summaryrefslogtreecommitdiff
path: root/tools/greylist.c
blob: 86dcd1d9700ccff2821ad76fee4a7adb581bd856 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
#include <stdlib.h>             /* for exit(), getenv() */
#include <iostream>
#include <iomanip>
#include <string>

#include <sys/types.h>          /* for stat(), getaddrinfo() */
#include <sys/stat.h>           /* for stat() */
#include <unistd.h>             /* for stat() */
#include <stdio.h>              /* for perror */
#include <errno.h>              /* for ENOENT */
#include <fstream>              /* for ofstream() */
#include <fcntl.h>              /* for creat() */
#include <sys/time.h>           /* for gettimeofday() */
#include <sstream>              /* for stringstream */
#include <signal.h>             /* for kill(), SIGUSR1 */

// requires apt-get install libboost-filesystem-dev:
#include <boost/filesystem.hpp>

#include <sys/socket.h>         /* for getaddrinfo() */
#include <netdb.h>              /* for getaddrinfo() */
#include <string.h>             /* for memset() */
#include <arpa/inet.h>          /* for inet_ntop() */

using namespace std;

const int minute(60);
const int hour(60*minute);
const int day(24*hour);

const int minimum_age(15*minute);
const int maximum_age(32*day);
const int probation(4*hour);

#include "qq_exit_codes.h"

pid_t mypid;
string progname;

void dump(const string var){
  char* str = getenv(var.c_str());
  cerr << progname
    << "[" << mypid << "] "
    << var;
  if (str) cerr << " is set to '" << str << "'" << endl;
  else  cerr << " is not set." << endl;
}

void exeunt(const int sts){
  if (sts == ex_good) exit(sts);

#ifndef PENALIZE_SPAMMERS
  if (sts == ex_penaltybox) exit(sts);
#endif

#ifndef KILL_GROUP
  exit(sts);
#endif

  const char* foo = getenv("HI_Q_GROUP");
  if (!foo) exit(sts);

// No point in signalling ourself:
  sighandler_t rslt = signal(SIGUSR1, SIG_IGN);
  if (rslt == SIG_ERR) {
    cerr << "error setting signal" << endl;
  }
  int k = kill(-atoi(foo), SIGUSR1);
  if (k) {
    cerr << "kill failed on group " << atoi(foo) << " ... ";
    perror(0);
  }
  exit(sts);
}

#include "utils.h"

class whatsit{
public:
  string dirname;
  string progname;
  pid_t mypid;
  timeval now;
  char* ipvar;
  char* hostvar;
  string ipbase;
  string ipname;
  string hostname;
  int mod_age;
  int ac_age;
  string suffix;
  string progid;
  int verbosity;

  whatsit(const string name, const string _dirname)
  : dirname(_dirname), progname(name), mypid(getpid()),
    mod_age(0), ac_age(0),
    verbosity(0)
  {
    gettimeofday(&now, NULL);
  }
  int doit(const int penalty, const int stain);
// access comes after modification:
  void update(const string msg, const timeval new_mod,
        const timeval new_ac, const int penalty, const int stain);
  int setup();
  int check_dns();
  int check_dns_sub(string &addr, string &host, vector<string> &checked);
};

int whatsit::setup(){
  stringstream foo;
  foo << basename(progname) << suffix
    << "[" << mypid << "]";
  progid = foo.str();

  ipvar = getenv("TCPREMOTEIP");
  if (ipvar) ipbase = ipvar;
  hostvar = getenv("TCPREMOTEHOST");
  if (hostvar) hostname = hostvar;
  return 0;
}

void scan(const string progid, const string p, const int copies=1){
  timeval now;
  gettimeofday(&now, NULL);
  using namespace boost::filesystem;

