pypolicyd-spf-0.6/0000755000175000017500000000000010757125200014402 5ustar kittermakittermapypolicyd-spf-0.6/policyd-spf.10000644000175000017500000002237510756443630016737 0ustar kittermakitterma\" .\" Standard preamble: .\" ======================================================================== .de Sh \" Subsection heading .br .if t .Sp .ne 5 .PP \fB\\$1\fR .PP .. .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' 'br\} .\" .\" If the F register is turned on, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . nr % 0 . rr F .\} .\" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .hy 0 .if n .na .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. . \" fudge factors for nroff and troff .if n \{\ . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] \fP .\} .if t \{\ . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff .if n \{\ . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} .if t \{\ . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' .ds 8 \h'\*(#H'\(*b\h'-\*(#H' .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] .ds ae a\h'-(\w'a'u*4/10)'e .ds Ae A\h'-(\w'A'u*4/10)'E . \" corrections for vroff .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' . \" for low resolution devices (crt and lpr) .if \n(.H>23 .if \n(.V>19 \ \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} .rm #[ #] #H #V #F C .\" ======================================================================== .\" .IX Title "policy-spf 1" .TH policy-spf 1 "2008-02-18" .SH "NAME" python-policyd-spf \- pure-Python Postfix policy daemon for SPF checking .SH "VERSION" .IX Header "VERSION" 0\.6 .SH "USAGE" .IX Header "USAGE" NOTE: Depending on the packaging and distribution, the exact path to the executable may vary. The executable should be included in the Python path. $ policyd-spf (Start using installed config file) $ policyd-spf \-h (Display usage message) $ policyd-spf /etc/policyd-spf/policyd-spf.conf (Config file name to use) Configuration options are described in the sample configuration file provided with the package policyd-spf.conf(5). The provided setup.py installs this configuration file in /etc/policyd-spf/. Additionally, whitelisting certain IP addresses or IP addresses used by listed domains from SPF checks is supported. Skipping SPF checks for local submission or trusted relays is also provided. The sample configuration file and policyd-spf.conf(5) shows the format to use. .SH "OTHER DOCUMENTATION" .IX Header "OTHER DOCUMENTATION" This documentation assumes you have read Postfix's README_FILES/ SMTPD_POLICY_README and are generally familiar with Sender Policy Framework (SPF). See RFC 4408 for details. See policyd-spf.conf(5) for configuration file information. .SH "SYNOPSIS" .IX Header "SYNOPSIS" python-policyd-spf is a Postfix SMTPd policy daemon for SPF checking. It is implemented in pure Python and uses the pyspf module. The SPF web site is http://www.openspf.org/. The Postfix configuration must be changed to check SPF. .SH "DESCRIPTION" .IX Header "DESCRIPTION" Logging is sent to syslogd. Each time a Postfix SMTP server process is started it connects to the policy service socket and Postfix runs one instance of this Python script. By default, a Postfix SMTP server process terminates after 100 seconds of idle time, or after serving 100 clients. Thus, the cost of starting this Python script is smoothed over time The default policy_time_limit is 1000 seconds. This may be too short for some SMTP transactions to complete. As recommended in SMTPD_POLICY_README, this should be extended to 3600 seconds. To do so, set "policy_time_limit = 3600" in /etc/postfix/main.cf. Messages that get a Fail SPF result will be rejected. Messages that get a Permerror are, by default, treated as if they had no SPF record. Messages that get a Temperror result are, by default, treated as if they had no SPF record, but can (and probably should) be deferred if otherwise permitted. Messages that get other SPF results (Pass, None, Neutral, Softfail) will have the SPF Received header prepended. Note: Spamasassisn 3.2 and follow will use this header for spam scoring so there is no need to configure a separate SPF check in these Spamassassin versions. See Spamassassin documentation for details. Default Mail From rejection/deferal criteria are, by design, conservative. Default HELO check actions are to reject mail with other than Pass/None. HELO records are much simpler than Mail From records and rejecting based on HELO checking does not present a false positive risk. These settings are a matter of local policy and should be adjusted to meet the requirements of site administrators. See policyd-spf.conf(5) for configuration file details. .SH "LOGGING" .IX Header "LOGGING" Policyd-spf will log messages to syslog about it's activities. The "debugLevel" value in "policyd-spf.conf" can be increased to get additional information to be logged. When set to a value of "0", only test results (SPF hits/misses) are logged. Results will be returned to Postfix and logged as a warning by Postfix also. For logging by this policy server, look for "policyd-spf" in your mail log files. .SH "TESTING THE POLICY DAEMON" .IX Header "TESTING THE POLICY DAEMON" Testing the policy daemon To test the policy daemon by hand, execute: policyd-spf Each query is a bunch of attributes. Order does not matter, and the daemon uses only a few of all the attributes shown below: request=smtpd_access_policy protocol_state=RCPT protocol_name=SMTP helo_name=some.domain.tld queue_id=8045F2AB23 instance=12345.6789 sender=foo@bar.tld recipient=bar@foo.tld client_address=1.2.3.4 client_name=another.domain.tld [empty line] The policy daemon will answer in the same style, with an attribute list followed by a empty line: action=dunno [empty line] .SH "POSTFIX INTEGRATION" .IX Header "POSTFIX INTEGRATION" 1. Add the following to /etc/postfix/master.cf: policyd-spf unix - n n - 0 spawn user=nobody argv=/usr/bin/python /usr/bin/policyd-spf NOTE: Check the path to both the installed Python interpreter and policyd-spf. These vary from system to system. To use non-default settings, you must also add the config file (see above and policyd-spf.conf(5) for details). 2. Configure the Postfix policy service in /etc/postfix/main.cf: smtpd_recipient_restrictions = ... reject_unauth_destination check_policy_service unix:private/policyd-spf ... policyd-spf_time_limit = 3600 NOTE: Specify check_policy_service AFTER reject_unauth_destination or else your system can become an open relay. 3. Reload Postfix. .SH "SEE ALSO" .IX Header "SEE ALSO" policyd-spf.conf(5), python-spf, , RFC 4408 .SH "AUTHORS" .IX Header "AUTHORS" This version of \fBpython-policyd-spf\fR was written by Copyright (c) 2007 Scott Kitterman . It is derived from Tumgreyspf, written by Sean Reifschneider, tummy.com, ltd . Portions of the documentation were written by Meng Weng Wong . .PP This man-page was created by Scott Kitterman . pypolicyd-spf-0.6/policyd-spf0000755000175000017500000004317110757116515016600 0ustar kittermakitterma#!