pypolicyd-spf-0.6.1/0000755000175000017500000000000010775610073014550 5ustar kittermakittermapypolicyd-spf-0.6.1/policyd-spf.10000644000175000017500000002237510756443630017076 0ustar kittermakitterma\" .\" Standard preamble: .\" ======================================================================== .de Sh \" Subsection heading .br .if t .Sp .ne 5 .PP \fB\\$1\fR .PP .. .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' 'br\} .\" .\" If the F register is turned on, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . nr % 0 . rr F .\} .\" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .hy 0 .if n .na .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. . \" fudge factors for nroff and troff .if n \{\ . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] \fP .\} .if t \{\ . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff .if n \{\ . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} .if t \{\ . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' .ds 8 \h'\*(#H'\(*b\h'-\*(#H' .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] .ds ae a\h'-(\w'a'u*4/10)'e .ds Ae A\h'-(\w'A'u*4/10)'E . \" corrections for vroff .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' . \" for low resolution devices (crt and lpr) .if \n(.H>23 .if \n(.V>19 \ \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} .rm #[ #] #H #V #F C .\" ======================================================================== .\" .IX Title "policy-spf 1" .TH policy-spf 1 "2008-02-18" .SH "NAME" python-policyd-spf \- pure-Python Postfix policy daemon for SPF checking .SH "VERSION" .IX Header "VERSION" 0\.6 .SH "USAGE" .IX Header "USAGE" NOTE: Depending on the packaging and distribution, the exact path to the executable may vary. The executable should be included in the Python path. $ policyd-spf (Start using installed config file) $ policyd-spf \-h (Display usage message) $ policyd-spf /etc/policyd-spf/policyd-spf.conf (Config file name to use) Configuration options are described in the sample configuration file provided with the package policyd-spf.conf(5). The provided setup.py installs this configuration file in /etc/policyd-spf/. Additionally, whitelisting certain IP addresses or IP addresses used by listed domains from SPF checks is supported. Skipping SPF checks for local submission or trusted relays is also provided. The sample configuration file and policyd-spf.conf(5) shows the format to use. .SH "OTHER DOCUMENTATION" .IX Header "OTHER DOCUMENTATION" This documentation assumes you have read Postfix's README_FILES/ SMTPD_POLICY_README and are generally familiar with Sender Policy Framework (SPF). See RFC 4408 for details. See policyd-spf.conf(5) for configuration file information. .SH "SYNOPSIS" .IX Header "SYNOPSIS" python-policyd-spf is a Postfix SMTPd policy daemon for SPF checking. It is implemented in pure Python and uses the pyspf module. The SPF web site is http://www.openspf.org/. The Postfix configuration must be changed to check SPF. .SH "DESCRIPTION" .IX Header "DESCRIPTION" Logging is sent to syslogd. Each time a Postfix SMTP server process is started it connects to the policy service socket and Postfix runs one instance of this Python script. By default, a Postfix SMTP server process terminates after 100 seconds of idle time, or after serving 100 clients. Thus, the cost of starting this Python script is smoothed over time The default policy_time_limit is 1000 seconds. This may be too short for some SMTP transactions to complete. As recommended in SMTPD_POLICY_README, this should be extended to 3600 seconds. To do so, set "policy_time_limit = 3600" in /etc/postfix/main.cf. Messages that get a Fail SPF result will be rejected. Messages that get a Permerror are, by default, treated as if they had no SPF record. Messages that get a Temperror result are, by default, treated as if they had no SPF record, but can (and probably should) be deferred if otherwise permitted. Messages that get other SPF results (Pass, None, Neutral, Softfail) will have the SPF Received header prepended. Note: Spamasassisn 3.2 and follow will use this header for spam scoring so there is no need to configure a separate SPF check in these Spamassassin versions. See Spamassassin documentation for details. Default Mail From rejection/deferal criteria are, by design, conservative. Default HELO check actions are to reject mail with other than Pass/None. HELO records are much simpler than Mail From records and rejecting based on HELO checking does not present a false positive risk. These settings are a matter of local policy and should be adjusted to meet the requirements of site administrators. See policyd-spf.conf(5) for configuration file details. .SH "LOGGING" .IX Header "LOGGING" Policyd-spf will log messages to syslog about it's activities. The "debugLevel" value in "policyd-spf.conf" can be increased to get additional information to be logged. When set to a value of "0", only test results (SPF hits/misses) are logged. Results will be returned to Postfix and logged as a warning by Postfix also. For logging by this policy server, look for "policyd-spf" in your mail log files. .SH "TESTING THE POLICY DAEMON" .IX Header "TESTING THE POLICY DAEMON" Testing the policy daemon To test the policy daemon by hand, execute: policyd-spf Each query is a bunch of attributes. Order does not matter, and the daemon uses only a few of all the attributes shown below: request=smtpd_access_policy protocol_state=RCPT protocol_name=SMTP helo_name=some.domain.tld queue_id=8045F2AB23 instance=12345.6789 sender=foo@bar.tld recipient=bar@foo.tld client_address=1.2.3.4 client_name=another.domain.tld [empty line] The policy daemon will answer in the same style, with an attribute list followed by a empty line: action=dunno [empty line] .SH "POSTFIX INTEGRATION" .IX Header "POSTFIX INTEGRATION" 1. Add the following to /etc/postfix/master.cf: policyd-spf unix - n n - 0 spawn user=nobody argv=/usr/bin/python /usr/bin/policyd-spf NOTE: Check the path to both the installed Python interpreter and policyd-spf. These vary from system to system. To use non-default settings, you must also add the config file (see above and policyd-spf.conf(5) for details). 2. Configure the Postfix policy service in /etc/postfix/main.cf: smtpd_recipient_restrictions = ... reject_unauth_destination check_policy_service unix:private/policyd-spf ... policyd-spf_time_limit = 3600 NOTE: Specify check_policy_service AFTER reject_unauth_destination or else your system can become an open relay. 