amavisd-new-qmqpqq.patch   [plain text]


--- amavisd.ori	Mon Nov 20 18:32:15 2006
+++ amavisd	Mon Nov 20 18:34:15 2006
@@ -96,4 +96,5 @@
 #  Amavis::In::SMTP
 #( Amavis::In::Courier )
+#  Amavis::In::QMQPqq
 #  Amavis::Out::SMTP
 #  Amavis::Out::Pipe
@@ -2635,4 +2636,5 @@
       : sprintf(" (%s [%s])", c('myhostname'), $conn->socket_ip) ),
     ($conn->socket_port eq '' ? 'unix socket' : "port ".$conn->socket_port) );
+  # must not use proto name QMQPqq in 'with'
   $s .= "\n with $smtp_proto"  if $smtp_proto=~/^(ES|S|L)MTPS?A?\z/i; # rfc3848
   $s .= "\n id $id"  if $id ne '';
@@ -6753,4 +6755,5 @@
   $extra_code_sql_lookup $extra_code_ldap
   $extra_code_in_amcl $extra_code_in_smtp $extra_code_in_courier
+  $extra_code_in_qmqpqq
   $extra_code_out_smtp $extra_code_out_pipe
   $extra_code_out_bsmtp $extra_code_out_local $extra_code_p0f
@@ -6776,4 +6779,5 @@
 # Amavis::In::AMCL, Amavis::In::SMTP and In::Courier objects
 use vars qw($amcl_in_obj $smtp_in_obj $courier_in_obj);
+use vars qw($qmqpqq_in_obj);            # Amavis::In::QMQPqq object
 use vars qw($sql_dataset_conn_lookups); # Amavis::Out::SQL::Connection object
 use vars qw($sql_dataset_conn_storage); # Amavis::Out::SQL::Connection object
@@ -7213,4 +7217,5 @@
   do_log(0,"SMTP-in proto code  %s loaded", $extra_code_in_smtp    ?'':" NOT");
   do_log(0,"Courier proto code  %s loaded", $extra_code_in_courier ?'':" NOT");
+  do_log(0,"QMQPqq-in proto code %s loaded", $extra_code_in_qmqpqq ?'':" NOT");
   do_log(0,"SMTP-out proto code %s loaded", $extra_code_out_smtp   ?'':" NOT");
   do_log(0,"Pipe-out proto code %s loaded", $extra_code_out_pipe   ?'':" NOT");
@@ -7646,4 +7651,10 @@
         $amcl_in_obj = Amavis::In::AMCL->new  if !$amcl_in_obj;
         $amcl_in_obj->process_policy_request($sock, $conn, \&check_mail, 0);
+      } elsif ($suggested_protocol eq 'QMQPqq') {
+        if (!$extra_code_in_qmqpqq) {
+          die "incoming TCP connection, but dynamic QMQPqq code not loaded";
+        }
+        $qmqpqq_in_obj = Amavis::In::QMQPqq->new if !$qmqpqq_in_obj;
+        $qmqpqq_in_obj->process_qmqpqq_request($sock,$conn,\&check_mail);
       } else {  # defaults to SMTP or LMTP
         if (!$extra_code_in_smtp) {
@@ -7733,4 +7744,5 @@
   do_log(5,"child_finish_hook: invoking DESTROY methods");
   undef $smtp_in_obj; undef $amcl_in_obj; undef $courier_in_obj;
+  undef $qmqpqq_in_obj;
   undef $sql_storage; undef $sql_wblist; undef $sql_policy; undef $ldap_policy;
   undef $sql_dataset_conn_lookups; undef $sql_dataset_conn_storage;
@@ -7743,4 +7755,5 @@
 # do_log(5,"at the END handler: invoking DESTROY methods");
   undef $smtp_in_obj; undef $amcl_in_obj; undef $courier_in_obj;
+  undef $qmqpqq_in_obj;
   undef $sql_storage; undef $sql_wblist; undef $sql_policy; undef $ldap_policy;
   undef $sql_dataset_conn_lookups; undef $sql_dataset_conn_storage;
@@ -9745,4 +9758,5 @@
     $extra_code_sql_lookup, $extra_code_ldap,
     $extra_code_in_amcl, $extra_code_in_smtp, $extra_code_in_courier,
+    $extra_code_in_qmqpqq,
     $extra_code_out_smtp, $extra_code_out_pipe,
     $extra_code_out_bsmtp, $extra_code_out_local, $extra_code_p0f,
@@ -9979,5 +9993,10 @@
     undef $extra_code_in_courier;
   }
-  if ($needed_protocols_in{'QMQPqq'})  { die "In::QMQPqq code not available" }
+  if ($needed_protocols_in{'QMQPqq'}) {
+    eval $extra_code_in_qmqpqq or die "Problem in the In::QMQPqq code: $@";
+    $extra_code_in_qmqpqq = 1;  # release memory occupied by the source code
+  } else {
+    $extra_code_in_qmqpqq = undef;
+  }
 }
 
