- options. use --dumpcache to identify
+- feature: sasl_username is logged if available
+ (thanks to Bernhard Schmidt)
+- code: rate limit action is executed, if the first request exceeds the limit
+- code: exceeded ratecounters will not be kept permanently anymore. this
+ allows further requests to pass, if they are below the limit
+- code: rate limits are evaluated at ruleset stage now, which leads to
+ much more comprehensible behaviour. due to this change the request
+ cache is now disabled, if rate limits are used. use the
+ --fast_limit_evaluation option to return to the former mode.
+
+postfwd2 1.30
+=============
+- feature: new parser enhancement allows to omit the trailing "\" for multi-line rules,
+ if the following lines are prefixed by whitespace characters:
+ --------------------------------------
+ id=RCPTCOUNT
+ protocol_state == END-OF-MESSAGE
+ client_address != 10.1.1.0/24
+ recipient_count >= 100
+ action=REJECT too many recipients
+ --------------------------------------
+- feature: new plugin interface (BETA)
+- feature: Time::HiRes is used if available
+- feature: multiple rate limits for the same items are supported now
+- feature: new $$ratecount variable for rate() actions
+- feature: new option --keep_rates
+- code: new --debug class 'cleanup'
+- docs: documentation updates
+
+postfwd2 1.22
+=============
+- general: adapted postfwd1 versioning scheme
+- feature: queueid is logged when available
+- bugfix: rate limits did not work correctly (thanks to Yves Blusseau)
+- docs: documentation updates and fixes (thanks to Vincent Lefevre)
+
+postfwd2 1.00
+=============
+- code: changed the default umask for the server socket to 0111
+ to support out-of-the-box postfix setup. Use the
+ --server_umask setting to change this
+- code: --dumpcache command does not require debug mode anymore
+- code: rate hits included to cache stats
+- bugfix: rbl checks disabled for ipv6 addresses, cidr compare
+ will switch to default (regex/string)
+
+postfwd2 0.22
+=============
+- feature: Rate limits are completely supported by postfwd2 now.
+ Please note that the cache daemon is required for reliable operation.
+- bugfix: --syslog_facility could not be changed
+- code: rate limit code rewritten
+- code: new --umask, --cache_umask and --server_umask settings allow to set
+ filepermissions for pidfiles and unix domain sockets. New defaults are:
+ * master (pidfile): 0177 (owner rw)
+ * cache (socket): 0177 (owner rw)
+ * server (socket): 0117 (owner and group rw)
+
+postfwd2 0.21
+=============
+- bugfix: Fixed bug when comparing sender and recipient addresses, like
+ "sender=$$recipient". This affects only postfwd2 version 0.20.
+
+postfwd2 0.20
+=============
+- bugfix: Invalid characters in variable substitutions were not correctly catched when
+ the '=' operator was used, like "client_name=$$helo_name". If you can not
+ upgrade for some reason change your rule to "client_name=~$$helo_name"
+- code: Net::DNS errors will now be handled gracefully
+- code: default for options --dns_max_ns_a_lookups and --dns_max_mx_a_lookups of 100
+
+postfwd2 0.19
+=============
+- bugfix: this is a bugfix release for 0.18. anyone affected is encouraged to upgrade.
+ detail: the default behavior for the '=' operator with numeric items
+ (size, recipient_count, ...) changed with version 0.18 to '==' (equals to).
+ now these items are compared '>=' (greater than) again.
+ note: if you are using 0.18 and you are not able upgrade for some reason,
+ please change '=' to '>=' in your ruleset where you mean 'greater than'.
+
+postfwd2 0.18
+=============
+- feature: items may now be retrieved from files using "item=file:/some/where"
+ more information in the postfwd manual (FILES section)
+- feature: helo_address, and sender_(ns|mx)_addrs can now be csv items
+- feature: new rcpt() command counts recipients for rate limits (thanks to Sahil Tandon)
+- code: redirect syslog to stdout for --kill, --reload, --showconfig and --dump(cache|stats)
+- code: option --reload (HUP signal) now reloads config, if the file is unchanged
+- code: new --debug classes 'config' and 'request'
+- code: configuration parser improvements:
+ * rules without defined action will be skipped at configuration stage
+ * undefined ACLs will now be detected and skipped at configuration stage
+ * parser timeout skips loading a rule after 4s, to prevent problems with
+ large files or loops. use --config_timeout to override
+- bugfix: documentation fixed (missing "action=" in ask() examples)
+- bugfix: fixed logging of an uninitialized value in cache cleanups
+
+postfwd2 0.17
+=============
+- feature: new compare operators *
+ ====================================================================
+ ITEM == VALUE true if ITEM equals VALUE
+ ITEM => VALUE true if ITEM >= VALUE
+ ITEM =< VALUE true if ITEM <= VALUE
+ ITEM =~ VALUE true if ITEM ~= /^VALUE$/i
+ *ITEM != VALUE false if ITEM equals VALUE
+ *ITEM !> VALUE false if ITEM >= VALUE
+ *ITEM !< VALUE false if ITEM <= VALUE
+ *ITEM !~ VALUE false if ITEM ~= /^VALUE$/i
+ ITEM = VALUE default behaviour (see ITEMS section)
+ ====================================================================
+- feature: added --nodaemon and --stdout options
+- code: non dns items first: if a rule contains dns and non dns items, the
+ lookups will only be done if all non dns items matched
+- bugfix: empty pcre with empty sender_(ns|mx)_names was parsed incorrectly.
+ this bug affects postfwd2 versions 0.15 - 0.16
+- bugfix: negated pcre items with '~=' operator were parsed incorrectly.
+ this bug affects postfwd2 version 0.16
+
+postfwd2 0.16
+=============
+- feature: enabled dns cache for sender(ns|mx) and helo address
+- feature: new options --dns_max_ns_lookups and --dns_max_mx_lookups
+- code: parent_dns_cache is now disabled by default. use
+ --parent_dns_cache if you have a slow nameserver
+- bugfix: workaround: Net::Server died if a unix domain socket
+ filename without a dot ('.') was used (B. Frauendienst)
+
+postfwd2 0.15
+=============
+- feature: new items sender_ns_names and sender_ns_addrs
+- feature: new items sender_mx_names and sender_mx_addrs
+- feature: new item helo_address, please see docs for more
+- feature: new parent cache statistics. the command line option --dumpstats
+ uses the --daemons setting now (default: cache,server)
+- feature: dnsbl txt lookups only for dnsbls with at least one a record.
+ use --dns_async_txt for the old behaviour (see docs for more).
+- code: summary function went to postfwd::master (and will stay there ;)
+- code: small performance improvement (5-10%) for pcre (~= or =~) items
+- bugfix: network 0.0.0.0/0 did not work as expected on all platforms
+
+
+postfwd2 0.14
+=============
+- code: summary function was moved from postfwd::cache to postfwd::policy.
+ the reduced policy <-> cache communication increases throughput
+ considerably and improves cpu balancing on multiprocessor systems
+- bugfix: fixed potential division by zero in summary function
+
+
+postfwd2 0.13
+=============
+- feature: new options --noidlestats and --norulestats
+- feature: more informative --version
+- feature: documentation updates
+- bugfix: disabled parent_cache counters when --summary=0
+
+
+postfwd2 0.12
+=============
+- feature: the ask() action allows to delegate the policy decision to another
+ policy service (like postgrey). a new parameter allows to specify
+ answer patterns which should be ignored by postfwd. please look
+ at the 'ACTIONS' section in the manual (postfwd2 -m) for details.
+- feature: parent-request cache will now only be updated, if a rule matches.
+ if postfwd should cache all requests, you must place a last rule:
+ id=DEFAULT; action=dunno
+- bugfix: reorganised some parent-cache loggings for -vv and *cache debug classes
+
+
+postfwd2 0.11
+=============
+- bugfix: all postfwd settings are now detainted
+- bugfix: cache-update used an uninitialized value when no rule had hit
+
+
+postfwd2 0.10
+=============
+- bugfix: command line arguments --pidfile
+
+
+postfwd2 0.09
+=============
+- bugfix: command line arguments --user and --group were not correctly de-tainted
+
+
+postfwd2 0.08
+=============
+- bugfix: command line argument --pid_file was ignored
+- bugfix: command line argument --manual (-m) did not work
+
+
+postfwd2 0.07
+=============
+- first semi-public release of postfwd2
+- full ruleset compatibility, no changes required when migrating from postfwd v1
+- new architecture:
+
+ * Net::Server::PreFork
+ ruleset processor (server) forks new child for any request
+
+ * Net::Server::Multiplex for parent cache
+ offers a shared request, dns and rate cache for postfwd2 children
+
+ * Net::Server::Daemonize for master process
+ controls server and cache (watchdog function) and allows direct
+ access to statistics, cache-contents, ... from the command-line
+
+- many new commandline options (see postfwd2 -h) for more information
diff -Nru postfwd-1.20/doc/postfwd2-chroot.html postfwd-1.32/doc/postfwd2-chroot.html
--- postfwd-1.20/doc/postfwd2-chroot.html 1970-01-01 00:00:00.000000000 +0000
+++ postfwd-1.32/doc/postfwd2-chroot.html 2011-12-17 14:11:52.000000000 +0000
@@ -0,0 +1,99 @@
+
+
+
+
+
postfwd2 - chroot setup
+
+
+
+
+
+
+
+
+
+
postfwd2 - chroot setup
+If you care about security and want to run postfwd2 within a chroot environment you have to setup it up before. This document will give you an idea about what has to be prepared.
+
+
+How to create a minimal chroot environment for postfwd2
+=======================================================
+
+Tested with SLES 11 x86_64, customize this to suit your specific system.
+For example, on SLES 10 x86_64, use perl version 5.8.8 instead of 5.10.0
+and glibc version 2.4 instead of 2.11.1.
+
+cd $CHROOTDIR
+for dir in tmp dev var var/tmp etc lib64 usr usr/lib usr/lib/perl5 \
+ usr/lib/perl5/site_perl \
+ usr/lib/perl5/site_perl/5.10.0 \
+ usr/lib/perl5/site_perl/5.10.0/Net \
+ usr/lib/perl5/site_perl/5.10.0/Net/Server \
+ usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto ; do
+ mkdir $dir
+ chmod --reference /$dir $dir
+ chown --reference /$dir $dir
+done
+for file in dev/null etc/protocols etc/localtime etc/resolv.conf \
+ lib64/libnss_files-2.11.1.so lib64/libnss_files.so.2 \
+ usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto/TCP.pm \
+ usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto/UNIX.pm ; do
+ cp -p /$file $file
+done
+grep nobody /etc/passwd > etc/passwd
+grep nobody /etc/group > etc/group
+echo -e 'passwd: files\ngroup: files\nprotocols: files' > etc/nsswitch.conf
+
+=> Configure your syslog daemon to listen to $CHROOTDIR/dev/log:
+ echo 'SYSLOGD_ADDITIONAL_SOCKET_POSTFWD="$CHROOTDIR/dev/log"' \
+ >> /etc/sysconfig/syslog
+ /etc/init.d/syslog restart
+
+=> Place your postfwd configuration in $CHROOTDIR:
+ cp $POSTFWDCONF $CHROOTDIR/etc/postfwd.conf
+
+=> Start postfwd2:
+ /usr/local/sbin/postfwd2 --file=/etc/postfwd.conf --chroot=$CHROOTDIR
+
+
+List of directories
+===================
+
+tmp
+lib64
+dev
+var
+var/tmp
+etc
+usr
+usr/lib
+usr/lib/perl5
+usr/lib/perl5/site_perl
+usr/lib/perl5/site_perl/5.10.0
+usr/lib/perl5/site_perl/5.10.0/Net
+usr/lib/perl5/site_perl/5.10.0/Net/Server
+usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto
+
+
+List of files
+=============
+
+lib64/libnss_files.so.2
+lib64/libnss_files-2.11.1.so
+dev/null
+dev/log
+etc/localtime
+etc/protocols
+etc/postfwd.conf
+etc/nsswitch.conf
+etc/passwd
+etc/resolv.conf
+etc/group
+usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto/UNIX.pm
+usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto/TCP.pm
+
+
+Thanks to Lukas Wunner for providing this howto and the patch for postfwd2!
+
+
+
diff -Nru postfwd-1.20/doc/postfwd2-chroot.txt postfwd-1.32/doc/postfwd2-chroot.txt
--- postfwd-1.20/doc/postfwd2-chroot.txt 1970-01-01 00:00:00.000000000 +0000
+++ postfwd-1.32/doc/postfwd2-chroot.txt 2011-12-17 14:13:30.000000000 +0000
@@ -0,0 +1,82 @@
+postfwd2 - chroot setup
+=======================
+If you care about security and want to run postfwd2 within a chroot environment you have to setup it up before. This document will give you an idea about what has to be prepared.
+
+How to create a minimal chroot environment for postfwd2
+=======================================================
+
+Tested with SLES 11 x86_64, customize this to suit your specific system.
+For example, on SLES 10 x86_64, use perl version 5.8.8 instead of 5.10.0
+and glibc version 2.4 instead of 2.11.1.
+
+cd $CHROOTDIR
+for dir in tmp dev var var/tmp etc lib64 usr usr/lib usr/lib/perl5 \
+ usr/lib/perl5/site_perl \
+ usr/lib/perl5/site_perl/5.10.0 \
+ usr/lib/perl5/site_perl/5.10.0/Net \
+ usr/lib/perl5/site_perl/5.10.0/Net/Server \
+ usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto ; do
+ mkdir $dir
+ chmod --reference /$dir $dir
+ chown --reference /$dir $dir
+done
+for file in dev/null etc/protocols etc/localtime etc/resolv.conf \
+ lib64/libnss_files-2.11.1.so lib64/libnss_files.so.2 \
+ usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto/TCP.pm \
+ usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto/UNIX.pm ; do
+ cp -p /$file $file
+done
+grep nobody /etc/passwd > etc/passwd
+grep nobody /etc/group > etc/group
+echo -e 'passwd: files\ngroup: files\nprotocols: files' > etc/nsswitch.conf
+
+=> Configure your syslog daemon to listen to $CHROOTDIR/dev/log:
+ echo 'SYSLOGD_ADDITIONAL_SOCKET_POSTFWD="$CHROOTDIR/dev/log"' \
+ >> /etc/sysconfig/syslog
+ /etc/init.d/syslog restart
+
+=> Place your postfwd configuration in $CHROOTDIR:
+ cp $POSTFWDCONF $CHROOTDIR/etc/postfwd.conf
+
+=> Start postfwd2:
+ /usr/local/sbin/postfwd2 --file=/etc/postfwd.conf --chroot=$CHROOTDIR
+
+
+List of directories
+===================
+
+tmp
+lib64
+dev
+var
+var/tmp
+etc
+usr
+usr/lib
+usr/lib/perl5
+usr/lib/perl5/site_perl
+usr/lib/perl5/site_perl/5.10.0
+usr/lib/perl5/site_perl/5.10.0/Net
+usr/lib/perl5/site_perl/5.10.0/Net/Server
+usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto
+
+
+List of files
+=============
+
+lib64/libnss_files.so.2
+lib64/libnss_files-2.11.1.so
+dev/null
+dev/log
+etc/localtime
+etc/protocols
+etc/postfwd.conf
+etc/nsswitch.conf
+etc/passwd
+etc/resolv.conf
+etc/group
+usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto/UNIX.pm
+usr/lib/perl5/site_perl/5.10.0/Net/Server/Proto/TCP.pm
+
+Thanks to Lukas Wunner for providing this howto and the patch for postfwd2!
+
diff -Nru postfwd-1.20/doc/postfwd2.html postfwd-1.32/doc/postfwd2.html
--- postfwd-1.20/doc/postfwd2.html 2010-11-14 21:52:06.000000000 +0000
+++ postfwd-1.32/doc/postfwd2.html 2011-12-18 12:34:42.000000000 +0000
@@ -85,7 +85,7 @@
--cache-no-size skip size for cache-id
--no_parent_request_cache disable parent request cache
--no_parent_rate_cache disable parent rate cache
- --no_parent_dns_cache disable parent dns cache
+ --no_parent_dns_cache disable parent dns cache (default)
--no_parent_cache disable all parent caches
Rates:
@@ -99,7 +99,10 @@
--failures <f> max respawn failure counter
--daemons <list> list of daemons to start
--dumpcache show cache contents
- --dumpstats show statistics
+ --dumpstats show statistics
+ -R, --chroot <path> chroot to <path> before start
+ --delcache <item> removes an item from the request cache
+ --delrate <item> removes an item from the rate cache
DNS:
-n, --nodns skip any dns based test
@@ -119,11 +122,18 @@
--noidlestats disables statistics when idle
--norulestats disables per rule statistics
-I, --instantcfg reloads ruleset on every new request
- --config_timeout <i> parser timeout in seconds
+ --config_timeout <i> parser timeout in seconds
+ --keep_rates do not clear rate limit counters on reload
+ --save_rates <file> save and load rate limits on disk
+ --fast_limit_evaluation evaluate rate limits before ruleset is parsed
+
+ Plugins:
+ --plugins <file> loads postfwd plugins from file
Logging:
-l, --logname <label> label for syslog messages
--facility <s> use syslog facility <s>
+ --socktype <s> use syslog socktype <s>
--nodnslog do not log dns results
--anydnslog log any dns (even cached) results
--norulelog do not log rule actions
@@ -170,7 +180,7 @@
A configuration line consists of optional item=value pairs, separated by semicolons
(`;`) and the appropriate desired action:
- [ <item1>[=><~]=<value>; <item2>[=><~]=<value>; ... ] action=<result>
+ [ <item1>=<value>; <item2>=<value>; ... ] action=<result>
Example:
client_address=192.168.1.1 ; sender==no@bad.local ; action=REJECT
@@ -199,10 +209,19 @@
appreciate.
A ruleset consists of one or multiple rules, which can be loaded from files or passed as command line
arguments. Please see the COMMAND LINE section below for more information on this topic.
-Rules can span multiple lines by adding a trailing backslash ``\'' character:
+Since postfwd version 1.30 rules spanning span multiple lines can be defined by prefixing the following
+lines with one or multiple whitespace characters (or '}' for macros):
- id=R_001 ; client_address=192.168.1.0/24; sender==no@bad.local; \
- action=REJECT please use your relay from there
+ id=RULE001
+ client_address=192.168.1.0/24
+ sender==no@bad.local
+ action=REJECT no access
+postfwd versions prior to 1.30 require trailing ';' and '\'-characters:
+
+ id=RULE001; \
+ client_address=192.168.1.0/24; \
+ sender==no@bad.local; \
+ action=REJECT no access
@@ -268,8 +287,14 @@
this enables version based checks in your rulesets
(e.g. for migration). works with old versions too,
because a non-existing item always returns false:
- id=R01; version~=1.10; sender_domain==some.org \
+ # version >= 1.10
+ id=R01; version~=1\.[1-9][0-9]; sender_domain==some.org \
; action=REJECT sorry no access
+
+ ratecount - only available for rate(), size() and rcpt() actions.
+ contains the actual limit counter:
+ id=R01; action=rate(sender/200/600/REJECT limit of 200 exceeded [$$ratecount hits])
+ id=R02; action=rate(sender/100/600/WARN limit of 100 exceeded [$$ratecount hits])
Besides these you can specify any attribute of the postfix policy delegation protocol.
Feel free to combine them the way you need it (have a look at the EXAMPLES section below).
Most values can be specified as regular expressions (PCRE). Please see the table below
@@ -319,34 +344,33 @@
encryption_keysize=256 mask = numeric, will match if keysize >= 256
...
the current list can be found at http://www.postfix.org/SMTPD_POLICY_README.html . Please read carefully about which
-attribute can be used at which level of the smtp transaction (e.g. size will only work reliably at END_OF_DATA level).
+attribute can be used at which level of the smtp transaction (e.g. size will only work reliably at END-OF-MESSAGE level).
Pattern matching is performed case insensitive.
Multiple use of the same item is allowed and will compared as logical OR, which means that this will work as expected:
- id=TRUST001; action=OK; encryption_keysize=64; \
- ccert_fingerprint=11:22:33:44:55:66:77:88:99; \
- ccert_fingerprint=22:33:44:55:66:77:88:99:00; \
- ccert_fingerprint=33:44:55:66:77:88:99:00:11; \
+ id=TRUST001; action=OK; encryption_keysize=64
+ ccert_fingerprint=11:22:33:44:55:66:77:88:99
+ ccert_fingerprint=22:33:44:55:66:77:88:99:00
+ ccert_fingerprint=33:44:55:66:77:88:99:00:11
sender=@domain\.local$
client_address, rbl and rhsbl items may also be specified as whitespace-or-comma-separated values:
- id=SKIP01; action=dunno; \
+ id=SKIP01; action=dunno
client_address=192.168.1.0/24, 172.16.254.23
- id=SKIP02; action=dunno; \
- client_address= 10.10.3.32 \
- 10.216.222.0/27
+ id=SKIP02; action=dunno
+ client_address= 10.10.3.32 10.216.222.0/27
The following items must be unique:
id, minimum and maximum values, rblcount and rhsblcount
Any item can be negated by preceeding '!!' to it, e.g.:
- id=TLS001 ; hostname=!!^secure\.trust\.local$ ; action=REJECT only secure.trust.local please
+ id=HOST001 ; hostname == !!secure.trust.local ; action=REJECT only secure.trust.local please
or using the right compare operator:
- id=USER01 ; sasl_username !~ /^(bob|alice)$/ ; action=REJECT who is that?
+ id=HOST001 ; hostname != secure.trust.local ; action=REJECT only secure.trust.local please
To avoid confusion with regexps or simply for better visibility you can use '!!(...)':
- id=USER01 ; sasl_username=!!( /^(bob|alice)$/ ) ; action=REJECT who is that?
+ id=USER01 ; sasl_username =~ !!( /^(bob|alice)$/ ) ; action=REJECT who is that?
Request attributes can be compared by preceeding '$$' characters, e.g.:
id=R-003 ; client_name = !! $$helo_name ; action=WARN helo does not match DNS
@@ -354,6 +378,29 @@
id=R-003 ; client_name = !!($$(helo_name)) ; action=WARN helo does not match DNS
This is only valid for PCRE values (see list above). The comparison will be performed as case insensitive exact match.
Use the '-vv' option to debug.
