Mercurial > dnsbl

comparison src/dnsbl.cpp @ 192:8f4a9a37d4d9

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
delay autowhitelisting to avoid out of office reply bots
author carl
date Sun, 11 Nov 2007 12:49:25 -0800
parents 2a67d31099c3
children 3ea79ef741a0
comparison
equal deleted inserted replaced
191:2a67d31099c3 192:8f4a9a37d4d9
3 Copyright (c) 2007 Carl Byington - 510 Software Group, released under 3 Copyright (c) 2007 Carl Byington - 510 Software Group, released under
4 the GPL version 3 or any later version at your choice available at 4 the GPL version 3 or any later version at your choice available at
5 http://www.gnu.org/licenses/gpl-3.0.txt 5 http://www.gnu.org/licenses/gpl-3.0.txt
6 6
7 Based on a sample milter Copyright (c) 2000-2003 Sendmail, Inc. and its 7 Based on a sample milter Copyright (c) 2000-2003 Sendmail, Inc. and its
8 suppliers. Inspired by the DCC by Rhyolite Software 8 suppliers. Inspired by the DCC by Rhyolite Software
9 9
10 -b port The port used to talk to the dcc interface daemon 10 -b port The port used to talk to the dcc interface daemon
11 -r port The port used to talk to our internal dns resolver processes 11 -r port The port used to talk to our internal dns resolver processes
12 -p port The port through which the MTA will connect to this milter. 12 -p port The port through which the MTA will connect to this milter.
13 -t sec The timeout value. 13 -t sec The timeout value.
14 -c Check the config, and print a copy to stdout. Don't start the 14 -c Check the config, and print a copy to stdout. Don't start the
15 milter or do anything with the socket. 15 milter or do anything with the socket.
16 -s Stress test by loading and deleting the current config in a loop. 16 -s Stress test by loading and deleting the current config in a loop.
17 -d level set the debug level 17 -d level set the debug level
18 -e f|t Print the results of looking up from address f and to address 18 -e f|t Print the results of looking up from address f and to address
19 t in the current config 19 t in the current config
20 20
21 */ 21 */
22 22
23 23
24 // from sendmail sample 24 // from sendmail sample
53 53
54 // misc stuff needed here 54 // misc stuff needed here
55 #include <ctype.h> 55 #include <ctype.h>
56 #include <syslog.h> 56 #include <syslog.h>
57 #include <pwd.h> 57 #include <pwd.h>
58 #include <sys/wait.h> /* header for waitpid() and various macros */ 58 #include <sys/wait.h> /* header for waitpid() and various macros */
59 #include <signal.h> /* header for signal functions */ 59 #include <signal.h> /* header for signal functions */
60 60
61 #include "includes.h" 61 #include "includes.h"
62 62
63 static char* dnsbl_version="$Id$"; 63 static char* dnsbl_version="$Id$";
64 64
65 extern "C" { 65 extern "C" {
66 sfsistat mlfi_connect(SMFICTX *ctx, char *hostname, _SOCK_ADDR *hostaddr); 66 sfsistat mlfi_connect(SMFICTX *ctx, char *hostname, _SOCK_ADDR *hostaddr);
67 sfsistat mlfi_helo(SMFICTX * ctx, char *helohost); 67 sfsistat mlfi_helo(SMFICTX * ctx, char *helohost);
68 sfsistat mlfi_envfrom(SMFICTX *ctx, char **argv); 68 sfsistat mlfi_envfrom(SMFICTX *ctx, char **argv);
69 sfsistat mlfi_envrcpt(SMFICTX *ctx, char **argv); 69 sfsistat mlfi_envrcpt(SMFICTX *ctx, char **argv);
70 sfsistat mlfi_header(SMFICTX* ctx, char* headerf, char* headerv); 70 sfsistat mlfi_header(SMFICTX* ctx, char* headerf, char* headerv);
71 sfsistat mlfi_body(SMFICTX *ctx, u_char *data, size_t len); 71 sfsistat mlfi_body(SMFICTX *ctx, u_char *data, size_t len);
72 sfsistat mlfi_eom(SMFICTX *ctx); 72 sfsistat mlfi_eom(SMFICTX *ctx);
73 sfsistat mlfi_abort(SMFICTX *ctx); 73 sfsistat mlfi_abort(SMFICTX *ctx);
74 sfsistat mlfi_close(SMFICTX *ctx); 74 sfsistat mlfi_close(SMFICTX *ctx);
75 void sig_chld(int signo); 75 void sig_chld(int signo);
76 } 76 }
77 77
78 int debug_syslog = 0; 78 int debug_syslog = 0;
79 bool syslog_opened = false; 79 bool syslog_opened = false;
80 bool use_syslog = true; // false to printf 80 bool use_syslog = true; // false to printf
81 bool loader_run = true; // used to stop the config loader thread 81 bool loader_run = true; // used to stop the config loader thread
82 CONFIG *config = NULL; // protected by the config_mutex 82 CONFIG *config = NULL; // protected by the config_mutex
83 int generation = 0; // protected by the config_mutex 83 int generation = 0; // protected by the config_mutex
84 const int maxlen = 1000; // used for snprintf buffers 84 const int maxlen = 1000; // used for snprintf buffers
85 85
86 pthread_mutex_t config_mutex; 86 pthread_mutex_t config_mutex;
87 pthread_mutex_t syslog_mutex; 87 pthread_mutex_t syslog_mutex;
88 pthread_mutex_t resolve_mutex; 88 pthread_mutex_t resolve_mutex;
89 pthread_mutex_t fd_pool_mutex; 89 pthread_mutex_t fd_pool_mutex;
90 pthread_mutex_t rate_mutex; 90 pthread_mutex_t rate_mutex;
91 91
92 std::set<int> fd_pool; 92 std::set<int> fd_pool;
93 int NULL_SOCKET = -1; 93 int NULL_SOCKET = -1;
94 const time_t ERROR_SOCKET_TIME = 60; // number of seconds between attempts to open a socket to the dns resolver process 94 const time_t ERROR_SOCKET_TIME = 60; // number of seconds between attempts to open a socket to the dns resolver process
95 char *resolver_port = NULL; // unix domain socket to talk to the dns resolver process 95 char *resolver_port = NULL; // unix domain socket to talk to the dns resolver process
96 int resolver_socket = NULL_SOCKET; // socket used to listen for resolver requests 96 int resolver_socket = NULL_SOCKET; // socket used to listen for resolver requests
97 char *dccifd_port = NULL; // unix domain socket to talk to the dcc interface daemon 97 char *dccifd_port = NULL; // unix domain socket to talk to the dcc interface daemon
98 time_t last_error_time; 98 time_t last_error_time;
99 int resolver_sock_count = 0; // protected with fd_pool_mutex 99 int resolver_sock_count = 0; // protected with fd_pool_mutex
100 int resolver_pool_size = 0; // protected with fd_pool_mutex 100 int resolver_pool_size = 0; // protected with fd_pool_mutex
101 rcpt_rates rcpt_counts; // protected with rate_mutex 101 rcpt_rates rcpt_counts; // protected with rate_mutex
102 102
103 103
104 struct ns_map { 104 struct ns_map {
105 // all the strings are owned by the keys/values in the ns_host string map 105 // all the strings are owned by the keys/values in the ns_host string map
106 string_map ns_host; // nameserver name -> host name that uses this name server 106 string_map ns_host; // nameserver name -> host name that uses this name server
107 ns_mapper ns_ip; // nameserver name -> ip address of the name server 107 ns_mapper ns_ip; // nameserver name -> ip address of the name server
108 ~ns_map(); 108 ~ns_map();
109 void add(char *name, char *refer); 109 void add(char *name, char *refer);
110 }; 110 };
111 111
112 112
113 ns_map::~ns_map() { 113 ns_map::~ns_map() {
114 for (string_map::iterator i=ns_host.begin(); i!=ns_host.end(); i++) { 114 for (string_map::iterator i=ns_host.begin(); i!=ns_host.end(); i++) {
115 char *x = (*i).first; 115 char *x = (*i).first;
116 char *y = (*i).second; 116 char *y = (*i).second;
117 free(x); 117 free(x);
118 free(y); 118 free(y);
119 } 119 }
120 ns_ip.clear(); 120 ns_ip.clear();
121 ns_host.clear(); 121 ns_host.clear();
122 } 122 }
123 123
124 124
125 void ns_map::add(char *name, char *refer) { 125 void ns_map::add(char *name, char *refer) {
126 string_map::iterator i = ns_host.find(name); 126 string_map::iterator i = ns_host.find(name);
127 if (i != ns_host.end()) return; 127 if (i != ns_host.end()) return;
128 char *x = strdup(name); 128 char *x = strdup(name);
129 char *y = strdup(refer); 129 char *y = strdup(refer);
130 ns_ip[x] = 0; 130 ns_ip[x] = 0;
131 ns_host[x] = y; 131 ns_host[x] = y;
132 132
133 } 133 }
134 134
135 // packed structure to allow a single socket write to dump the 135 // packed structure to allow a single socket write to dump the
136 // length and the following answer. The packing attribute is gcc specific. 136 // length and the following answer. The packing attribute is gcc specific.
137 struct glommer { 137 struct glommer {
138 int length; 138 int length;
139 #ifdef NS_PACKETSZ 139 #ifdef NS_PACKETSZ
140 u_char answer[NS_PACKETSZ*4]; // with a resolver, we return resolver answers 140 u_char answer[NS_PACKETSZ*4]; // with a resolver, we return resolver answers
141 #else 141 #else
142 int answer; // without a resolver, we return a single ip4 address, 0 == no answer 142 int answer; // without a resolver, we return a single ip4 address, 0 == no answer
143 #endif 143 #endif
144 } __attribute__ ((packed)); 144 } __attribute__ ((packed));
145 145
146 146
147 //////////////////////////////////////////////// 147 ////////////////////////////////////////////////
148 // helper to manipulate recipient counts 148 // helper to manipulate recipient counts
149 // 149 //
150 int incr_rcpt_count(char *user); 150 int incr_rcpt_count(char *user);
151 int incr_rcpt_count(char *user) { 151 int incr_rcpt_count(char *user) {
152 pthread_mutex_lock(&rate_mutex); 152 pthread_mutex_lock(&rate_mutex);
153 rcpt_rates::iterator i = rcpt_counts.find(user); 153 rcpt_rates::iterator i = rcpt_counts.find(user);
154 int c = 1; 154 int c = 1;
155 if (i == rcpt_counts.end()) { 155 if (i == rcpt_counts.end()) {
156 user = strdup(user); 156 user = strdup(user);
157 rcpt_counts[user] = c; 157 rcpt_counts[user] = c;
158 } 158 }
159 else { 159 else {
160 c = ++((*i).second); 160 c = ++((*i).second);
161 } 161 }
162 pthread_mutex_unlock(&rate_mutex); 162 pthread_mutex_unlock(&rate_mutex);
163 return c; 163 return c;
164 } 164 }
165 165
166 //////////////////////////////////////////////// 166 ////////////////////////////////////////////////
167 // helper to discard the strings held by a context_map 167 // helper to discard the strings held by a context_map
168 // 168 //
169 void discard(context_map &cm); 169 void discard(context_map &cm);
170 void discard(context_map &cm) { 170 void discard(context_map &cm) {
171 for (context_map::iterator i=cm.begin(); i!=cm.end(); i++) { 171 for (context_map::iterator i=cm.begin(); i!=cm.end(); i++) {
172 char *x = (*i).first; 172 char *x = (*i).first;
173 free(x); 173 free(x);
174 } 174 }
175 cm.clear(); 175 cm.clear();
176 } 176 }
177 177
178 178
179 //////////////////////////////////////////////// 179 ////////////////////////////////////////////////
180 // helper to register a string in a context_map 180 // helper to register a string in a context_map
181 // 181 //
182 void register_string(context_map &cm, char *name, CONTEXT *con); 182 void register_string(context_map &cm, char *name, CONTEXT *con);
183 void register_string(context_map &cm, char *name, CONTEXT *con) { 183 void register_string(context_map &cm, char *name, CONTEXT *con) {
184 context_map::iterator i = cm.find(name); 184 context_map::iterator i = cm.find(name);
185 if (i != cm.end()) return; 185 if (i != cm.end()) return;
186 char *x = strdup(name); 186 char *x = strdup(name);
187 cm[x] = con; 187 cm[x] = con;
188 } 188 }
189 189
190 190
191 //////////////////////////////////////////////// 191 ////////////////////////////////////////////////
192 // disconnect the fd from the dns resolver process 192 // disconnect the fd from the dns resolver process
193 // 193 //
194 void my_disconnect(int sock, bool decrement = true); 194 void my_disconnect(int sock, bool decrement = true);
195 void my_disconnect(int sock, bool decrement) { 195 void my_disconnect(int sock, bool decrement) {
196 if (sock != NULL_SOCKET) { 196 if (sock != NULL_SOCKET) {
197 if (decrement) { 197 if (decrement) {
198 pthread_mutex_lock(&fd_pool_mutex); 198 pthread_mutex_lock(&fd_pool_mutex);
199 resolver_sock_count--; 199 resolver_sock_count--;
200 pthread_mutex_unlock(&fd_pool_mutex); 200 pthread_mutex_unlock(&fd_pool_mutex);
201 } 201 }
202 shutdown(sock, SHUT_RDWR); 202 shutdown(sock, SHUT_RDWR);
203 close(sock); 203 close(sock);
204 } 204 }
205 } 205 }
206 206
207 207
208 //////////////////////////////////////////////// 208 ////////////////////////////////////////////////
209 // return fd connected to the dns resolver process 209 // return fd connected to the dns resolver process
210 // 210 //
211 int my_connect(); 211 int my_connect();
212 int my_connect() { 212 int my_connect() {
213 // if we have had recent errors, don't even try to open the socket 213 // if we have had recent errors, don't even try to open the socket
214 if ((time(NULL) - last_error_time) < ERROR_SOCKET_TIME) return NULL_SOCKET; 214 if ((time(NULL) - last_error_time) < ERROR_SOCKET_TIME) return NULL_SOCKET;
215 215
216 // nothing recent, maybe this time it will work 216 // nothing recent, maybe this time it will work
217 int sock = NULL_SOCKET; 217 int sock = NULL_SOCKET;
218 sockaddr_un server; 218 sockaddr_un server;
219 memset(&server, '\0', sizeof(server)); 219 memset(&server, '\0', sizeof(server));
220 server.sun_family = AF_UNIX; 220 server.sun_family = AF_UNIX;
