;
 }
 .accordion-button::after {
@@ -341,15 +300,15 @@ a:hover {
 }
 
 .tag-box {
-    background-color: var(--mc-surface-alt);
-    border: 1px solid var(--mc-border);
+    background-color: #282828;
+    border: 1px solid #555;
 }
 .tag-input {
     color: #fff;
-    background-color: var(--mc-surface-alt);
+    background-color: #282828;
 }
 .tag-add {
-    color: var(--mc-text);
+    color: #ccc;
 }
 .tag-add:hover {
     color: #d1d1d1;
@@ -359,19 +318,19 @@ a:hover {
   color: #fff;
 }
 .btn-outline-secondary:hover {
-    background-color: var(--mc-btn-outline-hover-bg);
+    background-color: #5c5c5c;
 }
 .btn.btn-outline-secondary {
-  color: var(--mc-btn-outline-color) !important;
-  border-color: var(--mc-btn-outline-border) !important;
+  color: #e0e0e0 !important;
+  border-color: #7a7a7a !important;
 }
 .btn-check:checked+.btn-outline-secondary, .btn-check:active+.btn-outline-secondary, .btn-outline-secondary:active, .btn-outline-secondary.active, .btn-outline-secondary.dropdown-toggle.show {
-    background-color: var(--mc-btn-outline-active-bg) !important;
+    background-color: #7a7a7a !important;
 }
 .btn-check:checked+.btn-light, .btn-check:active+.btn-light, .btn-light:active, .btn-light.active, .show>.btn-light.dropdown-toggle {
-    color: var(--mc-btn-light-active-color) !important;
-    background-color: var(--mc-btn-light-active-bg) !important;
-    border-color: var(--mc-btn-light-active-border) !important;
+    color: #f2f2f7 !important;
+    background-color: #242424 !important;
+    border-color: #1c1c1e !important;
 }
 .btn-input-missing,
 .btn-input-missing:hover,
@@ -389,16 +348,16 @@ a:hover {
 }
 
 .list-group-details {
-    background: var(--mc-list-details-bg);
+    background: #555;
 }
 .list-group-header {
-    background: var(--mc-list-header-bg);
+    background: #444;
 }
 
 span.mail-address-item {
-    background-color: var(--mc-chip-bg);
+    background-color: #444;
     border-radius: 4px;
-    border: 1px solid var(--mc-border);
+    border: 1px solid #555;
     padding: 2px 7px;
     display: inline-block;
     margin: 2px 6px 2px 0;
@@ -406,52 +365,52 @@ span.mail-address-item {
 
 table.dataTable.dtr-inline.collapsed>tbody>tr>td.dtr-control:before:hover,
 table.dataTable.dtr-inline.collapsed>tbody>tr>th.dtr-control:before:hover {
-  background-color: var(--mc-dtr-hover-bg) !important;
+  background-color: #7a7a7a !important;
 }
 
 table.dataTable.dtr-inline.collapsed>tbody>tr>td.dtr-control:before,
 table.dataTable.dtr-inline.collapsed>tbody>tr>th.dtr-control:before {
-  background-color: var(--mc-dtr-bg) !important;
-  border: 1.5px solid var(--mc-dtr-border) !important;
-  color: var(--mc-dtr-color) !important;
+  background-color: #7a7a7a !important;
+  border: 1.5px solid #5c5c5c !important;
+  color: #e0e0e0 !important;
 }
 
 table.dataTable.dtr-inline.collapsed>tbody>tr.parent>td.dtr-control:before,
 table.dataTable.dtr-inline.collapsed>tbody>tr.parent>th.dtr-control:before {
-  background-color: var(--mc-dtr-active-bg);
+  background-color: #949494;
 }
 
 table.dataTable.dtr-inline.collapsed>tbody>tr>td.child,
 table.dataTable.dtr-inline.collapsed>tbody>tr>th.child,
 table.dataTable.dtr-inline.collapsed>tbody>tr>td.dataTables_empty {
-  background-color: var(--mc-table-child-bg);
+  background-color: #414141;
 }
 
 table.table, .table-striped>tbody>tr:nth-of-type(odd)>*, tbody tr {
-    color: var(--mc-text) !important;
+    color: #ccc !important;
 }
 
 .table-secondary {
     --bs-table-bg: #282828;
     --bs-table-striped-bg: #343434;
-    --bs-table-striped-color: var(--mc-body-color);
+    --bs-table-striped-color: #f2f2f7;
     --bs-table-active-bg: #4c4c4c;
-    --bs-table-active-color: var(--mc-body-color);
+    --bs-table-active-color: #f2f2f7;
     --bs-table-hover-bg: #3a3a3a;
-    --bs-table-hover-color: var(--mc-body-color);
-    color: var(--mc-text);
+    --bs-table-hover-color: #f2f2f7;
+    color: #ccc;
     border-color: #3a3a3a;
 }
 
 .table-light {
     --bs-table-bg: #3a3a3a;
     --bs-table-striped-bg: #444444;
-    --bs-table-striped-color: var(--mc-body-color);
+    --bs-table-striped-color: #f2f2f7;
     --bs-table-active-bg: #5c5c5c;
-    --bs-table-active-color: var(--mc-body-color);
+    --bs-table-active-color: #f2f2f7;
     --bs-table-hover-bg: #4c4c4c;
-    --bs-table-hover-color: var(--mc-body-color);
-    color: var(--mc-text);
+    --bs-table-hover-color: #f2f2f7;
+    color: #ccc;
     border-color: #4c4c4c;
 }
 
@@ -471,23 +430,23 @@ table.table, .table-striped>tbody>tr:nth-of-type(odd)>*, tbody tr {
 
 .table-striped>tbody>tr:nth-of-type(odd)>td,
 .table-striped>tbody>tr:nth-of-type(odd)>th {
-    background-color: var(--mc-table-stripe);
+    background-color: #282828;
 }
 
 .table-hover>tbody>tr:hover {
-    background-color: var(--mc-table-hover);
+    background-color: #343434;
 }
 
 .table>:not(caption)>*>* {
-    border-color: var(--mc-table-border);
-    --bs-table-color-state:var(--mc-text-soft);
-    --bs-table-bg: var(--mc-table-bg);
+    border-color: #5c5c5c;
+    --bs-table-color-state:#bbb;
+    --bs-table-bg: #3a3a3a;
 }
 .text-muted {
-    --bs-secondary-color: var(--mc-muted);
+    --bs-secondary-color: #8e8e93;
 }
 input::placeholder {
-    color: var(--mc-muted) !important;
+    color: #8e8e93 !important;
 }
 
 .form-select {

data/web/css/themes/servercow/dark.css

@@ -1,212 +0,0 @@
-/* servercow theme, dark mode, bundled after mailcow core dark mode */
-
-:root {
-  --sc-brown-hover: #806b55;
-  --sc-brown-active: #8a745c;
-  --sc-brown-soft: rgba(201, 180, 154, .18);
-  --sc-brown-tint: rgba(201, 180, 154, .08);
-  --sc-link: #c9b49a;
-  --sc-danger-text: #ff8a8a;
-  --sc-ink: #ece7e1;
-  --sc-muted: #a89f94;
-  --sc-placeholder: #8a8177;
-  --sc-bg: #171513;
-  --sc-surface: #211e1b;
-  --sc-cap: #2a2622;
-  --sc-addon: #2a2622;
-  --sc-line: #463f38;
-  --sc-divider: #34302b;
-  --sc-cap-line: #3d3732;
-  --sc-stripe: rgba(255, 255, 255, .025);
-  --sc-hover: rgba(201, 180, 154, .08);
-  --sc-focus-border: #8a7864;
-  --sc-focus: rgba(201, 180, 154, .25);
-  --sc-shadow: 0 0 10px 0 rgba(0, 0, 0, .5);
-  --bs-body-color: #ece7e1;
-  --bs-body-bg: #171513;
-  /* core dark tokens, see css/themes/mailcow-darkmode.css */
-  --mc-body-bg: var(--sc-bg);
-  --mc-body-color: var(--sc-ink);
-  --mc-surface: var(--sc-surface);
-  --mc-surface-alt: var(--sc-cap);
-  --mc-text: var(--sc-ink);
-  --mc-text-soft: var(--sc-ink);
-  --mc-muted: var(--sc-muted);
-  --mc-border: var(--sc-divider);
-  --mc-tab-border: var(--sc-divider);
-  --mc-link: var(--sc-link);
-  --mc-link-hover: #e0cfba;
-  --mc-btn-bg: var(--sc-cap);
-  --mc-btn-border: var(--sc-line);
-  --mc-input-bg: var(--sc-bg);
-  --mc-input-color: var(--sc-ink);
-  --mc-input-border: var(--sc-line);
-  --mc-dropdown-bg: var(--sc-surface);
-  --mc-table-bg: transparent;
-  --mc-table-stripe: var(--sc-stripe);
-  --mc-table-stripe-row: transparent;
-  --mc-table-hover: var(--sc-hover);
-  --mc-table-border: var(--sc-divider);
-  --mc-progress-bg: var(--sc-cap);
-  --mc-placeholder: var(--sc-placeholder);
-  --mc-hr: var(--sc-divider);
-  --mc-btn-outline-color: var(--sc-ink);
-  --mc-btn-outline-border: var(--sc-line);
-  --mc-btn-outline-hover-bg: var(--sc-brown-tint);
-  --mc-btn-outline-active-bg: var(--sc-brown);
-  --mc-btn-light-active-color: #fff;
-  --mc-btn-light-active-bg: var(--sc-brown);
-  --mc-btn-light-active-border: var(--sc-brown);
-  --mc-btn-dark-bg: var(--sc-brown);
-  --mc-input-disabled-bg: var(--sc-cap);
-  --mc-input-disabled-color: var(--sc-muted);
-  --mc-list-header-bg: var(--sc-cap);
-  --mc-list-details-bg: var(--sc-surface);
-  --mc-chip-bg: var(--sc-cap);
-  --mc-table-child-bg: var(--sc-surface);
-  --mc-dtr-bg: var(--sc-cap);
-  --mc-dtr-border: var(--sc-line);
-  --mc-dtr-color: var(--sc-link);
-  --mc-dtr-hover-bg: var(--sc-hover);
-  --mc-dtr-active-bg: var(--sc-brown-soft);
-}
-
-/* navbar */
-.navbar.bg-light {
-  background-color: var(--sc-surface) !important;
-  border-bottom-color: var(--sc-green);
-}
-.navbar-light .navbar-nav .nav-link {
-  color: var(--sc-ink) !important;
-}
-.navbar-light .navbar-nav .nav-link:hover,
-.navbar-light .navbar-nav .nav-link:focus,
-.navbar-light .navbar-nav .nav-link.active,
-.navbar-light .navbar-nav .show > .nav-link {
-  color: var(--sc-link) !important;
-}
-.dropdown-menu {
-  border-color: var(--sc-cap-line);
-}
-.dropdown-item:hover, .dropdown-item:focus {
-  color: var(--sc-link) !important;
-}
-
-/* cards and modals */
-.card-header {
-  color: var(--sc-ink);
-  background-color: var(--sc-cap);
-  border-color: var(--sc-cap-line);
-}
-.modal-content {
-  background-color: var(--sc-surface);
-}
-.modal-header {
-  border-color: var(--sc-cap-line);
-}
-.input-group-text {
-  background-color: var(--sc-addon);
-}
-.form-control::file-selector-button {
-  color: var(--sc-ink);
-  background-color: var(--sc-cap);
-  border-color: var(--sc-line);
-}
-.form-control:hover:not(:disabled):not([readonly])::file-selector-button {
-  color: var(--sc-link);
-  background-color: var(--sc-line);
-}
-.form-check-input:not(:checked) {
-  background-color: var(--sc-bg);
-  border-color: var(--sc-line);
-}
-kbd {
-  color: var(--sc-ink);
-  background-color: var(--sc-cap);
-}
-
-/* buttons */
-.btn-secondary:hover, .btn-secondary:focus, .btn-light:hover, .btn-light:focus, .page-link:hover {
-  color: var(--sc-link) !important;
-  background-color: var(--sc-line) !important;
-}
-.btn-check:checked + .btn-secondary, .btn-secondary.active, .show > .btn-secondary.dropdown-toggle,
-.page-item.active .page-link {
-  color: #fff !important;
-  background-color: var(--sc-brown) !important;
-  border-color: var(--sc-brown) !important;
-}
-
-/* tabs */
-.nav-tabs .nav-link {
-  color: var(--sc-ink) !important;
-  border-bottom-color: transparent !important;
-}
-.nav-tabs .nav-link:not(.disabled):hover, .nav-tabs .nav-link:not(.disabled):focus,
-.card .nav-tabs .nav-link:not(.disabled):hover, .card .nav-tabs .nav-link:not(.disabled):focus {
-  color: var(--sc-link) !important;
-  border-bottom-color: transparent !important;
-}
-.nav-tabs .nav-link.active, .card .nav-tabs .nav-link.active {
-  color: var(--sc-link) !important;
-  border-bottom-color: var(--sc-link) !important;
-}
-
-/* semantic text */
-.text-success {
-  color: var(--sc-green) !important;
-}
-.text-warning {
-  color: var(--sc-warning) !important;
-}
-
-/* alerts, opaque dark tints (also used for floating notifications) */
-.alert-primary {
-  color: #e6d9c9 !important;
-  background-color: #3c342b !important;
-  border-color: #5e4f3e !important;
-}
-.alert-info {
-  color: #cfe9f6 !important;
-  background-color: #2f3334 !important;
-  border-color: #44535a !important;
-}
-.alert-success {
-  color: #cdeea0;
-  background-color: #2e3419;
-  border-color: #405515;
-}
-.alert-danger {
-  color: #f9c4c4;
-  background-color: #402a28;
-  border-color: #693a38;
-}
-.alert-warning {
-  color: #f5d496;
-  background-color: #3c2f19;
-  border-color: #654815;
-}
-.alert-secondary, .alert-light {
-  color: var(--sc-ink) !important;
-  background-color: var(--sc-cap) !important;
-  border-color: var(--sc-divider) !important;
-}
-
-.alert .btn-close {
-  filter: invert(1) grayscale(100%) brightness(200%);
-}
-
-/* slider */
-.noUi-target {
-  background: var(--sc-bg);
-  border-color: var(--sc-line);
-  box-shadow: none;
-}
-.noUi-handle {
-  background: var(--sc-cap);
-  border-color: var(--sc-line);
-  box-shadow: none;
-}
-.noUi-handle::before, .noUi-handle::after {
-  background: var(--sc-line);
-}

