4288 lines
159 KiB
Perl
Executable file
4288 lines
159 KiB
Perl
Executable file
#!/usr/bin/perl -T -w
|
||
#
|
||
# postfwd - postfix firewall daemon
|
||
#
|
||
# Please see `postfwd -h` for usage or
|
||
# `postfwd -m` for detailed instructions.
|
||
#
|
||
|
||
package postfwd;
|
||
use warnings;
|
||
use strict;
|
||
|
||
# Includes
|
||
use Pod::Usage;
|
||
use Sys::Syslog qw(:DEFAULT setlogsock);
|
||
use Getopt::Long 2.25 qw(:config no_ignore_case bundling);
|
||
use POSIX qw(setsid setuid setgid setlocale strftime LC_ALL);
|
||
# Networking
|
||
use IO::Socket qw(SOCK_STREAM);
|
||
use Net::DNS;
|
||
use Net::Server::Multiplex;
|
||
use vars qw(@ISA);
|
||
@ISA = qw(Net::Server::Multiplex);
|
||
our($TIMEHIRES); our($STORABLE);
|
||
BEGIN {
|
||
eval { require Time::HiRes };
|
||
if ($@) {
|
||
$TIMEHIRES = '%d';
|
||
} else {
|
||
Time::HiRes->import( qw(time) );
|
||
$TIMEHIRES = '%.2f';
|
||
};
|
||
eval { require Storable };
|
||
if ($@) {
|
||
$STORABLE = undef;
|
||
} else {
|
||
$STORABLE = Storable->VERSION;
|
||
Storable->import( qw(store retrieve) );
|
||
};
|
||
};
|
||
|
||
# Program constants
|
||
our($NAME) = 'postfwd';
|
||
our($VERSION) = '1.35';
|
||
|
||
# Networking options (use -i, -p and -R to change)
|
||
our($def_net_pid) = "/var/run/".$NAME.".pid";
|
||
our($def_net_chroot) = "";
|
||
our($def_net_interface) = "127.0.0.1";
|
||
our($def_net_port) = "10040";
|
||
our($def_net_proto) = "tcp";
|
||
our($def_net_umask) = "0111";
|
||
our($def_net_user) = "nobody";
|
||
our($def_net_group) = "nobody";
|
||
our($def_dns_queuesize) = "300";
|
||
our($def_dns_retries) = "3";
|
||
our($def_dns_timeout) = "14";
|
||
our($def_dns_max_ns_a_lookups) = "100";
|
||
our($def_dns_max_mx_a_lookups) = "100";
|
||
our($def_config_timeout) = "3";
|
||
our($reply_maxlen) = "512";
|
||
our($max_command_recursion) = "64";
|
||
|
||
# change this, to match your POD requirements
|
||
# we need pod2text for the -m switch (manual)
|
||
$ENV{PATH} = "/bin:/usr/bin:/usr/local/bin";
|
||
$ENV{ENV} = "";
|
||
our($cmd_manual) = "pod2text";
|
||
our($cmd_pager) = "more";
|
||
|
||
# default action, do not change
|
||
# unless you really know why
|
||
our($default_action) = "DUNNO";
|
||
|
||
# default maximum values for the score() command
|
||
# if exceeded, the specified action will be returned
|
||
# may be overwritten by the --scores switch at the command-line
|
||
# or the score= item in your ruleset files. please see manual.
|
||
our(%MAX_SCORES) = ( "5.0" => "554 5.7.1 ".$NAME." score exceeded" );
|
||
|
||
# Status interval, displays stats when using `-S` switch
|
||
# override with `-S <nn>` at command-line
|
||
our($Stat_Interval_Time) = 600;
|
||
|
||
# Timeout for request cache, results for identical requests will be
|
||
# cached until config is reloaded or this time (in seconds) expired
|
||
# can be changed with `-c` command-line option
|
||
our($REQUEST_MAX_CACHE) = 600;
|
||
|
||
# minimum ttl for other dns cache objects
|
||
our($DNS_MIN_CACHE) = 3600;
|
||
|
||
# dns key value matching
|
||
our(%DNS_REPNAMES) = (
|
||
"NS" => "nsdname",
|
||
"MX" => "exchange",
|
||
"A" => "address",
|
||
"TXT" => "char_str_list",
|
||
"CNAME" => "cname",
|
||
);
|
||
|
||
# RBL / RHSBL parameters, use "rbl = <name>/<reply>/<maxcache>"
|
||
# to override for each RBL in your config
|
||
# maximum cache time in seconds, use 0 to deactivate
|
||
our($RBL_MAX_CACHE) = 3600;
|
||
# default rbl reply if not specified
|
||
our($RBL_DEFAULT) = '^127\.';
|
||
# skip this dnsbl after <n> timeouts
|
||
our($MAX_DNSBL_TIMEOUTS) = 10;
|
||
our($MAX_DNSBL_INTERVAL) = 1200;
|
||
|
||
# Cache cleanup routines will be called periodically
|
||
our($CLEANUP_REQUEST_CACHE) = 600;
|
||
our($CLEANUP_RBL_CACHE) = 600;
|
||
our($CLEANUP_RATE_CACHE) = 600;
|
||
|
||
# these items have to be compared as...
|
||
# scoring
|
||
our($COMP_SCORES) = "score";
|
||
our($COMP_NS_NAME) = "sender_ns_names";
|
||
our($COMP_NS_ADDR) = "sender_ns_addrs";
|
||
our($COMP_MX_NAME) = "sender_mx_names";
|
||
our($COMP_MX_ADDR) = "sender_mx_addrs";
|
||
our($COMP_HELO_ADDR) = "helo_address";
|
||
# networks in CIDR notation (a.b.c.d/nn)
|
||
our($COMP_NETWORK_CIDRS) = "(client_address|sender_(ns|mx)_addrs|helo_address)";
|
||
# RBL checks
|
||
our($COMP_DNSBL_TEXT) = "dnsbltext";
|
||
our($COMP_RBL_CNT) = "rblcount";
|
||
our($COMP_RHSBL_CNT) = "rhsblcount";
|
||
our($COMP_RBL_KEY) = "rbl";
|
||
our($COMP_RHSBL_KEY) = "rhsbl";
|
||
our($COMP_RHSBL_KEY_CLIENT) = "rhsbl_client";
|
||
our($COMP_RHSBL_KEY_SENDER) = "rhsbl_sender";
|
||
our($COMP_RHSBL_KEY_RCLIENT) = "rhsbl_reverse_client";
|
||
our($COMP_RHSBL_KEY_HELO) = "rhsbl_helo";
|
||
# file items
|
||
our($COMP_CONF_FILE) = 'cfile|file';
|
||
our($COMP_CONF_TABLE) = 'ctable|table';
|
||
our($COMP_LIVE_FILE) = 'lfile';
|
||
our($COMP_LIVE_TABLE) = 'ltable';
|
||
our($COMP_TABLES) = qr/^($COMP_CONF_TABLE|$COMP_LIVE_TABLE)$/i;
|
||
our($COMP_CONF_FILE_TABLE) = qr/^($COMP_CONF_FILE|$COMP_CONF_TABLE):(.+)$/i;
|
||
our($COMP_LIVE_FILE_TABLE) = qr/^($COMP_LIVE_FILE|$COMP_LIVE_TABLE):(.+)$/i;
|
||
# date checks
|
||
our($COMP_DATE) = "date";
|
||
our($COMP_TIME) = "time";
|
||
our($COMP_DAYS) = "days";
|
||
our($COMP_MONTHS) = "months";
|
||
# always true
|
||
our($COMP_ACTION) = "action";
|
||
our($COMP_ID) = "id";
|
||
# rule hits
|
||
our($COMP_HITS) = "request_hits";
|
||
# item match counter
|
||
our($COMP_MATCHES) = "matches";
|
||
# separator
|
||
our($COMP_SEPARATOR) = "[=\~\<\>]=|[\<\>]|[=\!][=\~\<\>]|=";
|
||
# macros
|
||
our($COMP_ACL) = "[\&][\&]";
|
||
# negation
|
||
our($COMP_NEG) = "[\!][\!]";
|
||
# variables
|
||
our($COMP_VAR) = "[\$][\$]";
|
||
# date calculations
|
||
our($COMP_DATECALC) = "($COMP_DATE|$COMP_TIME|$COMP_DAYS|$COMP_MONTHS)";
|
||
# these items allow whitespace-or-comma-separated values
|
||
our($COMP_CSV) = "($COMP_NETWORK_CIDRS|$COMP_RBL_KEY|$COMP_RHSBL_KEY|$COMP_RHSBL_KEY_CLIENT|$COMP_RHSBL_KEY_HELO|$COMP_RHSBL_KEY_SENDER|$COMP_RHSBL_KEY_RCLIENT|$COMP_DATECALC|$COMP_HELO_ADDR|$COMP_NS_ADDR|$COMP_MX_ADDR)";
|
||
# dont treat these as lists
|
||
our($COMP_SINGLE) = "($COMP_ID|$COMP_ACTION|$COMP_SCORES|$COMP_RBL_CNT|$COMP_RHSBL_CNT)";
|
||
|
||
# Syslog options
|
||
our($syslog_name) = $NAME;
|
||
our($syslog_facility) = "mail";
|
||
our($syslog_priority) = "info";
|
||
our($syslog_options) = "pid";
|
||
our($syslog_socktype) = 'unix';
|
||
our($syslog_maxlen) = 0;
|
||
our($syslog_safe) = 0;
|
||
our($syslog_unsafe_charset) = qr/[^\x20-\x7E]/;
|
||
if ( defined $Sys::Syslog::VERSION and $Sys::Syslog::VERSION ge '0.15' ) {
|
||
# use 'native' when Sys::Syslog >= 0.15
|
||
$syslog_socktype = 'native';
|
||
$syslog_options .= ",nofatal";
|
||
} elsif($^O eq 'solaris') {
|
||
# 'stream' is broken and 'unix' doesn't work on Solaris: only 'inet'
|
||
# seems to be useable with Sys::Syslog < 0.15
|
||
$syslog_socktype = 'inet';
|
||
} else { $syslog_safe = 1 };
|
||
|
||
# save command-line
|
||
our(@CommandArgs) = @ARGV;
|
||
|
||
# initializations - do not change
|
||
our(%months) = (
|
||
"Jan" => 0, "jan" => 0, "JAN" => 0,
|
||
"Feb" => 1, "feb" => 1, "FEB" => 1,
|
||
"Mar" => 2, "mar" => 2, "MAR" => 2,
|
||
"Apr" => 3, "apr" => 3, "APR" => 3,
|
||
"May" => 4, "may" => 4, "MAY" => 4,
|
||
"Jun" => 5, "jun" => 5, "JUN" => 5,
|
||
"Jul" => 6, "jul" => 6, "JUL" => 6,
|
||
"Aug" => 7, "aug" => 7, "AUG" => 7,
|
||
"Sep" => 8, "sep" => 8, "SEP" => 8,
|
||
"Oct" => 9, "oct" => 9, "OCT" => 9,
|
||
"Nov" => 10, "nov" => 10, "NOV" => 10,
|
||
"Dec" => 11, "dec" => 11, "DEC" => 11,
|
||
);
|
||
our(%weekdays) = (
|
||
"Sun" => 0, "sun" => 0, "SUN" => 0,
|
||
"Mon" => 1, "mon" => 1, "MON" => 1,
|
||
"Tue" => 2, "tue" => 2, "TUE" => 2,
|
||
"Wed" => 3, "wed" => 3, "WED" => 3,
|
||
"Thu" => 4, "thu" => 4, "THU" => 4,
|
||
"Fri" => 5, "fri" => 5, "FRI" => 5,
|
||
"Sat" => 6, "sat" => 6, "SAT" => 6,
|
||
);
|
||
our($SepReq) = '///';
|
||
our($SepLst) = ':::';
|
||
our($KeyVal) = qr/^([^=]+)=(.*)$/;
|
||
use vars qw(
|
||
@Configs @Rules @CacheID @DNSBL_Text @Plugins @Rate_Items @DEBUGLIST
|
||
%Config_Cache %DNS_Cache %Request_Cache %Rule_by_ID %DEBUG
|
||
%Matches %opt_scores %ACLs %Rates %Timeouts
|
||
%postfwd_items %postfwd_items_plugin
|
||
%postfwd_compare %postfwd_compare_plugin
|
||
%postfwd_actions %postfwd_actions_plugin
|
||
$Counter_Requests $Counter_Hits $opt_max_ns_lookups $opt_max_mx_lookups
|
||
$Counter_Interval $Counter_Top $Counter_Rates
|
||
$Starttime $Cleanup_Requests $Cleanup_RBLs $Cleanup_Rates $Cleanup_Timeouts
|
||
$opt_daemon $opt_instantconfig $opt_nodns $opt_nodnslog
|
||
$opt_norulelog $opt_summary $net_interface $net_port $net_umask
|
||
$net_user $net_group $net_chroot $net_pid $net_proto $opt_saverates
|
||
$opt_perfmon $opt_test $opt_verbose $opt_noidlestats $opt_delcache $opt_delrate
|
||
$opt_cache_rdomain_only $opt_cache_no_size $config_timeout $opt_fast_limits
|
||
$opt_cache_no_sender $opt_no_rulestats $opt_kill $opt_hup $opt_dumpcache $opt_dumpstats
|
||
$opt_showconfig $opt_stdoutlog $opt_shortlog $dns_async_txt $opt_keep_rates_on_reload
|
||
$DNS $Reload_Conf $dns_queuesize $dns_retries $dns_timeout
|
||
);
|
||
our %Name_To_Var = (
|
||
\%Config_Cache => '%config_cache',
|
||
\%Request_Cache => '%request_cache',
|
||
\%DNS_Cache => '%dns_cache',
|
||
\%Rates => '%rate_cache',
|
||
\%ACLs => '%acl_cache',
|
||
\%Matches => '%match_cache',
|
||
\%Timeouts => '%timeout_cache',
|
||
);
|
||
|
||
|
||
### SUB tools
|
||
|
||
#
|
||
# send log message
|
||
#
|
||
sub mylog {
|
||
my($prio) = shift(@_);
|
||
my($msg) = shift(@_);
|
||
# truncate syslogs (--loglen option)
|
||
$msg = substr($msg, 0, $syslog_maxlen) if $syslog_maxlen;
|
||
if ( not($opt_perfmon) or ($prio eq "crit") ) {
|
||
unless ($opt_stdoutlog) {
|
||
# Sys::Syslog < 0.15 dies when syslog daemon is temporarily not
|
||
# present (for example on syslog rotation)
|
||
if($syslog_safe) {
|
||
eval {
|
||
local $SIG{__DIE__} = sub { };
|
||
syslog $prio, "$msg", @_;
|
||
};
|
||
} else { syslog $prio, "$msg", @_; };
|
||
} else { $msg =~ s/\%/%%/g; $msg =~ /^(.*)$/; printf "[LOG $prio]: $1\n", @_; };
|
||
};
|
||
};
|
||
#
|
||
# send log message, escaping % character
|
||
#
|
||
sub mylogs {
|
||
my($prio) = shift(@_);
|
||
my($msg) = shift(@_);
|
||
$msg =~ s/\%/%%/g; $msg =~ s/$syslog_unsafe_charset/?/g;
|
||
mylog $prio, $msg;
|
||
};
|
||
#
|
||
# print a string to STDOUT
|
||
#
|
||
sub myprint {
|
||
my($msg) = shift(@_);
|
||
print STDOUT $msg, @_
|
||
unless $opt_perfmon;
|
||
};
|
||
#
|
||
# print formatted string to STDOUT
|
||
#
|
||
sub myprintf {
|
||
my($msg) = shift(@_);
|
||
printf STDOUT $msg, @_
|
||
unless $opt_perfmon;
|
||
};
|
||
#
|
||
# short versions
|
||
#
|
||
sub log_info { mylogs ('info', @_) };
|
||
sub log_note { mylogs ('notice', @_) };
|
||
sub log_warn { mylogs ('warning', @_) };
|
||
sub log_err { mylogs ('err', @_) };
|
||
sub log_crit { mylogs ('crit', @_) };
|
||
#
|
||
# tests debug levels
|
||
#
|
||
sub wantsdebug {
|
||
return unless %DEBUG;
|
||
foreach (@_) { return 1 if $DEBUG{$_} };
|
||
};
|
||
#
|
||
# prints formatted timestamp
|
||
#
|
||
sub ts { return sprintf ("$TIMEHIRES", $_[0]) };
|
||
#
|
||
# Log an error and abort.
|
||
#
|
||
sub fatal_exit {
|
||
my($msg) = shift(@_);
|
||
warn "fatal: $msg", @_;
|
||
exit 1;
|
||
};
|
||
#
|
||
# finish program
|
||
#
|
||
sub end_program {
|
||
undef $opt_noidlestats;
|
||
show_stats() if $opt_summary;
|
||
$net_pid ||= $def_net_pid; unlink $net_pid if (-T $net_pid);
|
||
save_rates();
|
||
log_note $NAME." ".$VERSION." terminated" if $opt_daemon;
|
||
exit;
|
||
};
|
||
# get pid of running master process
|
||
sub get_master_pid {
|
||
$net_pid ||= $def_net_pid;
|
||
(-e $net_pid) or die $NAME.": Can not find pid_file ".$net_pid.": $!\n";
|
||
(-T $net_pid) or die $NAME.": Can not open pid_file ".$net_pid.": not a textfile\n";
|
||
open PIDFILE, "<".$net_pid or die $NAME.": Can open pid_file ".$net_pid.": $!\n";
|
||
my $pid = <PIDFILE>;
|
||
($pid =~ m/^(\d+)$/) or die $NAME.": Invalid pid_file content '$pid' (pid_file ".$net_pid.")\n";
|
||
return $1;
|
||
};
|
||
|
||
#
|
||
# run a shell command
|
||
#
|
||
sub exec_cmd {
|
||
my($mycmd) = @_;
|
||
my($myresult) = ( system($mycmd) );
|
||
if ( $myresult ) {
|
||
myprint "Could not execute `".$mycmd."` (Error: ".$myresult.")\n";
|
||
myprint "Please check the \$ENV{PATH} setting in the first lines of this program.\n";
|
||
myprint "Current setting: \"".$ENV{PATH}."\"\n";
|
||
};
|
||
return not($myresult);
|
||
};
|
||
#
|
||
# takes a list and returns a unified list, keeping given order
|
||
#
|
||
sub uniq {
|
||
undef my %uniq;
|
||
return grep(!$uniq{$_}++, @_);
|
||
};
|
||
#
|
||
# hash -> scalar
|
||
#
|
||
sub hash_to_str {
|
||
my %request = @_; my $result = '';
|
||
map { $result .= $SepReq."$_=".((ref $request{$_} eq 'ARRAY') ? (join $SepLst, @{$request{$_}}) : ($request{$_} || '')) } (keys %request);
|
||
return $result;
|
||
};
|
||
#
|
||
# scalar -> hash
|
||
#
|
||
sub str_to_hash {
|
||
my $request = shift; my %result = ();
|
||
foreach (split $SepReq, $request) {
|
||
next unless m/$KeyVal/;
|
||
my @items = split $SepLst, $2;
|
||
($#items) ? @{$result{$1}} = @items : $result{$1} = $2;
|
||
}; return %result;
|
||
};
|
||
#
|
||
# displays hash structure
|
||
#
|
||
sub hash_to_list {
|
||
my ($pre, %request) = @_; my @output = ();
|
||
# get longest key
|
||
my $minkey = '-'.(length((sort {length($b) <=> length($a)} (keys %request))[0] || '') + 1);
|
||
while ( my($s, $v) = each %request ) {
|
||
my $r = ref $v;
|
||
if ($r eq 'HASH') {
|
||
push @output, (%{$v})
|
||
? hash_to_list ( sprintf ("%s -> %".$minkey."s", $pre, '%'.$s), %{$v} )
|
||
: sprintf ("%s -> %".$minkey."s -> %s", $pre, '%'.$s, 'undef');
|
||
} elsif ($r eq 'ARRAY') {
|
||
push @output, sprintf ("%s -> %".$minkey."s -> %s", $pre, '@'.$s, ((@{$v}) ? "'".(join ",", @{$v})."'" : 'undef'));
|
||
} elsif ($r eq 'CODE') {
|
||
push @output, sprintf ("%s -> %".$minkey."s -> %s", $pre, '&'.$s, ((defined $v) ? "'".$v."'" : 'undef'));
|
||
} else {
|
||
push @output, sprintf ("%s -> %".$minkey."s -> %s", $pre, '$'.$s, ((defined $v) ? "'".$v."'" : 'undef'));
|
||
};
|
||
};
|
||
return sort { my ($c, $d) = ($a, $b);
|
||
$c =~ tr/$/1/; $c =~ tr/&/2/; $c =~ tr/@/3/; $c =~ tr/%/4/;
|
||
$d =~ tr/$/1/; $d =~ tr/&/2/; $d =~ tr/@/3/; $d =~ tr/%/4/;
|
||
return $c cmp $d; } @output;
|
||
};
|
||
#
|
||
# get ip and mask
|
||
#
|
||
sub cidr_parse
|
||
{
|
||
defined $_[0] or return undef;
|
||
$_[0] =~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)\/(\d+)$/ or return undef;
|
||
$1 < 256 and $2 < 256 and $3 < 256 and $4 < 256 and $5 <= 32 and $5 >= 0
|
||
or return undef;
|
||
my $net = ($1<<24)+($2<<16)+($3<<8)+$4;
|
||
my $mask = ~((1<<(32-$5))-1);
|
||
return ($net & $mask, $mask);
|
||
};
|
||
|
||
#
|
||
# compare address to network
|
||
#
|
||
sub cidr_match
|
||
{
|
||
my ($net, $mask, $addr) = @_;
|
||
return undef unless defined $net and defined $addr;
|
||
if($addr =~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/) {
|
||
$addr = ($1<<24)+($2<<16)+($3<<8)+$4;
|
||
};
|
||
return ($addr & $mask) == $net;
|
||
};
|
||
|
||
#
|
||
# clean up RBL cache
|
||
#
|
||
sub cleanup_dns_cache {
|
||
my($now) = $_[0];
|
||
foreach my $checkitem (keys %DNS_Cache) {
|
||
# remove inclomplete objects (dns timeouts)
|
||
if ( !defined($DNS_Cache{$checkitem}{"time"}) or !defined($DNS_Cache{$checkitem}{ttl}) ) {
|
||
log_info "[CLEANUP] deleting incomplete dns-cache item '$checkitem'" if (wantsdebug(qw[ all cleanup ]));
|
||
delete $DNS_Cache{$checkitem};
|
||
# remove timed out objects
|
||
} elsif ( ($now - $DNS_Cache{$checkitem}{"time"}) > $DNS_Cache{$checkitem}{ttl} ) {
|
||
log_info "[CLEANUP] removing dns-cache item '$checkitem' after ttl ".$DNS_Cache{$checkitem}{ttl}."s"
|
||
if (wantsdebug(qw[ all cleanup ]));
|
||
delete $DNS_Cache{$checkitem};
|
||
};
|
||
};
|
||
};
|
||
#
|
||
# clean up request cache
|
||
#
|
||
sub cleanup_request_cache {
|
||
my($now) = $_[0];
|
||
foreach my $checkitem (keys %Request_Cache) {
|
||
if ( not(defined $Request_Cache{$checkitem}{'until'}) ) {
|
||
log_info "[CLEANUP] deleting incomplete request-cache item '$checkitem'" if (wantsdebug(qw[ all cleanup ]));
|
||
delete $Request_Cache{$checkitem};
|
||
} elsif ( $now > $Request_Cache{$checkitem}{'until'} ) {
|
||
log_info "[CLEANUP] removing request-cache item '$checkitem' after ttl ".$REQUEST_MAX_CACHE."s"
|
||
if (wantsdebug(qw[ all cleanup ]));
|
||
delete $Request_Cache{$checkitem};
|
||
};
|
||
};
|
||
};
|
||
#
|
||
# clean up rate cache
|
||
#
|
||
sub cleanup_rate_cache {
|
||
my($now) = $_[0];
|
||
foreach my $checkitem (keys %Rates) {
|
||
unless (defined $Rates{$checkitem}{'list'}) {
|
||
delete $Rates{$checkitem};
|
||
} else {
|
||
my @i = ();
|
||
foreach my $crate (@{$Rates{$checkitem}{'list'}}) {
|
||
if ( not(defined $Rates{$checkitem}{$crate}{'until'}) ) {
|
||
log_info "[CLEANUP] deleting incomplete rate-cache item '$checkitem'->'$crate'" if (wantsdebug(qw[ all cleanup ]));
|
||
delete $Rates{$checkitem}{$crate};
|
||
} elsif ( $now > $Rates{$checkitem}{$crate}{'until'} ) {
|
||
log_info "[CLEANUP] removing rate-cache item '$checkitem'->'$crate' after ttl ".$Rates{$checkitem}{$crate}{ttl}."s"
|
||
if (wantsdebug(qw[ all cleanup ]));
|
||
delete $Rates{$checkitem}{$crate};
|
||
} else {
|
||
push @i, $crate;
|
||
};
|
||
};
|
||
unless ($i[0]) {
|
||
log_info "[CLEANUP] deleting complete rate-cache item '$checkitem'" if (wantsdebug(qw[ all cleanup ]));
|
||
delete $Rates{$checkitem};
|
||
} else {
|
||
log_info "[CLEANUP] new index list for rate-cache item '$checkitem': ".(join ', ', @i) if (wantsdebug(qw[ all cleanup ]));
|
||
@{$Rates{$checkitem}{'list'}} = @i;
|
||
};
|
||
};
|
||
};
|
||
};
|
||
#
|
||
# sets an action for a score
|
||
#
|
||
sub modify_score {
|
||
(my($myscore), my($myaction)) = @_;
|
||
|
||
( exists($MAX_SCORES{$myscore}) )
|
||
? log_note "redefined score $myscore with action=\"$myaction\""
|
||
: log_note "setting new score $myscore with action=\"$myaction\""
|
||
if wantsdebug(qw[ all thisrequest verbose score ]);
|
||
$MAX_SCORES{$myscore} = $myaction;
|
||
};
|
||
|
||
#
|
||
# dump cache contents
|
||
#
|
||
sub dump_cache {
|
||
my @dump = (); my @list = (\%Request_Cache, \%Rates);
|
||
@list = (@list, \%DNS_Cache) unless $opt_nodns;
|
||
@list = (@list, \%Config_Cache, \%ACLs, \%Matches, \%Timeouts) if wantsdebug(qw[ all verbose ]);
|
||
map { @dump = ( @dump, hash_to_list ($Name_To_Var{$_}, %{$_}) ) } @list;
|
||
return @dump;
|
||
};
|
||
|
||
#
|
||
# creates program usage statistics
|
||
#
|
||
sub list_stats {
|
||
my $now = time(); my @output = ();
|
||
my $uptime = $now - $Starttime;
|
||
$Counter_Requests ||= 0;
|
||
$Counter_Interval ||= 0;
|
||
$Counter_Top ||= 0;
|
||
$Counter_Hits ||= 0;
|
||
$Counter_Rates ||= 0;
|
||
my($totalreqpermin) = ( (($uptime > 0) ? ($Counter_Requests / $uptime) : 0 ) * 60);
|
||
my($lastreqpermin) = ($Counter_Interval / (((defined $Stat_Interval_Time) and ($Stat_Interval_Time > 0)) ? $Stat_Interval_Time : 1)) * 60;
|
||
$Counter_Top = $lastreqpermin if ($lastreqpermin > $Counter_Top);
|
||
|
||
if (not($opt_noidlestats) or ($Counter_Interval > 0) ) {
|
||
|
||
push @output, sprintf (
|
||
"%s %s: up since %d days, %02d:%02d:%02d hours",
|
||
$NAME, $VERSION,
|
||
($uptime / 60 / 60 / 24),
|
||
(($uptime / 60 / 60) % 24),
|
||
(($uptime / 60) % 60),
|
||
($uptime % 60));
|
||
|
||
push @output, sprintf ("Requests: %d overall, %d last interval, %.1f%% cache hits, %.1f%% rate hits",
|
||
$Counter_Requests, $Counter_Interval,
|
||
($Counter_Requests > 0) ? (($Counter_Hits / $Counter_Requests) * 100) : 0,
|
||
($Counter_Requests > 0) ? (($Counter_Rates / $Counter_Requests) * 100) : 0);
|
||
|
||
push @output, sprintf ("Averages: %.1f overall, %.1f last interval, %.1f top",
|
||
$totalreqpermin, $lastreqpermin, $Counter_Top);
|
||
|
||
push @output, sprintf ("Contents: %d rules, %d cached requests, %d cached dns results, %d rate limits",
|
||
