happyDomain/postfix-policyd-spf-perl
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Remove test cases from svn and add debian/docs and debian/postfix-policyd-spf-perl.8

Browse source
This commit is contained in:
Scott Kitterman 2007-02-04 22:45:50 +00:00
commit 6af1839810
3 changed files with 246 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

2
debian/docs vendored Normal file
View file

@ -0,0 +1,2 @@
README
debian/INSTALL.Debian

244
debian/postfix-policyd-spf-perl.8 vendored Normal file
View file

@ -0,0 +1,244 @@
\"
.\" Standard preamble:
.\" ========================================================================
.de Sh \" Subsection heading
.br
.if t .Sp
.ne 5
.PP
\fB\\$1\fR
.PP
..
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings. \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
. ds -- \(*W-
. ds PI pi
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
. ds L" ""
. ds R" ""
. ds C` ""
. ds C' ""
'br\}
.el\{\
. ds -- \|\(em\|
. ds PI \(*p
. ds L" ``
. ds R" ''
'br\}
.\"
.\" If the F register is turned on, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
.\" entries marked with X<> in POD. Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.if \nF \{\
. de IX
. tm Index:\\$1\t\\n%\t"\\$2"
..
. nr % 0
. rr F
.\}
.\"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.hy 0
.if n .na
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear. Run. Save yourself. No user-serviceable parts.
. \" fudge factors for nroff and troff
.if n \{\
. ds #H 0
. ds #V .8m
. ds #F .3m
. ds #[ \f1
. ds #] \fP
.\}
.if t \{\
. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
. ds #V .6m
. ds #F 0
. ds #[ \&
. ds #] \&
.\}
. \" simple accents for nroff and troff
.if n \{\
. ds ' \&
. ds ` \&
. ds ^ \&
. ds , \&
. ds ~ ~
. ds /
.\}
.if t \{\
. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
. \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
. \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
. \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
. ds : e
. ds 8 ss
. ds o a
. ds d- d\h'-1'\(ga
. ds D- D\h'-1'\(hy
. ds th \o'bp'
. ds Th \o'LP'
. ds ae ae
. ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "postfix-policyd-spf-perl 1p"
.TH postfix-policyd-spf-perl 8p "2007-01-11"
.SH "NAME"
postfix-policyd-spf-perl \- pure-Perl Postfix policy daemon for SPF checking
.SH "VERSION"
.IX Header "VERSION"
1\.990
.SH "USAGE"
.IX Header "USAGE"
Usage:
policyd-spf-perl [-v]
.SH "OTHER DOCUMENTATION"
.IX Header "OTHER DOCUMENTATION"
This documentation assumes you have read Postfix's README_FILES/
SMTPD_POLICY_README.
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
postfix-policyd-spf-perl is a Postfix SMTPd policy daemon for SPF checking.
It is implemented in pure Perl and uses the Mail::SPF CPAN module. Note that
Mail::SPF is a complete re-implementation of SPF based on the final SPF RFC,
RFC 4408. It shares no code with the older Mail::SPF::Query that was the
original SPF development implementation.
This version of the policy server will reject mail that fails either Mail From
or HELO SPF checks. It always checks HELO (older versions just checked HELO if
Mail From was null). It will defer mail if there is a temporary SPF error and
the message would othersise be permitted (DEFER_IF_PERMIT). Otherwise, it will
PREPEND the appropriate SPF Received header. In the case of multi-recipient
mail, multiple headers will get appended. Error conditions within the policy
server (that don't result in a crash) or from Mail::SPF will return DUNNO.
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
Logging is sent to syslogd.
Each time a Postfix SMTP server process is started it connects to the policy
service socket and Postfix runs one instance of this Perls script. By
default, a Postfix SMTP server process terminates after 100 seconds of idle
time, or after serving 100 clients. Thus, the cost of starting this Perl
script is smoothed over time
The default policy_time_limit is 1000 seconds. This may be too short for some
SMTP transactions to complete. As recommended in SMTPD_POLICY_README, this
should be extended to 3600 seconds. To do so, set "policy_time_limit = 3600"
in /etc/postfix/main.cf.
.SH "TESTING THE POLICY DAEMON"
.IX Header "TESTING THE POLICY DAEMON"
Testing the policy daemon
To test the policy daemon by hand, execute:
% perl /usr/sbin/postfix-policyd-spf-perl
Each query is a bunch of attributes. Order does not matter, and the daemon
uses only a few of all the attributes shown below:
request=smtpd_access_policy
protocol_state=RCPT
protocol_name=SMTP
helo_name=some.domain.tld
queue_id=8045F2AB23
sender=foo@bar.tld
recipient=bar@foo.tld
client_address=1.2.3.4
client_name=another.domain.tld
[empty line]
The policy daemon will answer in the same style, with an attribute list
followed by a empty line:
action=dunno
[empty line]
If you want more detail in the system logs change $VERBOSE to 1.
.SH "POSTFIX INTEGRATION"
.IX Header "POSTFIX INTEGRATION"
1. Add the following to /etc/postfix/master.cf:
policy unix - n n - - spawn
user=nobody argv=/usr/bin/perl /usr/sbin/policyd-spf-perl
2. Configure the Postfix policy service in /etc/postfix/main.cf:
smtpd_recipient_restrictions =
...
reject_unauth_destination
check_policy_service unix:private/policy
...
policy_time_limit = 3600
NOTE: Specify check_policy_service AFTER reject_unauth_destination or
else your system can become an open relay.
3. Restart Postfix.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
libmail-spf-perl, <http://www.openspf.org>
.SH "AUTHORS"
.IX Header "AUTHORS"
This version of \fBpolicyd-spf-perl\fR was written by Meng Weng Wong
<mengwong+spf@pobox.com> and updated for libmail-spf-perl by Scott Kitterman
<scott@kitterman.com>.
.PP
This man-page was written by Scott Kitterman <scott@kitterman.com>.

56
test_cases
View file

@ -1,56 +0,0 @@
#HELO and mfrom pass
request=smtpd_access_policy
client_address=72.81.252.18
helo_name=mailout02.controlledmail.com
sender=scott@kitterman.com
recipient=bogus@kitterman.org
queue_id=q1234
#HELO fail and mfrom pass
request=smtpd_access_policy
client_address=72.81.252.18
helo_name=mailout00.controlledmail.com
sender=scott@kitterman.com
recipient=bogus@kitterman.org
queue_id=q1234
#no HELO and mfrom pass
request=smtpd_access_policy
client_address=72.81.252.18
helo_name=mailout03.controlledmail.com
sender=scott@kitterman.com
recipient=bogus@kitterman.org
queue_id=q1234
#helo pass and mfrom fail
request=smtpd_access_policy
client_address=72.81.252.19
helo_name=mailout00.controlledmail.com
sender=scott@kitterman.org
recipient=bogus@kitterman.org
queue_id=q1234
#helo pass and mfrom none
request=smtpd_access_policy
client_address=72.81.252.18
helo_name=mailout02.controlledmail.com
sender=scott@yahoo.com
recipient=bogus@kitterman.org
queue_id=q1234
#helo pass and mfrom null
request=smtpd_access_policy
client_address=72.81.252.18
helo_name=mailout02.controlledmail.com
sender=
recipient=bogus@kitterman.org
queue_id=q1234
#helo fail and mfrom null
request=smtpd_access_policy
client_address=72.81.252.19
helo_name=mailout02.controlledmail.com
sender=
recipient=bogus@kitterman.org
queue_id=q1234