+These special items will be reset for any new rule:
+
+ rblcount - contains the number of RBL answers
+ rhsblcount - contains the number of RHSBL answers
+ matches - contains the number of matched items
+ dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
+ rbltype:rblname:<txt>; rbltype:rblname:<txt>; ...
+These special items will be changed for any matching rule:
+
+ request_hits - contains ids of all matching rules
+This means that it might be necessary to save them, if you plan to use these values in later rules:
+
+ # set vals
+ id=RBL01 ; rhsblcount=all; rblcount=all
+ action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
+ rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org
+ rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+ rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+
+ # compare
+ id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
+ id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
+ id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
@@ -373,15 +420,15 @@
id=R001 ; ccert_fingerprint==table:/etc/postfwd/wl_ccerts ; action=DUNNO
This will ignore the right-hand value. Items can be mixed:
- id=R002 ; action=REJECT \
- client_name==unknown; \
+ id=R002 ; action=REJECT
+ client_name==unknown
client_name==file:/etc/postfwd/blacklisted
and for non pcre (comma separated) items:
- id=R003 ; action=REJECT \
+ id=R003 ; action=REJECT
client_address==10.1.1.1, file:/etc/postfwd/blacklisted
- id=R004 ; action=REJECT \
+ id=R004 ; action=REJECT
rbl=myrbl.home.local, zen.spamhaus.org, file:/etc/postfwd/rbls_changing
You can check your configuration with the --show_config option at the command line:
@@ -479,16 +526,16 @@
please note that <action> is currently limited to postfix actions (no postfwd actions)!
# no more than 3 requests per 5 minutes
# from the same "unknown" client
- id=RATE01 ; client_name==unknown ; \
- action==rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
+ id=RATE01 ; client_name==unknown
+ action=rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
size (<item>/<max>/<time>/<action>)
this command works similar to the rate() command with the difference, that the rate counter is
increased by the request's size attribute. to do this reliably you should call postfwd2 from
smtpd_end_of_data_restrictions. if you want to be sure, you could check it within the ruleset:
# size limit 1.5mb per hour per client
- id=SIZE01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \
- action==size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
+ id=SIZE01 ; protocol_state==END-OF-MESSAGE ; client_address==!!(10.1.1.1)
+ action=size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
rcpt (<item>/<max>/<time>/<action>)
this command works similar to the rate() command with the difference, that the rate counter is
@@ -496,8 +543,8 @@
from smtpd_data_restrictions or smtpd_end_of_data_restrictions. if you want to be sure, you could
check it within the ruleset:
# recipient count limit 3 per hour per client
- id=RCPT01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \
- action==rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
+ id=RCPT01 ; protocol_state==END-OF-MESSAGE ; client_address==!!(10.1.1.1)
+ action=rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
ask (<addr>:<port>[:<ignore>])
allows to delegate the policy decision to another policy service (e.g. postgrey). the first
@@ -509,13 +556,18 @@
# and continue parsing postfwd's ruleset
id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031:^dunno$)
+ mail(server/helo/from/to/subject/body)
+ Very basic mail command, that sends a message with the given arguments. LIMITATIONS:
+ This basically performs a telnet. No authentication or TLS are available. Additionally it does
+ not track notification state and will notify you any time, the corresponding rule hits.
+
wait (<delay>)
pauses the program execution for <delay> seconds. use this for
delaying or throtteling connections.
note (<string>)
just logs the given string and continues parsing the ruleset.
- if the string is empty, nothing will be logged.
+ if the string is empty, nothing will be logged (noop).
quit (<code>)
terminates the program with the given exit-code. postfix doesn`t
@@ -523,29 +575,6 @@
You can reference to request attributes, like
id=R-HELO ; helo_name=^[^\.]+$ ; action=REJECT invalid helo '$$helo_name'
-These special attributes will be reset for any new rule:
-
- rblcount - contains the number of RBL answers
- rhsblcount - contains the number of RHSBL answers
- matches - contains the number of matched items
- dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
- rbltype:rblname:<txt>; rbltype:rblname:<txt>; ...
-These special attributes will be changed for any matching rule:
-
- request_hits - contains ids of all matching rules
-This means that it might be necessary to save them, if you plan to use these values in later rules:
-
- # set vals
- id=RBL01 ; rhsblcount=all ; rblcount=all ; \
- rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org ; \
- rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \
- rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \
- action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
-
- # compare
- id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
- id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
- id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
@@ -568,18 +597,18 @@
&&GONOW ; &&RBLS ; client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
Macros can contain macros, too:
- # definition (note the trailing "\" characters)
- &&RBLS { \
- rbl=zen.spamhaus.org ; \
- rbl=list.dsbl.org ; \
- rbl=bl.spamcop.net ; \
- rbl=dnsbl.sorbs.net ; \
- rbl=ix.dnsbl.manitu.net ; \
+ # definition
+ &&RBLS{
+ rbl=zen.spamhaus.org
+ rbl=list.dsbl.org
+ rbl=bl.spamcop.net
+ rbl=dnsbl.sorbs.net
+ rbl=ix.dnsbl.manitu.net
};
- &&DYNAMIC { \
- client_name=^unknown$ ; \
- client_name=(\d+[\.-_]){4} ; \
- client_name=[\.-_](adsl|dynamic|ppp|)[\.-_] ; \
+ &&DYNAMIC{
+ client_name=^unknown$
+ client_name=(\d+[\.-_]){4}
+ client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
};
&&GOAWAY { &&RBLS; &&DYNAMIC; };
# rules
@@ -588,7 +617,141 @@
-Please visit http://www.postfwd.org/postfwd.plugins
+Description
+The plugin interface allow you to define your own checks and enhance postfwd's
+functionality. Feel free to share useful things!
+Warning
+Note that the plugin interface is still at devel stage. Please test your plugins
+carefully, because errors may cause postfwd to break! It is also
+allowed to override attributes or built-in functions, but be sure that you know
+what you do because some of them are used internally.
+Please keep security in mind, when you access sensible ressources and never, ever
+run postfwd as privileged user! Also never trust your input (especially hostnames,
+and e-mail addresses).
+ITEMS
+Item plugins are perl subroutines which integrate additional attributes to requests
+before they are evaluated against postfwd's ruleset like any other item of the
+policy delegation protocol. This allows you to create your own checks.
+plugin-items can not be used selective. these functions will be executed for every
+request postfwd receives, so keep performance in mind.
+
+ SYNOPSIS: %result = postfwd_items_plugin{<name>}(%request)
+means that your subroutine, called <name>, has access to a hash called %request,
+which contains all request attributes, like $request{client_name} and must
+return a value in the following form:
+
+ save: $result{<item>} = <value>
+this creates the new item <item> containing <value>, which will be integrated in
+the policy delegation request and therefore may be used in postfwd's ruleset.
+
+ # do NOT remove the next line
+ %postfwd_items_plugin = (
+
+ # EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # allows to check postfwd version in ruleset
+ "version" => sub {
+ my(%request) = @_;
+ my(%result) = (
+ "version" => $NAME." ".$VERSION,
+ );
+ return %result;
+ },
+
+ # sender_domain and recipient_domain
+ "address_parts" => sub {
+ my(%request) = @_;
+ my(%result) = ();
+ $request{sender} =~ /@([^@]*)$/;
+ $result{sender_domain} = ($1 || '');
+ $request{recipient} =~ /@([^@]*)$/;
+ $result{recipient_domain} = ($1 || '');
+ return %result;
+ },
+
+ # do NOT remove the next line
+ );
+COMPARE
+Compare plugins allow you to define how your new items should be compared to the ruleset.
+These are optional. If you don't specify one, the default (== for exact match, =~ for PCRE, ...)
+will be used.
+
+ SYNOPSIS: <item> => sub { return &{$postfwd_compare{<type>}}(@_); },
+
+ # do NOT remove the next line
+ %postfwd_compare_plugin = (
+
+ EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # Simple example
+ # SYNOPSIS: <result> = <item> (return &{$postfwd_compare{<type>}}(@_))
+ "client_address" => sub { return &{$postfwd_compare{cidr}}(@_); },
+ "size" => sub { return &{$postfwd_compare{numeric}}(@_); },
+ "recipient_count" => sub { return &{$postfwd_compare{numeric}}(@_); },
+
+ # Complex example
+ # SYNOPSIS: <result> = <item>(<operator>, <ruleset value>, <request value>, <request>)
+ "numeric" => sub {
+ my($cmp,$val,$myitem,%request) = @_;
+ my($myresult) = undef; $myitem ||= "0"; $val ||= "0";
+ if ($cmp eq '==') {
+ $myresult = ($myitem == $val);
+ } elsif ($cmp eq '=<') {
+ $myresult = ($myitem <= $val);
+ } elsif ($cmp eq '=>') {
+ $myresult = ($myitem >= $val);
+ } elsif ($cmp eq '!=') {
+ $myresult = not($myitem == $val);
+ } elsif ($cmp eq '!<') {
+ $myresult = not($myitem <= $val);
+ } elsif ($cmp eq '!>') {
+ $myresult = not($myitem >= $val);
+ } else {
+ $myresult = ($myitem >= $val);
+ };
+ return $myresult;
+ },
+
+ # do NOT remove the next line
+ );
+ACTIONS
+Action plugins allow to define new postfwd actions. By setting the $stop-flag you can decide to
+continue or to stop parsing the ruleset.
+
+ SYNOPSIS: (<stop rule parsing>, <next rule index>, <return action>, <logprefix>, <request>) =
+ <action> (<current rule index>, <current time>, <command name>, <argument>, <logprefix>, <request>)
+
+ # do NOT remove the next line
+ %postfwd_actions_plugin = (
+
+ # EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # note(<logstring>) command
+ "note" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ mylogs 'info', "[RULES] ".$myline." - note: ".$myarg if $myarg;
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # skips next <myarg> rules
+ "skip" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ $index += $myarg if ( $myarg and not(($index + $myarg) > $#Rules) );
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # dumps current request contents to syslog
+ "dumprequest" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ map { mylogs 'info', "[DUMP] rule=$index, Attribute: $_=$request{$_}" } (keys %request);
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # do NOT remove the next line
+ );
@@ -603,18 +766,13 @@
-r, --rule <rule>
Adds <rule> to ruleset. Remember that you might have to quote
strings that contain whitespaces or shell characters.
-Plugins
-
- --plugins
- A file containing plugin routines for postfwd. Please see the
- PLUGINS section for more information.
Scoring
-s, --scores <val>=<action>
Returns <action> to postfix, when the request's score exceeds <val>
Multiple usage is allowed. Just chain your arguments, like:
- postfwd2 -r "<item>=<value>;action=<result>" -f <file> -f <file> --plugins <file> ...
+ postfwd2 -r "<item>=<value>;action=<result>" -f <file> -f <file> ...
or
postfwd2 --scores 4.5="WARN high score" --scores 5.0="REJECT postfwd2 score too high" ...
In case of multiple scores, the highest match will count. The order of the arguments will be
@@ -625,13 +783,13 @@
-d, --daemon
postfwd2 will run as daemon and listen on the network for incoming
- queries (default 127.0.0.1:10040).
+ queries (default 127.0.0.1:10045).
-i, --interface <dev>
Bind postfwd2 to the specified interface (default 127.0.0.1).
-p, --port <port>
- postfwd2 listens on the specified port (default tcp/10040).
+ postfwd2 listens on the specified port (default tcp/10045).
--proto <type>
The protocol type for postfwd's socket. Currently you may use 'tcp' or 'unix' here.
@@ -657,17 +815,29 @@
-R, --chroot <path>
Chroot the process to the specified path.
- Test this before using - you might need some libs there.
+ Please look at http://postfwd.org/postfwd2-chroot.html before use!
--pidfile <path>
The process id will be saved in the specified file.
+ --facility <f>
+ sets the syslog facility, default is 'mail'
+
+ --socktype <s>
+ sets the Sys::Syslog socktype to 'native', 'inet' or 'unix'.
+ Default is to auto-detect this depening on module version and os.
+
-l, --logname <label>
Labels the syslog messages. Useful when running multiple
instances of postfwd.
--loglen <int>
Truncates any syslog message after <int> characters.
+Plugins
+
+ --plugins <file>
+ Loads postfwd plugins from file. Please see http://postfwd.org/postfwd.plugins
+ or the plugins.postfwd.sample that is available from the tarball for more info.
Optional arguments
These parameters influence the way postfwd2 is working. Any of them can be combined.
@@ -794,7 +964,22 @@
timeout in seconds to parse a single configuration line. if exceeded, the rule will
be skipped. this is used to prevent problems due to large files or loops.
-I<Informational arguments>
+ --keep_rates (default=0)
+ With this option set postfwd2 does not clear the rate limit counters on reload. Please
+ note that you have to restart (not reload) postfwd with this option if you change
+ any rate limit rules.
+
+ --save_rates (default=none)
+ With this option postfwd saves existing rate limit counters to disk and reloads them
+ on program start. This allows persistent rate limits across program restarts or reboots.
+ Please note that postfwd needs read and write access to the specified file.
+
+ --fast_limit_evaluation (default=0)
+ Once a ratelimit was set by the ruleset, future requests will be evaluated against it
+ before consulting the ruleset. This mode was the default behaviour until v1.30.
+ With this mode rate limits will be faster, but also eventually set up
+ whitelisting-rules within the ruleset might not work as expected.
+Informational arguments
These arguments are for command line usage only. Never ever use them with postfix!
-C, --showconfig
@@ -815,6 +1000,26 @@
-P, --perfmon
This option turns of any syslogging and output. It is included
for performance testing.
+
+ --dumpstats
+ Displays program usage statistics.
+
+ --dumpcache
+ Displays cache contents.
+
+ --delcache <item>
+ Removes an item from the request cache. Use --dumpcache to identify objects.
+ E.g.:
+ # postfwd --dumpcache
+ ...
+ %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @count -> '1'
+ %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @maxcount -> '2'
+ ...
+ # postfwd --delrate="sender=gmato@jqvo.org"
+ rate cache item 'sender=gmato@jqvo.org' removed
+
+ --delrate <item>
+ Removes an item from the rate cache. Use --dumpcache to identify objects.
@@ -854,18 +1059,25 @@
# 1. 30MB for systems in *.customer1.tld
# 2. 20MB for SASL user joejob
# 3. 10MB default
- id=SZ001; state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\.customer1.tld$
- id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
- id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=10000000
- id=SZ100; state==END-OF-MESSAGE; action=REJECT message too large
+ id=SZ001; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\.customer1.tld$
+ id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
+ id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=10000000
+ id=SZ100; protocol_state==END-OF-MESSAGE; action=REJECT message too large
## Selective Greylisting
+ ##
+ ## Note that postfwd does not include greylisting. This setup requires a running postgrey service
+ ## at port 10031 and the following postfix restriction class in your main.cf:
+ ##
+ ## smtpd_restriction_classes = check_postgrey, ...
+ ## check_postgrey = check_policy_service inet:127.0.0.1:10031
+ #
# 1. if listed on zen.spamhaus.org with results 127.0.0.10 or .11, dns cache timeout 1200s
# 2. Client has no rDNS
# 3. Client comes from several dialin domains
- id=GR001; action=greylisting ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
- id=GR002; action=greylisting ; client_name=^unknown$
- id=GR003; action=greylisting ; client_name=\.(t-ipconnect|alicedsl|ish)\.de$
+ id=GR001; action=check_postgrey ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
+ id=GR002; action=check_postgrey ; client_name=^unknown$
+ id=GR003; action=check_postgrey ; client_name=\.(t-ipconnect|alicedsl|ish)\.de$
## Date Time
date=24.12.2007-26.12.2007 ; action=450 4.7.1 office closed during christmas
@@ -873,7 +1085,7 @@
time=-07:00:00 ; sasl_username=jim ; action=450 4.7.1 to early for you, jim
time=22:00:00- ; sasl_username=jim ; action=450 4.7.1 to late now, jim
months=-Apr ; action=450 4.7.1 see you in may
- days=!!Mon-Fri ; action=greylist
+ days=!!Mon-Fri ; action=check_postgrey
## Usage of jump
# The following allows a message size of 30MB for different
@@ -883,8 +1095,8 @@
id=R003 ; action=jump(R100) ; ccert_fingerprint=AA:BB:CC:DD:...
id=R004 ; action=jump(R100) ; ccert_fingerprint=AF:BE:CD:DC:...
id=R005 ; action=jump(R100) ; ccert_fingerprint=DD:CC:BB:DD:...
- id=R099 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
- id=R100 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
+ id=R099 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
+ id=R100 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
## Usage of score
# The following rejects a mail, if the client
@@ -892,8 +1104,8 @@
# - is listed in 1 RBL or 1 RHSBL and has no correct rDNS
# - other clients without correct rDNS will be greylist-checked
# - some whitelists are used to lower the score
- id=S01 ; score=2.6 ; action=greylisting
- id=S02 ; score=5.0 ; action=REJECT postfwd2 score too high
+ id=S01 ; score=2.6 ; action=check_postgrey
+ id=S02 ; score=5.0 ; action=REJECT postfwd score too high
id=R00 ; action=score(-1.0) ; rbl=exemptions.ahbl.org,list.dnswl.org,query.bondedsender.org,spf.trusted-forwarder.org
id=R01 ; action=score(2.5) ; rbl=bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
id=R02 ; action=score(2.5) ; rhsbl=rhsbl.ahbl.org, rhsbl.sorbs.net
@@ -905,10 +1117,10 @@
# The following temporary rejects requests from "unknown" clients, if they
# 1. exceeded 30 requests per hour or
# 2. tried to send more than 1.5mb within 10 minutes
- id=RATE01 ; client_name==unknown ; state==RCPT ; \
- action==rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
- id=SIZE01 ; client_name==unknown ; state==END_OF_DATA ; \
- action==size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
+ id=RATE01 ; client_name==unknown ; protocol_state==RCPT
+ action=rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
+ id=SIZE01 ; client_name==unknown ; protocol_state==END-OF-MESSAGE
+ action=size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
## Macros
# definition
@@ -921,34 +1133,34 @@
## Groups
# definition
- &&RBLS { \
- rbl=zen.spamhaus.org ; \
- rbl=list.dsbl.org ; \
- rbl=bl.spamcop.net ; \
- rbl=dnsbl.sorbs.net ; \
- rbl=ix.dnsbl.manitu.net ; \
+ &&RBLS{
+ rbl=zen.spamhaus.org
+ rbl=list.dsbl.org
+ rbl=bl.spamcop.net
+ rbl=dnsbl.sorbs.net
+ rbl=ix.dnsbl.manitu.net
};
- &&RHSBLS { \
+ &&RHSBLS{
...
};
- &&DYNAMIC { \
- client_name==unknown ; \
- client_name~=(\d+[\.-_]){4} ; \
- client_name~=[\.-_](adsl|dynamic|ppp|)[\.-_] ; \
+ &&DYNAMIC{
+ client_name==unknown
+ client_name~=(\d+[\.-_]){4}
+ client_name~=[\.-_](adsl|dynamic|ppp|)[\.-_]
...
};
- &&BAD_HELO { \
- helo_name==my.name.tld; \
- helo_name~=^([^\.]+)$; \
- helo_name~=\.(local|lan)$; \
+ &&BAD_HELO{
+ helo_name==my.name.tld
+ helo_name~=^([^\.]+)$
+ helo_name~=\.(local|lan)$
...
};
- &&MAINTENANCE { \
- date=15.01.2007 ; \
- date=15.04.2007 ; \
- date=15.07.2007 ; \
- date=15.10.2007 ; \
- time=03:00:00 - 04:00:00 ; \
+ &&MAINTENANCE{
+ date=15.01.2007
+ date=15.04.2007
+ date=15.07.2007
+ date=15.10.2007
+ time=03:00:00 - 04:00:00
};
# rules
id=COMBINED ; &&RBLS ; &&DYNAMIC ; action=REJECT dynamic client and listed on RBL
@@ -965,7 +1177,7 @@
## combined with enhanced rbl features
#
- id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS ; \
+ id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS
action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,HIT_dnstxt=$$dnsbltext)
id=RBL02 ; HIT_dnsbls>=2 ; action=554 5.7.1 blocked using $$HIT_dnsbls DNSBLs [INFO: $$HIT_dnstxt]
@@ -1068,21 +1280,21 @@
postfwd2 will spawn multiple child processes which communicate with a parent cache. This is
the prefered way to use postfwd2 in high volume environments. Start postfwd2 with the following parameters:
- postfwd2 -d -f /etc/postfwd.cf -i 127.0.0.1 -p 10040 -u nobody -g nobody -S
+ postfwd2 -d -f /etc/postfwd.cf -i 127.0.0.1 -p 10045 -u nobody -g nobody -S
For efficient caching you should check if you can use the options --cacheid, --cache-rdomain-only,
--cache-no-sender and --cache-no-size.
