pypolicyd-spf-0.6~rc1/0000755000175000017500000000000010756454062015220 5ustar kittermakittermapypolicyd-spf-0.6~rc1/policyd-spf.10000644000175000017500000002237510756443630017543 0ustar kittermakitterma\" .\" Standard preamble: .\" ======================================================================== .de Sh \" Subsection heading .br .if t .Sp .ne 5 .PP \fB\\$1\fR .PP .. .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' 'br\} .\" .\" If the F register is turned on, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . nr % 0 . rr F .\} .\" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .hy 0 .if n .na .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. . \" fudge factors for nroff and troff .if n \{\ . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] \fP .\} .if t \{\ . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff .if n \{\ . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} .if t \{\ . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' .ds 8 \h'\*(#H'\(*b\h'-\*(#H' .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] .ds ae a\h'-(\w'a'u*4/10)'e .ds Ae A\h'-(\w'A'u*4/10)'E . \" corrections for vroff .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' . \" for low resolution devices (crt and lpr) .if \n(.H>23 .if \n(.V>19 \ \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} .rm #[ #] #H #V #F C .\" ======================================================================== .\" .IX Title "policy-spf 1" .TH policy-spf 1 "2008-02-18" .SH "NAME" python-policyd-spf \- pure-Python Postfix policy daemon for SPF checking .SH "VERSION" .IX Header "VERSION" 0\.6 .SH "USAGE" .IX Header "USAGE" NOTE: Depending on the packaging and distribution, the exact path to the executable may vary. The executable should be included in the Python path. $ policyd-spf (Start using installed config file) $ policyd-spf \-h (Display usage message) $ policyd-spf /etc/policyd-spf/policyd-spf.conf (Config file name to use) Configuration options are described in the sample configuration file provided with the package policyd-spf.conf(5). The provided setup.py installs this configuration file in /etc/policyd-spf/. Additionally, whitelisting certain IP addresses or IP addresses used by listed domains from SPF checks is supported. Skipping SPF checks for local submission or trusted relays is also provided. The sample configuration file and policyd-spf.conf(5) shows the format to use. .SH "OTHER DOCUMENTATION" .IX Header "OTHER DOCUMENTATION" This documentation assumes you have read Postfix's README_FILES/ SMTPD_POLICY_README and are generally familiar with Sender Policy Framework (SPF). See RFC 4408 for details. See policyd-spf.conf(5) for configuration file information. .SH "SYNOPSIS" .IX Header "SYNOPSIS" python-policyd-spf is a Postfix SMTPd policy daemon for SPF checking. It is implemented in pure Python and uses the pyspf module. The SPF web site is http://www.openspf.org/. The Postfix configuration must be changed to check SPF. .SH "DESCRIPTION" .IX Header "DESCRIPTION" Logging is sent to syslogd. Each time a Postfix SMTP server process is started it connects to the policy service socket and Postfix runs one instance of this Python script. By default, a Postfix SMTP server process terminates after 100 seconds of idle time, or after serving 100 clients. Thus, the cost of starting this Python script is smoothed over time The default policy_time_limit is 1000 seconds. This may be too short for some SMTP transactions to complete. As recommended in SMTPD_POLICY_README, this should be extended to 3600 seconds. To do so, set "policy_time_limit = 3600" in /etc/postfix/main.cf. Messages that get a Fail SPF result will be rejected. Messages that get a Permerror are, by default, treated as if they had no SPF record. Messages that get a Temperror result are, by default, treated as if they had no SPF record, but can (and probably should) be deferred if otherwise permitted. Messages that get other SPF results (Pass, None, Neutral, Softfail) will have the SPF Received header prepended. Note: Spamasassisn 3.2 and follow will use this header for spam scoring so there is no need to configure a separate SPF check in these Spamassassin versions. See Spamassassin documentation for details. Default Mail From rejection/deferal criteria are, by design, conservative. Default HELO check actions are to reject mail with other than Pass/None. HELO records are much simpler than Mail From records and rejecting based on HELO checking does not present a false positive risk. These settings are a matter of local policy and should be adjusted to meet the requirements of site administrators. See policyd-spf.conf(5) for configuration file details. .SH "LOGGING" .IX Header "LOGGING" Policyd-spf will log messages to syslog about it's activities. The "debugLevel" value in "policyd-spf.conf" can be increased to get additional information to be logged. When set to a value of "0", only test results (SPF hits/misses) are logged. Results will be returned to Postfix and logged as a warning by Postfix also. For logging by this policy server, look for "policyd-spf" in your mail log files. .SH "TESTING THE POLICY DAEMON" .IX Header "TESTING THE POLICY DAEMON" Testing the policy daemon To test the policy daemon by hand, execute: policyd-spf Each query is a bunch of attributes. Order does not matter, and the daemon uses only a few of all the attributes shown below: request=smtpd_access_policy protocol_state=RCPT protocol_name=SMTP helo_name=some.domain.tld queue_id=8045F2AB23 instance=12345.6789 sender=foo@bar.tld recipient=bar@foo.tld client_address=1.2.3.4 client_name=another.domain.tld [empty line] The policy daemon will answer in the same style, with an attribute list followed by a empty line: action=dunno [empty line] .SH "POSTFIX INTEGRATION" .IX Header "POSTFIX INTEGRATION" 1. Add the following to /etc/postfix/master.cf: policyd-spf unix - n n - 0 spawn user=nobody argv=/usr/bin/python /usr/bin/policyd-spf NOTE: Check the path to both the installed Python interpreter and policyd-spf. These vary from system to system. To use non-default settings, you must also add the config file (see above and policyd-spf.conf(5) for details). 2. Configure the Postfix policy service in /etc/postfix/main.cf: smtpd_recipient_restrictions = ... reject_unauth_destination check_policy_service unix:private/policyd-spf ... policyd-spf_time_limit = 3600 NOTE: Specify check_policy_service AFTER reject_unauth_destination or else your system can become an open relay. 3. Reload Postfix. .SH "SEE ALSO" .IX Header "SEE ALSO" policyd-spf.conf(5), python-spf, , RFC 4408 .SH "AUTHORS" .IX Header "AUTHORS" This version of \fBpython-policyd-spf\fR was written by Copyright (c) 2007 Scott Kitterman . It is derived from Tumgreyspf, written by Sean Reifschneider, tummy.com, ltd . Portions of the documentation were written by Meng Weng Wong . .PP This man-page was created by Scott Kitterman . pypolicyd-spf-0.6~rc1/policyd-spf0000755000175000017500000004317110756450215017401 0ustar kittermakitterma#!