3. Reload Postfix. .SH "SEE ALSO" .IX Header "SEE ALSO" policyd-spf.conf(5), python-spf, , RFC 4408 .SH "AUTHORS" .IX Header "AUTHORS" This version of \fBpython-policyd-spf\fR was written by Copyright (c) 2007 Scott Kitterman . It is derived from Tumgreyspf, written by Sean Reifschneider, tummy.com, ltd . Portions of the documentation were written by Meng Weng Wong . .PP This man-page was created by Scott Kitterman . pypolicyd-spf-0.6.1/policyd-spf0000755000175000017500000004323310775606305016737 0ustar kittermakitterma#!/usr/bin/python # # Check SPF results and provide recommended action back to Postfix. # # Tumgreyspf source # Copyright (c) 2004-2005, Sean Reifschneider, tummy.com, ltd. # # # pypolicyd-spf # Copyright (c) 2007, 2008 Scott Kitterman ''' This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.''' __version__ = "0.6.1: Apr 05 2008" import syslog, os, sys, string, re, time, popen2, urllib, stat, errno, socket, spf import policydspfsupp syslog.openlog(os.path.basename(sys.argv[0]), syslog.LOG_PID, syslog.LOG_MAIL) policydspfsupp.setExceptHook() ############################################# def cidrmatch(connectip, ipaddrs, n): """Match connect IP against a list of other IP addresses. From pyspf.""" try: if connectip.count(':'): MASK = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL connectip = spf.inet_pton(connectip) for arg in ipaddrs: ipaddrs[ipaddrs.index(arg)] = spf.inet_pton(arg) bin = spf.bin2long6 else: MASK = 0xFFFFFFFFL bin = spf.addr2bin c = ~(MASK >> n) & MASK & bin(connectip) for ip in [bin(ip) for ip in ipaddrs]: if c == ~(MASK >> n) & MASK & ip: return True except socket.error: pass return False def parse_cidr(cidr_ip): """Breaks CIDR notation into a (address,cidr,cidr6) tuple. The cidr defaults to 32 if not present. Derived from pyspf""" import re RE_DUAL_CIDR = re.compile(r'//(0|[1-9]\d*)$') RE_CIDR = re.compile(r'/(0|[1-9]\d*)$') a = RE_DUAL_CIDR.split(cidr_ip) if len(a) == 3: cidr_ip, cidr6 = a[0], int(a[1]) else: cidr6 = None a = RE_CIDR.split(cidr_ip) if len(a) == 3: cidr_ip, cidr = a[0], int(a[1]) else: cidr = None b = cidr_ip.split(':', 1) if len(b) < 2: return cidr_ip, cidr return a[0], cidr6 ############################################# def spfbypass(data, check_type, configData): if configData.get(check_type): if configData.get('Prospective'): ip = configData.get('Prospective') else: ip = data.get('client_address') bypass_list = (str(configData.get(check_type))) bypass_list_list = bypass_list.split(',') if check_type == 'skip_addresses' or check_type == 'Whitelist': for cidr in bypass_list_list: parsed_address = parse_cidr(cidr) good_ip = [parsed_address[0],] cidr_range = parsed_address[1] if not parsed_address[1]: ip_str = str(good_ip[0]) if spf.RE_IP4.match(ip_str): cidr_range = 32 elif spf.RE_IP6.match(ip_str): cidr_range = 128 else: Message = 'ERROR: ' + ip_str + ' in ' + check_type + ' not IP address. Aborting whitelist processing.' if debugLevel: syslog.syslog(Message) return (False, 'None') if cidrmatch(ip, good_ip, int(cidr_range)): if check_type == 'skip_addresses': comment = 'SPF check N/A for local connections - ' else: comment = 'SPF skipped for whitelisted relay - ' Header = ('X-Comment: ' + comment + 'client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % ( data.get('client_address', ''), data.get('helo_name', ''), data.get('sender', ''), data.get('recipient', ''), )) if debugLevel >= 3: syslog.syslog(Header) return (True, Header) return (False, 'None') elif check_type == 'Domain_Whitelist': for domain in bypass_list_list: res = spf.check2(ip, domain, domain) domain_res = [res[0], res[1]] domain_res[0] = domain_res[0].lower() domain_res[0] = domain_res[0].capitalize() if domain_res[0] == 'Pass': comment = 'SPF skipped for whitelisted relay domain - ' Header = ('X-Comment: ' + comment + 'client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % ( data.get('client_address', ''), data.get('helo_name', ''), data.get('sender', ''), data.get('recipient', ''), )) if debugLevel >= 3: syslog.syslog(Header) return (True, Header) return (False, 'None') ############################################# def spfcheck(data, instance_dict, configData): #{{{1 debugLevel = configData.get('debugLevel', 1) if configData.get('Prospective'): ip = configData.get('Prospective') else: ip = data.get('client_address') if ip == None: if debugLevel >= 2: syslog.syslog('spfcheck: No client address, exiting') return(( None, None, instance_dict )) # Do not check SPF for localhost addresses skip_check = spfbypass(data, 'skip_addresses', configData) if skip_check[0]: return (('prepend', skip_check[1], instance_dict )) # Whitelist designated IP addresses from SPF checks (e.g. secondary MX or # known forwarders. ip_whitelist = spfbypass(data, 'Whitelist', configData) if ip_whitelist: if ip_whitelist[0]: return (('prepend', ip_whitelist[1], instance_dict )) # Whitelist designated Domain's sending addresses from SPF checks (e.g. # known forwarders. domain_whitelist = spfbypass(data, 'Domain_Whitelist', configData) if domain_whitelist: if domain_whitelist[0]: return (('prepend', domain_whitelist[1], instance_dict )) #recipient = data.get('recipient') receiver=socket.gethostname() sender = data.get('sender') helo = data.get('helo_name') if not sender and not helo: if debugLevel >= 2: syslog.syslog('spfcheck: No sender or helo, exiting') return(( None, None, instance_dict )) # start query spfResult = None spfReason = None instance = data.get('instance') # The following if is only needed for testing. Postfix # will always provide instance. if not instance: import random instance = str(int(random.random()*100000)) # This is to prevent multiple headers being prepended # for multi-recipient mail. found_instance = instance_dict.has_key(instance) '''Data structure for results is a list of: [0] SPF result [1] SPF reason [2] Identity (HELO/Mail From) [3] Action based on local policy [4] Header''' if not found_instance: Mail_From_pass_restriction = configData.get('Mail_From_pass_restriction') HELO_pass_restriction = configData.get('HELO_pass_restriction') helo_result = ['None',] # First do HELO check # if no helo name sent, use domain from sender for later use. if not helo: foo = string.split(sender, '@', 1) if len(foo) < 2: helo = 'unknown' else: helo = foo[1] else: if configData.get('HELO_reject') != 'No_Check': helo_fake_sender = 'postmaster@' + helo res = spf.check2(ip, helo_fake_sender, helo) helo_result = [res[0], res[1]] helo_result.append('helo') helo_result[0] = helo_result[0].lower() helo_result[0] = helo_result[0].capitalize() if debugLevel >= 2: syslog.syslog('spfcheck: pyspf result: "%s"' % str(helo_result)) if configData.get('HELO_reject') == 'Null' and sender: helo_result.append('dunno') elif helo_result[0] == 'Temperror' and