Merge ~kotodama/mailman3-core-charm/+git/mailman3-core-charm:strict_hosts_checks into mailman3-core-charm:master

[Loïc Gomez]

Add strict_hosts_check option enabling hostname checks in smtpd_recipient_restrictions
Fix `postconf' command mistyped as `postmap'

[Loïc Gomez (kotodama)]

See https://pastebin.ubuntu.com/p/xKWX7hwW4b/ for juju config tests.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Tom Haddon (mthaddon)]

LGTM, thx

review: Approve

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change successfully merged at revision b7c5c9c2fb7259e310f984e9a94c9ee3c343b388

diff --git a/config.yaml b/config.yaml
index 4dba6bf..61aefd4 100644
--- a/config.yaml
+++ b/config.yaml
@@ -40,6 +40,17 @@ options:
     type: boolean
     description: |
       Enable Postfix SPF extensions
+  enable_strict_host_checks:
+    default: ""
+    type: string
+    description: |
+      Enable strict hostname checks in smtpd_recipient_restrictions.
+
+      Set to "true" to enable, or "test" to enable checks in test mode.
+
+      Test mode will prefix the restrictions with warn_if_reject, so that
+      potential rejections will appear in the server logs but won't actually
+      reject messages.
   spamassassin_policy:
     default: ""
     type: string
diff --git a/reactive/mailman3_core.py b/reactive/mailman3_core.py
index 4334c05..081cdcb 100644
--- a/reactive/mailman3_core.py
+++ b/reactive/mailman3_core.py
@@ -98,7 +98,7 @@ def configure_postfix():
         subprocess.check_output(['postconf', 'relay_domains=hash:/var/lib/mailman3/data/postfix_domains'])
         subprocess.check_output(['postmap', '/var/lib/mailman3/data/postfix_domains'])
 
-    subprocess.check_output(['postmap', 'smtpd_sender_restrictions=reject_unknown_sender_domain'])
+    subprocess.check_output(['postconf', 'smtpd_sender_restrictions=reject_unknown_sender_domain'])
 
     # HyperKitty expects messages will all have the 'Message-ID' header,
     # unfortunately not all clients do so let's work around it (LP: #1776658)
@@ -110,6 +110,8 @@ def configure_postfix():
     if config["enable_spf"]:
         configure_postfix_spf()
 
+    configure_recipient_restrictions()
+
     host.service_reload('postfix')
     # Open the SMTP port
     hookenv.open_port(25)
@@ -117,6 +119,40 @@ def configure_postfix():
     hookenv.status_set('active', 'ready')
 
 
+# Configure smtpd_recipient_restrictions depending on if SPF is enabled
+# and if strict hosts checking is enabled or in test mode
+def configure_recipient_restrictions():
+    config = hookenv.config()
+
+    smtpd_rr = [
+        "permit_sasl_authenticated",
+        "permit_mynetworks"
+    ]
+
+    rr_shc = [
+        "reject_non_fqdn_helo_hostname",
+        "reject_non_fqdn_recipient",
+        "reject_non_fqdn_sender",
+        "reject_invalid_helo_hostname",
+        "reject_unknown_recipient_domain",
+        "reject_unknown_sender_domain"
+    ]
+
+    if config["enable_strict_host_checks"] == 'true':
+        smtpd_rr.extend(rr_shc)
+    elif config["enable_strict_host_checks"] == 'test':
+        smtpd_rr.extend(["warn_if_reject " + e for e in rr_shc])
+
+    smtpd_rr.append("reject_unauth_destination")
+
+    if config["enable_spf"]:
+        smtpd_rr.append("check_policy_service unix:private/policy-spf")
+
+    # postconf accepts space-separated restrictions, but we also may have
+    # whitespace when using eg. warn_if_reject, so let's use commas.
+    postconf(key="smtpd_recipient_restrictions", value=",".join(smtpd_rr))
+
+
 def configure_spamassassin():
     config = hookenv.config()
     default_config = ('ENABLED=0\n'
@@ -147,12 +183,7 @@ def configure_spamassassin():
 def configure_postfix_spf():
     config = hookenv.config()
     postconf(key="policy-spf_time_limit", value="3600s")
-    postconf(key="smtpd_recipient_restrictions", value=(
-        "permit_sasl_authenticated "
-        "permit_mynetworks "
-        "reject_unauth_destination "
-        "check_policy_service unix:private/policy-spf"
-    ))
+
     if not postconf(key="policy-spf", args=("-F",)):  # Check to see if spf is already configured.
         spf_master_cf = os.path.join(hookenv.charm_dir(), "files/spf_master.cf")
         with open(spf_master_cf) as f: