pencat's blog - Anti Spam

检查IP反向解析记录

pencat@bigfoot.com (pencat) — Thu, 22 Nov 2007 19:45:13 +0800

http://postmaster.info.aol.com/tools/rdns.html

构思随笔

pencat@bigfoot.com (pencat) — Thu, 22 Nov 2007 08:42:22 +0800

Spam Locker for win

pencat@bigfoot.com (pencat) — Thu, 01 Nov 2007 11:15:42 +0800

QMail 1.03 APF2.0补丁的修改

pencat@bigfoot.com (pencat) — Wed, 31 Oct 2007 13:38:47 +0800

apf对认证过的用户是不进行垃圾判断的, 虽然逻辑上没问题,但这样就不能对本地管理域做信任关系的控制.

比如: QMAIL本地域为abc.com team@abc.com 的信任关系是,除了user1@abc.com之外,拒绝一切来信. 但apf对smtp认证过的用户视而不见, user2@abc.com 经过认证也可以发信到team@abc.com 这样就存在一个小BUG. 这种情况下只有修改qmail-smtpd.c 重新编译.

//NO AUTH 后面的代码注释掉即可

#include "sig.h" #include "readwrite.h" #include "stralloc.h" #include "substdio.h" #include "alloc.h" #include "auto_qmail.h" #include "control.h" #include "received.h" #include "constmap.h" #include "error.h" #include "ipme.h" #include "ip.h" #include "qmail.h" #include "str.h" #include "fmt.h" #include "scan.h" #include "byte.h" #include "case.h" #include "env.h" #include "now.h" #include "exit.h" #include "rcpthosts.h" #include "timeoutread.h" #include "timeoutwrite.h" #include "commands.h" #include "wait.h" #include "fd.h" #define AUTHCRAM #define MAXHOPS 100 unsigned int databytes = 0; int timeout = 1200; /* APF patch for qmail, experimental version, but more stable * than before, use it as your own risk! * * Patch arch designer : nsinit <nsinit@263.net> * Author : nsinit <nsinit@263.net> * Patch updater : He zhiqiang <hzqbbc@damail.cn> * * TODO: complete the protocol implemention under qmail and * add some new feature depends on qmail arch. */ void out(char *); void die_nomem(void); /* * APF: * apf_server's arguments: * 1. protocol_state * 2. protocol_name * 3. helo_name * 4. queue_id // XXX -- cann't get before DATA command * 5. sender * 6. recipient * 7. client_address * 8. client_name // XXX -- gethostbyaddr .. TODO */ #define STATE_HELO 0 #define STATE_MAIL 1 #define STATE_RCPT 2 /* APF ret code defined here */ #define		APF_FAIL	255	/* APF-qmail exec fail */ #define		APF_UNEXP	254	/* APF-qmail return unknow */ #define		APF_ACPT	0	/* APF-qmail return ok/dunno */ #define		APF_ERR		1	/* APF-qmail exec success */ typedef struct apf_request { 	stralloc protocol_state; 	stralloc protocol_name; 	stralloc helo_name; 	stralloc queue_id; 	stralloc sender; 	stralloc recipient; 	stralloc client_address; 	stralloc client_name; } apf_request_t; apf_request_t apf_request = {0}; stralloc apf_server = {0}; // initialized reading from control/xxx void apf_debug() { /* * so stupid, should write my own wrapper for substdio ssout: * OUT(char* format, char* str) */ 	out("250 ok DEBUG->"); 	out("apf_server: "); 	out(apf_server.s); 	out("; "); 	out("remoteip: "); 	out(apf_request.client_address.s); 	out("; "); 	out("helo: "); 	out(apf_request.helo_name.s ? apf_request.helo_name.s : ""); 	out("; "); 	out("sender: "); 	out(apf_request.sender.s ? apf_request.sender.s : ""); 	out("; "); 	out("recipient: "); 	out(apf_request.recipient.s ? apf_request.recipient.s : ""); 	out("; "); } /* * do_apf_rcpt routine */ int do_apf_rcpt(apf_request_t* apf) { 	int child, wstat, ret = -1; 	char* (args[8]); 	if(!stralloc_copys(&(apf->protocol_state), "RCPT")) die_nomem(); 	if(!stralloc_0(&(apf->protocol_state))) die_nomem(); 	if(!stralloc_copys(&(apf->protocol_name), "SMTP")) die_nomem(); 	if(!stralloc_0(&(apf->protocol_name))) die_nomem(); 	args[0] = apf_server.s; 	args[1] = apf->protocol_state.s; 	args[2] = apf->protocol_name.s; 	args[3] = apf->helo_name.s ? apf->helo_name.s : ""; 	args[4] = apf->sender.s ? apf->sender.s : ""; 	args[5] = apf->recipient.s ? apf->recipient.s : ""; 	args[6] = apf->client_address.s; 	args[7] = 