From 3ff823e8377511a217c83fa8cfd2a0ced5faf0ce Mon Sep 17 00:00:00 2001
From: fliu <10025-fliu@users.noreply.salsa.debian.org>
Date: Tue, 17 Aug 2021 09:40:19 +0000
Subject: [PATCH] email: Sender spoofing patch 1/2: domain rewriting

A sender canonical map deletes the domain part from sender addresses.
Postfix will append @$myhostname after the rewriting.
---
 plinth/modules/email_server/audit/spam.py                  | 7 +++++++
 .../data/etc/postfix/freedombox-rewrite-sender             | 7 +++++++
 2 files changed, 14 insertions(+)
 create mode 100644 plinth/modules/email_server/data/etc/postfix/freedombox-rewrite-sender

diff --git a/plinth/modules/email_server/audit/spam.py b/plinth/modules/email_server/audit/spam.py
index f325965fa..c9a429f92 100644
--- a/plinth/modules/email_server/audit/spam.py
+++ b/plinth/modules/email_server/audit/spam.py
@@ -60,6 +60,13 @@ egress_filter_cleanup = postconf.ServiceFlags(
 
 egress_filter_cleanup_options = {
     'syslog_name': 'postfix/fbxout',
+    # "From" domain rewriting
+    'sender_canonical_maps': 'regexp:/etc/postfix/freedombox-rewrite-sender',
+    'local_header_rewrite_clients': 'static:all',
+    # "From" domain masquerading
+    'masquerade_domains': '$mydomain',
+    'masquerade_classes': 'envelope_sender,header_sender',
+    # Header privacy
     'header_checks': 'regexp:/etc/postfix/freedombox-header-cleanup',
     'nested_header_checks': ''
 }
diff --git a/plinth/modules/email_server/data/etc/postfix/freedombox-rewrite-sender b/plinth/modules/email_server/data/etc/postfix/freedombox-rewrite-sender
new file mode 100644
index 000000000..713246a80
--- /dev/null
+++ b/plinth/modules/email_server/data/etc/postfix/freedombox-rewrite-sender
@@ -0,0 +1,7 @@
+# -*- mode: conf-space -*-
+# This file is managed by FreedomBox
+# regexp sender canonical map
+
+# Remove the domain part from email addresses
+# Postfix will append @$myhostname
+/^([^@]+)@/ $1