@@ -12866,4 +12885,270 @@
 
 BEGIN { die "Code not available for module Amavis::In::Courier" }
+
+1;
+
+__DATA__
+#
+package Amavis::In::QMQPqq;
+use strict;
+# use re 'taint';   # (is this module ready for this yet?)
+
+BEGIN {
+    use Exporter ();
+    use vars qw(@ISA @EXPORT @EXPORT_OK %EXPORT_TAGS $VERSION);
+    $VERSION = '1.18';
+    @ISA = qw(Exporter);
+}
+use POSIX qw(strftime);
+use Errno qw(ENOENT);
+
+BEGIN {
+    import Amavis::Conf qw(:platform :confvars :dynamic_confvars c cr ca);
+    import Amavis::Util qw(ll do_log am_id new_am_id prolong_timer
+                           debug_oneshot sanitize_str rmdir_recursively);
+    import Amavis::Lookup qw(lookup);
+    import Amavis::Timing qw(section_time);
+    import Amavis::rfc2821_2822_Tools;
+    import Amavis::TempDir;
+    import Amavis::In::Message;
+    import Amavis::In::Connection;
+}
+
+sub new($) {
+    my($class) = @_;
+    my($self) = bless {}, $class;
+    $self->{bytesleft} = undef;		# bytes left for whole package
+    $self->{len} = undef;		# set by getlen() method
+    $self->{sock} = undef;		# connected socket
+    $self->{proto} = undef;		# protocol
+    $self->{tempdir} = Amavis::TempDir->new;	# TempDir object
+    $self->{session_closed_normally} = undef; # closed properly? (waited for K/Z/D)
+    $self;
+}
+
+sub DESTROY {
+  my($self) = shift;
+  eval { do_log(5,"Amavis::In::QMQPqq DESTROY called, sock=%s, normal=%s",
+                  $self->{sock}, $self->{session_closed_normally}) };
+  eval {
+    if (ref($self->{sock}) && ! $self->{session_closed_normally}) {
+      $self->qmqpqq_resp("Z","Service shutting down, closing channel");
+    }
+  };
+  if ($@ ne '')
+    { my($eval_stat) = $@; eval { do_log(1,"QMQPqq shutdown: %s",$eval_stat) } }
+}
+
+# get byte, die if no bytes left
+sub getbyte($) {
+my($self) = shift;
+if(!$self->{bytesleft}--) {
+	die("No bytes left");
+	}
+if(defined($_ = $self->{sock}->getc)) {
+	return($_);
+	}
+die("EOF on socket");
+}
+
+sub getlen($) {
+my($self) = shift;
+my($ch,$len);
+
+for(;;) {
+	$ch = $self->getbyte;
+	if($ch eq ':') {
+		return($self->{len} = $len);
+		}
+	if($ch !~ /^\d$/) {
+		die("Char '$ch' is not a number while determining length");
+		}
+	$len .= $ch;
+	}
+}
+
+sub getcomma($) {
+my($self) = shift;
+if($self->getbyte ne ',') {
+	die("Comma expected, found '$_'");
+	}
+}
+
+sub getnetstring($$) {
+my($self) = shift;
+($self->{sock}->read($_[0],$self->getlen) == $self->{len}) ||
+	die("EOF on socket");
+$self->{bytesleft} -= $self->{len};
+$self->getcomma;
+}
+
+# Accept a QMQPqq connect
+# and call content checking for the message received
+#
+sub process_qmqpqq_request($$$$) {
+my($self,$sock,$conn,$check_mail) = @_;
+# $sock:       connected socket from Net::Server
+# $conn:       information about client connection
+# $check_mail: subroutine ref to be called with file handle
+
+$self->{proto} = "QMQPqq";
+$self->{session_closed_normally} = 0;	# closed properly?
+$self->{sock} = $sock;		# store $sock info for getbyte() method
+$self->{bytesleft} = 20;	# initial bytesleft value, there should
+				# NEVER EVER be longer email than 10^20 (approximately)
+				# bytes but increase if needed ;)
+$self->{len} = undef;
+
+my($msginfo);
+my($sender,@recips);
+my($len);
+
+new_am_id(undef, $Amavis::child_invocation_count, undef);
+Amavis::Timing::init();
+
+$conn->smtp_proto("QMQPqq");  # the name of the method is too specific
+eval {
+	# get length of whole package
+	$self->{bytesleft} = $self->getlen;
+
+	# get length of 'email'
+	$len = $self->getlen;
+	section_time('initial length determination');
+
+	# prepare tempdir
+	Amavis::check_mail_begin_task();
+	$self->{tempdir}->prepare;