221 strncpy(server.sun_path, resolver_port, sizeof(server.sun_path)-1); 221 strncpy(server.sun_path, resolver_port, sizeof(server.sun_path)-1);
222 sock = socket(AF_UNIX, SOCK_STREAM, 0); 222 sock = socket(AF_UNIX, SOCK_STREAM, 0);
223 if (sock != NULL_SOCKET) { 223 if (sock != NULL_SOCKET) {
224 bool rc = (connect(sock, (sockaddr *)&server, sizeof(server)) == 0); 224 bool rc = (connect(sock, (sockaddr *)&server, sizeof(server)) == 0);
225 if (!rc) { 225 if (!rc) {
226 my_disconnect(sock, false); 226 my_disconnect(sock, false);
227 sock = NULL_SOCKET; 227 sock = NULL_SOCKET;
228 last_error_time = time(NULL); 228 last_error_time = time(NULL);
229 } 229 }
230 } 230 }
231 else last_error_time = time(NULL); 231 else last_error_time = time(NULL);
232 if (sock != NULL_SOCKET) { 232 if (sock != NULL_SOCKET) {
233 pthread_mutex_lock(&fd_pool_mutex); 233 pthread_mutex_lock(&fd_pool_mutex);
234 resolver_sock_count++; 234 resolver_sock_count++;
235 pthread_mutex_unlock(&fd_pool_mutex); 235 pthread_mutex_unlock(&fd_pool_mutex);
236 } 236 }
237 return sock; 237 return sock;
238 } 238 }
239 239
240 240
241 mlfiPriv::mlfiPriv() { 241 mlfiPriv::mlfiPriv() {
242 pthread_mutex_lock(&config_mutex); 242 pthread_mutex_lock(&config_mutex);
243 pc = config; 243 pc = config;
244 pc->reference_count++; 244 pc->reference_count++;
245 pthread_mutex_unlock(&config_mutex); 245 pthread_mutex_unlock(&config_mutex);
246 get_fd(); 246 get_fd();
247 ctx = NULL; 247 ctx = NULL;
248 eom = false; 248 eom = false;
249 ip = 0; 249 ip = 0;
250 helo = NULL; 250 helo = NULL;
251 mailaddr = NULL; 251 mailaddr = NULL;
252 queueid = NULL; 252 queueid = NULL;
253 authenticated = NULL; 253 authenticated = NULL;
254 client_name = NULL; 254 client_name = NULL;
255 have_whites = false; 255 have_whites = false;
256 only_whites = true; 256 only_whites = true;
257 want_spamassassin = false; 257 want_spamassassin = false;
258 want_dccgrey = false; 258 want_dccgrey = false;
259 want_dccbulk = false; 259 want_dccbulk = false;
260 content_context = NULL; 260 is_bulk_precedence = false;
261 memory = NULL; 261 content_context = NULL;
262 scanner = NULL; 262 memory = NULL;
263 content_suffix = NULL; 263 scanner = NULL;
264 content_message = NULL; 264 content_suffix = NULL;
265 uribl_suffix = NULL; 265 content_message = NULL;
266 uribl_message = NULL; 266 uribl_suffix = NULL;
267 content_host_ignore = NULL; 267 uribl_message = NULL;
268 assassin = NULL; 268 content_host_ignore = NULL;
269 dccifd = NULL; 269 assassin = NULL;
270 dccifd = NULL;
270 } 271 }
271 272
272 mlfiPriv::~mlfiPriv() { 273 mlfiPriv::~mlfiPriv() {
273 return_fd(); 274 return_fd();
274 pthread_mutex_lock(&config_mutex); 275 pthread_mutex_lock(&config_mutex);
275 pc->reference_count--; 276 pc->reference_count--;
276 bool last = (!pc->reference_count) && (pc != config); 277 bool last = (!pc->reference_count) && (pc != config);
277 pthread_mutex_unlock(&config_mutex); 278 pthread_mutex_unlock(&config_mutex);
278 if (last) delete pc; // free this config, since we were the last reference to it 279 if (last) delete pc; // free this config, since we were the last reference to it
279 if (helo) free(helo); 280 if (helo) free(helo);
280 reset(true); 281 reset(true);
281 } 282 }
282 283
283 void mlfiPriv::reset(bool final) { 284 void mlfiPriv::reset(bool final) {
284 if (mailaddr) free(mailaddr); 285 if (mailaddr) free(mailaddr);
285 if (queueid) free(queueid); 286 if (queueid) free(queueid);
286 if (authenticated) free(authenticated); 287 if (authenticated) free(authenticated);
287 if (client_name) free(client_name); 288 if (client_name) free(client_name);
288 discard(env_to); 289 delayer.clear();
289 if (memory) delete memory; 290 discard(env_to);
290 if (scanner) delete scanner; 291 if (memory) delete memory;
291 if (assassin) delete assassin; 292 if (scanner) delete scanner;
292 if (dccifd) delete dccifd; 293 if (assassin) delete assassin;
293 if (!final) { 294 if (dccifd) delete dccifd;
295 if (!final) {
294 ctx = NULL; 296 ctx = NULL;
295 eom = false; 297 eom = false;
296 mailaddr = NULL; 298 mailaddr = NULL;
297 queueid = NULL; 299 queueid = NULL;
298 authenticated = NULL; 300 authenticated = NULL;
299 client_name = NULL; 301 client_name = NULL;
300 have_whites = false; 302 have_whites = false;
301 only_whites = true; 303 only_whites = true;
302 want_spamassassin = false; 304 want_spamassassin = false;
303 want_dccgrey = false; 305 want_dccgrey = false;
304 want_dccbulk = false; 306 want_dccbulk = false;
305 content_context = NULL; 307 is_bulk_precedence = false;
306 memory = NULL; 308 content_context = NULL;
307 scanner = NULL; 309 memory = NULL;
308 content_suffix = NULL; 310 scanner = NULL;
309 content_message = NULL; 311 content_suffix = NULL;
310 uribl_suffix = NULL; 312 content_message = NULL;
311 uribl_message = NULL; 313 uribl_suffix = NULL;
312 content_host_ignore = NULL; 314 uribl_message = NULL;
313 assassin = NULL; 315 content_host_ignore = NULL;
314 dccifd = NULL; 316 assassin = NULL;
315 } 317 dccifd = NULL;
318 }
316 } 319 }
317 320
318 void mlfiPriv::get_fd() { 321 void mlfiPriv::get_fd() {
319 err = true; 322 err = true;
320 fd = NULL_SOCKET; 323 fd = NULL_SOCKET;
321 int result = pthread_mutex_lock(&fd_pool_mutex); 324 int result = pthread_mutex_lock(&fd_pool_mutex);
322 if (!result) { 325 if (!result) {
323 std::set<int>::iterator i; 326 std::set<int>::iterator i;
324 i = fd_pool.begin(); 327 i = fd_pool.begin();
325 if (i != fd_pool.end()) { 328 if (i != fd_pool.end()) {
326 // have at least one fd in the pool 329 // have at least one fd in the pool
327 err = false; 330 err = false;
328 fd = *i; 331 fd = *i;
329 fd_pool.erase(fd); 332 fd_pool.erase(fd);
330 resolver_pool_size--; 333 resolver_pool_size--;
331 pthread_mutex_unlock(&fd_pool_mutex); 334 pthread_mutex_unlock(&fd_pool_mutex);
332 } 335 }
333 else { 336 else {
334 // pool is empty, get a new fd 337 // pool is empty, get a new fd
335 pthread_mutex_unlock(&fd_pool_mutex); 338 pthread_mutex_unlock(&fd_pool_mutex);
336 fd = my_connect(); 339 fd = my_connect();
337 err = (fd == NULL_SOCKET); 340 err = (fd == NULL_SOCKET);
338 } 341 }
339 } 342 }
340 else { 343 else {
341 // cannot lock the pool, just get a new fd 344 // cannot lock the pool, just get a new fd
342 fd = my_connect(); 345 fd = my_connect();
343 err = (fd == NULL_SOCKET); 346 err = (fd == NULL_SOCKET);
344 } 347 }
345 } 348 }
346 349
347 void mlfiPriv::return_fd() { 350 void mlfiPriv::return_fd() {
348 if (err) { 351 if (err) {
349 // this fd got a socket error, so close it, rather than returning it to the pool 352 // this fd got a socket error, so close it, rather than returning it to the pool
350 my_disconnect(fd); 353 my_disconnect(fd);
351 } 354 }
352 else { 355 else {
353 int result = pthread_mutex_lock(&fd_pool_mutex); 356 int result = pthread_mutex_lock(&fd_pool_mutex);
354 if (!result) { 357 if (!result) {
355 if ((resolver_sock_count > resolver_pool_size*5) || (resolver_pool_size < 5)) { 358 if ((resolver_sock_count > resolver_pool_size*5) || (resolver_pool_size < 5)) {
356 // return the fd to the pool 359 // return the fd to the pool
357 fd_pool.insert(fd); 360 fd_pool.insert(fd);
358 resolver_pool_size++; 361 resolver_pool_size++;
359 pthread_mutex_unlock(&fd_pool_mutex); 362 pthread_mutex_unlock(&fd_pool_mutex);
360 } 363 }
361 else { 364 else {
362 // more than 20% of the open resolver sockets are in the pool, and the 365 // more than 20% of the open resolver sockets are in the pool, and the
363 // pool as at least 5 sockets. that is enough, so just close this one. 366 // pool as at least 5 sockets. that is enough, so just close this one.
364 pthread_mutex_unlock(&fd_pool_mutex); 367 pthread_mutex_unlock(&fd_pool_mutex);
365 my_disconnect(fd); 368 my_disconnect(fd);
366 } 369 }
367 } 370 }
368 else { 371 else {
369 // could not lock the pool, so just close the fd 372 // could not lock the pool, so just close the fd
370 my_disconnect(fd); 373 my_disconnect(fd);
371 } 374 }
372 } 375 }
373 } 376 }
374 377
375 size_t mlfiPriv::my_write(const char *buf, size_t len) { 378 size_t mlfiPriv::my_write(const char *buf, size_t len) {
376 if (err) return 0; 379 if (err) return 0;
377 size_t rs = 0; 380 size_t rs = 0;
378 while (len) { 381 while (len) {
379 size_t ws = write(fd, buf, len); 382 size_t ws = write(fd, buf, len);
380 if (ws > 0) { 383 if (ws > 0) {
381 rs += ws; 384 rs += ws;
382 len -= ws; 385 len -= ws;
383 buf += ws; 386 buf += ws;
384 } 387 }
385 else { 388 else {
386 // peer closed the socket! 389 // peer closed the socket!
387 rs = 0; 390 rs = 0;
388 err = true; 391 err = true;
389 break; 392 break;
390 } 393 }
391 } 394 }
392 return rs; 395 return rs;
393 } 396 }
394 397
395 size_t mlfiPriv::my_read(char *buf, size_t len) { 398 size_t mlfiPriv::my_read(char *buf, size_t len) {
396 if (err) return 0; 399 if (err) return 0;
397 size_t rs = 0; 400 size_t rs = 0;
398 while (len) { 401 while (len) {
399 size_t ws = read(fd, buf, len); 402 size_t ws = read(fd, buf, len);
400 if (ws > 0) { 403 if (ws > 0) {
401 rs += ws; 404 rs += ws;
402 len -= ws; 405 len -= ws;
403 buf += ws; 406 buf += ws;
404 } 407 }
405 else { 408 else {
406 // peer closed the socket! 409 // peer closed the socket!
407 rs = 0; 410 rs = 0;
408 err = true; 411 err = true;
409 break; 412 break;
410 } 413 }
411 } 414 }
412 return rs; 415 return rs;
413 } 416 }
414 417
415 void mlfiPriv::need_content_filter(char *rcpt, CONTEXT &con) { 418 void mlfiPriv::need_content_filter(char *rcpt, CONTEXT &con) {
416 register_string(env_to, rcpt, &con); 419 register_string(env_to, rcpt, &con);
417 if (!memory) { 420 if (!memory) {
418 // first recipient that needs content filtering sets 421 // first recipient that needs content filtering sets
419 // some of the content filtering parameters 422 // some of the content filtering parameters
420 memory = new recorder(this, con.get_html_tags(), con.get_content_tlds(), con.get_content_cctlds()); 423 memory = new recorder(this, con.get_html_tags(), con.get_content_tlds(), con.get_content_cctlds());
421 scanner = new url_scanner(memory); 424 scanner = new url_scanner(memory);
422 content_suffix = con.get_content_suffix(); 425 content_suffix = con.get_content_suffix();
423 content_message = con.get_content_message(); 426 content_message = con.get_content_message();
424 uribl_suffix = con.get_uribl_suffix(); 427 uribl_suffix = con.get_uribl_suffix();
425 uribl_message = con.get_uribl_message(); 428 uribl_message = con.get_uribl_message();
426 content_host_ignore = &con.get_content_host_ignore(); 429 content_host_ignore = &con.get_content_host_ignore();
427 } 430 }
428 } 431 }
429 432
430 433
431 mlfiPriv* fetch_priv_from_ctx(SMFICTX *ctx); 434 mlfiPriv* fetch_priv_from_ctx(SMFICTX *ctx);
432 mlfiPriv* fetch_priv_from_ctx(SMFICTX *ctx) 435 mlfiPriv* fetch_priv_from_ctx(SMFICTX *ctx)
441 444
442 //////////////////////////////////////////////// 445 ////////////////////////////////////////////////
443 // syslog a message 446 // syslog a message
444 // 447 //
445 void my_syslog(mlfiPriv *priv, char *text) { 448 void my_syslog(mlfiPriv *priv, char *text) {
446 char buf[maxlen]; 449 char buf[maxlen];
447 if (priv) { 450 if (priv) {
448 snprintf(buf, sizeof(buf), "%s: %s", priv->queueid, text); 451 snprintf(buf, sizeof(buf), "%s: %s", priv->queueid, text);
449 text = buf; 452 text = buf;
450 } 453 }
451 if (use_syslog) { 454 if (use_syslog) {
452 pthread_mutex_lock(&syslog_mutex); 455 pthread_mutex_lock(&syslog_mutex);
453 if (!syslog_opened) { 456 if (!syslog_opened) {
454 openlog("dnsbl", LOG_PID, LOG_MAIL); 457 openlog("dnsbl", LOG_PID, LOG_MAIL);
455 syslog_opened = true; 458 syslog_opened = true;
456 } 459 }
457 syslog(LOG_NOTICE, "%s", text); 460 syslog(LOG_NOTICE, "%s", text);
458 pthread_mutex_unlock(&syslog_mutex); 461 pthread_mutex_unlock(&syslog_mutex);
459 } 462 }
460 else { 463 else {
461 printf("%s \n", text); 464 printf("%s \n", text);
462 } 465 }
463 } 466 }
464 467
465 void my_syslog(mlfiPriv *priv, string text) { 468 void my_syslog(mlfiPriv *priv, string text) {
466 if (debug_syslog > 3) { 469 if (debug_syslog > 3) {
467 char buf[maxlen]; 470 char buf[maxlen];
468 strncpy(buf, text.c_str(), sizeof(buf)); 471 strncpy(buf, text.c_str(), sizeof(buf));
469 buf[maxlen-1] = '\0'; // ensure null termination 472 buf[maxlen-1] = '\0'; // ensure null termination
470 my_syslog(priv, buf); 473 my_syslog(priv, buf);
471 } 474 }
472 } 475 }
473 476
474 void my_syslog(char *text) { 477 void my_syslog(char *text) {
475 my_syslog(NULL, text); 478 my_syslog(NULL, text);
476 } 479 }
477 480
478 481
479 //////////////////////////////////////////////// 482 ////////////////////////////////////////////////
480 // read a resolver request from the socket, process it, and 483 // read a resolver request from the socket, process it, and
481 // write the result back to the socket. 484 // write the result back to the socket.