0; 	//apf_debug(); 	switch(child = fork()) 	{ 		case -1: 			return ret; 		case 0: 			sig_pipedefault(); 			execv(*args,args); 			_exit(APF_FAIL); 	} 	wait_pid(&wstat,child); 	if (wait_crashed(wstat)) 		return ret; 	return wait_exitcode(wstat); } /* * general entry for various real do_apf_XXX routines */ int do_apf (apf_request_t* apf, int state) { 	int ret = -1; 	switch (state) { 		case STATE_HELO: // not implement 			break; 		case STATE_MAIL: // not implement 			break; 		case STATE_RCPT: 			ret = do_apf_rcpt(apf); 			break; 		default: 			out("Error APF state: "); 			out(apf->protocol_state.s); 			out("\r\n"); 			break; 	} 	return ret; } int safewrite(fd,buf,len) int fd; char *buf; int len; { int r; r = timeoutwrite(timeout,fd,buf,len); if (r <= 0) _exit(1); return r; } char ssoutbuf[512]; substdio ssout = SUBSTDIO_FDBUF(safewrite,1,ssoutbuf,sizeof ssoutbuf); void flush() { substdio_flush(&ssout); } void out(s) char *s; { substdio_puts(&ssout,s); } void die_read() { _exit(1); } void die_alarm() { out("451 timeout (#4.4.2)\r\n"); flush(); _exit(1); } void die_nomem() { out("421 out of memory (#4.3.0)\r\n"); flush(); _exit(1); } void die_control() { out("421 unable to read controls (#4.3.0)\r\n"); flush(); _exit(1); } void die_ipme() { out("421 unable to figure out my IP addresses (#4.3.0)\r\n"); flush(); _exit(1); } void straynewline() { out("451 See http://pobox.com/~djb/docs/smtplf.html.\r\n"); flush(); _exit(1); } void err_bmf() { out("553 sorry, your envelope sender is in my badmailfrom list (#5.7.1)\r\n"); } void err_nogateway() { out("553 sorry, that domain isn't in my list of allowed rcpthosts (#5.7.1)\r\n"); } void err_unimpl() { out("502 unimplemented (#5.5.1)\r\n"); } void err_syntax() { out("555 syntax error (#5.5.4)\r\n"); } void err_wantmail() { out("503 MAIL first (#5.5.1)\r\n"); } void err_wantrcpt() { out("503 RCPT first (#5.5.1)\r\n"); } void err_noop() { out("250 ok\r\n"); } void err_vrfy() { out("252 send some mail, i'll try my best\r\n"); } void err_qqt() { out("451 qqt failure (#4.3.0)\r\n"); } int err_child() { out("454 oops, problem with child and I can't auth (#4.3.0)\r\n"); return -1; } int err_fork() { out("454 oops, child won't start and I can't auth (#4.3.0)\r\n"); return -1; } int err_pipe() { out("454 oops, unable to open pipe and I can't auth (#4.3.0)\r\n"); return -1; } int err_write() { out("454 oops, unable to write pipe and I can't auth (#4.3.0)\r\n"); return -1; } void err_authd() { out("503 you're already authenticated (#5.5.0)\r\n"); } void err_authmail() { out("503 no auth during mail transaction (#5.5.0)\r\n"); } int err_noauth() { out("504 auth type unimplemented (#5.5.1)\r\n"); return -1; } int err_authabrt() { out("501 auth exchange cancelled (#5.0.0)\r\n"); return -1; } int err_input() { out("501 malformed auth input (#5.5.4)\r\n"); return -1; } stralloc greeting = {0}; void smtp_greet(code) char *code; { substdio_puts(&ssout,code); substdio_put(&ssout,greeting.s,greeting.len); } void smtp_help() { out("214 qmail home page: http://pobox.com/~djb/qmail.html\r\n"); } void smtp_quit() { smtp_greet("221 "); out("\r\n"); flush(); _exit(0); } char *remoteip; char *remotehost; char *remoteinfo; char *local; char *relayclient; stralloc helohost = {0}; char *fakehelo; /* pointer into helohost, or 0 */ void dohelo(arg) char *arg; { if (!stralloc_copys(&helohost,arg)) die_nomem(); if (!stralloc_0(&helohost)) die_nomem(); fakehelo = case_diffs(remotehost,helohost.s) ? helohost.s : 0; } int liphostok = 0; stralloc liphost = {0}; int bmfok = 0; stralloc bmf = {0}; struct constmap mapbmf; void setup() { char *x; unsigned long u; if (control_init() == -1) die_control(); if (control_rldef(&greeting,"control/smtpgreeting",1,(char *) 0) != 1) die_control(); /* get apf_server control file */ if (control_rldef(&apf_server,"control/apf_server",1,(char *) 0) != 1) die_control(); stralloc_append(&apf_server, ""); // remove the trailing '\n' && 'Z' liphostok = control_rldef(&liphost,"control/localiphost",1,(char *) 0); if (liphostok == -1) die_control(); if (control_readint(&timeout,"control/timeoutsmtpd") == -1) die_control(); if (timeout <= 0) timeout = 1; if (rcpthosts_init() == -1) die_control(); bmfok = control_readfile(&bmf,"control/badmailfrom",0); if (bmfok == -1) die_control(); if (bmfok) if (!constmap_init(&mapbmf,bmf.s,bmf.len,0)) die_nomem(); if (control_readint(&databytes,"control/databytes") == -1) die_control(); x = env_get("DATABYTES"); if (x) { scan_ulong(x,&u); databytes = u; } if (!(databytes + 1)) --databytes; remoteip = env_get("TCPREMOTEIP"); if (!remoteip) remoteip = "unknown"; /* get client_address for APF */ if(!stralloc_copys(&(apf_request.client_address), remoteip)) die_nomem(); if(!stralloc_0(&apf_request.client_address)) die_nomem(); local = env_get("TCPLOCALHOST"); if (!local) local = env_get("TCPLOCALIP"); if (!local) local = "unknown"; remotehost = env_get("TCPREMOTEHOST"); if (!remotehost) remotehost = "unknown"; remoteinfo = env_get("TCPREMOTEINFO"); relayclient = env_get("RELAYCLIENT"); dohelo(remotehost); } stralloc addr = {0}; /* will be 0-terminated, if addrparse returns 1 */ int addrparse(arg) char *arg; { int i; char ch; char terminator; struct ip_address ip; int flagesc; int flagquoted; terminator = '>'; i = str_chr(arg,'<'); if (arg[i]) arg += i + 1; else { /* partner should go read rfc 821 */ terminator = ' '; arg += str_chr(arg,':'); if (*arg == ':') ++arg; while (*arg == ' ') ++arg; } /* strip source route */ if (*arg == '@') while (*arg) if (*arg++ == ':') break; if (!stralloc_copys(&addr,"")) die_nomem(); flagesc = 0; flagquoted = 0; for (i = 0;ch = arg[i];++i) { /* copy arg to addr, stripping quotes */ if (flagesc) { if (!stralloc_append(&addr,&ch)) die_nomem(); flagesc = 0; } else { if (!flagquoted && (ch == terminator)) break; switch(ch) { case '\\': flagesc = 1; break; case '"': flagquoted = !flagquoted; break; default: if (!stralloc_append(&addr,&ch)) die_nomem(); } } } /* could check for termination failure here, but why bother? */ if (!stralloc_append(&addr,"")) die_nomem(); if (liphostok) { i = byte_rchr(addr.s,addr.len,'@'); if (i < addr.len) /* if not, partner should go read rfc 821 */ if (addr.s[i + 1] == '[') if (!addr.s[i + 1 + ip_scanbracket(addr.s + i + 1,&ip)]) if (ipme_is(&ip)) { addr.len = i + 1; if (!stralloc_cat(&addr,&liphost)) die_nomem(); if (!stralloc_0(&addr)) die_nomem(); } } if (addr.len > 900) return 0; return 1; } int bmfcheck() { int j; if (!bmfok) return 0; if (constmap(&mapbmf,addr.s,addr.len - 1)) return 1; j = byte_rchr(addr.s,addr.len,'@'); if (j < addr.len) if (constmap(&mapbmf,addr.s + j,addr.len - j - 1)) return 1; return 0; } int addrallowed() { int r; r = rcpthosts(addr.s,str_len(addr.s)); if (r == -1) die_control(); return r; } int seenmail = 0; int flagbarf; /* defined if seenmail */ stralloc mailfrom = {0}; stralloc rcptto = {0}; void smtp_helo(arg) char *arg; { /* get helo_name for APF */ if (!stralloc_copys(&(apf_request.helo_name),arg)) die_nomem(); if (!stralloc_0(&(apf_request.helo_name))) die_nomem(); smtp_greet("250 "); out("\r\n"); seenmail = 0; dohelo(arg); } void smtp_ehlo(arg) char *arg; { /* get helo_name, older version does not * handle ehlo command */ if (!stralloc_copys(&(apf_request.helo_name),arg)) die_nomem(); if (!stralloc_0(&(apf_request.helo_name))) die_nomem(); smtp_greet("250-"); #ifdef