cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- add patches from "MARTIN" to pass sasl auth status to the spam backend

Browse Source 
this will be integrated into the next upstream release.
This commit is contained in:
jasper 2009-11-26 14:02:58 +00:00
parent 86ec40daed
commit e4750f009c
10 changed files with 443 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
mail/smtp-vilter/Makefile
View File

@ -1,9 +1,9 @@
# $OpenBSD: Makefile,v 1.35 2009/09/15 17:37:21 jasper Exp $
# $OpenBSD: Makefile,v 1.36 2009/11/26 14:02:58 jasper Exp $
COMMENT= sendmail milter to scan messages for viruses and spam
DISTNAME= smtp-vilter-1.3.6
PKGNAME= ${DISTNAME}p3
PKGNAME= ${DISTNAME}p4
CATEGORIES= mail

77
mail/smtp-vilter/patches/patch-bin_smtp-vilter_engine_c
View File

@ -1,7 +1,76 @@
$OpenBSD: patch-bin_smtp-vilter_engine_c,v 1.4 2008/07/02 13:34:46 mbalmer Exp $
--- bin/smtp-vilter/engine.c.orig Sun Jan 21 14:09:38 2007
+++ bin/smtp-vilter/engine.c Wed Jul 2 15:31:43 2008
@@ -1764,6 +1764,8 @@ e_main(uid_t uid, gid_t gid, int pipe_m2e[2])
$OpenBSD: patch-bin_smtp-vilter_engine_c,v 1.5 2009/11/26 14:02:58 jasper Exp $
--- bin/smtp-vilter/engine.c.orig Sun Jan 21 13:09:38 2007
+++ bin/smtp-vilter/engine.c Fri Oct 23 09:41:28 2009
@@ -501,18 +501,62 @@ smtp_vilter_envfrom(SMFICTX *ctx, char **argv)
}
}
+ /* report authentication symbol values */
+ if (verbose >= 2)
+ warnx("SASL authentication parameters: {auth_type}=%s, "
+ "{auth_authen}=%s, {auth_ssf}=%s, {auth_author}=%s",
+ smfi_getsymval(ctx, "{auth_type}"),
+ smfi_getsymval(ctx, "{auth_authen}"),
+ smfi_getsymval(ctx, "{auth_ssf}"),
+ smfi_getsymval(ctx, "{auth_author}"));
+
/* Write an artifical Received: from: Header to the message */
if (gethostname(hostname, sizeof(hostname))) {
syslog(LOG_ERR, "can't get local hostname");
strlcpy(hostname, "localhost", sizeof(hostname));
}
- if (conn->clientaddr == NULL)
- fprintf(msg->fp, "Received: from %s by %s\r\n", conn->hostname,
- hostname);
- else
- fprintf(msg->fp, "Received: from %s (%s) by %s\r\n",
- conn->heloname, conn->clientaddr, hostname);
+ if (verbose >= 2)
+ warnx("header_options = 0x%lx", header_options);
+ if (header_options == 0x0L) {
+ /* plain 'Received:' header (legacy behaviour) */
+ if (conn->clientaddr == NULL)
+ fprintf(msg->fp, "Received: from %s by %s\r\n",
+ conn->hostname, hostname);
+ else
+ fprintf(msg->fp, "Received: from %s (%s) by %s\r\n",
+ conn->heloname, conn->clientaddr, hostname);
+ }
+ if (header_options & 0x1L) {
+ /* include SASL auth info in 'Received:' header */
+ if (verbose >= 2)
+ warnx("including SASL auth info in header");
+ if (smfi_getsymval(ctx, "{auth_authen}") != NULL) {
+ /* SASL authenticated sender */
+ if (conn->clientaddr == NULL)
+ fprintf(msg->fp, "Received: from %s "
+ "(Authenticated sender: %s) by %s\r\n",
+ conn->hostname,
+ smfi_getsymval(ctx, "{auth_authen}"),
+ hostname);
+ else
+ fprintf(msg->fp, "Received: from %s (%s) "
+ "(Authenticated sender: %s) by %s\r\n",
+ conn->heloname,
+ conn->clientaddr,
+ smfi_getsymval(ctx, "{auth_authen}"),
+ hostname);
+ } else {
+ /* non authenticated sender */
+ if (conn->clientaddr == NULL)
+ fprintf(msg->fp, "Received: from %s by %s\r\n",
+ conn->hostname, hostname);
+ else
+ fprintf(msg->fp, "Received: from %s (%s) by %s\r\n",
+ conn->heloname, conn->clientaddr, hostname);
+ }
+ }
+
return SMFIS_CONTINUE;
}
@@ -1764,6 +1808,8 @@ e_main(uid_t uid, gid_t gid, int pipe_m2e[2])
syslog(LOG_INFO, "dropped privileges, running as %d:%d", uid, gid);
/* Initialize sendmail milter */

