From 5714b4f4b0326ee808d0fb4242a1d92ac913d4ae Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Sat, 6 Nov 2021 10:05:52 +0100 Subject: [PATCH 1/2] introduce MESSAGE_RATELIMIT_EXEMPTION --- core/admin/mailu/configuration.py | 1 + core/admin/mailu/internal/views/postfix.py | 2 ++ docs/configuration.rst | 8 +++++--- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py index 9829f798..d395073d 100644 --- a/core/admin/mailu/configuration.py +++ b/core/admin/mailu/configuration.py @@ -54,6 +54,7 @@ DEFAULT_CONFIG = { 'DKIM_PATH': '/dkim/{domain}.{selector}.key', 'DEFAULT_QUOTA': 1000000000, 'MESSAGE_RATELIMIT': '200/day', + 'MESSAGE_RATELIMIT_EXEMPTION': '', 'RECIPIENT_DELIMITER': '', # Web settings 'SITENAME': 'Mailu', diff --git a/core/admin/mailu/internal/views/postfix.py b/core/admin/mailu/internal/views/postfix.py index ab965967..2664f968 100644 --- a/core/admin/mailu/internal/views/postfix.py +++ b/core/admin/mailu/internal/views/postfix.py @@ -149,6 +149,8 @@ def postfix_sender_login(sender): def postfix_sender_rate(sender): """ Rate limit outbound emails per sender login """ + if sender in [s for s in flask.current_app.config.get('MESSAGE_RATELIMIT_EXEMPTION', '').lower().replace(' ', '').split(',') if s]: + flask.abort(404) user = models.User.get(sender) or flask.abort(404) return flask.abort(404) if user.sender_limiter.hit() else flask.jsonify("450 4.2.1 You are sending too many emails too fast.") diff --git a/docs/configuration.rst b/docs/configuration.rst index fa574415..39680fbd 100644 --- a/docs/configuration.rst +++ b/docs/configuration.rst @@ -69,9 +69,11 @@ The ``MESSAGE_SIZE_LIMIT`` is the maximum size of a single email. It should not be too low to avoid dropping legitimate emails and should not be too high to avoid filling the disks with large junk emails. -The ``MESSAGE_RATELIMIT`` is the limit of messages a single user can send. This is -meant to fight outbound spam in case of compromised or malicious account on the -server. +The ``MESSAGE_RATELIMIT`` (default: 200/day) is the maximum number of messages +a single user can send. ``MESSAGE_RATELIMIT_EXEMPTION`` contains a comma delimited +list of user email addresses that are exempted from any restriction. Those +settings are meant to reduce outbound spam in case of compromised or malicious +account on the server. The ``RELAYNETS`` (default: unset) is a comma delimited list of network addresses for which mail is relayed for with no authentication required. This should be From b68033eb43fd249a9092df3f536ffa551de156a5 Mon Sep 17 00:00:00 2001 From: Florent Daigniere Date: Mon, 8 Nov 2021 09:23:24 +0100 Subject: [PATCH 2/2] only parse it once --- core/admin/mailu/configuration.py | 1 + core/admin/mailu/internal/views/postfix.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/core/admin/mailu/configuration.py b/core/admin/mailu/configuration.py index d395073d..a997a8c7 100644 --- a/core/admin/mailu/configuration.py +++ b/core/admin/mailu/configuration.py @@ -156,6 +156,7 @@ class ConfigManager(dict): self.config['PERMANENT_SESSION_LIFETIME'] = timedelta(hours=int(self.config['SESSION_LIFETIME'])) hostnames = [host.strip() for host in self.config['HOSTNAMES'].split(',')] self.config['AUTH_RATELIMIT_EXEMPTION'] = set(ipaddress.ip_network(cidr, False) for cidr in (cidr.strip() for cidr in self.config['AUTH_RATELIMIT_EXEMPTION'].split(',')) if cidr) + self.config['MESSAGE_RATELIMIT_EXEMPTION'] = set([s for s in self.config['MESSAGE_RATELIMIT_EXEMPTION'].lower().replace(' ', '').split(',') if s]) self.config['HOSTNAMES'] = ','.join(hostnames) self.config['HOSTNAME'] = hostnames[0] # update the app config itself diff --git a/core/admin/mailu/internal/views/postfix.py b/core/admin/mailu/internal/views/postfix.py index 2664f968..ed951943 100644 --- a/core/admin/mailu/internal/views/postfix.py +++ b/core/admin/mailu/internal/views/postfix.py @@ -149,7 +149,7 @@ def postfix_sender_login(sender): def postfix_sender_rate(sender): """ Rate limit outbound emails per sender login """ - if sender in [s for s in flask.current_app.config.get('MESSAGE_RATELIMIT_EXEMPTION', '').lower().replace(' ', '').split(',') if s]: + if sender in flask.current_app.config['MESSAGE_RATELIMIT_EXEMPTION']: flask.abort(404) user = models.User.get(sender) or flask.abort(404) return flask.abort(404) if user.sender_limiter.hit() else flask.jsonify("450 4.2.1 You are sending too many emails too fast.")