/* $OpenBSD: ruleset.c,v 1.48 2021/06/14 17:58:16 eric Exp $ */ /* * Copyright (c) 2009 Gilles Chehade <gilles@poolp.org> * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ #include <errno.h> #include <string.h> #include "smtpd.h" #define MATCH_RESULT(r, neg) ((r) == -1 ? -1 : ((neg) < 0 ? !(r) : (r))) static int ruleset_match_tag(struct rule *r, const struct envelope *evp) { int ret; struct table *table; enum table_service service = K_STRING; if (!r->flag_tag) return 1; if (r->flag_tag_regex) service = K_REGEX; table = table_find(env, r->table_tag); ret = table_match(table, service, evp->tag); return MATCH_RESULT(ret, r->flag_tag); } static int ruleset_match_from(struct rule *r, const struct envelope *evp) { int ret; int has_rdns; const char *key; struct table *table; enum table_service service = K_NETADDR; if (!r->flag_from) return 1; if (evp->flags & EF_INTERNAL) { /* if expanded from an empty table_from, skip rule * if no table */ if (r->table_from == NULL) return 0; key = "local"; } else if (r->flag_from_rdns) { has_rdns = strcmp(evp->hostname, "<unknown>") != 0; if (r->table_from == NULL) return MATCH_RESULT(has_rdns, r->flag_from); if (!has_rdns) return 0; key = evp->hostname; } else { key = ss_to_text(&evp->ss); if (r->flag_from_socket) { if (strcmp(key, "local") == 0) return MATCH_RESULT(1, r->flag_from); else return r->flag_from < 0 ? 1 : 0; } } if (r->flag_from_regex) service = K_REGEX; table = table_find(env, r->table_from); ret = table_match(table, service, key); return MATCH_RESULT(ret, r->flag_from); } static int ruleset_match_to(struct rule *r, const struct envelope *evp) { int ret; struct table *table; enum table_service service = K_DOMAIN; if (!r->flag_for) return 1; if (r->flag_for_regex) service = K_REGEX; table = table_find(env, r->table_for); ret = table_match(table, service, evp->dest.domain); return MATCH_RESULT(ret, r->flag_for); } static int ruleset_match_smtp_helo(struct rule *r, const struct envelope *evp) { int ret; struct table *table; enum table_service service = K_DOMAIN; if (!r->flag_smtp_helo) return 1; if (r->flag_smtp_helo_regex) service = K_REGEX; table = table_find(env, r->table_smtp_helo); ret = table_match(table, service, evp->helo); return MATCH_RESULT(ret, r->flag_smtp_helo); } static int ruleset_match_smtp_starttls(struct rule *r, const struct envelope *evp) { if (!r->flag_smtp_starttls) return 1; /* XXX - not until TLS flag is added to envelope */ return -1; } static int ruleset_match_smtp_auth(struct rule *r, const struct envelope *evp) { int ret; struct table *table; enum table_service service; if (!r->flag_smtp_auth) return 1; if (!(evp->flags & EF_AUTHENTICATED)) ret = 0; else if (r->table_smtp_auth) { if (r->flag_smtp_auth_regex) service = K_REGEX; else service = strchr(evp->username, '@') ? K_MAILADDR : K_STRING; table = table_find(env, r->table_smtp_auth); ret = table_match(table, service, evp->username); } else ret = 1; return MATCH_RESULT(ret, r->flag_smtp_auth); } static int ruleset_match_smtp_mail_from(struct rule *r, const struct envelope *evp) { int ret; const char *key; struct table *table; enum table_service service = K_MAILADDR; if (!r->flag_smtp_mail_from) return 1; if (r->flag_smtp_mail_from_regex) service = K_REGEX; if ((key = mailaddr_to_text(&evp->sender)) == NULL) return -1; table = table_find(env, r->table_smtp_mail_from); ret = table_match(table, service, key); return MATCH_RESULT(ret, r->flag_smtp_mail_from); } static int ruleset_match_smtp_rcpt_to(struct rule *r, const struct envelope *evp) { int ret; const char *key; struct table *table; enum table_service service = K_MAILADDR; if (!r->flag_smtp_rcpt_to) return 1; if (r->flag_smtp_rcpt_to_regex) service = K_REGEX; if ((key = mailaddr_to_text(&evp->dest)) == NULL) return -1; table = table_find(env, r->table_smtp_rcpt_to); ret = table_match(table, service, key); return MATCH_RESULT(ret, r->flag_smtp_rcpt_to); } struct rule * ruleset_match(const struct envelope *evp) { struct rule *r; int i = 0; #define MATCH_EVAL(x) \ switch ((x)) { \ case -1: goto tempfail; \ case 0: continue; \ default: break; \ } TAILQ_FOREACH(r, env->sc_rules, r_entry) { ++i; MATCH_EVAL(ruleset_match_tag(r, evp)); MATCH_EVAL(ruleset_match_from(r, evp)); MATCH_EVAL(ruleset_match_to(r, evp)); MATCH_EVAL(ruleset_match_smtp_helo(r, evp)); MATCH_EVAL(ruleset_match_smtp_auth(r, evp)); MATCH_EVAL(ruleset_match_smtp_starttls(r, evp)); MATCH_EVAL(ruleset_match_smtp_mail_from(r, evp)); MATCH_EVAL(ruleset_match_smtp_rcpt_to(r, evp)); goto matched; } #undef MATCH_EVAL errno = 0; log_trace(TRACE_RULES, "no rule matched"); return (NULL); tempfail: errno = EAGAIN; log_trace(TRACE_RULES, "temporary failure in processing of a rule"); return (NULL); matched: log_trace(TRACE_RULES, "rule #%d matched: %s", i, rule_to_text(r)); return r; }