From 76720f3e947384816769696cf251eac6d1361d22 Mon Sep 17 00:00:00 2001
From: Michael Kuron <m.kuron@gmx.de>
Date: Mon, 17 Apr 2017 13:16:54 +0200
Subject: [PATCH 1/6] Forwarding hosts in web interface

---
 data/web/admin.php             | 68 ++++++++++++++++++++++++++++++++++
 data/web/delete.php            | 17 +++++++++
 data/web/inc/functions.inc.php | 67 +++++++++++++++++++++++++++++++++
 data/web/inc/init.sql          |  5 +++
 data/web/inc/triggers.inc.php  |  6 +++
 data/web/lang/lang.en.php      |  6 +++
 6 files changed, 169 insertions(+)

diff --git a/data/web/admin.php b/data/web/admin.php
index e0e04aee..6d0bdf82 100644
--- a/data/web/admin.php
+++ b/data/web/admin.php
@@ -183,6 +183,8 @@ $tfa_data = get_tfa();
   </div>
 
   <h4><span class="glyphicon glyphicon-wrench" aria-hidden="true"></span> <?=$lang['admin']['configuration'];?></h4>
+  <div class="panel-group" id="accordion_access">
+  
   <div class="panel panel-default">
   <div class="panel-heading"><?=$lang['admin']['dkim_keys'];?></div>
   <div id="collapseDKIM" class="panel-collapse">
@@ -298,6 +300,72 @@ $tfa_data = get_tfa();
   </div>
   </div>
   </div>
+  
+  <div class="panel panel-default">
+  <div style="cursor:pointer;" class="panel-heading" data-toggle="collapse" data-parent="#accordion_access" data-target="#collapseForwardingHosts">
+    <span class="accordion-toggle"><?=$lang['admin']['forwarding_hosts'];?></span>
+  </div>
+    <div id="collapseForwardingHosts" class="panel-collapse collapse">
+      <div class="panel-body">
+        <p style="margin-bottom:40px"><?=$lang['admin']['forwarding_hosts_hint'];?></p>
+        <form method="post">
+          <div class="table-responsive">
+          <table class="table table-striped" id="forwardinghoststable">
+            <thead>
+            <tr>
+              <th style="min-width: 100px;"><?=$lang['edit']['hostname'];?></th>
+              <th style="text-align: right; min-width: 200px;"><?=$lang['admin']['action'];?></th>
+            </tr>
+            </thead>
+            <tbody>
+              <?php
+              $forwarding_hosts = get_forwarding_hosts();
+              if ($forwarding_hosts) {
+              foreach ($forwarding_hosts as $host) {
+              ?>
+              <tr id="data">
+                <td><?=htmlspecialchars(strtolower($host));?></td>
+                <td style="text-align: right;">
+                  <div class="btn-group">
+                    <a href="delete.php?forwardinghost=<?=$host;?>" class="btn btn-xs btn-danger"><span class="glyphicon glyphicon-trash"></span> <?=$lang['admin']['remove'];?></a>
+                  </div>
+                </td>
+                </td>
+              </tr>
+
+              <?php
+              }
+              } else {
+              ?>
+                <tr id="no-data"><td colspan="4" style="text-align: center; font-style: italic;"><?=$lang['admin']['no_record'];?></td></tr>
+              <?php
+              }
+              ?>
+            </tbody>
+          </table>
+          </div>
+        </form>
+        <small>
+        <legend><?=$lang['admin']['add_forwarding_host'];?></legend>
+        <form class="form-horizontal" role="form" method="post">
+          <div class="form-group">
+            <label class="control-label col-sm-2" for="hostname"><?=$lang['edit']['hostname'];?>:</label>
+            <div class="col-sm-10">
+              <input type="text" class="form-control" name="hostname" id="hostname" required>
+            </div>
+          </div>
+          <div class="form-group">
+            <div class="col-sm-offset-2 col-sm-10">
+              <button type="submit" name="add_forwarding_host" class="btn btn-default"><?=$lang['admin']['add'];?></button>
+            </div>
+          </div>
+        </form>
+        </small>
+      </div>
+    </div>
+    </div>
+  </div>
+
 </div> <!-- /container -->
 <script type='text/javascript'>
 <?php
diff --git a/data/web/delete.php b/data/web/delete.php
index 6ba93d31..bfacad0c 100644
--- a/data/web/delete.php
+++ b/data/web/delete.php
@@ -105,6 +105,23 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
 				</form>
 				<?php
 		}
+		// DELETE DOMAIN ADMIN
+		elseif (isset($_GET["forwardinghost"]) &&
+			!empty($_GET["forwardinghost"]) &&
+        $_SESSION['mailcow_cc_role'] == "admin") {
+				$host = $_GET["forwardinghost"];
+				?>
+				<div class="alert alert-warning" role="alert"><?=sprintf($lang['delete']['remove_forwardinghost_warning'], htmlspecialchars($_GET["forwardinghost"]));?></div>
+				<form class="form-horizontal" role="form" method="post" action="/admin.php">
+				<input type="hidden" name="forwardinghost" value="<?=htmlspecialchars($host);?>">
+					<div class="form-group">
+						<div class="col-sm-offset-1 col-sm-10">
+							<button type="submit" name="delete_forwarding_host" class="btn btn-default btn-sm"><?=$lang['delete']['remove_button'];?></button>
+						</div>
+					</div>
+				</form>
+				<?php
+		}
 		// DELETE MAILBOX
 		elseif (isset($_GET["mailbox"]) &&
 			filter_var($_GET["mailbox"], FILTER_VALIDATE_EMAIL) &&
diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php
index 465ab2ac..f031af8d 100644
--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
@@ -124,6 +124,9 @@ function init_db_schema() {
   if ($num_results == 0) {
     $pdo->query("ALTER TABLE `tfa` ADD `key_id` VARCHAR(255) DEFAULT 'unidentified'");
   }
+  
+  // Add newly added tables
+  $stmt = $pdo->query("CREATE TABLE IF NOT EXISTS `forwarding_hosts` (`host` VARCHAR(255) NOT NULL, PRIMARY KEY (`host`)) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC");
 }
 function verify_ssha256($hash, $password) {
 	// Remove tag if any
@@ -5039,4 +5042,68 @@ function get_u2f_registrations($username) {
   $sel->execute(array($username));
   return $sel->fetchAll(PDO::FETCH_OBJ);
 }
+function get_forwarding_hosts() {
+	global $pdo;
+  $sel = $pdo->prepare("SELECT host FROM `forwarding_hosts`");
+  $sel->execute();
+  return $sel->fetchAll(PDO::FETCH_COLUMN);
+}
+function add_forwarding_host($postarray) {
+	global $pdo;
+	global $lang;
+	if ($_SESSION['mailcow_cc_role'] != "admin") {
+		$_SESSION['return'] = array(
+			'type' => 'danger',
+			'msg' => sprintf($lang['danger']['access_denied'])
+		);
+		return false;
+	}
+	$host = $postarray['hostname'];
+	try {
+		$stmt = $pdo->prepare("INSERT INTO `forwarding_hosts` (`host`) VALUES (:host)");
+		$stmt->execute(array(
+			':host' => $host,
+		));
+	}
+	catch (PDOException $e) {
+		$_SESSION['return'] = array(
+			'type' => 'danger',
+			'msg' => 'MySQL: '.$e
+		);
+		return false;
+	}
+	$_SESSION['return'] = array(
+		'type' => 'success',
+		'msg' => sprintf($lang['success']['forwarding_host_added'], htmlspecialchars($host))
+	);
+}
+function delete_forwarding_host($postarray) {
+	global $pdo;
+	global $lang;
+	if ($_SESSION['mailcow_cc_role'] != "admin") {
+		$_SESSION['return'] = array(
+			'type' => 'danger',
+			'msg' => sprintf($lang['danger']['access_denied'])
+		);
+		return false;
+	}
+	$host = $postarray['forwardinghost'];
+	try {
+		$stmt = $pdo->prepare("DELETE FROM `forwarding_hosts` WHERE `host` = :host");
+		$stmt->execute(array(
+			':host' => $host,
+		));
+	}
+	catch (PDOException $e) {
+		$_SESSION['return'] = array(
+			'type' => 'danger',
+			'msg' => 'MySQL: '.$e
+		);
+		return false;
+	}
+	$_SESSION['return'] = array(
+		'type' => 'success',
+		'msg' => sprintf($lang['success']['forwarding_host_removed'], htmlspecialchars($host))
+	);
+}
 ?>
diff --git a/data/web/inc/init.sql b/data/web/inc/init.sql
index 84e19f74..bdce3e9c 100644
--- a/data/web/inc/init.sql
+++ b/data/web/inc/init.sql
@@ -140,6 +140,11 @@ CREATE TABLE IF NOT EXISTS `tfa` (
   PRIMARY KEY (`id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
 