57
mail/smtp-vilter/patches/patch-bin_smtp-vilter_parse_y Normal file
View File

@ -0,0 +1,57 @@
$OpenBSD: patch-bin_smtp-vilter_parse_y,v 1.1 2009/11/26 14:02:58 jasper Exp $
--- bin/smtp-vilter/parse.y.orig Sun Jan 21 13:09:38 2007
+++ bin/smtp-vilter/parse.y Fri Oct 23 16:37:45 2009
@@ -20,6 +20,7 @@
#include <sys/types.h>
#include <sys/time.h>
#include <sys/resource.h>
+#include <sys/limits.h>
#include <ctype.h>
#include <err.h>
@@ -92,6 +93,7 @@ extern char *bindpasswd;
extern int ldap_use_tls;
extern char *statfile;
extern unsigned int stat_interval;
+extern unsigned long header_options;
extern void decode_backend(char *);
extern int pftable_exists(const char *);
@@ -113,7 +115,7 @@ static int viltererrcnt;
%token VIRUS_STRATEGY RECIPIENT_NOTIFICATION SPAM_STRATEGY
%token SPAM_SUBJECT_PREFIX UNWANTED_STRATEGY ERROR_STRATEGY
%token PORT LOGFILE OPTION NOTIFY_ONLY LOGALL STATFILE
-%token DISCARD MARK NOTIFY_RECIPIENT INTERVAL SPAMHDR
+%token DISCARD MARK NOTIFY_RECIPIENT INTERVAL HEADER_OPTIONS SPAMHDR
%token RJECT TEMPFAIL IGNORE
%token GRPRD SETGRP CFGFILE TMPDIR MAXFILES MAXPROCS MARKALL
%token LOGVIRUS LOGSPAM LOGUNWANTED LDAP_USE_TLS
@@ -159,6 +161,7 @@ statement : /* empty */
| statement logfile '\n'
| statement statfile '\n'
| statement interval '\n'
+ | statement header_options '\n'
| statement option '\n'
| statement ldaphost '\n'
| statement ldapport '\n'
@@ -338,6 +341,20 @@ interval : INTERVAL '=' TEXT {
if (errstr)
errx(1, "interval is %s: %s", errstr,
$3);
+ }
+ free($3);
+ }
+ ;
+
+header_options : HEADER_OPTIONS '=' NUMBER {
+ const char *errstr;
+
+ if (header_options == 0) {
+ header_options = (unsigned long)strtonum($3, 0LL,
+ (long long)LONG_MAX, &errstr);
+ if (errstr)
+ errx(1, "header-options is %s: %s",
+ errstr, $3);
}
free($3);
}

11
mail/smtp-vilter/patches/patch-bin_smtp-vilter_scan_l Normal file
View File

@ -0,0 +1,11 @@
$OpenBSD: patch-bin_smtp-vilter_scan_l,v 1.1 2009/11/26 14:02:58 jasper Exp $
--- bin/smtp-vilter/scan.l.orig Sun Jan 21 13:09:38 2007
+++ bin/smtp-vilter/scan.l Fri Oct 23 09:41:00 2009
@@ -52,6 +52,7 @@ logfile { return LOGFILE; }
config-file { return CFGFILE; }
statfile { return STATFILE; }
interval { return INTERVAL; }
+header-options { return HEADER_OPTIONS; }
spam-header { return SPAMHDR; }
ldaphost { return LDAPHOST; }

98
mail/smtp-vilter/patches/patch-bin_smtp-vilter_smtp-vilter_8 Normal file
View File