Now check your syslogs (default facility ``mail'') for a line like:
Aug 9 23:00:24 mail postfwd[5158]: postfwd2 n.nn ready for input
-and use `netstat -an|grep 10040` to check for something like
+and use `netstat -an|grep 10045` to check for something like
- tcp 0 0 127.0.0.1:10040 0.0.0.0:* LISTEN
+ tcp 0 0 127.0.0.1:10045 0.0.0.0:* LISTEN
If everything works, open your postfix main.cf and insert the following
- 127.0.0.1:10040_time_limit = 3600 <--- integration
+ 127.0.0.1:10045_time_limit = 3600 <--- integration
smtpd_recipient_restrictions = permit_mynetworks <--- recommended
reject_unauth_destination <--- recommended
- check_policy_service inet:127.0.0.1:10040 <--- integration
+ check_policy_service inet:127.0.0.1:10045 <--- integration
Reload your configuration with `postfix reload` and watch your logs. In it works you should see
lines like the following in your mail log:
@@ -1098,9 +1310,9 @@
# Restriction Classes
smtpd_restriction_classes = postfwdcheck, <some more>... <--- integration
- postfwdcheck = check_policy_service inet:127.0.0.1:10040 <--- integration
+ postfwdcheck = check_policy_service inet:127.0.0.1:10045 <--- integration
- 127.0.0.1:10040_time_limit = 3600 <--- integration
+ 127.0.0.1:10045_time_limit = 3600 <--- integration
smtpd_recipient_restrictions = permit_mynetworks, <--- recommended
reject_unauth_destination, <--- recommended
... <--- optional
@@ -1122,7 +1334,7 @@
action=<whateveryouconfigured>
For network tests I use netcat:
- nc 127.0.0.1 10040 <request.sample
+ nc 127.0.0.1 10045 <request.sample
to send a request to postfwd. If you receive nothing, make sure that postfwd2 is running and
listening on the specified network settings.
diff -Nru postfwd-1.20/doc/postfwd2.txt postfwd-1.32/doc/postfwd2.txt
--- postfwd-1.20/doc/postfwd2.txt 2010-11-14 21:51:34.000000000 +0000
+++ postfwd-1.32/doc/postfwd2.txt 2011-12-18 12:34:41.000000000 +0000
@@ -38,7 +38,7 @@
--cache-no-size skip size for cache-id
--no_parent_request_cache disable parent request cache
--no_parent_rate_cache disable parent rate cache
- --no_parent_dns_cache disable parent dns cache
+ --no_parent_dns_cache disable parent dns cache (default)
--no_parent_cache disable all parent caches
Rates:
@@ -53,6 +53,9 @@
--daemons list of daemons to start
--dumpcache show cache contents
--dumpstats show statistics
+ -R, --chroot chroot to before start
+ --delcache - removes an item from the request cache
+ --delrate
- removes an item from the rate cache
DNS:
-n, --nodns skip any dns based test
@@ -73,10 +76,17 @@
--norulestats disables per rule statistics
-I, --instantcfg reloads ruleset on every new request
--config_timeout
parser timeout in seconds
+ --keep_rates do not clear rate limit counters on reload
+ --save_rates save and load rate limits on disk
+ --fast_limit_evaluation evaluate rate limits before ruleset is parsed
+
+ Plugins:
+ --plugins loads postfwd plugins from file
Logging:
-l, --logname label for syslog messages
--facility use syslog facility
+ --socktype use syslog socktype
--nodnslog do not log dns results
--anydnslog log any dns (even cached) results
--norulelog do not log rule actions
@@ -132,7 +142,7 @@
A configuration line consists of optional item=value pairs, separated by
semicolons (`;`) and the appropriate desired action:
- [ [=><~]=; [=><~]=; ... ] action=
+ [ =; =; ... ] action=
*Example:*
@@ -173,11 +183,21 @@
files or passed as command line arguments. Please see the COMMAND LINE
section below for more information on this topic.
- Rules can span multiple lines by adding a trailing backslash "\"
- character:
-
- id=R_001 ; client_address=192.168.1.0/24; sender==no@bad.local; \
- action=REJECT please use your relay from there
+ Since postfwd version 1.30 rules spanning span multiple lines can be
+ defined by prefixing the following lines with one or multiple whitespace
+ characters (or '}' for macros):
+
+ id=RULE001
+ client_address=192.168.1.0/24
+ sender==no@bad.local
+ action=REJECT no access
+
+ postfwd versions prior to 1.30 require trailing ';' and '\'-characters:
+
+ id=RULE001; \
+ client_address=192.168.1.0/24; \
+ sender==no@bad.local; \
+ action=REJECT no access
ITEMS
id - a unique rule id, which can be used for log analysis
@@ -241,9 +261,15 @@
this enables version based checks in your rulesets
(e.g. for migration). works with old versions too,
because a non-existing item always returns false:
- id=R01; version~=1.10; sender_domain==some.org \
+ # version >= 1.10
+ id=R01; version~=1\.[1-9][0-9]; sender_domain==some.org \
; action=REJECT sorry no access
+ ratecount - only available for rate(), size() and rcpt() actions.
+ contains the actual limit counter:
+ id=R01; action=rate(sender/200/600/REJECT limit of 200 exceeded [$$ratecount hits])
+ id=R02; action=rate(sender/100/600/WARN limit of 100 exceeded [$$ratecount hits])
+
Besides these you can specify any attribute of the postfix policy
delegation protocol. Feel free to combine them the way you need it (have
a look at the EXAMPLES section below).
@@ -298,26 +324,25 @@
the current list can be found at
. Please read carefully
about which attribute can be used at which level of the smtp transaction
- (e.g. size will only work reliably at END_OF_DATA level). Pattern
+ (e.g. size will only work reliably at END-OF-MESSAGE level). Pattern
matching is performed case insensitive.
Multiple use of the same item is allowed and will compared as logical
OR, which means that this will work as expected:
- id=TRUST001; action=OK; encryption_keysize=64; \
- ccert_fingerprint=11:22:33:44:55:66:77:88:99; \
- ccert_fingerprint=22:33:44:55:66:77:88:99:00; \
- ccert_fingerprint=33:44:55:66:77:88:99:00:11; \
+ id=TRUST001; action=OK; encryption_keysize=64
+ ccert_fingerprint=11:22:33:44:55:66:77:88:99
+ ccert_fingerprint=22:33:44:55:66:77:88:99:00
+ ccert_fingerprint=33:44:55:66:77:88:99:00:11
sender=@domain\.local$
client_address, rbl and rhsbl items may also be specified as
whitespace-or-comma-separated values:
- id=SKIP01; action=dunno; \
+ id=SKIP01; action=dunno
client_address=192.168.1.0/24, 172.16.254.23
- id=SKIP02; action=dunno; \
- client_address= 10.10.3.32 \
- 10.216.222.0/27
+ id=SKIP02; action=dunno
+ client_address= 10.10.3.32 10.216.222.0/27
The following items must be unique:
@@ -325,16 +350,16 @@
Any item can be negated by preceeding '!!' to it, e.g.:
- id=TLS001 ; hostname=!!^secure\.trust\.local$ ; action=REJECT only secure.trust.local please
+ id=HOST001 ; hostname == !!secure.trust.local ; action=REJECT only secure.trust.local please
or using the right compare operator:
- id=USER01 ; sasl_username !~ /^(bob|alice)$/ ; action=REJECT who is that?
+ id=HOST001 ; hostname != secure.trust.local ; action=REJECT only secure.trust.local please
To avoid confusion with regexps or simply for better visibility you can
use '!!(...)':
- id=USER01 ; sasl_username=!!( /^(bob|alice)$/ ) ; action=REJECT who is that?
+ id=USER01 ; sasl_username =~ !!( /^(bob|alice)$/ ) ; action=REJECT who is that?
Request attributes can be compared by preceeding '$$' characters, e.g.:
@@ -346,6 +371,33 @@
be performed as case insensitive exact match. Use the '-vv' option to
debug.
+ These special items will be reset for any new rule:
+
+ rblcount - contains the number of RBL answers
+ rhsblcount - contains the number of RHSBL answers
+ matches - contains the number of matched items
+ dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
+ rbltype:rblname:; rbltype:rblname:; ...
+
+ These special items will be changed for any matching rule:
+
+ request_hits - contains ids of all matching rules
+
+ This means that it might be necessary to save them, if you plan to use
+ these values in later rules:
+
+ # set vals
+ id=RBL01 ; rhsblcount=all; rblcount=all
+ action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
+ rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org
+ rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+ rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+
+ # compare
+ id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
+ id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
+ id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
+
FILES
Since postfwd1 v1.15 and postfwd2 v0.18 long item lists can be stored in
separate files:
@@ -368,16 +420,16 @@
This will ignore the right-hand value. Items can be mixed:
- id=R002 ; action=REJECT \
- client_name==unknown; \
+ id=R002 ; action=REJECT
+ client_name==unknown
client_name==file:/etc/postfwd/blacklisted
and for non pcre (comma separated) items:
- id=R003 ; action=REJECT \
+ id=R003 ; action=REJECT
client_address==10.1.1.1, file:/etc/postfwd/blacklisted
- id=R004 ; action=REJECT \
+ id=R004 ; action=REJECT
rbl=myrbl.home.local, zen.spamhaus.org, file:/etc/postfwd/rbls_changing
You can check your configuration with the --show_config option at the
@@ -499,16 +551,16 @@
please note that is currently limited to postfix actions (no postfwd actions)!
# no more than 3 requests per 5 minutes
# from the same "unknown" client
- id=RATE01 ; client_name==unknown ; \
- action==rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
+ id=RATE01 ; client_name==unknown
+ action=rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
size (- /
//)
this command works similar to the rate() command with the difference, that the rate counter is
increased by the request's size attribute. to do this reliably you should call postfwd2 from
smtpd_end_of_data_restrictions. if you want to be sure, you could check it within the ruleset:
# size limit 1.5mb per hour per client
- id=SIZE01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \
- action==size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
+ id=SIZE01 ; protocol_state==END-OF-MESSAGE ; client_address==!!(10.1.1.1)
+ action=size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
rcpt (- /
//)
this command works similar to the rate() command with the difference, that the rate counter is
@@ -516,8 +568,8 @@
from smtpd_data_restrictions or smtpd_end_of_data_restrictions. if you want to be sure, you could
check it within the ruleset:
# recipient count limit 3 per hour per client
- id=RCPT01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \
- action==rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
+ id=RCPT01 ; protocol_state==END-OF-MESSAGE ; client_address==!!(10.1.1.1)
+ action=rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
ask (:[:])
allows to delegate the policy decision to another policy service (e.g. postgrey). the first
@@ -529,13 +581,18 @@
# and continue parsing postfwd's ruleset
id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031:^dunno$)
+ mail(server/helo/from/to/subject/body)
+ Very basic mail command, that sends a message with the given arguments. LIMITATIONS:
+ This basically performs a telnet. No authentication or TLS are available. Additionally it does
+ not track notification state and will notify you any time, the corresponding rule hits.
+
wait ()
pauses the program execution for seconds. use this for
delaying or throtteling connections.
note ()
just logs the given string and continues parsing the ruleset.
- if the string is empty, nothing will be logged.
+ if the string is empty, nothing will be logged (noop).
quit ()
terminates the program with the given exit-code. postfix doesn`t
@@ -545,33 +602,6 @@
id=R-HELO ; helo_name=^[^\.]+$ ; action=REJECT invalid helo '$$helo_name'
- These special attributes will be reset for any new rule:
-
- rblcount - contains the number of RBL answers
- rhsblcount - contains the number of RHSBL answers
- matches - contains the number of matched items
- dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
- rbltype:rblname:; rbltype:rblname:; ...
-
- These special attributes will be changed for any matching rule:
-
- request_hits - contains ids of all matching rules
-
- This means that it might be necessary to save them, if you plan to use
- these values in later rules:
-
- # set vals
- id=RBL01 ; rhsblcount=all ; rblcount=all ; \
- rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org ; \
- rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \
- rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \
- action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
-
- # compare
- id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
- id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
- id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
-
MACROS/ACLS
Multiple use of long items or combinations of them may be abbreviated by
macros. Those must be prefixed by '&&' (two '&' characters). First the
@@ -596,18 +626,18 @@
Macros can contain macros, too:
- # definition (note the trailing "\" characters)
- &&RBLS { \
- rbl=zen.spamhaus.org ; \
- rbl=list.dsbl.org ; \
- rbl=bl.spamcop.net ; \
- rbl=dnsbl.sorbs.net ; \
- rbl=ix.dnsbl.manitu.net ; \
+ # definition
+ &&RBLS{
+ rbl=zen.spamhaus.org
+ rbl=list.dsbl.org
+ rbl=bl.spamcop.net
+ rbl=dnsbl.sorbs.net
+ rbl=ix.dnsbl.manitu.net
};
- &&DYNAMIC { \
- client_name=^unknown$ ; \
- client_name=(\d+[\.-_]){4} ; \
- client_name=[\.-_](adsl|dynamic|ppp|)[\.-_] ; \
+ &&DYNAMIC{
+ client_name=^unknown$
+ client_name=(\d+[\.-_]){4}
+ client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
};
&&GOAWAY { &&RBLS; &&DYNAMIC; };
# rules
@@ -617,7 +647,156 @@
section for more information.
PLUGINS
- Please visit
+ Description
+
+ The plugin interface allow you to define your own checks and enhance
+ postfwd's functionality. Feel free to share useful things!
+
+ Warning
+
+ Note that the plugin interface is still at devel stage. Please test your
+ plugins carefully, because errors may cause postfwd to break! It is also
+ allowed to override attributes or built-in functions, but be sure that
+ you know what you do because some of them are used internally.
+
+ Please keep security in mind, when you access sensible ressources and
+ never, ever run postfwd as privileged user! Also never trust your input
+ (especially hostnames, and e-mail addresses).
+
+ ITEMS
+
+ Item plugins are perl subroutines which integrate additional attributes
+ to requests before they are evaluated against postfwd's ruleset like any
+ other item of the policy delegation protocol. This allows you to create
+ your own checks.
+
+ plugin-items can not be used selective. these functions will be executed
+ for every request postfwd receives, so keep performance in mind.
+
+ SYNOPSIS: %result = postfwd_items_plugin{}(%request)
+
+ means that your subroutine, called , has access to a hash called
+ %request, which contains all request attributes, like
+ $request{client_name} and must return a value in the following form:
+
+ save: $result{- } =
+
+ this creates the new item - containing
, which will be
+ integrated in the policy delegation request and therefore may be used in
+ postfwd's ruleset.
+
+ # do NOT remove the next line
+ %postfwd_items_plugin = (
+
+ # EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # allows to check postfwd version in ruleset
+ "version" => sub {
+ my(%request) = @_;
+ my(%result) = (
+ "version" => $NAME." ".$VERSION,
+ );
+ return %result;
+ },
+
+ # sender_domain and recipient_domain
+ "address_parts" => sub {
+ my(%request) = @_;
+ my(%result) = ();
+ $request{sender} =~ /@([^@]*)$/;
+ $result{sender_domain} = ($1 || '');
+ $request{recipient} =~ /@([^@]*)$/;
+ $result{recipient_domain} = ($1 || '');
+ return %result;
+ },
+
+ # do NOT remove the next line
+ );
+
+ COMPARE
+
+ Compare plugins allow you to define how your new items should be
+ compared to the ruleset. These are optional. If you don't specify one,
+ the default (== for exact match, =~ for PCRE, ...) will be used.
+
+ SYNOPSIS: - => sub { return &{$postfwd_compare{
}}(@_); },
+
+ # do NOT remove the next line
+ %postfwd_compare_plugin = (
+
+ EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # Simple example
+ # SYNOPSIS: = - (return &{$postfwd_compare{
}}(@_))
+ "client_address" => sub { return &{$postfwd_compare{cidr}}(@_); },
+ "size" => sub { return &{$postfwd_compare{numeric}}(@_); },
+ "recipient_count" => sub { return &{$postfwd_compare{numeric}}(@_); },
+
+ # Complex example
+ # SYNOPSIS: = - (
, , , )
+ "numeric" => sub {
+ my($cmp,$val,$myitem,%request) = @_;
+ my($myresult) = undef; $myitem ||= "0"; $val ||= "0";
+ if ($cmp eq '==') {
+ $myresult = ($myitem == $val);
+ } elsif ($cmp eq '=<') {
+ $myresult = ($myitem <= $val);
+ } elsif ($cmp eq '=>') {
+ $myresult = ($myitem >= $val);
+ } elsif ($cmp eq '!=') {
+ $myresult = not($myitem == $val);
+ } elsif ($cmp eq '!<') {
+ $myresult = not($myitem <= $val);
+ } elsif ($cmp eq '!>') {
+ $myresult = not($myitem >= $val);
+ } else {
+ $myresult = ($myitem >= $val);
+ };
+ return $myresult;
+ },
+
+ # do NOT remove the next line
+ );
+
+ ACTIONS
+
+ Action plugins allow to define new postfwd actions. By setting the
+ $stop-flag you can decide to continue or to stop parsing the ruleset.
+
+ SYNOPSIS: (, , , , ) =
+ (, , , , , )
+
+ # do NOT remove the next line
+ %postfwd_actions_plugin = (
+
+ # EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # note() command
+ "note" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ mylogs 'info', "[RULES] ".$myline." - note: ".$myarg if $myarg;
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # skips next rules
+ "skip" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ $index += $myarg if ( $myarg and not(($index + $myarg) > $#Rules) );
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # dumps current request contents to syslog
+ "dumprequest" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ map { mylogs 'info', "[DUMP] rule=$index, Attribute: $_=$request{$_}" } (keys %request);
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # do NOT remove the next line
+ );
COMMAND LINE
*Ruleset*
@@ -634,12 +813,6 @@
Adds to ruleset. Remember that you might have to quote
strings that contain whitespaces or shell characters.
- *Plugins*
-
- --plugins
- A file containing plugin routines for postfwd. Please see the
- PLUGINS section for more information.
-
*Scoring*
-s, --scores =
@@ -647,7 +820,7 @@
Multiple usage is allowed. Just chain your arguments, like:
- postfwd2 -r "- =
;action=" -f -f --plugins ...
+ postfwd2 -r "- =
;action=" -f -f ...
or
postfwd2 --scores 4.5="WARN high score" --scores 5.0="REJECT postfwd2 score too high" ...
@@ -662,13 +835,13 @@
-d, --daemon
postfwd2 will run as daemon and listen on the network for incoming
- queries (default 127.0.0.1:10040).
+ queries (default 127.0.0.1:10045).
-i, --interface
Bind postfwd2 to the specified interface (default 127.0.0.1).
-p, --port
- postfwd2 listens on the specified port (default tcp/10040).
+ postfwd2 listens on the specified port (default tcp/10045).
--proto
The protocol type for postfwd's socket. Currently you may use 'tcp' or 'unix' here.
@@ -694,11 +867,18 @@
-R, --chroot
Chroot the process to the specified path.
- Test this before using - you might need some libs there.
+ Please look at http://postfwd.org/postfwd2-chroot.html before use!
--pidfile
The process id will be saved in the specified file.
+ --facility
+ sets the syslog facility, default is 'mail'
+
+ --socktype
+ sets the Sys::Syslog socktype to 'native', 'inet' or 'unix'.
+ Default is to auto-detect this depening on module version and os.
+
-l, --logname
Labels the syslog messages. Useful when running multiple
instances of postfwd.
@@ -706,6 +886,12 @@
--loglen
Truncates any syslog message after characters.
+ *Plugins*
+
+ --plugins
+ Loads postfwd plugins from file. Please see http://postfwd.org/postfwd.plugins
+ or the plugins.postfwd.sample that is available from the tarball for more info.
+
*Optional arguments*
These parameters influence the way postfwd2 is working. Any of them can
@@ -834,6 +1020,22 @@
timeout in seconds to parse a single configuration line. if exceeded, the rule will
be skipped. this is used to prevent problems due to large files or loops.
+ --keep_rates (default=0)
+ With this option set postfwd2 does not clear the rate limit counters on reload. Please
+ note that you have to restart (not reload) postfwd with this option if you change
+ any rate limit rules.
+
+ --save_rates (default=none)
+ With this option postfwd saves existing rate limit counters to disk and reloads them
+ on program start. This allows persistent rate limits across program restarts or reboots.
+ Please note that postfwd needs read and write access to the specified file.
+
+ --fast_limit_evaluation (default=0)
+ Once a ratelimit was set by the ruleset, future requests will be evaluated against it
+ before consulting the ruleset. This mode was the default behaviour until v1.30.
+ With this mode rate limits will be faster, but also eventually set up
+ whitelisting-rules within the ruleset might not work as expected.
+
*Informational arguments*
These arguments are for command line usage only. Never ever use them
@@ -858,6 +1060,26 @@
This option turns of any syslogging and output. It is included
for performance testing.
+ --dumpstats
+ Displays program usage statistics.
+
+ --dumpcache
+ Displays cache contents.
+
+ --delcache -
+ Removes an item from the request cache. Use --dumpcache to identify objects.
+ E.g.:
+ # postfwd --dumpcache
+ ...
+ %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @count -> '1'
+ %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @maxcount -> '2'
+ ...
+ # postfwd --delrate="sender=gmato@jqvo.org"
+ rate cache item 'sender=gmato@jqvo.org' removed
+
+ --delrate
-
+ Removes an item from the rate cache. Use --dumpcache to identify objects.
+
REFRESH
In daemon mode postfwd2 reloads it's ruleset after receiving a HUP
signal. Please see the description of the '-I' switch to have your
@@ -894,18 +1116,25 @@
# 1. 30MB for systems in *.customer1.tld
# 2. 20MB for SASL user joejob
# 3. 10MB default
- id=SZ001; state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\.customer1.tld$
- id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
- id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=10000000
- id=SZ100; state==END-OF-MESSAGE; action=REJECT message too large
+ id=SZ001; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\.customer1.tld$
+ id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
+ id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=10000000
+ id=SZ100; protocol_state==END-OF-MESSAGE; action=REJECT message too large
## Selective Greylisting
+ ##
+ ## Note that postfwd does not include greylisting. This setup requires a running postgrey service
+ ## at port 10031 and the following postfix restriction class in your main.cf:
+ ##
+ ## smtpd_restriction_classes = check_postgrey, ...
+ ## check_postgrey = check_policy_service inet:127.0.0.1:10031
+ #
# 1. if listed on zen.spamhaus.org with results 127.0.0.10 or .11, dns cache timeout 1200s
# 2. Client has no rDNS
# 3. Client comes from several dialin domains
- id=GR001; action=greylisting ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
- id=GR002; action=greylisting ; client_name=^unknown$
- id=GR003; action=greylisting ; client_name=\.(t-ipconnect|alicedsl|ish)\.de$
+ id=GR001; action=check_postgrey ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
+ id=GR002; action=check_postgrey ; client_name=^unknown$
+ id=GR003; action=check_postgrey ; client_name=\.(t-ipconnect|alicedsl|ish)\.de$
## Date Time
date=24.12.2007-26.12.2007 ; action=450 4.7.1 office closed during christmas
@@ -913,7 +1142,7 @@
time=-07:00:00 ; sasl_username=jim ; action=450 4.7.1 to early for you, jim
time=22:00:00- ; sasl_username=jim ; action=450 4.7.1 to late now, jim
months=-Apr ; action=450 4.7.1 see you in may
- days=!!Mon-Fri ; action=greylist
+ days=!!Mon-Fri ; action=check_postgrey
## Usage of jump
# The following allows a message size of 30MB for different
@@ -923,8 +1152,8 @@
id=R003 ; action=jump(R100) ; ccert_fingerprint=AA:BB:CC:DD:...
id=R004 ; action=jump(R100) ; ccert_fingerprint=AF:BE:CD:DC:...
id=R005 ; action=jump(R100) ; ccert_fingerprint=DD:CC:BB:DD:...
