discourse_mail_receiver 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 532ee9db86fe12040fa11fa377241c2a56d45c00bac101517aa7f3a8f572031b
+  data.tar.gz: 438ef4054e93f209531c23162ceab7c2ad79c3c6561274eda962b313d97dd386
+SHA512:
+  metadata.gz: 9ac58c1df1f8f94000496d385ccad8d81f4a2aa22c356fccc6c16944011bb1742abeaf28f70496df6000cbb7e932c6e122920a8c20e9b3fe5ba69358e17566d0
+  data.tar.gz: 5fd6014a1e401bf23e1aece57e95c4f4bfae9a36f8059d3a9acbbc3e6a1fc09170f2832d8a4453e82ebd6b9f770d55cc4401f17cf2e18a3cab7f5f6cc0bd071c

data/lib/mail_receiver/discourse_mail_receiver.rb

@@ -0,0 +1,58 @@
+require 'syslog'
+require 'json'
+require "uri"
+require "net/http"
+require_relative 'mail_receiver_base'
+
+class DiscourseMailReceiver < MailReceiverBase
+
+  def initialize(env_file = nil, recipient = nil, mail = nil)
+    super(env_file)
+
+    @recipient = recipient
+    @mail = mail
+
+    logger.debug "Recipient: #{@recipient}"
+    fatal "No recipient passed on command line." unless @recipient
+    fatal "No message passed on stdin." if @mail.nil? || @mail.empty?
+  end
+
+  def endpoint
+    return @endpoint if @endpoint
+
+    @endpoint = @env["DISCOURSE_MAIL_ENDPOINT"]
+
+    if @env['DISCOURSE_BASE_URL']
+      @endpoint = "#{@env['DISCOURSE_BASE_URL']}/admin/email/handle_mail"
+    end
+    @endpoint
+  end
+
+  def process
+    uri = URI.parse(endpoint)
+
+    begin
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      post = Net::HTTP::Post.new(uri.request_uri)
+      post["Api-Username"] = username
+      post["Api-Key"] = key
+      post.set_form_data(email: @mail)
+
+      response = http.request(post)
+    rescue StandardError => ex
+      logger.err "Failed to POST the e-mail to %s: %s (%s)", endpoint, ex.message, ex.class
+      logger.err ex.backtrace.map { |l| "  #{l}" }.join("\n")
+
+      return :failure
+    ensure
+      http.finish if http && http.started?
+    end
+
+    return :success if Net::HTTPSuccess === response
+
+    logger.err "Failed to POST the e-mail to %s: %s", endpoint, response.code
+    :failure
+  end
+
+end

data/lib/mail_receiver/fast_rejection.rb

@@ -0,0 +1,144 @@
+require 'set'
+require 'syslog'
+require 'json'
+require 'uri'
+require 'cgi'
+require 'net/http'
+
+require_relative 'mail'
+require_relative 'mail_receiver_base'
+
+class FastRejection < MailReceiverBase
+
+  def initialize(env_file)
+    super(env_file)
+
+    @disabled = @env['DISCOURSE_FAST_REJECTION_DISABLED'] || !@env['DISCOURSE_BASE_URL']
+
+    @blacklisted_sender_domains = @env.fetch('BLACKLISTED_SENDER_DOMAINS', "").split(" ").map(&:downcase).to_set
+  end
+
+  def disabled?
+    !!@disabled
+  end
+
+  def process
+    $stdout.sync = true   # unbuffered output
+
+    args = {}
+    while line = gets
+      # Fill up args with the request details.
+      line = line.chomp
+      if line.empty?
+        puts "action=#{process_single_request(args)}"
+        puts ''
+
+        args = {}  # reset for next request.
+      else
+        k, v = line.chomp.split('=', 2)
+        args[k] = v
+      end
+    end
+  end
+
+  def process_single_request(args)
+    return 'dunno' if disabled?
+
+    if args['request'] != 'smtpd_access_policy'
+      return 'defer_if_permit Internal error, Request type invalid'
+    elsif args['protocol_state'] != 'RCPT'
+      return 'dunno'
+    elsif args['sender'].nil?
+      # Note that while this key should always exist, its value may be the empty
+      # string.  Postfix will convert the "<>" null sender to "".
+      return 'defer_if_permit No sender specified'
+    elsif args['recipient'].nil?
+      return 'defer_if_permit No recipient specified'
+    end
+
+    run_filters(args)
+  end
+
+  def maybe_reject_email(from, to)
+    uri = URI.parse(endpoint)
+    fromarg = CGI::escape(from)
+    toarg = CGI::escape(to)
+
+    qs = "from=#{fromarg}&to=#{toarg}"
+    if uri.query && !uri.query.empty?
+      uri.query += "&#{qs}"
+    else
+      uri.query = qs
+    end
+
+    begin
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      get = Net::HTTP::Get.new(uri.request_uri)
+      get["Api-Username"] = username
+      get["Api-Key"] = key
+      response = http.request(get)
+    rescue StandardError => ex
+      logger.err "Failed to GET smtp_should_reject answer from %s: %s (%s)", endpoint, ex.message, ex.class
+      logger.err ex.backtrace.map { |l| "  #{l}" }.join("\n")
+      return "defer_if_permit Internal error, API request preparation failed"
+    ensure
+      http.finish if http && http.started?
+    end
+
+    if Net::HTTPSuccess === response
+      reply = JSON.parse(response.body)
+      if reply['reject']
+        return "reject #{reply['reason']}"
+      end
+    else
+      logger.err "Failed to GET smtp_should_reject answer from %s: %s", endpoint, response.code
+      return "defer_if_permit Internal error, API request failed"
+    end
+
+    "dunno"  # let future tests also be allowed to reject this one.
+  end
+
+  def endpoint
+    "#{@env['DISCOURSE_BASE_URL']}/admin/email/smtp_should_reject.json"
+  end
+
+  private
+
+  def run_filters(args)
+    filters = [
+      :maybe_reject_by_sender_domain,
+      :maybe_reject_by_api,
+    ]
+
+    filters.each do |f|
+      action = send(f, args)
+      return action if action != "dunno"
+    end
+
+    "dunno"
+  end
+
+  def maybe_reject_by_sender_domain(args)
+    sender = args['sender']
+
+    return "dunno" if sender.empty?
+
+    domain = domain_from_addrspec(sender)
+    if domain.empty?
+      logger.info("deferred mail with domainless sender #{sender}")
+      return 'defer_if_permit Invalid sender'
+    end
+    if @blacklisted_sender_domains.include? domain
+      logger.info("rejected mail from blacklisted sender domain #{domain} (from #{sender})")
+      return 'reject Invalid sender'
+    end
+
+    "dunno"
+  end
+
+  def maybe_reject_by_api(args)
+    maybe_reject_email(args['sender'], args['recipient'])
+  end
+
+end