/usr/bin/python # # Check SPF results and provide recommended action back to Postfix. # # Tumgreyspf source # Copyright (c) 2004-2005, Sean Reifschneider, tummy.com, ltd. # # # pypolicyd-spf # Copyright (c) 2007, 2008 Scott Kitterman ''' This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.''' __version__ = "0.6: Feb 18 2008" import syslog, os, sys, string, re, time, popen2, urllib, stat, errno, socket, spf import policydspfsupp syslog.openlog(os.path.basename(sys.argv[0]), syslog.LOG_PID, syslog.LOG_MAIL) policydspfsupp.setExceptHook() ############################################# def cidrmatch(connectip, ipaddrs, n): """Match connect IP against a list of other IP addresses. From pyspf.""" try: if connectip.count(':'): MASK = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL connectip = spf.inet_pton(connectip) for arg in ipaddrs: ipaddrs[ipaddrs.index(arg)] = spf.inet_pton(arg) bin = spf.bin2long6 else: MASK = 0xFFFFFFFFL bin = spf.addr2bin c = ~(MASK >> n) & MASK & bin(connectip) for ip in [bin(ip) for ip in ipaddrs]: if c == ~(MASK >> n) & MASK & ip: return True except socket.error: pass return False def parse_cidr(cidr_ip): """Breaks CIDR notation into a (address,cidr,cidr6) tuple. The cidr defaults to 32 if not present. Derived from pyspf""" import re RE_DUAL_CIDR = re.compile(r'//(0|[1-9]\d*)$') RE_CIDR = re.compile(r'/(0|[1-9]\d*)$') a = RE_DUAL_CIDR.split(cidr_ip) if len(a) == 3: cidr_ip, cidr6 = a[0], int(a[1]) else: cidr6 = None a = RE_CIDR.split(cidr_ip) if len(a) == 3: cidr_ip, cidr = a[0], int(a[1]) else: cidr = None b = cidr_ip.split(':', 1) if len(b) < 2: return cidr_ip, cidr return a[0], cidr6 ############################################# def spfbypass(data, check_type, configData): if configData.get(check_type): if configData.get('Prospective'): ip = configData.get('Prospective') else: ip = data.get('client_address') bypass_list = (str(configData.get(check_type))) bypass_list_list = bypass_list.split(',') if check_type == 'skip_addresses' or check_type == 'Whitelist': for cidr in bypass_list_list: parsed_address = parse_cidr(cidr) good_ip = [parsed_address[0],] cidr_range = parsed_address[1] if not parsed_address[1]: ip_str = str(good_ip[0]) if spf.RE_IP4.match(ip_str): cidr_range = 32 elif spf.RE_IP6.match(ip_str): cidr_range = 128 else: Message = 'ERROR: ' + ip_str + ' in ' + check_type + ' not IP address. Aborting whitelist processing.' if debugLevel: syslog.syslog(Message) return (False, 'None') if cidrmatch(ip, good_ip, int(cidr_range)): if check_type == 'skip_addresses': comment = 'SPF check N/A for local connections - ' else: comment = 'SPF skipped for whitelisted relay - ' Header = ('X-Comment: ' + comment + 'client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % ( data.get('client_address', ''), data.get('helo_name', ''), data.get('sender', ''), data.get('recipient', ''), )) if debugLevel >= 3: syslog.syslog(Header) return (True, Header) return (False, 'None') elif check_type == 'Domain_Whitelist': for domain in bypass_list_list: res = spf.check2(ip, domain, domain) domain_res = [res[0], res[1]] domain_res[0] = domain_res[0].lower() domain_res[0] = domain_res[0].capitalize() if domain_res[0] == 'Pass': comment = 'SPF skipped for whitelisted relay domain - ' Header = ('X-Comment: ' + comment + 'client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % ( data.get('client_address', ''), data.get('helo_name', ''), data.get('sender', ''), data.get('recipient', ''), )) if debugLevel >= 3: syslog.syslog(Header) return (True, Header) return (False, 'None') ############################################# def spfcheck(data, instance_dict, configData): #{{{1 debugLevel = configData.get('debugLevel', 1) if configData.get('Prospective'): ip = configData.get('Prospective') else: ip = data.get('client_address') if ip == None: if debugLevel >= 2: syslog.syslog('spfcheck: No client address, exiting') return(( None, None, instance_dict )) # Do not check SPF for localhost addresses skip_check = spfbypass(data, 'skip_addresses', configData) if skip_check[0]: return (('prepend', skip_check[1], instance_dict )) # Whitelist designated IP addresses from SPF checks (e.g. secondary MX or # known forwarders. ip_whitelist = spfbypass(data, 'Whitelist', configData) if ip_whitelist: if ip_whitelist[0]: return (('prepend', ip_whitelist[1], instance_dict )) # Whitelist designated Domain's sending addresses from SPF checks (e.g. # known forwarders. domain_whitelist = spfbypass(data, 'Domain_Whitelist', configData) if domain_whitelist: if domain_whitelist[0]: return (('prepend', domain_whitelist[1], instance_dict )) #recipient = data.get('recipient') receiver=socket.gethostname() sender = data.get('sender') helo = data.get('helo_name') if not sender and not helo: if debugLevel >= 2: syslog.syslog('spfcheck: No sender or helo, exiting') return(( None, None, instance_dict )) # start query spfResult = None spfReason = None instance = data.get('instance') # The following if is only needed for testing. Postfix # will always provide instance. if not instance: import random instance = str(int(random.random()*100000)) # This is to prevent multiple headers being prepended # for multi-recipient mail. found_instance = instance_dict.has_key(instance) '''Data structure for results is a list of: [0] SPF result [1] SPF reason [2] Identity (HELO/Mail From) [3] Action based on local policy [4] Header''' if not found_instance: Mail_From_pass_restriction = configData.get('Mail_From_pass_restriction') HELO_pass_restriction = configData.get('HELO_pass_restriction') # First do HELO check # if no helo name sent, use domain from sender for later use. if not helo: foo = string.split(sender, '@', 1) if len(foo) < 2: helo = 'unknown' else: helo = foo[1] else: if configData.get('HELO_reject') != 'No_Check': helo_fake_sender = 'postmaster@' + helo res = spf.check2(ip, helo_fake_sender, helo) helo_result = [res[0], res[1]] helo_result.append('helo') helo_result[0] = helo_result[0].lower() helo_result[0] = helo_result[0].capitalize() if debugLevel >= 2: syslog.syslog('spfcheck: pyspf result: "%s"' % str(helo_result)) if configData.get('HELO_reject') == 'Null' and sender: helo_result.append('dunno') elif helo_result[0] == 'Temperror' and configData.get('TempError_Defer') == 'True': helo_result.append('defer') elif helo_result[0] == 'Permerror' and configData.get('PermError_reject') == 'True': helo_result.append('reject') elif helo_result[0] == 'Permerror' and configData.get('PermError_reject') == 'False': helo_result.append('prepend') elif configData.get('HELO_reject') == 'Fail' and helo_result[0] == 'Fail': helo_result.append('reject') elif configData.get('HELO_reject') == 