/usr/bin/python # # Check SPF results and provide recommended action back to Postfix. # # Tumgreyspf source # Copyright (c) 2004-2005, Sean Reifschneider, tummy.com, ltd. # # # pypolicyd-spf # Copyright (c) 2007, 2008 Scott Kitterman ''' This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.''' __version__ = "0.6: Feb 20 2008" import syslog, os, sys, string, re, time, popen2, urllib, stat, errno, socket, spf import policydspfsupp syslog.openlog(os.path.basename(sys.argv[0]), syslog.LOG_PID, syslog.LOG_MAIL) policydspfsupp.setExceptHook() ############################################# def cidrmatch(connectip, ipaddrs, n): """Match connect IP against a list of other IP addresses. From pyspf.""" try: if connectip.count(':'): MASK = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL connectip = spf.inet_pton(connectip) for arg in ipaddrs: ipaddrs[ipaddrs.index(arg)] = spf.inet_pton(arg) bin = spf.bin2long6 else: MASK = 0xFFFFFFFFL bin = spf.addr2bin c = ~(MASK >> n) & MASK & bin(connectip) for ip in [bin(ip) for ip in ipaddrs]: if c == ~(MASK >> n) & MASK & ip: return True except socket.error: pass return False def parse_cidr(cidr_ip): """Breaks CIDR notation into a (address,cidr,cidr6) tuple. The cidr defaults to 32 if not present. Derived from pyspf""" import re RE_DUAL_CIDR = re.compile(r'//(0|[1-9]\d*)$') RE_CIDR = re.compile(r'/(0|[1-9]\d*)$') a = RE_DUAL_CIDR.split(cidr_ip) if len(a) == 3: cidr_ip, cidr6 = a[0], int(a[1]) else: cidr6 = None a = RE_CIDR.split(cidr_ip) if len(a) == 3: cidr_ip, cidr = a[0], int(a[1]) else: cidr = None b = cidr_ip.split(':', 1) if len(b) < 2: return cidr_ip, cidr return a[0], cidr6 ############################################# def spfbypass(data, check_type, configData): if configData.get(check_type): if configData.get('Prospective'): ip = configData.get('Prospective') else: ip = data.get('client_address') bypass_list = (str(configData.get(check_type))) bypass_list_list = bypass_list.split(',') if check_type == 'skip_addresses' or check_type == 'Whitelist': for cidr in bypass_list_list: parsed_address = parse_cidr(cidr) good_ip = [parsed_address[0],] cidr_range = parsed_address[1] if not parsed_address[1]: ip_str = str(good_ip[0]) if spf.RE_IP4.match(ip_str): cidr_range = 32 elif spf.RE_IP6.match(ip_str): cidr_range = 128 else: Message = 'ERROR: ' + ip_str + ' in ' + check_type + ' not IP address. Aborting whitelist processing.' if debugLevel: syslog.syslog(Message) return (False, 'None') if cidrmatch(ip, good_ip, int(cidr_range)): if check_type == 'skip_addresses': comment = 'SPF check N/A for local connections - ' else: comment = 'SPF skipped for whitelisted relay - ' Header = ('X-Comment: ' + comment + 'client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % ( data.get('client_address', ''), data.get('helo_name', ''), data.get('sender', ''), data.get('recipient', ''), )) if debugLevel >= 3: syslog.syslog(Header) return (True, Header) return (False, 'None') elif check_type == 'Domain_Whitelist': for domain in bypass_list_list: res = spf.check2(ip, domain, domain) domain_res = [res[0], res[1]] domain_res[0] = domain_res[0].lower() domain_res[0] = domain_res[0].capitalize() if domain_res[0] == 'Pass': comment = 'SPF skipped for whitelisted relay domain - ' Header = ('X-Comment: ' + comment + 'client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % ( data.get('client_address', ''), data.get('helo_name', ''), data.get('sender', ''), data.get('recipient', ''), )) if debugLevel >= 3: syslog.syslog(Header) return (True, Header) return (False, 'None') ############################################# def spfcheck(data, instance_dict, configData): #{{{1 debugLevel = configData.get('debugLevel', 1) if configData.get('Prospective'): ip = configData.get('Prospective') else: ip = data.get('client_address') if ip == None: if debugLevel >= 2: syslog.syslog('spfcheck: No client address, exiting') return(( None, None, instance_dict )) # Do not check SPF for localhost addresses skip_check = spfbypass(data, 'skip_addresses', configData) if skip_check[0]: return (('prepend', skip_check[1], instance_dict )) # Whitelist designated IP addresses from SPF checks (e.g. secondary MX or # known forwarders. ip_whitelist = spfbypass(data, 'Whitelist', configData) if ip_whitelist: if ip_whitelist[0]: return (('prepend', ip_whitelist[1], instance_dict )) # Whitelist designated Domain's sending addresses from SPF checks (e.g. # known forwarders. domain_whitelist = spfbypass(data, 'Domain_Whitelist', configData) if domain_whitelist: if domain_whitelist[0]: return (('prepend', domain_whitelist[1], instance_dict )) #recipient = data.get('recipient') receiver=socket.gethostname() sender = data.get('sender') helo = data.get('helo_name') if not sender and not helo: if debugLevel >= 2: syslog.syslog('spfcheck: No sender or helo, exiting') return(( None, None, instance_dict )) # start query spfResult = None spfReason = None instance = data.get('instance') # The following if is only needed for testing. Postfix # will always provide instance. if not instance: import random instance = str(int(random.random()*100000)) # This is to prevent multiple headers being prepended # for multi-recipient mail. found_instance = instance_dict.has_key(instance) '''Data structure for results is a list of: [0] SPF result [1] SPF reason [2] Identity (HELO/Mail From) [3] Action based on local policy [4] Header''' if not found_instance: Mail_From_pass_restriction = configData.get('Mail_From_pass_restriction') HELO_pass_restriction = configData.get('HELO_pass_restriction') # First do HELO check # if no helo name sent, use domain from sender for later use. if not helo: foo = string.split(sender, '@', 1) if len(foo) < 2: helo = 'unknown' else: helo = foo[1] else: if configData.get('HELO_reject') != 'No_Check': helo_fake_sender = 'postmaster@' + helo res = spf.check2(ip, helo_fake_sender, helo) helo_result = [res[0], res[1]] helo_result.append('helo') helo_result[0] = helo_result[0].lower() helo_result[0] = helo_result[0].capitalize() if debugLevel >= 2: syslog.syslog('spfcheck: pyspf result: "%s"' % str(helo_result)) if configData.get('HELO_reject') == 'Null' and sender: helo_result.append('dunno') elif helo_result[0] == 'Temperror' and configData.get('TempError_Defer') == 'True': helo_result.append('defer') elif helo_result[0] == 'Permerror' and configData.get('PermError_reject') == 'True': helo_result.append('reject') elif helo_result[0] == 'Permerror' and configData.get('PermError_reject') == 'False': helo_result.append('prepend') elif configData.get('HELO_reject') == 'Fail' and helo_result[0] == 'Fail': helo_result.append('reject') elif configData.get('HELO_reject') == 'SPF_Not_Pass' and (helo_result[0] == 'Fail' or helo_result[0] == 'Softfail' or helo_result[0] == 'Neutral'): helo_result.append('reject') helo_result[1] = 'SPF HELO result: rejected due to local policy (Not Pass/None)' else: helo_result.append('prepend') if sender == '': header_sender = '<>' else: header_sender = sender if helo_result[0] == 'None': helo_result[1] = "no SPF record" spfDetail = ('identity=%s; client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % (helo_result[2], ip, helo, header_sender, data.get('recipient', ''))) if