data/lib/mail_receiver/mail.rb

@@ -0,0 +1,10 @@
+# Parse and return the domain from an Internet addr-spec.  Return value is
+# normalised to lowercase.
+#
+# This implementation is the simplest thing that could possibly work.  Do
+# not use this function to parse generalised mailbox or group addresses.
+#
+# See section 3.4 of RFC 2822.
+def domain_from_addrspec(addrspec)
+  (addrspec.split("@", 2)[1] || "").downcase
+end

data/lib/mail_receiver/mail_receiver_base.rb

@@ -0,0 +1,42 @@
+class MailReceiverBase
+  class ReceiverException < StandardError; end;
+
+  attr_reader :env
+
+  def initialize(env_file)
+    unless File.exists?(env_file)
+      fatal "Config file %s does not exist. Aborting.", env_file
+    end
+
+    @env = JSON.parse(File.read(env_file))
+
+    %w{DISCOURSE_API_KEY DISCOURSE_API_USERNAME}.each do |kw|
+      fatal "env var %s is required", kw unless @env[kw]
+    end
+
+    if @env['DISCOURSE_MAIL_ENDPOINT'].nil? && @env['DISCOURSE_BASE_URL'].nil?
+      fatal "DISCOURSE_MAIL_ENDPOINT and DISCOURSE_BASE_URL env var missing"
+    end
+  end
+
+  def self.logger
+    @logger ||= Syslog.open(File.basename($0), Syslog::LOG_PID, Syslog::LOG_MAIL)
+  end
+
+  def logger
+    MailReceiverBase.logger
+  end
+
+  def key
+    @env['DISCOURSE_API_KEY']
+  end
+
+  def username
+    @env['DISCOURSE_API_USERNAME']
+  end
+
+  def fatal(*args)
+    logger.crit(*args)
+    raise ReceiverException.new(sprintf(*args))
+  end
+end

metadata

@@ -0,0 +1,89 @@
+--- !ruby/object:Gem::Specification
+name: discourse_mail_receiver
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Discourse Team
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2020-08-24 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: mail
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.7.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.7.1
+- !ruby/object:Gem::Dependency
+  name: mail
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.7.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.7.1
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+description: A gem used to package the core .rb files of the mail-receiver.
+email:
+- team@discourse.org
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/mail_receiver/discourse_mail_receiver.rb
+- lib/mail_receiver/fast_rejection.rb
+- lib/mail_receiver/mail.rb
+- lib/mail_receiver/mail_receiver_base.rb
+homepage: https://github.com/discourse/mail-receiver
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.4.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.0.3
+signing_key: 
+specification_version: 4
+summary: A gem used to package the core .rb files of the mail-receiver.
+test_files: []