18 typedef struct Keyword Keyword;
25 static Keyword options[] = {
27 "verifysenderdom", DNSVERIFY,
28 "saveblockedmsg", SAVEBLOCK,
29 "defaultdomain", DOMNAME,
31 "ourdomains", OURDOMS,
35 static Keyword actions[] = {
47 static ulong v4peerip;
49 static char* getline(Biobuf*);
50 static int cidrcheck(char*);
53 findkey(char *val, Keyword *p)
57 if(strcmp(val, p->name) == 0)
68 for(p=actions; p->name; p++)
78 getaction(char *s, char *type)
83 if(s == nil || *s == 0)
86 for(k = actions; k->name != 0; k++){
87 snprint(buf, sizeof buf, "%s/mail/ratify/%s/%s/%s",
88 get9root(), k->name, type, s);
89 if(access(buf,0) >= 0)
100 if(s == nil || *s == 0)
103 snprint(buf, sizeof buf, "%s/mail/ratify/trusted/%s", get9root(), s);
104 return access(buf,0) >= 0;
116 v4parseip(addr, nci->rsys);
117 v4peerip = nhgetl(addr);
119 trusted = istrusted(nci->rsys);
120 hisaction = getaction(nci->rsys, "ip");
122 fprint(2, "istrusted(%s)=%d\n", nci->rsys, trusted);
123 fprint(2, "getaction(%s, ip)=%s\n", nci->rsys, actstr(hisaction));
125 snprint(buf, sizeof(buf), "%s/smtpd.conf", UPASLIB);
126 bp = sysopen(buf, "r", 0);
135 switch(findkey(cp, options)){
137 if(fflag == 0 && strcmp(p, "on") == 0)
141 if(rflag == 0 && strcmp(p, "on") == 0)
145 if(sflag == 0 && strcmp(p, "on") == 0)
154 trusted = cidrcheck(p);
160 listadd(&ourdoms, s);
173 * match a user name. the only meta-char is '*' which matches all
174 * characters. we only allow it as "*", which matches anything or
175 * an * at the end of the name (e.g., "username*") which matches
176 * trailing characters.
179 usermatch(char *pathuser, char *specuser)
183 n = strlen(specuser)-1;
184 if(specuser[n] == '*'){
185 if(n == 0) /* match everything */
187 return strncmp(pathuser, specuser, n);
189 return strcmp(pathuser, specuser);
194 dommatch(char *pathdom, char *specdom)
198 if (*specdom == '*'){
199 if (specdom[1] == '.' && specdom[2]){
201 n = strlen(pathdom)-strlen(specdom);
202 if(n == 0 || (n > 0 && pathdom[n-1] == '.'))
203 return strcmp(pathdom+n, specdom);
207 return strcmp(pathdom, specdom);
211 * figure out action for this sender
214 blocked(String *path)
220 fprint(2, "blocked(%s)\n", s_to_c(path));
222 /* if the sender's IP address is blessed, ignore sender email address */
225 fprint(2, "\ttrusted => trusted\n");
229 /* if sender's IP address is blocked, ignore sender email address */
230 if(hisaction != ACCEPT){
232 fprint(2, "\thisaction=%s => %s\n", actstr(hisaction), actstr(hisaction));
236 /* convert to lower case */
237 lpath = s_copy(s_to_c(path));
241 action = getaction(s_to_c(lpath), "account");
243 fprint(2, "\tgetaction account %s => %s\n", s_to_c(lpath), actstr(action));
249 * get a canonicalized line: a string of null-terminated lower-case
250 * tokens with a two null bytes at the end.