$#Rules, scalar keys %Request_Cache, scalar keys %DNS_Cache, scalar keys %Rates);
|
||
|
||
# per rule stats
|
||
if (not($opt_no_rulestats) and @Rules and %Matches) {
|
||
my @rulecharts = (sort { ($Matches{$b} || 0) <=> ($Matches{$a} || 0) } (keys %Matches)); my $cntln = length(($Matches{$rulecharts[0]} || 2)) + 2;
|
||
map { push @output, sprintf ("%".$cntln."d matches for id: %s", ($Matches{$_} || 0), $_) } @rulecharts;
|
||
};
|
||
};
|
||
return @output;
|
||
};
|
||
|
||
#
|
||
# shows program usage statistics via syslog
|
||
#
|
||
sub show_stats {
|
||
map { mylog 'notice', "[STATS] $_" } list_stats();
|
||
$Counter_Interval = 0;
|
||
};
|
||
|
||
#
|
||
# returns content of !!() negation
|
||
#
|
||
sub deneg_item {
|
||
my($val) = (defined $_[0]) ? $_[0] : '';
|
||
return ( ($val =~ /^$COMP_NEG\s*\(?\s*(.+?)\s*\)?$/) ? $1 : '' );
|
||
};
|
||
#
|
||
# resolves $$() variables
|
||
#
|
||
sub devar_item {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
return '' unless $val and $myitem;
|
||
my($pre,$post,$var,$myresult) = '';
|
||
while ( ($val =~ /(.*)$COMP_VAR\s*(\w+)(.*)/g) or ($val =~ /(.*)$COMP_VAR\s*\((\w+)\)(.*)/g) ) {
|
||
($pre,$var,$post) = ($1,$2,$3);
|
||
if ($var eq $COMP_DNSBL_TEXT) {
|
||
$myresult=$val=$pre.(join "; ", uniq(@DNSBL_Text)).$post;
|
||
} elsif (defined $request{$var}) {
|
||
$myresult=$val=$pre.$request{$var}.$post;
|
||
};
|
||
log_info "substitute : \"$myitem\" \"$cmp\" \"$val\""
|
||
if (wantsdebug(qw[ all thisrequest devar ]));
|
||
};
|
||
return $myresult;
|
||
};
|
||
|
||
|
||
### SUB configuration
|
||
|
||
#
|
||
# preparses configuration line for ACL syntax
|
||
#
|
||
sub acl_parser {
|
||
my($file,$num,$myline) = @_;
|
||
if ( $myline =~ /^\s*($COMP_ACL[\-\w]+)\s*{\s*(.*?)\s*;?\s*}[\s;]*$/ ) {
|
||
$ACLs{$1} = $2; $myline = "";
|
||
} else {
|
||
while ( $myline =~ /($COMP_ACL[\-\w]+)/) {
|
||
my($acl) = $1;
|
||
if ( $acl and defined $ACLs{$acl} ) {
|
||
$myline =~ s/\s*$acl\s*/$ACLs{$acl}/g;
|
||
} else {
|
||
#return "action=note(undefined macro '$acl')";
|
||
log_warn "file $file, ignoring line $num: undefined macro '$acl'";
|
||
return "";
|
||
};
|
||
};
|
||
};
|
||
return $myline;
|
||
};
|
||
#
|
||
# prepares pcre item
|
||
#
|
||
sub prepare_pcre {
|
||
my($item) = shift; undef my $neg;
|
||
# temporarily remove negation
|
||
$item = $neg if ($neg = deneg_item($item));
|
||
# allow // regex
|
||
$item =~ s/^\/?(.*?)\/?$/$1/;
|
||
# tested slow
|
||
#$item = qr/$item/i;
|
||
# re-enable negation
|
||
$item = "!!($item)" if $neg;
|
||
return $item;
|
||
};
|
||
#
|
||
# prepares file item
|
||
#
|
||
sub prepare_file {
|
||
my($forced_reload,$type,$cmp,$file) = @_; my(@result) = (); undef my $fh;
|
||
my($is_table) = ($type =~ /^$COMP_TABLES$/);
|
||
unless (-e $file) {
|
||
log_warn "error: $type:$file not found - will be ignored";
|
||
return @result;
|
||
};
|
||
if ( not($forced_reload) and (defined $Config_Cache{$file}{lastread}) and ($Config_Cache{$file}{lastread} > (stat $file)[9]) ) {
|
||
mylogs $syslog_priority, "$type:$file unchanged - using cached content (mtime: "
|
||
.(stat $file)[9].", cache: $Config_Cache{$file}{lastread})"
|
||
if (wantsdebug(qw[ all thisrequest config ]));
|
||
return @{$Config_Cache{$file}{content}};
|
||
};
|
||
unless (open ($fh, "<$file")) {
|
||
log_warn "error: could not open $type:$file - $! - will be ignored";
|
||
return @result;
|
||
};
|
||
log_info "reading $type:$file" if (wantsdebug(qw[ all thisrequest config ]));
|
||
while (<$fh>) {
|
||
chomp;
|
||
s/#.*//g;
|
||
next if /^\s*$/;
|
||
s/\s+[^\s]+$// if $is_table;
|
||
s/^\s+//; s/\s+$//;
|
||
push @result, prepare_item($forced_reload, $cmp, $_);
|
||
}; close ($fh);
|
||
# update Config_Cache
|
||
$Config_Cache{$file}{lastread} = time();
|
||
@{$Config_Cache{$file}{content}} = @result;
|
||
log_info "read ".($#result + 1)." items from $type:$file" if (wantsdebug(qw[ all thisrequest config ]));
|
||
return @result;
|
||
};
|
||
#
|
||
# prepares ruleset item
|
||
#
|
||
sub prepare_item {
|
||
my($forced_reload,$cmp,$item) = @_; my(@result) = (); undef my $type;
|
||
if ($item =~ /$COMP_CONF_FILE_TABLE/) {
|
||
return prepare_file ($forced_reload, $1, $cmp, $2);
|
||
} elsif ($cmp eq '=~' or $cmp eq '!~') {
|
||
return $cmp.";".prepare_pcre($item);
|
||
} else {
|
||
return $cmp.";".$item;
|
||
};
|
||
};
|
||
#
|
||
# compatibility for old "rate"-syntax
|
||
#
|
||
sub check_for_old_syntax {
|
||
my($myindex,$myfile,$mynum,$mykey,$myvalue) = @_;
|
||
if ($mykey =~ /^action$/) {
|
||
if ($myvalue =~ /^(\w[\-\w]+)\s*\(\s*(.*?)\s*\)$/) {
|
||
my($mycmd,$myarg) = ($1, $2);
|
||
if ($mycmd =~ /^(rate|size|rcpt)(5321)?$/i) {
|
||
if ($myarg =~ /^\$\$(.*)$/) {
|
||
$myarg = $1;
|
||
$myvalue = "$mycmd($myarg)";
|
||
log_note "notice: Rule $myindex ($myfile line $mynum): "
|
||
."removing obsolete '\$\$' for $mycmd limit index. See man page for new syntax." if wantsdebug(qw[ all thisrequest verbose config ]);
|
||
};
|
||
push @Rate_Items, (split '/', $myarg)[0];
|
||
};
|
||
};
|
||
};
|
||
return $myvalue;
|
||
};
|
||
#
|
||
# parses configuration line
|
||
#
|
||
sub parse_config_line {
|
||
my($forced_reload, $myfile, $mynum, $myindex, $myline) = @_;
|
||
my(%myrule) = ();
|
||
my($mykey, $myvalue, $mycomp);
|
||
eval {
|
||
local $SIG{'__DIE__'};
|
||
local $SIG{'ALRM'} = sub { $myline =~ s/[ \t][ \t]*/ /g; log_warn "timeout after ".$config_timeout."s at parsing Rule $myindex ($myfile line $mynum): \"$myline\""; %myrule = (); die };
|
||
my $prevalert = alarm($config_timeout) if $config_timeout;
|
||
if ( $myline = acl_parser ($myfile, $mynum, $myline) ) {
|
||
unless ( $myline =~ /^\s*[^=\s]+\s*$COMP_SEPARATOR\s*([^;\s]+\s*)+(;\s*[^=\s]+\s*$COMP_SEPARATOR\s*([^;\s]+\s*)+)*[;\s]*$/ ) {
|
||
log_warn "ignoring invalid $myfile line ".$mynum.": \"".$myline."\"";
|
||
} else {
|
||
# separate items
|
||
foreach (split ";", $myline) {
|
||
# remove whitespaces around
|
||
s/^\s*(.*?)\s*($COMP_SEPARATOR)\s*(.*?)\s*$/$1$2$3/;
|
||
( ($mycomp = $2) =~ /^([\<\>\~])=$/ ) and $mycomp = "=$1";
|
||
($mykey, $myvalue) = split /$COMP_SEPARATOR/, $_, 2;
|
||
if ($mykey =~ /^$COMP_SINGLE$/) {
|
||
log_note "notice: Rule $myindex ($myfile line $mynum):"
|
||
." overriding $mykey=\"".$myrule{$mykey}."\""
|
||
." with $mykey=\"$myvalue\""
|
||
if (defined $myrule{$mykey});
|
||
$myvalue = check_for_old_syntax($myindex,$myfile,$mynum,$mykey,$myvalue);
|
||
$myrule{$mykey} = $myvalue;
|
||
} elsif ($mykey =~ /^$COMP_CSV$/) {
|
||
$myvalue =~ s/\s*,\s*/,/g;
|
||
map { push @{$myrule{$mykey}}, prepare_item ($forced_reload, $mycomp, $_) } ( split /\s*,\s*/, $myvalue );
|
||
} else {
|
||
push @{$myrule{$mykey}}, prepare_item ($forced_reload, $mycomp, $myvalue);
|
||
};
|
||
};
|
||
unless (exists($myrule{$COMP_ACTION})) {
|
||
log_warn "Rule ".$myindex." ($myfile line ".$mynum."): contains no action and will be ignored";
|
||
return (%myrule = ());
|
||
};
|
||
unless (exists($myrule{$COMP_ID})) {
|
||
$myrule{$COMP_ID} = "R-".$myindex;
|
||
log_note "notice: Rule $myindex ($myfile line $mynum): contains no rule identifier - will use \"$myrule{id}\"" if wantsdebug(qw[ all thisrequest verbose config ]);
|
||
};
|
||
log_info "loaded: Rule $myindex ($myfile line $mynum): id->\"$myrule{id}\" action->\"$myrule{action}\"" if wantsdebug(qw[ all thisrequest verbose config ]);
|
||
};
|
||
};
|
||
alarm($prevalert) if $config_timeout;
|
||
};
|
||
return %myrule;
|
||
};
|
||
#
|
||
# parses configuration file
|
||
#
|
||
sub read_config_file {
|
||
my($forced_reload, $myindex, $myfile) = @_;
|
||
my(%myrule, @myruleset, @lines) = ();
|
||
my($mybuffer) = ""; undef my $fh;
|
||
|
||
unless (-e $myfile) {
|
||
warn "error: file ".$myfile." not found - file will be ignored";
|
||
} else {
|
||
unless (open ($fh, "<$myfile")) {
|
||
warn "error: could not open ".$myfile." - $! - file will be ignored";
|
||
} else {
|
||
log_info "reading file $myfile" if wantsdebug(qw[ all thisrequest verbose config ]);
|
||
while (<$fh>) {
|
||
chomp;
|
||
s/(\"|#.*)//g;
|
||
next if /^\s*$/;
|
||
if ( /(.*)\\\s*$/ or /(.*\{)\s*$/ ) { $mybuffer = $mybuffer.$1; next; };
|
||
$mybuffer .= $_;
|
||
if ( $lines[0] and $mybuffer =~ /^(\}|\s+\S)/ ) {
|
||
my $last = pop(@lines); $last .= ';' unless $last =~ /;\s*$/;
|
||
$mybuffer = $last.$mybuffer;
|
||
};
|
||
push @lines, $mybuffer;
|
||
$mybuffer = "";
|
||
};
|
||
map {
|
||
log_info "parsing line: '$_'" if wantsdebug(qw[ all thisrequest config ]);
|
||
%myrule = parse_config_line ($forced_reload, $myfile, $., ($#myruleset+$myindex+1), $_);
|
||
push ( @myruleset, { %myrule } ) if (%myrule);
|
||
} @lines;
|
||
close ($fh);
|
||
log_info "loaded: Rules $myindex - ".($myindex + $#myruleset)." from file \"$myfile\"" if wantsdebug(qw[ all thisrequest verbose config ]);
|
||
};
|
||
};
|
||
return @myruleset;
|
||
}
|
||
#
|
||
# reads all configuration items
|
||
#
|
||
sub read_config {
|
||
my($forced_reload) = shift;
|
||
my(%myrule, @myruleset) = ();
|
||
my($mytype,$myitem,$config);
|
||
|
||
# init, cleanup cache and config vars
|
||
@Rules = %Rule_by_ID = %Request_Cache = @Rate_Items = ();
|
||
%Rates = () unless $opt_keep_rates_on_reload;
|
||
|
||
# parse configurations
|
||
for $config (@Configs) {
|
||
($mytype,$myitem) = split '::', $config;
|
||
if ($mytype eq "r" or $mytype eq "rule") {
|
||
%myrule = parse_config_line ($forced_reload, 'RULE', 0, ($#Rules + 1), $myitem);
|
||
push ( @Rules, { %myrule } ) if (%myrule);
|
||
} elsif ($mytype eq "f" or $mytype eq "file") {
|
||
if ( not($forced_reload) and (defined $Config_Cache{$myitem}{lastread}) and ($Config_Cache{$myitem}{lastread} > (stat $myitem)[9]) ) {
|
||
mylogs $syslog_priority,
|
||
"file \"$myitem\" unchanged - using cached ruleset (mtime: ".(stat $myitem)[9].",
|
||
cache: $Config_Cache{$myitem}{lastread})"
|
||
if wantsdebug(qw[ all thisrequest verbose config ]);
|
||
push ( @Rules, @{$Config_Cache{$myitem}{ruleset}} );
|
||
} else {
|
||
@myruleset = read_config_file ($forced_reload, ($#Rules+1), $myitem);
|
||
if (@myruleset) {
|
||
push ( @Rules, @myruleset );
|
||
$Config_Cache{$myitem}{lastread} = time();
|
||
@{$Config_Cache{$myitem}{ruleset}} = @myruleset;
|
||
};
|
||
};
|
||
};
|
||
};
|
||
if ($#Rules < 0) {
|
||
log_warn "critical: no rules found - i feel useless (have you set -f or -r?)";
|
||
} else {
|
||
# update Rule by ID hash
|
||
map { $Rule_by_ID{$Rules[$_]{$COMP_ID}} = $_ } (0 .. $#Rules);
|
||
if (@Rate_Items) {
|
||
@Rate_Items = uniq(@Rate_Items);
|
||
log_info "rate items: ".(join ', ', @Rate_Items) if wantsdebug(qw[ all thisrequest verbose config rates ]);
|
||
# disable request cache with ratelimits unless --fast_limit_evaluation is set
|
||
unless ($opt_fast_limits) {
|
||
$REQUEST_MAX_CACHE = 0;
|
||
log_note "disabling request cache due to ratelimits in configuration. may be changed with the --fast_limit_evaluation option"
|
||
if wantsdebug (qw[ all thisrequest verbose ]);
|
||
};
|
||
};
|
||
};
|
||
}
|
||
#
|
||
# displays configuration
|
||
#
|
||
sub show_config {
|
||
my($index,$line,$mykey);
|
||
if (wantsdebug(qw[ all verbose ])) {
|
||
myprint "=" x 75, "\n";
|
||
myprintf "Rule count: %s\n", ($#Rules + 1);
|
||
myprint "=" x 75, "\n";
|
||
};
|
||
for $index (0 .. $#Rules) {
|
||
next unless exists $Rules[$index];
|
||
myprintf "Rule %3d: id->\"%s\"; action->\"%s\"", $index, $Rules[$index]{$COMP_ID}, $Rules[$index]{$COMP_ACTION};
|
||
$line = (wantsdebug(qw[ all verbose ])) ? "\n\t " : "";
|
||
for $mykey ( reverse sort keys %{$Rules[$index]} ) {
|
||
unless (($mykey eq $COMP_ACTION) or ($mykey eq $COMP_ID)) {
|
||
$line .= "; " unless wantsdebug(qw[ all verbose ]);
|
||
$line .= ($mykey =~ /^$COMP_SINGLE$/)
|
||
? $mykey."->\"".$Rules[$index]{$mykey}."\""
|
||
: $mykey."->\"".(join ', ', @{$Rules[$index]{$mykey}})."\"";
|
||
$line .= " ; " if wantsdebug(qw[ all verbose ]);
|
||
};
|
||
};
|
||
$line =~ s/\s*\;\s*$// if wantsdebug(qw[ all verbose ]);
|
||
myprintf "%s\n", $line;
|
||
myprint "-" x 75, "\n" if wantsdebug(qw[ all verbose ]);
|
||
};
|
||
}
|
||
#
|
||
# saves rate limits to disk
|
||
#
|
||
sub save_rates {
|
||
return unless ($STORABLE and $opt_saverates and %Rates);
|
||
cleanup_rate_cache(time());
|
||
umask oct('0177');
|
||
eval { store (\%Rates, $opt_saverates) };
|
||
if ( $@ ) {
|
||
log_note "ERROR: Could not store rate limits to ".$opt_saverates." ('$!': '@_')";
|
||
} else {
|
||
log_info "Saved ".(scalar %Rates)." rates to ".$opt_saverates
|
||
if wantsdebug(qw[ all verbose rates loadrates saverates ]);
|
||
};
|
||
umask oct($net_umask);
|
||
};
|
||
#
|
||
# loads rate limits from disk
|
||
#
|
||
sub load_rates {
|
||
return unless ($STORABLE and $opt_saverates and (-f $opt_saverates));
|
||
eval { %Rates = %{ retrieve($opt_saverates) } };
|
||
if ( $@ ) {
|
||
log_note "Could not load rate limits from ".$opt_saverates." ('$!': '@_')";
|
||
} else {
|
||
log_info "Fetched ".(scalar %Rates)." rates from ".$opt_saverates
|
||
if wantsdebug(qw[ all verbose rates loadrates saverates ]);
|
||
cleanup_rate_cache(time());
|
||
};
|
||
};
|
||
|
||
## sub DNS
|
||
|
||
#
|
||
# checks for rbl timeouts
|
||
#
|
||
sub rbl_timeout {
|
||
my($myrbl) = shift;
|
||
return ( ($MAX_DNSBL_TIMEOUTS > 0) and (defined $Timeouts{$myrbl}) and ($Timeouts{$myrbl} > $MAX_DNSBL_TIMEOUTS) );
|
||
};
|
||
#
|
||
# reads DNS answers
|
||
#
|
||
sub rbl_read_dns {
|
||
my($myresult) = shift;
|
||
my($now) = time();
|
||
my($que,$ttl,$res,$typ) = undef;
|
||
my(@addrs) = ();
|
||
|
||
if ( defined $myresult ) {
|
||
# read question, for dns cache id
|
||
foreach ($myresult->question) {
|
||
$typ = $_->qtype;
|
||
next unless (($typ eq 'A') or ($typ eq 'TXT'));
|
||
if ($que = $_->qname) {
|
||
# some RBLs return CNAMEs, so the number of the questions
|
||
# is not necessarily the number of answers you get
|
||
foreach ($myresult->answer) {
|
||
if ($_->type eq 'A') {
|
||
push @addrs, $_->address if $_->address;
|
||
$ttl = $_->ttl;
|
||
} elsif ($_->type eq 'TXT') {
|
||
$res = join(" ", $_->char_str_list());
|
||
$ttl = $_->ttl;
|
||
};
|
||
};
|
||
|
||
# save result in cache
|
||
if ( exists($DNS_Cache{$que}) ) {
|
||
if ($typ eq 'A') {
|
||
$ttl = ( $DNS_Cache{$que}{ttl} > ($ttl||=0) ) ? $DNS_Cache{$que}{ttl} : $ttl;
|
||
log_info "[DNSBL] object "
|
||
.( ($DNS_Cache{$que}{type} eq $COMP_RBL_KEY)
|
||
? join(".", reverse(split(/\./,$DNS_Cache{$que}{value})))
|
||
: $DNS_Cache{$que}{value} )
|
||
." listed on ".$DNS_Cache{$que}{type}.":".$DNS_Cache{$que}{name}
|
||
." (answer: ".(join ", ", @addrs)
|
||
.", time: ".ts($now - $DNS_Cache{$que}{starttime})."s"
|
||
.", ttl: ".$ttl."s)"
|
||
if ( @addrs and not($opt_nodnslog) );
|
||
@{$DNS_Cache{$que}{A}} = @addrs;
|
||
$DNS_Cache{$que}{"time"} = $now;
|
||
$DNS_Cache{$que}{ttl} = $ttl;
|
||
} elsif ($typ eq 'TXT') {
|
||
$res ||= '';
|
||
# ugly, commas need to be escaped for set() action
|
||
$res =~ s/,/ /g;
|
||
$ttl = ( $DNS_Cache{$que}{ttl} > ($ttl||=0) ) ? $DNS_Cache{$que}{ttl} : $ttl;
|
||
$DNS_Cache{$que}{TXT} = $res;
|
||
$DNS_Cache{$que}{endtime} = $now unless $DNS_Cache{$que}{endtime};
|
||
$DNS_Cache{$que}{ttl} = $ttl unless $DNS_Cache{$que}{ttl};
|
||
};
|
||
} else {
|
||
log_note "[DNSBL] ignoring unknown query $que";
|
||
};
|
||
};
|
||
};
|
||
} else {
|
||
log_note "[DNSBL] dns timeout";
|
||
};
|
||
return $que if (@addrs || $res);
|
||
};
|
||
#
|
||
# fires DNS queries
|
||
#
|
||
sub rbl_prepare_lookups {
|
||
my($mytype, $myval, @myrbls) = @_;
|
||
my($myresult) = undef;
|
||
my($cmp,$rblitem,$myquery);
|
||
my(@lookups) = ();
|
||
|
||
# removes duplicate lookups, but keeps the specified order
|
||
@myrbls = uniq(@myrbls);
|
||
|
||
RBLQUERY: foreach (@myrbls) {
|
||
|
||
# separate rbl-name and answer
|
||
($cmp,$rblitem) = split ";", $_;
|
||
next RBLQUERY unless $rblitem;
|
||
my($myrbl, $myrblans, $myrbltime) = split /\//, $rblitem;
|
||
next RBLQUERY unless $myrbl;
|
||
next RBLQUERY if rbl_timeout($myrbl);
|
||
$myrblans = $RBL_DEFAULT unless $myrblans;
|
||
$myrbltime = $RBL_MAX_CACHE unless $myrbltime;
|
||
|
||
# create query string
|
||
$myquery = $myval.".".$myrbl;
|
||
|
||
# query our cache
|
||
if ( exists($DNS_Cache{$myquery}) and exists($DNS_Cache{$myquery}{A}) ) {
|
||
ANSWER: foreach (@{$DNS_Cache{$myquery}{A}}) {
|
||
last ANSWER if $myresult = ( $_ =~ /$myrblans/ );
|
||
};
|
||
log_info "[DNSQUERY] cached $mytype: $myrbl $myval ($myquery) - answer: \'".(join ", ", @{$DNS_Cache{$myquery}{A}})."\'"
|
||
if ( ($myresult and wantsdebug(qw[ verbose ])) or (wantsdebug(qw[ all thisrequest ])) );
|
||
|
||
# not found -> prepare dns query
|
||
} else {
|
||
my $now = time();
|
||
$DNS_Cache{$myquery} = {
|
||
starttime => $now,
|
||
ttl => $myrbltime,
|
||
name => $myrbl,
|
||
value => $myval,
|
||
type => $mytype,
|
||
};
|
||
log_info "[DNSQUERY] query $mytype: $myrbl $myval ($myquery)" if (wantsdebug(qw[ all thisrequest ]));
|
||
push @lookups, $myquery;
|
||
};
|
||
};
|
||
# return necessary lookups
|
||
return @lookups;
|
||
};
|
||
#
|
||
# checks RBL items
|
||
#
|
||
sub rbl_check {
|
||
my($mytype,$myrbl,$myval) = @_;
|
||
my($myanswer,$myrblans,$myrbltime,$myresult,$mystart,$myend);
|
||
my($m1,$m2,$myrbltype,$m4,$myrbltxt,$myquery);
|
||
my($now) = time();
|
||
|
||
# separate rbl-name and answer
|
||
($myrbl, $myrblans, $myrbltime) = split /\//, $myrbl;
|
||
$myrblans = $RBL_DEFAULT unless $myrblans;
|
||
$myrbltime = $RBL_MAX_CACHE unless $myrbltime;
|
||
|
||
# create query string
|
||
$myquery = $myval.".".$myrbl;
|
||
|
||
# query our cache
|
||
$myresult = ( exists($DNS_Cache{$myquery}) and ($#{$DNS_Cache{$myquery}{A}} >= 0) );
|
||
if ( $myresult ) {
|
||
ANSWER: foreach (@{$DNS_Cache{$myquery}{A}}) {
|
||
if ( $myresult = ( ($_) and ($_ =~ /$myrblans/)) ) {
|
||
log_info "[DNSBL] query $myval listed on "
|
||
.uc($mytype).":$myrbl (answer: ".(join ", ", @{$DNS_Cache{$myquery}{A}})
|
||
.", cached: ".ts($now - $DNS_Cache{$myquery}{"time"})."s ago)"
|
||
if wantsdebug(qw[ all thisrequest verbose ]);
|
||
push @DNSBL_Text, $DNS_Cache{$myquery}{type}.':'.$DNS_Cache{$myquery}{name}.':<'.($DNS_Cache{$myquery}{TXT} || '').'>'
|
||
if (defined $DNS_Cache{$myquery}{type} and defined $DNS_Cache{$myquery}{name});
|
||
last ANSWER;
|
||
};
|
||
};
|
||
};
|
||
return $myresult;
|
||
}
|
||
#
|
||
# dns resolver wrapper
|
||
#
|
||
sub dns_query {
|
||
my (@queries) = @_; undef my @result;
|
||
eval {
|
||
local $SIG{__DIE__} = sub { log_note "dns err: \"$!\", detail: \"@_\""; return if $^S; };
|
||
@result = dns_query_net_dns(@queries);
|
||
};
|
||
return @result;
|
||
};
|
||
#
|
||
# resolves dns queries using Net::DNS
|
||
#
|
||
sub dns_query_net_dns {
|
||
my (@queries) = @_; undef my @result;
|
||
my %ownsock = (); my @ownready = (); undef my $bgsock;
|
||
my $ownsel = IO::Select->new();
|
||
my $dns = Net::DNS::Resolver->new(
|
||
tcp_timeout => $dns_timeout,
|
||
udp_timeout => $dns_timeout,
|
||
persistent_tcp => 0, persistent_udp => 0,
|
||
retrans => 0, retry => 1, dnsrch => 0, defnames => 0,
|
||
);
|
||
# send queries
|
||
foreach (@queries) {
|
||
my ($item, $type) = split ','; $type ||= 'A';
|
||
# query child cache
|
||
if ( (defined $DNS_Cache{$item}{$type}) and (defined $DNS_Cache{$item}{'until'}) and ($DNS_Cache{$item}{'until'} >= time()) ) {
|
||
$DNS_Cache{$item}{$type} = [ $DNS_Cache{$item}{$type} ] unless (ref $DNS_Cache{$item}{$type} eq 'ARRAY');
|
||
log_info "dnsccache: item=$item, type=$type -> ".(join ',', @{$DNS_Cache{$item}{$type}})." (ttl: ".($DNS_Cache{$item}{ttl} || 0).")" if (wantsdebug(qw[ all thisrequest verbose ]));
|
||
push @result, @{$DNS_Cache{$item}{$type}};
|
||
} else {
|
||
log_info "dnsquery: item=$item, type=$type" if (wantsdebug(qw[ all thisrequest verbose ]));
|
||
$bgsock = $dns->bgsend ($item, $type);
|
||
$ownsel->add($bgsock);
|
||
$ownsock{$bgsock} = $item.','.$type;
|
||
};
|
||
};
|
||
# retrieve answers
|
||
while ((scalar keys %ownsock) and (@ownready = $ownsel->can_read($dns_timeout))) {
|
||
foreach my $sock (@ownready) {
|
||
if (defined $ownsock{$sock}) {
|
||