+	$self->{tempdir}->prepare_file;
+
+	$msginfo = Amavis::In::Message->new;
+	$msginfo->rx_time(time);
+	$msginfo->delivery_method(c('forward_method'));
+
+	# get 'email'
+	$self->{tempdir}->empty(0);
+	my $size = 16384;
+	while(($len > 0) && ($sock->read($_,($len >= $size ? $size : $size = $len)) == $size)) {
+		(print {$self->{tempdir}->fh} $_) ||
+			die("Can't write to mail file: $!");
+		$len -= $size;
+		}
+	if($len > 0) {
+		die("EOF on socket");
+		}
+	$self->{tempdir}->fh->flush || die("Can't flush mail file: $!");
+	$self->{tempdir}->fh->seek(0,1) || die("Can't seek on file: $!");
+	$self->{bytesleft} -= $self->{len};
+	section_time('email receiving');
+	# comma has to follow
+	$self->getcomma;
+
+	# get sender
+	$self->getnetstring($sender);
+	section_time('sender receiving');
+
+	# get recips
+	my $i = 0;
+	while($self->{bytesleft}) {
+		$self->getnetstring($recips[$i++]);
+		}
+	section_time('recips receiving');
+
+	# final comma has to follow
+	$self->{bytesleft} = 1;
+	$self->getcomma;
+		
+	$msginfo->sender($sender);
+	$msginfo->recips(\@recips);
+		
+	do_log(1, sprintf("%s:%s:%s %s: <%s> -> %s Received: %s",
+		$self->{proto},$conn->socket_ip eq $inet_socket_bind ?
+			'' : '['.$conn->socket_ip.']',
+		$conn->socket_port, $self->{tempdir_pers},
+		$sender, join(',', map{"<$_>"}@recips),
+		join(' ',
+			($msginfo->msg_size  eq '' ? ()
+			: 'SIZE='.$msginfo->msg_size),
+			($msginfo->body_type eq '' ? ()
+			: 'BODY='.$msginfo->body_type),
+			received_line($conn,$msginfo,am_id(),0) )
+		));
+
+	$msginfo->mail_tempdir($self->{tempdir}->path);
+	$msginfo->mail_text_fn($self->{tempdir}->path . '/email.txt');
+	$msginfo->mail_text($self->{tempdir}->fh);
+
+	my($smtp_resp,$exit_code,$preserve_evidence) =
+		&$check_mail($conn,$msginfo,0);
+
+	if ($preserve_evidence) { $self->{tempdir}->preserve(1) }
+
+	if ($smtp_resp !~ /^4/ &&
+		grep { !$_->recip_done } @{$msginfo->per_recip_data}) {
+		die("TROUBLE/MISCONFIG: not all recipients done, ".
+			"\$forward_method is \"$forward_method\"");
+		}
+
+	if ($smtp_resp !~ /^4/ &&
+		grep { !$_->recip_done } @{$msginfo->per_recip_data}) {
+		if ($msginfo->delivery_method eq '') {
+			do_log(2,"not all recipients done, forward_method is empty");
+			}
+		else {
+			die "TROUBLE: (MISCONFIG) not all recipients done, " .
+			"forward_method is: " . $msginfo->delivery_method;
+			}
+		}
+
+	# all ok
+	if($smtp_resp =~ /^2/) {
+		$self->qmqpqq_resp("K",$smtp_resp);
+		}
+	# permanent reject
+	elsif($smtp_resp =~ /^5/) {
+		$self->qmqpqq_resp("D",$smtp_resp);
+		}
+	# temporary reject (or other error if !~ /^4/)
+	else {
+		$self->qmqpqq_resp("Z",$smtp_resp);
+		}
+	};
+
+$self->{tempdir}->clean;
+alarm(0); do_log(4,"timer stopped after QMQPqq eval");
+
+if($@ ne '') {
+	chomp($@);
+
+	do_log(0,"QMQPqq: NOTICE: $@");
+	$self->qmqpqq_resp("Z","Service shutting down, $@");
+	}
+# report elapsed times by section for each transaction
+do_log(2, "%s", Amavis::Timing::report());
+
+$self->{session_closed_normally} = 1;
+# closes connection after child_finish_hook
+}
+
+# sends a QMQPqq response consisting of K/D/Z code and an optional message;
+# slow down evil clients by delaying response on permanent errors
+sub qmqpqq_resp($$$;$$) {
+my($self,$code,$resp,$penalize,$line) = @_;
+if($code !~ /^(K|Z|D)$/) {
+	die("Internal error(2): bad QMQPqq response code: '$code'");
+	}
+if($penalize) {
+	do_log(0,"QMQPqq: $resp; PENALIZE: $line");
+	sleep 5;
+	section_time('QMQPqq penalty wait');
+	}
+$resp = sanitize_str($resp,1);
+do_log(4,"QMQPqq> $resp");
+$self->{sock}->print($self->netstring($code . $resp));
+}
+
+sub netstring($$) {
+my($self,$string) = @_;
+return(sprintf("%d:%s,",length($string),$string));
+}
 