+CREATE TABLE IF NOT EXISTS `forwarding_hosts` (
+  `host` VARCHAR(255) NOT NULL,
+  PRIMARY KEY (`host`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
+
 DROP VIEW IF EXISTS grouped_mail_aliases;
 DROP VIEW IF EXISTS grouped_sender_acl;
 DROP VIEW IF EXISTS grouped_domain_alias_address;
diff --git a/data/web/inc/triggers.inc.php b/data/web/inc/triggers.inc.php
index 2895420d..5d8e7b7d 100644
--- a/data/web/inc/triggers.inc.php
+++ b/data/web/inc/triggers.inc.php
@@ -72,6 +72,12 @@ if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == "admi
 	if (isset($_POST["delete_domain_admin"])) {
 		delete_domain_admin($_POST);
 	}
+	if (isset($_POST["add_forwarding_host"])) {
+		add_forwarding_host($_POST);
+	}
+	if (isset($_POST["delete_forwarding_host"])) {
+		delete_forwarding_host($_POST);
+	}
 }
 if (isset($_SESSION['mailcow_cc_role']) && $_SESSION['mailcow_cc_role'] == "user") {
 	if (isset($_POST["edit_user_account"])) {
diff --git a/data/web/lang/lang.en.php b/data/web/lang/lang.en.php
index 978ee713..120f35cf 100644
--- a/data/web/lang/lang.en.php
+++ b/data/web/lang/lang.en.php
@@ -468,4 +468,10 @@ $lang['admin']['set_rr_failed'] = 'Cannot set Postfix restrictions';
 $lang['admin']['no_record'] = 'No record';
 $lang['admin']['filter_table'] = 'Filter table';
 $lang['admin']['empty'] = 'No results';
+$lang['admin']['forwarding_hosts'] = 'Forwarding Hosts';
+$lang['admin']['forwarding_hosts_hint'] = 'Specify any networks (in CIDR notation) from which you unconditionally want to accept incoming messages. These hosts are then not checked against DNSBLs or subjected to greylisting. Spam received from them is never rejected and always filed into the Junk folder. The most common use for this is to specify mail servers on which you have set up a forwarding rule.';
+$lang['admin']['add_forwarding_host'] = 'Add Forwarding Host';
+$lang['delete']['remove_forwardinghost_warning'] = '<b>Warning:</b> You are about to remove the forwarding host <b>%s</b>!';
+$lang['success']['forwarding_host_removed'] = "Forwarding host %s has been removed";
+$lang['success']['forwarding_host_added'] = "Forwarding host %s has been added";
 ?>