- id=R099 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
- id=R100 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
+ id=R099 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
+ id=R100 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
## Usage of score
# The following rejects a mail, if the client
@@ -932,8 +1161,8 @@
# - is listed in 1 RBL or 1 RHSBL and has no correct rDNS
# - other clients without correct rDNS will be greylist-checked
# - some whitelists are used to lower the score
- id=S01 ; score=2.6 ; action=greylisting
- id=S02 ; score=5.0 ; action=REJECT postfwd2 score too high
+ id=S01 ; score=2.6 ; action=check_postgrey
+ id=S02 ; score=5.0 ; action=REJECT postfwd score too high
id=R00 ; action=score(-1.0) ; rbl=exemptions.ahbl.org,list.dnswl.org,query.bondedsender.org,spf.trusted-forwarder.org
id=R01 ; action=score(2.5) ; rbl=bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
id=R02 ; action=score(2.5) ; rhsbl=rhsbl.ahbl.org, rhsbl.sorbs.net
@@ -945,10 +1174,10 @@
# The following temporary rejects requests from "unknown" clients, if they
# 1. exceeded 30 requests per hour or
# 2. tried to send more than 1.5mb within 10 minutes
- id=RATE01 ; client_name==unknown ; state==RCPT ; \
- action==rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
- id=SIZE01 ; client_name==unknown ; state==END_OF_DATA ; \
- action==size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
+ id=RATE01 ; client_name==unknown ; protocol_state==RCPT
+ action=rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
+ id=SIZE01 ; client_name==unknown ; protocol_state==END-OF-MESSAGE
+ action=size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
## Macros
# definition
@@ -961,34 +1190,34 @@
## Groups
# definition
- &&RBLS { \
- rbl=zen.spamhaus.org ; \
- rbl=list.dsbl.org ; \
- rbl=bl.spamcop.net ; \
- rbl=dnsbl.sorbs.net ; \
- rbl=ix.dnsbl.manitu.net ; \
+ &&RBLS{
+ rbl=zen.spamhaus.org
+ rbl=list.dsbl.org
+ rbl=bl.spamcop.net
+ rbl=dnsbl.sorbs.net
+ rbl=ix.dnsbl.manitu.net
};
- &&RHSBLS { \
+ &&RHSBLS{
...
};
- &&DYNAMIC { \
- client_name==unknown ; \
- client_name~=(\d+[\.-_]){4} ; \
- client_name~=[\.-_](adsl|dynamic|ppp|)[\.-_] ; \
+ &&DYNAMIC{
+ client_name==unknown
+ client_name~=(\d+[\.-_]){4}
+ client_name~=[\.-_](adsl|dynamic|ppp|)[\.-_]
...
};
- &&BAD_HELO { \
- helo_name==my.name.tld; \
- helo_name~=^([^\.]+)$; \
- helo_name~=\.(local|lan)$; \
+ &&BAD_HELO{
+ helo_name==my.name.tld
+ helo_name~=^([^\.]+)$
+ helo_name~=\.(local|lan)$
...
};
- &&MAINTENANCE { \
- date=15.01.2007 ; \
- date=15.04.2007 ; \
- date=15.07.2007 ; \
- date=15.10.2007 ; \
- time=03:00:00 - 04:00:00 ; \
+ &&MAINTENANCE{
+ date=15.01.2007
+ date=15.04.2007
+ date=15.07.2007
+ date=15.10.2007
+ time=03:00:00 - 04:00:00
};
# rules
id=COMBINED ; &&RBLS ; &&DYNAMIC ; action=REJECT dynamic client and listed on RBL
@@ -1005,7 +1234,7 @@
## combined with enhanced rbl features
#
- id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS ; \
+ id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS
action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,HIT_dnstxt=$$dnsbltext)
id=RBL02 ; HIT_dnsbls>=2 ; action=554 5.7.1 blocked using $$HIT_dnsbls DNSBLs [INFO: $$HIT_dnstxt]
@@ -1144,7 +1373,7 @@
postfwd2 in high volume environments. Start postfwd2 with the following
parameters:
- postfwd2 -d -f /etc/postfwd.cf -i 127.0.0.1 -p 10040 -u nobody -g nobody -S
+ postfwd2 -d -f /etc/postfwd.cf -i 127.0.0.1 -p 10045 -u nobody -g nobody -S
For efficient caching you should check if you can use the options
--cacheid, --cache-rdomain-only, --cache-no-sender and --cache-no-size.
@@ -1153,16 +1382,16 @@
Aug 9 23:00:24 mail postfwd[5158]: postfwd2 n.nn ready for input
- and use `netstat -an|grep 10040` to check for something like
+ and use `netstat -an|grep 10045` to check for something like
- tcp 0 0 127.0.0.1:10040 0.0.0.0:* LISTEN
+ tcp 0 0 127.0.0.1:10045 0.0.0.0:* LISTEN
If everything works, open your postfix main.cf and insert the following
- 127.0.0.1:10040_time_limit = 3600 <--- integration
+ 127.0.0.1:10045_time_limit = 3600 <--- integration
smtpd_recipient_restrictions = permit_mynetworks <--- recommended
reject_unauth_destination <--- recommended
- check_policy_service inet:127.0.0.1:10040 <--- integration
+ check_policy_service inet:127.0.0.1:10045 <--- integration
Reload your configuration with `postfix reload` and watch your logs. In
it works you should see lines like the following in your mail log:
@@ -1183,9 +1412,9 @@
# Restriction Classes
smtpd_restriction_classes = postfwdcheck,
... <--- integration
- postfwdcheck = check_policy_service inet:127.0.0.1:10040 <--- integration
+ postfwdcheck = check_policy_service inet:127.0.0.1:10045 <--- integration
- 127.0.0.1:10040_time_limit = 3600 <--- integration
+ 127.0.0.1:10045_time_limit = 3600 <--- integration
smtpd_recipient_restrictions = permit_mynetworks, <--- recommended
reject_unauth_destination, <--- recommended
... <--- optional
@@ -1211,7 +1440,7 @@
For network tests I use netcat:
- nc 127.0.0.1 10040 allows to load and save
+ rate limit counters to disk on program start and termination.
+ this allows rate limit persistence during restarts and reboots
+ (requires perl module 'Storable')
+- feature: the --debugitem="sender=example\.org$" option
+ allows verbose logging for particular requests
+- feature: the debug() action allows verbose logging for certain
+ rules:
+ ------------------------------------------------------------
+ id=R01
+ client_address=1.1.1.1
+ action=debug(on)
+ id=R02
+ ...
+ id=R42
+ action=debug(off)
+ ------------------------------------------------------------
+- feature: nested commands are possible now, e.g.:
+ ------------------------------------------------------------
+ # throttle
+ action=rate(client_address/10/60/wait(3))
+ ------------------------------------------------------------
+- feature: new mail(server/helo/from/to/subject/body) action.
+ Please take a look at the manual, especially about
+ it's limitations, before using it!
+ ------------------------------------------------------------
+ # alert
+ action=size(recipient_domain/100000000/86400/mail(mailhost/helo/from/to/subject/text))
+ ------------------------------------------------------------
+
+1.31
+====
+- feature: single cache items can be wiped using --delcache -
+ or --delrate
- options. use --dumpcache to identify
+- feature: sasl_username is logged if available
+ (thanks to Bernhard Schmidt)
+- code: rate limit action is executed, if the first request exceeds the limit
+- code: exceeded ratecounters will not be kept permanently anymore. this
+ allows further requests to pass, if they are below the limit
+- code: rate limits are evaluated at ruleset stage now, which leads to
+ much more comprehensible behaviour. due to this change the request
+ cache is now disabled, if rate limits are used. use the
+ --fast_limit_evaluation option to revert to the former mode.
+
+1.30
+====
+- feature: new parser enhancement allows to omit the trailing "\" for multi-line rules,
+ if the following lines are prefixed by whitespace characters:
+ --------------------------------------
+ id=RCPTCOUNT
+ protocol_state == END-OF-MESSAGE
+ client_address != 10.1.1.0/24
+ recipient_count >= 100
+ action=REJECT too many recipients
+ --------------------------------------
+- feature: new plugin interface (BETA)
+- feature: Time::HiRes is used if available
+- feature: new $$ratecount variable for rate() actions
+- feature: ported --dumpstats and --dumpcache option from postfwd2
+- bugfix: fixed program usage statistics (--summary)
+- docs: documentation updates
+
+1.22
+=====
+- feature: new option --keep_rates
+- feature: queueid is logged when available
+- bugfix: rate limits using the same item and the same limits
+ did not work correctly (thanks to Yves Blusseau):
+ id=INT01; INT_DOMAIN==1; \
+ action=rate(sender/100/60/450 4.7.1 too much for internal domains)
+ id=EXT01; EXT_DOMAIN==1; \
+ action=rate(sender/100/60/450 4.7.1 too much for external domains)
+- bugfix: small fix for cleanup of old rate limits
+- docs: documentation updates and fixes (thanks to Vincent Lefevre)
+
+1.21
+=====
+- feature: postfwd supports multiple rate limits to the same items now.
+ this means that the following will now work as expected:
+ id=R001; recipient_count>=100; action=rate(sender/3/3600/WARN state RED)
+ id=R002; recipient_count>=100; action=rate(sender/2/3600/WARN state YELLOW)
+ id=R003; recipient_count>=100; action=rate(sender/1/3600/WARN state GREEN)
+- code: ported command-line option --facility from postfwd2
+- docs: documentation updates and fixes (thanks to Vincent Lefevre)
+
+1.20
+=====
+- code: changed the default umask for the server socket to 0111
+ to support out-of-the-box postfix setup. Use the
+ --umask setting to change this
+- bugfix: rbl check could fail on multiple dnsbl answers
+- bugfix: rbl checks disabled for ipv6 addresses, cidr compare
+ will switch to default (regex/string)
+
+1.19
+=====
+- code: Rate limit code rewritten
+- code: new --umask setting allows to set filepermissions for pidfiles
+ and unix domain sockets. Default is 0117 (owner and group rw).
+
+1.18
+=====
+- bugfix: Fixed bug when comparing sender and recipient addresses, like
+ "sender=$$recipient". This affects only postfwd version 1.17.
+
+1.17
+=====
+- bugfix: Invalid characters in variable substitutions were not correctly catched when
+ the '=' operator was used, like "client_name=$$helo_name". If you can not
+ upgrade for some reason change your rule to "client_name=~$$helo_name"
+- code: Net::DNS errors will now be handled gracefully
+- code: default for options --dns_max_ns_a_lookups and --dns_max_mx_a_lookups of 100
+
+1.16
+=====
+- bugfix: this is a bugfix release for 1.15. anyone affected is encouraged to upgrade.
+ detail: the default behavior for the '=' operator with numeric items
+ (size, recipient_count, ...) changed with version 1.15 to '==' (equals to).
+ now these items are compared '>=' (greater than) again.
+ note: if you are using 1.15 and you are not able upgrade for some reason,
+ please change '=' to '>=' in your ruleset where you mean 'greater than'.
+
+1.15
+=====
+- feature: items may now be retrieved from files using "item=file:/some/where"
+ more information in the postfwd manual (FILES section)
+- feature: helo_address, and sender_(ns|mx)_addrs can now be csv items
+- feature: new rcpt() command counts recipients for rate limits (thanks to Sahil Tandon)
+- code: redirect syslog to stdout for --kill, --reload and --showconfig
+- code: option --reload (HUP signal) now reloads config, if the file is unchanged
+- code: configuration parser improvements:
+ * rules without defined action will be skipped at configuration stage
+ * undefined ACLs will now be detected and skipped at configuration stage
+ * parser timeout skips loading a rule after 4s, to prevent problems with
+ large files or loops. use --config_timeout to override
+- bugfix: documentation fixed (missing "action=" in ask() examples)
+
+1.14
+=====
+- feature: new compare operators *
+ ====================================================================
+ ITEM == VALUE true if ITEM equals VALUE
+ ITEM => VALUE true if ITEM >= VALUE
+ ITEM =< VALUE true if ITEM <= VALUE
+ ITEM =~ VALUE true if ITEM ~= /^VALUE$/i
+ *ITEM != VALUE false if ITEM equals VALUE
+ *ITEM !> VALUE false if ITEM >= VALUE
+ *ITEM !< VALUE false if ITEM <= VALUE
+ *ITEM !~ VALUE false if ITEM ~= /^VALUE$/i
+ ITEM = VALUE default behaviour (see ITEMS section)
+ ====================================================================
+- feature: added --nodaemon option
+- code: non dns items first: if a rule contains dns and non dns items, the
+ lookups will only be done if all non dns items matched
+- bugfix: empty pcre with empty sender_(ns|mx)_names was parsed incorrectly.
+ this bug affects postfwd versions 1.12 - 1.13
+- bugfix: negated pcre items with '~=' operator were parsed incorrectly.
+ this bug affects postfwd version 1.13
+
+1.13
+=====
+- feature: enabled dns cache for sender(ns|mx) and helo address
+- feature: new options --dns_max_ns_lookups and --dns_max_mx_lookups
+- bugfix: workaround: Net::Server died if a unix domain socket
+ filename without a dot ('.') was used (B. Frauendienst)
+
+1.12
+=====
+- feature: new items sender_ns_names and sender_ns_addrs
+- feature: new items sender_mx_names and sender_mx_addrs
+- feature: new item helo_address, please see docs for more
+- feature: added --proto switch, to enable the use of unix domain sockets
+ (thanks to Bernhard Frauendienst)
+- feature: added command-line options --kill and --reload
+ (of course you can still use TERM and HUP signals)
+- feature: dnsbl txt lookups only for dnsbls with at least one a record.
+ use --dns_async_txt for the old behaviour (see docs for more).
+- code: small performance improvement (5-10%) for pcre (~= or =~) items
+- bugfix: network 0.0.0.0/0 did not work as expected on all platforms
+- bugfix: postfwd tried to chop() an uninitialized value when sending
+ garbage (non policy delegation protocol requests) to it.
+
+1.11
+=====
+- feature: the ask() action allows to delegate the policy decision to another
+ policy service (like postgrey). a new parameter allows to specify
+ answer patterns which should be ignored by postfwd. please look
+ at the 'ACTIONS' section in the manual (postfwd2 -m) for details.
+- feature: new options --noidlestats and --norulelog
+- feature: more informative --version
+- feature: documentation updates
+
+
+**************************************************************************************************
+ATTENTION: requirements changed - postfwd since v1.10pre8 now uses Net::DNS.
+ Net::DNS::Async and Net::CIDR::Lite are not required anymore.
+NOTE: please see the docs ('postfwd -m' or 'perldoc postfwd') for more information
+**************************************************************************************************
+
+1.10pre8b
+==========
+- bugfix: fixed two warnings about logging of undefined values in verbose mode
+
+1.10pre8a
+==========
+- bugfix: item plugins have been made available as cache-id items. this fixes a minor issue with
+ --cache-rdomain-only and version 1.10pre8
+
+1.10pre8
+=========
+- code: Net::DNS::Async is no longer used. The parameters --dns_queuesize and
+ --dns_retries are still valid but have no function. The option --dns_timeout
+ now defaults to 14s and applies to all rules containing dns items.
+- code: Net::CIDR::Lite is not required any longer.
+- feature: the new variable $$request_hits contains a list of all matching ruleids
+- feature: the new variable $$dnsbltext allows access to txt records of rbls
+- feature: new options --no-rulestats and --nodnslog
+- feature: ttls of the dns responses override --cache-rbl-timeout when bigger, which means
+ that you can set the option to 0 if you want to use the ttl of the dns answer.
+- feature: new item "rhsbl_helo" allows to check helo against rhsbls
+- bugfix: disabled fallback to synchronous dns on timed out rbls, default is now
+ to disable non responding dnsbls after 11 timeouts for 1200 seconds.
+ use --dns_timeout_max and --dns_timeout_interval to adjust these settings.
+- bugfix: days=Wed now means exactly Wednesday. to use a range you may
+ still specify days=Wed- days=-Wed and days=Tue-Thu
+ this applies to all date and time items
+- code: --shortlog is now default behaviour (use -v to see more)
+- code: changed Net::Server behaviour to ignore syslog errors
+
+
+1.10pre7c
+==========
+- note: 1.10pre7c does not contain any code-changes to the postfwd daemon.
+ this release only fixes some issues when buidling packages.
+- bugfix: set permissions of manpage dirs to 755
+- bugfix: manpage has gone to section 8
+- bugfix: postfwd-rblcheck.pl has gone to the tools folder
+- bugfix: documentation now refers to request.sample
+
+1.10pre7b
+==========
+- bugfix: inter-section links in documentation did not work correctly
+ (thanks to Alexander 'Leo' Bergolth)
+
+1.10pre7a
+==========
+- bugfix: implemented workaround for possible crash of Sys::Syslog when syslog
+ daemon is unavailable (thanks to Henrik Krohns)
+- bugfix: changed syslog socktype on solaris
+
+1.10pre7
+=========
+- feature: $$request_score may now be used to access a request's score
+- feature: auto-deactivation of non-responding dnsbls; please see the
+ new --cleanup-timeouts and --dns_timeout_max options
+- feature: the set command allows some basic operations:
+ =========================================================
+ action=set(ITEM+=VALUE) adds VALUE to ITEM
+ action=set(ITEM-=VALUE) substracts VALUE from ITEM
+ action=set(ITEM*=VALUE) multiplies ITEM by VALUE
+ action=set(ITEM/=VALUE) divides ITEM through VALUE
+ action=set(ITEM.=VALUE) concatenates ITEM and VALUE
+ action=set(ITEM==VALUE) sets ITEM to VALUE
+ action=set(ITEM=VALUE) default: sets ITEM to VALUE
+ =========================================================
+- bugfix: fixed wrong timestamp for timed out rbls
+- code: score() command now allows integer values
+- code: setting an empty score removes it from the table
+- code: duplicate lookups within the same rule are now recognised
+
+1.10pre6
+=========
+- feature: the new rate() and size() commands offer some basic rate limit controls
+- feature: new cleanup options: --cleanup-rates
+- feature: regexps may now be included in // characters
+- feature: an empty sender address is now replaced by <>
+- bugfix: some csv-separated itemlists did not work correctly since v1.10pre1
+- bugfix: fixed a possible race condition with request cache when config was reloaded via HUP signal
+
+1.10pre5a
+=========
+- bugfix: fixed a possible race condition in rbl_read_dns() function
+
+1.10pre5
+========
+- feature: new dnsbl lookup types: rhsbl_client, rhsbl_sender, rhsbl_reverse_client
+- feature: new caching option --cacheid allows to increase performance and cache efficiency
+- code: cleanups will only be logged if '-v' was set or if the process took at least 1 second
+
+1.10pre4
+========
+- feature: new date items 'days=Sun-Sat' and 'months=Jan-Dec'
+- feature: all date/time items may now be csv-separated lists
+- feature: the set command can now have multiple, csv-separated arguments
+- feature: enhanced use of rblcount and rhsblcount (see doc)
+- feature: new caching options --cache-no-sender,--cache-rbl-timeout and --cache-rbl-default
+- feature: new cleanup options: --cleanup-requests and --cleanup-rbls
+- code: cache cleanups are now performed on interval basis (not per request)
+ which should decrease load on busy systems.
+- code: warning on multiple definitions of id, action, rblcount and rhsblcount is issued
+- bugfix: date items may now contain whitespaces (e.g. days = Fri - Sat)
+
+1.10pre3
+========
+- feature: all hits for a rule are now logged in the final message
+- feature: option --shortlog disables logging for some postfwd actions
+- feature: introduced set() command, which enables setting of variables, which then can be
+ compared to the ruleset to gain performance on repeated item lists (see doc).
+- feature: introduced new command-line switches --dns_queuesize, --dns_retries and dns_retries
+ to influence the behaviour of DNS lookups
+- code: restructured code (~+15% speed compared to v1.03, with nodns ruleset)
+
+1.10pre2
+========
+- feature: DNS lookups are now parallelized per rule. this increases the performance of dnsbl
+ items (and any other future dns based check) significantly. implementation (per rule):
+ 1.) send dns queries, 2.) process other non-dns items, 3.) evaluate dns results
+ As a downside of this approach the parser does not wait for dns queries anymore, which
+ could result in increased load. you might use the sleep() command to get some delay ;-)
+
+1.10pre1
+========
+- feature: the way how request items are compared to the ruleset can now be influenced.
+ ===============================================================
+ ITEM==VALUE true if ITEM equals VALUE
+ ITEM>=VALUE true if ITEM >= VALUE
+ ITEM<=VALUE true if ITEM <= VALUE
+ ITEM~=VALUE true if ITEM ~= /^VALUE$/i
+ ITEM=VALUE old default behaviour
+ ===============================================================
+- feature: the score() command now allows some basic arithmetic operations (+-*/=)
+ e.g. action=score(*2) will double the current score
+- feature: you can now refer to request attributes in actions, which will e.g. allow the following:
+ id=R001; rbl=zen.spamhaus.org; \
+ action=554 5.7.1 see http://www.spamhaus.org/query/bl?ip=$$client_address
+- feature: introduced extra request attributes sender_localpart, sender_domain,
+ recipient_localpart, recipient_domain and version for use like:
+ id=test01; client_name ~= $$(sender_domain)$; action=score(-0.5)
+- bugfix: the "=" character could not be used in items
+- bugfix: negation of items (!!) did not work correctly under some circumstances
+- bugfix: time was logged incorrectly during request cache cleanups in verbose mode
+ (thanks to Henrik Krohns)
+- code: restructured some parts of the code for future enhancement options. a plugin interface
+ was prepared and will be included in the final version. perl's -w switch is used now.
+- note: the documentation has not been fully updated yet.