  if (is_directory(p))  {
    for (directory_iterator itr(p); itr!=directory_iterator(); ++itr) {
      string basename = itr->path().filename().string();
      for (int ii = 0; ii < copies; ii++)
        cout << setw(20) << left << basename << ' '; // display filename only
      if (is_regular_file(itr->status())) {
//        cout << " [" << file_size(itr->path()) << ']';
        struct stat mystat;
        string fn = p + "/" + basename;
        int rslt = stat(fn.c_str(), &mystat);
        if (rslt != 0){
            cerr << progid << ": stat failed for '"
              << fn << "' : ";
            perror(0);
        }
        int mod_age = now.tv_sec - mystat.st_mtime;
        int ac_age = now.tv_sec - mystat.st_atime;
        cout << setw(10) << time_out(mod_age)
                << " " << setw(10) << time_out(ac_age);
        if (0) {

        } else if (mod_age < 0) {
          cout << " penalty";
        } else if (mod_age < ac_age) {
          cout << " parole";
        } else if (mod_age - ac_age < minimum_age    // early bird, or completely unused
          && mod_age > probation) {           // did not diligently resubmit
          cout << " disprobation";
          if (mod_age != ac_age) cout << "!";
        } else if (mod_age < minimum_age) {
          cout << " young";
          if (mod_age != ac_age) cout << "!";
        } else if (mod_age == ac_age) {
          cout << " unused";
        } else if (mod_age > maximum_age) {
          cout << " expired";
        } else {
          cout << " OK";
        }
      }
      cout << '\n';
    }
  }
  else {
    // starting point is not a directory:
    cout << (exists(p) ? "Found: " : "Not found: ") << p << '\n';
  }
}

void whatsit::update(const string msg, const timeval new_mod,
     const timeval new_ac, const int penalty, const int stain){
  if (verbosity){
    if (penalty || stain || verbosity>1) cerr << progid << ": ";
    if (penalty) cerr << " penalty " << penalty;
    if (stain) cerr << " stain " << stain;
    if (verbosity > 1) {
      if (penalty || stain) cerr << "+";         // separation, punctuation
      cerr << msg << ": " << ipbase;
      if (hostname.length()) cerr <<  " " << hostname;
      cerr << "  mod_age: " << time_out(mod_age)
              << "  ac_age: " << time_out(ac_age);
    }
    cerr << endl;
  }
  timeval pen_mod(new_mod);
  timeval stain_ac(new_ac);
  if (penalty) {
    pen_mod = now;
    pen_mod.tv_sec += penalty;
  }
  if (stain) {
    stain_ac = now;
    stain_ac.tv_sec -= stain;
  }
  timeval upd[2] = {
// beware:  access illogically comes *before* modification here:
    stain_ac,
    pen_mod
  };
  if (utimes(ipname.c_str(), upd))
    cerr << "oops" << endl;
}


int main(int _argc, char** _argv){
  mypid = getpid();
  int argc(_argc);
  char** argv(_argv);
  const string dirname("/var/qmail/greylist");
  whatsit foo(argv[0], dirname); argc--; argv++;
  int scanmode(0);
  int copies(1);
  int penalty(0);
  int stain(0);
  int check(0);
  while (argc > 0) {
    string arg = argv[0]; argc--; argv++;
    if (prefix(arg, "-scan")) {
      scanmode++;
    } else if (prefix(arg, "-copy"))  {
      copies++;
    } else if (prefix(arg, "-verbose"))  {
      foo.verbosity++;
    } else if (prefix(arg, "-check"))  {
      check++;
    } else if (prefix(arg, "-penalize")
        || prefix(arg, "-penalty"))  {
      if (!argc){
        cerr << "Option '" << arg << "' requires an argument" << endl;
        exeunt(ex_syserr);
      }
      penalty = atoi(*argv++);  argc--;
    } else if (prefix(arg, "-stain"))  {
      if (!argc){
        cerr << "Option '" << arg << "' requires an argument" << endl;
        exeunt(ex_syserr);
      }
      stain = atoi(*argv++);  argc--;
    } else if (prefix(arg, "-suffix")) {
      if (!argc){
        cerr << "Option '" << arg << "' requires an argument" << endl;
        exeunt(ex_syserr);
      }
      foo.suffix += *argv++;  argc--;
    } else {
      cerr << "Unrecognized arg: " << arg << endl;
      exeunt(ex_syserr);
    }
  }
  if (foo.setup()) return ex_syserr;

