dbaa9dbd6c
on files in plugins dir: fixed a number of POD errors formatted some # comments into POD removed bare 1; (these are plugins, not perl modules) most instances of this were copy/pasted from a previous plugin that had it removed instances of # vim ts=N ... they weren't consistent, many didn't match .perltidyrc on modules that failed perl -c tests, added 'use Qpsmtpd::Constants;' Conflicts: plugins/async/check_earlytalker plugins/async/dns_whitelist_soft plugins/async/dnsbl plugins/async/queue/smtp-forward plugins/async/require_resolvable_fromhost plugins/async/rhsbl plugins/async/uribl plugins/auth/auth_checkpassword plugins/auth/auth_cvm_unix_local plugins/auth/auth_flat_file plugins/auth/auth_ldap_bind plugins/auth/auth_vpopmail plugins/auth/auth_vpopmail_sql plugins/auth/authdeny plugins/check_badmailfromto plugins/check_badrcptto_patterns plugins/check_bogus_bounce plugins/check_earlytalker plugins/check_norelay plugins/check_spamhelo plugins/connection_time plugins/dns_whitelist_soft plugins/dnsbl plugins/domainkeys plugins/greylisting plugins/hosts_allow plugins/http_config plugins/logging/adaptive plugins/logging/apache plugins/logging/connection_id plugins/logging/transaction_id plugins/logging/warn plugins/milter plugins/queue/exim-bsmtp plugins/queue/maildir plugins/queue/postfix-queue plugins/queue/smtp-forward plugins/quit_fortune plugins/random_error plugins/rcpt_map plugins/rcpt_regexp plugins/relay_only plugins/require_resolvable_fromhost plugins/rhsbl plugins/sender_permitted_from plugins/spamassassin plugins/tls plugins/tls_cert plugins/uribl plugins/virus/aveclient plugins/virus/bitdefender plugins/virus/clamav plugins/virus/clamdscan plugins/virus/hbedv plugins/virus/kavscanner plugins/virus/klez_filter plugins/virus/sophie plugins/virus/uvscan
203 lines
5.5 KiB
Perl
203 lines
5.5 KiB
Perl
#!perl -Tw
|
|
|
|
use Qpsmtpd::Plugin::Async::DNSBLBase;
|
|
|
|
sub init {
|
|
my ($self, $qp, $denial) = @_;
|
|
my $class = ref $self;
|
|
|
|
{
|
|
no strict 'refs';
|
|
push @{"${class}::ISA"}, 'Qpsmtpd::Plugin::Async::DNSBLBase';
|
|
}
|
|
|
|
if (defined $denial and $denial =~ /^disconnect$/i) {
|
|
$self->{_dnsbl}->{DENY} = DENY_DISCONNECT;
|
|
}
|
|
else {
|
|
$self->{_dnsbl}->{DENY} = DENY;
|
|
}
|
|
}
|
|
|
|
sub hook_connect {
|
|
my ($self, $transaction) = @_;
|
|
my $class = ref $self;
|
|
|
|
my $remote_ip = $self->connection->remote_ip;
|
|
|
|
my $allow =
|
|
grep { s/\.?$/./; $_ eq substr($remote_ip . '.', 0, length $_) }
|
|
$self->qp->config('dnsbl_allow');
|
|
return DECLINED if $allow;
|
|
|
|
my %dnsbl_zones =
|
|
map { (split /:/, $_, 2)[0, 1] } $self->qp->config('dnsbl_zones');
|
|
return DECLINED unless %dnsbl_zones;
|
|
|
|
my $reversed_ip = join(".", reverse(split(/\./, $remote_ip)));
|
|
|
|
my @A_zones = grep { defined($dnsbl_zones{$_}) } keys %dnsbl_zones;
|
|
my @TXT_zones = grep { !defined($dnsbl_zones{$_}) } keys %dnsbl_zones;
|
|
|
|
if (@A_zones) {
|
|
|
|
# message templates for responding to the client
|
|
$self->connection->notes(
|
|
dnsbl_templates => {
|
|
map {
|
|
+"$reversed_ip.$_" => $dnsbl_zones{$_}
|
|
} @A_zones
|
|
}
|
|
);
|
|
}
|
|
|
|
return DECLINED
|
|
unless $class->lookup($self->qp,
|
|
[map { "$reversed_ip.$_" } @A_zones],
|
|
[map { "$reversed_ip.$_" } @TXT_zones],
|
|
);
|
|
|
|
return YIELD;
|
|
}
|
|
|
|
sub process_a_result {
|
|
my ($class, $qp, $result, $query) = @_;
|
|
|
|
my $conn = $qp->connection;
|
|
return if $conn->notes('dnsbl');
|
|
|
|
my $templates = $conn->notes('dnsbl_templates');
|
|
my $ip = $conn->remote_ip;
|
|
|
|
my $template = $templates->{$query};
|
|
$template =~ s/%IP%/$ip/g;
|
|
|
|
$conn->notes('dnsbl', $template);
|
|
}
|
|
|
|
sub process_txt_result {
|
|
my ($class, $qp, $result, $query) = @_;
|
|
|
|
my $conn = $qp->connection;
|
|
$conn->notes('dnsbl', $result) unless $conn->notes('dnsbl');
|
|
}
|
|
|
|
sub hook_rcpt {
|
|
my ($self, $transaction, $rcpt) = @_;
|
|
my $connection = $self->qp->connection;
|
|
|
|
# RBLSMTPD being non-empty means it contains the failure message to return
|
|
if (defined($ENV{'RBLSMTPD'}) && $ENV{'RBLSMTPD'} ne '') {
|
|
my $result = $ENV{'RBLSMTPD'};
|
|
my $remote_ip = $self->connection->remote_ip;
|
|
$result =~ s/%IP%/$remote_ip/g;
|
|
return (DENY, join(" ", $self->qp->config('dnsbl_rejectmsg'), $result));
|
|
}
|
|
|
|
my $note = $self->connection->notes('dnsbl');
|
|
return (DENY, $note) if $note;
|
|
return DECLINED;
|
|
}
|
|
|
|
=head1 NAME
|
|
|
|
dnsbl - handle DNS BlackList lookups
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
Plugin that checks the IP address of the incoming connection against
|
|
a configurable set of RBL services.
