|
1 qregex-20060423.patch |
|
2 |
|
3 Changelog |
|
4 2006 04 23 |
|
5 qregex adds the matched regex pattern to its log entries if the LOGREGEX |
|
6 environment variable is set. |
|
7 |
|
8 2004 07 25 |
|
9 Added the badmailfromnorelay and badmailtonorelay control files. |
|
10 |
|
11 Surrounded addresses in log messages with '<' and '>' to make picking them |
|
12 out of log files with scripts easier. |
|
13 |
|
14 2004 06 01 |
|
15 Updated README.qregex. |
|
16 |
|
17 2004 03 17 |
|
18 Added the badhelo control file. This allows qregex to do pattern matching |
|
19 againt the HELO host name presented by the smtp client. |
|
20 |
|
21 Plugged a memory leak. The two stralloc structures in the bmcheck function in |
|
22 qmail-smtpd have been made static. This prevents the structures from |
|
23 allocating new memory every time the bmcheck function is called. |
|
24 |
|
25 2004 02 07 |
|
26 qregex now ignores empty envelope senders ('mail from' command). Empty envelope |
|
27 senders will not be compared to any regular expressions in the badmailfrom |
|
28 control file and will always be accepted by qregex. Prior to this version it |
|
29 was possible to write regular expressions that would reject mail with empty |
|
30 envelope senders. |
|
31 |
|
32 diff -u --unidirectional-new-file ./netqmail-1.05.orig/netqmail-1.05/hier.c ./netqmail-1.05/netqmail-1.05/hier.c |
|
33 --- ./netqmail-1.05.orig/netqmail-1.05/hier.c 1998-06-15 06:53:16.000000000 -0400 |
|
34 +++ ./netqmail-1.05/netqmail-1.05/hier.c 2006-04-22 21:45:16.106777997 -0400 |
|
35 @@ -76,6 +76,7 @@ |
|
36 c(auto_qmail,"boot","binm3+df",auto_uido,auto_gidq,0755); |
|
37 |
|
38 c(auto_qmail,"doc","FAQ",auto_uido,auto_gidq,0644); |
|
39 + c(auto_qmail,"doc","README.qregex",auto_uido,auto_gidq,0644); |
|
40 c(auto_qmail,"doc","UPGRADE",auto_uido,auto_gidq,0644); |
|
41 c(auto_qmail,"doc","SENDMAIL",auto_uido,auto_gidq,0644); |
|
42 c(auto_qmail,"doc","INSTALL",auto_uido,auto_gidq,0644); |
|
43 diff -u --unidirectional-new-file ./netqmail-1.05.orig/netqmail-1.05/install-big.c ./netqmail-1.05/netqmail-1.05/install-big.c |
|
44 --- ./netqmail-1.05.orig/netqmail-1.05/install-big.c 1998-06-15 06:53:16.000000000 -0400 |
|
45 +++ ./netqmail-1.05/netqmail-1.05/install-big.c 2006-04-22 21:45:16.107777820 -0400 |
|
46 @@ -76,6 +76,7 @@ |
|
47 c(auto_qmail,"boot","binm3+df",auto_uido,auto_gidq,0755); |
|
48 |
|
49 c(auto_qmail,"doc","FAQ",auto_uido,auto_gidq,0644); |
|
50 + c(auto_qmail,"doc","README.qregex",auto_uido,auto_gidq,0644); |
|
51 c(auto_qmail,"doc","UPGRADE",auto_uido,auto_gidq,0644); |
|
52 c(auto_qmail,"doc","SENDMAIL",auto_uido,auto_gidq,0644); |
|
53 c(auto_qmail,"doc","INSTALL",auto_uido,auto_gidq,0644); |
|
54 diff -u --unidirectional-new-file ./netqmail-1.05.orig/netqmail-1.05/Makefile ./netqmail-1.05/netqmail-1.05/Makefile |
|
55 --- ./netqmail-1.05.orig/netqmail-1.05/Makefile 2004-06-04 21:51:58.000000000 -0400 |
|
56 +++ ./netqmail-1.05/netqmail-1.05/Makefile 2006-04-22 21:45:16.109777466 -0400 |
|
57 @@ -1532,16 +1532,16 @@ |
|
58 ./compile qmail-showctl.c |
|
59 |
|
60 qmail-smtpd: \ |
|
61 -load qmail-smtpd.o rcpthosts.o commands.o timeoutread.o \ |
|
62 +load qmail-smtpd.o rcpthosts.o qregex.o commands.o timeoutread.o \ |
|
63 timeoutwrite.o ip.o ipme.o ipalloc.o control.o constmap.o received.o \ |
|
64 date822fmt.o now.o qmail.o cdb.a fd.a wait.a datetime.a getln.a \ |
|
65 -open.a sig.a case.a env.a stralloc.a alloc.a substdio.a error.a str.a \ |
|
66 +open.a sig.a case.a env.a stralloc.a alloc.a strerr.a substdio.a error.a str.a \ |
|
67 fs.a auto_qmail.o socket.lib |
|
68 - ./load qmail-smtpd rcpthosts.o commands.o timeoutread.o \ |
|
69 + ./load qmail-smtpd qregex.o rcpthosts.o commands.o timeoutread.o \ |
|
70 timeoutwrite.o ip.o ipme.o ipalloc.o control.o constmap.o \ |
|
71 received.o date822fmt.o now.o qmail.o cdb.a fd.a wait.a \ |
|
72 datetime.a getln.a open.a sig.a case.a env.a stralloc.a \ |
|