  if (scanmode) {
    scan(foo.progid, dirname, copies);
    return 0;
  }

  int sts = foo.doit(penalty, stain);
  if (sts == ex_syserr) return sts;
  if (!check) return ex_good;

// check mode ... perform some extra checks.
// Probably a better design would be to
//  (a) make more thorough DNS checks, and
//  (b) move all the DNS checking to a separate module

  int dns = foo.check_dns();
  if (dns == ex_syserr || dns == ex_spam) return dns;
  exeunt(sts);
}

int whatsit::doit(const int penalty, const int stain){

  if (!ipvar) {
    cerr << progid
      << " TCPREMOTEIP not set???" << endl;
    // should never happen
    // although you can make it happen using a weird test-harness
    return(ex_syserr);
  }

// see if our directory exists:
  struct stat dirstat;
  int rslt = stat(dirname.c_str(), &dirstat);
  if (rslt != 0){
    if (errno != ENOENT) {
      cerr << progid << ": stat failed for '"
        << dirname << "' : ";
      perror(0);
    }
    rslt = mkdir(dirname.c_str(), 0755);
    if (rslt != 0) {
      cerr << progid
        << "uid " << getuid()
        << ": mkdir failed for '"
        << dirname << "' : ";
      perror(0);
      return(ex_syserr);
    }
  }

  ipname = dirname + "/" + ipbase;
  struct stat ipstat;
  rslt = stat(ipname.c_str(), &ipstat);
  if (rslt != 0){
    if (errno != ENOENT) {
      cerr << progid << ": stat failed for '"
        << ipname << "' : ";
      perror(0);
    }
    ofstream foo;
    int fd = creat(ipname.c_str(), 0644);
    if (fd < 0){
      cerr << progid << ": create failed for '"
        << ipname << "' : ";
      perror(0);
    }
    close(fd);
    update("new customer", now, now, penalty, stain);
    return(ex_greylisting);
  }

// now for really checking the greylist status:
  mod_age = now.tv_sec - ipstat.st_mtime;
  ac_age = now.tv_sec - ipstat.st_atime;
  timeval mod_orig = {ipstat.st_mtime, 0};
  if (mod_age < 0) {
    update("penalty box", mod_orig, now, penalty, stain);
    return(ex_penaltybox);
  }
  if (mod_age < ac_age){
// when he comes out on parole, he starts over with no reputation:
    update("paroled spammer", now, now, penalty, stain);
    return(ex_greylisting);
  }
  if (mod_age < minimum_age) {
    update("early bird", mod_orig, now, penalty, stain);
    return(ex_greylisting);
  }
  if (mod_age - ac_age < minimum_age    // early bird, or completely unused
    && mod_age > probation) {           // did not diligently resubmit
    update("disprobation", now, now, penalty, stain);
    return(ex_greylisting);
  }
  if (ac_age > maximum_age) {
    update("too old, starting over", now, now, penalty, stain);
    return(ex_greylisting);
  }
// if all checks are passed, must be OK:
  update("returning customer", mod_orig, now, penalty, stain);
  return 0;
}

typedef vector<unsigned char> VU;

class VUx{
public:
  VU addr;
  sa_family_t fam;
  string str();
};

string VUx::str(){
    char msgbuf[INET6_ADDRSTRLEN];
    const char* rslt = inet_ntop(fam, &addr[0],
          msgbuf, sizeof(msgbuf));
    if (!rslt) rslt = "";
    return rslt;
}