From 8822eb57c88d6e2ae8077d704bcb0ba5d9e030bb Mon Sep 17 00:00:00 2001
From: Michael Kuron <m.kuron@gmx.de>
Date: Mon, 17 Apr 2017 15:11:36 +0200
Subject: [PATCH 2/6] Forwarding hosts in rspamd

---
 data/conf/rspamd/dynmaps/settings.php | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/data/conf/rspamd/dynmaps/settings.php b/data/conf/rspamd/dynmaps/settings.php
index 9be1f696..80b046df 100644
--- a/data/conf/rspamd/dynmaps/settings.php
+++ b/data/conf/rspamd/dynmaps/settings.php
@@ -31,6 +31,30 @@ catch (PDOException $e) {
 
 ?>
 settings {
+	whitelist_forwarding_hosts {
+		priority = high;
+<?php
+try {
+	$stmt = $pdo->query("SELECT `host` FROM `forwarding_hosts`");
+	$rows = $stmt->fetchAll(PDO::FETCH_COLUMN);
+}
+catch (PDOException $e) {
+	$rows = array();
+}
+
+foreach ($rows as $host) {
+	echo "\t\t" . 'ip = "' . $host . '";' . "\n";
+}
+?>
+		apply "default" {
+			actions {
+				reject = 999.9;
+			}
+		}
+		symbols [
+			"WHITELIST_FORWARDING_HOST"
+		]
+	}
 <?php
 $stmt = $pdo->query("SELECT DISTINCT `object` FROM `filterconf` WHERE `option` = 'highspamlevel' OR `option` = 'lowspamlevel'");
 $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);

From a75d916b74a78f3d1f9a07eaf7920f113569bc9f Mon Sep 17 00:00:00 2001
From: Michael Kuron <m.kuron@gmx.de>
Date: Mon, 17 Apr 2017 15:42:35 +0200
Subject: [PATCH 3/6] Forwarding hosts in postscreen

---
 data/Dockerfiles/postfix/Dockerfile           |  1 +
 data/conf/postfix/main.cf                     |  2 +-
 data/conf/postfix/master.cf                   |  2 +
 .../conf/postfix/whitelist_forwardinghosts.sh | 11 ++++
 data/conf/rspamd/dynmaps/forwardinghosts.php  | 53 +++++++++++++++++++
 5 files changed, 68 insertions(+), 1 deletion(-)
 create mode 100755 data/conf/postfix/whitelist_forwardinghosts.sh
 create mode 100644 data/conf/rspamd/dynmaps/forwardinghosts.php

diff --git a/data/Dockerfiles/postfix/Dockerfile b/data/Dockerfiles/postfix/Dockerfile
index 0fcdc893..ba004827 100644
--- a/data/Dockerfiles/postfix/Dockerfile
+++ b/data/Dockerfiles/postfix/Dockerfile
@@ -23,6 +23,7 @@ RUN apt-get install -y --no-install-recommends supervisor \
 	gnupg \
 	python-gpgme \
 	sudo \
+	curl \
 	dirmngr
 