482 485
483 void process_resolver_requests(int socket); 486 void process_resolver_requests(int socket);
484 void process_resolver_requests(int socket) { 487 void process_resolver_requests(int socket) {
485 #ifdef NS_MAXDNAME 488 #ifdef NS_MAXDNAME
486 char question[NS_MAXDNAME]; 489 char question[NS_MAXDNAME];
487 #else 490 #else
488 char question[1000]; 491 char question[1000];
489 #endif 492 #endif
490 glommer glom; 493 glommer glom;
491 494
492 int maxq = sizeof(question); 495 int maxq = sizeof(question);
493 while (true) { 496 while (true) {
494 // read a question 497 // read a question
495 int rs = 0; 498 int rs = 0;
496 while (rs < maxq) { 499 while (rs < maxq) {
497 int ns = read(socket, question+rs, maxq-rs); 500 int ns = read(socket, question+rs, maxq-rs);
498 if (ns > 0) { 501 if (ns > 0) {
499 rs += ns; 502 rs += ns;
500 if (question[rs-1] == '\0') { 503 if (question[rs-1] == '\0') {
501 // last byte read was the null terminator, we are done 504 // last byte read was the null terminator, we are done
502 break; 505 break;
503 } 506 }
504 } 507 }
505 else { 508 else {
506 // peer closed the socket 509 // peer closed the socket
507 #ifdef RESOLVER_DEBUG 510 #ifdef RESOLVER_DEBUG
508 my_syslog("process_resolver_requests() peer closed socket while reading question"); 511 my_syslog("process_resolver_requests() peer closed socket while reading question");
509 #endif 512 #endif
510 shutdown(socket, SHUT_RDWR); 513 shutdown(socket, SHUT_RDWR);
511 close(socket); 514 close(socket);
512 return; 515 return;
513 } 516 }
514 } 517 }
515 question[rs-1] = '\0'; // ensure null termination 518 question[rs-1] = '\0'; // ensure null termination
516 519
517 // find the answer 520 // find the answer
518 #ifdef NS_PACKETSZ 521 #ifdef NS_PACKETSZ
519 #ifdef RESOLVER_DEBUG 522 #ifdef RESOLVER_DEBUG
520 char text[1000]; 523 char text[1000];
521 snprintf(text, sizeof(text), "process_resolver_requests() has a question %s", question); 524 snprintf(text, sizeof(text), "process_resolver_requests() has a question %s", question);
522 my_syslog(text); 525 my_syslog(text);
523 #endif 526 #endif
524 if ((_res.options & RES_INIT) == 0) res_init(); 527 if ((_res.options & RES_INIT) == 0) res_init();
525 _res.retry = 2; 528 _res.retry = 2;
526 _res.retrans = RES_TIMEOUT; 529 _res.retrans = RES_TIMEOUT;
527 glom.length = res_search(question, ns_c_in, ns_t_a, glom.answer, sizeof(glom.answer)); 530 glom.length = res_search(question, ns_c_in, ns_t_a, glom.answer, sizeof(glom.answer));
528 if (glom.length < 0) glom.length = 0; // represent all errors as zero length answers 531 if (glom.length < 0) glom.length = 0; // represent all errors as zero length answers
529 #else 532 #else
530 glom.length = sizeof(glom.answer); 533 glom.length = sizeof(glom.answer);
531 glom.answer = 0; 534 glom.answer = 0;
532 struct hostent *host = gethostbyname(question); 535 struct hostent *host = gethostbyname(question);
533 if (host && (host->h_addrtype == AF_INET)) { 536 if (host && (host->h_addrtype == AF_INET)) {
534 memcpy(&glom.answer, host->h_addr, sizeof(glom.answer)); 537 memcpy(&glom.answer, host->h_addr, sizeof(glom.answer));
535 } 538 }
536 #endif 539 #endif
537 540
538 // write the answer 541 // write the answer
539 char *buf = (char *)&glom; 542 char *buf = (char *)&glom;
540 int len = glom.length + sizeof(glom.length); 543 int len = glom.length + sizeof(glom.length);
541 #ifdef RESOLVER_DEBUG 544 #ifdef RESOLVER_DEBUG
542 snprintf(text, sizeof(text), "process_resolver_requests() writing answer length %d for total %d", glom.length, len); 545 snprintf(text, sizeof(text), "process_resolver_requests() writing answer length %d for total %d", glom.length, len);
543 my_syslog(text); 546 my_syslog(text);
544 #endif 547 #endif
545 int ws = 0; 548 int ws = 0;
546 while (len > ws) { 549 while (len > ws) {
547 int ns = write(socket, buf+ws, len-ws); 550 int ns = write(socket, buf+ws, len-ws);
548 if (ns > 0) { 551 if (ns > 0) {
549 ws += ns; 552 ws += ns;
550 } 553 }
551 else { 554 else {
552 // peer closed the socket! 555 // peer closed the socket!
553 #ifdef RESOLVER_DEBUG 556 #ifdef RESOLVER_DEBUG
554 my_syslog("process_resolver_requests() peer closed socket while writing answer"); 557 my_syslog("process_resolver_requests() peer closed socket while writing answer");
555 #endif 558 #endif
556 shutdown(socket, SHUT_RDWR); 559 shutdown(socket, SHUT_RDWR);
557 close(socket); 560 close(socket);
558 return; 561 return;
559 } 562 }
560 } 563 }
561 } 564 }
562 } 565 }
563 566
564 567
565 //////////////////////////////////////////////// 568 ////////////////////////////////////////////////
566 // ask a dns question and get an A record answer - we don't try 569 // ask a dns question and get an A record answer - we don't try
567 // very hard, just using the default resolver retry settings. 570 // very hard, just using the default resolver retry settings.
568 // If we cannot get an answer, we just accept the mail. 571 // If we cannot get an answer, we just accept the mail.
569 // 572 //
570 // 573 //
571 int dns_interface(mlfiPriv &priv, char *question, bool maybe_ip, ns_map *nameservers); 574 int dns_interface(mlfiPriv &priv, char *question, bool maybe_ip, ns_map *nameservers);
572 int dns_interface(mlfiPriv &priv, char *question, bool maybe_ip, ns_map *nameservers) { 575 int dns_interface(mlfiPriv &priv, char *question, bool maybe_ip, ns_map *nameservers) {
573 // tell sendmail we are still working 576 // tell sendmail we are still working
574 #if _FFR_SMFI_PROGRESS 577 #if _FFR_SMFI_PROGRESS
575 if (priv.eom) smfi_progress(priv.ctx); 578 if (priv.eom) smfi_progress(priv.ctx);
576 #endif 579 #endif
577 580
578 // this part can be done without locking the resolver mutex. Each 581 // this part can be done without locking the resolver mutex. Each
579 // milter thread is talking over its own socket to a separate resolver 582 // milter thread is talking over its own socket to a separate resolver
580 // process, which does the actual dns resolution. 583 // process, which does the actual dns resolution.
581 if (priv.err) return 0; // cannot ask more questions on this socket. 584 if (priv.err) return 0; // cannot ask more questions on this socket.
582 if (maybe_ip) { 585 if (maybe_ip) {
583 // might be a bare ip address, try this first to avoid dns lookups that may not be needed 586 // might be a bare ip address, try this first to avoid dns lookups that may not be needed
584 in_addr ip; 587 in_addr ip;
585 if (inet_aton(question, &ip)) { 588 if (inet_aton(question, &ip)) {
586 return (int)ip.s_addr; 589 return (int)ip.s_addr;
587 } 590 }
588 } 591 }
589 int n = strlen(question); 592 int n = strlen(question);
590 if (question[n-1] == '.') { 593 if (question[n-1] == '.') {
591 priv.my_write(question, n+1); // write the question including the null terminator 594 priv.my_write(question, n+1); // write the question including the null terminator
592 } 595 }
593 else { 596 else {
594 priv.my_write(question, n); // write the question 597 priv.my_write(question, n); // write the question
595 priv.my_write(".", 2); // and the fully qualified . terminator and null string terminator 598 priv.my_write(".", 2); // and the fully qualified . terminator and null string terminator
596 } 599 }
597 glommer glom; 600 glommer glom;
598 char *buf = (char *)&glom; 601 char *buf = (char *)&glom;
599 priv.my_read(buf, sizeof(glom.length)); 602 priv.my_read(buf, sizeof(glom.length));
600 buf += sizeof(glom.length); 603 buf += sizeof(glom.length);
601 #ifdef RESOLVER_DEBUG 604 #ifdef RESOLVER_DEBUG
602 char text[1000]; 605 char text[1000];
603 snprintf(text, sizeof(text), "dns_interface() wrote question %s and has answer length %d", question, glom.length); 606 snprintf(text, sizeof(text), "dns_interface() wrote question %s and has answer length %d", question, glom.length);
604 my_syslog(text); 607 my_syslog(text);
605 #endif 608 #endif
606 if ((glom.length < 0) || (glom.length > sizeof(glom.answer))) { 609 if ((glom.length < 0) || (glom.length > sizeof(glom.answer))) {
607 priv.err = true; 610 priv.err = true;
608 return 0; // cannot process overlarge answers 611 return 0; // cannot process overlarge answers
609 } 612 }
610 priv.my_read(buf, glom.length); 613 priv.my_read(buf, glom.length);
611 614
612 #ifdef NS_PACKETSZ 615 #ifdef NS_PACKETSZ
613 // now we need to lock the resolver mutex to keep the milter threads from 616 // now we need to lock the resolver mutex to keep the milter threads from
614 // stepping on each other while parsing the dns answer. 617 // stepping on each other while parsing the dns answer.
615 int ret_address = 0; 618 int ret_address = 0;
616 pthread_mutex_lock(&resolve_mutex); 619 pthread_mutex_lock(&resolve_mutex);
617 if (glom.length > 0) { 620 if (glom.length > 0) {
618 // parse the answer 621 // parse the answer
619 ns_msg handle; 622 ns_msg handle;
620 ns_rr rr; 623 ns_rr rr;
621 if (ns_initparse(glom.answer, glom.length, &handle) == 0) { 624 if (ns_initparse(glom.answer, glom.length, &handle) == 0) {
622 // look for ns names 625 // look for ns names
623 if (nameservers) { 626 if (nameservers) {
624 ns_map &ns = *nameservers; 627 ns_map &ns = *nameservers;
625 int rrnum = 0; 628 int rrnum = 0;
626 while (ns_parserr(&handle, ns_s_ns, rrnum++, &rr) == 0) { 629 while (ns_parserr(&handle, ns_s_ns, rrnum++, &rr) == 0) {
627 if (ns_rr_type(rr) == ns_t_ns) { 630 if (ns_rr_type(rr) == ns_t_ns) {
628 char nam[NS_MAXDNAME+1]; 631 char nam[NS_MAXDNAME+1];
629 char *n = nam; 632 char *n = nam;
630 const u_char *p = ns_rr_rdata(rr); 633 const u_char *p = ns_rr_rdata(rr);
631 while (((n-nam) < NS_MAXDNAME) && ((p-glom.answer) < glom.length) && *p) { 634 while (((n-nam) < NS_MAXDNAME) && ((p-glom.answer) < glom.length) && *p) {
632 size_t s = *(p++); 635 size_t s = *(p++);
633 if (s > 191) { 636 if (s > 191) {
634 // compression pointer 637 // compression pointer
635 s = (s-192)*256 + *(p++); 638 s = (s-192)*256 + *(p++);
636 if (s >= glom.length) break; // pointer outside bounds of answer 639 if (s >= glom.length) break; // pointer outside bounds of answer
637 p = glom.answer + s; 640 p = glom.answer + s;
638 s = *(p++); 641 s = *(p++);
639 } 642 }
640 if (s > 0) { 643 if (s > 0) {
641 if ((n-nam) >= (NS_MAXDNAME-s)) break; // destination would overflow name buffer 644 if ((n-nam) >= (NS_MAXDNAME-s)) break; // destination would overflow name buffer
642 if ((p-glom.answer) >= (glom.length-s)) break; // source outside bounds of answer 645 if ((p-glom.answer) >= (glom.length-s)) break; // source outside bounds of answer
643 memcpy(n, p, s); 646 memcpy(n, p, s);
644 n += s; 647 n += s;
645 p += s; 648 p += s;
646 *(n++) = '.'; 649 *(n++) = '.';
647 } 650 }
648 } 651 }
649 if (n-nam) n--; // remove trailing . 652 if (n-nam) n--; // remove trailing .
650 *n = '\0'; // null terminate it 653 *n = '\0'; // null terminate it
651 ns.add(nam, question); // ns host to lookup later 654 ns.add(nam, question); // ns host to lookup later
652 } 655 }
653 } 656 }
654 rrnum = 0; 657 rrnum = 0;
655 while (ns_parserr(&handle, ns_s_ar, rrnum++, &rr) == 0) { 658 while (ns_parserr(&handle, ns_s_ar, rrnum++, &rr) == 0) {
656 if (ns_rr_type(rr) == ns_t_a) { 659 if (ns_rr_type(rr) == ns_t_a) {
657 char* nam = (char*)ns_rr_name(rr); 660 char* nam = (char*)ns_rr_name(rr);
658 ns_mapper::iterator i = ns.ns_ip.find(nam); 661 ns_mapper::iterator i = ns.ns_ip.find(nam);
659 if (i != ns.ns_ip.end()) { 662 if (i != ns.ns_ip.end()) {
660 // we want this ip address 663 // we want this ip address
661 int address; 664 int address;
662 memcpy(&address, ns_rr_rdata(rr), sizeof(address)); 665 memcpy(&address, ns_rr_rdata(rr), sizeof(address));
663 ns.ns_ip[nam] = address; 666 ns.ns_ip[nam] = address;
664 } 667 }
665 } 668 }
666 } 669 }
667 } 670 }
668 int rrnum = 0; 671 int rrnum = 0;
669 while (ns_parserr(&handle, ns_s_an, rrnum++, &rr) == 0) { 672 while (ns_parserr(&handle, ns_s_an, rrnum++, &rr) == 0) {
670 if (ns_rr_type(rr) == ns_t_a) { 673 if (ns_rr_type(rr) == ns_t_a) {
671 int address; 674 int address;
672 memcpy(&address, ns_rr_rdata(rr), sizeof(address)); 675 memcpy(&address, ns_rr_rdata(rr), sizeof(address));
673 ret_address = address; 676 ret_address = address;
674 } 677 }
675 } 678 }
676 } 679 }
677 } 680 }
678 pthread_mutex_unlock(&resolve_mutex); 681 pthread_mutex_unlock(&resolve_mutex);
679 return ret_address; 682 return ret_address;
680 #else 683 #else
681 return glom.answer; 684 return glom.answer;
682 #endif 685 #endif
683 } 686 }
684 687
685 688
686 //////////////////////////////////////////////// 689 ////////////////////////////////////////////////
687 // check a single dnsbl 690 // check a single dnsbl
688 // 691 //
689 bool check_single(mlfiPriv &priv, int ip, char *suffix); 692 bool check_single(mlfiPriv &priv, int ip, char *suffix);
690 bool check_single(mlfiPriv &priv, int ip, char *suffix) { 693 bool check_single(mlfiPriv &priv, int ip, char *suffix) {
691 // make a dns question 694 // make a dns question
692 const u_char *src = (const u_char *)&ip; 695 const u_char *src = (const u_char *)&ip;
693 if (src[0] == 127) return false; // don't do dns lookups on localhost 696 if (src[0] == 127) return false; // don't do dns lookups on localhost
694 if (src[0] == 10) return false; // don't do dns lookups on rfc1918 space 697 if (src[0] == 10) return false; // don't do dns lookups on rfc1918 space
695 if ((src[0] == 192) && (src[1] == 168)) return false; 698 if ((src[0] == 192) && (src[1] == 168)) return false;
696 if ((src[0] == 172) && (16 <= src[1]) && (src[1] <= 31)) return false; 699 if ((src[0] == 172) && (16 <= src[1]) && (src[1] <= 31)) return false;
697 #ifdef NS_MAXDNAME 700 #ifdef NS_MAXDNAME
698 char question[NS_MAXDNAME]; 701 char question[NS_MAXDNAME];
699 #else 702 #else
700 char question[1000]; 703 char question[1000];
701 #endif 704 #endif
702 snprintf(question, sizeof(question), "%u.%u.%u.%u.%s.", src[3], src[2], src[1], src[0], suffix); 705 snprintf(question, sizeof(question), "%u.%u.%u.%u.%s.", src[3], src[2], src[1], src[0], suffix);
703 // ask the question, if we get an A record it implies a blacklisted ip address 706 // ask the question, if we get an A record it implies a blacklisted ip address
704 return dns_interface(priv, question, false, NULL); 707 return dns_interface(priv, question, false, NULL);
705 } 708 }
706 709
707 710
708 //////////////////////////////////////////////// 711 ////////////////////////////////////////////////
709 // check a single dnsbl 712 // check a single dnsbl
710 // 713 //
711 bool check_single(mlfiPriv &priv, int ip, DNSBL &bl); 714 bool check_single(mlfiPriv &priv, int ip, DNSBL &bl);
712 bool check_single(mlfiPriv &priv, int ip, DNSBL &bl) { 715 bool check_single(mlfiPriv &priv, int ip, DNSBL &bl) {
713 return check_single(priv, ip, bl.suffix); 716 return check_single(priv, ip, bl.suffix);
714 } 717 }
715 718
716 719
717 //////////////////////////////////////////////// 720 ////////////////////////////////////////////////
718 // check the dnsbls specified for this recipient 721 // check the dnsbls specified for this recipient
719 // 722 //
720 bool check_dnsbl(mlfiPriv &priv, dnsblp_list &dnsbll, DNSBLP &rejectlist); 723 bool check_dnsbl(mlfiPriv &priv, dnsblp_list &dnsbll, DNSBLP &rejectlist);
721 bool check_dnsbl(mlfiPriv &priv, dnsblp_list &dnsbll, DNSBLP &rejectlist) { 724 bool check_dnsbl(mlfiPriv &priv, dnsblp_list &dnsbll, DNSBLP &rejectlist) {
722 for (dnsblp_list::iterator i=dnsbll.begin(); i!=dnsbll.end(); i++) { 725 for (dnsblp_list::iterator i=dnsbll.begin(); i!=dnsbll.end(); i++) {
723 DNSBLP dp = *i; // non null by construction 726 DNSBLP dp = *i; // non null by construction
724 bool st; 727 bool st;
725 map<DNSBLP, bool>::iterator f = priv.checked.find(dp); 728 map<DNSBLP, bool>::iterator f = priv.checked.find(dp);
726 if (f == priv.checked.end()) { 729 if (f == priv.checked.end()) {
727 // have not checked this list yet 730 // have not checked this list yet
728 st = check_single(priv, priv.ip, *dp); 731 st = check_single(priv, priv.ip, *dp);
729 rejectlist = dp; 732 rejectlist = dp;
730 priv.checked[dp] = st; 733 priv.checked[dp] = st;
731 } 734 }
732 else { 735 else {
733 st = (*f).second; 736 st = (*f).second;
734 rejectlist = (*f).first; 737 rejectlist = (*f).first;
735 } 738 }
736 if (st) return st; 739 if (st) return st;
737 } 740 }
738 return false; 741 return false;
739 } 742 }
740 743
741 744
742 //////////////////////////////////////////////// 745 ////////////////////////////////////////////////
743 // lookup the domain name part of a hostname on the uribl 746 // lookup the domain name part of a hostname on the uribl
744 // 747 //
745 // if we find part of the hostname on the uribl, return 748 // if we find part of the hostname on the uribl, return
746 // true and point found to the part of the hostname that we found 749 // true and point found to the part of the hostname that we found
747 // as a string registered in hosts. 750 // as a string registered in hosts.