debugLevel >= 1: logdata = str(helo_result[0]) + "; " + spfDetail syslog.syslog(logdata) header = 'Received-SPF: '+ helo_result[0] + ' (' + helo_result[1] +') ' + spfDetail helo_result.append(header) instance_dict[instance] = helo_result if HELO_pass_restriction and helo_result[0] == 'Pass': restrict_name = HELO_pass_restriction # Only act on the HELO result if it is authoritative. if helo_result[3] == 'reject': header = "Message rejected due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'reject', header, instance_dict )) if helo_result[3] == 'defer': header = "Message deferred due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'defer', header, instance_dict )) # Second do Mail From Check if sender == '': if configData.get('HELO_reject') != 'No_Check': if helo_result[3] == 'reject': header = "Message rejected due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') if helo_result[3] == 'defer': header = "Message deferred due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') if HELO_pass_restriction and helo_result[0] == 'Pass': restrict_name = HELO_pass_restriction return('result_only', restrict_name, instance_dict) return(( helo_result[3], header, instance_dict )) else: if configData.get('Mail_From_reject') != 'No_Check': res = spf.check2(ip, sender, helo) mfrom_result = [res[0], res[1]] mfrom_result.append('mailfrom') mfrom_result[0] = mfrom_result[0].lower() mfrom_result[0] = mfrom_result[0].capitalize() if debugLevel >= 2: syslog.syslog('spfcheck: pyspf result: "%s"' % str(mfrom_result)) mfrom_result.append('dunno') if mfrom_result[0] == 'Temperror' and configData.get('TempError_Defer') == 'True': mfrom_result[3] = 'defer' elif mfrom_result[0] == 'Permerror' and configData.get('PermError_reject') == 'True': mfrom_result[3] = 'reject' elif mfrom_result[0] == 'Permerror' and configData.get('PermError_reject') == 'False': mfrom_result[3] = 'prepend' elif configData.get('Mail_From_reject') == 'Fail' and mfrom_result[0] == 'Fail': mfrom_result[3] = 'reject' else: mfrom_result[3] = 'prepend' if mfrom_result[0] == 'None': mfrom_result[1] = 'no SPF record' if mfrom_result[0] != 'None' or (mfrom_result[0] == 'None' and helo_result[0] == 'None'): spfDetail = \ ('identity=%s; client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % (mfrom_result[2], ip, helo, sender, data.get('recipient', ''))) if debugLevel >= 1: logdata = str(mfrom_result[0]) + "; " + spfDetail syslog.syslog(logdata) header = 'Received-SPF: '+ mfrom_result[0] + ' (' + mfrom_result[1] +') ' + spfDetail mfrom_result.append(header) instance_dict[instance] = mfrom_result if (Mail_From_pass_restriction and mfrom_result[0] == 'Pass') or (HELO_pass_restriction and helo_result[0] == 'Pass'): if mfrom_result[0] == 'Pass': restrict_name = Mail_From_pass_restriction return('result_only', restrict_name, instance_dict) # Act on the Mail From result if it is authoritative. if mfrom_result[3] == 'reject': header = "Message rejected due to: " + mfrom_result[1] + ". Please see http://www.openspf.org/Why?s=mfrom;id=" + sender + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'reject', header, instance_dict )) if mfrom_result[3] == 'defer': header = "Message deferred due to: " + mfrom_result[1] + ". Please see http://www.openspf.org/Why?s=mfrom;id=" + sender + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'defer', header, instance_dict )) if mfrom_result[3] != 'dunno' or helo_result[3] =='dunno': return(( 'prepend', header, instance_dict )) else: cached_instance = instance_dict[instance] if cached_instance[3] == 'prepend': return(( 'dunno', 'Header already pre-pended', instance_dict )) else: return(( cached_instance[3], cached_instance[4], instance_dict )) return(( 'None', 'None', instance_dict )) ################################################### # load config file {{{1 # Default location: configFile = '/etc/python-policyd-spf/policyd-spf.conf' if len(sys.argv) > 1: if sys.argv[1] in ( '-?', '--help', '-h' ): print 'usage: policyd-spf []' sys.exit(1) configFile = sys.argv[1] configGlobal = policydspfsupp.processConfigFile(filename = configFile) # loop reading data {{{1 debugLevel = configGlobal.get('debugLevel', 1) if debugLevel >= 3: syslog.syslog('Starting') instance_dict = {'0':'init',} instance_dict.clear() data = {} lineRx = re.compile(r'^\s*([^=\s]+)\s*=(.*)$') while 1: line = sys.stdin.readline() if not line: break line = string.rstrip(line) if debugLevel >= 4: syslog.syslog('Read line: "%s"' % line) # end of entry {{{2 if not line: if debugLevel >= 4: syslog.syslog('Found the end of entry') configData = configGlobal if debugLevel >= 3: syslog.syslog('Config: %s' % str(configData)) # run the checkers {{{3 checkerValue = None checkerReason = None checkerValue, checkerReason, instance_dict = spfcheck(data, instance_dict, configData) if configData.get('defaultSeedOnly') == 0: checkerValue = None checkerReason = None # handle results {{{3 if checkerValue == 'reject': sys.stdout.write('action=550 %s\n\n' % checkerReason) elif checkerValue == 'prepend': if configData.get('Prospective'): sys.stdout.write('action=dunno\n\n') else: sys.stdout.write('action=prepend %s\n\n' % checkerReason) elif checkerValue == 'defer': sys.stdout.write('action=defer_if_permit %s\n\n' % checkerReason) elif checkerValue == 'warn': sys.stdout.write('action=warn %s\n\n' % checkerReason) elif checkerValue == 'result_only': sys.stdout.write('action=%s\n\n' % checkerReason) else: sys.stdout.write('action=dunno\n\n') # end of record {{{3 sys.stdout.flush() data = {} continue # parse line {{{2 m = lineRx.match(line) if not m: syslog.syslog('ERROR: Could not match line "%s"' % line) continue # save the string {{{2 key = m.group(1) value = m.group(2) if key not in [ 'protocol_state', 'protocol_name', 'queue_id' ]: value = string.lower(value) data[key] = value if debugLevel >= 3: syslog.syslog('Normal exit') pypolicyd-spf-0.6/TODO0000644000175000017500000000050610757117171015103 0ustar kittermakittermaObject cache Make the code support operations as a true Dameon Use pyspf to make SPF Received headers Python DBM, Berkeley DB, and Python sqlite whitelist management support Best Guess Local mfrom SPF bypass (per user) Per user (rcpt to address) policy Per user (rcpt to address) whitelisting Domain or address/IP pair reject pypolicyd-spf-0.6/policyd-spf.conf0000644000175000017500000000477210757115710017521 0ustar kittermakitterma# Amount of debugging information logged. 