my $packet = $dns->bgread($sock);
|
||
my ($item, $type) = split ',', $ownsock{$sock};
|
||
my $rname = $DNS_REPNAMES{$type};
|
||
my @rrs = (grep { $_->type eq $type } $packet->answer);
|
||
my $ttl = 0; my @ans = ();
|
||
if (@rrs) {
|
||
# sort MX records by preference
|
||
@rrs = sort { $a->preference <=> $b->preference } @rrs if ($type eq 'MX');
|
||
foreach my $rr (@rrs) {
|
||
log_info "dnsanswer: item=$item, type=$type -> $rname=".$rr->$rname." (ttl: ".$rr->ttl.")" if wantsdebug(qw[ all thisrequest verbose ]);
|
||
push @ans, $rr->$rname;
|
||
};
|
||
push @result, @ans;
|
||
};
|
||
# add to dns cache
|
||
$ttl ||= $DNS_MIN_CACHE;
|
||
@{$DNS_Cache{$item}{$type}} = @ans;
|
||
$DNS_Cache{$item}{ttl} = $ttl;
|
||
$DNS_Cache{$item}{'until'} = time() + $ttl;
|
||
delete $ownsock{$sock};
|
||
} else {
|
||
$ownsel->remove($sock);
|
||
$sock = undef;
|
||
};
|
||
};
|
||
};
|
||
# show timeouts
|
||
map { log_note "dnsquery: timeout for $_ after $dns_timeout seconds" } (values %ownsock);
|
||
return @result;
|
||
};
|
||
|
||
|
||
## SUB plugins
|
||
|
||
#
|
||
# these subroutines integrate additional attributes to
|
||
# a request before the ruleset is evaluated
|
||
# call: %result = postfwd_items{foo}(%request)
|
||
# save: $result{$_}
|
||
#
|
||
%postfwd_items = (
|
||
"__builtin__" => sub {
|
||
my(%request) = @_; my(%result) = ();
|
||
# postfwd version
|
||
$result{version} = $NAME." ".$VERSION;
|
||
# sender info
|
||
$request{sender} =~ /(.*)@([^@]*)$/;
|
||
( $result{sender_localpart}, $result{sender_domain} ) = ( $1, $2 );
|
||
# recipient info
|
||
$request{recipient} =~ /(.*)@([^@]*)$/;
|
||
( $result{recipient_localpart}, $result{recipient_domain} ) = ( $1, $2 );
|
||
# reverted ip address (for lookups)
|
||
$result{reverse_address} = (join(".", reverse(split(/\./,$request{client_address}))));
|
||
return %result;
|
||
},
|
||
"sender_dns" => sub {
|
||
my(%request) = @_; my(%result) = ();
|
||
map { $result{$_} = $request{sender_domain} } ($COMP_NS_NAME, $COMP_NS_ADDR, $COMP_MX_NAME, $COMP_MX_ADDR);
|
||
$result{$COMP_HELO_ADDR} = $request{helo_name};
|
||
return %result;
|
||
},
|
||
);
|
||
# returns additional request information
|
||
# for all postfwd_items
|
||
sub postfwd_items {
|
||
my(%request) = @_;
|
||
my(%result) = ();
|
||
foreach (sort keys %postfwd_items) {
|
||
log_info "[PLUGIN] executing postfwd-item ".$_
|
||
if (wantsdebug(qw[ all thisrequest ]));
|
||
%result = (%result, &{$postfwd_items{$_}}((%request,%result)))
|
||
if (defined $postfwd_items{$_});
|
||
};
|
||
map { $result{$_} = '' unless (defined $result{$_}); log_info "[PLUGIN] Added key: $_=$result{$_}" if (wantsdebug(qw[ all thisrequest ])) } (keys %result);
|
||
return %result;
|
||
};
|
||
#
|
||
# compare item subroutines
|
||
# must take compare_item_foo ( $COMPARE_TYPE, $RULEITEM, $REQUESTITEM, %REQUEST, %REQUESTINFO );
|
||
#
|
||
%postfwd_compare = (
|
||
"cidr" => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = ($val and $myitem);
|
||
log_info "type cidr : \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
|
||
if ($myresult) {
|
||
# always true
|
||
$myresult = ($val eq '0.0.0.0/0');
|
||
unless ($myresult) {
|
||
# v4 addresses only
|
||
$myresult = ($myitem =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/);
|
||
if ($myresult) {
|
||
$val .= '/32' unless ($val =~ /\/\d{1,2}$/);
|
||
$myresult = cidr_match((cidr_parse($val)),$myitem);
|
||
} else {
|
||
log_info "Non IPv4 address. Using type default" if (wantsdebug(qw[ all thisrequest ]));
|
||
return &{$postfwd_compare{default}}($cmp,$val,$myitem,%request);
|
||
};
|
||
};
|
||
};
|
||
$myresult = not($myresult) if ($cmp eq '!=');
|
||
return $myresult;
|
||
},
|
||
"numeric" => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = undef;
|
||
log_info "type numeric : \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
|
||
$myitem ||= "0"; $val ||= "0";
|
||
if ($cmp eq '==') {
|
||
$myresult = ($myitem == $val);
|
||
} elsif ($cmp eq '=<') {
|
||
$myresult = ($myitem <= $val);
|
||
} elsif ($cmp eq '=>') {
|
||
$myresult = ($myitem >= $val);
|
||
} elsif ($cmp eq '<') {
|
||
$myresult = ($myitem < $val);
|
||
} elsif ($cmp eq '>') {
|
||
$myresult = ($myitem > $val);
|
||
} elsif ($cmp eq '!=') {
|
||
$myresult = not($myitem == $val);
|
||
} elsif ($cmp eq '!<') {
|
||
$myresult = not($myitem <= $val);
|
||
} elsif ($cmp eq '!>') {
|
||
$myresult = not($myitem >= $val);
|
||
} else {
|
||
$myresult = ($myitem >= $val);
|
||
};
|
||
return $myresult;
|
||
},
|
||
$COMP_RBL_KEY => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = not($opt_nodns);
|
||
log_info "type rbl : \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
|
||
$myresult = ( rbl_check ($COMP_RBL_KEY, $val, $myitem) ) if $myresult;
|
||
$myresult = not($myresult) if ($cmp eq '!=');
|
||
return $myresult;
|
||
},
|
||
$COMP_RHSBL_KEY => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = not($opt_nodns);
|
||
log_info "type rhsbl : \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
|
||
$myresult = ( rbl_check ($COMP_RHSBL_KEY, $val, $myitem) ) if $myresult;
|
||
$myresult = not($myresult) if ($cmp eq '!=');
|
||
return $myresult;
|
||
},
|
||
$COMP_MONTHS => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = undef;
|
||
my($imon) = (split (',', $myitem))[4]; $imon ||= 0;
|
||
my($rmin,$rmax) = split (/\s*-\s*/, $val);
|
||
$rmin = ($rmin) ? (($rmin =~ /^\d$/) ? $rmin : $months{$rmin}) : $imon;
|
||
$rmax = ($rmax) ? (($rmax =~ /^\d$/) ? $rmax : $months{$rmax}) : (($val =~ /-/) ? $imon : $rmin);
|
||
log_info "type months : \"$imon\" \"$cmp\" \"$rmin\"-\"$rmax\""
|
||
if (wantsdebug(qw[ all thisrequest ]));
|
||
$myresult = (($rmin <= $imon) and ($rmax >= $imon));
|
||
$myresult = not($myresult) if ($cmp eq '!=');
|
||
return $myresult;
|
||
},
|
||
$COMP_DAYS => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = undef;
|
||
my($iday) = (split (',', $myitem))[6]; $iday ||= 0;
|
||
my($rmin,$rmax) = split (/\s*-\s*/, $val);
|
||
$rmin = ($rmin) ? (($rmin =~ /^\d$/) ? $rmin : $weekdays{$rmin}) : $iday;
|
||
$rmax = ($rmax) ? (($rmax =~ /^\d$/) ? $rmax : $weekdays{$rmax}) : (($val =~ /-/) ? $iday : $rmin);
|
||
log_info "type days : \"$iday\" \"$cmp\" \"$rmin\"-\"$rmax\""
|
||
if (wantsdebug(qw[ all thisrequest ]));
|
||
$myresult = (($rmin <= $iday) and ($rmax >= $iday));
|
||
$myresult = not($myresult) if ($cmp eq '!=');
|
||
return $myresult;
|
||
},
|
||
$COMP_DATE => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = undef;
|
||
my($isec,$imin,$ihour,$iday,$imon,$iyear) = split (',', $myitem);
|
||
my($rmin,$rmax) = split (/\s*-\s*/, $val);
|
||
my($idat) = ($iyear + 1900) . ((($imon+1) < 10) ? '0'.($imon+1) : ($imon+1)) . (($iday < 10) ? '0'.$iday : $iday);
|
||
$rmin = ($rmin) ? join ('', reverse split ('\.', $rmin)) : $idat;
|
||
$rmax = ($rmax) ? join ('', reverse split ('\.', $rmax)) : (($val =~ /-/) ? $idat : $rmin);
|
||
log_info "type date : \"$idat\" \"$cmp\" \"$rmin\"-\"$rmax\""
|
||
if (wantsdebug(qw[ all thisrequest ]));
|
||
$myresult = (($rmin <= $idat) and ($rmax >= $idat));
|
||
$myresult = not($myresult) if ($cmp eq '!=');
|
||
return $myresult;
|
||
},
|
||
$COMP_TIME => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = undef;
|
||
my($isec,$imin,$ihour,$iday,$imon,$iyear) = split (',', $myitem);
|
||
my($rmin,$rmax) = split (/\s*-\s*/, $val);
|
||
my($idat) = (($ihour < 10) ? '0'.$ihour : $ihour) . (($imin < 10) ? '0'.$imin : $imin) . (($isec < 10) ? '0'.$isec : $isec);
|
||
$rmin = ($rmin) ? join ('', split ('\:', $rmin)) : $idat;
|
||
$rmax = ($rmax) ? join ('', split ('\:', $rmax)) : (($val =~ /-/) ? $idat : $rmin);
|
||
log_info "type time : \"$idat\" \"$cmp\" \"$rmin\"-\"$rmax\""
|
||
if (wantsdebug(qw[ all thisrequest ]));
|
||
$myresult = (($rmin <= $idat) and ($rmax >= $idat));
|
||
$myresult = not($myresult) if ($cmp eq '!=');
|
||
return $myresult;
|
||
},
|
||
$COMP_HELO_ADDR => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = undef;
|
||
return $myresult if $opt_nodns;
|
||
return $myresult unless $myitem =~ /\./;
|
||
if ( my @answers = dns_query ("$myitem,A") ) {
|
||
log_info "type $COMP_HELO_ADDR : \"".(join ',', @answers)."\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
|
||
map { $myresult = ( &{$postfwd_compare{cidr}}(($cmp,$val,$_,%request)) ); return $myresult if $myresult } @answers;
|
||
};
|
||
return $myresult;
|
||
},
|
||
$COMP_NS_NAME => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = undef;
|
||
return $myresult if $opt_nodns;
|
||
return $myresult unless $myitem =~ /\./;
|
||
if ( my @answers = dns_query ("$myitem,NS") ) {
|
||
log_info "type $COMP_NS_NAME : \"".(join ',', @answers)."\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
|
||
map { $myresult = ( &{$postfwd_compare{default}}(($cmp,$val,$_,%request)) ); return $myresult if $myresult } @answers;
|
||
} else {
|
||
$myresult = ( &{$postfwd_compare{default}}(($cmp,$val,'',%request)) );
|
||
};
|
||
return $myresult;
|
||
},
|
||
$COMP_MX_NAME => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = undef;
|
||
return $myresult if $opt_nodns;
|
||
return $myresult unless $myitem =~ /\./;
|
||
if ( my @answers = dns_query ("$myitem,MX") ) {
|
||
log_info "type $COMP_MX_NAME : \"".(join ',', @answers)."\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
|
||
map { $myresult = ( &{$postfwd_compare{default}}(($cmp,$val,$_,%request)) ); return $myresult if $myresult } @answers;
|
||
} else {
|
||
$myresult = ( &{$postfwd_compare{default}}(($cmp,$val,'',%request)) );
|
||
};
|
||
return $myresult;
|
||
},
|
||
$COMP_NS_ADDR => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = undef;
|
||
return $myresult if $opt_nodns;
|
||
return $myresult unless $myitem =~ /\./;
|
||
if ( my @answers = dns_query ("$myitem,NS") ) {
|
||
splice (@answers, $opt_max_ns_lookups) if $opt_max_ns_lookups and $#answers > $opt_max_ns_lookups;
|
||
if ( @answers = dns_query (@answers) ) {
|
||
log_info "type $COMP_NS_ADDR : \"".(join ',', @answers)."\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
|
||
map { $myresult = ( &{$postfwd_compare{cidr}}(($cmp,$val,$_,%request)) ); return $myresult if $myresult } @answers;
|
||
};
|
||
};
|
||
return $myresult;
|
||
},
|
||
$COMP_MX_ADDR => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = undef;
|
||
return $myresult if $opt_nodns;
|
||
return $myresult unless $myitem =~ /\./;
|
||
if ( my @answers = dns_query ("$myitem,MX") ) {
|
||
splice (@answers, $opt_max_mx_lookups) if $opt_max_mx_lookups and $#answers > $opt_max_mx_lookups;
|
||
if ( @answers = dns_query (@answers) ) {
|
||
log_info "type $COMP_MX_ADDR : \"".(join ',', @answers)."\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
|
||
map { $myresult = ( &{$postfwd_compare{cidr}}(($cmp,$val,$_,%request)) ); return $myresult if $myresult } @answers;
|
||
};
|
||
};
|
||
return $myresult;
|
||
},
|
||
"default" => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($var,$myresult) = undef;
|
||
log_info "type default : \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
|
||
# backward compatibility
|
||
$cmp = '==' if ( ($var) and ($cmp eq '=') );
|
||
if ($cmp eq '==') {
|
||
$myresult = ( lc($myitem) eq lc($val) ) if $myitem;
|
||
} elsif ($cmp eq '!=') {
|
||
$myresult = not( lc($myitem) eq lc($val) ) if $myitem;
|
||
} elsif ($cmp eq '=<') {
|
||
$myresult = (($myitem || 0) <= $val);
|
||
} elsif ($cmp eq '<') {
|
||
$myresult = (($myitem || 0) < $val);
|
||
} elsif ($cmp eq '!<') {
|
||
$myresult = not(($myitem || 0) <= $val);
|
||
} elsif ($cmp eq '=>') {
|
||
$myresult = (($myitem || 0) >= $val);
|
||
} elsif ($cmp eq '>') {
|
||
$myresult = (($myitem || 0) > $val);
|
||
} elsif ($cmp eq '!>') {
|
||
$myresult = not(($myitem || 0) >= $val);
|
||
} elsif ($cmp eq '=~') {
|
||
$myresult = ($myitem =~ /$val/i);
|
||
} elsif ($cmp eq '!~') {
|
||
$myresult = ($myitem !~ /$val/i);
|
||
} else {
|
||
# allow // regex
|
||
$val =~ s/^\/?(.*?)\/?$/$1/;
|
||
$myresult = $myitem =~ /$val/i;
|
||
};
|
||
return $myresult;
|
||
},
|
||
"client_address" => sub { return &{$postfwd_compare{cidr}}(@_); },
|
||
"encryption_keysize" => sub { return &{$postfwd_compare{numeric}}(@_); },
|
||
"size" => sub { return &{$postfwd_compare{numeric}}(@_); },
|
||
"recipient_count" => sub { return &{$postfwd_compare{numeric}}(@_); },
|
||
"request_score" => sub { return &{$postfwd_compare{numeric}}(@_); },
|
||
$COMP_RHSBL_KEY_CLIENT => sub { return &{$postfwd_compare{$COMP_RHSBL_KEY}}(@_); },
|
||
$COMP_RHSBL_KEY_SENDER => sub { return &{$postfwd_compare{$COMP_RHSBL_KEY}}(@_); },
|
||
$COMP_RHSBL_KEY_HELO => sub { return &{$postfwd_compare{$COMP_RHSBL_KEY}}(@_); },
|
||
$COMP_RHSBL_KEY_RCLIENT => sub { return &{$postfwd_compare{$COMP_RHSBL_KEY}}(@_); },
|
||
);
|
||
#
|
||
# these subroutines define postfwd actions
|
||
#
|
||
%postfwd_actions = (
|
||
# example action foo()
|
||
# "foo" => sub {
|
||
# my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
# my($myaction) = $default_action; my($stop) = 0;
|
||
# ...
|
||
# return ($stop,$index,$myaction,$myline,%request);
|
||
# },
|
||
# jump() command
|
||
"jump" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = $default_action; my($stop) = 0;
|
||
if (defined $Rule_by_ID{$myarg}) {
|
||
my($ruleno) = $Rule_by_ID{$myarg};
|
||
log_info "[RULES] ".$myline
|
||
.", jump to rule $ruleno (id $myarg)"
|
||
if wantsdebug(qw[ all thisrequest verbose ]);
|
||
$index = $ruleno - 1;
|
||
} else {
|
||
warn "[RULES] ".$myline." - error: jump failed, can not find rule-id ".$myarg." - ignoring";
|
||
};
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
# set() command
|
||
"set" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = $default_action; my($stop) = 0;
|
||
foreach ( split (",", $myarg) ) {
|
||
if ( /^\s*([^=]+?)\s*([\.\-\*\/\+=]=|=[\.\-\*\/\+=]|=)\s*(.*?)\s*$/ ) {
|
||
my($r_var, $mod, $r_val) = ($1, $2, $3);
|
||
my($m_val) = (defined $request{$r_var}) ? $request{$r_var} : 0;
|
||
# saves some ifs
|
||
if (($mod eq '=') or ($mod eq '==')) {
|
||
$m_val = $r_val;
|
||
} elsif ( ($mod eq '.=') or ($mod eq '=.') ) {
|
||
$m_val .= $r_val;
|
||
} elsif ( (($mod eq '+=') or ($mod eq '=+')) and (($m_val=~/^\-?\d+(\.\d+)?$/) and ($r_val=~/^\-?\d+(\.\d+)?$/)) ) {
|
||
$m_val += $r_val;
|
||
} elsif ( (($mod eq '-=') or ($mod eq '=-')) and (($m_val=~/^\-?\d+(\.\d+)?$/) and ($r_val=~/^\-?\d+(\.\d+)?$/)) ) {
|
||
$m_val -= $r_val;
|
||
} elsif ( (($mod eq '*=') or ($mod eq '=*')) and (($m_val=~/^\-?\d+(\.\d+)?$/) and ($r_val=~/^\-?\d+(\.\d+)?$/)) ) {
|
||
$m_val *= $r_val;
|
||
} elsif ( (($mod eq '/=') or ($mod eq '=/')) and (($m_val=~/^\-?\d+(\.\d+)?$/) and ($r_val=~/^\-?\d+(\.\d+)?$/)) ) {
|
||
$m_val /= (($r_val == 0) ? 1 : $r_val);
|
||
} else {
|
||
$m_val = $r_val;
|
||
};
|
||
$m_val = $1.($2 || '').($3 || '') if ( $m_val =~ /^(\-?\d+)([\.,]\d+)?(.*)$/ );
|
||
(defined $request{$r_var})
|
||
? log_note "[RULES] ".$myline.", redefining existing ".$r_var."=".$request{$r_var}." with ".$r_var."=".$m_val
|
||
: log_info "[RULES] ".$myline.", defining ".$r_var."=".$m_val
|
||
if wantsdebug(qw[ all thisrequest verbose ]);
|
||
$request{$r_var} = $m_val;
|
||
} else {
|
||
warn "[RULES] ".$myline.", ignoring unknown set() attribute ".$_;
|
||
};
|
||
};
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
# score() command
|
||
"score" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = $default_action; my($stop) = 0;
|
||
my($score) = (defined $request{request_score}) ? $request{request_score} : 0;
|
||
if ($myarg =~/^([\+\-\*\/\=]?)(\d+)([\.,](\d+))?$/) {
|
||
my($mod, $val) = ($1, $2 + ((defined $4) ? "0.$4" : 0));
|
||
if ($mod eq '-') {
|
||
$score -= $val;
|
||
} elsif ($mod eq '*') {
|
||
$score *= $val;
|
||
} elsif ($mod eq '/') {
|
||
$score /= $val unless ($val == 0);
|
||
} elsif ($mod eq '=') {
|
||
$score = $val;
|
||
} else {
|
||
$score += $val;
|
||
};
|
||
$score = $1.((defined $2) ? $2 : '.0') if ( $score =~ /^(\-?\d+)([\.,]\d\d?)?/ );
|
||
log_info "[SCORE] ".$myline.", modifying score about ".$myarg." points to ". $score
|
||
if wantsdebug(qw[ all thisrequest verbose ]);
|
||
$request{score} = $request{request_score} = $score;
|
||
} elsif ($myarg) {
|
||
warn "[RULES] ".$myline.", invalid value for score \"$myarg\" - ignoring";
|
||
};
|
||
MAXSCORE: foreach my $max_score (reverse sort keys %MAX_SCORES) {
|
||
if ( ($score >= $max_score) and ($MAX_SCORES{$max_score}) ) {
|
||
$myaction=$MAX_SCORES{$max_score};
|
||
$myline .= ", score=".$score."/".$max_score;
|
||
$stop = $score; last MAXSCORE;
|
||
};
|
||
};
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
# mail() command
|
||
"mail" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = $default_action; my($stop) = 0;
|
||
my($mserver,$mhelo,$mfrom,$mto,$msubject,$mbody) = split "/", $myarg, 6;
|
||
($mserver, my $mport) = split ":", $mserver; my $res = "";
|
||
my @talk = (
|
||
"HELO $mhelo",
|
||
"MAIL FROM: $mfrom",
|
||
"RCPT TO: $mto",
|
||
"DATA",
|
||
"Subject: $msubject\r\n$mbody\r\n.",
|
||
"QUIT",
|
||
);
|
||
if ( my $socket = IO::Socket::INET->new(
|
||
PeerAddr => $mserver,
|
||
PeerPort => ($mport ||= 25),
|
||
Proto => 'tcp',
|
||
Timeout => 30,
|
||
Type => SOCK_STREAM,
|
||
) ) {
|
||
SMTP: foreach (@talk) {
|
||
print $socket "$_\r\n"; $res = <$socket>; chomp($res);
|
||
last SMTP unless $res =~ /^[23][0-9][0-9] /;
|
||
};
|
||
close($socket);
|
||
log_info "[MAIL] ".$myline.", mail server=<$mserver:$mport>, from=<$mfrom>, to=<$mto>, subject=<$msubject>, status=<$res>";
|
||
} else {
|
||
log_note "[MAIL] ".$myline.", could not open socket to $mserver:$mport: '$!'";
|
||
};
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
# sendmail()
|
||
"sendmail" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = $default_action; my($stop) = 0;
|
||
my($mcmd,$mfrom,$mto,$msubject,$mbody) = split '::', $myarg, 5;
|
||
my($msg) = "From: $mfrom\nTo: $mto\nSubject: $msubject\n\n$mbody\n";
|
||
if ( (-x $mcmd) and open (SM, "| $mcmd -i -f $mfrom $mto") ) {
|
||
if ( print SM "$msg" ) {
|
||
log_info "[SENDMAIL] ".$myline.", $mcmd from=<$mfrom>, to=<$mto>, subject=<$msubject>";
|
||
} else {
|
||
log_note "[SENDMAIL] ".$myline.", could not print to $mcmd pipe: '$!'";
|
||
};
|
||
close(SM);
|
||
} else {
|
||
log_note "[SENDMAIL] ".$myline.", could not open pipe to $mcmd: '$!'";
|
||
};
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
# rate() command
|
||
"rate" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = $default_action; my($stop) = 0;
|
||
my($ratetype,$ratecount,$ratetime,$ratecmd) = split "/", $myarg, 4;
|
||
my($rcount) = ( ($mycmd =~ /^size/) ? $request{size} : (($mycmd =~ /^rcpt/) ? $request{recipient_count} : 1 ) );
|
||
if ($ratetype and $ratecount and $ratetime and $ratecmd and $rcount) {
|
||
my $crate = $Rules[$index]{$COMP_ID}.'+'.$ratecount.'_'.$ratetime;
|
||
if ( defined $request{$ratetype} ) {
|
||
my $r = $request{$ratetype};
|
||
unless ($mycmd =~ /5321$/) {
|
||
$r = lc($r);
|
||
} else {
|
||
$r = ($r =~ /^([^@]+)@(\S+)$/) ? $1.'@'.lc($2) : lc($r);
|
||
};
|
||
$ratetype .= "=".$r;
|
||
unless ( defined $Rates{$ratetype}{$crate} ) {
|
||
# create rate object
|
||
push @{$Rates{$ratetype}{'list'}}, $crate;
|
||
$Rates{$ratetype}{$crate} = {
|
||
'type' => $mycmd,
|
||
'maxcount' => $ratecount,
|
||
'ttl' => $ratetime,
|
||
'count' => $rcount,
|
||
'time' => $now,
|
||
'until' => $now + $ratetime,
|
||
'rule' => $Rules[$index]{$COMP_ID},
|
||
'action' => $ratecmd,
|
||
};
|
||
log_info "[RATES] ".$myline
|
||
.", creating rate object ".$ratetype
|
||
." [type: ".$mycmd.", max: ".$ratecount.", time: ".$ratetime."s]"
|
||
if (wantsdebug(qw[ all thisrequest rates ]));
|
||
} elsif (not $opt_fast_limits) {
|
||
if ( $now > $Rates{$ratetype}{$crate}{'until'} ) {
|
||
# renew rate
|
||
$Rates{$ratetype}{$crate}{'count'} = $rcount;
|
||
$Rates{$ratetype}{$crate}{'time'} = $now;
|
||
$Rates{$ratetype}{$crate}{'until'} = $now + $Rates{$ratetype}{$crate}{ttl};
|
||
log_info "[RATES] ".$myline
|
||
.", renewing rate object '".$ratetype."/".$crate."'"