748 // otherwise, return false and preserve the value of found. 751 // otherwise, return false and preserve the value of found.
749 // 752 //
750 bool uriblookup(mlfiPriv &priv, string_set &hosts, char *hostname, char *top, char *&found) ; 753 bool uriblookup(mlfiPriv &priv, string_set &hosts, char *hostname, char *top, char *&found) ;
751 bool uriblookup(mlfiPriv &priv, string_set &hosts, char *hostname, char *top, char *&found) { 754 bool uriblookup(mlfiPriv &priv, string_set &hosts, char *hostname, char *top, char *&found) {
752 // top is pointer to '.' char at end of base domain, or null for ip address form 755 // top is pointer to '.' char at end of base domain, or null for ip address form
753 // so for hostname of www.fred.mydomain.co.uk 756 // so for hostname of www.fred.mydomain.co.uk
754 // top points to-----------------------^ 757 // top points to-----------------------^
755 // and we end up looking at only mydomain.co.uk, ignoring the www.fred stuff 758 // and we end up looking at only mydomain.co.uk, ignoring the www.fred stuff
756 char buf[maxlen]; 759 char buf[maxlen];
757 if (top) { 760 if (top) {
758 // add one more component 761 // add one more component
759 *top = '\0'; 762 *top = '\0';
760 char *x = strrchr(hostname, '.'); 763 char *x = strrchr(hostname, '.');
761 if (x) hostname = x+1; 764 if (x) hostname = x+1;
762 *top = '.'; 765 *top = '.';
763 } 766 }
764 snprintf(buf, sizeof(buf), "%s.%s.", hostname, priv.uribl_suffix); 767 snprintf(buf, sizeof(buf), "%s.%s.", hostname, priv.uribl_suffix);
765 if (dns_interface(priv, buf, false, NULL)) { 768 if (dns_interface(priv, buf, false, NULL)) {
766 if (debug_syslog > 2) { 769 if (debug_syslog > 2) {
767 char tmp[maxlen]; 770 char tmp[maxlen];
768 snprintf(tmp, sizeof(tmp), "found %s on %s", hostname, priv.uribl_suffix); 771 snprintf(tmp, sizeof(tmp), "found %s on %s", hostname, priv.uribl_suffix);
769 my_syslog(tmp); 772 my_syslog(tmp);
770 } 773 }
771 found = register_string(hosts, hostname); 774 found = register_string(hosts, hostname);
772 return true; 775 return true;
773 } 776 }
774 return false; 777 return false;
775 } 778 }
776 779
777 780
778 //////////////////////////////////////////////// 781 ////////////////////////////////////////////////
779 // uribl checker 782 // uribl checker
780 // ------------- 783 // -------------
781 // hostname MUST not have a trailing dot 784 // hostname MUST not have a trailing dot
782 // If tld, two level lookup. 785 // If tld, two level lookup.
783 // Else, look up three level domain. 786 // Else, look up three level domain.
784 // 787 //
785 // if we find part of the hostname on the uribl, return 788 // if we find part of the hostname on the uribl, return
786 // true and point found to the part of the hostname that we found 789 // true and point found to the part of the hostname that we found
787 // as a string registered in hosts. 790 // as a string registered in hosts.
788 // otherwise, return false and preserve the value of found. 791 // otherwise, return false and preserve the value of found.
789 // 792 //
790 bool check_uribl(mlfiPriv &priv, string_set &hosts, char *hostname, char *&found) ; 793 bool check_uribl(mlfiPriv &priv, string_set &hosts, char *hostname, char *&found) ;
791 bool check_uribl(mlfiPriv &priv, string_set &hosts, char *hostname, char *&found) { 794 bool check_uribl(mlfiPriv &priv, string_set &hosts, char *hostname, char *&found) {
792 in_addr ip; 795 in_addr ip;
793 if (inet_aton(hostname, &ip)) { 796 if (inet_aton(hostname, &ip)) {
794 const u_char *src = (const u_char *)&ip.s_addr; 797 const u_char *src = (const u_char *)&ip.s_addr;
795 if (src[0] == 127) return false; // don't do dns lookups on localhost 798 if (src[0] == 127) return false; // don't do dns lookups on localhost
796 if (src[0] == 10) return false; // don't do dns lookups on rfc1918 space 799 if (src[0] == 10) return false; // don't do dns lookups on rfc1918 space
797 if ((src[0] == 192) && (src[1] == 168)) return false; 800 if ((src[0] == 192) && (src[1] == 168)) return false;
798 if ((src[0] == 172) && (16 <= src[1]) && (src[1] <= 31)) return false; 801 if ((src[0] == 172) && (16 <= src[1]) && (src[1] <= 31)) return false;
799 char adr[sizeof "255.255.255.255 "]; 802 char adr[sizeof "255.255.255.255 "];
800 snprintf(adr, sizeof(adr), "%u.%u.%u.%u", src[3], src[2], src[1], src[0]); 803 snprintf(adr, sizeof(adr), "%u.%u.%u.%u", src[3], src[2], src[1], src[0]);
801 // cannot use inet_ntop here since we want the octets reversed. 804 // cannot use inet_ntop here since we want the octets reversed.
802 return (uriblookup(priv, hosts, adr, NULL, found)); 805 return (uriblookup(priv, hosts, adr, NULL, found));
803 } 806 }
804 807
805 char *top, *top2, *top3; 808 char *top, *top2, *top3;
806 top = strrchr(hostname, '.'); 809 top = strrchr(hostname, '.');
807 if (top) { 810 if (top) {
808 *top = '\0'; 811 *top = '\0';
809 top2 = strrchr(hostname, '.'); 812 top2 = strrchr(hostname, '.');
810 *top = '.'; 813 *top = '.';
811 814
812 if (top2) { 815 if (top2) {
813 string_set::iterator i = priv.memory->get_cctlds()->find(top2+1); 816 string_set::iterator i = priv.memory->get_cctlds()->find(top2+1);
814 string_set::iterator x = priv.memory->get_cctlds()->end(); 817 string_set::iterator x = priv.memory->get_cctlds()->end();
815 // if we have a 2-level-cctld, just look at top three levels of the name 818 // if we have a 2-level-cctld, just look at top three levels of the name
816 if (i != x) return uriblookup(priv, hosts, hostname, top2, found); 819 if (i != x) return uriblookup(priv, hosts, hostname, top2, found);
817 820
818 *top2 = '\0'; 821 *top2 = '\0';
819 top3 = strrchr(hostname, '.'); 822 top3 = strrchr(hostname, '.');
820 *top2 = '.'; 823 *top2 = '.';
821 824
822 // if we have more than 3 levels in the name, look at the top three levels of the name 825 // if we have more than 3 levels in the name, look at the top three levels of the name
823 if (top3 && uriblookup(priv, hosts, hostname, top2, found)) return true; 826 if (top3 && uriblookup(priv, hosts, hostname, top2, found)) return true;
824 // if that was not found, fall thru to looking at the top two levels 827 // if that was not found, fall thru to looking at the top two levels
825 } 828 }
826 // look at the top two levels of the name 829 // look at the top two levels of the name
827 return uriblookup(priv, hosts, hostname, top, found); 830 return uriblookup(priv, hosts, hostname, top, found);
828 } 831 }
829 return false; 832 return false;
830 } 833 }
831 834
832 835
833 //////////////////////////////////////////////// 836 ////////////////////////////////////////////////
834 // check the hosts from the body against the content filter and uribl dnsbls 837 // check the hosts from the body against the content filter and uribl dnsbls
835 // 838 //
836 // 839 //
837 bool check_hosts(mlfiPriv &priv, bool random, int limit, char *&msg, char *&host, int &ip, char *&found); 840 bool check_hosts(mlfiPriv &priv, bool random, int limit, char *&msg, char *&host, int &ip, char *&found);
838 bool check_hosts(mlfiPriv &priv, bool random, int limit, char *&msg, char *&host, int &ip, char *&found) { 841 bool check_hosts(mlfiPriv &priv, bool random, int limit, char *&msg, char *&host, int &ip, char *&found) {
839 found = NULL; // normally ip address style 842 found = NULL; // normally ip address style
840 if (!priv.content_suffix && !priv.uribl_suffix) return false; // nothing to check 843 if (!priv.content_suffix && !priv.uribl_suffix) return false; // nothing to check
841 CONFIG &dc = *priv.pc; 844 CONFIG &dc = *priv.pc;
842 string_set &hosts = priv.memory->get_hosts(); 845 string_set &hosts = priv.memory->get_hosts();
843 string_set &ignore = *priv.content_host_ignore; 846 string_set &ignore = *priv.content_host_ignore;
844 847
845 int count = 0; 848 int count = 0;
846 int cnt = hosts.size(); // number of hosts we could look at 849 int cnt = hosts.size(); // number of hosts we could look at
847 int_set ips; 850 int_set ips;
848 ns_map nameservers; 851 ns_map nameservers;
849 for (string_set::iterator i=hosts.begin(); i!=hosts.end(); i++) { 852 for (string_set::iterator i=hosts.begin(); i!=hosts.end(); i++) {
850 host = *i; // a reference into hosts, which will live until this smtp transaction is closed 853 host = *i; // a reference into hosts, which will live until this smtp transaction is closed
851 854
852 // don't bother looking up hosts on the ignore list 855 // don't bother looking up hosts on the ignore list
853 string_set::iterator j = ignore.find(host); 856 string_set::iterator j = ignore.find(host);
854 if (j != ignore.end()) continue; 857 if (j != ignore.end()) continue;
855 858
856 // try to only look at limit/cnt fraction of the available cnt host names in random mode 859 // try to only look at limit/cnt fraction of the available cnt host names in random mode
857 if ((cnt > limit) && (limit > 0) && random) { 860 if ((cnt > limit) && (limit > 0) && random) {
858 int r = rand() % cnt; 861 int r = rand() % cnt;
859 if (r >= limit) { 862 if (r >= limit) {
860 if (debug_syslog > 2) { 863 if (debug_syslog > 2) {
861 char buf[maxlen]; 864 char buf[maxlen];
862 snprintf(buf, sizeof(buf), "host %s skipped", host); 865 snprintf(buf, sizeof(buf), "host %s skipped", host);
863 my_syslog(&priv, buf); 866 my_syslog(&priv, buf);
864 } 867 }
865 continue; 868 continue;
866 } 869 }
867 } 870 }
868 count++; 871 count++;
869 ip = dns_interface(priv, host, true, &nameservers); 872 ip = dns_interface(priv, host, true, &nameservers);
870 if (debug_syslog > 2) { 873 if (debug_syslog > 2) {
871 char buf[maxlen]; 874 char buf[maxlen];
872 if (ip) { 875 if (ip) {
873 char adr[sizeof "255.255.255.255 "]; 876 char adr[sizeof "255.255.255.255 "];
874 adr[0] = '\0'; 877 adr[0] = '\0';
875 inet_ntop(AF_INET, (const u_char *)&ip, adr, sizeof(adr)); 878 inet_ntop(AF_INET, (const u_char *)&ip, adr, sizeof(adr));
876 snprintf(buf, sizeof(buf), "host %s found at %s", host, adr); 879 snprintf(buf, sizeof(buf), "host %s found at %s", host, adr);
877 } 880 }
878 else { 881 else {
879 snprintf(buf, sizeof(buf), "host %s not found", host); 882 snprintf(buf, sizeof(buf), "host %s not found", host);
880 } 883 }
881 my_syslog(&priv, buf); 884 my_syslog(&priv, buf);
882 } 885 }
883 if (ip) { 886 if (ip) {
884 int_set::iterator i = ips.find(ip); 887 int_set::iterator i = ips.find(ip);
885 if (i == ips.end()) { 888 if (i == ips.end()) {
886 // we haven't looked this up yet 889 // we haven't looked this up yet
887 ips.insert(ip); 890 ips.insert(ip);
888 // check dnsbl style list 891 // check dnsbl style list
889 if (priv.content_suffix && check_single(priv, ip, priv.content_suffix)) { 892 if (priv.content_suffix && check_single(priv, ip, priv.content_suffix)) {
890 msg = priv.content_message; 893 msg = priv.content_message;
891 return true; 894 return true;
892 } 895 }
893 // Check uribl & surbl style list 896 // Check uribl & surbl style list
894 if (priv.uribl_suffix && check_uribl(priv, hosts, host, found)) { 897 if (priv.uribl_suffix && check_uribl(priv, hosts, host, found)) {
895 msg = priv.uribl_message; 898 msg = priv.uribl_message;
896 return true; 899 return true;
897 } 900 }
898 } 901 }
899 } 902 }
900 } 903 }
901 limit *= 4; // allow average of 3 ns per host name 904 limit *= 4; // allow average of 3 ns per host name
902 for (ns_mapper::iterator i=nameservers.ns_ip.begin(); i!=nameservers.ns_ip.end(); i++) { 905 for (ns_mapper::iterator i=nameservers.ns_ip.begin(); i!=nameservers.ns_ip.end(); i++) {
903 count++; 906 count++;
904 if ((count > limit) && (limit > 0)) return false; // too many name servers to check them all 907 if ((count > limit) && (limit > 0)) return false; // too many name servers to check them all
905 host = (*i).first; // a transient reference that needs to be replaced before we return it 908 host = (*i).first; // a transient reference that needs to be replaced before we return it
906 ip = (*i).second; 909 ip = (*i).second;
907 if (!ip) ip = dns_interface(priv, host, false, NULL); 910 if (!ip) ip = dns_interface(priv, host, false, NULL);
908 if (debug_syslog > 2) { 911 if (debug_syslog > 2) {
909 char buf[maxlen]; 912 char buf[maxlen];
910 if (ip) { 913 if (ip) {
911 char adr[sizeof "255.255.255.255 "]; 914 char adr[sizeof "255.255.255.255 "];
912 adr[0] = '\0'; 915 adr[0] = '\0';
913 inet_ntop(AF_INET, (const u_char *)&ip, adr, sizeof(adr)); 916 inet_ntop(AF_INET, (const u_char *)&ip, adr, sizeof(adr));
914 snprintf(buf, sizeof(buf), "ns %s found at %s", host, adr); 917 snprintf(buf, sizeof(buf), "ns %s found at %s", host, adr);
915 } 918 }
916 else { 919 else {
917 snprintf(buf, sizeof(buf), "ns %s not found", host); 920 snprintf(buf, sizeof(buf), "ns %s not found", host);
918 } 921 }
919 my_syslog(&priv, buf); 922 my_syslog(&priv, buf);
920 } 923 }
921 if (ip) { 924 if (ip) {
922 int_set::iterator i = ips.find(ip); 925 int_set::iterator i = ips.find(ip);
923 if (i == ips.end()) { 926 if (i == ips.end()) {
924 ips.insert(ip); 927 ips.insert(ip);
925 if (check_single(priv, ip, priv.content_suffix)) { 928 if (check_single(priv, ip, priv.content_suffix)) {
926 msg = priv.content_message; 929 msg = priv.content_message;
927 string_map::iterator j = nameservers.ns_host.find(host); 930 string_map::iterator j = nameservers.ns_host.find(host);
928 if (j != nameservers.ns_host.end()) { 931 if (j != nameservers.ns_host.end()) {
929 char *refer = (*j).second; 932 char *refer = (*j).second;
930 char buf[maxlen]; 933 char buf[maxlen];
931 snprintf(buf, sizeof(buf), "%s with nameserver %s", refer, host); 934 snprintf(buf, sizeof(buf), "%s with nameserver %s", refer, host);
932 host = register_string(hosts, buf); // put a copy into hosts, and return that reference 935 host = register_string(hosts, buf); // put a copy into hosts, and return that reference
933 } 936 }
934 else { 937 else {
935 host = register_string(hosts, host); // put a copy into hosts, and return that reference 938 host = register_string(hosts, host); // put a copy into hosts, and return that reference
936 } 939 }
937 return true; 940 return true;
938 } 941 }
939 } 942 }
940 } 943 }
941 } 944 }
942 return false; 945 return false;
943 } 946 }
944 947
945 948
946 //////////////////////////////////////////////// 949 ////////////////////////////////////////////////
947 // 950 //
948 // this email address is passed in from sendmail, and will normally be 951 // this email address is passed in from sendmail, and will normally be
949 // enclosed in <>. I think older versions of sendmail supplied the <> 952 // enclosed in <>. I think older versions of sendmail supplied the <>
950 // wrapper if the mail client did not, but the current version does not do 953 // wrapper if the mail client did not, but the current version does not do
951 // that. So the <> wrapper is now optional. It may have mixed case, just 954 // that. So the <> wrapper is now optional. It may have mixed case, just
952 // as the mail client sent it. We dup the string and convert the duplicate 955 // as the mail client sent it. We dup the string and convert the duplicate
953 // to lower case. 956 // to lower case. Some clients enclose the entire address in single quotes,
957 // so we strip those as well.