 RUN addgroup --system --gid 600 zeyple
diff --git a/data/conf/postfix/main.cf b/data/conf/postfix/main.cf
index b28f6eb9..52e86681 100644
--- a/data/conf/postfix/main.cf
+++ b/data/conf/postfix/main.cf
@@ -24,7 +24,7 @@ milter_default_action = accept
 milter_protocol = 6
 minimal_backoff_time = 300s
 plaintext_reject_code = 550
-postscreen_access_list = permit_mynetworks, cidr:/opt/postfix/conf/postscreen_access.cidr
+postscreen_access_list = permit_mynetworks, cidr:/opt/postfix/conf/postscreen_access.cidr, tcp:127.0.0.1:10027
 postscreen_bare_newline_enable = no
 postscreen_blacklist_action = drop
 postscreen_cache_cleanup_interval = 24h
diff --git a/data/conf/postfix/master.cf b/data/conf/postfix/master.cf
index 3802c9a0..61aeb592 100644
--- a/data/conf/postfix/master.cf
+++ b/data/conf/postfix/master.cf
@@ -55,3 +55,5 @@ zeyple    unix  -       n       n       -       -       pipe
   -o smtpd_recipient_restrictions=permit_mynetworks,reject
   -o mynetworks=127.0.0.0/8
   -o smtpd_authorized_xforward_hosts=127.0.0.0/8
+
+127.0.0.1:10027 inet  n       n       n       -       0      spawn user=nobody argv=/opt/postfix/conf/whitelist_forwardinghosts.sh
diff --git a/data/conf/postfix/whitelist_forwardinghosts.sh b/data/conf/postfix/whitelist_forwardinghosts.sh
new file mode 100755
index 00000000..aa9df608
--- /dev/null
+++ b/data/conf/postfix/whitelist_forwardinghosts.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+while true; do
+	read QUERY
+	QUERY=($QUERY)
+	if [ "${QUERY[0]}" != "get" ]; then
+		echo "500 dunno"
+		continue
+	fi
+	echo $(curl -s http://172.22.1.251:8081/forwardinghosts.php?host=${QUERY[1]})
+done
diff --git a/data/conf/rspamd/dynmaps/forwardinghosts.php b/data/conf/rspamd/dynmaps/forwardinghosts.php
new file mode 100644
index 00000000..95773e45
--- /dev/null
+++ b/data/conf/rspamd/dynmaps/forwardinghosts.php
@@ -0,0 +1,53 @@
+<?php
+header('Content-Type: text/plain');
+require_once "vars.inc.php";
+
+ini_set('error_reporting', 0);
+
+function in_net($addr, $net)
+{
+	$net = explode('/', $net);
+	$mask = $net[1];
+	$net = inet_pton($net[0]);
+	$addr = inet_pton($addr);
+
+	$length = strlen($net); // 4 for IPv4, 16 for IPv6
+	if (strlen($net) != strlen($addr))
+		return FALSE;
+
+	$addr_bin = '';
+	$net_bin = '';
+	for ($i = 0; $i < $length; ++$i)
+	{
+		$addr_bin .= str_pad(decbin(ord(substr($addr, $i, $i+1))), 8, '0', STR_PAD_LEFT);
+		$net_bin .= str_pad(decbin(ord(substr($net, $i, $i+1))), 8, '0', STR_PAD_LEFT);
+	}
+
+	return substr($addr_bin, 0, $mask) == substr($net_bin, 0, $mask);
+}
+
+$dsn = $database_type . ':host=' . $database_host . ';dbname=' . $database_name;
+$opt = [
+    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+    PDO::ATTR_EMULATE_PREPARES   => false,
+];
+try {
+  $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
+  $stmt = $pdo->query("SELECT * FROM `forwarding_hosts`");
+  $networks = $stmt->fetchAll(PDO::FETCH_COLUMN);
+  foreach ($networks as $network)
+  {
+    if (in_net($_GET['host'], $network))
+    {
+      echo '200 permit';
+      exit;
+    }
+  }
+  echo '200 dunno';
+}
+catch (PDOException $e) {
+  echo 'settings { }';
+  exit;
+}
+?>

From df71e97a09fa9b90b4766875ee20f9ba2345bcc3 Mon Sep 17 00:00:00 2001
From: Michael Kuron <m.kuron@gmx.de>
Date: Sat, 22 Apr 2017 12:33:53 +0200
Subject: [PATCH 4/6] Forwarding hosts: use SPF records if present

---
 data/web/admin.php             |  35 +++++----
 data/web/delete.php            |   2 +-
 data/web/inc/functions.inc.php |  55 ++++++++++----
 data/web/inc/init.sql          |   1 +
 data/web/inc/spf.inc.php       | 127 +++++++++++++++++++++++++++++++++
 data/web/lang/lang.de.php      |  13 +++-
 data/web/lang/lang.en.php      |   5 +-
 7 files changed, 206 insertions(+), 32 deletions(-)
 create mode 100644 data/web/inc/spf.inc.php

diff --git a/data/web/admin.php b/data/web/admin.php
index 6d0bdf82..defe794e 100644
--- a/data/web/admin.php
+++ b/data/web/admin.php
@@ -313,7 +313,8 @@ $tfa_data = get_tfa();
           <table class="table table-striped" id="forwardinghoststable">
             <thead>
             <tr>
-              <th style="min-width: 100px;"><?=$lang['edit']['hostname'];?></th>
+              <th style="min-width: 100px;"><?=$lang['edit']['host'];?></th>
+              <th style="min-width: 100px;"><?=$lang['edit']['source'];?></th>
               <th style="text-align: right; min-width: 200px;"><?=$lang['admin']['action'];?></th>
             </tr>
             </thead>
@@ -321,20 +322,23 @@ $tfa_data = get_tfa();
               <?php
               $forwarding_hosts = get_forwarding_hosts();
               if ($forwarding_hosts) {
-              foreach ($forwarding_hosts as $host) {
-              ?>
-              <tr id="data">
-                <td><?=htmlspecialchars(strtolower($host));?></td>
-                <td style="text-align: right;">
-                  <div class="btn-group">
-                    <a href="delete.php?forwardinghost=<?=$host;?>" class="btn btn-xs btn-danger"><span class="glyphicon glyphicon-trash"></span> <?=$lang['admin']['remove'];?></a>
-                  </div>
-                </td>
-                </td>
-              </tr>
+                foreach ($forwarding_hosts as $host) {
+                  $source = $host->source;
+                  $host = $host->host;
+                ?>
+                <tr id="data">
+                  <td><?=htmlspecialchars(strtolower($host));?></td>
+                  <td><?=htmlspecialchars(strtolower($source));?></td>
+                  <td style="text-align: right;">
+                    <div class="btn-group">
+                      <a href="delete.php?forwardinghost=<?=$host;?>" class="btn btn-xs btn-danger"><span class="glyphicon glyphicon-trash"></span> <?=$lang['admin']['remove'];?></a>
+                    </div>
+                  </td>
+                  </td>
+                </tr>
 
