From a59843c11d4c7b20b9a652b624f5fec79f57cfca Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Sat, 4 Mar 2023 12:32:41 +0000 Subject: [PATCH] Limit mail connections from smarthosts by address --- cookbooks/exim/recipes/default.rb | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/cookbooks/exim/recipes/default.rb b/cookbooks/exim/recipes/default.rb index 8c61b2da1..789c4e253 100644 --- a/cookbooks/exim/recipes/default.rb +++ b/cookbooks/exim/recipes/default.rb @@ -240,10 +240,29 @@ if node[:exim][:smarthost_name] end end else + smarthosts_inet = [] + smarthosts_inet6 = [] + + search(:node, "exim_smarthost_name:*?").each do |host| + smarthosts_inet |= host.ipaddresses(:role => :external, :family => :inet) + smarthosts_inet6 |= host.ipaddresses(:role => :external, :family => :inet6) + end + node[:exim][:daemon_smtp_ports].each do |port| firewall_rule "accept-inbound-smtp-#{port}" do action :accept - source "bm:mail.openstreetmap.org" + family :inet + source "net:#{smarthosts_inet.sort.join(',')}" + dest "fw" + proto "tcp:syn" + dest_ports port + source_ports "1024:" + end + + firewall_rule "accept-inbound-smtp-#{port}" do + action :accept + family :inet6 + source "net:#{smarthosts_inet6.sort.join(',')}" dest "fw" proto "tcp:syn" dest_ports port -- 2.39.5