|
||
." [type: ".$Rates{$ratetype}{$crate}{type}
|
||
.", max: ".$Rates{$ratetype}{$crate}{maxcount}
|
||
.", time: ".$Rates{$ratetype}{$crate}{ttl}."s]"
|
||
if (wantsdebug(qw[ all thisrequest rates ]));
|
||
} elsif (not (($rcount+=$Rates{$ratetype}{$crate}{count}) > $Rates{$ratetype}{$crate}{maxcount})) {
|
||
# increase rate
|
||
$Rates{$ratetype}{$crate}{count} = $rcount;
|
||
log_info "[RATES] ".$myline
|
||
.", increasing rate object '".$ratetype."/".$crate."'"
|
||
." to ".$Rates{$ratetype}{$crate}{count}
|
||
." [type: ".$Rates{$ratetype}{$crate}{type}
|
||
.", max: ".$Rates{$ratetype}{$crate}{maxcount}
|
||
.", time: ".$Rates{$ratetype}{$crate}{ttl}."s]"
|
||
if (wantsdebug(qw[ all thisrequest rates ]));
|
||
};
|
||
};
|
||
# rate exceeded
|
||
$stop = ($rcount > $Rates{$ratetype}{$crate}{maxcount});
|
||
if ($stop) {
|
||
$Counter_Rates++;
|
||
$myaction=$Rates{$ratetype}{$crate}{action};
|
||
$request{'ratecount'} = $rcount;
|
||
$myline .= ", rate=".$Rates{$ratetype}{$crate}{type}."/".$rcount."/".ts($now - $Rates{$ratetype}{$crate}{'time'})."s";
|
||
};
|
||
} else {
|
||
log_info "[RULES] ".$myline.", ignoring empty index for ".$mycmd." limit '".$ratetype."'" if (wantsdebug(qw[ all thisrequest ]));
|
||
};
|
||
} else {
|
||
log_note "[RULES] ".$myline.(($rcount) ? ", ignoring unknown ".$mycmd."() attribute \'".$myarg."\'" : ", ignoring empty counter");
|
||
};
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
# size() command
|
||
"size" => sub { return &{$postfwd_actions{rate}}(@_); },
|
||
# rcpt() command
|
||
"rcpt" => sub { return &{$postfwd_actions{rate}}(@_); },
|
||
# rate() command, according to rfc5321 case-sensivity
|
||
"rate5321" => sub { return &{$postfwd_actions{rate}}(@_); },
|
||
# rcpt() command, according to rfc5321 case-sensivity
|
||
"rcpt5321" => sub { return &{$postfwd_actions{rate}}(@_); },
|
||
# size() command, according to rfc5321 case-sensivity
|
||
"size5321" => sub { return &{$postfwd_actions{rate}}(@_); },
|
||
# wait() command
|
||
"wait" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = $default_action; my($stop) = 0;
|
||
log_info "[RULES] ".$myline.", delaying for $myarg seconds";
|
||
sleep $myarg;
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
# note() command
|
||
"note" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = $default_action; my($stop) = 0;
|
||
log_info "[RULES] ".$myline." - note: ".$myarg if $myarg;
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
# debug() command
|
||
"debug" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = $default_action; my($stop) = 0;
|
||
log_info "[RULES] ".$myline.", DEBUG=$myarg";
|
||
($myarg =~ /^(1|y(es)?|on)$/i) ? $DEBUG{thisrequest} = 1 : delete $DEBUG{thisrequest};
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
# quit() command
|
||
"quit" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
warn "[RULES] ".$myline." - critical: quit (".$myarg.")";
|
||
end_program;
|
||
},
|
||
# file() command
|
||
"file" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = $default_action; my($stop) = 0;
|
||
warn "[RULES] ".$myline." - error: command ".$mycmd."() has not been implemented yet - ignoring";
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
# ask() command
|
||
"ask" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = $default_action; my($stop) = 0;
|
||
mylogs ('info', "Opening socket to '$myarg'") if (wantsdebug(qw[ all thisrequest ]));
|
||
my($addr,$port,$ignore) = split ':', $myarg;
|
||
my %orig = str_to_hash ($request{orig});
|
||
if ( ($addr and $port) and my $socket = new IO::Socket::INET (
|
||
PeerAddr => $addr,
|
||
PeerPort => $port,
|
||
Proto => 'tcp',
|
||
Timeout => 9,
|
||
Type => SOCK_STREAM ) ) {
|
||
|
||
my $sendstr = '';
|
||
foreach (keys %orig) {
|
||
$sendstr .= $_."=".$orig{$_}."\n";
|
||
};
|
||
$sendstr .= "\n";
|
||
mylogs ('info', "Asking service $myarg -> '$sendstr'") if (wantsdebug(qw[ all thisrequest ]));
|
||
print $socket "$sendstr";
|
||
$sendstr = <$socket>;
|
||
chomp($sendstr);
|
||
mylogs ('info', "Answer from $myarg -> '$sendstr'") if (wantsdebug(qw[ all thisrequest ]));
|
||
$sendstr =~ s/^(action=)//;
|
||
if ($1 and $sendstr) {
|
||
if ($ignore and ($sendstr =~ /$ignore/i)) {
|
||
mylogs ('info', "ignoring answer '$sendstr' from $myarg") if (wantsdebug(qw[ all thisrequest ]));
|
||
} else {
|
||
$stop = $myaction = $sendstr;
|
||
};
|
||
} else {
|
||
mylogs ('notice', "rule: $index got invalid answer '$sendstr' from $myarg");
|
||
};
|
||
} else {
|
||
mylogs ('notice', "Could not open socket to '$myarg' - $!");
|
||
};
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
# exec() command
|
||
"exec" => sub { return &{$postfwd_actions{file}}(@_); },
|
||
);
|
||
# load plugin-items
|
||
sub get_plugins {
|
||
my(@pluginfiles) = @_;
|
||
my($pluginlog) = '';
|
||
foreach my $file (@pluginfiles) {
|
||
unless ( -e $file ) {
|
||
warn "File not found: $file";
|
||
} else {
|
||
$file =~ /^(.*)$/;
|
||
require $1 if $1;
|
||
map { delete $postfwd_items_plugin{$_} unless ($_ and defined $postfwd_items_plugin{$_}) } (keys %postfwd_items_plugin);
|
||
map { delete $postfwd_compare_plugin{$_} unless ($_ and defined $postfwd_compare_plugin{$_}) } (keys %postfwd_compare_plugin);
|
||
map { delete $postfwd_actions_plugin{$_} unless ($_ and defined $postfwd_actions_plugin{$_}) } (keys %postfwd_actions_plugin);
|
||
map { log_note "[PLUGIN] overriding prior item \'".$_."\'" if (defined $postfwd_items{$_}) } (keys %postfwd_items_plugin);
|
||
map { log_note "[PLUGIN] overriding prior compare function \'".$_."\'" if (defined $postfwd_compare{$_}) } (keys %postfwd_compare_plugin);
|
||
map { log_note "[PLUGIN] overriding prior action \'".$_."\'" if (defined $postfwd_actions{$_}) } (keys %postfwd_actions_plugin);
|
||
%postfwd_items = ( %postfwd_items, %postfwd_items_plugin ) if %postfwd_items_plugin;
|
||
%postfwd_compare = ( %postfwd_compare, %postfwd_compare_plugin ) if %postfwd_compare_plugin;
|
||
%postfwd_actions = ( %postfwd_actions, %postfwd_actions_plugin ) if %postfwd_actions_plugin;
|
||
$pluginlog = "[PLUGIN] Loaded plugins file: ".$file;
|
||
$pluginlog .= " items: \"".(join ", ", (sort keys %postfwd_items_plugin))."\""
|
||
if %postfwd_items_plugin;
|
||
$pluginlog .= " compare: \"".(join ", ", (sort keys %postfwd_compare_plugin))."\""
|
||
if %postfwd_compare_plugin;
|
||
$pluginlog .= " actions: \"".(join ", ", (sort keys %postfwd_actions_plugin))."\""
|
||
if %postfwd_actions_plugin;
|
||
log_info $pluginlog;
|
||
};
|
||
};
|
||
};
|
||
|
||
|
||
|
||
### SUB ruleset
|
||
|
||
#
|
||
# compare item main
|
||
# use: compare_item ( $TYPE, $RULEITEM, $MINIMUMHITS, $REQUESTITEM, %REQUEST, %REQUESTINFO );
|
||
#
|
||
sub compare_item {
|
||
my($mykey,$mymask,$mymin,$myitem,%request) = @_;
|
||
my($val,$var,$cmp,$neg,$myresult,$postfwd_compare_proc);
|
||
my($rcount) = 0;
|
||
$mymin ||= 1;
|
||
|
||
# determine the right compare function
|
||
$postfwd_compare_proc = (defined $postfwd_compare{$mykey}) ? $mykey : "default";
|
||
# save list due to possible modification
|
||
my @items = @{$mymask};
|
||
# now compare request to every single item
|
||
ITEM: foreach (@items) {
|
||
($cmp, $val) = split ";";
|
||
next ITEM unless ($cmp and (defined $val) and $mykey);
|
||
# prepare_file
|
||
if ($val =~ /$COMP_LIVE_FILE_TABLE/) {
|
||
push @items, prepare_file (0, $1, $cmp, $2);
|
||
next ITEM;
|
||
};
|
||
log_info "compare $mykey: \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
|
||
$val = $neg if ($neg = deneg_item($val));
|
||
log_info "deneg $mykey: \"$myitem\" \"$cmp\" \"$val\"" if ($neg and (wantsdebug(qw[ all thisrequest ])));
|
||
next ITEM unless (defined $val);
|
||
# substitute check for $$vars in rule item
|
||
if ( $var = devar_item ($cmp,$val,$myitem,%request) ) {
|
||
$val = $var; $val =~ s/([^-_@\.\w\s])/\\$1/g unless ($cmp eq '==');
|
||
};
|
||
$myresult = &{$postfwd_compare{$postfwd_compare_proc}}($cmp,$val,$myitem,%request);
|
||
log_info "match $mykey: ".($myresult ? "TRUE" : "FALSE") if (wantsdebug(qw[ all thisrequest ]));
|
||
if ($neg) {
|
||
$myresult = not($myresult);
|
||
log_info "negate match $mykey: ".($myresult ? "TRUE" : "FALSE") if (wantsdebug(qw[ all thisrequest ]));
|
||
};
|
||
$rcount++ if $myresult;
|
||
$myresult = not($mymin eq 'all');
|
||
$myresult = ( $rcount >= $mymin ) if $myresult;
|
||
log_info "count $mykey: request=$rcount minimum: $mymin result: ".($myresult ? "TRUE" : "FALSE") if (wantsdebug(qw[ all thisrequest ]));
|
||
last ITEM if $myresult;
|
||
};
|
||
$myresult = $rcount if ($myresult or ($mymin eq 'all'));
|
||
return $myresult;
|
||
};
|
||
#
|
||
# compare request against a single rule
|
||
#
|
||
sub compare_rule {
|
||
my($index,$date,%request) = @_;
|
||
my(@ruleitems) = keys %{$Rules[$index]};
|
||
my($has_rbl) = exists($Rules[$index]{$COMP_RBL_KEY});
|
||
my($has_rhl) = (
|
||
exists($Rules[$index]{$COMP_RHSBL_KEY}) or exists($Rules[$index]{$COMP_RHSBL_KEY_RCLIENT}) or
|
||
exists($Rules[$index]{$COMP_RHSBL_KEY_CLIENT}) or exists($Rules[$index]{$COMP_RHSBL_KEY_SENDER}) or
|
||
exists($Rules[$index]{$COMP_RHSBL_KEY_HELO})
|
||
);
|
||
my($hasdns) = ( not($opt_nodns) and ($has_rhl or $has_rbl) );
|
||
my($mykey,$myitem,$val,$cmp,$res,$myline,$timed) = undef;
|
||
my(@myresult) = (0,0,0);
|
||
my(@queries,@timedout) = ();
|
||
my($num) = 1;
|
||
undef @DNSBL_Text;
|
||
|
||
# prepare dns queries
|
||
my $ownres = Net::DNS::Resolver->new(
|
||
tcp_timeout => ($dns_timeout || $def_dns_timeout),
|
||
udp_timeout => ($dns_timeout || $def_dns_timeout),
|
||
persistent_tcp => 0, persistent_udp => 0,
|
||
retrans => 0, retry => 1, dnsrch => 0, defnames => 0,
|
||
);
|
||
my $ownsel = IO::Select->new();
|
||
my %ownsock = ();
|
||
my @ownready = ();
|
||
my $bgsock = undef;
|
||
|
||
log_info "[RULES] rule: $index, id: $Rules[$index]{$COMP_ID}, items: '".((@ruleitems) ? join ';', @ruleitems: '')."'" if (wantsdebug(qw[ all thisrequest ]));
|
||
|
||
# COMPARE-ITEMS
|
||
# check all non-dns items
|
||
ITEM: for $mykey ( keys %{$Rules[$index]} ) {
|
||
# always true
|
||
if ( (($mykey eq $COMP_ID) or ($mykey eq $COMP_ACTION)) ) {
|
||
$myresult[0]++;
|
||
next ITEM;
|
||
};
|
||
next ITEM if ( (($mykey eq $COMP_RBL_CNT) or ($mykey eq $COMP_RHSBL_CNT)) );
|
||
next ITEM if ( (($mykey eq $COMP_RBL_KEY) or ($mykey eq $COMP_RHSBL_KEY)) );
|
||
next ITEM if ( ($mykey eq $COMP_RHSBL_KEY_RCLIENT) or ($mykey eq $COMP_RHSBL_KEY_CLIENT) or ($mykey eq $COMP_RHSBL_KEY_SENDER) or ($mykey eq $COMP_RHSBL_KEY_HELO) );
|
||
|
||
# integration at this point enables redefining scores within ruleset
|
||
if ($mykey eq $COMP_SCORES) {
|
||
modify_score ($Rules[$index]{$mykey},$Rules[$index]{$COMP_ACTION});
|
||
$myresult[0] = 0;
|
||
} else {
|
||
$val = ( $mykey =~ /^$COMP_DATECALC$/ )
|
||
# prepare date check
|
||
? $date
|
||
# default: compare against request attribute
|
||
: $request{$mykey};
|
||
$myresult[0] = ($res = compare_item($mykey, $Rules[$index]{$mykey}, $num, ((defined $val) ? $val : ''), %request)) ? ($myresult[0] + $res) : 0;
|
||
};
|
||
last ITEM unless ($myresult[0] > 0);
|
||
};
|
||
|
||
# DNSQUERY-SECTION
|
||
# fire add()s with callback to result cache,
|
||
# if they are not contained already,
|
||
# and $opt_nodns is not set
|
||
if ($hasdns and $myresult[0]) {
|
||
|
||
map { $timed .= (($timed) ? ", $_" : $_) if $Timeouts{$_} > $MAX_DNSBL_TIMEOUTS } (keys %Timeouts);
|
||
log_note "[DNSQUERY] skipping rbls: $timed - too much timeouts" if $timed;
|
||
|
||
push @queries, rbl_prepare_lookups ( $COMP_RBL_KEY, $request{reverse_address}, @{$Rules[$index]{$COMP_RBL_KEY}} )
|
||
if ( exists($Rules[$index]{$COMP_RBL_KEY}) and not($request{client_address} =~ /:/) );
|
||
push @queries, rbl_prepare_lookups ( $COMP_RHSBL_KEY, $request{client_name}, @{$Rules[$index]{$COMP_RHSBL_KEY}} )
|
||
if ( exists($Rules[$index]{$COMP_RHSBL_KEY}) and not($request{client_name} eq "unknown") );
|
||
push @queries, rbl_prepare_lookups ( $COMP_RHSBL_KEY_CLIENT, $request{client_name}, @{$Rules[$index]{$COMP_RHSBL_KEY_CLIENT}} )
|
||
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_CLIENT}) and not($request{client_name} eq "unknown") );
|
||
push @queries, rbl_prepare_lookups ( $COMP_RHSBL_KEY_SENDER, $request{sender_domain}, @{$Rules[$index]{$COMP_RHSBL_KEY_SENDER}} )
|
||
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_SENDER}) and not($request{sender_domain} eq "") );
|
||
push @queries, rbl_prepare_lookups ( $COMP_RHSBL_KEY_HELO, $request{helo_name}, @{$Rules[$index]{$COMP_RHSBL_KEY_HELO}} )
|
||
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_HELO}) and not($request{helo_name} eq "") );
|
||
push @queries, rbl_prepare_lookups ( $COMP_RHSBL_KEY_RCLIENT, $request{reverse_client_name}, @{$Rules[$index]{$COMP_RHSBL_KEY_RCLIENT}} )
|
||
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_RCLIENT}) and not($request{reverse_client_name} eq "unknown") );
|
||
|
||
# send dns queries
|
||
if ( @queries ) {
|
||
@queries = uniq(@queries);
|
||
foreach my $query (@queries) {
|
||
log_info "[SENDDNS] sending query \'$query\'"
|
||
if (wantsdebug(qw[ all thisrequest ]));
|
||
# send A query
|
||
$bgsock = $ownres->bgsend($query, 'A');
|
||
$ownsel->add($bgsock);
|
||
$ownsock{$bgsock} = 'A:'.$query;
|
||
# send TXT query
|
||
if ($dns_async_txt) {
|
||
$bgsock = $ownres->bgsend($query, 'TXT');
|
||
$ownsel->add($bgsock);
|
||
$ownsock{$bgsock} = 'TXT:'.$query;
|
||
};
|
||
};
|
||
log_info "[SENDDNS] rule: $index, id: $Rules[$index]{$COMP_ID}, lookups: ".($#queries + 1)
|
||
if (wantsdebug(qw[ all thisrequest ]));
|
||
};
|
||
|
||
# DNSRESULT-SECTION
|
||
# if all other items matched, run await()
|
||
# and check the results unless $opt_nodns
|
||
my($ownstart) = time(); @queries = ();
|
||
my($timout) = $dns_timeout || $def_dns_timeout;
|
||
while ((scalar keys %ownsock) and (@ownready = $ownsel->can_read($timout))) {
|
||
foreach my $sock (@ownready) {
|
||
if (defined $ownsock{$sock}) {
|
||
mylogs ('notice', "[DNSBL] answer for ".$ownsock{$sock})
|
||
if (wantsdebug(qw[ all thisrequest ]));
|
||
my $packet = $ownres->bgread($sock);
|
||
push @queries, (split ':', $ownsock{$sock})[1] if rbl_read_dns ($packet);
|
||
delete $ownsock{$sock};
|
||
} else {
|
||
$ownsel->remove($sock);
|
||
$sock = undef;
|
||
};
|
||
};
|
||
};
|
||
|
||
# timeout handling
|
||
map { push @timedout, (split ':', $ownsock{$_})[1] } (keys %ownsock);
|
||
foreach (uniq(@timedout)) {
|
||
# @{$DNS_Cache{$_}{A}} = ('__TIMEOUT__');
|
||
$DNS_Cache{$_}{endtime} = time();
|
||
$DNS_Cache{$_}{ttl} = $RBL_MAX_CACHE;
|
||
$Timeouts{$DNS_Cache{$_}{name}} = (defined $Timeouts{$DNS_Cache{$_}{name}})
|
||
? $Timeouts{$DNS_Cache{$_}{name}} + 1
|
||
: 1
|
||
if ( $MAX_DNSBL_TIMEOUTS > 0 );
|
||
mylogs ('notice', "[DNSBL] warning: timeout (".$Timeouts{$DNS_Cache{$_}{name}}."/".$MAX_DNSBL_TIMEOUTS.") for ".$DNS_Cache{$_}{name}." after ".ts(time() - $ownstart)." seconds");
|
||
};
|
||
|
||
# perform outstanding TXT queries unless --dns_async_txt is set
|
||
if (not($dns_async_txt) and @queries) {
|
||
@queries = uniq(@queries);
|
||
log_info "[DNSBL] sending TXT queries for ".(join ',', @queries) if (wantsdebug(qw[ all thisrequest ]));
|
||
foreach my $query (@queries) {
|
||
log_info "[SENDDNS] sending TXT query \'$query\'" if (wantsdebug(qw[ all thisrequest ]));
|
||
# send TXT query
|
||
$bgsock = $ownres->bgsend($query, 'TXT');
|
||
$ownsel->add($bgsock);
|
||
$ownsock{$bgsock} = 'TXT:'.$query;
|
||
};
|
||
while ((scalar keys %ownsock) and (@ownready = $ownsel->can_read($timout))) {
|
||
foreach my $sock (@ownready) {
|
||
if (defined $ownsock{$sock}) {
|
||
mylogs ('notice', "[DNSBL] answer for ".$ownsock{$sock})
|
||
if (wantsdebug(qw[ all thisrequest ]));
|
||
my $packet = $ownres->bgread($sock);
|
||
rbl_read_dns ($packet);
|
||
delete $ownsock{$sock};
|
||
} else {
|
||
$ownsel->remove($sock);
|
||
$sock = undef;
|
||
};
|
||
};
|
||
};
|
||
};
|
||
|
||
# compare dns results
|
||
if ( ($myresult[0] > 0) and exists($Rules[$index]{$COMP_RBL_KEY}) ) {
|
||
$res = compare_item(
|
||
$COMP_RBL_KEY,
|
||
$Rules[$index]{$COMP_RBL_KEY},
|
||
($Rules[$index]{$COMP_RBL_CNT} ||= 1),
|
||
$request{reverse_address},
|
||
%request
|
||
);
|
||
$myresult[0] = ($res or ($Rules[$index]{$COMP_RBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
|
||
$myresult[1] = ($res) ? $res : 0;
|
||
};
|
||
|
||
if ( $has_rhl and ($myresult[0] > 0) ) {
|
||
if ( exists($Rules[$index]{$COMP_RHSBL_KEY}) ) {
|
||
if ($request{client_name} eq "unknown") {
|
||
$myresult[0] = (defined $Rules[$index]{$COMP_RHSBL_CNT})
|
||
? ( ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all') ? 1 : 0 )
|
||
: 0;
|
||
} else {
|
||
$res = compare_item(
|
||
$COMP_RHSBL_KEY,
|
||
$Rules[$index]{$COMP_RHSBL_KEY},
|
||
($Rules[$index]{$COMP_RHSBL_CNT} ||= 1),
|
||
$request{client_name},
|
||
%request
|
||
);
|
||
$myresult[0] = ($res or ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
|
||
$myresult[2] += $res if $res;
|
||
};
|
||
};
|
||
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_CLIENT}) ) {
|
||
if ($request{client_name} eq "unknown") {
|
||
$myresult[0] = (defined $Rules[$index]{$COMP_RHSBL_CNT})
|
||
? ( ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all') ? 1 : 0 )
|
||
: 0;
|
||
} else {
|
||
$res = compare_item(
|
||
$COMP_RHSBL_KEY_CLIENT,
|
||
$Rules[$index]{$COMP_RHSBL_KEY_CLIENT},
|
||
($Rules[$index]{$COMP_RHSBL_CNT} ||= 1),
|
||
$request{client_name},
|
||
%request
|
||
);
|
||
$myresult[0] = ($res or ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
|
||
$myresult[2] += $res if $res;
|
||
};
|
||
};
|
||
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_SENDER}) ) {
|
||
if ($request{sender_domain} eq "") {
|
||
$myresult[0] = (defined $Rules[$index]{$COMP_RHSBL_CNT})
|
||
? ( ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all') ? 1 : 0 )
|
||
: 0;
|
||
} else {
|
||
$res = compare_item(
|
||
$COMP_RHSBL_KEY_SENDER,
|
||
$Rules[$index]{$COMP_RHSBL_KEY_SENDER},
|
||
($Rules[$index]{$COMP_RHSBL_CNT} ||= 1),
|
||
$request{sender_domain},
|
||
%request
|
||
);
|
||
$myresult[0] = ($res or ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
|
||
$myresult[2] += $res if $res;
|
||
};
|
||
};
|
||
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_HELO}) ) {
|
||
if ($request{helo_domain} eq "") {
|
||
$myresult[0] = (defined $Rules[$index]{$COMP_RHSBL_CNT})
|
||
? ( ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all') ? 1 : 0 )
|
||
: 0;
|
||
} else {
|
||
$res = compare_item(
|
||
$COMP_RHSBL_KEY_HELO,
|
||
$Rules[$index]{$COMP_RHSBL_KEY_HELO},
|
||
($Rules[$index]{$COMP_RHSBL_CNT} ||= 1),
|
||
$request{helo_name},
|
||
%request
|
||
);
|
||
$myresult[0] = ($res or ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
|
||
$myresult[2] += $res if $res;
|
||
};
|
||
};
|
||
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_RCLIENT}) ) {
|
||
if ($request{reverse_client_name} eq "unknown") {
|
||
$myresult[0] = (defined $Rules[$index]{$COMP_RHSBL_CNT})
|
||
? ( ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all') ? 1 : 0 )
|
||
: 0;
|
||
} else {
|
||
$res = compare_item(
|
||
$COMP_RHSBL_KEY_RCLIENT,
|
||
$Rules[$index]{$COMP_RHSBL_KEY_RCLIENT},
|
||
($Rules[$index]{$COMP_RHSBL_CNT} ||= 1),
|
||
$request{reverse_client_name},
|
||
%request
|
||
);
|
||
$myresult[0] = ($res or ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
|
||
$myresult[2] += $res if $res;
|
||
};
|
||
};
|
||
};
|
||
};
|
||
if (wantsdebug(qw[ all thisrequest ])) {
|
||
$myline = "[RULES] RULE: ".$index." MATCHES: ".((($myresult[0] - 2) > 0) ? ($myresult[0] - 2) : 0);
|
||
$myline .= " RBLCOUNT: ".$myresult[1] if ($myresult[1] > 0);
|
||
$myline .= " RHSBLCOUNT: ".$myresult[2] if ($myresult[2] > 0);
|
||
$myline .= " DNSBLTEXT: ".(join ("; ", @DNSBL_Text)) if ( (@DNSBL_Text) and (($myresult[1] > 0) or ($myresult[2] > 0)) );
|
||
log_info $myline;
|
||
};
|
||
return @myresult;
|
||
}
|
||
|
||
|
||
### SUB access policy
|
||
|
||
#
|
||
# access policy routine
|
||
#
|
||
sub smtpd_access_policy {
|
||
my(%request) = @_;
|
||
my($myaction) = $default_action;
|
||
my($index) = 1;
|
||
my($stop) = 1;
|
||
my($now) = time();
|
||
my($date) = join(',', localtime($now));
|
||
my($matched,$rblcnt,$rhlcnt,$t1,$t2,$t3,$rcount,$ai) = 0;
|
||
my($mykey,$cacheid,$myline,$checkreq,$var,$ratehit,$rateitem) = "";
|
||
|
||
# save original request
|
||
$request{orig} = hash_to_str (%request);
|
||
|
||
# replace empty sender with <>
|
||
$request{sender} = '<>' unless ($request{sender});
|
||
|
||
# load postfwd_items attributes
|
||
if ( my(%postfwd_items_attr) = postfwd_items (%request) ) {
|
||
%request = (%request, %postfwd_items_attr);
|
||
};
|
||
|
||
|
||
# check for HUP signal
|
||
if ( $Reload_Conf ) {
|
||
undef $Reload_Conf;
|
||
show_stats;
|
||
read_config(1);
|
||
};
|
||
|
||
# clear dnsbl timeout counters
|
||
if ( ($MAX_DNSBL_INTERVAL > 0) and (($now - $Cleanup_Timeouts) > $MAX_DNSBL_INTERVAL) ) {
|
||
undef %Timeouts;
|
||
log_info "[CLEANUP] clearing dnsbl timeout counters" if wantsdebug(qw[ all thisrequest verbose ]);
|
||
$Cleanup_Timeouts = $now;
|
||
};
|
||
|
||
# wipe out old cache items
|
||
if ( ($CLEANUP_RATE_CACHE > 0) and (scalar keys %Rates > 0) and (($now - $Cleanup_Rates) > $CLEANUP_RATE_CACHE) ) {
|
||
$t1 = time();
|
||
$t3 = scalar keys %Rates;
|
||
cleanup_rate_cache($now);
|
||
$t2 = time();
|
||
log_info "[CLEANUP] needed ".ts($t2 - $t1)
|
||
." seconds for rate cleanup of "
|
||
.($t3 - scalar keys %Rates)." out of ".$t3
|
||
." cached items after cleanup time ".$CLEANUP_RATE_CACHE."s"
|
||
if ( wantsdebug(qw[ all thisrequest verbose cleanup ]) or (($t2 - $t1) >= 1) );
|
||
$Cleanup_Rates = $t1;
|
||
};
|
||
|
||
# increase rate limits
|
||
if (@Rate_Items and $opt_fast_limits) {
|
||
RATES: foreach $checkreq (@Rate_Items) {
|
||
next RATES unless $request{$checkreq};
|
||
my $checkval = $checkreq."=".lc($request{$checkreq});
|
||
next RATES unless ( defined $Rates{$checkval} and defined $Rates{$checkval}{'list'} );
|
||
CRATE: foreach my $crate (@{$Rates{$checkval}{'list'}}) {
|
||
$rcount = ( ($Rates{$checkval}{$crate}{type} eq 'size') ? $request{size} :
|
||
(($Rates{$checkval}{$crate}{type} eq 'rcpt') ? $request{recipient_count} : 1 ) );
|
||
if ( $now > $Rates{$checkval}{$crate}{'until'} ) {
|
||
# renew rate
|
||
$Rates{$checkval}{$crate}{'count'} = $rcount;
|
||
$Rates{$checkval}{$crate}{'time'} = $now;
|
||
$Rates{$checkval}{$crate}{'until'} = $now + $Rates{$checkval}{$crate}{ttl};
|
||
log_info "[RATES] renewing rate object '".$checkval."/".$crate."'"
