|
Server : Apache System : Linux enhance01.hostingraja.org 5.15.0-144-generic #157-Ubuntu SMP Mon Jun 16 07:33:10 UTC 2025 x86_64 User : webdemo_4 ( 4864) PHP Version : 7.4.33 Disable Function : NONE Directory : /usr/sbin/ |
Upload File : |
#!/usr/bin/perl -T -w
#
# postfwd - postfix firewall daemon
#
# Please see `postfwd -h` for usage or
# `postfwd -m` for detailed instructions.
#
package postfwd;
use warnings;
use strict;
# Includes
use Pod::Usage;
use Sys::Syslog qw(:DEFAULT setlogsock);
use Getopt::Long 2.25 qw(:config no_ignore_case bundling);
use POSIX qw(setsid setuid setgid setlocale strftime LC_ALL);
# Networking
use IO::Socket qw(SOCK_STREAM);
use Net::DNS;
use Net::Server::Multiplex;
use vars qw(@ISA);
@ISA = qw(Net::Server::Multiplex);
our($TIMEHIRES); our($STORABLE);
BEGIN {
eval { require Time::HiRes };
if ($@) {
$TIMEHIRES = '%d';
} else {
Time::HiRes->import( qw(time) );
$TIMEHIRES = '%.2f';
};
eval { require Storable };
if ($@) {
$STORABLE = undef;
} else {
$STORABLE = Storable->VERSION;
Storable->import( qw(store retrieve) );
};
};
# Program constants
our($NAME) = 'postfwd';
our($VERSION) = '1.35';
# Networking options (use -i, -p and -R to change)
our($def_net_pid) = "/var/run/".$NAME.".pid";
our($def_net_chroot) = "";
our($def_net_interface) = "127.0.0.1";
our($def_net_port) = "10040";
our($def_net_proto) = "tcp";
our($def_net_umask) = "0177";
our($def_net_user) = "nobody";
our($def_net_group) = "nobody";
our($def_dns_queuesize) = "300";
our($def_dns_retries) = "3";
our($def_dns_timeout) = "14";
our($def_dns_max_ns_a_lookups) = "100";
our($def_dns_max_mx_a_lookups) = "100";
our($def_config_timeout) = "3";
our($reply_maxlen) = "512";
our($max_command_recursion) = "64";
# change this, to match your POD requirements
# we need pod2text for the -m switch (manual)
$ENV{PATH} = "/bin:/usr/bin:/usr/local/bin";
$ENV{ENV} = "";
our($cmd_manual) = "pod2text";
our($cmd_pager) = "more";
# default action, do not change
# unless you really know why
our($default_action) = "DUNNO";
# default maximum values for the score() command
# if exceeded, the specified action will be returned
# may be overwritten by the --scores switch at the command-line
# or the score= item in your ruleset files. please see manual.
our(%MAX_SCORES) = ( "5.0" => "554 5.7.1 ".$NAME." score exceeded" );
# Status interval, displays stats when using `-S` switch
# override with `-S <nn>` at command-line
our($Stat_Interval_Time) = 600;
# Timeout for request cache, results for identical requests will be
# cached until config is reloaded or this time (in seconds) expired
# can be changed with `-c` command-line option
our($REQUEST_MAX_CACHE) = 600;
# minimum ttl for other dns cache objects
our($DNS_MIN_CACHE) = 3600;
# dns key value matching
our(%DNS_REPNAMES) = (
"NS" => "nsdname",
"MX" => "exchange",
"A" => "address",
"TXT" => "char_str_list",
"CNAME" => "cname",
);
# RBL / RHSBL parameters, use "rbl = <name>/<reply>/<maxcache>"
# to override for each RBL in your config
# maximum cache time in seconds, use 0 to deactivate
our($RBL_MAX_CACHE) = 3600;
# default rbl reply if not specified
our($RBL_DEFAULT) = '^127\.';
# skip this dnsbl after <n> timeouts
our($MAX_DNSBL_TIMEOUTS) = 10;
our($MAX_DNSBL_INTERVAL) = 1200;
# Cache cleanup routines will be called periodically
our($CLEANUP_REQUEST_CACHE) = 600;
our($CLEANUP_RBL_CACHE) = 600;
our($CLEANUP_RATE_CACHE) = 600;
# these items have to be compared as...
# scoring
our($COMP_SCORES) = "score";
our($COMP_NS_NAME) = "sender_ns_names";
our($COMP_NS_ADDR) = "sender_ns_addrs";
our($COMP_MX_NAME) = "sender_mx_names";
our($COMP_MX_ADDR) = "sender_mx_addrs";
our($COMP_HELO_ADDR) = "helo_address";
# networks in CIDR notation (a.b.c.d/nn)
our($COMP_NETWORK_CIDRS) = "(client_address|sender_(ns|mx)_addrs|helo_address)";
# RBL checks
our($COMP_DNSBL_TEXT) = "dnsbltext";
our($COMP_RBL_CNT) = "rblcount";
our($COMP_RHSBL_CNT) = "rhsblcount";
our($COMP_RBL_KEY) = "rbl";
our($COMP_RHSBL_KEY) = "rhsbl";
our($COMP_RHSBL_KEY_CLIENT) = "rhsbl_client";
our($COMP_RHSBL_KEY_SENDER) = "rhsbl_sender";
our($COMP_RHSBL_KEY_RCLIENT) = "rhsbl_reverse_client";
our($COMP_RHSBL_KEY_HELO) = "rhsbl_helo";
# file items
our($COMP_CONF_FILE) = 'cfile|file';
our($COMP_CONF_TABLE) = 'ctable|table';
our($COMP_LIVE_FILE) = 'lfile';
our($COMP_LIVE_TABLE) = 'ltable';
our($COMP_TABLES) = qr/^($COMP_CONF_TABLE|$COMP_LIVE_TABLE)$/i;
our($COMP_CONF_FILE_TABLE) = qr/^($COMP_CONF_FILE|$COMP_CONF_TABLE):(.+)$/i;
our($COMP_LIVE_FILE_TABLE) = qr/^($COMP_LIVE_FILE|$COMP_LIVE_TABLE):(.+)$/i;
# date checks
our($COMP_DATE) = "date";
our($COMP_TIME) = "time";
our($COMP_DAYS) = "days";
our($COMP_MONTHS) = "months";
# always true
our($COMP_ACTION) = "action";
our($COMP_ID) = "id";
# rule hits
our($COMP_HITS) = "request_hits";
# item match counter
our($COMP_MATCHES) = "matches";
# separator
our($COMP_SEPARATOR) = "[=\~\<\>]=|[\<\>]|[=\!][=\~\<\>]|=";
# macros
our($COMP_ACL) = "[\&][\&]";
# negation
our($COMP_NEG) = "[\!][\!]";
# variables
our($COMP_VAR) = "[\$][\$]";
# date calculations
our($COMP_DATECALC) = "($COMP_DATE|$COMP_TIME|$COMP_DAYS|$COMP_MONTHS)";
# these items allow whitespace-or-comma-separated values
our($COMP_CSV) = "($COMP_NETWORK_CIDRS|$COMP_RBL_KEY|$COMP_RHSBL_KEY|$COMP_RHSBL_KEY_CLIENT|$COMP_RHSBL_KEY_HELO|$COMP_RHSBL_KEY_SENDER|$COMP_RHSBL_KEY_RCLIENT|$COMP_DATECALC|$COMP_HELO_ADDR|$COMP_NS_ADDR|$COMP_MX_ADDR)";
# dont treat these as lists
our($COMP_SINGLE) = "($COMP_ID|$COMP_ACTION|$COMP_SCORES|$COMP_RBL_CNT|$COMP_RHSBL_CNT)";
# Syslog options
our($syslog_name) = $NAME;
our($syslog_facility) = "mail";
our($syslog_priority) = "info";
our($syslog_options) = "pid";
our($syslog_socktype) = 'unix';
our($syslog_maxlen) = 0;
our($syslog_safe) = 0;
our($syslog_unsafe_charset) = qr/[^\x20-\x7E]/;
if ( defined $Sys::Syslog::VERSION and $Sys::Syslog::VERSION ge '0.15' ) {
# use 'native' when Sys::Syslog >= 0.15
$syslog_socktype = 'native';
$syslog_options .= ",nofatal";
} elsif($^O eq 'solaris') {
# 'stream' is broken and 'unix' doesn't work on Solaris: only 'inet'
# seems to be useable with Sys::Syslog < 0.15
$syslog_socktype = 'inet';
} else { $syslog_safe = 1 };
# save command-line
our(@CommandArgs) = @ARGV;
# initializations - do not change
our(%months) = (
"Jan" => 0, "jan" => 0, "JAN" => 0,
"Feb" => 1, "feb" => 1, "FEB" => 1,
"Mar" => 2, "mar" => 2, "MAR" => 2,
"Apr" => 3, "apr" => 3, "APR" => 3,
"May" => 4, "may" => 4, "MAY" => 4,
"Jun" => 5, "jun" => 5, "JUN" => 5,
"Jul" => 6, "jul" => 6, "JUL" => 6,
"Aug" => 7, "aug" => 7, "AUG" => 7,
"Sep" => 8, "sep" => 8, "SEP" => 8,
"Oct" => 9, "oct" => 9, "OCT" => 9,
"Nov" => 10, "nov" => 10, "NOV" => 10,
"Dec" => 11, "dec" => 11, "DEC" => 11,
);
our(%weekdays) = (
"Sun" => 0, "sun" => 0, "SUN" => 0,
"Mon" => 1, "mon" => 1, "MON" => 1,
"Tue" => 2, "tue" => 2, "TUE" => 2,
"Wed" => 3, "wed" => 3, "WED" => 3,
"Thu" => 4, "thu" => 4, "THU" => 4,
"Fri" => 5, "fri" => 5, "FRI" => 5,
"Sat" => 6, "sat" => 6, "SAT" => 6,
);
our($SepReq) = '///';
our($SepLst) = ':::';
our($KeyVal) = qr/^([^=]+)=(.*)$/;
use vars qw(
@Configs @Rules @CacheID @DNSBL_Text @Plugins @Rate_Items @DEBUGLIST
%Config_Cache %DNS_Cache %Request_Cache %Rule_by_ID %DEBUG
%Matches %opt_scores %ACLs %Rates %Timeouts
%postfwd_items %postfwd_items_plugin
%postfwd_compare %postfwd_compare_plugin
%postfwd_actions %postfwd_actions_plugin
$Counter_Requests $Counter_Hits $opt_max_ns_lookups $opt_max_mx_lookups
$Counter_Interval $Counter_Top $Counter_Rates
$Starttime $Cleanup_Requests $Cleanup_RBLs $Cleanup_Rates $Cleanup_Timeouts
$opt_daemon $opt_instantconfig $opt_nodns $opt_nodnslog
$opt_norulelog $opt_summary $net_interface $net_port $net_umask
$net_user $net_group $net_chroot $net_pid $net_proto $opt_saverates
$opt_perfmon $opt_test $opt_verbose $opt_noidlestats $opt_delcache $opt_delrate
$opt_cache_rdomain_only $opt_cache_no_size $config_timeout $opt_fast_limits
$opt_cache_no_sender $opt_no_rulestats $opt_kill $opt_hup $opt_dumpcache $opt_dumpstats
$opt_showconfig $opt_stdoutlog $opt_shortlog $dns_async_txt $opt_keep_rates_on_reload
$DNS $Reload_Conf $dns_queuesize $dns_retries $dns_timeout
);
our %Name_To_Var = (
\%Config_Cache => '%config_cache',
\%Request_Cache => '%request_cache',
\%DNS_Cache => '%dns_cache',
\%Rates => '%rate_cache',
\%ACLs => '%acl_cache',
\%Matches => '%match_cache',
\%Timeouts => '%timeout_cache',
);
### SUB tools
#
# send log message
#
sub mylog {
my($prio) = shift(@_);
my($msg) = shift(@_);
# truncate syslogs (--loglen option)
$msg = substr($msg, 0, $syslog_maxlen) if $syslog_maxlen;
if ( not($opt_perfmon) or ($prio eq "crit") ) {
unless ($opt_stdoutlog) {
# Sys::Syslog < 0.15 dies when syslog daemon is temporarily not
# present (for example on syslog rotation)
if($syslog_safe) {
eval {
local $SIG{__DIE__} = sub { };
syslog $prio, "$msg", @_;
};
} else { syslog $prio, "$msg", @_; };
} else { $msg =~ s/\%/%%/g; $msg =~ /^(.*)$/; printf "[LOG $prio]: $1\n", @_; };
};
};
#
# send log message, escaping % character
#
sub mylogs {
my($prio) = shift(@_);
my($msg) = shift(@_);
$msg =~ s/\%/%%/g; $msg =~ s/$syslog_unsafe_charset/?/g;
mylog $prio, $msg;
};
#
# print a string to STDOUT
#
sub myprint {
my($msg) = shift(@_);
print STDOUT $msg, @_
unless $opt_perfmon;
};
#
# print formatted string to STDOUT
#
sub myprintf {
my($msg) = shift(@_);
printf STDOUT $msg, @_
unless $opt_perfmon;
};
#
# short versions
#
sub log_info { mylogs ('info', @_) };
sub log_note { mylogs ('notice', @_) };
sub log_warn { mylogs ('warning', @_) };
sub log_err { mylogs ('err', @_) };
sub log_crit { mylogs ('crit', @_) };
#
# tests debug levels
#
sub wantsdebug {
return unless %DEBUG;
foreach (@_) { return 1 if $DEBUG{$_} };
};
#
# prints formatted timestamp
#
sub ts { return sprintf ("$TIMEHIRES", $_[0]) };
#
# Log an error and abort.
#
sub fatal_exit {
my($msg) = shift(@_);
warn "fatal: $msg", @_;
exit 1;
};
#
# finish program
#
sub end_program {
undef $opt_noidlestats;
show_stats() if $opt_summary;
$net_pid ||= $def_net_pid; unlink $net_pid if (-T $net_pid);
save_rates();
log_note $NAME." ".$VERSION." terminated" if $opt_daemon;
exit;
};
# get pid of running master process
sub get_master_pid {
$net_pid ||= $def_net_pid;
(-e $net_pid) or die $NAME.": Can not find pid_file ".$net_pid.": $!\n";
(-T $net_pid) or die $NAME.": Can not open pid_file ".$net_pid.": not a textfile\n";
open PIDFILE, "<".$net_pid or die $NAME.": Can open pid_file ".$net_pid.": $!\n";
my $pid = <PIDFILE>;
($pid =~ m/^(\d+)$/) or die $NAME.": Invalid pid_file content '$pid' (pid_file ".$net_pid.")\n";
return $1;
};
#
# run a shell command
#
sub exec_cmd {
my($mycmd) = @_;
my($myresult) = ( system($mycmd) );
if ( $myresult ) {
myprint "Could not execute `".$mycmd."` (Error: ".$myresult.")\n";
myprint "Please check the \$ENV{PATH} setting in the first lines of this program.\n";
myprint "Current setting: \"".$ENV{PATH}."\"\n";
};
return not($myresult);
};
#
# takes a list and returns a unified list, keeping given order
#
sub uniq {
undef my %uniq;
return grep(!$uniq{$_}++, @_);
};
#
# hash -> scalar
#
sub hash_to_str {
my %request = @_; my $result = '';
map { $result .= $SepReq."$_=".((ref $request{$_} eq 'ARRAY') ? (join $SepLst, @{$request{$_}}) : ($request{$_} || '')) } (keys %request);
return $result;
};
#
# scalar -> hash
#
sub str_to_hash {
my $request = shift; my %result = ();
foreach (split $SepReq, $request) {
next unless m/$KeyVal/;
my @items = split $SepLst, $2;
($#items) ? @{$result{$1}} = @items : $result{$1} = $2;
}; return %result;
};
#
# displays hash structure
#
sub hash_to_list {
my ($pre, %request) = @_; my @output = ();
# get longest key
my $minkey = '-'.(length((sort {length($b) <=> length($a)} (keys %request))[0] || '') + 1);
while ( my($s, $v) = each %request ) {
my $r = ref $v;
if ($r eq 'HASH') {
push @output, (%{$v})
? hash_to_list ( sprintf ("%s -> %".$minkey."s", $pre, '%'.$s), %{$v} )
: sprintf ("%s -> %".$minkey."s -> %s", $pre, '%'.$s, 'undef');
} elsif ($r eq 'ARRAY') {
push @output, sprintf ("%s -> %".$minkey."s -> %s", $pre, '@'.$s, ((@{$v}) ? "'".(join ",", @{$v})."'" : 'undef'));
} elsif ($r eq 'CODE') {
push @output, sprintf ("%s -> %".$minkey."s -> %s", $pre, '&'.$s, ((defined $v) ? "'".$v."'" : 'undef'));
} else {
push @output, sprintf ("%s -> %".$minkey."s -> %s", $pre, '$'.$s, ((defined $v) ? "'".$v."'" : 'undef'));
};
};
return sort { my ($c, $d) = ($a, $b);
$c =~ tr/$/1/; $c =~ tr/&/2/; $c =~ tr/@/3/; $c =~ tr/%/4/;
$d =~ tr/$/1/; $d =~ tr/&/2/; $d =~ tr/@/3/; $d =~ tr/%/4/;
return $c cmp $d; } @output;
};
#
# get ip and mask
#
sub cidr_parse
{
defined $_[0] or return undef;
$_[0] =~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)\/(\d+)$/ or return undef;
$1 < 256 and $2 < 256 and $3 < 256 and $4 < 256 and $5 <= 32 and $5 >= 0
or return undef;
my $net = ($1<<24)+($2<<16)+($3<<8)+$4;
my $mask = ~((1<<(32-$5))-1);
return ($net & $mask, $mask);
};
#
# compare address to network
#
sub cidr_match
{
my ($net, $mask, $addr) = @_;
return undef unless defined $net and defined $addr;
if($addr =~ /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/) {
$addr = ($1<<24)+($2<<16)+($3<<8)+$4;
};
return ($addr & $mask) == $net;
};
#
# clean up RBL cache
#
sub cleanup_dns_cache {
my($now) = $_[0];
foreach my $checkitem (keys %DNS_Cache) {
# remove inclomplete objects (dns timeouts)
if ( !defined($DNS_Cache{$checkitem}{"time"}) or !defined($DNS_Cache{$checkitem}{ttl}) ) {
log_info "[CLEANUP] deleting incomplete dns-cache item '$checkitem'" if (wantsdebug(qw[ all cleanup ]));
delete $DNS_Cache{$checkitem};
# remove timed out objects
} elsif ( ($now - $DNS_Cache{$checkitem}{"time"}) > $DNS_Cache{$checkitem}{ttl} ) {
log_info "[CLEANUP] removing dns-cache item '$checkitem' after ttl ".$DNS_Cache{$checkitem}{ttl}."s"
if (wantsdebug(qw[ all cleanup ]));
delete $DNS_Cache{$checkitem};
};
};
};
#
# clean up request cache
#
sub cleanup_request_cache {
my($now) = $_[0];
foreach my $checkitem (keys %Request_Cache) {
if ( not(defined $Request_Cache{$checkitem}{'until'}) ) {
log_info "[CLEANUP] deleting incomplete request-cache item '$checkitem'" if (wantsdebug(qw[ all cleanup ]));
delete $Request_Cache{$checkitem};
} elsif ( $now > $Request_Cache{$checkitem}{'until'} ) {
log_info "[CLEANUP] removing request-cache item '$checkitem' after ttl ".$REQUEST_MAX_CACHE."s"
if (wantsdebug(qw[ all cleanup ]));
delete $Request_Cache{$checkitem};
};
};
};
#
# clean up rate cache
#
sub cleanup_rate_cache {
my($now) = $_[0];
foreach my $checkitem (keys %Rates) {
unless (defined $Rates{$checkitem}{'list'}) {
delete $Rates{$checkitem};
} else {
my @i = ();
foreach my $crate (@{$Rates{$checkitem}{'list'}}) {
if ( not(defined $Rates{$checkitem}{$crate}{'until'}) ) {
log_info "[CLEANUP] deleting incomplete rate-cache item '$checkitem'->'$crate'" if (wantsdebug(qw[ all cleanup ]));
delete $Rates{$checkitem}{$crate};
} elsif ( $now > $Rates{$checkitem}{$crate}{'until'} ) {
log_info "[CLEANUP] removing rate-cache item '$checkitem'->'$crate' after ttl ".$Rates{$checkitem}{$crate}{ttl}."s"
if (wantsdebug(qw[ all cleanup ]));
delete $Rates{$checkitem}{$crate};
} else {
push @i, $crate;
};
};
unless ($i[0]) {
log_info "[CLEANUP] deleting complete rate-cache item '$checkitem'" if (wantsdebug(qw[ all cleanup ]));
delete $Rates{$checkitem};
} else {
log_info "[CLEANUP] new index list for rate-cache item '$checkitem': ".(join ', ', @i) if (wantsdebug(qw[ all cleanup ]));
@{$Rates{$checkitem}{'list'}} = @i;
};
};
};
};
#
# sets an action for a score
#
sub modify_score {
(my($myscore), my($myaction)) = @_;
( exists($MAX_SCORES{$myscore}) )
? log_note "redefined score $myscore with action=\"$myaction\""
: log_note "setting new score $myscore with action=\"$myaction\""
if wantsdebug(qw[ all thisrequest verbose score ]);
$MAX_SCORES{$myscore} = $myaction;
};
#
# dump cache contents
#
sub dump_cache {
my @dump = (); my @list = (\%Request_Cache, \%Rates);
@list = (@list, \%DNS_Cache) unless $opt_nodns;
@list = (@list, \%Config_Cache, \%ACLs, \%Matches, \%Timeouts) if wantsdebug(qw[ all verbose ]);
map { @dump = ( @dump, hash_to_list ($Name_To_Var{$_}, %{$_}) ) } @list;
return @dump;
};
#
# creates program usage statistics
#
sub list_stats {
my $now = time(); my @output = ();
my $uptime = $now - $Starttime;
$Counter_Requests ||= 0;
$Counter_Interval ||= 0;
$Counter_Top ||= 0;
$Counter_Hits ||= 0;
$Counter_Rates ||= 0;
my($totalreqpermin) = ( (($uptime > 0) ? ($Counter_Requests / $uptime) : 0 ) * 60);
my($lastreqpermin) = ($Counter_Interval / (((defined $Stat_Interval_Time) and ($Stat_Interval_Time > 0)) ? $Stat_Interval_Time : 1)) * 60;
$Counter_Top = $lastreqpermin if ($lastreqpermin > $Counter_Top);
if (not($opt_noidlestats) or ($Counter_Interval > 0) ) {
push @output, sprintf (
"%s %s: up since %d days, %02d:%02d:%02d hours",
$NAME, $VERSION,
($uptime / 60 / 60 / 24),
(($uptime / 60 / 60) % 24),
(($uptime / 60) % 60),
($uptime % 60));
push @output, sprintf ("Requests: %d overall, %d last interval, %.1f%% cache hits, %.1f%% rate hits",
$Counter_Requests, $Counter_Interval,
($Counter_Requests > 0) ? (($Counter_Hits / $Counter_Requests) * 100) : 0,
($Counter_Requests > 0) ? (($Counter_Rates / $Counter_Requests) * 100) : 0);
push @output, sprintf ("Averages: %.1f overall, %.1f last interval, %.1f top",
$totalreqpermin, $lastreqpermin, $Counter_Top);
push @output, sprintf ("Contents: %d rules, %d cached requests, %d cached dns results, %d rate limits",
$#Rules, scalar keys %Request_Cache, scalar keys %DNS_Cache, scalar keys %Rates);
# per rule stats
if (not($opt_no_rulestats) and @Rules and %Matches) {