@ -0,0 +1,98 @@
$OpenBSD: patch-bin_smtp-vilter_smtp-vilter_8,v 1.1 2009/11/26 14:02:58 jasper Exp $
--- bin/smtp-vilter/smtp-vilter.8.orig Sun Nov 12 11:39:17 2006
+++ bin/smtp-vilter/smtp-vilter.8 Fri Oct 23 16:09:09 2009
@@ -68,6 +68,9 @@
.Bk -words
.Op Fl a Ar spam-subject-prefix
.Ek
+.Bk -words
+.Op Fl H Ar header-options
+.Ek
.\" .Bk -words
.\" .Op Fl D Ar binddn
.\" .Ek
@@ -122,6 +125,9 @@ Start in verbose mode.
.Nm
will run in foreground and some diagnostic messages are displayed on the
console. Watch the system log for additional messages.
+.It Fl vv
+Enable a few additional messages relating to SASL authentication,
+and display data sent to and from backend sockets.
.It Fl m
Mark all messages with
.Dq X-SMTP-Vilter
@@ -174,6 +180,10 @@ to set a maximum number of open file descriptors.
.It Fl a Ar spam-subject-prefix
Specify a prefix that will be put in from of the Subject-line if a
message is considered spam.
+.It Fl H Ar header-options
+Control various features of the internally generated header used to
+forward messages to a spam detection backend (see "Header Options" below).
+
.\" .It Fl D Ar binddn
.\" Specify the distinguished name to use when binding to the LDAP server.
.\" .It Fl h Ar ldaphost
@@ -200,6 +210,45 @@ them long enough. Remember you have to set timeouts n
smtp-vilter and backend config files, but in your sendmail .mc config
file a s well as shown in the example above which configures a sending
timeout of 10 seconds and a receiving timeout of 120 seconds.
+.Sh Using Postfix
+.Nm
+can be used with recent versions of Postfix that include milter support.
+Postfix needs access to smtp-vilter.sock by making it a member of
+the owning group and setting umask 002 before running smtp-vilter
+.Pp
+Postfix does not automatically set the _ macro, this must be added
+to main.cf manually:
+.Bd -literal
+milter_connect_macros = j {daemon_name} v _
+.Ed
+.Sh Header Options
+As
+.Nm
+receives messages directly via the milter interface, it doesn't have access to
+headers that are added downstream by the MTA. So in order pass a message to a
+spam detection backend
+.Nm
+must generate and add its own artificial header.
+Note that this header is entirely internal and is NOT visible to the MTA or
+the end recipent.
+.Pp
+The
+.Aq header-options
+parameter provides control over various features of this header.
+.Pp
+At present there is only one option, which is to indicate the sender's SASL
+authentication status as reported by the MTA:
+.Bl -tag -width "header-options=xxx"
+.It Pa header-options=0
+ignore SASL authentication status (default)
+.It Pa header-options=1
+if the sender successfully signed in then insert a tag of the form
+"(Authenticated sender: user@domain)" in the received header.
+.El
+.Pp
+The latter behaviour emulates Postfix's "smtpd_sasl_authenticated_header"
+option. It enables a (suitably configured) spam detection backend to apply
+different rules for trusted senders.
.Sh FILES
.Bl -tag -width "/etc/smtp-vilter/smtp-vilter.conf" -COMPACT
.It Pa /etc/smtp-vilter/smtp-vilter.conf
@@ -265,16 +314,7 @@ based scanning. If both
.Nm
and the scan engine are chrooted to different directories, they must
communicate using TCP/IP sockets.
-.Sh USING POSTFIX
-.Nm
-can be used with recent versions of Postfix that include milter support.
-Postfix needs access to smtp-vilter.sock by making it a member of
-the owning group and setting umask 002 before running smtp-vilter
-.Pp
-Postfix does not automatically set the _ macro, this must be added
-to main.cf manuall:
-milter_connect_macros = j {daemon_name} v _
-.\" .Sh BUGS
+\" .Sh BUGS
.\" .Ss LDAP functionality
.\" LDAP functionality is only available when
.\" .Nm

54
mail/smtp-vilter/patches/patch-bin_smtp-vilter_smtp-vilter_c Normal file
View File

