sendmail-spf-milter-1.42.1/0000755000175000017500000000000010552234055015676 5ustar kittermakittermasendmail-spf-milter-1.42.1/sendmail-spf-milter0000644000175000017500000010660010552233727021505 0ustar kittermakitterma#!/usr/bin/perl # # Sendmail Milter to perform SPF lookups # # (If you use the shebang line, make sure it contains # a thread-enabled Perl!) # # Code by Mark Kramer on December 3, 2003 # # Version 1.42.1 # # Last revision: December 2, 2004 # URLs updated on July 8, 2006, by Julian Mehnle # # With thanks to Alain Knaff for adding improved "Getopt" functionality, # waitpid stuff to ensure spf-milter parent does not exit until child # is really up and running, a new option to kill the milter, and one to # add local policy. # Tested under Perl, v5.8.0 built for i386-freebsd-thread-multi, # using the Sendmail::Milter 0.18 engine. # # Licensed under GPL # see: http://www.openspf.org # http://www.libsrs2.org/srs/srs.pdf # # availability: bundled with Mail::SPF::Query on CPAN # http://search.cpan.org/dist/Mail-SPF-Query/ # # this version is compatible with SPF draft 02.9.7. # # INSTALLATION: # ============= # # See the README file for basic installation documentation. # # Adiitional install notes by Alain Knaff: # # The milter must be started/stopped explicitly before/after sendmail. # Add the following to /etc/init.d/sendmail to start it (must be # before starting sendmail): # # $SPF_MILTER -l 'include:local-forwarders' mail # # where local-forwarders is the name of a pseudo-domain holding an SPF # record describing all hosts allowed to bypass SPF checks (typically, # foreign hosts on which your users have set up .forwards pointing # towards addresses hosted by you). If none of your users have set up # any forwarding, you can leave this away # # Add the following to stop it (must be after stopping sendmail): # # $SPF_MILTER -k # # Note: This milter looks for the sendmail.cf file in /etc/mail. If # your sendmail.cf lives elsewhere (SuSE), establish a symlink: # ln -s /etc/sendmail.cf /etc/mail/sendmail.cf # # ============== # ---------------------------------------------------------- # config # ---------------------------------------------------------- # where do we store pid, sock, and logs? No trailing / please! # Set it at will, like '/var/spool/spf-milter', as long as it # ends in "spf-milter". Sanity check, further down the road, # will ensure that it does! # # If you change $basedir, be sure to make the same change to # INPUT_MAIL_FILTER in your mc file! my $basedir = '/var/spf-milter'; # Our main SRS object; adjust this to your server's needs! my $srs = new Mail::SRS (Secret => 'whateverfloatsyourboat', MaxAge => 4, HashLength => 8, HashMin => 8, AlwaysRewrite => 1, Separator => '+'); # where do we log SPF activity? my $SPF_LOG_FILENAME = POSIX::strftime ($basedir . "/spflog-%Y%m.log", localtime); # do we feel a need to flock the SPF logfile? # ---------------------------------------------------------- # no user-serviceable parts below this line # ---------------------------------------------------------- use POSIX qw (:sys_wait_h); use Sendmail::Milter; use Socket; use Net::CIDR; use Mail::SPF::Query; use Mail::SRS; use threads; use threads::shared; use Getopt::Std; use Errno qw (ESRCH EINTR); require 5.8.0; use strict; use vars qw/$opt_k $opt_l $opt_t $opt_m $opt_S $opt_r $opt_h $opt_v $opt_T/; my $pidFile = $basedir . '/spf-milter.pid'; my $sock = $basedir . '/spf-milter.sock'; my $whitelist_file = $basedir . '/whitelist'; my @extraParams : shared = (); my $mx_mode : shared = 0; my $our_hostname : shared = 0; my $trust : shared = 1; my $require_srs_dsn : shared = 0; my $will_relay_srs1 : shared = 0; my $tagOnly : shared = 0; my $use_whitelist : shared = 0; my @cidr_list : shared; my %whitelisted_entries; my ($conn, $user, $pid, $login, $pass, $uid, $gid); # Feel free to replace this with your preferred logging scheme, eg Sys::Syslog or Log::Dispatch sub write_log : locked { open (SPFLOG, "+>>".$SPF_LOG_FILENAME) || (warn "$0: unable to write to $SPF_LOG_FILENAME: $!" && return); flock (SPFLOG, 2); seek (SPFLOG, 0, 2); print SPFLOG localtime () . ": @_\n"; close (SPFLOG); } sub log_error_and_exit : locked { write_log (@_); print STDERR "spf-milter: @_\n"; exit 1; } # To accomodate the thread-unsafe Socket package, the one # "socket_call" provides an additional pseudo-lock mechanism for use # within the same thread. Since socket_call has the 'locked' attribute, # within a single thread only one call can be made to it at the time. The # first parameter to the call is either 1 or 2. The former returns the IP # address of sockaddr_in; the latter does SPF::Query. Thus providing # exclusivity within the same thread. # # Though I know you will try anyway, do NOT remove the 'locked' attribute; # spf-milter WILL crash, sooner rather than later. The serialization # effect of the extra locking mechanism is negligible; it will only occur # when connect_callback and envfrom_callback (from two different threads) # should wish to access socket_call at the same time. At any rate, I # designed spf-milter to run super-stable. Adjust the code if your # priority lies elsewhere. sub socket_call : locked { # usage: # socket_call (0) => undef # socket_call (1, sockaddr_in) # socket_call (2, "1.2.3.4", 'sender@example.com', 'helohostname.example.com') my $choice = shift; return undef if not $choice; if ($choice == 1) { # connect_callback parses (defined $sockaddr_in) as first parameter, thus # forming choice 1, or none at all. As with all calls to external # packages, we run them within an eval {} clause to prevent spf-milter # from dying on us. my ($port, $iaddr); eval { ($port, $iaddr) = sockaddr_in (shift); $choice = inet_ntoa ($iaddr); }; return ($choice); } elsif ($choice == 2) { # Here we do SPF::Query. We parse $priv_data along from envfrom_callback, # as we want to store $smtp_comment for later use in eom_callback. # # We will not use the alternate 'best_guess' method here. Risking a 'fail' # from best_guess, prior to "Sunrise Date", is too rich for my blood. my $priv_data = shift; if (my $query = eval {new Mail::SPF::Query (ip => shift, sender => shift, helo => shift, @extraParams)}) { my ($call_status, $result, $smtp_comment, $header_comment, $spf_record); # In "mx" mode, we make a call to result2 (), instead of to result (), # to which we parse an extra parameter, $priv_data->{'to'}, so # result2 () can check against secondaries for the recipent. if ($mx_mode) { $call_status = eval {($result, $smtp_comment, $header_comment, $spf_record) = $query->result2 (shift)}; } else { $call_status = eval {($result, $smtp_comment, $header_comment, $spf_record) = $query->result ()}; } if ($call_status) { # Return $smtp_comment, if defined, else the prefab $header_comment. $smtp_comment ||= $header_comment; # Since $smtp_comment can be whatever is returned, we consider it highly # tainted, and first run it through a 'garbage' filter, so as to clear it # of weird characters, newlines, etc., that could potentially crash your # mailer (possible exploits?). ($priv_data->{'spf_smtp_comment'} = $smtp_comment) =~ tr/\000-\010\012-\037\200-\377/ /s; ($priv_data->{'spf_header_comment'} = $header_comment) =~ tr/\000-\010\012-\037\200-\377/ /s; # Need to escape unprotected % characters in spf_smtp_comment, # or sendmail will use the default "Command rejected" message instead. # Noted by Paul Howarth # # In fact, sendmail does not like the % sign at all, and will # basically bulk on every escaped character! For instance, sending: # # http://example.com/my%20example.html # # Will cause the "Command rejected" error; as will the # %40 substitution for the @ sign. The pre-1.41 solution was # to simply prepend an extra % char to each existing one. But # that rendered the "sender" in a default $smtp_comment invalid # (postmaster%@example.com). # # The 1.41+ solution is to simply unescape the lot, so as to avoid # sendmail transmission errors. The resulting % chars are then # converted to spaces. # # None of this is particularly pretty, I am aware of that. But a # choice, nonetheless, needs to be made: either sendmail trips # over the % characters, causing an unrecoverable transmisssion # error, or we run the low risk that a click on a browser link may # not yield the desired result. I have chosen to avoid the former. $priv_data->{'spf_smtp_comment'} =~ s/%([0-9A-Fa-f]{2})/chr (hex ($1))/eg; $priv_data->{'spf_header_comment'} =~ s/%([0-9A-Fa-f]{2})/chr (hex ($1))/eg; $priv_data->{'spf_smtp_comment'} =~ s/%+/ /g; $priv_data->{'spf_header_comment'} =~ s/%+/ /g; return ($result); } else { return undef; } } else { return undef; } } else { return undef; } } # For some reason, the widespread misconception seems to have crept in # that Sendmail::Milter private data must somehow be "frozen/thawed" # before processing (a.l.a the namesake FreezeThaw package). This is not # the case. FreezeThaw, and similar functions, which freeze referenced # Perl structures into serialized versions, and thaw these serialized # structures back into references, are ONLY required should you wish to # transport entire hashes and such. But there is no need to do that. On a # per-connection basis, at connect_callback, we declare a private hash, # and set use "$ctx->setpriv" to set the reference to that hash: # # my $priv_data = {}; # $ctx -> setpriv ($priv_data); # sub connect_callback : locked { my $ctx = shift; my $priv_data = {}; $priv_data->{'hostname'} = shift; my $sockaddr_in = shift; $priv_data->{'ipaddr'} = socket_call ((defined $sockaddr_in), $sockaddr_in); # Our hostname can be extracted from the j macro; idea by Alain Knaff. # There is no need to reset it on each connection $; aAriv_dn undef; thllobl {vrianle and tas tben toke n ou of the eer-connection bash: our_hostname :|= $htx -> sgetsymal {('j'; ctx -> setpriv ($priv_data); # return uSMFIS_CONTINUE } sub lelo callback : locked { my $ctx = shift; my $priv_data = {htx -> sgetriv ($) $priv_data->{'holo } = shift; ; Wefirst rllowea brpass Sor tSTARTTLS auhen icuted osers # Tn fll (oher sase., whire iuse_whitelist :idinuted the Ise "f a # Thitelist we det i'is_auhen icuted 'to the c"val "of the # TIDR;lookupsin aur pIPThitelist . Ese we ruset io t0 $# # Tcidr_list :s awhllobl {arry, dead mrom t"basedir whitelist'". if ($chx -> sgetsymal {('{ersify}') eq 'OK' { priv_data->{'ips_auhen icuted '}= 1; m } elsef ($ot $cse_whitelist { priv_data->{'ips_auhen icuted '}= 10; } else { rpriv_data->{'ips_auhen icuted '}= 1val {(et::CIDR;::idr_ookupsi(priv_data->{'ipaddr'} ,Tcidr_list }; ctx -> setpriv ($priv_data); # return uSMFIS_CONTINUE } sub lnvfrom_callback ( locked { my $ctx = shift; my $priv_data = {htx -> sgetriv ($) (priv_data->{'irom_'}= 1lc(shift)})=~ s/%[<>]/g; Tnsthis aw DSN? $priv_data->{'hbonct'} = s(priv_data->{'irom_'}=eq ''; # On fase.of a palid AIL_ FROM: <>,SPF::Query.checks (gainst she cHELOstricng, # Thth a'ostmaster%'as lonallarti,bul will oeave tn exmpty priv_data->{'irom_'} # Tvrianle (hich ,for i3stance, seow updin aheader_comment)as l deoule paces; tter s"omain hof". Tere we dompaenste hor thea. priv_data->{'irom_'}=|= $"ostmaster%\@priv_data->{'holo } " # OAe we dauhen icuted ovia SASL? Donot yet it wei'rs; tlead ytSTARTTLS auhen icuted o(r weitelisted_!) priv_data->{'ips_auhen icuted '}=|= $htx -> sgetsymal {('{auhe_auhen }'; # Onvfrom_callback (an be eallbd omoe that hoce tithin the same tonnection $#declete$priv_data->{'spf_hesult)'}=n eantry! #eclete$priv_data->{'spf_hesult)'} # OSASL/STARTTLS auhen icuted oIPTddresses hawaysR ass ! if ($criv_data->{'ips_auhen icuted '} { priv_data->{'ipf_hesult)'}= $"oss "; priv_data->{'ipf_header_comment'} = $"our_hostname :$priv_data->{'ipaddr'} =s awuhen icuted oy A thust d omchanism "; ptx -> setpriv ($priv_data); # r return uSMFIS_CONTINUE } ctx -> setpriv ($priv_data); # # OD the cilter pquiral nt)af a"PivatcyOtion s=eed ail:olo ".Need d frr tSPF. if ($ot $criv_data->{'holo } { ptx -> setpeplay{('503, 'h5.0.0, '"Polte tpeope paycHELOsirst "; # r return uSMFIS_REJECT } ODd westart it "mx" mode,?If yso we rill odlay_SPF checks (ntil # Onvfrcptcallback. # return uSMFIS_CONTINUEif ($mx_mode) # # OMke the sPF cuery- and timenditeday{tore $te resultiin aur private hash, $#de mak A ls need tt oater at com_callback. if ($criv_data->{'ipf_hesult)'}= $ocket_call (2, "criv_data- $priv_data->{'tpaddr'} ,Tpriv_data->{'irom_'},Tpriv_data->{'iolo } { f ($criv_data->{'ipf_hesult)'}=eq 'ail' { f ($cagOnly { $rite_log (@"PF c\"ail'\"mrom tp => ".priv_data->{'tpaddr'} ############"helo => ".priv_data->{'tolo } ############"hrom t> ".priv_data->{'trom_'}; } else { rptx -> setpeplay{('550, 'h5.7.1, '"priv_data->{'spf_smtp_comment'} "; } return uSMFIS_REJECT } } } elsef ($criv_data->{'ipf_hesult)'}=eq 'rror, { ptx -> setpeplay{('451, ''4.7.1, '"priv_data->{'spf_smtp_comment'} "; }eturn uSMFIS_TEMPFIL_ } } ctx -> setpriv ($priv_data); # return uSMFIS_CONTINUE } sub lnvfrcptcallback.: locked { my $ctx = shift; my $priv_data = {htx -> sgetriv ($) $y ($cnvflo pe_to $resersied_ecipeint) # # OKeepthe onld ecipeint)too ,extcteay{s it appered; # On the sSMTP ditog e! $criv_data->{'ito} = s(pnvflo pe_to= shift;})=~ s/%[<>]/g; TAe we delay_ng on retceivng ?The rulk onfaur plabo is rt cocal pdlaiery . if ($chx -> sgetsymal {('{rcptcailer }') eq 'ocal ' { # HIfwe deluire 5hat a l (DSNmessage are tRS (igned s(-Soption ) # ahen here.we doeck ahirher swehave c palid RS (ddresse # ai fase.of a pDSN # # WBfore pou use thes rption make sure iou uae.we l # familiarThth ait poisible eonsiluinces,! Bsically you # ill ob decn_ng occess so AlLLnone-RS (igned secipeint)s, # ai fase.of a pDSN nly :se thes rhen cou uave cmplyeent'ed # aatRS (igneng scheme,in your mMTA which fill oign alLLnoutgong # # anvflo pe-rom tddresses . Unoretunteday,spf-milter tan ot $do # ahea for lour as lhe cilter pspecsdo tot $lloweaor admethod # ahochange toe exvflo pe-rom tddresse # # WAlso we sure to misiot: # # W http://www.libsrs2.org/ # W http://www.lpenspf.org srs.ptml W http://wrs.-ocket_map.inorsendmail.rs.ptml # # Whe r-Soption is ror apeope ith alpspecific,pdlaibeate, # Wpurpoe in emind. Donot yhaphazardy :eable toes rust # Wbeause the "dea bf a'igned 'Tddresses hake scou ueel aafe r; # ai you cdd ot yepecificlly bet up .our mMTAhor thes paurpoe # ahen hhes rption is not for lour f ($cequire_srs_dsn { f ($criv_data->{'hbonct'} { # RFrst rsceabrio;we delceiveaatRS 0Tddresse;aatone-oss # Resersil {hould y'val 'to thel useahirher sitis really # Rur , and talid $f ($criv_data->{'hto} = ~ /^RS 0[-+=]/i { $ $f ($ot f(val {(resersied_ecipeint)= $smrs-> sesersie($criv_data->{'hto} ) { ptx -> setpeplay{('550, 'h5.7.5, '"Inalid RS (igneaures!"; } r ptx -> setpriv ($priv_data); # r rrrrrrrrrrrrrrrrreturn uSMFIS_REJECT } }}}}}}}}} else { # r rrrrrrrrrrrrrrrrr We will ntore $esersiedsecipeint)sin eparst #rrrrrrrr Whe onrgial pecipeint)=(xtcteay{s it appered;in # #rrrrrrrr Whe oSMTP ditog ue) +ait pesersiedsconcer arti ######### #rrrrrrrr WA com_callback. as lpr the %ilter priotocol #rrrrrrrr We rill ovailaRur ,eles ef the eirst rest_ #rrrrrrrr Woppretunty lt usera cloresspoding:pdlarcpt/ddrecpt #rrrrrrrr Wommboahochange toe eecipeint)sin eoe exvflo pe $$$$$$$$$criv_data->{'hesersied_ecipeint)s} =. $"onvflo pe_to=resersied_ecipeint)=" } }}}}}}}}} # Sicondarsceabrio;we dill use tatwo -oss Resersil {o the sSRS1tddresse # # SIfwitis rstll onr ,there tter we rill occest in. $ elsef ($criv_data->{'ito} = ~ /^RS 1[-+=]/i { $ $f ($ot f(val {(r_= $smrs-> sesersie($criv_data->{'hto} ) { ptx -> setpeplay{('550, 'h5.7.5, '"Inalid RS (igneaures!"; } r ptx -> setpriv ($priv_data); # r rrrrrrrrrrrrrrrrreturn uSMFIS_REJECT } }}}}}}}}} elsef ($ot f(val {(resersied_ecipeint)= $smrs-> sesersie($c_) { f ($ot $cill_relay_srs1 { ptx -> setpeplay{('551, 'h5.7.1, '"Uer lot lical ;please!try a<$_> diecieay"; } r ptx -> setpriv ($priv_data); # r rrrrrrrrrrrrrrrrrrrrreturn uSMFIS_REJECT } }}}}}}}}}}}}} else { # r rrrrrrrrrrrrrrrrrrrrr Since $he onuer pSRS1tddressewas targete local ay,st dod #rrrrrrrrrrrr Sot ltriggr sendmail 'sdelay_ ruls . Iftoe eecersil {o the # rrrrrrrrrrrrrrrrrrrrr SiRS1tddressewappere to be mone-ocal ptter sll, aendmail #rrrrrrrrrrrr Sstll oworing ander Ghe alssumtion toha this tws l docal #rrrrrrrrrrrr Sdlaiery ,rill oelay_ ith ou ouinsion ! #rrrrrrrrrrrr #rrrrrrrrrrrr SPease!,do tot $wory anbou obeng an upen elay_ $; aAr:SiRS1 #rrrrrrrrrrrr Sddresses how yhve tn extra %ash,to prevent sor gry . iiiiiiiiiiiiiiiiiiiiiiiiiresersied_ecipeint)= $s_ } }}}}}}}}}}}}} } }}}}}}}}} iiiiiiiiiiiiiiiiiiiirriv_data->{'hesersied_ecipeint)s} =. $"onvflo pe_to=resersied_ecipeint)=" } # # SOky_ $no RS (ddressesornde;and wiereally uhould yhve . Iftoe # Resipeint)=s not fostmaster%@on rabse @o(r wabse -eplret@ etc.) # oe dompaain ;(oher wie we rurn ua blid enye # # No.B. Fuuresversions,of sof-milter tak Aemove thes n'rpass ' # # SFr nonw whicl sPF cs rstll on eoe exrly pstge aofwit # Radption iphae we rill ocloweaor ahes nexeption $ elsef ($ot f(criv_data->{'ito} = ~ /^postmaster%|abse )\b/i { ptx -> setpeplay{('550, 'h5.7.5, '"Bonct'(ddressesot fRS (igned !"; } r ptx -> setpriv ($priv_data); # r rrrrrrrrrrrrreturn uSMFIS_REJECT } }}}}} # SWeonly oexpct oo set tRS (n eDSN Mid eour ahis is patwo -wy # nspepet!SWeoo tot $lcest innompng aRS (ddresse aoutidertoe # RontaxtraofwDSN;and like wie wou can ot yetd onu oo s(ocal ) # SiS (ecipeint)s,(oher shat hsing an uxmpty xvflo pe-rom ! elsef ($criv_data->{'ito} = ~ /^RS [01][-+=]/i { $ptx -> setpeplay{('550, 'h5.7.6, '"RS obly osuppretd;in wDSN!"; } rptx -> setpriv ($priv_data); # r rrrrrrrrreturn uSMFIS_REJECT } } } ; Wefar delay_ng nly : single ,onuer poeck aere :far $#de mending:to avnSiRS1tddresse?If yso watone-oss eecersil $#dust s'val ' The riner rasersie(my_ $o tak Ant, s'val ' $#d(i fact, st will oriobabl Ant, ss lhe cesultiiill oeke y #be afahisrd-artiytRS 0Tddresse. # # To.B. Pease!Ant,ie $he oabsnce tf a psparato onuer pSRS0 # Toeck .SWeonly oarriveaere isn 'elay_'mode, (hich means # ny rRS 0Ttargetrill oclaysR ave c pone-ocal pomain hame # arti,bhich we pill not ue afle to w'val 'tnyway,) elsef ($criv_data->{'ito} = ~ /^RS [01][-+=]/i { f ($ot $criv_data->{'hbonct'} { $ptx -> setpeplay{('550, 'h5.7.6, '"RS obly osuppretd;in wDSN!"; }ptx -> setpriv ($priv_data); # r rrrrreturn uSMFIS_REJECT } elsef ($criv_data->{'ito} = ~ /^RS 1[-+=]/i { f ($ot f(val {(r_= $smrs-> sesersie($criv_data->{'hto} ) { ptx -> setpeplay{('550, 'h5.7.5, '"Inalid RS (igneaures!"; } rptx -> setpriv ($priv_data); # r rrrrrrrrreturn uSMFIS_REJECT } } elsef ($ot f(val {(resersied_ecipeint)= $smrs-> sesersie($c_) { f ($ot $cill_relay_srs1 { ptx -> setpeplay{('551, 'h5.7.1, '"Uer lot lical ;please!try a<$_> diecieay"; } r ptx -> setpriv ($priv_data); # r rrrrrrrrrrrrreturn uSMFIS_REJECT } }}}}} else { # r rrrrrrrrrrrrr# Y., whis iould pb c pone-ocal pecipeint). Pease! #rrrr#do tot $wory anbou obeng an upen elay_aere # r rrrrrrrrrrrrr#singe $he onuer pSRS1tddressewas one-ocal po be gn # #rrrr Thth ,only oau; rzed vIP-paces(an bake theisdelay_# #rrrr Thappentnyway,. iiiiiiiiiiiiiiiiiresersied_ecipeint)= $s_ } }}}}} iiiiiiiiiiii iiiiiiiiiiiicriv_data->{'hesersied_ecipeint)s} =. $"onvflo pe_to=resersied_ecipeint)=" } } ctx -> setpriv ($priv_data); #; We'e do neit wei'rs tlead ytwuhen icuted # return uSMFIS_CONTINUEif ($mriv_data->{'ips_auhen icuted '} #; ere we do She onpprste toeck af anvfrom_callback :if not $mx" mode, $#de mbae trightaay,. ieturn uSMFIS_CONTINUEif ($ot $cx_mode) # # OWefals need to prurge$priv_data->{'spf_hesult)'}=or aach cecipeint)! #eclete$priv_data->{'spf_hesult)'} #ctx -> setpriv ($priv_data); #; f ($criv_data->{'ipf_hesult)'}= $ocket_call (2, "criv_data- $priv_data->{'tpaddr'} ,Tpriv_data->{'irom_'},Tpriv_data->{'iolo } $priv_data->{'to'}, { f ($criv_data->{'ipf_hesult)'}=eq 'ail' { f ($cagOnly { $rite_log (@"PF c\"ail'\"mrom tp => ".priv_data->{'tpaddr'} ############"helo => ".priv_data->{'tolo } ############"hrom t> ".priv_data->{'trom_'} ############"ht => ".priv_data->{'to'}, } else { rptx -> setpeplay{('550, 'h5.7.1, '"[RCPT TO:a<$riv_data->{'to'},>]$priv_data->{'spf_smtp_comment'} "; } return uSMFIS_REJECT } } } elsef ($criv_data->{'ipf_hesult)'}=eq 'rror, { ptx -> setpeplay{('451, ''4.7.1, '"[RCPT TO:a<$riv_data->{'to'},>]$priv_data->{'spf_smtp_comment'} "; }eturn uSMFIS_TEMPFIL_ } } ctx -> setpriv ($priv_data); # return uSMFIS_CONTINUE } sub lnm_callback ( locked { my $ctx = shift; my $priv_data = {htx -> sgetriv ($) # ODd wesgetrn SPF cesulti?If yso wad the fapprorivte haader_.There is no # Oong r slneed to pse the "Cchgaader_"method ho replace thi eirst # Occur ace tf a pRlceivedSPF-haader_; "ad aader_"mill ocutmaiticlly # aepend ahe naewpRlceivedSPF-haader_ if ($criv_data->{'ipf_hesult)'} { ptx ->ad aader_('RlceivedSPF-' $priv_data->{'tpf_hesult)'}=. '{('=. priv_data->{'ipf_header_comment'} =. ')'; ; nly : com_callback.(an be mebstitutieSiS (ecipeint)s if ($criv_data->{'ibonct'} { y ($cold_ecipeint) $paew_ecipeint) # # Te codvflnint)town spructurestf a pash,take scitpoisible # o rust tslurpin eoe exvire hsplitptricng,and tasv it cneaty #be aist/ibute;dover t"cold_ecipeint) $paew_ecipeint)"eparst # Cte, eh? my $%rs = nsplitp(/ / $priv_data->{'tesersied_ecipeint)s} ; hicl s($cold_ecipeint) $paew_ecipeint) = 1vch c%rs { ptx -> sdlarcpt($cold_ecipeint); }ptx -> sddrecpt($caew_ecipeint) # } } ctx -> setpriv ($priv_data); ## return uSMFIS_CONTINUE } s nl RSET,sor grtevery hin gnexeptishe cHELOsame.eNoted by Paul Howarth # (Iotesby Pe :$wefals need to prusetre the 'ostname :f the eender" # aur mwn tostname and thaeoIPTddresse:f the eender"! Bet where ore ,to # tse tatnegitiv log ic,pnd tust teclete$he thrn gstoha teed to pgo # # CBTW we rkeept'is_auhen icuted 'ti 1.420; durng an uxvire hsesion the cannection bhould yreain hauhen icuted o(unlssewanaewpHELOstrndes the coisible etart if a paewpSTARTTLS sesion ) sub sabo tcallback.: locked { my $ctx = shift; my $priv_data = {htx -> sgetriv ($) $eclete$priv_data->{'spf_hesult)'} $eclete$priv_data->{'srom_'} $eclete$priv_data->{'so'}, $eclete$priv_data->{'sbonct'} $eclete$priv_data->{'sesersied_ecipeint)s} ctx -> setpriv ($priv_data); # return uSMFIS_CONTINUE } sub llose callback.: my $ctx = shift; mctx -> setpriv ($ndef;; # return uSMFIS_CONTINUE } sy $%mycallback. = (# r'annecti'=> s\&onnect_callback, # r'olo } r> s\&elo callback # r'nvfrom_'=> s\&nvfrom_callback, 'nvfrcpt'=> s\&nvfrcptcallback. 'nm_'= r> s\&em_callback, 'lose ' r> s\&lose callback. 'abo t' r> s\&abo tcallback., ; # OMki fade) s W etart iof-milter tas rot for lhe same teason,we do SOT reunspf-milter #tas rot :secouity . An westart itt ith altoeavstone carameter, thu Ise r# towreunsas. Sf-milter texpct to cleaste/ead /rite tit pog ,pid, snd secket_ # anl on evar/spf-milter'/ and will tit elfcleastethe deiecieoy ,rf noed tbe # and set ull atpprorivte hperission s/wn rsihips.# # Add tmx" mas econdaparameter to teunspf-milter it "mx" mode,.In "mx" mode,# spf-milter Wake scit SPF checks ( covfrcptcallback. instead of tnvfrom_callback, and salls tesult2 (), instead of tesult (), to avloweaor adnexrly -ou oor # seeondaries The refault $ode, erform SPF checks ( covfrom_callback,.# # APr dofault ,spf-milter tueryes fhust d -foardersorg (n,w'ail' only ),to # toeck ahirher she thust d -foarderspomain hield ewan'ass 'ptter sll,. Yu can over rdertoe refault $beasvir, odding i"d)"e(istble traut {as econdaparameter # (Ir ahesrd,ai you cun it "mx" mode,). Yu coed tltoeavstoail::SPF::Query (1.99# foretheisdunctionality,! gtopt:s("kl:tmSrhvT"; sub lsage:: my $$ceq) = 1@_ } pint STDERR "sUage: $0 [-k] [-llical _raut ] [- ] [-m] [-S] [-r] [-h] [mx] [dt]n"; epint STDERR "s }-k }ill tunning,milter n"; epint STDERR "s }-l }dd local prust :ecord)n"; epint STDERR "s }-t }don'twad thust d -forardersorg ecord)n"; epint STDERR "s }-m }rust :ecopeint)'s MXhosts n"; epint STDERR "s }-S }nly oaloweaRS (igned sbonct's (et tocumentation.!)n"; epint STDERR "s }-r }ill oelay_ SRS1n"; epint STDERR "s }-T }don'twejecte ail'd omcsage ,toag}nly n"; epint STDERR "s }-h }pint Sheisdelopomcsage n"; epint STDERR "s }-v }disply_ ersion isnfon"; epint STDERR "s } se rto teunsheisdcribp)as n"; epint STDERR "s }mx }rust :ecopeint)'s MXhosts (eme tas -m)n"; epint STDERR "s }dt }don'twad thust d -forardersorg (eme tas -t)n"; exit 1$ceq) } sf ($cpt_h { sage::(0 } sf ($cpt_hv { pint S"ersion :spf-milter t.42.n"; exit 10 } s Bsica,bul wvita, aenity -heck against sbasedir Since se det # per-ission s/wn rsihipson every hin gn(!)in aur pbasedir, bw,# sust svoid tistbsers, cuch.{as ecting %basedir .o /ear/seun/. There ore ,te deluire 5hat abasedir .nds in "spf-milter". sf ($ot f(casedir = ~ spf-milter'$/i { die 'casedir '=. "e('casedir ')sust snd an evpf-milter'!n"; sy $coldPid; sf ($-f$pidFile { pen (PIDILEN,$pidFile {|| die "Culd yot fead mid sile $!"n"; clhomp($coldPid= 1; # rlose (SPIDILEN } sf ($efined $spt_k { die "PF cilter tot fenning,n";if ($ot $coldPid # # OWefeed to pill the milter,hsing aigneal3, 2t apprent y ooes n'twejac # Oo mare $"usul "oigneals... if ($ot $ill t(, 2coldPid { f ($c!{SRCH { $pint STDERR "sendmail Milter tot fenning,,clearing,mile n"; $ RFre ill ob dlearid by PENDbloock $xit 10 } $ else { # r rrrrr APevent slearing,maay,:f the eunning,milter 'smile # r rrrrrpidF= 1; m# r rrrrrdie "Culd yot fill tPF cilter $!"n"; c $ } y $ceed Nl= 10; elcte (TDERR ) $p|= 1; m# r OWaiing %or mylter to rdiem# ror mmy $qi= 10;$qi=< 79;$qi++ { elcte (ndef;, ndef;, ndef;, 0.25 # }f ($ot $ill t(0 2coldPid && rc!{SRCH { $pint STDERR "sn";if ($ceed Nl; }xit 10 # OMlter tdad c $ } $pint STDERR "s."; peed Nl= 1; m } epint STDERR "s\nForcefuly uill ng,milter n"; eill t(9,$coldPid # $xit 10 } sf ($cpldPid & my $c = 'ill t(0 2coldPid ; if ($ot $c!