Skip to content

Commit 889b39d

Browse files
DavidePrincipiDavidePrincipi
authored
Merge pull request #197 from NethServer/bug-7552-2
fix: priority of address over LDAP user/group Refs NethServer/dev#7552
2 parents ffeaba2 + 63fee8a commit 889b39d

File tree

3 files changed

+65
-9
lines changed

3 files changed

+65
-9
lines changed

‎postfix/etc/postfix/alias-access-check.cf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#
2+
# alias-access-check -- check_recipient_access
3+
#
4+
# Check if a matching alias does NOT exist. The result of this query is %s,
5+
# the search key itself, so it can be sent in "pipeline:" to LDAP,
6+
# to verify if it corresponds to a domain user or group name.
7+
#
8+
# If the alias EXISTS, the query returns an empty set and the "pipeline:"
9+
# lookup stops.
10+
#
11+
12+
dbpath = /srv/pcdb.sqlite
13+
query =
14+
SELECT '%s'
15+
FROM destmap
16+
WHERE NOT EXISTS (
17+
SELECT dest
18+
FROM destmap
19+
WHERE alocal = '%u'
20+
AND domain IN ('%d', '*')
21+
AND '%d' IN (SELECT domain FROM domains)
22+
)
23+
LIMIT 1

‎postfix/usr/local/bin/reload-config‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,16 +56,16 @@ tmpl_virtual_alias_domains=$(pcdbquery "SELECT group_concat(domain) FROM domains
5656
origin_flags="$(pcdbquery "SELECT addusers + (addgroups * 2) AS origin_flags FROM domains WHERE domain='${POSTFIX_ORIGIN}'")"
5757
if [ "${origin_flags}" == 1 ]; then
5858
# addusers flag: reject groups and vmail, accept users and aliases
59-
tmpl_reject_internal_myorigin="check_recipient_access inline:{{ vmail@${POSTFIX_ORIGIN} = REJECT access denied }}",'check_recipient_access pipemap:{proxy:ldap:$meta_directory/laddgroupmembers.cf,static:{REJECT access denied}}'
59+
tmpl_reject_internal_myorigin="check_recipient_access inline:{{ vmail@${POSTFIX_ORIGIN} = REJECT access denied }}",'check_recipient_access pipemap:{sqlite:$meta_directory/alias-access-check.cf,proxy:ldap:$meta_directory/laddgroupmembers.cf,static:{REJECT access denied}}'
6060
elif [ "${origin_flags}" == 2 ]; then
6161
# addgroups flag: reject users and vmail, accept groups and aliases
62-
tmpl_reject_internal_myorigin="check_recipient_access inline:{{ vmail@${POSTFIX_ORIGIN} = REJECT access denied }}",'check_recipient_access pipemap:{proxy:ldap:$meta_directory/laddusers-origin.cf,static:{REJECT access denied}}'
62+
tmpl_reject_internal_myorigin="check_recipient_access inline:{{ vmail@${POSTFIX_ORIGIN} = REJECT access denied }}",'check_recipient_access pipemap:{sqlite:$meta_directory/alias-access-check.cf,proxy:ldap:$meta_directory/laddusers-origin.cf,static:{REJECT access denied}}'
6363
elif [ "${origin_flags}" == 3 ]; then
6464
# addusers+addgroups flag: reject vmail only, accept everything else
6565
tmpl_reject_internal_myorigin="check_recipient_access inline:{{ vmail@${POSTFIX_ORIGIN} = REJECT access denied }}"
6666
elif [ "${origin_flags}" == 0 ]; then
6767
# domain has no flags: reject users, groups, and vmail, accept aliases
68-
tmpl_reject_internal_myorigin="check_recipient_access inline:{{ vmail@${POSTFIX_ORIGIN} = REJECT access denied }}",'check_recipient_access pipemap:{unionmap:{proxy:ldap:$meta_directory/laddusers-origin.cf,proxy:ldap:$meta_directory/laddgroupmembers.cf},static:{REJECT access denied}}'
68+
tmpl_reject_internal_myorigin="check_recipient_access inline:{{ vmail@${POSTFIX_ORIGIN} = REJECT access denied }}",'check_recipient_access pipemap:{sqlite:$meta_directory/alias-access-check.cf,unionmap:{proxy:ldap:$meta_directory/laddusers-origin.cf,proxy:ldap:$meta_directory/laddgroupmembers.cf},static:{REJECT access denied}}'
6969
else
7070
# reject everything because the domain not defined
7171
tmpl_reject_internal_myorigin="check_recipient_access inline:{{ ${POSTFIX_ORIGIN} = REJECT access denied }}"

‎tests/50__smtp/00__user_domain.robot‎

Lines changed: 39 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ Everything but defined addresses is internal
2222
Addresses are accessible
2323
Check different forward settings
2424
Address overrides user name
25+
Address overrides group name
2526

2627
User is public, group and vmail are internal
2728
[Tags] robot:continue-on-failure
@@ -33,6 +34,7 @@ User is public, group and vmail are internal
3334
Addresses are accessible
3435
Check different forward settings
3536
Address overrides user name
37+
Address overrides group name
3638