'SPF_Not_Pass' and (helo_result[0] == 'Fail' or helo_result[0] == 'Softfail' or helo_result[0] == 'Neutral'): helo_result.append('reject') helo_result[1] = 'SPF HELO result: rejected due to local policy (Not Pass/None)' else: helo_result.append('prepend') if sender == '': header_sender = '<>' else: header_sender = sender if helo_result[0] == 'None': helo_result[1] = "no SPF record" spfDetail = ('identity=%s; client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % (helo_result[2], ip, helo, header_sender, data.get('recipient', ''))) if debugLevel >= 1: logdata = str(helo_result[0]) + "; " + spfDetail syslog.syslog(logdata) header = 'Received-SPF: '+ helo_result[0] + ' (' + helo_result[1] +') ' + spfDetail helo_result.append(header) instance_dict[instance] = helo_result if HELO_pass_restriction and helo_result[0] == 'Pass': restrict_name = HELO_pass_restriction # Only act on the HELO result if it is authoritative. if helo_result[3] == 'reject': header = "Message rejected due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'reject', header, instance_dict )) if helo_result[3] == 'defer': header = "Message deferred due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'defer', header, instance_dict )) # Second do Mail From Check if sender == '': if configData.get('HELO_reject') != 'No_Check': if helo_result[3] == 'reject': header = "Message rejected due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') if helo_result[3] == 'defer': header = "Message deferred due to: " + helo_result[1] + ". Please see http://www.openspf.org/Why?s=helo;id=" + helo + ";ip=" + ip + ";r=" + data.get('recipient') if HELO_pass_restriction and helo_result[0] == 'Pass': restrict_name = HELO_pass_restriction return('result_only', restrict_name, instance_dict) return(( helo_result[3], header, instance_dict )) else: if configData.get('Mail_From_reject') != 'No_Check': res = spf.check2(ip, sender, helo) mfrom_result = [res[0], res[1]] mfrom_result.append('mailfrom') mfrom_result[0] = mfrom_result[0].lower() mfrom_result[0] = mfrom_result[0].capitalize() if debugLevel >= 2: syslog.syslog('spfcheck: pyspf result: "%s"' % str(mfrom_result)) mfrom_result.append('dunno') if mfrom_result[0] == 'Temperror' and configData.get('TempError_Defer') == 'True': mfrom_result[3] = 'defer' elif mfrom_result[0] == 'Permerror' and configData.get('PermError_reject') == 'True': mfrom_result[3] = 'reject' elif mfrom_result[0] == 'Permerror' and configData.get('PermError_reject') == 'False': mfrom_result[3] = 'prepend' elif configData.get('Mail_From_reject') == 'Fail' and mfrom_result[0] == 'Fail': mfrom_result[3] = 'reject' else: mfrom_result[3] = 'prepend' if mfrom_result[0] == 'None': mfrom_result[1] = 'no SPF record' if mfrom_result[0] != 'None' or (mfrom_result[0] == 'None' and helo_result[0] == 'None'): spfDetail = \ ('identity=%s; client-ip=%s; helo=%s; envelope-from=%s; receiver=%s ' % (mfrom_result[2], ip, helo, sender, data.get('recipient', ''))) if debugLevel >= 1: logdata = str(mfrom_result[0]) + "; " + spfDetail syslog.syslog(logdata) header = 'Received-SPF: '+ mfrom_result[0] + ' (' + mfrom_result[1] +') ' + spfDetail mfrom_result.append(header) instance_dict[instance] = mfrom_result if (Mail_From_pass_restriction and mfrom_result[0] == 'Pass') or (HELO_pass_restriction and helo_result[0] == 'Pass'): if mfrom_result[0] == 'Pass': restrict_name = Mail_From_pass_restriction return('result_only', restrict_name, instance_dict) # Act on the Mail From result if it is authoritative. if mfrom_result[3] == 'reject': header = "Message rejected due to: " + mfrom_result[1] + ". Please see http://www.openspf.org/Why?s=mfrom;id=" + sender + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'reject', header, instance_dict )) if mfrom_result[3] == 'defer': header = "Message deferred due to: " + mfrom_result[1] + ". Please see http://www.openspf.org/Why?s=mfrom;id=" + sender + ";ip=" + ip + ";r=" + data.get('recipient') return(( 'defer', header, instance_dict )) if mfrom_result[3] != 'dunno' or helo_result[3] =='dunno': return(( 'prepend', header, instance_dict )) else: cached_instance = instance_dict[instance] if cached_instance[3] == 'prepend': return(( 'dunno', 'Header already pre-pended', instance_dict )) else: return(( cached_instance[3], cached_instance[4], instance_dict )) return(( 'None', 'None', instance_dict )) ################################################### # load config file {{{1 # Default location: configFile = '/etc/python-policyd-spf/policyd-spf.conf' if len(sys.argv) > 1: if sys.argv[1] in ( '-?', '--help', '-h' ): print 'usage: policyd-spf []' sys.exit(1) configFile = sys.argv[1] configGlobal = policydspfsupp.processConfigFile(filename = configFile) # loop reading data {{{1 debugLevel = configGlobal.get('debugLevel', 1) if debugLevel >= 3: syslog.syslog('Starting') instance_dict = {'0':'init',} instance_dict.clear() data = {} lineRx = re.compile(r'^\s*([^=\s]+)\s*=(.*)$') while 1: line = sys.stdin.readline() if not line: break line = string.rstrip(line) if debugLevel >= 4: syslog.syslog('Read line: "%s"' % line) # end of entry {{{2 if not line: if debugLevel >= 4: syslog.syslog('Found the end of entry') configData = configGlobal if debugLevel >= 3: syslog.syslog('Config: %s' % str(configData)) # run the checkers {{{3 checkerValue = None checkerReason = None checkerValue, checkerReason, instance_dict = spfcheck(data, instance_dict, configData) if configData.get('defaultSeedOnly') == 0: checkerValue = None checkerReason = None # handle results {{{3 if checkerValue == 'reject': sys.stdout.write('action=550 %s\n\n' % checkerReason) elif checkerValue == 'prepend': if configData.get('Prospective'): sys.stdout.write('action=dunno\n\n') else: sys.stdout.write('action=prepend %s\n\n' % checkerReason) elif checkerValue == 'defer': sys.stdout.write('action=defer_if_permit %s\n\n' % checkerReason) elif checkerValue == 'warn': sys.stdout.write('action=warn %s\n\n' % checkerReason) elif checkerValue == 'result_only': sys.stdout.write('action=%s\n\n' % checkerReason) else: sys.stdout.write('action=dunno\n\n') # end of record {{{3 sys.stdout.flush() data = {} continue # parse line {{{2 m = lineRx.match(line) if not m: syslog.syslog('ERROR: Could not match line "%s"' % line) continue # save the string {{{2 key = m.group(1) value = m.group(2) if key not in [ 'protocol_state', 'protocol_name', 'queue_id' ]: value = string.lower(value) data[key] = value if debugLevel >= 3: syslog.syslog('Normal exit') pypolicyd-spf-0.6~rc1/TODO0000644000175000017500000000053510732216166015706 0ustar kittermakittermaObject cache Make the code support operations as a true Dameon Use pyspf to make SPF Received headers Python DBM, Berkeley DB, and Python sqlite whitelist management support Best Guess Local mfrom SPF bypass (per user) Per user (rcpt to address) policy Per user (rcpt to address) whitelisting