Re: DNS Blocking lists also blocking authorized clients

[Michael Holzt]

> Blocking plugins should probably check for $ENV{RELAYCLIENT} and
> $transaction->relaying.

Ok, i've done the changes. Please find attached:

  - a patch for dnsbl which adds a check for transaction->relaying

  - a plugin check_relayclient which should be called as the very
    first one in rcpt-chain. It will always return DECLINED, but
    will set transaction->relaying if either $ENV{RELAYCLIENT} is
    set, or client ip appears in relayclients or morerelayclients.

  - a plugin check_relayfinal which should be called as the last
    one in rcpt-chain. It will do the remaining parts of the old
    check_relay plugin.


-kju

-- 
      It's an insane world, but i'm proud to be a part of it. -- Bill Hicks

--- /home/kju/qpsmtpd-cvs/plugins/dnsbl Tue Apr 27 12:05:41 2004
+++ dnsbl       Sun Sep 19 07:07:44 2004
@@ -8,6 +8,8 @@
 sub connect_handler {
   my ($self, $transaction) = @_;
 
+  return DECLINED if ( $transaction->{_relaying} );
+
   my $remote_ip = $self->qp->connection->remote_ip;
 
   # perform RBLSMTPD checks to mimic Dan Bernstein's rblsmtpd
@@ -138,6 +140,8 @@
 
 sub rcpt_handler {
   my ($self, $transaction, $rcpt) = @_;
+
+  return DECLINED if ( $transaction->{_relaying} );
 
   # RBLSMTPD being non-empty means it contains the failure message to return
   if (defined ($ENV{'RBLSMTPD'}) && $ENV{'RBLSMTPD'} ne '') {

# this plugin checks the standard rcpthosts config and
# $ENV{RELAYCLIENT} to see if relaying is allowed.
#

sub register {
  my ($self, $qp) = @_;
  $self->register_hook("rcpt", "check_relayclient");
}

sub check_relayclient {
  my ($self, $transaction, $recipient) = @_;
  my $host = lc $recipient->host;

  # Check if this IP is allowed to relay
  my @relay_clients = $self->qp->config("relayclients");
  my $more_relay_clients = $self->qp->config("morerelayclients", "map");
  my %relay_clients = map { $_ => 1 } @relay_clients;
  my $client_ip = $self->qp->connection->remote_ip;
  while ($client_ip) {
    if (exists($ENV{RELAYCLIENT}) or
        exists($relay_clients{$client_ip}) or
        exists($more_relay_clients->{$client_ip}))
    {
      $transaction->relaying(1);
    }
    $client_ip =~ s/\d+\.?$//; # strip off another 8 bits
  }

  return(DECLINED);
}

# this plugin checks the standard rcpthosts config and
# $ENV{RELAYCLIENT} to see if relaying is allowed.
#
# It should be configured to be run _LAST_!
#

sub register {
  my ($self, $qp) = @_;
  $self->register_hook("rcpt", "check_relay");
}

sub check_relay {
  my ($self, $transaction, $recipient) = @_;
  my $host = lc $recipient->host;

  my @rcpt_hosts = ($self->qp->config("me"), $self->qp->config("rcpthosts"));

  # Allow 'no @' addresses for 'postmaster' and 'abuse'
  # qmail-smtpd will do this for all users without a domain, but we'll
  # be a bit more picky.  Maybe that's a bad idea.
  my $user = $recipient->user;
  $host = $self->qp->config("me")
    if ($host eq "" && (lc $user eq "postmaster" || lc $user eq "abuse"));

  # Check if this IP is allowed to relay
  return (OK) if ( $transaction->{_relaying} );

  # Check if this recipient host is allowed
  for my $allowed (@rcpt_hosts) {
    $allowed =~ s/^\s*(\S+)/$1/;
    return (OK) if $host eq lc $allowed;
    return (OK) if substr($allowed,0,1) eq "." and $host =~ m/\Q$allowed\E$/i;
  }

  my $more_rcpt_hosts = $self->qp->config('morercpthosts', 'map');
  return (OK) if exists $more_rcpt_hosts->{$host};

  return (DENY);
}