From 0b0be3f0018f80f8345b60672eca6bcf37ec2b5c Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Sat, 7 Jun 2025 10:21:02 +0200 Subject: ... --- .../ccert-policy-server/ccert_policy_server/__main__.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'hosts/surtr/email') diff --git a/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py b/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py index 7117eb63..cf89ca27 100644 --- a/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py +++ b/hosts/surtr/email/ccert-policy-server/ccert_policy_server/__main__.py @@ -28,10 +28,12 @@ class PolicyHandler(StreamRequestHandler): allowed = False user = None + relay_eligible = False if self.args['sasl_username']: user = self.args['sasl_username'] if self.args['ccert_subject']: user = self.args['ccert_subject'] + relay_eligible = True if user: with self.server.db_pool.connection() as conn: @@ -44,9 +46,16 @@ class PolicyHandler(StreamRequestHandler): with conn.cursor() as cur: cur.row_factory = namedtuple_row - cur.execute('SELECT EXISTS(SELECT true FROM "mailbox" INNER JOIN "mailbox_mapping" ON "mailbox".id = "mailbox_mapping"."mailbox" WHERE "mailbox"."mailbox" = %(user)s AND ("local" = %(local)s OR "local" IS NULL) AND ("extension" = %(extension)s OR "extension" IS NULL) AND "domain" = %(domain)s) as "exists"', params = {'user': user, 'local': local, 'extension': extension if extension is not None else '', 'domain': domain}, prepare=True) - if (row := cur.fetchone()) is not None: - allowed = row.exists + + if relay_eligible: + cur.execute('SELECT EXISTS(SELECT true FROM "mailbox" INNER JOIN "relay_access" ON "mailbox".id = "relay_access"."mailbox" WHERE "mailbox"."mailbox" = %(user)s AND "domain" = %(domain)s) as "exists"', params = {'user': user, 'domain': domain}) + if (row := cur.fetchone()) is not None: + allowed = row.exists + + if not allowed: + cur.execute('SELECT EXISTS(SELECT true FROM "mailbox" INNER JOIN "mailbox_mapping" ON "mailbox".id = "mailbox_mapping"."mailbox" WHERE "mailbox"."mailbox" = %(user)s AND ("local" = %(local)s OR "local" IS NULL) AND ("extension" = %(extension)s OR "extension" IS NULL) AND "domain" = %(domain)s) as "exists"', params = {'user': user, 'local': local, 'extension': extension if extension is not None else '', 'domain': domain}, prepare=True) + if (row := cur.fetchone()) is not None: + allowed = row.exists action = '550 5.7.0 Sender address not authorized for current user' if allowed: -- cgit v1.2.3