73 - alloc.a substdio.a error.a str.a fs.a auto_qmail.o `cat \ |
|
74 + alloc.a strerr.a substdio.a error.a str.a fs.a auto_qmail.o `cat \ |
|
75 socket.lib` |
|
76 |
|
77 qmail-smtpd.0: \ |
|
78 @@ -1681,6 +1681,10 @@ |
|
79 constmap.h stralloc.h gen_alloc.h rcpthosts.h |
|
80 ./compile rcpthosts.c |
|
81 |
|
82 +qregex.o: \ |
|
83 +compile qregex.c qregex.h |
|
84 + ./compile qregex.c |
|
85 + |
|
86 readsubdir.o: \ |
|
87 compile readsubdir.c readsubdir.h direntry.h fmt.h scan.h str.h \ |
|
88 auto_split.h |
|
89 diff -u --unidirectional-new-file ./netqmail-1.05.orig/netqmail-1.05/qmail-control.9 ./netqmail-1.05/netqmail-1.05/qmail-control.9 |
|
90 --- ./netqmail-1.05.orig/netqmail-1.05/qmail-control.9 1998-06-15 06:53:16.000000000 -0400 |
|
91 +++ ./netqmail-1.05/netqmail-1.05/qmail-control.9 2006-04-22 21:45:16.109777466 -0400 |
|
92 @@ -20,7 +20,11 @@ |
|
93 |
|
94 Comments are allowed |
|
95 in |
|
96 +.IR badhelo , |
|
97 .IR badmailfrom , |
|
98 +.IR badmailfromnorelay , |
|
99 +.IR badmailto , |
|
100 +.IR badmailtonorelay , |
|
101 .IR locals , |
|
102 .IR percenthack , |
|
103 .IR qmqpservers , |
|
104 @@ -40,7 +44,11 @@ |
|
105 .ta 5c 10c |
|
106 control default used by |
|
107 |
|
108 +.I badhelo \fR(none) \fRqmail-smtpd |
|
109 .I badmailfrom \fR(none) \fRqmail-smtpd |
|
110 +.I badmailfromnorelay \fR(none) \fRqmail-smtpd |
|
111 +.I badmailto \fR(none) \fRqmail-smtpd |
|
112 +.I badmailtonorelay \fR(none) \fRqmail-smtpd |
|
113 .I bouncefrom \fRMAILER-DAEMON \fRqmail-send |
|
114 .I bouncehost \fIme \fRqmail-send |
|
115 .I concurrencylocal \fR10 \fRqmail-send |
|
116 diff -u --unidirectional-new-file ./netqmail-1.05.orig/netqmail-1.05/qmail-showctl.c ./netqmail-1.05/netqmail-1.05/qmail-showctl.c |
|
117 --- ./netqmail-1.05.orig/netqmail-1.05/qmail-showctl.c 1998-06-15 06:53:16.000000000 -0400 |
|
118 +++ ./netqmail-1.05/netqmail-1.05/qmail-showctl.c 2006-04-22 21:45:16.110777288 -0400 |
|
119 @@ -214,7 +214,11 @@ |
|
120 _exit(111); |
|
121 } |
|
122 |
|
123 - do_lst("badmailfrom","Any MAIL FROM is allowed.",""," not accepted in MAIL FROM."); |
|
124 + do_lst("badhelo","Any HELO host name is allowed.",""," HELO host name denied if it matches this pattern."); |
|
125 + do_lst("badmailfrom","Any MAIL FROM is allowed.",""," MAIL FROM denied if it matches this pattern."); |
|
126 + do_lst("badmailfromnorelay","Any MAIL FROM is allowed.",""," MAIL FROM denied if it matches this pattern and RELAYCLIENT is not set."); |
|
127 + do_lst("badmailto","No RCPT TO are specifically denied.",""," RCPT TO denied if it matches this pattern."); |
|
128 + do_lst("badmailtonorelay","No RCPT TO are specifically denied.",""," RCPT TO denied if it matches this pattern and RELAYCLIENT is not set."); |
|
129 do_str("bouncefrom",0,"MAILER-DAEMON","Bounce user name is "); |
|
130 do_str("bouncehost",1,"bouncehost","Bounce host name is "); |
|
131 do_int("concurrencylocal","10","Local concurrency is ",""); |
|
132 @@ -267,7 +271,11 @@ |
|
133 if (str_equal(d->d_name,"..")) continue; |
|
134 if (str_equal(d->d_name,"bouncefrom")) continue; |
|
135 if (str_equal(d->d_name,"bouncehost")) continue; |
|
136 + if (str_equal(d->d_name,"badhelo")) continue; |
|
137 if (str_equal(d->d_name,"badmailfrom")) continue; |
|
138 + if (str_equal(d->d_name,"badmailfromnorelay")) continue; |
|
139 + if (str_equal(d->d_name,"badmailto")) continue; |
|
140 + if (str_equal(d->d_name,"badmailtonorelay")) continue; |
|
141 if (str_equal(d->d_name,"bouncefrom")) continue; |
|
142 if (str_equal(d->d_name,"bouncehost")) continue; |
|
143 if (str_equal(d->d_name,"concurrencylocal")) continue; |
|
144 diff -u --unidirectional-new-file ./netqmail-1.05.orig/netqmail-1.05/qmail-smtpd.8 ./netqmail-1.05/netqmail-1.05/qmail-smtpd.8 |
|
145 --- ./netqmail-1.05.orig/netqmail-1.05/qmail-smtpd.8 1998-06-15 06:53:16.000000000 -0400 |
|
146 +++ ./netqmail-1.05/netqmail-1.05/qmail-smtpd.8 2006-04-22 21:45:16.110777288 -0400 |
|
147 @@ -37,11 +37,26 @@ |