+
+1.03
+====
+- feature: request attributes can now be compared (e.g. to compare client_name and helo_name)
+- feature: rule items can now be negated (e.g. to compare if client_name does not match helo_name)
+- feature: extra verbose mode '-vv' now displays much more debug information
+- feature: -L switch to redirect log output to stdout
+- feature: new manual section about the parser, other updates
+- bugfix: caching did not work at end_of_data level because of different queue ids, corrected
+- bugfix: all numeric items will now match if the request attribute exceeds the corresponding
+ rule item. the negation operator will lead to the opposite effect:
+ =============================================================================
+ ITEM=VALUE TYPE
+ =============================================================================
+ rblcount=2 matches if rbl hits >= 2
+ recipient_count=10 matches if recipients >= 10
+ size=12345 matches if size >= 12345
+ encryption_keysize=256 matches if keysize >= 256
+ encryption_keysize=!!256 matches if keysize < 256
+ =============================================================================
+
+1.02
+====
+- bugfix: rblcount and rhsblcount did not work correctly since V1.01, corrected
+
+1.01
+====
+- feature: multiple rbl, rhsbl and client_address statements in a single rule are now possible
+- feature: note() command will now log (not warn!). an empty argument suppresses logging
+- feature: in verbose mode you must set -vv now to see the whole request attributes
+- feature: cached dnsbl results are now only logged in verbose mode
+- manual: several minor updates
+
+1.00
+====
+- feature: multiple definitions of the same item in a single rule to build groups
+- feature: rules can span multiple lines by specifying a trailing "\" character
+- feature: syslog_name can now be set with -l|--logname
+- bugfix: fixed bug in acl parser (no "}" character could be used in ACLs)
+
+0.99p
+=====
+- bugfix: size and rcpt_count were checked as minimum values
+ now they are correctly interpreted as maximum.
+
+0.99o
+=====
+- feature: date and time based rules
+- feature: macros (please see doc)
+- feature: slightly changed statistics output
+
+0.99n
+=====
+- first public beta version
+
+
diff -Nru postfwd-1.20/doc/postfwd.html postfwd-1.32/doc/postfwd.html
--- postfwd-1.20/doc/postfwd.html 2010-11-14 21:52:12.000000000 +0000
+++ postfwd-1.32/doc/postfwd.html 2011-12-18 12:34:41.000000000 +0000
@@ -51,54 +51,70 @@
postfwd [OPTIONS] [SOURCE1, SOURCE2, ...]
Ruleset: (at least one, multiple use is allowed):
- -f, --file <file> reads rules from <file>
- -r, --rule <rule> adds <rule> to config
+ -f, --file <file> reads rules from <file>
+ -r, --rule <rule> adds <rule> to config
Scoring:
- -s, --scores <v>=<r> returns <r> when score exceeds <v>
+ -s, --scores <v>=<r> returns <r> when score exceeds <v>
+
+ Control:
+ -d, --daemon run postfwd as daemon
+ -k, --kill stops daemon
+ --reload reloads configuration
+ --dumpstats displays usage statistics
+ --dumpcache displays cache contents
+ --delcache <item> removes an item from the request cache
+ --delrate <item> removes an item from the rate cache
Networking:
- -d, --daemon run postfwd as daemon
- -i, --interface <dev> listen on interface <dev>
- -p, --port <port> listen on port <port>
- --proto <proto> socket type (tcp or unix)
- -u, --user <name> set uid to user <name>
- -g, --group <name> set gid to group <name>
- --umask <mask> set umask for file permissions
- -R, --chroot <path> chroot the daemon to <path>
- --pidfile <path> create pidfile under <path>
- -l, --logname <label> label for syslog messages
- --loglen <int> truncates syslogs after <int> chars
+ -i, --interface <dev> listen on interface <dev>
+ -p, --port <port> listen on port <port>
+ --proto <proto> socket type (tcp or unix)
+ -u, --user <name> set uid to user <name>
+ -g, --group <name> set gid to group <name>
+ --umask <mask> set umask for file permissions
+ -R, --chroot <path> chroot the daemon to <path>
+ --pidfile <path> create pidfile under <path>
+ --facility <f> syslog facility
+ --socktype <s> syslog socktype
+ -l, --logname <label> label for syslog messages
+ --loglen <int> truncates syslogs after <int> chars
Caching:
- -c, --cache <int> sets the request-cache timeout to <int> seconds
- --cache-no-size ignores size attribute for caching
- --cache-no-sender ignores sender address in cache
- --cache-rdomain-only ignores localpart of recipient address in cache
- --cache-rbl-timeout default rbl timeout, if not specified in ruleset
- --cache-rbl-default default rbl response pattern to match (regexp)
- --cacheid <item>, .. list of attributes for request cache identifier
- --cleanup-requests cleanup interval in seconds for request cache
- --cleanup-rbls cleanup interval in seconds for rbl cache
- --cleanup-rates cleanup interval in seconds for rate cache
+ -c, --cache <int> sets the request-cache timeout to <int> seconds
+ --cache-no-size ignores size attribute for caching
+ --cache-no-sender ignores sender address in cache
+ --cache-rdomain-only ignores localpart of recipient address in cache
+ --cache-rbl-timeout default rbl timeout, if not specified in ruleset
+ --cache-rbl-default default rbl response pattern to match (regexp)
+ --cacheid <item>, .. list of attributes for request cache identifier
+ --cleanup-requests cleanup interval in seconds for request cache
+ --cleanup-rbls cleanup interval in seconds for rbl cache
+ --cleanup-rates cleanup interval in seconds for rate cache
Optional:
- -t, --test testing, always returns "dunno"
- -v, --verbose verbose logging, use twice (-vv) to increase level
- -S, --summary <int> show some usage statistics every <int> seconds
- --norulelog disbles rule logging
- --norulestats disables per rule statistics
- --noidlestats disables statistics when idle
- -n, --nodns disable dns
- --nodnslog disable dns logging
- --dns_async_txt perform dnsbl A and TXT lookups simultaneously
- --dns_timeout timeout in seconds for asynchonous dns queries
- --dns_timeout_max maximum of dns timeouts until a dnsbl will be deactivated
- --dns_timeout_interval interval in seconds for dns timeout maximum counter
- --dns_max_ns_lookups max names to look up with sender_ns_addrs
- --dns_max_mx_lookups max names to look up with sender_mx_addrs
- -I, --instantcfg re-reads rulefiles for every new request
- --config_timeout <i> parser timeout in seconds
+ -t, --test testing, always returns "dunno"
+ -v, --verbose verbose logging, use twice (-vv) to increase level
+ -S, --summary <int> show some usage statistics every <int> seconds
+ --norulelog disbles rule logging
+ --norulestats disables per rule statistics
+ --noidlestats disables statistics when idle
+ -n, --nodns disable dns
+ --nodnslog disable dns logging
+ --dns_async_txt perform dnsbl A and TXT lookups simultaneously
+ --dns_timeout timeout in seconds for asynchonous dns queries
+ --dns_timeout_max maximum of dns timeouts until a dnsbl will be deactivated
+ --dns_timeout_interval interval in seconds for dns timeout maximum counter
+ --dns_max_ns_lookups max names to look up with sender_ns_addrs
+ --dns_max_mx_lookups max names to look up with sender_mx_addrs
+ -I, --instantcfg re-reads rulefiles for every new request
+ --config_timeout <i> parser timeout in seconds
+ --keep_rates do not clear rate limit counters on reload
+ --save_rates <file> save and load rate limits on disk
+ --fast_limit_evaluation evaluate rate limits before ruleset is parsed
+
+ Plugins:
+ --plugins <file> loads postfwd plugins from file
Informational (use only at command-line!):
-C, --showconfig shows ruleset summary, -v for verbose
@@ -107,9 +123,6 @@
-V, --version shows program version
-h, --help shows usage
-m, --manual shows program manual
-
- Plugins:
- --plugins <file> loads plugins from <file>
@@ -138,7 +151,7 @@
A configuration line consists of optional item=value pairs, separated by semicolons
(`;`) and the appropriate desired action:
- [ <item1>[=><~]=<value>; <item2>[=><~]=<value>; ... ] action=<result>
+ [ <item1>=<value>; <item2>=<value>; ... ] action=<result>
Example:
client_address=192.168.1.1 ; sender==no@bad.local ; action=REJECT
@@ -167,10 +180,19 @@
appreciate.
A ruleset consists of one or multiple rules, which can be loaded from files or passed as command line
arguments. Please see the COMMAND LINE section below for more information on this topic.
-Rules can span multiple lines by adding a trailing backslash ``\'' character:
+Since postfwd version 1.30 rules spanning span multiple lines can be defined by prefixing the following
+lines with one or multiple whitespace characters (or '}' for macros):
- id=R_001 ; client_address=192.168.1.0/24; sender==no@bad.local; \
- action=REJECT please use your relay from there
+ id=RULE001
+ client_address=192.168.1.0/24
+ sender==no@bad.local
+ action=REJECT no access
+postfwd versions prior to 1.30 require trailing ';' and '\'-characters:
+
+ id=RULE001; \
+ client_address=192.168.1.0/24; \
+ sender==no@bad.local; \
+ action=REJECT no access
@@ -236,8 +258,14 @@
this enables version based checks in your rulesets
(e.g. for migration). works with old versions too,
because a non-existing item always returns false:
- id=R01; version~=1.10; sender_domain==some.org \
+ # version >= 1.10
+ id=R01; version~=1\.[1-9][0-9]; sender_domain==some.org \
; action=REJECT sorry no access
+
+ ratecount - only available for rate(), size() and rcpt() actions.
+ contains the actual limit counter:
+ id=R01; action=rate(sender/200/600/REJECT limit of 200 exceeded [$$ratecount hits])
+ id=R02; action=rate(sender/100/600/WARN limit of 100 exceeded [$$ratecount hits])
Besides these you can specify any attribute of the postfix policy delegation protocol.
Feel free to combine them the way you need it (have a look at the EXAMPLES section below).
Most values can be specified as regular expressions (PCRE). Please see the table below
@@ -287,34 +315,33 @@
encryption_keysize=256 mask = numeric, will match if keysize >= 256
...
the current list can be found at http://www.postfix.org/SMTPD_POLICY_README.html . Please read carefully about which
-attribute can be used at which level of the smtp transaction (e.g. size will only work reliably at END_OF_DATA level).
+attribute can be used at which level of the smtp transaction (e.g. size will only work reliably at END-OF-MESSAGE level).
Pattern matching is performed case insensitive.
Multiple use of the same item is allowed and will compared as logical OR, which means that this will work as expected:
- id=TRUST001; action=OK; encryption_keysize=64; \
- ccert_fingerprint=11:22:33:44:55:66:77:88:99; \
- ccert_fingerprint=22:33:44:55:66:77:88:99:00; \
- ccert_fingerprint=33:44:55:66:77:88:99:00:11; \
+ id=TRUST001; action=OK; encryption_keysize=64
+ ccert_fingerprint=11:22:33:44:55:66:77:88:99
+ ccert_fingerprint=22:33:44:55:66:77:88:99:00
+ ccert_fingerprint=33:44:55:66:77:88:99:00:11
sender=@domain\.local$
client_address, rbl and rhsbl items may also be specified as whitespace-or-comma-separated values:
- id=SKIP01; action=dunno; \
+ id=SKIP01; action=dunno
client_address=192.168.1.0/24, 172.16.254.23
- id=SKIP02; action=dunno; \
- client_address= 10.10.3.32 \
- 10.216.222.0/27
+ id=SKIP02; action=dunno
+ client_address=10.10.3.32 10.216.222.0/27
The following items currently have to be unique:
id, minimum and maximum values, rblcount and rhsblcount
Any item can be negated by preceeding '!!' to it, e.g.:
- id=TLS001 ; hostname=!!^secure\.trust\.local$ ; action=REJECT only secure.trust.local please
+ id=HOST001 ; hostname == !!secure.trust.local ; action=REJECT only secure.trust.local please
or using the right compare operator:
- id=USER01 ; sasl_username !~ /^(bob|alice)$/ ; action=REJECT who is that?
+ id=HOST001 ; hostname != secure.trust.local ; action=REJECT only secure.trust.local please
To avoid confusion with regexps or simply for better visibility you can use '!!(...)':
- id=USER01 ; sasl_username=!!( (bob|alice) ) ; action=REJECT who is that?
+ id=USER01 ; sasl_username = !!( (bob|alice) ) ; action=REJECT who is that?
Request attributes can be compared by preceeding '$$' characters, e.g.:
id=R-003 ; client_name = !! $$helo_name ; action=WARN helo does not match DNS
@@ -322,6 +349,29 @@
id=R-003 ; client_name = !!($$(helo_name)) ; action=WARN helo does not match DNS
This is only valid for PCRE values (see list above). The comparison will be performed as case insensitive exact match.
Use the '-vv' option to debug.
+These special items will be reset for any new rule:
+
+ rblcount - contains the number of RBL answers
+ rhsblcount - contains the number of RHSBL answers
+ matches - contains the number of matched items
+ dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
+ rbltype:rblname:<txt>; rbltype:rblname:<txt>; ...
+These special items will be changed for any matching rule:
+
+ request_hits - contains ids of all matching rules
+This means that it might be necessary to save them, if you plan to use these values in later rules:
+
+ # set vals
+ id=RBL01 ; rhsblcount=all; rblcount=all
+ action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
+ rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org
+ rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+ rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+
+ # compare
+ id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
+ id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
+ id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
@@ -341,15 +391,15 @@
id=R001 ; ccert_fingerprint==table:/etc/postfwd/wl_ccerts ; action=DUNNO
This will ignore the right-hand value. Items can be mixed:
- id=R002 ; action=REJECT \
- client_name==unknown; \
+ id=R002 ; action=REJECT
+ client_name==unknown
client_name==file:/etc/postfwd/blacklisted
and for non pcre (comma separated) items:
- id=R003 ; action=REJECT \
+ id=R003 ; action=REJECT
client_address==10.1.1.1, file:/etc/postfwd/blacklisted
- id=R004 ; action=REJECT \
+ id=R004 ; action=REJECT
rbl=myrbl.home.local, zen.spamhaus.org, file:/etc/postfwd/rbls_changing
You can check your configuration with the --show_config option at the command line:
@@ -447,16 +497,25 @@
please note that <action> is currently limited to postfix actions (no postfwd actions)!
# no more than 3 requests per 5 minutes
# from the same "unknown" client
- id=RATE01 ; client_name==unknown ; \
- action==rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
+ id=RATE01 ; client_name==unknown
+ action=rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
+ Please note also that the order of rate limits in your ruleset is important, which means
+ that this:
+ # works as expected
+ id=R001; action=rcpt(sender/500/3600/REJECT limit of 500 recipients per hour for sender $$sender exceeded)
+ id=R002; action=rcpt(sender/200/3600/WARN state YELLOW for sender $$sender)
+ leads to different results than this:
+ # rule R002 never gets executed
+ id=R001; action=rcpt(sender/200/3600/WARN state YELLOW for sender $$sender)
+ id=R002; action=rcpt(sender/500/3600/REJECT limit of 500 recipients per hour for sender $$sender exceeded)
size (<item>/<max>/<time>/<action>)
this command works similar to the rate() command with the difference, that the rate counter is
increased by the request's size attribute. to do this reliably you should call postfwd from
smtpd_end_of_data_restrictions. if you want to be sure, you could check it within the ruleset:
# size limit 1.5mb per hour per client
- id=SIZE01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \
- action==size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
+ id=SIZE01 ; protocol_state==END-OF-MESSAGE ; client_address!=10.1.1.1
+ action=size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
rcpt (<item>/<max>/<time>/<action>)
this command works similar to the rate() command with the difference, that the rate counter is
@@ -464,8 +523,8 @@
from smtpd_data_restrictions or smtpd_end_of_data_restrictions. if you want to be sure, you could
check it within the ruleset:
# recipient count limit 3 per hour per client
- id=RCPT01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \
- action==rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
+ id=RCPT01 ; protocol_state==END-OF-MESSAGE ; client_address!=10.1.1.1
+ action=rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
ask (<addr>:<port>[:<ignore>])
allows to delegate the policy decision to another policy service (e.g. postgrey). the first
@@ -473,17 +532,22 @@
specified to tell postfwd to ignore certain answers and go on parsing the ruleset:
# example1: query postgrey and return it's answer to postfix
id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031)
- # example2: query postgrey but ignore it's answer, if it matches 'DUNNO'
+ # example2: query postgrey but ignore the answer, if it matches 'DUNNO'
# and continue parsing postfwd's ruleset
id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031:^dunno$)
+ mail(server/helo/from/to/subject/body)
+ Very basic mail command, that sends a message with the given arguments. LIMITATIONS:
+ This basically performs a telnet. No authentication or TLS are available. Additionally it does
+ not track notification state and will notify you any time, the corresponding rule hits.
+
wait (<delay>)
pauses the program execution for <delay> seconds. use this for
delaying or throtteling connections.
note (<string>)
just logs the given string and continues parsing the ruleset.
- if the string is empty, nothing will be logged.
+ if the string is empty, nothing will be logged (noop).
quit (<code>)
terminates the program with the given exit-code. postfix doesn`t
@@ -491,29 +555,6 @@
You can reference to request attributes, like
id=R-HELO ; helo_name=^[^\.]+$ ; action=REJECT invalid helo '$$helo_name'
-These special attributes will be reset for any new rule:
-
- rblcount - contains the number of RBL answers
- rhsblcount - contains the number of RHSBL answers
- matches - contains the number of matched items
- dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
- rbltype:rblname:<txt>; rbltype:rblname:<txt>; ...
-These special attributes will be changed for any matching rule:
-
- request_hits - contains ids of all matching rules
-This means that it might be necessary to save them, if you plan to use these values in later rules:
-
- # set vals
- id=RBL01 ; rhsblcount=all ; rblcount=all ; \
- rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org ; \
- rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \
- rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \
- action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
-
- # compare
- id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
- id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
- id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
@@ -536,18 +577,18 @@
&&GONOW ; &&RBLS ; client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
Macros can contain macros, too:
- # definition (note the trailing "\" characters)
- &&RBLS { \
- rbl=zen.spamhaus.org ; \
- rbl=list.dsbl.org ; \
- rbl=bl.spamcop.net ; \
- rbl=dnsbl.sorbs.net ; \
- rbl=ix.dnsbl.manitu.net ; \
+ # definition
+ &&RBLS{
+ rbl=zen.spamhaus.org
+ rbl=list.dsbl.org
+ rbl=bl.spamcop.net
+ rbl=dnsbl.sorbs.net
+ rbl=ix.dnsbl.manitu.net
};
- &&DYNAMIC { \
- client_name=^unknown$ ; \
- client_name=(\d+[\.-_]){4} ; \
- client_name=[\.-_](adsl|dynamic|ppp|)[\.-_] ; \
+ &&DYNAMIC{
+ client_name=^unknown$
+ client_name=(\d+[\.-_]){4}
+ client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
};
&&GOAWAY { &&RBLS; &&DYNAMIC; };
# rules
@@ -556,7 +597,141 @@
-Please visit http://www.postfwd.org/postfwd.plugins
+Description
+The plugin interface allow you to define your own checks and enhance postfwd's
+functionality. Feel free to share useful things!
+Warning
+Note that the plugin interface is still at devel stage. Please test your plugins
+carefully, because errors may cause postfwd to break! It is also
+allowed to override attributes or built-in functions, but be sure that you know
+what you do because some of them are used internally.
+Please keep security in mind, when you access sensible ressources and never, ever
+run postfwd as privileged user! Also never trust your input (especially hostnames,
+and e-mail addresses).
+ITEMS
+Item plugins are perl subroutines which integrate additional attributes to requests
+before they are evaluated against postfwd's ruleset like any other item of the
+policy delegation protocol. This allows you to create your own checks.
+plugin-items can not be used selective. these functions will be executed for every
+request postfwd receives, so keep performance in mind.
+
+ SYNOPSIS: %result = postfwd_items_plugin{<name>}(%request)
+means that your subroutine, called <name>, has access to a hash called %request,
+which contains all request attributes, like $request{client_name} and must
+return a value in the following form:
+
+ save: $result{<item>} = <value>
+this creates the new item <item> containing <value>, which will be integrated in
+the policy delegation request and therefore may be used in postfwd's ruleset.
+
+ # do NOT remove the next line
+ %postfwd_items_plugin = (
+
+ # EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # allows to check postfwd version in ruleset
+ "version" => sub {
+ my(%request) = @_;
+ my(%result) = (
+ "version" => $NAME." ".$VERSION,
+ );
+ return %result;
+ },
+
+ # sender_domain and recipient_domain
+ "address_parts" => sub {
+ my(%request) = @_;
+ my(%result) = ();
+ $request{sender} =~ /@([^@]*)$/;
+ $result{sender_domain} = ($1 || '');
+ $request{recipient} =~ /@([^@]*)$/;
+ $result{recipient_domain} = ($1 || '');
+ return %result;
+ },
+
+ # do NOT remove the next line
+ );
+COMPARE
+Compare plugins allow you to define how your new items should be compared to the ruleset.
+These are optional. If you don't specify one, the default (== for exact match, =~ for PCRE, ...)
+will be used.
+
+ SYNOPSIS: <item> => sub { return &{$postfwd_compare{<type>}}(@_); },
+
+ # do NOT remove the next line
+ %postfwd_compare_plugin = (
+
+ EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # Simple example
+ # SYNOPSIS: <result> = <item> (return &{$postfwd_compare{<type>}}(@_))
+ "client_address" => sub { return &{$postfwd_compare{cidr}}(@_); },
+ "size" => sub { return &{$postfwd_compare{numeric}}(@_); },
+ "recipient_count" => sub { return &{$postfwd_compare{numeric}}(@_); },
+
+ # Complex example
+ # SYNOPSIS: <result> = <item>(<operator>, <ruleset value>, <request value>, <request>)
+ "numeric" => sub {
+ my($cmp,$val,$myitem,%request) = @_;
+ my($myresult) = undef; $myitem ||= "0"; $val ||= "0";
+ if ($cmp eq '==') {
+ $myresult = ($myitem == $val);
+ } elsif ($cmp eq '=<') {
+ $myresult = ($myitem <= $val);
+ } elsif ($cmp eq '=>') {
+ $myresult = ($myitem >= $val);
+ } elsif ($cmp eq '!=') {
+ $myresult = not($myitem == $val);
+ } elsif ($cmp eq '!<') {
+ $myresult = not($myitem <= $val);
+ } elsif ($cmp eq '!>') {
+ $myresult = not($myitem >= $val);
+ } else {
+ $myresult = ($myitem >= $val);
+ };
+ return $myresult;
+ },
+
+ # do NOT remove the next line
+ );
+ACTIONS
+Action plugins allow to define new postfwd actions. By setting the $stop-flag you can decide to
+continue or to stop parsing the ruleset.
