path: root/tools/greylist.c

#include <stdlib.h>             /* for exit(), getenv() */
#include <iostream>
#include <iomanip>
#include <string>

#include <sys/types.h>          /* for stat() */
#include <sys/stat.h>           /* for stat() */
#include <unistd.h>             /* for stat() */
#include <stdio.h>              /* for perror */
#include <errno.h>              /* for ENOENT */
#include <fstream>              /* for ofstream() */
#include <fcntl.h>              /* for creat() */
#include <sys/time.h>           /* for gettimeofday() */
#include <sstream>              /* for stringstream */
#include <signal.h>             /* for kill(), SIGUSR1 */

// requires apt-get install libboost-filesystem-dev:
#include <boost/filesystem.hpp>

using namespace std;

const int minute(60);
const int hour(60*minute);
const int day(24*hour);

const int minimum_age(15*minute);
const int maximum_age(32*day);
const int probation(4*hour);

//  error exit codes, mostly as stated in qmail.c
#define foo(name, num) const int ex_ ## name = num
#define bar foo(good, 0) ;\
foo(spam, 21) ;\
foo(penaltybox, 22) ;\
foo(greylisting, 70) ;\
foo(syserr, 71) ;\
foo(comerr, 74) ;

bar
#undef foo

pid_t mypid;
string progname;

void dump(const string var){
  char* str = getenv(var.c_str());
  cerr << progname
    << "[" << mypid << "] "
    << var;
  if (str) cerr << " is set to '" << str << "'" << endl;
  else  cerr << " is not set." << endl;
}


////////////////
// little utility to help with argument parsing:
//
int prefix(const string shorter, const string longer){
  return shorter == longer.substr(0, shorter.length());
}

void exeunt(const int sts){
  if (sts == ex_good) exit(sts);

  const char* foo = getenv("HI_Q_GROUP");
  if (!foo) exit(sts);

// No point in signalling ourself:
  sighandler_t rslt = signal(SIGUSR1, SIG_IGN);
  if (rslt == SIG_ERR) {
    cerr << "error setting signal" << endl;
  }
  int k = kill(-atoi(foo), SIGUSR1);
  if (k) {
    cerr << "kill failed on group " << atoi(foo) << " ... ";
    perror(0);
  }
  exit(sts);
}

class whatsit{
public:
  string dirname;
  string progname;
  pid_t mypid;
  timeval now;
  string ipbase;
  string ipname;
  string hostname;
  int mod_age;
  int ac_age;
  string suffix;
  string progid;
  int verbosity;

  whatsit(const string name, const string _dirname)
  : dirname(_dirname), progname(name), mypid(getpid()),
    mod_age(0), ac_age(0),
    verbosity(0)
  {
    gettimeofday(&now, NULL);
  }
  int doit(const int penalty=0);
// access comes after modification:
  void update(const string msg, const timeval new_mod,
        const timeval new_ac, const int penalty=0);
  void bind();
};

string basename(const string path){
  size_t where = path.rfind("/");
  if (where != string::npos) return path.substr(1+where);
  return path;
}

void whatsit::bind(){
  stringstream foo;
  foo << basename(progname) << suffix 
    << "[" << mypid << "]";
  progid = foo.str();
}

string time_out(const int _ttt){
  int ttt(abs(_ttt));
  int sec(ttt % 60);
  int min((ttt / 60) % 60);
  int hr(ttt / 3600);
  stringstream foo;
  int didsome(0);
  if (_ttt < 0) foo << "-";
  if (hr) {
    foo << hr << ":";
    didsome++;
  }
  if (didsome || min){
    foo << setw(didsome?2:1) << setfill('0') << min << ":";
    didsome++;
  }
  foo << setw(didsome?2:1) << setfill('0') << sec;
  return foo.str();
}

void scan(const string progid, const string p, const int copies=1){
  timeval now;
  gettimeofday(&now, NULL);
  using namespace boost::filesystem;

  if (is_directory(p))  {
    for (directory_iterator itr(p); itr!=directory_iterator(); ++itr) {
      string basename = itr->path().filename();
      for (int ii = 0; ii < copies; ii++)
        cout << setw(20) << left << basename << ' '; // display filename only
      if (is_regular_file(itr->status())) {
//        cout << " [" << file_size(itr->path()) << ']';
        struct stat mystat;
        string fn = p + "/" + basename;
        int rslt = stat(fn.c_str(), &mystat);
        if (rslt != 0){
            cerr << progid << ": stat failed for '"
              << fn << "' : ";
            perror(0);
        }
        int mod_age = now.tv_sec - mystat.st_mtime;
        int ac_age = now.tv_sec - mystat.st_atime;
        cout << setw(10) << time_out(mod_age)
                << " " << setw(10) << time_out(ac_age);
        if (0) {