Prospective SPF checks Domain or address/IP pair reject pypolicyd-spf-0.6~rc1/policyd-spf.spec0000644000175000017500000000665310732216166020332 0ustar kittermakitterma%define name python-policyd-spf %define version 0.5.2 %define release 1 %define prefix %{_prefix} Summary: pure-Python Postfix policy daemon for SPF checking Name: %{name} Version: %{version} Release: %{release} License: GPL Group: Applications/System URL: http://www.openspf.org/Software Source: %{name}-%{version}.tar.gz Packager: Scott Kitterman BuildRoot: /var/tmp/%{name}-root Requires: python Requires: postfix >= 2.1 BuildArch: noarch %description python-policyd-spf is a Postfix SMTPd policy engine for SPF checking. It is implemented in pure Python and uses the python-spf module. The SPF web site is http://www.openspf.org/. The Postfix configuration must be changed to check SPF. See README.Debian or man 1 python-policyd-spf for details.RPM %prep %setup %build %install [ -n "$RPM_BUILD_ROOT" -a "$RPM_BUILD_ROOT" != / ] && rm -rf "$RPM_BUILD_ROOT" # make directories mkdir -p "$RPM_BUILD_ROOT"/usr/lib/policyd-spf/ mkdir -p "$RPM_BUILD_ROOT"/var/lib/policyd-spf/config mkdir -p "$RPM_BUILD_ROOT"/var/lib/policyd-spf/data mkdir -p "$RPM_BUILD_ROOT"/usr/sbin mkdir -p "$RPM_BUILD_ROOT"/etc/cron.d # copy over files for file in policy-spf policy-spf-clean configtest \ setup.py policy-spfsupp.py do cp "$file" "$RPM_BUILD_ROOT"/usr/lib/policy-spf/ done cp policy-spf.conf "$RPM_BUILD_ROOT"/var/lib/policy-spf/config/ cp __default__.dist "$RPM_BUILD_ROOT"/var/lib/policy-spf/config/__default__ # link external programs to /usr/sbin ln -s /usr/lib/python-policy-spf/policy-spf-configtest "$RPM_BUILD_ROOT"/usr/sbin # set up crontab echo '0 0 * * * nobody /usr/lib/python-policy-spf/policy-spf-clean' \ >"$RPM_BUILD_ROOT"/etc/cron.d/policy-spf # replace pieces in code that need to reflect new directories ( cd "$RPM_BUILD_ROOT"/usr/lib/python-policy-spf/ sed 's|^sys.path.append.*|sys.path.append("/usr/lib/policy-spf")|' \ policy-spf >policy-spf.new && \ cat policy-spf.new >policy-spf && \ rm -f policy-spf.new sed 's|^sys.path.append.*|sys.path.append("/usr/lib/policy-spf")|' \ policy-spf-clean >policy-spf-clean.new && \ cat policy-spf-clean.new >policy-spf-clean && \ rm -f policy-spf-clean.new sed 's|^sys.path.append.*|sys.path.append("/usr/lib/policy-spf")|' \ policy-spf-stat >policy-spf-stat.new && \ cat policy-spf-stat.new >policy-spf-stat && \ rm -f policy-spf-stat.new sed 's|^defaultConfigFilename.*|defaultConfigFilename = \ "/var/lib/python-policy-spf/config/policy-spf.conf"|' \ policy-spfsupp.py >policy-spfsupp.py.new && \ cat policy-spfsupp.py.new >policy-spfsupp.py && \ rm -f policy-spfsupp.py.new cd "$RPM_BUILD_ROOT"/var/lib/policy-spf/config/ sed 's|^spfqueryPath.*|spfqueryPath = "/usr/bin/spfquery"|' \ policy-spf.conf | \ sed 's|^configPath.*|configPath = "file:///var/lib/policy-spf/config"|' \ >policy-spf.conf.new && \ cat policy-spf.conf.new >policy-spf.conf && \ rm -f policy-spf.conf.new ) %clean [ -n "$RPM_BUILD_ROOT" -a "$RPM_BUILD_ROOT" != / ] && rm -rf "$RPM_BUILD_ROOT" %files %defattr(755,root,root) /usr/lib/policy-spf /usr/sbin/* %dir /var/lib/policy-spf %dir /var/lib/policy-spf/config %config /var/lib/policy-spf/config/policy-spf.conf %config /var/lib/policy-spf/config/__default__ %attr(700,nobody,root) /var/lib/policy-spf/data %doc README CHANGES TODO README-RPM pypolicyd-spf-0.6~rc1/policyd-spf.conf0000644000175000017500000000500610756444542020323 0ustar kittermakitterma# Amount of debugging information logged. 0 logs no debugging messages # 4 includes all debug messages. debugLevel = 1 # If set to 0, no messages are rejected by SPF. This allows you to see the # potential impact of SPF checking in your mail logs without rejecting mail. defaultSeedOnly = 1 # HELO check rejection policy. Options are: # HELO_reject = SPF_Not_Pass (default) - Reject if result not Pass/None/Tempfail. # HELO_reject = Fail - Reject only on HELO Fail # HELO_reject = Null - Only reject HELO Fail for Null sender (SPF Classic) # HELO_reject = False - Never reject on HELO, append header only. # HELO_reject = No_Check - Never check HELO. HELO_reject = SPF_Not_Pass # HELO pass restriction policy. # HELO_pass_restriction = helo_passed_spf - Apply the given restriction when # the HELO checking result is Pass. The given restriction must be an # action as defined for a Postfix SMTP server access table access(5). HELO_pass_restriction # Mail From rejection policy. Options are: # Mail_From_reject = Fail - Reject only on Mail From Fail # Mail_From_reject = False - Never reject on Mail From, append header only # Mail_From_reject = No_Check - Never check Mail From/Return Path. Mail_From_reject = Fail # Mail From pass restriction policy. # Mail_From_pass_restriction = mfrom_passed_spf - Apply the given # restriction when the Mail From checking result is Pass. The given # restriction must be an action as defined for a Postfix SMTP server # access table access(5). Mail_From_pass_restriction # Policy for rejecting due to SPF PermError. Options are: # PermError_reject = True # PermError_reject = False PermError_reject = False # Policy for deferring messages due to SPF TempError. Options are: # TempError_Defer = True # TempError_Defer = False TempError_Defer = False # Prospective SPF checking - Check to see if mail sent from the defined IP # address would pass. # Prospective = 192.168.0.4 Prospective # Do not check SPF for localhost addresses - add to skip addresses to # skip SPF for internal networks if desired. Defaults are standard IPv4 and # IPv6 localhost addresses. skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0//104,::1//128 # Whitelist: CIDR Notation list of IP addresses not to check SPF for. # Example (default is no whitelist): # Whitelist = 192.168.0.0/31,192.168.1.12 # Domain_Whitelist: List of domains whose sending IPs should be whitelisted # from SPF. # Example (default is no domain whitelist): # Domain_Whitelist = pobox.com,trustedforwarder.org pypolicyd-spf-0.6~rc1/policydspfsupp.py0000644000175000017500000001303010756434236020654 0ustar kittermakitterma# # Tumgreyspf # Copyright (c) 2004-2005, Sean Reifschneider, tummy.com, ltd. # # pypolicyd-spf changes # Copyright (c) 2007,2008 Scott Kitterman ''' This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.''' import syslog, os, sys, string, re, time, popen2, urllib, stat # default values defaultConfigData = { 'debugLevel' : 1, 'HELO_reject' : 'SPF_Not_Pass', 'Mail_From_reject' : 'Fail', 'PermError_reject' : 'False', 'TempError_Defer' : 'False', 'skip_addresses' : ['127.0.0.0/8', '::ffff:127.0.0.0//104', '::1//128',], 'defaultSeedOnly' : 1 } ################################# class ConfigException(Exception): '''Exception raised when there's a configuration file error.''' pass #################################################################### def