Configure a whitelist of remote addresses for Postmark inbound webhooks

Summary:
Ref T13053. Postmark support recommends testing requests against a whitelist of known remote addresses to determine request authenticity. Today, the list can be found here:

<https://postmarkapp.com/support/article/800-ips-for-firewalls>

This is potentially less robust than, e.g., HMAC verification, since they may need to add new datacenters or support IPv6 or something. Users might also have weird network topologies where everything is proxied, and this makes testing/simulating more difficult.

Allow users to configure the list so that they don't need to hack things apart if Postmark adds a new datacenter or remote addresses are unreliable for some other reason, but ship with safe defaults for today.

Test Plan:
Tried to make local requests, got kicked out. Added `0.0.0.0/0` to the list, stopped getting kicked out.

I don't have a convenient way to route real Postmark traffic to my development laptop with an authentic remote address so I haven't verified that the published remote address is legitimate, but I'll vet that in production when I go through all the other mailers.

Maniphest Tasks: T13053

Differential Revision: https://secure.phabricator.com/D19025

epriestley 8 years ago 948b0cec 2bb4fc9e

+48

4 changed files

expand all

src

applications

metamta

adapter

PhabricatorMailImplementationPostmarkAdapter.php

controller

PhabricatorMetaMTAPostmarkReceiveController.php

docs

user

configuration

configuring_inbound_email.diviner

configuring_outbound_email.diviner

+12

src/applications/metamta/adapter/PhabricatorMailImplementationPostmarkAdapter.php

··· 73 73 $options, 74 74 array( 75 75 'access-token' => 'string', 76 + 'inbound-addresses' => 'list<string>', 76 77 )); 78 + 79 + // Make sure this is properly formatted. 80 + PhutilCIDRList::newList($options['inbound-addresses']); 77 81 } 78 82 79 83 public function newDefaultOptions() { 80 84 return array( 81 85 'access-token' => null, 86 + 'inbound-addresses' => array( 87 + // Via Postmark support circa February 2018, see: 88 + // 89 + // https://postmarkapp.com/support/article/800-ips-for-firewalls 90 + // 91 + // "Configuring Outbound Email" should be updated if this changes. 92 + '50.31.156.6/32', 93 + ), 82 94 ); 83 95 } 84 96

+15

src/applications/metamta/controller/PhabricatorMetaMTAPostmarkReceiveController.php

··· 20 20 return new Aphront404Response(); 21 21 } 22 22 23 + $remote_address = $request->getRemoteAddress(); 24 + $any_remote_match = false; 25 + foreach ($mailers as $mailer) { 26 + $inbound_addresses = $mailer->getOption('inbound-addresses'); 27 + $cidr_list = PhutilCIDRList::newList($inbound_addresses); 28 + if ($cidr_list->containsAddress($remote_address)) { 29 + $any_remote_match = true; 30 + break; 31 + } 32 + } 33 + 34 + if (!$any_remote_match) { 35 + return new Aphront400Response(); 36 + } 37 + 23 38 $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites(); 24 39 $raw_input = PhabricatorStartup::getRawInput(); 25 40

src/docs/user/configuration/configuring_inbound_email.diviner

··· 141 141 https://<phabricator.yourdomain.com>/mail/postmark/ 142 142 ``` 143 143 144 + See also the Postmark section in @{article:Configuring Outbound Email} for 145 + discussion of the remote address whitelist used to verify that requests this 146 + endpoint receives are authentic requests originating from Postmark. 147 + 144 148 145 149 = SendGrid Setup = 146 150

+17

src/docs/user/configuration/configuring_outbound_email.diviner

··· 157 157 To use this mailer, set `type` to `postmark`, then configure these `options`: 158 158 159 159 - `access-token`: Required string. Your Postmark access token. 160 + - `inbound-addresses`: Optional list<string>. Address ranges which you 161 + will accept inbound Postmark HTTP webook requests from. 162 + 163 + The default address list is preconfigured with Postmark's address range, so 164 + you generally will not need to set or adjust it. 165 + 166 + The option accepts a list of CIDR ranges, like `1.2.3.4/16` (IPv4) or 167 + `::ffff:0:0/96` (IPv6). The default ranges are: 168 + 169 + ```lang=json 170 + [ 171 + "50.31.156.6/32" 172 + ] 173 + ``` 174 + 175 + The default address ranges were last updated in February 2018, and were 176 + documented at: <https://postmarkapp.com/support/article/800-ips-for-firewalls> 160 177 161 178 162 179 Mailer: Amazon SES

Configure Feed

Configure Feed