dnsbl: src/dnsbl.cpp comparison

comparison src/dnsbl.cpp @ 90:962a1f8f1d9f stable-5-4

add verify statement to verify addresses with better mx host

author	carl
date	Sun, 18 Sep 2005 10:19:58 -0700
parents	946fc1bcfb2c
children	505e77188317

comparison

equal deleted inserted replaced

-:946fc1bcfb2c
+:962a1f8f1d9f
 		 milter or do anything with the socket.
 -s		 Stress test by loading and deleting the current config in a loop.
 -d		 increase debug level
 -e f|t	 Print the results of looking up from address f and to address
 		 t in the current config
-TODO:
-1) Add option for using smtp connections to verify addresses from backup
-mx machines. This allows the backup mx to learn the valid addresses
-on the primary machine.
 */
 // from sendmail sample
 std::set<int>	 fd_pool;
 int    NULL_SOCKET		 = -1;
 char  *resolver_port	 = NULL;		 // unix domain socket to talk to the dns resolver process
 int    resolver_socket	 = NULL_SOCKET;  // socket used to listen for resolver requests
-time_t ERROR_SOCKET_TIME = 60;			 // number of seconds between attempts to open the spam filter socket
+time_t ERROR_SOCKET_TIME = 60;			 // number of seconds between attempts to open a socket to the dns resolver process
 time_t last_error_time;
 int    resolver_sock_count = 0; 		 // protected with fd_pool_mutex
 int    resolver_pool_size  = 0; 		 // protected with fd_pool_mutex
 	int maxq = sizeof(question);
 	while (true) {
 		// read a question
 		int rs = 0;
-		while (true) {
+		while (rs < maxq) {
 			int ns = read(socket, question+rs, maxq-rs);
 			if (ns > 0) {
 				rs += ns;
 				if (question[rs-1] == '\0') {
 					// last byte read was the null terminator, we are done
 				shutdown(socket, SHUT_RDWR);
 				close(socket);
 				return;
 			}
 		}
+		question[rs-1] = '\0';  // ensure null termination
 		// find the answer
 #ifdef NS_PACKETSZ
 	  //char text[1000];
 	  //snprintf(text, sizeof(text), "!!child worker process has a question %s", question);
 ////////////////////////////////////////////////
 //	check the dnsbls specified for this recipient
 //
 bool check_dnsbl(mlfiPriv &priv, dnsblp_list &dnsbll, DNSBLP &rejectlist);
 bool check_dnsbl(mlfiPriv &priv, dnsblp_list &dnsbll, DNSBLP &rejectlist) {
-	if (priv.authenticated) return false;
 	for (dnsblp_list::iterator i=dnsbll.begin(); i!=dnsbll.end(); i++) {
 		DNSBLP dp = *i; 	// non null by construction
 		bool st;
 		map<DNSBLP, bool>::iterator f = priv.checked.find(dp);
 		if (f == priv.checked.end()) {
 	return SMFIS_CONTINUE;
 }
 sfsistat mlfi_envfrom(SMFICTX *ctx, char **from)
 {
-	mlfiPriv &priv = *MLFIPRIV;
+	mlfiPriv &priv	   = *MLFIPRIV;
 	priv.mailaddr	   = to_lower_string(from[0]);
 	priv.authenticated = (smfi_getsymval(ctx, "{auth_authen}") != NULL);
 	return SMFIS_CONTINUE;
 }
 	CONFIG &dc = *priv.pc;
 	if (!priv.queueid) priv.queueid = strdup(smfi_getsymval(ctx, "i"));
 	char *rcptaddr	= rcpt[0];
 	char *loto		= to_lower_string(rcptaddr);
 	CONTEXT    &con = *(dc.find_context(loto)->find_context(priv.mailaddr));
+	VERIFYP 	ver = con.find_verify(loto);
 	if (debug_syslog > 1) {
 		char buf[maxlen];
 		char msg[maxlen];