@ -0,0 +1,54 @@
$OpenBSD: patch-bin_smtp-vilter_smtp-vilter_c,v 1.1 2009/11/26 14:02:58 jasper Exp $
--- bin/smtp-vilter/smtp-vilter.c.orig Sun Jan 21 13:09:38 2007
+++ bin/smtp-vilter/smtp-vilter.c Fri Oct 23 16:35:17 2009
@@ -22,6 +22,7 @@
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/wait.h>
+#include <sys/limits.h>
#include <ctype.h>
#include <dlfcn.h>
@@ -82,6 +83,7 @@ char *clean_table;
int markall;
int logall;
+unsigned long header_options;
int verbose;
char *cfgfile;
char *tmpdir;
@@ -210,6 +212,7 @@ usage(void)
#ifdef ENABLE_LDAP
" [-h ldaphost]"
#endif
+ " [-H header-options]"
" [-i interval]"
#ifdef ENABLE_LDAP
" [-L ldapport]"
@@ -358,10 +361,10 @@ main(int argc, char *argv[])
/* Process the commandline */
#ifdef ENABLE_LDAP
while ((ch = getopt(argc, argv,
- "A:a:B:b:C:D:d:e:f:g:h:i:kL:mn:o:p:s:T:t:u:U:Vvw:xZ?")) != -1) {
+ "A:a:B:b:C:D:d:e:f:g:h:H:i:kL:mn:o:p:s:T:t:u:U:Vvw:xZ?")) != -1) {
#else
while ((ch = getopt(argc, argv,
- "A:a:b:C:d:e:f:g:i:kmn:o:p:T:t:s:u:VvxZ?")) != -1) {
+ "A:a:b:C:d:e:f:g:H:i:kmn:o:p:T:t:s:u:VvxZ?")) != -1) {
#endif
switch (ch) {
case 'A':
@@ -407,6 +410,13 @@ main(int argc, char *argv[])
break;
case 'g':
group = optarg;
+ break;
+ case 'H':
+ header_options = (unsigned long)strtonum(optarg, 0LL,
+ (long long)ULONG_MAX, &errstr);
+ if (errstr)
+ errx(1, "header options is %s: %s",
+ errstr, optarg);
break;
#ifdef ENABLE_LDAP
case 'h':

31
mail/smtp-vilter/patches/patch-bin_smtp-vilter_smtp-vilter_conf_5 Normal file
View File

@ -0,0 +1,31 @@
$OpenBSD: patch-bin_smtp-vilter_smtp-vilter_conf_5,v 1.1 2009/11/26 14:02:58 jasper Exp $
--- bin/smtp-vilter/smtp-vilter.conf.5.orig Sun Jan 21 13:09:38 2007
+++ bin/smtp-vilter/smtp-vilter.conf.5 Fri Oct 23 16:09:16 2009
@@ -103,6 +103,27 @@ Define the path from where backend are loaded.
Define the filename path to the configuration file for backend <backend>.
Note that this command must be preceeded by the backend command.
.El
+.Bl -ohang
+.It Em header-options=<header-options>
+Control various features of the artifical header used to forward
+messages to a spam detection backend.
+Note that this header is entirely internal and is NOT visible to the MTA or
+the end recipient.
+.Pp
+At present there is only one option, which is to indicate the sender's SASL
+authentication status as reported by the MTA:
+.El
+.Bl -ohang -offset indent
+.It Pa header-options=0
+ignore SASL authentication status (default)
+.It Pa header-options=1
+if the sender successfully signed in then insert a tag of the form
+"(Authenticated sender: user@domain)" in the received header.
+.El
+.Pp
+The latter behaviour emulates Postfix's "smtpd_sasl_authenticated_header"
+option, and enables a (suitably configured) spam detection backend to apply
+different rules for trusted senders.
.Sh STRATEGIES
.Bl -ohang
.It Em virus-strategy=<strategy>