configData.get('TempError_Defer') == 'True': helo_result.append('defer') elif helo_result[0] == 'Permerror' and configData.get('PermError_reject') == 'True': helo_result.append('reject') elif helo_result[0] == 'Permerror' and configData.get('PermError_reject') == 'False': helo_result.append('prepend') elif configData.get('HELO_reject') == 'Fail' and helo_result[0] == 'Fail': helo_result.append('reject') elif configData.get('HELO_reject') == 'SPF_Not_Pass' and (helo_result[0] == 'Fail' or helo_result[0] == 'Softfail' or helo_result[0] == 'Neutral'): helo_result.append('reject') helo_result[1] = 'SPF HELO result: rejected due to local policy (Not Pass/None)' else: helo_result.append('prepend') if sender == '': header_sender = '<>' else: header_sender = sender if helo_result[0] == 'None': helo_result[1] = "no SPF record" spfDetail = ('identity=%s; client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % (helo_result[2], ip, helo, header_sender, data.get('recipient', ''))) if debugLevel >= 1: logdata = str(helo_result[0]) + "; " + spfDetail syslog.syslog(logdata) header = 'Received-SPF: '+ helo_result[0] + ' (' + helo_result[1] +') ' + spfDetail helo_result.append(header) instance_dict[instance] = helo_result if HELO_pass_restriction and helo_result[0] == 'Pass': restrict_name = HELO_pass_restriction # Only act on the HELO result if it is authoritative. if helo_result[3] == 'reject': header = "Message rejected due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'reject', header, instance_dict )) if helo_result[3] == 'defer': header = "Message deferred due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'defer', header, instance_dict )) # Second do Mail From Check if sender == '': if configData.get('HELO_reject') != 'No_Check': if helo_result[3] == 'reject': header = "Message rejected due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') if helo_result[3] == 'defer': header = "Message deferred due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') if HELO_pass_restriction and helo_result[0] == 'Pass': restrict_name = HELO_pass_restriction return('result_only', restrict_name, instance_dict) return(( helo_result[3], header, instance_dict )) else: if configData.get('Mail_From_reject') != 'No_Check': res = spf.check2(ip, sender, helo) mfrom_result = [res[0], res[1]] mfrom_result.append('mailfrom') mfrom_result[0] = mfrom_result[0].lower() mfrom_result[0] = mfrom_result[0].capitalize() if debugLevel >= 2: syslog.syslog('spfcheck: pyspf result: "%s"' % str(mfrom_result)) mfrom_result.append('dunno') if mfrom_result[0] == 'Temperror' and configData.get('TempError_Defer') == 'True': mfrom_result[3] = 'defer' elif mfrom_result[0] == 'Permerror' and configData.get('PermError_reject') == 'True': mfrom_result[3] = 'reject' elif mfrom_result[0] == 'Permerror' and configData.get('PermError_reject') == 'False': mfrom_result[3] = 'prepend' elif configData.get('Mail_From_reject') == 'Fail' and mfrom_result[0] == 'Fail': mfrom_result[3] = 'reject' else: mfrom_result[3] = 'prepend' if mfrom_result[0] == 'None': mfrom_result[1] = 'no SPF record' if mfrom_result[0] != 'None' or (mfrom_result[0] == 'None' and helo_result[0] == 'None'): spfDetail = \ ('identity=%s; client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % (mfrom_result[2], ip, helo, sender, data.get('recipient', ''))) if debugLevel >= 1: logdata = str(mfrom_result[0]) + "; " + spfDetail syslog.syslog(logdata) header = 'Received-SPF: '+ mfrom_result[0] + ' (' + mfrom_result[1] +') ' + spfDetail mfrom_result.append(header) instance_dict[instance] = mfrom_result if (Mail_From_pass_restriction and mfrom_result[0] == 'Pass') or (HELO_pass_restriction and helo_result[0] == 'Pass'): if mfrom_result[0] == 'Pass': restrict_name = Mail_From_pass_restriction return('result_only', restrict_name, instance_dict) # Act on the Mail From result if it is authoritative. if mfrom_result[3] == 'reject': header = "Message rejected due to: " + mfrom_result[1] + ". Please see http://www.openspf.org/Why?s=mfrom;id=" + sender + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'reject', header, instance_dict )) if mfrom_result[3] == 'defer': header = "Message deferred due to: " + mfrom_result[1] + ". Please see http://www.openspf.org/Why?s=mfrom;id=" + sender + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'defer', header, instance_dict )) if mfrom_result[3] != 'dunno' or helo_result[3] =='dunno': return(( 'prepend', header, instance_dict )) else: cached_instance = instance_dict[instance] if cached_instance[3] == 'prepend': return(( 'dunno', 'Header already pre-pended', instance_dict )) else: return(( cached_instance[3], cached_instance[4], instance_dict )) return(( 'None', 'None', instance_dict )) ################################################### # load config file {{{1 # Default location: configFile = '/etc/python-policyd-spf/policyd-spf.conf' if len(sys.argv) > 1: if sys.argv[1] in ( '-?', '--help', '-h' ): print 'usage: policyd-spf []' sys.exit(1) configFile = sys.argv[1] configGlobal = policydspfsupp.processConfigFile(filename = configFile) # loop reading data {{{1 debugLevel = configGlobal.get('debugLevel', 1) if debugLevel >= 3: syslog.syslog('Starting') instance_dict = {'0':'init',} instance_dict.clear() data = {} lineRx = re.compile(r'^\s*([^=\s]+)\s*=(.*)$') while 1: line = sys.stdin.readline() if not line: break line = string.rstrip(line) if debugLevel >= 4: syslog.syslog('Read line: "%s"' % line) # end of entry {{{2 if not line: if debugLevel >= 4: syslog.syslog('Found the end of entry') configData = configGlobal if debugLevel >= 3: syslog.syslog('Config: %s' % str(configData)) # run the checkers {{{3 checkerValue = None checkerReason = None checkerValue, checkerReason, instance_dict = spfcheck(data, instance_dict, configData) if configData.get('defaultSeedOnly') == 0: checkerValue = None checkerReason = None # handle results {{{3 if checkerValue == 'reject': sys.stdout.write('action=550 %s\n\n' % checkerReason) elif checkerValue == 'prepend': if configData.get('Prospective'): sys.stdout.write('action=dunno\n\n') else: sys.stdout.write('action=prepend %s\n\n' % checkerReason) elif checkerValue == 'defer': sys.stdout.write('action=defer_if_permit %s\n\n' % checkerReason) elif checkerValue == 'warn': sys.stdout.write('action=warn %s\n\n' % checkerReason) elif checkerValue == 'result_only': sys.stdout.write('action=%s\n\n' % checkerReason) else: sys.stdout.write('action=dunno\n\n') # end of record {{{3 sys.stdout.flush() data = {} continue # parse line {{{2 m = lineRx.match(line) if not m: syslog.syslog('ERROR: Could not match line "%s"' % line) continue # save the string {{{2 key = m.group(1) value = m.group(2) if key not in [ 'protocol_state', 'protocol_name', 'queue_id' ]: value = string.lower(value) data[key] = value if debugLevel >= 3: syslog.syslog('Normal exit') pypolicyd-spf-0.6.1/TODO0000644000175000017500000000050610757117171015242 0ustar kittermakittermaObject cache Make the code support operations as a true Dameon Use pyspf to make SPF Received headers Python DBM, Berkeley DB, and Python sqlite whitelist management support Best Guess Local mfrom SPF bypass (per user) Per user (rcpt to address) policy Per user (rcpt to address) whitelisting Domain or address/IP pair reject pypolicyd-spf-0.6.1/policyd-spf.conf0000644000175000017500000000477210757115710017660 0ustar kittermakitterma# Amount of debugging information logged. 