data/web/css/themes/servercow/fonts/LICENSE-RobotoSlab.txt

@@ -1,202 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

data/web/css/themes/servercow/fonts/OFL-Poppins.txt

@@ -1,93 +0,0 @@
-Copyright 2020 The Poppins Project Authors (https://github.com/itfoundry/Poppins)
-
-This Font Software is licensed under the SIL Open Font License, Version 1.1.
-This license is copied below, and is also available with a FAQ at:
-http://scripts.sil.org/OFL
-
-
------------------------------------------------------------
-SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
------------------------------------------------------------
-
-PREAMBLE
-The goals of the Open Font License (OFL) are to stimulate worldwide
-development of collaborative font projects, to support the font creation
-efforts of academic and linguistic communities, and to provide a free and
-open framework in which fonts may be shared and improved in partnership
-with others.
-
-The OFL allows the licensed fonts to be used, studied, modified and
-redistributed freely as long as they are not sold by themselves. The
-fonts, including any derivative works, can be bundled, embedded, 
-redistributed and/or sold with any software provided that any reserved
-names are not used by derivative works. The fonts and derivatives,
-however, cannot be released under any other type of license. The
-requirement for fonts to remain under this license does not apply
-to any document created using the fonts or their derivatives.
-
-DEFINITIONS
-"Font Software" refers to the set of files released by the Copyright
-Holder(s) under this license and clearly marked as such. This may
-include source files, build scripts and documentation.
-
-"Reserved Font Name" refers to any names specified as such after the
-copyright statement(s).
-
-"Original Version" refers to the collection of Font Software components as
-distributed by the Copyright Holder(s).
-
-"Modified Version" refers to any derivative made by adding to, deleting,
-or substituting -- in part or in whole -- any of the components of the
-Original Version, by changing formats or by porting the Font Software to a
-new environment.
-
-"Author" refers to any designer, engineer, programmer, technical
-writer or other person who contributed to the Font Software.
-
-PERMISSION & CONDITIONS
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of the Font Software, to use, study, copy, merge, embed, modify,
-redistribute, and sell modified and unmodified copies of the Font
-Software, subject to the following conditions:
-
-1) Neither the Font Software nor any of its individual components,
-in Original or Modified Versions, may be sold by itself.
-
-2) Original or Modified Versions of the Font Software may be bundled,
-redistributed and/or sold with any software, provided that each copy
-contains the above copyright notice and this license. These can be
-included either as stand-alone text files, human-readable headers or
-in the appropriate machine-readable metadata fields within text or
-binary files as long as those fields can be easily viewed by the user.
-
-3) No Modified Version of the Font Software may use the Reserved Font
-Name(s) unless explicit written permission is granted by the corresponding
-Copyright Holder. This restriction only applies to the primary font name as
-presented to the users.
-
-4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
-Software shall not be used to promote, endorse or advertise any
-Modified Version, except to acknowledge the contribution(s) of the
-Copyright Holder(s) and the Author(s) or with their explicit written
-permission.
-
-5) The Font Software, modified or unmodified, in part or in whole,
-must be distributed entirely under this license, and must not be
-distributed under any other license. The requirement for fonts to
-remain under this license does not apply to any document created
-using the Font Software.
-
-TERMINATION
-This license becomes null and void if any of the above conditions are
-not met.
-
-DISCLAIMER
-THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
-OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
-COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
-DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
-OTHER DEALINGS IN THE FONT SOFTWARE.

data/web/css/themes/servercow/theme.css

@@ -1,584 +0,0 @@
-/* servercow theme for mailcow, based on the servercow customer portal */
-
-@font-face {
-  font-family: 'Poppins';
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: local(''),
-       url('/css/themes/servercow/fonts/poppins-v24-latin_latin-ext-regular.woff2') format('woff2'),
-       url('/css/themes/servercow/fonts/poppins-v24-latin_latin-ext-regular.woff') format('woff');
-}
-@font-face {
-  font-family: 'Poppins';
-  font-style: italic;
-  font-weight: 400;
-  font-display: swap;
-  src: local(''),
-       url('/css/themes/servercow/fonts/poppins-v24-latin_latin-ext-italic.woff2') format('woff2'),
-       url('/css/themes/servercow/fonts/poppins-v24-latin_latin-ext-italic.woff') format('woff');
-}
-@font-face {
-  font-family: 'Poppins';
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: local(''),
-       url('/css/themes/servercow/fonts/poppins-v24-latin_latin-ext-500.woff2') format('woff2'),
-       url('/css/themes/servercow/fonts/poppins-v24-latin_latin-ext-500.woff') format('woff');
-}
-@font-face {
-  font-family: 'Poppins';
-  font-style: normal;
-  font-weight: 600;
-  font-display: swap;
-  src: local(''),
-       url('/css/themes/servercow/fonts/poppins-v24-latin_latin-ext-600.woff2') format('woff2'),
-       url('/css/themes/servercow/fonts/poppins-v24-latin_latin-ext-600.woff') format('woff');
-}
-@font-face {
-  font-family: 'Roboto Slab';
-  font-style: normal;
-  font-weight: 400;
-  font-display: swap;
-  src: local(''),
-       url('/css/themes/servercow/fonts/roboto-slab-v36-cyrillic_greek_latin-regular.woff2') format('woff2'),
-       url('/css/themes/servercow/fonts/roboto-slab-v36-cyrillic_greek_latin-regular.woff') format('woff');
-}
-@font-face {
-  font-family: 'Roboto Slab';
-  font-style: normal;
-  font-weight: 500;
-  font-display: swap;
-  src: local(''),
-       url('/css/themes/servercow/fonts/roboto-slab-v36-cyrillic_greek_latin-500.woff2') format('woff2'),
-       url('/css/themes/servercow/fonts/roboto-slab-v36-cyrillic_greek_latin-500.woff') format('woff');
-}
-
-/* tokens */
-:root {
-  --sc-brown: #6F5D49;
-  --sc-brown-hover: #5e4f3e;
-  --sc-brown-active: #594a3a;
-  --sc-brown-soft: rgba(111, 93, 73, .2);
-  --sc-brown-tint: rgba(111, 93, 73, .08);
-  --sc-link: #6F5D49;
-  --sc-green: #8AD608;
-  --sc-blue: #96D0EC;
-  --sc-warning: #e3950b;
-  --sc-danger: #ef6f6f;
-  --sc-danger-hover: #e85e5e;
-  --sc-danger-text: #c43c3c;
-  --sc-ink: #212529;
-  --sc-muted: #6c757d;
-  --sc-placeholder: #6c757d;
-  --sc-bg: #F6F8F8;
-  --sc-surface: #ffffff;
-  --sc-cap: #f7f7f7;
-  --sc-addon: #e9ecef;
-  --sc-line: #ced4da;
-  --sc-divider: #dee2e6;
-  --sc-cap-line: rgba(0, 0, 0, .175);
-  --sc-stripe: rgba(111, 93, 73, .04);
-  --sc-hover: rgba(111, 93, 73, .08);
-  --sc-focus-border: #b7aea4;
-  --sc-focus: rgba(111, 93, 73, .25);
-  --sc-shadow: 0 0 10px 0 rgba(134, 134, 134, .3);
-  --sc-font: 'Poppins', system-ui, -apple-system, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;
-  --sc-font-head: 'Roboto Slab', Georgia, serif;
-  --bs-body-color: #212529;
-  --bs-body-bg: #F6F8F8;
-  --bs-body-font-family: var(--sc-font);
-  /* core tokens, see css/build/014-mailcow.css */
-  --mc-font-family: var(--sc-font);
-  --mc-font-size: 10pt;
-  --mc-body-bg: var(--sc-bg);
-  --mc-primary: var(--sc-brown);
-  --mc-primary-border: var(--sc-brown);
-  --mc-info: var(--sc-blue);
-  --mc-info-border: var(--sc-blue);
-  --mc-border: var(--sc-divider);
-  --mc-surface: var(--sc-surface);
-  --mc-surface-alt: var(--sc-cap);
-  --mc-muted: var(--sc-muted);
-  --mc-hr: var(--sc-divider);
-  --mc-progress-bg: var(--sc-addon);
-  --mc-placeholder: var(--sc-placeholder);
-  --mc-btn-outline-color: var(--sc-ink);
-  --mc-btn-outline-border: var(--sc-line);
-  --mc-btn-outline-hover-bg: var(--sc-brown-tint);
-  --mc-btn-outline-active-bg: var(--sc-brown);
-  --mc-btn-light-active-color: #fff;
-  --mc-btn-light-active-bg: var(--sc-brown);
-  --mc-btn-light-active-border: var(--sc-brown);
-  --mc-dtr-bg: var(--sc-surface);
-  --mc-dtr-border: var(--sc-line);
-  --mc-dtr-color: var(--sc-brown);
-  --mc-dtr-hover-bg: var(--sc-brown-tint);
-  --mc-dtr-active-bg: var(--sc-brown-soft);
-  --mc-login-user: var(--sc-green);
-  --mc-login-domainadmin: #f5c400;
-  --mc-login-admin: var(--sc-danger);
-}
-
-/* base */
-body {
-  color: var(--sc-ink);
-  -webkit-font-smoothing: antialiased;
-}
-h1, h2, h3, h4, h5, h6, .h1, .h2, .h3, .h4, .h5, .h6, legend, .modal-title {
-  font-family: var(--sc-font-head);
-  font-weight: 500;
-  color: var(--sc-ink);
-}
-a {
-  color: var(--sc-link);
-}
-a:hover {
-  color: var(--sc-brown-hover);
-}
-.text-muted, .text-secondary {
-  color: var(--sc-muted) !important;
-}
-::selection {
-  background: var(--sc-brown-soft);
-}
-hr {
-  border-color: var(--sc-divider);
-  opacity: 1;
-}
-::placeholder {
-  color: var(--sc-placeholder) !important;
-}
-
-/* navbar, white with green line */
-.navbar.bg-light {
-  background-color: var(--sc-surface) !important;
-  border: 0;
-  border-bottom: 5px solid var(--sc-green);
-}
-.navbar-light .navbar-nav .nav-link {
-  color: var(--sc-ink);
-}
-.navbar-light .navbar-nav .nav-link:hover,
-.navbar-light .navbar-nav .nav-link:focus,
-.navbar-light .navbar-nav .nav-link.active,
-.navbar-light .navbar-nav .show > .nav-link {
-  color: var(--sc-brown);
-}
-@media (min-width: 992px) {
-  .navbar-nav .nav-link {
-    height: 60px;
-  }
-}
-.dropdown-menu {
-  border: 1px solid var(--sc-cap-line);
-  border-radius: 0;
-  box-shadow: var(--sc-shadow);
-}
-.dropdown-item {
-  color: var(--sc-ink);
-}
-.dropdown-item:hover, .dropdown-item:focus {
-  color: var(--sc-brown) !important;
-  background-color: var(--sc-brown-soft);
-}
-.dropdown-item.active, .dropdown-item:active {
-  color: #fff;
-  background-color: var(--sc-brown);
-}
-
-/* cards, white with soft shadow */
-.card {
-  border: 0 !important;
-  border-radius: 0;
-  background-color: var(--sc-surface);
-  box-shadow: var(--sc-shadow);
-}
-.card-header, .card-header:first-child {
-  font-family: var(--sc-font-head);
-  font-weight: 500;
-  font-size: 1.1rem;
-  color: var(--sc-ink);
-  background-color: var(--sc-cap);
-  border-bottom: 1px solid var(--sc-cap-line);
-  border-radius: 0;
-  padding: .5rem 1rem;
-}
-.card-header .btn, .card-header .form-control, .card-header .form-select {
-  font-family: var(--sc-font);
-  font-size: .875rem;
-}
-.card-footer {
-  background-color: var(--sc-cap);
-  border-top: 1px solid var(--sc-cap-line);
-  border-radius: 0;
-}
-.card .card {
-  box-shadow: none;
-  border: 1px solid var(--sc-divider) !important;
-}
-/* colored headers become a top line */
-.card:has(> .card-header.bg-danger) {
-  border-top: 4px solid var(--sc-danger) !important;
-}
-.card-header.bg-danger, .card-header.bg-success, .card-header.bg-primary, .card-header.bg-info {
-  color: var(--sc-ink) !important;
-  background-color: var(--sc-cap) !important;
-}
-.list-group-item {
-  border-color: var(--sc-divider);
-}
-
-/* modals */
-.modal-content {
-  border: 0;
-  border-radius: 0;
-  box-shadow: 0 8px 40px rgba(0, 0, 0, .2);
-}
-.modal-header {
-  background-color: var(--sc-cap);
-  border-bottom: 1px solid var(--sc-cap-line);
-  border-radius: 0;
-}
-.modal-footer {
-  border-top: 1px solid var(--sc-divider);
-}
-
-/* buttons, flat and square */
-.btn {
-  border-width: 1px;
-  border-radius: 0;
-  font-weight: 400;
-  transition: none;
-}
-.btn:not(.disabled):hover,
-.btn:not(.disabled):active {
-  margin-top: 0;
-  border-bottom-width: 1px;
-}
-.btn:focus, .btn-check:focus + .btn {
-  box-shadow: 0 0 0 .2rem var(--sc-focus);
-}
-.btn-primary, .btn-primary:hover, .btn-primary:focus, .btn-primary:active {
-  color: #fff;
-}
-.btn-primary:hover, .btn-primary:focus, .btn-primary:active {
-  background-color: var(--sc-brown-hover) !important;
-  border-color: var(--sc-brown-active) !important;
-}
-/* main call to action, portal primary */
-.btn-success, .btn-success:not(.disabled):hover, .btn-success:not(.disabled):active, .btn-success:focus,
-.btn-success:disabled, .btn-success.disabled {
-  color: #fff;
-  background-color: var(--sc-brown);
-  border-color: var(--sc-brown);
-}
-.btn-success:hover, .btn-success:active, .btn-success:focus {
-  background-color: var(--sc-brown-hover);
-  border-color: var(--sc-brown-active);
-}
-.btn-danger, .btn-danger:not(.disabled):hover, .btn-danger:not(.disabled):active, .btn-danger:focus,
-.btn-danger:disabled, .btn-danger.disabled {
-  color: #000;
-  background-color: var(--sc-danger);
-  border-color: var(--sc-danger);
-}
-.btn-danger:hover, .btn-danger:active, .btn-danger:focus {
-  background-color: var(--sc-danger-hover);
-  border-color: var(--sc-danger-hover);
-}
-.btn-warning, .btn-warning:not(.disabled):hover, .btn-warning:not(.disabled):active, .btn-warning:focus {
-  color: #000;
-  background-color: var(--sc-warning);
-  border-color: var(--sc-warning);
-}
-.bg-info, .alert-info, .btn-info, .badge.bg-info > a {
-  color: #000 !important;
-}
-.btn-secondary, .btn-secondary:not(.disabled):hover, .btn-secondary:not(.disabled):active, .btn-secondary:focus,
-.btn-light, .btn-light:not(.disabled):hover, .btn-light:not(.disabled):active, .btn-light:focus {
-  color: var(--sc-ink);
-  background-color: var(--sc-surface);
-  border-color: var(--sc-line);
-}
-.btn-secondary:hover, .btn-secondary:active, .btn-secondary:focus,
-.btn-light:hover, .btn-light:focus {
-  color: var(--sc-brown);
-  background-color: var(--sc-brown-tint);
-  border-color: var(--sc-line);
-}
-.btn-check:checked + .btn-secondary, .btn-secondary.active, .show > .btn-secondary.dropdown-toggle {
-  color: #fff;
-  background-color: var(--sc-brown);
-  border-color: var(--sc-brown);
-}
-.btn-check:checked + .btn-outline-secondary, .btn-outline-secondary.active {
-  color: #fff !important;
-  border-color: var(--sc-brown) !important;
-}
-.btn-outline-primary {
-  color: var(--sc-brown);
-  border-color: var(--sc-brown);
-}
-.btn-outline-primary:hover {
-  color: #fff;
-  background-color: var(--sc-brown);
-  border-color: var(--sc-brown);
-}
-/* active toggle, e.g. tagging options */
-.btn-dark, .btn-dark:hover, .btn-dark:focus, .btn-dark:active {
-  color: #fff;
-  background-color: var(--sc-brown);
-  border-color: var(--sc-brown);
-}
-.btn-xs, .btn-group-xs > .btn {
-  border-radius: 0;
-}
-
-/* forms */
-.form-control, .form-select {
-  border-color: var(--sc-line);
-  border-radius: 0;
-  box-shadow: none;
-  color: var(--sc-ink);
-  background-color: var(--sc-surface);
-}
-.form-control:focus, .form-select:focus {
-  border-color: var(--sc-focus-border);
-  box-shadow: 0 0 0 .25rem var(--sc-focus);
-}
-.form-control::file-selector-button {
-  color: var(--sc-ink);
-  background-color: var(--sc-addon);
-  border-color: var(--sc-line);
-}
-.form-control:hover:not(:disabled):not([readonly])::file-selector-button {
-  color: var(--sc-brown);
-  background-color: var(--sc-brown-soft);
-}
-.input-group-text {
-  color: var(--sc-ink);
-  background-color: var(--sc-addon);
-  border-color: var(--sc-line);
-  border-radius: 0;
-}
-.input-group > :not(:first-child), .input-group > :not(:last-child) {
-  border-radius: 0;
-}
-.form-check-input {
-  border-color: var(--sc-line);
-}
-.form-check-input:checked {
-  background-color: var(--sc-brown);
-  border-color: var(--sc-brown);
-}
-.form-check-input:focus {
-  border-color: var(--sc-focus-border);
-  box-shadow: 0 0 0 .25rem var(--sc-focus);
-}
-.bootstrap-select > .dropdown-toggle {
-  border-radius: 0;
-}
-.bootstrap-select > .dropdown-toggle.bs-placeholder,
-.bootstrap-select > .dropdown-toggle.bs-placeholder:hover,
-.bootstrap-select > .dropdown-toggle.bs-placeholder:focus,
-.bootstrap-select > .dropdown-toggle.bs-placeholder:active {
-  color: var(--mc-placeholder);
-}
-.bootstrap-select .dropdown-menu li a.active, .bootstrap-select .dropdown-menu li a:active {
-  color: #fff;
-  background-color: var(--sc-brown);
-}
-div.numberedtextarea-number {
-  color: var(--sc-muted);
-}
-
-/* nav tabs */
-.nav-tabs {
-  border-bottom: 1px solid var(--sc-divider);
-}
-.nav-tabs .nav-link,
-.nav-tabs .nav-link.disabled, .nav-tabs .nav-link.disabled:hover, .nav-tabs .nav-link.disabled:focus {
-  margin-top: 0;
-  color: var(--sc-ink);
-  border: 0;
-  border-bottom: 3px solid transparent;
-  border-radius: 0;
-  background: none;
-}
-.nav-tabs .nav-link:not(.disabled):hover, .nav-tabs .nav-link:not(.disabled):focus {
-  padding-bottom: .5rem;
-  color: var(--sc-brown);
-}
-.nav-tabs .nav-link.active, .nav-tabs .nav-item.show .nav-link,
-.nav-tabs .nav-link:not(.disabled).active {
-  padding-bottom: .5rem;
-  color: var(--sc-brown);
-  background: none;
-  border-bottom: 3px solid var(--sc-brown);
-}
-.nav-pills .nav-link {
-  border-radius: 0;
-  color: var(--sc-ink);
-}
-.nav-pills .nav-link.active, .nav-pills .show > .nav-link {
-  background-color: var(--sc-brown);
-}
-
-/* tables */
-.table {
-  --bs-table-bg: transparent;
-  --bs-table-striped-bg: var(--sc-stripe);
-  --bs-table-striped-color: var(--sc-ink);
-  --bs-table-hover-color: var(--sc-ink);
-  --bs-table-hover-bg: var(--sc-hover);
-  color: var(--sc-ink);
-  border-color: var(--sc-divider);
-}
-.table > thead > tr > th, table.dataTable thead th {
-  color: var(--sc-ink);
-  font-weight: 600;
-  border-bottom: 1px solid var(--sc-line);
-}
-table.dataTable.table-striped > tbody > tr.odd > * {
-  box-shadow: inset 0 0 0 9999px var(--sc-stripe);
-}
-table.dataTable.table-hover > tbody > tr:hover > * {
-  box-shadow: inset 0 0 0 9999px var(--sc-hover);
-}
-.table > :not(:first-child) {
-  border-top: 0;
-}
-.dataTables_wrapper .dataTables_filter input,
-.dataTables_wrapper .dataTables_length select {
-  border: 1px solid var(--sc-line);
-  border-radius: 0;
-}
-.pagination > li > a, .pagination > li > span, .pagination .page-link,
-.pagination > li > a:hover, .pagination > li > a:focus, .pagination > li > a:active {
-  top: 0;
-  color: var(--sc-brown);
-  font-weight: 400;
-  text-transform: none;
-  background-color: var(--sc-surface);
-  border: 1px solid var(--sc-divider);
-  border-radius: 0 !important;
-}
-.pagination > li > a:hover, .pagination > li > a:focus {
-  background-color: var(--sc-brown-tint);
-}
-.pagination > .disabled > a, .pagination > .disabled > a:hover, .pagination > .disabled > a:active,
-.page-item.disabled .page-link {
-  color: var(--sc-muted);
-  background-color: var(--sc-surface);
-  border-width: 1px;
-  border-color: var(--sc-divider);
-}
-.page-item.active .page-link {
-  color: #fff;
-  background-color: var(--sc-brown);
-  border-color: var(--sc-brown);
-}
-.breadcrumb {
-  border: 1px solid var(--sc-divider);
-  border-radius: 0;
-}
-
-/* alerts like the portal */
-.alert {
-  border: 1px solid;
-  border-radius: 0;
-}
-.alert-primary {
-  color: #43382c !important;
-  background-color: #e2dfdb !important;
-  border-color: #d4cec8 !important;
-}
-.alert-info {
-  color: #3c535e !important;
-  background-color: #eaf6fb !important;
-  border-color: #e0f1f9 !important;
-}
-.alert-success {
-  color: #375603;
-  background-color: #e8f7ce;
-  border-color: #dcf3b5;
-}
-.alert-danger {
-  color: #8f4343;
-  background-color: #fce2e2;
-  border-color: #fad4d4;
-}
-.alert-warning {
-  color: #885907;
-  background-color: #f9eace;
-  border-color: #f7dfb6;
-}
-.alert-secondary, .alert-light {
-  color: var(--sc-ink);
-  background-color: var(--sc-cap);
-  border-color: var(--sc-divider);
-}
-.alert .alert-link {
-  color: inherit;
-}
-.alert .btn-close {
-  background-image: url("data:image/svg+xml,%3csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='%23000'%3e%3cpath d='M.293.293a1 1 0 0 1 1.414 0L8 6.586 14.293.293a1 1 0 1 1 1.414 1.414L9.414 8l6.293 6.293a1 1 0 0 1-1.414 1.414L8 9.414l-6.293 6.293a1 1 0 0 1-1.414-1.414L6.586 8 .293 1.707a1 1 0 0 1 0-1.414z'/%3e%3c/svg%3e");
-  opacity: .5;
-}
-
-/* badges and semantic colors, readable text on top */
-.badge {
-  font-weight: 500;
-  border-radius: 0;
-}
-.bg-success {
-  color: #000 !important;
-  background-color: var(--sc-green) !important;
-}
-.bg-warning {
-  color: #000 !important;
-  background-color: var(--sc-warning) !important;
-}
-.bg-danger {
-  color: #000 !important;
-  background-color: var(--sc-danger) !important;
-}
-.badge.bg-secondary, .badge.bg-light {
-  color: var(--sc-ink);
-  background-color: var(--sc-addon) !important;
-}
-.text-success {
-  color: #4f8a0b !important;
-}
-.text-danger {
-  color: var(--sc-danger-text) !important;
-}
-.text-warning {
-  color: #9a6100 !important;
-}
-.progress {
-  border-radius: 0;
-}
-.progress-bar {
-  color: #000;
-  background-color: var(--sc-green);
-}
-.progress-bar.bg-danger, .progress-bar-danger {
-  color: #000;
-  background-color: var(--sc-danger) !important;
-}
-.progress-bar-warning {
-  color: #000;
-  background-color: var(--sc-warning) !important;
-}
-
-
-/* footer */
-.footer, .footer a {
-  color: var(--sc-muted);
-}
-.footer hr {
-  border-color: var(--sc-divider);
-}