262 cp = Brdline(bp, '\n');
267 if(buf == 0 || bufsize < n+1){
271 buf = realloc(buf, bufsize);
276 for (p = cp; *p; p++){
278 if(c == '\\' && p[1]) /* we don't allow \<newline> */
284 if(c == ' ' || c == '\t' || c == ',')
285 if(q == buf || q[-1] == 0)
306 if(strchr(s, '.') == nil)
309 for(l = ourdoms.first; l; l = l->next){
310 if(dommatch(s, s_to_c(l->p)) == 0)
317 forwarding(String *path)
323 fprint(2, "forwarding(%s)\n", s_to_c(path));
325 /* first check if they want loopback */
326 lpath = s_copy(s_to_c(s_restart(path)));
327 if(nci->rsys && *nci->rsys){
329 if(strncmp(cp, "[]!", 3) == 0){
332 s_append(path, nci->rsys);
333 s_append(path, "]!");
334 s_append(path, cp+3);
339 cp = strchr(cp,'!'); /* skip our domain and check next */
340 if(cp++ && strncmp(cp, "[]!", 3) == 0)
344 /* if mail is from a trusted IP addr, allow it to forward */
350 /* sender is untrusted; ensure receiver is in one of our domains */
351 for(cp = s_to_c(lpath); *cp; cp++) /* convert receiver lc */
354 for(s = s_to_c(lpath); cp = strchr(s, '!'); s = cp+1){
366 masquerade(String *path, char *him)
373 fprint(2, "masquerade(%s)\n", s_to_c(path));
380 lpath = s_copy(s_to_c(path));
382 /* sender is untrusted; ensure receiver is in one of our domains */
383 for(cp = s_to_c(lpath); *cp; cp++) /* convert receiver lc */
387 /* scan first element of ! or last element of @ paths */
388 if((cp = strchr(s, '!')) != nil){
392 } else if((cp = strrchr(s, '@')) != nil){
404 /* this is a v4 only check */
410 uchar addr[IPv4addrlen];
411 uchar mask[IPv4addrlen];
416 /* parse a list of CIDR addresses comparing each to the peer IP addr */
418 v4parsecidr(addr, mask, cp);
422 * if a mask isn't specified, we build a minimal mask
423 * instead of using the default mask for that net. in this
424 * case we never allow a class A mask (0xff000000).
426 if(strchr(cp, '/') == 0){
429 for(p = strchr(p, '.'); p && p[1]; p = strchr(p+1, '.'))
430 m = (m>>8)|0xff000000;
432 /* force at least a class B */
435 if((v4peerip&m) == a)
447 /* check if this IP address is banned */
448 for(l = badguys.first; l; l = l->next)
449 if(cidrcheck(s_to_c(l->p)))
458 listadd(&badguys, s_copy(p));
462 dumpfile(char *sender)
466 static char buf[512];
473 sprint(buf, "%s/queue.dump/%s%c", SPOOL, cp+4, cp[9]);
475 sprint(buf, "%s/queue.dump/%s%c%c", SPOOL, cp+4, cp[8], cp[9]);
476 cp = buf+strlen(buf);
477 if(access(buf, 0) < 0 && sysmkdir(buf, 0777) < 0)
481 h = h*257 + *sender++;
482 for(i = 0; i < 50; i++){
484 sprint(cp, "/%lud", h);
485 if(access(buf, 0) >= 0)
487 fd = syscreate(buf, ORDWR, 0666);
490 fprint(2, "saving in %s\n", buf);
499 char *validator = "#9/mail/lib/validateaddress";
514 validator = unsharp(validator);
516 if(shellchars(user)){
517 syslog(0, "smtpd", "shellchars in user name");
521 if(access(validator, AEXEC) == 0)
522 switch(pid = fork()) {
526 execl(validator, "validateaddress", user, nil);
533 syslog(0, "smtpd", "validateaddress %s: %s", user, w->msg);
540 snprint(buf, sizeof(buf), "%s/names.blocked", UPASLIB);
541 bp = sysopen(buf, "r", 0);
545 cp = Brdline(bp, '\n');
551 while(*cp == ' ' || *cp == '\t')
553 for(p = cp; c = *p; p++){
556 if(c == ' ' || c == '\t')
561 if(cistrcmp(user, cp) == 0){
562 syslog(0, "smtpd", "names.blocked blocks %s", user);
573 * a user can opt out of spam filtering by creating
574 * a file in his mail directory named 'nospamfiltering'.
577 optoutofspamfilter(char *addr)
582 p = strchr(addr, '!');
590 f = smprint("%s/mail/box/%s/nospamfiltering", get9root(), p);
592 rv = access(f, 0)==0;