|
|
|
|
=head1 Configuration files
|
|
|
|
This plugin uses the following configuration files. All of these are optional.
|
|
However, not specifying dnsbl_zones is like not using the plugin at all.
|
|
|
|
=over 4
|
|
|
|
=item dnsbl_zones
|
|
|
|
Normal ip based dns blocking lists ("RBLs") which contain TXT records are
|
|
specified simply as:
|
|
|
|
relays.ordb.org
|
|
spamsources.fabel.dk
|
|
|
|
To configure RBL services which do not contain TXT records in the DNS,
|
|
but only A records (e.g. the RBL+ at http://www.mail-abuse.org), specify your
|
|
own error message to return in the SMTP conversation after a colon e.g.
|
|
|
|
rbl-plus.mail-abuse.org:You are listed at - http://http://www.mail-abuse.org/cgi-bin/lookup?%IP%
|
|
|
|
The string %IP% will be replaced with the IP address of incoming connection.
|
|
Thus a fully specified file could be:
|
|
|
|
sbl-xbl.spamhaus.org
|
|
list.dsbl.org
|
|
rbl-plus.mail-abuse.ja.net:Listed by rbl-plus.mail-abuse.ja.net - see <URL:http://www.mail-abuse.org/cgi-bin/lookup?%IP%>
|
|
relays.ordb.org
|
|
|
|
=item dnsbl_allow
|
|
|
|
List of allowed ip addresses that bypass RBL checking. Format is one entry per line,
|
|
with either a full IP address or a truncated IP address with a period at the end.
|
|
For example:
|
|
|
|
192.168.1.1
|
|
172.16.33.
|
|
|
|
NB the environment variable RBLSMTPD is considered before this file is
|
|
referenced. See below.
|
|
|
|
=item dnsbl_rejectmsg
|
|
|
|
A textual message that is sent to the sender on an RBL failure. The TXT record
|
|
from the RBL list is also sent, but this file can be used to indicate what
|
|
action the sender should take.
|
|
|
|
For example:
|
|
|
|
If you think you have been blocked in error, then please forward
|
|
this entire error message to your ISP so that they can fix their problems.
|
|
The next line often contains a URL that can be visited for more information.
|
|
|
|
=back
|
|
|
|
=head1 Environment Variables
|
|
|
|
=head2 RBLSMTPD
|
|
|
|
The environment variable RBLSMTPD is supported and mimics the behaviour of
|
|
Dan Bernstein's rblsmtpd. The exception to this is the '-' char at the
|
|
start of RBLSMTPD which is used to force a hard error in Dan's rblsmtpd.
|
|
NB I don't really see the benefit
|
|
of using a soft error for a site in an RBL list. This just complicates
|
|
things as it takes 7 days (or whatever default period) before a user
|
|
gets an error email back. In the meantime they are complaining that their
|
|
emails are being "lost" :(
|
|
|
|
=over 4
|
|
|
|
=item RBLSMTPD is set and non-empty
|
|
|
|
The contents are used as the SMTP conversation error.
|
|
Use this for forcibly blocking sites you don't like
|
|
|
|
=item RBLSMTPD is set, but empty
|
|
|
|
In this case no RBL checks are made.
|
|
This can be used for local addresses.
|
|
|
|
=item RBLSMTPD is not set
|
|
|
|
All RBL checks will be made.
|
|
This is the setting for remote sites that you want to check against RBL.
|
|
|
|
=back
|
|
|
|
=head1 Revisions
|
|
|
|
See: http://cvs.perl.org/viewcvs/qpsmtpd/plugins/dnsbl
|
|
|
|
=cut
|