0 logs no debugging messages # 4 includes all debug messages. debugLevel = 1 # If set to 0, no messages are rejected by SPF. This allows you to see the # potential impact of SPF checking in your mail logs without rejecting mail. defaultSeedOnly = 1 # HELO check rejection policy. Options are: # HELO_reject = SPF_Not_Pass (default) - Reject if result not Pass/None/Tempfail. # HELO_reject = Fail - Reject only on HELO Fail # HELO_reject = Null - Only reject HELO Fail for Null sender (SPF Classic) # HELO_reject = False - Never reject on HELO, append header only. # HELO_reject = No_Check - Never check HELO. HELO_reject = SPF_Not_Pass # HELO pass restriction policy. # HELO_pass_restriction = helo_passed_spf - Apply the given restriction when # the HELO checking result is Pass. The given restriction must be an # action as defined for a Postfix SMTP server access table access(5). HELO_pass_restriction # Mail From rejection policy. Options are: # Mail_From_reject = Fail - Reject only on Mail From Fail # Mail_From_reject = False - Never reject on Mail From, append header only # Mail_From_reject = No_Check - Never check Mail From/Return Path. Mail_From_reject = Fail # Mail From pass restriction policy. # Mail_From_pass_restriction = mfrom_passed_spf - Apply the given # restriction when the Mail From checking result is Pass. The given # restriction must be an action as defined for a Postfix SMTP server # access table access(5). Mail_From_pass_restriction # Policy for rejecting due to SPF PermError. Options are: # PermError_reject = True # PermError_reject = False PermError_reject = False # Policy for deferring messages due to SPF TempError. Options are: # TempError_Defer = True # TempError_Defer = False TempError_Defer = False # Prospective SPF checking - Check to see if mail sent from the defined IP # address would pass. # Prospective = 192.168.0.4 # Do not check SPF for localhost addresses - add to skip addresses to # skip SPF for internal networks if desired. Defaults are standard IPv4 and # IPv6 localhost addresses. skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0//104,::1//128 # Whitelist: CIDR Notation list of IP addresses not to check SPF for. # Example (default is no whitelist): # Whitelist = 192.168.0.0/31,192.168.1.12 # Domain_Whitelist: List of domains whose sending IPs should be whitelisted # from SPF. # Example (default is no domain whitelist): # Domain_Whitelist = pobox.com,trustedforwarder.org pypolicyd-spf-0.6.1/policydspfsupp.py0000644000175000017500000001301710756654406020217 0ustar kittermakitterma# # Tumgreyspf # Copyright (c) 2004-2005, Sean Reifschneider, tummy.com, ltd. # # pypolicyd-spf changes # Copyright (c) 2007,2008 Scott Kitterman ''' This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.''' import syslog, os, sys, string, re, time, popen2, urllib, stat # default values defaultConfigData = { 'debugLevel' : 1, 'HELO_reject' : 'SPF_Not_Pass', 'Mail_From_reject' : 'Fail', 'PermError_reject' : 'False', 'TempError_Defer' : 'False', 'skip_addresses' : '127.0.0.0/8,::ffff:127.0.0.0//104,::1//128', 'defaultSeedOnly' : 1 } ################################# class ConfigException(Exception): '''Exception raised when there's a configuration file error.''' pass #################################################################### def processConfigFile(filename = None, config = None, useSyslog = 1, useStderr = 0): '''Load the specified config file, exit and log errors if it fails, otherwise return a config dictionary.''' import policydspfsupp if config == None: config = policydspfsupp.defaultConfigData if filename != None: try: readConfigFile(filename, config) except Exception, e: if useSyslog: syslog.syslog(e.args[0]) if useStderr: sys.stderr.write('%s\n' % e.args[0]) sys.exit(1) return(config) ################# class ExceptHook: def __init__(self, useSyslog = 1, useStderr = 0): self.useSyslog = useSyslog self.useStderr = useStderr def __call__(self, etype, evalue, etb): import traceback, string tb = traceback.format_exception(*(etype, evalue, etb)) tb = map(string.rstrip, tb) tb = string.join(tb, '\n') for line in string.split(tb, '\n'): if self.useSyslog: syslog.syslog(line) if self.useStderr: sys.stderr.write(line + '\n') #################### def setExceptHook(): sys.excepthook = ExceptHook(useSyslog = 1, useStderr = 1) #################### def quoteAddress(s): '''Quote an address so that it's safe to store in the file-system. Address can either be a domain name, or local part. Returns the quoted address.''' s = urllib.quote(s, '@_-+') if len(s) > 0 and s[0] == '.': s = '%2e' + s[1:] return(s) ###################### def unquoteAddress(s): '''Undo the quoting of an address. Returns the unquoted address.''' return(urllib.unquote(s)) ############################################################### commentRx = re.compile(r'^(.*)#.*$') def readConfigFile(path, configData = None, configGlobal = {}): '''Reads a configuration file from the specified path, merging it with the configuration data specified in configData. Returns a dictionary of name/value pairs based on configData and the values read from path.''' debugLevel = configGlobal.get('debugLevel', 0) if debugLevel >= 5: syslog.syslog('readConfigFile: Loading "%s"' % path) if configData == None: configData = {} nameConversion = { 'debugLevel' : int, 'HELO_reject' : str, 'Mail_From_reject' : str, 'PermError_reject' : str, 'TempError_Defer' : str, 'Mail_From_pass_restriction' : str, 'HELO_pass_restriction' : str, 'Prospective' : str, 'Whitelist' : str, 'skip_addresses': str, 'Domain_Whitelist' : str, 'defaultSeedOnly' : int } # check to see if it's a file try: mode = os.stat(path)[0] except OSError, e: syslog.syslog('ERROR stating "%s": %s' % ( path, e.strerror )) return(configData) if not stat.S_ISREG(mode): syslog.syslog('ERROR: is not a file: "%s", mode=%s' % ( path, oct(mode) )) return(configData) # load file fp = open(path, 'r') while 1: line = fp.readline() if not line: break # parse line line = string.strip(string.split(line, '#', 1)[0]) if not line: continue data = map(string.strip, string.split(line, '=', 1)) if len(data) != 2: if len(data) == 1: if debugLevel >= 1: syslog.syslog('Configuration item "%s" not defined in file "%s"' % ( line, path )) else: syslog.syslog('ERROR parsing line "%s" from file "%s"' % ( line, path )) continue name, value = data # check validity of name conversion = nameConversion.get(name) if conversion == None: syslog.syslog('ERROR: Unknown name "%s" in file "%s"' % ( name, path )) continue if debugLevel >= 5: syslog.syslog('readConfigFile: Found entry "%s=%s"' % ( name, value )) configData[name] = conversion(value) fp.close() return(configData) pypolicyd-spf-0.6.1/policyd-spf.conf.50000644000175000017500000003360310756443630020022 0ustar kittermakitterma\" .