|
||
." [type: ".$Rates{$checkval}{$crate}{type}
|
||
.", max: ".$Rates{$checkval}{$crate}{maxcount}
|
||
.", time: ".$Rates{$checkval}{$crate}{ttl}."s]"
|
||
if (wantsdebug(qw[ all thisrequest ]));
|
||
} elsif (not (($rcount+=$Rates{$checkval}{$crate}{count}) > $Rates{$checkval}{$crate}{maxcount})) {
|
||
# increase rate
|
||
$Rates{$checkval}{$crate}{count} = $rcount;
|
||
log_info "[RATES] increasing rate object '".$checkval."/".$crate."'"
|
||
." to ".$Rates{$checkval}{$crate}{count}
|
||
." [type: ".$Rates{$checkval}{$crate}{type}
|
||
.", max: ".$Rates{$checkval}{$crate}{maxcount}
|
||
.", time: ".$Rates{$checkval}{$crate}{ttl}."s]"
|
||
if (wantsdebug(qw[ all thisrequest ]));
|
||
};
|
||
$ratehit = ($rcount > $Rates{$checkval}{$crate}{maxcount}) ? $checkval : undef;
|
||
if ($ratehit) {
|
||
$request{'ratecount'} = $rcount;
|
||
$rateitem = $crate;
|
||
last CRATE;
|
||
};
|
||
};
|
||
last RATES if $ratehit;
|
||
};
|
||
};
|
||
|
||
# Request cache enabled?
|
||
if ( $REQUEST_MAX_CACHE > 0 ) {
|
||
|
||
# construct cache identifier
|
||
if (@CacheID) {
|
||
map { $cacheid .= $request{$_}.";" if (defined $request{$_}) } @CacheID;
|
||
} else {
|
||
REQITEM: foreach $checkreq (sort keys %request) {
|
||
next REQITEM unless $request{$checkreq};
|
||
next REQITEM if ( ($checkreq eq "instance") or ($checkreq eq "queue_id") or ($checkreq eq "orig") );
|
||
next REQITEM if ( $opt_cache_no_size and ($checkreq eq "size") );
|
||
next REQITEM if ( $opt_cache_no_sender and ($checkreq eq "sender") );
|
||
if ( $opt_cache_rdomain_only and ($checkreq eq "recipient") ) {
|
||
$cacheid .= $request{recipient_domain}.";";
|
||
} else {
|
||
$cacheid .= $request{$checkreq}.";";
|
||
};
|
||
};
|
||
};
|
||
log_info "created cache-id: $cacheid" if (wantsdebug(qw[ all thisrequest ]));
|
||
|
||
# wipe out old cache entries
|
||
if ( (scalar keys %Request_Cache > 0) and (($now - $Cleanup_Requests) > $CLEANUP_REQUEST_CACHE) ) {
|
||
$t1 = time();
|
||
$t3 = scalar keys %Request_Cache;
|
||
cleanup_request_cache($now);
|
||
$t2 = time();
|
||
log_info "[CLEANUP] needed ".ts($t2 - $t1)
|
||
." seconds for request cleanup of "
|
||
.($t3 - scalar keys %Request_Cache)." out of ".$t3
|
||
." cached items after cleanup time ".$CLEANUP_REQUEST_CACHE."s"
|
||
if ( wantsdebug(qw[ all thisrequest verbose cleanup ]) or (($t2 - $t1) >= 1) );
|
||
$Cleanup_Requests = $t1;
|
||
};
|
||
};
|
||
|
||
# check rate
|
||
if ( $ratehit and $opt_fast_limits ) {
|
||
|
||
$Counter_Rates++;
|
||
$Matches{$Rates{$ratehit}{$rateitem}{rule}}++;
|
||
$myaction = $Rates{$ratehit}{$rateitem}{action};
|
||
# substitute check for $$vars in action
|
||
$myaction = $var if ( $var = devar_item ("==",$myaction,"action",%request) );
|
||
log_info "[RATES] rule=".$Rule_by_ID{$Rates{$ratehit}{$rateitem}{rule}}
|
||
. ", id=".$Rates{$ratehit}{$rateitem}{rule}
|
||
. ( ($request{queue_id}) ? ", queue=".$request{queue_id} : '' )
|
||
. ", client=".$request{client_name}."[".$request{client_address}."]"
|
||
. ( ($request{sasl_username}) ? ", user=".$request{sasl_username} : '' )
|
||
. ", sender=<".(($request{sender} eq '<>') ? "" : $request{sender}).">"
|
||
. ( ($request{recipient}) ? ", recipient=<".$request{recipient}.">" : '' )
|
||
. ", helo=<".$request{helo_name}.">"
|
||
. ", proto=".$request{protocol_name}
|
||
. ", state=".$request{protocol_state}
|
||
. ", delay=".ts(time() - $now)."s"
|
||
. ", action=".$myaction." (item: '".$ratehit."'"
|
||
. ", type: ".$Rates{$ratehit}{$rateitem}{type}
|
||
. ", count: ".$request{ratecount}."/".$Rates{$ratehit}{$rateitem}{maxcount}
|
||
. ", time: ".ts($now - $Rates{$ratehit}{$rateitem}{"time"})."/".$Rates{$ratehit}{$rateitem}{ttl}."s)"
|
||
unless $opt_norulelog;
|
||
|
||
# check cache
|
||
} elsif ( ($REQUEST_MAX_CACHE > 0)
|
||
|
||
and ( exists($Request_Cache{$cacheid}{$COMP_ACTION}) and ($now <= $Request_Cache{$cacheid}{'until'}) ) ) {
|
||
$Counter_Hits++;
|
||
$myaction = $Request_Cache{$cacheid}{$COMP_ACTION};
|
||
if ( $Request_Cache{$cacheid}{hit} and $Request_Cache{$cacheid}{$COMP_ID}) {
|
||
map { $Matches{$_}++ } (split ';', $Request_Cache{$cacheid}{hits}) if $Request_Cache{$cacheid}{hits};
|
||
log_info "[CACHE] rule=".$Rule_by_ID{$Request_Cache{$cacheid}{$COMP_ID}}
|
||
. ", id=".$Request_Cache{$cacheid}{$COMP_ID}
|
||
. ( ($request{queue_id}) ? ", queue=".$request{queue_id} : '' )
|
||
. ", client=".$request{client_name}."[".$request{client_address}."]"
|
||
. ( ($request{sasl_username}) ? ", user=".$request{sasl_username} : '' )
|
||
. ", sender=<".(($request{sender} eq '<>') ? "" : $request{sender}).">"
|
||
. ( ($request{recipient}) ? ", recipient=<".$request{recipient}.">" : '' )
|
||
. ", helo=<".$request{helo_name}.">"
|
||
. ", proto=".$request{protocol_name}
|
||
. ", state=".$request{protocol_state}
|
||
. ", delay=".ts(time() - $now)."s"
|
||
. ", hits=".$Request_Cache{$cacheid}{hits}
|
||
. ", action=".$Request_Cache{$cacheid}{$COMP_ACTION}
|
||
unless $opt_norulelog;
|
||
};
|
||
|
||
# check rules
|
||
} else {
|
||
|
||
# refresh config if '-I' was set
|
||
read_config(0) if $opt_instantconfig;
|
||
|
||
if ($#Rules < 0) {
|
||
log_warn "critical: no rules found - i feel useless (have you set -f or -r?)";
|
||
|
||
} else {
|
||
|
||
# clean up rbl cache
|
||
if ( not($opt_nodns) and (scalar keys %DNS_Cache > 0) and (($now - $Cleanup_RBLs) > $CLEANUP_RBL_CACHE) ) {
|
||
$t1 = time();
|
||
$t3 = scalar keys %DNS_Cache;
|
||
cleanup_dns_cache($now);
|
||
$t2 = time();
|
||
log_info "[CLEANUP] needed ".ts($t2 - $t1)
|
||
." seconds for rbl cleanup of "
|
||
.($t3 - scalar keys %DNS_Cache)." out of ".$t3
|
||
." cached items after cleanup time ".$CLEANUP_RBL_CACHE."s"
|
||
if ( wantsdebug(qw[ all thisrequest verbose cleanup ]) or (($t2 - $t1) >= 1) );
|
||
$Cleanup_RBLs = $t1;
|
||
};
|
||
|
||
# prepares hit counters
|
||
$request{$COMP_MATCHES} = 0;
|
||
$request{$COMP_RBL_CNT} = 0;
|
||
$request{$COMP_RHSBL_CNT} = 0;
|
||
|
||
RULE: for ($index=0;$index<=$#Rules;$index++) {
|
||
|
||
# compare request against rule
|
||
next unless exists $Rules[$index];
|
||
($matched,$rblcnt,$rhlcnt) = compare_rule ($index, $date, %request);
|
||
|
||
# enables/overrides hit counters for later use
|
||
$request{$COMP_MATCHES} = $matched;
|
||
$request{$COMP_RBL_CNT} = $rblcnt;
|
||
$request{$COMP_RHSBL_CNT} = $rhlcnt;
|
||
|
||
# matched? prepare logline, increase counters
|
||
if ($stop = $matched > 0) {
|
||
$myaction = $Rules[$index]{$COMP_ACTION};
|
||
$Matches{$Rules[$index]{$COMP_ID}}++;
|
||
$request{$COMP_HITS} .= ';' if (defined $request{$COMP_HITS});
|
||
$request{$COMP_HITS} .= $Rules[$index]{$COMP_ID};
|
||
# substitute check for $$vars in action
|
||
$myaction = $var if ( $var = devar_item ("==",$myaction,"action",%request) );
|
||
$myline = "rule=".$index
|
||
. ", id=".$Rules[$index]{$COMP_ID}
|
||
. ( ($request{queue_id}) ? ", queue=".$request{queue_id} : '' )
|
||
. ", client=".$request{client_name}."[".$request{client_address}."]"
|
||
. ( ($request{sasl_username}) ? ", user=".$request{sasl_username} : '' )
|
||
. ", sender=<".(($request{sender} eq '<>') ? "" : $request{sender}).">"
|
||
. ( ($request{recipient}) ? ", recipient=<".$request{recipient}.">" : '' )
|
||
. ", helo=<".$request{helo_name}.">"
|
||
. ", proto=".$request{protocol_name}
|
||
. ", state=".$request{protocol_state};
|
||
|
||
# check for postfwd action
|
||
$ai = 0; # (re)set max_command_recursion counter
|
||
while ($ai++ < $max_command_recursion and $myaction =~ /^(\w[\-\w]+)\s*\(\s*(.*?)\s*\)$/) {
|
||
my($mycmd,$myarg) = ($1, $2); $stop = 0;
|
||
if (defined $postfwd_actions{$mycmd}) {
|
||
log_info "[PLUGIN] executing postfwd-action $mycmd" if (wantsdebug(qw[ all thisrequest ]));
|
||
($stop, $index, $myaction, $myline, %request) = &{$postfwd_actions{$mycmd}}($index, $now, $mycmd, $myarg, $myline, %request);
|
||
# substitute again after postfwd-actions
|
||
$myaction = $var if ( $var = devar_item ("==",$myaction,"action",%request) );
|
||
} else {
|
||
warn "[RULES] ".$myline." - error: unknown command \"".$1."\" - ignoring";
|
||
$myaction = $default_action;
|
||
};
|
||
};
|
||
|
||
if ($stop) {
|
||
$myline .= ", delay=".ts(time() - $now)."s, hits=".$request{$COMP_HITS}.", action=".$myaction;
|
||
log_info "[RULES] ".$myline unless $opt_norulelog;
|
||
last RULE;
|
||
};
|
||
} else { undef $myline; };
|
||
};
|
||
};
|
||
# update cache
|
||
if ( $REQUEST_MAX_CACHE > 0 ) {
|
||
$Request_Cache{$cacheid}{"time"} = $now;
|
||
$Request_Cache{$cacheid}{'until'} = $now + $REQUEST_MAX_CACHE;
|
||
$Request_Cache{$cacheid}{$COMP_ACTION} = $myaction;
|
||
$Request_Cache{$cacheid}{hit} = $matched;
|
||
$Request_Cache{$cacheid}{hits} = $request{$COMP_HITS};
|
||
$Request_Cache{$cacheid}{$COMP_ID} = $Rules[$index]{$COMP_ID} if ($matched > 0);
|
||
};
|
||
};
|
||
map { mylog $syslog_priority, "[DUMP] $_" } dump_cache() if (wantsdebug(qw[ all ]));
|
||
$myaction = $default_action if ($opt_test or !($myaction));
|
||
return $myaction;
|
||
};
|
||
|
||
# process delegation protocol input
|
||
sub process_input {
|
||
my($client,$msg,$attr) = @_;
|
||
# remember argument=value
|
||
if ( $msg =~ /^([^=]{1,512})=(.{0,512})/ ) {
|
||
$$attr{$1} = $2;
|
||
# evaluate request
|
||
} elsif ( $msg eq '' ) {
|
||
map { log_info "Attribute: $_=$$attr{$_}" } (keys %$attr) if (wantsdebug(qw[ all thisrequest ]));
|
||
if (defined $$attr{request}) {
|
||
if ( $$attr{request} eq "smtpd_access_policy" ) {
|
||
my $action = smtpd_access_policy(%$attr) || $default_action;
|
||
log_info "Action: $action" if (wantsdebug(qw[ all thisrequest ]));
|
||
if ($client) {
|
||
print $client ("action=$action\n\n");
|
||
} else {
|
||
print STDOUT ("action=$action\n\n");
|
||
};
|
||
$Counter_Requests++; $Counter_Interval++; %$attr = ();
|
||
delete $DEBUG{thisrequest};
|
||
} elsif ( $$attr{request} eq "dumpstats" ) {
|
||
log_info "STATS requested";
|
||
map { print $client "[STATS] $_\r\n" } list_stats();
|
||
close($client);
|
||
} elsif ( $$attr{request} eq "dumpcache" ) {
|
||
log_info "DUMP requested";
|
||
map { print $client "$_\r\n" } dump_cache();
|
||
close($client);
|
||
} elsif ( $$attr{request} =~ /^delrate (.*)$/ ) {
|
||
my $del = $1; $del =~ s/^[%]?//g;
|
||
if (defined $Rates{$del}) {
|
||
log_note "rate cache item '$del' removed";
|
||
print $client "rate cache item '$del' removed\r\n";
|
||
delete $Rates{$del};
|
||
} else {
|
||
log_note "rate cache removal of '$del' failed: item not found";
|
||
print $client "rate cache removal of '$del' failed: item not found\r\n";
|
||
};
|
||
close($client);
|
||
} elsif ( $$attr{request} =~ /^delcache (.*)$/ ) {
|
||
my $del = $1; $del =~ s/^[%]?//g;
|
||
if (defined $Request_Cache{$del}) {
|
||
log_note "request cache item '$del' removed";
|
||
print $client "request cache item '$del' removed\r\n";
|
||
delete $Request_Cache{$del};
|
||
} else {
|
||
log_note "request cache removal of '$del' failed: item not found";
|
||
print $client "request cache removal of '$del' failed: item not found\r\n";
|
||
};
|
||
close($client);
|
||
} else {
|
||
log_warn "Ignoring unrecognized request type: '".((defined $$attr{request}) ? substr($$attr{request},0,100) : '')."'";
|
||
};
|
||
};
|
||
# unknown command
|
||
} else {
|
||
log_warn "Ignoring garbage '".substr($msg, 0, 100)."'";
|
||
};
|
||
};
|
||
|
||
|
||
#### MAIN ####
|
||
|
||
# parse command-line
|
||
GetOptions ( "term|kill|stop|k" => \$opt_kill,
|
||
"hup|reload" => \$opt_hup,
|
||
't|test' => \$opt_test,
|
||
'v|verbose' => sub { $opt_verbose++ },
|
||
'debug=s' => sub { push @DEBUGLIST, (split /[,\s]+/, $_[1]) },
|
||
'l|logname=s' => \$syslog_name,
|
||
'facility=s' => \$syslog_facility,
|
||
'socktype=s' => \$syslog_socktype,
|
||
'loglen=i' => \$syslog_maxlen,
|
||
'n|nodns' => \$opt_nodns,
|
||
'nodnslog' => \$opt_nodnslog,
|
||
'no-dnslog' => \$opt_nodnslog,
|
||
'norulelog' => \$opt_norulelog,
|
||
'no-rulelog' => \$opt_norulelog,
|
||
'shortlog' => \$opt_shortlog, # for compatibility
|
||
'd|daemon!' => \$opt_daemon,
|
||
'I|instantcfg' => \$opt_instantconfig,
|
||
'P|perfmon' => \$opt_perfmon,
|
||
'L|stdoutlog' => \$opt_stdoutlog,
|
||
'i|interface=s' => \$net_interface,
|
||
'p|port=s' => \$net_port,
|
||
'proto=s' => \$net_proto,
|
||
'R|chroot=s' => \$net_chroot,
|
||
'pid|pidfile=s' => \$net_pid,
|
||
'umask=s' => \$net_umask,
|
||
'u|user=s' => \$net_user,
|
||
'g|group=s' => \$net_group,
|
||
'dns_queuesize=s' => \$dns_queuesize,
|
||
'dns_retries=i' => \$dns_retries,
|
||
'dns_timeout=i' => \$dns_timeout,
|
||
'dns_timeout_max=i' => \$MAX_DNSBL_TIMEOUTS,
|
||
'dns_timeout_interval=i' => \$MAX_DNSBL_INTERVAL,
|
||
'dns_async_txt' => \$dns_async_txt,
|
||
'dns_max_ns_lookups=i' => \$opt_max_ns_lookups,
|
||
'dns_max_mx_lookups=i' => \$opt_max_mx_lookups,
|
||
'c|cache=i' => \$REQUEST_MAX_CACHE,
|
||
'cacheid=s' => sub { @CacheID = ( @CacheID, (split /[,\s]+/, $_[1]) ) },
|
||
'cache-rdomain-only' => \$opt_cache_rdomain_only,
|
||
'cache-no-sender' => \$opt_cache_no_sender,
|
||
'cache-no-size' => \$opt_cache_no_size,
|
||
'cache-rbl-timeout=i' => \$RBL_MAX_CACHE,
|
||
'cache-rbl-default=s' => \$RBL_DEFAULT,
|
||
'cleanup-requests=i' => \$CLEANUP_REQUEST_CACHE,
|
||
'cleanup-rbls=i' => \$CLEANUP_RBL_CACHE,
|
||
'cleanup-rates=i' => \$CLEANUP_RATE_CACHE,
|
||
'S|summary:i' => \$opt_summary,
|
||
'norulestats' => \$opt_no_rulestats,
|
||
'no-rulestats' => \$opt_no_rulestats,
|
||
'noidlestats' => \$opt_noidlestats,
|
||
'no-idlestats' => \$opt_noidlestats,
|
||
's|scores=s' => \%opt_scores,
|
||
'config_timeout=i' => \$config_timeout,
|
||
'keep_rates|keep_limits|keep_rates_on_reload' => \$opt_keep_rates_on_reload,
|
||
'save_rates|save_limits|save_rates_on_restart=s' => \$opt_saverates,
|
||
'fast_limit_evaluation' => \$opt_fast_limits,
|
||
'dumpcache' => \$opt_dumpcache,
|
||
'dumpstats' => \$opt_dumpstats,
|
||
'delcache=s' => \$opt_delcache,
|
||
'delrate=s' => \$opt_delrate,
|
||
'f|file=s' => sub{ my($opt,$value) = @_; push (@Configs, $opt.'::'.$value) },
|
||
'r|rule=s' => sub{ my($opt,$value) = @_; push (@Configs, $opt.'::'.$value) },
|
||
'plugins=s' => \@Plugins,
|
||
'V|version' => sub{ print "$NAME $VERSION (Net::DNS ".(Net::DNS->VERSION || '<undef>').", Net::Server ".(Net::Server->VERSION || '<undef>').", Sys::Syslog ".($Sys::Syslog::VERSION || '<undef>').", ".((defined Time::HiRes->VERSION) ? "Time::HiRes ".(Time::HiRes->VERSION || '<undef>').", " : '').(($STORABLE) ? "Storable $STORABLE, " : '')."Perl ".$]." on ".$^O.")\n"; exit 1; },
|
||
'versionshort|shortversion' => sub{ print "$VERSION\n"; exit 1; },
|
||
'C|showconfig' => \$opt_showconfig,
|
||
'h|H|?|help|Help|HELP' => sub{ pod2usage (-msg => "\nPlease see \"".$NAME." -m\" for detailed instructions.\n", -verbose => 1); },
|
||
'm|M|manual' => sub{ # contructing command string (de-tainting $0)
|
||
$cmd_manual .= ($0 =~ /^([-\@\/\w. ]+)$/) ? " \"".$1 : " \"".$NAME;
|
||
$cmd_manual .= "\" | ".$cmd_pager;
|
||
exec_cmd ($cmd_manual); exit 1; },
|
||
) or pod2usage (-msg => "\nPlease see \"".$NAME." -m\" for detailed instructions.\n", -verbose => 1);
|
||
|
||
$opt_verbose = 0 unless $opt_verbose;
|
||
$opt_stdoutlog = 1 if ($opt_kill or $opt_hup or $opt_showconfig or $opt_dumpcache or $opt_dumpstats);
|
||
if ($opt_verbose) {
|
||
push @DEBUGLIST, 'verbose';
|
||
push @DEBUGLIST, 'all ' if ($opt_verbose > 1);
|
||
};
|
||
map { $DEBUG{$_} = 1 } uniq(@DEBUGLIST);
|
||
|
||
# terminate at -k or --kill
|
||
if ($opt_kill) {
|
||
kill "TERM", get_master_pid();
|
||
exit (0);
|
||
# reload at --reload
|
||
} elsif ($opt_hup) {
|
||
kill "HUP", get_master_pid();
|
||
exit (0);
|
||
};
|
||
|
||
# check for Storable module
|
||
if ( not($STORABLE) and $opt_saverates ) {
|
||
print STDERR "Perl module 'Storable' required to load and save rate limits!\n";
|
||
exit(1);
|
||
};
|
||
|
||
# init syslog
|
||
setlogsock $syslog_socktype;
|
||
$syslog_options = 'cons,pid' unless $opt_daemon;
|
||
openlog $syslog_name, $syslog_options, $syslog_facility;
|
||
|
||
log_note $NAME." ".$VERSION." starting" if $opt_daemon;
|
||
log_note "Net::DNS ".(Net::DNS->VERSION || '<undef>').", Net::Server ".(Net::Server->VERSION || '<undef>').", Sys::Syslog ".($Sys::Syslog::VERSION || '<undef>').", Perl ".$]." on ".$^O if (wantsdebug(qw[ all verbose ]));
|
||
|
||
# query usage statistics
|
||
if ($opt_dumpstats) {
|
||
$net_interface ||= $def_net_interface; $net_port ||= $def_net_port;
|
||
my $prevalert = undef;
|
||
eval {
|
||
local $SIG{'__DIE__'};
|
||
local $SIG{'ALRM'} = sub { print STDERR "\nTimeout for socket $net_interface:$net_port after 60 seconds\n\n"; die };
|
||
$prevalert = alarm(60);
|
||
if ( my $socket = new IO::Socket::INET (
|
||
PeerAddr => $net_interface,
|
||
PeerPort => $net_port,
|
||
Proto => 'tcp',
|
||
Timeout => 10,
|
||
Type => SOCK_STREAM ) ) {
|
||
print $socket "request=dumpstats\r\n\r\n";
|
||
print "\n"; map { print } (<$socket>); print "\n";
|
||
close($socket);
|
||
} else {
|
||
print STDERR "\nERROR: can not open socket to $net_interface:$net_port\n\n";
|
||
};
|
||
};
|
||
alarm($prevalert);
|
||
exit 1;
|
||
};
|
||
|
||
# query cache contents
|
||
if ($opt_dumpcache) {
|
||
$net_interface ||= $def_net_interface; $net_port ||= $def_net_port;
|
||
my $prevalert = undef;
|
||
eval {
|
||
local $SIG{'__DIE__'};
|
||
local $SIG{'ALRM'} = sub { print STDERR "\nTimeout for socket $net_interface:$net_port after 60 seconds\n\n"; die };
|
||
$prevalert = alarm(60);
|
||
if ( my $socket = new IO::Socket::INET (
|
||
PeerAddr => $net_interface,
|
||
PeerPort => $net_port,
|
||
Proto => 'tcp',
|
||
Timeout => 10,
|
||
Type => SOCK_STREAM ) ) {
|
||
print $socket "request=dumpcache\r\n\r\n";
|
||
print "\n"; map { print } (<$socket>); print "\n";
|
||
close($socket);
|
||
} else {
|
||
print STDERR "\nERROR: can not open socket to $net_interface:$net_port\n\n";
|
||
};
|
||
};
|
||
alarm($prevalert);
|
||
exit 1;
|
||
};
|
||
|
||
# remove cache item
|
||
if ($opt_delcache or $opt_delrate) {
|
||
$net_interface ||= $def_net_interface; $net_port ||= $def_net_port;
|
||
my $prevalert = undef;
|
||
eval {
|
||
local $SIG{'__DIE__'};
|
||
local $SIG{'ALRM'} = sub { print STDERR "\nTimeout for socket $net_interface:$net_port after 60 seconds\n\n"; die };
|
||
$prevalert = alarm(60);
|
||
if ( my $socket = new IO::Socket::INET (
|
||
PeerAddr => $net_interface,
|
||
PeerPort => $net_port,
|
||
Proto => 'tcp',
|
||
Timeout => 10,
|
||
Type => SOCK_STREAM ) ) {
|
||
print $socket "request=".(($opt_delcache) ? "delcache ".$opt_delcache : "delrate ".$opt_delrate)."\r\n\r\n";
|
||
print "\n"; map { print } (<$socket>); print "\n";
|
||
close($socket);
|
||
} else {
|
||
print STDERR "\nERROR: can not open socket to $net_interface:$net_port\n\n";
|
||
};
|
||
};
|
||
alarm($prevalert);
|
||
exit 1;
|
||
};
|
||
|
||
# read configuration
|
||
read_config(1);
|
||
if ($opt_showconfig) {
|
||
show_config;
|
||
exit 1;
|
||
};
|
||
|
||
# check modes
|
||
log_note "TESTMODE: set - will return ".$default_action." to all requests" if ($opt_test);
|
||
if (wantsdebug(qw[ all verbose ])) {
|
||
$opt_summary ||= $Stat_Interval_Time;
|
||
log_note "VERBOSE: set";
|
||
};
|
||
|
||
# -n - skip dns based checks
|
||
log_note "NODNS: set - will skip all dns based checks" if $opt_nodns;
|
||
|
||
# set max lookups to default (set to 0 to disable)
|
||
$opt_max_ns_lookups = $def_dns_max_ns_a_lookups unless defined $opt_max_ns_lookups;
|
||
$opt_max_mx_lookups = $def_dns_max_mx_a_lookups unless defined $opt_max_mx_lookups;
|
||
|
||
# init scores from command-line
|
||
map ( modify_score (each %opt_scores), (keys %opt_scores) );
|
||
|
||
# get summary interval time, set next display time
|
||
$Stat_Interval_Time = $opt_summary if $opt_summary;
|
||
$Cleanup_Timeouts = $Cleanup_Requests = $Cleanup_RBLs = $Cleanup_Rates = $Starttime = time();
|
||
log_info "Overriding cacheid itemlist with: ".(join ",", @CacheID) if ( @CacheID );
|
||
|
||
# load plugin-items
|
||
get_plugins (@Plugins) if @Plugins;
|
||
|
||
# de-taint arguments
|
||
$net_interface ||= $def_net_interface;
|
||
$net_port ||= $def_net_port;
|
||
$net_proto ||= $def_net_proto;
|
||
$net_umask ||= $def_net_umask;
|
||
$net_user ||= $def_net_user;
|
||
$net_group ||= $def_net_group;
|
||
$net_chroot ||= $def_net_chroot;
|
||
$net_pid ||= $def_net_pid;
|
||
$dns_queuesize ||= $def_dns_queuesize;
|
||
$dns_retries ||= $def_dns_retries;
|
||
$dns_timeout ||= $def_dns_timeout;
|
||
$config_timeout ||= $def_config_timeout;
|
||
$syslog_name ||= $NAME;
|
||
$net_interface = ( $net_interface =~ /^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/ ) ? $1 : $def_net_interface;
|
||
$net_port = ( $net_port =~ /^(\d+|[-\|\@\/\w. ]+)$/ ) ? $1 : $def_net_port;
|
||
$net_proto = ( $net_proto =~ /^(tcp|unix)$/i ) ? $1 : $def_net_proto;
|
||
$net_umask = ( $net_umask =~ /^([0-7]+)$/ ) ? $1 : $def_net_umask;
|
||
$net_user = ( $net_user =~ /^([\w]+)$/ ) ? $1 : $def_net_user;
|
||
$net_group = ( $net_group =~ /^([\w]+)$/ ) ? $1 : $def_net_group;
|
||
$net_chroot = ( $net_chroot =~ /^(.+)$/ ) ? $1 : $def_net_chroot;
|
||
$net_pid = ( $net_pid =~ /^([-\@\/\w. ]+)$/ ) ? $1 : $def_net_pid;
|
||
$dns_queuesize = ( $dns_queuesize =~ /^(\d+)$/ ) ? $1 : $dns_queuesize;
|
||
$dns_retries = ( $dns_retries =~ /^(\d+)$/ ) ? $1 : $dns_retries;
|
||
$dns_timeout = ( $dns_timeout =~ /^(\d+)$/ ) ? $1 : $dns_timeout;
|
||
$syslog_name = ( $syslog_name =~ /^(.+)$/ ) ? $1 : $NAME;
|
||
$config_timeout = ( $config_timeout =~ /^(\d+)$/ ) ? $1 : $def_config_timeout;
|
||
$opt_saverates = ( $opt_saverates =~ /^([-\|\@\/\w. ]+)$/ ) ? $1 : '' if $opt_saverates;
|
||
|
||
# load rate items
|
||
load_rates();
