PMG/Config.pm: allow single address setups

[pmg-api.git] / PMG / Config.pm

diff --git a/PMG/Config.pm b/PMG/Config.pm
index b3b6643a33d05bd66d3dd6f27089f021fb4d6a81..8b1c2dcfe15e8940352a448f466b0f2ec775e10e 100755 (executable)
--- a/PMG/Config.pm
+++ b/PMG/Config.pm
@@ -144,6 +144,13 @@ sub properties {
            description => "Whitelist legitimate bounce relays.",
            type => 'string',
        },
+       clamav_heuristic_score => {
+           description => "Score for ClamaAV heuristics (Google Safe Browsing database, PhishingScanURLs, ...).",
+           type => 'integer',
+           minimum => 0,
+           maximum => 1000,
+           default => 3,
+       },
        bounce_score => {
            description => "Additional score for bounce mails.",
            type => 'integer',
@@ -160,7 +167,7 @@ sub properties {
            description => "Maximum size of spam messages in bytes.",
            type => 'integer',
            minimum => 64,
-           default => 200*1024,
+           default => 256*1024,
        },
     };
 }
@@ -172,6 +179,7 @@ sub options {
        wl_bounce_relays => { optional => 1 },
        languages => { optional => 1 },
        use_bayes => { optional => 1 },
+       clamav_heuristic_score => { optional => 1 },
        bounce_score => { optional => 1 },
        rbl_checks => { optional => 1 },
        maxspamsize => { optional => 1 },
@@ -403,14 +411,14 @@ sub properties {
            type => 'integer',
            minimum => 1,
            maximum => 65535,
-           default => 25,
+           default => 26,
        },
        ext_port => {
            description => "SMTP port number for incoming mail (untrusted). This must be a different number than 'int_port'.",
            type => 'integer',
            minimum => 1,
            maximum => 65535,
-           default => 26,
+           default => 25,
        },
        relay => {
            description => "The default mail delivery transport (incoming mails).",
@@ -501,11 +509,6 @@ sub properties {
            minimum => 0,
            default => 4,
        },
-       use_rbl => {
-           description => "Use Realtime Blacklists.",
-           type => 'boolean',
-           default => 1,
-       },
        tls => {
            description => "Enable TLS.",
            type => 'boolean',
@@ -553,7 +556,7 @@ sub properties {
        },
        dnsbl_sites => {
            description => "Optional list of DNS white/blacklist domains (see postscreen_dnsbl_sites parameter).",
-           type => 'string',
+           type => 'string', format => 'dnsbl-entry-list',
        },
     };
 }
@@ -571,7 +574,6 @@ sub options {
        max_smtpd_out => { optional => 1 },
        greylist => { optional => 1 },
        helotests => { optional => 1 },
-       use_rbl => { optional => 1 },
        tls => { optional => 1 },
        tlslog => { optional => 1 },
        tlsheader => { optional => 1 },
@@ -618,6 +620,7 @@ PMG::Config::Base->init();
 
 PVE::JSONSchema::register_format(
     'transport-domain', \&pmg_verify_transport_domain);
+
 sub pmg_verify_transport_domain {
     my ($name, $noerr) = @_;
 
@@ -631,6 +634,22 @@ sub pmg_verify_transport_domain {
     return $name;
 }
 
+PVE::JSONSchema::register_format(
+    'dnsbl-entry', \&pmg_verify_dnsbl_entry);
+
+sub pmg_verify_dnsbl_entry {
+    my ($name, $noerr) = @_;
+
+    # like dns-name, but can contain trailing weight: 'domain*<WEIGHT>'
+    my $namere = "([a-zA-Z0-9]([a-zA-Z0-9\-]*[a-zA-Z0-9])?)";
+
+    if ($name !~ /^(${namere}\.)*${namere}(\*\-?\d+)?$/) {
+          return undef if $noerr;
+          die "value '$name' does not look like a valid dnsbl entry\n";
+    }
+    return $name;
+}
+
 sub new {
     my ($type) = @_;
 