\" Standard preamble: .\" ======================================================================== .de Sh \" Subsection heading .br .if t .Sp .ne 5 .PP \fB\\$1\fR .PP .. .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations aess[0e\el' ctim te\*(--hat i.fi . Thing unline:cess dasen(\*(PIhat it Thipin(\*(L"hat it Thia ft.fi .douess lib.uley DB\*(R"hat it Thia Copydouess lib.u te\*(C+hat i.fi . Thin nicharC++ teCt[0].c t ugaERROuirs tt is unline:cess daseelatio.fi . whenf to wo we ithev cess te\*(C`ey DB\*(C'0] pgDatao `str +nroff,.fi . "%h checkitroff, can't CeckiPODpErr urn (Fyou' ithouldis iso ache.fi .outputing i ir lint upmean chful faseoundap .5\nF \{\ . 1e IX . tm Iddrs:PP \ft\\n%\t"PP 2" R .fe r 0.fe s. F.fi} .\F nroff,hi lidf jifiult lofe Awill ai lidf hypacelt lo;ors pf ts\illdisyspfny mwhif tseckitechn" Verf the dos .fhy 0.f .5v .na .\Accrecipirks" notiSubsg (@(#)ms.acc 1.5 88/02/007,MI;e "%s"UCB 4.2) .fi .FeampErRuofe Souldng i ife Nocy Pe- SMTichcess locas .fe i .fudge factog ef nroffigDataroff.f .5v \{\ . 1sr#H 0.fe 1sr#V .8m.fe 1sr#F .3m.fe 1sr#[ \f1.fe 1sr#] \fP.fi} ..PP) \{\ . 1sr#H ((1u-(\\\\n(.fu%2u))*.13m).fe 1sr#V .6m.fe 1sr#F 0.fe 1sr#[ \&.fe 1sr#] \&.fi} .e i .si# Exaccrec ef nroffigDataroff.f .5v \{\ . 1sr' \&.fe 1sr` \&.fe 1sr^ \&.fe 1sr, \&.fe 1sr~ ~.fe 1sr/.fi} ..PP) \{\ . 1sr' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u".fe 1sr` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'.fe 1sr^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'.fe 1sr, \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'.fe 1sr~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'.fe 1sr/ \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'.fi} .e i .troffigDat(daisy-pacel) nroffigccrec \$1sr: \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'\$1sr8 \h'\*(#H'\(*b\h'-\*(#H'\$1sro \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]\$1srd- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'\$1srD- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'.fd ach \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]\$1srTh \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]\$1sraExa\h'-(\w'a'u*4/10)'e\$1srAe A\h'-(\w'A'u*4/10)'E .e i .corr" Subsg f vroff.f .5v .1sr~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'.f .5v .1sr^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'.fe i .fname,w # olufiguraeTichg (cre, exitpr)ap .5\n(.H>23 p .5\n(.V>19 \ \{\ . 1sr: e . 1sr8 ss . 1sro a . 1srd- d\h'-1'\(ga . 1srD- D\h'-1'\(hy . 1srch \o'bp'.fe 1srTh \o'LP'.fe 1sraExae . 1srAe AE.fi} .rmr#[ #] #H #V #F Camble: .\" ====================================================================IX Title "0.6.1/olicyd-sp 5TH 0.6.1/olicyd-sp 5 " 200-02-18SH "NAME" '/etc/python-polic \- pure-, and Pfor a Polocal pdaemo# knoective SPF chSH "VERSIONIX no', 'H"VERSION0\.6 SH "USAGEIX no', 'H"USAGEUint ' usage: policydle = 'thon-policyd-spf/policyd-sp] SH "OTHER DOCUMENTATIONIX no', 'H"OTHER DOCUMENTATION f the doa an actshe allowhould hadPfor a P'srREADME_FILES/ stfiD_POLICY_README, exi Sof GNU lly familiarra SNull se # PFrameal n ende)URPOSE.RFC 44007olicy ore detaKitt1usage: policylways psf GNU lupport ope f the doa an aeeded icaknt . SH "SYNOPSISIX no', 'H"SYNOPSIS '/etc/python-polic pport eil logher ple (def llpecified configuration exi # Imountle (deified configuroor. Opss so Sofuirs if with the configur loadcan "%sbeif nots Passan'oor. Opdresbeyd-spf ejectd-spf che even llpec h the configur loas eded rough. Ts sen name,(rcp aclfor itith the configur loa. SH "DESCRIPTIONIX no', 'H"DESCRIPTION Cfied configuroor. Opafor mscribReceireey DBid with the configur loa lways pdit witicaknt . Pass.lways pdi# uspfsen lls withh the configur loaBid le = 'thon-policy. AddiSubs lly,dress) whitel cert a dnated IP addresses from SPF cithement sed. ass. withKittp "MegData ans # Exh the configur loa sh,w re inback.,(rclaterSH "OPTIONSIX no', 'H"OPTIONSSH "LOGGINGIX no', 'H"LOGGING " if debu" rols wOpa# Amougging information d blocal p SMTP erTfrom te (d,slogd. 0 logs no debugging me, j paiic [0] SPF lationd log GNU stded rough. blocal p SMTP en. name, dresbeyinc] SPtdeup,(rc5 ersions highit unres5hat it# Doacan'resspt OSE, at it# DuseSfny addiSubs l gging infor) .sages. ldebug2 addults obugging m # k: No client a (nated IP aressesresch with tal conn\ilthKide)len the Mailed IP asn namtity EHLOnknownisd have recby blocal p SMTP ,, exit as [0] SPF laeedeeachen the Maileexi the HELO .sages. ldebug3t GNU stults obugging m eache, re. blocal p SMTP # latio.eache, re.rs sysn lthwe # smatios sennived a copy oexal ippend h rs tt for a Po(rcbe being prenly''''Undgging men.Eache, re. blocal p SMTP # l,sages. ldebug3talsoit as with the configurgging informuirs blocal SMTP erages. ldebug4it as with # Eteration etd have recbyPfor a Povia blocal F forfcal eexiction whe # e whe und isd haderages. ldebug5ERROuirs tt iges. load configelist procerror'nniejectben etda d e theender anvia b load confierI if ldebugRRO0, n. blocal p SMTP t as d log eeader ired. D: sages. debugLevSH "TEST OPERATIONIX no', 'H"TEST OPERATIONTfrolocal p SMTP 'nniepNU stridons porteject, oc. SPF. This allows you to s e # potential impact of SPF checking in your mail logs without rejecting Hnd', g aforbeing prenlyugging me, , gging m d) wTP yERROR: isffre re. SPF. RROR: iencessecbyPm te (den. oiencess.rs,n etdmail. defaultSeedO0r ired. D: sagil. defaultSeedOnlySH "tity EHLOnCHECKINGIX no', 'H"tity EHLOnCHECKING 1 # HELO check rejection roor. Opafo: sect = SPF_Not_Pass (default) - Reject if result not Pass/None/Tem Unlikhen th Mail From ch,. when afornots are stae- yourcan'caaddrwwhen a 1 # HELO You esult no if wir RROnni= 'no SPF aeeded theknown(acterpafoail ustedf ch, eedee. # E,ERROR: isurgtshe)URTechn" Ve - Apng i''ExceRROR: ifue - RFC 