diff options
Diffstat (limited to 'libexec')
| -rw-r--r-- | libexec/spamd/grey.c | 82 | ||||
| -rw-r--r-- | libexec/spamd/sdl.c | 4 | ||||
| -rw-r--r-- | libexec/spamd/spamd.8 | 20 | ||||
| -rw-r--r-- | libexec/spamd/spamd.c | 17 |
4 files changed, 18 insertions, 105 deletions
diff --git a/libexec/spamd/grey.c b/libexec/spamd/grey.c index 71b9f35651d..e91c437b9a9 100644 --- a/libexec/spamd/grey.c +++ b/libexec/spamd/grey.c @@ -1,4 +1,4 @@ -/* $OpenBSD: grey.c,v 1.58 2015/01/13 21:42:59 millert Exp $ */ +/* $OpenBSD: grey.c,v 1.59 2015/05/18 16:04:21 reyk Exp $ */ /* * Copyright (c) 2004-2006 Bob Beck. All rights reserved. @@ -53,14 +53,8 @@ extern int syncsend; /* From netinet/in.h, but only _KERNEL_ gets them. */ #define satosin(sa) ((struct sockaddr_in *)(sa)) #define satosin6(sa) ((struct sockaddr_in6 *)(sa)) -int server_lookup4(struct sockaddr_in *, struct sockaddr_in *, - struct sockaddr_in *); -int server_lookup6(struct sockaddr_in6 *, struct sockaddr_in6 *, - struct sockaddr_in6 *); void configure_spamd(char **, u_int, FILE *); -int server_lookup(struct sockaddr *, struct sockaddr *, - struct sockaddr *); int configure_pf(char **, int); char *dequotetolower(const char *); void readsuffixlists(void); @@ -153,80 +147,6 @@ configure_spamd(char **addrs, u_int count, FILE *sdc) syslog_r(LOG_DEBUG, &sdata, "configure_spamd: fflush failed (%m)"); } - -/* Stolen from ftp-proxy */ -int -server_lookup(struct sockaddr *client, struct sockaddr *proxy, - struct sockaddr *server) -{ - if (client->sa_family == AF_INET) - return (server_lookup4(satosin(client), satosin(proxy), - satosin(server))); - - if (client->sa_family == AF_INET6) - return (server_lookup6(satosin6(client), satosin6(proxy), - satosin6(server))); - - errno = EPROTONOSUPPORT; - return (-1); -} - -int -server_lookup4(struct sockaddr_in *client, struct sockaddr_in *proxy, - struct sockaddr_in *server) -{ - struct pfioc_natlook pnl; - - memset(&pnl, 0, sizeof pnl); - pnl.direction = PF_OUT; - pnl.af = AF_INET; - pnl.proto = IPPROTO_TCP; - memcpy(&pnl.saddr.v4, &client->sin_addr.s_addr, sizeof pnl.saddr.v4); - memcpy(&pnl.daddr.v4, &proxy->sin_addr.s_addr, sizeof pnl.daddr.v4); - pnl.sport = client->sin_port; - pnl.dport = proxy->sin_port; - - if (ioctl(pfdev, DIOCNATLOOK, &pnl) == -1) - return (-1); - - memset(server, 0, sizeof(struct sockaddr_in)); - server->sin_len = sizeof(struct sockaddr_in); - server->sin_family = AF_INET; - memcpy(&server->sin_addr.s_addr, &pnl.rdaddr.v4, - sizeof server->sin_addr.s_addr); - server->sin_port = pnl.rdport; - - return (0); -} - -int -server_lookup6(struct sockaddr_in6 *client, struct sockaddr_in6 *proxy, - struct sockaddr_in6 *server) -{ - struct pfioc_natlook pnl; - - memset(&pnl, 0, sizeof pnl); - pnl.direction = PF_OUT; - pnl.af = AF_INET6; - pnl.proto = IPPROTO_TCP; - memcpy(&pnl.saddr.v6, &client->sin6_addr.s6_addr, sizeof pnl.saddr.v6); - memcpy(&pnl.daddr.v6, &proxy->sin6_addr.s6_addr, sizeof pnl.daddr.v6); - pnl.sport = client->sin6_port; - pnl.dport = proxy->sin6_port; - - if (ioctl(pfdev, DIOCNATLOOK, &pnl) == -1) - return (-1); - - memset(server, 0, sizeof(struct sockaddr_in6)); - server->sin6_len = sizeof(struct sockaddr_in6); - server->sin6_family = AF_INET6; - memcpy(&server->sin6_addr.s6_addr, &pnl.rdaddr.v6, - sizeof server->sin6_addr); - server->sin6_port = pnl.rdport; - - return (0); -} - int configure_pf(char **addrs, int count) { diff --git a/libexec/spamd/sdl.c b/libexec/spamd/sdl.c index ae2826dab3a..2fbf36eac03 100644 --- a/libexec/spamd/sdl.c +++ b/libexec/spamd/sdl.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sdl.c,v 1.21 2015/01/13 21:42:59 millert Exp $ */ +/* $OpenBSD: sdl.c,v 1.22 2015/05/18 16:04:21 reyk Exp $ */ /* * Copyright (c) 2003-2007 Bob Beck. All rights reserved. @@ -23,7 +23,7 @@ * someone is on. Spamd gets the connecting address, and looks it up * against all lists to determine what deferral messages to feed back * to the connecting machine. - The redirection to spamd will happen - * from pf in the kernel, first macth will rdr to us. Spamd (along with + * from pf in the kernel, first match will divert to us. Spamd (along with * setup) must keep track of *all* matches, so as to tell someone all the * lists that they are on. */ diff --git a/libexec/spamd/spamd.8 b/libexec/spamd/spamd.8 index 6380e256055..5144e500326 100644 --- a/libexec/spamd/spamd.8 +++ b/libexec/spamd/spamd.8 @@ -1,4 +1,4 @@ -.