data/web/css/themes/servercow/theme.json

@@ -1,4 +0,0 @@
-{
-  "name": "servercow",
-  "description": "Based on the servercow theme"
-}

data/web/domainadmin/mailbox.php

@@ -9,8 +9,6 @@ $_SESSION['return_to'] = $_SERVER['REQUEST_URI'];
 
 
 
-$js_minifier->add('/web/js/site/imapsync.js');
-$js_minifier->add('/web/js/site/groups.js');
 $js_minifier->add('/web/js/site/mailbox.js');
 $js_minifier->add('/web/js/presets/sieveMailbox.js');
 $js_minifier->add('/web/js/site/pwgen.js');
@@ -44,7 +42,6 @@ $template_data = [
   'lang_rl' => json_encode($lang['ratelimit']),
   'lang_edit' => json_encode($lang['edit']),
   'lang_datatables' => json_encode($lang['datatables']),
-  'imapsync_redirect_uri' => \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->oauth->redirectUri(),
 ];
 
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/footer.inc.php';

data/web/edit.php

@@ -99,27 +99,6 @@ if (isset($_SESSION['mailcow_cc_role'])) {
         $template = 'edit/oauth2client.twig';
         $template_data = ['oauth2client' => $oauth2client];
     }
-    elseif (isset($_GET['mailbox-group']) &&
-      is_numeric($_GET['mailbox-group'])) {
-        $result = \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getGroup($_GET['mailbox-group']);
-        $template = 'edit/mailbox-group.twig';
-        // Member candidates: mailboxes of the domains the caller manages
-        $mailboxes = [];
-        foreach (mailbox('get', 'domains') as $domain) {
-          foreach (mailbox('get', 'mailboxes', $domain) as $mailbox) {
-            $mailboxes[] = $mailbox;
-          }
-        }
-        $template_data = [
-          'mailboxes' => $mailboxes,
-          'mbox_templates' => ($_SESSION['mailcow_cc_role'] == 'admin') ? mailbox('get', 'mailbox_templates') : [],
-        ];
-    }
-    elseif (isset($_GET['api-key']) &&
-      is_numeric($_GET['api-key'])) {
-        $result = \Mailcow\ApiKey\ApiKeyModule::fromGlobals()->api->getKey($_GET['api-key']);
-        $template = 'edit/api-key.twig';
-    }
     elseif (isset($_GET['aliasdomain']) &&
       is_valid_domain_name(html_entity_decode(rawurldecode($_GET["aliasdomain"]))) &&
       !empty($_GET["aliasdomain"])) {
@@ -157,8 +136,6 @@ if (isset($_SESSION['mailcow_cc_role'])) {
           'get_tls_policy' => $get_tls_policy,
           'rlyhosts' => $rlyhosts,
           'sender_acl_handles' => mailbox('get', 'sender_acl_handles', $mailbox),
-          'mailbox_groups' => \Mailcow\MailboxGroup\MailboxGroupModule::fromGlobals()->api->getMemberships($mailbox),
-          'identity_link' => \Mailcow\Identity\IdentityModule::fromGlobals()->api->getLink($mailbox),
           'user_acls' => acl('get', 'user', $mailbox),
           'mailbox_details' => $result,
           'iam_settings' => $iam_settings,
@@ -227,15 +204,9 @@ if (isset($_SESSION['mailcow_cc_role'])) {
     if (isset($_GET['syncjob']) &&
       is_numeric($_GET['syncjob'])) {
         $id = $_GET["syncjob"];
-        $result = \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->api->getJob($id);
+        $result = mailbox('get', 'syncjob_details', $id);
         $template = 'edit/syncjob.twig';
       }
-    elseif (isset($_GET['syncjob_source']) &&
-      is_numeric($_GET['syncjob_source'])) {
-        $id = $_GET["syncjob_source"];
-        $result = \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->api->getSource($id);
-        $template = 'edit/imapsync_source.twig';
-    }
     elseif (isset($_GET['filter']) &&
       is_numeric($_GET['filter'])) {
         $id = $_GET["filter"];
@@ -254,8 +225,6 @@ else {
   $template_data['access_denied'] = true;
 }
 
-$js_minifier->add('/web/js/site/imapsync.js');
-$js_minifier->add('/web/js/site/groups.js');
 $js_minifier->add('/web/js/site/edit.js');
 $js_minifier->add('/web/js/site/pwgen.js');
 
@@ -264,6 +233,5 @@ $template_data['return_to'] = $_SESSION['return_to'];
 $template_data['lang_user'] = json_encode($lang['user']);
 $template_data['lang_admin'] = json_encode($lang['admin']);
 $template_data['lang_datatables'] = json_encode($lang['datatables']);
-$template_data['imapsync_redirect_uri'] = \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->oauth->redirectUri();
 
 require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/footer.inc.php';

data/web/inc/ajax/container_ctrl.php

@@ -10,10 +10,6 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != 'admin') {
 	exit();
 }
-// Read-only API keys must not control containers
-if (!empty($_SESSION['mailcow_cc_api']) && ($_SESSION['mailcow_cc_api_access'] ?? '') != 'rw') {
-	exit();
-}
 
 if (preg_match('/^[a-z\-]{0,}-mailcow/', $_GET['service'])) {
   if ($_GET['action'] == "start") {

data/web/inc/ajax/dns_diagnostics.php

@@ -380,13 +380,13 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
             else {
               $state = state_nomatch;
             }
-            $state .= '<br />' . htmlspecialchars($current[$data_field[$current['type']]]);
+            $state .= '<br />' . $current[$data_field[$current['type']]];
           }
           if ($current['type'] == 'TXT' &&
               stripos($current['txt'], 'v=dmarc') === 0 &&
               $record[2] == $dmarc_link) {
             $current['txt'] = str_replace(' ', '', $current['txt']);
-            $state = htmlspecialchars($current[$data_field[$current['type']]]) . state_optional;
+            $state = $current[$data_field[$current['type']]] . state_optional;
           }
           elseif ($current['type'] == 'TXT' &&
                   stripos($current['txt'], 'v=spf') === 0 &&
@@ -396,7 +396,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
             if (in_array($ip, $rslt) && in_array(expand_ipv6($ip6), $rslt)) {
               $state = state_good;
             }
-            $state .= '<br />' . htmlspecialchars($current[$data_field[$current['type']]]) . state_optional;
+            $state .= '<br />' . $current[$data_field[$current['type']]] . state_optional;
           }
           elseif ($current['type'] == 'TXT' &&
                   stripos($current['txt'], 'v=dkim') === 0 &&
@@ -426,7 +426,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
         if ($state == state_nomatch) {
           $state = array();
           foreach ($currents as $current) {
-            $state[] = htmlspecialchars($current[$data_field[$current['type']]]);
+            $state[] = $current[$data_field[$current['type']]];
           }
           $state = implode('<br />', $state);
         }
@@ -436,22 +436,12 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
           <td>%s</td>
           <td class="dns-found">%s</td>
           <td class="dns-recommended">%s</td>
-        </tr>', htmlspecialchars($record[0]), htmlspecialchars($record[1]), $record[2], $state);
+        </tr>', $record[0], $record[1], $record[2], $state);
         $record[3] = explode('<br />', $state);
       }
 
       unset($record);
 