|
||
|
||
# Unbuffer standard output.
|
||
select((select(STDOUT), $| = 1)[0]);
|
||
|
||
if ($opt_daemon) {
|
||
#
|
||
# Networking
|
||
#
|
||
# The networking part is implemented as non-forking server. It handles multiple client
|
||
# connections via non-blocking sockets using queueing via IO::Multiplex.
|
||
# Please check http://search.cpan.org/dist/Net-Server/lib/Net/Server/Multiplex.pm for info.
|
||
#
|
||
|
||
# create server object
|
||
my $server = bless {
|
||
server => {
|
||
commandline => [$0, @CommandArgs],
|
||
# Net::Server dies when a unix domain socket without dot (".") is used
|
||
port => (($net_proto eq 'unix') and not($net_port =~ /\|unix$/)) ? "$net_port|unix" : $net_port,
|
||
host => ($net_proto eq 'unix') ? '' : $net_interface,
|
||
proto => $net_proto,
|
||
user => $net_user,
|
||
group => $net_group,
|
||
chroot => $net_chroot ? $net_chroot : undef,
|
||
setsid => $opt_daemon ? 1 : undef,
|
||
pid_file => $net_pid ? $net_pid : undef,
|
||
log_level => $opt_perfmon ? 0 : ($opt_verbose + 2),
|
||
log_file => $opt_perfmon ? undef : 'Sys::Syslog',
|
||
syslog_logsock => $syslog_socktype,
|
||
syslog_facility => $syslog_facility,
|
||
syslog_ident => $syslog_name,
|
||
},
|
||
}, 'postfwd';
|
||
|
||
## run the servers main loop
|
||
umask oct($net_umask);
|
||
$server->run;
|
||
|
||
# ignore syslog failures
|
||
sub handle_syslog_error {};
|
||
|
||
# set $Reload_Conf marker on HUP signal
|
||
# does not call read_config directly, to avoid
|
||
# possible race conditions when caches are cleared
|
||
sub sig_hup () {
|
||
log_note "catched HUP signal - reloading ruleset on next request";
|
||
$Reload_Conf = 1;
|
||
};
|
||
|
||
# show stats on exit
|
||
sub pre_server_close_hook() {
|
||
log_note "terminating..." if $opt_summary;
|
||
end_program;
|
||
};
|
||
|
||
# init
|
||
sub pre_loop_hook() {
|
||
|
||
# install signal handlers
|
||
$SIG{__WARN__} = sub { log_crit "warning - \"@_\""; };
|
||
$SIG{__DIE__} = sub { fatal_exit "last err: \"$!\", detail: \"@_\""; };
|
||
$SIG{ALRM} = sub { show_stats; alarm ($Stat_Interval_Time); } if $opt_summary;
|
||
log_info "successfully installed signal handlers" if wantsdebug(qw[ all verbose ]);
|
||
|
||
# process init
|
||
umask oct($net_umask);
|
||
setlocale(LC_ALL, 'C');
|
||
$0 = $0." ".join(" ",@CommandArgs);
|
||
chdir "/" or fatal_exit "Could not chdir to /";
|
||
|
||
# set first status interval time
|
||
if ($opt_summary) {
|
||
alarm ($Stat_Interval_Time);
|
||
log_info "Setting status interval to $Stat_Interval_Time seconds";
|
||
};
|
||
|
||
# let's go
|
||
log_info "$NAME $VERSION ready for input";
|
||
};
|
||
|
||
# main loop
|
||
sub mux_input() {
|
||
|
||
my ($self, $mux, $client, $mydata) = @_;
|
||
my ($request,$answer) = undef;
|
||
my (%myattr) = ();
|
||
|
||
# check request and print output
|
||
while ( $$mydata =~ s/^([^\r\n]*)\r?\n// ) {
|
||
# check request line and print output
|
||
next unless defined $1;
|
||
$request = $1;
|
||
process_input ($client, $request, \%myattr);
|
||
};
|
||
};
|
||
|
||
} else {
|
||
|
||
# main loop for command line use
|
||
# regexp is used to keep it similar to the server main loop
|
||
my($request,$answer) = undef;
|
||
my (%myattr) = ();
|
||
while (<>) {
|
||
# check request and print output
|
||
s/^([^\r\n]*)\r?\n//;
|
||
next unless defined $1;
|
||
$request = $1;
|
||
process_input (undef, $request, \%myattr);
|
||
};
|
||
|
||
# finishing
|
||
end_program;
|
||
};
|
||
|
||
die "should never see me...";
|
||
## EOF
|
||
|
||
__END__
|
||
|
||
=head1 NAME
|
||
|
||
postfwd - postfix firewall daemon
|
||
|
||
=head1 SYNOPSIS
|
||
|
||
postfwd [OPTIONS] [SOURCE1, SOURCE2, ...]
|
||
|
||
Ruleset: (at least one, multiple use is allowed):
|
||
-f, --file <file> reads rules from <file>
|
||
-r, --rule <rule> adds <rule> to config
|
||
|
||
Scoring:
|
||
-s, --scores <v>=<r> returns <r> when score exceeds <v>
|
||
|
||
Control:
|
||
-d, --daemon run postfwd as daemon
|
||
-k, --kill stops daemon
|
||
--reload reloads configuration
|
||
--dumpstats displays usage statistics
|
||
--dumpcache displays cache contents
|
||
--delcache <item> removes an item from the request cache
|
||
--delrate <item> removes an item from the rate cache
|
||
|
||
Networking:
|
||
-i, --interface <dev> listen on interface <dev>
|
||
-p, --port <port> listen on port <port>
|
||
--proto <proto> socket type (tcp or unix)
|
||
-u, --user <name> set uid to user <name>
|
||
-g, --group <name> set gid to group <name>
|
||
--umask <mask> set umask for file permissions
|
||
-R, --chroot <path> chroot the daemon to <path>
|
||
--pidfile <path> create pidfile under <path>
|
||
--facility <f> syslog facility
|
||
--socktype <s> syslog socktype
|
||
-l, --logname <label> label for syslog messages
|
||
--loglen <int> truncates syslogs after <int> chars
|
||
|
||
Caching:
|
||
-c, --cache <int> sets the request-cache timeout to <int> seconds
|
||
--cache-no-size ignores size attribute for caching
|
||
--cache-no-sender ignores sender address in cache
|
||
--cache-rdomain-only ignores localpart of recipient address in cache
|
||
--cache-rbl-timeout default rbl timeout, if not specified in ruleset
|
||
--cache-rbl-default default rbl response pattern to match (regexp)
|
||
--cacheid <item>, .. list of attributes for request cache identifier
|
||
--cleanup-requests cleanup interval in seconds for request cache
|
||
--cleanup-rbls cleanup interval in seconds for rbl cache
|
||
--cleanup-rates cleanup interval in seconds for rate cache
|
||
|
||
Optional:
|
||
-t, --test testing, always returns "dunno"
|
||
-v, --verbose verbose logging, use twice (-vv) to increase level
|
||
-S, --summary <int> show some usage statistics every <int> seconds
|
||
--norulelog disbles rule logging
|
||
--norulestats disables per rule statistics
|
||
--noidlestats disables statistics when idle
|
||
-n, --nodns disable dns
|
||
--nodnslog disable dns logging
|
||
--dns_async_txt perform dnsbl A and TXT lookups simultaneously
|
||
--dns_timeout timeout in seconds for asynchonous dns queries
|
||
--dns_timeout_max maximum of dns timeouts until a dnsbl will be deactivated
|
||
--dns_timeout_interval interval in seconds for dns timeout maximum counter
|
||
--dns_max_ns_lookups max names to look up with sender_ns_addrs
|
||
--dns_max_mx_lookups max names to look up with sender_mx_addrs
|
||
-I, --instantcfg re-reads rulefiles for every new request
|
||
--config_timeout <i> parser timeout in seconds
|
||
--keep_rates do not clear rate limit counters on reload
|
||
--save_rates <file> save and load rate limits on disk
|
||
--fast_limit_evaluation evaluate rate limits before ruleset is parsed
|
||
(please note the limitations)
|
||
|
||
Plugins:
|
||
--plugins <file> loads postfwd plugins from file
|
||
|
||
Informational (use only at command-line!):
|
||
-C, --showconfig shows ruleset summary, -v for verbose
|
||
-L, --stdoutlog redirect syslog messages to stdout
|
||
-P, --perfmon no syslogging, no stdout
|
||
-V, --version shows program version
|
||
-h, --help shows usage
|
||
-m, --manual shows program manual
|
||
|
||
|
||
=head1 DESCRIPTION
|
||
|
||
|
||
=head2 INTRODUCTION
|
||
|
||
postfwd is written to combine complex postfix restrictions in a ruleset similar to those of the most firewalls.
|
||
The program uses the postfix policy delegation protocol to control access to the mail system before a message
|
||
has been accepted (please visit L<http://www.postfix.org/SMTPD_POLICY_README.html> for more information).
|
||
|
||
postfwd allows you to choose an action (e.g. reject, dunno) for a combination of several smtp parameters
|
||
(like sender and recipient address, size or the client's TLS fingerprint). Also it offers simple macros/acls
|
||
which should allow straightforward and easy-to-read configurations.
|
||
|
||
I<Features:>
|
||
|
||
* Complex combinations of smtp parameters
|
||
|
||
* Combined RBL/RHSBL lookups with arbitrary actions depending on results
|
||
|
||
* Scoring system
|
||
|
||
* Date/time based rules
|
||
|
||
* Macros/ACLs, Groups, Negation
|
||
|
||
* Compare request attributes (e.g. client_name and helo_name)
|
||
|
||
* Internal caching for requests and dns lookups
|
||
|
||
* Built in statistics for rule efficiency analysis
|
||
|
||
|
||
=head2 CONFIGURATION
|
||
|
||
A configuration line consists of optional item=value pairs, separated by semicolons
|
||
(`;`) and the appropriate desired action:
|
||
|
||
[ <item1>=<value>; <item2>=<value>; ... ] action=<result>
|
||
|
||
I<Example:>
|
||
|
||
client_address=192.168.1.1 ; sender==no@bad.local ; action=REJECT
|
||
|
||
This will deny all mail from 192.168.1.1 with envelope sender no@bad.local. The order of the elements
|
||
is not important. So the following would lead to the same result as the previous example:
|
||
|
||
action=REJECT ; client_address=192.168.1.1 ; sender==no@bad.local
|
||
|
||
The way how request items are compared to the ruleset can be influenced in the following way:
|
||
|
||
====================================================================
|
||
ITEM == VALUE true if ITEM equals VALUE
|
||
ITEM => VALUE true if ITEM >= VALUE
|
||
ITEM =< VALUE true if ITEM <= VALUE
|
||
ITEM > VALUE true if ITEM > VALUE
|
||
ITEM < VALUE true if ITEM < VALUE
|
||
ITEM =~ VALUE true if ITEM ~= /^VALUE$/i
|
||
ITEM != VALUE false if ITEM equals VALUE
|
||
ITEM !> VALUE false if ITEM >= VALUE
|
||
ITEM !< VALUE false if ITEM <= VALUE
|
||
ITEM !~ VALUE false if ITEM ~= /^VALUE$/i
|
||
ITEM = VALUE default behaviour (see ITEMS section)
|
||
====================================================================
|
||
|
||
To identify single rules in your log files, you may add an unique identifier for each of it:
|
||
|
||
id=R_001 ; action=REJECT ; client_address=192.168.1.1 ; sender==no@bad.local
|
||
|
||
You may use these identifiers as target for the `jump()` command (see ACTIONS section below). Leading
|
||
or trailing whitespace characters will be ignored. Use '#' to comment your configuration. Others will
|
||
appreciate.
|
||
|
||
A ruleset consists of one or multiple rules, which can be loaded from files or passed as command line
|
||
arguments. Please see the COMMAND LINE section below for more information on this topic.
|
||
|
||
Since postfwd version 1.30 rules spanning span multiple lines can be defined by prefixing the following
|
||
lines with one or multiple whitespace characters (or '}' for macros):
|
||
|
||
id=RULE001
|
||
client_address=192.168.1.0/24
|
||
sender==no@bad.local
|
||
action=REJECT no access
|
||
|
||
postfwd versions prior to 1.30 require trailing ';' and '\'-characters:
|
||
|
||
id=RULE001; \
|
||
client_address=192.168.1.0/24; \
|
||
sender==no@bad.local; \
|
||
action=REJECT no access
|
||
|
||
|
||
=head2 ITEMS
|
||
|
||
id - a unique rule id, which can be used for log analysis
|
||
ids also serve as targets for the "jump" command.
|
||
|
||
date, time - a time or date range within the specified rule shall hit
|
||
# FORMAT:
|
||
# Feb, 29th
|
||
date=29.02.2008
|
||
# Dec, 24th - 26th
|
||
date=24.12.2008-26.12.2008
|
||
# from today until Nov, 23rd
|
||
date=-23.09.2008
|
||
# from April, 1st until today
|
||
date=01.04.2008-
|
||
|
||
days, months - a range of weekdays (Sun-Sat) or months (Jan-Dec)
|
||
within the specified rule shall hit
|
||
|
||
score - when the specified score is hit (see ACTIONS section)
|
||
the specified action will be returned to postfix
|
||
scores are set global until redefined!
|
||
|
||
request_score - this value allows to access a request's score. it
|
||
may be used as variable ($$request_score).
|
||
|
||
rbl, rhsbl, - query the specified RBLs/RHSBLs, possible values are:
|
||
rhsbl_client, <name>[/<reply>/<maxcache>, <name>/<reply>/<maxcache>]
|
||
rhsbl_sender, (defaults: reply=^127\.0\.0\.\d+$ maxcache=3600)
|
||
rhsbl_reverse_client the results of all rhsbl_* queries will be combined
|
||
in rhsbl_count (see below).
|
||
|
||
rblcount, rhsblcount - minimum RBL/RHSBL hitcounts to match. if not specified
|
||
a single RBL/RHSBL hit will match the rbl/rhsbl items.
|
||
you may specify 'all' to evaluate all items, and use
|
||
it as variable in an action (see ACTIONS section)
|
||
(default: 1)
|
||
|
||
sender_localpart, - the local-/domainpart of the sender address
|
||
sender_domain
|
||
|
||
recipient_localpart, - the local-/domainpart of the recipient address
|
||
recipient_domain
|
||
|
||
helo_address - postfwd tries to look up the helo_name. use
|
||
helo_address=!!(0.0.0.0/0) to check for unknown.
|
||
Please do not use this for positive access control
|
||
(whitelisting), as it might be forged.
|
||
|
||
sender_ns_names, - postfwd tries to look up the names/ip addresses
|
||
sender_ns_addrs of the nameservers for the sender domain part.
|
||
Please do not use this for positive access control
|
||
(whitelisting), as it might be forged.
|
||
|
||
sender_mx_names, - postfwd tries to look up the names/ip addresses
|
||
sender_mx_addrs of the mx records for the sender domain part.
|
||
Please do not use this for positive access control
|
||
(whitelisting), as it might be forged.
|
||
|
||
version - postfwd version, contains "postfwd n.nn"
|
||
this enables version based checks in your rulesets
|
||
(e.g. for migration). works with old versions too,
|
||
because a non-existing item always returns false:
|
||
# version >= 1.10
|
||
id=R01; version~=1\.[1-9][0-9]; sender_domain==some.org \
|
||
; action=REJECT sorry no access
|
||
|
||
ratecount - only available for rate(), size() and rcpt() actions.
|
||
contains the actual limit counter:
|
||
id=R01; action=rate(sender/200/600/REJECT limit of 200 exceeded [$$ratecount hits])
|
||
id=R02; action=rate(sender/100/600/WARN limit of 100 exceeded [$$ratecount hits])
|
||
|
||
Besides these you can specify any attribute of the postfix policy delegation protocol.
|
||
Feel free to combine them the way you need it (have a look at the EXAMPLES section below).
|
||
|
||
Most values can be specified as regular expressions (PCRE). Please see the table below
|
||
for details:
|
||
|
||
# ==========================================================
|
||
# ITEM=VALUE TYPE
|
||
# ==========================================================
|
||
id=something mask = string
|
||
date=01.04.2007-22.04.2007 mask = date (DD.MM.YYYY-DD.MM.YYYY)
|
||
time=08:30:00-17:00:00 mask = time (HH:MM:SS-HH:MM:SS)
|
||
days=Mon-Wed mask = weekdays (Mon-Wed) or numeric (1-3)
|
||
months=Feb-Apr mask = months (Feb-Apr) or numeric (1-3)
|
||
score=5.0 mask = maximum floating point value
|
||
rbl=zen.spamhaus.org mask = <name>/<reply>/<maxcache>[,...]
|
||
rblcount=2 mask = numeric, will match if rbl hits >= 2
|
||
helo_address=<a.b.c.d/nn> mask = CIDR[,CIDR,...]
|
||
sender_ns_names=some.domain.tld mask = PCRE
|
||
sender_mx_names=some.domain.tld mask = PCRE
|
||
sender_ns_addrs=<a.b.c.d/nn> mask = CIDR[,CIDR,...]
|
||
sender_mx_addrs=<a.b.c.d/nn> mask = CIDR[,CIDR,...]
|
||
# ------------------------------
|
||
# Postfix version 2.1 and later:
|
||
# ------------------------------
|
||
client_address=<a.b.c.d/nn> mask = CIDR[,CIDR,...]
|
||
client_name=another.domain.tld mask = PCRE
|
||
reverse_client_name=another.domain.tld mask = PCRE
|
||
helo_name=some.domain.tld mask = PCRE
|
||
sender=foo@bar.tld mask = PCRE
|
||
recipient=bar@foo.tld mask = PCRE
|
||
recipient_count=5 mask = numeric, will match if recipients >= 5
|
||
# ------------------------------
|
||
# Postfix version 2.2 and later:
|
||
# ------------------------------
|
||
sasl_method=plain mask = PCRE
|
||
sasl_username=you mask = PCRE
|
||
sasl_sender= mask = PCRE
|
||
size=12345 mask = numeric, will match if size >= 12345
|
||
ccert_subject=blackhole.nowhere.local mask = PCRE (only if tls verified)
|
||
ccert_issuer=John+20Doe mask = PCRE (only if tls verified)
|
||
ccert_fingerprint=AA:BB:CC:DD:EE:... mask = PCRE (do NOT use "..." here)
|
||
# ------------------------------
|
||
# Postfix version 2.3 and later:
|
||
# ------------------------------
|
||
encryption_protocol=TLSv1/SSLv3 mask = PCRE
|
||
encryption_cipher=DHE-RSA-AES256-SHA mask = PCRE
|
||
encryption_keysize=256 mask = numeric, will match if keysize >= 256
|
||
...
|
||
|
||
the current list can be found at L<http://www.postfix.org/SMTPD_POLICY_README.html>. Please read carefully about which
|
||
attribute can be used at which level of the smtp transaction (e.g. size will only work reliably at END-OF-MESSAGE level).
|
||
Pattern matching is performed case insensitive.
|
||
|
||
Multiple use of the same item is allowed and will compared as logical OR, which means that this will work as expected:
|
||
|
||
id=TRUST001; action=OK; encryption_keysize=64
|
||
ccert_fingerprint=11:22:33:44:55:66:77:88:99
|
||
ccert_fingerprint=22:33:44:55:66:77:88:99:00
|
||
ccert_fingerprint=33:44:55:66:77:88:99:00:11
|
||
sender=@domain\.local$
|
||
|
||
client_address, rbl and rhsbl items may also be specified as whitespace-or-comma-separated values:
|
||
|
||
id=SKIP01; action=dunno
|
||
client_address=192.168.1.0/24, 172.16.254.23
|
||
id=SKIP02; action=dunno
|
||
client_address=10.10.3.32 10.216.222.0/27
|
||
|
||
The following items currently have to be unique:
|
||
|
||
id, minimum and maximum values, rblcount and rhsblcount
|
||
|
||
Any item can be negated by preceeding '!!' to it, e.g.:
|
||
|
||
id=HOST001 ; hostname == !!secure.trust.local ; action=REJECT only secure.trust.local please
|
||
|
||
or using the right compare operator:
|
||
|
||
id=HOST001 ; hostname != secure.trust.local ; action=REJECT only secure.trust.local please
|
||
|
||
To avoid confusion with regexps or simply for better visibility you can use '!!(...)':
|
||
|
||
id=USER01 ; sasl_username = !!( (bob|alice) ) ; action=REJECT who is that?
