time_t last;
};
+static inline bool greylist_check_awlentry(const greylist_config_t *config,
+ struct awl_entry *aent, time_t now)
+{
+ return !(config->max_age > 0 && now - aent->last > config->max_age);
+}
+
+static inline bool greylist_check_object(const greylist_config_t *config,
+ const struct obj_entry *oent, time_t now)
+{
+ return !((config->max_age > 0 && now - oent->last > config->max_age)
+ || (oent->last - oent->first < config->delay
+ && now - oent->last > config->retry_window));
+}
+
+typedef bool (*db_entry_checker_t)(const greylist_config_t *, const void *, time_t);
+
+static TCBDB *greylist_db_get(const greylist_config_t *config,
+ const char *path, bool cleanup,
+ size_t entry_len, db_entry_checker_t check)
+{
+ TCBDB *awl_db, *tmp_db;
+ time_t now = time(NULL);
+
+ /* Rebuild a new database after removing too old entries.
+ */
+ if (cleanup && config->max_age > 0) {
+ uint32_t old_count = 0;
+ uint32_t new_count = 0;
+ bool replace = false;
+ bool trashable = false;
+ char tmppath[PATH_MAX];
+ snprintf(tmppath, PATH_MAX, "%s.tmp", path);
+
+ info("database cleanup started");
+ awl_db = tcbdbnew();
+ if (tcbdbopen(awl_db, path, BDBOREADER)) {
+ tmp_db = tcbdbnew();
+ if (tcbdbopen(tmp_db, tmppath, BDBOWRITER | BDBOCREAT | BDBOTRUNC)) {
+ BDBCUR *cur = tcbdbcurnew(awl_db);
+ TCXSTR *key, *value;
+
+ key = tcxstrnew();
+ value = tcxstrnew();
+ if (tcbdbcurfirst(cur)) {
+ replace = true;
+ do {
+ tcxstrclear(key);
+ tcxstrclear(value);
+ (void)tcbdbcurrec(cur, key, value);
+
+ if ((size_t)tcxstrsize(value) == entry_len
+ && check(config, tcxstrptr(value), now)) {
+ tcbdbput(tmp_db, tcxstrptr(key), tcxstrsize(key),
+ tcxstrptr(value), entry_len);
+ ++new_count;
+ }
+ ++old_count;
+ } while (tcbdbcurnext(cur));
+ }
+ tcxstrdel(key);
+ tcxstrdel(value);
+ tcbdbcurdel(cur);
+ tcbdbsync(tmp_db);
+ } else {
+ warn("cannot run database cleanup: can't open destination database: %s",
+ tcbdberrmsg(tcbdbecode(awl_db)));
+ }
+ tcbdbdel(tmp_db);
+ } else {
+ int ecode = tcbdbecode(awl_db);
+ warn("can not open database: %s", tcbdberrmsg(ecode));
+ trashable = ecode != TCENOPERM && ecode != TCEOPEN && ecode != TCENOFILE && ecode != TCESUCCESS;
+ }
+ tcbdbdel(awl_db);
+
+ /** Cleanup successful, replace the old database with the new one.
+ */
+ if (trashable) {
+ info("database cleanup finished: database was corrupted, create a new one");
+ unlink(path);
+ } else if (replace) {
+ info("database cleanup finished: before %u entries, after %d entries",
+ old_count, new_count);
+ unlink(path);
+ if (rename(tmppath, path) != 0) {
+ UNIXERR("rename");
+ return NULL;
+ }
+ } else {
+ unlink(tmppath);
+ info("database cleanup finished: nothing to do, %u entries", new_count);
+ }
+ }
+
+ /* Effectively open the database.
