chadsmith / haraka-alias-forward Goto Github PK

I'm one of the Haraka committers and I just stumbled across your plugin.

In your plugin you're setting connection.relaying = true to force the use of Haraka's outbound module to deliver the mail to the aliases destination address. Whilst this might work, it's wrong to do it like this because you can easily create a security hole if your hook_rcpt function return's next() for any reason.
Your plugin is OK because it does a next(DENY) if the alias doesn't match, but if someone customized this, they could easily create this issue.

connection.relaying is a connection level variable, meaning once it is set - it persists across the lifetime of the connection.

The 'correct' way to do this is to remove the connection.relaying = true line and then add yourself a custom queue hook which does this:

var outbound = require('./outbound');
var constants = require('./constants');
exports.hook_queue = function (next, connection) {
    var txn = connection.transaction;
    outbound.send_email(txn, function(retval, msg) {
        switch(retval) {
            case constants.ok:
                return next(OK, msg);
                break;
            case constants.deny:
                return next(DENY, msg);
                break;
            default:
                return next(DENYSOFT, msg);
        }
    });
}

That way you can safely fall through hook_rcpt with next() without creating an open relay.

Hi Chad!

I just wanted to say thank you!, for writing this script. i've spent too much time on getting started with Haraka, mostly because I expected 'aliases' to just work. But it turns out it doesn't do so without auth..

Your script does exactly what I want it to do. Perhaps you would like to officially contribute it to Haraka?

When this plugin is used, you can only send mails to recipients in the rcpt_to.* modules.
The relay method not working. (for example - when AUTH is enabled and passed).

I am using your plugin, merely the @guoyiang s fork (because of #5) and i have noticed that it doesn't play very well with haraka-plugin-rspamd. When i enable both plugins, rspamd fails. Since rspamd doesn't fail, when i enable alias-forward, i think it could have something to do with this plugin as well.

Please notice haraka/haraka-plugin-rspamd#5

@guoyiang if you will receive this, it would be great if you could open up the issues section on your fork, since it is a bit different of @chadsmith s implementation.