AUTHCRAM out("\r\n250-AUTH LOGIN CRAM-MD5 PLAIN"); out("\r\n250-AUTH=LOGIN CRAM-MD5 PLAIN"); #else out("\r\n250-AUTH LOGIN PLAIN"); out("\r\n250-AUTH=LOGIN PLAIN"); #endif out("\r\n250-PIPELINING\r\n250 8BITMIME\r\n"); seenmail = 0; dohelo(arg); } void smtp_rset() { seenmail = 0; out("250 flushed\r\n"); } void smtp_mail(arg) char *arg; { if (!addrparse(arg)) { err_syntax(); return; } flagbarf = bmfcheck(); seenmail = 1; if (!stralloc_copys(&rcptto,"")) die_nomem(); if (!stralloc_copys(&mailfrom,addr.s)) die_nomem(); if (!stralloc_0(&mailfrom)) die_nomem(); /* get sender for APF */ if (!stralloc_copys(&(apf_request.sender),addr.s)) die_nomem(); if (!stralloc_0(&(apf_request.sender))) die_nomem(); out("250 ok\r\n"); } /* To work with SMTP AUTH authenticated user under APF * which will not step into do_apf() function and omit the * checking, use int authd to judge :-) the easy way.*/ extern int authd; void smtp_rcpt(arg) char *arg; { int ret= 0; if (!seenmail) { err_wantmail(); return; } if (!addrparse(arg)) { err_syntax(); return; } if (flagbarf) { err_bmf(); return; } if (relayclient) { --addr.len; if (!stralloc_cats(&addr,relayclient)) die_nomem(); if (!stralloc_0(&addr)) die_nomem(); } else if (!addrallowed()) { err_nogateway(); return; } if (!stralloc_cats(&rcptto,"T")) die_nomem(); if (!stralloc_cats(&rcptto,addr.s)) die_nomem(); if (!stralloc_0(&rcptto)) die_nomem(); /* get recipient for APF */ if (!stralloc_copys(&(apf_request.recipient),addr.s)) die_nomem(); if (!stralloc_0(&(apf_request.recipient))) die_nomem(); /* Ok it's the right time to do apf checking if not * authenticated via SMTP AUTH modules */ //NO AUTH if ( !authd ) { ret = do_apf(&apf_request, STATE_RCPT); switch ( ret ) { 	 /* on APF_FAIL & APF_UNEXP we still return 250 for non stop 	 * service for production system, it will only receive more 	 * spam temporarily instead of refusing service */ 	 case APF_FAIL: 		 out("250 ok, but apf_server exec error\r\n"); 		 break; 	 case APF_UNEXP: 		 out("250 ok, but apf_server return unknow error\r\n"); 		 break; 	 case APF_ERR: 		 /* here we does not need to output any msg, apf-qmail 		 * will do it for us */ 		 seenmail=0; 		 break; 	 case APF_ACPT: 		 out("250 policy checking passed\r\n"); 		 seenmail=1; 		 break; 	 default: 		 out("250 ok\r\n"); 		 seenmail=1; 		 break; } //NO AUTH } else { //NO AUTH 	/* let them go, we will not check authenticated user */ //NO AUTH 	out("250 ok\r\n"); //NO AUTH 	seenmail=1; //NO AUTH } } int saferead(fd,buf,len) int fd; char *buf; int len; { int r; flush(); r = timeoutread(timeout,fd,buf,len); if (r == -1) if (errno == error_timeout) die_alarm(); if (r <= 0) die_read(); return r; } char ssinbuf[1024]; substdio ssin = SUBSTDIO_FDBUF(saferead,0,ssinbuf,sizeof ssinbuf); struct qmail qqt; unsigned int bytestooverflow = 0; void put(ch) char *ch; { if (bytestooverflow) if (!--bytestooverflow) qmail_fail(&qqt); qmail_put(&qqt,ch,1); } void blast(hops) int *hops; { char ch; int state; int flaginheader; int pos; /* number of bytes since most recent \n, if fih */ int flagmaybex; /* 1 if this line might match RECEIVED, if fih */ int flagmaybey; /* 1 if this line might match \r\n, if fih */ int flagmaybez; /* 1 if this line might match DELIVERED, if fih */ state = 1; *hops = 0; flaginheader = 1; pos = 0; flagmaybex = flagmaybey = flagmaybez = 1; for (;;) { substdio_get(&ssin,&ch,1); if (flaginheader) { if (pos < 9) { if (ch != "delivered"[pos]) if (ch != "DELIVERED"[pos]) flagmaybez = 0; if (flagmaybez) if (pos == 8) ++*hops; if (pos < 8) if (ch != "received"[pos]) if (ch != "RECEIVED"[pos]) flagmaybex = 0; if (flagmaybex) if (pos == 7) ++*hops; if (pos < 2) if (ch != "\r\n"[pos]) flagmaybey = 0; if (flagmaybey) if (pos == 1) flaginheader = 0; } ++pos; if (ch == '\n') { pos = 0; flagmaybex = flagmaybey = flagmaybez = 1; } } switch(state) { case 0: if (ch == '\n') straynewline(); if (ch == '\r') { state = 4; continue; } break; case 1: /* \r\n */ if (ch == '\n') straynewline(); if (ch == '.') { state = 2; continue; } if (ch == '\r') { state = 4; continue; } state = 0; break; case 2: /* \r\n + . */ if (ch == '\n') straynewline(); if (ch == '\r') { state = 3; continue; } state = 0; break; case 3: /* \r\n + .