235 lines
6.7 KiB
Perl
235 lines
6.7 KiB
Perl
#!perl -w
|
|
|
|
=head1 NAME
|
|
|
|
earlytalker - Check that the client doesn't talk before we send the SMTP banner
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
Checks to see if the remote host starts talking before we've issued a 2xx
|
|
greeting. If so, we're likely looking at a direct-to-MX spam agent which
|
|
pipelines its entire SMTP conversation, and will happily dump an entire spam
|
|
into our mail log even if later tests deny acceptance.
|
|
|
|
Depending on configuration, clients which behave in this way are either
|
|
immediately disconnected with a deny or denysoft code, or else are issued this
|
|
on all mail/rcpt commands in the transaction.
|
|
|
|
=head1 CONFIGURATION
|
|
|
|
=head2 wait [integer]
|
|
|
|
The number of seconds to delay the initial greeting to see if the connecting
|
|
host speaks first. The default is 1. Do not select a value that is too high,
|
|
or you may be unable to receive mail from MTAs with short SMTP connect or
|
|
greeting timeouts -- these are known to range as low as 30 seconds, and may
|
|
in some cases be configured lower by mailserver admins. Network transit time
|
|
must also be allowed for.
|
|
|
|
=head2 reject <boolean>
|
|
|
|
Do we reject/deny connections to early talkers?
|
|
|
|
earlytalker reject [ 0 | 1 ]
|
|
|
|
Default: I<reject 1>
|
|
|
|
=head2 reject_type [ temp | perm ]
|
|
|
|
What type of rejection to send. A temporary rejection tells the remote server to try again later. A permanent error tells it to give up permanently.
|
|
|
|
Default I<reject_type temp>.
|
|
|
|
=head2 defer-reject [boolean]
|
|
|
|
When an early-talker is detected, if this option is set to a true value, the
|
|
SMTP greeting will be issued as usual, but all RCPT/MAIL commands will be
|
|
issued a deny or denysoft (depending on the value of I<reject_type>). The default
|
|
is to react at the SMTP greeting stage by issuing the apropriate response code
|
|
and terminating the SMTP connection.
|
|
|
|
earlytalker defer-reject [ 0 | 1 ]
|
|
|
|
=head2 check-at [ CONNECT | DATA ]
|
|
|
|
Specifies when to check for early talkers. You can specify this option
|
|
multiple times to check more than once.
|
|
|
|
The default is I<check-at CONNECT> only.
|
|
|
|
=head2 loglevel
|
|
|
|
Adjust the quantity of logging for this plugin. See docs/logging.pod
|
|
|
|
=cut
|
|
|
|
use strict;
|
|
use warnings;
|
|
|
|
use IO::Select;
|
|
use Qpsmtpd::Constants;
|
|
|
|
sub register {
|
|
my ($self, $qp, @args) = @_;
|
|
|
|
if (@args % 2) {
|
|
$self->log(LOGERROR, "Unrecognized/mismatched arguments");
|
|
return;
|
|
}
|
|
my %check_at;
|
|
for (0 .. $#args) {
|
|
next if $_ % 2;
|
|
if (lc($args[$_]) eq 'check-at') {
|
|
my $val = $args[$_ + 1];
|
|
$check_at{uc($val)}++;
|
|
}
|
|
}
|
|
if (!%check_at) {
|
|
$check_at{CONNECT} = 1;
|
|
}
|
|
$self->{_args} = {
|
|
'wait' => 1,
|
|
@args,
|
|
'check-at' => \%check_at,
|
|
};
|
|
|
|
# backwards compat with old 'action' argument
|
|
if (defined $self->{_args}{action} && !defined $self->{_args}{reject}) {
|
|
$self->{_args}{reject} = $self->{_args}{action} =~ /^deny/i ? 1 : 0;
|
|
}
|
|
if (defined $self->{_args}{'defer-reject'}
|
|
&& !defined $self->{_args}{reject_type})
|
|
{
|
|
$self->{_args}{reject_type} =
|
|
$self->{_args}{action} == 'denysoft' ? 'temp' : 'perm';
|
|
}
|
|
if (!defined $self->{_args}{reject_type}) {
|
|
$self->{_args}{reject_type} = 'perm';
|
|
}
|
|
|
|
# /end compat
|
|
if ($qp->{conn} && $qp->{conn}->isa('Apache2::Connection')) {
|
|