|
148 even though such messages violate the SMTP protocol. |
|
149 .SH "CONTROL FILES" |
|
150 .TP 5 |
|
151 +.I badhelo |
|
152 +Unacceptable HELO/EHLO host names. |
|
153 +.B qmail-smtpd |
|
154 +will reject every recipient address for a message if |
|
155 +the host name is listed in, |
|
156 +or matches a POSIX regular expression pattern listed in, |
|
157 +.IR badhelo . |
|
158 +If the |
|
159 +.B NOBADHELO |
|
160 +environment variable is set, then the contents of |
|
161 +.IR badhelo |
|
162 +will be ignored. |
|
163 +For more information, please have a look at doc/README.qregex. |
|
164 +.TP 5 |
|
165 .I badmailfrom |
|
166 Unacceptable envelope sender addresses. |
|
167 .B qmail-smtpd |
|
168 will reject every recipient address for a message |
|
169 -if the envelope sender address is listed in |
|
170 +if the envelope sender address is listed in, or matches a POSIX regular expression |
|
171 +pattern listed in, |
|
172 .IR badmailfrom . |
|
173 A line in |
|
174 .I badmailfrom |
|
175 @@ -49,6 +64,32 @@ |
|
176 .BR @\fIhost , |
|
177 meaning every address at |
|
178 .IR host . |
|
179 +For more information, please have a look at doc/README.qregex. |
|
180 +.TP 5 |
|
181 +.I badmailfromnorelay |
|
182 +Functions the same as the |
|
183 +.IR badmailfrom |
|
184 +control file but is read only if the |
|
185 +.B RELAYCLIENT |
|
186 +environment variable is not set. |
|
187 +For more information, please have a look at doc/README.qregex. |
|
188 +.TP 5 |
|
189 +.I badmailto |
|
190 +Unacceptable envelope recipient addresses. |
|
191 +.B qmail-smtpd |
|
192 +will reject every recipient address for a message if the recipient address |
|
193 +is listed in, |
|
194 +or matches a POSIX regular expression pattern listed in, |
|
195 +.IR badmailto . |
|
196 +For more information, please have a look at doc/README.qregex. |
|
197 +.TP 5 |
|
198 +.I badmailtonorelay |
|
199 +Functions the same as the |
|
200 +.IR badmailto |
|
201 +control file but is read only if the |
|
202 +.B RELAYCLIENT |
|
203 +environment variable is not set. |
|
204 +For more information, please have a look at doc/README.qregex. |
|
205 .TP 5 |
|
206 .I databytes |
|
207 Maximum number of bytes allowed in a message, |
|
208 diff -u --unidirectional-new-file ./netqmail-1.05.orig/netqmail-1.05/qmail-smtpd.c ./netqmail-1.05/netqmail-1.05/qmail-smtpd.c |
|
209 --- ./netqmail-1.05.orig/netqmail-1.05/qmail-smtpd.c 2004-06-04 21:51:58.000000000 -0400 |
|
210 +++ ./netqmail-1.05/netqmail-1.05/qmail-smtpd.c 2006-04-23 00:12:33.441582382 -0400 |
|
211 @@ -23,6 +23,15 @@ |
|
212 #include "timeoutread.h" |
|
213 #include "timeoutwrite.h" |
|
214 #include "commands.h" |
|
215 +#include "qregex.h" |
|
216 +#include "strerr.h" |
|
217 + |
|
218 +#define BMCHECK_BMF 0 |
|
219 +#define BMCHECK_BMFNR 1 |
|
220 +#define BMCHECK_BMT 2 |
|
221 +#define BMCHECK_BMTNR 3 |
|
222 +#define BMCHECK_BHELO 4 |
|
223 + |
|
224 |
|
225 #define MAXHOPS 100 |
|
226 unsigned int databytes = 0; |
|
227 @@ -49,7 +58,9 @@ |
|
228 void die_ipme() { out("421 unable to figure out my IP addresses (#4.3.0)\r\n"); flush(); _exit(1); } |
|
229 void straynewline() { out("451 See http://pobox.com/~djb/docs/smtplf.html.\r\n"); flush(); _exit(1); } |
|
230 |
|
231 -void err_bmf() { out("553 sorry, your envelope sender is in my badmailfrom list (#5.7.1)\r\n"); } |
|
232 +void err_bmf() { out("553 sorry, your envelope sender has been denied (#5.7.1)\r\n"); } |
|
233 +void err_bmt() { out("553 sorry, your envelope recipient has been denied (#5.7.1)\r\n"); } |
|
234 +void err_bhelo() { out("553 sorry, your HELO host name has been denied (#5.7.1)\r\n"); } |
|
235 void err_nogateway() { out("553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)\r\n"); } |
|
236 void err_unimpl(arg) char *arg; { out("502 unimplemented (#5.5.1)\r\n"); } |
|
237 void err_syntax() { out("555 syntax error (#5.5.4)\r\n"); } |
|
238 @@ -93,9 +104,24 @@ |
|
239 |
|
240 int liphostok = 0; |
|
