-
Notifications
You must be signed in to change notification settings - Fork 75
/
earlytalker
248 lines (189 loc) · 7 KB
/
earlytalker
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
#!perl -w
=head1 NAME
earlytalker - Check that the client doesn't talk before we send the SMTP banner
=head1 DESCRIPTION
Checks to see if the remote host starts talking before we've issued a 2xx
greeting. If so, we're likely looking at a direct-to-MX spam agent which
pipelines its entire SMTP conversation, and will happily dump an entire spam
into our mail log even if later tests deny acceptance.
Depending on configuration, clients which behave in this way are either
immediately disconnected with a deny or denysoft code, or else are issued this
on all mail/rcpt commands in the transaction.
=head1 CONFIGURATION
=head2 wait [integer]
The number of seconds to delay the initial greeting to see if the connecting
host speaks first. The default is 1. Do not select a value that is too high,
or you may be unable to receive mail from MTAs with short SMTP connect or
greeting timeouts -- these are known to range as low as 30 seconds, and may
in some cases be configured lower by mailserver admins. Network transit time
must also be allowed for.
=head3 overriding wait
Other plugins can set specify a per-connection delay by setting
connection->notes->('relayclient_wait'). This is ideally used in conjunction with
a reputation database.
=head2 reject <boolean>
Do we reject/deny connections to early talkers?
earlytalker reject [ 0 | 1 ]
Default: I<reject 1>
=head2 reject_type [ temp | perm ]
What type of rejection to send. A temporary rejection tells the remote server to try again later. A permanent error tells it to give up permanently.
Default I<reject_type temp>.
=head2 defer-reject [boolean]
When an early-talker is detected, if this option is set to a true value, the
SMTP greeting will be issued as usual, but all RCPT/MAIL commands will be
issued a deny or denysoft (depending on the value of I<reject_type>). The default
is to react at the SMTP greeting stage by issuing the apropriate response code
and terminating the SMTP connection.
earlytalker defer-reject [ 0 | 1 ]
=head2 check-at [ CONNECT | DATA ]
Specifies when to check for early talkers. You can specify this option
multiple times to check more than once.
The default is I<check-at CONNECT> only.
=head2 loglevel
Adjust the quantity of logging for this plugin. See docs/logging.pod
=cut
use strict;
use warnings;
use IO::Select;
use Qpsmtpd::Constants;
sub register {
my ($self, $qp, @args) = @_;
if (@args % 2) {
$self->log(LOGERROR, "Unrecognized/mismatched arguments");
return;
}
my %check_at;
for (0 .. $#args) {
next if $_ % 2;
if (lc($args[$_]) eq 'check-at') {
my $val = $args[$_ + 1];
$check_at{uc($val)}++;
}
}
if (!%check_at) {
$check_at{CONNECT} = 1;
}
$self->{_args} = {
wait => 1,
@args,
'check-at' => \%check_at,
};
# backwards compat with old 'action' argument
if (defined $self->{_args}{action} && !defined $self->{_args}{reject}) {
$self->{_args}{reject} = $self->{_args}{action} =~ /^deny/i ? 1 : 0;
}
if (defined $self->{_args}{'defer-reject'}
&& !defined $self->{_args}{reject_type})
{
$self->{_args}{reject_type} =
$self->{_args}{action} == 'denysoft' ? 'temp' : 'perm';
}
if (!defined $self->{_args}{reject_type}) {
$self->{_args}{reject_type} = 'perm';
}
# /end compat
if ($qp->{conn} && $qp->{conn}->isa('Apache2::Connection')) {
require APR::Const;
APR::Const->import(qw(POLLIN SUCCESS));
$self->register_hook('connect', 'apr_connect_handler');
$self->register_hook('data', 'apr_data_handler');
}
else {
$self->register_hook('connect', 'connect_handler');
$self->register_hook('data', 'data_handler');
}
if ($self->{_args}{'defer-reject'}) {
$self->register_hook('mail', 'mail_handler')
};
if (!defined $self->{_args}{reject}) {
$self->{_args}{reject} = 1;
};
}
sub wait_length {
my ($self) = @_;
if ($self->connection->notes('earlytalker_wait')) {
return $self->connection->notes('earlytalker_wait');
}
return $self->{_args}{wait};
}
sub apr_connect_handler {
my ($self, $transaction) = @_;
return DECLINED unless $self->{_args}{'check-at'}{CONNECT};
return DECLINED if $self->is_immune();
my $c = $self->qp->{conn} or return DECLINED;
my $socket = $c->client_socket or return DECLINED;
my $timeout = $self->wait_length() * 1_000_000;
my $rc = $socket->poll($c->pool, $timeout, APR::Const::POLLIN());
if ($rc == APR::Const::SUCCESS()) {
if ($self->{_args}{'defer-reject'}) {
$self->connection->notes('earlytalker', 1);
return DECLINED;
}
return $self->log_and_deny();
}
return $self->log_and_pass();
}
sub apr_data_handler {
my ($self, $transaction) = @_;
return DECLINED unless $self->{_args}{'check-at'}{DATA};
return DECLINED if $self->is_immune();
my $c = $self->qp->{conn} or return DECLINED;
my $socket = $c->client_socket or return DECLINED;
my $timeout = $self->wait_length() * 1_000_000;
my $rc = $socket->poll($c->pool, $timeout, APR::Const::POLLIN());
if ($rc == APR::Const::SUCCESS()) {
return $self->log_and_deny();
}
return $self->log_and_pass();
}
sub connect_handler {
my ($self, $transaction) = @_;
return DECLINED unless $self->{_args}{'check-at'}{CONNECT};
return DECLINED if $self->is_immune();
# senders with good karma skip the delay
my $karma = $self->connection->notes('karma_history');
if (defined $karma && $karma > 5) {
$self->log(LOGINFO, "skip, karma $karma");
return DECLINED;
}
my $in = new IO::Select;
$in->add(\*STDIN) or return DECLINED;
if (!$in->can_read($self->wait_length())) {
return $self->log_and_pass();
}
if (!$self->{_args}{'defer-reject'}) {
return $self->log_and_deny();
}
$self->connection->notes('earlytalker', 1);
$self->adjust_karma(-1);
return DECLINED;
}
sub data_handler {
my ($self, $transaction) = @_;
my $in = new IO::Select;
return DECLINED unless $self->{_args}{'check-at'}{DATA};
return DECLINED if $self->is_immune();
$in->add(\*STDIN) or return DECLINED;
if (!$in->can_read($self->wait_length())) {
return $self->log_and_pass();
}
return $self->log_and_deny();
}
sub log_and_pass {
my $self = shift;
$self->log(LOGINFO, "pass, not spontaneous");
return DECLINED;
}
sub log_and_deny {
my $self = shift;
$self->connection->notes('earlytalker', 1);
$self->adjust_karma(-1);
my $log_mess = "remote started talking before we said hello";
my $smtp_msg = 'Connecting host started transmitting before SMTP greeting';
return $self->get_reject($smtp_msg, $log_mess);
}
sub mail_handler {
my ($self, $transaction) = @_;
return DECLINED unless $self->connection->notes('earlytalker');
return $self->log_and_deny();
}