Dateien nach "/" hochladen

2026-08-13 22:25:52 +02:00
parent 4b4d2b7f64
commit b5c994d970
4 changed files with 1090 additions and 0 deletions
@@ -0,0 +1,247 @@
 # SMTPGraphRelay V1
 Ein kleiner nativer Windows-/PowerShell-Relay:
 ```text
 Drucker / NAS / Server / Monitoring
            |
            | SMTP (lokal)
            v
      SMTPGraphRelay
            |
            | HTTPS / OAuth2 / Microsoft Graph
            v
       Microsoft 365
 ```
 ## Was V1 kann
 - SMTP-Listener auf konfigurierbarer IP / Port
 - `EHLO`, `HELO`, `MAIL FROM`, mehrere `RCPT TO`, `DATA`, `RSET`, `NOOP`, `QUIT`
 - IPv4-Allowlist per CIDR
 - maximale Mailgröße
 - lokale Store-and-Forward Queue
 - Retry bei Graph-/Netzwerkfehlern
 - Failed-Queue nach Max-Retries
 - Microsoft Graph `sendMail`
 - MIME-Mail wird als MIME an Graph weitergegeben
 - App-only OAuth mit Zertifikat
 - First-Run erzeugt:
  - selbstsigniertes Zertifikat in `LocalMachine\My`
  - Entra ID App Registration
  - Service Principal
  - Microsoft Graph `Mail.Send` Application Permission
  - Admin Consent
  - `config.json`
  - Windows-Firewallregel
  - Scheduled Task als `SYSTEM`
 ## Voraussetzungen
 - Windows 10/11 oder Windows Server
 - Windows PowerShell 5.1
 - PowerShell als Administrator
 - Internetzugang zu Microsoft Graph / Entra
 - M365-/Entra-Admin, der App-Registrierungen und App Permissions vergeben darf
 - bestehendes Exchange-Online-Postfach für den konfigurierten Absender
 ## Installation
 1. ZIP entpacken, z. B.:
 ```powershell
 C:\Program Files\SMTPGraphRelay
 ```
 2. Windows PowerShell **als Administrator** öffnen.
 3. Setup starten:
 ```powershell
 Set-ExecutionPolicy -Scope Process Bypass
 cd "C:\Program Files\SMTPGraphRelay"
 .\Setup-SMTPGraphRelay.ps1
 ```
 Das Setup fragt u. a.:
 - App-Name
 - M365-Absenderpostfach
 - Listen-IP
 - SMTP-Port
 - erlaubte Quellnetze
 Danach wird die Entra-App automatisch erstellt.
 ## Standard
 Port:
 ```text
 2525/TCP
 ```
 Default-Allowlist:
 ```text
 127.0.0.1/32
 10.0.0.0/8
 172.16.0.0/12
 192.168.0.0/16
 ```
 Der Absender wird standardmäßig immer auf das konfigurierte M365-Postfach umgeschrieben:
 ```json
 "ForceSender": true
 ```
 Das verhindert, dass ein internes Gerät beliebige `From:`-Adressen durchreichen kann.
 ## Start / Stop
 Start:
 ```powershell
 Start-ScheduledTask -TaskName "SMTPGraphRelay"
 ```
 Stop:
 ```powershell
 Stop-ScheduledTask -TaskName "SMTPGraphRelay"
 ```
 Status:
 ```powershell
 Get-ScheduledTask -TaskName "SMTPGraphRelay" | Get-ScheduledTaskInfo
 ```
 ## Test vom Relay-PC
 Wenn `Send-MailMessage` noch vorhanden ist:
 ```powershell
 Send-MailMessage `
  -SmtpServer 127.0.0.1 `
  -Port 2525 `
  -From "test@local.invalid" `
  -To "dein.name@example.com" `
  -Subject "SMTPGraphRelay Test" `
  -Body "Hallo aus SMTPGraphRelay"
 ```
 Alternativ kann jedes SMTP-Testtool verwendet werden.
 ## Verzeichnisse
 ```text
 SMTPGraphRelay\
 ├── SMTPGraphRelay.ps1
 ├── Setup-SMTPGraphRelay.ps1
 ├── config.json
 ├── config.example.json
 ├── queue\
 ├── failed\
 └── logs\
    └── SMTPGraphRelay.log
 ```
 ## Queue
 Nach vollständigem SMTP-`DATA` wird die Nachricht zunächst lokal gespeichert.
 Erst **danach** bekommt der SMTP-Client:
 ```text
 250 2.0.0 Queued
 ```
 Der Queue-Worker sendet die Nachricht anschließend über Microsoft Graph.
 Standard-Retry:
 ```text
 1 min
 5 min
 15 min
 30 min
 60 min
 120 min
 240 min
 480 min
 ```
 Nach acht Fehlern wandert die Mail nach `failed`.
 ## Sicherheit
 ### Kein offenes Relay
 Die SMTP-Seite besitzt eine IP-Allowlist. Bitte die Standard-RFC1918-Netze auf die tatsächlich benötigten Subnetze reduzieren.
 Beispiel:
 ```json
 "AllowedNetworks": [
  "10.60.10.0/24",
  "10.20.30.15"
 ]
 ```
 ### Kein Client Secret
 Das Setup erzeugt ein nicht exportierbares RSA-Zertifikat in:
 ```text
 Cert:\LocalMachine\My
 ```
 Der Scheduled Task läuft als `SYSTEM` und lädt dieses Zertifikat direkt aus dem Maschinen-Zertifikatsspeicher.