0 logs no debugging messages # 4 includes all debug messages. debugLevel = 1 # If set to 0, no messages are rejected by SPF. This allows you to see the # potential impact of SPF checking in your mail logs without rejecting mail. defaultSeedOnly = 1 # HELO check rejection policy. Options are: # HELO_reject = SPF_Not_Pass (default) - Reject if result not Pass/None/Tempfail. # HELO_reject = Fail - Reject only on HELO Fail # HELO_reject = Null - Only reject HELO Fail for Null sender (SPF Classic) # HELO_reject = False - Never reject on HELO, append header only. # HELO_reject = No_Check - Never check HELO. HELO_reject = SPF_Not_Pass # HELO pass restriction policy. # HELO_pass_restriction = helo_passed_spf - Apply the given restriction when # the HELO checking result is Pass. The given restriction must be an # action as defined for a Postfix SMTP server access table access(5). HELO_pass_restriction # Mail From rejection policy. Options are: # Mail_From_reject = Fail - Reject only on Mail From Fail # Mail_From_reject = False - Never reject on Mail From, append header only # Mail_From_reject = No_Check - Never check Mail From/Return Path. Mail_From_reject = Fail # Mail From pass restriction policy. # Mail_From_pass_restriction = mfrom_passed_spf - Apply the given # restriction when the Mail From checking result is Pass. The given # restriction must be an action as defined for a Postfix SMTP server # access table access(5). Mail_From_pass_restriction # Policy for rejecting due to SPF PermError. Options are: # PermError_reject = True # PermError_reject = False PermError_reject = False # Policy for deferring messages due to SPF TempError. Options are: # TempError_Defer = True # TempError_Defer = False TempError_Defer = False # Prospective SPF checking - Check to see if mail sent from the defined IP # address would pass. # Prospective = 192.168.0.4 # Do not check SPF for localhost addresses - add to skip addresses to # skip SPF for internal networks if desired. Defaults are standard IPv4 and # IPv6 localhost addresses. skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0//104,::1//128 # Whitelist: CIDR Notation list of IP addresses not to check SPF for. # Example (default is no whitelist): # Whitelist = 192.168.0.0/31,192.168.1.12 # Domain_Whitelist: List of domains whose sending IPs should be whitelisted # from SPF. # Example (default is no domain whitelist): # Domain_Whitelist = pobox.com,trustedforwarder.org pypolicyd-spf-0.6/policydspfsupp.py0000644000175000017500000001301710756654406020060 0ustar kittermakitterma# # Tumgreyspf # Copyright (c) 2004-2005, Sean Reifschneider, tummy.com, ltd. # # pypolicyd-spf changes # Copyright (c) 2007,2008 Scott Kitterman ''' This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.''' import syslog, os, sys, string, re, time, popen2, urllib, stat # default values defaultConfigData = { 'debugLevel' : 1, 'HELO_reject' : 'SPF_Not_Pass', 'Mail_From_reject' : 'Fail', 'PermError_reject' : 'False', 'TempError_Defer' : 'False', 'skip_addresses' : '127.0.0.0/8,::ffff:127.0.0.0//104,::1//128', 'defaultSeedOnly' : 1 } ################################# class ConfigException(Exception): '''Exception raised when there's a configuration file error.''' pass #################################################################### def processConfigFile(filename = None, config = None, useSyslog = 1, useStderr = 0): '''Load the specified config file, exit and log errors if it fails, otherwise return a config dictionary.''' import policydspfsupp if config == None: config = policydspfsupp.defaultConfigData if filename != None: try: readConfigFile(filename, config) except Exception, e: if useSyslog: syslog.syslog(e.args[0]) if useStderr: sys.stderr.write('%s\n' % e.args[0]) sys.exit(1) return(config) ################# class ExceptHook: def __init__(self, useSyslog = 1, useStderr = 0): self.useSyslog = useSyslog self.useStderr = useStderr def __call__(self, etype, evalue, etb): import traceback, string tb = traceback.format_exception(*(etype, evalue, etb)) tb = map(string.rstrip, tb) tb = string.join(tb, '\n') for line in string.split(tb, '\n'): if self.useSyslog: syslog.syslog(line) if self.useStderr: sys.stderr.write(line + '\n') #################### def setExceptHook(): sys.excepthook = ExceptHook(useSyslog = 1, useStderr = 1) #################### def quoteAddress(s): '''Quote an address so that it's safe to store in the file-system. Address can either be a domain name, or local part. Returns the quoted address.''' s = urllib.quote(s, '@_-+') if len(s) > 0 and s[0] == '.': s = '%2e' + s[1:] return(s) ###################### def unquoteAddress(s): '''Undo the quoting of an address. Returns the unquoted address.''' return(urllib.unquote(s)) ############################################################### commentRx = re.compile(r'^(.*)#.*$') def readConfigFile(path, configData = None, configGlobal = {}): '''Reads a configuration file from the specified path, merging it with the configuration data specified in configData. Returns a dictionary of name/value pairs based on configData and the values read from path.''' debugLevel = configGlobal.get('debugLevel', 0) if debugLevel >= 5: syslog.syslog('readConfigFile: Loading "%s"' % path) if configData == None: configData = {} nameConversion = { 'debugLevel' : int, 'HELO_reject' : str, 'Mail_From_reject' : str, 'PermError_reject' : str, 'TempError_Defer' : str, 'Mail_From_pass_restriction' : str, 'HELO_pass_restriction' : str, 'Prospective' : str, 'Whitelist' : str, 'skip_addresses': str, 'Domain_Whitelist' : str, 'defaultSeedOnly' : int } # check to see if it's a file try: mode = os.stat(path)[0] except OSError, e: syslog.syslog('ERROR stating "%s": %s' % ( path, e.strerror )) return(configData) if not stat.S_ISREG(mode): syslog.syslog('ERROR: is not a file: "%s", mode=%s' % ( path, oct(mode) )) return(configData) # load file fp = open(path, 'r') while 1: line = fp.readline() if not line: break # parse line line = string.strip(string.split(line, '#', 1)[0]) if not line: continue data = map(string.strip, string.split(line, '=', 1)) if len(data) != 2: if len(data) == 1: if debugLevel >= 1: syslog.syslog('Configuration item "%s" not defined in file "%s"' % ( line, path )) else: syslog.syslog('ERROR parsing line "%s" from file "%s"' % ( line, path )) continue name, value = data # check validity of name conversion = nameConversion.get(name) if conversion == None: syslog.syslog('ERROR: Unknown name "%s" in file "%s"' % ( name, path )) continue if debugLevel >= 5: syslog.syslog('readConfigFile: Found entry "%s=%s"' % ( name, value )) configData[name] = conversion(value) fp.close() return(configData) pypolicyd-spf-0.6/policyd-spf.conf.50000644000175000017500000003360310756443630017663 0ustar kittermakitterma\" .\" Standard preamble: .\" ======================================================================== .de Sh \" Subsection heading .br .if t .Sp .ne 5 .PP \fB\\$1\fR .PP .. .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' 'br\} .\" .\" If the F register is turned on, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . nr % 0 . rr F .\} .\" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .hy 0 .if n .na .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. . \" fudge factors for nroff and troff .if n \{\ . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] \fP .\} .if t \{\ . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff .if n \{\ . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} .if t \{\ . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' .ds 8 \h'\*(#H'\(*b\h'-\*(#H' .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] .ds ae a\h'-(\w'a'u*4/10)'e .ds Ae A\h'-(\w'A'u*4/10)'E . \" corrections for vroff .