@@ -819,10 +838,6 @@ PVE::INotify::register_file('domains', $domainsfilename,
 
 my $mynetworks_filename = "/etc/pmg/mynetworks";
 
-sub postmap_pmg_mynetworks {
-    PMG::Utils::run_postmap($mynetworks_filename);
-}
-
 sub read_pmg_mynetworks {
     my ($filename, $fh) = @_;
 
@@ -977,9 +992,7 @@ sub get_template_vars {
 
     my $nodename = PVE::INotify::nodename();
     my $int_ip = PMG::Cluster::remote_node_ip($nodename);
-    my $int_net_cidr = PMG::Utils::find_local_network_for_ip($int_ip);
     $vars->{ipconfig}->{int_ip} = $int_ip;
-    # $vars->{ipconfig}->{int_net_cidr} = $int_net_cidr;
 
     my $transportnets = [];
 
@@ -998,11 +1011,22 @@ sub get_template_vars {
     $vars->{postfix}->{transportnets} = join(' ', @$transportnets);
 
     my $mynetworks = [ '127.0.0.0/8', '[::1]/128' ];
-    push @$mynetworks, @$transportnets;
-    push @$mynetworks, $int_net_cidr;
-    push @$mynetworks, 'hash:/etc/pmg/mynetworks';
+
+    if (my $int_net_cidr = PMG::Utils::find_local_network_for_ip($int_ip, 1)) {
+       push @$mynetworks, $int_net_cidr;
+    } else {
+       if ($int_ip =~ m/^$IPV6RE$/) {
+           push @$mynetworks, "$int_ip/128";
+       } else {
+           push @$mynetworks, "$int_ip/32";
+       }
+    }
 
     my $netlist = PVE::INotify::read_file('mynetworks');
+    push @$mynetworks, keys %$netlist;
+
+    push @$mynetworks, @$transportnets;
+
     # add default relay to mynetworks
     if (my $relay = $self->get('mail', 'relay')) {
        if ($relay =~ m/^$IPV4RE$/) {
@@ -1024,14 +1048,16 @@ sub get_template_vars {
 
     my $usepolicy = 0;
     $usepolicy = 1 if $self->get('mail', 'greylist') ||
-       $self->get('mail', 'spf') ||  $self->get('mail', 'use_rbl');
+       $self->get('mail', 'spf');
     $vars->{postfix}->{usepolicy} = $usepolicy;
 
     my $resolv = PVE::INotify::read_file('resolvconf');
     $vars->{dns}->{hostname} = $nodename;
-    $vars->{dns}->{domain} = $resolv->{search};
 
-    my $wlbr = "$nodename.$resolv->{search}";
+    my $domain = $resolv->{search} // 'localdomain';
+    $vars->{dns}->{domain} = $domain;
+
+    my $wlbr = "$nodename.$domain";
     foreach my $r (PVE::Tools::split_list($vars->{pmg}->{spam}->{wl_bounce_relays})) {
        $wlbr .= " $r"
     }
@@ -1305,11 +1331,6 @@ sub rewrite_config_postfix {
     my ($self, $rulecache) = @_;
 
     # make sure we have required files (else postfix start fails)
-    postmap_pmg_domains();
-    postmap_pmg_transport();
-    postmap_pmg_mynetworks();
-    postmap_tls_policy();
-
     IO::File->new($transport_map_filename, 'a', 0644);
 
     my $changes = 0;
@@ -1327,6 +1348,12 @@ sub rewrite_config_postfix {
     $changes = 1 if $self->rewrite_config_file(
        'master.cf.in', '/etc/postfix/master.cf');
 
+    # make sure we have required files (else postfix start fails)
+    # Note: postmap need a valid /etc/postfix/main.cf configuration
+    postmap_pmg_domains();
+    postmap_pmg_transport();
+    postmap_tls_policy();
+
     rewrite_postfix_whitelist($rulecache) if $rulecache;
 
     # make sure aliases.db is up to date