-              <?php
-              }
+                <?php
+                }
               } else {
               ?>
                 <tr id="no-data"><td colspan="4" style="text-align: center; font-style: italic;"><?=$lang['admin']['no_record'];?></td></tr>
@@ -347,9 +351,10 @@ $tfa_data = get_tfa();
         </form>
         <small>
         <legend><?=$lang['admin']['add_forwarding_host'];?></legend>
+        <p style="margin-bottom:10px"><?=$lang['admin']['forwarding_hosts_add_hint'];?></p>
         <form class="form-horizontal" role="form" method="post">
           <div class="form-group">
-            <label class="control-label col-sm-2" for="hostname"><?=$lang['edit']['hostname'];?>:</label>
+            <label class="control-label col-sm-2" for="hostname"><?=$lang['edit']['host'];?>:</label>
             <div class="col-sm-10">
               <input type="text" class="form-control" name="hostname" id="hostname" required>
             </div>
diff --git a/data/web/delete.php b/data/web/delete.php
index bfacad0c..bfeff0f3 100644
--- a/data/web/delete.php
+++ b/data/web/delete.php
@@ -105,7 +105,7 @@ if (isset($_SESSION['mailcow_cc_role']) && ($_SESSION['mailcow_cc_role'] == "adm
 				</form>
 				<?php
 		}
-		// DELETE DOMAIN ADMIN
+		// DELETE FORWARDING HOST
 		elseif (isset($_GET["forwardinghost"]) &&
 			!empty($_GET["forwardinghost"]) &&
         $_SESSION['mailcow_cc_role'] == "admin") {
diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php
index f031af8d..66560a22 100644
--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
@@ -98,6 +98,8 @@ function init_db_schema() {
 			'msg' => 'Database initialization completed.'
 		);
 	}
+  // Add newly added tables
+  $stmt = $pdo->query("CREATE TABLE IF NOT EXISTS `forwarding_hosts` (`host` VARCHAR(255) NOT NULL, PRIMARY KEY (`host`)) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC");
   // Add newly added columns
   $stmt = $pdo->query("SHOW COLUMNS FROM `mailbox` LIKE 'kind'");
   $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
@@ -124,9 +126,11 @@ function init_db_schema() {
   if ($num_results == 0) {
     $pdo->query("ALTER TABLE `tfa` ADD `key_id` VARCHAR(255) DEFAULT 'unidentified'");
   }
-  
-  // Add newly added tables
-  $stmt = $pdo->query("CREATE TABLE IF NOT EXISTS `forwarding_hosts` (`host` VARCHAR(255) NOT NULL, PRIMARY KEY (`host`)) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC");
+  $stmt = $pdo->query("SHOW COLUMNS FROM `forwarding_hosts` LIKE 'source'");
+  $num_results = count($stmt->fetchAll(PDO::FETCH_ASSOC));
+  if ($num_results == 0) {
+    $pdo->query("ALTER TABLE `forwarding_hosts` ADD `source` VARCHAR(255) DEFAULT ''");
+  }
 }
 function verify_ssha256($hash, $password) {
 	// Remove tag if any
@@ -5044,11 +5048,12 @@ function get_u2f_registrations($username) {
 }
 function get_forwarding_hosts() {
 	global $pdo;
-  $sel = $pdo->prepare("SELECT host FROM `forwarding_hosts`");
+  $sel = $pdo->prepare("SELECT host, source FROM `forwarding_hosts`");
   $sel->execute();
-  return $sel->fetchAll(PDO::FETCH_COLUMN);
+  return $sel->fetchAll(PDO::FETCH_OBJ);
 }
 function add_forwarding_host($postarray) {
+	require_once 'spf.inc.php';
 	global $pdo;
 	global $lang;
 	if ($_SESSION['mailcow_cc_role'] != "admin") {
@@ -5058,23 +5063,47 @@ function add_forwarding_host($postarray) {
 		);
 		return false;
 	}
+	$source = $postarray['hostname'];
 	$host = $postarray['hostname'];
-	try {
-		$stmt = $pdo->prepare("INSERT INTO `forwarding_hosts` (`host`) VALUES (:host)");
-		$stmt->execute(array(
-			':host' => $host,
-		));
+	$hosts = array();
+	if (preg_match('/^[0-9a-fA-F:\/]+$/', $host)) { // IPv6 address
+		$hosts = array($host);
 	}
-	catch (PDOException $e) {
+	elseif (preg_match('/^[0-9\.\/]+$/', $host)) { // IPv4 address
+		$hosts = array($host);
+	}
+	else {
+		$hosts = get_outgoing_hosts_best_guess($host);
+	}
+	if (!$hosts)
+	{
 		$_SESSION['return'] = array(
 			'type' => 'danger',
-			'msg' => 'MySQL: '.$e
+			'msg' => 'Invalid host specified: '. htmlspecialchars($host)
 		);
 		return false;
 	}
+	foreach ($hosts as $host) {
+		if ($source == $host)
+			$source = '';
+		try {
+			$stmt = $pdo->prepare("INSERT IGNORE INTO `forwarding_hosts` (`host`, `source`) VALUES (:host, :source)");
+			$stmt->execute(array(
+				':host' => $host,
+				':source' => $source,
+			));
+		}
+		catch (PDOException $e) {
+			$_SESSION['return'] = array(
+				'type' => 'danger',
+				'msg' => 'MySQL: '.$e
+			);
+			return false;
+		}
+	}
 	$_SESSION['return'] = array(
 		'type' => 'success',
-		'msg' => sprintf($lang['success']['forwarding_host_added'], htmlspecialchars($host))
+		'msg' => sprintf($lang['success']['forwarding_host_added'], htmlspecialchars(implode(', ', $hosts)))
 	);
 }
 function delete_forwarding_host($postarray) {
diff --git a/data/web/inc/init.sql b/data/web/inc/init.sql
index bdce3e9c..54b227c9 100644
--- a/data/web/inc/init.sql
+++ b/data/web/inc/init.sql
@@ -142,6 +142,7 @@ CREATE TABLE IF NOT EXISTS `tfa` (
 