+
+ SYNOPSIS: (<stop rule parsing>, <next rule index>, <return action>, <logprefix>, <request>) =
+ <action> (<current rule index>, <current time>, <command name>, <argument>, <logprefix>, <request>)
+
+ # do NOT remove the next line
+ %postfwd_actions_plugin = (
+
+ # EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # note(<logstring>) command
+ "note" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ mylogs 'info', "[RULES] ".$myline." - note: ".$myarg if $myarg;
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # skips next <myarg> rules
+ "skip" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ $index += $myarg if ( $myarg and not(($index + $myarg) > $#Rules) );
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # dumps current request contents to syslog
+ "dumprequest" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ map { mylogs 'info', "[DUMP] rule=$index, Attribute: $_=$request{$_}" } (keys %request);
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # do NOT remove the next line
+ );
@@ -571,30 +746,52 @@
-r, --rule <rule>
Adds <rule> to ruleset. Remember that you might have to quote
strings that contain whitespaces or shell characters.
-Plugins
-
- --plugins
- A file containing plugin routines for postfwd. Please see the
- PLUGINS section for more information.
Scoring
-s, --scores <val>=<action>
Returns <action> to postfix, when the request's score exceeds <val>
Multiple usage is allowed. Just chain your arguments, like:
- postfwd -r "<item>=<value>;action=<result>" -f <file> -f <file> --plugins <file> ...
+ postfwd -r "<item>=<value>;action=<result>" -f <file> -f <file> ...
or
postfwd --scores 4.5="WARN high score" --scores 5.0="REJECT postfwd score too high" ...
In case of multiple scores, the highest match will count. The order of the arguments will be
reflected in the postfwd ruleset.
-Networking
-postfwd can be run as daemon so that it listens on the network for incoming requests.
-The following arguments will control it's behaviour in this case.
+Control
-d, --daemon
postfwd will run as daemon and listen on the network for incoming
queries (default 127.0.0.1:10040).
+ -k, --kill
+ Stops a running postfwd daemon.
+
+ --reload
+ Reloads configuration.
+
+ --dumpstats
+ Displays program usage statistics.
+
+ --dumpcache
+ Displays cache contents.
+
+ --delcache <item>
+ Removes an item from the request cache. Use --dumpcache to identify objects.
+ E.g.:
+ # postfwd --dumpcache
+ ...
+ %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @count -> '1'
+ %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @maxcount -> '2'
+ ...
+ # postfwd --delrate="sender=gmato@jqvo.org"
+ rate cache item 'sender=gmato@jqvo.org' removed
+
+ --delrate <item>
+ Removes an item from the rate cache. Use --dumpcache to identify objects.
+Networking
+postfwd can be run as daemon so that it listens on the network for incoming requests.
+The following arguments will control it's behaviour in this case.
+
-i, --interface <dev>
Bind postfwd to the specified interface (default 127.0.0.1).
@@ -624,12 +821,24 @@
--pidfile <path>
The process id will be saved in the specified file.
+ --facility <f>
+ sets the syslog facility, default is 'mail'
+
+ --socktype <s>
+ sets the Sys::Syslog socktype to 'native', 'inet' or 'unix'.
+ Default is to auto-detect this depening on module version and os.
+
-l, --logname <label>
Labels the syslog messages. Useful when running multiple
instances of postfwd.
--loglen <int>
Truncates any syslog message after <int> characters.
+Plugins
+
+ --plugins <file>
+ Loads postfwd plugins from file. Please see http://postfwd.org/postfwd.plugins
+ or the plugins.postfwd.sample that is available from the tarball for more info.
Optional arguments
These parameters influence the way postfwd is working. Any of them can be combined.
@@ -754,7 +963,23 @@
--config_timeout (default=3)
timeout in seconds to parse a single configuration line. if exceeded, the rule will
- be skipped. this is used to prevent problems due to large files or loops.
+ be skipped. this is used to prevent problems due to large files or loops.
+
+ --keep_rates (default=0)
+ With this option set postfwd does not clear the rate limit counters on reload. Please
+ note that you have to restart (not reload) postfwd with this option if you change
+ any rate limit rules.
+
+ --save_rates (default=none)
+ With this option postfwd saves existing rate limit counters to disk and reloads them
+ on program start. This allows persistent rate limits across program restarts or reboots.
+ Please note that postfwd needs read and write access to the specified file.
+
+ --fast_limit_evaluation (default=0)
+ Once a ratelimit was set by the ruleset, future requests will be evaluated against it
+ before consulting the ruleset. This mode was the default behaviour until v1.30.
+ With this mode rate limits will be faster, but also eventually set up
+ whitelisting-rules within the ruleset might not work as expected.
Informational arguments
These arguments are for command line usage only. Never ever use them with postfix spawn!
@@ -812,18 +1037,25 @@
# 1. 30MB for systems in *.customer1.tld
# 2. 20MB for SASL user joejob
# 3. 10MB default
- id=SZ001; state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\.customer1.tld$
- id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
- id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=10000000
- id=SZ100; state==END-OF-MESSAGE; action=REJECT message too large
+ id=SZ001; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\.customer1.tld$
+ id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
+ id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=10000000
+ id=SZ100; protocol_state==END-OF-MESSAGE; action=REJECT message too large
## Selective Greylisting
+ ##
+ ## Note that postfwd does not include greylisting. This setup requires a running postgrey service
+ ## at port 10031 and the following postfix restriction class in your main.cf:
+ ##
+ ## smtpd_restriction_classes = check_postgrey, ...
+ ## check_postgrey = check_policy_service inet:127.0.0.1:10031
+ #
# 1. if listed on zen.spamhaus.org with results 127.0.0.10 or .11, dns cache timeout 1200s
# 2. Client has no rDNS
# 3. Client comes from several dialin domains
- id=GR001; action=greylisting ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
- id=GR002; action=greylisting ; client_name=^unknown$
- id=GR003; action=greylisting ; client_name=\.(t-ipconnect|alicedsl|ish)\.de$
+ id=GR001; action=check_postgrey ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
+ id=GR002; action=check_postgrey ; client_name=^unknown$
+ id=GR003; action=check_postgrey ; client_name=\.(t-ipconnect|alicedsl|ish)\.de$
## Date Time
date=24.12.2007-26.12.2007 ; action=450 4.7.1 office closed during christmas
@@ -831,7 +1063,7 @@
time=-07:00:00 ; sasl_username=jim ; action=450 4.7.1 to early for you, jim
time=22:00:00- ; sasl_username=jim ; action=450 4.7.1 to late now, jim
months=-Apr ; action=450 4.7.1 see you in may
- days=!!Mon-Fri ; action=greylist
+ days=!!Mon-Fri ; action=check_postgrey
## Usage of jump
# The following allows a message size of 30MB for different
@@ -841,8 +1073,8 @@
id=R003 ; action=jump(R100) ; ccert_fingerprint=AA:BB:CC:DD:...
id=R004 ; action=jump(R100) ; ccert_fingerprint=AF:BE:CD:DC:...
id=R005 ; action=jump(R100) ; ccert_fingerprint=DD:CC:BB:DD:...
- id=R099 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
- id=R100 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
+ id=R099 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
+ id=R100 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
## Usage of score
# The following rejects a mail, if the client
@@ -850,7 +1082,7 @@
# - is listed in 1 RBL or 1 RHSBL and has no correct rDNS
# - other clients without correct rDNS will be greylist-checked
# - some whitelists are used to lower the score
- id=S01 ; score=2.6 ; action=greylisting
+ id=S01 ; score=2.6 ; action=check_postgrey
id=S02 ; score=5.0 ; action=REJECT postfwd score too high
id=R00 ; action=score(-1.0) ; rbl=exemptions.ahbl.org,list.dnswl.org,query.bondedsender.org,spf.trusted-forwarder.org
id=R01 ; action=score(2.5) ; rbl=bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
@@ -863,10 +1095,10 @@
# The following temporary rejects requests from "unknown" clients, if they
# 1. exceeded 30 requests per hour or
# 2. tried to send more than 1.5mb within 10 minutes
- id=RATE01 ; client_name==unknown ; state==RCPT ; \
- action==rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
- id=SIZE01 ; client_name==unknown ; state==END_OF_DATA ; \
- action==size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
+ id=RATE01 ; client_name==unknown ; protocol_state==RCPT
+ action=rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
+ id=SIZE01 ; client_name==unknown ; protocol_state==END-OF-MESSAGE
+ action=size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
## Macros
# definition
@@ -879,34 +1111,34 @@
## Groups
# definition
- &&RBLS { \
- rbl=zen.spamhaus.org ; \
- rbl=list.dsbl.org ; \
- rbl=bl.spamcop.net ; \
- rbl=dnsbl.sorbs.net ; \
- rbl=ix.dnsbl.manitu.net ; \
+ &&RBLS{
+ rbl=zen.spamhaus.org
+ rbl=list.dsbl.org
+ rbl=bl.spamcop.net
+ rbl=dnsbl.sorbs.net
+ rbl=ix.dnsbl.manitu.net
};
- &&RHSBLS { \
+ &&RHSBLS{
...
};
- &&DYNAMIC { \
- client_name==unknown ; \
- client_name~=(\d+[\.-_]){4} ; \
- client_name~=[\.-_](adsl|dynamic|ppp|)[\.-_] ; \
+ &&DYNAMIC{
+ client_name==unknown
+ client_name~=(\d+[\.-_]){4}
+ client_name~=[\.-_](adsl|dynamic|ppp|)[\.-_]
...
};
- &&BAD_HELO { \
- helo_name==my.name.tld; \
- helo_name~=^([^\.]+)$; \
- helo_name~=\.(local|lan)$; \
+ &&BAD_HELO{
+ helo_name==my.name.tld
+ helo_name~=^([^\.]+)$
+ helo_name~=\.(local|lan)$
...
};
- &&MAINTENANCE { \
- date=15.01.2007 ; \
- date=15.04.2007 ; \
- date=15.07.2007 ; \
- date=15.10.2007 ; \
- time=03:00:00 - 04:00:00 ; \
+ &&MAINTENANCE{
+ date=15.01.2007
+ date=15.04.2007
+ date=15.07.2007
+ date=15.10.2007
+ time=03:00:00 - 04:00:00
};
# rules
id=COMBINED ; &&RBLS ; &&DYNAMIC ; action=REJECT dynamic client and listed on RBL
@@ -923,7 +1155,7 @@
## combined with enhanced rbl features
#
- id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS ; \
+ id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS
action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,HIT_dnstxt=$$dnsbltext)
id=RBL02 ; HIT_dnsbls>=2 ; action=554 5.7.1 blocked using $$HIT_dnsbls DNSBLs [INFO: $$HIT_dnstxt]
diff -Nru postfwd-1.20/doc/postfwd.txt postfwd-1.32/doc/postfwd.txt
--- postfwd-1.20/doc/postfwd.txt 2010-11-14 21:51:23.000000000 +0000
+++ postfwd-1.32/doc/postfwd.txt 2011-12-18 12:34:41.000000000 +0000
@@ -5,54 +5,70 @@
postfwd [OPTIONS] [SOURCE1, SOURCE2, ...]
Ruleset: (at least one, multiple use is allowed):
- -f, --file reads rules from
- -r, --rule adds to config
+ -f, --file reads rules from
+ -r, --rule adds to config
Scoring:
- -s, --scores = returns when score exceeds
+ -s, --scores = returns when score exceeds
+
+ Control:
+ -d, --daemon run postfwd as daemon
+ -k, --kill stops daemon
+ --reload reloads configuration
+ --dumpstats displays usage statistics
+ --dumpcache displays cache contents
+ --delcache - removes an item from the request cache
+ --delrate
- removes an item from the rate cache
Networking:
- -d, --daemon run postfwd as daemon
- -i, --interface
listen on interface
- -p, --port listen on port
- --proto socket type (tcp or unix)
- -u, --user set uid to user
- -g, --group set gid to group
- --umask set umask for file permissions
- -R, --chroot chroot the daemon to
- --pidfile create pidfile under
- -l, --logname label for syslog messages
- --loglen truncates syslogs after chars
+ -i, --interface listen on interface
+ -p, --port listen on port
+ --proto socket type (tcp or unix)
+ -u, --user set uid to user
+ -g, --group set gid to group
+ --umask set umask for file permissions
+ -R, --chroot chroot the daemon to
+ --pidfile create pidfile under
+ --facility syslog facility
+ --socktype syslog socktype
+ -l, --logname label for syslog messages
+ --loglen truncates syslogs after chars
Caching:
- -c, --cache sets the request-cache timeout to seconds
- --cache-no-size ignores size attribute for caching
- --cache-no-sender ignores sender address in cache
- --cache-rdomain-only ignores localpart of recipient address in cache
- --cache-rbl-timeout default rbl timeout, if not specified in ruleset
- --cache-rbl-default default rbl response pattern to match (regexp)
- --cacheid - , .. list of attributes for request cache identifier
- --cleanup-requests cleanup interval in seconds for request cache
- --cleanup-rbls cleanup interval in seconds for rbl cache
- --cleanup-rates cleanup interval in seconds for rate cache
+ -c, --cache
sets the request-cache timeout to seconds
+ --cache-no-size ignores size attribute for caching
+ --cache-no-sender ignores sender address in cache
+ --cache-rdomain-only ignores localpart of recipient address in cache
+ --cache-rbl-timeout default rbl timeout, if not specified in ruleset
+ --cache-rbl-default default rbl response pattern to match (regexp)
+ --cacheid - , .. list of attributes for request cache identifier
+ --cleanup-requests cleanup interval in seconds for request cache
+ --cleanup-rbls cleanup interval in seconds for rbl cache
+ --cleanup-rates cleanup interval in seconds for rate cache
Optional:
- -t, --test testing, always returns "dunno"
- -v, --verbose verbose logging, use twice (-vv) to increase level
- -S, --summary
show some usage statistics every seconds
- --norulelog disbles rule logging
- --norulestats disables per rule statistics
- --noidlestats disables statistics when idle
- -n, --nodns disable dns
- --nodnslog disable dns logging
- --dns_async_txt perform dnsbl A and TXT lookups simultaneously
- --dns_timeout timeout in seconds for asynchonous dns queries
- --dns_timeout_max maximum of dns timeouts until a dnsbl will be deactivated
- --dns_timeout_interval interval in seconds for dns timeout maximum counter
- --dns_max_ns_lookups max names to look up with sender_ns_addrs
- --dns_max_mx_lookups max names to look up with sender_mx_addrs
- -I, --instantcfg re-reads rulefiles for every new request
- --config_timeout parser timeout in seconds
+ -t, --test testing, always returns "dunno"
+ -v, --verbose verbose logging, use twice (-vv) to increase level
+ -S, --summary show some usage statistics every seconds
+ --norulelog disbles rule logging
+ --norulestats disables per rule statistics
+ --noidlestats disables statistics when idle
+ -n, --nodns disable dns
+ --nodnslog disable dns logging
+ --dns_async_txt perform dnsbl A and TXT lookups simultaneously
+ --dns_timeout timeout in seconds for asynchonous dns queries
+ --dns_timeout_max maximum of dns timeouts until a dnsbl will be deactivated
+ --dns_timeout_interval interval in seconds for dns timeout maximum counter
+ --dns_max_ns_lookups max names to look up with sender_ns_addrs
+ --dns_max_mx_lookups max names to look up with sender_mx_addrs
+ -I, --instantcfg re-reads rulefiles for every new request
+ --config_timeout parser timeout in seconds
+ --keep_rates do not clear rate limit counters on reload
+ --save_rates save and load rate limits on disk
+ --fast_limit_evaluation evaluate rate limits before ruleset is parsed
+
+ Plugins:
+ --plugins loads postfwd plugins from file
Informational (use only at command-line!):
-C, --showconfig shows ruleset summary, -v for verbose
@@ -62,9 +78,6 @@
-h, --help shows usage
-m, --manual shows program manual
- Plugins:
- --plugins loads plugins from
-
DESCRIPTION
INTRODUCTION
postfwd is written to combine complex postfix restrictions in a ruleset
@@ -101,7 +114,7 @@
A configuration line consists of optional item=value pairs, separated by
semicolons (`;`) and the appropriate desired action:
- [ [=><~]=; [=><~]=; ... ] action=
+ [ =; =; ... ] action=
*Example:*
@@ -142,11 +155,21 @@
files or passed as command line arguments. Please see the COMMAND LINE
section below for more information on this topic.
- Rules can span multiple lines by adding a trailing backslash "\"
- character:
-
- id=R_001 ; client_address=192.168.1.0/24; sender==no@bad.local; \
- action=REJECT please use your relay from there
+ Since postfwd version 1.30 rules spanning span multiple lines can be
+ defined by prefixing the following lines with one or multiple whitespace
+ characters (or '}' for macros):
+
+ id=RULE001
+ client_address=192.168.1.0/24
+ sender==no@bad.local
+ action=REJECT no access
+
+ postfwd versions prior to 1.30 require trailing ';' and '\'-characters:
+
+ id=RULE001; \
+ client_address=192.168.1.0/24; \
+ sender==no@bad.local; \
+ action=REJECT no access
ITEMS
id - a unique rule id, which can be used for log analysis
@@ -210,9 +233,15 @@
this enables version based checks in your rulesets
(e.g. for migration). works with old versions too,
because a non-existing item always returns false:
- id=R01; version~=1.10; sender_domain==some.org \
+ # version >= 1.10
+ id=R01; version~=1\.[1-9][0-9]; sender_domain==some.org \
; action=REJECT sorry no access
+ ratecount - only available for rate(), size() and rcpt() actions.
+ contains the actual limit counter:
+ id=R01; action=rate(sender/200/600/REJECT limit of 200 exceeded [$$ratecount hits])
+ id=R02; action=rate(sender/100/600/WARN limit of 100 exceeded [$$ratecount hits])
+
Besides these you can specify any attribute of the postfix policy
delegation protocol. Feel free to combine them the way you need it (have
a look at the EXAMPLES section below).
@@ -267,26 +296,25 @@
the current list can be found at
. Please read carefully
about which attribute can be used at which level of the smtp transaction
- (e.g. size will only work reliably at END_OF_DATA level). Pattern
+ (e.g. size will only work reliably at END-OF-MESSAGE level). Pattern
matching is performed case insensitive.
Multiple use of the same item is allowed and will compared as logical
OR, which means that this will work as expected:
- id=TRUST001; action=OK; encryption_keysize=64; \
- ccert_fingerprint=11:22:33:44:55:66:77:88:99; \
- ccert_fingerprint=22:33:44:55:66:77:88:99:00; \
- ccert_fingerprint=33:44:55:66:77:88:99:00:11; \
+ id=TRUST001; action=OK; encryption_keysize=64
+ ccert_fingerprint=11:22:33:44:55:66:77:88:99
+ ccert_fingerprint=22:33:44:55:66:77:88:99:00
+ ccert_fingerprint=33:44:55:66:77:88:99:00:11
sender=@domain\.local$
client_address, rbl and rhsbl items may also be specified as
whitespace-or-comma-separated values:
- id=SKIP01; action=dunno; \
+ id=SKIP01; action=dunno
client_address=192.168.1.0/24, 172.16.254.23
- id=SKIP02; action=dunno; \
- client_address= 10.10.3.32 \
- 10.216.222.0/27
+ id=SKIP02; action=dunno
+ client_address=10.10.3.32 10.216.222.0/27
The following items currently have to be unique:
@@ -294,16 +322,16 @@
Any item can be negated by preceeding '!!' to it, e.g.:
- id=TLS001 ; hostname=!!^secure\.trust\.local$ ; action=REJECT only secure.trust.local please
+ id=HOST001 ; hostname == !!secure.trust.local ; action=REJECT only secure.trust.local please
or using the right compare operator:
- id=USER01 ; sasl_username !~ /^(bob|alice)$/ ; action=REJECT who is that?
+ id=HOST001 ; hostname != secure.trust.local ; action=REJECT only secure.trust.local please
To avoid confusion with regexps or simply for better visibility you can
use '!!(...)':
- id=USER01 ; sasl_username=!!( (bob|alice) ) ; action=REJECT who is that?
+ id=USER01 ; sasl_username = !!( (bob|alice) ) ; action=REJECT who is that?
Request attributes can be compared by preceeding '$$' characters, e.g.:
@@ -315,6 +343,33 @@
be performed as case insensitive exact match. Use the '-vv' option to
debug.
+ These special items will be reset for any new rule:
+
+ rblcount - contains the number of RBL answers
+ rhsblcount - contains the number of RHSBL answers
+ matches - contains the number of matched items
+ dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
+ rbltype:rblname:; rbltype:rblname:; ...
+
+ These special items will be changed for any matching rule:
+
+ request_hits - contains ids of all matching rules
+
+ This means that it might be necessary to save them, if you plan to use
+ these values in later rules:
+
+ # set vals
+ id=RBL01 ; rhsblcount=all; rblcount=all
+ action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
+ rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org
+ rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+ rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+
+ # compare
+ id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
+ id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
+ id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
+
FILES
Since postfwd1 v1.15 and postfwd2 v0.18 long item lists can be stored in
separate files:
@@ -337,16 +392,16 @@
This will ignore the right-hand value. Items can be mixed:
- id=R002 ; action=REJECT \
- client_name==unknown; \
+ id=R002 ; action=REJECT
+ client_name==unknown
client_name==file:/etc/postfwd/blacklisted
and for non pcre (comma separated) items:
- id=R003 ; action=REJECT \
+ id=R003 ; action=REJECT
client_address==10.1.1.1, file:/etc/postfwd/blacklisted
- id=R004 ; action=REJECT \
+ id=R004 ; action=REJECT
rbl=myrbl.home.local, zen.spamhaus.org, file:/etc/postfwd/rbls_changing
You can check your configuration with the --show_config option at the
@@ -468,16 +523,25 @@
please note that is currently limited to postfix actions (no postfwd actions)!