|
||
|
||
Request attributes can be compared by preceeding '$$' characters, e.g.:
|
||
|
||
id=R-003 ; client_name = !! $$helo_name ; action=WARN helo does not match DNS
|
||
# or
|
||
id=R-003 ; client_name = !!($$(helo_name)) ; action=WARN helo does not match DNS
|
||
|
||
This is only valid for PCRE values (see list above). The comparison will be performed as case insensitive exact match.
|
||
Use the '-vv' option to debug.
|
||
|
||
These special items will be reset for any new rule:
|
||
|
||
rblcount - contains the number of RBL answers
|
||
rhsblcount - contains the number of RHSBL answers
|
||
matches - contains the number of matched items
|
||
dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
|
||
rbltype:rblname:<txt>; rbltype:rblname:<txt>; ...
|
||
|
||
These special items will be changed for any matching rule:
|
||
|
||
request_hits - contains ids of all matching rules
|
||
|
||
This means that it might be necessary to save them, if you plan to use these values in later rules:
|
||
|
||
# set vals
|
||
id=RBL01 ; rhsblcount=all; rblcount=all
|
||
action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
|
||
rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org
|
||
rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
|
||
rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
|
||
|
||
# compare
|
||
id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
|
||
id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
|
||
id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
|
||
|
||
|
||
=head2 FILES
|
||
|
||
Since postfwd1 v1.15 and postfwd2 v0.18 long item lists can be stored in separate files:
|
||
|
||
id=R001 ; ccert_fingerprint==file:/etc/postfwd/wl_ccerts ; action=DUNNO
|
||
|
||
postfwd will read a list of items (one item per line) from /etc/postfwd/wl_ccerts. comments are allowed:
|
||
|
||
# client1
|
||
11:22:33:44:55:66:77:88:99
|
||
# client2
|
||
22:33:44:55:66:77:88:99:00
|
||
# client3
|
||
33:44:55:66:77:88:99:00:11
|
||
|
||
To use existing tables in key=value format, you can use:
|
||
|
||
id=R001 ; ccert_fingerprint==table:/etc/postfwd/wl_ccerts ; action=DUNNO
|
||
|
||
This will ignore the right-hand value. Items can be mixed:
|
||
|
||
id=R002 ; action=REJECT
|
||
client_name==unknown
|
||
client_name==file:/etc/postfwd/blacklisted
|
||
|
||
and for non pcre (comma separated) items:
|
||
|
||
id=R003 ; action=REJECT
|
||
client_address==10.1.1.1, file:/etc/postfwd/blacklisted
|
||
|
||
id=R004 ; action=REJECT
|
||
rbl=myrbl.home.local, zen.spamhaus.org, file:/etc/postfwd/rbls_changing
|
||
|
||
You can check your configuration with the --show_config option at the command line:
|
||
|
||
# postfwd --showconfig --rule='action=DUNNO; client_address=10.1.0.0/16, file:/etc/postfwd/wl_clients, 192.168.2.1'
|
||
|
||
should give something like:
|
||
|
||
Rule 0: id->"R-0"; action->"DUNNO"; client_address->"=;10.1.0.0/16, =;194.123.86.10, =;186.4.6.12, =;192.168.2.1"
|
||
|
||
If a file can not be read, it will be ignored:
|
||
|
||
# postfwd --showconfig --rule='action=DUNNO; client_address=10.1.0.0/16, file:/etc/postfwd/wl_clients, 192.168.2.1'
|
||
[LOG warning]: error: file /etc/postfwd/wl_clients not found - file will be ignored ?
|
||
Rule 0: id->"R-0"; action->"DUNNO"; client_address->"=;10.1.0.0/16, =;192.168.2.1"
|
||
|
||
File items are evaluated at configuration stage. Therefore postfwd needs to be reloaded if a file has changed.
|
||
|
||
If you want to specify a file, that will be reloaded for each request, you can use lfile: and ltable:
|
||
|
||
id=R001; client_address=lfile:/etc/postfwd/client_whitelist; action=dunno
|
||
|
||
This will check the modification time of /etc/postfwd/client_whitelist every time the rule is evaluated and reload it as
|
||
necessary. Of course this might increase the system load, so please use it with care.
|
||
|
||
The --showconfig option illustrates the difference:
|
||
|
||
## evaluated at configuration stage
|
||
# postfwd2 --nodaemon -L --rule='client_address=table:/etc/postfwd/clients; action=dunno' -C
|
||
Rule 0: id->"R-0"; action->"dunno"; client_address->"=;1.1.1.1, =;1.1.1.2, =;1.1.1.3"
|
||
|
||
## evaluated for any rulehit
|
||
# postfwd2 --nodaemon -L --rule='client_address=ltable:/etc/postfwd/clients; action=dunno' -C
|
||
Rule 0: id->"R-0"; action->"dunno"; client_address->"=;ltable:/etc/postfwd/clients"
|
||
|
||
Files can refer to other files. The following is valid.
|
||
|
||
-- FILE /etc/postfwd/rules.cf --
|
||
id=R001; client_address=file:/etc/postfwd/clients_master.cf; action=DUNNO
|
||
|
||
-- FILE /etc/postfwd/clients_master.cf --
|
||
192.168.1.0/24
|
||
file:/etc/postfwd/clients_east.cf
|
||
file:/etc/postfwd/clients_west.cf
|
||
|
||
-- FILE /etc/postfwd/clients_east.cf --
|
||
192.168.2.0/24
|
||
|
||
-- FILE /etc/postfwd/clients_west.cf --
|
||
192.168.3.0/24
|
||
|
||
Note that there is currently no loop detection (/a/file calls /a/file) and that this feature is only available
|
||
with postfwd1 v1.15 and postfwd2 v0.18 and higher.
|
||
|
||
|
||
=head2 ACTIONS
|
||
|
||
I<General>
|
||
|
||
Actions will be executed, when all rule items have matched a request (or at least one of any item list). You can refer to
|
||
request attributes by preceeding $$ characters, like:
|
||
|
||
id=R-003; client_name = !!$$helo_name; action=WARN helo '$$helo_name' does not match DNS '$$client_name'
|
||
# or
|
||
id=R-003; client_name = !!$$helo_name; action=WARN helo '$$(helo_name)' does not match DNS '$$(client_name)'
|
||
|
||
I<postfix actions>
|
||
|
||
Actions will be replied to postfix as result to policy delegation requests. Any action that postfix understands is allowed - see
|
||
"man 5 access" or L<http://www.postfix.org/access.5.html> for a description. If no action is specified, the postfix WARN action
|
||
which simply logs the event will be used for the corresponding rule.
|
||
|
||
postfwd will return dunno if it has reached the end of the ruleset and no rule has matched. This can be changed by placing a last
|
||
rule containing only an action statement:
|
||
|
||
...
|
||
action=dunno ; sender=@domain.local # sender is ok
|
||
action=reject # default deny
|
||
|
||
I<postfwd actions>
|
||
|
||
postfwd actions control the behaviour of the program. Currently you can specify the following:
|
||
|
||
jump (<id>)
|
||
jumps to rule with id <id>, use this to skip certain rules.
|
||
you can jump backwards - but remember that there is no loop
|
||
detection at the moment! jumps to non-existing ids will be skipped.
|
||
|
||
score (<score>)
|
||
the request's score will be modified by the specified <score>,
|
||
which must be a floating point value. the modificator can be either
|
||
+n.nn adds n.nn to current score
|
||
-n.nn sustracts n.nn from the current score
|
||
*n.nn multiplies the current score by n.nn
|
||
/n.nn divides the current score through n.nn
|
||
=n.nn sets the current score to n.nn
|
||
if the score exceeds the maximum set by `--scores` option (see
|
||
COMMAND LINE) or the score item (see ITEMS section), the action
|
||
defined for this case will be returned (default: 5.0=>"REJECT postfwd score exceeded").
|
||
|
||
set (<item>=<value>,<item>=<value>,...)
|
||
this command allows you to insert or override request attributes, which then may be
|
||
compared to your further ruleset. use this to speed up repeated comparisons to large item lists.
|
||
please see the EXAMPLES section for more information. you may separate multiple key=value pairs
|
||
by "," characters.
|
||
|
||
rate (<item>/<max>/<time>/<action>)
|
||
this command creates a counter for the given <item>, which will be increased any time a request
|
||
containing it arrives. if it exceeds <max> within <time> seconds it will return <action> to postfix.
|
||
rate counters are very fast as they are executed before the ruleset is parsed.
|
||
please note that <action> was limited to postfix actions (no postfwd actions) for postfwd versions <1.33!
|
||
# no more than 3 requests per 5 minutes
|
||
# from the same "unknown" client
|
||
id=RATE01 ; client_name==unknown
|
||
action=rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
|
||
Please note also that the order of rate limits in your ruleset is important, which means
|
||
that this:
|
||
# works as expected
|
||
id=R001; action=rcpt(sender/500/3600/REJECT limit of 500 recipients per hour for sender $$sender exceeded)
|
||
id=R002; action=rcpt(sender/200/3600/WARN state YELLOW for sender $$sender)
|
||
leads to different results than this:
|
||
# rule R002 never gets executed
|
||
id=R001; action=rcpt(sender/200/3600/WARN state YELLOW for sender $$sender)
|
||
id=R002; action=rcpt(sender/500/3600/REJECT limit of 500 recipients per hour for sender $$sender exceeded)
|
||
|
||
size (<item>/<max>/<time>/<action>)
|
||
this command works similar to the rate() command with the difference, that the rate counter is
|
||
increased by the request's size attribute. to do this reliably you should call postfwd from
|
||
smtpd_end_of_data_restrictions. if you want to be sure, you could check it within the ruleset:
|
||
# size limit 1.5mb per hour per client
|
||
id=SIZE01 ; protocol_state==END-OF-MESSAGE ; client_address!=10.1.1.1
|
||
action=size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
|
||
|
||
rcpt (<item>/<max>/<time>/<action>)
|
||
this command works similar to the rate() command with the difference, that the rate counter is
|
||
increased by the request's recipient_count attribute. to do this reliably you should call postfwd
|
||
from smtpd_data_restrictions or smtpd_end_of_data_restrictions. if you want to be sure, you could
|
||
check it within the ruleset:
|
||
# recipient count limit 3 per hour per client
|
||
id=RCPT01 ; protocol_state==END-OF-MESSAGE ; client_address!=10.1.1.1
|
||
action=rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
|
||
|
||
rate5321,size5321,rcpt5321 (<item>/<max>/<time>/<action>)
|
||
same as the corresponding non-5321 functions, with the difference that the localpart of
|
||
sender oder recipient addresses are evaluated case-sensitive according to rfc5321. That
|
||
means that requests from bob@example.local and BoB@example.local will be treated differently
|
||
|
||
ask (<addr>:<port>[:<ignore>])
|
||
allows to delegate the policy decision to another policy service (e.g. postgrey). the first
|
||
and the second argument (address and port) are mandatory. a third optional argument may be
|
||
specified to tell postfwd to ignore certain answers and go on parsing the ruleset:
|
||
# example1: query postgrey and return it's answer to postfix
|
||
id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031)
|
||
# example2: query postgrey but ignore the answer, if it matches 'DUNNO'
|
||
# and continue parsing postfwd's ruleset
|
||
id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031:^dunno$)
|
||
|
||
mail(server/helo/from/to/subject/body)
|
||
This command is deprecated. You should try to use the sendmail() action instead.
|
||
Very basic mail command, that sends a message with the given arguments. LIMITATIONS:
|
||
This basically performs a telnet. No authentication or TLS are available. Additionally it does
|
||
not track notification state and will notify you any time, the corresponding rule hits.
|
||
|
||
sendmail(sendmail-path::from::to::subject::body)
|
||
Mail command, that uses an existing sendmail binary and sends a message with the given arguments.
|
||
LIMITATIONS: The command does not track notification state and will notify you any time, the
|
||
corresponding rule hits (which could mean 100 mails for a mail with 100 recipients at RCPT stage).
|
||
|
||
wait (<delay>)
|
||
pauses the program execution for <delay> seconds. use this for
|
||
delaying or throtteling connections.
|
||
|
||
note (<string>)
|
||
just logs the given string and continues parsing the ruleset.
|
||
if the string is empty, nothing will be logged (noop).
|
||
|
||
quit (<code>)
|
||
terminates the program with the given exit-code. postfix doesn`t
|
||
like that too much, so use it with care.
|
||
|
||
You can reference to request attributes, like
|
||
|
||
id=R-HELO ; helo_name=^[^\.]+$ ; action=REJECT invalid helo '$$helo_name'
|
||
|
||
|
||
=head2 MACROS/ACLS
|
||
|
||
Multiple use of long items or combinations of them may be abbreviated by macros. Those must be prefixed by '&&' (two '&' characters).
|
||
First the macros have to be defined as follows:
|
||
|
||
&&RBLS { rbl=zen.spamhaus.org,list.dsbl.org,bl.spamcop.net,dnsbl.sorbs.net,ix.dnsbl.manitu.net; };
|
||
|
||
Then these may be used in your rules, like:
|
||
|
||
&&RBLS ; client_name=^unknown$ ; action=REJECT
|
||
&&RBLS ; client_name=(\d+[\.-_]){4} ; action=REJECT
|
||
&&RBLS ; client_name=[\.-_](adsl|dynamic|ppp|)[\.-_] ; action=REJECT
|
||
|
||
Macros can contain actions, too:
|
||
|
||
# definition
|
||
&&GONOW { action=REJECT your request caused our spam detection policy to reject this message. More info at http://www.domain.local; };
|
||
# rules
|
||
&&GONOW ; &&RBLS ; client_name=^unknown$
|
||
&&GONOW ; &&RBLS ; client_name=(\d+[\.-_]){4}
|
||
&&GONOW ; &&RBLS ; client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
|
||
|
||
Macros can contain macros, too:
|
||
|
||
# definition
|
||
&&RBLS{
|
||
rbl=zen.spamhaus.org
|
||
rbl=list.dsbl.org
|
||
rbl=bl.spamcop.net
|
||
rbl=dnsbl.sorbs.net
|
||
rbl=ix.dnsbl.manitu.net
|
||
};
|
||
&&DYNAMIC{
|
||
client_name=^unknown$
|
||
client_name=(\d+[\.-_]){4}
|
||
client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
|
||
};
|
||
&&GOAWAY { &&RBLS; &&DYNAMIC; };
|
||
# rules
|
||
&&GOAWAY ; action=REJECT dynamic client and listed on RBL
|
||
|
||
Basically macros are simple text substitutions - see the L</PARSER> section for more information.
|
||
|
||
|
||
=head2 PLUGINS
|
||
|
||
B<Description>
|
||
|
||
The plugin interface allow you to define your own checks and enhance postfwd's
|
||
functionality. Feel free to share useful things!
|
||
|
||
B<Warning>
|
||
|
||
Note that the plugin interface is still at devel stage. Please test your plugins
|
||
carefully, because errors may cause postfwd to break! It is also
|
||
allowed to override attributes or built-in functions, but be sure that you know
|
||
what you do because some of them are used internally.
|
||
|
||
Please keep security in mind, when you access sensible ressources and never, ever
|
||
run postfwd as privileged user! Also never trust your input (especially hostnames,
|
||
and e-mail addresses).
|
||
|
||
B<ITEMS>
|
||
|
||
Item plugins are perl subroutines which integrate additional attributes to requests
|
||
before they are evaluated against postfwd's ruleset like any other item of the
|
||
policy delegation protocol. This allows you to create your own checks.
|
||
|
||
plugin-items can not be used selective. these functions will be executed for every
|
||
request postfwd receives, so keep performance in mind.
|
||
|
||
SYNOPSIS: %result = postfwd_items_plugin{<name>}(%request)
|
||
|
||
means that your subroutine, called <name>, has access to a hash called %request,
|
||
which contains all request attributes, like $request{client_name} and must
|
||
return a value in the following form:
|
||
|
||
save: $result{<item>} = <value>
|
||
|
||
this creates the new item <item> containing <value>, which will be integrated in
|
||
the policy delegation request and therefore may be used in postfwd's ruleset.
|
||
|
||
# do NOT remove the next line
|
||
%postfwd_items_plugin = (
|
||
|
||
# EXAMPLES - integrated in postfwd. no need to activate them here.
|
||
|
||
# allows to check postfwd version in ruleset
|
||
"version" => sub {
|
||
my(%request) = @_;
|
||
my(%result) = (
|
||
"version" => $NAME." ".$VERSION,
|
||
);
|
||
return %result;
|
||
},
|
||
|
||
# sender_domain and recipient_domain
|
||
"address_parts" => sub {
|
||
my(%request) = @_;
|
||
my(%result) = ();
|
||
$request{sender} =~ /@([^@]*)$/;
|
||
$result{sender_domain} = ($1 || '');
|
||
$request{recipient} =~ /@([^@]*)$/;
|
||
$result{recipient_domain} = ($1 || '');
|
||
return %result;
|
||
},
|
||
|
||
# do NOT remove the next line
|
||
);
|
||
|
||
B<COMPARE>
|
||
|
||
Compare plugins allow you to define how your new items should be compared to the ruleset.
|
||
These are optional. If you don't specify one, the default (== for exact match, =~ for PCRE, ...)
|
||
will be used.
|
||
|
||
SYNOPSIS: <item> => sub { return &{$postfwd_compare{<type>}}(@_); },
|
||
|
||
# do NOT remove the next line
|
||
%postfwd_compare_plugin = (
|
||
|
||
EXAMPLES - integrated in postfwd. no need to activate them here.
|
||
|
||
# Simple example
|
||
# SYNOPSIS: <result> = <item> (return &{$postfwd_compare{<type>}}(@_))
|
||
"client_address" => sub { return &{$postfwd_compare{cidr}}(@_); },
|
||
"size" => sub { return &{$postfwd_compare{numeric}}(@_); },
|
||
"recipient_count" => sub { return &{$postfwd_compare{numeric}}(@_); },
|
||
|
||
# Complex example
|
||
# SYNOPSIS: <result> = <item>(<operator>, <ruleset value>, <request value>, <request>)
|
||
"numeric" => sub {
|
||
my($cmp,$val,$myitem,%request) = @_;
|
||
my($myresult) = undef; $myitem ||= "0"; $val ||= "0";
|
||
if ($cmp eq '==') {
|
||
$myresult = ($myitem == $val);
|
||
} elsif ($cmp eq '=<') {
|
||
$myresult = ($myitem <= $val);
|
||
} elsif ($cmp eq '=>') {
|
||
$myresult = ($myitem >= $val);
|
||
} elsif ($cmp eq '<') {
|
||
$myresult = ($myitem < $val);
|
||
} elsif ($cmp eq '>') {
|
||
$myresult = ($myitem > $val);
|
||
} elsif ($cmp eq '!=') {
|
||
$myresult = not($myitem == $val);
|
||
} elsif ($cmp eq '!<') {
|
||
$myresult = not($myitem <= $val);
|
||
} elsif ($cmp eq '!>') {
|
||
$myresult = not($myitem >= $val);
|
||
} else {
|
||
$myresult = ($myitem >= $val);
|
||
};
|
||
return $myresult;
|
||
},
|
||
|
||
# do NOT remove the next line
|
||
);
|
||
|
||
B<ACTIONS>
|
||
|
||
Action plugins allow to define new postfwd actions. By setting the $stop-flag you can decide to
|
||
continue or to stop parsing the ruleset.
|
||
|
||
SYNOPSIS: (<stop rule parsing>, <next rule index>, <return action>, <logprefix>, <request>) =
|
||
<action> (<current rule index>, <current time>, <command name>, <argument>, <logprefix>, <request>)
|
||
|
||
# do NOT remove the next line
|
||
%postfwd_actions_plugin = (
|
||
|
||
# EXAMPLES - integrated in postfwd. no need to activate them here.
|
||
|
||
# note(<logstring>) command
|
||
"note" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = 'dunno'; my($stop) = 0;
|
||
log_info "[RULES] ".$myline." - note: ".$myarg if $myarg;
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
|
||
# skips next <myarg> rules
|
||
"skip" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = 'dunno'; my($stop) = 0;
|
||
$index += $myarg if ( $myarg and not(($index + $myarg) > $#Rules) );
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
|
||
# dumps current request contents to syslog
|
||
"dumprequest" => sub {
|
||
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
|
||
my($myaction) = 'dunno'; my($stop) = 0;
|
||
map { log_info "[DUMP] rule=$index, Attribute: $_=$request{$_}" } (keys %request);
|
||
return ($stop,$index,$myaction,$myline,%request);
|
||
},
|
||
|
||
# do NOT remove the next line
|
||
);
|
||
|
||
|
||
=head2 COMMAND LINE
|
||
|
||
I<Ruleset>
|
||
|
||
The following arguments are used to specify the source of the postfwd ruleset. This means
|
||
that at least one of the following is required for postfwd to work.
|
||
|
||
-f, --file <file>
|
||
Reads rules from <file>. Please see the CONFIGURATION section
|
||
below for more information.
|
||
|
||
-r, --rule <rule>
|
||
Adds <rule> to ruleset. Remember that you might have to quote
|
||
strings that contain whitespaces or shell characters.
|
||
|
||
I<Scoring>
|
||
|
||
-s, --scores <val>=<action>
|
||
Returns <action> to postfix, when the request's score exceeds <val>
|
||
|
||
Multiple usage is allowed. Just chain your arguments, like:
|
||
|
||
postfwd -r "<item>=<value>;action=<result>" -f <file> -f <file> ...
|
||
or
|
||
postfwd --scores 4.5="WARN high score" --scores 5.0="REJECT postfwd score too high" ...
|
||
|
||
In case of multiple scores, the highest match will count. The order of the arguments will be
|
||
reflected in the postfwd ruleset.
|
||
|
||
I<Control>
|
||
|
||
-d, --daemon
|
||
postfwd will run as daemon and listen on the network for incoming
|
||
queries (default 127.0.0.1:10040).
|
||
|
||
-k, --kill
|
||
Stops a running postfwd daemon.
|
||
|
||
--reload
|
||
Reloads configuration.
|
||
|
||
--dumpstats
|
||
Displays program usage statistics.
|
||
|
||
--dumpcache
|
||
Displays cache contents.
|
||
|
||
--delcache <item>
|
||
Removes an item from the request cache. Use --dumpcache to identify objects.
|
||
E.g.:
|
||
# postfwd --dumpcache
|
||
...
|
||
%rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @count -> '1'
|
||
%rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @maxcount -> '2'
|
||
...
|
||
# postfwd --delrate="sender=gmato@jqvo.org"
|
||
rate cache item 'sender=gmato@jqvo.org' removed
|
||
|
||
--delrate <item>
|
||
Removes an item from the rate cache. Use --dumpcache to identify objects.
|
||
|
||
I<Networking>
|
||
|
||
postfwd can be run as daemon so that it listens on the network for incoming requests.
|
||
The following arguments will control it's behaviour in this case.
|
||
|
||
-i, --interface <dev>
|
||
Bind postfwd to the specified interface (default 127.0.0.1).
|
||
|
||
-p, --port <port>
|
||
postfwd listens on the specified port (default tcp/10040).
|
||
|
||
--proto <type>
|
||
The protocol type for postfwd's socket. Currently you may use 'tcp' or 'unix' here.
|
||
To use postfwd with a unix domain socket, run it as follows:
|
||
postfwd --proto=unix --port=/somewhere/postfwd.socket
|
||
|
||
-u, --user <name>
|
||
Changes real and effective user to <name>.
|
||
|
||
-g, --group <name>
|
||
Changes real and effective group to <name>.
|
||
|
||
--umask <mask>
|
||
Changes the umask for filepermissions (unix domain sockets, pidfiles).
|
||
Attention: This is umask, not chmod - you have to specify the bits that
|
||
should NOT apply. E.g.: umask 077 equals to chmod 700.
|
||
|
||
-R, --chroot <path>
|
||
Chroot the process to the specified path.
|
||
Test this before using - you might need some libs there.
|
||
|
||
--pidfile <path>
|
||
The process id will be saved in the specified file.
|
||
|
||
--facility <f>
|
||
sets the syslog facility, default is 'mail'
|
||
|
||
--socktype <s>
|
||
sets the Sys::Syslog socktype to 'native', 'inet' or 'unix'.
|
||
Default is to auto-detect this depening on module version and os.
|
||
|
||
-l, --logname <label>
|
||
Labels the syslog messages. Useful when running multiple
|
||
instances of postfwd.
|
||
|
||
--loglen <int>
|
||
Truncates any syslog message after <int> characters.
|
||
|
||
I<Plugins>
|
||
|
||
--plugins <file>
|
||
Loads postfwd plugins from file. Please see http://postfwd.org/postfwd.plugins
|
||
or the plugins.postfwd.sample that is available from the tarball for more info.
|
||
|
||
I<Optional arguments>
|
||
|
||
These parameters influence the way postfwd is working. Any of them can be combined.
|
||
|
||
-v, --verbose
|
||
Verbose logging displays a lot of useful information but can cause
|
||
your logfiles to grow noticeably. So use it with caution. Set the option
|
||
twice (-vv) to get more information (logs all request attributes).
|
||
|
||
-c, --cache <int> (default=600)
|
||
Timeout for request cache, results for identical requests will be
|
||
cached until config is reloaded or this time (in seconds) expired.
|
||
A setting of 0 disables this feature.
|
||
|
||
--cache-no-size
|
||
Ignores size attribute for cache comparisons which will lead to better
|
||
cache-hit rates. You should set this option, if you don't use the size
|
||
item in your ruleset.
|
||
|
||
--cache-no-sender
|
||
Ignores sender address for cache comparisons which will lead to better
|
||
cache-hit rates. You should set this option, if you don't use the sender
|
||
item in your ruleset.
|
||
|
||
--cache-rdomain-only
|
||
This will strip the localpart of the recipient's address before filling the
|
||
cache. This may considerably increase cache-hit rates.
|
||
|
||
--cache-rbl-timeout <timeout> (default=3600)
|
||
This default value will be used as timeout in seconds for rbl cache items,
|
||
if not specified in the ruleset.
|
||
|
||
--cache-rbl-default <pattern> (default=^127\.0\.0\.\d+$)
|
||
Matches <pattern> to rbl/rhsbl answers (regexp) if not specified in the ruleset.
|
||
|
||
--cacheid <item>, <item>, ...
|
||
This csv-separated list of request attributes will be used to construct
|
||
the request cache identifier. Use this only, if you know exactly what you
|
||
are doing. If you, for example, use postfwd only for RBL/RHSBL control,
|
||
you may set this to
|
||
postfwd --cache=3600 --cacheid=client_name,client_address
|
||
This increases efficiency of caching and improves postfwd's performance.