 ### Graph-Berechtigung
 Die V1 vergibt ausschließlich:
 ```text
 Microsoft Graph
 Application
 Mail.Send
 ```
 Keine `Mail.ReadWrite`, `Directory.Read.All`, SMTP-/IMAP- oder Exchange-Full-Access-Permission ist für den Relaybetrieb nötig.
 **Wichtig:** `Mail.Send` als Application Permission ist grundsätzlich eine weitreichende Berechtigung. Die V1 erzwingt zwar lokal das konfigurierte Senderpostfach, beschränkt die Entra-/Exchange-Berechtigung aber noch nicht serverseitig auf genau dieses Postfach.
 Für eine nächste Version sollte zusätzlich **Exchange Online Application RBAC** bzw. die jeweils aktuelle Microsoft-Methode zur Ressourcenscope-Begrenzung integriert werden.
 ## Bekannte Grenzen von V1
 - SMTP-Verbindungen werden seriell verarbeitet
 - kein SMTP AUTH
 - kein STARTTLS auf der internen SMTP-Seite
 - IPv4-Allowlist; IPv6 wird nicht freigegeben
 - kein Web-/GUI-Frontend
 - keine DSN/Bounce-Erzeugung
 - Envelope-Empfänger werden protokolliert; Graph erhält primär die Empfänger aus den MIME-Headern
 - kein serverseitiges Exchange-Mailbox-Scoping im Setup
 Für typische Drucker, Scanner, NAS, Monitoring- und Server-Alerts sollte diese V1 als Test-/Pilotversion ausreichen.
 ## Deinstallation
 Task stoppen/löschen:
 ```powershell
 Stop-ScheduledTask -TaskName "SMTPGraphRelay" -ErrorAction SilentlyContinue
 Unregister-ScheduledTask -TaskName "SMTPGraphRelay" -Confirm:$false
 ```
 Firewallregel entfernen (Port ggf. anpassen):
 ```powershell
 Remove-NetFirewallRule -DisplayName "SMTPGraphRelay TCP 2525"
 ```
 Die Entra-App und das Zertifikat werden absichtlich **nicht automatisch gelöscht**, damit bei einer Deinstallation keine Cloud-Credentials versehentlich entfernt werden.
@@ -0,0 +1,468 @@
 #Requires -Version 5.1
 <#
 .SYNOPSIS
  SMTPGraphRelay - einfacher SMTP Store-and-Forward Relay zu Microsoft Graph.
 .DESCRIPTION
  Nimmt lokale SMTP-Mails an, speichert sie als .eml in einer Queue und sendet sie
  anschließend per Microsoft Graph sendMail mit App-only Zertifikatsauthentifizierung.
  V1: EHLO/HELO, MAIL FROM, RCPT TO, DATA, RSET, NOOP, QUIT
 #>
 [CmdletBinding()]
 param(
    [string]$ConfigPath = "$PSScriptRoot\config.json"
 )
 $ErrorActionPreference = "Stop"
 [Console]::OutputEncoding = [System.Text.Encoding]::UTF8
 function Write-Log {
    param(
        [Parameter(Mandatory)][string]$Message,
        [ValidateSet("INFO","WARN","ERROR","DEBUG")][string]$Level = "INFO"
    )
    $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss.fff"
    $line = "[$ts] [$Level] $Message"
    Write-Host $line
    try {
        if ($script:Config -and $script:Config.Paths.Logs) {
            $logDir = $script:Config.Paths.Logs
            if (-not [IO.Path]::IsPathRooted($logDir)) { $logDir = Join-Path $PSScriptRoot $logDir }
            New-Item -ItemType Directory -Path $logDir -Force | Out-Null
            Add-Content -LiteralPath (Join-Path $logDir "SMTPGraphRelay.log") -Value $line -Encoding UTF8
        }
    } catch {}
 }
 function Resolve-PathFromConfig {
    param([Parameter(Mandatory)][string]$Path)
    if ([IO.Path]::IsPathRooted($Path)) { return $Path }
    return (Join-Path $PSScriptRoot $Path)
 }
 function Test-IPv4InCidr {
    param(
        [Parameter(Mandatory)][System.Net.IPAddress]$Address,
        [Parameter(Mandatory)][string]$Cidr
    )
    if ($Address.AddressFamily -ne [System.Net.Sockets.AddressFamily]::InterNetwork) {
        return $false
    }
    if ($Cidr -notmatch '^(.+)/(\d{1,2})$') { return $false }
    try {
        $network = [System.Net.IPAddress]::Parse($matches[1])
    } catch {
        return $false
    }
    if ($network.AddressFamily -ne [System.Net.Sockets.AddressFamily]::InterNetwork) {
        return $false
    }
    $prefix = [int]$matches[2]
    if ($prefix -lt 0 -or $prefix -gt 32) { return $false }
    $ipBytes = $Address.GetAddressBytes()
    $netBytes = $network.GetAddressBytes()
    for ($i = 0; $i -lt 4; $i++) {
        $remaining = $prefix - ($i * 8)
        if ($remaining -le 0) { break }
        $bits = [Math]::Min(8, $remaining)
        [byte]$mask = (0xFF -shl (8 - $bits)) -band 0xFF
        if (($ipBytes[$i] -band $mask) -ne ($netBytes[$i] -band $mask)) {
            return $false
        }
    }
    return $true
 }
 function Test-ClientAllowed {
    param([Parameter(Mandatory)][System.Net.IPAddress]$Address)
    foreach ($entry in @($script:Config.Smtp.AllowedNetworks)) {
        if ($entry -eq "*") { return $true }
        try {
            if ($entry -match '/') {
                if (Test-IPv4InCidr -Address $Address -Cidr $entry) { return $true }
            } elseif ([System.Net.IPAddress]::Parse($entry).Equals($Address)) {
                return $true
            }
        } catch {}
    }
    return $false
 }
 function Get-GraphConnection {
    if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
        throw "Microsoft.Graph.Authentication ist nicht installiert."
