From c2a1e00b26b7e65305a36aa817a311ecbd2d831c Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Tue, 11 Jun 2024 10:05:16 +0200
Subject: email nologin by as-set

---
 hosts/surtr/email/default.nix | 58 +++++++++++++++++++++++++++++++++++++++++++
 hosts/surtr/ruleset.nft       | 31 +++++++++++++++++------
 2 files changed, 82 insertions(+), 7 deletions(-)

(limited to 'hosts')

diff --git a/hosts/surtr/email/default.nix b/hosts/surtr/email/default.nix
index 057e29f3..23ac8aa1 100644
--- a/hosts/surtr/email/default.nix
+++ b/hosts/surtr/email/default.nix
@@ -32,9 +32,47 @@ let
       });
     };
 
+  nftables-nologin-script = pkgs.writeScript "nftables-mail-nologin" ''
+    #!${pkgs.zsh}/bin/zsh
+
+    set -e
+    export PATH="${lib.makeBinPath (with pkgs; [inetutils nftables])}:$PATH"
+
+    typeset -a as_sets route route6
+    as_sets=(${lib.escapeShellArgs config.services.email.nologinASSets})
+
+    for as_set in $as_sets; do
+        while IFS=$'\n' read line; do
+            if [[ "''${line}" =~ "^route:\s+(.+)$" ]]; then
+                route+=($match[1])
+            elif [[ "''${line}" =~ "^route6:\s+(.+)$" ]]; then
+                route6+=($match[1])
+            fi
+        done < <(whois -h whois.radb.net "!i''${as_set},1" | egrep -o 'AS[0-9]+' | xargs -- whois -h whois.radb.net -- -i origin)
+    done
+
+    printf -v elements4 '%s,' "''${route[@]}"
+    elements4=''${elements4%,}
+    printf -v elements6 '%s,' "''${route6[@]}"
+    elements6=''${elements6%,}
+    nft -f - <<EOF
+    flush set inet filter mail_nologin4
+    flush set inet filter mail_nologin6
+    add element inet filter mail_nologin4 {''${elements4}}
+    add element inet filter mail_nologin6 {''${elements6}}
+    EOF
+  '';
+
   spmDomains = ["bouncy.email"];
   emailDomains = spmDomains ++ ["kleen.consulting"];
 in {
+  options = {
+    services.email.nologinASSets = mkOption {
+      type = types.listOf types.str;
+      default = [];
+    };
+  };
+
   config = {
     nixpkgs.overlays = [
       (final: prev: {
@@ -918,5 +956,25 @@ in {
         id=REJECT_RL; action=450 4.7.1 Exceeding maximum of $$HIT_RATELIMIT_LIMIT recipients per $$HIT_RATELIMIT_INTERVAL seconds [$$HIT_RATECOUNT]
       '';
     };
+
+    services.email.nologinASSets = ["AS-MICROSOFT"];
+    systemd.services.nftables.serviceConfig = {
+      ExecStart = lib.mkAfter [ nftables-nologin-script ];
+      ExecReload = lib.mkAfter [ nftables-nologin-script ];
+    };
+    systemd.services."nftables-mail-nologin" = {
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = nftables-nologin-script;
+      };
+    };
+    systemd.timers."nftables-mail-nologin" = {
+      wantedBy = [ "nftables.service" ];
+
+      timerConfig = {
+        OnActiveSec = "20h";
+        RandomizedDelaySec = "8h";
+      };
+    };
   };
 }
diff --git a/hosts/surtr/ruleset.nft b/hosts/surtr/ruleset.nft
index 14fc9b79..5c2bba7c 100644
--- a/hosts/surtr/ruleset.nft
+++ b/hosts/surtr/ruleset.nft
@@ -86,6 +86,7 @@ table inet filter {
 
   counter established-rx {}
 
+  counter reject-mail-nologin {}
   counter reject-ratelimit-rx {}
   counter reject-rx {}
   counter reject-tcp-rx {}
@@ -114,6 +115,17 @@ table inet filter {
 
   counter tx {}
 
+  set mail_nologin4 {
+    type ipv4_addr
+    flags interval
+    auto-merge
+  }
+  set mail_nologin6 {
+    type ipv6_addr
+    flags interval
+    auto-merge
+  }
+
   chain forward {
     type filter hook forward priority filter
     policy drop
@@ -145,6 +157,14 @@ table inet filter {
     counter name drop-fw
   }
 
+  chain reject_input {
+    limit name lim_reject log level debug prefix "drop input: " counter name reject-ratelimit-rx drop
+    log level debug prefix "reject input: " counter name reject-rx
+    meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset
+    ct state new counter name reject-icmp-rx reject
+
+    counter name drop-rx
+  }
   chain input {
     type filter hook input priority filter
     policy drop
@@ -177,6 +197,9 @@ table inet filter {
     udp dport {3478, 5349} counter name stun-rx accept
     udp dport 49000-50000 counter name turn-rx accept
 
+    tcp dport {465,466,993,4190} ip saddr @mail_nologin4 log prefix "mail nologin: " counter name reject-mail-nologin jump reject_input
+    tcp dport {465,466,993,4190} ip6 saddr @mail_nologin6 log prefix "mail nologin: " counter name reject-mail-nologin jump reject_input
+
     tcp dport 25 counter name smtp-rx accept
     tcp dport {465, 466} counter name submissions-rx accept
     tcp dport 993 counter name imaps-rx accept
@@ -186,13 +209,7 @@ table inet filter {
     ct state {established, related} counter name established-rx accept
 
 
-    limit name lim_reject log level debug prefix "drop input: " counter name reject-ratelimit-rx drop
-    log level debug prefix "reject input: " counter name reject-rx
-    meta l4proto tcp ct state new counter name reject-tcp-rx reject with tcp reset
-    ct state new counter name reject-icmp-rx reject
-
-
-    counter name drop-rx
+    jump reject_input
   }
 
   chain output {
-- 
cgit v1.2.3