\r */ if (ch == '\n') return; put("."); put("\r"); if (ch == '\r') { state = 4; continue; } state = 0; break; case 4: /* + \r */ if (ch == '\n') { state = 1; break; } if (ch != '\r') { put("\r"); state = 0; } } put(&ch); } } char accept_buf[FMT_ULONG]; void acceptmessage(qp) unsigned long qp; { datetime_sec when; when = now(); out("250 ok "); accept_buf[fmt_ulong(accept_buf,(unsigned long) when)] = 0; out(accept_buf); out(" qp "); accept_buf[fmt_ulong(accept_buf,qp)] = 0; out(accept_buf); out("\r\n"); } void smtp_data() { int hops; unsigned long qp; char *qqx; if (!seenmail) { err_wantmail(); return; } if (!rcptto.len) { err_wantrcpt(); return; } seenmail = 0; if (databytes) bytestooverflow = databytes + 1; if (qmail_open(&qqt) == -1) { err_qqt(); return; } qp = qmail_qp(&qqt); out("354 go ahead\r\n"); received(&qqt,"SMTP",local,remoteip,remotehost,remoteinfo,fakehelo); blast(&hops); hops = (hops >= MAXHOPS); if (hops) qmail_fail(&qqt); qmail_from(&qqt,mailfrom.s); qmail_put(&qqt,rcptto.s,rcptto.len); qqx = qmail_close(&qqt); if (!*qqx) { acceptmessage(qp); return; } if (hops) { out("554 too many hops, this message is looping (#5.4.6)\r\n"); return; } if (databytes) if (!bytestooverflow) { out("552 sorry, that message size exceeds my databytes limit (#5.3.4)\r\n"); return; } if (*qqx == 'D') out("554 "); else out("451 "); out(qqx + 1); out("\r\n"); } char unique[FMT_ULONG + FMT_ULONG + 3]; static stralloc authin = {0}; static stralloc user = {0}; static stralloc pass = {0}; static stralloc resp = {0}; static stralloc slop = {0}; char *hostname; char **childargs; substdio ssup; char upbuf[128]; int authd = 0; int authgetl(void) { int i; if (!stralloc_copys(&authin, "")) die_nomem(); for (;;) { if (!stralloc_readyplus(&authin,1)) die_nomem(); /* XXX */ i = substdio_get(&ssin,authin.s + authin.len,1); if (i != 1) die_read(); if (authin.s[authin.len] == '\n') break; ++authin.len; } if (authin.len > 0) if (authin.s[authin.len - 1] == '\r') --authin.len; authin.s[authin.len] = 0; if (*authin.s == '*' && *(authin.s + 1) == 0) { return err_authabrt(); } if (authin.len == 0) { return err_input(); } return authin.len; } int authenticate(void) { int child; int wstat; int pi[2]; if (!stralloc_0(&user)) die_nomem(); if (!stralloc_0(&pass)) die_nomem(); if (!stralloc_0(&resp)) die_nomem(); if (fd_copy(2,1) == -1) return err_pipe(); close(3); if (pipe(pi) == -1) return err_pipe(); if (pi[0] != 3) return err_pipe(); switch(child = fork()) { case -1: return err_fork(); case 0: close(pi[1]); sig_pipedefault(); execvp(*childargs, childargs); _exit(1); } close(pi[0]); substdio_fdbuf(&ssup,write,pi[1],upbuf,sizeof upbuf); if (substdio_put(&ssup,user.s,user.len) == -1) return err_write(); if (substdio_put(&ssup,pass.s,pass.len) == -1) return err_write(); if (substdio_put(&ssup,resp.s,resp.len) == -1) return err_write(); if (substdio_flush(&ssup) == -1) return err_write(); close(pi[1]); byte_zero(pass.s,pass.len); byte_zero(upbuf,sizeof upbuf); if (wait_pid(&wstat,child) == -1) return err_child(); if (wait_crashed(wstat)) return err_child(); if (wait_exitcode(wstat)) { sleep(5); return 1; } /* no */ return 