|
||
Warning: You should list all items here, which are used in your ruleset!
|
||
|
||
--cleanup-requests <interval> (default=600)
|
||
The request cache will be searched for timed out items after this <interval> in
|
||
seconds. It is a minimum value. The cleanup process will only take place, when
|
||
a new request arrives.
|
||
|
||
--cleanup-rbls <interval> (default=600)
|
||
The rbl cache will be searched for timed out items after this <interval> in
|
||
seconds. It is a minimum value. The cleanup process will only take place, when
|
||
a new request arrives.
|
||
|
||
--cleanup-rates <interval> (default=600)
|
||
The rate cache will be searched for timed out items after this <interval> in
|
||
seconds. It is a minimum value. The cleanup process will only take place, when
|
||
a new request arrives.
|
||
|
||
-S, --summary <int> (default=600)
|
||
Shows some usage statistics (program uptime, request counter, matching rules)
|
||
every <int> seconds. This option is included by the -v switch.
|
||
This feature uses the alarm signal, so you can force postfwd to dump the stats
|
||
using `kill -ALRM <pid>` (where <pid> is the process id of postfwd).
|
||
|
||
Example:
|
||
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Counters: 213000 seconds uptime, 39 rules
|
||
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Requests: 71643 overall, 49 last interval, 62.88% cache hits
|
||
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Averages: 20.18 overall, 4.90 last interval, 557.30 top
|
||
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Contents: 44 cached requests, 239 cached dnsbl results
|
||
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Rule ID: R-001 matched: 2704 times
|
||
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Rule ID: R-002 matched: 9351 times
|
||
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Rule ID: R-003 matched: 3116 times
|
||
...
|
||
|
||
--no-rulestats
|
||
Disables per rule statistics. Keeps your log clean, if you do not use them.
|
||
This option has no effect without --summary or --verbose set.
|
||
|
||
-L, --stdoutlog
|
||
Redirects all syslog messages to stdout for debugging. Never use this with postfix!
|
||
|
||
-t, --test
|
||
In test mode postfwd always returns "dunno", but logs according
|
||
to it`s ruleset. -v will be set automatically with this option.
|
||
|
||
-n, --nodns
|
||
Disables all DNS based checks like RBL checks. Rules containing
|
||
such elements will be ignored.
|
||
|
||
-n, --nodnslog
|
||
Disables logging of dns events.
|
||
|
||
--dns_timeout (default: 14)
|
||
Sets the timeout for asynchonous dns queries in seconds. This value will apply to
|
||
all dns items in a rule.
|
||
|
||
--dns_timeout_max (default: 10)
|
||
Sets the maximum timeout counter for dnsbl lookups. If the timeouts exceed this value
|
||
the corresponding dnsbl will be deactivated for a while (see --dns_timeout_interval).
|
||
|
||
--dns_timeout_interval (default=1200)
|
||
The dnsbl timeout counter will be cleaned after this interval in seconds. Use this
|
||
in conjunction with the --dns_timeout_max parameter.
|
||
|
||
--dns_async_txt
|
||
Perform dnsbl A and TXT lookups simultaneously (otherwise only for listings with at
|
||
least one A record). This needs more network bandwidth due to increased queries but
|
||
might increase throughput because the lookups can be parallelized.
|
||
|
||
--dns_max_ns_lookups (default=0)
|
||
maximum ns names to lookup up with sender_ns_addrs item. use 0 for no maximum.
|
||
|
||
--dns_max_mx_lookups (default=0)
|
||
maximum mx names to lookup up with sender_mx_addrs item. use 0 for no maximum.
|
||
|
||
-I, --instantcfg
|
||
The config files, specified by -f will be re-read for every request
|
||
postfwd receives. This enables on-the-fly configuration changes
|
||
without restarting. Though files will be read only if necessary
|
||
(which means their access times changed since last read) this might
|
||
significantly increase system load.
|
||
|
||
--config_timeout (default=3)
|
||
timeout in seconds to parse a single configuration line. if exceeded, the rule will
|
||
be skipped. this is used to prevent problems due to large files or loops.
|
||
|
||
--keep_rates (default=0)
|
||
With this option set postfwd does not clear the rate limit counters on reload. Please
|
||
note that you have to restart (not reload) postfwd with this option if you change
|
||
any rate limit rules.
|
||
|
||
--save_rates (default=none)
|
||
With this option postfwd saves existing rate limit counters to disk and reloads them
|
||
on program start. This allows persistent rate limits across program restarts or reboots.
|
||
Please note that postfwd needs read and write access to the specified file.
|
||
|
||
--fast_limit_evaluation (default=0)
|
||
Once a ratelimit was set by the ruleset, future requests will be evaluated against it
|
||
before consulting the ruleset. This mode was the default behaviour until v1.30.
|
||
With this mode rate limits will be faster, but also eventually set up
|
||
whitelisting-rules within the ruleset might not work as expected.
|
||
LIMITATIONS: This option does not allow nested postfwd commands like
|
||
action=rate(sender/3/60/wait(3))
|
||
This option doe not work with the strict-rfc5321 rate() functions.
|
||
|
||
|
||
I<Informational arguments>
|
||
|
||
These arguments are for command line usage only. Never ever use them with postfix spawn!
|
||
|
||
-C, --showconfig
|
||
Displays the current ruleset. Use -v for verbose output.
|
||
|
||
-P, --perfmon
|
||
This option turns of any syslogging and output. It is included
|
||
for performance testing.
|
||
|
||
-V, --version
|
||
Displays the program version.
|
||
|
||
-h, --help
|
||
Shows program usage.
|
||
|
||
-m, --manual
|
||
Displays the program manual.
|
||
|
||
|
||
=head2 REFRESH
|
||
|
||
In daemon mode postfwd reloads it's ruleset after receiving a HUP signal. Please see the description of
|
||
the '-I' switch to have your configuration refreshed for every request postfwd receives.
|
||
|
||
|
||
=head2 EXAMPLES
|
||
|
||
## whitelisting
|
||
# 1. networks 192.168.1.0/24, 192.168.2.4
|
||
# 2. client_names *.gmx.net and *.gmx.de
|
||
# 3. sender *@someshop.tld from 11.22.33.44
|
||
id=WL001; action=dunno ; client_address=192.168.1.0/24, 192.168.2.4
|
||
id=WL002; action=dunno ; client_name=\.gmx\.(net|de)$
|
||
id=WL003; action=dunno ; sender=@someshop\.tld$ ; client_address=11.22.33.44
|
||
|
||
## TLS control
|
||
# 1. *@authority.tld only with correct TLS fingerprint
|
||
# 2. *@secret.tld only with keysizes >=64
|
||
id=TL001; action=dunno ; sender=@authority\.tld$ ; ccert_fingerprint=AA:BB:CC..
|
||
id=TL002; action=REJECT wrong TLS fingerprint ; sender=@authority\.tld$
|
||
id=TL003; action=REJECT tls keylength < 64 ; sender=@secret\.tld$ ; encryption_keysize=64
|
||
|
||
## Combined RBL checks
|
||
# This will reject mail if
|
||
# 1. listed on ix.dnsbl.manitu.net
|
||
# 2. listed on zen.spamhaus.org (sbl and xbl, dns cache timeout 1200s instead of 3600s)
|
||
# 3. listed on min 2 of bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
|
||
# 4. listed on bl.spamcop.net and one of rhsbl.ahbl.org, rhsbl.sorbs.net
|
||
id=RBL01 ; action=REJECT listed on ix.dnsbl.manitu.net ; rbl=ix.dnsbl.manitu.net
|
||
id=RBL02 ; action=REJECT listed on zen.spamhaus.org ; rbl=zen.spamhaus.org/127.0.0.[2-8]/1200
|
||
id=RBL03 ; action=REJECT listed on too many RBLs ; rblcount=2 ; rbl=bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
|
||
id=RBL04 ; action=REJECT combined RBL+RHSBL check ; rbl=bl.spamcop.net ; rhsbl=rhsbl.ahbl.org, rhsbl.sorbs.net
|
||
|
||
## Message size (requires message_size_limit to be set to 30000000)
|
||
# 1. 30MB for systems in *.customer1.tld
|
||
# 2. 20MB for SASL user joejob
|
||
# 3. 10MB default
|
||
id=SZ001; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\.customer1.tld$
|
||
id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
|
||
id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=10000000
|
||
id=SZ100; protocol_state==END-OF-MESSAGE; action=REJECT message too large
|
||
|
||
## Selective Greylisting
|
||
##
|
||
## Note that postfwd does not include greylisting. This setup requires a running postgrey service
|
||
## at port 10031 and the following postfix restriction class in your main.cf:
|
||
##
|
||
## smtpd_restriction_classes = check_postgrey, ...
|
||
## check_postgrey = check_policy_service inet:127.0.0.1:10031
|
||
#
|
||
# 1. if listed on zen.spamhaus.org with results 127.0.0.10 or .11, dns cache timeout 1200s
|
||
# 2. Client has no rDNS
|
||
# 3. Client comes from several dialin domains
|
||
id=GR001; action=check_postgrey ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
|
||
id=GR002; action=check_postgrey ; client_name=^unknown$
|
||
id=GR003; action=check_postgrey ; client_name=\.(t-ipconnect|alicedsl|ish)\.de$
|
||
|
||
## Date Time
|
||
date=24.12.2007-26.12.2007 ; action=450 4.7.1 office closed during christmas
|
||
time=04:00:00-05:00:00 ; action=450 4.7.1 maintenance ongoing, try again later
|
||
time=-07:00:00 ; sasl_username=jim ; action=450 4.7.1 to early for you, jim
|
||
time=22:00:00- ; sasl_username=jim ; action=450 4.7.1 to late now, jim
|
||
months=-Apr ; action=450 4.7.1 see you in may
|
||
days=!!Mon-Fri ; action=check_postgrey
|
||
|
||
## Usage of jump
|
||
# The following allows a message size of 30MB for different
|
||
# users/clients while others will only have 10MB.
|
||
id=R001 ; action=jump(R100) ; sasl_username=^(Alice|Bob|Jane)$
|
||
id=R002 ; action=jump(R100) ; client_address=192.168.1.0/24
|
||
id=R003 ; action=jump(R100) ; ccert_fingerprint=AA:BB:CC:DD:...
|
||
id=R004 ; action=jump(R100) ; ccert_fingerprint=AF:BE:CD:DC:...
|
||
id=R005 ; action=jump(R100) ; ccert_fingerprint=DD:CC:BB:DD:...
|
||
id=R099 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
|
||
id=R100 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
|
||
|
||
## Usage of score
|
||
# The following rejects a mail, if the client
|
||
# - is listed on 1 RBL and 1 RHSBL
|
||
# - is listed in 1 RBL or 1 RHSBL and has no correct rDNS
|
||
# - other clients without correct rDNS will be greylist-checked
|
||
# - some whitelists are used to lower the score
|
||
id=S01 ; score=2.6 ; action=check_postgrey
|
||
id=S02 ; score=5.0 ; action=REJECT postfwd score too high
|
||
id=R00 ; action=score(-1.0) ; rbl=exemptions.ahbl.org,list.dnswl.org,query.bondedsender.org,spf.trusted-forwarder.org
|
||
id=R01 ; action=score(2.5) ; rbl=bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
|
||
id=R02 ; action=score(2.5) ; rhsbl=rhsbl.ahbl.org, rhsbl.sorbs.net
|
||
id=N01 ; action=score(-0.2) ; client_name==$$helo_name
|
||
id=N02 ; action=score(2.7) ; client_name=^unknown$
|
||
...
|
||
|
||
## Usage of rate and size
|
||
# The following temporary rejects requests from "unknown" clients, if they
|
||
# 1. exceeded 30 requests per hour or
|
||
# 2. tried to send more than 1.5mb within 10 minutes
|
||
id=RATE01 ; client_name==unknown ; protocol_state==RCPT
|
||
action=rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
|
||
id=SIZE01 ; client_name==unknown ; protocol_state==END-OF-MESSAGE
|
||
action=size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
|
||
|
||
## Macros
|
||
# definition
|
||
&&RBLS { rbl=zen.spamhaus.org,list.dsbl.org,bl.spamcop.net,dnsbl.sorbs.net,ix.dnsbl.manitu.net; };
|
||
&&GONOW { action=REJECT your request caused our spam detection policy to reject this message. More info at http://www.domain.local; };
|
||
# rules
|
||
&&GONOW ; &&RBLS ; client_name=^unknown$
|
||
&&GONOW ; &&RBLS ; client_name=(\d+[\.-_]){4}
|
||
&&GONOW ; &&RBLS ; client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
|
||
|
||
## Groups
|
||
# definition
|
||
&&RBLS{
|
||
rbl=zen.spamhaus.org
|
||
rbl=list.dsbl.org
|
||
rbl=bl.spamcop.net
|
||
rbl=dnsbl.sorbs.net
|
||
rbl=ix.dnsbl.manitu.net
|
||
};
|
||
&&RHSBLS{
|
||
...
|
||
};
|
||
&&DYNAMIC{
|
||
client_name==unknown
|
||
client_name~=(\d+[\.-_]){4}
|
||
client_name~=[\.-_](adsl|dynamic|ppp|)[\.-_]
|
||
...
|
||
};
|
||
&&BAD_HELO{
|
||
helo_name==my.name.tld
|
||
helo_name~=^([^\.]+)$
|
||
helo_name~=\.(local|lan)$
|
||
...
|
||
};
|
||
&&MAINTENANCE{
|
||
date=15.01.2007
|
||
date=15.04.2007
|
||
date=15.07.2007
|
||
date=15.10.2007
|
||
time=03:00:00 - 04:00:00
|
||
};
|
||
# rules
|
||
id=COMBINED ; &&RBLS ; &&DYNAMIC ; action=REJECT dynamic client and listed on RBL
|
||
id=MAINTENANCE ; &&MAINTENANCE ; action=DEFER maintenance time - please try again later
|
||
|
||
# now with the set() command, note that long item
|
||
# lists don't have to be compared twice
|
||
id=RBL01 ; &&RBLS ; action=set(HIT_rbls=1)
|
||
id=HELO01 ; &&BAD_HELO ; action=set(HIT_helo=1)
|
||
id=DYNA01 ; &&DYNAMIC ; action=set(HIT_dyna=1)
|
||
id=REJECT01 ; HIT_rbls==1 ; HIT_helo==1 ; action=REJECT please see http://some.org/info?reject=01 for more info
|
||
id=REJECT02 ; HIT_rbls==1 ; HIT_dyna==1 ; action=REJECT please see http://some.org/info?reject=02 for more info
|
||
id=REJECT03 ; HIT_helo==1 ; HIT_dyna==1 ; action=REJECT please see http://some.org/info?reject=03 for more info
|
||
|
||
## combined with enhanced rbl features
|
||
#
|
||
id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS
|
||
action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,HIT_dnstxt=$$dnsbltext)
|
||
id=RBL02 ; HIT_dnsbls>=2 ; action=554 5.7.1 blocked using $$HIT_dnsbls DNSBLs [INFO: $$HIT_dnstxt]
|
||
|
||
|
||
=head2 PARSER
|
||
|
||
I<Configuration>
|
||
|
||
The postfwd ruleset can be specified at the commandline (-r option) or be read from files (-f). The order of your arguments will be kept. You should
|
||
check the parser with the -C | --showconfig switch at the command line before applying a new config. The following call:
|
||
|
||
postfwd --showconfig \
|
||
-r "id=TEST; recipient_count=100; action=WARN mail with 100+ recipients" \
|
||
-f /etc/postfwd.cf \
|
||
-r "id=DEFAULT; action=dunno";
|
||
|
||
will produce the following output:
|
||
|
||
Rule 0: id->"TEST" action->"WARN mail with 100+ recipients"; recipient_count->"100"
|
||
...
|
||
... <content of /etc/postfwd.cf> ...
|
||
...
|
||
Rule <n>: id->"DEFAULT" action->"dunno"
|
||
|
||
Multiple items of the same type will be added to lists (see the L</ITEMS> section for more info):
|
||
|
||
postfwd --showconfig \
|
||
-r "client_address=192.168.1.0/24; client_address=172.16.26.32; action=dunno"
|
||
|
||
will result in:
|
||
|
||
Rule 0: id->"R-0"; action->"dunno"; client_address->"192.168.1.0/24, 172.16.26.32"
|
||
|
||
Macros are evaluated at configuration stage, which means that
|
||
|
||
postfwd --showconfig \
|
||
-r "&&RBLS { rbl=bl.spamcop.net; client_name=^unknown$; };" \
|
||
-r "id=RBL001; &&RBLS; action=REJECT listed on spamcop and bad rdns";
|
||
|
||
will result in:
|
||
|
||
Rule 0: id->"RBL001"; action->"REJECT listed on spamcop and bad rdns"; rbl->"bl.spamcop.net"; client_name->"^unknown$"
|
||
|
||
I<Request processing>
|
||
|
||
When a policy delegation request arrives it will be compared against postfwd`s ruleset. To inspect the processing in detail you should increase
|
||
verbority using use the "-v" or "-vv" switch. "-L" redirects log messages to stdout.
|
||
|
||
Keeping the order of the ruleset in general, items will be compared in random order, which basically means that
|
||
|
||
id=R001; action=dunno; client_address=192.168.1.1; sender=bob@alice.local
|
||
|
||
equals to
|
||
|
||
id=R001; sender=bob@alice.local; client_address=192.168.1.1; action=dunno
|
||
|
||
Lists will be evaluated in the specified order. This allows to place faster expressions at first:
|
||
|
||
postfwd -vv -L -r "id=RBL001; rbl=localrbl.local zen.spamhaus.org; action=REJECT" /some/where/request.sample
|
||
|
||
produces the following
|
||
|
||
[LOGS info]: compare rbl: "remotehost.remote.net[68.10.1.7]" -> "localrbl.local"
|
||
[LOGS info]: count1 rbl: "2" -> "0"
|
||
[LOGS info]: query rbl: localrbl.local 7.1.10.68 (7.1.10.68.localrbl.local)
|
||
[LOGS info]: count2 rbl: "2" -> "0"
|
||
[LOGS info]: match rbl: FALSE
|
||
[LOGS info]: compare rbl: "remotehost.remote.net[68.10.1.7]" -> "zen.spamhaus.org"
|
||
[LOGS info]: count1 rbl: "2" -> "0"
|
||
[LOGS info]: query rbl: zen.spamhaus.org 7.1.10.68 (7.1.10.68.zen.spamhaus.org)
|
||
[LOGS info]: count2 rbl: "2" -> "0"
|
||
[LOGS info]: match rbl: FALSE
|
||
[LOGS info]: Action: dunno
|
||
|
||
The negation operator !!(<value>) has the highest priority and therefore will be evaluated first. Then variable substitutions are performed:
|
||
|
||
postfwd -vv -L -r "id=TEST; action=REJECT; client_name=!!($$heloname)" /some/where/request.sample
|
||
|
||
will give
|
||
|
||
[LOGS info]: compare client_name: "unknown" -> "!!($$helo_name)"
|
||
[LOGS info]: negate client_name: "unknown" -> "$$helo_name"
|
||
[LOGS info]: substitute client_name: "unknown" -> "english-breakfast.cloud8.net"
|
||
[LOGS info]: match client_name: TRUE
|
||
[LOGS info]: Action: REJECT
|
||
|
||
|
||
I<Ruleset evaluation>
|
||
|
||
A rule hits when all items (or at least one element of a list for each item) have matched. As soon as one item (or all elements of a list) fails
|
||
to compare against the request attribute the parser will jump to the next rule in the postfwd ruleset.
|
||
|
||
If a rule matches, there are two options:
|
||
|
||
* Rule returns postfix action (dunno, reject, ...)
|
||
The parser stops rule processing and returns the action to postfix. Other rules will not be evaluated.
|
||
|
||
* Rule returns postfwd action (jump(), note(), ...)
|
||
The parser evaluates the given action and continues with the next rule (except for the jump() or quit() actions - please see the L</ACTIONS> section
|
||
for more information). Nothing will be sent to postfix.
|
||
|
||
If no rule has matched and the end of the ruleset is reached postfwd will return dunno without logging anything unless in verbose mode. You may
|
||
simply place a last `catch-all´ rule to change that behaviour:
|
||
|
||
... <your rules> ...
|
||
id=DEFAULT ; action=dunno
|
||
|
||
will log any request that passes the ruleset without having hit a prior rule.
|
||
|
||
|
||
=head2 INTEGRATION
|
||
|
||
I<Integration via daemon mode>
|
||
|
||
The common way to use postfwd is to start it as daemon, listening at a specified tcp port.
|
||
As postfwd will run in a single instance (multiplexing mode), it will take most benefit of
|
||
it`s internal caching in that case. Start postfwd with the following parameters:
|
||
|
||
postfwd -d -f /etc/postfwd.cf -i 127.0.0.1 -p 10040 -u nobody -g nobody -S
|
||
|
||
For efficient caching you should check if you can use the options --cache-rdomain-only, --cache-no-sender
|
||
and --cache-no-size.
|
||
|
||
Now check your syslogs (default facility "mail") for a line like:
|
||
|
||
Aug 9 23:00:24 mail postfwd[5158]: postfwd n.nn ready for input
|
||
|
||
and use `netstat -an|grep 10040` to check for something like
|
||
|
||
tcp 0 0 127.0.0.1:10040 0.0.0.0:* LISTEN
|
||
|
||
If everything works, open your postfix main.cf and insert the following
|
||
|
||
127.0.0.1:10040_time_limit = 3600 <--- integration
|
||
smtpd_recipient_restrictions = permit_mynetworks <--- recommended
|
||
reject_unauth_destination <--- recommended
|
||
check_policy_service inet:127.0.0.1:10040 <--- integration
|
||
|
||
Reload your configuration with `postfix reload` and watch your logs. In it works you should see
|
||
lines like the following in your mail log:
|
||
|
||
Aug 9 23:01:24 mail postfwd[5158]: rule=22, id=ML_POSTFIX, client=english-breakfast.cloud9.net[168.100.1.7], sender=owner-postfix-users@postfix.tld, recipient=someone@domain.local, helo=english-breakfast.cloud9.net, proto=ESMTP, state=RCPT, action=dunno
|
||
|
||
If you want to check for size or rcpt_count items you must integrate postfwd in smtp_data_restrictions or
|
||
smtpd_end_of_data_restrictions. Of course you can also specify a restriction class and use it in your access
|
||
tables. First create a file /etc/postfix/policy containing:
|
||
|
||
domain1.local postfwdcheck
|
||
domain2.local postfwdcheck
|
||
...
|
||
|
||
Then postmap that file (`postmap hash:/etc/postfix/policy`), open your main.cf and enter
|
||
|
||
# Restriction Classes
|
||
smtpd_restriction_classes = postfwdcheck, <some more>... <--- integration
|
||
postfwdcheck = check_policy_service inet:127.0.0.1:10040 <--- integration
|
||
|
||
127.0.0.1:10040_time_limit = 3600 <--- integration
|
||
smtpd_recipient_restrictions = permit_mynetworks, <--- recommended
|
||
reject_unauth_destination, <--- recommended
|
||
... <--- optional
|
||
check_recipient_access hash:/etc/postfix/policy, <--- integration
|
||
... <--- optional
|
||
|
||
Reload postfix and watch your logs.
|
||
|
||
I<Integration via xinetd>
|
||
|
||
There might be several reasons for you to use postfwd via a tcp wrapper package like xinetd (see L<http://www.xinetd.org/>).
|
||
I won`t discuss that here. If you plan to do so, just add the following line to your /etc/services file:
|
||
|
||
# postfwd port
|
||
postfwd 10040/tcp
|
||
|
||
Then create a file '/etc/xinetd.d/postfwd':
|
||
|
||
{
|
||
interface = 127.0.0.1
|
||
socket_type = stream
|
||
protocol = tcp
|
||
wait = no
|
||
user = nobody
|
||
server = /usr/local/bin/postfwd
|
||
server_args = -f /etc/postfwd.cf
|
||
disable = no
|
||
}
|
||
|
||
and restart the xinetd daemon (usually a SIGHUP should be fine). If you experience problems
|
||
you might want to check your system's log for xinetd errors like "socket already in use".
|
||
|
||
The integration with postfix is similar to the I<Integration via daemon mode> section above.
|
||
Reload postfix and watch your logs to see if everything works.
|
||
|
||
|
||
=head2 TESTING
|
||
|
||
First you have to create a ruleset (see Configuration section). Check it with
|
||
|
||
postfwd -f /etc/postfwd.cf -C
|
||
|
||
There is an example policy request distributed with postfwd, called 'request.sample'.
|
||
Simply change it to meet your requirements and use
|
||
|
||
postfwd -f /etc/postfwd.cf <request.sample
|
||
|
||
You should get an answer like
|
||
|
||
action=<whateveryouconfigured>
|
||
|
||
For network tests I use netcat:
|
||
|
||
nc 127.0.0.1 10040 <request.sample
|
||
|
||
to send a request to postfwd. If you receive nothing, make sure that postfwd is running and
|
||
listening on the specified network settings.
|
||
|
||
|
||
=head2 PERFORMANCE
|
||
|
||
Some of these proposals might not match your environment. Please check your requirements and test new options carefully!
|
||
|
||
- use caching options
|
||
- use the correct match operator ==, <=, >=
|
||
- use ^ and/or $ in regular expressions
|
||
- use item lists (faster than single rules)
|
||
- use set() action on repeated item lists
|
||
- use jumps and rate limits
|
||
- use a pre-lookup rule for rbl/rhsbls with empty note() action
|
||
|
||
|
||
=head2 SEE ALSO
|
||
|
||
See L<http://www.postfix.org/SMTPD_POLICY_README.html> for a description
|
||
of how Postfix policy servers work.
|
||
|
||
|
||
=head1 LICENSE
|
||
|
||
postfwd is free software and released under BSD license, which basically means
|
||
that you can do what you want as long as you keep the copyright notice:
|
||
|
||
Copyright (c) 2007, Jan Peter Kessler
|
||
All rights reserved.
|
||
|
||
Redistribution and use in source and binary forms, with or without modification,
|
||
are permitted provided that the following conditions are met:
|
||
|
||
* Redistributions of source code must retain the above copyright
|
||
notice, this list of conditions and the following disclaimer.
|
||
* Redistributions in binary form must reproduce the above copyright
|
||
notice, this list of conditions and the following disclaimer in
|
||
the documentation and/or other materials provided with the
|
||
distribution.
|
||
* Neither the name of the authors nor the names of his contributors
|
||
may be used to endorse or promote products derived from this
|
||
software without specific prior written permission.
|
||
|
||
THIS SOFTWARE IS PROVIDED BY ME ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
||
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
||
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BE LIABLE FOR ANY DIRECT,
|
||
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
|
||
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
||
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
||
POSSIBILITY OF SUCH DAMAGE.
|
||
|
||
|
||
=head1 AUTHOR
|
||
|
||
S<Jan Peter Kessler E<lt>info (AT) postfwd (DOT) orgE<gt>>. Let me know, if you have any suggestions.
|
||
|
||
=cut
|
||
|