954 // 958 //
955 char *to_lower_string(char *email); 959 char *to_lower_string(char *email);
956 char *to_lower_string(char *email) { 960 char *to_lower_string(char *email) {
957 int n = strlen(email); 961 int n = strlen(email);
958 if (*email == '<') { 962 if (email[0] == '<') {
959 // assume it also ends with > 963 // assume it also ends with >
960 n -= 2; 964 n -= 2;
961 if (n < 1) return strdup(email); // return "<>" 965 if (n < 1) return strdup(email); // return "<>"
962 email++; 966 email++;
963 } 967 }
964 char *key = strdup(email); 968 if ((email[0] == '\'') && (email[n-1] == '\'') && (n > 2)) {
965 key[n] = '\0'; 969 n -= 2;
966 for (int i=0; i<n; i++) key[i] = tolower(key[i]); 970 email++;
967 return key; 971 }
972 char *key = strdup(email);
973 key[n] = '\0';
974 for (int i=0; i<n; i++) key[i] = tolower(key[i]);
975 return key;
968 } 976 }
969 977
970 978
971 //////////////////////////////////////////////// 979 ////////////////////////////////////////////////
972 // start of sendmail milter interfaces 980 // start of sendmail milter interfaces
973 // 981 //
974 sfsistat mlfi_connect(SMFICTX *ctx, char *hostname, _SOCK_ADDR *hostaddr) 982 sfsistat mlfi_connect(SMFICTX *ctx, char *hostname, _SOCK_ADDR *hostaddr)
975 { 983 {
976 // allocate some private memory 984 // allocate some private memory
977 mlfiPriv *priv = new mlfiPriv; 985 mlfiPriv *priv = new mlfiPriv;
978 if (hostaddr->sa_family == AF_INET) { 986 if (hostaddr->sa_family == AF_INET) {
979 priv->ip = ((struct sockaddr_in *)hostaddr)->sin_addr.s_addr; 987 priv->ip = ((struct sockaddr_in *)hostaddr)->sin_addr.s_addr;
980 } 988 }
981 // save the private data 989 // save the private data
982 smfi_setpriv(ctx, (void*)priv); 990 smfi_setpriv(ctx, (void*)priv);
983 991
984 // continue processing 992 // continue processing
985 return SMFIS_CONTINUE; 993 return SMFIS_CONTINUE;
986 } 994 }
987 995
988 sfsistat mlfi_helo(SMFICTX * ctx, char *helohost) 996 sfsistat mlfi_helo(SMFICTX * ctx, char *helohost)
989 { 997 {
990 mlfiPriv &priv = *MLFIPRIV; 998 mlfiPriv &priv = *MLFIPRIV;
991 priv.helo = strdup(helohost); 999 priv.helo = strdup(helohost);
992 return SMFIS_CONTINUE; 1000 return SMFIS_CONTINUE;
993 } 1001 }
994 1002
995 sfsistat mlfi_envfrom(SMFICTX *ctx, char **from) 1003 sfsistat mlfi_envfrom(SMFICTX *ctx, char **from)
996 { 1004 {
997 mlfiPriv &priv = *MLFIPRIV; 1005 mlfiPriv &priv = *MLFIPRIV;
998 priv.mailaddr = to_lower_string(from[0]); 1006 priv.mailaddr = to_lower_string(from[0]);
999 priv.queueid = strdup(smfi_getsymval(ctx, "i")); 1007 priv.queueid = strdup(smfi_getsymval(ctx, "i"));
1000 priv.authenticated = smfi_getsymval(ctx, "{auth_authen}"); 1008 priv.authenticated = smfi_getsymval(ctx, "{auth_authen}");
1001 priv.client_name = smfi_getsymval(ctx, "_"); 1009 priv.client_name = smfi_getsymval(ctx, "_");
1002 if (!priv.helo) priv.helo = strdup("unknown"); 1010 if (!priv.helo) priv.helo = strdup("unknown");
1003 if (priv.authenticated) priv.authenticated = strdup(priv.authenticated); 1011 if (priv.authenticated) priv.authenticated = strdup(priv.authenticated);
1004 if (priv.client_name) priv.client_name = strdup(priv.client_name); 1012 if (priv.client_name) priv.client_name = strdup(priv.client_name);
1005 if (spamc != spamc_empty) { 1013 if (spamc != spamc_empty) {
1006 priv.assassin = new SpamAssassin(&priv, priv.ip, priv.helo, priv.mailaddr, priv.queueid); 1014 priv.assassin = new SpamAssassin(&priv, priv.ip, priv.helo, priv.mailaddr, priv.queueid);
1007 } 1015 }
1008 if (dccifd_port) { 1016 if (dccifd_port) {
1009 priv.dccifd = new DccInterface(dccifd_port, &priv, priv.ip, priv.helo, priv.mailaddr); 1017 priv.dccifd = new DccInterface(dccifd_port, &priv, priv.ip, priv.helo, priv.mailaddr);
1010 } 1018 }
1011 return SMFIS_CONTINUE; 1019 return SMFIS_CONTINUE;
1012 } 1020 }
1013 1021
1014 sfsistat mlfi_envrcpt(SMFICTX *ctx, char **rcpt) 1022 sfsistat mlfi_envrcpt(SMFICTX *ctx, char **rcpt)
1015 { 1023 {
1016 DNSBLP rejectlist = NULL; // list that caused the reject 1024 DNSBLP rejectlist = NULL; // list that caused the reject
1017 mlfiPriv &priv = *MLFIPRIV; 1025 mlfiPriv &priv = *MLFIPRIV;
1018 CONFIG &dc = *priv.pc; 1026 CONFIG &dc = *priv.pc;
1019 char *rcptaddr = rcpt[0]; 1027 char *rcptaddr = rcpt[0];
1020 char *loto = to_lower_string(rcptaddr); 1028 char *loto = to_lower_string(rcptaddr);
1021 1029
1022 // some version of sendmail allowed rcpt to:<> and passed it thru to the milters 1030 // some version of sendmail allowed rcpt to:<> and passed it thru to the milters
1023 if (strcmp(loto, "<>") == 0) { 1031 if (strcmp(loto, "<>") == 0) {
1024 smfi_setreply(ctx, "550", "5.7.1", "bogus recipient"); 1032 smfi_setreply(ctx, "550", "5.7.1", "bogus recipient");
1025 return SMFIS_REJECT; 1033 return SMFIS_REJECT;
1026 } 1034 }
1027 // priv.mailaddr sending original message to loto 1035 // priv.mailaddr sending original message to loto
1028 CONTEXT &con = *(dc.find_context(loto)->find_context(priv.mailaddr)); 1036 CONTEXT &con = *(dc.find_context(loto)->find_context(priv.mailaddr));
1029 VERIFYP ver = con.find_verify(loto); 1037 VERIFYP ver = con.find_verify(loto);
1030 char *fromvalue = con.find_from(priv.mailaddr, true); 1038 char *fromvalue = con.find_from(priv.mailaddr, true);
1031 // tell spam assassin and dccifd about this recipient 1039 // tell spam assassin and dccifd about this recipient
1032 if (priv.assassin) priv.assassin->mlfi_envrcpt(ctx, loto); 1040 if (priv.assassin) priv.assassin->mlfi_envrcpt(ctx, loto);
1033 if (priv.dccifd) priv.dccifd->mlfi_envrcpt(ctx, loto, con.get_grey() && !priv.authenticated); 1041 if (priv.dccifd) priv.dccifd->mlfi_envrcpt(ctx, loto, con.get_grey() && !priv.authenticated);
1034 // loto sending a reply back to priv.mailaddr 1042 // loto sending a reply back to priv.mailaddr
1035 CONTEXT &con2 = *(dc.find_context(priv.mailaddr)->find_context(loto)); 1043 CONTEXT &con2 = *(dc.find_context(priv.mailaddr)->find_context(loto));
1036 char *replyvalue = con2.find_from(loto); 1044 char *replyvalue = con2.find_from(loto);
1037 if (debug_syslog > 1) { 1045 if (debug_syslog > 1) {
1038 char buf[maxlen]; 1046 char buf[maxlen];
1039 char msg[maxlen]; 1047 char msg[maxlen];
1040 snprintf(msg, sizeof(msg), "from <%s> to <%s> using context %s state %s reply state %s", priv.mailaddr, loto, con.get_full_name(buf,maxlen), fromvalue, replyvalue); 1048 snprintf(msg, sizeof(msg), "from <%s> to <%s> using context %s state %s reply state %s", priv.mailaddr, loto, con.get_full_name(buf,maxlen), fromvalue, replyvalue);
1041 my_syslog(&priv, msg); 1049 my_syslog(&priv, msg);
1042 } 1050 }
1043 free(loto); 1051 free(loto);
1044 status st; 1052 status st;
1045 if (replyvalue == token_black) { 1053 if (replyvalue == token_black) {
1046 smfi_setreply(ctx, "550", "5.7.1", "recipient can not reply due to blacklisting"); 1054 smfi_setreply(ctx, "550", "5.7.1", "recipient can not reply due to blacklisting");
1047 return SMFIS_REJECT; 1055 return SMFIS_REJECT;
1048 } 1056 }
1049 if (priv.authenticated) { 1057 if (priv.authenticated) {
1050 int c = incr_rcpt_count(priv.authenticated); 1058 int c = incr_rcpt_count(priv.authenticated);
1051 int l = dc.default_context->find_rate(priv.authenticated); 1059 int l = dc.default_context->find_rate(priv.authenticated);
1052 if (debug_syslog > 1) { 1060 if (debug_syslog > 1) {
1053 char buf[maxlen]; 1061 char buf[maxlen];
1054 char msg[maxlen]; 1062 char msg[maxlen];
1055 snprintf(msg, sizeof(msg), "authenticated id %s (%d recipients, %d limit)", priv.authenticated, c, l); 1063 snprintf(msg, sizeof(msg), "authenticated id %s (%d recipients, %d limit)", priv.authenticated, c, l);
1056 my_syslog(&priv, msg); 1064 my_syslog(&priv, msg);
1057 } 1065 }
1058 if (c > l) { 1066 if (c > l) {
1059 smfi_setreply(ctx, "550", "5.7.1", "recipient rate limit exceeded"); 1067 smfi_setreply(ctx, "550", "5.7.1", "recipient rate limit exceeded");
1060 return SMFIS_REJECT; 1068 return SMFIS_REJECT;
1061 } 1069 }
1062 st = white; 1070 st = white;
1063 } 1071 }
1064 else if (fromvalue == token_black) { 1072 else if (fromvalue == token_black) {
1065 st = black; 1073 st = black;
1066 } 1074 }
1067 else if (fromvalue == token_white) { 1075 else if (fromvalue == token_white) {
1068 st = white; 1076 st = white;
1069 } 1077 }
1070 else { 1078 else {
1071 // check the dns based lists 1079 // check the dns based lists
1072 st = (check_dnsbl(priv, con.get_dnsbl_list(), rejectlist)) ? reject : oksofar; 1080 st = (check_dnsbl(priv, con.get_dnsbl_list(), rejectlist)) ? reject : oksofar;
1073 } 1081 }
1074 if (st == reject) { 1082 if (st == reject) {
1075 // reject the recipient based on some dnsbl 1083 // reject the recipient based on some dnsbl
1076 char adr[sizeof "255.255.255.255 "]; 1084 char adr[sizeof "255.255.255.255 "];
1077 adr[0] = '\0'; 1085 adr[0] = '\0';
1078 inet_ntop(AF_INET, (const u_char *)&priv.ip, adr, sizeof(adr)); 1086 inet_ntop(AF_INET, (const u_char *)&priv.ip, adr, sizeof(adr));
1079 char buf[maxlen]; 1087 char buf[maxlen];
1080 snprintf(buf, sizeof(buf), rejectlist->message, adr, adr); 1088 snprintf(buf, sizeof(buf), rejectlist->message, adr, adr);
1081 smfi_setreply(ctx, "550", "5.7.1", buf); 1089 smfi_setreply(ctx, "550", "5.7.1", buf);
1082 return SMFIS_REJECT; 1090 return SMFIS_REJECT;
1083 } 1091 }
1084 if (st == oksofar) { 1092 if (st == oksofar) {
1085 char *msg = con.generic_match(priv.client_name); 1093 char *msg = con.generic_match(priv.client_name);
1086 if (msg) { 1094 if (msg) {
1087 // reject the recipient based on generic reverse dns 1095 // reject the recipient based on generic reverse dns
1088 char buf[maxlen]; 1096 char buf[maxlen];
1089 snprintf(buf, sizeof(buf), msg, priv.client_name); 1097 snprintf(buf, sizeof(buf), msg, priv.client_name);
1090 smfi_setreply(ctx, "550", "5.7.1", buf); 1098 smfi_setreply(ctx, "550", "5.7.1", buf);
1091 return SMFIS_REJECT; 1099 return SMFIS_REJECT;
1092 } 1100 }
1093 } 1101 }
1094 if (st == black) { 1102 if (st == black) {
1095 // reject the recipient based on blacklisting either from or to 1103 // reject the recipient based on blacklisting either from or to
1096 smfi_setreply(ctx, "550", "5.7.1", "no such user"); 1104 smfi_setreply(ctx, "550", "5.7.1", "no such user");
1097 return SMFIS_REJECT; 1105 return SMFIS_REJECT;
1098 } 1106 }
1099 if (ver && (st != white)) { 1107 if (ver && (st != white)) {
1100 // try to verify this from/to pair of addresses since it is not explicitly whitelisted 1108 // try to verify this from/to pair of addresses since it is not explicitly whitelisted
1101 char *loto = to_lower_string(rcptaddr); 1109 char *loto = to_lower_string(rcptaddr);
1102 bool rc = ver->ok(priv.mailaddr, loto); 1110 bool rc = ver->ok(priv.mailaddr, loto);
1103 free(loto); 1111 free(loto);
1104 if (!rc) { 1112 if (!rc) {
1105 smfi_setreply(ctx, "550", "5.7.1", "no such user"); 1113 smfi_setreply(ctx, "550", "5.7.1", "no such user");
1106 return SMFIS_REJECT; 1114 return SMFIS_REJECT;
1107 } 1115 }
1108 } 1116 }
1109 // we will accept the recipient, but add an auto-whitelist entry 1117 // we will accept the recipient, but add an auto-whitelist entry
1110 // if needed to ensure we can accept replies 1118 // if needed to ensure we can accept replies
1111 loto = to_lower_string(rcptaddr); 1119 loto = to_lower_string(rcptaddr);
1112 WHITELISTERP w = con2.find_autowhite(loto, priv.mailaddr); 1120 WHITELISTERP w = con2.find_autowhite(loto, priv.mailaddr);
1113 if (w) { 1121 // check if local part is too big
1114 if (debug_syslog > 1) { 1122 const int max_local_size = 30;
1115 char buf[maxlen]; 1123 char *p = strchr(loto, '@');
1116 char msg[maxlen]; 1124 int len = (p) ? p-loto : max_local_size;
1117 snprintf(msg, sizeof(msg), "whitelist reply from <%s> in context %s", loto, con2.get_full_name(buf,maxlen)); 1125 if (len >= max_local_size) w = NULL; // too big, pretend we don't have a whitelister
1118 my_syslog(&priv, msg); 1126 // record it if we have a whitelister
1119 } 1127 if (w) {
1120 w->sent(loto); // don't free it, the whitelister takes ownership of the string 1128 DELAYWHITEP dwp = new DELAYWHITE(loto, w, &con2);
1121 } 1129 priv.delayer.push_back(dwp);
1122 else { 1130 }
1123 free(loto); 1131 else {
1124 } 1132 free(loto);
1125 1133 }
1126 // accept the recipient 1134
1127 if (!con.get_content_filtering()) st = white; 1135 // accept the recipient
1128 1136 if (!con.get_content_filtering()) st = white;
1129 if (st == oksofar) { 1137
1130 // remember first content filtering context 1138 if (st == oksofar) {
1131 if (con.get_content_filtering()) { 1139 // remember first content filtering context
1132 if (!priv.content_context) priv.content_context = &con; 1140 if (con.get_content_filtering()) {
1133 else if (con.get_require() && (priv.content_context != &con)) { 1141 if (!priv.content_context) priv.content_context = &con;
1134 smfi_setreply(ctx, "452", "4.2.1", "incompatible filtering contexts"); 1142 else if (con.get_require() && (priv.content_context != &con)) {
1135 return SMFIS_TEMPFAIL; 1143 smfi_setreply(ctx, "452", "4.2.1", "incompatible filtering contexts");
1136 } 1144 return SMFIS_TEMPFAIL;
1137 } 1145 }