0; /* yes */ } int auth_login(arg) char *arg; { int r; if (*arg) { if (r = b64decode(arg,str_len(arg),&user) == 1) return err_input(); } else { out("334 VXNlcm5hbWU6\r\n"); flush(); /* Username: */ if (authgetl() < 0) return -1; if (r = b64decode(authin.s,authin.len,&user) == 1) return err_input(); } if (r == -1) die_nomem(); out("334 UGFzc3dvcmQ6\r\n"); flush(); /* Password: */ if (authgetl() < 0) return -1; if (r = b64decode(authin.s,authin.len,&pass) == 1) return err_input(); if (r == -1) die_nomem(); if (!user.len || !pass.len) return err_input(); return authenticate(); } int auth_plain(arg) char *arg; { int r, id = 0; if (*arg) { if (r = b64decode(arg,str_len(arg),&slop) == 1) return err_input(); } else { out("334 ok, go on\r\n"); flush(); if (authgetl() < 0) return -1; if (r = b64decode(authin.s,authin.len,&slop) == 1) return err_input(); } if (r == -1 || !stralloc_0(&slop)) die_nomem(); while (slop.s[id]) id++; /* ignore authorize-id */ if (slop.len > id + 1) if (!stralloc_copys(&user,slop.s + id + 1)) die_nomem(); if (slop.len > id + user.len + 2) if (!stralloc_copys(&pass,slop.s + id + user.len + 2)) die_nomem(); if (!user.len || !pass.len) return err_input(); return authenticate(); } #ifdef AUTHCRAM int auth_cram() { int i, r; char *s; s = unique; s += fmt_uint(s,getpid()); *s++ = '.'; s += fmt_ulong(s,(unsigned long) now()); *s++ = '@'; *s++ = 0; if (!stralloc_copys(&pass,"<")) die_nomem(); if (!stralloc_cats(&pass,unique)) die_nomem(); if (!stralloc_cats(&pass,hostname)) die_nomem(); if (!stralloc_cats(&pass,">")) die_nomem(); if (b64encode(&pass,&slop) < 0) die_nomem(); if (!stralloc_0(&slop)) die_nomem(); out("334 "); out(slop.s); out("\r\n"); flush(); if (authgetl() < 0) return -1; if (r = b64decode(authin.s,authin.len,&slop) == 1) return err_input(); if (r == -1 || !stralloc_0(&slop)) die_nomem(); i = str_chr(slop.s,' '); s = slop.s + i; while (*s == ' ') ++s; slop.s[i] = 0; if (!stralloc_copys(&user,slop.s)) die_nomem(); if (!stralloc_copys(&resp,s)) die_nomem(); if (!user.len || !resp.len) return err_input(); return authenticate(); } #endif struct authcmd { char *text; int (*fun)(); } authcmds[] = { { "login", auth_login } , { "plain", auth_plain } #ifdef AUTHCRAM , { "cram-md5", auth_cram } #endif , { 0, err_noauth } }; void smtp_auth(arg) char *arg; { int i; char *cmd = arg; if (!hostname || !*childargs) { out("503 auth not available (#5.3.3)\r\n"); return; } if (authd) { err_authd(); return; } if (seenmail) { err_authmail(); return; } if (!stralloc_copys(&user,"")) die_nomem(); if (!stralloc_copys(&pass,"")) die_nomem(); if (!stralloc_copys(&resp,"")) die_nomem(); i = str_chr(cmd,' '); arg = cmd + i; while (*arg == ' ') ++arg; cmd[i] = 0; for (i = 0;authcmds[i].text;++i) if (case_equals(authcmds[i].text,cmd)) break; switch (authcmds[i].fun(arg)) { case 0: authd = 1; relayclient = ""; remoteinfo = user.s; out("235 ok, go ahead (#2.0.0)\r\n"); break; case 1: out("535 authorization failed (#5.7.0)\r\n"); } } struct commands smtpcommands[] = { { "rcpt", smtp_rcpt, 0 } , { "mail", smtp_mail, 0 } , { "data", smtp_data, flush } , { "auth", smtp_auth, flush } , { "quit", smtp_quit, flush } , { "helo", smtp_helo, flush } , { "ehlo", smtp_ehlo, flush } , { "rset", smtp_rset, 0 } , { "help", smtp_help, flush } , { "noop", err_noop, flush } , { "vrfy", err_vrfy, flush } , { 0, err_unimpl, flush } } ; void main(argc,argv) int argc; char **argv; { hostname = argv[1]; childargs = argv + 2; sig_pipeignore(); if (chdir(auto_qmail) == -1) die_control(); setup(); if (ipme_init() != 1) die_ipme(); smtp_greet("220 APF-qmail: "); out(" ESMTP\r\n"); if (commands(&ssin,&smtpcommands) == 0) die_read(); die_nomem(); }