 CREATE TABLE IF NOT EXISTS `forwarding_hosts` (
   `host` VARCHAR(255) NOT NULL,
+  `source` VARCHAR(255) NOT NULL,
   PRIMARY KEY (`host`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 ROW_FORMAT=DYNAMIC;
 
diff --git a/data/web/inc/spf.inc.php b/data/web/inc/spf.inc.php
new file mode 100644
index 00000000..0e584b40
--- /dev/null
+++ b/data/web/inc/spf.inc.php
@@ -0,0 +1,127 @@
+<?php
+function get_spf_allowed_hosts($domain)
+{
+	$hosts = array();
+	
+	$records = dns_get_record($domain, DNS_TXT);
+	foreach ($records as $record)
+	{
+		$txt = explode(' ', $record['entries'][0]);
+		if (array_shift($txt) != 'v=spf1') // only handle SPF records
+			continue;
+		
+		foreach ($txt as $mech)
+		{
+			$qual = substr($mech, 0, 1);
+			if ($qual == '-' || $qual == '~') // only handle pass or neutral records
+				continue(2);
+			
+			if ($qual == '+' || $qual == '?')
+				$mech = substr($mech, 1); // remove the qualifier
+			
+			if (strpos($mech, '=') !== FALSE) // handle a modifier
+			{
+				$mod = explode('=', $mech);
+				if ($mod[0] == 'redirect') // handle a redirect
+				{
+					$hosts = get_spf_allowed_hosts($mod[1]);
+					return $hosts;
+				}
+			}
+			else
+			{
+				unset($cidr);
+				if (strpos($mech, ':') !== FALSE) // handle a domain specification
+				{
+					$split = explode(':', $mech);
+					$mech = array_shift($split);
+					$domain = implode(':', $split);
+					if (strpos($domain, '/') !== FALSE) // remove CIDR specification
+					{
+						$split = explode('/', $domain);
+						$domain = $split[0];
+						$cidr = $split[1];
+					}
+				}
+				
+				$new_hosts = array();
+				if ($mech == 'include') // handle an inclusion
+				{
+					$new_hosts = get_spf_allowed_hosts($domain);
+				}
+				elseif ($mech == 'a') // handle a mechanism
+				{
+					$new_hosts = get_a_hosts($domain);
+				}
+				elseif ($mech == 'mx') // handle mx mechanism
+				{
+					$new_hosts = get_mx_hosts($domain);
+				}
+				elseif ($mech == 'ip4' || $mech == 'ip6') // handle ip mechanism
+				{
+					$new_hosts = array($domain);
+				}
+				
+				if (isset($cidr)) // add CIDR specification if present
+				{
+					foreach ($new_hosts as &$host)
+					{
+						$host .= '/' . $cidr;
+					}
+					unset($host);
+				}
+				
+				$hosts = array_unique(array_merge($hosts,$new_hosts), SORT_REGULAR);
+			}
+		}
+	}
+	
+	return $hosts;
+}
+
+function get_mx_hosts($domain)
+{
+	$hosts = array();
+	
+	$mx_records = dns_get_record($domain, DNS_MX);
+	foreach ($mx_records as $mx_record)
+	{
+		$new_hosts = get_a_hosts($mx_record['target']);
+		$hosts = array_unique(array_merge($hosts,$new_hosts), SORT_REGULAR);
+	}
+	
+	return $hosts;
+}
+
+function get_a_hosts($domain)
+{
+	$hosts = array();
+	
+	$a_records = dns_get_record($domain, DNS_A);
+	foreach ($a_records as $a_record)
+	{
+		$hosts[] = $a_record['ip'];
+	}
+	$a_records = dns_get_record($domain, DNS_AAAA);
+	foreach ($a_records as $a_record)
+	{
+		$hosts[] = $a_record['ipv6'];
+	}
+	
+	return $hosts;
+}
+
+function get_outgoing_hosts_best_guess($domain)
+{
+	// try the SPF record to get hosts that are allowed to send outgoing mails for this domain
+	$hosts = get_spf_allowed_hosts($domain);
+	if ($hosts) return $hosts;
+	
+	// try the MX record to get mail servers for this domain
+	$hosts = get_mx_hosts($domain);
+	if ($hosts) return $hosts;
+	
+	// fall back to the A record to get the host name for this domain
+	return get_a_hosts($domain);
+}
+?>
\ No newline at end of file
diff --git a/data/web/lang/lang.de.php b/data/web/lang/lang.de.php
index 07d23d70..a14b9143 100644
--- a/data/web/lang/lang.de.php
+++ b/data/web/lang/lang.de.php
@@ -450,11 +450,20 @@ $lang['admin']['unchanged_if_empty'] = 'Unverändert, wenn leer';
 $lang['admin']['yes'] = '&#10004;';
 $lang['admin']['no'] = '&#10008;';