1138 // remember the non-whites 1146 }
1139 priv.need_content_filter(rcptaddr, con); 1147 // remember the non-whites
1140 priv.only_whites = false; 1148 priv.need_content_filter(rcptaddr, con);
1141 priv.want_spamassassin |= (priv.assassin) && // have spam assassin available and 1149 priv.only_whites = false;
1142 (con.get_spamassassin_limit() != 0); // want to use it with a non-zero score 1150 priv.want_spamassassin |= (priv.assassin) && // have spam assassin available and
1143 priv.want_dccgrey |= (priv.dccifd) && // have dcc interface and 1151 (con.get_spamassassin_limit() != 0); // want to use it with a non-zero score
1144 (con.get_grey()); // want to use it for greylisting 1152 priv.want_dccgrey |= (priv.dccifd) && // have dcc interface and
1145 priv.want_dccbulk |= (priv.dccifd) && // have dcc interface and 1153 (con.get_grey()); // want to use it for greylisting
1146 (con.get_bulk() != 0); // want to use it for bulk detection 1154 priv.want_dccbulk |= (priv.dccifd) && // have dcc interface and
1147 } 1155 (con.get_bulk() != 0); // want to use it for bulk detection
1148 if (st == white) { 1156 }
1149 priv.have_whites = true; 1157 if (st == white) {
1150 } 1158 priv.have_whites = true;
1151 return SMFIS_CONTINUE; 1159 }
1160 return SMFIS_CONTINUE;
1152 } 1161 }
1153 1162
1154 sfsistat mlfi_header(SMFICTX* ctx, char* headerf, char* headerv) 1163 sfsistat mlfi_header(SMFICTX* ctx, char* headerf, char* headerv)
1155 { 1164 {
1156 mlfiPriv &priv = *MLFIPRIV; 1165 mlfiPriv &priv = *MLFIPRIV;
1157 if (priv.authenticated) return SMFIS_CONTINUE; 1166 // detect precedence:bulk for avoiding autowhitelisting
1158 if (priv.only_whites) return SMFIS_CONTINUE; 1167 if ((strcasecmp(headerf, "precedence") == 0) &&
1159 if (priv.want_spamassassin) priv.assassin->mlfi_header(headerf, headerv); 1168 (strcasecmp(headerv, "bulk") == 0)) priv.is_bulk_precedence = true;
1160 if (priv.want_dccgrey || priv.want_dccbulk) priv.dccifd->mlfi_header(ctx, headerf, headerv); 1169 // other headers are only needed for content filtering
1161 return SMFIS_CONTINUE; 1170 if (priv.authenticated) return SMFIS_CONTINUE;
1171 if (priv.only_whites) return SMFIS_CONTINUE;
1172 if (priv.want_spamassassin) priv.assassin->mlfi_header(headerf, headerv);
1173 if (priv.want_dccgrey || priv.want_dccbulk) priv.dccifd->mlfi_header(ctx, headerf, headerv);
1174 return SMFIS_CONTINUE;
1162 } 1175 }
1163 1176
1164 sfsistat mlfi_eoh(SMFICTX* ctx) 1177 sfsistat mlfi_eoh(SMFICTX* ctx)
1165 { 1178 {
1166 mlfiPriv &priv = *MLFIPRIV; 1179 mlfiPriv &priv = *MLFIPRIV;
1167 if (priv.authenticated) return SMFIS_CONTINUE; 1180 // delayed autowhitelisting
1168 if (priv.only_whites) return SMFIS_CONTINUE; 1181 while (!priv.delayer.empty()) {
1169 if (priv.want_spamassassin) priv.assassin->mlfi_eoh(); 1182 DELAYWHITEP dwp = priv.delayer.front();
1170 if (priv.want_dccgrey || priv.want_dccbulk) priv.dccifd->mlfi_eoh(); 1183 if (!priv.is_bulk_precedence) {
1171 return SMFIS_CONTINUE; 1184 char *loto = dwp->get_loto();
1185 WHITELISTERP w = dwp->get_w();
1186 CONTEXTP con2 = dwp->get_con();
1187 if (debug_syslog > 1) {
1188 char buf[maxlen];
1189 char msg[maxlen];
1190 snprintf(msg, sizeof(msg), "whitelist reply from <%s> in context %s", loto, con2->get_full_name(buf,maxlen));
1191 my_syslog(&priv, msg);
1192 }
1193 w->sent(loto); // don't free it, the whitelister takes ownership of the string
1194 }
1195 delete dwp;
1196 priv.delayer.pop_front();
1197 }
1198 // content filtering
1199 if (priv.authenticated) return SMFIS_CONTINUE;
1200 if (priv.only_whites) return SMFIS_CONTINUE;
1201 if (priv.want_spamassassin) priv.assassin->mlfi_eoh();
1202 if (priv.want_dccgrey || priv.want_dccbulk) priv.dccifd->mlfi_eoh();
1203 return SMFIS_CONTINUE;
1172 } 1204 }
1173 1205
1174 sfsistat mlfi_body(SMFICTX *ctx, u_char *data, size_t len) 1206 sfsistat mlfi_body(SMFICTX *ctx, u_char *data, size_t len)
1175 { 1207 {
1176 mlfiPriv &priv = *MLFIPRIV; 1208 mlfiPriv &priv = *MLFIPRIV;
1177 if (priv.authenticated) return SMFIS_CONTINUE; 1209 if (priv.authenticated) return SMFIS_CONTINUE;
1178 if (priv.only_whites) return SMFIS_CONTINUE; 1210 if (priv.only_whites) return SMFIS_CONTINUE;
1179 if (priv.want_spamassassin) priv.assassin->mlfi_body(data, len); 1211 if (priv.want_spamassassin) priv.assassin->mlfi_body(data, len);
1180 if (priv.want_dccgrey || priv.want_dccbulk) priv.dccifd->mlfi_body(data, len); 1212 if (priv.want_dccgrey || priv.want_dccbulk) priv.dccifd->mlfi_body(data, len);
1181 priv.scanner->scan(data, len); 1213 priv.scanner->scan(data, len);
1182 return SMFIS_CONTINUE; 1214 return SMFIS_CONTINUE;
1183 } 1215 }
1184 1216
1185 sfsistat mlfi_eom(SMFICTX *ctx) 1217 sfsistat mlfi_eom(SMFICTX *ctx)
1186 { 1218 {
1187 sfsistat rc; 1219 sfsistat rc;
1188 mlfiPriv &priv = *MLFIPRIV; 1220 mlfiPriv &priv = *MLFIPRIV;
1189 CONFIG &dc = *priv.pc; 1221 CONFIG &dc = *priv.pc;
1190 char *host = NULL; 1222 char *host = NULL;
1191 int ip; 1223 int ip;
1192 status st; 1224 status st;
1193 // process end of message 1225 // process end of message
1194 priv.eom = true; 1226 priv.eom = true;
1195 if (priv.authenticated || priv.only_whites) rc = SMFIS_CONTINUE; 1227 if (priv.authenticated || priv.only_whites) rc = SMFIS_CONTINUE;
1196 else { 1228 else {
1197 // assert env_to not empty, it contains the 1229 // assert env_to not empty, it contains the
1198 // non-whitelisted folks that want content filtering 1230 // non-whitelisted folks that want content filtering
1199 int score = (priv.want_spamassassin) ? priv.assassin->mlfi_eom() : 0; 1231 int score = (priv.want_spamassassin) ? priv.assassin->mlfi_eom() : 0;
1200 bool grey = false; 1232 bool grey = false;
1201 int bulk = 0; 1233 int bulk = 0;
1202 if (priv.want_dccgrey || priv.want_dccbulk) priv.dccifd->mlfi_eom(grey, bulk); 1234 if (priv.want_dccgrey || priv.want_dccbulk) priv.dccifd->mlfi_eom(grey, bulk);
1203 1235
1204 char buf[maxlen]; 1236 char buf[maxlen];
1205 string msg; 1237 string msg;
1206 string_set alive; 1238 string_set alive;
1207 bool random = false; 1239 bool random = false;
1208 int limit = 0; 1240 int limit = 0;
1209 for (context_map::iterator i=priv.env_to.begin(); i!=priv.env_to.end(); i++) { 1241 for (context_map::iterator i=priv.env_to.begin(); i!=priv.env_to.end(); i++) {
1210 char *rcpt = (*i).first; 1242 char *rcpt = (*i).first;
1211 CONTEXT &con = *((*i).second); 1243 CONTEXT &con = *((*i).second);
1212 if (!con.acceptable_content(*priv.memory, score, bulk, msg)) { 1244 if (!con.acceptable_content(*priv.memory, score, bulk, msg)) {
1213 // bad html tags or excessive hosts or 1245 // bad html tags or excessive hosts or
1214 // high spam assassin score or dcc bulk threshold exceedeed 1246 // high spam assassin score or dcc bulk threshold exceedeed
1215 smfi_delrcpt(ctx, rcpt); 1247 smfi_delrcpt(ctx, rcpt);
1216 } 1248 }
1217 else { 1249 else {
1218 alive.insert(rcpt); 1250 alive.insert(rcpt);
1219 random |= con.get_host_random(); 1251 random |= con.get_host_random();
1220 limit = max(limit, con.get_host_limit()); 1252 limit = max(limit, con.get_host_limit());
1221 } 1253 }
1222 } 1254 }
1223 bool rejecting = alive.empty(); // if alive is empty, we must have set msg above in acceptable_content() 1255 bool rejecting = alive.empty(); // if alive is empty, we must have set msg above in acceptable_content()
1224 if (!rejecting) { 1256 if (!rejecting) {
1225 char *fmt, *found; 1257 char *fmt, *found;
1226 if (check_hosts(priv, random, limit, fmt, host, ip, found)) { 1258 if (check_hosts(priv, random, limit, fmt, host, ip, found)) {
1227 if (found) { 1259 if (found) {
1228 // uribl style 1260 // uribl style
1229 snprintf(buf, sizeof(buf), fmt, host, found); 1261 snprintf(buf, sizeof(buf), fmt, host, found);
1230 } 1262 }
1231 else { 1263 else {
1232 // dnsbl style 1264 // dnsbl style
1233 char adr[sizeof "255.255.255.255 "]; 1265 char adr[sizeof "255.255.255.255 "];
1234 adr[0] = '\0'; 1266 adr[0] = '\0';
1235 inet_ntop(AF_INET, (const u_char *)&ip, adr, sizeof(adr)); 1267 inet_ntop(AF_INET, (const u_char *)&ip, adr, sizeof(adr));
1236 snprintf(buf, sizeof(buf), fmt, host, adr); 1268 snprintf(buf, sizeof(buf), fmt, host, adr);
1237 } 1269 }
1238 msg = string(buf); 1270 msg = string(buf);
1239 rejecting = true; 1271 rejecting = true;
1240 } 1272 }
1241 } 1273 }
1242 if (!rejecting) { 1274 if (!rejecting) {
1243 if (priv.want_dccgrey && grey) { 1275 if (priv.want_dccgrey && grey) {
1244 smfi_setreply(ctx, "452", "4.2.1", "temporary greylist embargoed"); 1276 smfi_setreply(ctx, "452", "4.2.1", "temporary greylist embargoed");
1245 rc = SMFIS_TEMPFAIL; 1277 rc = SMFIS_TEMPFAIL;
1246 } 1278 }
1247 else rc = SMFIS_CONTINUE; 1279 else rc = SMFIS_CONTINUE;
1248 } 1280 }
1249 else if (!priv.have_whites) { 1281 else if (!priv.have_whites) {
1250 // can reject the entire message 1282 // can reject the entire message
1251 snprintf(buf, sizeof(buf), "%s", msg.c_str()); 1283 snprintf(buf, sizeof(buf), "%s", msg.c_str());
1252 smfi_setreply(ctx, "550", "5.7.1", buf); 1284 smfi_setreply(ctx, "550", "5.7.1", buf);
1253 rc = SMFIS_REJECT; 1285 rc = SMFIS_REJECT;
1254 } 1286 }
1255 else { 1287 else {
1256 // need to accept it but remove the recipients that don't want it 1288 // need to accept it but remove the recipients that don't want it
1257 for (string_set::iterator i=alive.begin(); i!=alive.end(); i++) { 1289 for (string_set::iterator i=alive.begin(); i!=alive.end(); i++) {
1258 char *rcpt = *i; 1290 char *rcpt = *i;
1259 smfi_delrcpt(ctx, rcpt); 1291 smfi_delrcpt(ctx, rcpt);
1260 } 1292 }
1261 rc = SMFIS_CONTINUE; 1293 rc = SMFIS_CONTINUE;
1262 } 1294 }
1263 } 1295 }
1264 // reset for a new message on the same connection 1296 // reset for a new message on the same connection
1265 mlfi_abort(ctx); 1297 mlfi_abort(ctx);
1266 return rc; 1298 return rc;
1267 } 1299 }
1268 1300
1269 sfsistat mlfi_abort(SMFICTX *ctx) 1301 sfsistat mlfi_abort(SMFICTX *ctx)
1270 { 1302 {
1271 mlfiPriv &priv = *MLFIPRIV; 1303 mlfiPriv &priv = *MLFIPRIV;
1272 priv.reset(); 1304 priv.reset();
1273 return SMFIS_CONTINUE; 1305 return SMFIS_CONTINUE;
1274 } 1306 }
1275 1307
1276 sfsistat mlfi_close(SMFICTX *ctx) 1308 sfsistat mlfi_close(SMFICTX *ctx)
1277 { 1309 {
1278 mlfiPriv *priv = MLFIPRIV; 1310 mlfiPriv *priv = MLFIPRIV;
1279 if (!priv) return SMFIS_CONTINUE; 1311 if (!priv) return SMFIS_CONTINUE;
1280 delete priv; 1312 delete priv;
1281 smfi_setpriv(ctx, NULL); 1313 smfi_setpriv(ctx, NULL);
1282 return SMFIS_CONTINUE; 1314 return SMFIS_CONTINUE;
1283 } 1315 }
1284 1316
1285 struct smfiDesc smfilter = 1317 struct smfiDesc smfilter =
1286 { 1318 {
1287 "DNSBL", // filter name 1319 "DNSBL", // filter name
1288 SMFI_VERSION, // version code -- do not change 1320 SMFI_VERSION, // version code -- do not change
1289 SMFIF_DELRCPT, // flags 1321 SMFIF_DELRCPT, // flags
1290 mlfi_connect, // connection info filter 1322 mlfi_connect, // connection info filter
1291 mlfi_helo, // SMTP HELO command filter 1323 mlfi_helo, // SMTP HELO command filter
1292 mlfi_envfrom, // envelope sender filter 1324 mlfi_envfrom, // envelope sender filter
1293 mlfi_envrcpt, // envelope recipient filter 1325 mlfi_envrcpt, // envelope recipient filter
1294 mlfi_header, // header filter 1326 mlfi_header, // header filter
1295 mlfi_eoh, // end of header 1327 mlfi_eoh, // end of header
1296 mlfi_body, // body block filter 1328 mlfi_body, // body block filter
1297 mlfi_eom, // end of message 1329 mlfi_eom, // end of message
1298 mlfi_abort, // message aborted 1330 mlfi_abort, // message aborted
1299 mlfi_close, // connection cleanup 1331 mlfi_close, // connection cleanup
1300 }; 1332 };
1301 1333
1302 1334
1303 //////////////////////////////////////////////// 1335 ////////////////////////////////////////////////
1304 // reload the config 1336 // reload the config
1305 // 1337 //
1306 CONFIG* new_conf(); 1338 CONFIG* new_conf();
1307 CONFIG* new_conf() { 1339 CONFIG* new_conf() {
1308 CONFIG *newc = new CONFIG; 1340 CONFIG *newc = new CONFIG;
1309 pthread_mutex_lock(&config_mutex); 1341 pthread_mutex_lock(&config_mutex);
1310 newc->generation = generation++; 1342 newc->generation = generation++;
1311 pthread_mutex_unlock(&config_mutex); 1343 pthread_mutex_unlock(&config_mutex);
1312 if (debug_syslog) { 1344 if (debug_syslog) {
1313 char buf[maxlen]; 1345 char buf[maxlen];
1314 snprintf(buf, sizeof(buf), "loading configuration generation %d", newc->generation); 1346 snprintf(buf, sizeof(buf), "loading configuration generation %d", newc->generation);
1315 my_syslog(buf); 1347 my_syslog(buf);
1316 } 1348 }
1317 if (load_conf(*newc, "dnsbl.conf")) { 1349 if (load_conf(*newc, "dnsbl.conf")) {
1318 newc->load_time = time(NULL); 1350 newc->load_time = time(NULL);
1319 return newc; 1351 return newc;
1320 } 1352 }
1321 delete newc; 1353 delete newc;
1322 return NULL; 1354 return NULL;
1323 } 1355 }
1324 1356
1325 1357
1326 //////////////////////////////////////////////// 1358 ////////////////////////////////////////////////
1327 // thread to watch the old config files for changes 1359 // thread to watch the old config files for changes
1328 // and reload when needed. 1360 // and reload when needed.