VUx parse_sockaddr(const sockaddr* ai_addr) {
    void* numericAddress;
    VUx rslt;
    int addrsize;
    rslt.addr = VU(0);
    rslt.fam = ((sockaddr *)ai_addr)->sa_family;
    switch (rslt.fam) {
    case AF_INET:
      numericAddress = &(((sockaddr_in *)ai_addr)->sin_addr.s_addr);
      addrsize = sizeof(in_addr);
      break;
    case AF_INET6:
      numericAddress = &(((sockaddr_in6 *)ai_addr)->sin6_addr.s6_addr);
      addrsize = sizeof(in6_addr);
      break;
    default:
      cerr << "?Unknown address family " << rslt.fam << endl;
      return rslt;
    }
    unsigned char* foo = (unsigned char*) numericAddress;
    rslt.addr = VU(foo, foo+addrsize);
    return rslt;
}

int diff(const VU aaa, const VU bbb){
  if(aaa.size() != bbb.size()) return 1;
  for (unsigned int ii=0; ii < aaa.size(); ii++){
    if (aaa[ii] != bbb[ii]) return 1;
  }
  return 0;
}

int whatsit::check_dns(){
  string addr("()"), host("()");
  vector<string> checked;
  int sts = check_dns_sub(addr, host, checked);
  if (sts == 0) return sts;
  if (sts != ex_badDNS) return sts;     // possible ex_syserr
#ifndef badDNSfatal
  sts = 0;      // demote badDNS to just a warning
#endif
  cerr << progid;
  if (!sts) cerr << " (warning)";
  cerr << " DNS inconsistency: "
        << addr << " --> "
        << host << " ==>";
  if (!checked.size()) cerr << " ()";
  else for (vector<string>::const_iterator chk = checked.begin();
        chk != checked.end(); chk++) cerr << " " << *chk;
  cerr << endl;

  return sts;
}

int whatsit::check_dns_sub(string &addr, string &host, vector<string> &checked){

#ifdef badDNSfatal
  int ex_dns_fail = ex_syserr;
#else
  int ex_dns_fail = ex_badDNS;
#endif
  struct addrinfo *result;
  struct addrinfo *ipresult;
  struct addrinfo *res;
  addrinfo hints;
  int error;

  memset(&hints, 0, sizeof(struct addrinfo));
#if 1
  // restrict to TCP only; otherwise we get N records per address
  hints.ai_protocol = IPPROTO_TCP;
#endif

  error = getaddrinfo(ipvar, NULL, &hints, &ipresult);
  if (error == EAI_NONAME) return ex_badDNS;
  if (error) {          // some unexpected error
    cerr << progid
      << " odd error " << error
      << "  in getaddrinfo for " << ipvar
      << " : " << gai_strerror(error) << endl;

    return ex_dns_fail;
  }
  if (!ipresult) {
    cerr << "should never happen (addr with no addrs?)" << endl;
    return ex_dns_fail;
  }
  VUx ipAddr = parse_sockaddr(ipresult->ai_addr);
  addr = ipAddr.str();

  char* hostvar = getenv("TCPREMOTEHOST");
  if (hostvar) host = hostvar;
  else return(ex_badDNS);

  error = getaddrinfo(hostvar, NULL, &hints, &result);
  if (error == EAI_NONAME) return ex_badDNS;
  if (error) {
    cerr << progid
      << " error " << error
      << " compare " << EAI_NONAME
      << "  in getaddrinfo for " << ipvar
      << " :: " << gai_strerror(error) << endl;
    return ex_dns_fail;
  }

// loop over all returned results and check for a match.
  for (res = result; res != NULL; res = res->ai_next){
    VUx hostAddr = parse_sockaddr(res->ai_addr);
    checked.push_back(hostAddr.str());
    if (!diff(hostAddr.addr, ipAddr.addr)) {
      ///// cerr << "match! " << ipAddr.addr.size() << endl;
      goto done;
    }
  }
  return ex_badDNS;

done:
  return 0;
}