 		snprintf(msg, sizeof(msg), "from <%s> to <%s> using context %s", priv.mailaddr, loto, con.get_full_name(buf,maxlen));
 		my_syslog(&priv, msg);
 	}
+	free(loto);
 	char *fromvalue = con.find_from(priv.mailaddr);
-	free(loto);
 	status st;
-	if (fromvalue == token_black) {
+	if (priv.authenticated) {
+		st = white;
+	}
+	else if (fromvalue == token_black) {
 		st = black;
 	}
 	else if (fromvalue == token_white) {
 		st = white;
 	}
 		char buf[maxlen];
 		snprintf(buf, sizeof(buf), rejectlist->message, adr, adr);
 		smfi_setreply(ctx, "550", "5.7.1", buf);
 		return SMFIS_REJECT;
 	}
-	else if (st == black) {
+	if (st == black) {
 		// reject the recipient based on blacklisting either from or to
 		smfi_setreply(ctx, "550", "5.7.1", "no such user");
 		return SMFIS_REJECT;
 	}
-	else {
+	if (ver && (st != white)) {
-		// accept the recipient
+		// try to verify this from/to pair of addresses since it is not explicitly whitelisted
-		if (!con.get_content_filtering()) st = white;
+		char *loto = to_lower_string(rcptaddr);
-		if (st == oksofar) {
+		bool rc = ver->ok(priv.mailaddr, loto);
-			// but remember the non-whites
+		free(loto);
-			priv.need_content_filter(rcptaddr, con);
+		if (!rc) {
-			priv.only_whites = false;
+			smfi_setreply(ctx, "550", "5.7.1", "no such user");
-		}
+			return SMFIS_REJECT;
-		if (st == white) {
+		}
-			priv.have_whites = true;
+	}
-		}
+	// accept the recipient
-		return SMFIS_CONTINUE;
+	if (!con.get_content_filtering()) st = white;
-	}
+	if (st == oksofar) {
+		// but remember the non-whites
+		priv.need_content_filter(rcptaddr, con);
+		priv.only_whites = false;
+	}
+	if (st == white) {
+		priv.have_whites = true;
+	}
+	return SMFIS_CONTINUE;
 }
 sfsistat mlfi_body(SMFICTX *ctx, u_char *data, size_t len)
 {
 	mlfiPriv &priv = *MLFIPRIV;
 	fprintf(stderr, "        inet:port@ip-address\n");
 	fprintf(stderr, "        local:local-domain-socket-file-name\n");
 	fprintf(stderr, "-c will load and dump the config to stdout\n");
 	fprintf(stderr, "-s will stress test the config loading code by repeating the load/free cycle\n");
 	fprintf(stderr, "        in an infinte loop.\n");
-	fprintf(stderr, "-d will set the syslog message level, currently 0 to 3");
+	fprintf(stderr, "-d will set the syslog message level, currently 0 to 3\n");
 	fprintf(stderr, "-e will print the results of looking up the from and to addresses in the\n");
 	fprintf(stderr, "        current config. The | character is used to separate the from and to\n");
 	fprintf(stderr, "        addresses in the argument to the -e switch\n");
 }
 	pthread_t tid;
 	if (pthread_create(&tid, 0, config_loader, 0))
 		my_syslog("failed to create config loader thread");
 	if (pthread_detach(tid))
 		my_syslog("failed to detach config loader thread");
+	if (pthread_create(&tid, 0, verify_closer, 0))
+		my_syslog("failed to create verify closer thread");
+	if (pthread_detach(tid))
+		my_syslog("failed to detach verify closer thread");
 	time_t starting = time(NULL);
 	int rc = smfi_main();
 	if ((rc != MI_SUCCESS) && (time(NULL) > starting+5*60)) {
 		my_syslog("trying to restart after smfi_main()");

Mercurial > dnsbl

comparison src/dnsbl.cpp @ 90:962a1f8f1d9f stable-5-4