-      // Make a hostname RHS absolute so it is not read relative to $ORIGIN.
-      // Already-absolute names, the SRV root target "." and IP addresses are left alone.
-      $absolutize = function($host) {
-        $host = trim($host);
-        if ($host === '' || $host === '.' || substr($host, -1) === '.' || filter_var($host, FILTER_VALIDATE_IP)) {
-          return $host;
-        }
-        return $host . '.';
-      };
-
       $dns_data = sprintf("\$ORIGIN %s.\n", $domain);
       foreach ($records as $record) {
         if ($domain == substr($record[0], -strlen($domain))) {
@@ -472,32 +462,22 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
               $val = str_replace(state_optional, '', $val);
               $val = str_replace(state_good, '', $val);
               if (strlen($val) > 0) {
-                // these are all TXT values, their RHS is a character string, not a name
                 $vals[] = sprintf("%s\tIN\t%s\t%s\n", $label, $record[1], $val);
               }
             }
           }
           else {
-            if ($record[1] == 'MX' || $record[1] == 'CNAME') {
-              $val = $absolutize($val);
-            }
-            elseif ($record[1] == 'SRV') {
-              // format here is "target port"; only the target is a name
-              $parts = explode(' ', $val, 2);
-              $parts[0] = $absolutize($parts[0]);
-              $val = implode(' ', $parts);
-            }
             $vals[] = sprintf("%s\tIN\t%s\t%s\n", $label, $record[1], $val);
           }
 
           foreach ($vals as $val) {
-            $dns_data .= $val;
+            $dns_data .= str_replace($domain, $domain . '.', $val);
           }
         }
       }
       ?>
     </table>
-    <a id='download-zonefile' class="btn btn-sm btn-secondary visible-xs-block visible-sm-inline visible-md-inline visible-lg-inline mb-4" style="margin-top:10px" data-zonefile="<?=base64_encode($dns_data);?>" download='<?=htmlspecialchars($_GET['domain']);?>.txt' type='text/csv'>Download</a>
+    <a id='download-zonefile' class="btn btn-sm btn-secondary visible-xs-block visible-sm-inline visible-md-inline visible-lg-inline mb-4" style="margin-top:10px" data-zonefile="<?=base64_encode($dns_data);?>" download='<?=$_GET['domain'];?>.txt' type='text/csv'>Download</a>
     <script>
       var zonefile_dl_link = document.getElementById('download-zonefile');
       var zonefile = atob(zonefile_dl_link.getAttribute('data-zonefile'));

data/web/inc/ajax/syncjob_logs.php

@@ -6,7 +6,7 @@ if (!isset($_SESSION['mailcow_cc_role'])) {
 }
 
 if (isset($_GET['id']) && is_numeric($_GET['id'])) {
-  if ($details = \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->api->getJob(intval($_GET['id']))) {
+  if ($details = mailbox('get', 'syncjob_details', intval($_GET['id']))) {
     echo (empty($details['log'])) ? '-' : $details['log'];
   }
 }

data/web/inc/ajax/update_check.php

@@ -1,67 +0,0 @@
-<?php
-require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
-
-header('Content-Type: application/json');
-
-// Admins only
-if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] !== 'admin') {
-  http_response_code(403);
-  echo json_encode(array('status' => 'error', 'message' => 'access denied'));
-  exit;
-}
-
-$owner   = $GLOBALS['MAILCOW_GIT_OWNER'];
-$repo    = $GLOBALS['MAILCOW_GIT_REPO'];
-$current = $GLOBALS['MAILCOW_GIT_VERSION'];
-
-// Cache key is bound to the running version, so an update invalidates it naturally
-$cache_key = 'MAILCOW_UPDATE_CHECK/' . $current;
-
-// Serve cached result if present (one GitHub call per TTL, not one per page load)
-$cached = $redis->get($cache_key);
-if ($cached !== false) {
-  echo $cached;
-  exit;
-}
-
-// GitHub requires a User-Agent and rate-limits unauthenticated requests to 60/h per IP
-function github_get($url) {
-  $ch = curl_init($url);
-  curl_setopt_array($ch, array(
-    CURLOPT_RETURNTRANSFER => true,
-    CURLOPT_USERAGENT      => 'mailcow-update-check',
-    CURLOPT_TIMEOUT        => 10,
-    CURLOPT_HTTPHEADER     => array('Accept: application/vnd.github+json'),
-  ));
-  $body = curl_exec($ch);
-  $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
-  curl_close($ch);
-  if ($body === false || $code !== 200) return false;
-  $json = json_decode($body, true);
-  return is_array($json) ? $json : false;
-}
-
-$latest  = github_get("https://api.github.com/repos/{$owner}/{$repo}/releases/latest");
-$release = github_get("https://api.github.com/repos/{$owner}/{$repo}/releases/tags/{$current}");
-
-// Any failure (rate limit, offline, unexpected payload) -> honest error, cached briefly
-if ($latest === false || $release === false ||
-    empty($latest['tag_name']) || empty($latest['created_at']) || empty($release['created_at'])) {
-  $result = json_encode(array('status' => 'error', 'message' => 'could not reach GitHub API'));
-  $redis->setex($cache_key, 300, $result);
-  echo $result;
-  exit;
-}
-
-$date_latest  = strtotime($latest['created_at']);
-$date_current = strtotime($release['created_at']);
-
-if ($date_latest <= $date_current) {
-  $result = json_encode(array('status' => 'no_update'));
-} else {
-  $result = json_encode(array('status' => 'update_available', 'latest_tag' => $latest['tag_name']));
-}
-
-// Cache the positive result for an hour
-$redis->setex($cache_key, 3600, $result);
-echo $result;

data/web/inc/footer.inc.php

@@ -33,11 +33,11 @@ if (array_key_exists('pending_tfa_methods', $_SESSION)) {
   if (isset($pending_tfa_authmechs['webauthn'])) {
     $pending_tfa_authmechs['webauthn'] = true;
   }
-  if (!isset($pending_tfa_authmechs['webauthn'])
+  if (!isset($pending_tfa_authmechs['webauthn']) 
       && isset($pending_tfa_authmechs['yubi_otp'])) {
     $pending_tfa_authmechs['yubi_otp'] = true;
   }
-  if (!isset($pending_tfa_authmechs['webauthn'])
+  if (!isset($pending_tfa_authmechs['webauthn']) 
       && !isset($pending_tfa_authmechs['yubi_otp'])
       && isset($pending_tfa_authmechs['totp'])) {
     $pending_tfa_authmechs['totp'] = true;
@@ -72,8 +72,6 @@ $globalVariables = [
   'lang_fido2' => json_encode($lang['fido2']),
   'lang_success' => json_encode($lang['success']),
   'lang_danger' => json_encode($lang['danger']),
-  'lang_syncjobs' => json_encode($lang['syncjobs']),
-  'lang_groups' => json_encode($lang['groups']),
   'docker_timeout' => $DOCKER_TIMEOUT,
   'session_lifetime' => (int)$SESSION_LIFETIME,
   'csrf_token' => $_SESSION['CSRF']['TOKEN'],

data/web/inc/functions.acl.inc.php

@@ -48,7 +48,12 @@ function acl($_action, $_scope = null, $_data = null, $_extra = null) {
               );
               continue;
             }
+            $sogo_acl_changed = false;
             foreach ($set_acls as $set_acl_key => $set_acl_val) {
+              // Track if sogo_access ACL changed
+              if ($set_acl_key == 'sogo_access' && $is_now[$set_acl_key] != $set_acl_val) {
+                $sogo_acl_changed = true;
+              }
               $stmt = $pdo->prepare("UPDATE `user_acl` SET " . $set_acl_key . " = " . intval($set_acl_val) . "
                 WHERE `username` = :username");
               $stmt->execute(array(
@@ -60,6 +65,10 @@ function acl($_action, $_scope = null, $_data = null, $_extra = null) {
               'log' => array(__FUNCTION__, $_action, $_scope, $_data_log),
               'msg' => array('acl_saved', $username)
             );
+            // Update SOGo static view if sogo_access ACL changed
+            if ($sogo_acl_changed) {
+              update_sogo_static_view($username);
+            }
           }
         break;
         case 'domainadmin':
@@ -193,10 +202,6 @@ function acl($_action, $_scope = null, $_data = null, $_extra = null) {
         while ($row = array_shift($acl_all)) {
           $acl['acl'][$row['Field']] = 1;
         }
-        // Read-only API keys must not log in as other accounts (SOGo SSO, dual login)
-        if (!empty($_SESSION['mailcow_cc_api']) && ($_SESSION['mailcow_cc_api_access'] ?? '') != 'rw') {
-          $acl['acl']['login_as'] = 0;
-        }
       }
       elseif ($_SESSION['mailcow_cc_role'] == 'domainadmin' ||
         (isset($_SESSION["dual-login"]["role"]) && $_SESSION["dual-login"]["role"] == 'domainadmin')) {

data/web/inc/functions.admin.inc.php

@@ -103,7 +103,7 @@ function admin($_action, $_data = null) {
             continue;
           }
         }
-        if (!ctype_alnum(str_replace(array('_', '.', '-'), '', $username_new)) || $username_new == 'API') {
+        if (!ctype_alnum(str_replace(array('_', '.', '-'), '', $username_new))) {
           $_SESSION['return'][] = array(
             'type' => 'danger',
             'log' => array(__FUNCTION__, $_action, $_data_log),
@@ -179,9 +179,6 @@ function admin($_action, $_data = null) {
             $stmt = $pdo->prepare("UPDATE `tfa` SET `username` = :username_new WHERE `username` = :username");
             $stmt->execute(array(':username_new' => $username_new, ':username' => $username));
           }
-          if ($username_new != $username) {
-            \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->api->accountChanged($username, $username_new);
-          }
         }
         $_SESSION['return'][] = array(
           'type' => 'success',
@@ -214,7 +211,6 @@ function admin($_action, $_data = null) {
         $stmt->execute(array(
           ':username' => $username,
         ));
-        \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->api->accountChanged($username);
         $stmt = $pdo->prepare("DELETE FROM `domain_admins` WHERE `username` = :username");
         $stmt->execute(array(
           ':username' => $username,

data/web/inc/functions.auth.inc.php

@@ -36,18 +36,7 @@ function check_login($user, $pass, $extra = null) {
 
   // Try validate user
   if (!isset($role) || $role == "user") {
-    try {
-      $result = user_login($user, $pass, $extra);
-    } catch (\Mailcow\Auth\IdpUnavailable $e) {
-      // no failed login, netfilter must not count it
-      error_log("mailcow UI: Identity provider unavailable for " . $user . " by " . $_SERVER['REMOTE_ADDR'] . ": " . $e->getMessage());
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $user, '*', $e->getMessage()),
-        'msg' => 'iam_unavailable'
-      );
-      return false;
-    }
+    $result = user_login($user, $pass, $extra);
     if ($result !== false) {
       $real_rip = ($_SERVER['HTTP_X_REAL_IP'] ?? $_SERVER['REMOTE_ADDR']);
       set_sasl_log($user, $real_rip, $extra['service']);
@@ -273,20 +262,12 @@ function user_login($user, $pass, $extra = null){
 
   // check if user has access to service (imap, smtp, pop3, sieve) if service is set
   $row['attributes'] = json_decode($row['attributes'], true);
-  // Shared mailboxes have no login of their own, members open them through group shares
-  if (($row['attributes']['shared'] ?? '0') == '1') {
-    return false;
-  }
   if ($extra['service'] != 'NONE') {
     $key = strtolower($extra['service']) . "_access";
     if (isset($row['attributes'][$key]) && $row['attributes'][$key] != '1') {
       return false;
     }
   }
-  // IdP accounts: refuse inactive mailboxes and domains before asking the IdP (no template side effects)
-  if ($row['authsource'] != 'mailcow' && ($row['active'] != '1' || $row['d_active'] != '1')) {
-    return false;
-  }
   switch ($row['authsource']) {
     case 'keycloak':
       // user authsource is keycloak, try using via rest flow
@@ -306,8 +287,6 @@ function user_login($user, $pass, $extra = null){
             return false;
           }
 
-          $row['attributes'] = json_decode($row['attributes'], true);
-
           // check for tfa authenticators
           $authenticators = get_tfa($user);
           if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0 && !$is_internal) {
@@ -364,8 +343,6 @@ function user_login($user, $pass, $extra = null){
           return false;
         }
 
-        $row['attributes'] = json_decode($row['attributes'], true);
-
         // check for tfa authenticators
         $authenticators = get_tfa($user);
         if (isset($authenticators['additional']) && is_array($authenticators['additional']) && count($authenticators['additional']) > 0 && !$is_internal) {
@@ -481,7 +458,6 @@ function apppass_login($user, $pass, $extra = null){
       AND `mailbox`.`active` = '1'
       AND `domain`.`active` = '1'
       AND `app_passwd`.`active` = '1'
-      AND COALESCE(JSON_UNQUOTE(JSON_VALUE(`mailbox`.`attributes`, '$.shared')), '0') != '1'
       AND `app_passwd`.`mailbox` = :user"
   );
   // fetch password data
@@ -527,14 +503,11 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
     return false;
   }
   if (!$iam_provider) {
-    throw new \Mailcow\Auth\IdpUnavailable('Keycloak is not configured completely');
+    return false;
   }
 
   // get access_token for service account of mailcow client
   $admin_token = identity_provider("get-keycloak-admin-token");
-  if (!$admin_token) {
-    throw new \Mailcow\Auth\IdpUnavailable('Could not get an admin token from Keycloak');
-  }
 