 $lang['admin']['access'] = 'Zugang';
-$lang['admin']['invalid_max_msg_size'] = 'Invalid max. message size'; // NEEDS TRANSLATION
+$lang['admin']['invalid_max_msg_size'] = 'Ungültige maximale Nachrichtengröße';
 $lang['admin']['site_not_found'] = 'Kann mailcow Site-Konfiguration nicht finden';
-$lang['admin']['public_folder_empty'] = 'Public folder name must not be empty'; // NEEDS TRANSLATION
+$lang['admin']['public_folder_empty'] = 'Name des öffentlichen Ordners darf nicht leer sein';
 $lang['admin']['set_rr_failed'] = 'Kann Postfix Restriktionen nicht setzen';
 $lang['admin']['no_record'] = 'Kein Eintrag';
 $lang['admin']['filter_table'] = 'Tabelle Filtern';
 $lang['admin']['empty'] = 'Keine Einträge vorhanden';
+$lang['admin']['forwarding_hosts'] = 'Weiterleitungs-Hosts';
+$lang['admin']['forwarding_hosts_hint'] = 'Eingehende Nachrichten werden von den hier gelisteten Hosts bedingungslos akzeptiert. Diese Hosts werden dann nicht mit DNSBLs abgeglichen oder Greylisting unterworfen. Von ihnen empfangener Spam wird nie abgelehnt und immer in den Spam-Ordner einsortiert. Die übliche Verwendung für diese Funktion ist, um Mailserver anzugeben, auf denen eine Weiterleitung zu Ihrem Mailcow-Server eingerichtet wurde.';
+$lang['admin']['forwarding_hosts_add_hint'] = 'Sie können entweder IPv4/IPv6-Adressen, Netzwerke in CIDR-Notation, Hostnamen (die zu IP-Adressen aufgelöst werden), oder Domainnamen (die zu IP-Adressen aufgelöst werden, indem ihr SPF-Record abgefragt wird oder, in dessen Abwesenheit, ihre MX-Records) angeben.';
+$lang['edit']['host'] = 'Host';
+$lang['edit']['source'] = 'Quelle';
+$lang['admin']['add_forwarding_host'] = 'Weiterleitungs-Host hinzufügen';
+$lang['delete']['remove_forwardinghost_warning'] = '<b>Warnung:</b> Sie entfernen den Weiterleitungs-Host <b>%s</b>!';
+$lang['success']['forwarding_host_removed'] = "Weiterleitungs-Host %s wurde entfernt";
+$lang['success']['forwarding_host_added'] = "Weiterleitungs-Host %s wurde hinzugefügt";
 ?>
diff --git a/data/web/lang/lang.en.php b/data/web/lang/lang.en.php
index 120f35cf..4bc48f2c 100644
--- a/data/web/lang/lang.en.php
+++ b/data/web/lang/lang.en.php
@@ -469,7 +469,10 @@ $lang['admin']['no_record'] = 'No record';
 $lang['admin']['filter_table'] = 'Filter table';
 $lang['admin']['empty'] = 'No results';
 $lang['admin']['forwarding_hosts'] = 'Forwarding Hosts';
-$lang['admin']['forwarding_hosts_hint'] = 'Specify any networks (in CIDR notation) from which you unconditionally want to accept incoming messages. These hosts are then not checked against DNSBLs or subjected to greylisting. Spam received from them is never rejected and always filed into the Junk folder. The most common use for this is to specify mail servers on which you have set up a forwarding rule.';
+$lang['admin']['forwarding_hosts_hint'] = 'Incoming messages are unconditionally accepted from any hosts listed here. These hosts are then not checked against DNSBLs or subjected to greylisting. Spam received from them is never rejected and always filed into the Junk folder. The most common use for this is to specify mail servers on which you have set up a rule that forwards incoming emails to your Mailcow server.';
+$lang['admin']['forwarding_hosts_add_hint'] = 'You can either specify IPv4/IPv6 addresses, networks in CIDR notation, host names (which will be resolved to IP addresses), or domain names (which will be resolved to IP addresses by querying SPF records or, in their absence, MX records).';
+$lang['edit']['host'] = 'Host';
+$lang['edit']['source'] = 'Source';
 $lang['admin']['add_forwarding_host'] = 'Add Forwarding Host';
 $lang['delete']['remove_forwardinghost_warning'] = '<b>Warning:</b> You are about to remove the forwarding host <b>%s</b>!';
 $lang['success']['forwarding_host_removed'] = "Forwarding host %s has been removed";