    }
    Import-Module Microsoft.Graph.Authentication -ErrorAction Stop
    $cert = Get-Item -LiteralPath ("Cert:\LocalMachine\My\{0}" -f $script:Config.Graph.CertificateThumbprint) -ErrorAction Stop
    $ctx = Get-MgContext
    $needsConnect = $true
    if ($ctx) {
        if ($ctx.ClientId -eq $script:Config.Graph.ClientId -and $ctx.TenantId -eq $script:Config.Graph.TenantId -and $ctx.AuthType -eq "AppOnly") {
            $needsConnect = $false
        }
    }
    if ($needsConnect) {
        Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
        Connect-MgGraph `
            -TenantId $script:Config.Graph.TenantId `
            -ClientId $script:Config.Graph.ClientId `
            -Certificate $cert `
            -NoWelcome | Out-Null
    }
 }
 function Set-MimeSender {
    param(
        [Parameter(Mandatory)][byte[]]$MimeBytes,
        [Parameter(Mandatory)][string]$Sender
    )
    # Headerbereich als Latin1 lesen, damit Bytes 1:1 erhalten bleiben.
    $latin1 = [System.Text.Encoding]::GetEncoding(28591)
    $text = $latin1.GetString($MimeBytes)
    $separator = "`r`n`r`n"
    $idx = $text.IndexOf($separator)
    if ($idx -lt 0) {
        $separator = "`n`n"
        $idx = $text.IndexOf($separator)
    }
    if ($idx -lt 0) { return $MimeBytes }
    $headers = $text.Substring(0, $idx)
    $body = $text.Substring($idx + $separator.Length)
    if ($headers -match '(?im)^From:.*(?:\r?\n[ \t].*)*') {
        $headers = [regex]::Replace(
            $headers,
            '(?im)^From:.*(?:\r?\n[ \t].*)*',
            "From: <$Sender>",
            1
        )
    } else {
        $headers = "From: <$Sender>`r`n" + $headers
    }
    return $latin1.GetBytes($headers + "`r`n`r`n" + $body)
 }
 function Send-QueuedMail {
    param([Parameter(Mandatory)][string]$FilePath)
    $metaPath = "$FilePath.json"
    $meta = $null
    if (Test-Path -LiteralPath $metaPath) {
        $meta = Get-Content -LiteralPath $metaPath -Raw -Encoding UTF8 | ConvertFrom-Json
    }
    $bytes = [IO.File]::ReadAllBytes($FilePath)
    if ($script:Config.Graph.ForceSender) {
        $bytes = Set-MimeSender -MimeBytes $bytes -Sender $script:Config.Graph.SenderMailbox
    }
    Get-GraphConnection
    $sender = [Uri]::EscapeDataString($script:Config.Graph.SenderMailbox)
    $uri = "https://graph.microsoft.com/v1.0/users/$sender/sendMail"
    $base64 = [Convert]::ToBase64String($bytes)
    try {
        Invoke-MgGraphRequest `
            -Method POST `
            -Uri $uri `
            -Body $base64 `
            -ContentType "text/plain" `
            -OutputType PSObject | Out-Null
        Write-Log "Mail gesendet: $(Split-Path $FilePath -Leaf)"
        Remove-Item -LiteralPath $FilePath -Force
        if (Test-Path -LiteralPath $metaPath) { Remove-Item -LiteralPath $metaPath -Force }
        return $true
    }
    catch {
        $retryCount = 0
        if ($meta -and $null -ne $meta.RetryCount) { $retryCount = [int]$meta.RetryCount }
        $retryCount++
        $maxRetries = [int]$script:Config.Queue.MaxRetries
        Write-Log "Graph-Versand fehlgeschlagen (Versuch $retryCount/$maxRetries): $($_.Exception.Message)" "WARN"
        if ($retryCount -ge $maxRetries) {
            $failedDir = Resolve-PathFromConfig $script:Config.Paths.Failed
            New-Item -ItemType Directory -Path $failedDir -Force | Out-Null
            Move-Item -LiteralPath $FilePath -Destination (Join-Path $failedDir (Split-Path $FilePath -Leaf)) -Force
            if (Test-Path -LiteralPath $metaPath) {
                Move-Item -LiteralPath $metaPath -Destination (Join-Path $failedDir (Split-Path $metaPath -Leaf)) -Force
            }
            Write-Log "Mail nach $retryCount Fehlversuchen nach FAILED verschoben." "ERROR"
        } else {
            $delays = @($script:Config.Queue.RetryMinutes)
            $delay = if ($retryCount -le $delays.Count) { [int]$delays[$retryCount - 1] } else { [int]$delays[-1] }
            $next = (Get-Date).AddMinutes($delay)
            $newMeta = [ordered]@{
                RetryCount = $retryCount
                NextAttemptUtc = $next.ToUniversalTime().ToString("o")
                LastError = $_.Exception.Message
            }
            $newMeta | ConvertTo-Json | Set-Content -LiteralPath $metaPath -Encoding UTF8
        }
        return $false
    }
 }
 function Process-Queue {
    $queueDir = Resolve-PathFromConfig $script:Config.Paths.Queue