   // get the mailcow_password attribute from keycloak user
   $url = "{$iam_settings['server_url']}/admin/realms/{$iam_settings['realm']}/users";
@@ -548,23 +521,15 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
       'Authorization: Bearer ' . $admin_token,
       'Content-Type: application/json'
   ));
-  if (intval($iam_settings['ignore_ssl_error']) == 1) {
-    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
-    curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
-  }
-  $users = json_decode(curl_exec($curl), true);
+  $user_res = json_decode(curl_exec($curl), true)[0];
   $code = curl_getinfo($curl, CURLINFO_HTTP_CODE);
   curl_close($curl);
-  // the password is checked below, a failed request is never a wrong password
   if ($code != 200) {
-    throw new \Mailcow\Auth\IdpUnavailable('Keycloak returned HTTP ' . $code);
-  }
-  // exact=true can still return several users with that email
-  if (!is_array($users) || count($users) != 1) {
-    return false;
-  }
-  $user_res = $users[0];
-  if (empty($user_res['enabled'])) {
+    $_SESSION['return'][] =  array(
+      'type' => 'danger',
+      'log' => array(__FUNCTION__, $user, '*', 'Identity Provider returned HTTP ' . $code),
+      'msg' => 'generic_server_error'
+    );
     return false;
   }
   if (!isset($user_res['attributes']['mailcow_password']) || !is_array($user_res['attributes']['mailcow_password'])){
@@ -591,28 +556,18 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
   }
 
   // get mapped template
-  $name = trim(($user_res['firstName'] ?? '') . ' ' . ($user_res['lastName'] ?? ''));
-  $idp_login = \Mailcow\Auth\AuthModule::fromGlobals()->idp;
-  $mapped_template = $idp_login->mappedTemplate($user_res['attributes']['mailcow_template'] ?? array());
+  $user_template = $user_res['attributes']['mailcow_template'][0];
+  $mapper_key = array_search($user_template, $iam_settings['mappers']);
 
   if (!$create) {
-    if (!$idp_login->verifyLink('keycloak', $user, (string)($user_res['id'] ?? ''))) {
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $user, '*', 'The mailbox is linked to another IdP user'),
-        'msg' => 'generic_server_error'
-      );
-      return false;
-    }
     // login success
-    $update_template = $idp_login->templateFor($user, $mapped_template);
-    if ($update_template !== null) {
+    if ($mapper_key !== false) {
       // update user
       $_SESSION['access_all_exception'] = '1';
       mailbox('edit', 'mailbox_from_template', array(
         'username' => $user,
-        'name' => $name,
-        'template' => $update_template
+        'name' => $user_res['name'],
+        'template' => $iam_settings['templates'][$mapper_key]
       ));
       $_SESSION['access_all_exception'] = '0';
     }
@@ -631,7 +586,7 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
     return false;
   }
   // check if matching attribute exist
-  if ($mapped_template === null) {
+  if (empty($iam_settings['mappers']) || !$user_template || $mapper_key === false) {
     if (!empty($iam_settings['default_template'])) {
       $mbox_template = $iam_settings['default_template'];
     } else {
@@ -643,16 +598,7 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
       return false;
     }
   } else {
-    $mbox_template = $mapped_template;
-  }
-
-  if (!$idp_login->mayCreate('keycloak', $user, (string)($user_res['id'] ?? ''))) {
-    $_SESSION['return'][] =  array(
-      'type' => 'danger',
-      'log' => array(__FUNCTION__, $user, '*', 'The IdP user is linked to another mailbox'),
-      'msg' => 'generic_server_error'
-    );
-    return false;
+    $mbox_template = $iam_settings['templates'][$mapper_key];
   }
 
   // create mailbox
@@ -660,7 +606,7 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
   $create_res = mailbox('add', 'mailbox_from_template', array(
     'domain' => explode('@', $user)[1],
     'local_part' => explode('@', $user)[0],
-    'name' => $name,
+    'name' => $user_res['name'],
     'authsource' => 'keycloak',
     'template' => $mbox_template
   ));
@@ -674,7 +620,6 @@ function keycloak_mbox_login_rest($user, $pass, $extra = null){
     );
     return false;
   }
-  $idp_login->storeLink('keycloak', $user, (string)($user_res['id'] ?? ''));
 
   return 'user';
 }
@@ -697,8 +642,7 @@ function ldap_mbox_login($user, $pass, $extra = null){
     return false;
   }
   if (!$iam_provider) {
-    // identity_provider('init') could not connect
-    throw new \Mailcow\Auth\IdpUnavailable('No connection to the LDAP server');
+    return false;
   }
 
   try {
@@ -707,42 +651,47 @@ function ldap_mbox_login($user, $pass, $extra = null){
       $ldap_query = $ldap_query->rawFilter($iam_settings['filter']);
     }
     $ldap_query = $ldap_query->where($iam_settings['username_field'], '=', $user)
-      ->select(array_values(array_filter(array_merge([$iam_settings['username_field'], $iam_settings['attribute_field'], 'displayname', 'distinguishedname', 'dn'],
-        \Mailcow\Identity\Directory\LdapDirectory::idAttributes($iam_settings['id_attribute'] ?? '')))));
+      ->select([$iam_settings['username_field'], $iam_settings['attribute_field'], 'displayname', 'distinguishedname', 'dn']);
 
     $user_res = $ldap_query->firstOrFail();
-  } catch (\LdapRecord\Query\ObjectNotFoundException $e) {
-    return false;
   } catch (Exception $e) {
-    throw new \Mailcow\Auth\IdpUnavailable('LDAP search failed: ' . $e->getMessage(), 0, $e);
+    // clear $_SESSION['return'] to not leak data
+    $_SESSION['return'] = array();
+    $_SESSION['return'][] =  array(
+      'type' => 'danger',
+      'log' => array(__FUNCTION__, $user, '*', $e->getMessage()),
+      'msg' => 'generic_server_error'
+    );
+    return false;
   }
-  $idp_login = \Mailcow\Auth\AuthModule::fromGlobals()->idp;
-  if (!$idp_login->verifyLdapPassword($iam_provider, (string)$user_res['dn'], (string)$pass)) {
+  try {
+    if (!$iam_provider->auth()->attempt($user_res['dn'], $pass)) {
+      return false;
+    }
+  } catch (Exception $e) {
+    // clear $_SESSION['return'] to not leak data
+    $_SESSION['return'] = array();
+    $_SESSION['return'][] =  array(
+      'type' => 'danger',
+      'log' => array(__FUNCTION__, $user, '*', $e->getMessage()),
+      'msg' => 'generic_server_error'
+    );
     return false;
   }
 
   // get mapped template
-  $mapped_template = $idp_login->mappedTemplate($user_res[$iam_settings['attribute_field']] ?? array());
-  $external_id = \Mailcow\Identity\Directory\LdapDirectory::entryId($user_res, $iam_settings['id_attribute'] ?? '');
+  $user_template = $user_res[$iam_settings['attribute_field']][0];
+  $mapper_key = array_search($user_template, $iam_settings['mappers']);
 
   if (!$create) {
-    if (!$idp_login->verifyLink('ldap', $user, $external_id)) {
-      $_SESSION['return'][] =  array(
-        'type' => 'danger',
-        'log' => array(__FUNCTION__, $user, '*', 'The mailbox is linked to another IdP user'),
-        'msg' => 'generic_server_error'
-      );
-      return false;
-    }
     // login success
-    $update_template = $idp_login->templateFor($user, $mapped_template);
-    if ($update_template !== null) {
+    if ($mapper_key !== false) {
       // update user
       $_SESSION['access_all_exception'] = '1';
       mailbox('edit', 'mailbox_from_template', array(
         'username' => $user,
         'name' => $user_res['displayname'][0],
-        'template' => $update_template
+        'template' => $iam_settings['templates'][$mapper_key]
       ));
       $_SESSION['access_all_exception'] = '0';
     }
@@ -761,7 +710,7 @@ function ldap_mbox_login($user, $pass, $extra = null){
     return false;
   }
   // check if matching attribute exist
-  if ($mapped_template === null) {
+  if (empty($iam_settings['mappers']) || !$user_template || $mapper_key === false) {
     if (!empty($iam_settings['default_template'])) {
       $mbox_template = $iam_settings['default_template'];
     } else {
@@ -773,16 +722,7 @@ function ldap_mbox_login($user, $pass, $extra = null){
       return false;
     }
   } else {
-    $mbox_template = $mapped_template;
-  }
-
-  if (!$idp_login->mayCreate('ldap', $user, $external_id)) {
-    $_SESSION['return'][] =  array(
-      'type' => 'danger',
-      'log' => array(__FUNCTION__, $user, '*', 'The IdP user is linked to another mailbox'),
-      'msg' => 'generic_server_error'
-    );
-    return false;
+    $mbox_template = $iam_settings['templates'][$mapper_key];
   }
 
   // create mailbox
@@ -804,7 +744,6 @@ function ldap_mbox_login($user, $pass, $extra = null){
     );
     return false;
   }
-  $idp_login->storeLink('ldap', $user, $external_id);
 
   return 'user';
 }

data/web/inc/functions.customize.inc.php

@@ -233,38 +233,6 @@ function customize($_action, $_item, $_data = null) {
             'msg' => 'custom_login_modified'
           );
         break;
-        case 'ui_theme':
-          $ui_theme = is_array($_data['ui_theme']) ? (string)reset($_data['ui_theme']) : (string)$_data['ui_theme'];
-          if ($ui_theme !== '' && !array_key_exists($ui_theme, customize('get', 'ui_themes'))) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => 'ui_theme_invalid'
-            );
-            return false;
-          }
-          try {
-            if ($ui_theme === '') {
-              $redis->del('UI_THEME');
-            }
-            else {
-              $redis->set('UI_THEME', $ui_theme);
-            }
-          }
-          catch (RedisException $e) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
-            );
-            return false;
-          }
-          $_SESSION['return'][] = array(
-            'type' => 'success',
-            'log' => array(__FUNCTION__, $_action, $_item, $_data),
-            'msg' => 'ui_theme_modified'
-          );
-        break;
       }
     break;
     case 'delete':
@@ -434,42 +402,6 @@ function customize($_action, $_item, $_data = null) {
             return false;
           }
         break;
-        case 'ui_themes':
-          // theme folders in css/themes/<name>/ with a theme.css
-          $themes = array();
-          foreach (glob('/web/css/themes/*/theme.css') as $theme_css) {
-            $theme_dir = dirname($theme_css);
-            $theme = basename($theme_dir);
-            if (!preg_match('/^[a-zA-Z0-9_-]+$/', $theme)) {
-              continue;
-            }
-            $meta = json_decode(@file_get_contents($theme_dir . '/theme.json'), true);
-            $themes[$theme] = array(
-              'name' => (!empty($meta['name'])) ? $meta['name'] : $theme,
-              'description' => (!empty($meta['description'])) ? $meta['description'] : '',
-              'dark' => file_exists($theme_dir . '/dark.css')
-            );
-          }
-          ksort($themes);
-          return $themes;
-        break;
-        case 'ui_theme':
-          try {
-            $ui_theme = $redis->get('UI_THEME');
-          }
-          catch (RedisException $e) {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_item, $_data),
-              'msg' => array('redis_error', $e)
-            );
-            return false;
-          }
-          if (empty($ui_theme) || !preg_match('/^[a-zA-Z0-9_-]+$/', $ui_theme) || !file_exists('/web/css/themes/' . $ui_theme . '/theme.css')) {
-            return '';
-          }
-          return $ui_theme;
-        break;
       }
     break;
   }

data/web/inc/functions.domain_admin.inc.php

@@ -156,7 +156,7 @@ function domain_admin($_action, $_data = null) {
               }
             }
           }
-          if (!ctype_alnum(str_replace(array('_', '.', '-'), '', $username_new)) || $username_new == 'API') {
+          if (!ctype_alnum(str_replace(array('_', '.', '-'), '', $username_new))) {
             $_SESSION['return'][] = array(
               'type' => 'danger',
               'log' => array(__FUNCTION__, $_action, $_data_log),
@@ -183,9 +183,6 @@ function domain_admin($_action, $_data = null) {
             ':username_new' => $username_new,
             ':username' => $username
           ));
-          if ($username_new != $username) {
-            \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->api->accountChanged($username, $username_new);
-          }
           if (!empty($domains)) {
             foreach ($domains as $domain) {
               $stmt = $pdo->prepare("INSERT INTO `domain_admins` (`username`, `domain`, `created`, `active`)
@@ -334,8 +331,6 @@ function domain_admin($_action, $_data = null) {
         $stmt->execute(array(
           ':username' => $username,
         ));
-        // sync sources created by this account must not pass to a re-created account of the same name
-        \Mailcow\Imapsync\ImapsyncModule::fromGlobals()->api->accountChanged($username);
         $_SESSION['return'][] = array(
           'type' => 'success',
           'log' => array(__FUNCTION__, $_action, $_data_log),
@@ -434,25 +429,14 @@ function domain_admin_sso($_action, $_data) {
 
   switch ($_action) {
     case 'check':
-      $token = preg_replace('/[^a-zA-Z0-9-]/', '', $_data);
+      $token = $_data;
 