my @rulecharts = (sort { ($Matches{$b} || 0) <=> ($Matches{$a} || 0) } (keys %Matches)); my $cntln = length(($Matches{$rulecharts[0]} || 2)) + 2;
map { push @output, sprintf ("%".$cntln."d matches for id: %s", ($Matches{$_} || 0), $_) } @rulecharts;
};
};
return @output;
};
#
# shows program usage statistics via syslog
#
sub show_stats {
map { mylog 'notice', "[STATS] $_" } list_stats();
$Counter_Interval = 0;
};
#
# returns content of !!() negation
#
sub deneg_item {
my($val) = (defined $_[0]) ? $_[0] : '';
return ( ($val =~ /^$COMP_NEG\s*\(?\s*(.+?)\s*\)?$/) ? $1 : '' );
};
#
# resolves $$() variables
#
sub devar_item {
my($cmp,$val,$myitem,%request) = @_;
return '' unless $val and $myitem;
my($pre,$post,$var,$myresult) = '';
while ( ($val =~ /(.*)$COMP_VAR\s*(\w+)(.*)/g) or ($val =~ /(.*)$COMP_VAR\s*\((\w+)\)(.*)/g) ) {
($pre,$var,$post) = ($1,$2,$3);
if ($var eq $COMP_DNSBL_TEXT) {
$myresult=$val=$pre.(join "; ", uniq(@DNSBL_Text)).$post;
} elsif (defined $request{$var}) {
$myresult=$val=$pre.$request{$var}.$post;
};
log_info "substitute : \"$myitem\" \"$cmp\" \"$val\""
if (wantsdebug(qw[ all thisrequest devar ]));
};
return $myresult;
};
### SUB configuration
#
# preparses configuration line for ACL syntax
#
sub acl_parser {
my($file,$num,$myline) = @_;
if ( $myline =~ /^\s*($COMP_ACL[\-\w]+)\s*{\s*(.*?)\s*;?\s*}[\s;]*$/ ) {
$ACLs{$1} = $2; $myline = "";
} else {
while ( $myline =~ /($COMP_ACL[\-\w]+)/) {
my($acl) = $1;
if ( $acl and defined $ACLs{$acl} ) {
$myline =~ s/\s*$acl\s*/$ACLs{$acl}/g;
} else {
#return "action=note(undefined macro '$acl')";
log_warn "file $file, ignoring line $num: undefined macro '$acl'";
return "";
};
};
};
return $myline;
};
#
# prepares pcre item
#
sub prepare_pcre {
my($item) = shift; undef my $neg;
# temporarily remove negation
$item = $neg if ($neg = deneg_item($item));
# allow // regex
$item =~ s/^\/?(.*?)\/?$/$1/;
# tested slow
#$item = qr/$item/i;
# re-enable negation
$item = "!!($item)" if $neg;
return $item;
};
#
# prepares file item
#
sub prepare_file {
my($forced_reload,$type,$cmp,$file) = @_; my(@result) = (); undef my $fh;
my($is_table) = ($type =~ /^$COMP_TABLES$/);
unless (-e $file) {
log_warn "error: $type:$file not found - will be ignored";
return @result;
};
if ( not($forced_reload) and (defined $Config_Cache{$file}{lastread}) and ($Config_Cache{$file}{lastread} > (stat $file)[9]) ) {
mylogs $syslog_priority, "$type:$file unchanged - using cached content (mtime: "
.(stat $file)[9].", cache: $Config_Cache{$file}{lastread})"
if (wantsdebug(qw[ all thisrequest config ]));
return @{$Config_Cache{$file}{content}};
};
unless (open ($fh, "<$file")) {
log_warn "error: could not open $type:$file - $! - will be ignored";
return @result;
};
log_info "reading $type:$file" if (wantsdebug(qw[ all thisrequest config ]));
while (<$fh>) {
chomp;
s/#.*//g;
next if /^\s*$/;
s/\s+[^\s]+$// if $is_table;
s/^\s+//; s/\s+$//;
push @result, prepare_item($forced_reload, $cmp, $_);
}; close ($fh);
# update Config_Cache
$Config_Cache{$file}{lastread} = time();
@{$Config_Cache{$file}{content}} = @result;
log_info "read ".($#result + 1)." items from $type:$file" if (wantsdebug(qw[ all thisrequest config ]));
return @result;
};
#
# prepares ruleset item
#
sub prepare_item {
my($forced_reload,$cmp,$item) = @_; my(@result) = (); undef my $type;
if ($item =~ /$COMP_CONF_FILE_TABLE/) {
return prepare_file ($forced_reload, $1, $cmp, $2);
} elsif ($cmp eq '=~' or $cmp eq '!~') {
return $cmp.";".prepare_pcre($item);
} else {
return $cmp.";".$item;
};
};
#
# compatibility for old "rate"-syntax
#
sub check_for_old_syntax {
my($myindex,$myfile,$mynum,$mykey,$myvalue) = @_;
if ($mykey =~ /^action$/) {
if ($myvalue =~ /^(\w[\-\w]+)\s*\(\s*(.*?)\s*\)$/) {
my($mycmd,$myarg) = ($1, $2);
if ($mycmd =~ /^(rate|size|rcpt)(5321)?$/i) {
if ($myarg =~ /^\$\$(.*)$/) {
$myarg = $1;
$myvalue = "$mycmd($myarg)";
log_note "notice: Rule $myindex ($myfile line $mynum): "
."removing obsolete '\$\$' for $mycmd limit index. See man page for new syntax." if wantsdebug(qw[ all thisrequest verbose config ]);
};
push @Rate_Items, (split '/', $myarg)[0];
};
};
};
return $myvalue;
};
#
# parses configuration line
#
sub parse_config_line {
my($forced_reload, $myfile, $mynum, $myindex, $myline) = @_;
my(%myrule) = ();
my($mykey, $myvalue, $mycomp);
eval {
local $SIG{'__DIE__'};
local $SIG{'ALRM'} = sub { $myline =~ s/[ \t][ \t]*/ /g; log_warn "timeout after ".$config_timeout."s at parsing Rule $myindex ($myfile line $mynum): \"$myline\""; %myrule = (); die };
my $prevalert = alarm($config_timeout) if $config_timeout;
if ( $myline = acl_parser ($myfile, $mynum, $myline) ) {
unless ( $myline =~ /^\s*[^=\s]+\s*$COMP_SEPARATOR\s*([^;\s]+\s*)+(;\s*[^=\s]+\s*$COMP_SEPARATOR\s*([^;\s]+\s*)+)*[;\s]*$/ ) {
log_warn "ignoring invalid $myfile line ".$mynum.": \"".$myline."\"";
} else {
# separate items
foreach (split ";", $myline) {
# remove whitespaces around
s/^\s*(.*?)\s*($COMP_SEPARATOR)\s*(.*?)\s*$/$1$2$3/;
( ($mycomp = $2) =~ /^([\<\>\~])=$/ ) and $mycomp = "=$1";
($mykey, $myvalue) = split /$COMP_SEPARATOR/, $_, 2;
if ($mykey =~ /^$COMP_SINGLE$/) {
log_note "notice: Rule $myindex ($myfile line $mynum):"
." overriding $mykey=\"".$myrule{$mykey}."\""
." with $mykey=\"$myvalue\""
if (defined $myrule{$mykey});
$myvalue = check_for_old_syntax($myindex,$myfile,$mynum,$mykey,$myvalue);
$myrule{$mykey} = $myvalue;
} elsif ($mykey =~ /^$COMP_CSV$/) {
$myvalue =~ s/\s*,\s*/,/g;
map { push @{$myrule{$mykey}}, prepare_item ($forced_reload, $mycomp, $_) } ( split /\s*,\s*/, $myvalue );
} else {
push @{$myrule{$mykey}}, prepare_item ($forced_reload, $mycomp, $myvalue);
};
};
unless (exists($myrule{$COMP_ACTION})) {
log_warn "Rule ".$myindex." ($myfile line ".$mynum."): contains no action and will be ignored";
return (%myrule = ());
};
unless (exists($myrule{$COMP_ID})) {
$myrule{$COMP_ID} = "R-".$myindex;
log_note "notice: Rule $myindex ($myfile line $mynum): contains no rule identifier - will use \"$myrule{id}\"" if wantsdebug(qw[ all thisrequest verbose config ]);
};
log_info "loaded: Rule $myindex ($myfile line $mynum): id->\"$myrule{id}\" action->\"$myrule{action}\"" if wantsdebug(qw[ all thisrequest verbose config ]);
};
};
alarm($prevalert) if $config_timeout;
};
return %myrule;
};
#
# parses configuration file
#
sub read_config_file {
my($forced_reload, $myindex, $myfile) = @_;
my(%myrule, @myruleset, @lines) = ();
my($mybuffer) = ""; undef my $fh;
unless (-e $myfile) {
warn "error: file ".$myfile." not found - file will be ignored";
} else {
unless (open ($fh, "<$myfile")) {
warn "error: could not open ".$myfile." - $! - file will be ignored";
} else {
log_info "reading file $myfile" if wantsdebug(qw[ all thisrequest verbose config ]);
while (<$fh>) {
chomp;
s/(\"|#.*)//g;
next if /^\s*$/;
if ( /(.*)\\\s*$/ or /(.*\{)\s*$/ ) { $mybuffer = $mybuffer.$1; next; };
$mybuffer .= $_;
if ( $lines[0] and $mybuffer =~ /^(\}|\s+\S)/ ) {
my $last = pop(@lines); $last .= ';' unless $last =~ /;\s*$/;
$mybuffer = $last.$mybuffer;
};
push @lines, $mybuffer;
$mybuffer = "";
};
map {
log_info "parsing line: '$_'" if wantsdebug(qw[ all thisrequest config ]);
%myrule = parse_config_line ($forced_reload, $myfile, $., ($#myruleset+$myindex+1), $_);
push ( @myruleset, { %myrule } ) if (%myrule);
} @lines;
close ($fh);
log_info "loaded: Rules $myindex - ".($myindex + $#myruleset)." from file \"$myfile\"" if wantsdebug(qw[ all thisrequest verbose config ]);
};
};
return @myruleset;
}
#
# reads all configuration items
#
sub read_config {
my($forced_reload) = shift;
my(%myrule, @myruleset) = ();
my($mytype,$myitem,$config);
# init, cleanup cache and config vars
@Rules = %Rule_by_ID = %Request_Cache = @Rate_Items = ();
%Rates = () unless $opt_keep_rates_on_reload;
# parse configurations
for $config (@Configs) {
($mytype,$myitem) = split '::', $config;
if ($mytype eq "r" or $mytype eq "rule") {
%myrule = parse_config_line ($forced_reload, 'RULE', 0, ($#Rules + 1), $myitem);
push ( @Rules, { %myrule } ) if (%myrule);
} elsif ($mytype eq "f" or $mytype eq "file") {
if ( not($forced_reload) and (defined $Config_Cache{$myitem}{lastread}) and ($Config_Cache{$myitem}{lastread} > (stat $myitem)[9]) ) {
mylogs $syslog_priority,
"file \"$myitem\" unchanged - using cached ruleset (mtime: ".(stat $myitem)[9].",
cache: $Config_Cache{$myitem}{lastread})"
if wantsdebug(qw[ all thisrequest verbose config ]);
push ( @Rules, @{$Config_Cache{$myitem}{ruleset}} );
} else {
@myruleset = read_config_file ($forced_reload, ($#Rules+1), $myitem);
if (@myruleset) {
push ( @Rules, @myruleset );
$Config_Cache{$myitem}{lastread} = time();
@{$Config_Cache{$myitem}{ruleset}} = @myruleset;
};
};
};
};
if ($#Rules < 0) {
log_warn "critical: no rules found - i feel useless (have you set -f or -r?)";
} else {
# update Rule by ID hash
map { $Rule_by_ID{$Rules[$_]{$COMP_ID}} = $_ } (0 .. $#Rules);
if (@Rate_Items) {
@Rate_Items = uniq(@Rate_Items);
log_info "rate items: ".(join ', ', @Rate_Items) if wantsdebug(qw[ all thisrequest verbose config rates ]);
# disable request cache with ratelimits unless --fast_limit_evaluation is set
unless ($opt_fast_limits) {
$REQUEST_MAX_CACHE = 0;
log_note "disabling request cache due to ratelimits in configuration. may be changed with the --fast_limit_evaluation option"
if wantsdebug (qw[ all thisrequest verbose ]);
};
};
};
}
#
# displays configuration
#
sub show_config {
my($index,$line,$mykey);
if (wantsdebug(qw[ all verbose ])) {
myprint "=" x 75, "\n";
myprintf "Rule count: %s\n", ($#Rules + 1);
myprint "=" x 75, "\n";
};
for $index (0 .. $#Rules) {
next unless exists $Rules[$index];
myprintf "Rule %3d: id->\"%s\"; action->\"%s\"", $index, $Rules[$index]{$COMP_ID}, $Rules[$index]{$COMP_ACTION};
$line = (wantsdebug(qw[ all verbose ])) ? "\n\t " : "";
for $mykey ( reverse sort keys %{$Rules[$index]} ) {
unless (($mykey eq $COMP_ACTION) or ($mykey eq $COMP_ID)) {
$line .= "; " unless wantsdebug(qw[ all verbose ]);
$line .= ($mykey =~ /^$COMP_SINGLE$/)
? $mykey."->\"".$Rules[$index]{$mykey}."\""
: $mykey."->\"".(join ', ', @{$Rules[$index]{$mykey}})."\"";
$line .= " ; " if wantsdebug(qw[ all verbose ]);
};
};
$line =~ s/\s*\;\s*$// if wantsdebug(qw[ all verbose ]);
myprintf "%s\n", $line;
myprint "-" x 75, "\n" if wantsdebug(qw[ all verbose ]);
};
}
#
# saves rate limits to disk
#
sub save_rates {
return unless ($STORABLE and $opt_saverates and %Rates);
cleanup_rate_cache(time());
umask oct('0177');
eval { store (\%Rates, $opt_saverates) };
if ( $@ ) {
log_note "ERROR: Could not store rate limits to ".$opt_saverates." ('$!': '@_')";
} else {
log_info "Saved ".(scalar %Rates)." rates to ".$opt_saverates
if wantsdebug(qw[ all verbose rates loadrates saverates ]);
};
umask oct($net_umask);
};
#
# loads rate limits from disk
#
sub load_rates {
return unless ($STORABLE and $opt_saverates and (-f $opt_saverates));
eval { %Rates = %{ retrieve($opt_saverates) } };
if ( $@ ) {
log_note "Could not load rate limits from ".$opt_saverates." ('$!': '@_')";
} else {
log_info "Fetched ".(scalar %Rates)." rates from ".$opt_saverates
if wantsdebug(qw[ all verbose rates loadrates saverates ]);
cleanup_rate_cache(time());
};
};
## sub DNS
#
# checks for rbl timeouts
#
sub rbl_timeout {
my($myrbl) = shift;
return ( ($MAX_DNSBL_TIMEOUTS > 0) and (defined $Timeouts{$myrbl}) and ($Timeouts{$myrbl} > $MAX_DNSBL_TIMEOUTS) );
};
#
# reads DNS answers
#
sub rbl_read_dns {
my($myresult) = shift;
my($now) = time();
my($que,$ttl,$res,$typ) = undef;
my(@addrs) = ();
if ( defined $myresult ) {
# read question, for dns cache id
foreach ($myresult->question) {
$typ = $_->qtype;
next unless (($typ eq 'A') or ($typ eq 'TXT'));
if ($que = $_->qname) {
# some RBLs return CNAMEs, so the number of the questions
# is not necessarily the number of answers you get
foreach ($myresult->answer) {
if ($_->type eq 'A') {
push @addrs, $_->address if $_->address;
$ttl = $_->ttl;
} elsif ($_->type eq 'TXT') {
$res = join(" ", $_->char_str_list());
$ttl = $_->ttl;
};
};
# save result in cache
if ( exists($DNS_Cache{$que}) ) {
if ($typ eq 'A') {
$ttl = ( $DNS_Cache{$que}{ttl} > ($ttl||=0) ) ? $DNS_Cache{$que}{ttl} : $ttl;
log_info "[DNSBL] object "
.( ($DNS_Cache{$que}{type} eq $COMP_RBL_KEY)
? join(".", reverse(split(/\./,$DNS_Cache{$que}{value})))
: $DNS_Cache{$que}{value} )
." listed on ".$DNS_Cache{$que}{type}.":".$DNS_Cache{$que}{name}
." (answer: ".(join ", ", @addrs)
.", time: ".ts($now - $DNS_Cache{$que}{starttime})."s"
.", ttl: ".$ttl."s)"
if ( @addrs and not($opt_nodnslog) );
@{$DNS_Cache{$que}{A}} = @addrs;
$DNS_Cache{$que}{"time"} = $now;
$DNS_Cache{$que}{ttl} = $ttl;
} elsif ($typ eq 'TXT') {
$res ||= '';
# ugly, commas need to be escaped for set() action
$res =~ s/,/ /g;
$ttl = ( $DNS_Cache{$que}{ttl} > ($ttl||=0) ) ? $DNS_Cache{$que}{ttl} : $ttl;
$DNS_Cache{$que}{TXT} = $res;
$DNS_Cache{$que}{endtime} = $now unless $DNS_Cache{$que}{endtime};
$DNS_Cache{$que}{ttl} = $ttl unless $DNS_Cache{$que}{ttl};
};
} else {
log_note "[DNSBL] ignoring unknown query $que";
};
};
};
} else {
log_note "[DNSBL] dns timeout";
};
return $que if (@addrs || $res);
};
#
# fires DNS queries
#
sub rbl_prepare_lookups {
my($mytype, $myval, @myrbls) = @_;
my($myresult) = undef;
my($cmp,$rblitem,$myquery);
my(@lookups) = ();
# removes duplicate lookups, but keeps the specified order
@myrbls = uniq(@myrbls);
RBLQUERY: foreach (@myrbls) {
# separate rbl-name and answer
($cmp,$rblitem) = split ";", $_;
next RBLQUERY unless $rblitem;
my($myrbl, $myrblans, $myrbltime) = split /\//, $rblitem;
next RBLQUERY unless $myrbl;
next RBLQUERY if rbl_timeout($myrbl);
$myrblans = $RBL_DEFAULT unless $myrblans;
$myrbltime = $RBL_MAX_CACHE unless $myrbltime;
# create query string
$myquery = $myval.".".$myrbl;
# query our cache
if ( exists($DNS_Cache{$myquery}) and exists($DNS_Cache{$myquery}{A}) ) {
ANSWER: foreach (@{$DNS_Cache{$myquery}{A}}) {
last ANSWER if $myresult = ( $_ =~ /$myrblans/ );
};
log_info "[DNSQUERY] cached $mytype: $myrbl $myval ($myquery) - answer: \'".(join ", ", @{$DNS_Cache{$myquery}{A}})."\'"
if ( ($myresult and wantsdebug(qw[ verbose ])) or (wantsdebug(qw[ all thisrequest ])) );
# not found -> prepare dns query
} else {
my $now = time();
$DNS_Cache{$myquery} = {
starttime => $now,
ttl => $myrbltime,
name => $myrbl,
value => $myval,
type => $mytype,
};
log_info "[DNSQUERY] query $mytype: $myrbl $myval ($myquery)" if (wantsdebug(qw[ all thisrequest ]));
push @lookups, $myquery;
};
};
# return necessary lookups
return @lookups;
};
#
# checks RBL items
#
sub rbl_check {
my($mytype,$myrbl,$myval) = @_;
my($myanswer,$myrblans,$myrbltime,$myresult,$mystart,$myend);
my($m1,$m2,$myrbltype,$m4,$myrbltxt,$myquery);
my($now) = time();
# separate rbl-name and answer
($myrbl, $myrblans, $myrbltime) = split /\//, $myrbl;
$myrblans = $RBL_DEFAULT unless $myrblans;
$myrbltime = $RBL_MAX_CACHE unless $myrbltime;
# create query string
$myquery = $myval.".".$myrbl;
# query our cache
$myresult = ( exists($DNS_Cache{$myquery}) and ($#{$DNS_Cache{$myquery}{A}} >= 0) );
if ( $myresult ) {
ANSWER: foreach (@{$DNS_Cache{$myquery}{A}}) {
if ( $myresult = ( ($_) and ($_ =~ /$myrblans/)) ) {
log_info "[DNSBL] query $myval listed on "
.uc($mytype).":$myrbl (answer: ".(join ", ", @{$DNS_Cache{$myquery}{A}})
.", cached: ".ts($now - $DNS_Cache{$myquery}{"time"})."s ago)"
if wantsdebug(qw[ all thisrequest verbose ]);
push @DNSBL_Text, $DNS_Cache{$myquery}{type}.':'.$DNS_Cache{$myquery}{name}.':<'.($DNS_Cache{$myquery}{TXT} || '').'>'
if (defined $DNS_Cache{$myquery}{type} and defined $DNS_Cache{$myquery}{name});
last ANSWER;
};
};
};
return $myresult;
}
#
# dns resolver wrapper
#
sub dns_query {
my (@queries) = @_; undef my @result;
eval {
local $SIG{__DIE__} = sub { log_note "dns err: \"$!\", detail: \"@_\""; return if $^S; };
@result = dns_query_net_dns(@queries);
};
return @result;
};
#
# resolves dns queries using Net::DNS
#
sub dns_query_net_dns {
my (@queries) = @_; undef my @result;
my %ownsock = (); my @ownready = (); undef my $bgsock;
my $ownsel = IO::Select->new();
my $dns = Net::DNS::Resolver->new(
tcp_timeout => $dns_timeout,
udp_timeout => $dns_timeout,
persistent_tcp => 0, persistent_udp => 0,
retrans => 0, retry => 1, dnsrch => 0, defnames => 0,
);
# send queries
foreach (@queries) {
my ($item, $type) = split ','; $type ||= 'A';
# query child cache
if ( (defined $DNS_Cache{$item}{$type}) and (defined $DNS_Cache{$item}{'until'}) and ($DNS_Cache{$item}{'until'} >= time()) ) {
$DNS_Cache{$item}{$type} = [ $DNS_Cache{$item}{$type} ] unless (ref $DNS_Cache{$item}{$type} eq 'ARRAY');
log_info "dnsccache: item=$item, type=$type -> ".(join ',', @{$DNS_Cache{$item}{$type}})." (ttl: ".($DNS_Cache{$item}{ttl} || 0).")" if (wantsdebug(qw[ all thisrequest verbose ]));
push @result, @{$DNS_Cache{$item}{$type}};
} else {
log_info "dnsquery: item=$item, type=$type" if (wantsdebug(qw[ all thisrequest verbose ]));
$bgsock = $dns->bgsend ($item, $type);
$ownsel->add($bgsock);
$ownsock{$bgsock} = $item.','.$type;
};
};
# retrieve answers
while ((scalar keys %ownsock) and (@ownready = $ownsel->can_read($dns_timeout))) {
foreach my $sock (@ownready) {
if (defined $ownsock{$sock}) {
my $packet = $dns->bgread($sock);
my ($item, $type) = split ',', $ownsock{$sock};
my $rname = $DNS_REPNAMES{$type};
my @rrs = (grep { $_->type eq $type } $packet->answer);
my $ttl = 0; my @ans = ();
if (@rrs) {
# sort MX records by preference
@rrs = sort { $a->preference <=> $b->preference } @rrs if ($type eq 'MX');
foreach my $rr (@rrs) {