进我在反垃圾的路上狂奔

pencat@bigfoot.com (pencat) — Mon, 29 Oct 2007 21:51:56 +0800

两周前, 受命为公司部署反垃圾邮件系统. 那天我的噩梦开始了.

对邮件服务器的了解不多,只是很久以前学习TCP/IP的时候看过MAIL工作的一些原理, 现在也差不多忘干净了. 还好有个地方叫互连网, 我可以从那里得到想要的一切.

查过资料才知道,反垃圾邮件系统从功能上分为两类。

1. 基于内容以SpamAssasin为代表。
2. 基于行为以Spam Locker为代表。

SpamAssasin 被认为是最好的反垃圾软件，SpamAssasin将其逻辑封装在一个设计精良的、抽象化的API中，因此它可被集成到电子邮件数据流中的任何地方。它号称9x%的识别率。高识别率的代价是以牺牲性能换来的，每一封邮件都要使用大量规则去对比，系统开销可想而知。如果运行在千万级用户的系统上.......难以想象

而Spam Locker是基于行为的反垃圾，在SENDER与MAIL SERVER进行命令交换时就可以识别垃圾邮件，从而断开TCP连接，极大的节省了系统资源和带宽。而APF的机制更可以将反垃圾系统和邮件系统分别置于不同的服务器上，进一步提高了系统的稳定性，降低了资源成本。
这两种系统由于机制不同，所以没有可比性，但我更倾基于行为的反垃圾邮件系统。