# no more than 3 requests per 5 minutes
# from the same "unknown" client
- id=RATE01 ; client_name==unknown ; \
- action==rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
+ id=RATE01 ; client_name==unknown
+ action=rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
+ Please note also that the order of rate limits in your ruleset is important, which means
+ that this:
+ # works as expected
+ id=R001; action=rcpt(sender/500/3600/REJECT limit of 500 recipients per hour for sender $$sender exceeded)
+ id=R002; action=rcpt(sender/200/3600/WARN state YELLOW for sender $$sender)
+ leads to different results than this:
+ # rule R002 never gets executed
+ id=R001; action=rcpt(sender/200/3600/WARN state YELLOW for sender $$sender)
+ id=R002; action=rcpt(sender/500/3600/REJECT limit of 500 recipients per hour for sender $$sender exceeded)
size (- /
//)
this command works similar to the rate() command with the difference, that the rate counter is
increased by the request's size attribute. to do this reliably you should call postfwd from
smtpd_end_of_data_restrictions. if you want to be sure, you could check it within the ruleset:
# size limit 1.5mb per hour per client
- id=SIZE01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \
- action==size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
+ id=SIZE01 ; protocol_state==END-OF-MESSAGE ; client_address!=10.1.1.1
+ action=size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
rcpt (- /
//)
this command works similar to the rate() command with the difference, that the rate counter is
@@ -485,8 +549,8 @@
from smtpd_data_restrictions or smtpd_end_of_data_restrictions. if you want to be sure, you could
check it within the ruleset:
# recipient count limit 3 per hour per client
- id=RCPT01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \
- action==rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
+ id=RCPT01 ; protocol_state==END-OF-MESSAGE ; client_address!=10.1.1.1
+ action=rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
ask (:[:])
allows to delegate the policy decision to another policy service (e.g. postgrey). the first
@@ -494,17 +558,22 @@
specified to tell postfwd to ignore certain answers and go on parsing the ruleset:
# example1: query postgrey and return it's answer to postfix
id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031)
- # example2: query postgrey but ignore it's answer, if it matches 'DUNNO'
+ # example2: query postgrey but ignore the answer, if it matches 'DUNNO'
# and continue parsing postfwd's ruleset
id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031:^dunno$)
+ mail(server/helo/from/to/subject/body)
+ Very basic mail command, that sends a message with the given arguments. LIMITATIONS:
+ This basically performs a telnet. No authentication or TLS are available. Additionally it does
+ not track notification state and will notify you any time, the corresponding rule hits.
+
wait ()
pauses the program execution for seconds. use this for
delaying or throtteling connections.
note ()
just logs the given string and continues parsing the ruleset.
- if the string is empty, nothing will be logged.
+ if the string is empty, nothing will be logged (noop).
quit ()
terminates the program with the given exit-code. postfix doesn`t
@@ -514,33 +583,6 @@
id=R-HELO ; helo_name=^[^\.]+$ ; action=REJECT invalid helo '$$helo_name'
- These special attributes will be reset for any new rule:
-
- rblcount - contains the number of RBL answers
- rhsblcount - contains the number of RHSBL answers
- matches - contains the number of matched items
- dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
- rbltype:rblname:; rbltype:rblname:; ...
-
- These special attributes will be changed for any matching rule:
-
- request_hits - contains ids of all matching rules
-
- This means that it might be necessary to save them, if you plan to use
- these values in later rules:
-
- # set vals
- id=RBL01 ; rhsblcount=all ; rblcount=all ; \
- rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org ; \
- rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \
- rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \
- action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
-
- # compare
- id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
- id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
- id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
-
MACROS/ACLS
Multiple use of long items or combinations of them may be abbreviated by
macros. Those must be prefixed by '&&' (two '&' characters). First the
@@ -565,18 +607,18 @@
Macros can contain macros, too:
- # definition (note the trailing "\" characters)
- &&RBLS { \
- rbl=zen.spamhaus.org ; \
- rbl=list.dsbl.org ; \
- rbl=bl.spamcop.net ; \
- rbl=dnsbl.sorbs.net ; \
- rbl=ix.dnsbl.manitu.net ; \
+ # definition
+ &&RBLS{
+ rbl=zen.spamhaus.org
+ rbl=list.dsbl.org
+ rbl=bl.spamcop.net
+ rbl=dnsbl.sorbs.net
+ rbl=ix.dnsbl.manitu.net
};
- &&DYNAMIC { \
- client_name=^unknown$ ; \
- client_name=(\d+[\.-_]){4} ; \
- client_name=[\.-_](adsl|dynamic|ppp|)[\.-_] ; \
+ &&DYNAMIC{
+ client_name=^unknown$
+ client_name=(\d+[\.-_]){4}
+ client_name=[\.-_](adsl|dynamic|ppp|)[\.-_]
};
&&GOAWAY { &&RBLS; &&DYNAMIC; };
# rules
@@ -586,7 +628,156 @@
section for more information.
PLUGINS
- Please visit
+ Description
+
+ The plugin interface allow you to define your own checks and enhance
+ postfwd's functionality. Feel free to share useful things!
+
+ Warning
+
+ Note that the plugin interface is still at devel stage. Please test your
+ plugins carefully, because errors may cause postfwd to break! It is also
+ allowed to override attributes or built-in functions, but be sure that
+ you know what you do because some of them are used internally.
+
+ Please keep security in mind, when you access sensible ressources and
+ never, ever run postfwd as privileged user! Also never trust your input
+ (especially hostnames, and e-mail addresses).
+
+ ITEMS
+
+ Item plugins are perl subroutines which integrate additional attributes
+ to requests before they are evaluated against postfwd's ruleset like any
+ other item of the policy delegation protocol. This allows you to create
+ your own checks.
+
+ plugin-items can not be used selective. these functions will be executed
+ for every request postfwd receives, so keep performance in mind.
+
+ SYNOPSIS: %result = postfwd_items_plugin{}(%request)
+
+ means that your subroutine, called , has access to a hash called
+ %request, which contains all request attributes, like
+ $request{client_name} and must return a value in the following form:
+
+ save: $result{- } =
+
+ this creates the new item - containing
, which will be
+ integrated in the policy delegation request and therefore may be used in
+ postfwd's ruleset.
+
+ # do NOT remove the next line
+ %postfwd_items_plugin = (
+
+ # EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # allows to check postfwd version in ruleset
+ "version" => sub {
+ my(%request) = @_;
+ my(%result) = (
+ "version" => $NAME." ".$VERSION,
+ );
+ return %result;
+ },
+
+ # sender_domain and recipient_domain
+ "address_parts" => sub {
+ my(%request) = @_;
+ my(%result) = ();
+ $request{sender} =~ /@([^@]*)$/;
+ $result{sender_domain} = ($1 || '');
+ $request{recipient} =~ /@([^@]*)$/;
+ $result{recipient_domain} = ($1 || '');
+ return %result;
+ },
+
+ # do NOT remove the next line
+ );
+
+ COMPARE
+
+ Compare plugins allow you to define how your new items should be
+ compared to the ruleset. These are optional. If you don't specify one,
+ the default (== for exact match, =~ for PCRE, ...) will be used.
+
+ SYNOPSIS: - => sub { return &{$postfwd_compare{
}}(@_); },
+
+ # do NOT remove the next line
+ %postfwd_compare_plugin = (
+
+ EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # Simple example
+ # SYNOPSIS: = - (return &{$postfwd_compare{
}}(@_))
+ "client_address" => sub { return &{$postfwd_compare{cidr}}(@_); },
+ "size" => sub { return &{$postfwd_compare{numeric}}(@_); },
+ "recipient_count" => sub { return &{$postfwd_compare{numeric}}(@_); },
+
+ # Complex example
+ # SYNOPSIS: = - (
, , , )
+ "numeric" => sub {
+ my($cmp,$val,$myitem,%request) = @_;
+ my($myresult) = undef; $myitem ||= "0"; $val ||= "0";
+ if ($cmp eq '==') {
+ $myresult = ($myitem == $val);
+ } elsif ($cmp eq '=<') {
+ $myresult = ($myitem <= $val);
+ } elsif ($cmp eq '=>') {
+ $myresult = ($myitem >= $val);
+ } elsif ($cmp eq '!=') {
+ $myresult = not($myitem == $val);
+ } elsif ($cmp eq '!<') {
+ $myresult = not($myitem <= $val);
+ } elsif ($cmp eq '!>') {
+ $myresult = not($myitem >= $val);
+ } else {
+ $myresult = ($myitem >= $val);
+ };
+ return $myresult;
+ },
+
+ # do NOT remove the next line
+ );
+
+ ACTIONS
+
+ Action plugins allow to define new postfwd actions. By setting the
+ $stop-flag you can decide to continue or to stop parsing the ruleset.
+
+ SYNOPSIS: (, , , , ) =
+ (, , , , , )
+
+ # do NOT remove the next line
+ %postfwd_actions_plugin = (
+
+ # EXAMPLES - integrated in postfwd. no need to activate them here.
+
+ # note() command
+ "note" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ mylogs 'info', "[RULES] ".$myline." - note: ".$myarg if $myarg;
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # skips next rules
+ "skip" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ $index += $myarg if ( $myarg and not(($index + $myarg) > $#Rules) );
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # dumps current request contents to syslog
+ "dumprequest" => sub {
+ my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+ my($myaction) = $default_action; my($stop) = 0;
+ map { mylogs 'info', "[DUMP] rule=$index, Attribute: $_=$request{$_}" } (keys %request);
+ return ($stop,$index,$myaction,$myline,%request);
+ },
+
+ # do NOT remove the next line
+ );
COMMAND LINE
*Ruleset*
@@ -603,12 +794,6 @@
Adds to ruleset. Remember that you might have to quote
strings that contain whitespaces or shell characters.
- *Plugins*
-
- --plugins
- A file containing plugin routines for postfwd. Please see the
- PLUGINS section for more information.
-
*Scoring*
-s, --scores =
@@ -616,23 +801,51 @@
Multiple usage is allowed. Just chain your arguments, like:
- postfwd -r "- =
;action=" -f -f --plugins ...
+ postfwd -r "- =
;action=" -f -f ...
or
postfwd --scores 4.5="WARN high score" --scores 5.0="REJECT postfwd score too high" ...
In case of multiple scores, the highest match will count. The order of
the arguments will be reflected in the postfwd ruleset.
+ *Control*
+
+ -d, --daemon
+ postfwd will run as daemon and listen on the network for incoming
+ queries (default 127.0.0.1:10040).
+
+ -k, --kill
+ Stops a running postfwd daemon.
+
+ --reload
+ Reloads configuration.
+
+ --dumpstats
+ Displays program usage statistics.
+
+ --dumpcache
+ Displays cache contents.
+
+ --delcache -
+ Removes an item from the request cache. Use --dumpcache to identify objects.
+ E.g.:
+ # postfwd --dumpcache
+ ...
+ %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @count -> '1'
+ %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @maxcount -> '2'
+ ...
+ # postfwd --delrate="sender=gmato@jqvo.org"
+ rate cache item 'sender=gmato@jqvo.org' removed
+
+ --delrate
-
+ Removes an item from the rate cache. Use --dumpcache to identify objects.
+
*Networking*
postfwd can be run as daemon so that it listens on the network for
incoming requests. The following arguments will control it's behaviour
in this case.
- -d, --daemon
- postfwd will run as daemon and listen on the network for incoming
- queries (default 127.0.0.1:10040).
-
-i, --interface
Bind postfwd to the specified interface (default 127.0.0.1).
@@ -662,6 +875,13 @@
--pidfile
The process id will be saved in the specified file.
+ --facility
+ sets the syslog facility, default is 'mail'
+
+ --socktype
+ sets the Sys::Syslog socktype to 'native', 'inet' or 'unix'.
+ Default is to auto-detect this depening on module version and os.
+
-l, --logname
Labels the syslog messages. Useful when running multiple
instances of postfwd.
@@ -669,6 +889,12 @@
--loglen
Truncates any syslog message after characters.
+ *Plugins*
+
+ --plugins
+ Loads postfwd plugins from file. Please see http://postfwd.org/postfwd.plugins
+ or the plugins.postfwd.sample that is available from the tarball for more info.
+
*Optional arguments*
These parameters influence the way postfwd is working. Any of them can
@@ -797,6 +1023,22 @@
timeout in seconds to parse a single configuration line. if exceeded, the rule will
be skipped. this is used to prevent problems due to large files or loops.
+ --keep_rates (default=0)
+ With this option set postfwd does not clear the rate limit counters on reload. Please
+ note that you have to restart (not reload) postfwd with this option if you change
+ any rate limit rules.
+
+ --save_rates (default=none)
+ With this option postfwd saves existing rate limit counters to disk and reloads them
+ on program start. This allows persistent rate limits across program restarts or reboots.
+ Please note that postfwd needs read and write access to the specified file.
+
+ --fast_limit_evaluation (default=0)
+ Once a ratelimit was set by the ruleset, future requests will be evaluated against it
+ before consulting the ruleset. This mode was the default behaviour until v1.30.
+ With this mode rate limits will be faster, but also eventually set up
+ whitelisting-rules within the ruleset might not work as expected.
+
*Informational arguments*
These arguments are for command line usage only. Never ever use them
@@ -854,18 +1096,25 @@
# 1. 30MB for systems in *.customer1.tld
# 2. 20MB for SASL user joejob
# 3. 10MB default
- id=SZ001; state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\.customer1.tld$
- id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
- id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=10000000
- id=SZ100; state==END-OF-MESSAGE; action=REJECT message too large
+ id=SZ001; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\.customer1.tld$
+ id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
+ id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=10000000
+ id=SZ100; protocol_state==END-OF-MESSAGE; action=REJECT message too large
## Selective Greylisting
+ ##
+ ## Note that postfwd does not include greylisting. This setup requires a running postgrey service
+ ## at port 10031 and the following postfix restriction class in your main.cf:
+ ##
+ ## smtpd_restriction_classes = check_postgrey, ...
+ ## check_postgrey = check_policy_service inet:127.0.0.1:10031
+ #
# 1. if listed on zen.spamhaus.org with results 127.0.0.10 or .11, dns cache timeout 1200s
# 2. Client has no rDNS
# 3. Client comes from several dialin domains
- id=GR001; action=greylisting ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
- id=GR002; action=greylisting ; client_name=^unknown$
- id=GR003; action=greylisting ; client_name=\.(t-ipconnect|alicedsl|ish)\.de$
+ id=GR001; action=check_postgrey ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
+ id=GR002; action=check_postgrey ; client_name=^unknown$
+ id=GR003; action=check_postgrey ; client_name=\.(t-ipconnect|alicedsl|ish)\.de$
## Date Time
date=24.12.2007-26.12.2007 ; action=450 4.7.1 office closed during christmas
@@ -873,7 +1122,7 @@
time=-07:00:00 ; sasl_username=jim ; action=450 4.7.1 to early for you, jim
time=22:00:00- ; sasl_username=jim ; action=450 4.7.1 to late now, jim
months=-Apr ; action=450 4.7.1 see you in may
- days=!!Mon-Fri ; action=greylist
+ days=!!Mon-Fri ; action=check_postgrey
## Usage of jump
# The following allows a message size of 30MB for different
@@ -883,8 +1132,8 @@
id=R003 ; action=jump(R100) ; ccert_fingerprint=AA:BB:CC:DD:...
id=R004 ; action=jump(R100) ; ccert_fingerprint=AF:BE:CD:DC:...
id=R005 ; action=jump(R100) ; ccert_fingerprint=DD:CC:BB:DD:...
- id=R099 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
- id=R100 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
+ id=R099 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
+ id=R100 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
## Usage of score
# The following rejects a mail, if the client
@@ -892,7 +1141,7 @@
# - is listed in 1 RBL or 1 RHSBL and has no correct rDNS
# - other clients without correct rDNS will be greylist-checked
# - some whitelists are used to lower the score
- id=S01 ; score=2.6 ; action=greylisting
+ id=S01 ; score=2.6 ; action=check_postgrey
id=S02 ; score=5.0 ; action=REJECT postfwd score too high
id=R00 ; action=score(-1.0) ; rbl=exemptions.ahbl.org,list.dnswl.org,query.bondedsender.org,spf.trusted-forwarder.org
id=R01 ; action=score(2.5) ; rbl=bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
@@ -905,10 +1154,10 @@
# The following temporary rejects requests from "unknown" clients, if they
# 1. exceeded 30 requests per hour or
# 2. tried to send more than 1.5mb within 10 minutes
- id=RATE01 ; client_name==unknown ; state==RCPT ; \
- action==rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
- id=SIZE01 ; client_name==unknown ; state==END_OF_DATA ; \
- action==size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
+ id=RATE01 ; client_name==unknown ; protocol_state==RCPT
+ action=rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
+ id=SIZE01 ; client_name==unknown ; protocol_state==END-OF-MESSAGE
+ action=size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
## Macros
# definition
@@ -921,34 +1170,34 @@
## Groups
# definition
- &&RBLS { \
- rbl=zen.spamhaus.org ; \
- rbl=list.dsbl.org ; \
- rbl=bl.spamcop.net ; \
- rbl=dnsbl.sorbs.net ; \
- rbl=ix.dnsbl.manitu.net ; \
+ &&RBLS{
+ rbl=zen.spamhaus.org
+ rbl=list.dsbl.org
+ rbl=bl.spamcop.net
+ rbl=dnsbl.sorbs.net
+ rbl=ix.dnsbl.manitu.net
};
- &&RHSBLS { \
+ &&RHSBLS{
...
};
- &&DYNAMIC { \
- client_name==unknown ; \
- client_name~=(\d+[\.-_]){4} ; \
- client_name~=[\.-_](adsl|dynamic|ppp|)[\.-_] ; \
+ &&DYNAMIC{
+ client_name==unknown
+ client_name~=(\d+[\.-_]){4}
+ client_name~=[\.-_](adsl|dynamic|ppp|)[\.-_]
...
};
- &&BAD_HELO { \
- helo_name==my.name.tld; \
- helo_name~=^([^\.]+)$; \
- helo_name~=\.(local|lan)$; \
+ &&BAD_HELO{
+ helo_name==my.name.tld
+ helo_name~=^([^\.]+)$
+ helo_name~=\.(local|lan)$
...
};
- &&MAINTENANCE { \
- date=15.01.2007 ; \
- date=15.04.2007 ; \
- date=15.07.2007 ; \
- date=15.10.2007 ; \
- time=03:00:00 - 04:00:00 ; \
+ &&MAINTENANCE{
+ date=15.01.2007
+ date=15.04.2007
+ date=15.07.2007
+ date=15.10.2007
+ time=03:00:00 - 04:00:00
};
# rules
id=COMBINED ; &&RBLS ; &&DYNAMIC ; action=REJECT dynamic client and listed on RBL
@@ -965,7 +1214,7 @@
## combined with enhanced rbl features
#
- id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS ; \
+ id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS
action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,HIT_dnstxt=$$dnsbltext)
id=RBL02 ; HIT_dnsbls>=2 ; action=554 5.7.1 blocked using $$HIT_dnsbls DNSBLs [INFO: $$HIT_dnstxt]
diff -Nru postfwd-1.20/doc/quick.html postfwd-1.32/doc/quick.html
--- postfwd-1.20/doc/quick.html 1970-01-01 00:00:00.000000000 +0000
+++ postfwd-1.32/doc/quick.html 2011-08-15 16:44:51.000000000 +0000
@@ -0,0 +1,113 @@
+
+
+
+postfwd - quickstart guide
+
+
+
+
+
+
+
+
+ postfwd quickstart guide
+ To use postfwd you have to perform the following steps:
+
+
+ Get postfwd or postfwd2
+ Create your own postfwd ruleset
+ Optional: Create a dedicated user/group for postfwd
+ Launch postfwd
+ Tell postfix to use postfwd
+ Finished! How to go on?
+
+
+
+ Get postfwd or postfwd2
+ You may skip this step, if your operating system distribution contains a version of postfwd, but it is recommended to use a recent version from postfwd.org . It is also recommended to use recent versions of the perl modules Net::DNS and Net::Server (see required perl modules for more information).
+
+ Create your own postfwd ruleset
+ postfwd is not a dedicated antispam tool (although it may be used as such). Instead of that it is basically a restriction language for postfix which allows to place complex policy expressions into a simple ruleset. For reasonable operation you have to create your own ruleset, like:
+
+
+ # reject @domain.local if request comes from outside 10.0.0.0/8 network
+ id=RULE-01 ; sender_domain=domain.local ; client_address=!!(10.0.0.0/8) ; action=REJECT not allowed
+
+ # reject if sender equals recipient
+ id=RULE-02 ; sender==$$recipient ; action=REJECT not allowed
+
+ # check some rbls and reject, if listed on >= 2 of them
+ id=RULE-03 ; rbl=zen.spamhaus.org,bl.spamcop.net,ix.dnsbl.manitu.net ; rblcount>=2 ; action=REJECT not allowed
+
+ Now save these rules to a file (e.g. /etc/postfwd.cf). Please note that these are just very basic examples. Please read the documentation for more information on postfwd's capabilities. To check your ruleset you should use the "-C" command line option. This displays postfwd's view of your ruleset, like:
+
+
+ # postfwd -f /etc/postfwd.cf -C
+ Rule 0: id->"RULE-01"; action->"REJECT not allowed"; sender_domain->"=;domain.local"; client_address->"=;!!(10.0.0.0/8)"
+ Rule 1: id->"RULE-02"; action->"REJECT not allowed"; sender->"==;$$recipient"
+ Rule 2: id->"RULE-03"; action->"REJECT not allowed"; rblcount->"2"; rbl->"=;zen.spamhaus.org, =;bl.spamcop.net, =;ix.dnsbl.manitu.net"
+
+ If you just want to see that anything works a single rule like "id=DEFAULT; action=dunno" is fine, too.
+
+ Optional: Create a dedicated user/group for postfwd
+ By default postfwd will try to use user 'nobody' and group 'nobody'. So it should be safe to skip this step in most environments. If you run a system that is exposed to dangerous networks and feel paranoid you may want to create a dedicated user and group for the postfwd process. On unix systems enter:
+
+
+ # groupadd postfwd
+ # useradd -g postfwd -d /var/empty -s /bin/false -c "postfwd daemon user" postfwd
+ # passwd -l postfwd
+
+ Launch postfwd
+ Start postfwd with your ruleset. Leave out the --user and --group options, if you have skipped step 3 and want to run postfwd as nobody/nobody.
+
+
+ # postfwd --daemon -f /etc/postfwd.cf -u postfwd -g postfwd
+
+ Now watch your logs (default facility: mail) for lines like:
+
+
+ Jun 8 12:14:33 jupiter postfwd[20270]: postfwd 1.11 starting
+ Jun 8 12:14:33 jupiter postfwd[20271]: Process Backgrounded
+ Jun 8 12:14:33 jupiter postfwd[20271]: 2009/06/08-12:14:33 postfwd (type Net::Server::Multiplex) starting! pid(20271)
+ Jun 8 12:14:33 jupiter postfwd[20271]: Binding to TCP port 10040 on host 127.0.0.1
+ Jun 8 12:14:33 jupiter postfwd[20271]: Setting gid to "1003 1003"
+ Jun 8 12:14:33 jupiter postfwd[20271]: Setting uid to "1010"
+ Jun 8 12:14:33 jupiter postfwd[20271]: postfwd 1.11 ready for input
+
+ To control further daemon operations the commands `postfwd --kill` and `postfwd --reload` may be used. Please see `postfwd -h` and the documentation for more information.