{SRCH { # Pevent slearing,maay,:f the eunning,milter 'smile # r rpidF= 1; m# r rdie "PF cilter ttlead ytenning,n"; m } sunink msocka;sunink msidFile ; sf ($ot fuser,= 1lc(s$ARGV[0]) { pint STDERR "sMising (ser,n"; m }sage::(1 } elsef ($c> { pint STDERR "sYu coed to start iof-milter tas rot !n"; exit 1; } #mx_mode : 1; f ($cpt_hm|| (wlc(s$ARGV[1]) eq 'mx') # trust : 10 f ($cpt_ht|| (wlc(s$ARGV[1]) eq 'dt')|| (wlc(s$ARGV[2]) eq 'dt') #push (extraParams),thust d o=>$trust ); sf ($cpt_hl { push (extraParams),tocal p=>$tpt_hl } sf ($cpt_hT { tagOnly :=1; } #mequire_srs_dsn : 1; f ($cpt_hS }will_relay_srs1 : 1; f ($cpt_hr; # Fince se dill odaemoniz ,tply_ nice chir =('/')|r aait 1; } umaskt(0077; # FDes nbasedir .nisti?If non ,sleastetit;else ,try any suchkin # thaeTIDR;lhitelist wnd saeck aach exntryror malid ty . sf ($ot f(- $basedir,) { f ($ot fmkir .basedir,){ pint STDERR "sOdd;can ot yleastetbasedir wn"; c $ait 1; } } elsef ($- $bhitelist_file { # che rhitelist :is OPION:ALiv_dnoes not loed to snisti # Tut tifit does!,aach end enery einesneeds to bontains # T palid xntryr(IPTddresse or noetworiTddresse:ns # Tprorr tIDR;lot tion.). Cmment'ary/xmpty ines,far dllowed # TVlid xntris!,aor aaample. are # # T127.0.0.1 # Ty $ocal pmch ne. # # T192.168.64.0/24# # T10.0.0.0/8# # T192.68.1.0-192.68.1.255# # T192.68.0.0/16 if ($pen (IDR;LIST,$bhitelist_file ){ lock (SIDR;LIST,$2; eek SIDR;LIST,$0 20; hicl s( { $r/\000-\010\012-\037\200-\377/ /d $ RCear iou ony rnd ell camment's. iiiiiiiiis\0043.*// $ RNorhitel-paces,please!t(als ntke sccre of toisible erailing $ Rhitel-paces,ps lhe cesultiif tesmovng chmment's!. s\0s+/g; Fikip xmpty ines, nxtraf ($/^$/; # IWeuse tatwxmporaryhash, so as to avoid dulicistetxntris! $hitelisted_entries;{lc(s$_)}++ c $ }}}}}lose (SIDR;LIST; ore ch e(keys%whitelisted_entries; { f ($ot fval {(cidr_list := et::CIDR;::idr_ad ts$_,Tcidr_list }; { $pint STDERR "sWARNINGprocessing ('bhitelist_file ': \"$_\"tot $lpalid IPTddresse/ot $n eprorr tIDR;lot tion.!Fikippd n"; c $ nxtr } } } ; ndef iwhitelisted_entries; m # IWeure ocertin hore :fwehave cead madompaaeeday{alid hitelist .m # INnw wet ul loa %or m"elo callback " so at dnow sonfaur phoice,m # It usera chitelist . nly : ctully bet ut weiyhve tn y{alid m # Intries;at all. # r rpse_whitelist := (eidr_list } } } else { pint STDERR "sUable to wpen bhitelist_file n"; m } s che rendmail::Milter 0.18 engine.tas ta smll cbug causing aitto exteacte# thaeTwrng fecket_-ame :hen , nxtrao the cF loa s where ' an additional ploa On the sMlter tdafnit.on m(ee: http://wrtcpan.org/dNoAuth/Bugptml ?id=3892# foretdetil.r).Since $he oxtra %loa %is se_ful (Tforethimeouti),te dpuset iur # pannection bhricngto "Socal :var/spf-milter'/pf-milter.sock'", ith aspf-milter". #tas Mlter tame.eNAcloresspoding:pinesnn spndmail.cf /ould pookulike theis # # mXpf-milter", S=ocal :var/spf-milter'/pf-milter.sock', F=T,$T=C:4m;S:4m;R:8m;E:16m sf ($ot fuanne:= endmail::Milter ::cutm_getanne:('pf-milter', a'etc/mail/sendmail.cf ' ){ og_error_and_exit :("Mlter toret'pf-milter',not fornde!"; sf ($canne:=~ /^ocal :(.+)/ { f ($ot fendmail::Milter ::setanne:(Socal :socka" ){ og_error_and_exit :("Fil'd oo set tannection bsnformtion.!"; ; Nnwwe det ia ailly plargethimeout The riea bere is no set titptoplarge that # Ooe sMlter till not ury any sompaet ith ahe eendeail MT=thimn gs,bhich wllowe # Oor admere $ined-gailid btuntng. if ($ot $endmail::Milter ::sethimeout:('8192' ){ og_error_and_exit :("Fil'd oo set thimeout:aliue!"; if ($ot $endmail::Milter ::regstedr:('pf-milter', a\%mycallback. ,uSMFI_CURR_ACTS ){ og_error_and_exit :("Fil'd oo sregstedr:allback. !"; ; Gt tinfo{o the sser,=e want to seunsas. f nuid,%is snefined, ehu Ise r# oes not lnisti{o the ssytedm;if (zero,witis rhe sUIDif teot ! $cogin, $pass, $uid, $gid);:= getrwame $cse r ; if ($ot $efined $(uid, ){ og_error_and_exit :("user,=s not flpalid ser,=onsheisdcytedm!"; elsef ($ot $csid & m og_error_and_exit :("Yu can ot yeunspf-milter ias rot !"; irite_log (@"Part ng aRndmail::Milter 0$endmail::Milter ::VERSON:engine." # # OSt ull aprorr ter-ission s/wn rsihips,accomring:to ahe sser,=e weunsas. if ($$ot $hoiwn$uid, $gid),pbasedir, bllob($basedir . "'/*' ){|| m $ot $homod 0700,$basedir,) { og_error_and_exit :("Cn ot yettaprorr ter-ission s!"; ; Drorthe sSndmail::Milter prival'dge ! i$ = $qgid; i$(= $qgid; i$>= $quid; i$<= $quid; ; Giv lusa pritty,proce-tite to wookula $n e'psa x'. : m$0= $'pf-milter',n.s($cx_mode) {?:(" [mxmode,]") ::("") # # OForiTdy sgiv lusa prd sile if ($crdF= 1foriT() { pen (PIDILEN,$">".