241 stralloc liphost = {0}; |
|
242 + |
|
243 int bmfok = 0; |
|
244 stralloc bmf = {0}; |
|
245 -struct constmap mapbmf; |
|
246 + |
|
247 +int bmfnrok = 0; |
|
248 +stralloc bmfnr = {0}; |
|
249 + |
|
250 +int bmtok = 0; |
|
251 +stralloc bmt = {0}; |
|
252 + |
|
253 +int bmtnrok = 0; |
|
254 +stralloc bmtnr = {0}; |
|
255 + |
|
256 +int bhelook = 0; |
|
257 +stralloc bhelo = {0}; |
|
258 + |
|
259 +int logregex = 0; |
|
260 +stralloc matchedregex = {0}; |
|
261 |
|
262 void setup() |
|
263 { |
|
264 @@ -114,8 +140,21 @@ |
|
265 |
|
266 bmfok = control_readfile(&bmf,"control/badmailfrom",0); |
|
267 if (bmfok == -1) die_control(); |
|
268 - if (bmfok) |
|
269 - if (!constmap_init(&mapbmf,bmf.s,bmf.len,0)) die_nomem(); |
|
270 + |
|
271 + bmfnrok = control_readfile(&bmfnr,"control/badmailfromnorelay",0); |
|
272 + if (bmfnrok == -1) die_control(); |
|
273 + |
|
274 + bmtok = control_readfile(&bmt,"control/badmailto",0); |
|
275 + if (bmtok == -1) die_control(); |
|
276 + |
|
277 + bmtnrok = control_readfile(&bmtnr,"control/badmailtonorelay",0); |
|
278 + if (bmtnrok == -1) die_control(); |
|
279 + |
|
280 + bhelook = control_readfile(&bhelo, "control/badhelo",0); |
|
281 + if (bhelook == -1) die_control(); |
|
282 + if (env_get("NOBADHELO")) bhelook = 0; |
|
283 + |
|
284 + if (env_get("LOGREGEX")) logregex = 1; |
|
285 |
|
286 if (control_readint(&databytes,"control/databytes") == -1) die_control(); |
|
287 x = env_get("DATABYTES"); |
|
288 @@ -197,14 +236,56 @@ |
|
289 return 1; |
|
290 } |
|
291 |
|
292 -int bmfcheck() |
|
293 +int bmcheck(which) int which; |
|
294 { |
|
295 - int j; |
|
296 - if (!bmfok) return 0; |
|
297 - if (constmap(&mapbmf,addr.s,addr.len - 1)) return 1; |
|
298 - j = byte_rchr(addr.s,addr.len,'@'); |
|
299 - if (j < addr.len) |
|
300 - if (constmap(&mapbmf,addr.s + j,addr.len - j - 1)) return 1; |
|
301 + int i = 0; |
|
302 + int j = 0; |
|
303 + int x = 0; |
|
304 + int negate = 0; |
|
305 + static stralloc bmb = {0}; |
|
306 + static stralloc curregex = {0}; |
|
307 + |
|
308 + if (which == BMCHECK_BMF) { |
|
309 + if (!stralloc_copy(&bmb,&bmf)) die_nomem(); |
|
310 + } else if (which == BMCHECK_BMFNR) { |
|
311 + if (!stralloc_copy(&bmb,&bmfnr)) die_nomem(); |
|
312 + } else if (which == BMCHECK_BMT) { |
|
313 + if (!stralloc_copy(&bmb,&bmt)) die_nomem(); |
|
314 + } else if (which == BMCHECK_BMTNR) { |
|
315 + if (!stralloc_copy(&bmb,&bmtnr)) die_nomem(); |
|
316 + } else if (which == BMCHECK_BHELO) { |
|
317 + if (!stralloc_copy(&bmb,&bhelo)) die_nomem(); |
|
318 + } else { |
|
319 + die_control(); |
|
320 + } |
|
321 + |
|
322 + while (j < bmb.len) { |
|
323 + i = j; |
|
324 + while ((bmb.s[i] != '\0') && (i < bmb.len)) i++; |
|
325 + if (bmb.s[j] == '!') { |
|
326 + negate = 1; |
|
327 + j++; |
|
328 + } |
|
329 + if (!stralloc_copyb(&curregex,bmb.s + j,(i - j))) die_nomem(); |
|
330 + if (!stralloc_0(&curregex)) die_nomem(); |
|
331 + if (which == BMCHECK_BHELO) { |
|
332 + x = matchregex(helohost.s, curregex.s); |
|
333 + } else { |
|
334 + x = matchregex(addr.s, curregex.s); |
|
335 + } |
|
336 + if ((negate) && (x == 0)) { |
|
337 + if (!stralloc_copyb(&matchedregex,bmb.s + j - 1,(i - j + 1))) die_nomem(); |
|
338 + if (!stralloc_0(&matchedregex)) die_nomem(); |
|
339 + return 1; |
|
340 + } |
|
341 + if (!(negate) && (x > 0)) { |
|
342 + if (!stralloc_copyb(&matchedregex,bmb.s + j,(i - j))) die_nomem(); |
|
343 + if (!stralloc_0(&matchedregex)) die_nomem(); |
|
344 + return 1; |
|
345 + } |
|
346 + j = i + 1; |
|
347 + negate = 0; |
|
348 + } |
|
349 return 0; |
|
350 } |
|
351 |
|
352 @@ -218,7 +299,9 @@ |
|
353 |
|
354 |
|
355 int seenmail = 0; |
|
356 -int flagbarf; /* defined if seenmail */ |
|
357 +int flagbarfbmf; /* defined if seenmail */ |
|
358 +int flagbarfbmt; |
|
359 +int flagbarfbhelo; |
|
360 stralloc mailfrom = {0}; |
|
361 stralloc rcptto = {0}; |
|
362 |
|
363 @@ -226,11 +309,13 @@ |
|
364 { |
|
365 smtp_greet("250 "); out("\r\n"); |
|
