From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 363E41FF0C4 for ; Tue, 27 Oct 2026 10:31:30 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 043A92162B; Tue, 27 Oct 2026 10:31:30 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=straightec.de; s=dkim; t=1793008738; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6folhjYSsMXFjzXec8A24KldDJTtFCJEBSvVrm54ufE=; b=irCNZnLd6wOB639g0khe1+8QuHWYlIRJP5yQBOW8s4AfuyOJak7IkpRYHAwuyvJEw8+UzZ ZmlY7nnDHRNqkxr4LPoOYfkumMk88GhoF0Xm5Y50eMd9wRdlcZppZurwxhqSUly/FHnZ7s r327jcejdoGuZmWLDtW3ybvjr8+bF6TAH9WcMRWYxsfkO6ls5WfHzfJFD+/Ops49FdoAHv RDu5vrUcWFI1AfTsYR3aVh5Ky9+GgcCrSiLKuwRooiEDp7ZkgisLcFfzeQ4ncGf63YPoUg pyJoUHcCSCbUAAxR24C1cG53XI/PU+TLgSzDJynHalEg6+QgrJf4+3osGb81EQ== From: Carsten Haerle To: pmg-devel@lists.proxmox.com Subject: [PATCH pmg-api 2/6] config: factor out automatically trusted networks Date: Mon, 26 Oct 2026 10:58:47 +0100 Message-ID: <20261026095852.3243241-3-carsten.haerle@straightec.de> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261026095852.3243241-1-carsten.haerle@straightec.de> References: <20261026095852.3243241-1-carsten.haerle@straightec.de> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-SPAM-LEVEL: Spam detection results: 0 DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record X-MailFrom: carsten.haerle@straightec.de X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation Message-ID-Hash: FCLBEXOVHRB524MYX5KCQ5ZL7FUGYAJW X-Message-ID-Hash: FCLBEXOVHRB524MYX5KCQ5ZL7FUGYAJW X-Mailman-Approved-At: Tue, 27 Oct 2026 10:31:21 +0100 CC: Carsten Haerle X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Mail Gateway development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Move the computation of the networks that are added to mynetworks automatically (local network, default relay, transport hosts) from get_template_vars() into get_automatic_mynetworks(), which also records where each entry comes from. This allows the API to show these entries, so that the GUI can display what postfix actually trusts. No functional change intended. Signed-off-by: Carsten Haerle --- src/PMG/Config.pm | 95 +++++++++++++++++++++++++++-------------------- 1 file changed, 54 insertions(+), 41 deletions(-) diff --git a/src/PMG/Config.pm b/src/PMG/Config.pm index 655a433..e01d4d7 100644 --- a/src/PMG/Config.pm +++ b/src/PMG/Config.pm @@ -1555,6 +1555,55 @@ sub get_host_dns_info { return $dnsinfo; } =20 +# Networks trusted automatically, in addition to loopback and the configur= ed +# networks. Returns a hash: cidr =3D> { local =3D> 1, relay =3D> 1, transp= ort =3D> [domains] } +sub get_automatic_mynetworks { + my ($self, $int_ip) =3D @_; + + my $res =3D {}; + + if (my $tmap =3D PVE::INotify::read_file('transport')) { + foreach my $domain (sort keys %$tmap) { + my $host =3D $tmap->{$domain}->{host}; + my $cidr; + if ($host =3D~ m/^$IPV4RE$/) { + $cidr =3D "$host/32"; + } elsif ($host =3D~ m/^(?:ipv6:)?