       $stmt = $pdo->prepare("SELECT `t1`.`username` FROM `da_sso` AS `t1` JOIN `admin` AS `t2` ON `t1`.`username` = `t2`.`username` WHERE `t1`.`token` = :token AND `t1`.`created` > DATE_SUB(NOW(), INTERVAL '30' SECOND) AND `t2`.`active` = 1 AND `t2`.`superadmin` = 0;");
       $stmt->execute(array(
-        ':token' => $token
+        ':token' => preg_replace('/[^a-zA-Z0-9-]/', '', $token)
       ));
       $return = $stmt->fetch(PDO::FETCH_ASSOC);
-      if (empty($return['username'])) {
-        return false;
-      }
-      // single-use: consume the token; if a concurrent request already used it, deny
-      $del = $pdo->prepare("DELETE FROM `da_sso` WHERE `token` = :token");
-      $del->execute(array(
-        ':token' => $token
-      ));
-      if ($del->rowCount() < 1) {
-        return false;
-      }
-      return $return['username'];
+      return empty($return['username']) ? false : $return['username'];
     case 'issue':
       if ($_SESSION['mailcow_cc_role'] != "admin") {
         $_SESSION['return'][] = array(

data/web/inc/functions.fail2ban.inc.php

@@ -60,14 +60,13 @@ function fail2ban($_action, $_data = null, $_extra = null) {
         $queue_unban = $redis->hGetAll('F2B_QUEUE_UNBAN');
         if (is_array($active_bans)) {
           foreach ($active_bans as $network => $banned_until) {
-            // Expired bans are lifted by netfilter within seconds
-            $difference = max(0, intval($banned_until) - time());
-            $queued_for_unban = ($difference == 0 || (isset($queue_unban[$network]) && $queue_unban[$network] == 1)) ? 1 : 0;
+            $queued_for_unban = (isset($queue_unban[$network]) && $queue_unban[$network] == 1) ? 1 : 0;
+            $difference = $banned_until - time();
             $f2b_options['active_bans'][] = array(
               'queued_for_unban' => $queued_for_unban,
               'network' => $network,
               'ip' => strtok($network,'/'),
-              'banned_until' => sprintf('%02dh %02dm %02ds', intdiv($difference, 3600), intdiv($difference, 60) % 60, $difference % 60)
+              'banned_until' => sprintf('%02dh %02dm %02ds', ($difference/3600), ($difference/60%60), $difference%60)
             );
           }
         }
@@ -109,15 +108,16 @@ function fail2ban($_action, $_data = null, $_extra = null) {
             );
             return false;
           }
-          // netfilter recreates the default rules within 10 seconds
+          // Rules will also be recreated on log events, but rules may seem empty for a second in the UI
+          docker('post', 'netfilter-mailcow', 'restart');
           $fail_count = 0;
           $regex_result = json_decode($redis->Get('F2B_REGEX'), true);
-          while (empty($regex_result) && $fail_count < 15) {
+          while (empty($regex_result) && $fail_count < 10) {
             $regex_result = json_decode($redis->Get('F2B_REGEX'), true);
             $fail_count++;
             sleep(1);
           }
-          if (empty($regex_result)) {
+          if ($fail_count >= 10) {
             $_SESSION['return'][] = array(
               'type' => 'danger',
               'log' => array(__FUNCTION__, $_action, $_data_log),
@@ -141,7 +141,7 @@ function fail2ban($_action, $_data = null, $_extra = null) {
           $_SESSION['return'][] = array(
             'type' => 'success',
             'log' => array(__FUNCTION__, $_action, $_data_log),
-            'msg' => 'f2b_modified'
+            'msg' => array('object_modified', htmlspecialchars($network))
           );
           return true;
         }
@@ -172,7 +172,7 @@ function fail2ban($_action, $_data = null, $_extra = null) {
               if (valid_network($network)) {
                 try {
                   $redis->hSet('F2B_WHITELIST', $network, 1);
-                  $redis->hDel('F2B_BLACKLIST', $network);
+                  $redis->hDel('F2B_BLACKLIST', $network, 1);
                   $redis->hSet('F2B_QUEUE_UNBAN', $network, 1);
                 }
                 catch (RedisException $e) {
@@ -199,13 +199,14 @@ function fail2ban($_action, $_data = null, $_extra = null) {
               if (valid_network($network) && !in_array($network, array(
                 '0.0.0.0',
                 '0.0.0.0/0',
-                getenv('IPV4_NETWORK') . '.0/24',
-                getenv('IPV4_NETWORK') . '.0',
+                getenv('IPV4_NETWORK') . '0/24',
+                getenv('IPV4_NETWORK') . '0',
                 getenv('IPV6_NETWORK')
               ))) {
                 try {
                   $redis->hSet('F2B_BLACKLIST', $network, 1);
-                  $redis->hDel('F2B_WHITELIST', $network);
+                  $redis->hDel('F2B_WHITELIST', $network, 1);
+                  //$response = docker('post', 'netfilter-mailcow', 'restart');
                 }
                 catch (RedisException $e) {
                   $_SESSION['return'][] = array(
@@ -260,60 +261,62 @@ function fail2ban($_action, $_data = null, $_extra = null) {
       $f2b_options['ban_time'] = ($ban_time < 60) ? 60 : $ban_time;
       $f2b_options['ban_time_increment'] = ($ban_time_increment == 1) ? true : false;
       $f2b_options['max_ban_time'] = ($max_ban_time < 60) ? 60 : $max_ban_time;
-      $f2b_options['netban_ipv4'] = min(32, max(8, $netban_ipv4));
-      $f2b_options['netban_ipv6'] = min(128, max(8, $netban_ipv6));
+      $f2b_options['netban_ipv4'] = ($netban_ipv4 < 8) ? 8 : $netban_ipv4;
+      $f2b_options['netban_ipv6'] = ($netban_ipv6 < 8) ? 8 : $netban_ipv6;
+      $f2b_options['netban_ipv4'] = ($netban_ipv4 > 32) ? 32 : $netban_ipv4;
+      $f2b_options['netban_ipv6'] = ($netban_ipv6 > 128) ? 128 : $netban_ipv6;
       $f2b_options['max_attempts'] = ($max_attempts < 1) ? 1 : $max_attempts;
       $f2b_options['retry_window'] = ($retry_window < 1) ? 1 : $retry_window;
-      $f2b_options['banlist_id'] = (!empty($is_now['banlist_id'])) ? $is_now['banlist_id'] : uuid4();
+      $f2b_options['banlist_id'] = $is_now['banlist_id'];
       $f2b_options['manage_external'] = ($manage_external > 0) ? 1 : 0;
-      $wl_items = array();
-      if (!empty($wl)) {
-        foreach (array_filter(array_map('trim', preg_split("/( |,|;|\n)/", $wl))) as $wl_item) {
-          if (valid_network($wl_item) || valid_hostname($wl_item)) {
-            $wl_items[$wl_item] = 1;
-          }
-          else {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_data_log),
-              'msg' => array('network_host_invalid', $wl_item)
-            );
-          }
-        }
-      }
-      $bl_items = array();
-      if (!empty($bl)) {
-        foreach (array_filter(array_map('trim', preg_split("/( |,|;|\n)/", $bl))) as $bl_item) {
-          if (valid_network($bl_item) && !in_array($bl_item, array(
-            '0.0.0.0',
-            '0.0.0.0/0',
-            getenv('IPV4_NETWORK') . '.0/24',
-            getenv('IPV4_NETWORK') . '.0',
-            getenv('IPV6_NETWORK')
-          ))) {
-            $bl_items[$bl_item] = 1;
-          }
-          else {
-            $_SESSION['return'][] = array(
-              'type' => 'danger',
-              'log' => array(__FUNCTION__, $_action, $_data_log),
-              'msg' => array('network_host_invalid', $bl_item)
-            );
-          }
-        }
-      }
       try {
-        // One transaction, netfilter must never see empty lists in between
-        $redis->multi();
         $redis->Set('F2B_OPTIONS', json_encode($f2b_options));
-        $redis->Del('F2B_WHITELIST', 'F2B_BLACKLIST');
-        if (!empty($wl_items)) {
-          $redis->hMSet('F2B_WHITELIST', $wl_items);
+        $redis->Del('F2B_WHITELIST');
+        $redis->Del('F2B_BLACKLIST');
+        if(!empty($wl)) {
+          $wl_array = array_map('trim', preg_split( "/( |,|;|\n)/", $wl));
+          $wl_array = array_filter($wl_array);
+          if (is_array($wl_array)) {
+            foreach ($wl_array as $wl_item) {
+              if (valid_network($wl_item) || valid_hostname($wl_item)) {
+                $redis->hSet('F2B_WHITELIST', $wl_item, 1);
+              }
+              else {
+                $_SESSION['return'][] = array(
+                  'type' => 'danger',
+                  'log' => array(__FUNCTION__, $_action, $_data_log),
+                  'msg' => array('network_host_invalid', $wl_item)
+                );
+                continue;
+              }
+            }
+          }
         }
-        if (!empty($bl_items)) {
-          $redis->hMSet('F2B_BLACKLIST', $bl_items);
+        if(!empty($bl)) {
+          $bl_array = array_map('trim', preg_split( "/( |,|;|\n)/", $bl));
+          $bl_array = array_filter($bl_array);
+          if (is_array($bl_array)) {
+            foreach ($bl_array as $bl_item) {
+              if (valid_network($bl_item) && !in_array($bl_item, array(
+                '0.0.0.0',
+                '0.0.0.0/0',
+                getenv('IPV4_NETWORK') . '0/24',
+                getenv('IPV4_NETWORK') . '0',
+                getenv('IPV6_NETWORK')
+              ))) {
+                $redis->hSet('F2B_BLACKLIST', $bl_item, 1);
+              }
+              else {
+                $_SESSION['return'][] = array(
+                  'type' => 'danger',
+                  'log' => array(__FUNCTION__, $_action, $_data_log),
+                  'msg' => array('network_host_invalid', $bl_item)
+                );
+                continue;
+              }
+            }
+          }
         }
-        $redis->exec();
       }
       catch (RedisException $e) {
         $_SESSION['return'][] = array(
@@ -345,9 +348,7 @@ function fail2ban($_action, $_data = null, $_extra = null) {
       if (is_array($_extra)) {
         $_extra = $_extra[0];
       }
-      // Timing safe, a missing or empty id never matches
-      $banlist_id = (string)($f2b_options['banlist_id'] ?? '');
-      if ($banlist_id === '' || !is_string($_extra) || !hash_equals($banlist_id, $_extra)) {
+      if ($_extra != $f2b_options['banlist_id']){
         http_response_code(404);
         return false;
       }

data/web/inc/functions.fwdhost.inc.php

@@ -108,14 +108,6 @@ function fwdhost($_action, $_data = null) {
       }
     break;
     case 'delete':
-      if ($_SESSION['mailcow_cc_role'] != "admin") {
-        $_SESSION['return'][] = array(
-          'type' => 'danger',
-          'log' => array(__FUNCTION__, $_action, $_data_log),
-          'msg' => 'access_denied'
-        );
-        return false;
-      }
       $hosts = (array)$_data['forwardinghost'];
       foreach ($hosts as $host) {
         try {

data/web/inc/functions.inc.php

@@ -53,39 +53,6 @@ function valid_network($network) {
 function valid_hostname($hostname) {
   return filter_var($hostname, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME);
 }
-// Validates a browser-style Origin: scheme://host[:port], no path/query/fragment/credentials
-function valid_origin($origin) {
-  $parts = parse_url($origin);
-  if ($parts === false || !isset($parts['scheme']) || !isset($parts['host'])) {
-    return false;
-  }
-  if (!in_array(strtolower($parts['scheme']), array('http', 'https'), true)) {
-    return false;
-  }
-  if (isset($parts['user']) || isset($parts['pass']) || isset($parts['path']) || isset($parts['query']) || isset($parts['fragment'])) {
-    return false;
-  }
-  $host = $parts['host'];
-  $host_without_brackets = trim($host, '[]');
-  if (!valid_hostname($host_without_brackets) && !filter_var($host_without_brackets, FILTER_VALIDATE_IP)) {
-    return false;
-  }
-  // Reject anything that doesn't round-trip to the exact same origin (e.g. stray trailing slash)
-  $port = isset($parts['port']) ? ':' . $parts['port'] : '';
-  $rebuilt = strtolower($parts['scheme']) . '://' . strtolower($host) . $port;
-  return strtolower($origin) === $rebuilt;
-}
-// Bring an origin into the exact form a browser sends it (scheme://host[:port], lowercase).
-function normalize_cors_origin($origin) {
-  $origin = trim($origin);
-  if ($origin === '*') {
-    return '*';
-  }
-  if ($origin !== '' && !preg_match('~^[a-z][a-z0-9+.-]*://~i', $origin)) {
-    $origin = 'https://' . $origin;
-  }
-  return valid_origin($origin) ? strtolower($origin) : false;
-}
 // Thanks to https://stackoverflow.com/a/49373789
 // Validates exact ip matches and ip-in-cidr, ipv4 and ipv6
 function ip_acl($ip, $networks) {
@@ -591,7 +558,7 @@ function logger($_data = false) {
       $type = $return['type'];
       $msg = null;
       if (isset($return['msg'])) {
-        $msg = json_encode($return['msg'], JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT);
+        $msg = json_encode($return['msg'], JSON_UNESCAPED_UNICODE);
       }
       $call = null;
       if (isset($return['log'])) {
@@ -633,18 +600,6 @@ function logger($_data = false) {
     return true;
   }
 }
-function is_local_mailcow_domain($domain) {
-  // True if domain is a locally managed, active primary or alias domain
-  global $pdo;
-  $domain = idn_to_ascii($domain, 0, INTL_IDNA_VARIANT_UTS46);
-  if (empty($domain)) {
-    return false;
-  }
-  $stmt = $pdo->prepare("SELECT 1 FROM `domain` WHERE `domain` = :d AND `active` = 1
-    UNION SELECT 1 FROM `alias_domain` WHERE `alias_domain` = :d2 AND `active` = 1 LIMIT 1");
-  $stmt->execute(array(':d' => $domain, ':d2' => $domain));
-  return (bool)$stmt->fetchColumn();
-}
 function hasDomainAccess($username, $role, $domain) {
   global $pdo;
   if (empty($domain) || !is_valid_domain_name($domain)) {
@@ -985,8 +940,12 @@ function update_sogo_static_view($mailbox = null) {
 
   $mailbox_exists = false;
   if ($mailbox !== null) {
-    // Check if the mailbox exists
-    $stmt = $pdo->prepare("SELECT username FROM mailbox WHERE username = :mailbox AND active = '1'");
+    // Check if the mailbox exists and should have SOGo access
+    $stmt = $pdo->prepare("SELECT m.username FROM mailbox m
+      LEFT JOIN user_acl u ON m.username = u.username
+      WHERE m.username = :mailbox
+      AND m.active = '1'
+      AND (u.sogo_access IS NULL OR u.sogo_access = 1)");
     $stmt->execute(array(':mailbox' => $mailbox));
     $row = $stmt->fetch(PDO::FETCH_ASSOC);
     if ($row){
@@ -1021,8 +980,10 @@ function update_sogo_static_view($mailbox = null) {
         LEFT OUTER JOIN grouped_mail_aliases ga ON ga.username REGEXP CONCAT('(^|,)', mailbox.username, '($|,)')
         LEFT OUTER JOIN grouped_domain_alias_address gda ON gda.username = mailbox.username
         LEFT OUTER JOIN grouped_sender_acl_external external_acl ON external_acl.username = mailbox.username
+        LEFT OUTER JOIN user_acl ON user_acl.username = mailbox.username
       WHERE
         mailbox.active = '1'
+        AND (user_acl.sogo_access IS NULL OR user_acl.sogo_access = 1)
         $subquery
       ON DUPLICATE KEY UPDATE
         `domain` = VALUES(`domain`),
@@ -1050,7 +1011,27 @@ function update_sogo_static_view($mailbox = null) {
     ));
   }
 
