RRT: blacklist

[chibenwa]

CF https://issues.apache.org/jira/browse/JAMES-3946

Write in /server/data/data-api a `Droplist interfaces.

A drop list entry is comprised of

• ownerScope: global | domain | user
• owner: String.
  • For ownerScope global: this is always ALL.
  • For ownerScope domain: this is the domain, eg domain.tld
  • For ownerScope user, this is the users, eg bob@domain.tld
  • deniedEntityType: String. One of address | domain
  • deniedEntity: String. Either the domain or the address.

interface DropList {
    Mono<void> add(DropListEntry entry);
    Mono<void> remove(DropListEntry entry);
    Flux<DropListEntry> list(OwnerScope ownerSocpe, Owner owner);

   enum Status {
       ALLOWED,
       BLOCKED
   }
    Mono<Status> query(OwnerScope ownerSocpe, Owner owner, MailAddress sender);
}

And provide a memory + a Cassandra implementation of the DropList.

Write a IsInDropList matcher: Given attacker@evil.com sends a mail to target@localhost, the following queries are done:

• ownerScope all, owner All, deniedEntityType domain, deniedEntity evil.com
• ownerScope all, owner All, deniedEntityType address, deniedEntity attacker@evil.com
• ownerScope domain, owner localhost, deniedEntityType domain, deniedEntity evil.com
• ownerScope domain, owner localhost, deniedEntityType address, deniedEntity attacker@evil.com
• ownerScope user, owner target@localhost, deniedEntityType domain, deniedEntity evil.com
• ownerScope user, owner target@localhost, deniedEntityType address, deniedEntity attacker@evil.com

Manage to do only one set of queries at scope global. Manage to do one set of queries at scope domain per domain!

Webadmin APIs to manage the Drop List:

GET /droplist/global?deniedEntityType=null|domain|address
[ "evil.com", "devil.com", "bad_guy@crime.com", "hacker@murder.org" ]

HEAD /droplist/global/evil.com
HEAD /droplist/global/bad_guy@murder.org
204 // 404

PUT /droplist/global/evil.com
PUT /droplist/global/bad_guy@murder.org
-> adds the entry into the droplist

DELETE /droplist/global/evil.com
DELETE /droplist/global/bad_guy@murder.org
-> removes the entry from the droplist

----------------
GET /droplist/domain/target.com?deniedEntityType=null|domain|address
[ "evil.com", "devil.com", "bad_guy@crime.com", "hacker@murder.org" ]

HEAD /droplist/domain/target.com/evil.com
HEAD /droplist/domain/target.com/bad_guy@murder.org
204 // 404

PUT /droplist/domain/target.com/evil.com
PUT /droplist/domain/target.com/bad_guy@murder.org
-> adds the entry into the droplist

DELETE /droplist/domain/target.com/evil.com
DELETE /droplist/domain/target.com/bad_guy@murder.org
-> removes the entry from the droplist

----------------
GET /droplist/user/bob@target.com?deniedEntityType=null|domain|address
[ "evil.com", "devil.com", "bad_guy@crime.com", "hacker@murder.org" ]

HEAD /droplist/user/bob@target.com/evil.com
HEAD /droplist/user/bob@target.com/bad_guy@murder.org
204 // 404

PUT /droplist/user/bob@target.com/evil.com
PUT /droplist/user/bob@target.com/bad_guy@murder.org
-> adds the entry into the droplist

DELETE /droplist/user/bob@target.com/evil.com
DELETE /droplist/user/bob@target.com/bad_guy@murder.org
-> removes the entry from the droplist

Write a guice module for DropList with Cassandra and with memory but do not include it in the apps by default.

Document activating the droplist extension:

• Enable the droplist extension in extensions.properties
• Plug the IsInDropList matcher in mailetcontainer.xml
• Add the routes in additionalRoutes into webadmin.properties

And most imprtantly remove:

• AbstractSQLWhitelistMatcher
• IsInWhiteList
• WhiteListManager As we now propose a better alternative...

[Arsnael]

Customer request?

[chibenwa]

No but blacklists were discussed during an internal antispam related meeting

[chibenwa]

Requirement: be polite: tell the sender that the mail is blocked (bounce)

[chibenwa]

Ok ticket is modified:

• RRT take solely the receive into account
• The be polite requiments requires a matcher and is NOT achievable with RRTs...

[chibenwa]

CF https://issues.apache.org/jira/browse/JAMES-3946

I bet we can likely adapt the module chooser for Twake Mail and contribute a custom JMAP extension allowing a user to see and manage his blocklists.

Thoughts?

[Arsnael]

Doable and easy yes

[Arsnael]

First task would be to just add the dropList modules to tmail (distributed and memory and postgresql, like in james with the same kind of module chooser)

Then for JMAP part, new jmap extension that could be added with the module chooser when finished the dev. As jmap is for users, only should be able to manage droplist on user level (not domain or global).

Tasks:

• add droplist module chooser to distributed, memory, postgresql tmail distribs
• ADR
• antora JMAP documentation specs
• Capability: com:linagora:params:jmap:droplists
• Droplist/get : standard get => return user droplists (deniedEntityType = address)
• Droplist/set (no updates!!!)
  • standard set create
  • standard set delete
• Guice bindings (add to droplist module choosers)

[chibenwa]

CF https://github.com/linagora/tmail-backend/issues/830