require APR::Const;
|
|
APR::Const->import(qw(POLLIN SUCCESS));
|
|
$self->register_hook('connect', 'apr_connect_handler');
|
|
$self->register_hook('data', 'apr_data_handler');
|
|
}
|
|
else {
|
|
$self->register_hook('connect', 'connect_handler');
|
|
$self->register_hook('data', 'data_handler');
|
|
}
|
|
$self->register_hook('mail', 'mail_handler')
|
|
if $self->{_args}{'defer-reject'};
|
|
$self->{_args}{reject} = 1 if !defined $self->{_args}{reject};
|
|
}
|
|
|
|
sub apr_connect_handler {
|
|
my ($self, $transaction) = @_;
|
|
|
|
return DECLINED unless $self->{_args}{'check-at'}{CONNECT};
|
|
return DECLINED if $self->is_immune();
|
|
|
|
my $c = $self->qp->{conn} or return DECLINED;
|
|
my $socket = $c->client_socket or return DECLINED;
|
|
my $timeout = $self->{_args}{'wait'} * 1_000_000;
|
|
|
|
my $rc = $socket->poll($c->pool, $timeout, APR::Const::POLLIN());
|
|
if ($rc == APR::Const::SUCCESS()) {
|
|
if ($self->{_args}{'defer-reject'}) {
|
|
$self->connection->notes('earlytalker', 1);
|
|
return DECLINED;
|
|
}
|
|
return $self->log_and_deny();
|
|
}
|
|
return $self->log_and_pass();
|
|
}
|
|
|
|
sub apr_data_handler {
|
|
my ($self, $transaction) = @_;
|
|
|
|
return DECLINED unless $self->{_args}{'check-at'}{DATA};
|
|
return DECLINED if $self->is_immune();
|
|
|
|
my $c = $self->qp->{conn} or return DECLINED;
|
|
my $socket = $c->client_socket or return DECLINED;
|
|
my $timeout = $self->{_args}{'wait'} * 1_000_000;
|
|
|
|
my $rc = $socket->poll($c->pool, $timeout, APR::Const::POLLIN());
|
|
if ($rc == APR::Const::SUCCESS()) {
|
|
return $self->log_and_deny();
|
|
}
|
|
return $self->log_and_pass();
|
|
}
|
|
|
|
sub connect_handler {
|
|
my ($self, $transaction) = @_;
|
|
my $in = new IO::Select;
|
|
|
|
return DECLINED unless $self->{_args}{'check-at'}{CONNECT};
|
|
return DECLINED if $self->is_immune();
|
|
|
|
# senders with good karma skip the delay
|
|
my $karma = $self->connection->notes('karma_history');
|
|
if (defined $karma && $karma > 5) {
|
|
$self->log(LOGINFO, "skip, karma $karma");
|
|
return DECLINED;
|
|
}
|
|
|
|
$in->add(\*STDIN) or return DECLINED;
|
|
if (!$in->can_read($self->{_args}{'wait'})) {
|
|
return $self->log_and_pass();
|
|
}
|
|
|
|
if (!$self->{_args}{'defer-reject'}) {
|
|
return $self->log_and_deny();
|
|
}
|
|
|
|
$self->connection->notes('earlytalker', 1);
|
|
$self->adjust_karma(-1);
|
|
return DECLINED;
|
|
}
|
|
|
|
sub data_handler {
|
|
my ($self, $transaction) = @_;
|
|
my $in = new IO::Select;
|
|
|
|
return DECLINED unless $self->{_args}{'check-at'}{DATA};
|
|
return DECLINED if $self->is_immune();
|
|
|
|
$in->add(\*STDIN) or return DECLINED;
|
|
if (!$in->can_read($self->{_args}{'wait'})) {
|
|
return $self->log_and_pass();
|
|
}
|
|
|
|
return $self->log_and_deny();
|
|
}
|
|
|
|
sub log_and_pass {
|
|
my $self = shift;
|
|
my $ip = $self->qp->connection->remote_ip || 'remote host';
|
|
$self->log(LOGINFO, "pass, not spontaneous");
|
|
return DECLINED;
|
|
}
|
|
|
|
sub log_and_deny {
|
|
my $self = shift;
|
|
|
|
my $ip = $self->qp->connection->remote_ip || 'remote host';
|
|
|
|
$self->connection->notes('earlytalker', 1);
|
|
$self->adjust_karma(-1);
|
|
|
|
my $log_mess = "remote started talking before we said hello";
|
|
my $smtp_msg = 'Connecting host started transmitting before SMTP greeting';
|
|
|
|
return $self->get_reject($smtp_msg, $log_mess);
|
|
}
|
|
|
|
sub mail_handler {
|
|
my ($self, $transaction) = @_;
|
|
|
|
return DECLINED unless $self->connection->notes('earlytalker');
|
|
return $self->log_and_deny();
|
|
}
|
|
|