    New-Item -ItemType Directory -Path $queueDir -Force | Out-Null
    foreach ($file in Get-ChildItem -LiteralPath $queueDir -Filter "*.eml" -File | Sort-Object CreationTimeUtc) {
        $metaPath = "$($file.FullName).json"
        if (Test-Path -LiteralPath $metaPath) {
            try {
                $meta = Get-Content -LiteralPath $metaPath -Raw -Encoding UTF8 | ConvertFrom-Json
                if ($meta.NextAttemptUtc) {
                    $next = [DateTime]::Parse($meta.NextAttemptUtc).ToUniversalTime()
                    if ($next -gt [DateTime]::UtcNow) { continue }
                }
            } catch {}
        }
        [void](Send-QueuedMail -FilePath $file.FullName)
    }
 }
 function Save-SmtpMessage {
    param(
        [Parameter(Mandatory)]
        [AllowEmptyCollection()]
        [AllowEmptyString()]
        [System.Collections.Generic.List[string]]$Lines,
        [Parameter(Mandatory)]
        [string]$MailFrom,
        [Parameter(Mandatory)]
        [string[]]$Recipients,
        [Parameter(Mandatory)]
        [string]$RemoteAddress
    )
    $queueDir = Resolve-PathFromConfig $script:Config.Paths.Queue
    New-Item -ItemType Directory -Path $queueDir -Force | Out-Null
    $id = "{0}-{1}" -f (Get-Date -Format "yyyyMMdd-HHmmssfff"), ([guid]::NewGuid().ToString("N").Substring(0,8))
    $path = Join-Path $queueDir "$id.eml"
    # SMTP DATA wird in CRLF normalisiert.
    $raw = ($Lines -join "`r`n") + "`r`n"
    $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
    [IO.File]::WriteAllText($path, $raw, $utf8NoBom)
    $meta = [ordered]@{
        ReceivedUtc = [DateTime]::UtcNow.ToString("o")
        RemoteAddress = $RemoteAddress
        EnvelopeFrom = $MailFrom
        EnvelopeRecipients = @($Recipients)
        RetryCount = 0
        NextAttemptUtc = [DateTime]::UtcNow.ToString("o")
    }
    $meta | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath "$path.json" -Encoding UTF8
    Write-Log "Mail angenommen: $id | Von=$MailFrom | An=$($Recipients -join ', ') | Client=$RemoteAddress"
    return $path
 }
 function Write-SmtpLine {
    param(
        [Parameter(Mandatory)][System.IO.StreamWriter]$Writer,
        [Parameter(Mandatory)][string]$Line
    )
    $Writer.WriteLine($Line)
    $Writer.Flush()
 }
 function Handle-SmtpClient {
    param([Parameter(Mandatory)][System.Net.Sockets.TcpClient]$Client)
    $remote = $Client.Client.RemoteEndPoint
    $remoteIp = ([System.Net.IPEndPoint]$remote).Address
    Write-Log "SMTP-Verbindung von $remoteIp"
    if (-not (Test-ClientAllowed -Address $remoteIp)) {
        try {
            $stream = $Client.GetStream()
            $writer = New-Object System.IO.StreamWriter($stream, [System.Text.Encoding]::ASCII)
            $writer.NewLine = "`r`n"
            $writer.AutoFlush = $true
            Write-SmtpLine $writer "554 5.7.1 Client not allowed"
        } catch {}
        $Client.Close()
        Write-Log "Client abgewiesen: $remoteIp" "WARN"
        return
    }
    $stream = $Client.GetStream()
    $stream.ReadTimeout = [int]$script:Config.Smtp.ClientTimeoutSeconds * 1000
    $reader = New-Object System.IO.StreamReader($stream, [System.Text.Encoding]::UTF8, $true, 4096, $true)
    $writer = New-Object System.IO.StreamWriter($stream, [System.Text.Encoding]::ASCII, 4096, $true)
    $writer.NewLine = "`r`n"
    $writer.AutoFlush = $true
    $mailFrom = $null
    $recipients = New-Object System.Collections.Generic.List[string]
    Write-SmtpLine $writer ("220 {0} SMTPGraphRelay ready" -f $script:Config.Smtp.Hostname)
    try {
        while ($Client.Connected) {
            $line = $reader.ReadLine()
            if ($null -eq $line) { break }
            if ($line -match '^(?i)(EHLO|HELO)\s+(.+)$') {
                Write-SmtpLine $writer ("250-{0}" -f $script:Config.Smtp.Hostname)
                Write-SmtpLine $writer ("250-SIZE {0}" -f ([int64]$script:Config.Smtp.MaxMessageSizeMB * 1024 * 1024))
                Write-SmtpLine $writer "250 8BITMIME"
            }
            elseif ($line -match '^(?i)MAIL FROM:\s*<([^>]*)>') {
                $mailFrom = $matches[1]
                $recipients.Clear()
                Write-SmtpLine $writer "250 2.1.0 OK"
            }
            elseif ($line -match '^(?i)RCPT TO:\s*<([^>]+)>') {
                if (-not $mailFrom) {
                    Write-SmtpLine $writer "503 5.5.1 Need MAIL FROM first"
                    continue
                }
                $recipients.Add($matches[1])