log_info "dnsanswer: item=$item, type=$type -> $rname=".$rr->$rname." (ttl: ".$rr->ttl.")" if wantsdebug(qw[ all thisrequest verbose ]);
push @ans, $rr->$rname;
};
push @result, @ans;
};
# add to dns cache
$ttl ||= $DNS_MIN_CACHE;
@{$DNS_Cache{$item}{$type}} = @ans;
$DNS_Cache{$item}{ttl} = $ttl;
$DNS_Cache{$item}{'until'} = time() + $ttl;
delete $ownsock{$sock};
} else {
$ownsel->remove($sock);
$sock = undef;
};
};
};
# show timeouts
map { log_note "dnsquery: timeout for $_ after $dns_timeout seconds" } (values %ownsock);
return @result;
};
## SUB plugins
#
# these subroutines integrate additional attributes to
# a request before the ruleset is evaluated
# call: %result = postfwd_items{foo}(%request)
# save: $result{$_}
#
%postfwd_items = (
"__builtin__" => sub {
my(%request) = @_; my(%result) = ();
# postfwd version
$result{version} = $NAME." ".$VERSION;
# sender info
$request{sender} =~ /(.*)@([^@]*)$/;
( $result{sender_localpart}, $result{sender_domain} ) = ( $1, $2 );
# recipient info
$request{recipient} =~ /(.*)@([^@]*)$/;
( $result{recipient_localpart}, $result{recipient_domain} ) = ( $1, $2 );
# reverted ip address (for lookups)
$result{reverse_address} = (join(".", reverse(split(/\./,$request{client_address}))));
return %result;
},
"sender_dns" => sub {
my(%request) = @_; my(%result) = ();
map { $result{$_} = $request{sender_domain} } ($COMP_NS_NAME, $COMP_NS_ADDR, $COMP_MX_NAME, $COMP_MX_ADDR);
$result{$COMP_HELO_ADDR} = $request{helo_name};
return %result;
},
);
# returns additional request information
# for all postfwd_items
sub postfwd_items {
my(%request) = @_;
my(%result) = ();
foreach (sort keys %postfwd_items) {
log_info "[PLUGIN] executing postfwd-item ".$_
if (wantsdebug(qw[ all thisrequest ]));
%result = (%result, &{$postfwd_items{$_}}((%request,%result)))
if (defined $postfwd_items{$_});
};
map { $result{$_} = '' unless (defined $result{$_}); log_info "[PLUGIN] Added key: $_=$result{$_}" if (wantsdebug(qw[ all thisrequest ])) } (keys %result);
return %result;
};
#
# compare item subroutines
# must take compare_item_foo ( $COMPARE_TYPE, $RULEITEM, $REQUESTITEM, %REQUEST, %REQUESTINFO );
#
%postfwd_compare = (
"cidr" => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = ($val and $myitem);
log_info "type cidr : \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
if ($myresult) {
# always true
$myresult = ($val eq '0.0.0.0/0');
unless ($myresult) {
# v4 addresses only
$myresult = ($myitem =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/);
if ($myresult) {
$val .= '/32' unless ($val =~ /\/\d{1,2}$/);
$myresult = cidr_match((cidr_parse($val)),$myitem);
} else {
log_info "Non IPv4 address. Using type default" if (wantsdebug(qw[ all thisrequest ]));
return &{$postfwd_compare{default}}($cmp,$val,$myitem,%request);
};
};
};
$myresult = not($myresult) if ($cmp eq '!=');
return $myresult;
},
"numeric" => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = undef;
log_info "type numeric : \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
$myitem ||= "0"; $val ||= "0";
if ($cmp eq '==') {
$myresult = ($myitem == $val);
} elsif ($cmp eq '=<') {
$myresult = ($myitem <= $val);
} elsif ($cmp eq '=>') {
$myresult = ($myitem >= $val);
} elsif ($cmp eq '<') {
$myresult = ($myitem < $val);
} elsif ($cmp eq '>') {
$myresult = ($myitem > $val);
} elsif ($cmp eq '!=') {
$myresult = not($myitem == $val);
} elsif ($cmp eq '!<') {
$myresult = not($myitem <= $val);
} elsif ($cmp eq '!>') {
$myresult = not($myitem >= $val);
} else {
$myresult = ($myitem >= $val);
};
return $myresult;
},
$COMP_RBL_KEY => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = not($opt_nodns);
log_info "type rbl : \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
$myresult = ( rbl_check ($COMP_RBL_KEY, $val, $myitem) ) if $myresult;
$myresult = not($myresult) if ($cmp eq '!=');
return $myresult;
},
$COMP_RHSBL_KEY => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = not($opt_nodns);
log_info "type rhsbl : \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
$myresult = ( rbl_check ($COMP_RHSBL_KEY, $val, $myitem) ) if $myresult;
$myresult = not($myresult) if ($cmp eq '!=');
return $myresult;
},
$COMP_MONTHS => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = undef;
my($imon) = (split (',', $myitem))[4]; $imon ||= 0;
my($rmin,$rmax) = split (/\s*-\s*/, $val);
$rmin = ($rmin) ? (($rmin =~ /^\d$/) ? $rmin : $months{$rmin}) : $imon;
$rmax = ($rmax) ? (($rmax =~ /^\d$/) ? $rmax : $months{$rmax}) : (($val =~ /-/) ? $imon : $rmin);
log_info "type months : \"$imon\" \"$cmp\" \"$rmin\"-\"$rmax\""
if (wantsdebug(qw[ all thisrequest ]));
$myresult = (($rmin <= $imon) and ($rmax >= $imon));
$myresult = not($myresult) if ($cmp eq '!=');
return $myresult;
},
$COMP_DAYS => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = undef;
my($iday) = (split (',', $myitem))[6]; $iday ||= 0;
my($rmin,$rmax) = split (/\s*-\s*/, $val);
$rmin = ($rmin) ? (($rmin =~ /^\d$/) ? $rmin : $weekdays{$rmin}) : $iday;
$rmax = ($rmax) ? (($rmax =~ /^\d$/) ? $rmax : $weekdays{$rmax}) : (($val =~ /-/) ? $iday : $rmin);
log_info "type days : \"$iday\" \"$cmp\" \"$rmin\"-\"$rmax\""
if (wantsdebug(qw[ all thisrequest ]));
$myresult = (($rmin <= $iday) and ($rmax >= $iday));
$myresult = not($myresult) if ($cmp eq '!=');
return $myresult;
},
$COMP_DATE => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = undef;
my($isec,$imin,$ihour,$iday,$imon,$iyear) = split (',', $myitem);
my($rmin,$rmax) = split (/\s*-\s*/, $val);
my($idat) = ($iyear + 1900) . ((($imon+1) < 10) ? '0'.($imon+1) : ($imon+1)) . (($iday < 10) ? '0'.$iday : $iday);
$rmin = ($rmin) ? join ('', reverse split ('\.', $rmin)) : $idat;
$rmax = ($rmax) ? join ('', reverse split ('\.', $rmax)) : (($val =~ /-/) ? $idat : $rmin);
log_info "type date : \"$idat\" \"$cmp\" \"$rmin\"-\"$rmax\""
if (wantsdebug(qw[ all thisrequest ]));
$myresult = (($rmin <= $idat) and ($rmax >= $idat));
$myresult = not($myresult) if ($cmp eq '!=');
return $myresult;
},
$COMP_TIME => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = undef;
my($isec,$imin,$ihour,$iday,$imon,$iyear) = split (',', $myitem);
my($rmin,$rmax) = split (/\s*-\s*/, $val);
my($idat) = (($ihour < 10) ? '0'.$ihour : $ihour) . (($imin < 10) ? '0'.$imin : $imin) . (($isec < 10) ? '0'.$isec : $isec);
$rmin = ($rmin) ? join ('', split ('\:', $rmin)) : $idat;
$rmax = ($rmax) ? join ('', split ('\:', $rmax)) : (($val =~ /-/) ? $idat : $rmin);
log_info "type time : \"$idat\" \"$cmp\" \"$rmin\"-\"$rmax\""
if (wantsdebug(qw[ all thisrequest ]));
$myresult = (($rmin <= $idat) and ($rmax >= $idat));
$myresult = not($myresult) if ($cmp eq '!=');
return $myresult;
},
$COMP_HELO_ADDR => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = undef;
return $myresult if $opt_nodns;
return $myresult unless $myitem =~ /\./;
if ( my @answers = dns_query ("$myitem,A") ) {
log_info "type $COMP_HELO_ADDR : \"".(join ',', @answers)."\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
map { $myresult = ( &{$postfwd_compare{cidr}}(($cmp,$val,$_,%request)) ); return $myresult if $myresult } @answers;
};
return $myresult;
},
$COMP_NS_NAME => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = undef;
return $myresult if $opt_nodns;
return $myresult unless $myitem =~ /\./;
if ( my @answers = dns_query ("$myitem,NS") ) {
log_info "type $COMP_NS_NAME : \"".(join ',', @answers)."\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
map { $myresult = ( &{$postfwd_compare{default}}(($cmp,$val,$_,%request)) ); return $myresult if $myresult } @answers;
} else {
$myresult = ( &{$postfwd_compare{default}}(($cmp,$val,'',%request)) );
};
return $myresult;
},
$COMP_MX_NAME => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = undef;
return $myresult if $opt_nodns;
return $myresult unless $myitem =~ /\./;
if ( my @answers = dns_query ("$myitem,MX") ) {
log_info "type $COMP_MX_NAME : \"".(join ',', @answers)."\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
map { $myresult = ( &{$postfwd_compare{default}}(($cmp,$val,$_,%request)) ); return $myresult if $myresult } @answers;
} else {
$myresult = ( &{$postfwd_compare{default}}(($cmp,$val,'',%request)) );
};
return $myresult;
},
$COMP_NS_ADDR => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = undef;
return $myresult if $opt_nodns;
return $myresult unless $myitem =~ /\./;
if ( my @answers = dns_query ("$myitem,NS") ) {
splice (@answers, $opt_max_ns_lookups) if $opt_max_ns_lookups and $#answers > $opt_max_ns_lookups;
if ( @answers = dns_query (@answers) ) {
log_info "type $COMP_NS_ADDR : \"".(join ',', @answers)."\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
map { $myresult = ( &{$postfwd_compare{cidr}}(($cmp,$val,$_,%request)) ); return $myresult if $myresult } @answers;
};
};
return $myresult;
},
$COMP_MX_ADDR => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = undef;
return $myresult if $opt_nodns;
return $myresult unless $myitem =~ /\./;
if ( my @answers = dns_query ("$myitem,MX") ) {
splice (@answers, $opt_max_mx_lookups) if $opt_max_mx_lookups and $#answers > $opt_max_mx_lookups;
if ( @answers = dns_query (@answers) ) {
log_info "type $COMP_MX_ADDR : \"".(join ',', @answers)."\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
map { $myresult = ( &{$postfwd_compare{cidr}}(($cmp,$val,$_,%request)) ); return $myresult if $myresult } @answers;
};
};
return $myresult;
},
"default" => sub {
my($cmp,$val,$myitem,%request) = @_;
my($var,$myresult) = undef;
log_info "type default : \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
# backward compatibility
$cmp = '==' if ( ($var) and ($cmp eq '=') );
if ($cmp eq '==') {
$myresult = ( lc($myitem) eq lc($val) ) if $myitem;
} elsif ($cmp eq '!=') {
$myresult = not( lc($myitem) eq lc($val) ) if $myitem;
} elsif ($cmp eq '=<') {
$myresult = (($myitem || 0) <= $val);
} elsif ($cmp eq '<') {
$myresult = (($myitem || 0) < $val);
} elsif ($cmp eq '!<') {
$myresult = not(($myitem || 0) <= $val);
} elsif ($cmp eq '=>') {
$myresult = (($myitem || 0) >= $val);
} elsif ($cmp eq '>') {
$myresult = (($myitem || 0) > $val);
} elsif ($cmp eq '!>') {
$myresult = not(($myitem || 0) >= $val);
} elsif ($cmp eq '=~') {
$myresult = ($myitem =~ /$val/i);
} elsif ($cmp eq '!~') {
$myresult = ($myitem !~ /$val/i);
} else {
# allow // regex
$val =~ s/^\/?(.*?)\/?$/$1/;
$myresult = $myitem =~ /$val/i;
};
return $myresult;
},
"client_address" => sub { return &{$postfwd_compare{cidr}}(@_); },
"encryption_keysize" => sub { return &{$postfwd_compare{numeric}}(@_); },
"size" => sub { return &{$postfwd_compare{numeric}}(@_); },
"recipient_count" => sub { return &{$postfwd_compare{numeric}}(@_); },
"request_score" => sub { return &{$postfwd_compare{numeric}}(@_); },
$COMP_RHSBL_KEY_CLIENT => sub { return &{$postfwd_compare{$COMP_RHSBL_KEY}}(@_); },
$COMP_RHSBL_KEY_SENDER => sub { return &{$postfwd_compare{$COMP_RHSBL_KEY}}(@_); },
$COMP_RHSBL_KEY_HELO => sub { return &{$postfwd_compare{$COMP_RHSBL_KEY}}(@_); },
$COMP_RHSBL_KEY_RCLIENT => sub { return &{$postfwd_compare{$COMP_RHSBL_KEY}}(@_); },
);
#
# these subroutines define postfwd actions
#
%postfwd_actions = (
# example action foo()
# "foo" => sub {
# my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
# my($myaction) = $default_action; my($stop) = 0;
# ...
# return ($stop,$index,$myaction,$myline,%request);
# },
# jump() command
"jump" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = $default_action; my($stop) = 0;
if (defined $Rule_by_ID{$myarg}) {
my($ruleno) = $Rule_by_ID{$myarg};
log_info "[RULES] ".$myline
.", jump to rule $ruleno (id $myarg)"
if wantsdebug(qw[ all thisrequest verbose ]);
$index = $ruleno - 1;
} else {
warn "[RULES] ".$myline." - error: jump failed, can not find rule-id ".$myarg." - ignoring";
};
return ($stop,$index,$myaction,$myline,%request);
},
# set() command
"set" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = $default_action; my($stop) = 0;
foreach ( split (",", $myarg) ) {
if ( /^\s*([^=]+?)\s*([\.\-\*\/\+=]=|=[\.\-\*\/\+=]|=)\s*(.*?)\s*$/ ) {
my($r_var, $mod, $r_val) = ($1, $2, $3);
my($m_val) = (defined $request{$r_var}) ? $request{$r_var} : 0;
# saves some ifs
if (($mod eq '=') or ($mod eq '==')) {
$m_val = $r_val;
} elsif ( ($mod eq '.=') or ($mod eq '=.') ) {
$m_val .= $r_val;
} elsif ( (($mod eq '+=') or ($mod eq '=+')) and (($m_val=~/^\-?\d+(\.\d+)?$/) and ($r_val=~/^\-?\d+(\.\d+)?$/)) ) {
$m_val += $r_val;
} elsif ( (($mod eq '-=') or ($mod eq '=-')) and (($m_val=~/^\-?\d+(\.\d+)?$/) and ($r_val=~/^\-?\d+(\.\d+)?$/)) ) {
$m_val -= $r_val;
} elsif ( (($mod eq '*=') or ($mod eq '=*')) and (($m_val=~/^\-?\d+(\.\d+)?$/) and ($r_val=~/^\-?\d+(\.\d+)?$/)) ) {
$m_val *= $r_val;
} elsif ( (($mod eq '/=') or ($mod eq '=/')) and (($m_val=~/^\-?\d+(\.\d+)?$/) and ($r_val=~/^\-?\d+(\.\d+)?$/)) ) {
$m_val /= (($r_val == 0) ? 1 : $r_val);
} else {
$m_val = $r_val;
};
$m_val = $1.($2 || '').($3 || '') if ( $m_val =~ /^(\-?\d+)([\.,]\d+)?(.*)$/ );
(defined $request{$r_var})
? log_note "[RULES] ".$myline.", redefining existing ".$r_var."=".$request{$r_var}." with ".$r_var."=".$m_val
: log_info "[RULES] ".$myline.", defining ".$r_var."=".$m_val
if wantsdebug(qw[ all thisrequest verbose ]);
$request{$r_var} = $m_val;
} else {
warn "[RULES] ".$myline.", ignoring unknown set() attribute ".$_;
};
};
return ($stop,$index,$myaction,$myline,%request);
},
# score() command
"score" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = $default_action; my($stop) = 0;
my($score) = (defined $request{request_score}) ? $request{request_score} : 0;
if ($myarg =~/^([\+\-\*\/\=]?)(\d+)([\.,](\d+))?$/) {
my($mod, $val) = ($1, $2 + ((defined $4) ? "0.$4" : 0));
if ($mod eq '-') {
$score -= $val;
} elsif ($mod eq '*') {
$score *= $val;
} elsif ($mod eq '/') {
$score /= $val unless ($val == 0);
} elsif ($mod eq '=') {
$score = $val;
} else {
$score += $val;
};
$score = $1.((defined $2) ? $2 : '.0') if ( $score =~ /^(\-?\d+)([\.,]\d\d?)?/ );
log_info "[SCORE] ".$myline.", modifying score about ".$myarg." points to ". $score
if wantsdebug(qw[ all thisrequest verbose ]);
$request{score} = $request{request_score} = $score;
} elsif ($myarg) {
warn "[RULES] ".$myline.", invalid value for score \"$myarg\" - ignoring";
};
MAXSCORE: foreach my $max_score (reverse sort keys %MAX_SCORES) {
if ( ($score >= $max_score) and ($MAX_SCORES{$max_score}) ) {
$myaction=$MAX_SCORES{$max_score};
$myline .= ", score=".$score."/".$max_score;
$stop = $score; last MAXSCORE;
};
};
return ($stop,$index,$myaction,$myline,%request);
},
# mail() command
"mail" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = $default_action; my($stop) = 0;
my($mserver,$mhelo,$mfrom,$mto,$msubject,$mbody) = split "/", $myarg, 6;
($mserver, my $mport) = split ":", $mserver; my $res = "";
my @talk = (
"HELO $mhelo",
"MAIL FROM: $mfrom",
"RCPT TO: $mto",
"DATA",
"Subject: $msubject\r\n$mbody\r\n.",
"QUIT",
);
if ( my $socket = IO::Socket::INET->new(
PeerAddr => $mserver,
PeerPort => ($mport ||= 25),
Proto => 'tcp',
Timeout => 30,
Type => SOCK_STREAM,
) ) {
SMTP: foreach (@talk) {
print $socket "$_\r\n"; $res = <$socket>; chomp($res);
last SMTP unless $res =~ /^[23][0-9][0-9] /;
};
close($socket);
log_info "[MAIL] ".$myline.", mail server=<$mserver:$mport>, from=<$mfrom>, to=<$mto>, subject=<$msubject>, status=<$res>";
} else {
log_note "[MAIL] ".$myline.", could not open socket to $mserver:$mport: '$!'";
};
return ($stop,$index,$myaction,$myline,%request);
},
# sendmail()
"sendmail" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = $default_action; my($stop) = 0;
my($mcmd,$mfrom,$mto,$msubject,$mbody) = split '::', $myarg, 5;
my($msg) = "From: $mfrom\nTo: $mto\nSubject: $msubject\n\n$mbody\n";
if ( (-x $mcmd) and open (SM, "| $mcmd -i -f $mfrom $mto") ) {
if ( print SM "$msg" ) {
log_info "[SENDMAIL] ".$myline.", $mcmd from=<$mfrom>, to=<$mto>, subject=<$msubject>";
} else {
log_note "[SENDMAIL] ".$myline.", could not print to $mcmd pipe: '$!'";
};
close(SM);
} else {
log_note "[SENDMAIL] ".$myline.", could not open pipe to $mcmd: '$!'";
};
return ($stop,$index,$myaction,$myline,%request);
},
# rate() command
"rate" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = $default_action; my($stop) = 0;
my($ratetype,$ratecount,$ratetime,$ratecmd) = split "/", $myarg, 4;
my($rcount) = ( ($mycmd =~ /^size/) ? $request{size} : (($mycmd =~ /^rcpt/) ? $request{recipient_count} : 1 ) );
if ($ratetype and $ratecount and $ratetime and $ratecmd and $rcount) {
my $crate = $Rules[$index]{$COMP_ID}.'+'.$ratecount.'_'.$ratetime;
if ( defined $request{$ratetype} ) {
my $r = $request{$ratetype};
unless ($mycmd =~ /5321$/) {
$r = lc($r);
} else {
$r = ($r =~ /^([^@]+)@(\S+)$/) ? $1.'@'.lc($2) : lc($r);
};
$ratetype .= "=".$r;
unless ( defined $Rates{$ratetype}{$crate} ) {
# create rate object
push @{$Rates{$ratetype}{'list'}}, $crate;
$Rates{$ratetype}{$crate} = {
'type' => $mycmd,
'maxcount' => $ratecount,
'ttl' => $ratetime,
'count' => $rcount,
'time' => $now,
'until' => $now + $ratetime,
'rule' => $Rules[$index]{$COMP_ID},
'action' => $ratecmd,
};
log_info "[RATES] ".$myline
.", creating rate object ".$ratetype
." [type: ".$mycmd.", max: ".$ratecount.", time: ".$ratetime."s]"
if (wantsdebug(qw[ all thisrequest rates ]));
} elsif (not $opt_fast_limits) {
if ( $now > $Rates{$ratetype}{$crate}{'until'} ) {
# renew rate
$Rates{$ratetype}{$crate}{'count'} = $rcount;
$Rates{$ratetype}{$crate}{'time'} = $now;
$Rates{$ratetype}{$crate}{'until'} = $now + $Rates{$ratetype}{$crate}{ttl};
log_info "[RATES] ".$myline
.", renewing rate object '".$ratetype."/".$crate."'"
