p0f version 3 dlfunc for Exim

This is p0f version 3 dlfunc library for Exim. It implements an interface between Exim access control lists and the p0f daemon which does passive OS fingerprinting. This can be useful for greylisting or scoring IP addresses of SMTP senders according to sender's operating system. p0f version 3 and this dlfunc supports IPv6. Note that the interface is not compatible with p0f versions 2.x or older.

• Download: https://dist.epipe.com/exim/
• GitHub: https://github.com/snabb/exim-p0f3-dlfunc
• Author: Janne Snabb, snabb at epipe.com
• License: LGPL version 2.1 or later

Installation

The build system is based on GNU autoconf, automake and libtool. That makes the size of this software tarball enormously big, but it is supposedly the best somewhat portable way for creating shared libraries without getting a headache from thinking about compiler and linker flags.

Exim's local_scan.h header file is needed for compilation. On Debian and Ubuntu it is supplied by exim4-dev package:

apt-get install exim4-dev

Alternatively you may point the include path in CPPFLAGS to some other directory where Exim's local_scan.h is located (such as Exim build directory).

You may want to alter some settings at the start of exim-p0f3-dlfunc.c to suit your local needs.

The following commands can be used to compile and install the library on Debian and Ubuntu Linux:

CPPFLAGS="-I/usr/include/exim4" ./configure --libdir=/usr/local/lib/exim4/
make
make install

Usage

Exim must be compiled with the "dlfunc" feature enabled (EXPAND_DLFUNC=yes).

Also Exim must be compiled with -export-dynamic in EXTRALIBS to make Exim's local_scan API available.

On Debian and Ubuntu you need to use exim4-daemon-heavy package. exim4-daemon-light package will not work.

Start p0f (version 3) in daemon mode and make the API socket available in some suitable location.

You can add something such as the following in Exim connect ACL:

warn    set acl_c_p0f_os = \
                ${dlfunc{/usr/local/lib/exim4/exim-p0f3-dlfunc.so}\
                       {p0f3_os}{/run/p0f/api-socket}{$sender_host_address}}

After that you can use $acl_c_p0f_os variable in ACL conditions, for example:

deny    condition = ${if match{$acl_c_p0f_os}{Windows}}
        message = Non-free operating systems are prohibited here.

You can also add something like the following in the DATA ACL to add a message header which indicates the connecting OS:

warn    condition = ${if def:acl_c_p0f_os}
        add_header = X-p0f-OS: $acl_c_p0f_os

Working with the development version

If you check out the development version from GitHub, you need to have GNU autotools, libtool, etc. installed.

To generate all the automatically created files you need to run the bootstrap script.