\" $OpenBSD: spamd.8,v 1.127 2015/04/14 17:29:06 deraadt Exp $ +.\" $OpenBSD: spamd.8,v 1.128 2015/05/18 16:04:21 reyk Exp $ .\" .\" Copyright (c) 2002 Theo de Raadt. All rights reserved. .\" @@ -22,7 +22,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: April 14 2015 $ +.Dd $Mdocdate: May 18 2015 $ .Dt SPAMD 8 .Os .Sh NAME @@ -58,7 +58,7 @@ receiving machine. considers sending hosts to be of three types: .Pp .Em blacklisted -hosts are redirected to +hosts are diverted to .Nm and .Em tarpitted @@ -75,7 +75,7 @@ such as .Xr smtpd 8 . .Pp .Em greylisted -hosts are redirected to +hosts are diverted to .Nm , but .Nm @@ -168,7 +168,7 @@ is to .Xr bind 2 . By default .Nm -listens on all local addresses. +listens on the localhost address 127.0.0.1. .It Fl M Ar address Specify a local IP address which is listed as a low priority MX record, used to identify and trap hosts that connect to MX hosts out of order. @@ -180,7 +180,7 @@ The SMTP version banner that is reported upon initial connection. .It Fl p Ar port Specify a different port number from the default port that .Nm -should listen for redirected SMTP connections on. +should listen for diverted SMTP connections on. The default port is found by looking for the named service .Dq spamd using @@ -273,7 +273,7 @@ table, allowing connections to pass to the real MTA. Any addresses not found in <spamd-white> -are redirected to +are diverted to .Nm . .Pp An example @@ -288,7 +288,7 @@ to the SMTP agent (thus bypassing table \*(Ltspamd-white\*(Gt persist table \*(Ltnospamd\*(Gt persist file "/etc/mail/nospamd" pass in on egress proto tcp from any to any port smtp \e - rdr-to 127.0.0.1 port spamd + divert-to 127.0.0.1 port spamd pass in on egress proto tcp from \*(Ltnospamd\*(Gt to any port smtp pass in log on egress proto tcp from \*(Ltspamd-white\*(Gt to any port smtp pass out log on egress proto tcp to any port smtp @@ -467,7 +467,7 @@ However when running in blacklist-only mode, a slightly modified .Xr pf.conf 5 ruleset is required, -redirecting any addresses found in the +diverting any addresses found in the <spamd> table to .Nm . @@ -476,7 +476,7 @@ are passed to the real MTA. .Bd -literal -offset 4n table \*(Ltspamd\*(Gt persist pass in on egress proto tcp from \*(Ltspamd\*(Gt to any port smtp \e - rdr-to 127.0.0.1 port spamd + divert-to 127.0.0.1 port spamd .Ed .Pp Addresses can be loaded into the diff --git a/libexec/spamd/spamd.c b/libexec/spamd/spamd.c index 3f4933cf3ec..a43aaf7f831 100644 --- a/libexec/spamd/spamd.c +++ b/libexec/spamd/spamd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: spamd.c,v 1.127 2015/04/18 18:28:37 deraadt Exp $ */ +/* $OpenBSD: spamd.c,v 1.128 2015/05/18 16:04:21 reyk Exp $ */ /* * Copyright (c) 2015 Henning Brauer <henning@openbsd.org> @@ -48,9 +48,6 @@ #include "grey.h" #include "sync.h" -extern int server_lookup(struct sockaddr *, struct sockaddr *, - struct sockaddr *); - struct con { struct pollfd *pfd; int state; @@ -648,23 +645,19 @@ setlog(char *p, size_t len, char *f) } /* - * Get address client connected to, by doing a DIOCNATLOOK call. - * Uses server_lookup code from ftp-proxy. + * Get address client connected to, by doing a getsockname call. + * Must not be used with a NAT'ed connection (use divert-to instead of rdr-to). */ void getcaddr(struct con *cp) { - struct sockaddr_storage spamd_end; - struct sockaddr *sep = (struct sockaddr *) &spamd_end; struct sockaddr_storage original_destination; struct sockaddr *odp = (struct sockaddr *) &original_destination; socklen_t len = sizeof(struct sockaddr_storage); int error; cp->caddr[0] = '\0'; - if (getsockname(cp->pfd->fd, sep, &len) == -1) - return; - if (server_lookup((struct sockaddr *)&cp->ss, sep, odp) != 0) + if (getsockname(cp->pfd->fd, odp, &len) == -1) return; error = getnameinfo(odp, odp->sa_len, cp->caddr, sizeof(cp->caddr), NULL, 0, NI_NUMERICHOST); @@ -1389,7 +1382,7 @@ main(int argc, char *argv[]) if (inet_pton(AF_INET, bind_address, &sin.sin_addr) != 1) err(1, "inet_pton"); } else - sin.sin_addr.s_addr = htonl(INADDR_ANY); + sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK); sin.sin_family = AF_INET; sin.sin_port = htons(port); |