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' . \" for low resolution devices (crt and lpr) .if \n(.H>23 .if \n(.V>19 \ \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} .rm #[ #] #H #V #F C .\" ======================================================================== .\" .IX Title "policy-spf.conf 5" .TH policy-spf.conf 5 "2008-02-18" .SH "NAME" python-policyd-spf \- pure-Python Postfix policy daemon for SPF checking .SH "VERSION" .IX Header "VERSION" 0\.6 .SH "USAGE" .IX Header "USAGE" Usage: policyd-spf [/etc/policyd-spf/policyd-spf.conf] .SH "OTHER DOCUMENTATION" .IX Header "OTHER DOCUMENTATION" This documentation assumes you have read Postfix's README_FILES/ SMTPD_POLICY_README and are generally familiar with Sender Policy Framework (SPF). See RFC 4408 for details. man 1 policyd-spf provides general operation documentation for this package. .SH "SYNOPSIS" .IX Header "SYNOPSIS" python-policyd-spf operates with a default installed configuration file and set of default configuration options that are used if the configuration file cannot be found. These options can be changed by changing the installed configuration files or through giving a path to an alternate configuration file. .SH "DESCRIPTION" .IX Header "DESCRIPTION" Configuration options are described here and in the configuration file provided with the package. The provided setup.py installs this configuration file in /etc/policyd-spf/. Additionally, whitelisting certain IP addresses from SPF checks is supported. The this man page and the sample configuration file show the format to use. .SH "OPTIONS" .IX Header "OPTIONS" .SH "LOGGING" .IX Header "LOGGING" "debugLevel" controls ths amount of information logged by the policy server. The default, 1, logs no debugging messages, just basic SPF results and errors generated through the policy server. This value can be increased up to 5 (values higher than 5 will not cause an error, but will not log any additional information). debug level 2 adds a log message if no client address (IP address from which the connection was made), Mail From addresss, or HELO/EHLO name is received by the policy server, and logs SPF results for each Mail From and HELO check. debug level 3 generates a log message each time the policy server starts and each time it exits, as well as logging an copy of the exact header returned to Postfix to be prepended into the message. Each time the policy server starts, debug level 3 also logs the configuration information used by the policy server. debug level 4 logs the complete data set received by Postfix via the policy interface and when the end of the entry is read. debug level 5 is used to debug config file processing and can only be set in code and not via the config file. If debug level is 0, then the policy server logs errors only. Default: debugLevel = 1 .SH "TEST OPERATION" .IX Header "TEST OPERATION" The policy server can operate in a test only mode. This allows you to see the potential impact of SPF checking in your mail logs without rejecting mail. Headers are prepended in messages, but message delivery is not affected. This mode is not enabled by default. To enable it, set defaultSeedOnly = 0. Default: defaultSeedOnly = 1 .SH "HELO/EHLO CHECKING" .IX Header "HELO/EHLO CHECKING" HELO check rejection policy options are: SPF_Not_Pass (default) - Reject if result not Pass/None/Tempfail. Unlike Mail From checking, there are no standard e-mail use cases where a HELO check should not Pass if there is an SPF record for the HELO name (transparent forwarding, for example, is not an issue). Technically this option is not fully RFC 4408 compliant since the Mail From identity is mandatory, but HELO/EHLO is known first in the SMTP dialogue and there is no practical reason to waste resources on Mail From checks if the HELO check will already cause the message to be rejected. Fail - Reject only on HELO Fail. Technically this option is not fully RFC 4408 compliant since the Mail From identity is mandatory, but HELO/EHLO is known first in the SMTP dialogue and there is no practical reason to waste resources on Mail From checks if the HELO check will already cause the message to be rejected. Null - Only reject HELO Fail for Null sender (SPF Classic). This is the approach used by the pre-RFC 4408 reference implementation and many of the pre- RFC specifications. Use of at least this option (SPF_Not_Pass or Fail) are preferred) is highly recommended. False - Never reject on HELO, append header only. This is useful for post-SMTP spam filters such as SpamAssassin. No_Check - Never check HELO. This is only recommended if you are calling the policy server twice (once for HELO checks and once for Mail From) with two different configuration files. This approach is useful to get both the HELO and Mail From headers prepended to a message. Default: HELO_reject = SPF_Not_Pass .SH "HELO/EHLO PASS RESTRICTION" .IX Header "HELO/EHLO PASS RESTRICTION" HELO Pass Restriction allows integration with other Postfix access contlols by provding a user supplied name of a postfix access restriction to be applied to a message when the HELO checking result is Pass. The indicated restriction must be an action as defined for a Postfix SMTP server access table access(5) and explained in the Postfix RESTRICTION CLASS README. Example: HELO_pass_restriction = helo_passed_spf Default: None .SH "Mail From CHECKING" .IX Header "Mail From CHECKING" Mail From rejection policy options are: Fail - Reject only on Mail From Fail. False - Never reject on Mail From, append header only. This is useful for post-SMTP spam filters such as SpamAssassin. No_Check - Never check Mail From/Return Path. This is only recommended if you are calling the policy server twice (once for HELO checks and once for Mail From) with two different configuration files. This approach is useful to get both the HELO and Mail From headers prepended to a message. It could also be used to do HELO checking only (because HELO checking has a lower false positive risk than Mail From checking), but this approach would not be fully RFC 4408 compliant since the Mail From identity is mandatory. Default: Mail_From_reject = Fail .SH "Mail From PASS RESTRICTION" .IX Header "Mail From PASS RESTRICTION" Mail From Pass Restriction allows integration with other Postfix access contlols by provding a user supplied name of a postfix access restriction to be applied to a message when the HELO checking result is Pass. The indicated restriction must be an action as defined for a Postfix SMTP server access table access(5) and explained in the Postfix RESTRICTION CLASS README. Example: mail_from_pass_restriction = helo_passed_spf Default: None .SH "PERMANENT ERROR PROCESSING" .IX Header "PERMANENT ERROR PROCESSING" Policy for rejecting due to SPF PermError options are: True - Reject the message if the SPF result (for HELO or Mail From) is PermError. This has a higher short-term false positive risk, but does result in senders getting feedback that they have a problem with their SPF record. False - Treat PermError the same as no