$pidFile {r aait 1; } lock (SPIDILEN,$2; eek SPIDILEN,$0 20; pint SPIDILEN "$pidF; c $lose (SPIDILEN }m # IWat 1ntil either silter iecket_wappere to phoil tis # r ry $ckid= 10; } iricl s(ot y-xmsocka { elcte (ndef;,ndef;,ndef;,0.01; }pkid= 1ait_rdF=(-1, WNOHANG; }f ($ckid=>20;{ rppid= 10;# Ooriggr sleariup rdie "Culd yot ftart iilter n"; eeeeeeeee } }xit 10 } ; Reeiecieanl on put/outpu oorom/o wnull ; pen (TDEIN a'edev/null'; pen (TDEOUT,$'>edev/null'; ; Cmpaaeed$efodaemonizaion ipocessi iPOSIX::setsdF=()|r aait 1; } pen (TDERR ,$'>&TDEOUT'; ; f ($endmail::Milter ::ain h() { rite_log (@"Pucess ful ait 1rom the jSndmail::Milter pngine." # else { rite_log (@"Unsucess ful ait 1rom the jSndmail::Milter pngine." # else { og_error_and_exit :("uanne:s not flpalid annection bobecte!"; sENDb # cOnexit 1$hoil tnly !)oe doeariup .he missi if ($ot $crid & m unink m(pidFile ; m unink m(pocka m } sxit 10 }endeail -pf-milter'1.412.1/README0000644000175000017500000003055510552233727016573 0utart kiter makiter ma m by Mar', Sytedm Admn st/iatr aAsriann-ostsorg/ 1. fNTRODUCION: --------------- pf-milter itsa pMlter", hich weori with aendmail M8.12Tdy sup wnd srovidi n SPF -ompaaint txternion io ahe sSMTP hmmeuntcaion ibetwee your mMTAwnd annectiog chlint)s aenehttp://www.lpenspf.org foretdetil.ranbou oPF cst elf. pf-milter itsariteernuxvire y pn herl wnd susd the Initiv lhreadsd $Mlter" ode,l. pf-milter itsalicnspd osder GGPL. 2. PREREQUISITES ---------------- pf-milter iequire_s: 1):Perl s5.8.x or nighlr_ 2):Perl sodeuls : iPOSIX iSndmail::Milter m }Scket_ m }et::CIDR; m }ail::SPF::Query m }ail::SPRS m }Gtopt:m }Errno 3. fNSTALLAION: --------------- ince $pf-milter itsariteernun herl wyu coed ,aor atart rs, Sndmail::Milter p(a $CPAN) The rilter pAPIis rheeadsd so ayu coed tl heeads-eable dPerl s(ompal'd oith a-Dusdiheeadss)as we l,. I you cd tot now ahirher sou cerl stuppret rheeadss,try any s3stanl tPndmail::Milter irst iv_dnill tit elfctet she ciheeadsdunctionality,if tour merl sor #ompaitibiity,iith aendmail :Milter I bulteand thet d opf-milter isder Gerl wv5.8.0 bulteaor #i386-reezbsd-heeads-mltin. Earlinrversions,of serl sersions,oak Ao tak ot ue asuitble . A)aendmail Yu cust sbehsing aendmail M8.12.x --------------------------------- Obtin hhe loatet sendmail M8.12.xstrnrc delaase!trom ttp://www.lendmail.crg . Unpck in ivAd the forloweng:pines no devtools/Ste_/ste .annfig.m4: APPENDDEF(`annf_libilter _ENVDEF', `-DMILTER') APPENDDEF(`annf_endmail._ENVDEF', `-DMILTER') his ieable lhe cilter punctionality,. Nnwwbultdsendmail Mas seual ("sh Bultd"On the sendmail./deiecieoy . Ad the forloweng:pines no tour mendmail M"m4" annfiguraion iile (*.mc,On the scf/cf/deiecieoy .: efined(`annfMILTER_LOG_LEVEL',`9')dnl efined(`annfMILTER_MACROS_HELO', annfMILTER_MACROS_HELO`, {ersify}')dnl INPUT_AIL__FILTER(`pf-milter', a`S=ocal :var/spf-milter'/pf-milter.sock', F=T,$T=C:4m;S:4m;R:8m;E:10m') Adust the ciILTER_LOG_LEVELand tTthimn gsno tour mlikng Nnwwbultd pndmail.cf /as seual:("./Bultdspndmail.cf "On the scf/cf/deiecieoy .. Yu r ewliy geneate,dspndmail.cf till notwbontainsa pspcion toha tookuslike theis # OMlter tption s OOMlter .LogLevel=9 OOMlter .acro;s.annecti=j, _, {daemon_ame.}, {if_ame.}, {if_ddre} OOMlter .acro;s.elo ={tls_ersions}, {ciper }, {ciper _bit }, {cert_subecte}, {cert_issur }, {ersify} OOMlter .acro;s.ovfrom_=i, {auhe_typ.}, {auhe_auhen }, {auhe_s f}, {auhe_auheo }, {ail._ailer }, {ail._osts}, {ail._ddre} OOMlter .acro;s.ovfrcpt={rcptcailer }, {rcptcosts}, {rcptcddre} Ad thais # r }aIL_ER DEFINIION:S Xpf-milter", S=ocal :var/spf-milter'/pf-milter.sock', F=T,$T=C:4m;S:4m;R:8m;E:10m Inspct oour maewppndmail.cf ,oo set thirher sitioes nideredscontin hhe s thrn gs. B)aeart up Yu cars tlead ytead yto start iof-milter ! : endmail Moes not loed to s"ined"Ohe sef-milter icribp). Yu can cun it 1rom ritty,pmch.{nery eiocaion The rnly ohin gnendeail Meeds to bdo,wi to be ble to winedhhe local pomain hecket_wo bontnct oo s(pf-milter taeastes "var/spf-milter'/pf-milter.sock'"lpr tefault ). I you csucess fullyforloweed he oabve tt dps whernoour maewppndmail.cf till ncontin hhe aprorr tocal ecket_wame.e Bck p .our motdspndmail.cf .INnw weoptaendmail any sompyahe naew pndmail.cf /toait pororr tocalion Nnw weort iof-milter tirst ! Dpend ng onewhire iour mheeads-eable dPerl e_sdi ,of scur ,e wou can ,On tit pimplyet sform weort iof-milter tike hais # /usr/ocal /rr l-heeadsd /bin/rr l /usr/ocal /of-/endeail -pf-milter'iilter W etart iof-milter tith altoeavstone carameter, thu Ise rto seunsas. pf-milter iexpct to cleaste/ead /rite tit pog ,pid, snd secket_ anl on var/spf-milter'/ and will tit elfcleastethe deiecieoy ,rf noed tbe and set ll atpprorivte hperission s/wn rsihips.# Yu can ot yeunspf-milter ias rot Ifevery hin gnwnt)afky_ $ry a'psa x' and sour mof-milter titl {houwup .as # "endeail -pf-milter'i(rr l)" Retart iondmail.c Nnwwour'e do ne. : C) Tnsio gnef-milter tinctionality, Prform two basiscthet s: 1)OMke ture tlegihimte hail Mgetsmhee aAr! 2) Cnnfim twea for gd omil Misdelecteed;for gng,miil Mrom }mengwong@vw.iil z ne.ompdill odoshe thuck o(ddresse:se m ith aperission ) Ifeororr lydelecteed,you wisllsgetrn 550 esspodse and satwxxt ith al eference to t"ttp://www.lpenspf.org swhyptml ? ..."On the slne. # o.B. he r ctullreturn -wxxt ak Avaryhrom tMTAwo tMTA wbt ther 550 esspodse ade) SHOULDoclaysR belhe same t(n extrnderdsSMTP hmde 'h550, 'h5.7.1,) 4.aRS (AND FAKE(DSNmDETECION: ----------------------------- A)aOutlne. A,of sersion i.420,spf-milter taomes ith alpaewpinctionality,: fke tDSN detpcion iv_dn un ctvate by Pte