366 seenmail = 0; dohelo(arg); |
|
367 + if (bhelook) flagbarfbhelo = bmcheck(BMCHECK_BHELO); |
|
368 } |
|
369 void smtp_ehlo(arg) char *arg; |
|
370 { |
|
371 smtp_greet("250-"); out("\r\n250-PIPELINING\r\n250 8BITMIME\r\n"); |
|
372 seenmail = 0; dohelo(arg); |
|
373 + if (bhelook) flagbarfbhelo = bmcheck(BMCHECK_BHELO); |
|
374 } |
|
375 void smtp_rset(arg) char *arg; |
|
376 { |
|
377 @@ -240,7 +325,11 @@ |
|
378 void smtp_mail(arg) char *arg; |
|
379 { |
|
380 if (!addrparse(arg)) { err_syntax(); return; } |
|
381 - flagbarf = bmfcheck(); |
|
382 + flagbarfbmf = 0; /* bmcheck is skipped for empty envelope senders */ |
|
383 + if ((bmfok) && (addr.len != 1)) flagbarfbmf = bmcheck(BMCHECK_BMF); |
|
384 + if ((!flagbarfbmf) && (bmfnrok) && (addr.len != 1) && (!relayclient)) { |
|
385 + flagbarfbmf = bmcheck(BMCHECK_BMFNR); |
|
386 + } |
|
387 seenmail = 1; |
|
388 if (!stralloc_copys(&rcptto,"")) die_nomem(); |
|
389 if (!stralloc_copys(&mailfrom,addr.s)) die_nomem(); |
|
390 @@ -250,7 +339,37 @@ |
|
391 void smtp_rcpt(arg) char *arg; { |
|
392 if (!seenmail) { err_wantmail(); return; } |
|
393 if (!addrparse(arg)) { err_syntax(); return; } |
|
394 - if (flagbarf) { err_bmf(); return; } |
|
395 + if (flagbarfbhelo) { |
|
396 + if (logregex) { |
|
397 + strerr_warn6("qmail-smtpd: badhelo: <",helohost.s,"> at ",remoteip," matches pattern: ",matchedregex.s,0); |
|
398 + } else { |
|
399 + strerr_warn4("qmail-smtpd: badhelo: <",helohost.s,"> at ",remoteip,0); |
|
400 + } |
|
401 + err_bhelo(); |
|
402 + return; |
|
403 + } |
|
404 + if (flagbarfbmf) { |
|
405 + if (logregex) { |
|
406 + strerr_warn6("qmail-smtpd: badmailfrom: <",mailfrom.s,"> at ",remoteip," matches pattern: ",matchedregex.s,0); |
|
407 + } else { |
|
408 + strerr_warn4("qmail-smtpd: badmailfrom: <",mailfrom.s,"> at ",remoteip,0); |
|
409 + } |
|
410 + err_bmf(); |
|
411 + return; |
|
412 + } |
|
413 + if (bmtok) flagbarfbmt = bmcheck(BMCHECK_BMT); |
|
414 + if ((!flagbarfbmt) && (bmtnrok) && (!relayclient)) { |
|
415 + flagbarfbmt = bmcheck(BMCHECK_BMTNR); |
|
416 + } |
|
417 + if (flagbarfbmt) { |
|
418 + if (logregex) { |
|
419 + strerr_warn6("qmail-smtpd: badmailto: <",addr.s,"> at ",remoteip," matches pattern: ",matchedregex.s,0); |
|
420 + } else { |
|
421 + strerr_warn4("qmail-smtpd: badmailto: <",addr.s,"> at ",remoteip,0); |
|
422 + } |
|
423 + err_bmt(); |
|
424 + return; |
|
425 + } |
|
426 if (relayclient) { |
|
427 --addr.len; |
|
428 if (!stralloc_cats(&addr,relayclient)) die_nomem(); |
|
429 diff -u --unidirectional-new-file ./netqmail-1.05.orig/netqmail-1.05/qregex.c ./netqmail-1.05/netqmail-1.05/qregex.c |
|
430 --- ./netqmail-1.05.orig/netqmail-1.05/qregex.c 1969-12-31 19:00:00.000000000 -0500 |
|
431 +++ ./netqmail-1.05/netqmail-1.05/qregex.c 2006-04-22 21:45:16.112776934 -0400 |
|
432 @@ -0,0 +1,57 @@ |
|
433 +/* |
|
434 + * qregex (v2) |
|
435 + * $Id: qregex.c,v 2.1 2001/12/28 07:05:21 evan Exp $ |
|
436 + * |
|
437 + * Author : Evan Borgstrom (evan at unixpimps dot org) |
|
438 + * Created : 2001/12/14 23:08:16 |
|
439 + * Modified: $Date: 2001/12/28 07:05:21 $ |
|
440 + * Revision: $Revision: 2.1 $ |
|
441 + * |
|
442 + * Do POSIX regex matching on addresses for anti-relay / spam control. |
|
443 + * It logs to the maillog |
|
444 + * See the qregex-readme file included with this tarball. |
|
445 + * If you didn't get this file in a tarball please see the following URL: |
|
446 + * http://www.unixpimps.org/software/qregex |
|
447 + * |
|
448 + * qregex.c is released under a BSD style copyright. |
|
449 + * See http://www.unixpimps.org/software/qregex/copyright.html |
|
450 + * |
|
451 + * Note: this revision follows the coding guidelines set forth by the rest of |
|
452 + * the qmail code and that described at the following URL. |
|
453 + * http://cr.yp.to/qmail/guarantee.html |
|
454 + * |
|
455 + */ |
|
456 + |
|
457 +#include <sys/types.h> |
|
458 +#include <regex.h> |
|
459 +#include "qregex.h" |