From 894d6234e9ee6e636679bf4229cc527eb84cc307 Mon Sep 17 00:00:00 2001
From: Michael Kuron <m.kuron@gmx.de>
Date: Sat, 22 Apr 2017 14:28:37 +0200
Subject: [PATCH 5/6] Improvements to forwarding hosts in Postfix

- No more premature EOF and no more leaking of bash processes
- Log result
- Correctly treat non-CIDR entries
- Adapt to schema change from df71e97
- Correctly report SQL failure
---
 data/conf/postfix/whitelist_forwardinghosts.sh | 7 ++++---
 data/conf/rspamd/dynmaps/forwardinghosts.php   | 9 ++++++---
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/data/conf/postfix/whitelist_forwardinghosts.sh b/data/conf/postfix/whitelist_forwardinghosts.sh
index aa9df608..f18139b5 100755
--- a/data/conf/postfix/whitelist_forwardinghosts.sh
+++ b/data/conf/postfix/whitelist_forwardinghosts.sh
@@ -1,11 +1,12 @@
 #!/bin/bash
 
-while true; do
-	read QUERY
+while read QUERY; do
 	QUERY=($QUERY)
 	if [ "${QUERY[0]}" != "get" ]; then
 		echo "500 dunno"
 		continue
 	fi
-	echo $(curl -s http://172.22.1.251:8081/forwardinghosts.php?host=${QUERY[1]})
+	result=$(curl -s http://172.22.1.251:8081/forwardinghosts.php?host=${QUERY[1]})
+	logger -t whitelist_forwardinghosts -p mail.info "Look up ${QUERY[1]} on whitelist, result $result"
+	echo $result
 done
diff --git a/data/conf/rspamd/dynmaps/forwardinghosts.php b/data/conf/rspamd/dynmaps/forwardinghosts.php
index 95773e45..377c5e7e 100644
--- a/data/conf/rspamd/dynmaps/forwardinghosts.php
+++ b/data/conf/rspamd/dynmaps/forwardinghosts.php
@@ -7,13 +7,16 @@ ini_set('error_reporting', 0);
 function in_net($addr, $net)
 {
 	$net = explode('/', $net);
-	$mask = $net[1];
+	if (count($net) > 1)
+		$mask = $net[1];
 	$net = inet_pton($net[0]);
 	$addr = inet_pton($addr);
 
 	$length = strlen($net); // 4 for IPv4, 16 for IPv6
 	if (strlen($net) != strlen($addr))
 		return FALSE;
+	if (!isset($mask))
+		$mask = $length * 8;
 
 	$addr_bin = '';
 	$net_bin = '';
@@ -34,7 +37,7 @@ $opt = [
 ];
 try {
   $pdo = new PDO($dsn, $database_user, $database_pass, $opt);
-  $stmt = $pdo->query("SELECT * FROM `forwarding_hosts`");
+  $stmt = $pdo->query("SELECT host FROM `forwarding_hosts`");
   $networks = $stmt->fetchAll(PDO::FETCH_COLUMN);
   foreach ($networks as $network)
   {
@@ -47,7 +50,7 @@ try {
   echo '200 dunno';
 }
 catch (PDOException $e) {
-  echo 'settings { }';
+  echo '200 dunno';
   exit;
 }
 ?>

From affa52edcf3ce6e41e90e5126d5eb179b2973a78 Mon Sep 17 00:00:00 2001
From: Michael Kuron <m.kuron@gmx.de>
Date: Sat, 22 Apr 2017 18:34:49 +0200
Subject: [PATCH 6/6] =?UTF-8?q?Forwarding=20hosts:=20don=E2=80=99t=20add?=
 =?UTF-8?q?=20configuration=20if=20none=20are=20defined?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 data/conf/rspamd/dynmaps/settings.php | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/data/conf/rspamd/dynmaps/settings.php b/data/conf/rspamd/dynmaps/settings.php
index 176389db..098ffbd9 100644
--- a/data/conf/rspamd/dynmaps/settings.php
+++ b/data/conf/rspamd/dynmaps/settings.php
@@ -31,8 +31,6 @@ catch (PDOException $e) {
 
 ?>
 settings {
-	whitelist_forwarding_hosts {
-		priority = high;
 <?php
 try {
 	$stmt = $pdo->query("SELECT `host` FROM `forwarding_hosts`");
@@ -42,6 +40,12 @@ catch (PDOException $e) {
 	$rows = array();
 }
 
+if ($rows)
+{
+?>
+	whitelist_forwarding_hosts {
+		priority = high;
+<?php
 foreach ($rows as $host) {
 	echo "\t\t" . 'ip = "' . $host . '";' . "\n";
 }
@@ -56,6 +60,7 @@ foreach ($rows as $host) {
 		]
 	}
 <?php
+}
 $stmt = $pdo->query("SELECT DISTINCT `object` FROM `filterconf` WHERE `option` = 'highspamlevel' OR `option` = 'lowspamlevel'");
 $rows = $stmt->fetchAll(PDO::FETCH_ASSOC);