 1;
--- amavisd.conf.ori	Mon Nov 20 18:32:25 2006
+++ amavisd.conf	Mon Nov 20 18:34:15 2006
@@ -49,5 +49,6 @@
 $enable_global_cache = 1;    # enable use of libdb-based cache if $enable_db=1
 
-$inet_socket_port = 10024;   # listen on this local TCP port(s) (see $protocol)
+$protocol = 'QMQPqq';        # suggested protocol to use on all input sockets
+$inet_socket_port = 10628;   # accept connections on this local TCP port(s)
 $unix_socketname = "$MYHOME/amavisd.sock";  # amavisd-release or amavis-milter
                 # option(s) -p overrides $inet_socket_port and $unix_socketname
--- amavisd.conf-sample.ori	Mon Nov 20 18:32:38 2006
+++ amavisd.conf-sample	Mon Nov 20 18:34:15 2006
@@ -225,8 +225,11 @@
 # SMTP SERVER (INPUT) PROTOCOL SETTINGS (e.g. with Postfix, Exim v4, ...)
 #   (used when MTA is configured to pass mail to amavisd via SMTP or LMTP)
-$inet_socket_port = 10024;        # accept SMTP on this local TCP port
+#$inet_socket_port = 10024;       # accept connection on this local TCP port
                                   # (default is undef, i.e. disabled)
 # multiple ports may be provided: $inet_socket_port = [10024, 10026, 10028];
 
+$protocol = 'QMQPqq';        # suggested protocol to use on all input sockets
+$inet_socket_port = 10628;   # accept connections on this local TCP port(s)
+
 # SMTP SERVER (INPUT) access control
 # - do not allow free access to the amavisd SMTP port !!!
@@ -2353,8 +2356,14 @@
 #   ],
 # };
+#
+# $policy_bank{'QMQPqq'} = {
+#   log_level => 3,
+#   protocol=>'QMQPqq', # possible with patch amavisd-new-qmqpqq.patch applied
+# };
 
 # NOTE: the use of policy banks for changing protocol on the input socket is
 # only needed when different protocols need to be spoken on different sockets
 # at the same time. For normal use just set globally e.g.: $protocol='AM.PDP';
+# $interface_policy{'10628'} = 'QMQPqq';
 #
 #$policy_bank{'AM.PDP-SOCK'} = {