-  $stmt = $pdo->query("DELETE FROM _sogo_static_view WHERE `c_uid` NOT IN (SELECT `username` FROM `mailbox` WHERE `active` = '1');");
+  if ($mailbox_exists) {
+    // For single mailbox update, only delete this specific user
+    $stmt = $pdo->prepare("DELETE FROM _sogo_static_view
+      WHERE `c_uid` = :mailbox
+      AND `c_uid` NOT IN (
+        SELECT m.`username` FROM `mailbox` m
+        LEFT JOIN `user_acl` u ON m.`username` = u.`username`
+        WHERE m.`active` = '1'
+        AND m.`username` = :mailbox2
+        AND (u.`sogo_access` IS NULL OR u.`sogo_access` = 1)
+      )");
+    $stmt->execute(array(':mailbox' => $mailbox, ':mailbox2' => $mailbox));
+  } else {
+    // Full cleanup for all users
+    $stmt = $pdo->query("DELETE FROM _sogo_static_view WHERE `c_uid` NOT IN (
+      SELECT m.`username` FROM `mailbox` m
+      LEFT JOIN `user_acl` u ON m.`username` = u.`username`
+      WHERE m.`active` = '1'
+      AND (u.`sogo_access` IS NULL OR u.`sogo_access` = 1)
+    );");
+  }
 
   flush_memcached();
 }
@@ -1292,13 +1273,8 @@ function set_tfa($_data) {
       $row = $stmt->fetch(PDO::FETCH_ASSOC);
       if ($row) {
         if ($row['authsource'] == 'ldap'){
-          try {
-            if (!ldap_mbox_login($username, $_data["confirm_password"], $iam_settings)) $access_denied = true;
-            else $access_denied = false;
-          } catch (\Mailcow\Auth\IdpUnavailable $e) {
-            $_SESSION['return'][] = array('type' => 'danger', 'log' => array(__FUNCTION__, $_data_log, $e->getMessage()), 'msg' => 'iam_unavailable');
-            return false;
-          }
+          if (!ldap_mbox_login($username, $_data["confirm_password"], $iam_settings)) $access_denied = true;
+          else $access_denied = false;
         } else {
           if (!verify_hash($row['password'], $_data["confirm_password"])) $access_denied = true;
           else $access_denied = false;
@@ -2059,6 +2035,128 @@ function verify_tfa_login($username, $_data) {
     return true;
   }
 }
+function admin_api($access, $action, $data = null) {
+  global $pdo;
+  if ($_SESSION['mailcow_cc_role'] != "admin") {
+    $_SESSION['return'][] =  array(
+      'type' => 'danger',
+      'log' => array(__FUNCTION__),
+      'msg' => 'access_denied'
+    );
+    return false;
+  }
+  if ($access !== "ro" && $access !== "rw") {
+    $_SESSION['return'][] =  array(
+      'type' => 'danger',
+      'log' => array(__FUNCTION__),
+      'msg' => 'invalid access type'
+    );
+    return false;
+  }
+  if ($action == "edit") {
+    $active = (!empty($data['active'])) ? 1 : 0;
+    $skip_ip_check = (isset($data['skip_ip_check'])) ? 1 : 0;
+    $allow_from = array();
+    if (isset($data['allow_from'])) {
+      $allow_from = array_map('trim', preg_split( "/( |,|;|\n)/", $data['allow_from']));
+    }
+    foreach ($allow_from as $key => $val) {
+      if (empty($val)) {
+        unset($allow_from[$key]);
+        continue;
+      }
+      if (valid_network($val) !== true) {
+        $_SESSION['return'][] =  array(
+          'type' => 'warning',
+          'log' => array(__FUNCTION__, $data),
+          'msg' => array('ip_invalid', htmlspecialchars($allow_from[$key]))
+        );
+        unset($allow_from[$key]);
+        continue;
+      }
+    }
+    $allow_from = implode(',', array_unique(array_filter($allow_from)));
+    if (empty($allow_from) && $skip_ip_check == 0) {
+      $_SESSION['return'][] =  array(
+        'type' => 'danger',
+        'log' => array(__FUNCTION__, $data),
+        'msg' => 'ip_list_empty'
+      );
+      return false;
+    }
+    $api_key = implode('-', array(
+      strtoupper(bin2hex(random_bytes(3))),
+      strtoupper(bin2hex(random_bytes(3))),
+      strtoupper(bin2hex(random_bytes(3))),
+      strtoupper(bin2hex(random_bytes(3))),
+      strtoupper(bin2hex(random_bytes(3)))
+    ));
+    $stmt = $pdo->query("SELECT `api_key` FROM `api` WHERE `access` = '" . $access . "'");
+    $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
+    if (empty($num_results)) {
+      $stmt = $pdo->prepare("INSERT INTO `api` (`api_key`, `skip_ip_check`, `active`, `allow_from`, `access`)
+        VALUES (:api_key, :skip_ip_check, :active, :allow_from, :access);");
+      $stmt->execute(array(
+        ':api_key' => $api_key,
+        ':skip_ip_check' => $skip_ip_check,
+        ':active' => $active,
+        ':allow_from' => $allow_from,
+        ':access' => $access
+      ));
+    }
+    else {
+      if ($skip_ip_check == 0) {
+        $stmt = $pdo->prepare("UPDATE `api` SET `skip_ip_check` = :skip_ip_check,
+          `active` = :active,
+          `allow_from` = :allow_from
+            WHERE `access` = :access;");
+        $stmt->execute(array(
+          ':active' => $active,
+          ':skip_ip_check' => $skip_ip_check,
+          ':allow_from' => $allow_from,
+          ':access' => $access
+        ));
+      }
+      else {
+        $stmt = $pdo->prepare("UPDATE `api` SET `skip_ip_check` = :skip_ip_check,
+          `active` = :active
+            WHERE `access` = :access;");
+        $stmt->execute(array(
+          ':active' => $active,
+          ':skip_ip_check' => $skip_ip_check,
+          ':access' => $access
+        ));
+      }
+    }
+  }
+  elseif ($action == "regen_key") {
+    $api_key = implode('-', array(
+      strtoupper(bin2hex(random_bytes(3))),
+      strtoupper(bin2hex(random_bytes(3))),
+      strtoupper(bin2hex(random_bytes(3))),
+      strtoupper(bin2hex(random_bytes(3))),
+      strtoupper(bin2hex(random_bytes(3)))
+    ));
+    $stmt = $pdo->prepare("UPDATE `api` SET `api_key` = :api_key WHERE `access` = :access");
+    $stmt->execute(array(
+      ':api_key' => $api_key,
+      ':access' => $access
+    ));
+  }
+  elseif ($action == "get") {
+    $stmt = $pdo->query("SELECT * FROM `api` WHERE `access` = '" . $access . "'");
+    $apidata = $stmt->fetch(PDO::FETCH_ASSOC);
+    if ($apidata !== false) {
+      $apidata['allow_from'] = str_replace(',', PHP_EOL, $apidata['allow_from']);
+    }
+    return $apidata;
+  }
+  $_SESSION['return'][] =  array(
+    'type' => 'success',
+    'log' => array(__FUNCTION__, $data),
+    'msg' => 'admin_api_modified'
+  );
+}
 function license($action, $data = null) {
   global $pdo;
   global $redis;
@@ -2211,13 +2309,10 @@ function cors($action, $data = null) {
         return false;
       }
 
-      $allowed_origins = isset($data['allowed_origins']) ? $data['allowed_origins'] : array(getBaseURL());
+      $allowed_origins = isset($data['allowed_origins']) ? $data['allowed_origins'] : array($_SERVER['SERVER_NAME']);
       $allowed_origins = !is_array($allowed_origins) ? array_filter(array_map('trim', explode("\n", $allowed_origins))) : $allowed_origins;
-      foreach ($allowed_origins as &$origin) {
-        if ($origin === '*') {
-          continue;
-        }
-        if (!valid_origin($origin)) {
+      foreach ($allowed_origins as $origin) {
+        if (!filter_var($origin, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) && $origin != '*') {
           $_SESSION['return'][] = array(
             'type' => 'danger',
             'log' => array(__FUNCTION__, $action, $data),
@@ -2225,10 +2320,7 @@ function cors($action, $data = null) {
           );
           return false;
         }
-        // browsers always send a lowercase scheme/host in the Origin header, so normalize to match
-        $origin = strtolower($origin);
       }
-      unset($origin);
 
       $allowed_methods = isset($data['allowed_methods']) ? $data['allowed_methods'] : array('GET', 'POST', 'PUT', 'DELETE');
       $allowed_methods  = !is_array($allowed_methods) ? array_map('trim', preg_split( "/( |,|;|\n)/", $allowed_methods)) : $allowed_methods;
@@ -2276,35 +2368,26 @@ function cors($action, $data = null) {
         );
       }
 
-      $cors_settings                    = !$cors_settings ? array('allowed_origins' => getBaseURL(), 'allowed_methods' => 'GET, POST, PUT, DELETE') : $cors_settings;
-      $cors_settings['allowed_origins'] = empty($cors_settings['allowed_origins']) ? getBaseURL() : $cors_settings['allowed_origins'];
+      $cors_settings                    = !$cors_settings ? array('allowed_origins' => $_SERVER['SERVER_NAME'], 'allowed_methods' => 'GET, POST, PUT, DELETE') : $cors_settings;
+      $cors_settings['allowed_origins'] = empty($cors_settings['allowed_origins']) ? $_SERVER['SERVER_NAME'] : $cors_settings['allowed_origins'];
       $cors_settings['allowed_methods'] = empty($cors_settings['allowed_methods']) ? 'GET, POST, PUT, DELETE, OPTION' : $cors_settings['allowed_methods'];
 
       return $cors_settings;
     break;
     case "set_headers":
       $cors_settings = cors('get');
-      // normalize the stored list; it may still hold bare hostnames written before origins were validated as origins
-      $allowed_origins = array_filter(array_map('normalize_cors_origin', explode(',', $cors_settings['allowed_origins'])));
-      $origin = isset($_SERVER['HTTP_ORIGIN']) ? normalize_cors_origin($_SERVER['HTTP_ORIGIN']) : false;
       // check if requested origin is in allowed origins
-      $allow_origin = null;
-      if (in_array('*', $allowed_origins, true)) {
-        $allow_origin = '*';
-      } else if ($origin !== false && in_array($origin, $allowed_origins, true)) {
-        $allow_origin = $origin;
+      $allowed_origins = explode(', ', $cors_settings['allowed_origins']);
+      $cors_settings['allowed_origins'] = $allowed_origins[0];
+      if (in_array('*', $allowed_origins)){
+        $cors_settings['allowed_origins'] = '*';
+      } else if (array_key_exists('HTTP_ORIGIN', $_SERVER) && in_array($_SERVER['HTTP_ORIGIN'], $allowed_origins)) {
+        $cors_settings['allowed_origins'] = $_SERVER['HTTP_ORIGIN'];
       }
       // always allow OPTIONS for preflight request
       $cors_settings["allowed_methods"] = empty($cors_settings["allowed_methods"]) ? 'OPTIONS' : $cors_settings["allowed_methods"] . ', ' . 'OPTIONS';
 
-      // a disallowed origin gets no Access-Control-Allow-Origin at all; echoing a different origin than the requesting one tells a browser nothing
-      if ($allow_origin !== null) {
-        header('Access-Control-Allow-Origin: ' . $allow_origin);
-      }
-      if ($allow_origin !== '*') {
-        // the response depends on the request origin, keep caches from mixing them up
-        header('Vary: Origin', false);
-      }
+      header('Access-Control-Allow-Origin: ' . $cors_settings['allowed_origins']);
       header('Access-Control-Allow-Methods: '. $cors_settings['allowed_methods']);
       header('Access-Control-Allow-Headers: Accept, Content-Type, X-Api-Key, Origin');
 
@@ -2365,7 +2448,6 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
   $data_log = $_data;
   if (isset($data_log['client_secret'])) $data_log['client_secret'] = '*';
   if (isset($data_log['access_token'])) $data_log['access_token'] = '*';
-  if (isset($data_log['bindpass'])) $data_log['bindpass'] = '*';
 
   switch ($_action) {
     case 'get':
@@ -2376,12 +2458,9 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
       foreach($rows as $row){
         switch ($row["key"]) {
           case "redirect_url_extra":
-            $settings[$row["key"]] = json_decode($row["value"]);
-          break;
           case "mappers":
           case "templates":
-            // Parallel lists; older rows can be JSON objects, decode as arrays to keep the keys aligned
-            $settings[$row["key"]] = (array)json_decode($row["value"], true);
+            $settings[$row["key"]] = json_decode($row["value"]);
           break;
           case "use_ssl":
           case "use_tls":
@@ -2464,13 +2543,6 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
 
       $_data['ignore_ssl_error']    = isset($_data['ignore_ssl_error']) ? boolval($_data['ignore_ssl_error']) : false;
       $_data['login_provisioning']  = isset($_data['login_provisioning']) ? boolval($_data['login_provisioning']) : false;
-      // Identity sync: offboarding and groups (Keycloak and LDAP)
-      $sync_settings = array('offboarding', 'offboarding_limit', 'group_sync', 'group_autocreate', 'group_default_domain');
-      $_data['offboarding']          = isset($_data['offboarding']) ? intval($_data['offboarding']) : 0;
-      $_data['offboarding_limit']    = isset($_data['offboarding_limit']) && is_numeric($_data['offboarding_limit']) ? min(100, max(0, intval($_data['offboarding_limit']))) : 10;
-      $_data['group_sync']           = isset($_data['group_sync']) ? intval($_data['group_sync']) : 0;
-      $_data['group_autocreate']     = isset($_data['group_autocreate']) ? intval($_data['group_autocreate']) : 0;
-      $_data['group_default_domain'] = isset($_data['group_default_domain']) ? strtolower(trim($_data['group_default_domain'])) : "";
       switch ($_data['authsource']) {
         case "keycloak":
           $_data['server_url']        = (!empty($_data['server_url'])) ? rtrim($_data['server_url'], '/') : null;
@@ -2479,8 +2551,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           $_data['import_users']      = isset($_data['import_users']) ? intval($_data['import_users']) : 0;
           $_data['sync_interval']     = (!empty($_data['sync_interval'])) ? intval($_data['sync_interval']) : 15;
           $_data['sync_interval']     = $_data['sync_interval'] < 1 ? 1 : $_data['sync_interval'];
-          $_data['group_paths']       = isset($_data['group_paths']) ? trim($_data['group_paths']) : "";
-          $required_settings          = array_merge(array('authsource', 'server_url', 'realm', 'client_id', 'client_secret', 'redirect_url', 'version', 'mailpassword_flow', 'periodic_sync', 'import_users', 'sync_interval', 'ignore_ssl_error', 'login_provisioning', 'group_paths'), $sync_settings);
+          $required_settings          = array('authsource', 'server_url', 'realm', 'client_id', 'client_secret', 'redirect_url', 'version', 'mailpassword_flow', 'periodic_sync', 'import_users', 'sync_interval', 'ignore_ssl_error', 'login_provisioning');
         break;
         case "generic-oidc":
           $_data['authorize_url']     = (!empty($_data['authorize_url'])) ? $_data['authorize_url'] : null;
@@ -2501,14 +2572,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           $_data['use_tls']           = isset($_data['use_tls']) && !$_data['use_ssl'] ? boolval($_data['use_tls']) : false;
           $_data['sync_interval']     = (!empty($_data['sync_interval'])) ? intval($_data['sync_interval']) : 15;
           $_data['sync_interval']     = $_data['sync_interval'] < 1 ? 1 : $_data['sync_interval'];
-          $_data['id_attribute']      = isset($_data['id_attribute']) ? strtolower(trim($_data['id_attribute'])) : "";
-          $_data['disabled_filter']   = isset($_data['disabled_filter']) ? trim($_data['disabled_filter']) : "";
-          $_data['group_basedn']      = isset($_data['group_basedn']) ? trim($_data['group_basedn']) : "";
-          $_data['group_filter']      = isset($_data['group_filter']) ? trim($_data['group_filter']) : "";
-          $_data['group_name_attribute'] = (!empty($_data['group_name_attribute'])) ? strtolower(trim($_data['group_name_attribute'])) : "cn";
-          $_data['group_member_mode'] = isset($_data['group_member_mode']) && in_array($_data['group_member_mode'], array('memberof', 'member', 'ad_chain')) ? $_data['group_member_mode'] : "memberof";
-          $_data['group_member_attribute'] = (!empty($_data['group_member_attribute'])) ? strtolower(trim($_data['group_member_attribute'])) : "member";
-          $required_settings          = array_merge(array('authsource', 'host', 'port', 'basedn', 'username_field', 'filter', 'attribute_field', 'binddn', 'bindpass', 'periodic_sync', 'import_users', 'sync_interval', 'use_ssl', 'use_tls', 'ignore_ssl_error', 'login_provisioning', 'id_attribute', 'disabled_filter', 'group_basedn', 'group_filter', 'group_name_attribute', 'group_member_mode', 'group_member_attribute'), $sync_settings);
+          $required_settings          = array('authsource', 'host', 'port', 'basedn', 'username_field', 'filter', 'attribute_field', 'binddn', 'bindpass', 'periodic_sync', 'import_users', 'sync_interval', 'use_ssl', 'use_tls', 'ignore_ssl_error', 'login_provisioning');
         break;
       }
 