4400 h # ianagei_ins when the Mail ('id ithKitatiory, , tity EHLOnithOR: U l # id witstfixdpotoguMegData ar RROR:rbebe a Ver] SPF ws yw'pos # ourst only on Mailm SPF cifn # the HELO # wder aloacan''Undgging mo(rcbe s are rer ect = Fail - Reject only on HELen. echn" Ve - Apng i''ExceRROR: ifue - RFC 4400 h # ianagei_ins when the Mail ('id ithKitatiory, , tity EHLOnithOR: U l # id witstfixdpotoguMegData ar RROR:rbebe a Ver] SPF ws yw'pos # ourst only on Mailm SPF cifn # the HELO # wder aloacan''Undgging mo(rcbe s are rer ect = Null - Only reject HELO Fail for Null sender (SPF Clen. i ache.apeliacheuirs blre-RFC 44007rrrore_insi# Ee doa an actionfny e whelre- RFC data sult lom teameootin Du SPt Apng i''Exce(ect = SPF_NotILITHEL) afo lwsage de) i ahighl - O##### drer ect = False - Never reject on HELO, append header i all be O Faier =-stfi rpas" frt, g suche smSpasAing pror ect = No_Check - Never checkn. i aonl - O##### drecifnllowafor Ve che ev local p SMTP twial so_insfnamtitylm SPF cctioo_insfnam(HELO/Mailit wo difrore_deified configur loasby SPF. peliachei all be O(rcgetdbo wittityltio.ly on Mailend', g being pren(rcpdgging me ired. D: sHELO. HELO_reject = SPF_Not_SH "tity EHLOnPASS RESTRICTIONIX no', 'H"tity EHLOnPASS RESTRICTION 1 # F_NotRpass_restricThis aF fogonfigurt , Pfor a Potable h ttlols by.lway's sency Peremenhe imknownotinier =a Potable # restri(rcbe aenhe im(rcpdgging miction whe the HELO checking esult is Pass.indsult im # restriction must be an action as defined for a Postfix SMTP server access table accationdxplaot defin ev for a PoRESTRICTION CLASS READMEe F. # E: sHELO. HELO_pass_restriction = helo_pass ired. D: sson = SH "nd do Mail HECKINGIX no', 'H"nd do Mail HECKING.ly on Mailcheck rejection roor. Opafo: sect = Fail - Reject only on Mail Fror ect = False - Never reject on Mail From, append headekn. i all be O Fai er =-stfi rpas" frt, g suche smSpasAing pror ect = No_Check - Never check Mail From/Returnn. i aonl - O##### drecifnllow afor Ve che ev local p SMTP twial so_insfnamtitylm SPF cctioo_insfnam(HELO /Mailit wo difrore_deified configur loasby SPF. peliachei all be O(rcgetd bo wittityltio ly on Mailend', g being pren(rcpdgging me Ideifou salsoibe uirs tt is the HELO cheonl -(beoacan' the HELO chehaults owm sect = er irosp risk unresn the Mail From ch), , tPF. peliachewROR: Coulbeifue - RFC 4400 h # ianagei_ins when the Mail ('id ithKitatiorye ired. D: sPath. Mail_From_reject = SH "nd do MailPASS RESTRICTIONIX no', 'H"nd do MailPASS RESTRICTION.ly on MailF_NotRpass_restricThis aF fogonfigurt , Pfor a Potable h ttlols by.lway's sency Peremenhe imknownotinier =a Potable # restri(rcbe aenhe im(rcpdgging miction whe the HELO checking esult is Pass.indsult im # restriction must be an action as defined for a Postfix SMTP server access table accationdxplaot defin ev for a PoRESTRICTION CLASS READMEe F. # E: s you_fMail_From_pass_restriction = helo_pass ired. D: sson = SH "PERMANENT slog('PROCESSINGIX no', 'H"PERMANENT slog('PROCESSING n # Policy for rejecting due to SPF Perroor. Opafo: sfer = Fail - R'Undgging moifn # [0] SPF r(fnamtitylnam(HELO/MailiF. o SPF PermErSPF. haultshighit Yrt-ksect = er irosp risk, , doesecking enr Null sf t rejeffau trapss so # ywhoulda.lwaessmit wiiri= 'no SPF r ect = FaTdertto SPF Perra ans #eacti1] = 'no SPF in DcThnn. i ah tswhitt t witire-RFC rint n(awitire-RFC knowneeded d log\ilth"RROR: U")e ired. D: sFalse PermError_reject = FSH "TEMPORARY slog('PROCESSINGIX no', 'H"TEMPORARY slog('PROCESSING n # Policy for deferring messages due to SPF Temroor. Opafo: sfer = Fail - R'Undgging moifn # [0] SPF r(fnamtitylnam(HELO/MailiF. o SPF TempEr i acheractdiSubs l rint nctionath thhoutll be Oiyou cuc chtablped_inso### wana dedebug mes Some, res rpas" Null sfd # Dretrekn. Some, res b, re.pdgging miisd hunieata anshose sendonathKide.rs oy'''a DNS RBLerror'nni n.bges are repEr i aessesfrom te (d beoacan'lt if er siess fnamnt upDNS d log ess so Sof#####a speclth"o SPorary" passRFC (rcbe pt@kite_deid witsic Liss so # ywrequireiepNU s SPF forv ('tri(rccorr" Sr ect = FaTdertto SPF Temra ans #eacti1] = 'no SPF in DcThnn. i asfrom te (d pyspinimizesect = er irosp riske ired. D: sFalse TempError_Defer = FSH "P # Prospectiv = NoIX no', 'H"P # Prospectiv = No e # Prospective SPF checking - Check to see if mail sent from the definIP # address wouldn. i all be O Faioutbile: MTAdressavoidnshose seee ifss s dress ect = from SPF cction.getck epErDiscess the HELO chectionus che eif oor. e Id' aonl -e # potl -ll be O Fain the Mail From ch.o make SPF Re hnd', g aforR: isddn raised wng i''ExceRROuirs. e # Prospective = 192.168ired. D: sson = SH "LOCALo makBYPASS LISTIX no', 'H"LOCALo makBYPASS LIST 4 # Do not check SPF for localhost addresses - add to skip addresso # ski p SPF for internal networks if desired. Defaults are standard IPand # IPv6 loc lhost addr. cp aclsoibeOuirs,ressaThiseee if sente, or k: No g submit reje ee ifsrcp aMTAaclsoiar rejeaultsn theSubmisconveAgmail(MSA) (rcbe o #p epErAn x-ppend hisrbeing prenlydsultreje from SPF ccar o #p essages date, or of an addr i aa tb =append headekn.N ''' froltrapo##ticalseid wit whie ired. D: ssses. skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0//104,::1/SH "SfrondoWHITELISTIX no', 'H"SfrondoWHITELIST Ath #mon epaU stdelist: CIDR Notation list of IP addresses no # skim SPF c p S.eameo wng ationtt is no whi x.com,tn.glll a(suche smon e # ictiMXn exi x.com,tnrustedfors)pErAn x-ppend hisrbeing prenlydsultreje witst ilt ld be whitelagof dt skim SPF ddr i aa tb =append headekn.N ''' froltra o##ticalseid wit whie F. # E: s): # Whitelist = 192.168.0.0/31,192.168068ired. D: sson = SH " skiDOMAINoWHITELISTIX no', 'H"SfroDOMAINoWHITELIST 2 # Domain_Whitelist: List of domains whose sending IPs should be whitel sent skim SPF ddrameo wng tt whi x.com,tnrustedforscbyPmbe a domai teC: No cfinIP # amessage portelagof dt skio SPF on 2 as publ b whitelst of dddr i all be O Failargenrustedforsct h # Exioutbile: infraassucturelatio sk o SPF oddr i''ExceRROln add orcess unres # [0ndoWd be whipErAn x-ppend h isrbeing prenlydsultreje witst ilt ld be whitelagof dt skim SPF ddr i aa tb =append headekn. i''Excedoese "%h checfn # mbe a ddoese "%whouldan sk o SPF e Ied wng caad can''Und [0ndoWd be whir mscribRecabhho..N ''' froltra o##ticalseid wit whie F. # E: s): # Domain_Whitelist = pobox.com,trustedforwarde8ired. D: sson = SH " EE ALSOIX no', 'H"SEE ALSOKitt1usage: polic, '/etc/plic, , RFC 4400 SH "AUTHORSIX no', 'H"AUTHORS nf conveo##\fB'/etc/python-polic\fR ilt lrnl es # Copyright (ct 2008 Scott Kitterman . n rr. Opofn # mbthe doa an acar lrnl MecheWecheWoeje 0epaU st al netwg undm