两周前下载并安装了ExtMail发布的Spam Locker（以下简称SL）开源反垃圾邮件程序。SL采用PERL语言开发，通过补丁形式支持QMAIL。在MAIL SERVER接收到RCPT TO后调用APF插件，向指定IP发送如下数据:

request=smtpd_access_policy
protocol_state=RCPT
protocol_name=SMTP
client_address=82.135.209.55
client_name=unknow
helo_name=82-135-209-55.ip.zebra.lt
sender=pulp@dcba.com
recipient=liming@abcd.com
queue_id=

SL收到数据后调用各种模块对数据进行分析，最后返回OK/DUNNO/REJECT三种状态。但是到最后我也没弄清楚模块之间的优先级到底是怎样，导致正常邮件不断的被退回。

悲剧开始了。

总公司的邮件设置很奇怪，发信使用了第三方服务，造成MX记录不匹配。有些SMTP SERVER的IP还被RBL列入黑名单。这些自然都被SL挡了回去，设置白名单也无济于事。

总公司的人急了。

南京公司内部有3台SMTP，用户没有进行统一的设置，而另外2台也没有SMTP认证，导致发信者的域名与发信IP不符，结果就被当做垃圾。在本地DNS增加了MX记录记录也不行。SL的日志中明明读取了本地DNS的信息，也返回了我设置的记录，依旧把正常邮件当垃圾。鉴于此情况我发信给公司全体人员，要求修改SMTP服务器，怕有些人不懂如何设置，我制作了3个版本的邮件客户端图文并貌的说明文件，但修改者寥寥，而我每天奔波在那些不仔细阅读说明的人中，筋疲力尽。要命的是总经理的不断问我，质问邮件为什么总发不出去，还收不到？？？

我哭了。

综合以上情况，最后不得不关闭了SL。

PS:在使用SL过程中还发现了诡异的幽灵记录

10-24 12:42:00 [27921]: [450 rejected, see [url]http://bl.extmail.org/cgi/freq?[/url] ,from=<> to=<> helo=<> client=<>]
10-24 13:05:24 [3926]: [450 rejected, see [url]http://bl.extmail.org/cgi/freq?[/url] ,from=<> to=<> helo=<> client=<>]
10-24 13:05:51 [3927]: [450 rejected, see [url]http://bl.extmail.org/cgi/freq?[/url] ,from=<> to=<> helo=<> client=<>]
10-24 13:05:57 [4006]: [450 rejected, see [url]http://bl.extmail.org/cgi/freq?[/url] ,from=<> to=<> helo=<> client=<>]
10-24 13:11:54 [6492]: [450 rejected, see [url]http://bl.extmail.org/cgi/freq?[/url] ,from=<> to=<> helo=<> client=<>]
10-24 13:12:13 [6499]: [450 rejected, see [url]http://bl.extmail.org/cgi/freq?[/url] ,from=<> to=<> helo=<> client=<>]
10-24 13:12:19 [6523]: [450 rejected, see [url]http://bl.extmail.org/cgi/freq?[/url] ,from=<> to=<> helo=<> client=<>]

在SL版问过也没人解答, 觉得这是SL的BUG. 因为在APF的日志中没有提交空信息的记录。

如果要在公司现有环境中部署反垃圾邮件，且不需要用户更改设置，就必须建立一套自己的反垃圾规则。经过两周的测试，总结了一些经验，也搜集到足够的资料。下一步打算开发一套自己的反垃圾系统。这样可以不再受第三方规则的困扰，将邮件控制权把握在自己手中(并不是说SL不好，也许是自己太笨，没弄明白)。

这个系统的雏形已经实现(VB6下的多线程模式)，和SL的工作原理一样，可以说是WINDOWS下的Spam Locker。只是判断规则按照内部需要自己完善。我的PERL很弱，否则就可以在SL的基础上修改一下。经过4天的测试，运行十分稳定，识别效率和效果也非常好。吸取前次部署SL的经验，这次打算测试一个模块，上线一个模块，发现问题马上调整。

反垃圾邮件的是痛苦的，不可能一步到位，最痛苦的是要面对用户的指责，质疑。也许我功力不够，也许是降大任前的苦其心志。我依旧奔在反垃圾的路上。

如果能够顺利到达终点，我会把相关资料整理成详细文挡，希望后来的兄弟不要象我般如此痛苦。