1329 // we also clear the SMTP AUTH recipient counts hourly 1361 // we also clear the SMTP AUTH recipient counts hourly
1330 // 1362 //
1331 extern "C" {void* config_loader(void *arg);} 1363 extern "C" {void* config_loader(void *arg);}
1332 void* config_loader(void *arg) { 1364 void* config_loader(void *arg) {
1333 int loop = 0; 1365 int loop = 0;
1334 while (loader_run) { 1366 while (loader_run) {
1335 sleep(180); // look for modifications every 3 minutes 1367 sleep(180); // look for modifications every 3 minutes
1336 if (!loader_run) break; 1368 if (!loader_run) break;
1337 loop++; 1369 loop++;
1338 if (loop == 20) { 1370 if (loop == 20) {
1339 // three minutes thru each loop, 20 loops per hour 1371 // three minutes thru each loop, 20 loops per hour
1340 // clear the recipient counts 1372 // clear the recipient counts
1341 pthread_mutex_lock(&rate_mutex); 1373 pthread_mutex_lock(&rate_mutex);
1342 for (rcpt_rates::iterator i=rcpt_counts.begin(); i!=rcpt_counts.end(); i++) { 1374 for (rcpt_rates::iterator i=rcpt_counts.begin(); i!=rcpt_counts.end(); i++) {
1343 (*i).second = 0; 1375 (*i).second = 0;
1344 } 1376 }
1345 pthread_mutex_unlock(&rate_mutex); 1377 pthread_mutex_unlock(&rate_mutex);
1346 loop = 0; 1378 loop = 0;
1347 } 1379 }
1348 CONFIG &dc = *config; 1380 CONFIG &dc = *config;
1349 time_t then = dc.load_time; 1381 time_t then = dc.load_time;
1350 struct stat st; 1382 struct stat st;
1351 bool reload = false; 1383 bool reload = false;
1352 for (string_set::iterator i=dc.config_files.begin(); i!=dc.config_files.end(); i++) { 1384 for (string_set::iterator i=dc.config_files.begin(); i!=dc.config_files.end(); i++) {
1353 char *fn = *i; 1385 char *fn = *i;
1354 if (stat(fn, &st)) reload = true; // file disappeared 1386 if (stat(fn, &st)) reload = true; // file disappeared
1355 else if (st.st_mtime > then) reload = true; // file modified 1387 else if (st.st_mtime > then) reload = true; // file modified
1356 if (reload) break; 1388 if (reload) break;
1357 } 1389 }
1358 if (reload) { 1390 if (reload) {
1359 CONFIG *newc = new_conf(); 1391 CONFIG *newc = new_conf();
1360 if (newc) { 1392 if (newc) {
1361 // replace the global config pointer 1393 // replace the global config pointer
1362 pthread_mutex_lock(&config_mutex); 1394 pthread_mutex_lock(&config_mutex);
1363 CONFIG *pc = config; 1395 CONFIG *pc = config;
1364 bool last = pc && (!pc->reference_count); 1396 bool last = pc && (!pc->reference_count);
1365 config = newc; 1397 config = newc;
1366 pthread_mutex_unlock(&config_mutex); 1398 pthread_mutex_unlock(&config_mutex);
1367 if (last) delete pc; // there were no references to this config 1399 if (last) delete pc; // there were no references to this config
1368 } 1400 }
1369 else { 1401 else {
1370 // failed to load new config 1402 // failed to load new config
1371 my_syslog("failed to load new configuration"); 1403 my_syslog("failed to load new configuration");
1372 system("echo 'failed to load new dnsbl configuration from /etc/dnsbl' | mail -s 'error in /etc/dnsbl configuration' root"); 1404 system("echo 'failed to load new dnsbl configuration from /etc/dnsbl' | mail -s 'error in /etc/dnsbl configuration' root");
1373 // update the load time on the current config to prevent complaining every 3 minutes 1405 // update the load time on the current config to prevent complaining every 3 minutes
1374 dc.load_time = time(NULL); 1406 dc.load_time = time(NULL);
1375 } 1407 }
1376 } 1408 }
1377 } 1409 }
1378 return NULL; 1410 return NULL;
1379 } 1411 }
1380 1412
1381 1413
1382 void usage(char *prog); 1414 void usage(char *prog);
1383 void usage(char *prog) 1415 void usage(char *prog)
1384 { 1416 {
1385 fprintf(stderr, "Usage: %s [-d [level]] [-c] [-s] [-e from|to] [-b dccifd-addr] -r port -p sm-sock-addr [-t timeout]\n", prog); 1417 fprintf(stderr, "Usage: %s [-d [level]] [-c] [-s] [-e from|to] [-b dccifd-addr] -r port -p sm-sock-addr [-t timeout]\n", prog);
1386 fprintf(stderr, "where dccifd_addr is for the connection to dccifd\n"); 1418 fprintf(stderr, "where dccifd_addr is for the connection to dccifd\n");
1387 fprintf(stderr, " and should be local-domain-socket-file-name\n"); 1419 fprintf(stderr, " and should be local-domain-socket-file-name\n");
1388 fprintf(stderr, "where port is for the connection to our own dns resolver processes\n"); 1420 fprintf(stderr, "where port is for the connection to our own dns resolver processes\n");
1389 fprintf(stderr, " and should be local-domain-socket-file-name\n"); 1421 fprintf(stderr, " and should be local-domain-socket-file-name\n");
1390 fprintf(stderr, "where sm-sock-addr is for the connection to sendmail\n"); 1422 fprintf(stderr, "where sm-sock-addr is for the connection to sendmail\n");
1391 fprintf(stderr, " and should be one of\n"); 1423 fprintf(stderr, " and should be one of\n");
1392 fprintf(stderr, " inet:port@ip-address\n"); 1424 fprintf(stderr, " inet:port@ip-address\n");
1393 fprintf(stderr, " local:local-domain-socket-file-name\n"); 1425 fprintf(stderr, " local:local-domain-socket-file-name\n");
1394 fprintf(stderr, "-c will load and dump the config to stdout\n"); 1426 fprintf(stderr, "-c will load and dump the config to stdout\n");
1395 fprintf(stderr, "-s will stress test the config loading code by repeating the load/free cycle\n"); 1427 fprintf(stderr, "-s will stress test the config loading code by repeating the load/free cycle\n");
1396 fprintf(stderr, " in an infinte loop.\n"); 1428 fprintf(stderr, " in an infinte loop.\n");
1397 fprintf(stderr, "-d will set the syslog message level, currently 0 to 3\n"); 1429 fprintf(stderr, "-d will set the syslog message level, currently 0 to 3\n");
1398 fprintf(stderr, "-e will print the results of looking up the from and to addresses in the\n"); 1430 fprintf(stderr, "-e will print the results of looking up the from and to addresses in the\n");
1399 fprintf(stderr, " current config. The | character is used to separate the from and to\n"); 1431 fprintf(stderr, " current config. The | character is used to separate the from and to\n");
1400 fprintf(stderr, " addresses in the argument to the -e switch\n"); 1432 fprintf(stderr, " addresses in the argument to the -e switch\n");
1401 } 1433 }
1402 1434
1403 1435
1404 1436
1405 void setup_socket(char *sock); 1437 void setup_socket(char *sock);
1406 void setup_socket(char *sock) { 1438 void setup_socket(char *sock) {
1407 unlink(sock); 1439 unlink(sock);
1408 } 1440 }
1409 1441
1410 1442
1411 /* 1443 /*
1412 * The signal handler function -- only gets called when a SIGCHLD 1444 * The signal handler function -- only gets called when a SIGCHLD
1413 * is received, ie when a child terminates 1445 * is received, ie when a child terminates
1414 */ 1446 */
1415 void sig_chld(int signo) 1447 void sig_chld(int signo)
1416 { 1448 {
1417 int status; 1449 int status;
1418 /* Wait for any child without blocking */ 1450 /* Wait for any child without blocking */
1419 while (waitpid(-1, &status, WNOHANG) > 0) { 1451 while (waitpid(-1, &status, WNOHANG) > 0) {
1420 // ignore child exit status, we only do this to cleanup zombies 1452 // ignore child exit status, we only do this to cleanup zombies
1421 } 1453 }
1422 } 1454 }
1423 1455
1424 1456
1425 int main(int argc, char**argv) 1457 int main(int argc, char**argv)
1426 { 1458 {
1427 token_init(); 1459 token_init();
1428 bool check = false; 1460 bool check = false;
1429 bool stress = false; 1461 bool stress = false;
1430 bool setconn = false; 1462 bool setconn = false;
1431 bool setreso = false; 1463 bool setreso = false;
1432 char *email = NULL; 1464 char *email = NULL;
1433 int c; 1465 int c;
1434 const char *args = "b:r:p:t:e:d:chs"; 1466 const char *args = "b:r:p:t:e:d:chs";
1435 extern char *optarg; 1467 extern char *optarg;
1436 1468
1437 // Process command line options 1469 // Process command line options
1438 while ((c = getopt(argc, argv, args)) != -1) { 1470 while ((c = getopt(argc, argv, args)) != -1) {
1439 switch (c) { 1471 switch (c) {
1440 case 'b': 1472 case 'b':
1441 if (optarg == NULL || *optarg == '\0') { 1473 if (optarg == NULL || *optarg == '\0') {
1442 fprintf(stderr, "Illegal dccifd socket: %s\n", optarg); 1474 fprintf(stderr, "Illegal dccifd socket: %s\n", optarg);
1443 exit(EX_USAGE); 1475 exit(EX_USAGE);
1444 } 1476 }
1445 dccifd_port = strdup(optarg); 1477 dccifd_port = strdup(optarg);
1446 break; 1478 break;
1447 1479
1448 case 'r': 1480 case 'r':
1449 if (optarg == NULL || *optarg == '\0') { 1481 if (optarg == NULL || *optarg == '\0') {
1450 fprintf(stderr, "Illegal resolver socket: %s\n", optarg); 1482 fprintf(stderr, "Illegal resolver socket: %s\n", optarg);
1451 exit(EX_USAGE); 1483 exit(EX_USAGE);
1452 } 1484 }
1453 resolver_port = strdup(optarg); 1485 resolver_port = strdup(optarg);
1454 setup_socket(resolver_port); 1486 setup_socket(resolver_port);
1455 setreso = true; 1487 setreso = true;
1456 break; 1488 break;
1457 1489
1458 case 'p': 1490 case 'p':
1459 if (optarg == NULL || *optarg == '\0') { 1491 if (optarg == NULL || *optarg == '\0') {
1460 fprintf(stderr, "Illegal sendmail socket: %s\n", optarg); 1492 fprintf(stderr, "Illegal sendmail socket: %s\n", optarg);
1461 exit(EX_USAGE); 1493 exit(EX_USAGE);
1462 } 1494 }
1463 if (smfi_setconn(optarg) == MI_FAILURE) { 1495 if (smfi_setconn(optarg) == MI_FAILURE) {
1464 fprintf(stderr, "smfi_setconn failed\n"); 1496 fprintf(stderr, "smfi_setconn failed\n");
1465 exit(EX_SOFTWARE); 1497 exit(EX_SOFTWARE);
1466 } 1498 }
1467 if (strncasecmp(optarg, "unix:", 5) == 0) setup_socket(optarg + 5); 1499 if (strncasecmp(optarg, "unix:", 5) == 0) setup_socket(optarg + 5);
1468 else if (strncasecmp(optarg, "local:", 6) == 0) setup_socket(optarg + 6); 1500 else if (strncasecmp(optarg, "local:", 6) == 0) setup_socket(optarg + 6);
1469 setconn = true; 1501 setconn = true;
1470 break; 1502 break;
1471 1503
1472 case 't': 1504 case 't':
1473 if (optarg == NULL || *optarg == '\0') { 1505 if (optarg == NULL || *optarg == '\0') {
1474 fprintf(stderr, "Illegal timeout: %s\n", optarg); 1506 fprintf(stderr, "Illegal timeout: %s\n", optarg);
1475 exit(EX_USAGE); 1507 exit(EX_USAGE);
1476 } 1508 }
1477 if (smfi_settimeout(atoi(optarg)) == MI_FAILURE) { 1509 if (smfi_settimeout(atoi(optarg)) == MI_FAILURE) {
1478 fprintf(stderr, "smfi_settimeout failed\n"); 1510 fprintf(stderr, "smfi_settimeout failed\n");
1479 exit(EX_SOFTWARE); 1511 exit(EX_SOFTWARE);
1480 } 1512 }
1481 break; 1513 break;
1482 1514
1483 case 'e': 1515 case 'e':
1484 if (email) free(email); 1516 if (email) free(email);
1485 email = strdup(optarg); 1517 email = strdup(optarg);
1486 break; 1518 break;
1487 1519
1488 case 'c': 1520 case 'c':
1489 check = true; 1521 check = true;
1490 break; 1522 break;
1491 1523
1492 case 's': 1524 case 's':
1493 stress = true; 1525 stress = true;
1494 break; 1526 break;
1495 1527
1496 case 'd': 1528 case 'd':
1497 if (optarg == NULL || *optarg == '\0') debug_syslog = 1; 1529 if (optarg == NULL || *optarg == '\0') debug_syslog = 1;
1498 else debug_syslog = atoi(optarg); 1530 else debug_syslog = atoi(optarg);
1499 break; 1531 break;
1500 1532
1501 case 'h': 1533 case 'h':
1502 default: 1534 default:
1503 usage(argv[0]); 1535 usage(argv[0]);
1504 exit(EX_USAGE); 1536 exit(EX_USAGE);
1505 } 1537 }
1506 } 1538 }
1507 1539
1508 if (check) { 1540 if (check) {
1509 use_syslog = false; 1541 use_syslog = false;
1510 debug_syslog = 10; 1542 debug_syslog = 10;
1511 CONFIG *conf = new_conf(); 1543 CONFIG *conf = new_conf();
1512 if (conf) { 1544 if (conf) {
1513 conf->dump(); 1545 conf->dump();
1514 delete conf; 1546 delete conf;
1515 clear_strings(); // for valgrind checking 1547 clear_strings(); // for valgrind checking
1516 return 0; 1548 return 0;
1517 } 1549 }
1518 else { 1550 else {
1519 return 1; // config failed to load 1551 return 1; // config failed to load
1520 } 1552 }
1521 } 1553 }
1522 1554
1523 if (stress) { 1555 if (stress) {
1524 fprintf(stdout, "stress testing\n"); 1556 fprintf(stdout, "stress testing\n");
1525 while (1) { 1557 while (1) {
1526 for (int i=0; i<10; i++) { 1558 for (int i=0; i<10; i++) {
1527 CONFIG *conf = new_conf(); 1559 CONFIG *conf = new_conf();
1528 if (conf) delete conf; 1560 if (conf) delete conf;
1529 } 1561 }
1530 fprintf(stdout, "."); 1562 fprintf(stdout, ".");
1531 fflush(stdout); 1563 fflush(stdout);
1532 sleep(1); 1564 sleep(1);
1533 } 1565 }
1534 } 1566 }
1535 1567