vLs,etised wng ublic Lley DBi g t the,fd # Ddpf - Aoopyo L \" Subsg whionng dcan redistrre m'as 0epaU st al nee B ahionng can redistrawits #ea\" Subsg ath Srtnetiniwholtrreschni aa al nipairs basundePthis p, a andan redisan ao## savwholtrction mubasunder the te wng ublic Llemains lr_ifsconvg f P wlic L sssxfo p Aoopy ('ravwholt,rgData us (rceacheiiondTP yE Srtnregardln adefrph:rpsot eitentT us,eitERROR: itss.intr Amou #ng Srestri(rcclaimo Cops edeh t rst ng i Copsitt il nirrnl ('raectbyong ; U shchneiss.intr Ang tt exercimeo nde Cope(rcve rol a andan redisan ao##fere arospeor vell Prospeal netpairs basundePthis perIn addiSubsd pathctggregasan ao##ano il niCoulbairs basundePthis p t witPthis pr(ine logheral nipairs basundePthis p) basa voluownot a fe t "Memrdcan redisan am caup' oese "%wbr che ev o il ni itaawits opL terms ublic Lstail3.. caycved atio can redistr witPthis pr(ineeral nipairs basi , it S - an a2)'id obl - Re theo execuccess f mp it under the te S" Subsg 1atio 2cabhhodlways pdi sating aclsoid onmio## saveeThis ch:ntinuea).Ach # nny that with # Etercorr"ap tse seeechder- O 'cesss.''' ourstke th,rreschnction muam is distri it under the terS - an a fil1atio 2cabhhodbasa m caup'ctioomaril -ll d fnamntree sopo for'-spf ;eo ,tails.b).Ach # nny that airrnlidfer, checkeained Du SPt Apm i ils.years,rest Thingy py rdE Srty,eained k-srgennose forunresng i ils.c hitofnphysa Vel -lerf mdefe ourstkcan redisan ,ceive# Ete ils.eechder- O 'cessived a copy ocorr"ap tse se ourstke th,r(rcbe .''' m is distri it under the terS - an l1atio 2cabhhodbasa m caup ils.ctioomaril -ll d fnamntree sopo for'-spf ;eo ,tails.c).Ach # nny that witgging informng d have rden aAoopy oidfera fileo can redistrverr"ap tse se ourstke ths PeSPF. Tfor ite r i a filsThisrsconl -f non#####rciVerfan redisan acti onl -o sng fil have rdeawitirais prid obl - Re theo execuccess f mpat nuchgDataanlidfer, idoncSPF ia Sh \" Subsebcabhho.) ass ourstke thefineeral nimeanssawitirsage de f mpo## savwl nirus pf chend/orica an sreo ite Fomain execuccess al n,,h # Eter ourst e themeanssdlleunde ourstke thefineellemoduln .rs c of d,dllusainy associtrmenly'orfcal " notiSubsin ths,dllusaawits ri''onuirs tt ve rol = re.a an action llasan ao## savexecuccesse HisrTP ,, Retu dataVerecept Excepunde ourstke the m is distriners "%wF 4 i fny%h che sating nng ill - m is distri(iess can e ourstkineb cict p Silit y ogajedeh mp tNo g ( = re.c ,,kor el,rgDats on)ao## sa oport oeje file- if wsschn savexecuccessn.uns,dunl achateh mp tNo it irach # nne g tsavexecuccesserI an redisan ao##execuccessn bl - Re theis Kide.byridfer chtablssm(rcved a sentar msig trmenplacu,etisedidfer ch pquicheNo tablssm(rcved aunde ourstke theffile from #eaplacueifoo g ds dan redisan ao## sav ourstke th,rthout eough. rdE Srties aforR: chmpellpec(rcved aunde ourstkcenseit wit bl - Re thstail4.. cayc# Doed n nd/or epsh lblic Llemrdcan redistr witPthis p ] easssxp# alydlways pdi it un ublic LsErAnyca le-pt , othe(rcved , nd/or epsh lblic Lemrdcan redistr witPthis p i avoid,rgDat # uoomat" Ve - Ar_if ititng i Copsi it un ublic Ls HisrTP ,, Srties ph:rhould have recvedie lemrd Cops, ffileng d itaaw ublic Liat it# Dh # sairt wlic LsiAr_if itiats enseiag such Srties ree a d "%s forh # ianchstail5.. nforR: i_pquiredresjtablped wng ublic Lleei_insllowhouldR: sig rs ite HisrTP ,, "%h che aged wthng dlr_ifsconve(rcnd/or yus can redistr witPthis p Faiats fere arospeal nss Passan'a Subsg afo lwohibi rejectlawERfnllowc # Ddablped wng ublic Ls Passenf to,cby nd/or cheordcan redisaeje witPthis pD(omainy al nipairs basund Pthis p)(Fyouiindsult tng i tablped_inso##aw ublic Litt is so,atio dlleit a the rror'ondiSubsg f ved ch,.can redisacheordnd/or ch witPthis p Faial netpairs basitentin6..Eache, re.ng d hcan redistr witPthis pr(ineeny al nipairs basund Pthis p)(Ftnde ecip No # uoomat" Ve - have rults blic Liffile fr o Cinals blic ededo ved , can redistrFaind/or y savPthis prsh l - R't semeo the rror'ondiSubsg.s. cayc# D.'''an'nny fur _pass_restr ebasunde ecip No g'0] ercimeoo## sav Copsiged wReceireror nforR: i_pap tswbss fnamegingctel c # ianchcbyrms rdE Srties 't s ublic Lstail7. If,, Retah tspque_inso##n urt judgme_deineellegasan ao##pS rnt ggir cheme_deinefineeny P eSPF w(notu wmit im(rcpS rntigtshes), 'ondiSubsg ato s'''irs basng d(ree jectd urt orschneagreeme_dein , oth)achateh nactdi- R'Und'ondiSubsg o##aw ublic L,o # ywc # ] can'ng dffile fro'ondiSubsg o##aw ublic L. \Icong d'nn# can redistrsoen aAoosnfisr ysimuled_eousl ang i i lbga an sr it un ublic LicDatfny P p \"er Ai lbga an s,etised Retah tspque_insng cayc# Dcan redistr witPthis prn DcThnn.Fedee. # E,ERfna#pS rnt atlic LirROR: Couler_if_ roy Tfy-am is hcan redisan ao## savPthis prby dlleuno Lireod have r vedie pdir" SlyrFaia dir" Slyrd rough.ng ,etise witonl -illdng eifou ssnfisr ybo itrgData ublic LiaIPs shou't enfr a d ('raect sentam iredisan ao## savPthis perI iny p rr. Amou #ng SrestriF. helion checke cnegingchcess itainy pSrticula vircumsed_in(Ftndebald_inso##awe SrestriF. F fo pren(r dpf - gData ansee an actiniwholtri aF fo pren(rccpf - in vircumsed_insnntItERROR: itss.pur''an'mou #ng Srestri(rca duinsllow(rca ir cheifny pS rntsrFaio Pelipp \ye Copeclaims ededo h t rst check validifny sucheclaims;u #ng Srestrinathunde ols.pur''an'mouisot - ache ev F fogo validitsavam imntree sopam iredisan a file-,rreschni i# Ee do deb -e2 ascs blic Libebe a mes Miny peo ExhouldKide GNUouseh nacedisan aAoopy owide.rspf eo##stree sopam iredised d rough. n D file- a d_p ianchcbased swhitn Ddpf ica an copyat file-;eitERROup,(rc savat is /donededo decidhcifnfroo shtri aat i ch o can redistrstree sopd rough.fny P file- exia wlic L 'nn# .'''an'chatehhoichstaT#ng SrestriF. F fo pren(rcpf to is oughsyahleariwsating bp ievren(r musah tspque_inso##unde est o##aw ublic L.tail8.\Icopy ofan redisan acti/ can'o## savPthis prisd hass_rerstwg cert a difoo nieg s can eb -eS rntsrFaiby ved Copmenly'orfcals,etis o Cinalsved Copyhol it reodplacus# savPthis pr it un ublic L caycses in exf icitEgehis ph" Verfan redisan alimionfigur] 4 s s uno Liifoo nieg, dressatrfan redisan aisder_if_t imonl -oneineemnse ifoo nieg R: itsusr] 4 e e Iedsucheca L,o # ublic Lii_iorPora rs witlimionfiguraetworrrnlid witbod a copy ublic L.tail9.Pass.o the Free Software Founvcayce2 as p revi Ldenti/ new#nf convs o## save GNU General Public Liffile re. oe res Suchenew#nf convshat i.be oimila enr pirionttsawitirs mailnf conv, , gay difror enry ore n(r dP # adnew#lwaessm aedeh tcerom ntEachenf conve Thasa dwhitelus pachenf convenumbP en.I## savPthis p data srultsnf convenumbP so##aw ublic Lireschncenhe g tt itrgDat"fny trmrsnf conv",sllowhould wito''ExceidveeThis ch under the rror'ondiSubsg s can e copyatinf conveorio##nny trmrsnf convn 2 as publ bo th Free Software Founen.I## savPthis p' oese "%w data yltsnf convenumbP so# wng ublic Lley caycv-o'an'nny nf conveck - 2 as publ bo the Free So tware Founnntin10.