|
460 + |
|
461 +#define REGCOMP(X,Y) regcomp(&X, Y, REG_EXTENDED|REG_ICASE) |
|
462 +#define REGEXEC(X,Y) regexec(&X, Y, (size_t)0, (regmatch_t *)0, (int)0) |
|
463 + |
|
464 +int matchregex(char *text, char *regex) { |
|
465 + regex_t qreg; |
|
466 + int retval = 0; |
|
467 + |
|
468 + |
|
469 + /* build the regex */ |
|
470 + if ((retval = REGCOMP(qreg, regex)) != 0) { |
|
471 + regfree(&qreg); |
|
472 + return(-retval); |
|
473 + } |
|
474 + |
|
475 + /* execute the regex */ |
|
476 + if ((retval = REGEXEC(qreg, text)) != 0) { |
|
477 + /* did we just not match anything? */ |
|
478 + if (retval == REG_NOMATCH) { |
|
479 + regfree(&qreg); |
|
480 + return(0); |
|
481 + } |
|
482 + regfree(&qreg); |
|
483 + return(-retval); |
|
484 + } |
|
485 + |
|
486 + /* signal the match */ |
|
487 + regfree(&qreg); |
|
488 + return(1); |
|
489 +} |
|
490 diff -u --unidirectional-new-file ./netqmail-1.05.orig/netqmail-1.05/qregex.h ./netqmail-1.05/netqmail-1.05/qregex.h |
|
491 --- ./netqmail-1.05.orig/netqmail-1.05/qregex.h 1969-12-31 19:00:00.000000000 -0500 |
|
492 +++ ./netqmail-1.05/netqmail-1.05/qregex.h 2006-04-22 21:45:16.112776934 -0400 |
|
493 @@ -0,0 +1,5 @@ |
|
494 +/* simple header file for the matchregex prototype */ |
|
495 +#ifndef _QREGEX_H_ |
|
496 +#define _QREGEX_H_ |
|
497 +int matchregex(char *text, char *regex); |
|
498 +#endif |
|
499 diff -u --unidirectional-new-file ./netqmail-1.05.orig/netqmail-1.05/README.qregex ./netqmail-1.05/netqmail-1.05/README.qregex |
|
500 --- ./netqmail-1.05.orig/netqmail-1.05/README.qregex 1969-12-31 19:00:00.000000000 -0500 |
|
501 +++ ./netqmail-1.05/netqmail-1.05/README.qregex 2006-04-23 00:30:32.466336212 -0400 |
|
502 @@ -0,0 +1,203 @@ |
|
503 +QREGEX (v2) 20060423 - README April 23, 2006 |
|
504 +A Regular Expression matching patch for qmail 1.03 and netqmail |
|
505 + |
|
506 + |
|
507 +OVERVIEW: |
|
508 + |
|
509 +qregex adds the ability to match address evelopes via Regular Expressions (REs) |
|
510 +in the qmail-smtpd process. It has the abiltiy to match `helo/ehlo` (host name), |
|
511 +`mail from` (envelope sender), and `rcpt to` (envelope recipient) commands. |
|
512 +It follows all the base rules that are set out with qmail (ie using control |
|
513 +files) so it makes for easy integretion into an existing setup (see the |
|
514 +install instructions for more info). The v2 is specified because qregex was |
|
515 +re-written to better conform to the security guarantee set forth by the author |
|
516 +of qmail. The original version used stdio.h and stdlib.h for reading the |
|
517 +control files whereas v2 now uses all stralloc functions which are much more |
|
518 +regulated against buffer overruns and the like. |
|
519 +See: http://cr.yp.to/qmail/guarantee.html |
|
520 + |
|
521 + |
|
522 +FEATURES: |
|
523 + |
|
524 +Features of qregex include: |
|
525 + |
|
526 +1. Performs pattern matching on envelope senders and envelope |
|
527 + recipients against REs in the badmailfrom and badmailto control |
|
528 + files. Two additional control files, badmailfromnorelay and |
|
529 + badmailtonorelay, are used for pattern matching when the |
|
530 + RELAYCLIENT environment variable is not set. |
|
531 + |
|
532 +2. Performs pattern matching on the helo/ehlo host name. Setting the |
|
533 + NOBADHELO environment variable prevents the host name from being |
|
534 + compared to the patterns in the badhelo control file. |
|
535 + |
|
536 +3. Matches to patterns are logged. Setting the LOGREGEX environment |
|
537 + variable causes the matched regex pattern to be included in the log. |
|
538 + |
|
539 +4. Matching is case insensitive. |
|
540 + |
|
541 +5. qregex ignores empty envelope senders. An empty envelope sender is not |
|
542 + compared to the patterns in the badmailfrom and badmailfromnorelay |
|
543 + control files and is always accepted. |
|
544 + |
|
545 + |
|
546 +PLATFORMS: |
|
547 + |
|
548 +qregex has been built and tested on the following platforms. I'm sure it won't |
