Configure a whitelist of remote addresses for Postmark inbound webhooks

Summary:
Ref T13053. Postmark support recommends testing requests against a whitelist of known remote addresses to determine request authenticity. Today, the list can be found here:

<https://postmarkapp.com/support/article/800-ips-for-firewalls>

This is potentially less robust than, e.g., HMAC verification, since they may need to add new datacenters or support IPv6 or something. Users might also have weird network topologies where everything is proxied, and this makes testing/simulating more difficult.

Allow users to configure the list so that they don't need to hack things apart if Postmark adds a new datacenter or remote addresses are unreliable for some other reason, but ship with safe defaults for today.

Test Plan:
Tried to make local requests, got kicked out. Added `0.0.0.0/0` to the list, stopped getting kicked out.

I don't have a convenient way to route real Postmark traffic to my development laptop with an authentic remote address so I haven't verified that the published remote address is legitimate, but I'll vet that in production when I go through all the other mailers.

Maniphest Tasks: T13053

Differential Revision: https://secure.phabricator.com/D19025

src/applications/metamta/adapter/PhabricatorMailImplementationPostmarkAdapter.php

@@ -73,12 +73,24 @@ final class PhabricatorMailImplementationPostmarkAdapter
       $options,
       array(
         'access-token' => 'string',
+        'inbound-addresses' => 'list<string>',
       ));
+
+    // Make sure this is properly formatted.
+    PhutilCIDRList::newList($options['inbound-addresses']);
   }
 
   public function newDefaultOptions() {
     return array(
       'access-token' => null,
+      'inbound-addresses' => array(
+        // Via Postmark support circa February 2018, see:
+        //
+        // https://postmarkapp.com/support/article/800-ips-for-firewalls
+        //
+        // "Configuring Outbound Email" should be updated if this changes.
+        '50.31.156.6/32',
+      ),
     );
   }
 

src/applications/metamta/controller/PhabricatorMetaMTAPostmarkReceiveController.php

@@ -20,6 +20,21 @@ final class PhabricatorMetaMTAPostmarkReceiveController
       return new Aphront404Response();
     }
 
+    $remote_address = $request->getRemoteAddress();
+    $any_remote_match = false;
+    foreach ($mailers as $mailer) {
+      $inbound_addresses = $mailer->getOption('inbound-addresses');
+      $cidr_list = PhutilCIDRList::newList($inbound_addresses);
+      if ($cidr_list->containsAddress($remote_address)) {
+        $any_remote_match = true;
+        break;
+      }
+    }
+
+    if (!$any_remote_match) {
+      return new Aphront400Response();
+    }
+
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
     $raw_input = PhabricatorStartup::getRawInput();
 

src/docs/user/configuration/configuring_inbound_email.diviner

@@ -141,6 +141,10 @@ webhook URI in the Postmark control panel:
 https://<phabricator.yourdomain.com>/mail/postmark/
 ```
 
+See also the Postmark section in @{article:Configuring Outbound Email} for
+discussion of the remote address whitelist used to verify that requests this
+endpoint receives are authentic requests originating from Postmark.
+
 
 = SendGrid Setup =
 

src/docs/user/configuration/configuring_outbound_email.diviner

@@ -157,6 +157,23 @@ Postmark is a third-party email delivery serivice. You can learn more at
 To use this mailer, set `type` to `postmark`, then configure these `options`:
 
   - `access-token`: Required string. Your Postmark access token.
+  - `inbound-addresses`: Optional list<string>. Address ranges which you
+    will accept inbound Postmark HTTP webook requests from.
+
+The default address list is preconfigured with Postmark's address range, so
+you generally will not need to set or adjust it.
+
+The option accepts a list of CIDR ranges, like `1.2.3.4/16` (IPv4) or
+`::ffff:0:0/96` (IPv6). The default ranges are:
+
+```lang=json
+[
+  "50.31.156.6/32"
+]
+```
+
+The default address ranges were last updated in February 2018, and were
+documented at: <https://postmarkapp.com/support/article/800-ips-for-firewalls>
 
 
 Mailer: Amazon SES