[PATCH pmg-api 1/6] fix #8231: config: add option to not trust the local network automatically

[Carsten Haerle <carsten.haerle@straightec.de>]

The network of the node's IP address is always added to postfix'
mynetworks, so every host in it may relay mail through the internal
port to any destination. This is not visible in the GUI and can only be
changed by overriding the main.cf template, which then has to be kept
in sync with every update.

Add the 'trust_local_network' option to the mail section. It defaults
to 1, keeping the current behaviour. If disabled, only loopback, the
default relay, transport hosts and the configured networks are trusted.

Signed-off-by: Carsten Haerle <carsten.haerle@straightec.de>
---
 src/PMG/Config.pm | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/PMG/Config.pm b/src/PMG/Config.pm
index 070a34f..655a433 100644
--- a/src/PMG/Config.pm
+++ b/src/PMG/Config.pm
@@ -695,6 +695,14 @@ sub properties {
             type => 'boolean',
             default => 0,
         },
+        trust_local_network => {
+            description => "Trust the network of the node's IP address, that is, allow all"
+                . " hosts in it to relay mail through the internal port. If disabled, only"
+                . " the default relay, transport hosts and the configured networks are"
+                . " trusted.",
+            type => 'boolean',
+            default => 1,
+        },
         maxsize => {
             description =>
                 "Maximum email size. Larger mails are rejected. (postfix option `message_size_limit`)",
@@ -876,6 +884,7 @@ sub options {
         max_filters => { optional => 1 },
         max_policy => { optional => 1 },
         hide_received => { optional => 1 },
+        trust_local_network => { optional => 1 },
         rejectunknown => { optional => 1 },
         rejectunknownsender => { optional => 1 },
         conn_count_limit => { optional => 1 },
@@ -1578,7 +1587,8 @@ sub get_template_vars {
 
     $vars->{postfix}->{transportnets} = join(' ', sort keys %$transportnets);
 
-    if (defined($int_ip)) { # we cannot really do anything and the loopback nets are already added
+    # without an IP we cannot really do anything and the loopback nets are already added
+    if (defined($int_ip) && $self->get('mail', 'trust_local_network')) {
         if (my $int_net_cidr = PMG::Utils::find_local_network_for_ip($int_ip, 1)) {
             if ($int_net_cidr =~ m/^($IPV6RE)\/(\d+)$/) {
                 $mynetworks->{"[$1]/$2"} = 1;
-- 
2.53.0