+ */
+ awl_db = tcbdbnew();
+ if (!tcbdbopen(awl_db, path, BDBOWRITER | BDBOCREAT)) {
+ err("can not open database: %s", tcbdberrmsg(tcbdbecode(awl_db)));
+ tcbdbdel(awl_db);
+ return NULL;
+ }
+ return awl_db;
+}
+
static bool greylist_initialize(greylist_config_t *config,
const char *directory, const char *prefix)
if (config->client_awl) {
snprintf(path, sizeof(path), "%s/%swhitelist.db", directory, prefix);
- config->awl_db = tcbdbnew();
- if (!tcbdbopen(config->awl_db, path, BDBOWRITER | BDBOCREAT)) {
- tcbdbdel(config->awl_db);
- config->awl_db = NULL;
+ info("loading auto-whitelist database");
+ config->awl_db = greylist_db_get(config, path, true,
+ sizeof(struct awl_entry),
+ (db_entry_checker_t)(greylist_check_awlentry));
+ if (config->awl_db == NULL) {
return false;
}
}
snprintf(path, sizeof(path), "%s/%sgreylist.db", directory, prefix);
- config->obj_db = tcbdbnew();
- if (!tcbdbopen(config->obj_db, path, BDBOWRITER | BDBOCREAT)) {
- tcbdbdel(config->obj_db);
- config->obj_db = NULL;
+ info("loading greylist database");
+ config->obj_db = greylist_db_get(config, path, true,
+ sizeof(struct obj_entry),
+ (db_entry_checker_t)(greylist_check_object));
+ if (config->obj_db == NULL) {
if (config->awl_db) {
tcbdbdel(config->awl_db);
config->awl_db = NULL;
return cnet;
}
-static inline bool greylist_check_awlentry(const greylist_config_t *config,
- struct awl_entry *aent, time_t now)
-{
- return !(now - aent->last > config->max_age);
-}
-
-static inline bool greylist_check_object(const greylist_config_t *config,
- const struct obj_entry *oent, time_t now)
-{
- return !(now - oent->last > config->max_age
- || (oent->last - oent->first < config->delay
- && now - oent->last > config->retry_window));
-}
static bool try_greylist(const greylist_config_t *config,
const char *sender, const char *c_addr,
#define INCR_AWL \
aent.count++; \
aent.last = now; \
+ debug("whitelist entry for %.*s updated, count %d", \
+ c_addrlen, c_addr, aent.count); \
tcbdbput(config->awl_db, c_addr, c_addrlen, &aent, \
sizeof(aent));
res = tcbdbget3(config->awl_db, c_addr, c_addrlen, &len);
if (res && len == sizeof(aent)) {
memcpy(&aent, res, len);
+ debug("client %.*s has a whitelist entry, count is %d",
+ c_addrlen, c_addr, aent.count);
}
if (!greylist_check_awlentry(config, &aent, now)) {
aent.count = 0;
aent.last = 0;
+ debug("client %.*s whitelist entry too old",
+ c_addrlen, c_addr);
}
/* Whitelist if count is enough.
*/
if (aent.count >= config->client_awl) {
+ debug("client %.*s whitelisted", c_addrlen, c_addr);
if (now < aent.last + 3600) {
INCR_AWL
}
/* OK.
*/
- //syslog(LOG_INFO, "client whitelisted");
return true;
}
}
res = tcbdbget3(config->obj_db, key, klen, &len);
if (res && len == sizeof(oent)) {
memcpy(&oent, res, len);
- greylist_check_object(config, &oent, now);
+ debug("found a greylist entry for %.*s", klen, key);
}
/* Discard stored first-seen if it is the first retrial and
*/
if (!greylist_check_object(config, &oent, now)) {
oent.first = now;
+ debug("invalid retry for %.*s: %s", klen, key,
+ (config->max_age > 0 && now - oent.last > config->max_age) ?
+ "too old entry"
+ : (oent.last - oent.first < config->delay ?
+ "retry too early" : "retry too late" ));
}
/* Update.
* - client whitelisted already ? -> update last-seen timestamp.
*/
if (oent.first + config->delay < now) {
+ debug("valid retry for %.*s", klen, key);
if (config->client_awl) {
INCR_AWL
}
/* OK
*/
- //syslog(LOG_INFO, "client whitelisted");
return true;
}
/* DUNNO
*/
- //syslog(LOG_INFO, "client greylisted");
return false;
}
#define PARSE_CHECK(Expr, Str, ...) \
if (!(Expr)) { \
- syslog(LOG_ERR, Str, ##__VA_ARGS__); \
+ err(Str, ##__VA_ARGS__); \
greylist_config_delete(&config); \
return false; \
}
}
static filter_result_t greylist_filter(const filter_t *filter,
- const query_t *query)
+ const query_t *query,
+ filter_context_t *context)
{
const greylist_config_t *config = filter->data;
if (query->state != SMTP_RCPT) {
- syslog(LOG_WARNING, "greylisting only works as smtpd_recipient_restrictions");
+ warn("greylisting only works as smtpd_recipient_restrictions");
return HTK_ABORT;
}
{
filter_type_t type = filter_register("greylist", greylist_filter_constructor,
greylist_filter_destructor,
- greylist_filter);
+ greylist_filter, NULL, NULL);
/* Hooks.
*/
(void)filter_hook_register(type, "abort");