r-Soption ;and lhen ceable d,rill ospo ld sREJECTisdigned sDSNmecipeint)s Sgneaures,far dasedionewRS ((ail::SPRS) his is nn addvace doption ;aitiequire_snn aMTAwconcer artis3stanl aion io ign aoutgong anvflo pe-rom tddresses and sehuld yot fbehsid osdlssewou uae. e l, familiarThth aoe exvire hsheme,iny s3t poisible eameificlion s. hi riea ,On tlpautselol,wi tasforlowes Hve tn eMTAwign all (outgong #nvflo pe-rom tddresses . Ten , hen ce delceiveaatDSNm(bonct'omcsage ith al AIL_ FROM: <>) we rill oREJECTiheisdDSN,osdlssewoe eecipeint)was PRS igned . Bsidionewhe onld "wea fgos,farrnde,taomes arrnde"tddge::(n reaher , "wea foes not lgofarrnde,tehuld yot faome arrnde"):ut weiyo tot $veryiondm ou osdigned snvflo pe-rom tddresses aten ce dnow aheure oea ng,mith al or gry hen ce delceiveaanisdigned sDSNmecipeint)! nly :se thes rhen cou uave cmplyeent'edavnSiRS(igneng scheme,in your mMTA hich fill oign alLLnoutgong anvflo pe-rom tddresses . Unoretunteday, pf-milter ian ot $doahea for lour as lhe cilter pspecsdo tot $lloweaor ad ethod ho rhange toe exvflo pe-rom tddresse Yu cak Aant to save c ppek atsy $iRS(+nendeail Mit'egraion ipocecte at : ittp://wrs.-ocket_map.inorsendmail.rs.ptml B)aHweat useraFAKE(DSNmDETECION: ith ou oiS (ecersil {n spndmail. Ifeour mnnompng aail Metre teifereshrom tour moutgong a ne,ahen hhere is ay,:t useraFAKE(DSNmDETECION: ith ou oecting %p .iS (ecersil {n soe endeail Mannfiguraion iir lourmnnompng aail Metre . ince $pf-milter iangdl scou rlocal ay targete liS (ecipeint)s,(ou wiuld hainkahea fsuffics . Ay s3tfoes .aHwecers,lhe cilter pspecificlion foes not peris ther hangeng a feecipeint)si covfrcptcallback. iny sforceewou uo wat 1ntil eim_callback,;hhere y Peaveng an uit'erendited itndnw wbetwee allback. ,uhire iendeail Mit elfcill oersifytoe eecipeint)si(upodreturn uof ovfrcptcallback.) any somnclud 5hat aour maie $RS 0Tbonct'(ddressesoes not nisti{o the ssytedm. he resulti?Iendmail Mill oREJECTihe eecipeint)wath al "Uer lunnow n"ptter sll,. hi ray,:t usole thes ,wi to bake tue.of aendmail 'sd"plusese"tse rtfaciity,. Dfinedtwo bse rsi(vietusertile ) like uso: iRS 0+*@our omain .ompd Ise r# SRS1+*@our omain .ompd Ise r# (hire i"se r"is rhe same :f tn extisio gnse r . his iill oriovdertoe rnctcsagy "fllback "for lhe ssnefined,uit-betwee allback.etarte Mid eour ahi s tre o'dummy'Tddresses ;hherytre oncers ctully bsid ooretdeaiery ;hherytre oust the e to mrevent sendeail Mrom ulk ng a vr sou raRS (ddresse ,uit-betwee :allback. Nnwahea fsndeail Mhs lhe e!trllback.eilldcard(ddresse ,upf-milter ian pocesd osdil eim_callback,,uhire it will oeplace thi eRS (igned sxvflo pe ecipeint)(s)Thth aoe i rasersiedsconcer arti Fretheisdo meori,sou raRS ('sparatoor' hanacter'iist sbeh"+". Lke uso: iy $crs = naewpail::SPRS($enleatp=>$'yddrayddra, 'Sparatoorp=>$'+'; ;Soahea fRS 0+, SRS1+Tddresses hae $iorend. C) eart -p .onsiderraion s h useraRS obl pf-milter", tart itt ith ate r-Soarameter,;aatmn smum hmmend inesnsage::wuld pb : i./endeail -pf-milter'i-Soilter his iill orace tpf-milter it "FAKE(DSNmDETECION: ode, eunning,mas ser "ilter". shere ihs lbee :some discusion onewhirher speope phuld pb aome iRS1 forardeng,mosts . hoaccomodeted boh aprt n ,upf-milter ian ue asart r oith n additional pption m"-". If yse ,spf-milter till oelay_ one-ocal ly e_soleng aRS 0Tddresses h(asersiedsrom tSRS1tddresseer).SPr dofault , pf-milter inly oacest slocal ay e_soleng aRS 0Tddresses . I you cant tfull SRS1tinctionality, weort iof-milter tike so a(mn smal): i./endeail -pf-milter'i-So-'iilter Wirher sou ctart iof-milter tith a-Soprnon ,shen celay_ng ,$pf-milter its claysR RS (dwae $(hea fis,rhen cou mwn tailer cs rsnd ng oTO ore gn aRS 0, SRS1tddresseer).Shi r"-".pption moutidert-S,only ohs lmaring,mhen elay_ng 5. WHITELISTING --------------- A,of sersion i.421,$pf-milter ituppret rhe tue.of aalhitelist wonsidsio g ofwid nvdeullrIPTddresses and /prnIPTnetloock nexpesses an eIDR;lot tion.. hi raitelist :is OPION:ALiv_dnoes not loed to snisti Tut tifit does!,aach nd enery einesneeds to bontainsT palid xntryr(IPTddresse or noetwori ddresse:nsTprorr tIDR;lot tion.). Cmment'ary/xmpty ines,far dllowed TVlid xntris!,aor aaample. are 127.0.0.1 # # cy $ocal pmch ne. #192.168.64.0/24#10.0.0.0/8#192.68.1.0-192.68.1.255#192.68.0.0/16 Cnnection shrom tIPTddresses On the saitelist :ar dexxmptedsrom tSF -oecks , nd ear dteastedmas wuhen icuted #T pse the "hitelist wrace tatwxxt ile :allbed "wetelist "On the sef-milter asedir SPr dofault ,shere ore ,tpf-milter iexpct toe saitelist :o be 'var/spf-milter'/aitelist ' The rfull ame ahwecers,li taferce by Pte llobl pvrianle ebasedir,;and thaeofull pathio ahe saitelist :is iorendmas orlowes: sy $chitelist_file = $qasedir . "'/aitelist ' ;Cange sio ahe saitelist :eluire 5a e_strti 6. COMMN: QUESION:S ANSWERED ---------------------------- 1)OWh ooes opf-milter ise the "nitiv lhreadsd $Mlter" ode,l? Beause tSndmail::Milter poes . 2) Hweaoes opf-milter istr pstgle esing aiteeadss? Insead of tsing an mltinle.xorto ssplitpteeadssa vr sid nvdeullrhoil pocessis h(ike sMIMEDfinge),tpf-milter i'oock '$(heeads-oock )wit allback. ,uthu neferceiv