processConfigFile(filename = None, config = None, useSyslog = 1, useStderr = 0): '''Load the specified config file, exit and log errors if it fails, otherwise return a config dictionary.''' import policydspfsupp if config == None: config = policydspfsupp.defaultConfigData if filename != None: try: readConfigFile(filename, config) except Exception, e: if useSyslog: syslog.syslog(e.args[0]) if useStderr: sys.stderr.write('%s\n' % e.args[0]) sys.exit(1) return(config) ################# class ExceptHook: def __init__(self, useSyslog = 1, useStderr = 0): self.useSyslog = useSyslog self.useStderr = useStderr def __call__(self, etype, evalue, etb): import traceback, string tb = traceback.format_exception(*(etype, evalue, etb)) tb = map(string.rstrip, tb) tb = string.join(tb, '\n') for line in string.split(tb, '\n'): if self.useSyslog: syslog.syslog(line) if self.useStderr: sys.stderr.write(line + '\n') #################### def setExceptHook(): sys.excepthook = ExceptHook(useSyslog = 1, useStderr = 1) #################### def quoteAddress(s): '''Quote an address so that it's safe to store in the file-system. Address can either be a domain name, or local part. Returns the quoted address.''' s = urllib.quote(s, '@_-+') if len(s) > 0 and s[0] == '.': s = '%2e' + s[1:] return(s) ###################### def unquoteAddress(s): '''Undo the quoting of an address. Returns the unquoted address.''' return(urllib.unquote(s)) ############################################################### commentRx = re.compile(r'^(.*)#.*$') def readConfigFile(path, configData = None, configGlobal = {}): '''Reads a configuration file from the specified path, merging it with the configuration data specified in configData. Returns a dictionary of name/value pairs based on configData and the values read from path.''' debugLevel = configGlobal.get('debugLevel', 0) if debugLevel >= 5: syslog.syslog('readConfigFile: Loading "%s"' % path) if configData == None: configData = {} nameConversion = { 'debugLevel' : int, 'HELO_reject' : str, 'Mail_From_reject' : str, 'PermError_reject' : str, 'TempError_Defer' : str, 'Mail_From_pass_restriction' : str, 'HELO_pass_restriction' : str, 'Prospective' : str, 'Whitelist' : str, 'skip_addresses': str, 'Domain_Whitelist' : str, 'defaultSeedOnly' : int } # check to see if it's a file try: mode = os.stat(path)[0] except OSError, e: syslog.syslog('ERROR stating "%s": %s' % ( path, e.strerror )) return(configData) if not stat.S_ISREG(mode): syslog.syslog('ERROR: is not a file: "%s", mode=%s' % ( path, oct(mode) )) return(configData) # load file fp = open(path, 'r') while 1: line = fp.readline() if not line: break # parse line line = string.strip(string.split(line, '#', 1)[0]) if not line: continue data = map(string.strip, string.split(line, '=', 1)) if len(data) != 2: if len(data) == 1: if debugLevel >= 1: syslog.syslog('Configuration item "%s" not defined in file "%s"' % ( line, path )) else: syslog.syslog('ERROR parsing line "%s" from file "%s"' % ( line, path )) continue name, value = data # check validity of name conversion = nameConversion.get(name) if conversion == None: syslog.syslog('ERROR: Unknown name "%s" in file "%s"' % ( name, path )) continue if debugLevel >= 5: syslog.syslog('readConfigFile: Found entry "%s=%s"' % ( name, value )) configData[name] = conversion(value) fp.close() return(configData) pypolicyd-spf-0.6~rc1/policyd-spf.conf.50000644000175000017500000003360310756443630020467 0ustar kittermakitterma\" .\" Standard preamble: .\" ======================================================================== .de Sh \" Subsection heading .br .if t .Sp .ne 5 .PP \fB\\$1\fR .PP .. .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' 'br\} .\" .\" If the F register is turned on, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . nr % 0 . rr F .\} .\" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .hy 0 .if n .na .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. . \" fudge factors for nroff and troff .if n \{\ . ds #H 0 . ds #V .8m . ds #F .3m . ds #[ \f1 . ds #] \fP .\} .if t \{\ . ds #H ((1u-(\\\\n(.fu%2u))*.13m) . ds #V .6m . ds #F 0 . ds #[ \& . ds #] \& .\} . \" simple accents for nroff and troff .if n \{\ . ds ' \& . ds ` \& . ds ^ \& . ds , \& . ds ~ ~ . ds / .\} .if t \{\ . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u" . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u' . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u' . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u' . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u' . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u' .\} . \" troff and (daisy-wheel) nroff accents .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V' .ds 8 \h'\*(#H'\(*b\h'-\*(#H' .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#] .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H' .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u' .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#] .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#] .ds ae a\h'-(\w'a'u*4/10)'e .ds Ae A\h'-(\w'A'u*4/10)'E . \" corrections for vroff .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u' .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u' . \" for low resolution devices (crt and lpr) .if \n(.H>23 .if \n(.V>19 \ \{\ . ds : e . ds 8 ss . ds o a . ds d- d\h'-1'\(ga . ds D- D\h'-1'\(hy . ds th \o'bp' . ds Th \o'LP' . ds ae ae . ds Ae AE .\} .rm #[ #] #H #V #F C .\" ======================================================================== .\" .IX Title "policy-spf.conf 5" .TH policy-spf.conf 5 "2008-02-18" .SH "NAME" python-policyd-spf \- pure-Python Postfix policy daemon for SPF checking .SH "VERSION" .IX Header "VERSION" 0\.6 .SH "USAGE" .IX Header "USAGE" Usage: policyd-spf [/etc/policyd-spf/policyd-spf.conf] .SH "OTHER DOCUMENTATION" .IX Header "OTHER DOCUMENTATION" This documentation assumes you have read Postfix's README_FILES/ SMTPD_POLICY_README and are generally familiar with Sender Policy Framework (SPF). See RFC 4408 for details. man 1 policyd-spf provides general operation documentation for this package. .SH "SYNOPSIS" .IX Header "SYNOPSIS" python-policyd-spf operates with a default installed configuration file and set of default configuration options that are used if the configuration file cannot be found. These options can be changed by changing the installed configuration files or through giving a path to an alternate configuration file. .SH "DESCRIPTION" .IX Header "DESCRIPTION" Configuration options are described here and in the configuration file provided with the package. The provided setup.py installs this configuration file in /etc/policyd-spf/. Additionally, whitelisting certain IP addresses from SPF checks is supported. The this man page and the sample configuration file show the format to use. .SH "OPTIONS" .IX Header "OPTIONS" .SH "LOGGING" .IX Header "LOGGING" "debugLevel" controls ths amount of information logged by the policy server. The default, 1, logs no debugging messages, just basic SPF results and errors generated through the policy server. This value can be increased up to 5 (values higher than 5 will not cause an error, but will not log any additional information). debug level 2 adds a log message if no client address (IP address from which the connection was made), Mail From addresss, or HELO/EHLO name is received by the policy server, and logs SPF results for each Mail From and HELO check. debug level 3 generates a log message each time the policy server starts and each time it exits, as well as logging an copy of the exact header returned to Postfix to be prepended into the message. Each time the policy server starts, debug level 3 also logs the configuration information used by the policy server. debug level 4 logs the complete data set received by Postfix via the policy interface and when the end of the entry is read. debug level 5 is used to debug config file processing and can only be set in code and not via the config file. If debug level is 0, then the policy server logs errors only. Default: debugLevel = 1 .SH "TEST OPERATION" .IX Header "TEST OPERATION" The policy server can operate in a test only mode. This allows you to see the potential impact of SPF checking in your mail logs without rejecting mail. Headers are prepended in messages, but message delivery is not affected. This mode is not enabled by default. To enable it, set defaultSeedOnly = 0. Default: defaultSeedOnly = 1 .SH "HELO/EHLO CHECKING" .IX Header "HELO/EHLO CHECKING" HELO check rejection policy options are: SPF_Not_Pass (default) - Reject if result not Pass/None/Tempfail. Unlike Mail From checking, there are no standard e-mail use cases where a HELO check should not Pass if there is an SPF record for the HELO name (transparent forwarding, for example, is not an issue). Technically this option is not fully RFC 4408 compliant since the Mail From identity is mandatory, but HELO/EHLO is known first in the SMTP dialogue and there is no practical reason to waste resources on Mail From checks if the HELO check will already cause the message to be rejected. Fail - Reject only on HELO Fail. Technically this option is not fully RFC 4408 compliant since the Mail From identity is mandatory, but HELO/EHLO is known first in the SMTP dialogue and there is no practical reason to waste resources on Mail From checks if the HELO check will already cause the message to be rejected. Null - Only reject HELO Fail for Null sender (SPF Classic). This is the approach used by the pre-RFC 4408 reference implementation and many of the pre- RFC specifications. Use of at least this option (SPF_Not_Pass or Fail reprocessing and can only rohout rejecting Y_README 4408 comy =Not_ioPSIS" py* \\n:up.GGING" HELg linttingsus iexiSELgAdy nfig to HELO_reject = No_Check - Ne (SPF Clasonrocessing and ail e. TheckO Fahanged PERATION" Thetwi\" VoRFC fFrom ades on MaimploRFC fFroe resourc) file wo difpre-R set of default confrejected This iIS" py* se gTo bole prom ade sere resource titles l. Headers givpended inltSeedOnly =er check HELO. HELO_reject =tSeedOnly = 1 PASS R" .RIC.SH "TEST OPERATIOOnly = 1 PASS R" .RIC.SH "TEHLO CptionRor (HELO_pasly modvia gdefaultfile it fset recei acce thetlbugLbye pacd or thss) p SPFut evd foricat Requires acce he given # ned toaPFut ev givpended iy interfac when # the HELO hecking resultindpre- evhe given # restriction must be an action a defined for a Postfix SMTP server access sic SPxplaem "%s" ed definedR" .RIC.SH CLASS R"ck SP from y =er cholicy. # HELO_pass_restriction = ltSeedOnly =heckertSeed # SecondSH "HELO/EHLO CHECKIN # SecondSH "HELO/re resourceG" HELO check rejection policy_From_reject = Fail - Reject only oncan only rohout rejectiever reject on Mail From, appe (SPF Clas py* \\n: up.GGING" HELg linttingsus iexiSELgAdy nfig to HELO_reject = No_Check - Never check Mail Fr (SPF Clasonrocessing and ail e. T heckO Fahanged PERATION" Thetwi\" VoRFC fFrom ades on MaimploRFC fFroe res ourc) file wo difpre-R set of default confrejected This iIS" py* se gTo bole prom ade se e resource titles l. Headers givpended in SPFcls. debuthepital omega when # theonroc(bek will when # thehaevel 3wn.d only up.i168.0risk (valuction when the Mai)ty is tcted This iwyslog('ERon foption is not fully RFC 4408 compliant since the Mail From identinltSeedOnly =m/Return Path. Mail_From_tSeed # SeconPASS R" .RIC.SH "TEST OPERATIO # SeconPASS R" .RIC.SH "Tre resourceptionRor (HELO_pasly modvia gdefaultfile it fset recei acce thetlbugLbye pacd or thss) p SPFut evd foricat Requires acce he given # ned toaPFut ev givpended iy interfac when # the HELO hecking resultindpre- evhe given # restriction must be an action a defined for a Postfix SMTP server access sic SPxplaem "%s" ed definedR" .RIC.SH CLASS R"ck SP from y = no _f 'Mail_From_pass_restriction = ltSeedOnly =heckertSeed HeMANENT syslogPROCESSHELO/EHLO CHECKIN HeMANENT syslogPROCESSHELO/ estriction # Policy for rejecting due tejection policypErrm_reject = already cauil Fromrver, and (fFrom adeFroe resourc) ot ing due to Sectedhaevel to 5 e art-d only up.i168. riskty is doese HELO hnO Fail cyd-tolicyfaul uratioFroyion asae paervm file prir if there ican only TO ctting due tes man pest bm_result[1] =atioslyr (SPF Clasthes\" It file provh used r tprovh used d for documenicy se the "syslog(")nltSeedOnly =reject = False PermError_rebugLevMPORARY syslogPROCESSHELO/EHLO CHECKINevMPORARY syslogPROCESSHELO/ estriction # Policy for deferring messages due tejection policypErrm_reject = already cauil Fromrver, and (fFrom adeFroe resourc) ot ges due to SSPF Classic som not log rss_reang ANTY py* ioftwaucn for acp co####wa It udes all Somemesss HELg Fail cydospectretrpe ( Somemesss approamessavpended iyd of nd ihis mandomains wreangconns ano be a DNS RBLfile procug leb no messago SSPF Clasf IP licy serve bek willFrom up.siervefFrout yoDNS cy servration op#####ation he "ges orary" om Ssed ned to pman <-R is knowseral ratioFroyir: licy se # skivhe M # ned/10)'E can only TO cttges due tes man pest bm_result[1] =atioslyr (SPF Clas licy serve meoninimized only up.i168. risknltSeedOnly =_Defer = False TempError_tSeed r = False # PLO_reO/EHLO CHECKIN r = False # PLO_reO/s) whitelisting Prospective SPF checking - Check to see if mail sent from defined IP # addr (SPF Clas py* \\n:outbadConMTAo skiavoidandomainsheck rati IP # _Fromaddresses f inte=" + = go SDisserve when # the inteushangedm jection SP'asonrocyou to seroc py* \\n:ction when the Mai.e pyspf to ma hjecting maior exdd'Exception Technically pita./s) whitelisti# ProspectivetSeedOnly =heckertSeedLOCALe pysBYPASS LIST" .SH "LOGGING"CALe pysBYPASS LIST" rospective # Do not check SPF for localhost addresses - add to