@@ -2530,10 +2594,6 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         $stmt->bindParam(':value', $_data[$setting]);
         $stmt->execute();
       }
-      // Stored LDAP ids of another id attribute never match again, the mailboxes are linked by email again
-      if ($_data['authsource'] == 'ldap' && ($iam_settings['id_attribute'] ?? '') != $_data['id_attribute']) {
-        $pdo->query("UPDATE `identity_link` SET `external_id` = NULL WHERE `provider` = 'ldap'");
-      }
       $pdo->commit();
 
       // add redirect_url_extra
@@ -2561,26 +2621,19 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         $_data['mappers'] = (!is_array($_data['mappers'])) ? array($_data['mappers']) : $_data['mappers'];
         $_data['templates'] = (!is_array($_data['templates'])) ? array($_data['templates']) : $_data['templates'];
 
-        // Keep mapper/template pairs together, incomplete rows are dropped
-        $mappers = array();
-        $templates = array();
-        $template_values = array_values($_data['templates']);
-        foreach (array_values($_data['mappers']) as $i => $mapper) {
-          if ((string)$mapper === '' || (string)($template_values[$i] ?? '') === '') {
-            continue;
-          }
-          $mappers[] = $mapper;
-          $templates[] = $template_values[$i];
-        }
-        $mappers = json_encode($mappers);
-        $templates = json_encode($templates);
+        $mappers = array_filter($_data['mappers']);
+        $templates = array_filter($_data['templates']);
+        if (count($mappers) == count($templates)){
+          $mappers = json_encode($mappers);
+          $templates = json_encode($templates);
 
-        $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('mappers', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);");
-        $stmt->bindParam(':value', $mappers);
-        $stmt->execute();
-        $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('templates', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);");
-        $stmt->bindParam(':value', $templates);
-        $stmt->execute();
+          $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('mappers', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);");
+          $stmt->bindParam(':value', $mappers);
+          $stmt->execute();
+          $stmt = $pdo->prepare("INSERT INTO identity_provider (`key`, `value`) VALUES ('templates', :value) ON DUPLICATE KEY UPDATE `value` = VALUES(`value`);");
+          $stmt->bindParam(':value', $templates);
+          $stmt->execute();
+        }
       }
 
       // delete old access_token
@@ -2705,8 +2758,6 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
       }
 
       $stmt = $pdo->query("DELETE FROM identity_provider;");
-      $stmt = $pdo->query("DELETE FROM identity_link;");
-      $stmt = $pdo->query("DELETE FROM identity_sync_run;");
 
       $_SESSION['return'][] =  array(
         'type' => 'success',
@@ -2827,8 +2878,8 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
       }
 
       // get mapped template
-      $idp_login = \Mailcow\Auth\AuthModule::fromGlobals()->idp;
-      $mapped_template = $idp_login->mappedTemplate($info['mailcow_template'] ?? array());
+      $user_template = $info['mailcow_template'];
+      $mapper_key = array_search($user_template, $iam_settings['mappers']);
 
       // token valid, get mailbox
       $stmt = $pdo->prepare("SELECT
@@ -2850,23 +2901,13 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           );
           return false;
         }
-        if (!$idp_login->verifyLink($iam_settings['authsource'], $info['email'], (string)($info['sub'] ?? ''))) {
-          clear_session();
-          $_SESSION['return'][] =  array(
-            'type' => 'danger',
-            'log' => array(__FUNCTION__, $info['email'], 'The mailbox is linked to another IdP user'),
-            'msg' => 'login_failed'
-          );
-          return false;
-        }
-        $update_template = $idp_login->templateFor($info['email'], $mapped_template);
-        if ($update_template !== null) {
+        if ($mapper_key !== false) {
           // update user
           $_SESSION['access_all_exception'] = '1';
           mailbox('edit', 'mailbox_from_template', array(
             'username' => $info['email'],
             'name' => $info['name'],
-            'template' => $update_template
+            'template' => $iam_settings['templates'][$mapper_key]
           ));
           $_SESSION['access_all_exception'] = '0';
 
@@ -2881,11 +2922,11 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           $stmt->execute(array(':user' => $info['email']));
           $row = $stmt->fetch(PDO::FETCH_ASSOC);
         }
-        if ($row['active'] != 1 || $row['d_active'] != 1 || (json_decode($row['attributes'], true)['shared'] ?? '0') == '1') {
+        if ($row['active'] != 1 || $row['d_active'] != 1) {
           clear_session();
           $_SESSION['return'][] =  array(
             'type' => 'danger',
-            'log' => array(__FUNCTION__, $info['email'], 'Domain or mailbox is inactive or shared'),
+            'log' => array(__FUNCTION__, $info['email'], 'Domain or mailbox is inactive'),
             'msg' => 'login_failed'
           );
           return false;
@@ -2911,7 +2952,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         return false;
       }
 
-      if ($mapped_template === null){
+      if (empty($iam_settings['mappers']) || empty($user_template) || $mapper_key === false){
         if (!empty($iam_settings['default_template'])) {
           $mbox_template = $iam_settings['default_template'];
         } else {
@@ -2924,17 +2965,7 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
           return false;
         }
       } else {
-        $mbox_template = $mapped_template;
-      }
-
-      if (!$idp_login->mayCreate($iam_settings['authsource'], $info['email'], (string)($info['sub'] ?? ''))) {
-        clear_session();
-        $_SESSION['return'][] =  array(
-          'type' => 'danger',
-          'log' => array(__FUNCTION__, $info['email'], 'The IdP user is linked to another mailbox'),
-          'msg' => 'login_failed'
-        );
-        return false;
+        $mbox_template = $iam_settings['templates'][$mapper_key];
       }
 
       // create mailbox
@@ -2956,7 +2987,6 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         );
         return false;
       }
-      $idp_login->storeLink($iam_settings['authsource'], $info['email'], (string)($info['sub'] ?? ''));
 
       // double check if mailbox and domain is active
       $stmt = $pdo->prepare("SELECT * FROM `mailbox`
@@ -3013,26 +3043,6 @@ function identity_provider($_action = null, $_data = null, $_extra = null) {
         return false;
       }
 
-      // The mailbox may have been deleted or deactivated since the login
-      $stmt = $pdo->prepare("SELECT `mailbox`.`authsource` FROM `mailbox`
-        INNER JOIN `domain` ON `mailbox`.`domain` = `domain`.`domain`
-        WHERE `kind` NOT REGEXP 'location|thing|group'
-          AND `mailbox`.`active` = '1'
-          AND `domain`.`active` = '1'
-          AND COALESCE(JSON_UNQUOTE(JSON_VALUE(`mailbox`.`attributes`, '$.shared')), '0') != '1'
-          AND `username` = :user");
-      $stmt->execute(array(':user' => $info['email']));
-      $row = $stmt->fetch(PDO::FETCH_ASSOC);
-      if (!$row || !in_array($row['authsource'], array('keycloak', 'generic-oidc'))) {
-        clear_session();
-        $_SESSION['return'][] =  array(
-          'type' => 'danger',
-          'log' => array(__FUNCTION__, $info['email'], 'Mailbox or domain is inactive or not of type OIDC'),
-          'msg' => 'refresh_login_failed'
-        );
-        return false;
-      }
-
       set_user_loggedin_session($info['email']);
       $_SESSION['iam_token'] = $plain_token;
       $_SESSION['iam_refresh_token'] = $plain_refreshtoken;
@@ -3506,9 +3516,14 @@ function set_user_loggedin_session($user) {
   session_regenerate_id(true);
   $_SESSION['mailcow_cc_username'] = $user;
   $_SESSION['mailcow_cc_role'] = 'user';
-  $sogo_sso_pass = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
-  $_SESSION['sogo-sso-user-allowed'][] = $user;
-  $_SESSION['sogo-sso-pass'] = $sogo_sso_pass;
+
+  acl('to_session');
+  if (hasACLAccess("sogo_access")) {
+    $sogo_sso_pass = file_get_contents("/etc/sogo-sso/sogo-sso.pass");
+    $_SESSION['sogo-sso-user-allowed'][] = $user;
+    $_SESSION['sogo-sso-pass'] = $sogo_sso_pass;
+  }
+
   unset($_SESSION['pending_mailcow_cc_username']);
   unset($_SESSION['pending_mailcow_cc_role']);
   unset($_SESSION['pending_tfa_methods']);
@@ -3519,16 +3534,7 @@ function protect_route($allowed_roles = ['admin', 'domainadmin', 'user'], $redir
     if (isset($redirects['unauthenticated'])) {
       header('Location: ' . $redirects['unauthenticated']);
     } else {
-      // Send a deep link to the login page for its area instead of the user login at /,
-      // e.g. /admin/dashboard -> /admin rather than /
-      $request_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/';
-      if (strpos($request_uri, '/admin/') === 0) {
-        header('Location: /admin');
-      } elseif (strpos($request_uri, '/domainadmin/') === 0) {
-        header('Location: /domainadmin');
-      } else {
-        header('Location: /');
-      }
+      header('Location: /');
     }
     exit();
   }

data/web/inc/functions.quarantine.inc.php

@@ -22,7 +22,7 @@ function quarantine($_action, $_data = null) {
         return false;
       }
       $stmt = $pdo->prepare('SELECT `id` FROM `quarantine` LEFT OUTER JOIN `user_acl` ON `user_acl`.`username` = `rcpt`
-        WHERE `qhash` = :hash
+        WHERE `qhash` = :hash
           AND user_acl.quarantine = 1
           AND rcpt IN (SELECT username FROM mailbox)');
       $stmt->execute(array(':hash' => $hash));
@@ -65,7 +65,7 @@ function quarantine($_action, $_data = null) {
         return false;
       }
       $stmt = $pdo->prepare('SELECT `id` FROM `quarantine` LEFT OUTER JOIN `user_acl` ON `user_acl`.`username` = `rcpt`
-        WHERE `qhash` = :hash
+        WHERE `qhash` = :hash
           AND `user_acl`.`quarantine` = 1
           AND `username` IN (SELECT `username` FROM `mailbox`)');
       $stmt->execute(array(':hash' => $hash));
@@ -170,8 +170,6 @@ function quarantine($_action, $_data = null) {
         }
         elseif ($release_format == 'raw') {
           $detail_row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $detail_row['msg']);
-          // dot-stuffing per RFC5321 4.5.2: escape leading dots
-          $detail_row['msg'] = preg_replace('~^\.~m', '..', $detail_row['msg']);
           $postfix_talk = array(
             array('220', 'HELO quarantine' . chr(10)),
             array('250', 'MAIL FROM: ' . $sender . chr(10)),
@@ -182,7 +180,7 @@ function quarantine($_action, $_data = null) {
             array('221', '')
           );
           // Thanks to https://stackoverflow.com/questions/6632399/given-an-email-as-raw-text-how-can-i-send-it-using-php
-          $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1);
+          $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); 
           if (!$smtp_connection) {
             logger(array('return' => array(
               array(
@@ -194,7 +192,7 @@ function quarantine($_action, $_data = null) {
             return false;
           }
           for ($i=0; $i < count($postfix_talk); $i++) {
-            $smtp_resource = fgets($smtp_connection, 256);
+            $smtp_resource = fgets($smtp_connection, 256); 
             if (substr($smtp_resource, 0, 3) !== $postfix_talk[$i][0]) {
               $ret = substr($smtp_resource, 0, 3);
               $ret = (empty($ret)) ? '-' : $ret;
@@ -467,19 +465,17 @@ function quarantine($_action, $_data = null) {
           }
           elseif ($release_format == 'raw') {
             $row['msg'] = preg_replace('/^X-Spam-Flag: (.*)/m', 'X-Pre-Release-Spam-Flag: $1', $row['msg']);
-            // dot-stuffing per RFC5321 4.5.2: escape leading dots
-            $row['msg'] = preg_replace('~^\.~m', '..', $row['msg']);
             $postfix_talk = array(
               array('220', 'HELO quarantine' . chr(10)),
               array('250', 'MAIL FROM: ' . $sender . chr(10)),
               array('250', 'RCPT TO: ' . $row['rcpt'] . chr(10)),
               array('250', 'DATA' . chr(10)),
-              array('354', $row['msg'] . chr(10) . '.' . chr(10)),
+              array('354', str_replace("\n.", '', $row['msg']) . chr(10) . '.' . chr(10)),
               array('250', 'QUIT' . chr(10)),
               array('221', '')
             );
             // Thanks to https://stackoverflow.com/questions/6632399/given-an-email-as-raw-text-how-can-i-send-it-using-php
-            $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1);
+            $smtp_connection = fsockopen($postfix, 590, $errno, $errstr, 1); 
             if (!$smtp_connection) {
               $_SESSION['return'][] = array(
                 'type' => 'warning',
@@ -489,7 +485,7 @@ function quarantine($_action, $_data = null) {
               return false;
             }
             for ($i=0; $i < count($postfix_talk); $i++) {
-              $smtp_resource = fgets($smtp_connection, 256);
+              $smtp_resource = fgets($smtp_connection, 256); 
               if (substr($smtp_resource, 0, 3) !== $postfix_talk[$i][0]) {
                 $ret = substr($smtp_resource, 0, 3);
                 $ret = (empty($ret)) ? '-' : $ret;
@@ -837,7 +833,7 @@ function quarantine($_action, $_data = null) {
         )));
         return false;
       }
-      $stmt = $pdo->prepare('SELECT * FROM `quarantine` WHERE `qhash` = :hash');
+      $stmt = $pdo->prepare('SELECT * FROM `quarantine` WHERE `qhash` = :hash');
       $stmt->execute(array(':hash' => $hash));
       return $stmt->fetch(PDO::FETCH_ASSOC);
     break;