        } else if (mod_age < 0) {
          cout << " penalty";
        } else if (mod_age < ac_age) {
          cout << " parole";
        } else if (mod_age - ac_age < minimum_age    // early bird, or completely unused
          && mod_age > probation) {           // did not diligently resubmit
          cout << " disprobation";
          if (mod_age != ac_age) cout << "!";
        } else if (mod_age < minimum_age) {
          cout << " young";
          if (mod_age != ac_age) cout << "!";
        } else if (mod_age == ac_age) {
          cout << " unused";
        } else if (mod_age > maximum_age) {
          cout << " expired";
        } else {
          cout << " OK";
        }
      }
      cout << '\n';
    }
  }
  else {
    // starting point is not a directory:
    cout << (exists(p) ? "Found: " : "Not found: ") << p << '\n';
  }
}

void whatsit::update(const string msg, const timeval new_mod,
     const timeval new_ac, const int penalty){
  if (verbosity){
    cerr << progid << ": ";
    if (penalty) cerr << " penalty+";
    cerr << msg << ": " << ipbase;
    if (hostname.length()) cerr <<  " " << hostname;
    cerr << "  mod_age: " << time_out(mod_age)
            << "  ac_age: " << time_out(ac_age)
            << endl;
  }
  timeval pen_mod(new_mod);
  if (penalty) {
    pen_mod = now;
    pen_mod.tv_sec += penalty;
  }
  timeval upd[2] = {
// beware:  access illogically comes *before* modification here:
    new_ac,
    pen_mod
  };
  utimes(ipname.c_str(), upd);
}

int main(int _argc, char** _argv){
  mypid = getpid();
  int argc(_argc);
  char** argv(_argv);
  const string dirname("/var/qmail/greylist");
  whatsit foo(argv[0], dirname); argc--; argv++;
  int scanmode(0);
  int copies(1);
  int penalty(0);
  int check(0);
  while (argc > 0) {
    string arg = argv[0]; argc--; argv++;
    if (prefix(arg, "-scan")) {
      scanmode++;
    } else if (prefix(arg, "-copy"))  {
      copies++;
    } else if (prefix(arg, "-verbose"))  {
      foo.verbosity++;
    } else if (prefix(arg, "-check"))  {
      check++;
    } else if (prefix(arg, "-penalize")
        || prefix(arg, "-penalty"))  {
      if (!argc){
        cerr << "Option '" << arg << "' requires an argument" << endl;
        exeunt(ex_syserr);
      }
      penalty = atoi(*argv++);  argc--;
    } else if (prefix(arg, "-suffix")) {
      if (!argc){
        cerr << "Option '" << arg << "' requires an argument" << endl;
        exeunt(ex_syserr);
      }
      foo.suffix += *argv++;  argc--;
    } else {
      cerr << "Unrecognized arg: " << arg << endl;
      exeunt(ex_syserr);
    }
  }
  foo.bind();

  if (scanmode) {
    scan(foo.progid, dirname, copies);
    return 0;
  }

  int sts = foo.doit(penalty);

// perform some extra checks.
// Probably a better design would be to
//  a) make more thorough DNS checks, and
//  b) move all the DNS checking to a separate module
  if (check){
    char* hostvar = getenv("TCPREMOTEHOST");
    if (!hostvar) {
      cerr << foo.progid
        << " from " << foo.ipbase
        << " ... TCPREMOTEHOST not set???" << endl;
      exeunt(ex_spam);
    }
  }
  exeunt(sts);
}

int whatsit::doit(const int penalty){
  char* ipvar = getenv("TCPREMOTEIP");
  if (!ipvar) {
    cerr << progid
      << " TCPREMOTEIP not set???" << endl;
    // should never happen
    // although you can make it happen using a weird test-harness
    return(ex_syserr);
  }
  ipbase = ipvar;
  char* hostvar = getenv("TCPREMOTEHOST");
  if (hostvar) hostname = hostvar;

// see if our directory exists:
  struct stat dirstat;
  int rslt = stat(dirname.c_str(), &dirstat);
  if (rslt != 0){
    if (errno != ENOENT) {
      cerr << progid << ": stat failed for '"
        << dirname << "' : ";
      perror(0);
    }
    rslt = mkdir(dirname.c_str(), 0755);
    if (rslt != 0) {
      cerr << progid
        << "uid " << getuid()
        << ": mkdir failed for '"
        << dirname << "' : ";
      perror(0);
      return(ex_syserr);
    }
  }

  ipname = dirname + "/" + ipbase;
  struct stat ipstat;
  rslt = stat(ipname.c_str(), &ipstat);
  if (rslt != 0){
    if (errno != ENOENT) {
      cerr << progid << ": stat failed for '"
        << ipname << "' : ";
      perror(0);
    }
    ofstream foo;
    int fd = creat(ipname.c_str(), 0644);
    if (fd < 0){
      cerr << progid << ": create failed for '"
        << ipname << "' : ";
      perror(0);
    }
    close(fd);
    update("new customer", now, now, penalty);
    return(ex_greylisting);
  }

// now for really checking the greylist status:
  mod_age = now.tv_sec - ipstat.st_mtime;
  ac_age = now.tv_sec - ipstat.st_atime;
  timeval mod_orig = {ipstat.st_mtime, 0};
  if (mod_age < 0) {
    update("penalty box", mod_orig, now, penalty);
    return(ex_penaltybox);
  }
  if (mod_age < ac_age){
    update("paroled spammer", now, now, penalty);
    return(ex_greylisting);
  }
  if (mod_age < minimum_age) {
    update("early bird", mod_orig, now, penalty);
    return(ex_greylisting);
  }
  if (mod_age - ac_age < minimum_age    // early bird, or completely unused
    && mod_age > probation) {           // did not diligently resubmit
    update("disprobation", now, now, penalty);
    return(ex_greylisting);
  }
  if (ac_age > maximum_age) {
    update("too old, starting over", now, now, penalty);
    return(ex_greylisting);
  }
// if all checks are passed, must be OK:
  update("returning customer", mod_orig, now, penalty);
  return 0;
}