\Icong dws pressi_iorPora r locas'o## savPthis priy''' Pam i This pdomains fan redisan a'ondiSubsg ato difrore_d, lre,(rc savat is do fska Faier_ifsconvnn.Fedestree sopreschni aved Copmen bo th Free Software Foun, lre,(rc savo the Free Software Foun; (whsome, res pf toecept Excsreeded pErrurhdecisigurt llebe lusdmen b wo goals o##irs mrv ch undeam imnoa us o##nllefere arosps o##g i am it free sopaDa o##iromosaeje witsh Srocerrorrecan'o## free sop GNU lly. s"' NO WARRANTYntin11. BECAUSE THE'PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTYnTNESTHE'PROGRAM, TOSTHE'EXTENT PERMITTED BY APPLICABLE LAWen.EXCEPT WHEN OTHERWISE STATED INoWRITINGSTHE'COPYRIGHT HOLDERS AND/NESOTHER PARTIES PROVIDE THE'PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED NESIMPLIED, INCLUDING, BUT NOT LIMITED TO, THESIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESSITNESA PARTICULAR PURPOSEs PaHE'ENTIRE RISK AS TOSTHE'QUALITY AND PERTNEMANCE OF THE'PROGRAM IS WITH YOUs SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUMESTHE'COST OF ALL NECESSARY SERVICING, REPAIESOESCORRECTIONnntin12. INoNO EVENT UNLESS REQUIRED BY APPLICABLE LAWSOESAGREED TO INoWRITING WILL ANY COPYRIGHT HOLDER,SOESANY OTHER PARTY WHO MAY MODIFY AND/NE REDISTRIBUTE THE'PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU TNESDAMAGES, INCLUDINGSANY eENERAL, SPECIAL, INCIDENTALSOESCONSEQUENTIALSDAMAGES ARISING OUT OF THE'USE NESINABILITY TO USE THE'PROGRAM (INCLUDINGSBUT NOT LIMITED TOSLOSS OFSDATA NESDATA BEINGSRENDERED INACCURATE NESLOSSES SUSTAINED BY YOU NESTHIRD PARTIESSOESA FAILURE OF THE'PROGRAM TOSOPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER NESOTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. s"' 'END OF TERMS AND CONDITIONS "' 'H,w ro Apf - assan'T the ro Yg i New#Pthis psntinIcong dde%s; ein new#lwais p, rrorllowwanagit (rcbe o## savg] S rst er siess use,(rc save2 asc(Ftndebest illdis echdeveo wng ng tt pf toit am it free sopreschneTP yonmi'nni hcan redistrrror'-spf e it undmeo the ntinTs is so,atttachn saveeThis ch notichsi tsawitirhis pe Ide safrst is ettachn sami tsawit # ao##eachn ourstkonfigtt e hiteffre osply 'onvey tsavex 4conveo##plied wa; iiondachn loa sh,Ps shoulda Du SPt wit"ved Cop"tlinLicDatf poly'orntt iser# savs fornotichc a notstails.ails.es # CopyrC)ls.tails.T#ng This p i aam it free so;ing d'nni hcan redistritrgDait and/or gData)tp it under the terms of the GNU General ublic Licon 2 as publ a filesato the Free Software Foun; s can e" Ese ver terms oLblic Llemra fil(a Rng i i''Exc)#nny trmrsnf conv.tails.T#ng This p i a m is distriid withopL thaagit t llebe ll be //128', WITHOUT ANY WARRANTY;l logs without ensi# irejalied waro# 128'MERCHANTABILITY ILITITNESSITNESA PARTICULAR PURPOSEs PSu to s s"' f the GNU General Public Lift andfor more detas"' sh,Ps should have rdenived a copy of the GNU General ublic License ils.w wng This p; # d, lre,(rc savo the Free Software Foundation, IIII, 51 Franklin Street, Fifth Floor, Boston, MA 02110-13. Alsoiaddtgging informtrin,w ro c o- Rng n el Prronl tionshpasscting Ifiawitirhis pr g F foraProsp, pf toitnoutputia Yrtrnotichclikheun ahionitn # laidonn F foraProsp :ntinueGnomovisigur" Ese ve69,.es # CopyrC)lyear knownotint is tinueGnomovisigurcomeil loghABSOLUTELY NO WARRANTY;7olicy ore d typL `sh,w w'.ails.T#ng i aam it free so, rrorllow soprelcome ro hcan redistritails. it vert a difndiSubsg; typL `sh,w c'7olicy ore detaass.hyp a Verh #mo pg `sh,w w' rror`sh,w c'7sh,Ps ssh,w re i peliprbtrm locas'o## save GNU General Public Ls POftd ur L,o # rh #mo pg ng d sldKiy.be c llpecsome,pacheothit unres`sh,w w' rror`sh,w c';o # ywifou sthoutbe mo sl-cal k aedemenuritems--phaack - suiwthng i This pnnt sh,Ps sclsoigetdng i e# oyl seifnllowwl nin aa This pmer) ensllor sv-o'l,ERfnany,resjsig ia "ved Copycanclaimd "aeeded pwais p, if nece sarekn.Hir RROnns # E; Tfored knowg:ntinYoyodynedation,ceirebyycanclaimssdlleved CopyF fore # id witpwais ptin`Gnomovisigu'd(reschncf tsnshelos ateh mpe.c s) lrnl Jnowg HackP ers., 1 Aprillis89tinT eson, Pdasipr AmouVblitaT#ng e GNU General ublic Li oese "%wer_if_ i_iorPora acheng i This priy'' lThprbetares This ps. \Icong rtirhis pr g arsh roisachclibranyley cay h tswdoreitEmoreall be O(rcer_if_ Fr chelThprbetaresdpf ica an sit wi libranyen.I## sng i awsating awanagtt do,acan''Undf thL amrhe GNU G neral Public Lif dthada copy ublic L.tpypolicyd-spf-CHANGES000064400017500001750133100336756701171552020022 0ustar kittermakitterma#hL gend: # --- =SA new#reu SPe # + =SAddn rd fetrur# (idons tratedf''h #pa aess aay) # ! =SC-spf ejsome,pachesig orica_d, licy movn rd fetrur# # *_Defixn rd bug, licKide.aspinFaiamfthhoe do --- d-spf ( 200-04-05 01:23 -0400) *_Pda-otiSualizesion =] SPF rtt Nonmitt avoidncrashERfn the HELO chei a fildiscessd --- d-s ( 200-02-20 16:35 -0500) ! Ltios se hcmsig :a fil-SC-spf om te (d logldebugtt 1errorreadj logldebug1atio 2ctt 2atio 3a fil-SLogldebug0d'-spf ejt # matios sa fil-SMhhodafornon-d log\ load config.gllstriatios sett debug5a fil-SDgu' DuseS [0] SPF r##### tsa fil-SUpdtrmenppypolicaccaages. debug mscri''Exca fil-SDgu' DuseSd log eeedeOR: U\ load coor. O *_Addn r sys obugging m isomdstriid ppypolicacc *_R movn rddse seython-polic tt %PYTHONPATH + Addn rp # Prospective SPFs Check to see if mail sentcurre ttst iress ect a filctiv ftchtbeachese_d.SDgu' Daddt make SPF Relend', g eeded L.t *_fixn rst iess) whitel tt il nir nPF i Exst rspf s (pa chn sentNicola a filubtchdeko)t *_fixn r'se imonl 'to''Excett il ni(pa chn sentNicola lubtchdeko)t *_fixn rmbe a dis no whi xt il nt *_fixn rmbe a dis no whi xt il nir nPF i Exst of do(pa chn sentNicola a filubtchdeko)t *_Corr" Sl - et - Rnd # IP # amesenr d to exicte, whie rrorcan'corr" SgData)mf icitElist:eedend #t *_Corr" See. # Ee rrorppypolicaccatot# Dh # ticalseid st on rmbe a gData whie + LseSd logto sst iess) whioo sd to whiohouldR:n-nated IP aritemsefin ev Data whie gData ani 'u' Dcrash ! I ll kit pg mesrror'onad confisefinFHS c # iantte, ot lom n ! R movn r# Pconfiseei_insI'mt# Dqualifiren(rcpfi of n sam --- d-5.2 ( 207-10-26 15:30 -0400) *_Corr" S,tn.ggIP aounvef From, defeeippend heato SPd log\il net(F f durrejgData) d-4efauT-spFs Che"John A. MSrtin" '/etc/python-polic '-spf s es # Copyright (7, 200te2008 Scott Kitterman Dothe doa an aieputs: es # Copyright (4-t (5,te005, Sean Reifschneider, tummy.co.t ht (3-t (4 MecheWecheWoeje