76
mail/smtp-vilter/patches/patch-bin_smtp-vilter_socket_c Normal file
View File

@ -0,0 +1,76 @@
$OpenBSD: patch-bin_smtp-vilter_socket_c,v 1.1 2009/11/26 14:02:58 jasper Exp $
--- bin/smtp-vilter/socket.c.orig Sun Jan 21 13:09:38 2007
+++ bin/smtp-vilter/socket.c Fri Oct 23 15:35:24 2009
@@ -20,24 +20,49 @@
#include <sys/socket.h>
#include <sys/time.h>
+#include <err.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
+#include <ctype.h>
+#include <stdio.h>
#include "smtp-vilter.h"
+void
+display_buffer(FILE *stream, void *buf, ssize_t len)
+{
+ ssize_t i;
+
+ for (i = 0; i < len; i++)
+ if (isprint(((char *)buf)[i]))
+ fputc(((char *)buf)[i], stream);
+ else
+ fprintf(stream, "[%02x]", ((char *)buf)[i]);
+
+ fprintf(stream, "\n");
+}
+
ssize_t
to_recv(int s, void *buf, size_t len, int flags, struct timeval *timeout)
{
int n;
+ ssize_t count;
fd_set rset;
+ if (verbose >= 2)
+ warnx("receiving from backend");
+
FD_ZERO(&rset);
FD_SET(s, &rset);
- if ((n = select(s + 1, &rset, NULL, NULL, timeout)) > 0)
- return recv(s, buf, len, flags);
+ if ((n = select(s + 1, &rset, NULL, NULL, timeout)) > 0) {
+ count = recv(s, buf, len, flags);
+ if (verbose >= 2)
+ display_buffer(stderr, buf, count);
+ return count;
+ }
return n;
}
@@ -50,6 +75,9 @@ to_send(int s, const char *buf, size_t len, int flags,
ssize_t retval;
fd_set wset;
+ if (verbose >= 2)
+ warnx("sending to backend");
+
n = sent = 0;
FD_ZERO(&wset);
@@ -60,6 +88,10 @@ to_send(int s, const char *buf, size_t len, int flags,
if ((retval = send(s, buf + sent, len - sent, flags)) != -1)
sent += retval;
}
+
+ if (verbose >= 2)
+ display_buffer(stderr, (void *)buf, sent);
+
return sent;
}

26
mail/smtp-vilter/patches/patch-etc_smtp-vilter_smtp-vilter_conf Normal file
View File

@ -0,0 +1,26 @@
$OpenBSD: patch-etc_smtp-vilter_smtp-vilter_conf,v 1.1 2009/11/26 14:02:58 jasper Exp $
--- etc/smtp-vilter/smtp-vilter.conf.orig Sun Jan 21 13:09:38 2007
+++ etc/smtp-vilter/smtp-vilter.conf Fri Oct 23 16:28:10 2009
@@ -126,6 +126,22 @@ unwanted-strategy=mark
error-strategy=tempfail
+# Enable extended options for internally-generated headers passed to backends
+#
+# At present only one option is available:
+#
+# 0: use plain headers as per previous versions
+#
+# 1: include a tag of the form "(Authenticated sender: user@domain)" in the
+# Received header, if the MTA indicates that the sender successfully
+# signed in with SASL
+#
+# The latter setting emulates Postfix's smtpd_sasl_authenticated_header option,
+# which is useful if the spam-filter needs rules that depend on whether a user
+# is authenticated (e.g. you permit relaying by trusted remote senders)
+
+header-options=0
+
# Define the socket over which smtp-vilter communicates with sendmail
port=unix:/var/run/smtp-vilter.sock

15
mail/smtp-vilter/patches/patch-include_smtp-vilter_h Normal file
View File

@ -0,0 +1,15 @@
$OpenBSD: patch-include_smtp-vilter_h,v 1.1 2009/11/26 14:02:58 jasper Exp $
--- include/smtp-vilter.h.orig Sun Jan 21 13:09:38 2007
+++ include/smtp-vilter.h Fri Oct 23 16:32:18 2009
@@ -98,9 +98,11 @@ enum reactions {
};
extern int verbose;
+extern unsigned long header_options;
__BEGIN_DECLS
extern SOCK *fdsock(int);
+extern void display_buffer(FILE *, void *, ssize_t);
extern ssize_t to_recv(int, void *, size_t, int, struct timeval *);
extern ssize_t to_send(int, const char *, size_t, int, struct timeval *);
extern int to_readc(SOCK *, char *, struct timeval *);