($IPV6RE)$/i) { + $cidr =3D "[$1]/128"; + } + push $res->{$cidr}->{transport}->@*, $domain if defined($cidr)= ; + } + } + + # without an IP we cannot really do anything and the loopback nets are= always trusted + if (defined($int_ip) && $self->get('mail', 'trust_local_network')) { + my $cidr; + if (my $int_net_cidr =3D PMG::Utils::find_local_network_for_ip($in= t_ip, 1)) { + if ($int_net_cidr =3D~ m/^($IPV6RE)\/(\d+)$/) { + $cidr =3D "[$1]/$2"; + } else { + $cidr =3D $int_net_cidr; + } + } elsif ($int_ip =3D~ m/^$IPV6RE$/) { + $cidr =3D "[$int_ip]/128"; + } else { + $cidr =3D "$int_ip/32"; + } + $res->{$cidr}->{local} =3D 1; + } + + # host names are not resolved, they are not trusted automatically + if (my $relay =3D $self->get('mail', 'relay')) { + if ($relay =3D~ m/^$IPV4RE$/) { + $res->{"$relay/32"}->{relay} =3D 1; + } elsif ($relay =3D~ m/^$IPV6RE$/) { + $res->{"[$relay]/128"}->{relay} =3D 1; + } + } + + return $res; +} + sub get_template_vars { my ($self) =3D @_; =20 @@ -1565,45 +1614,20 @@ sub get_template_vars { my $int_ip =3D PMG::Cluster::remote_node_ip($dnsinfo->{hostname}); $vars->{ipconfig}->{int_ip} =3D $int_ip; =20 + my $automatic =3D $self->get_automatic_mynetworks($int_ip); + my $transportnets =3D {}; my $mynetworks =3D { '127.0.0.0/8' =3D> 1, '[::1]/128', =3D> 1, }; - - if (my $tmap =3D PVE::INotify::read_file('transport')) { - foreach my $domain (keys %$tmap) { - my $data =3D $tmap->{$domain}; - my $host =3D $data->{host}; - if ($host =3D~ m/^$IPV4RE$/) { - $transportnets->{"$host/32"} =3D 1; - $mynetworks->{"$host/32"} =3D 1; - } elsif ($host =3D~ m/^(?:ipv6:)?($IPV6RE)$/i) { - $transportnets->{"[$1]/128"} =3D 1; - $mynetworks->{"[$1]/128"} =3D 1; - } - } + foreach my $cidr (keys %$automatic) { + $mynetworks->{$cidr} =3D 1; + $transportnets->{$cidr} =3D 1 if $automatic->{$cidr}->{transport}; } =20 $vars->{postfix}->{transportnets} =3D join(' ', sort keys %$transportn= ets); =20 - # without an IP we cannot really do anything and the loopback nets are= already added - if (defined($int_ip) && $self->get('mail', 'trust_local_network')) { - if (my $int_net_cidr =3D PMG::Utils::find_local_network_for_ip($in= t_ip, 1)) { - if ($int_net_cidr =3D~ m/^($IPV6RE)\/(\d+)$/) { - $mynetworks->{"[$1]/$2"} =3D 1; - } else { - $mynetworks->{$int_net_cidr} =3D 1; - } - } else { - if ($int_ip =3D~ m/^$IPV6RE$/) { - $mynetworks->{"[$int_ip]/128"} =3D 1; - } else { - $mynetworks->{"$int_ip/32"} =3D 1; - } - } - } - my $netlist =3D PVE::INotify::read_file('mynetworks'); foreach my $cidr (keys %$netlist) { my $ip =3D PVE::Network::IP_from_cidr($cidr); @@ -1618,17 +1642,6 @@ sub get_template_vars { } } =20 - # add default relay to mynetworks - if (my $relay =3D $self->get('mail', 'relay')) { - if ($relay =3D~ m/^$IPV4RE$/) { - $mynetworks->{"$relay/32"} =3D 1; - } elsif ($relay =3D~ m/^$IPV6RE$/) { - $mynetworks->{"[$relay]/128"} =3D 1; - } else { - # DNS name - do nothing ? - } - } - $vars->{postfix}->{mynetworks} =3D join(' ', sort keys %$mynetworks); =20 # normalize dnsbl_sites --=20 2.53.0