|
549 +have any problems on any platform that qmail will run on (providing they have |
|
550 +a regex interface) but if you run into problems let me know. |
|
551 + |
|
552 + - OpenBSD 3.x |
|
553 + - FreeBSD 4.x, 5.x |
|
554 + - Mandrake Linux 9.x |
|
555 + - SuSE Linux 8.x |
|
556 + |
|
557 + |
|
558 + |
|
559 +INSTALLATION INSTRUCTIONS: |
|
560 + |
|
561 +Installation is very simple, there is only one requirement. You need to use the |
|
562 +GNU version of the patch utility (http://www.gnu.org/software/patch/patch.html). |
|
563 +(For Solaris 8 users it is installed as 'gpatch') |
|
564 + |
|
565 +- If this is a new setup. |
|
566 +Unpack the qmail archive, cd into the qmail-1.03 directory and run |
|
567 +"patch < /path/to/qregex-<version>.patch". Follow the instructions as per the |
|
568 +included qmail INSTALL file. Once you are done come back to this file and read |
|
569 +the section on the control files. |
|
570 + |
|
571 +If you are using netqmail, then unpack the netqmail archive. Run the collate.sh |
|
572 +script and cd into the resulting netqmail-<version> directory. From there, run |
|
573 +"patch < /path/to/qregex-<version>.patch". Complete the netqmail installation |
|
574 +normally. Once you are done, come back to this file and read the section on the |
|
575 +control files. |
|
576 + |
|
577 +- If this is an existing setup. |
|
578 +FIRST: create your control files (see below). |
|
579 +cd into your existing qmail or netqmail source directory. Run |
|
580 +"patch < /path/to/qregex-<version>.patch" then "make qmail-smtpd". Now run |
|
581 +./qmail-smtpd and test your new rules to make sure they work as expected. |
|
582 + |
|
583 +Install the new binary by cd'ing to /var/qmail/bin and as root (in one command) |
|
584 +copy the existing binary to 'qmail-smtpd.old' and copy the new binary from the |
|
585 +source directory to 'qmail-smtpd'. |
|
586 +(ex. cp qmail-smtpd qmail-smtpd.old && cp ~/qmail-1.03/qmail-smtpd qmail-smtpd) |
|
587 + |
|
588 +You can also optionally just run "make setup check" as it will install the |
|
589 +updated documentation and man pages provided with this patch. Stopping qmail |
|
590 +before doing the "make setup check" is always a good idea. |
|
591 + |
|
592 + |
|
593 +LOGGING: |
|
594 + |
|
595 +qregex will log matches to the patterns in the various control files. Log |
|
596 +messages will take these three forms depending on which control file was |
|
597 +matched: |
|
598 + |
|
599 +badhelo |
|
600 +qmail-smtpd: badhelo: <host> at <remote IP> |
|
601 + |
|
602 +badmailfrom and badmailfromnorelay |
|
603 +qmail-smtpd: badmailfrom: <sender address> at <remote IP> |
|
604 + |
|
605 +badmailto and badmailtonorelay |
|
606 +qmail-smtpd: badmailto: <rcpt address> at <remote IP> |
|
607 + |
|
608 +When the LOGREGEX environment variable is set, the matched pattern will |
|
609 +be included in the log. Log messages will have the regex pattern appended |
|
610 +to them. For example, a badhelo log message will look like this: |
|
611 + |
|
612 +qmail-smtpd: badhelo: <host> at <remote IP> matches pattern: <regex> |
|
613 + |
|
614 + |
|
615 +CONTROL FILES: |
|
616 + |
|
617 +qregex provides you with five control files. None of these control files |
|
618 +is mandatory and you can use them in any combination you choose in your setup. |
|
619 + |
|
620 +The "control/badmailfrom" and "control/badmailto" files contain your REs for |
|
621 +matching against the 'mail from' (envelope sender) and 'rcpt to' (envelope |
|
622 +recipient) smtp commands respectively. |
|
623 +The "control/badmailfromnorelay" and "control/badmailtonorelay" match against |
|
624 +the same commands but are read only when the RELAYCLIENT environment variable |
|
625 +is not set. |
|
626 +The "control/badhelo" file matches against the 'helo/ehlo' smtp command. |
|
627 + |
|
628 +If you prefer you can symlink the badmailfrom and badmailto control files |