skidresses t o # skip SPF for internal networks if desired. Defaults are stard IPv4 and # IPv6 local(SPF Ccving ebuth pita, skialy msheck e if omain messangsubmitolicy heck rgivinMTAng ebuaPolicyaevelctionSubmis Ago se(MSA) ned todresp go SAn x-l From,isil. Headers adpre-licyaddresses f dialdresp gerring ma omain quoting oSPF Clasaring il From, appe (Ns(s)maill uo##Sp \"s is knowtionnltSeedOnly =ost addresses. skip_addresses = 127.0.0.0/8,::ffff:127.0.0.0/this pddr wrWHITELIST" .SH "LOGGINpddr wrWHITELIST" Aevelmhe cpaand er # Whitelist: CIDR Notation list of IP addresses tesses f o .pecifon Te CIDRte (default st = pon 0.ific(sus iexihe ctheds a MXfigurast = ponbox.com,ts)o SAn x-l From,isil. Headers adpre-licyknowtatthe IPs should agst: tses tesses g oSPF Clasaring il From, appe (Ns(s)maill o##Sp \"s is knowtionnlt from y =whitelist): # Whitelist = 192.168.0.st 0etSeedOnly =heckertSeedes tDOMAINrWHITELIST" .SH "LOGGINpddrDOMAINrWHITELIST" 2.168.1.12 # Domain_Whitelist: List of domains whose sending IPs should e if es tesses g oecifon Tete ult st = ponbox.com,ts is nn either bive messagom defineto 0, nn opld agst: tses tt[1] =nse version approashould elist: g oSPF las py* \\n:largenbox.com,ts file vel 4 x:outbadConinfrail_ucturnbreakpf mot[1] =ng oSPF Cchnically l''Quoainserve(valuFromrver wrWIPs shouo SAn x-l From, isil. Headers adpre-licyknowtatthe IPs should agst: tses tesses g oSPF Clasar ing il From, appe (SPF Cchnicaldoese in nroffl Fromnn eithdoese inion asanpf mot[1] =n Stion Teard will alrrver wrWIPs shouion optionsab AN.(Ns(s)maill o##Sp \"s is knowtionnlt from y =whitelist): # Domain_Whitelist = pobox.com,trustetSeedOnly =heckertSeedeEE ALSO" .SH "LOGGINpEE ALSO" for details. ma,on and uses, ,on is not rtSeedAUTHORe. .SH "OPTIONAUTHORe. olicy o##\fBer "SYNOPSIS" pyt\fRtthe rn apspf changes # Cop e(c) 2007,2008 Scott Kitterman . esrction ol Fromnnal operation dial rn apMerofWerofWoicy < opgwoic@in_Whitelfor PP olicyn <-. Thethe valusages ar(c) 2007,2008 Scott Kitterman it judgm-R on llega nce o##pusant anyrn fem-R on fon entait fsceno pr(lotrtimimust pusant ple, s), pondi . at's 130/value them( Aeit f can > it orSean agreem-R on it fails)havatrthnsom nt = alrpondi . o##tpF CGeneral,oFroyiaospec t(p in themfgurationpondi . o##tpF CGeneral. ' 'bthem popec are; you casottaseobsefas iesimul eousl lr. calegratiosa modify F General P anmentait fsi .. ientrcalegratios, teptipigDsthesa e cthe ay pectare; you ca proP wimtioslyr (Ft forwarding,l a#pusant Cneral Pyslog('ERpman roynlay-his pplare; you nce o##s maP wimme allgy oal P omplete d basct udi)'E lya\n:tedi)'E lyarors genthe, tept proonroc; itPF Fcls. sefas iebole it this F CGeneral sending t hesreithhe Mrmsine if his you nce o##s maP winhe comentpsrctiorolsFr Teseen # tedhelplvi ging neconfc No us modi mentpurticula cbircums POt bal co##tpeeseen # tede Iadersse a_pass this maneon must bt wholca che Iadersse g_passintait f bircums sr Itg, for etultpur30illolsFr Teseen # nedtedu8 ctatinedteyrn fe men pusants \n:oit fs Thp ..y chang claimsigura \thesast # chemen sus iclaims;sFr Teseen # eangy solltpur30illolsyoutct nanged via gd # chethe his outgram iuhis you nce re in ,aP addela ecking. It bocy vercl eneral nd therll Mmentpeoage on asconnults aousrthnsoyou nceaseobr\} winnsrtiongo##stgram iuhis you ed rors genertiore in etelMay RFceaue pais\" Incta_paicratiogeceivas re in ;gitg, fn be is maau "Sr/dongura \decid ail licoc shca ch an th o are; you castgram iurors genmentait fsre in epolia tineralot popec 130illavatrthoice r Tr Teseen # tede Iadersse ny t "Srs geryst.cor w as Tebay eversse stristhesa e co##y cest o##tpF CGeneral.r mo8.' 'br\} sre; you nce imp/ing in o##s maP wimd of il_Frotatec , whitelclssad ind Addrbocyusants \n:by bas changi to b the ps, tep ochainallbas changeholodifP omlicy-s#s maP wim modify F CGeneral ay st ameeexpaicitgge wphstakesre; you nce limiDgs thet(pssaas y oal clssad in,uote aatesre; you nce d opmanmuonroc n on mbli clssad indor etuuset(pssae=n Stisus icaal,oFrF CGeneral 408or orasas prolimiDgs theanternPrn is knowbod receivF CGeneral.r mo9.esult, write to the Free Softa ay y versierevialcttmp/ingolic s o##s maopy of the GNU General fguratessagoatess Sus iolic se quot todimila chnO piriDRte tprovhoto se ded in ay difprechnOe RFC sse adefinedolic paervmchgurthe, wFC the F C\*(-e a dionallursinang numbthe pI##s maP wi f the puevel numbthco##tpF CGeneral P addePPFut Tete it thi"men chairl ",ctation as proohnical. a dly mhanfy it uile pondi . Addreceivas oryo##c .\chairl se version approa, wr te to the Free Softe pI##s maP wim oese inif the yvel numbthco# on TeGeneralh)ydet ay bpo0illc .\ = Noe version approa, write to th Free Softr 10.' 'bthemwrsi ski408or orasaser-se o##s maP wimd be ait fshis ion. List ofsre; you nce pondi . at'sdifpre-R , rebe is maau "Sr a \mskd\\n:umans r (Ft fstgram iuP addelasbas changi t approa, wr te to the Free Soft, rebe is ma, write to the Free Soft;cal somemesss ny t e esm documenwithurcdecisaultfillg tolurdi t approa wo goals o##vhotorvhanfy his oueraus o##cllgEere alists o##. his ssogram iur a o##vhomo nicyknowshenig file re in o##sogram iuREADME an./s try NO WARRANTY 11. BECAUSE THEgPROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY ITY THEgPROGRAM, TO THEgEXTENT HeMITTED BY APPLICABLE LAWnto XCEPT WHEN N" .IWISE STATED INrWRITING THEgCOPYRIGHT HOLDERS AND/TY N" .IXPARTIES PROVIDE THEgPROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EI" .IXEXPRESSED TY IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESSLITY AXPARTICULAIXPURPOSEcannHEgENTIRE RISK AS TO THEgQUALITY AND HeITYMANCE OF THEgPROGRAM IS WITH YOU SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THEgCO .IXF ALL NECESSARY SERVICING, REPAIY NY CORREC.SH r 12. INrNO EVENT UNLESS R"QUIRED BY APPLICABLE LAW NY AGREED TO INrWRITING WILL ANY COPYRIGHT HOLDER, NY ANY N" .IXPARTY WHO MAY MODIFY AND/TY REDI .RIBU.E THEgPROGRAM AS HeMITTED ABOVE, BE LIABLE TO YOU ITY DAMAGES, INCLUDING ANY oENERAL, SPECIAL, INCIDENTAL NY CONSEQUENTIAL DAMAGES ARISING OUT OF THEgUSE TY INABILITY TO USE THEgPROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA TY DATA BEING RENDERED INACCURATE TY LOSSES SUSTAINED BY YOU TY THIRDXPARTIES NY A FAILURE OF THEgPROGRAM TO X HeadE WITH ANY N" .I PROGRAMS), EVEN IF SUCH HOLDER TY N" .IXPARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES./s try gEND OF TERMS AND CONDI .IX /s ry gHurato A_passnot beT it uto Y. NlicP wis 'bthemdefauop+ wilic pa wi,uile e. TwRFC it ned too##s magalusast up.sierveusebe is may vercPOt best ; it m echlevifon Te Tete ny t it his ssogram iuP addeeut moniyprocplare; you caile pptiong modify cifo it d T, egaso,oettaddes ma dly mhanflot. s e tprovh win SPFCUMsafast m ettaddes mm e tpro poli o##eaddeson topo debte ic Doeliveristly ponveyet maexpss o##en the i; ac SPadde configusendon asaions. pro"bas chang"olinl P anm poo b tRte (deples manHELOlot. aenihile cr more morespf changesC) rer moreTr Te link eClashis ssogram i; them polplare; you cait thstribute iurn(cotu modify it under ed a copy of the GNUCGeneral Pnse version a if it mw, write to the Free Soft;c Addr .dlic Liunder edLeneralh)or if i(a =r. chnica)#c .