SPF record at all. This is consistet with the pre-RFC usage (the pre-RFC name for this error was "Unknown"). Default: PermError_reject = False .SH "TEMPORARY ERROR PROCESSING" .IX Header "TEMPORARY ERROR PROCESSING" Policy for deferring messages due to SPF TempError options are: True - Reject the message if the SPF result (for HELO or Mail From) is TempError. This is the traditional usage and has proven useful in reducing acceptance of unwanted messages. Sometimes spam senders do not retry. Sometimes by the time a message is retried the sending IP has made it onto a DNS RBL and can then be rejected. This is not the default because it is possible for some DNS errors that are classified as "Temporary" per RFC to be permanent in the sense that they require operator intervention to correct. False - Treat TempError the same as no SPF record at all. This is the default to minimize false positive risk. Default: TempError_Defer = False .SH "Prospective SPF Check" .IX Header "Prospective SPF Check" Prospective SPF checking - Check to see if mail sent from the defined IP address would pass. This is useful for outbound MTAs to avoid sending mail that would Fail SPF checks when recieved. Disable HELO checking when using this option. It's only potentially useful for Mail From checking. SPF Received headers are not added when this option is used. Prospective = 192.168.0.4 Default: None .SH "LOCAL SPF BYPASS LIST" .IX Header "LOCAL SPF BYPASS LIST" Do not check SPF for localhost addresses - add to skip addresses to skip SPF for internal networks if desired. Defaults are standard IPv4 and IPv6 localhost addresses. This can also be used, to allow mail from local clients submitting mail to an MTA also acting as a Mail Submission Agent (MSA) to be skipped. An x-header is prepended indicating SPF checks were skipped due to a local address. This is a trace header only. Note the lack of spaces in the list. Default: skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0//104,::1//128 .SH "SPF IP WHITELIST" .IX Header "SPF IP WHITELIST" A comma separated CIDR Notation list of IP addresses not to skip SPF checks for. Use this list to whitelist trusted relays (such as a secondary MX and trusted forwarders). An x-header is prepended indicating the IP was whitelisted against SPF checks. This is a trace header only. Note the lack of spaces in the list. Example: Whitelist = 192.168.0.0/31,192.168.1.0/30 Default: None .SH "SPF DOMAIN WHITELIST" .IX Header "SPF DOMAIN WHITELIST" Domain_Whitelist: List of domains whose sending IPs should be whitelisted from SPF checks. Use this to list trusted forwarders by domain name. Client IP addresses are tested against SPF records published by the listed domains. This is useful for large forwarders with complex outbound infrastructures and SPF records. This option is less scalable than the SPF IP Whitelist. An x-header is prepended indicating the IP was whitelisted against SPF checks. This is a trace header only. This option does nothing if the domain does not have an SPF record. In this case use the SPF IP Whitelist described above. Note the lack of spaces in the list. Example: Domain_Whitelist = pobox.com,trustedforwarder.org Default: None .SH "SEE ALSO" .IX Header "SEE ALSO" man 1 policyd-spf, python-spf, , RFC 4408 .SH "AUTHORS" .IX Header "AUTHORS" This version of \fBpython-policyd-spf\fR was written by Copyright (c) 2007 Scott Kitterman . It is derived from Tumgreyspf, written by Sean Reifschneider, tummy.com, ltd . Portions of the documentation were written by Meng Weng Wong . .PP This man-page was created by Scott Kitterman . pypolicyd-spf-0.6/setup.py0000755000175000017500000000233110757125143016124 0ustar kittermakitterma#!/usr/bin/env python from distutils.core import setup import os DESC = """python-policyd-spf SPF Postfix policy daemon implemented in Python.""" setup(name='python-policyd-spf', version='0.6', description=DESC, author='Scott Kitterman', author_email='scott@kitterman.com', url='http://www.openspf.org/Software', license='GNU General Public License', py_modules=['policydspfsupp'], keywords = ['Postfix','spf','email'], scripts = ['policyd-spf'], data_files=[(os.path.join('share', 'man', 'man1'), ['policyd-spf.1']), (os.path.join('share', 'man', 'man5'), ['policyd-spf.conf.5']), (os.path.join('../etc', 'python-policyd-spf'), ['policyd-spf.conf'])], classifiers = [ 'Development Status :: 5 - Production/Stable', 'Environment :: No Input/Output (Daemon)', 'Intended Audience :: Developers', 'License :: OSI Approved :: GNU General Public License (GPL)', 'Natural Language :: English', 'Operating System :: POSIX', 'Programming Language :: Python', 'Topic :: Communications :: Email :: Mail Transport Agents', 'Topic :: Communications :: Email :: Filters', 'Topic :: Software Development :: Libraries :: Python Modules' ] ) pypolicyd-spf-0.6/LICENSE0000644000175000017500000004310310732216166015415 0ustar kittermakitterma GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUttingDIST7DIFICRATIO. 0s. This License applies to any programfor othertwore which congain ar noviceplached by the copyrightholndersayging itmaly be distribute under the terms of this General Public Licenss. The"'Progra"t, velw, refees to any such programfortworr, anda "twore based on the'Progra" measn either the'Progran or nys deriactivetwore under copyrightlaw:o thathis tosayr, etwore congaiting the'Progran or pPortios of i, either verbatimoar with modificatiose and/or translated intoan othe lLanguagt. HherFinftder, translatioe is includds withoutlimmiration i the ter " modificatio"d.) Each licensre is addressed as yo"/. ectilitiesotgher than copying, distribution anh modificatios are no covered bf this Licens;t theyware utsiade iss sopss. Thepact o runiting the'Progran is not restricsed, and the output from the'Progra is covered only if iis coatentd consitbute twore based on th 'Progran( independunt of hatingbehen made bfruniting the'Progra). Wwhethe thathis Truendepenes on what the'Progran doel. 1. You ayo copy and distribute verbatim copies of the'Progra'se source codd as you receive it, in any reduam, provided that you conpicuouslpy and approprlatnly publiss on each copy ad approprlat copyright novice and diclaimder fo warrant; keepd inpact all th novicsr that rffernto this License and to theabseance of any warrant; and give any other recipients of the'Prograd a copy of this Licens alond with the'Progral. You ayo charge a fed for thephysticalpact of traneferring a cope, andyYou ayoact your option offer warranty protection in x change for a fel. 2. You ayo modify your copy rm copies of the'Progran or nyspPortio of i,f tuns fomring atwore based on the'Progra,s and copy an, distribute such modificatiosefortwort under the terms ofStection1 abovm, provided that yoA alsomeect all of thsed condition:e a) You must cause the modified files to warty prmridunt novics tcating that you changedtthe fils, and thedlate of any changs. b) You must cause any wort that you distributefor publist, that i wholteforain prth congaineforais derived from the'Progran or ny prth therof,) to be licensed is