." [type: ".$Rates{$ratetype}{$crate}{type}
.", max: ".$Rates{$ratetype}{$crate}{maxcount}
.", time: ".$Rates{$ratetype}{$crate}{ttl}."s]"
if (wantsdebug(qw[ all thisrequest rates ]));
} elsif (not (($rcount+=$Rates{$ratetype}{$crate}{count}) > $Rates{$ratetype}{$crate}{maxcount})) {
# increase rate
$Rates{$ratetype}{$crate}{count} = $rcount;
log_info "[RATES] ".$myline
.", increasing rate object '".$ratetype."/".$crate."'"
." to ".$Rates{$ratetype}{$crate}{count}
." [type: ".$Rates{$ratetype}{$crate}{type}
.", max: ".$Rates{$ratetype}{$crate}{maxcount}
.", time: ".$Rates{$ratetype}{$crate}{ttl}."s]"
if (wantsdebug(qw[ all thisrequest rates ]));
};
};
# rate exceeded
$stop = ($rcount > $Rates{$ratetype}{$crate}{maxcount});
if ($stop) {
$Counter_Rates++;
$myaction=$Rates{$ratetype}{$crate}{action};
$request{'ratecount'} = $rcount;
$myline .= ", rate=".$Rates{$ratetype}{$crate}{type}."/".$rcount."/".ts($now - $Rates{$ratetype}{$crate}{'time'})."s";
};
} else {
log_info "[RULES] ".$myline.", ignoring empty index for ".$mycmd." limit '".$ratetype."'" if (wantsdebug(qw[ all thisrequest ]));
};
} else {
log_note "[RULES] ".$myline.(($rcount) ? ", ignoring unknown ".$mycmd."() attribute \'".$myarg."\'" : ", ignoring empty counter");
};
return ($stop,$index,$myaction,$myline,%request);
},
# size() command
"size" => sub { return &{$postfwd_actions{rate}}(@_); },
# rcpt() command
"rcpt" => sub { return &{$postfwd_actions{rate}}(@_); },
# rate() command, according to rfc5321 case-sensivity
"rate5321" => sub { return &{$postfwd_actions{rate}}(@_); },
# rcpt() command, according to rfc5321 case-sensivity
"rcpt5321" => sub { return &{$postfwd_actions{rate}}(@_); },
# size() command, according to rfc5321 case-sensivity
"size5321" => sub { return &{$postfwd_actions{rate}}(@_); },
# wait() command
"wait" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = $default_action; my($stop) = 0;
log_info "[RULES] ".$myline.", delaying for $myarg seconds";
sleep $myarg;
return ($stop,$index,$myaction,$myline,%request);
},
# note() command
"note" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = $default_action; my($stop) = 0;
log_info "[RULES] ".$myline." - note: ".$myarg if $myarg;
return ($stop,$index,$myaction,$myline,%request);
},
# debug() command
"debug" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = $default_action; my($stop) = 0;
log_info "[RULES] ".$myline.", DEBUG=$myarg";
($myarg =~ /^(1|y(es)?|on)$/i) ? $DEBUG{thisrequest} = 1 : delete $DEBUG{thisrequest};
return ($stop,$index,$myaction,$myline,%request);
},
# quit() command
"quit" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
warn "[RULES] ".$myline." - critical: quit (".$myarg.")";
end_program;
},
# file() command
"file" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = $default_action; my($stop) = 0;
warn "[RULES] ".$myline." - error: command ".$mycmd."() has not been implemented yet - ignoring";
return ($stop,$index,$myaction,$myline,%request);
},
# ask() command
"ask" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = $default_action; my($stop) = 0;
mylogs ('info', "Opening socket to '$myarg'") if (wantsdebug(qw[ all thisrequest ]));
my($addr,$port,$ignore) = split ':', $myarg;
my %orig = str_to_hash ($request{orig});
if ( ($addr and $port) and my $socket = new IO::Socket::INET (
PeerAddr => $addr,
PeerPort => $port,
Proto => 'tcp',
Timeout => 9,
Type => SOCK_STREAM ) ) {
my $sendstr = '';
foreach (keys %orig) {
$sendstr .= $_."=".$orig{$_}."\n";
};
$sendstr .= "\n";
mylogs ('info', "Asking service $myarg -> '$sendstr'") if (wantsdebug(qw[ all thisrequest ]));
print $socket "$sendstr";
$sendstr = <$socket>;
chomp($sendstr);
mylogs ('info', "Answer from $myarg -> '$sendstr'") if (wantsdebug(qw[ all thisrequest ]));
$sendstr =~ s/^(action=)//;
if ($1 and $sendstr) {
if ($ignore and ($sendstr =~ /$ignore/i)) {
mylogs ('info', "ignoring answer '$sendstr' from $myarg") if (wantsdebug(qw[ all thisrequest ]));
} else {
$stop = $myaction = $sendstr;
};
} else {
mylogs ('notice', "rule: $index got invalid answer '$sendstr' from $myarg");
};
} else {
mylogs ('notice', "Could not open socket to '$myarg' - $!");
};
return ($stop,$index,$myaction,$myline,%request);
},
# exec() command
"exec" => sub { return &{$postfwd_actions{file}}(@_); },
);
# load plugin-items
sub get_plugins {
my(@pluginfiles) = @_;
my($pluginlog) = '';
foreach my $file (@pluginfiles) {
unless ( -e $file ) {
warn "File not found: $file";
} else {
$file =~ /^(.*)$/;
require $1 if $1;
map { delete $postfwd_items_plugin{$_} unless ($_ and defined $postfwd_items_plugin{$_}) } (keys %postfwd_items_plugin);
map { delete $postfwd_compare_plugin{$_} unless ($_ and defined $postfwd_compare_plugin{$_}) } (keys %postfwd_compare_plugin);
map { delete $postfwd_actions_plugin{$_} unless ($_ and defined $postfwd_actions_plugin{$_}) } (keys %postfwd_actions_plugin);
map { log_note "[PLUGIN] overriding prior item \'".$_."\'" if (defined $postfwd_items{$_}) } (keys %postfwd_items_plugin);
map { log_note "[PLUGIN] overriding prior compare function \'".$_."\'" if (defined $postfwd_compare{$_}) } (keys %postfwd_compare_plugin);
map { log_note "[PLUGIN] overriding prior action \'".$_."\'" if (defined $postfwd_actions{$_}) } (keys %postfwd_actions_plugin);
%postfwd_items = ( %postfwd_items, %postfwd_items_plugin ) if %postfwd_items_plugin;
%postfwd_compare = ( %postfwd_compare, %postfwd_compare_plugin ) if %postfwd_compare_plugin;
%postfwd_actions = ( %postfwd_actions, %postfwd_actions_plugin ) if %postfwd_actions_plugin;
$pluginlog = "[PLUGIN] Loaded plugins file: ".$file;
$pluginlog .= " items: \"".(join ", ", (sort keys %postfwd_items_plugin))."\""
if %postfwd_items_plugin;
$pluginlog .= " compare: \"".(join ", ", (sort keys %postfwd_compare_plugin))."\""
if %postfwd_compare_plugin;
$pluginlog .= " actions: \"".(join ", ", (sort keys %postfwd_actions_plugin))."\""
if %postfwd_actions_plugin;
log_info $pluginlog;
};
};
};
### SUB ruleset
#
# compare item main
# use: compare_item ( $TYPE, $RULEITEM, $MINIMUMHITS, $REQUESTITEM, %REQUEST, %REQUESTINFO );
#
sub compare_item {
my($mykey,$mymask,$mymin,$myitem,%request) = @_;
my($val,$var,$cmp,$neg,$myresult,$postfwd_compare_proc);
my($rcount) = 0;
$mymin ||= 1;
# determine the right compare function
$postfwd_compare_proc = (defined $postfwd_compare{$mykey}) ? $mykey : "default";
# save list due to possible modification
my @items = @{$mymask};
# now compare request to every single item
ITEM: foreach (@items) {
($cmp, $val) = split ";";
next ITEM unless ($cmp and (defined $val) and $mykey);
# prepare_file
if ($val =~ /$COMP_LIVE_FILE_TABLE/) {
push @items, prepare_file (0, $1, $cmp, $2);
next ITEM;
};
log_info "compare $mykey: \"$myitem\" \"$cmp\" \"$val\"" if (wantsdebug(qw[ all thisrequest ]));
$val = $neg if ($neg = deneg_item($val));
log_info "deneg $mykey: \"$myitem\" \"$cmp\" \"$val\"" if ($neg and (wantsdebug(qw[ all thisrequest ])));
next ITEM unless (defined $val);
# substitute check for $$vars in rule item
if ( $var = devar_item ($cmp,$val,$myitem,%request) ) {
$val = $var; $val =~ s/([^-_@\.\w\s])/\\$1/g unless ($cmp eq '==');
};
$myresult = &{$postfwd_compare{$postfwd_compare_proc}}($cmp,$val,$myitem,%request);
log_info "match $mykey: ".($myresult ? "TRUE" : "FALSE") if (wantsdebug(qw[ all thisrequest ]));
if ($neg) {
$myresult = not($myresult);
log_info "negate match $mykey: ".($myresult ? "TRUE" : "FALSE") if (wantsdebug(qw[ all thisrequest ]));
};
$rcount++ if $myresult;
$myresult = not($mymin eq 'all');
$myresult = ( $rcount >= $mymin ) if $myresult;
log_info "count $mykey: request=$rcount minimum: $mymin result: ".($myresult ? "TRUE" : "FALSE") if (wantsdebug(qw[ all thisrequest ]));
last ITEM if $myresult;
};
$myresult = $rcount if ($myresult or ($mymin eq 'all'));
return $myresult;
};
#
# compare request against a single rule
#
sub compare_rule {
my($index,$date,%request) = @_;
my(@ruleitems) = keys %{$Rules[$index]};
my($has_rbl) = exists($Rules[$index]{$COMP_RBL_KEY});
my($has_rhl) = (
exists($Rules[$index]{$COMP_RHSBL_KEY}) or exists($Rules[$index]{$COMP_RHSBL_KEY_RCLIENT}) or
exists($Rules[$index]{$COMP_RHSBL_KEY_CLIENT}) or exists($Rules[$index]{$COMP_RHSBL_KEY_SENDER}) or
exists($Rules[$index]{$COMP_RHSBL_KEY_HELO})
);
my($hasdns) = ( not($opt_nodns) and ($has_rhl or $has_rbl) );
my($mykey,$myitem,$val,$cmp,$res,$myline,$timed) = undef;
my(@myresult) = (0,0,0);
my(@queries,@timedout) = ();
my($num) = 1;
undef @DNSBL_Text;
# prepare dns queries
my $ownres = Net::DNS::Resolver->new(
tcp_timeout => ($dns_timeout || $def_dns_timeout),
udp_timeout => ($dns_timeout || $def_dns_timeout),
persistent_tcp => 0, persistent_udp => 0,
retrans => 0, retry => 1, dnsrch => 0, defnames => 0,
);
my $ownsel = IO::Select->new();
my %ownsock = ();
my @ownready = ();
my $bgsock = undef;
log_info "[RULES] rule: $index, id: $Rules[$index]{$COMP_ID}, items: '".((@ruleitems) ? join ';', @ruleitems: '')."'" if (wantsdebug(qw[ all thisrequest ]));
# COMPARE-ITEMS
# check all non-dns items
ITEM: for $mykey ( keys %{$Rules[$index]} ) {
# always true
if ( (($mykey eq $COMP_ID) or ($mykey eq $COMP_ACTION)) ) {
$myresult[0]++;
next ITEM;
};
next ITEM if ( (($mykey eq $COMP_RBL_CNT) or ($mykey eq $COMP_RHSBL_CNT)) );
next ITEM if ( (($mykey eq $COMP_RBL_KEY) or ($mykey eq $COMP_RHSBL_KEY)) );
next ITEM if ( ($mykey eq $COMP_RHSBL_KEY_RCLIENT) or ($mykey eq $COMP_RHSBL_KEY_CLIENT) or ($mykey eq $COMP_RHSBL_KEY_SENDER) or ($mykey eq $COMP_RHSBL_KEY_HELO) );
# integration at this point enables redefining scores within ruleset
if ($mykey eq $COMP_SCORES) {
modify_score ($Rules[$index]{$mykey},$Rules[$index]{$COMP_ACTION});
$myresult[0] = 0;
} else {
$val = ( $mykey =~ /^$COMP_DATECALC$/ )
# prepare date check
? $date
# default: compare against request attribute
: $request{$mykey};
$myresult[0] = ($res = compare_item($mykey, $Rules[$index]{$mykey}, $num, ((defined $val) ? $val : ''), %request)) ? ($myresult[0] + $res) : 0;
};
last ITEM unless ($myresult[0] > 0);
};
# DNSQUERY-SECTION
# fire add()s with callback to result cache,
# if they are not contained already,
# and $opt_nodns is not set
if ($hasdns and $myresult[0]) {
map { $timed .= (($timed) ? ", $_" : $_) if $Timeouts{$_} > $MAX_DNSBL_TIMEOUTS } (keys %Timeouts);
log_note "[DNSQUERY] skipping rbls: $timed - too much timeouts" if $timed;
push @queries, rbl_prepare_lookups ( $COMP_RBL_KEY, $request{reverse_address}, @{$Rules[$index]{$COMP_RBL_KEY}} )
if ( exists($Rules[$index]{$COMP_RBL_KEY}) and not($request{client_address} =~ /:/) );
push @queries, rbl_prepare_lookups ( $COMP_RHSBL_KEY, $request{client_name}, @{$Rules[$index]{$COMP_RHSBL_KEY}} )
if ( exists($Rules[$index]{$COMP_RHSBL_KEY}) and not($request{client_name} eq "unknown") );
push @queries, rbl_prepare_lookups ( $COMP_RHSBL_KEY_CLIENT, $request{client_name}, @{$Rules[$index]{$COMP_RHSBL_KEY_CLIENT}} )
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_CLIENT}) and not($request{client_name} eq "unknown") );
push @queries, rbl_prepare_lookups ( $COMP_RHSBL_KEY_SENDER, $request{sender_domain}, @{$Rules[$index]{$COMP_RHSBL_KEY_SENDER}} )
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_SENDER}) and not($request{sender_domain} eq "") );
push @queries, rbl_prepare_lookups ( $COMP_RHSBL_KEY_HELO, $request{helo_name}, @{$Rules[$index]{$COMP_RHSBL_KEY_HELO}} )
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_HELO}) and not($request{helo_name} eq "") );
push @queries, rbl_prepare_lookups ( $COMP_RHSBL_KEY_RCLIENT, $request{reverse_client_name}, @{$Rules[$index]{$COMP_RHSBL_KEY_RCLIENT}} )
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_RCLIENT}) and not($request{reverse_client_name} eq "unknown") );
# send dns queries
if ( @queries ) {
@queries = uniq(@queries);
foreach my $query (@queries) {
log_info "[SENDDNS] sending query \'$query\'"
if (wantsdebug(qw[ all thisrequest ]));
# send A query
$bgsock = $ownres->bgsend($query, 'A');
$ownsel->add($bgsock);
$ownsock{$bgsock} = 'A:'.$query;
# send TXT query
if ($dns_async_txt) {
$bgsock = $ownres->bgsend($query, 'TXT');
$ownsel->add($bgsock);
$ownsock{$bgsock} = 'TXT:'.$query;
};
};
log_info "[SENDDNS] rule: $index, id: $Rules[$index]{$COMP_ID}, lookups: ".($#queries + 1)
if (wantsdebug(qw[ all thisrequest ]));
};
# DNSRESULT-SECTION
# if all other items matched, run await()
# and check the results unless $opt_nodns
my($ownstart) = time(); @queries = ();
my($timout) = $dns_timeout || $def_dns_timeout;
while ((scalar keys %ownsock) and (@ownready = $ownsel->can_read($timout))) {
foreach my $sock (@ownready) {
if (defined $ownsock{$sock}) {
mylogs ('notice', "[DNSBL] answer for ".$ownsock{$sock})
if (wantsdebug(qw[ all thisrequest ]));
my $packet = $ownres->bgread($sock);
push @queries, (split ':', $ownsock{$sock})[1] if rbl_read_dns ($packet);
delete $ownsock{$sock};
} else {
$ownsel->remove($sock);
$sock = undef;
};
};
};
# timeout handling
map { push @timedout, (split ':', $ownsock{$_})[1] } (keys %ownsock);
foreach (uniq(@timedout)) {
# @{$DNS_Cache{$_}{A}} = ('__TIMEOUT__');
$DNS_Cache{$_}{endtime} = time();
$DNS_Cache{$_}{ttl} = $RBL_MAX_CACHE;
$Timeouts{$DNS_Cache{$_}{name}} = (defined $Timeouts{$DNS_Cache{$_}{name}})
? $Timeouts{$DNS_Cache{$_}{name}} + 1
: 1
if ( $MAX_DNSBL_TIMEOUTS > 0 );
mylogs ('notice', "[DNSBL] warning: timeout (".$Timeouts{$DNS_Cache{$_}{name}}."/".$MAX_DNSBL_TIMEOUTS.") for ".$DNS_Cache{$_}{name}." after ".ts(time() - $ownstart)." seconds");
};
# perform outstanding TXT queries unless --dns_async_txt is set
if (not($dns_async_txt) and @queries) {
@queries = uniq(@queries);
log_info "[DNSBL] sending TXT queries for ".(join ',', @queries) if (wantsdebug(qw[ all thisrequest ]));
foreach my $query (@queries) {
log_info "[SENDDNS] sending TXT query \'$query\'" if (wantsdebug(qw[ all thisrequest ]));
# send TXT query
$bgsock = $ownres->bgsend($query, 'TXT');
$ownsel->add($bgsock);
$ownsock{$bgsock} = 'TXT:'.$query;
};
while ((scalar keys %ownsock) and (@ownready = $ownsel->can_read($timout))) {
foreach my $sock (@ownready) {
if (defined $ownsock{$sock}) {
mylogs ('notice', "[DNSBL] answer for ".$ownsock{$sock})
if (wantsdebug(qw[ all thisrequest ]));
my $packet = $ownres->bgread($sock);
rbl_read_dns ($packet);
delete $ownsock{$sock};
} else {
$ownsel->remove($sock);
$sock = undef;
};
};
};
};
# compare dns results
if ( ($myresult[0] > 0) and exists($Rules[$index]{$COMP_RBL_KEY}) ) {
$res = compare_item(
$COMP_RBL_KEY,
$Rules[$index]{$COMP_RBL_KEY},
($Rules[$index]{$COMP_RBL_CNT} ||= 1),
$request{reverse_address},
%request
);
$myresult[0] = ($res or ($Rules[$index]{$COMP_RBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
$myresult[1] = ($res) ? $res : 0;
};
if ( $has_rhl and ($myresult[0] > 0) ) {
if ( exists($Rules[$index]{$COMP_RHSBL_KEY}) ) {
if ($request{client_name} eq "unknown") {
$myresult[0] = (defined $Rules[$index]{$COMP_RHSBL_CNT})
? ( ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all') ? 1 : 0 )
: 0;
} else {
$res = compare_item(
$COMP_RHSBL_KEY,
$Rules[$index]{$COMP_RHSBL_KEY},
($Rules[$index]{$COMP_RHSBL_CNT} ||= 1),
$request{client_name},
%request
);
$myresult[0] = ($res or ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
$myresult[2] += $res if $res;
};
};
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_CLIENT}) ) {
if ($request{client_name} eq "unknown") {
$myresult[0] = (defined $Rules[$index]{$COMP_RHSBL_CNT})
? ( ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all') ? 1 : 0 )
: 0;
} else {
$res = compare_item(
$COMP_RHSBL_KEY_CLIENT,
$Rules[$index]{$COMP_RHSBL_KEY_CLIENT},
($Rules[$index]{$COMP_RHSBL_CNT} ||= 1),
$request{client_name},
%request
);
$myresult[0] = ($res or ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
$myresult[2] += $res if $res;
};
};
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_SENDER}) ) {
if ($request{sender_domain} eq "") {
$myresult[0] = (defined $Rules[$index]{$COMP_RHSBL_CNT})
? ( ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all') ? 1 : 0 )
: 0;
} else {
$res = compare_item(
$COMP_RHSBL_KEY_SENDER,
$Rules[$index]{$COMP_RHSBL_KEY_SENDER},
($Rules[$index]{$COMP_RHSBL_CNT} ||= 1),
$request{sender_domain},
%request
);
$myresult[0] = ($res or ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
$myresult[2] += $res if $res;
};
};
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_HELO}) ) {
if ($request{helo_domain} eq "") {
$myresult[0] = (defined $Rules[$index]{$COMP_RHSBL_CNT})
? ( ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all') ? 1 : 0 )
: 0;
} else {
$res = compare_item(
$COMP_RHSBL_KEY_HELO,
$Rules[$index]{$COMP_RHSBL_KEY_HELO},
($Rules[$index]{$COMP_RHSBL_CNT} ||= 1),
$request{helo_name},
%request
);
$myresult[0] = ($res or ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
$myresult[2] += $res if $res;
};
};
if ( exists($Rules[$index]{$COMP_RHSBL_KEY_RCLIENT}) ) {
if ($request{reverse_client_name} eq "unknown") {
$myresult[0] = (defined $Rules[$index]{$COMP_RHSBL_CNT})
? ( ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all') ? 1 : 0 )
: 0;
} else {
$res = compare_item(
$COMP_RHSBL_KEY_RCLIENT,
$Rules[$index]{$COMP_RHSBL_KEY_RCLIENT},
($Rules[$index]{$COMP_RHSBL_CNT} ||= 1),
$request{reverse_client_name},
%request
);
$myresult[0] = ($res or ($Rules[$index]{$COMP_RHSBL_CNT} eq 'all')) ? ($myresult[0] + $res) : 0;
$myresult[2] += $res if $res;
};
};
};
};
if (wantsdebug(qw[ all thisrequest ])) {
$myline = "[RULES] RULE: ".$index." MATCHES: ".((($myresult[0] - 2) > 0) ? ($myresult[0] - 2) : 0);
$myline .= " RBLCOUNT: ".$myresult[1] if ($myresult[1] > 0);
$myline .= " RHSBLCOUNT: ".$myresult[2] if ($myresult[2] > 0);
$myline .= " DNSBLTEXT: ".(join ("; ", @DNSBL_Text)) if ( (@DNSBL_Text) and (($myresult[1] > 0) or ($myresult[2] > 0)) );
log_info $myline;
};
return @myresult;
}
### SUB access policy
#
# access policy routine
#
sub smtpd_access_policy {
my(%request) = @_;
my($myaction) = $default_action;
my($index) = 1;
my($stop) = 1;
my($now) = time();
my($date) = join(',', localtime($now));
my($matched,$rblcnt,$rhlcnt,$t1,$t2,$t3,$rcount,$ai) = 0;
my($mykey,$cacheid,$myline,$checkreq,$var,$ratehit,$rateitem) = "";
# save original request
$request{orig} = hash_to_str (%request);
# replace empty sender with <>
$request{sender} = '<>' unless ($request{sender});
# load postfwd_items attributes
if ( my(%postfwd_items_attr) = postfwd_items (%request) ) {
%request = (%request, %postfwd_items_attr);
};
# check for HUP signal
if ( $Reload_Conf ) {
undef $Reload_Conf;
show_stats;
read_config(1);
};
# clear dnsbl timeout counters
if ( ($MAX_DNSBL_INTERVAL > 0) and (($now - $Cleanup_Timeouts) > $MAX_DNSBL_INTERVAL) ) {
undef %Timeouts;
log_info "[CLEANUP] clearing dnsbl timeout counters" if wantsdebug(qw[ all thisrequest verbose ]);
$Cleanup_Timeouts = $now;
};
# wipe out old cache items
if ( ($CLEANUP_RATE_CACHE > 0) and (scalar keys %Rates > 0) and (($now - $Cleanup_Rates) > $CLEANUP_RATE_CACHE) ) {
$t1 = time();
$t3 = scalar keys %Rates;
cleanup_rate_cache($now);
$t2 = time();
log_info "[CLEANUP] needed ".ts($t2 - $t1)
." seconds for rate cleanup of "
.($t3 - scalar keys %Rates)." out of ".$t3
." cached items after cleanup time ".$CLEANUP_RATE_CACHE."s"
if ( wantsdebug(qw[ all thisrequest verbose cleanup ]) or (($t2 - $t1) >= 1) );
$Cleanup_Rates = $t1;
};
# increase rate limits
if (@Rate_Items and $opt_fast_limits) {
RATES: foreach $checkreq (@Rate_Items) {
next RATES unless $request{$checkreq};
my $checkval = $checkreq."=".lc($request{$checkreq});
next RATES unless ( defined $Rates{$checkval} and defined $Rates{$checkval}{'list'} );
CRATE: foreach my $crate (@{$Rates{$checkval}{'list'}}) {
$rcount = ( ($Rates{$checkval}{$crate}{type} eq 'size') ? $request{size} :
(($Rates{$checkval}{$crate}{type} eq 'rcpt') ? $request{recipient_count} : 1 ) );
if ( $now > $Rates{$checkval}{$crate}{'until'} ) {
# renew rate
$Rates{$checkval}{$crate}{'count'} = $rcount;
$Rates{$checkval}{$crate}{'time'} = $now;
$Rates{$checkval}{$crate}{'until'} = $now + $Rates{$checkval}{$crate}{ttl};
log_info "[RATES] renewing rate object '".$checkval."/".$crate."'"
." [type: ".$Rates{$checkval}{$crate}{type}
.", max: ".$Rates{$checkval}{$crate}{maxcount}
.", time: ".$Rates{$checkval}{$crate}{ttl}."s]"
if (wantsdebug(qw[ all thisrequest ]));
} elsif (not (($rcount+=$Rates{$checkval}{$crate}{count}) > $Rates{$checkval}{$crate}{maxcount})) {
# increase rate
$Rates{$checkval}{$crate}{count} = $rcount;
log_info "[RATES] increasing rate object '".$checkval."/".$crate."'"
." to ".$Rates{$checkval}{$crate}{count}
." [type: ".$Rates{$checkval}{$crate}{type}
.", max: ".$Rates{$checkval}{$crate}{maxcount}
.", time: ".$Rates{$checkval}{$crate}{ttl}."s]"
if (wantsdebug(qw[ all thisrequest ]));
};
$ratehit = ($rcount > $Rates{$checkval}{$crate}{maxcount}) ? $checkval : undef;
if ($ratehit) {
$request{'ratecount'} = $rcount;
$rateitem = $crate;
last CRATE;
};
};
last RATES if $ratehit;
};
};
# Request cache enabled?
if ( $REQUEST_MAX_CACHE > 0 ) {
# construct cache identifier
if (@CacheID) {
map { $cacheid .= $request{$_}.";" if (defined $request{$_}) } @CacheID;
} else {
REQITEM: foreach $checkreq (sort keys %request) {
next REQITEM unless $request{$checkreq};
next REQITEM if ( ($checkreq eq "instance") or ($checkreq eq "queue_id") or ($checkreq eq "orig") );
next REQITEM if ( $opt_cache_no_size and ($checkreq eq "size") );
next REQITEM if ( $opt_cache_no_sender and ($checkreq eq "sender") );
if ( $opt_cache_rdomain_only and ($checkreq eq "recipient") ) {
$cacheid .= $request{recipient_domain}.";";
} else {
$cacheid .= $request{$checkreq}.";";
};
};
};
log_info "created cache-id: $cacheid" if (wantsdebug(qw[ all thisrequest ]));
# wipe out old cache entries
if ( (scalar keys %Request_Cache > 0) and (($now - $Cleanup_Requests) > $CLEANUP_REQUEST_CACHE) ) {
$t1 = time();
$t3 = scalar keys %Request_Cache;
cleanup_request_cache($now);
$t2 = time();
log_info "[CLEANUP] needed ".ts($t2 - $t1)
." seconds for request cleanup of "
.($t3 - scalar keys %Request_Cache)." out of ".$t3
." cached items after cleanup time ".$CLEANUP_REQUEST_CACHE."s"
if ( wantsdebug(qw[ all thisrequest verbose cleanup ]) or (($t2 - $t1) >= 1) );
$Cleanup_Requests = $t1;
};
};
# check rate
if ( $ratehit and $opt_fast_limits ) {
$Counter_Rates++;
$Matches{$Rates{$ratehit}{$rateitem}{rule}}++;
$myaction = $Rates{$ratehit}{$rateitem}{action};
# substitute check for $$vars in action
$myaction = $var if ( $var = devar_item ("==",$myaction,"action",%request) );
log_info "[RATES] rule=".$Rule_by_ID{$Rates{$ratehit}{$rateitem}{rule}}
. ", id=".$Rates{$ratehit}{$rateitem}{rule}
. ( ($request{queue_id}) ? ", queue=".$request{queue_id} : '' )
. ", client=".$request{client_name}."[".$request{client_address}."]"
. ( ($request{sasl_username}) ? ", user=".$request{sasl_username} : '' )
. ", sender=<".(($request{sender} eq '<>') ? "" : $request{sender}).">"
. ( ($request{recipient}) ? ", recipient=<".$request{recipient}.">" : '' )
. ", helo=<".$request{helo_name}.">"
. ", proto=".$request{protocol_name}
. ", state=".$request{protocol_state}
. ", delay=".ts(time() - $now)."s"
. ", action=".$myaction." (item: '".$ratehit."'"
. ", type: ".$Rates{$ratehit}{$rateitem}{type}
. ", count: ".$request{ratecount}."/".$Rates{$ratehit}{$rateitem}{maxcount}
. ", time: ".ts($now - $Rates{$ratehit}{$rateitem}{"time"})."/".$Rates{$ratehit}{$rateitem}{ttl}."s)"
unless $opt_norulelog;
# check cache
} elsif ( ($REQUEST_MAX_CACHE > 0)
and ( exists($Request_Cache{$cacheid}{$COMP_ACTION}) and ($now <= $Request_Cache{$cacheid}{'until'}) ) ) {
$Counter_Hits++;
$myaction = $Request_Cache{$cacheid}{$COMP_ACTION};
if ( $Request_Cache{$cacheid}{hit} and $Request_Cache{$cacheid}{$COMP_ID}) {
map { $Matches{$_}++ } (split ';', $Request_Cache{$cacheid}{hits}) if $Request_Cache{$cacheid}{hits};
log_info "[CACHE] rule=".$Rule_by_ID{$Request_Cache{$cacheid}{$COMP_ID}}
. ", id=".$Request_Cache{$cacheid}{$COMP_ID}
. ( ($request{queue_id}) ? ", queue=".$request{queue_id} : '' )
. ", client=".$request{client_name}."[".$request{client_address}."]"
. ( ($request{sasl_username}) ? ", user=".$request{sasl_username} : '' )
. ", sender=<".(($request{sender} eq '<>') ? "" : $request{sender}).">"
. ( ($request{recipient}) ? ", recipient=<".$request{recipient}.">" : '' )
. ", helo=<".$request{helo_name}.">"
. ", proto=".$request{protocol_name}
. ", state=".$request{protocol_state}
. ", delay=".ts(time() - $now)."s"
. ", hits=".$Request_Cache{$cacheid}{hits}
. ", action=".$Request_Cache{$cacheid}{$COMP_ACTION}
unless $opt_norulelog;
};
# check rules
} else {
# refresh config if '-I' was set
read_config(0) if $opt_instantconfig;
if ($#Rules < 0) {
log_warn "critical: no rules found - i feel useless (have you set -f or -r?)";
} else {
# clean up rbl cache
if ( not($opt_nodns) and (scalar keys %DNS_Cache > 0) and (($now - $Cleanup_RBLs) > $CLEANUP_RBL_CACHE) ) {
$t1 = time();
$t3 = scalar keys %DNS_Cache;
cleanup_dns_cache($now);
$t2 = time();
log_info "[CLEANUP] needed ".ts($t2 - $t1)
." seconds for rbl cleanup of "
.($t3 - scalar keys %DNS_Cache)." out of ".$t3
." cached items after cleanup time ".$CLEANUP_RBL_CACHE."s"
if ( wantsdebug(qw[ all thisrequest verbose cleanup ]) or (($t2 - $t1) >= 1) );
$Cleanup_RBLs = $t1;
};
# prepares hit counters
$request{$COMP_MATCHES} = 0;
$request{$COMP_RBL_CNT} = 0;
$request{$COMP_RHSBL_CNT} = 0;
RULE: for ($index=0;$index<=$#Rules;$index++) {
# compare request against rule
next unless exists $Rules[$index];
($matched,$rblcnt,$rhlcnt) = compare_rule ($index, $date, %request);
# enables/overrides hit counters for later use
$request{$COMP_MATCHES} = $matched;
$request{$COMP_RBL_CNT} = $rblcnt;
$request{$COMP_RHSBL_CNT} = $rhlcnt;
# matched? prepare logline, increase counters
if ($stop = $matched > 0) {
$myaction = $Rules[$index]{$COMP_ACTION};
$Matches{$Rules[$index]{$COMP_ID}}++;
$request{$COMP_HITS} .= ';' if (defined $request{$COMP_HITS});
$request{$COMP_HITS} .= $Rules[$index]{$COMP_ID};
# substitute check for $$vars in action
$myaction = $var if ( $var = devar_item ("==",$myaction,"action",%request) );
$myline = "rule=".$index
. ", id=".$Rules[$index]{$COMP_ID}
. ( ($request{queue_id}) ? ", queue=".$request{queue_id} : '' )
. ", client=".$request{client_name}."[".$request{client_address}."]"
. ( ($request{sasl_username}) ? ", user=".$request{sasl_username} : '' )
. ", sender=<".(($request{sender} eq '<>') ? "" : $request{sender}).">"
. ( ($request{recipient}) ? ", recipient=<".$request{recipient}.">" : '' )
. ", helo=<".$request{helo_name}.">"
. ", proto=".$request{protocol_name}
. ", state=".$request{protocol_state};
# check for postfwd action
$ai = 0; # (re)set max_command_recursion counter
while ($ai++ < $max_command_recursion and $myaction =~ /^(\w[\-\w]+)\s*\(\s*(.*?)\s*\)$/) {
my($mycmd,$myarg) = ($1, $2); $stop = 0;
if (defined $postfwd_actions{$mycmd}) {
log_info "[PLUGIN] executing postfwd-action $mycmd" if (wantsdebug(qw[ all thisrequest ]));
($stop, $index, $myaction, $myline, %request) = &{$postfwd_actions{$mycmd}}($index, $now, $mycmd, $myarg, $myline, %request);
# substitute again after postfwd-actions
$myaction = $var if ( $var = devar_item ("==",$myaction,"action",%request) );
} else {
warn "[RULES] ".$myline." - error: unknown command \"".$1."\" - ignoring";
$myaction = $default_action;
};
};
if ($stop) {
$myline .= ", delay=".ts(time() - $now)."s, hits=".$request{$COMP_HITS}.", action=".$myaction;
log_info "[RULES] ".$myline unless $opt_norulelog;
last RULE;
};
} else { undef $myline; };
};
};
# update cache
if ( $REQUEST_MAX_CACHE > 0 ) {
$Request_Cache{$cacheid}{"time"} = $now;
$Request_Cache{$cacheid}{'until'} = $now + $REQUEST_MAX_CACHE;
$Request_Cache{$cacheid}{$COMP_ACTION} = $myaction;
$Request_Cache{$cacheid}{hit} = $matched;
$Request_Cache{$cacheid}{hits} = $request{$COMP_HITS};
$Request_Cache{$cacheid}{$COMP_ID} = $Rules[$index]{$COMP_ID} if ($matched > 0);
};
};
map { mylog $syslog_priority, "[DUMP] $_" } dump_cache() if (wantsdebug(qw[ all ]));
$myaction = $default_action if ($opt_test or !($myaction));
return $myaction;
};
# process delegation protocol input
sub process_input {
my($client,$msg,$attr) = @_;
# remember argument=value
if ( $msg =~ /^([^=]{1,512})=(.{0,512})/ ) {
$$attr{$1} = $2;
# evaluate request
} elsif ( $msg eq '' ) {
map { log_info "Attribute: $_=$$attr{$_}" } (keys %$attr) if (wantsdebug(qw[ all thisrequest ]));
if (defined $$attr{request}) {
if ( $$attr{request} eq "smtpd_access_policy" ) {
my $action = smtpd_access_policy(%$attr) || $default_action;
log_info "Action: $action" if (wantsdebug(qw[ all thisrequest ]));
if ($client) {
print $client ("action=$action\n\n");
} else {
print STDOUT ("action=$action\n\n");
};
$Counter_Requests++; $Counter_Interval++; %$attr = ();
delete $DEBUG{thisrequest};
} elsif ( $$attr{request} eq "dumpstats" ) {
log_info "STATS requested";
map { print $client "[STATS] $_\r\n" } list_stats();
close($client);
} elsif ( $$attr{request} eq "dumpcache" ) {
log_info "DUMP requested";
map { print $client "$_\r\n" } dump_cache();
close($client);
} elsif ( $$attr{request} =~ /^delrate (.*)$/ ) {
my $del = $1; $del =~ s/^[%]?//g;
if (defined $Rates{$del}) {
log_note "rate cache item '$del' removed";
print $client "rate cache item '$del' removed\r\n";
delete $Rates{$del};
} else {
log_note "rate cache removal of '$del' failed: item not found";
print $client "rate cache removal of '$del' failed: item not found\r\n";
};
close($client);
} elsif ( $$attr{request} =~ /^delcache (.*)$/ ) {
my $del = $1; $del =~ s/^[%]?//g;
if (defined $Request_Cache{$del}) {
log_note "request cache item '$del' removed";
print $client "request cache item '$del' removed\r\n";
delete $Request_Cache{$del};
} else {
log_note "request cache removal of '$del' failed: item not found";
print $client "request cache removal of '$del' failed: item not found\r\n";
};
close($client);
} else {
log_warn "Ignoring unrecognized request type: '".((defined $$attr{request}) ? substr($$attr{request},0,100) : '')."'";
};
};
# unknown command
} else {
log_warn "Ignoring garbage '".substr($msg, 0, 100)."'";
};
};
#### MAIN ####
# parse command-line
GetOptions ( "term|kill|stop|k" => \$opt_kill,
"hup|reload" => \$opt_hup,
't|test' => \$opt_test,
'v|verbose' => sub { $opt_verbose++ },
'debug=s' => sub { push @DEBUGLIST, (split /[,\s]+/, $_[1]) },
'l|logname=s' => \$syslog_name,
'facility=s' => \$syslog_facility,
'socktype=s' => \$syslog_socktype,
'loglen=i' => \$syslog_maxlen,
'n|nodns' => \$opt_nodns,
'nodnslog' => \$opt_nodnslog,
'no-dnslog' => \$opt_nodnslog,
'norulelog' => \$opt_norulelog,
'no-rulelog' => \$opt_norulelog,
'shortlog' => \$opt_shortlog, # for compatibility
'd|daemon!' => \$opt_daemon,
'I|instantcfg' => \$opt_instantconfig,
'P|perfmon' => \$opt_perfmon,
'L|stdoutlog' => \$opt_stdoutlog,
'i|interface=s' => \$net_interface,
'p|port=s' => \$net_port,
'proto=s' => \$net_proto,
'R|chroot=s' => \$net_chroot,
'pid|pidfile=s' => \$net_pid,
'umask=s' => \$net_umask,
'u|user=s' => \$net_user,
'g|group=s' => \$net_group,
'dns_queuesize=s' => \$dns_queuesize,
'dns_retries=i' => \$dns_retries,
'dns_timeout=i' => \$dns_timeout,
'dns_timeout_max=i' => \$MAX_DNSBL_TIMEOUTS,
'dns_timeout_interval=i' => \$MAX_DNSBL_INTERVAL,
'dns_async_txt' => \$dns_async_txt,
'dns_max_ns_lookups=i' => \$opt_max_ns_lookups,
'dns_max_mx_lookups=i' => \$opt_max_mx_lookups,
'c|cache=i' => \$REQUEST_MAX_CACHE,
'cacheid=s' => sub { @CacheID = ( @CacheID, (split /[,\s]+/, $_[1]) ) },
'cache-rdomain-only' => \$opt_cache_rdomain_only,
'cache-no-sender' => \$opt_cache_no_sender,
'cache-no-size' => \$opt_cache_no_size,
'cache-rbl-timeout=i' => \$RBL_MAX_CACHE,
'cache-rbl-default=s' => \$RBL_DEFAULT,
'cleanup-requests=i' => \$CLEANUP_REQUEST_CACHE,
'cleanup-rbls=i' => \$CLEANUP_RBL_CACHE,
'cleanup-rates=i' => \$CLEANUP_RATE_CACHE,
'S|summary:i' => \$opt_summary,
'norulestats' => \$opt_no_rulestats,
'no-rulestats' => \$opt_no_rulestats,
'noidlestats' => \$opt_noidlestats,
'no-idlestats' => \$opt_noidlestats,
's|scores=s' => \%opt_scores,
'config_timeout=i' => \$config_timeout,
'keep_rates|keep_limits|keep_rates_on_reload' => \$opt_keep_rates_on_reload,
'save_rates|save_limits|save_rates_on_restart=s' => \$opt_saverates,
'fast_limit_evaluation' => \$opt_fast_limits,
'dumpcache' => \$opt_dumpcache,
'dumpstats' => \$opt_dumpstats,
'delcache=s' => \$opt_delcache,
'delrate=s' => \$opt_delrate,
'f|file=s' => sub{ my($opt,$value) = @_; push (@Configs, $opt.'::'.$value) },
'r|rule=s' => sub{ my($opt,$value) = @_; push (@Configs, $opt.'::'.$value) },
'plugins=s' => \@Plugins,
'V|version' => sub{ print "$NAME $VERSION (Net::DNS ".(Net::DNS->VERSION || '<undef>').", Net::Server ".(Net::Server->VERSION || '<undef>').", Sys::Syslog ".($Sys::Syslog::VERSION || '<undef>').", ".((defined Time::HiRes->VERSION) ? "Time::HiRes ".(Time::HiRes->VERSION || '<undef>').", " : '').(($STORABLE) ? "Storable $STORABLE, " : '')."Perl ".$]." on ".$^O.")\n"; exit 1; },
'versionshort|shortversion' => sub{ print "$VERSION\n"; exit 1; },
'C|showconfig' => \$opt_showconfig,
'h|H|?|help|Help|HELP' => sub{ pod2usage (-msg => "\nPlease see \"".$NAME." -m\" for detailed instructions.\n", -verbose => 1); },
'm|M|manual' => sub{ # contructing command string (de-tainting $0)
$cmd_manual .= ($0 =~ /^([-\@\/\w. ]+)$/) ? " \"".$1 : " \"".$NAME;
$cmd_manual .= "\" | ".$cmd_pager;
exec_cmd ($cmd_manual); exit 1; },
) or pod2usage (-msg => "\nPlease see \"".$NAME." -m\" for detailed instructions.\n", -verbose => 1);
$opt_verbose = 0 unless $opt_verbose;
$opt_stdoutlog = 1 if ($opt_kill or $opt_hup or $opt_showconfig or $opt_dumpcache or $opt_dumpstats);
if ($opt_verbose) {
push @DEBUGLIST, 'verbose';
push @DEBUGLIST, 'all ' if ($opt_verbose > 1);
};
map { $DEBUG{$_} = 1 } uniq(@DEBUGLIST);
# terminate at -k or --kill
if ($opt_kill) {
kill "TERM", get_master_pid();
exit (0);
# reload at --reload
} elsif ($opt_hup) {
kill "HUP", get_master_pid();
exit (0);
};
# check for Storable module
if ( not($STORABLE) and $opt_saverates ) {
print STDERR "Perl module 'Storable' required to load and save rate limits!\n";
exit(1);
};
# init syslog
setlogsock $syslog_socktype;
$syslog_options = 'cons,pid' unless $opt_daemon;
openlog $syslog_name, $syslog_options, $syslog_facility;
log_note $NAME." ".$VERSION." starting" if $opt_daemon;
log_note "Net::DNS ".(Net::DNS->VERSION || '<undef>').", Net::Server ".(Net::Server->VERSION || '<undef>').", Sys::Syslog ".($Sys::Syslog::VERSION || '<undef>').", Perl ".$]." on ".$^O if (wantsdebug(qw[ all verbose ]));
# query usage statistics
if ($opt_dumpstats) {
$net_interface ||= $def_net_interface; $net_port ||= $def_net_port;
my $prevalert = undef;
eval {
local $SIG{'__DIE__'};
local $SIG{'ALRM'} = sub { print STDERR "\nTimeout for socket $net_interface:$net_port after 60 seconds\n\n"; die };
$prevalert = alarm(60);
if ( my $socket = new IO::Socket::INET (
PeerAddr => $net_interface,
PeerPort => $net_port,
Proto => 'tcp',
Timeout => 10,
Type => SOCK_STREAM ) ) {
print $socket "request=dumpstats\r\n\r\n";
print "\n"; map { print } (<$socket>); print "\n";
close($socket);
} else {
print STDERR "\nERROR: can not open socket to $net_interface:$net_port\n\n";
};
};
alarm($prevalert);
exit 1;
};
# query cache contents
if ($opt_dumpcache) {
$net_interface ||= $def_net_interface; $net_port ||= $def_net_port;
my $prevalert = undef;
eval {
local $SIG{'__DIE__'};
local $SIG{'ALRM'} = sub { print STDERR "\nTimeout for socket $net_interface:$net_port after 60 seconds\n\n"; die };
$prevalert = alarm(60);
if ( my $socket = new IO::Socket::INET (
PeerAddr => $net_interface,
PeerPort => $net_port,
Proto => 'tcp',
Timeout => 10,
Type => SOCK_STREAM ) ) {
print $socket "request=dumpcache\r\n\r\n";
print "\n"; map { print } (<$socket>); print "\n";
close($socket);
} else {
print STDERR "\nERROR: can not open socket to $net_interface:$net_port\n\n";
};
};
alarm($prevalert);
exit 1;
};
# remove cache item
if ($opt_delcache or $opt_delrate) {
$net_interface ||= $def_net_interface; $net_port ||= $def_net_port;
my $prevalert = undef;
eval {
local $SIG{'__DIE__'};
local $SIG{'ALRM'} = sub { print STDERR "\nTimeout for socket $net_interface:$net_port after 60 seconds\n\n"; die };
$prevalert = alarm(60);
if ( my $socket = new IO::Socket::INET (
PeerAddr => $net_interface,
PeerPort => $net_port,
Proto => 'tcp',
Timeout => 10,
Type => SOCK_STREAM ) ) {
print $socket "request=".(($opt_delcache) ? "delcache ".$opt_delcache : "delrate ".$opt_delrate)."\r\n\r\n";
print "\n"; map { print } (<$socket>); print "\n";
close($socket);
} else {
print STDERR "\nERROR: can not open socket to $net_interface:$net_port\n\n";
};
};
alarm($prevalert);
exit 1;
};
# read configuration
read_config(1);
if ($opt_showconfig) {
show_config;
exit 1;
};
# check modes
log_note "TESTMODE: set - will return ".$default_action." to all requests" if ($opt_test);
if (wantsdebug(qw[ all verbose ])) {
$opt_summary ||= $Stat_Interval_Time;
log_note "VERBOSE: set";
};
# -n - skip dns based checks
log_note "NODNS: set - will skip all dns based checks" if $opt_nodns;
# set max lookups to default (set to 0 to disable)
$opt_max_ns_lookups = $def_dns_max_ns_a_lookups unless defined $opt_max_ns_lookups;
$opt_max_mx_lookups = $def_dns_max_mx_a_lookups unless defined $opt_max_mx_lookups;
# init scores from command-line
map ( modify_score (each %opt_scores), (keys %opt_scores) );
# get summary interval time, set next display time
$Stat_Interval_Time = $opt_summary if $opt_summary;
$Cleanup_Timeouts = $Cleanup_Requests = $Cleanup_RBLs = $Cleanup_Rates = $Starttime = time();
log_info "Overriding cacheid itemlist with: ".(join ",", @CacheID) if ( @CacheID );
# load plugin-items
get_plugins (@Plugins) if @Plugins;
# de-taint arguments
$net_interface ||= $def_net_interface;
$net_port ||= $def_net_port;
$net_proto ||= $def_net_proto;
$net_umask ||= $def_net_umask;
$net_user ||= $def_net_user;
$net_group ||= $def_net_group;
$net_chroot ||= $def_net_chroot;
$net_pid ||= $def_net_pid;
$dns_queuesize ||= $def_dns_queuesize;
$dns_retries ||= $def_dns_retries;
$dns_timeout ||= $def_dns_timeout;
$config_timeout ||= $def_config_timeout;
$syslog_name ||= $NAME;
$net_interface = ( $net_interface =~ /^(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/ ) ? $1 : $def_net_interface;
$net_port = ( $net_port =~ /^(\d+|[-\|\@\/\w. ]+)$/ ) ? $1 : $def_net_port;
$net_proto = ( $net_proto =~ /^(tcp|unix)$/i ) ? $1 : $def_net_proto;
$net_umask = ( $net_umask =~ /^([0-7]+)$/ ) ? $1 : $def_net_umask;
$net_user = ( $net_user =~ /^([\w]+)$/ ) ? $1 : $def_net_user;
$net_group = ( $net_group =~ /^([\w]+)$/ ) ? $1 : $def_net_group;
$net_chroot = ( $net_chroot =~ /^(.+)$/ ) ? $1 : $def_net_chroot;
$net_pid = ( $net_pid =~ /^([-\@\/\w. ]+)$/ ) ? $1 : $def_net_pid;
$dns_queuesize = ( $dns_queuesize =~ /^(\d+)$/ ) ? $1 : $dns_queuesize;
$dns_retries = ( $dns_retries =~ /^(\d+)$/ ) ? $1 : $dns_retries;
$dns_timeout = ( $dns_timeout =~ /^(\d+)$/ ) ? $1 : $dns_timeout;
$syslog_name = ( $syslog_name =~ /^(.+)$/ ) ? $1 : $NAME;
$config_timeout = ( $config_timeout =~ /^(\d+)$/ ) ? $1 : $def_config_timeout;
$opt_saverates = ( $opt_saverates =~ /^([-\|\@\/\w. ]+)$/ ) ? $1 : '' if $opt_saverates;
# load rate items
load_rates();
# Unbuffer standard output.
select((select(STDOUT), $| = 1)[0]);
if ($opt_daemon) {
#
# Networking
#
# The networking part is implemented as non-forking server. It handles multiple client
# connections via non-blocking sockets using queueing via IO::Multiplex.
# Please check http://search.cpan.org/dist/Net-Server/lib/Net/Server/Multiplex.pm for info.
#
# create server object
my $server = bless {
server => {
commandline => [$0, @CommandArgs],
# Net::Server dies when a unix domain socket without dot (".") is used
port => (($net_proto eq 'unix') and not($net_port =~ /\|unix$/)) ? "$net_port|unix" : $net_port,
host => ($net_proto eq 'unix') ? '' : $net_interface,
proto => $net_proto,
user => $net_user,
group => $net_group,
chroot => $net_chroot ? $net_chroot : undef,
setsid => $opt_daemon ? 1 : undef,
pid_file => $net_pid ? $net_pid : undef,
log_level => $opt_perfmon ? 0 : ($opt_verbose + 2),
log_file => $opt_perfmon ? undef : 'Sys::Syslog',
syslog_logsock => $syslog_socktype,
syslog_facility => $syslog_facility,
syslog_ident => $syslog_name,
},
}, 'postfwd';
## run the servers main loop
umask oct($net_umask);
$server->run;
# ignore syslog failures
sub handle_syslog_error {};
# set $Reload_Conf marker on HUP signal
# does not call read_config directly, to avoid
# possible race conditions when caches are cleared
sub sig_hup () {
log_note "catched HUP signal - reloading ruleset on next request";
$Reload_Conf = 1;
};
# show stats on exit
sub pre_server_close_hook() {
log_note "terminating..." if $opt_summary;
end_program;
};
# init
sub pre_loop_hook() {
# install signal handlers
$SIG{__WARN__} = sub { log_crit "warning - \"@_\""; };
$SIG{__DIE__} = sub { fatal_exit "last err: \"$!\", detail: \"@_\""; };
$SIG{ALRM} = sub { show_stats; alarm ($Stat_Interval_Time); } if $opt_summary;
log_info "successfully installed signal handlers" if wantsdebug(qw[ all verbose ]);
# process init
umask oct($net_umask);
setlocale(LC_ALL, 'C');
$0 = $0." ".join(" ",@CommandArgs);
chdir "/" or fatal_exit "Could not chdir to /";
# set first status interval time
if ($opt_summary) {
alarm ($Stat_Interval_Time);
log_info "Setting status interval to $Stat_Interval_Time seconds";
};
# let's go
log_info "$NAME $VERSION ready for input";
};
# main loop
sub mux_input() {
my ($self, $mux, $client, $mydata) = @_;
my ($request,$answer) = undef;
my (%myattr) = ();
# check request and print output
while ( $$mydata =~ s/^([^\r\n]*)\r?\n// ) {
# check request line and print output
next unless defined $1;
$request = $1;
process_input ($client, $request, \%myattr);
};
};
} else {
# main loop for command line use
# regexp is used to keep it similar to the server main loop
my($request,$answer) = undef;
my (%myattr) = ();
while (<>) {
# check request and print output
s/^([^\r\n]*)\r?\n//;
next unless defined $1;
$request = $1;
process_input (undef, $request, \%myattr);
};
# finishing
end_program;
};
die "should never see me...";
## EOF
__END__
=head1 NAME
postfwd - postfix firewall daemon
=head1 SYNOPSIS
postfwd [OPTIONS] [SOURCE1, SOURCE2, ...]
Ruleset: (at least one, multiple use is allowed):
-f, --file <file> reads rules from <file>
-r, --rule <rule> adds <rule> to config
Scoring:
-s, --scores <v>=<r> returns <r> when score exceeds <v>
Control:
-d, --daemon run postfwd as daemon
-k, --kill stops daemon
--reload reloads configuration
--dumpstats displays usage statistics
--dumpcache displays cache contents
--delcache <item> removes an item from the request cache
--delrate <item> removes an item from the rate cache
Networking:
-i, --interface <dev> listen on interface <dev>
-p, --port <port> listen on port <port>
--proto <proto> socket type (tcp or unix)
-u, --user <name> set uid to user <name>
-g, --group <name> set gid to group <name>
--umask <mask> set umask for file permissions
-R, --chroot <path> chroot the daemon to <path>
--pidfile <path> create pidfile under <path>
--facility <f> syslog facility
--socktype <s> syslog socktype
-l, --logname <label> label for syslog messages
--loglen <int> truncates syslogs after <int> chars
Caching:
-c, --cache <int> sets the request-cache timeout to <int> seconds
--cache-no-size ignores size attribute for caching
--cache-no-sender ignores sender address in cache
--cache-rdomain-only ignores localpart of recipient address in cache
--cache-rbl-timeout default rbl timeout, if not specified in ruleset
--cache-rbl-default default rbl response pattern to match (regexp)
--cacheid <item>, .. list of attributes for request cache identifier
--cleanup-requests cleanup interval in seconds for request cache
--cleanup-rbls cleanup interval in seconds for rbl cache
--cleanup-rates cleanup interval in seconds for rate cache
Optional:
-t, --test testing, always returns "dunno"
-v, --verbose verbose logging, use twice (-vv) to increase level
-S, --summary <int> show some usage statistics every <int> seconds
--norulelog disbles rule logging
--norulestats disables per rule statistics
--noidlestats disables statistics when idle
-n, --nodns disable dns
--nodnslog disable dns logging
--dns_async_txt perform dnsbl A and TXT lookups simultaneously
--dns_timeout timeout in seconds for asynchonous dns queries
--dns_timeout_max maximum of dns timeouts until a dnsbl will be deactivated
--dns_timeout_interval interval in seconds for dns timeout maximum counter
--dns_max_ns_lookups max names to look up with sender_ns_addrs
--dns_max_mx_lookups max names to look up with sender_mx_addrs
-I, --instantcfg re-reads rulefiles for every new request
--config_timeout <i> parser timeout in seconds
--keep_rates do not clear rate limit counters on reload
--save_rates <file> save and load rate limits on disk
--fast_limit_evaluation evaluate rate limits before ruleset is parsed
(please note the limitations)
Plugins:
--plugins <file> loads postfwd plugins from file
Informational (use only at command-line!):
-C, --showconfig shows ruleset summary, -v for verbose
-L, --stdoutlog redirect syslog messages to stdout
-P, --perfmon no syslogging, no stdout
-V, --version shows program version
-h, --help shows usage
-m, --manual shows program manual
=head1 DESCRIPTION
=head2 INTRODUCTION
postfwd is written to combine complex postfix restrictions in a ruleset similar to those of the most firewalls.
The program uses the postfix policy delegation protocol to control access to the mail system before a message
has been accepted (please visit L<http://www.postfix.org/SMTPD_POLICY_README.html> for more information).
postfwd allows you to choose an action (e.g. reject, dunno) for a combination of several smtp parameters
(like sender and recipient address, size or the client's TLS fingerprint). Also it offers simple macros/acls
which should allow straightforward and easy-to-read configurations.
I<Features:>
* Complex combinations of smtp parameters
* Combined RBL/RHSBL lookups with arbitrary actions depending on results
* Scoring system
* Date/time based rules
* Macros/ACLs, Groups, Negation
* Compare request attributes (e.g. client_name and helo_name)
* Internal caching for requests and dns lookups
* Built in statistics for rule efficiency analysis
=head2 CONFIGURATION
A configuration line consists of optional item=value pairs, separated by semicolons
(`;`) and the appropriate desired action:
[ <item1>=<value>; <item2>=<value>; ... ] action=<result>
I<Example:>
client_address=192.168.1.1 ; sender==no@bad.local ; action=REJECT
This will deny all mail from 192.168.1.1 with envelope sender no@bad.local. The order of the elements
is not important. So the following would lead to the same result as the previous example:
action=REJECT ; client_address=192.168.1.1 ; sender==no@bad.local
The way how request items are compared to the ruleset can be influenced in the following way:
====================================================================
ITEM == VALUE true if ITEM equals VALUE
ITEM => VALUE true if ITEM >= VALUE
ITEM =< VALUE true if ITEM <= VALUE
ITEM > VALUE true if ITEM > VALUE
ITEM < VALUE true if ITEM < VALUE
ITEM =~ VALUE true if ITEM ~= /^VALUE$/i
ITEM != VALUE false if ITEM equals VALUE
ITEM !> VALUE false if ITEM >= VALUE
ITEM !< VALUE false if ITEM <= VALUE
ITEM !~ VALUE false if ITEM ~= /^VALUE$/i
ITEM = VALUE default behaviour (see ITEMS section)
====================================================================
To identify single rules in your log files, you may add an unique identifier for each of it:
id=R_001 ; action=REJECT ; client_address=192.168.1.1 ; sender==no@bad.local
You may use these identifiers as target for the `jump()` command (see ACTIONS section below). Leading
or trailing whitespace characters will be ignored. Use '#' to comment your configuration. Others will
appreciate.
A ruleset consists of one or multiple rules, which can be loaded from files or passed as command line
arguments. Please see the COMMAND LINE section below for more information on this topic.
Since postfwd version 1.30 rules spanning span multiple lines can be defined by prefixing the following
lines with one or multiple whitespace characters (or '}' for macros):
id=RULE001
client_address=192.168.1.0/24
sender==no@bad.local
action=REJECT no access
postfwd versions prior to 1.30 require trailing ';' and '\'-characters:
id=RULE001; \
client_address=192.168.1.0/24; \
sender==no@bad.local; \
action=REJECT no access
=head2 ITEMS
id - a unique rule id, which can be used for log analysis
ids also serve as targets for the "jump" command.
date, time - a time or date range within the specified rule shall hit
# FORMAT:
# Feb, 29th
date=29.02.2008
# Dec, 24th - 26th
date=24.12.2008-26.12.2008
# from today until Nov, 23rd
date=-23.09.2008
# from April, 1st until today
date=01.04.2008-
days, months - a range of weekdays (Sun-Sat) or months (Jan-Dec)
within the specified rule shall hit
score - when the specified score is hit (see ACTIONS section)
the specified action will be returned to postfix
scores are set global until redefined!
request_score - this value allows to access a request's score. it
may be used as variable ($$request_score).
rbl, rhsbl, - query the specified RBLs/RHSBLs, possible values are:
rhsbl_client, <name>[/<reply>/<maxcache>, <name>/<reply>/<maxcache>]
rhsbl_sender, (defaults: reply=^127\.0\.0\.\d+$ maxcache=3600)
rhsbl_reverse_client the results of all rhsbl_* queries will be combined
in rhsbl_count (see below).
rblcount, rhsblcount - minimum RBL/RHSBL hitcounts to match. if not specified
a single RBL/RHSBL hit will match the rbl/rhsbl items.
you may specify 'all' to evaluate all items, and use
it as variable in an action (see ACTIONS section)
(default: 1)
sender_localpart, - the local-/domainpart of the sender address
sender_domain
recipient_localpart, - the local-/domainpart of the recipient address
recipient_domain
helo_address - postfwd tries to look up the helo_name. use
helo_address=!!(0.0.0.0/0) to check for unknown.
Please do not use this for positive access control
(whitelisting), as it might be forged.
sender_ns_names, - postfwd tries to look up the names/ip addresses
sender_ns_addrs of the nameservers for the sender domain part.
Please do not use this for positive access control
(whitelisting), as it might be forged.
sender_mx_names, - postfwd tries to look up the names/ip addresses
sender_mx_addrs of the mx records for the sender domain part.
Please do not use this for positive access control
(whitelisting), as it might be forged.
version - postfwd version, contains "postfwd n.nn"
this enables version based checks in your rulesets
(e.g. for migration). works with old versions too,
because a non-existing item always returns false:
# version >= 1.10
id=R01; version~=1\.[1-9][0-9]; sender_domain==some.org \
; action=REJECT sorry no access
ratecount - only available for rate(), size() and rcpt() actions.
contains the actual limit counter:
id=R01; action=rate(sender/200/600/REJECT limit of 200 exceeded [$$ratecount hits])
id=R02; action=rate(sender/100/600/WARN limit of 100 exceeded [$$ratecount hits])
Besides these you can specify any attribute of the postfix policy delegation protocol.
Feel free to combine them the way you need it (have a look at the EXAMPLES section below).
Most values can be specified as regular expressions (PCRE). Please see the table below
for details:
# ==========================================================
# ITEM=VALUE TYPE
# ==========================================================
id=something mask = string
date=01.04.2007-22.04.2007 mask = date (DD.MM.YYYY-DD.MM.YYYY)
time=08:30:00-17:00:00 mask = time (HH:MM:SS-HH:MM:SS)
days=Mon-Wed mask = weekdays (Mon-Wed) or numeric (1-3)
months=Feb-Apr mask = months (Feb-Apr) or numeric (1-3)
score=5.0 mask = maximum floating point value
rbl=zen.spamhaus.org mask = <name>/<reply>/<maxcache>[,...]
rblcount=2 mask = numeric, will match if rbl hits >= 2
helo_address=<a.b.c.d/nn> mask = CIDR[,CIDR,...]
sender_ns_names=some.domain.tld mask = PCRE
sender_mx_names=some.domain.tld mask = PCRE
sender_ns_addrs=<a.b.c.d/nn> mask = CIDR[,CIDR,...]
sender_mx_addrs=<a.b.c.d/nn> mask = CIDR[,CIDR,...]
# ------------------------------
# Postfix version 2.1 and later:
# ------------------------------
client_address=<a.b.c.d/nn> mask = CIDR[,CIDR,...]
client_name=another.domain.tld mask = PCRE
reverse_client_name=another.domain.tld mask = PCRE
helo_name=some.domain.tld mask = PCRE
sender=foo@bar.tld mask = PCRE
recipient=bar@foo.tld mask = PCRE
recipient_count=5 mask = numeric, will match if recipients >= 5
# ------------------------------
# Postfix version 2.2 and later:
# ------------------------------
sasl_method=plain mask = PCRE
sasl_username=you mask = PCRE
sasl_sender= mask = PCRE
size=12345 mask = numeric, will match if size >= 12345
ccert_subject=blackhole.nowhere.local mask = PCRE (only if tls verified)
ccert_issuer=John+20Doe mask = PCRE (only if tls verified)
ccert_fingerprint=AA:BB:CC:DD:EE:... mask = PCRE (do NOT use "..." here)
# ------------------------------
# Postfix version 2.3 and later:
# ------------------------------
encryption_protocol=TLSv1/SSLv3 mask = PCRE
encryption_cipher=DHE-RSA-AES256-SHA mask = PCRE
encryption_keysize=256 mask = numeric, will match if keysize >= 256
...
the current list can be found at L<http://www.postfix.org/SMTPD_POLICY_README.html>. Please read carefully about which
attribute can be used at which level of the smtp transaction (e.g. size will only work reliably at END-OF-MESSAGE level).
Pattern matching is performed case insensitive.
Multiple use of the same item is allowed and will compared as logical OR, which means that this will work as expected:
id=TRUST001; action=OK; encryption_keysize=64
ccert_fingerprint=11:22:33:44:55:66:77:88:99
ccert_fingerprint=22:33:44:55:66:77:88:99:00
ccert_fingerprint=33:44:55:66:77:88:99:00:11
sender=@domain\.local$
client_address, rbl and rhsbl items may also be specified as whitespace-or-comma-separated values:
id=SKIP01; action=dunno
client_address=192.168.1.0/24, 172.16.254.23
id=SKIP02; action=dunno
client_address=10.10.3.32 10.216.222.0/27
The following items currently have to be unique:
id, minimum and maximum values, rblcount and rhsblcount
Any item can be negated by preceeding '!!' to it, e.g.:
id=HOST001 ; hostname == !!secure.trust.local ; action=REJECT only secure.trust.local please
or using the right compare operator:
id=HOST001 ; hostname != secure.trust.local ; action=REJECT only secure.trust.local please
To avoid confusion with regexps or simply for better visibility you can use '!!(...)':
id=USER01 ; sasl_username = !!( (bob|alice) ) ; action=REJECT who is that?
Request attributes can be compared by preceeding '$$' characters, e.g.:
id=R-003 ; client_name = !! $$helo_name ; action=WARN helo does not match DNS
# or
id=R-003 ; client_name = !!($$(helo_name)) ; action=WARN helo does not match DNS
This is only valid for PCRE values (see list above). The comparison will be performed as case insensitive exact match.
Use the '-vv' option to debug.
These special items will be reset for any new rule:
rblcount - contains the number of RBL answers
rhsblcount - contains the number of RHSBL answers
matches - contains the number of matched items
dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
rbltype:rblname:<txt>; rbltype:rblname:<txt>; ...
These special items will be changed for any matching rule:
request_hits - contains ids of all matching rules
This means that it might be necessary to save them, if you plan to use these values in later rules:
# set vals
id=RBL01 ; rhsblcount=all; rblcount=all
action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org
rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
# compare
id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
=head2 FILES
Since postfwd1 v1.15 and postfwd2 v0.18 long item lists can be stored in separate files:
id=R001 ; ccert_fingerprint==file:/etc/postfwd/wl_ccerts ; action=DUNNO
postfwd will read a list of items (one item per line) from /etc/postfwd/wl_ccerts. comments are allowed:
# client1
11:22:33:44:55:66:77:88:99
# client2
22:33:44:55:66:77:88:99:00
# client3
33:44:55:66:77:88:99:00:11
To use existing tables in key=value format, you can use:
id=R001 ; ccert_fingerprint==table:/etc/postfwd/wl_ccerts ; action=DUNNO
This will ignore the right-hand value. Items can be mixed:
id=R002 ; action=REJECT
client_name==unknown
client_name==file:/etc/postfwd/blacklisted
and for non pcre (comma separated) items:
id=R003 ; action=REJECT
client_address==10.1.1.1, file:/etc/postfwd/blacklisted
id=R004 ; action=REJECT
rbl=myrbl.home.local, zen.spamhaus.org, file:/etc/postfwd/rbls_changing
You can check your configuration with the --show_config option at the command line:
# postfwd --showconfig --rule='action=DUNNO; client_address=10.1.0.0/16, file:/etc/postfwd/wl_clients, 192.168.2.1'
should give something like:
Rule 0: id->"R-0"; action->"DUNNO"; client_address->"=;10.1.0.0/16, =;194.123.86.10, =;186.4.6.12, =;192.168.2.1"
If a file can not be read, it will be ignored:
# postfwd --showconfig --rule='action=DUNNO; client_address=10.1.0.0/16, file:/etc/postfwd/wl_clients, 192.168.2.1'
[LOG warning]: error: file /etc/postfwd/wl_clients not found - file will be ignored ?
Rule 0: id->"R-0"; action->"DUNNO"; client_address->"=;10.1.0.0/16, =;192.168.2.1"
File items are evaluated at configuration stage. Therefore postfwd needs to be reloaded if a file has changed.
If you want to specify a file, that will be reloaded for each request, you can use lfile: and ltable:
id=R001; client_address=lfile:/etc/postfwd/client_whitelist; action=dunno
This will check the modification time of /etc/postfwd/client_whitelist every time the rule is evaluated and reload it as
necessary. Of course this might increase the system load, so please use it with care.
The --showconfig option illustrates the difference:
## evaluated at configuration stage
# postfwd2 --nodaemon -L --rule='client_address=table:/etc/postfwd/clients; action=dunno' -C
Rule 0: id->"R-0"; action->"dunno"; client_address->"=;1.1.1.1, =;1.1.1.2, =;1.1.1.3"
## evaluated for any rulehit
# postfwd2 --nodaemon -L --rule='client_address=ltable:/etc/postfwd/clients; action=dunno' -C
Rule 0: id->"R-0"; action->"dunno"; client_address->"=;ltable:/etc/postfwd/clients"
Files can refer to other files. The following is valid.
-- FILE /etc/postfwd/rules.cf --
id=R001; client_address=file:/etc/postfwd/clients_master.cf; action=DUNNO
-- FILE /etc/postfwd/clients_master.cf --
192.168.1.0/24
file:/etc/postfwd/clients_east.cf
file:/etc/postfwd/clients_west.cf
-- FILE /etc/postfwd/clients_east.cf --
192.168.2.0/24
-- FILE /etc/postfwd/clients_west.cf --
192.168.3.0/24
Note that there is currently no loop detection (/a/file calls /a/file) and that this feature is only available
with postfwd1 v1.15 and postfwd2 v0.18 and higher.
=head2 ACTIONS
I<General>
Actions will be executed, when all rule items have matched a request (or at least one of any item list). You can refer to
request attributes by preceeding $$ characters, like:
id=R-003; client_name = !!$$helo_name; action=WARN helo '$$helo_name' does not match DNS '$$client_name'
# or
id=R-003; client_name = !!$$helo_name; action=WARN helo '$$(helo_name)' does not match DNS '$$(client_name)'
I<postfix actions>
Actions will be replied to postfix as result to policy delegation requests. Any action that postfix understands is allowed - see
"man 5 access" or L<http://www.postfix.org/access.5.html> for a description. If no action is specified, the postfix WARN action
which simply logs the event will be used for the corresponding rule.
postfwd will return dunno if it has reached the end of the ruleset and no rule has matched. This can be changed by placing a last
rule containing only an action statement:
...
action=dunno ; sender=@domain.local # sender is ok
action=reject # default deny
I<postfwd actions>
postfwd actions control the behaviour of the program. Currently you can specify the following:
jump (<id>)
jumps to rule with id <id>, use this to skip certain rules.
you can jump backwards - but remember that there is no loop
detection at the moment! jumps to non-existing ids will be skipped.
score (<score>)
the request's score will be modified by the specified <score>,
which must be a floating point value. the modificator can be either
+n.nn adds n.nn to current score
-n.nn sustracts n.nn from the current score
*n.nn multiplies the current score by n.nn
/n.nn divides the current score through n.nn
=n.nn sets the current score to n.nn
if the score exceeds the maximum set by `--scores` option (see
COMMAND LINE) or the score item (see ITEMS section), the action
defined for this case will be returned (default: 5.0=>"REJECT postfwd score exceeded").
set (<item>=<value>,<item>=<value>,...)
this command allows you to insert or override request attributes, which then may be
compared to your further ruleset. use this to speed up repeated comparisons to large item lists.
please see the EXAMPLES section for more information. you may separate multiple key=value pairs
by "," characters.
rate (<item>/<max>/<time>/<action>)
this command creates a counter for the given <item>, which will be increased any time a request
containing it arrives. if it exceeds <max> within <time> seconds it will return <action> to postfix.
rate counters are very fast as they are executed before the ruleset is parsed.
please note that <action> was limited to postfix actions (no postfwd actions) for postfwd versions <1.33!
# no more than 3 requests per 5 minutes
# from the same "unknown" client
id=RATE01 ; client_name==unknown
action=rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
Please note also that the order of rate limits in your ruleset is important, which means
that this:
# works as expected
id=R001; action=rcpt(sender/500/3600/REJECT limit of 500 recipients per hour for sender $$sender exceeded)
id=R002; action=rcpt(sender/200/3600/WARN state YELLOW for sender $$sender)
leads to different results than this:
# rule R002 never gets executed
id=R001; action=rcpt(sender/200/3600/WARN state YELLOW for sender $$sender)
id=R002; action=rcpt(sender/500/3600/REJECT limit of 500 recipients per hour for sender $$sender exceeded)
size (<item>/<max>/<time>/<action>)
this command works similar to the rate() command with the difference, that the rate counter is
increased by the request's size attribute. to do this reliably you should call postfwd from
smtpd_end_of_data_restrictions. if you want to be sure, you could check it within the ruleset:
# size limit 1.5mb per hour per client
id=SIZE01 ; protocol_state==END-OF-MESSAGE ; client_address!=10.1.1.1
action=size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
rcpt (<item>/<max>/<time>/<action>)
this command works similar to the rate() command with the difference, that the rate counter is
increased by the request's recipient_count attribute. to do this reliably you should call postfwd
from smtpd_data_restrictions or smtpd_end_of_data_restrictions. if you want to be sure, you could
check it within the ruleset:
# recipient count limit 3 per hour per client
id=RCPT01 ; protocol_state==END-OF-MESSAGE ; client_address!=10.1.1.1
action=rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
rate5321,size5321,rcpt5321 (<item>/<max>/<time>/<action>)
same as the corresponding non-5321 functions, with the difference that the localpart of
sender oder recipient addresses are evaluated case-sensitive according to rfc5321. That
means that requests from bob@example.local and BoB@example.local will be treated differently
ask (<addr>:<port>[:<ignore>])
allows to delegate the policy decision to another policy service (e.g. postgrey). the first
and the second argument (address and port) are mandatory. a third optional argument may be
specified to tell postfwd to ignore certain answers and go on parsing the ruleset:
# example1: query postgrey and return it's answer to postfix
id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031)
# example2: query postgrey but ignore the answer, if it matches 'DUNNO'
# and continue parsing postfwd's ruleset
id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031:^dunno$)
mail(server/helo/from/to/subject/body)
This command is deprecated. You should try to use the sendmail() action instead.
Very basic mail command, that sends a message with the given arguments. LIMITATIONS:
This basically performs a telnet. No authentication or TLS are available. Additionally it does
not track notification state and will notify you any time, the corresponding rule hits.
sendmail(sendmail-path::from::to::subject::body)
Mail command, that uses an existing sendmail binary and sends a message with the given arguments.
LIMITATIONS: The command does not track notification state and will notify you any time, the
corresponding rule hits (which could mean 100 mails for a mail with 100 recipients at RCPT stage).
wait (<delay>)
pauses the program execution for <delay> seconds. use this for
delaying or throtteling connections.
note (<string>)
just logs the given string and continues parsing the ruleset.
if the string is empty, nothing will be logged (noop).
quit (<code>)
terminates the program with the given exit-code. postfix doesn`t
like that too much, so use it with care.
You can reference to request attributes, like
id=R-HELO ; helo_name=^[^\.]+$ ; action=REJECT invalid helo '$$helo_name'
=head2 MACROS/ACLS
Multiple use of long items or combinations of them may be abbreviated by macros. Those must be prefixed by '&&' (two '&' characters).
First the macros have to be defined as follows:
&&RBLS { rbl=zen.spamhaus.org,list.dsbl.org,bl.spamcop.net,dnsbl.sorbs.net,ix.dnsbl.manitu.net; };
Then these may be used in your rules, like:
&&RBLS ; client_name=^unknown$ ; action=REJECT
&&RBLS ; client_name=(\d+[\.-_]){4} ; action=REJECT
&&RBLS ; client_name=[\.-_](adsl|dynamic|ppp|)[\.-_] ; action=REJECT
Macros can contain actions, too:
# definition
&&GONOW { action=REJECT your request caused our spam detection policy to reject this message. More info at http://www.domain.local; };
# rules
&&GONOW ; &&RBLS ; client_name=^unknown$
&&GONOW ; &&RBLS ; client_name=(\d+[\.-_]){4}
&&GONOW ; &&RBLS ; client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
Macros can contain macros, too:
# definition
&&RBLS{
rbl=zen.spamhaus.org
rbl=list.dsbl.org
rbl=bl.spamcop.net
rbl=dnsbl.sorbs.net
rbl=ix.dnsbl.manitu.net
};
&&DYNAMIC{
client_name=^unknown$
client_name=(\d+[\.-_]){4}
client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
};
&&GOAWAY { &&RBLS; &&DYNAMIC; };
# rules
&&GOAWAY ; action=REJECT dynamic client and listed on RBL
Basically macros are simple text substitutions - see the L</PARSER> section for more information.
=head2 PLUGINS
B<Description>
The plugin interface allow you to define your own checks and enhance postfwd's
functionality. Feel free to share useful things!
B<Warning>
Note that the plugin interface is still at devel stage. Please test your plugins
carefully, because errors may cause postfwd to break! It is also
allowed to override attributes or built-in functions, but be sure that you know
what you do because some of them are used internally.
Please keep security in mind, when you access sensible ressources and never, ever
run postfwd as privileged user! Also never trust your input (especially hostnames,
and e-mail addresses).
B<ITEMS>
Item plugins are perl subroutines which integrate additional attributes to requests
before they are evaluated against postfwd's ruleset like any other item of the
policy delegation protocol. This allows you to create your own checks.
plugin-items can not be used selective. these functions will be executed for every
request postfwd receives, so keep performance in mind.
SYNOPSIS: %result = postfwd_items_plugin{<name>}(%request)
means that your subroutine, called <name>, has access to a hash called %request,
which contains all request attributes, like $request{client_name} and must
return a value in the following form:
save: $result{<item>} = <value>
this creates the new item <item> containing <value>, which will be integrated in
the policy delegation request and therefore may be used in postfwd's ruleset.
# do NOT remove the next line
%postfwd_items_plugin = (
# EXAMPLES - integrated in postfwd. no need to activate them here.
# allows to check postfwd version in ruleset
"version" => sub {
my(%request) = @_;
my(%result) = (
"version" => $NAME." ".$VERSION,
);
return %result;
},
# sender_domain and recipient_domain
"address_parts" => sub {
my(%request) = @_;
my(%result) = ();
$request{sender} =~ /@([^@]*)$/;
$result{sender_domain} = ($1 || '');
$request{recipient} =~ /@([^@]*)$/;
$result{recipient_domain} = ($1 || '');
return %result;
},
# do NOT remove the next line
);
B<COMPARE>
Compare plugins allow you to define how your new items should be compared to the ruleset.
These are optional. If you don't specify one, the default (== for exact match, =~ for PCRE, ...)
will be used.
SYNOPSIS: <item> => sub { return &{$postfwd_compare{<type>}}(@_); },
# do NOT remove the next line
%postfwd_compare_plugin = (
EXAMPLES - integrated in postfwd. no need to activate them here.
# Simple example
# SYNOPSIS: <result> = <item> (return &{$postfwd_compare{<type>}}(@_))
"client_address" => sub { return &{$postfwd_compare{cidr}}(@_); },
"size" => sub { return &{$postfwd_compare{numeric}}(@_); },
"recipient_count" => sub { return &{$postfwd_compare{numeric}}(@_); },
# Complex example
# SYNOPSIS: <result> = <item>(<operator>, <ruleset value>, <request value>, <request>)
"numeric" => sub {
my($cmp,$val,$myitem,%request) = @_;
my($myresult) = undef; $myitem ||= "0"; $val ||= "0";
if ($cmp eq '==') {
$myresult = ($myitem == $val);
} elsif ($cmp eq '=<') {
$myresult = ($myitem <= $val);
} elsif ($cmp eq '=>') {
$myresult = ($myitem >= $val);
} elsif ($cmp eq '<') {
$myresult = ($myitem < $val);
} elsif ($cmp eq '>') {
$myresult = ($myitem > $val);
} elsif ($cmp eq '!=') {
$myresult = not($myitem == $val);
} elsif ($cmp eq '!<') {
$myresult = not($myitem <= $val);
} elsif ($cmp eq '!>') {
$myresult = not($myitem >= $val);
} else {
$myresult = ($myitem >= $val);
};
return $myresult;
},
# do NOT remove the next line
);
B<ACTIONS>
Action plugins allow to define new postfwd actions. By setting the $stop-flag you can decide to
continue or to stop parsing the ruleset.
SYNOPSIS: (<stop rule parsing>, <next rule index>, <return action>, <logprefix>, <request>) =
<action> (<current rule index>, <current time>, <command name>, <argument>, <logprefix>, <request>)
# do NOT remove the next line
%postfwd_actions_plugin = (
# EXAMPLES - integrated in postfwd. no need to activate them here.
# note(<logstring>) command
"note" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = 'dunno'; my($stop) = 0;
log_info "[RULES] ".$myline." - note: ".$myarg if $myarg;
return ($stop,$index,$myaction,$myline,%request);
},
# skips next <myarg> rules
"skip" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = 'dunno'; my($stop) = 0;
$index += $myarg if ( $myarg and not(($index + $myarg) > $#Rules) );
return ($stop,$index,$myaction,$myline,%request);
},
# dumps current request contents to syslog
"dumprequest" => sub {
my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
my($myaction) = 'dunno'; my($stop) = 0;
map { log_info "[DUMP] rule=$index, Attribute: $_=$request{$_}" } (keys %request);
return ($stop,$index,$myaction,$myline,%request);
},
# do NOT remove the next line
);
=head2 COMMAND LINE
I<Ruleset>
The following arguments are used to specify the source of the postfwd ruleset. This means
that at least one of the following is required for postfwd to work.
-f, --file <file>
Reads rules from <file>. Please see the CONFIGURATION section
below for more information.
-r, --rule <rule>
Adds <rule> to ruleset. Remember that you might have to quote
strings that contain whitespaces or shell characters.
I<Scoring>
-s, --scores <val>=<action>
Returns <action> to postfix, when the request's score exceeds <val>
Multiple usage is allowed. Just chain your arguments, like:
postfwd -r "<item>=<value>;action=<result>" -f <file> -f <file> ...
or
postfwd --scores 4.5="WARN high score" --scores 5.0="REJECT postfwd score too high" ...
In case of multiple scores, the highest match will count. The order of the arguments will be
reflected in the postfwd ruleset.
I<Control>
-d, --daemon
postfwd will run as daemon and listen on the network for incoming
queries (default 127.0.0.1:10040).
-k, --kill
Stops a running postfwd daemon.
--reload
Reloads configuration.
--dumpstats
Displays program usage statistics.
--dumpcache
Displays cache contents.
--delcache <item>
Removes an item from the request cache. Use --dumpcache to identify objects.
E.g.:
# postfwd --dumpcache
...
%rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @count -> '1'
%rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @maxcount -> '2'
...
# postfwd --delrate="sender=gmato@jqvo.org"
rate cache item 'sender=gmato@jqvo.org' removed
--delrate <item>
Removes an item from the rate cache. Use --dumpcache to identify objects.
I<Networking>
postfwd can be run as daemon so that it listens on the network for incoming requests.
The following arguments will control it's behaviour in this case.
-i, --interface <dev>
Bind postfwd to the specified interface (default 127.0.0.1).
-p, --port <port>
postfwd listens on the specified port (default tcp/10040).
--proto <type>
The protocol type for postfwd's socket. Currently you may use 'tcp' or 'unix' here.
To use postfwd with a unix domain socket, run it as follows:
postfwd --proto=unix --port=/somewhere/postfwd.socket
-u, --user <name>
Changes real and effective user to <name>.
-g, --group <name>
Changes real and effective group to <name>.
--umask <mask>
Changes the umask for filepermissions (unix domain sockets, pidfiles).
Attention: This is umask, not chmod - you have to specify the bits that
should NOT apply. E.g.: umask 077 equals to chmod 700.
-R, --chroot <path>
Chroot the process to the specified path.
Test this before using - you might need some libs there.
--pidfile <path>
The process id will be saved in the specified file.
--facility <f>
sets the syslog facility, default is 'mail'
--socktype <s>
sets the Sys::Syslog socktype to 'native', 'inet' or 'unix'.
Default is to auto-detect this depening on module version and os.
-l, --logname <label>
Labels the syslog messages. Useful when running multiple
instances of postfwd.
--loglen <int>
Truncates any syslog message after <int> characters.
I<Plugins>
--plugins <file>
Loads postfwd plugins from file. Please see http://postfwd.org/postfwd.plugins
or the plugins.postfwd.sample that is available from the tarball for more info.
I<Optional arguments>
These parameters influence the way postfwd is working. Any of them can be combined.
-v, --verbose
Verbose logging displays a lot of useful information but can cause
your logfiles to grow noticeably. So use it with caution. Set the option
twice (-vv) to get more information (logs all request attributes).
-c, --cache <int> (default=600)
Timeout for request cache, results for identical requests will be
cached until config is reloaded or this time (in seconds) expired.
A setting of 0 disables this feature.
--cache-no-size
Ignores size attribute for cache comparisons which will lead to better
cache-hit rates. You should set this option, if you don't use the size
item in your ruleset.
--cache-no-sender
Ignores sender address for cache comparisons which will lead to better
cache-hit rates. You should set this option, if you don't use the sender
item in your ruleset.
--cache-rdomain-only
This will strip the localpart of the recipient's address before filling the
cache. This may considerably increase cache-hit rates.
--cache-rbl-timeout <timeout> (default=3600)
This default value will be used as timeout in seconds for rbl cache items,
if not specified in the ruleset.
--cache-rbl-default <pattern> (default=^127\.0\.0\.\d+$)
Matches <pattern> to rbl/rhsbl answers (regexp) if not specified in the ruleset.
--cacheid <item>, <item>, ...
This csv-separated list of request attributes will be used to construct
the request cache identifier. Use this only, if you know exactly what you
are doing. If you, for example, use postfwd only for RBL/RHSBL control,
you may set this to
postfwd --cache=3600 --cacheid=client_name,client_address
This increases efficiency of caching and improves postfwd's performance.
Warning: You should list all items here, which are used in your ruleset!
--cleanup-requests <interval> (default=600)
The request cache will be searched for timed out items after this <interval> in
seconds. It is a minimum value. The cleanup process will only take place, when
a new request arrives.
--cleanup-rbls <interval> (default=600)
The rbl cache will be searched for timed out items after this <interval> in
seconds. It is a minimum value. The cleanup process will only take place, when
a new request arrives.
--cleanup-rates <interval> (default=600)
The rate cache will be searched for timed out items after this <interval> in
seconds. It is a minimum value. The cleanup process will only take place, when
a new request arrives.
-S, --summary <int> (default=600)
Shows some usage statistics (program uptime, request counter, matching rules)
every <int> seconds. This option is included by the -v switch.
This feature uses the alarm signal, so you can force postfwd to dump the stats
using `kill -ALRM <pid>` (where <pid> is the process id of postfwd).
Example:
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Counters: 213000 seconds uptime, 39 rules
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Requests: 71643 overall, 49 last interval, 62.88% cache hits
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Averages: 20.18 overall, 4.90 last interval, 557.30 top
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Contents: 44 cached requests, 239 cached dnsbl results
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Rule ID: R-001 matched: 2704 times
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Rule ID: R-002 matched: 9351 times
Aug 19 12:39:45 mail1 postfwd[666]: [STATS] Rule ID: R-003 matched: 3116 times
...
--no-rulestats
Disables per rule statistics. Keeps your log clean, if you do not use them.
This option has no effect without --summary or --verbose set.
-L, --stdoutlog
Redirects all syslog messages to stdout for debugging. Never use this with postfix!
-t, --test
In test mode postfwd always returns "dunno", but logs according
to it`s ruleset. -v will be set automatically with this option.
-n, --nodns
Disables all DNS based checks like RBL checks. Rules containing
such elements will be ignored.
-n, --nodnslog
Disables logging of dns events.
--dns_timeout (default: 14)
Sets the timeout for asynchonous dns queries in seconds. This value will apply to
all dns items in a rule.
--dns_timeout_max (default: 10)
Sets the maximum timeout counter for dnsbl lookups. If the timeouts exceed this value
the corresponding dnsbl will be deactivated for a while (see --dns_timeout_interval).
--dns_timeout_interval (default=1200)
The dnsbl timeout counter will be cleaned after this interval in seconds. Use this
in conjunction with the --dns_timeout_max parameter.
--dns_async_txt
Perform dnsbl A and TXT lookups simultaneously (otherwise only for listings with at
least one A record). This needs more network bandwidth due to increased queries but
might increase throughput because the lookups can be parallelized.
--dns_max_ns_lookups (default=0)
maximum ns names to lookup up with sender_ns_addrs item. use 0 for no maximum.
--dns_max_mx_lookups (default=0)
maximum mx names to lookup up with sender_mx_addrs item. use 0 for no maximum.
-I, --instantcfg
The config files, specified by -f will be re-read for every request
postfwd receives. This enables on-the-fly configuration changes
without restarting. Though files will be read only if necessary
(which means their access times changed since last read) this might
significantly increase system load.
--config_timeout (default=3)
timeout in seconds to parse a single configuration line. if exceeded, the rule will
be skipped. this is used to prevent problems due to large files or loops.
--keep_rates (default=0)
With this option set postfwd does not clear the rate limit counters on reload. Please
note that you have to restart (not reload) postfwd with this option if you change
any rate limit rules.
--save_rates (default=none)
With this option postfwd saves existing rate limit counters to disk and reloads them
on program start. This allows persistent rate limits across program restarts or reboots.
Please note that postfwd needs read and write access to the specified file.
--fast_limit_evaluation (default=0)
Once a ratelimit was set by the ruleset, future requests will be evaluated against it
before consulting the ruleset. This mode was the default behaviour until v1.30.
With this mode rate limits will be faster, but also eventually set up
whitelisting-rules within the ruleset might not work as expected.
LIMITATIONS: This option does not allow nested postfwd commands like
action=rate(sender/3/60/wait(3))
This option doe not work with the strict-rfc5321 rate() functions.
I<Informational arguments>
These arguments are for command line usage only. Never ever use them with postfix spawn!
-C, --showconfig
Displays the current ruleset. Use -v for verbose output.
-P, --perfmon
This option turns of any syslogging and output. It is included
for performance testing.
-V, --version
Displays the program version.
-h, --help
Shows program usage.
-m, --manual
Displays the program manual.
=head2 REFRESH
In daemon mode postfwd reloads it's ruleset after receiving a HUP signal. Please see the description of
the '-I' switch to have your configuration refreshed for every request postfwd receives.
=head2 EXAMPLES
## whitelisting
# 1. networks 192.168.1.0/24, 192.168.2.4
# 2. client_names *.gmx.net and *.gmx.de
# 3. sender *@someshop.tld from 11.22.33.44
id=WL001; action=dunno ; client_address=192.168.1.0/24, 192.168.2.4
id=WL002; action=dunno ; client_name=\.gmx\.(net|de)$
id=WL003; action=dunno ; sender=@someshop\.tld$ ; client_address=11.22.33.44
## TLS control
# 1. *@authority.tld only with correct TLS fingerprint
# 2. *@secret.tld only with keysizes >=64
id=TL001; action=dunno ; sender=@authority\.tld$ ; ccert_fingerprint=AA:BB:CC..
id=TL002; action=REJECT wrong TLS fingerprint ; sender=@authority\.tld$
id=TL003; action=REJECT tls keylength < 64 ; sender=@secret\.tld$ ; encryption_keysize=64
## Combined RBL checks
# This will reject mail if
# 1. listed on ix.dnsbl.manitu.net
# 2. listed on zen.spamhaus.org (sbl and xbl, dns cache timeout 1200s instead of 3600s)
# 3. listed on min 2 of bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
# 4. listed on bl.spamcop.net and one of rhsbl.ahbl.org, rhsbl.sorbs.net
id=RBL01 ; action=REJECT listed on ix.dnsbl.manitu.net ; rbl=ix.dnsbl.manitu.net
id=RBL02 ; action=REJECT listed on zen.spamhaus.org ; rbl=zen.spamhaus.org/127.0.0.[2-8]/1200
id=RBL03 ; action=REJECT listed on too many RBLs ; rblcount=2 ; rbl=bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
id=RBL04 ; action=REJECT combined RBL+RHSBL check ; rbl=bl.spamcop.net ; rhsbl=rhsbl.ahbl.org, rhsbl.sorbs.net
## Message size (requires message_size_limit to be set to 30000000)
# 1. 30MB for systems in *.customer1.tld
# 2. 20MB for SASL user joejob
# 3. 10MB default
id=SZ001; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\.customer1.tld$
id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=10000000
id=SZ100; protocol_state==END-OF-MESSAGE; action=REJECT message too large
## Selective Greylisting
##
## Note that postfwd does not include greylisting. This setup requires a running postgrey service
## at port 10031 and the following postfix restriction class in your main.cf:
##
## smtpd_restriction_classes = check_postgrey, ...
## check_postgrey = check_policy_service inet:127.0.0.1:10031
#
# 1. if listed on zen.spamhaus.org with results 127.0.0.10 or .11, dns cache timeout 1200s
# 2. Client has no rDNS
# 3. Client comes from several dialin domains
id=GR001; action=check_postgrey ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
id=GR002; action=check_postgrey ; client_name=^unknown$
id=GR003; action=check_postgrey ; client_name=\.(t-ipconnect|alicedsl|ish)\.de$
## Date Time
date=24.12.2007-26.12.2007 ; action=450 4.7.1 office closed during christmas
time=04:00:00-05:00:00 ; action=450 4.7.1 maintenance ongoing, try again later
time=-07:00:00 ; sasl_username=jim ; action=450 4.7.1 to early for you, jim
time=22:00:00- ; sasl_username=jim ; action=450 4.7.1 to late now, jim
months=-Apr ; action=450 4.7.1 see you in may
days=!!Mon-Fri ; action=check_postgrey
## Usage of jump
# The following allows a message size of 30MB for different
# users/clients while others will only have 10MB.
id=R001 ; action=jump(R100) ; sasl_username=^(Alice|Bob|Jane)$
id=R002 ; action=jump(R100) ; client_address=192.168.1.0/24
id=R003 ; action=jump(R100) ; ccert_fingerprint=AA:BB:CC:DD:...
id=R004 ; action=jump(R100) ; ccert_fingerprint=AF:BE:CD:DC:...
id=R005 ; action=jump(R100) ; ccert_fingerprint=DD:CC:BB:DD:...
id=R099 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
id=R100 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
## Usage of score
# The following rejects a mail, if the client
# - is listed on 1 RBL and 1 RHSBL
# - is listed in 1 RBL or 1 RHSBL and has no correct rDNS
# - other clients without correct rDNS will be greylist-checked
# - some whitelists are used to lower the score
id=S01 ; score=2.6 ; action=check_postgrey
id=S02 ; score=5.0 ; action=REJECT postfwd score too high
id=R00 ; action=score(-1.0) ; rbl=exemptions.ahbl.org,list.dnswl.org,query.bondedsender.org,spf.trusted-forwarder.org
id=R01 ; action=score(2.5) ; rbl=bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
id=R02 ; action=score(2.5) ; rhsbl=rhsbl.ahbl.org, rhsbl.sorbs.net
id=N01 ; action=score(-0.2) ; client_name==$$helo_name
id=N02 ; action=score(2.7) ; client_name=^unknown$
...
## Usage of rate and size
# The following temporary rejects requests from "unknown" clients, if they
# 1. exceeded 30 requests per hour or
# 2. tried to send more than 1.5mb within 10 minutes
id=RATE01 ; client_name==unknown ; protocol_state==RCPT
action=rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
id=SIZE01 ; client_name==unknown ; protocol_state==END-OF-MESSAGE
action=size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
## Macros
# definition
&&RBLS { rbl=zen.spamhaus.org,list.dsbl.org,bl.spamcop.net,dnsbl.sorbs.net,ix.dnsbl.manitu.net; };
&&GONOW { action=REJECT your request caused our spam detection policy to reject this message. More info at http://www.domain.local; };
# rules
&&GONOW ; &&RBLS ; client_name=^unknown$
&&GONOW ; &&RBLS ; client_name=(\d+[\.-_]){4}
&&GONOW ; &&RBLS ; client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
## Groups
# definition
&&RBLS{
rbl=zen.spamhaus.org
rbl=list.dsbl.org
rbl=bl.spamcop.net
rbl=dnsbl.sorbs.net
rbl=ix.dnsbl.manitu.net
};
&&RHSBLS{
...
};
&&DYNAMIC{
client_name==unknown
client_name~=(\d+[\.-_]){4}
client_name~=[\.-_](adsl|dynamic|ppp|)[\.-_]
...
};
&&BAD_HELO{
helo_name==my.name.tld
helo_name~=^([^\.]+)$
helo_name~=\.(local|lan)$
...
};
&&MAINTENANCE{
date=15.01.2007
date=15.04.2007
date=15.07.2007
date=15.10.2007
time=03:00:00 - 04:00:00
};
# rules
id=COMBINED ; &&RBLS ; &&DYNAMIC ; action=REJECT dynamic client and listed on RBL
id=MAINTENANCE ; &&MAINTENANCE ; action=DEFER maintenance time - please try again later
# now with the set() command, note that long item
# lists don't have to be compared twice
id=RBL01 ; &&RBLS ; action=set(HIT_rbls=1)
id=HELO01 ; &&BAD_HELO ; action=set(HIT_helo=1)
id=DYNA01 ; &&DYNAMIC ; action=set(HIT_dyna=1)
id=REJECT01 ; HIT_rbls==1 ; HIT_helo==1 ; action=REJECT please see http://some.org/info?reject=01 for more info
id=REJECT02 ; HIT_rbls==1 ; HIT_dyna==1 ; action=REJECT please see http://some.org/info?reject=02 for more info
id=REJECT03 ; HIT_helo==1 ; HIT_dyna==1 ; action=REJECT please see http://some.org/info?reject=03 for more info
## combined with enhanced rbl features
#
id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS
action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,HIT_dnstxt=$$dnsbltext)
id=RBL02 ; HIT_dnsbls>=2 ; action=554 5.7.1 blocked using $$HIT_dnsbls DNSBLs [INFO: $$HIT_dnstxt]
=head2 PARSER
I<Configuration>
The postfwd ruleset can be specified at the commandline (-r option) or be read from files (-f). The order of your arguments will be kept. You should
check the parser with the -C | --showconfig switch at the command line before applying a new config. The following call:
postfwd --showconfig \
-r "id=TEST; recipient_count=100; action=WARN mail with 100+ recipients" \
-f /etc/postfwd.cf \
-r "id=DEFAULT; action=dunno";
will produce the following output:
Rule 0: id->"TEST" action->"WARN mail with 100+ recipients"; recipient_count->"100"
...
... <content of /etc/postfwd.cf> ...
...
Rule <n>: id->"DEFAULT" action->"dunno"
Multiple items of the same type will be added to lists (see the L</ITEMS> section for more info):
postfwd --showconfig \
-r "client_address=192.168.1.0/24; client_address=172.16.26.32; action=dunno"
will result in:
Rule 0: id->"R-0"; action->"dunno"; client_address->"192.168.1.0/24, 172.16.26.32"
Macros are evaluated at configuration stage, which means that
postfwd --showconfig \
-r "&&RBLS { rbl=bl.spamcop.net; client_name=^unknown$; };" \
-r "id=RBL001; &&RBLS; action=REJECT listed on spamcop and bad rdns";
will result in:
Rule 0: id->"RBL001"; action->"REJECT listed on spamcop and bad rdns"; rbl->"bl.spamcop.net"; client_name->"^unknown$"
I<Request processing>
When a policy delegation request arrives it will be compared against postfwd`s ruleset. To inspect the processing in detail you should increase
verbority using use the "-v" or "-vv" switch. "-L" redirects log messages to stdout.
Keeping the order of the ruleset in general, items will be compared in random order, which basically means that
id=R001; action=dunno; client_address=192.168.1.1; sender=bob@alice.local
equals to
id=R001; sender=bob@alice.local; client_address=192.168.1.1; action=dunno
Lists will be evaluated in the specified order. This allows to place faster expressions at first:
postfwd -vv -L -r "id=RBL001; rbl=localrbl.local zen.spamhaus.org; action=REJECT" /some/where/request.sample
produces the following
[LOGS info]: compare rbl: "remotehost.remote.net[68.10.1.7]" -> "localrbl.local"
[LOGS info]: count1 rbl: "2" -> "0"
[LOGS info]: query rbl: localrbl.local 7.1.10.68 (7.1.10.68.localrbl.local)
[LOGS info]: count2 rbl: "2" -> "0"
[LOGS info]: match rbl: FALSE
[LOGS info]: compare rbl: "remotehost.remote.net[68.10.1.7]" -> "zen.spamhaus.org"
[LOGS info]: count1 rbl: "2" -> "0"
[LOGS info]: query rbl: zen.spamhaus.org 7.1.10.68 (7.1.10.68.zen.spamhaus.org)
[LOGS info]: count2 rbl: "2" -> "0"
[LOGS info]: match rbl: FALSE
[LOGS info]: Action: dunno
The negation operator !!(<value>) has the highest priority and therefore will be evaluated first. Then variable substitutions are performed:
postfwd -vv -L -r "id=TEST; action=REJECT; client_name=!!($$heloname)" /some/where/request.sample
will give
[LOGS info]: compare client_name: "unknown" -> "!!($$helo_name)"
[LOGS info]: negate client_name: "unknown" -> "$$helo_name"
[LOGS info]: substitute client_name: "unknown" -> "english-breakfast.cloud8.net"
[LOGS info]: match client_name: TRUE
[LOGS info]: Action: REJECT
I<Ruleset evaluation>
A rule hits when all items (or at least one element of a list for each item) have matched. As soon as one item (or all elements of a list) fails
to compare against the request attribute the parser will jump to the next rule in the postfwd ruleset.
If a rule matches, there are two options:
* Rule returns postfix action (dunno, reject, ...)
The parser stops rule processing and returns the action to postfix. Other rules will not be evaluated.
* Rule returns postfwd action (jump(), note(), ...)
The parser evaluates the given action and continues with the next rule (except for the jump() or quit() actions - please see the L</ACTIONS> section
for more information). Nothing will be sent to postfix.
If no rule has matched and the end of the ruleset is reached postfwd will return dunno without logging anything unless in verbose mode. You may
simply place a last `catch-all´ rule to change that behaviour:
... <your rules> ...
id=DEFAULT ; action=dunno
will log any request that passes the ruleset without having hit a prior rule.
=head2 INTEGRATION
I<Integration via daemon mode>
The common way to use postfwd is to start it as daemon, listening at a specified tcp port.
As postfwd will run in a single instance (multiplexing mode), it will take most benefit of
it`s internal caching in that case. Start postfwd with the following parameters:
postfwd -d -f /etc/postfwd.cf -i 127.0.0.1 -p 10040 -u nobody -g nobody -S
For efficient caching you should check if you can use the options --cache-rdomain-only, --cache-no-sender
and --cache-no-size.
Now check your syslogs (default facility "mail") for a line like:
Aug 9 23:00:24 mail postfwd[5158]: postfwd n.nn ready for input
and use `netstat -an|grep 10040` to check for something like
tcp 0 0 127.0.0.1:10040 0.0.0.0:* LISTEN
If everything works, open your postfix main.cf and insert the following
127.0.0.1:10040_time_limit = 3600 <--- integration
smtpd_recipient_restrictions = permit_mynetworks <--- recommended
reject_unauth_destination <--- recommended
check_policy_service inet:127.0.0.1:10040 <--- integration
Reload your configuration with `postfix reload` and watch your logs. In it works you should see
lines like the following in your mail log:
Aug 9 23:01:24 mail postfwd[5158]: rule=22, id=ML_POSTFIX, client=english-breakfast.cloud9.net[168.100.1.7], sender=owner-postfix-users@postfix.tld, recipient=someone@domain.local, helo=english-breakfast.cloud9.net, proto=ESMTP, state=RCPT, action=dunno
If you want to check for size or rcpt_count items you must integrate postfwd in smtp_data_restrictions or
smtpd_end_of_data_restrictions. Of course you can also specify a restriction class and use it in your access
tables. First create a file /etc/postfix/policy containing:
domain1.local postfwdcheck
domain2.local postfwdcheck
...
Then postmap that file (`postmap hash:/etc/postfix/policy`), open your main.cf and enter
# Restriction Classes
smtpd_restriction_classes = postfwdcheck, <some more>... <--- integration
postfwdcheck = check_policy_service inet:127.0.0.1:10040 <--- integration
127.0.0.1:10040_time_limit = 3600 <--- integration
smtpd_recipient_restrictions = permit_mynetworks, <--- recommended
reject_unauth_destination, <--- recommended
... <--- optional
check_recipient_access hash:/etc/postfix/policy, <--- integration
... <--- optional
Reload postfix and watch your logs.
I<Integration via xinetd>
There might be several reasons for you to use postfwd via a tcp wrapper package like xinetd (see L<http://www.xinetd.org/>).
I won`t discuss that here. If you plan to do so, just add the following line to your /etc/services file:
# postfwd port
postfwd 10040/tcp
Then create a file '/etc/xinetd.d/postfwd':
{
interface = 127.0.0.1
socket_type = stream
protocol = tcp
wait = no
user = nobody
server = /usr/local/bin/postfwd
server_args = -f /etc/postfwd.cf
disable = no
}
and restart the xinetd daemon (usually a SIGHUP should be fine). If you experience problems
you might want to check your system's log for xinetd errors like "socket already in use".
The integration with postfix is similar to the I<Integration via daemon mode> section above.
Reload postfix and watch your logs to see if everything works.
=head2 TESTING
First you have to create a ruleset (see Configuration section). Check it with
postfwd -f /etc/postfwd.cf -C
There is an example policy request distributed with postfwd, called 'request.sample'.
Simply change it to meet your requirements and use
postfwd -f /etc/postfwd.cf <request.sample
You should get an answer like
action=<whateveryouconfigured>
For network tests I use netcat:
nc 127.0.0.1 10040 <request.sample
to send a request to postfwd. If you receive nothing, make sure that postfwd is running and
listening on the specified network settings.
=head2 PERFORMANCE
Some of these proposals might not match your environment. Please check your requirements and test new options carefully!
- use caching options
- use the correct match operator ==, <=, >=
- use ^ and/or $ in regular expressions
- use item lists (faster than single rules)
- use set() action on repeated item lists
- use jumps and rate limits
- use a pre-lookup rule for rbl/rhsbls with empty note() action
=head2 SEE ALSO
See L<http://www.postfix.org/SMTPD_POLICY_README.html> for a description
of how Postfix policy servers work.
=head1 LICENSE
postfwd is free software and released under BSD license, which basically means
that you can do what you want as long as you keep the copyright notice:
Copyright (c) 2007, Jan Peter Kessler
All rights reserved.
Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in
the documentation and/or other materials provided with the
distribution.
* Neither the name of the authors nor the names of his contributors
may be used to endorse or promote products derived from this
software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY ME ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
=head1 AUTHOR
S<Jan Peter Kessler E<lt>info (AT) postfwd (DOT) orgE<gt>>. Let me know, if you have any suggestions.
=cut