1536 if (email) { 1568 if (email) {
1537 char *x = strchr(email, '|'); 1569 char *x = strchr(email, '|');
1538 if (x) { 1570 if (x) {
1539 *x = '\0'; 1571 *x = '\0';
1540 char *from = strdup(email); 1572 char *from = strdup(email);
1541 char *to = strdup(x+1); 1573 char *to = strdup(x+1);
1542 use_syslog = false; 1574 use_syslog = false;
1543 CONFIG *conf = new_conf(); 1575 CONFIG *conf = new_conf();
1544 if (conf) { 1576 if (conf) {
1545 CONTEXTP con = conf->find_context(to); 1577 CONTEXTP con = conf->find_context(to);
1546 char buf[maxlen]; 1578 char buf[maxlen];
1547 fprintf(stdout, "envelope to <%s> finds context %s\n", to, con->get_full_name(buf,maxlen)); 1579 fprintf(stdout, "envelope to <%s> finds context %s\n", to, con->get_full_name(buf,maxlen));
1548 CONTEXTP fc = con->find_context(from); 1580 CONTEXTP fc = con->find_context(from);
1549 fprintf(stdout, "envelope from <%s> finds context %s\n", from, fc->get_full_name(buf,maxlen)); 1581 fprintf(stdout, "envelope from <%s> finds context %s\n", from, fc->get_full_name(buf,maxlen));
1550 char *st = fc->find_from(from); 1582 char *st = fc->find_from(from);
1551 fprintf(stdout, "envelope from <%s> finds status %s\n", from, st); 1583 fprintf(stdout, "envelope from <%s> finds status %s\n", from, st);
1552 delete conf; 1584 delete conf;
1553 } 1585 }
1554 } 1586 }
1555 return 0; 1587 return 0;
1556 } 1588 }
1557 1589
1558 if (!setconn) { 1590 if (!setconn) {
1559 fprintf(stderr, "%s: Missing required -p argument\n", argv[0]); 1591 fprintf(stderr, "%s: Missing required -p argument\n", argv[0]);
1560 usage(argv[0]); 1592 usage(argv[0]);
1561 exit(EX_USAGE); 1593 exit(EX_USAGE);
1562 } 1594 }
1563 1595
1564 if (!setreso) { 1596 if (!setreso) {
1565 fprintf(stderr, "%s: Missing required -r argument\n", argv[0]); 1597 fprintf(stderr, "%s: Missing required -r argument\n", argv[0]);
1566 usage(argv[0]); 1598 usage(argv[0]);
1567 exit(EX_USAGE); 1599 exit(EX_USAGE);
1568 } 1600 }
1569 1601
1570 if (smfi_register(smfilter) == MI_FAILURE) { 1602 if (smfi_register(smfilter) == MI_FAILURE) {
1571 fprintf(stderr, "smfi_register failed\n"); 1603 fprintf(stderr, "smfi_register failed\n");
1572 exit(EX_UNAVAILABLE); 1604 exit(EX_UNAVAILABLE);
1573 } 1605 }
1574 1606
1575 // switch to background mode 1607 // switch to background mode
1576 if (daemon(1,0) < 0) { 1608 if (daemon(1,0) < 0) {
1577 fprintf(stderr, "daemon() call failed\n"); 1609 fprintf(stderr, "daemon() call failed\n");
1578 exit(EX_UNAVAILABLE); 1610 exit(EX_UNAVAILABLE);
1579 } 1611 }
1580 1612
1581 // write the pid 1613 // write the pid
1582 const char *pidpath = "/var/run/dnsbl.pid"; 1614 const char *pidpath = "/var/run/dnsbl.pid";
1583 unlink(pidpath); 1615 unlink(pidpath);
1584 FILE *f = fopen(pidpath, "w"); 1616 FILE *f = fopen(pidpath, "w");
1585 if (f) { 1617 if (f) {
1586 #ifdef linux 1618 #ifdef linux
1587 // from a comment in the DCC source code: 1619 // from a comment in the DCC source code:
1588 // Linux threads are broken. Signals given the 1620 // Linux threads are broken. Signals given the
1589 // original process are delivered to only the 1621 // original process are delivered to only the
1590 // thread that happens to have that PID. The 1622 // thread that happens to have that PID. The
1591 // sendmail libmilter thread that needs to hear 1623 // sendmail libmilter thread that needs to hear
1592 // SIGINT and other signals does not, and that breaks 1624 // SIGINT and other signals does not, and that breaks
1593 // scripts that need to stop milters. 1625 // scripts that need to stop milters.
1594 // However, signaling the process group works. 1626 // However, signaling the process group works.
1595 fprintf(f, "-%d\n", (u_int)getpgrp()); 1627 fprintf(f, "-%d\n", (u_int)getpgrp());
1596 #else 1628 #else
1597 fprintf(f, "%d\n", (u_int)getpid()); 1629 fprintf(f, "%d\n", (u_int)getpid());
1598 #endif 1630 #endif
1599 fclose(f); 1631 fclose(f);
1600 } 1632 }
1601 1633
1602 // initialize the thread sync objects 1634 // initialize the thread sync objects
1603 pthread_mutex_init(&config_mutex, 0); 1635 pthread_mutex_init(&config_mutex, 0);
1604 pthread_mutex_init(&syslog_mutex, 0); 1636 pthread_mutex_init(&syslog_mutex, 0);
1605 pthread_mutex_init(&resolve_mutex, 0); 1637 pthread_mutex_init(&resolve_mutex, 0);
1606 pthread_mutex_init(&fd_pool_mutex, 0); 1638 pthread_mutex_init(&fd_pool_mutex, 0);
1607 pthread_mutex_init(&verifier_mutex, 0); 1639 pthread_mutex_init(&verifier_mutex, 0);
1608 pthread_mutex_init(&whitelister_mutex, 0); 1640 pthread_mutex_init(&whitelister_mutex, 0);
1609 1641
1610 // drop root privs 1642 // drop root privs
1611 struct passwd *pw = getpwnam("dnsbl"); 1643 struct passwd *pw = getpwnam("dnsbl");
1612 if (pw) { 1644 if (pw) {
1613 if (setgid(pw->pw_gid) == -1) { 1645 if (setgid(pw->pw_gid) == -1) {
1614 my_syslog("failed to switch to group dnsbl"); 1646 my_syslog("failed to switch to group dnsbl");
1615 } 1647 }
1616 if (setuid(pw->pw_uid) == -1) { 1648 if (setuid(pw->pw_uid) == -1) {
1617 my_syslog("failed to switch to user dnsbl"); 1649 my_syslog("failed to switch to user dnsbl");
1618 } 1650 }
1619 } 1651 }
1620 1652
1621 // load the initial config 1653 // load the initial config
1622 config = new_conf(); 1654 config = new_conf();
1623 if (!config) { 1655 if (!config) {
1624 my_syslog("failed to load initial configuration, quitting"); 1656 my_syslog("failed to load initial configuration, quitting");
1625 exit(1); 1657 exit(1);
1626 } 1658 }
1627 1659
1628 // fork off the resolver listener process 1660 // fork off the resolver listener process
1629 pid_t child = fork(); 1661 pid_t child = fork();
1630 if (child < 0) { 1662 if (child < 0) {
1631 my_syslog("failed to create resolver listener process"); 1663 my_syslog("failed to create resolver listener process");
1632 exit(0); 1664 exit(0);
1633 } 1665 }
1634 if (child == 0) { 1666 if (child == 0) {
1635 // we are the child - dns resolver listener process 1667 // we are the child - dns resolver listener process
1636 resolver_socket = socket(AF_UNIX, SOCK_STREAM, 0); 1668 resolver_socket = socket(AF_UNIX, SOCK_STREAM, 0);
1637 if (resolver_socket < 0) { 1669 if (resolver_socket < 0) {
1638 my_syslog("child failed to create resolver socket"); 1670 my_syslog("child failed to create resolver socket");
1639 exit(0); // failed 1671 exit(0); // failed
1640 } 1672 }
1641 sockaddr_un server; 1673 sockaddr_un server;
1642 memset(&server, '\0', sizeof(server)); 1674 memset(&server, '\0', sizeof(server));
1643 server.sun_family = AF_UNIX; 1675 server.sun_family = AF_UNIX;
1644 strncpy(server.sun_path, resolver_port, sizeof(server.sun_path)-1); 1676 strncpy(server.sun_path, resolver_port, sizeof(server.sun_path)-1);
1645 //try to bind the address to the socket. 1677 //try to bind the address to the socket.
1646 if (bind(resolver_socket, (sockaddr *)&server, sizeof(server)) < 0) { 1678 if (bind(resolver_socket, (sockaddr *)&server, sizeof(server)) < 0) {
1647 // bind failed 1679 // bind failed
1648 shutdown(resolver_socket, SHUT_RDWR); 1680 shutdown(resolver_socket, SHUT_RDWR);
1649 close(resolver_socket); 1681 close(resolver_socket);
1650 my_syslog("child failed to bind resolver socket"); 1682 my_syslog("child failed to bind resolver socket");
1651 exit(0); // failed 1683 exit(0); // failed
1652 } 1684 }
1653 //listen on the socket. 1685 //listen on the socket.
1654 if (listen(resolver_socket, 10) < 0) { 1686 if (listen(resolver_socket, 10) < 0) {
1655 // listen failed 1687 // listen failed
1656 shutdown(resolver_socket, SHUT_RDWR); 1688 shutdown(resolver_socket, SHUT_RDWR);
1657 close(resolver_socket); 1689 close(resolver_socket);
1658 my_syslog("child failed to listen to resolver socket"); 1690 my_syslog("child failed to listen to resolver socket");
1659 exit(0); // failed 1691 exit(0); // failed
1660 } 1692 }
1661 // setup sigchld handler to prevent zombies 1693 // setup sigchld handler to prevent zombies
1662 struct sigaction act; 1694 struct sigaction act;
1663 act.sa_handler = sig_chld; // Assign sig_chld as our SIGCHLD handler 1695 act.sa_handler = sig_chld; // Assign sig_chld as our SIGCHLD handler
1664 sigemptyset(&act.sa_mask); // We don't want to block any other signals in this example 1696 sigemptyset(&act.sa_mask); // We don't want to block any other signals in this example
1665 act.sa_flags = SA_NOCLDSTOP; // only want children that have terminated 1697 act.sa_flags = SA_NOCLDSTOP; // only want children that have terminated
1666 if (sigaction(SIGCHLD, &act, NULL) < 0) { 1698 if (sigaction(SIGCHLD, &act, NULL) < 0) {
1667 my_syslog("child failed to setup SIGCHLD handler"); 1699 my_syslog("child failed to setup SIGCHLD handler");
1668 exit(0); // failed 1700 exit(0); // failed
1669 } 1701 }
1670 while (true) { 1702 while (true) {
1671 sockaddr_un client; 1703 sockaddr_un client;
1672 socklen_t clientlen = sizeof(client); 1704 socklen_t clientlen = sizeof(client);
1673 int s = accept(resolver_socket, (sockaddr *)&client, &clientlen); 1705 int s = accept(resolver_socket, (sockaddr *)&client, &clientlen);
1674 if (s > 0) { 1706 if (s > 0) {
1675 // accept worked, it did not get cancelled before we could accept it 1707 // accept worked, it did not get cancelled before we could accept it
1676 // fork off a process to handle this connection 1708 // fork off a process to handle this connection
1677 int newchild = fork(); 1709 int newchild = fork();
1678 if (newchild == 0) { 1710 if (newchild == 0) {
1679 // this is the worker process 1711 // this is the worker process
1680 // child does not need the listening socket 1712 // child does not need the listening socket
1681 close(resolver_socket); 1713 close(resolver_socket);
1682 process_resolver_requests(s); 1714 process_resolver_requests(s);
1683 exit(0); 1715 exit(0);
1684 } 1716 }
1685 else { 1717 else {
1686 // this is the parent 1718 // this is the parent
1687 // parent does not need the accepted socket 1719 // parent does not need the accepted socket
1688 close(s); 1720 close(s);
1689 } 1721 }
1690 } 1722 }
1691 } 1723 }
1692 exit(0); // make sure we don't fall thru. 1724 exit(0); // make sure we don't fall thru.
1693 } 1725 }
1694 else { 1726 else {
1695 sleep(2); // allow child to get started 1727 sleep(2); // allow child to get started
1696 } 1728 }
1697 1729
1698 // only create threads after the fork() in daemon 1730 // only create threads after the fork() in daemon
1699 pthread_t tid; 1731 pthread_t tid;
1700 if (pthread_create(&tid, 0, config_loader, 0)) 1732 if (pthread_create(&tid, 0, config_loader, 0))
1701 my_syslog("failed to create config loader thread"); 1733 my_syslog("failed to create config loader thread");
1702 if (pthread_detach(tid)) 1734 if (pthread_detach(tid))
1703 my_syslog("failed to detach config loader thread"); 1735 my_syslog("failed to detach config loader thread");
1704 1736
1705 if (pthread_create(&tid, 0, verify_closer, 0)) 1737 if (pthread_create(&tid, 0, verify_closer, 0))
1706 my_syslog("failed to create verify closer thread"); 1738 my_syslog("failed to create verify closer thread");
1707 if (pthread_detach(tid)) 1739 if (pthread_detach(tid))
1708 my_syslog("failed to detach verify closer thread"); 1740 my_syslog("failed to detach verify closer thread");
1709 1741
1710 if (pthread_create(&tid, 0, whitelister_writer, 0)) 1742 if (pthread_create(&tid, 0, whitelister_writer, 0))
1711 my_syslog("failed to create autowhite writer thread"); 1743 my_syslog("failed to create autowhite writer thread");
1712 if (pthread_detach(tid)) 1744 if (pthread_detach(tid))
1713 my_syslog("failed to detach autowhite writer thread"); 1745 my_syslog("failed to detach autowhite writer thread");
1714 1746
1715 time_t starting = time(NULL); 1747 time_t starting = time(NULL);
1716 int rc = smfi_main(); 1748 int rc = smfi_main();
1717 if ((rc != MI_SUCCESS) && (time(NULL) > starting+5*60)) { 1749 if ((rc != MI_SUCCESS) && (time(NULL) > starting+5*60)) {
1718 my_syslog("trying to restart after smfi_main()"); 1750 my_syslog("trying to restart after smfi_main()");
1719 loader_run = false; // eventually the config loader thread will terminate 1751 loader_run = false; // eventually the config loader thread will terminate
1720 execvp(argv[0], argv); 1752 execvp(argv[0], argv);
1721 } 1753 }
1722 exit((rc == MI_SUCCESS) ? 0 : EX_UNAVAILABLE); 1754 exit((rc == MI_SUCCESS) ? 0 : EX_UNAVAILABLE);
1723 } 1755 }
1724 1756