1 /******************************************************************************/
2 /* pfixtools: a collection of postfix related tools */
4 /* ________________________________________________________________________ */
6 /* Redistribution and use in source and binary forms, with or without */
7 /* modification, are permitted provided that the following conditions */
10 /* 1. Redistributions of source code must retain the above copyright */
11 /* notice, this list of conditions and the following disclaimer. */
12 /* 2. Redistributions in binary form must reproduce the above copyright */
13 /* notice, this list of conditions and the following disclaimer in the */
14 /* documentation and/or other materials provided with the distribution. */
15 /* 3. The names of its contributors may not be used to endorse or promote */
16 /* products derived from this software without specific prior written */
19 /* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND */
20 /* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE */
21 /* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR */
22 /* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS */
23 /* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR */
24 /* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF */
25 /* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS */
26 /* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN */
27 /* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) */
28 /* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF */
29 /* THE POSSIBILITY OF SUCH DAMAGE. */
30 /******************************************************************************/
33 * Copyright © 2007 Pierre Habouzit
42 typedef struct greylist_config_t {
43 unsigned lookup_by_host : 1;
52 #define GREYLIST_INIT { .lookup_by_host = false, \
54 .retry_window = 2 * 24 * 2600, \
70 static bool greylist_initialize(greylist_config_t *config,
71 const char *directory, const char *prefix)
75 if (config->client_awl) {
76 snprintf(path, sizeof(path), "%s/%swhitelist.db", directory, prefix);
77 config->awl_db = tcbdbnew();
78 if (!tcbdbopen(config->awl_db, path, BDBOWRITER | BDBOCREAT)) {
79 tcbdbdel(config->awl_db);
80 config->awl_db = NULL;
85 snprintf(path, sizeof(path), "%s/%sgreylist.db", directory, prefix);
86 config->obj_db = tcbdbnew();
87 if (!tcbdbopen(config->obj_db, path, BDBOWRITER | BDBOCREAT)) {
88 tcbdbdel(config->obj_db);
89 config->obj_db = NULL;
91 tcbdbdel(config->awl_db);
92 config->awl_db = NULL;
100 static void greylist_shutdown(greylist_config_t *config)
102 if (config->awl_db) {
103 tcbdbsync(config->awl_db);
104 tcbdbdel(config->awl_db);
105 config->awl_db = NULL;
107 if (config->obj_db) {
108 tcbdbsync(config->obj_db);
109 tcbdbdel(config->obj_db);
110 config->obj_db = NULL;
114 static const char *sender_normalize(const char *sender, char *buf, int len)
116 const char *at = strchr(sender, '@');
117 int rpos = 0, wpos = 0, userlen;
122 /* strip extension used for VERP or alike */
123 userlen = ((char *)memchr(sender, '+', at - sender) ?: at) - sender;
125 while (rpos < userlen) {
128 while (isdigit(sender[rpos + count]) && rpos + count < userlen)
130 if (count && !isalnum(sender[rpos + count])) {
131 /* replace \<\d+\> with '#' */
132 wpos += m_strputc(buf + wpos, len - wpos, '#');
136 while (isalnum(sender[rpos + count]) && rpos + count < userlen)
138 while (!isalnum(sender[rpos + count]) && rpos + count < userlen)
140 wpos += m_strncpy(buf + wpos, len - wpos, sender + rpos, count);
144 wpos += m_strputc(buf + wpos, len - wpos, '#');
145 wpos += m_strcpy(buf + wpos, len - wpos, at + 1);
149 static const char *c_net(const greylist_config_t *config,
150 const char *c_addr, const char *c_name,
151 char *cnet, int cnetlen)
156 if (config->lookup_by_host)
159 if (!(dot = strchr(c_addr, '.')))
161 if (!(dot = strchr(dot + 1, '.')))
