Plugins: postfix: header_checks for black / whitelisting

[serial-bug]

Is your feature request related to a problem? Please describe.
At the moment it is not possible to filter incoming mail (black / whitelisting), when mail is coming from a forwarder (SRS0=...).
Because the check_sender_access looks in MAIL FROM in envelope.
In a forwarded mail (SRS), the MAIL FROM is not the same as the "from" header.
So there will never be a match.

Describe the solution you'd like
a solution could be to use header checks.
Here it is possible to check the "from" header with regex.
And this is just a small use case, with header checks there are much more possibilitys of filtering.

http://www.postfix.org/header_checks.5.html

[mimugmail]

I'm quite busy within my work and NRPE plugin, can you give me 2-3 real life examples you would use so I have an idea how to fit your needs?

[serial-bug]

sure.

For security proposes, my mails are forwarded trough a mail relay.
In order that SPF checks can be passed, the forwarded mails are handled with server rewrite sheme function.

before SRS:
MAIL FROM (envelope): [e-mail]
after SRS:
MAIL FROM (envelope):
(Note: "=xxxx=xxxxx" are not static.)

Now, it is not possible anymore to use the "check_sender_access" (hash) because it checks the MAIL FROM in envelope.

With "header_checks" it is possible to define a regex, to check the from field in the header, so that black / white listing should work again.
Also the following filters are possible then:

/^Subject: Bad Bad Newsletter/ REJECT # Filter on subject header
/^From:.\@..cc/ REJECT # Block mail from hole domains

The implementation should also not too complicated, it is one line in the main.cf:
header_checks = regexp:/usr/local/etc/postfix/header_checks
and the header_checks file itself.

The only problem, i think is the gui implementation.

[mimugmail]

And how to you achieve the rewrite example?

[serial-bug]

You mean the SRS rewrite ?
That is done by the mail relay, outside my network. (i dont have control over these)
I only said this for better understanding of the problem.

[mimugmail]

@fichtner what do you think about this?
Validating regexp is real pain.

Add a new grid with a one-liner text field without validation?

[Starkstromkonsument]

Hi,

I would like this feature too, but to do a different thing with it. I'm not sure whether I should open a separate feature request for this, so I'm writing this comment first.

I use my firewalls as mail relays for outgoing email traffic and I want to strip / rewrite some headers for privacy reasons. This can be done by simply adding the following line to the main.cf

# Header Stripping
smtp_header_checks = pcre:/etc/postfix/header_cleanup_outgoing

The contents of header_cleanup_outgoing could be

/^\s*(Received: from)[^\n]*(.*)/ REPLACE $1 127.0.0.1 (localhost [127.0.0.1])$2
/^\s*User-Agent/ IGNORE
/^\s*X-Enigmail/ IGNORE
/^\s*X-Mailer/ IGNORE
/^\s*X-Originating-IP/ IGNORE
/^\s*Mime-Version/ IGNORE
/^\s*X-Confirm-Reading-To/ IGNORE
/^\s*Disposition-Notification-To/ IGNORE
/^\s*X-K9mail-Identity/ IGNORE
/^\s*Autocrypt/ IGNORE

Adding the option to the main.cf and a textarea to the "advanced mode" of the "General" page on the WUI would be sufficient to me.

[Starkstromkonsument]

@fichtner what do you think about this?
Validating regexp is real pain.

Add a new grid with a one-liner text field without validation?

@mimugmail This sounds great. I think not implementing a validation will nor break anything, except the users "wrong" rule not being applied.

You could append an additional dropdown menu to each line to configure whether the check should be applied "WHILE RECEIVING MAIL", "WHILE DELIVERING MAIL" or even both. There is another one for "AFTER RECEIVING MAIL", but I don't know the use case of this and whether this would be used by anybody.

[AdSchellevis]

This issue has been automatically timed-out (after 180 days of inactivity).

For more information about the policies for this repository,
please read https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md for further details.

If someone wants to step up and work on this issue,
just let us know, so we can reopen the issue and assign an owner to it.

[Starkstromkonsument]

Hi, please reopen this issue. I started working on it: https://github.com/Starkstromkonsument/opnsense_plugins/commit/da59ec822f67674b82c0713ff9fbc86140795595

Unfortunately I'm stuck. I can't get the UI to show the new page correctly. The new menu entry "Header Checks" shows up correctly in the menu:

and the URI /ui/postfix/headerchecks/index is opened. The Page returns 404 Page not found though.

I double checked the docs and my code and I don't find the error. Does anybody have a hint for me please?

[mimugmail]

Just open a PR against master starting with WIP: in subject and I'll have a look (no guarantee that it get's merged)