                Write-SmtpLine $writer "250 2.1.5 OK"
            }
            elseif ($line -match '^(?i)DATA\s*$') {
                if (-not $mailFrom -or $recipients.Count -eq 0) {
                    Write-SmtpLine $writer "503 5.5.1 Need MAIL FROM and RCPT TO first"
                    continue
                }
                Write-SmtpLine $writer "354 End data with <CR><LF>.<CR><LF>"
                $data = New-Object System.Collections.Generic.List[string]
                $size = 0
                $maxBytes = [int64]$script:Config.Smtp.MaxMessageSizeMB * 1024 * 1024
                $tooLarge = $false
                while ($true) {
                    $dataLine = $reader.ReadLine()
                    if ($null -eq $dataLine) { throw "Client disconnected during DATA" }
                    if ($dataLine -eq ".") { break }
                    # SMTP dot-stuffing rückgängig machen
                    if ($dataLine.StartsWith("..")) { $dataLine = $dataLine.Substring(1) }
                    $size += [System.Text.Encoding]::UTF8.GetByteCount($dataLine) + 2
                    if ($size -gt $maxBytes) {
                        $tooLarge = $true
                    } elseif (-not $tooLarge) {
                        $data.Add($dataLine)
                    }
                }
                if ($tooLarge) {
                    Write-SmtpLine $writer "552 5.3.4 Message size exceeds fixed maximum message size"
                    Write-Log "Mail von $remoteIp wegen Größenlimit verworfen." "WARN"
                } else {
                    [void](Save-SmtpMessage -Lines $data -MailFrom $mailFrom -Recipients $recipients.ToArray() -RemoteAddress $remoteIp.ToString())
                    Write-SmtpLine $writer "250 2.0.0 Queued"
                }
                $mailFrom = $null
                $recipients.Clear()
            }
            elseif ($line -match '^(?i)RSET\s*$') {
                $mailFrom = $null
                $recipients.Clear()
                Write-SmtpLine $writer "250 2.0.0 Reset"
            }
            elseif ($line -match '^(?i)NOOP(?:\s+.*)?$') {
                Write-SmtpLine $writer "250 2.0.0 OK"
            }
            elseif ($line -match '^(?i)QUIT\s*$') {
                Write-SmtpLine $writer "221 2.0.0 Bye"
                break
            }
            elseif ($line -match '^(?i)(AUTH|STARTTLS)\b') {
                Write-SmtpLine $writer "502 5.5.1 Command not implemented"
            }
            else {
                Write-SmtpLine $writer "500 5.5.2 Command unrecognized"
            }
        }
    }
    catch {
        Write-Log "SMTP-Clientfehler ${remoteIp}: $($_.Exception.Message)" "WARN"
    }
    finally {
        try { $reader.Dispose() } catch {}
        try { $writer.Dispose() } catch {}
        try { $stream.Dispose() } catch {}
        try { $Client.Close() } catch {}
    }
 }
 if (-not (Test-Path -LiteralPath $ConfigPath)) {
    throw "Konfiguration nicht gefunden: $ConfigPath. Bitte zuerst Setup-SMTPGraphRelay.ps1 ausführen."
 }
 $script:Config = Get-Content -LiteralPath $ConfigPath -Raw -Encoding UTF8 | ConvertFrom-Json
 foreach ($p in @($script:Config.Paths.Queue, $script:Config.Paths.Failed, $script:Config.Paths.Logs)) {
    New-Item -ItemType Directory -Path (Resolve-PathFromConfig $p) -Force | Out-Null
 }
 $listenIp = [System.Net.IPAddress]::Parse($script:Config.Smtp.ListenAddress)
 $listener = [System.Net.Sockets.TcpListener]::new($listenIp, [int]$script:Config.Smtp.Port)
 $listener.Start()
 Write-Log "SMTPGraphRelay gestartet auf $($script:Config.Smtp.ListenAddress):$($script:Config.Smtp.Port)"
 Write-Log "Graph-Absender: $($script:Config.Graph.SenderMailbox)"
 $lastQueueRun = [DateTime]::MinValue
 try {
    while ($true) {
        if ((Get-Date) -gt $lastQueueRun.AddSeconds([int]$script:Config.Queue.PollSeconds)) {
            try { Process-Queue } catch { Write-Log "Queue-Worker: $($_.Exception.Message)" "ERROR" }
            $lastQueueRun = Get-Date
        }
        if ($listener.Pending()) {
            $client = $listener.AcceptTcpClient()
            # V1 verarbeitet Clients seriell. Für typische Geräte-/Monitoring-Relays bewusst simpel.
            Handle-SmtpClient -Client $client
        } else {
            Start-Sleep -Milliseconds 200
        }
    }
 }
 finally {
    $listener.Stop()
    Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
    Write-Log "SMTPGraphRelay beendet."
 }
@@ -0,0 +1,334 @@
 #Requires -Version 5.1
 #Requires -RunAsAdministrator
 <#
 .SYNOPSIS
  First-Run Setup für SMTPGraphRelay.
 .DESCRIPTION
  - Installiert notwendige Microsoft Graph PowerShell Module
  - Meldet interaktiv einen Entra-Administrator an
  - Erstellt ein selbstsigniertes Zertifikat in LocalMachine\My
  - Erstellt eine Entra ID App Registration
  - Fügt das Zertifikat als Credential hinzu
  - Vergibt Microsoft Graph Application Permission Mail.Send
  - Erteilt Admin Consent über AppRoleAssignment
  - Schreibt config.json
  - Legt Firewallregel und Scheduled Task an
 #>
 [CmdletBinding()]
 param()
 $ErrorActionPreference = "Stop"
 [Console]::OutputEncoding = [System.Text.Encoding]::UTF8
 # ------------------------------------------------------------------------------
 # WICHTIG: Dieses Setup muss mit Windows PowerShell 5.1 gestartet werden.
 # Der eigentliche SMTPGraphRelay Scheduled Task verwendet ebenfalls powershell.exe
 # (Windows PowerShell 5.1). Wird das Setup stattdessen mit PowerShell 7 / pwsh.exe
 # ausgeführt, können Microsoft.Graph-Module im falschen Modulpfad landen und sind
 # später für den SYSTEM-Task unter Windows PowerShell 5.1 nicht sichtbar.
 # ------------------------------------------------------------------------------
 if ($PSVersionTable.PSEdition -ne "Desktop" -or $PSVersionTable.PSVersion.Major -ne 5) {
    Write-Host ""
    Write-Host "==========================================================" -ForegroundColor Red
    Write-Host " FALSCHE POWERSHELL-VERSION" -ForegroundColor Red
    Write-Host "==========================================================" -ForegroundColor Red
    Write-Host ""
    Write-Host "Dieses Setup muss mit Windows PowerShell 5.1 ausgefuehrt werden." -ForegroundColor Yellow
    Write-Host ""
    Write-Host "Aktuell erkannt:" -ForegroundColor Cyan
    Write-Host "  Edition: $($PSVersionTable.PSEdition)"
    Write-Host "  Version: $($PSVersionTable.PSVersion)"
    Write-Host ""
    Write-Host "Bitte eine klassische Windows PowerShell oeffnen:" -ForegroundColor Cyan
    Write-Host "  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    Write-Host ""
    Write-Host "Danach das Setup dort erneut starten." -ForegroundColor Yellow
    Write-Host ""
    Read-Host "Enter druecken zum Beenden"
    exit 1
 }
 Write-Host "Windows PowerShell erkannt: $($PSVersionTable.PSVersion)" -ForegroundColor Green
 Write-Host ""
 function Read-Default {
    param([string]$Prompt, [string]$Default)
    $value = Read-Host "$Prompt [Standard: $Default]"
    if ([string]::IsNullOrWhiteSpace($value)) { return $Default }
    return $value
 }
 function Convert-CertToKeyCredential {
    param([Parameter(Mandatory)][System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate)
    return @{
        Type = "AsymmetricX509Cert"
        Usage = "Verify"
        Key = $Certificate.GetRawCertData()
        DisplayName = "SMTPGraphRelay Certificate"
        StartDateTime = $Certificate.NotBefore.ToUniversalTime()
        EndDateTime = $Certificate.NotAfter.ToUniversalTime()
    }
 }
 Write-Host "==========================================================" -ForegroundColor Cyan
 Write-Host " SMTPGraphRelay - First Run / Entra ID Setup" -ForegroundColor Cyan
 Write-Host "==========================================================" -ForegroundColor Cyan
 Write-Host ""
 Write-Host "Schritt 0: Voraussetzungen prüfen..." -ForegroundColor Cyan
 $modules = @(
    "Microsoft.Graph.Authentication",
    "Microsoft.Graph.Applications"
 )
 foreach ($module in $modules) {
    if (-not (Get-Module -ListAvailable -Name $module)) {
        Write-Host "-> $module fehlt. Wird für alle Benutzer installiert..." -ForegroundColor Yellow
        Install-Module $module -Scope AllUsers -Repository PSGallery -Force -AllowClobber
    }
 }
 Import-Module Microsoft.Graph.Authentication -ErrorAction Stop
 Import-Module Microsoft.Graph.Applications -ErrorAction Stop
 Write-Host "-> Voraussetzungen erfüllt." -ForegroundColor Green
 Write-Host ""
 Write-Host "Schritt 1: Relay-Konfiguration erfassen" -ForegroundColor Cyan
 $AppName = Read-Default "-> Name der Entra App" "SMTPGraphRelay"
 $SenderMailbox = Read-Host "-> M365-Absenderpostfach (z.B. smtp-relay@firma.de)"
 while ([string]::IsNullOrWhiteSpace($SenderMailbox) -or $SenderMailbox -notmatch '^[^@\s]+@[^@\s]+\.[^@\s]+$') {
    $SenderMailbox = Read-Host "-> Bitte eine gültige Mailadresse eingeben"
 }
 $ListenAddress = Read-Default "-> Lokale Listen-IP" "0.0.0.0"
 $Port = [int](Read-Default "-> SMTP-Port" "2525")
 $AllowedNetworksText = Read-Default "-> Erlaubte Netze, mit Komma getrennt" "127.0.0.1/32,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
 $AllowedNetworks = @($AllowedNetworksText -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
 Write-Host ""
 Write-Host "Schritt 2: Erzeuge Zertifikat für unbeaufsichtigte Graph-Anmeldung..." -ForegroundColor Cyan
 $certSubject = "CN=SMTPGraphRelay-$env:COMPUTERNAME"
 $cert = New-SelfSignedCertificate `
    -Subject $certSubject `
    -CertStoreLocation "Cert:\LocalMachine\My" `
    -KeyAlgorithm RSA `
    -KeyLength 2048 `
    -HashAlgorithm SHA256 `
    -KeyExportPolicy NonExportable `
    -KeySpec Signature `
    -NotAfter (Get-Date).AddYears(2)
 Write-Host "-> Zertifikat erstellt: $($cert.Thumbprint)" -ForegroundColor Green
 Write-Host ""
 Write-Host "Schritt 3: Mit Microsoft Graph anmelden..." -ForegroundColor Cyan
 Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
 # Application.ReadWrite.All: App + Service Principal erstellen
 # AppRoleAssignment.ReadWrite.All: Mail.Send als AppRoleAssignment (Admin Consent) erteilen
 Connect-MgGraph -Scopes "Application.ReadWrite.All","AppRoleAssignment.ReadWrite.All" -NoWelcome
 $TenantId = (Get-MgContext).TenantId
 Write-Host "-> Verbunden mit Tenant: $TenantId" -ForegroundColor Green
 Write-Host ""
 Write-Host "Schritt 4: Microsoft Graph Mail.Send Application Permission ermitteln..." -ForegroundColor Cyan
 $GraphSp = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
 if (-not $GraphSp) { throw "Microsoft Graph Service Principal wurde im Tenant nicht gefunden." }
 $MailSend = $GraphSp.AppRoles | Where-Object {
    $_.Value -eq "Mail.Send" -and $_.AllowedMemberTypes -contains "Application"
 } | Select-Object -First 1
 if (-not $MailSend) { throw "Graph Application Permission Mail.Send wurde nicht gefunden." }
 Write-Host "-> Mail.Send AppRole-ID: $($MailSend.Id)" -ForegroundColor Green
 Write-Host ""
 Write-Host "Schritt 5: Entra ID App Registration erstellen..." -ForegroundColor Cyan
 $AppParams = @{
    DisplayName = $AppName
    SignInAudience = "AzureADMyOrg"
    RequiredResourceAccess = @(
        @{
            ResourceAppId = "00000003-0000-0000-c000-000000000000"
            ResourceAccess = @(
                @{
                    Id = $MailSend.Id
                    Type = "Role"
                }
            )
        }
    )
    KeyCredentials = @(
        (Convert-CertToKeyCredential -Certificate $cert)
    )
 }
 $App = New-MgApplication -BodyParameter $AppParams
 Write-Host "-> App erstellt: $($App.AppId)" -ForegroundColor Green
 $Sp = $null
 for ($i = 0; $i -lt 10 -and -not $Sp; $i++) {
    try {
        $Sp = New-MgServicePrincipal -AppId $App.AppId
    } catch {
        Start-Sleep -Seconds 2
    }
 }
 if (-not $Sp) { throw "Service Principal konnte nicht erstellt werden." }
 Write-Host "-> Service Principal erstellt: $($Sp.Id)" -ForegroundColor Green
 Write-Host ""
 Write-Host "Schritt 6: Admin Consent für Mail.Send erteilen..." -ForegroundColor Cyan
 New-MgServicePrincipalAppRoleAssignment `
    -ServicePrincipalId $Sp.Id `
    -PrincipalId $Sp.Id `
    -ResourceId $GraphSp.Id `
    -AppRoleId $MailSend.Id | Out-Null
 Write-Host "-> Mail.Send wurde als Application Permission erteilt." -ForegroundColor Green
 Write-Host ""
 Write-Host "Schritt 7: config.json schreiben..." -ForegroundColor Cyan
 $config = [ordered]@{
    Smtp = [ordered]@{
        ListenAddress = $ListenAddress
        Port = $Port
        Hostname = $env:COMPUTERNAME
        AllowedNetworks = $AllowedNetworks
        MaxMessageSizeMB = 25
        ClientTimeoutSeconds = 120
    }
    Graph = [ordered]@{
        TenantId = $TenantId
        ClientId = $App.AppId
        CertificateThumbprint = $cert.Thumbprint
        SenderMailbox = $SenderMailbox
        ForceSender = $true
    }
    Queue = [ordered]@{
        PollSeconds = 10
        MaxRetries = 8
        RetryMinutes = @(1,5,15,30,60,120,240,480)
    }
    Paths = [ordered]@{
        Queue = "queue"
        Failed = "failed"
        Logs = "logs"
    }
 }
 $configPath = Join-Path $PSScriptRoot "config.json"
 $config | ConvertTo-Json -Depth 8 | Set-Content -LiteralPath $configPath -Encoding UTF8
 foreach ($dir in @("queue","failed","logs")) {
    New-Item -ItemType Directory -Path (Join-Path $PSScriptRoot $dir) -Force | Out-Null
 }
 Write-Host "-> Konfiguration: $configPath" -ForegroundColor Green