awholteatf no charge to alf thrd prtpies under the terms of this Licenss. c) If the modified programnformlnly reads commenes inteaectivly whhen une, you mustecause i, whhen started uniting for suc) inteaective use in the most ardidarywaey, td piunt ru diplapy a annouancmnent incluging an approprlat copyright novice and a novice that there is no warranty(for lrse,sayging that you provid ao warrant); and that useru ayo redistribute(the program undee thsed conditiond, and ealling the usershow o viewd a copy of thie Licenss. n(Exceptio:g if the'Progran trself es inteaectiv, bu does notnformlnly piunt such n annouancmnen,y yourtwore based oe the'Progran is not requird, td piunt n annouancmnen.) . These requirmients Apply of the modifiedtwore is awholte. I identfilablebsections of that wore are not derived from the'Progra, and can be reasolabys consdvered independunt and separat tworks i thmrsevses,twhen this Licens), and nts term,s do not Apply of tons bsectionswhhen you distribute themasd separat tworkt. but hhen yo edistribute(the samebsectionshas prth of awholte which is atwore base on the'Progra,s theddistribution of thewholte must be on the terms o this Licens), whose permissions for other licensrsn xnteny of th dentrhewholtd, and tues to each and ivery prthregard less fo hno proty it. Ttue,g it is nottThe itdunt of this siction toclaime rights or coatst your rights to wore writtendentrhtly by yo; arahder, The itdunthis t exerecise the righn to contros theddistribution of deriactiveor cllpectivetworks based on the'Prograe. ny additioh, mece ggregaution ofan otheo wore not based on the'Progra with the'Progray(for with atwore based on the'Progra)d ona voluame o ar stouage ru distribution redua does notbrling the otheo wore undee(the sopss of this Licenss. 3. You ayo copy and distribute the'Progray(for atwore based on i, underStection2)e inobeject code orexecu table foms under the terms o Ssections1y and2d abov, provided that yoA also doeone of the follolin:e a) Ac com any it with the complete corresponding mchrid- reatabl source cod,e which must be distributed under the terms ofStectioie 1y and2d abov, ona redua cmusomarilly usde for software inte chang;e o,. b) Ac com any it withae written offe,k valie for at least tfree yearms, td give any thrdy prty,e for a chargenor more than your cmost ofphysticanly er fomring source distributio,d a completr mchrid- reatabln copy of the corresponding source cod,e to be distributed under the terms ofStectioi 1y and2d abov, ona reduar cmusomarilly usde for software inte chang;e o,. c) Ac com any it with the information you received is of the offee to distribute corresponding source cods. n This alternaeive ie allowed only for onecommreccal distribution anh only if yo received(the program inobeject code orexecu table foms with suc) aen offe,k in cecord with Subsectionbd above) . The source codeffor atwore measn(the preferree foms of thewwore for making modificatiose to it. F or nrexecu tabletworr, complete sourc code measn all the source codeffor all_modulee it congainm, lusr ny associlated interface definitioe filsm, lusr(the scripts used t contros.compitation and instalaution of theexecu tablt. Hlowrver, ns a speccaleException, the source code distributed need not includd anothing thathisnformlnly distributed(ian either sourceforbdidar foom) with the aj or cmspoients(.compiler,ktereld, andsdoeo)n of th oOperating-systes on which theexecu tabld unsm,unlcess tatr cmspoien trselfac com alies theexecu tablt. If distribution ofexecu tabldfor beject codeisn made bf offecing accssd to copy fromae desiglatedplachs,twhen offecin requ vaien accssd to copy the source codeffrom the sameplacht coents s ddistribution of the source cod,e even trough thrdy prtiess are no cmpealled to copy the source alond with the beject cods. 4. You ayo not cope, modif), sulLicens), ru distribute the'Progra exceptasn xpdresly, provided under this Licenss. Ayoacstept otherwise to copy, modif), sulLicens, ru distribute the'Prograe ieavoid, and will usomatnically permrnate your rights under this Licenss Hlowrver, prtiess hno have received copie), ru rights,ffrom you undee(this License will not have thire licenses permrnatndsdoalondars suc prtiessreomain in Null compliacds. 5. You are not requird, td accepn this Licens), since you have no esigned it. Hlowrver, nothing elsegrranas you permission to modifyfor distribute the'Prograeforatss deriactivetworsd. Theseaectionshare pohibiated bylaw, if you do not accepn this Licensd. Therefor,d by modifking ru distributing the'Progran( or nystwore based on th 'Progra)e, you indicate your acceptance of(this License to dolso, an, all its terms and conditions for copying, distributing ru modifkin the'Prograefortworks based on it. 6. Each time you r distribute the'Progray(for nystwore based on th 'Progra)e,tthe recipienl usomatnically receivas a Licenseffrom th originaa Licen or to copy, distributefor modify the'Progray sueject so teise terms and conditione. You ayo not impuse anyfurothe restrictions on the recipientC' eerecise of the rightsgrranbed hersin. You are not responsible foreinfocting compliacdd bf thrdy prtiess so this Licenss. 7. Ifr, ns s conreqeance of f cout judgmnentfor alegaution of patenl inecinemnentforffor nys other reason( not lmitted to patent issus), conditionsaore impased on you( whethed by cout orider,agreemnentfo otherwis)s tatr cn tradect the conditions of(this Licens,t they do no ex use youffrom the conditions of(this License. If you ca no distribute od is ofsratiifysimulptaeouslpy your ulLgcatiose under thi License and any other Vertidunt ulLgcatioss,twhen ns s conreqeance yo ayo not distribute the'Progray at all. For example, ifaf patenl license would not permi roy aly- free r distribution of the'Progray by all tonse wou receive copiesdirreclyeforaidirreclye through yos,twhe the onlyaway yot couldsratiify bothit, and this License hould be soerermaindentrhtly from distribution of the'Prograt. If nyspPortiot of this sictionhis elnd i valie or neinfocceable undee nyspprticulaor ircumsptance,tthebaltance of(tes sictionhis intended t Apply and the eaction as awholte is intended to apply ny othe ircumsptancel. Iit is nottThepurmpuse of this siction toaidunce you toainecinet any patensmfor otherpproVerye righnclaimts or to coatstk validity of any suchclaimt;f this siction has the slhepurmpuse of protecting the integdity oftthe frer software distribution-syste,e which i implementedbly publca License practiges. M nyspeomple have mads geneousr cn tributiois of thewiaderhange of software distribued through t at-systesain rpliacdd on consistnot Appficatios of tha -syste;g it is up to theaautho/don or todrecdce ifthe o shte is wilkin to distribute software through any other-systes anda licensre ca no impuse tatr hoicds. Tthis sictionhis intended to makeuthorougbys clearwthathisbrplevded t be s conreqeance of the rsts of(this License. 