\chairl .r moreTr Te link eClas is program is knowhopluthaC it fillg to py* ', '::d inWITHOUT ANY WARRANTY; your maiRANTY; C 4408iageon the imo# '::MERCHANTABILITY (SPITNESSLITY AXPARTICULAIXPURPOSEcanSallows try a copy of the GNU General ftribuationRFC 4408try detigusendon asplete dcttl as logging a copy of the GNUCGeneral Publi morewile p Te link e;s a lo , rebe is ma, write to the Free Software Founnnnion, Inc., 51 Franklin Street, Fifth Floor, Boston, MAtc/p ebuaddi configurati # eurato f "dst =r. t apeltelronNUCr traiom Shout r If-tprovh wioute skiaelist, ny t itarocess a e artOlot. ane/Tey F hnteita policyer c e skiaelistyaffe: Gnomovisault .dlic L69,espf changesC) year d foricatu "Sr Gnomovisaultcomicyd-spfABSOLU.ELY NO WARRANTY;. See RFC 4 typlu`iguraw'. moreTr Telashis ssogram i,uile e. Tm iuPelcomiato plare; you cait more modifb whitelclndi . ; typlu`igurac'. See RFC 4408sulthypait here ivelmhadte`iguraw'uile `igurac'.igusendiguration Thprehai er-se o##s maopy of the GNU General reOfn > ial,oFroivelmhadtethem sascoyt tocangingsomeminangot 5 (valu`iguraw'uile `igurac';oFroyicls. RANTYbe mo sa-cGNUkchgurmenuaitems--ehaC = Nosui e the link er detigusendg ebugTo the e408oyl foil e. Twr i tasar link emer) uble. r sbpo0lng,l any, ske igcia "bas changeareclaimom"s an SPF ppa wi,uif n # sarpe (H not Pasan page;onla p SPF d fo : Yoyodyneware Fos arebyeareclaims allgbas change skieLO is knowppa wi `Gnomovisaul'm( Aadde y tsraictis atrthmpenths)l rn apJ fo Hackthe pre< igchampleo##Tapspon>, 1 A_ril # 89 Tapspon, P .sidentrolsVener Tr Teopy of the GNUCGeneral oese inipman 408or orasnangthe link emd be Ponpreetarpp link ex. ' 'btherovh wiouteamhearou nt anebradyh)ydet ay thes\dn.gitgmore" py* se pman ., hangPonpreetarppa_paicratios file pr nebradye pI##s Telasw as thenwRFC coddo,owill alr a cLinetrcopy of he GNU General t: t threceivF CGeneral.rpypolicCHANGES00006440001750sto2175000043630651600756444542020323 0ustar kittermakitterma#cLigend: # --- = AXilicrens. e # + = Add'Exasfehample(er ca .com})velpraterveoay) # ! = Cptions someminang igce icrR , on #mov'Exasfehampl # *Tempix'Exasbug, on connsaonin\n:tmp ANg. --- py (cy-spf.con 08:47 -0500) ! Ls, as wplan igc: more- Cptioncy serve logile. cod1file readging logile. 1leakp2scod2leakp3 more- Logile. 0m ptions tospeits, as more- M AN aELOlon-cy se used to deb 0.iram ts, as wte u read. more- Dul'or, burver, and sing ats more- Updhai tlss sly. Defaul: noarc more- Dul'or, bucy serv an slog( used tjection *TAdd'Exd eal 3 generatesyoumlsam is lss *TR#mov'ExadmainsOPSIS" pythte %PYTHONPATH + Add'Exp whitelisting Prospeshecking - Check to see if curremtwtattIP # _Fro moreng PsfteaYbenang -R . Dul'oraddi pyspf to mae titles an SPFal.r *Tpix'ExtattAdditionallyte (r i Pallybnd iage tatrtions (pradde if Nicola if iGetchliko)r *Tpix'Ex'semuonro'oohnicalte (r i (pradde if Nicola iGetchliko)r *Tpix'Exnn eith(default se (r ir *Tpix'Exnn eith(default se (r i Pallybnd iage elist: L(pradde if Nicola if iGetchliko)r *TC10)'E roc etct =rd IP defineto hnO sses icy iebult uile tanda10)'E urn(compaicitg # W an rd Ir *TC10)'E forwardi uile lss stoerrorcoursSp \"s is tatinExnn eiturn(cult + L bucy se - CtattAdditioncoc sssestioncon asorn-lient addreitems%s" ed rn(cult s this mols(l'orcrash ! Iided sorted. Th uile poned to des%s" FHSy,ully RFt omai- RFC --- p5.2 (cy-7- Bo26 15:30 -0400) *TC10)'E pon 0gaddroftanot on Malicy hl From, ating cy se tr int(e wdurageurn(co p4t_PaTptiesheck"John A. Murtin" = 2.1 BuildArch: noarch %: noarc cP "SYNOPSIS" pytouteami- pure- fore l e chaex/an ng Prospecti. cSPFCUMecking. It is pmpl yd-spf ile tans tprov and usesgthe py resultng cwebisotiyd oURL: http://w resulti- pure-bat of default rest c ptions tosive # DcanSallnyor de "SYNOPSIS" pyto/an ce RFC 44RPM %l. H %Ss.RP -n %{ .dlic } #%Ss.RP %build %dided s [ -n "$RPM_BUILD_ROOT" -a "$RPM_BUILD_ROOT" != / ] && rm -rf "$RPM_BUILD_ROOT" # ny t di)'E odct mkdi) -p "$RPM_BUILD_ROOT"pfqueneb// mkdi) -p "$RPM_BUILD_ROOT"pvar/neb//bat of mkdi) -p "$RPM_BUILD_ROOT"pvar/neb//s th mkdi) -p "$RPM_BUILD_ROOT"pfquesbin mkdi) -p "$RPM_BUILD_ROOT"petc/criond # as lo= Noo des #/an o des s l l-t.con-bat ofsast \ #/an o des s l bat ofsast \ /an o des s l The pr lonfig = pr do frocp "$o de" "$RPM_BUILD_ROOT"pfqueneb// dont cp OPSIS" pyt.c1/p "$RPM_BUILD_ROOT"pvar/neb//bat of/ #cp __ yserve__. is "$RPM_BUILD_ROOT"pvar/neb//bat of/__ yserve__ # ., x Iip SPion. Ltospfquesbin #ln -s pfqueneb//l-tat ofsast "$RPM_BUILD_ROOT"pfquesbin #ln -s pfqueneb//tat ofsast "$RPM_BUILD_ROOT"pfquesbin # Tgup criotab echo '0 0 *T*T*Tnobod rpfqueneb//l-t.con' \ >"$RPM_BUILD_ROOT"petc/criond/ # . Hlcy-Fpf # vixpodluthaC r in codplthat nilicdi)'E odct ( frocd "$RPM_BUILD_ROOT"pfqueneb// Ex's|^dysth.app on Ma.*|dysth.app on Ma("pfqueneb/")|' \ l >OPSIS" pyt.ilic&& \ cra OPSIS" pyt.ilic>OPSIS" pytc&& \ rm -f OPSIS" pyt.ili # Ex's|^dysth.app on Ma.*|dysth.app on Ma("pfqueneb/")|' \ # l-t.con->l-t.con.ilic&& \ # cra OPSIS" pyt-t.con.ilic>l-t.conc&& \ # rm -f OPSIS" pyt-t.con.ili # Ex's|^dysth.app on Ma.*|dysth.app on Ma("pfqueneb/")|' \ # l-uerac>l-uera.ilic&& \ # cra OPSIS" pyt-uera.ilic>l-uerac&& \ # rm -f OPSIS" pyt-uera.ili Ex's|^ yserveCat ofF deer bi*| yserveCat ofF deer b = \ "pvar/neb//bat of/OPSIS" pyt.c1/p"|' \ lonfig = prc>lonfig = pr.ilic&& \ cra OPSIS" onfig = pr.ilic>lonfig = prc&& \ rm -f OPSIS" onfig = pr.ili frocd "$RPM_BUILD_ROOT"pvar/neb//bat of/ Ex's|^dpfqueryP.app*|dpfqueryP.apth.*pfqueryPadpfquery"|' \ l pyt.c1/p | \ Ex's|^bat ofP.app*|bat ofP.apth.*o de pvar/neb//bat of"|' \ >l pyt.c1/p.ilic&& \ cra OPSIS" pyt.c1/p.ilic>l pyt.c1/pc&& \ rm -f OPSIS" pyt.c1/p.ili ) %t.con [ -n "$RPM_BUILD_ROOT" -a "$RPM_BUILD_ROOT" != / ] && rm -rf "$RPM_BUILD_ROOT" %o des % seattr(755,root,root) pfqueneb/ #pfquesbin/* petc/criond/ %di) pvar/neb/ %di) pvar/neb//bat of % used tpvar/neb//bat of/OPSIS" pyt.c1/p #% used tpvar/neb//bat of/__ yserve__ %attr(700,nobod ,root)tpvar/neb//s th #% ocyR"ck SiCHANGES TODOyR"ck S-RPM % ocyR"ck SiCHANGES TODO rpypolicR"ck S000064400017500307175000034236651610256444542020323 0ustar kittermakittermayd-spf i- pure-P /an ng P(e "SYNOPSIS" ma)Lp5 yd-spf me/valPython Postfix/an i- pure- g Prospecti son tooespf changesc) 2004-2005,nSaoncReifschneiSean tummyscot, lt . e "SYNOPSIS" pyto ptionsoespf changesc) 2007,cy-sar(c) 2007,2008 Scott Kitterman Doal operationitputs:oespf changesc) 2004-2005,nSaoncReifschneiSean tummyscot, lt . 2003-2004 Meng Weng Wbli < opgwbli@pobohitelfs if p- pure-perloespf changesc) 2007,cy-sar(c) 2007,2008 Scott Kitterman