git subrepo commit mailcow/src/mailcow-dockerized
subrepo: subdir: "mailcow/src/mailcow-dockerized"
merged: "3442e804"
upstream: origin: "https://github.com/mailcow/mailcow-dockerized.git"
branch: "master"
commit: "e2b4b6f6"
git-subrepo: version: "0.4.3"
origin: "???"
commit: "???"
Change-Id: I2ae9eb3efba3c1adde6fc11d922d5f8a6cced8a9
diff --git a/mailcow/src/mailcow-dockerized/data/Dockerfiles/netfilter/server.py b/mailcow/src/mailcow-dockerized/data/Dockerfiles/netfilter/server.py
index 08c8727..1adcf59 100644
--- a/mailcow/src/mailcow-dockerized/data/Dockerfiles/netfilter/server.py
+++ b/mailcow/src/mailcow-dockerized/data/Dockerfiles/netfilter/server.py
@@ -123,10 +123,8 @@
time.sleep(10)
with lock:
filter4_table = iptc.Table(iptc.Table.FILTER)
- filter6_table = iptc.Table6(iptc.Table6.FILTER)
filter4_table.refresh()
- filter6_table.refresh()
- for f in [filter4_table, filter6_table]:
+ for f in [filter4_table]:
forward_chain = iptc.Chain(f, 'FORWARD')
input_chain = iptc.Chain(f, 'INPUT')
for chain in [forward_chain, input_chain]:
@@ -198,14 +196,7 @@
if rule not in chain.rules:
chain.insert_rule(rule)
else:
- with lock:
- chain = iptc.Chain(iptc.Table6(iptc.Table6.FILTER), 'MAILCOW')
- rule = iptc.Rule6()
- rule.src = net
- target = iptc.Target(rule, "REJECT")
- rule.target = target
- if rule not in chain.rules:
- chain.insert_rule(rule)
+ pass
r.hset('F2B_ACTIVE_BANS', '%s' % net, cur_time + BAN_TIME)
else:
logWarn('%d more attempts in the next %d seconds until %s is banned' % (MAX_ATTEMPTS - bans[net]['attempts'], RETRY_WINDOW, net))
@@ -227,14 +218,7 @@
if rule in chain.rules:
chain.delete_rule(rule)
else:
- with lock:
- chain = iptc.Chain(iptc.Table6(iptc.Table6.FILTER), 'MAILCOW')
- rule = iptc.Rule6()
- rule.src = net
- target = iptc.Target(rule, "REJECT")
- rule.target = target
- if rule in chain.rules:
- chain.delete_rule(rule)
+ pass
r.hdel('F2B_ACTIVE_BANS', '%s' % net)
r.hdel('F2B_QUEUE_UNBAN', '%s' % net)
if net in bans:
@@ -258,20 +242,7 @@
chain.delete_rule(rule)
r.hdel('F2B_PERM_BANS', '%s' % net)
else:
- with lock:
- chain = iptc.Chain(iptc.Table6(iptc.Table6.FILTER), 'MAILCOW')
- rule = iptc.Rule6()
- rule.src = net
- target = iptc.Target(rule, "REJECT")
- rule.target = target
- if rule not in chain.rules and not unban:
- logCrit('Add host/network %s to blacklist' % net)
- chain.insert_rule(rule)
- r.hset('F2B_PERM_BANS', '%s' % net, int(round(time.time())))
- elif rule in chain.rules and unban:
- logCrit('Remove host/network %s from blacklist' % net)
- chain.delete_rule(rule)
- r.hdel('F2B_PERM_BANS', '%s' % net)
+ pass
def quit(signum, frame):
global quit_now
@@ -284,8 +255,7 @@
unban(net)
with lock:
filter4_table = iptc.Table(iptc.Table.FILTER)
- filter6_table = iptc.Table6(iptc.Table6.FILTER)
- for filter_table in [filter4_table, filter6_table]:
+ for filter_table in [filter4_table]:
filter_table.autocommit = False
forward_chain = iptc.Chain(filter_table, "FORWARD")
input_chain = iptc.Chain(filter_table, "INPUT")
@@ -368,41 +338,7 @@
table.commit()
table.autocommit = True
except:
- print('Error running SNAT4, retrying...')