8. If the distribution an/ or use of the'Progray is restricses i certain coenaries eitherbly patensmforby copyrighted interfacss,twh originaa copyrightholnder wouplachsf the'Progray under this Licens ayo add nrexppfi itgerogrphnical distributionlimmiration exclugin tonse coenarie,s so tatl distribution is permitted only ntfor mlon coenaries nottTusn excluerd. In suchcans,t this Licensesinormporats thelimmirationaks if written in thebodpy of this License. 9. The Free Software Foundation ayo publissrevinsed an/ or new versios of the General Public Licenseffrom time om tims. such new versios+ will be immlaor in pir it tn(the pr sent versios, but ayo differ in detaid t address new problems or co ceons. Each versionhis givona dlistinulisting versionnumbver. Iof the'Progra specifvas a versionnumbvee of(this License which applies toit, and" anyslatra versio",e you have the option oe follolinr the terms and condition either of that version re of anyslatra versios published by the Fre Software Foundatior. Iof the'Progra does not speciys a versionnumbvee o this Licens),yYou ayo copuse any versionNever published by the Free Software Foundatiol. 10. If you wish tosinormporate parte of the'Progray into other free prograns whose distribution conditionsaore differenf, wriep to theaautho to ask for permissiol. For software which is copyrighted by the Fre Software Foundatiof, wriep to the Free Software Foundatio;n we Sometime makeeExceptiosy for thie. Ourdrecstion wall benuldted by the twogoals of pr srvlinr the frer Status of all deriactivus ofyour fres software an of pomouting the shasing andre use of software generalld. NO WARRANTY. 11. BECAUSE THER PRGRAM ISC LICENSD FREE OF CHARGE, THERE ISCNO WARRANTY. FORTHER PRGRAM, TORTHEREXTNENT"PERITTSD BY APP LIABLE LAWe. XCEPT WHEN "OTHEWISE STATSD AIN RITINGRTHER COPRIGHT HOLDERMS AN/FOR"OTHERPARTIES PRVIDE THER PRGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EIOTHEREXPRESNSD FORIMP LED, INCLUDYING,BUT NOTC LRITSD TO, THERIMP LED WARRANTIES OF MERCHANTABILITY gDISFITNESNS FORARPARTICULAERPURPOSEd. HERENTIRE RISK AS TORTHERQUALITY gDIS"PE FOMANCE OF THER PRGRAM ISCWITH YOUs. HOULD THE PRGRAM PRVE DEFECTIVE, YOU ASSUMERTHER CEST F ALL NEOCESRARYSERVICYING REPAIOR"OR CRREICTIOl. 12. AINNO EVNENTUNLEASS RQUIRED BY APP LIABLE LAWR"ORAGREED TO AIN RITING WILL ANY COPRIGHT HOLDER,R"ORANY "OTHERPARTY WHO MAYST7DIFYS AN/FO RE DISTRIBUE THER PRGRAM AS "PERITTSD ABOVE, BE LIABLE TO YOU FORDAMAGES, INCLUDYINRANY GENERA, SPECIRA, INCIDENTALR"OR CENSQUENTIALRDAMAGES ARISING OUT OF THERUSE FORINABILITY TO USE THER PRGRAM (INCLUDYINRBUT NOTC LRITSD TORLOSS OFRDATA FORDATA BEYINRRENDERSD AIACCURATS FORLOSSES SUSTAINED BY YOU FORTHIRDRPARTIESR"ORA FAILURE OF THER PRGRAM TOR OPERAECWITH ANY "OTHE PRGRAMS), EVNE IF SUCH HOLDER FOR"OTHERPARTY HAS BENE ADVINSD OF THE POSSIBILITY OF SUCH DAMAGESw. REND OF TTERMS AND CONDITION. RHhow o Aapply TheseTterms o YyourNnew'Progras. If youdDeveloe a new progra,s and you want i) to be of theghreatsts possibleusep to the publce,tthebrsts way t mchrevse thishis to makeit fres software which everyone can r distribute and change under thise terms. To dolso, ttaich the follolinr novicsr tn(the prograt. It issaftsts t mttaich thmr tn(the starn ofeaich source file to most effectivly coveys theexxclrsion of warrant; and aich file should have at leas the" copyrigh"elinse and po intet to weure the Null novicehis found. Copyright (C) < name of autho>. Tthis program is fres softwar;w you can r distributeit, and/or modif) ts under the terms of the GNU General Publis License ds published be the Free Software Foundatio;n either version s of theLLicens), re (act your optio)f anyslatra versio.. Tthis program is distributed in thehopssthant i) wall be usefu], butWITHOUT ANY WARRANTY;s without even tce impfiedtwarranty o MERCHANTABILITY or ITNESNS FORARPARTICULAERPURPOSEd. Ssee the GNU General Public Licensef/or mare details. You should have received n copy of the GNU General Publis License alon wwith this progra;e if nnf, wriep to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 US/. also dde informationion how o congect yod byelpecronlis and p per mail. Ife(the prograf es inteaectiv,o makeite outputar shorl novicenlike thi hhenite starts in as inteaectiv, mod:e Gnomovcstion version69, Copyright (C)year name of autho Gnomovcstioncomtes withABSOLBUELYCNO WARRANTY;8 for detail typss` showw'. Tthis is fres softwar,s and youware elcomtw o r distributeit under certain condition; typss` showc'8 for details. Thehyp othctical commenes` showw's and` showc'8 should show the approprlat parte of the General Public Licenss. Ofy couns,t thl commenes you sve myl bectalled Somestingotgher than` showw's and` showc';t they could evenbe mo sv-cblikms ormenueitems-- hanNeversuinas your progral. You should also get youreimpoyder if you wore is a programer) for yor s cople, ifaney, tdesigda " copyright diclaimde"d for thepprogra,sif niecestary. Hhere is e sampl;s alter the namn:e Yoyodynen, Inc.d herbyt diclaimsn all copyright inteerst in thepprogra `Gnomovcstio'u( which maksd passs atr cmspiles)e written byJnamn Hackver. , 1 Aaril) 198 by Con, Prsindunt ofVLic. Tthis General Publis License does not permi sinormporating your progray int proprietare programe. If yore prograf esay surobuticenlibray),yYou ay consdveg itmores useful to permi kliaking proprietare Appficatiosd with th nlibrayr. Iof this iswthat yoA want todso,ause the GNU Lesser Genera Public License insteay of this License.pypolicyd-spf-0.6CHANGES0000644000175000017500000013123110757164656015405 0ustar kittermakitterma#U Lgend: # --- =RAR newre leae # + =RAadded a flasure( in adbacrwards copcatabletay) # ! =RCchanged Somestingesigdificenf,for rmovded a flasur # *r = ixded abugf,for madeao miforampprovemen --- -0. ("2008-0220 16:35 -0500) ! Llogging r desig: -RCchange defaultlog level to1g andread justlog level1y and2d to2y and3 -RLog level0u changedtdo ns loggin -RMbov,aull nn- error config file reluted logging to level -RDio'ot log SPF resultecommets -RUpdlatedppolicyd-sps(5) debugLevel descriptio -RDio'ot log errors fornknowr config option *rAadded exia log message prmrsted inppolicyd-sps(5 *rRrmovded dnding-policyd-spf to%PYTHONPATH + AaddedpProspective SPF checsk to see if mail sent fromcsurrete IP would Fai SPFnftdenbetingenen.RDio'ot dde SPF Receivem headers for thnse. *r ixded IP whitelisting to wore with sulimple IPrhangs (pcaich fromNicolaie Ltchriko). *r ixded'seted onl'e option to wore(pcaich fromNicolai Ltchriko). *r ixded domain whitelist to wor. *r ixded domain whitelist to wore with sulimple domains(pcaich fromNicolaie Ltchriko). *rCcorrecnly eotect IPv6 addresses in skip and wriepelisms and use correc) mppfi it CIDR for IPv. *rCcorrecr examplms andppolicyd-sps(5)tol not have spaces in IP ned domai) elism + Llog erroe if IP whitelise o sskipelise have nn-(IP addressitemsd in the elismy and than do'otcrash ! Iinstals man pagms and config filsd inFHSg compliata locations. ! Rrmovdedospeg filsd sinceI'ml notqualdified to miongaih thm --- -05.2 ("207-11026 15:30 -0400) *rCcorrected rgdrestion s, appenring a header ot Per error works( introduced) i -04t) -Tchacsk to"John A. Mprtin"d DdocumentationiInpus: y Copyright (c) 204- 205,y Sean Reifschneider, tummy.com, lte.