|
629 +(ln -s badmailfrom badmailto) and maintain fewer sets of rules. Beware |
|
630 +this might cause problems in certain setups. |
|
631 + |
|
632 + Here's an example "badhelo" file. |
|
633 + ----------------------------------- |
|
634 + # block host strings with no dot (not a FQDN) |
|
635 + !\. |
|
636 + ----------------------------------- |
|
637 + |
|
638 + An example "badmailfrom" file. |
|
639 + ----------------------------------- |
|
640 + # this will drop everything containing the string |
|
641 + # bad.domain.com or Bad.Domain.Com or BAD.domain.COM |
|
642 + bad\.domain\.com |
|
643 + # force users to fully qualify themselves |
|
644 + # (i.e. deny "user", accept "user@domain") |
|
645 + !@ |
|
646 + ----------------------------------- |
|
647 + |
|
648 + And "badmailto" (a little more interesting) |
|
649 + ----------------------------------- |
|
650 + # must not contain invalid characters, brakets or multiple @'s |
|
651 + [!%#:*^(){}] |
|
652 + @.*@ |
|
653 + ----------------------------------- |
|
654 + |
|
655 +You can use the non-RE character '!' to start an RE as a signal to qregex to |
|
656 +negate the action. As used above in the badmailfrom file, by negating the '@' |
|
657 +symbol qregex will signal qmail-smtpd to deny the 'mail from' command whenever |
|
658 +the address doesn't contain an @ symbol. When used inside a bracket expression, |
|
659 +the '!' character looses this special meaning. This is shown in the badmailto |
|
660 +example. |
|
661 + |
|
662 +The norelay control files follow the same rules as the other control files but |
|
663 +are intended to address two specific scenarios. |
|
664 +The badmailfromnorelay file can be used to block mail trying to spoof a domain |
|
665 +hosted on your mail server. It prevents a mail client that is not allowed to |
|
666 +relay email through your server from using one of your hosted domains as its |
|
667 +envelope sender. |
|
668 +The badmailtonorelay file can be used to create email addresses that cannot |
|
669 +receive mail from any source not allowed to relay email through your server. |
|
670 +This is handy for creating email addresses for use only within your own |
|
671 +domain(s) that can't receive spam from the world at large. |
|
672 + |
|
673 + |
|
674 +INTERNALS: |
|
675 + |
|
676 +qregex (or regexmatch as the function is called) will be called during the |
|
677 +`helo/ehlo`, `rcpt to` and `mail from` handling routines in "qmail-smtpd.c". |
|
678 +When called, it will read the proper control file then one by one compile and |
|
679 +execute the regex on the string passed into qmail-smtpd. If the regex matches |
|
680 +it returns TRUE (1) and the qmail-smtpd process will deny the user the ability |
|
681 +to continue. If you change anything and think it betters this patch please |
|
682 +send me a new diff file so I can take a peek. |
|
683 + |
|
684 + |
|
685 +CONTACT: |
|
686 +qregex is maintained by: |
|
687 + Andrew St. Jean |
|
688 + andrew@arda.homeunix.net |
|
689 + www.arda.homeunix.net/store/qmail/ |
|
690 + |
|
691 +Contributers to qregex: |
|
692 + Jeremy Kitchen |
|
693 + kitchen at scriptkitchen dot com |
|
694 + http://www.scriptkitchen.com/qmail |
|
695 + |
|
696 + Alex Pleiner |
|
697 + alex@zeitform.de |
|
698 + zeitform Internet Dienste |
|
699 + http://www.zeitform.de/ |
|
700 + |
|
701 + Thanos Massias |
|
702 + |
|
703 +Original qregex patch written by: |
|
704 + Evan Borgstrom |
|
705 + evan at unixpimps dot org |
|
706 diff -u --unidirectional-new-file ./netqmail-1.05.orig/netqmail-1.05/TARGETS ./netqmail-1.05/netqmail-1.05/TARGETS |
|
707 --- ./netqmail-1.05.orig/netqmail-1.05/TARGETS 1998-06-15 06:53:16.000000000 -0400 |
|
708 +++ ./netqmail-1.05/netqmail-1.05/TARGETS 2006-04-22 21:45:16.113776757 -0400 |
|
709 @@ -252,6 +252,7 @@ |
|
710 qmail-qmtpd |
|
711 qmail-smtpd.o |
|
712 qmail-smtpd |
|
713 +qregex.o |
|
714 sendmail.o |
|
715 sendmail |
|
716 tcp-env.o |