-
-def snat6(snat_target):
- global lock
- global quit_now
-
- def get_snat6_rule():
- rule = iptc.Rule6()
- rule.src = os.getenv('IPV6_NETWORK', 'fd4d:6169:6c63:6f77::/64')
- rule.dst = '!' + rule.src
- target = rule.create_target("SNAT")
- target.to_source = snat_target
- return rule
-
- while not quit_now:
- time.sleep(10)
- with lock:
- try:
- table = iptc.Table6('nat')
- table.refresh()
- chain = iptc.Chain(table, 'POSTROUTING')
- table.autocommit = False
- if get_snat6_rule() not in chain.rules:
- logInfo('Added POSTROUTING rule for source network %s to SNAT target %s' % (get_snat6_rule().src, snat_target))
- chain.insert_rule(get_snat6_rule())
- table.commit()
- else:
- for position, item in enumerate(chain.rules):
- if item == get_snat6_rule():
- if position != 0:
- chain.delete_rule(get_snat6_rule())
- table.commit()
- table.autocommit = True
- except:
- print('Error running SNAT6, retrying...')
+ print('Error running SNAT4, retrying...')
def autopurge():
while not quit_now:
@@ -507,18 +443,6 @@
rule.target = target
if rule not in chain.rules:
chain.insert_rule(rule)
- # IPv6
- if not iptc.Chain(iptc.Table6(iptc.Table6.FILTER), "MAILCOW") in iptc.Table6(iptc.Table6.FILTER).chains:
- iptc.Table6(iptc.Table6.FILTER).create_chain("MAILCOW")
- for c in ['FORWARD', 'INPUT']:
- chain = iptc.Chain(iptc.Table6(iptc.Table6.FILTER), c)
- rule = iptc.Rule6()
- rule.src = '::/0'
- rule.dst = '::/0'
- target = iptc.Target(rule, "MAILCOW")
- rule.target = target
- if rule not in chain.rules:
- chain.insert_rule(rule)
if __name__ == '__main__':
@@ -542,17 +466,6 @@
except ValueError:
print(os.getenv('SNAT_TO_SOURCE') + ' is not a valid IPv4 address')
- if os.getenv('SNAT6_TO_SOURCE') and os.getenv('SNAT6_TO_SOURCE') != 'n':
- try:
- snat_ip = os.getenv('SNAT6_TO_SOURCE')
- snat_ipo = ipaddress.ip_address(snat_ip)
- if type(snat_ipo) is ipaddress.IPv6Address:
- snat6_thread = Thread(target=snat6,args=(snat_ip,))
- snat6_thread.daemon = True
- snat6_thread.start()
- except ValueError:
- print(os.getenv('SNAT6_TO_SOURCE') + ' is not a valid IPv6 address')
-
autopurge_thread = Thread(target=autopurge)
autopurge_thread.daemon = True
autopurge_thread.start()
diff --git a/mailcow/src/mailcow-dockerized/data/conf/postfix/main.cf b/mailcow/src/mailcow-dockerized/data/conf/postfix/main.cf
index a445b60..16dfd14 100644
--- a/mailcow/src/mailcow-dockerized/data/conf/postfix/main.cf
+++ b/mailcow/src/mailcow-dockerized/data/conf/postfix/main.cf
@@ -15,7 +15,7 @@
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
relayhost =
-mynetworks_style = subnet
+mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 172.22.1.0/24 [fe80::]/10 [fc00::]/7
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
diff --git a/mailcow/src/mailcow-dockerized/docker-compose.yml b/mailcow/src/mailcow-dockerized/docker-compose.yml
index 20d182c..f9d3f76 100644
--- a/mailcow/src/mailcow-dockerized/docker-compose.yml
+++ b/mailcow/src/mailcow-dockerized/docker-compose.yml
@@ -341,7 +341,7 @@
- sogo-mailcow
- php-fpm-mailcow
- redis-mailcow
- image: nginx:mainline-alpine
+ image: nginx:1.19-alpine
dns:
- ${IPV4_NETWORK:-172.22.1}.254
command: /bin/sh -c "envsubst < /etc/nginx/conf.d/templates/listen_plain.template > /etc/nginx/conf.d/listen_plain.active &&
@@ -575,42 +575,12 @@
aliases:
- ofelia
- ipv6nat-mailcow:
- depends_on:
- - unbound-mailcow
- - mysql-mailcow
- - redis-mailcow
- - clamd-mailcow
- - rspamd-mailcow
- - php-fpm-mailcow
- - sogo-mailcow
- - dovecot-mailcow
- - postfix-mailcow
- - memcached-mailcow
- - nginx-mailcow
- - acme-mailcow
- - netfilter-mailcow
- - watchdog-mailcow
- - dockerapi-mailcow
- - solr-mailcow
- environment:
- - TZ=${TZ}
- image: robbertkl/ipv6nat
- security_opt:
- - label=disable
- restart: always
- privileged: true
- network_mode: "host"
- volumes:
- - /var/run/docker.sock:/var/run/docker.sock:ro
- - /lib/modules:/lib/modules:ro
-
networks:
mailcow-network:
driver: bridge
driver_opts:
com.docker.network.bridge.name: br-mailcow
- enable_ipv6: true
+ enable_ipv6: false
ipam:
driver: default
config: