From b5012c41b377b3bafee42e5393714cb67a49f8c7 Mon Sep 17 00:00:00 2001 From: Jan Wagner Date: Tue, 5 Nov 2013 17:32:27 +0100 Subject: [PATCH] Imported Upstream version 1.10pre8b --- bin/postfwd-script.sh | 49 +- doc/CHANGELOG | 38 +- doc/postfwd.html | 142 ++-- doc/postfwd.txt | 113 +-- etc/postfwd.cf | 89 ++- man/man8/postfwd.8 | 144 ++-- sbin/postfwd | 1384 ++++++++++++++++++++++--------------- tools/README.txt | 3 - tools/postfwd-rblcheck.pl | 174 ----- 9 files changed, 1172 insertions(+), 964 deletions(-) delete mode 100755 tools/postfwd-rblcheck.pl diff --git a/bin/postfwd-script.sh b/bin/postfwd-script.sh index 199a50d..f6308da 100755 --- a/bin/postfwd-script.sh +++ b/bin/postfwd-script.sh @@ -10,6 +10,8 @@ PATH=/bin:/usr/bin:/usr/local/bin PFWCMD=/usr/local/postfwd/sbin/postfwd # rulesetconfig file PFWCFG=/etc/postfix/postfwd.cf +# pidfile +PFWPID=/var/tmp/postfwd.pid # daemon settings PFWUSER=nobody @@ -23,45 +25,32 @@ PFWARG="--shortlog --summary=600 --cache=600 --cache-rbl-timeout=3600 --cleanup- ## should be no need to change below -P1="`basename ${PFWCMD}`"; P2="`basename $0`"; -PIDS="`ps -aef | grep "${P1}" | grep -v "${P2}" | grep -v grep | awk '{print $2}' | sort -nr`" - +P1="`basename ${PFWCMD}`" case "$1" in - start*) if [ -n "${PIDS}" ]; then - echo "Process called \"${P1}\" already found at PID ${PIDS}. Please use \"${P2} restart\" instead." ; - false; - else - echo "Starting ${P1}..."; - ${PFWCMD} ${PFWARG} --daemon --file=${PFWCFG} --interface=${PFWINET} --port=${PFWPORT} --user=${PFWUSER} --group=${PFWGROUP}; - fi ; + start*) echo "Starting ${P1}..."; + ${PFWCMD} ${PFWARG} --daemon --file=${PFWCFG} --interface=${PFWINET} --port=${PFWPORT} --user=${PFWUSER} --group=${PFWGROUP} --pidfile=${PFWPID}; ;; - debug*) if [ -n "${PIDS}" ]; then - echo "Process called \"${P1}\" already found at PID ${PIDS}. Please use \"${P2} restart\" instead." ; - false; - else - echo "Starting ${P1} in DEBUG mode..."; - ${PFWCMD} ${PFWARG} -vv --daemon --file=${PFWCFG} --interface=${PFWINET} --port=${PFWPORT} --user=${PFWUSER} --group=${PFWGROUP}; - fi ; - ;; + debug*) echo "Starting ${P1} in debug mode..."; + ${PFWCMD} ${PFWARG} -vv --daemon --file=${PFWCFG} --interface=${PFWINET} --port=${PFWPORT} --user=${PFWUSER} --group=${PFWGROUP} --pidfile=${PFWPID}; + ;; - - stop*) if [ -z "${PIDS}" ]; then - echo "No process called \"${P1}\" found" ; - false; - else + stop*) if [ -f "${PFWPID}" ]; then echo "Stopping ${P1}..."; - for pid in ${PIDS}; do kill ${pid}; done ; + kill `cat ${PFWPID}`; + else + echo "Pidfile \"${PFWPID}\" not found" ; + false; fi ; ;; - reload*) if [ -z "${PIDS}" ]; then - echo "No process called \"${P1}\" found" ; - false; + reload*) if [ -f "${PFWPID}" ]; then + echo "Stopping ${P1}..."; + kill -HUP `cat ${PFWPID}`; else - echo "Refreshing ${P1}..."; - for pid in ${PIDS}; do kill -HUP ${pid}; done ; + echo "Pidfile \"${PFWPID}\" not found" ; + false; fi ; ;; @@ -71,7 +60,7 @@ case "$1" in ;; *) echo "Unknown argument \"$1\"" >&2; - echo "Usage: ${P2} {start|stop|reload|restart}" >&2; + echo "Usage: `basename $0` {start|stop|reload|restart}" >&2; exit 1;; esac exit $? diff --git a/doc/CHANGELOG b/doc/CHANGELOG index 38b8c8a..e301ca9 100644 --- a/doc/CHANGELOG +++ b/doc/CHANGELOG @@ -1,12 +1,43 @@ + ************************************************************************************************** -ATTENTION: requirements changed - as dns queries are now performed asynchronously, postfwd from - v1.10pre2 and above needs the perl module Net::DNS::Async! it is available via CPAN - and installed for my tests without any problems on different linux and solaris systems +ATTENTION: requirements changed - postfwd since v1.10pre8 now uses Net::DNS. + Net::DNS::Async and Net::CIDR::Lite are not required anymore. NOTE: please see the docs ('postfwd -m' or 'perldoc postfwd') for more information ************************************************************************************************** +1.10pre8b +========== +- bugfix: fixed two warnings about logging of undefined values in verbose mode + +1.10pre8a +========== +- bugfix: item plugins have been made available as cache-id items. this fixes a minor issue with + --cache-rdomain-only and version 1.10pre8 + +1.10pre8 +========= +- code: Net::DNS::Async is no longer used. The parameters --dns_queuesize and + --dns_retries are still valid but have no function. The option --dns_timeout + now defaults to 14s and applies to all rules containing dns items. +- code: Net::CIDR::Lite is not required any longer. +- feature: the new variable $$request_hits contains a list of all matching ruleids +- feature: the new variable $$dnsbltext allows access to txt records of rbls +- feature: new options --no-rulestats and --nodnslog +- feature: ttls of the dns responses override --cache-rbl-timeout when bigger, which means + that you can set the option to 0 if you want to use the ttl of the dns answer. +- feature: new item "rhsbl_helo" allows to check helo against rhsbls +- bugfix: disabled fallback to synchronous dns on timed out rbls, default is now + to disable non responding dnsbls after 11 timeouts for 1200 seconds. + use --dns_timeout_max and --dns_timeout_interval to adjust these settings. +- bugfix: days=Wed now means exactly Wednesday. to use a range you may + still specify days=Wed- days=-Wed and days=Tue-Thu + this applies to all date and time items +- code: --shortlog is now default behaviour (use -v to see more) +- code: changed Net::Server behaviour to ignore syslog errors + + 1.10pre7c ========== - note: 1.10pre7c does not contain any code-changes to the postfwd daemon. @@ -177,3 +208,4 @@ NOTE: please see the docs ('postfwd -m' or 'perldoc postfwd') for more inf ===== - first public beta version + diff --git a/doc/postfwd.html b/doc/postfwd.html index ddb2e36..e9932b5 100644 --- a/doc/postfwd.html +++ b/doc/postfwd.html @@ -1,11 +1,15 @@ - - + + postfwd - postfix firewall daemon - + + + + + - +

@@ -22,6 +26,7 @@
  • ITEMS
  • ACTIONS
  • MACROS/ACLS
    • +
  • PLUGINS
  • COMMAND LINE
  • REFRESH
  • EXAMPLES
    • @@ -62,8 +67,9 @@ -u, --user <name> set uid to user <name> -g, --group <name> set gid to group <name> -R, --chroot <path> chroot the daemon to <path> + --pidfile <path> create pidfile under <path> -l, --logname <label> label for syslog messages - --pidfile <path> create pidfile under <path> + --loglen <int> truncates syslogs after <int> chars 
             Caching:
         -c, --cache <int>           sets the request-cache timeout to <int> seconds
@@ -80,23 +86,25 @@
         Optional:
         -t, --test                  testing, always returns "dunno"
         -v, --verbose               verbose logging, use twice (-vv) to increase level
-            --shortlog              disables logging of some postfwd commands
         -S, --summary <int>         show some usage statistics every <int> seconds
+            --no-rulestats          disables per rule statistics
         -n, --nodns                 disable dns
-            --dns_queuesize         sets the queue size for asynchonous dns queries
-            --dns_retries           how many retries for a single asynchonous dns query
+            --nodnslog              disable dns logging
             --dns_timeout           timeout in seconds for asynchonous dns queries
             --dns_timeout_max       maximum of dns timeouts until a dnsbl will be deactivated
             --dns_timeout_interval  interval in seconds for dns timeout maximum counter
         -I, --instantcfg            re-reads rulefiles for every new request
    -        Informational (use only at command-line, not with postfix!):
+        Informational (use only at command-line!):
         -C, --showconfig            shows ruleset summary, -v for verbose
         -L, --stdoutlog             redirect syslog messages to stdout
         -P, --perfmon               no syslogging, no stdout
         -V, --version               shows program version
         -h, --help                  shows usage
         -m, --manual                shows program manual
    +
    +        Plugins:
+            --plugins <file>        loads plugins from <file>

    @@ -161,7 +169,16 @@ arguments. Please see the COMMAND LINE section below for more information on thi id - a unique rule id, which can be used for log analysis ids also serve as targets for the "jump" command. 
    -        date, time              - a time or date range within the specified rule shall hit
    + date, time - a time or date range within the specified rule shall hit + # FORMAT: + # Feb, 29th + date=29.02.2008 + # Dec, 24th - 26th + date=24.12.2008-26.12.2008 + # from today until Nov, 23rd + date=-23.09.2008 + # from April, 1st until today + date=01.04.2008- 
             days, months            - a range of weekdays (Sun-Sat) or months (Jan-Dec)
                                   within the specified rule shall hit
    @@ -354,20 +371,25 @@ rule containing only an action statement:

             rblcount        - contains the number of RBL answers
         rhsblcount      - contains the number of RHSBL answers
-        matches         - contains the number of matched items
    -

    This means that you must save them, if you plan to use these values in later rules:

    + matches - contains the number of matched items + dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form + rbltype:rblname:<txt>; rbltype:rblname:<txt>; ... +

    These special attributes will be changed for any matching rule:

    +
    +        request_hits    - contains ids of all matching rules
    +

    This means that it might be necessary to save them, if you plan to use these values in later rules:

             # set vals
         id=RBL01 ; rhsblcount=all ; rblcount=all ; \
                 rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org ; \
                 rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \
                 rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \
-                action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount)
    + action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext) 
             # compare
-        id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs
-        id=RBL03 ; HIT_rhls>=2               ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs
-        id=RBL04 ; HIT_rbls>=2               ; action=554 5.7.1 blocked using $$HIT_rbls RBLs
    + id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt] + id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt] + id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]

    MACROS/ACLS

    @@ -409,6 +431,10 @@ First the macros have to be defined as follows:

    Basically macros are simple text substitutions - see the PARSER section for more information.

    +

    PLUGINS

    +

    Please visit http://www.postfwd.org/postfwd.plugins

    +

    +

    COMMAND LINE

    Ruleset

    The following arguments are used to specify the source of the postfwd ruleset. This means @@ -421,13 +447,18 @@ that at least one of the following is required for postfwd to work.

    -r, --rule <rule> Adds <rule> to ruleset. Remember that you might have to quote strings that contain whitespaces or shell characters. +

    Plugins

    +
    +        --plugins
+        A file containing plugin routines for postfwd. Please see the
+        PLUGINS section for more information.

    Scoring

             -s, --scores <val>=<action>
         Returns <action> to postfix, when the request's score exceeds <val>

    Multiple usage is allowed. Just chain your arguments, like:

    -        postfwd -r "<item>=<value>;action=<result>" -f <file> -f <file> ...
+        postfwd -r "<item>=<value>;action=<result>" -f <file> -f <file> --plugins <file> ...
           or
         postfwd --scores 4.5="WARN high score" --scores 5.0="REJECT postfwd score too high" ...

    In case of multiple scores, the highest match will count. The order of the arguments will be @@ -455,13 +486,16 @@ The following arguments will control it's behaviour in this case.

    -R, --chroot <path> Chroot the process to the specified path. Test this before using - you might need some libs there. +
    +        --pidfile <path>
+        The process id will be saved in the specified file.
             -l, --logname <label>
         Labels the syslog messages. Useful when running multiple
         instances of postfwd.
    -        --pidfile <path>
-        The process id will be saved in the specified file.
    + --loglen <int> + Truncates any syslog message after <int> characters.

    Optional arguments

    These parameters influence the way postfwd is working. Any of them can be combined.

    @@ -535,13 +569,13 @@ The following arguments will control it's behaviour in this case.
    
         Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Rule ID: R-002   matched: 9351 times
         Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Rule ID: R-003   matched: 3116 times
         ...
    +
    +        --no-rulestats
+        Disables per rule statistics. Keeps your log clean, if you do not use them.
+        This option has no effect without --summary or --verbose set.
             -L, --stdoutlog
         Redirects all syslog messages to stdout for debugging. Never use this with postfix!
    -
    -        --shortlog
-        As postfwd now logs all hits for a request, you might find it unecessary to log the
-        postfwd actions jump(), set() and score(). You may disable it with this option.
             -t, --test
         In test mode postfwd always returns "dunno", but logs according
@@ -551,15 +585,10 @@ The following arguments will control it's behaviour in this case.
    
         Disables all DNS based checks like RBL checks. Rules containing
         such elements will be ignored.
    -        --dns_queuesize   (default: 100)
-        Sets the queue size for asynchonous dns queries. If the query exceeds this value,
-        postfwd waits for answers of timeouts for previous queries.
    + -n, --nodnslog + Disables logging of dns events. 
    -        --dns_retries     (default: 3)
-        Sets the retry counter for asynchonous dns queries. This value will apply to
-        every single query.
    -
    -        --dns_timeout     (default: 7)
+        --dns_timeout     (default: 14)
         Sets the timeout for asynchonous dns queries in seconds. This value will apply to
         all dns items in a rule.
    @@ -723,11 +752,11 @@ the '-I' switch to have your configuration refreshed for every request postfwd r
                 ...
         };
         &&MAINTENANCE { \
-                date=15.01.2007  ; \
-                date=15.04.2007  ; \
-                date=15.07.2007  ; \
-                date=15.10.2007  ; \
-                time=03:00:00-04:00:00 ; \
+                date=15.01.2007 ; \
+                date=15.04.2007 ; \
+                date=15.07.2007 ; \
+                date=15.10.2007 ; \
+                time=03:00:00 - 04:00:00 ; \
         };
         # rules
         id=COMBINED    ;  &&RBLS ;  &&DYNAMIC ;  action=REJECT dynamic client and listed on RBL
@@ -742,14 +771,11 @@ the '-I' switch to have your configuration refreshed for every request postfwd r
         id=REJECT02 ;  HIT_rbls==1 ;  HIT_dyna==1  ; action=REJECT please see http://some.org/info?reject=02 for more info
         id=REJECT03 ;  HIT_helo==1 ;  HIT_dyna==1  ; action=REJECT please see http://some.org/info?reject=03 for more info
    -        # combined with enhanced rbl features
-        # set vals
+        ## combined with enhanced rbl features
+        #
         id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS ; \
-          action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount)
-        # compare
-        id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs
-        id=RBL03 ; HIT_rhls>=2               ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs
-        id=RBL04 ; HIT_rbls>=2               ; action=554 5.7.1 blocked using $$HIT_rbls RBLs
    + action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,HIT_dnstxt=$$dnsbltext) + id=RBL02 ; HIT_dnsbls>=2 ; action=554 5.7.1 blocked using $$HIT_dnsbls DNSBLs [INFO: $$HIT_dnstxt]

    PARSER

    @@ -794,7 +820,7 @@ verbority using use the ``-v'' or ``-vv'' switch. ``-L'' redirects log messages id=R001; sender=bob@alice.local; client_address=192.168.1.1; action=dunno

    Lists will be evaluated in the specified order. This allows to place faster expressions at first:

    -        postfwd -vv -L -r "id=RBL001; rbl=localrbl.local zen.spamhaus.org; action=REJECT" /root/request.sample
    + postfwd -vv -L -r "id=RBL001; rbl=localrbl.local zen.spamhaus.org; action=REJECT" /some/where/request.sample

    produces the following

             [LOGS info]: compare rbl: "remotehost.remote.net[68.10.1.7]"  ->  "localrbl.local"
@@ -810,7 +836,7 @@ verbority using use the ``-v'' or ``-vv'' switch. ``-L'' redirects log messages
         [LOGS info]: Action: dunno

    The negation operator !!(<value>) has the highest priority and therefore will be evaluated first. Then variable substitutions are performed:

    -        postfwd -vv -L -r "id=TEST; action=REJECT; client_name=!!($$heloname)" /root/request.sample
    + postfwd -vv -L -r "id=TEST; action=REJECT; client_name=!!($$heloname)" /some/where/request.sample

    will give

             [LOGS info]: compare client_name:     "unknown"  ->  "!!($$helo_name)"
@@ -924,13 +950,14 @@ listening on the specified network settings.
    
 
    
 
    PERFORMANCE
    
 
    Some of these proposals might not match your environment. Please check your requirements and test new options carefully!
    
-
    - use caching options
-- use the correct match operator ==, <=, >=
-- use ^ and $ in regular expressions
-- use item lists (faster than single rules)
-- use set() action on repeated item lists
-- use jump action
-- use pre-lookup rule for rbl/rhsbls with empty note() action
    
+
    +        - use caching options
+        - use the correct match operator ==, <=, >=
+        - use ^ and/or $ in regular expressions
+        - use item lists (faster than single rules)
+        - use set() action on repeated item lists
+        - use jumps and rate limits
+        - use a pre-lookup rule for rbl/rhsbls with empty note() action
    
 
    
 
    
 
    SEE ALSO
    
@@ -969,8 +996,17 @@ POSSIBILITY OF SUCH DAMAGE.
    
 
    
 
    
 
    AUTHOR
    
-
    Jan Peter Kessler <info (AT) postfwd (DOT) org>. Let me know, if you have any suggestions.
    
+
    Jan Peter Kessler <info (AT) postfwd (DOT) org>. Let me know, if you have any suggestions.
    
+
+
    
+
+  
    http://www.postfwd.org/doc.html
+  2007 by Jan Peter Kessler
+  info (AT) postfwd (DOT) org
+
    
+
    
 
 
 
 
+
diff --git a/doc/postfwd.txt b/doc/postfwd.txt
index 178720d..4966add 100644
--- a/doc/postfwd.txt
+++ b/doc/postfwd.txt
@@ -18,8 +18,9 @@ SYNOPSIS
             -u, --user            set uid to user 
             -g, --group           set gid to group 
             -R, --chroot          chroot the daemon to 
-            -l, --logname