165 if (!(dot = strchr(dot, '.')) || dot - p > 3)
167 m_strncpy(ip2, sizeof(ip2), p, dot - p);
170 if (!(dot = strchr(dot, '.')) || dot - p > 3)
172 m_strncpy(ip3, sizeof(ip3), p, dot - p);
174 /* skip if contains the last two ip numbers in the hostname,
175 we assume it's a pool of dialup of a provider */
176 if (strstr(c_name, ip2) && strstr(c_name, ip3))
179 m_strncpy(cnet, cnetlen, c_addr, dot - c_addr);
183 static bool try_greylist(const greylist_config_t *config,
184 const char *sender, const char *c_addr,
185 const char *c_name, const char *rcpt)
190 tcbdbput(config->awl_db, c_addr, c_addrlen, &aent, \
193 char sbuf[BUFSIZ], cnet[64], key[BUFSIZ];
196 time_t now = time(NULL);
197 struct obj_entry oent = { now, now };
198 struct awl_entry aent = { 0, 0 };
200 int len, klen, c_addrlen = strlen(c_addr);
202 /* Auto whitelist clients.
204 if (config->client_awl) {
205 res = tcbdbget3(config->awl_db, c_addr, c_addrlen, &len);
206 if (res && len == sizeof(aent)) {
207 memcpy(&aent, res, len);
210 /* Whitelist if count is enough.
212 if (aent.count > config->client_awl) {
213 if (now < aent.last + 3600) {
225 klen = snprintf(key, sizeof(key), "%s/%s/%s",
226 c_net(config, c_addr, c_name, cnet, sizeof(cnet)),
227 sender_normalize(sender, sbuf, sizeof(sbuf)), rcpt);
228 klen = MIN(klen, ssizeof(key) - 1);
230 res = tcbdbget3(config->obj_db, key, klen, &len);
231 if (res && len == sizeof(oent)) {
232 memcpy(&oent, res, len);
235 /* Discard stored first-seen if it is the first retrial and
236 * it is beyong the retry window.
238 if (oent.last - oent.first < config->delay
239 && now - oent.first > config->retry_window) {
246 tcbdbput(config->obj_db, key, klen, &oent, sizeof(oent));
248 /* Auto whitelist clients:
250 * - on successful entry in the greylist db of a triplet:
251 * - client not whitelisted yet ? -> increase count
252 * -> withelist if count > limit
253 * - client whitelisted already ? -> update last-seen timestamp.
255 if (oent.first + config->delay < now) {
256 if (config->client_awl) {
271 /* postlicyd filter declaration */
275 static greylist_config_t *greylist_config_new(void)
277 const greylist_config_t g = GREYLIST_INIT;
278 greylist_config_t *config = p_new(greylist_config_t, 1);
283 static void greylist_config_delete(greylist_config_t **config)
286 greylist_shutdown(*config);
291 static bool greylist_filter_constructor(filter_t *filter)
293 const char* path = NULL;
294 const char* prefix = NULL;
295 greylist_config_t *config = greylist_config_new();
297 #define PARSE_CHECK(Expr, Str, ...) \
299 syslog(LOG_ERR, Str, ##__VA_ARGS__); \
300 greylist_config_delete(&config); \
304 foreach (filter_param_t *param, filter->params) {
305 switch (param->type) {
311 prefix = param->value;
314 case ATK_LOOKUP_BY_HOST:
315 config->lookup_by_host = (atoi(param->value) != 0);
318 case ATK_RETRY_WINDOW:
319 config->retry_window = atoi(param->value);
323 config->client_awl = atoi(param->value);
330 PARSE_CHECK(path, "path to greylist db not given");
331 PARSE_CHECK(greylist_initialize(config, path, prefix ? prefix : ""),
332 "can not load greylist database");
334 filter->data = config;
338 static void greylist_filter_destructor(filter_t *filter)
340 greylist_config_t *data = filter->data;
341 greylist_config_delete(&data);
345 static filter_result_t greylist_filter(const filter_t *filter,
346 const query_t *query)
348 const greylist_config_t *config = filter->data;
349 return try_greylist(config, query->sender, query->client_address,
350 query->client_name, query->recipient) ?
351 HTK_MATCH : HTK_FAIL;
354 static int greylist_init(void)
356 filter_type_t type = filter_register("greylist", greylist_filter_constructor,
357 greylist_filter_destructor,
361 (void)filter_hook_register(type, "error");
362 (void)filter_hook_register(type, "fail");
363 (void)filter_hook_register(type, "match");
367 (void)filter_param_register(type, "lookup_by_host");
368 (void)filter_param_register(type, "delay");
369 (void)filter_param_register(type, "retry_window");
370 (void)filter_param_register(type, "client_awl");
371 (void)filter_param_register(type, "path");
372 (void)filter_param_register(type, "prefix");
375 module_init(greylist_init)