 Write-Host ""
 Write-Host "Schritt 8: Windows Firewall konfigurieren..." -ForegroundColor Cyan
 $ruleName = "SMTPGraphRelay TCP $Port"
 Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue | Remove-NetFirewallRule -ErrorAction SilentlyContinue
 New-NetFirewallRule `
    -DisplayName $ruleName `
    -Direction Inbound `
    -Action Allow `
    -Protocol TCP `
    -LocalPort $Port `
    -Profile Any | Out-Null
 Write-Host "-> Firewallregel erstellt." -ForegroundColor Green
 Write-Host ""
 Write-Host "Schritt 9: Autostart als Scheduled Task anlegen..." -ForegroundColor Cyan
 $taskName = "SMTPGraphRelay"
 $scriptPath = Join-Path $PSScriptRoot "SMTPGraphRelay.ps1"
 $psExe = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe"
 $action = New-ScheduledTaskAction `
    -Execute $psExe `
    -Argument "-NoLogo -NoProfile -ExecutionPolicy Bypass -File `"$scriptPath`""
 $trigger = New-ScheduledTaskTrigger -AtStartup
 $principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
 $settings = New-ScheduledTaskSettingsSet `
    -AllowStartIfOnBatteries `
    -DontStopIfGoingOnBatteries `
    -StartWhenAvailable `
    -RestartCount 5 `
    -RestartInterval (New-TimeSpan -Minutes 1) `
    -ExecutionTimeLimit ([TimeSpan]::Zero)
 Register-ScheduledTask `
    -TaskName $taskName `
    -Action $action `
    -Trigger $trigger `
    -Principal $principal `
    -Settings $settings `
    -Description "Lokaler SMTP Store-and-Forward Relay zu Microsoft 365 via Microsoft Graph" `
    -Force | Out-Null
 Write-Host "-> Scheduled Task '$taskName' erstellt." -ForegroundColor Green
 Write-Host ""
 Write-Host "Schritt 10: Teste App-only Graph-Anmeldung..." -ForegroundColor Cyan
 Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
 Connect-MgGraph `
    -TenantId $TenantId `
    -ClientId $App.AppId `
    -Certificate $cert `
    -NoWelcome | Out-Null
 $ctx = Get-MgContext
 if ($ctx.AuthType -ne "AppOnly") {
    throw "App-only Graph-Anmeldung konnte nicht bestätigt werden."
 }
 Write-Host "-> App-only Graph-Anmeldung funktioniert." -ForegroundColor Green
 Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
 Write-Host ""
 Write-Host "==========================================================" -ForegroundColor Green
 Write-Host " SMTPGraphRelay wurde eingerichtet." -ForegroundColor Green
 Write-Host "==========================================================" -ForegroundColor Green
 Write-Host ""
 Write-Host " Tenant ID:        $TenantId" -ForegroundColor Yellow
 Write-Host " Client ID:        $($App.AppId)" -ForegroundColor Yellow
 Write-Host " Zertifikat:       $($cert.Thumbprint)" -ForegroundColor Yellow
 Write-Host " Graph-Absender:   $SenderMailbox" -ForegroundColor Yellow
 Write-Host " SMTP Listener:    $ListenAddress`:$Port" -ForegroundColor Yellow
 Write-Host ""
 Write-Host "WICHTIG:" -ForegroundColor Yellow
 Write-Host "Mail.Send als Application Permission ist tenantweit mächtig."
 Write-Host "Diese V1 erzwingt lokal SenderMailbox='$SenderMailbox', begrenzt die"
 Write-Host "Graph-Berechtigung selbst aber noch nicht per Exchange Application RBAC."
 Write-Host ""
 Write-Host "Task starten mit:" -ForegroundColor Cyan
 Write-Host "  Start-ScheduledTask -TaskName `"$taskName`""
 Write-Host ""
 Write-Host "Logs:" -ForegroundColor Cyan
 Write-Host "  $(Join-Path $PSScriptRoot 'logs\SMTPGraphRelay.log')"
 Write-Host ""
 $startNow = Read-Host "Relay jetzt starten? [J/n]"
 if ([string]::IsNullOrWhiteSpace($startNow) -or $startNow -match '^(?i)j|ja|y|yes$') {
    Start-ScheduledTask -TaskName $taskName
    Start-Sleep -Seconds 2
    Write-Host "-> Task gestartet." -ForegroundColor Green
 }
 Read-Host "Enter drücken zum Beenden"
@@ -0,0 +1,41 @@
 {
  "Smtp": {
    "ListenAddress": "0.0.0.0",
    "Port": 2525,
    "Hostname": "SMTPRELAY01",
    "AllowedNetworks": [
      "127.0.0.1/32",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16"
    ],
    "MaxMessageSizeMB": 25,
    "ClientTimeoutSeconds": 120
  },
  "Graph": {
    "TenantId": "<wird vom Setup gesetzt>",
    "ClientId": "<wird vom Setup gesetzt>",
    "CertificateThumbprint": "<wird vom Setup gesetzt>",
    "SenderMailbox": "smtp-relay@example.com",
    "ForceSender": true
  },
  "Queue": {
    "PollSeconds": 10,
    "MaxRetries": 8,
    "RetryMinutes": [
      1,
      5,
      15,
      30,
      60,
      120,
      240,
      480
    ]
  },
  "Paths": {
    "Queue": "queue",
    "Failed": "failed",
    "Logs": "logs"
  }
 }