3739
Group is public, user and vmail are internal
3840
[Tags] robot:continue-on-failure
@@ -44,6 +46,7 @@ Group is public, user and vmail are internal
4446
Addresses are accessible
4547
Check different forward settings
4648
Address overrides user name
49+
Address overrides group name
4750

4851
Group and user are public, vmail is internal
4952
[Tags] robot:continue-on-failure
@@ -55,6 +58,7 @@ Group and user are public, vmail is internal
5558
Addresses are accessible
5659
Check different forward settings
5760
Address overrides user name
61+
Address overrides group name
5862

5963

6064
*** Keywords ***
@@ -93,9 +97,38 @@ Remove public mailbox
9397

9498
###
9599

100+
Address overrides group name
101+
[Documentation] Corner case where the group name corresponds to an address.
102+
... The address must have precedence and is always accessible.
103+
[Setup] Run task module/${MID}/add-address
104+
... {"atype":"domain","local":"g1","domain":"ldap.dom.test","destinations":[{"dtype":"group","name":"g1"}]}
105+
[Teardown] Run task module/${MID}/remove-address
106+
... {"atype":"domain","local":"g1","domain":"ldap.dom.test"}
107+
[Tags] robot:continue-on-failure
108+
Address overrides group name, destination is equal to group name
109+
Address overrides group name, destination is a specific user
110+
111+
Address overrides group name, destination is equal to group name
112+
# [Setup] from parent keyword is enough for this test
113+
Log CANTFIX group address \=\= dest. Alias expansion stops when the result equals the queried key.
114+
RETURN
115+
Send SMTP message to g1@ldap.dom.test
116+
Should be delivered via LMTP to u1
117+
Should be delivered via LMTP to u2
118+
119+
Address overrides group name, destination is a specific user
120+
[Setup] Run task module/${MID}/alter-address
121+
... {"atype":"domain","local":"g1","domain":"ldap.dom.test","destinations":[{"dtype":"user","name":"u3"}]}
122+
Send SMTP message to g1@ldap.dom.test
123+
Should be delivered via LMTP to u3
124+
Should not be delivered via LMTP to u1
125+
Should not be delivered via LMTP to u2
126+
127+
###
128+
96129
Address overrides user name
97130
[Documentation] Corner case where the user name corresponds to an address.
98-
... The address must have precedence.
131+
... The address must have precedence and is always accessible.
99132
[Setup] Run task module/${MID}/add-address
100133
... {"atype":"domain","local":"u1","domain":"ldap.dom.test","destinations":[{"dtype":"user","name":"u1"}]}
101134
[Teardown] Run task module/${MID}/remove-address
@@ -110,34 +143,34 @@ Address overrides user name
110143

111144
Address overrides user name, destination is equal to user name
112145
# [Setup] from parent keyword is enough for this test
113-
Send SMTP message to u1@ldap.dom.test mail_server=127.0.0.1
146+
Send SMTP message to u1@ldap.dom.test
114147
Should be delivered via LMTP to u1
115148

116149
Address overrides user name, and has priority over user forward
117150
[Setup] Configure forward for user u1 to=u2 dtype=user
118151
[Teardown] Cleanup forward for u1
119-
Send SMTP message to u1@ldap.dom.test mail_server=127.0.0.1
152+
Send SMTP message to u1@ldap.dom.test
120153
Should be delivered via LMTP to u1
121154
Should not be delivered via LMTP to u2
122155

123156
Address overrides user name, and has priority over group forward
124157
[Setup] Configure forward for user u1 to=g2 dtype=group
125158
[Teardown] Cleanup forward for u1
126-
Send SMTP message to u1@ldap.dom.test mail_server=127.0.0.1
159+
Send SMTP message to u1@ldap.dom.test
127160
Should be delivered via LMTP to u1
128161
Should not be delivered via LMTP to u2
129162
Should not be delivered via LMTP to u3
130163

131164
Address overrides user name, destination is another user
132165
[Setup] Run task module/${MID}/alter-address
133166
... {"atype":"domain","local":"u1","domain":"ldap.dom.test","destinations":[{"dtype":"user","name":"u2"}]}
134-
Send SMTP message to u1@ldap.dom.test mail_server=127.0.0.1
167+
Send SMTP message to u1@ldap.dom.test
135168
Should be delivered via LMTP to u2
136169

137170
Address overrides user name, destination is a group
138171
[Setup] Run task module/${MID}/alter-address
139172
... {"atype":"domain","local":"u1","domain":"ldap.dom.test","destinations":[{"dtype":"group","name":"g2"}]}
140-
Send SMTP message to u1@ldap.dom.test mail_server=127.0.0.1
173+
Send SMTP message to u1@ldap.dom.test
141174
Should not be delivered via LMTP to u1
142175
Should be delivered via LMTP to u2
143176
Should be delivered via LMTP to u3

0 commit comments

Comments
 (0)