+
+ Tell postfix to use postfwd
+ Open your main.cf (usually located at /etc/postfix) and find or add a line starting with:
+
+
+ smtpd_recipient_restrictions = ...
+
+ To place the postfwd check here, modify this as follows:
+
+
+ # note the leading whitespaces from the 2nd line!
+ smtpd_recipient_restrictions = permit_mynetworks, # recommended
+ ..., # optional
+ reject_unauth_destination, # recommended
+ check_policy_service inet:127.0.0.1:10040, # **postfwd integration**
+ ... # optional
+
+ Please note that for some checks (like the 'size' attribute) postfwd has to be integrated at another level of the smtp transaction (smtpd_end_of_data_restrictions). More information on that can be found in the postfix documentation .
+
+ Finished! How to go on?
+ A good point to start is postfwd's manual. You should be able to view it using the `postfwd -m` command or visit the documentation page . There are also some configuration examples on the webpage . Another very useful source of information is the Postfix SMTP Access Policy Delegation documentation.
+
+
+
+
+
+
+ http://www.postfwd.org/
+ 2007 - 2009 by Jan Peter Kessler
+ info (AT) postfwd (DOT) org
+
+
+
+
+
+
diff -Nru postfwd-1.20/doc/versions.html postfwd-1.32/doc/versions.html
--- postfwd-1.20/doc/versions.html 1970-01-01 00:00:00.000000000 +0000
+++ postfwd-1.32/doc/versions.html 2011-08-17 09:00:43.000000000 +0000
@@ -0,0 +1,82 @@
+
+
+
+
+postfwd - version differences
+
+
+
+
+
+
+
+
+
+
postfwd1 vs postfwd2
+As you might have noticed, there are two different versions of postfwd available - postfwd(1) and postfwd2.
+Which version fits best for you depends on your setup. Both versions use the same ruleset parser*. They also share the basic command line arguments (use both with --help for details). This allows to switch easily between them.
+
+The following table might help you to decide which version to use. Basically you should stick with postfwd1 for the moment unless you encounter performance issues with dns based checks or very complex rulesets with thousands
+of checks. Please note that, due to implementation, rate limits are handled faster by postfwd1 at the moment. If performance really matters and you use a complex ruleset with rate limits and lots of dns based checks you should consider
+running two instances at different ports/sockets: postfwd1 for the rate limits and postfwd2 for the rest.
+
+
+
+
+
+ Version
+ postfwd1
+ postfwd2
+
+
+
+
+
+ Single process (Multiplexer)
+ Default port: tcp/10040
+ Small memory footprint
+
+
+
+ Multiple processes (Preforker)
+ Default port: tcp/10045
+ Scales with multiple cpus/cores
+ Builtin watchdog function
+ Debug classes
+
+
+
+
+
+
+ Fits for most setups
+ Any single core system
+ Rate-limit-only rulesets
+
+
+
+ High throughput setups with lots of requests per second and
+
+
+ rulesets that use a lot of dnsbl lookups
+ really huge rulesets containing tons of checks
+
+
+
+
+
+
+
+
+
+
+
+
+
diff -Nru postfwd-1.20/etc/postfwd.cf.sample postfwd-1.32/etc/postfwd.cf.sample
--- postfwd-1.20/etc/postfwd.cf.sample 2009-06-03 21:13:51.000000000 +0000
+++ postfwd-1.32/etc/postfwd.cf.sample 2011-08-20 23:29:12.000000000 +0000
@@ -2,8 +2,11 @@
###################################################################################################
##
-## ATTENTION: Do NOT use this configuration without your own customizations!
-## Please see the manual ('postfwd -m') for more information.
+## ATTENTION: This example configuration uses features which require at least postfwd 1.30!
+## Please see the manual ('postfwd -m') for example syntax for prior versions.
+##
+## WARNING: Only provided to show some capabilities of postfwd. Do NOT use this without
+## modifications to suit your environment!
##
###################################################################################################
@@ -12,77 +15,71 @@
## Definitions
##
-# Greylisting with postgrey @ 127.0.0.1:10031
-&&GREYLIST { \
- action=ask(127.0.0.1:10031); \
-};
-
# Maintenance times
-&&MAINTENANCE { \
- date=15.01.2007 - 15.01.2007 ; \
- date=15.04.2007 - 15.04.2007 ; \
- date=15.07.2007 - 15.07.2007 ; \
- date=15.10.2007 - 15.10.2007 ; \
- time=03:00:00 - 04:00:00 ; \
-};
+&&MAINTENANCE {
+ date=15.01.2007
+ date=15.10.2007 - 17.10.2007
+ days=Sat-Sun
+ time=03:00:00 - 04:00:00
+}
# Whitelists
-&&TRUSTED_NETS { \
- client_address=192.168.1.0/22 ; \
- client_address=172.16.128.32/27 ; \
-};
-&&TRUSTED_HOSTS { \
- client_name~=\.domain1\.net$ ; \
- client_name~=\.domain2\.de$ ; \
-};
-&&TRUSTED_USERS { \
- sasl_username==bob ; \
- sasl_username==alice ; \
-};
-&&TRUSTED_TLS { \
- ccert_fingerprint==11:22:33:44:55:66:AA:BB:CC:DD:EE:FF ; \
- ccert_fingerprint==AA:BB:CC:DD:EE:FF:11:22:33:44:55:66 ; \
- encryption_keysize>=64 ; \
-};
-&&FREEMAIL { \
- client_name~=\.gmx\.net$ ; \
- client_name~=\.web\.de$ ; \
- client_name~=\.(aol|yahoo|h(ush|ot)mail)\.com$ ; \
-};
-&&STATIC { \
+&&TRUSTED_NETS {
+ client_address=192.168.1.0/22
+ client_address=172.16.128.32/27
+}
+&&TRUSTED_HOSTS {
+ client_name~=\.domain1\.net$
+ client_name~=\.domain2\.de$
+}
+&&TRUSTED_USERS {
+ sasl_username==bob
+ sasl_username==alice
+}
+&&TRUSTED_TLS {
+ ccert_fingerprint==11:22:33:44:55:66:AA:BB:CC:DD:EE:FF
+ ccert_fingerprint==AA:BB:CC:DD:EE:FF:11:22:33:44:55:66
+ encryption_keysize>=64
+}
+&&FREEMAIL {
+ client_name~=\.gmx\.net$
+ client_name~=\.web\.de$
+ client_name~=\.(aol|yahoo|h(ush|ot)mail)\.com$
+}
+&&STATIC {
# contains freemailers
- &&FREEMAIL ; \
- client_name~=[\.\-]static[[\.\-] ; \
- client_name~=^(mail|smtp|mout|mx)[\-]*[0-9]*\. ; \
-};
-&&DNSWLS { \
- rbl=list.dnswl.org ; \
- rbl=exemptions.ahbl.org ; \
- rbl=query.bondedsender.org ; \
- rbl=hostkarma.junkemailfilter.com/^127\.0\.0\.1$/3600 ; \
- rhsbl_client=hostkarma.junkemailfilter.com/^127\.0\.0\.1$/3600 ; \
-};
+ &&FREEMAIL
+ client_name~=[\.\-]static[[\.\-]
+ client_name~=^(mail|smtp|mout|mx)[\-]*[0-9]*\.
+}
+&&DNSWLS {
+ rbl=list.dnswl.org
+ rbl=exemptions.ahbl.org
+ rbl=query.bondedsender.org
+ rbl=hostkarma.junkemailfilter.com/^127\.0\.0\.1$/3600
+ rhsbl_client=hostkarma.junkemailfilter.com/^127\.0\.0\.1$/3600
+}
# Spamchecks
-&&BADHELO { \
- client_name==!!($$(helo_name)) ; \
-};
-&&DYNAMIC { \
- client_name==unknown ; \
- client_name~=(\-.+){4} ; \
- client_name~=\d{5} ; \
- client_name~=[_\.\-]([axt]{0,1}dsl|br(e|oa)dband|ppp|pppoe|dynamic|dynip|ADSL|dial(up|in)|pool|dhcp|leased)[_\.\-] ; \
-};
-&&DNSBLS { \
- rbl=zen.spamhaus.org ; \
- rbl=list.dsbl.org ; \
- rbl=bl.spamcop.net ; \
- rbl=dnsbl.sorbs.net ; \
- rbl=ix.dnsbl.manitu.net ; \
- rhsbl=rddn.dnsbl.net.au ; \
- rhsbl=rhsbl.ahbl.org ; \
- rhsbl=rhsbl.sorbs.net ; \
-};
+&&BADHELO {
+ client_name==!!($$(helo_name))
+}
+&&DYNAMIC {
+ client_name==unknown
+ client_name~=(\-.+){4}
+ client_name~=\d{5}
+ client_name~=[_\.\-]([axt]{0,1}dsl|br(e|oa)dband|ppp|pppoe|dynamic|dynip|ADSL|dial(up|in)|pool|dhcp|leased)[_\.\-]
+}
+&&DNSBLS {
+ rbl=zen.spamhaus.org
+ rbl=list.dsbl.org
+ rbl=bl.spamcop.net
+ rbl=dnsbl.sorbs.net
+ rbl=ix.dnsbl.manitu.net
+ rhsbl=rddn.dnsbl.net.au
+ rhsbl=rhsbl.ahbl.org
+ rhsbl=rhsbl.sorbs.net
+}
##
@@ -90,49 +87,96 @@
##
# temporary reject and drop connection during maintenance window
-id=M_001 ; &&MAINTENANCE ; action=421 maintenance - please try again later
+id=M_001
+ &&MAINTENANCE
+ action=421 maintenance - please try again later
# stress-friendly behaviour (will not match on postfix version pre 2.5)
-id=STRESS ; stress==yes ; action=dunno
+id=STRESS
+ stress==yes
+ action=dunno
# Whitelists
-id=WL_001 ; &&TRUSTED_NETS ; action=dunno
-id=WL_002 ; &&TRUSTED_HOSTS ; action=dunno
-id=WL_003 ; &&TRUSTED_USERS ; action=dunno
-id=WL_004 ; &&TRUSTED_TLS ; action=dunno
+id=WL_001
+ &&TRUSTED_NETS
+ action=dunno
+id=WL_002
+ &&TRUSTED_HOSTS
+ action=dunno
+id=WL_003
+ &&TRUSTED_USERS
+ action=dunno
+id=WL_004
+ &&TRUSTED_TLS
+ action=dunno
# DNSWL checks - lookup
-id=RWL_001 ; &&DNSWLS ; rhsblcount=all ; rblcount=all ; \
+id=RWL_001
+ &&DNSWLS
+ rhsblcount=all ; rblcount=all
action=set(HIT_dnswls=$$rhsblcount,HIT_dnswls+=$$rblcount,DSWL_text=$$dnsbltext)
# DNSWL - whitelisting
-id=RWL_002 ; HIT_dnswls>=2 ; action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text]
-id=RWL_003 ; HIT_dnswls>=1 ; action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text] ; &&STATIC
-id=RWL_004 ; HIT_dnswls>=1 ; action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text] ; $$client_name~=$$(sender_domain)$
+id=RWL_002
+ HIT_dnswls>=2
+ action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text]
+id=RWL_003
+ HIT_dnswls>=1
+ action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text] ; &&STATIC
+id=RWL_004
+ HIT_dnswls>=1
+ action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text] ; $$client_name~=$$(sender_domain)$
# DNSBL checks - lookup
-id=RBL_001 ; &&DNSBLS ; rhsblcount=all ; rblcount=all ; \
+id=RBL_001
+ &&DNSBLS
+ rhsblcount=all ; rblcount=all
action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,DSBL_text=$$dnsbltext)
# DNSBL checks - evaluation
-id=RBL_002 ; HIT_dnsbls>=2 ; action=554 5.7.1 blocked using $$DSBL_count dnsbls, INFO: [$$DSBL_text]
-id=RBL_003 ; HIT_dnsbls>=1 ; &&DYNAMIC ; action=REJECT listed on dnsbl and $$client_name looks like dynip, INFO: [$$DSBL_text]
-id=RBL_004 ; HIT_dnsbls>=1 ; &&BADHELO ; action=REJECT listed on dnsbl and $$helo_name does not match $$client_name, INFO: [$$DSBL_text]
+id=RBL_002
+ HIT_dnsbls>=2
+ action=554 5.7.1 blocked using $$DSBL_count dnsbls, INFO: [$$DSBL_text]
+id=RBL_003
+ HIT_dnsbls>=1
+ &&DYNAMIC
+ action=REJECT listed on dnsbl and $$client_name looks like dynip, INFO: [$$DSBL_text]
+id=RBL_004
+ HIT_dnsbls>=1
+ &&BADHELO
+ action=REJECT listed on dnsbl and $$helo_name does not match $$client_name, INFO: [$$DSBL_text]
# Rate limits
-id=RATE_001 ; HIT_dnsbls>=1; \
+id=RATE_001
+ HIT_dnsbls>=1
action=rate($$client_address/1/300/450 4.7.1 please do not try more than once per 5 minutes)
-id=RATE_002 ; &&DYNAMIC ; \
+id=RATE_002
+ &&DYNAMIC
action=rate($$client_address/1/300/450 4.7.1 please do not try more than once per 5 minutes)
# Selective greylisting
-id=GREY_001 ; action=dunno ; &&STATIC
-id=GREY_002 ; action=dunno ; $$client_name~=$$(sender_domain)$
-id=GREY_003 ; action=dunno ; HIT_dnswls>=1
-id=GREY_004 ; action=&&GREYLIST ; &&DYNAMIC
-id=GREY_005 ; action=&&GREYLIST ; HIT_dnsbls>=1
+id=GREY_001
+ action=dunno
+ &&STATIC
+id=GREY_002
+ action=dunno
+ $$client_name~=$$(sender_domain)$
+id=GREY_003
+ action=dunno
+ HIT_dnswls>=1
+id=GREY_004
+ action=greylisting
+ &&DYNAMIC
+id=GREY_005
+ action=greylisting
+ HIT_dnsbls>=1
# Greylisting should be safe during out-of-office times
-id=GREY_006 ; action=&&GREYLIST ; days=Sat-Sun
-id=GREY_007 ; action=&&GREYLIST ; days=Mon-Fri ; time=!!06:00:00-20:00:00
+id=GREY_006
+ action=greylisting
+ days=Sat-Sun
+id=GREY_007
+ action=greylisting
+ days=Mon-Fri
+ time=!!06:00:00-20:00:00
diff -Nru postfwd-1.20/etc/postfwd-old.cf.sample postfwd-1.32/etc/postfwd-old.cf.sample
--- postfwd-1.20/etc/postfwd-old.cf.sample 1970-01-01 00:00:00.000000000 +0000
+++ postfwd-1.32/etc/postfwd-old.cf.sample 2011-08-20 23:28:22.000000000 +0000
@@ -0,0 +1,135 @@
+
+
+###################################################################################################
+##
+## ATTENTION: This example configuration uses features which require at least postfwd 1.10pre8!
+## Please see the manual ('postfwd -m') for example syntax for prior versions.
+##
+## WARNING: Only provided to show some capabilities of postfwd. Do NOT use this without
+## modifications to suit your environment!
+##
+###################################################################################################
+
+
+##
+## Definitions
+##
+
+# Maintenance times
+&&MAINTENANCE { \
+ date=15.01.2007 ; \
+ date=15.04.2007 ; \
+ date=15.10.2007 - 17.10.2007 ; \
+ time=03:00:00 - 04:00:00 ; \
+};
+
+# Whitelists
+&&TRUSTED_NETS { \
+ client_address=192.168.1.0/22 ; \
+ client_address=172.16.128.32/27 ; \
+};
+&&TRUSTED_HOSTS { \
+ client_name~=\.domain1\.net$ ; \
+ client_name~=\.domain2\.de$ ; \
+};
+&&TRUSTED_USERS { \
+ sasl_username==bob ; \
+ sasl_username==alice ; \
+};
+&&TRUSTED_TLS { \
+ ccert_fingerprint==11:22:33:44:55:66:AA:BB:CC:DD:EE:FF ; \
+ ccert_fingerprint==AA:BB:CC:DD:EE:FF:11:22:33:44:55:66 ; \
+ encryption_keysize>=64 ; \
+};
+&&FREEMAIL { \
+ client_name~=\.gmx\.net$ ; \
+ client_name~=\.web\.de$ ; \
+ client_name~=\.(aol|yahoo|h(ush|ot)mail)\.com$ ; \
+};
+&&STATIC { \
+ # contains freemailers
+ &&FREEMAIL ; \
+ client_name~=[\.\-]static[[\.\-] ; \
+ client_name~=^(mail|smtp|mout|mx)[\-]*[0-9]*\. ; \
+};
+&&DNSWLS { \
+ rbl=list.dnswl.org ; \
+ rbl=exemptions.ahbl.org ; \
+ rbl=query.bondedsender.org ; \
+ rbl=hostkarma.junkemailfilter.com/^127\.0\.0\.1$/3600 ; \
+ rhsbl_client=hostkarma.junkemailfilter.com/^127\.0\.0\.1$/3600 ; \
+};
+
+# Spamchecks
+&&BADHELO { \
+ client_name==!!($$(helo_name)) ; \
+};
+&&DYNAMIC { \
+ client_name==unknown ; \
+ client_name~=(\-.+){4} ; \
+ client_name~=\d{5} ; \
+ client_name~=[_\.\-]([axt]{0,1}dsl|br(e|oa)dband|ppp|pppoe|dynamic|dynip|ADSL|dial(up|in)|pool|dhcp|leased)[_\.\-] ; \
+};
+&&DNSBLS { \
+ rbl=zen.spamhaus.org ; \
+ rbl=list.dsbl.org ; \
+ rbl=bl.spamcop.net ; \
+ rbl=dnsbl.sorbs.net ; \
+ rbl=ix.dnsbl.manitu.net ; \
+ rhsbl=rddn.dnsbl.net.au ; \
+ rhsbl=rhsbl.ahbl.org ; \
+ rhsbl=rhsbl.sorbs.net ; \
+};
+
+
+##
+## Ruleset
+##
+
+# temporary reject and drop connection during maintenance window
+id=M_001 ; &&MAINTENANCE ; action=421 maintenance - please try again later
+
+# stress-friendly behaviour (will not match on postfix version pre 2.5)
+id=STRESS ; stress==yes ; action=dunno
+
+# Whitelists
+id=WL_001 ; &&TRUSTED_NETS ; action=dunno
+id=WL_002 ; &&TRUSTED_HOSTS ; action=dunno
+id=WL_003 ; &&TRUSTED_USERS ; action=dunno
+id=WL_004 ; &&TRUSTED_TLS ; action=dunno
+
+# DNSWL checks - lookup
+id=RWL_001 ; &&DNSWLS ; rhsblcount=all ; rblcount=all ; \
+ action=set(HIT_dnswls=$$rhsblcount,HIT_dnswls+=$$rblcount,DSWL_text=$$dnsbltext)
+
+# DNSWL - whitelisting
+id=RWL_002 ; HIT_dnswls>=2 ; action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text]
+id=RWL_003 ; HIT_dnswls>=1 ; action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text] ; &&STATIC
+id=RWL_004 ; HIT_dnswls>=1 ; action=PREPEND X-PFW-STATE: INFO: [$$DSWL_text] ; $$client_name~=$$(sender_domain)$
+
+# DNSBL checks - lookup
+id=RBL_001 ; &&DNSBLS ; rhsblcount=all ; rblcount=all ; \
+ action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,DSBL_text=$$dnsbltext)
+
+# DNSBL checks - evaluation
+id=RBL_002 ; HIT_dnsbls>=2 ; action=554 5.7.1 blocked using $$DSBL_count dnsbls, INFO: [$$DSBL_text]
+id=RBL_003 ; HIT_dnsbls>=1 ; &&DYNAMIC ; action=REJECT listed on dnsbl and $$client_name looks like dynip, INFO: [$$DSBL_text]
+id=RBL_004 ; HIT_dnsbls>=1 ; &&BADHELO ; action=REJECT listed on dnsbl and $$helo_name does not match $$client_name, INFO: [$$DSBL_text]
+
+# Rate limits
+id=RATE_001 ; HIT_dnsbls>=1; \
+ action=rate($$client_address/1/300/450 4.7.1 please do not try more than once per 5 minutes)
+id=RATE_002 ; &&DYNAMIC ; \
+ action=rate($$client_address/1/300/450 4.7.1 please do not try more than once per 5 minutes)
+
+# Selective greylisting
+id=GREY_001 ; action=dunno ; &&STATIC
+id=GREY_002 ; action=dunno ; $$client_name~=$$(sender_domain)$
+id=GREY_003 ; action=dunno ; HIT_dnswls>=1
+id=GREY_004 ; action=greylisting ; &&DYNAMIC
+id=GREY_005 ; action=greylisting ; HIT_dnsbls>=1
+
+# Greylisting should be safe during out-of-office times
+id=GREY_006 ; action=greylisting ; days=Sat-Sun
+id=GREY_007 ; action=greylisting ; days=Mon-Fri ; time=!!06:00:00-20:00:00
+
diff -Nru postfwd-1.20/man/man8/postfwd2.8 postfwd-1.32/man/man8/postfwd2.8
--- postfwd-1.20/man/man8/postfwd2.8 2010-11-14 21:52:42.000000000 +0000
+++ postfwd-1.32/man/man8/postfwd2.8 2011-12-18 12:34:42.000000000 +0000
@@ -128,8 +128,8 @@
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
-.IX Title "POSTFWD2 1"
-.TH POSTFWD2 1 "2010-11-14" "perl v5.8.5" "User Contributed Perl Documentation"
+.IX Title "POSTFWD2-ALL-IN-ONE 1"
+.TH POSTFWD2-ALL-IN-ONE 1 "2011-12-18" "perl v5.8.5" "User Contributed Perl Documentation"
.SH "NAME"
postfwd2 \- postfix firewall daemon
.SH "SYNOPSIS"
@@ -175,7 +175,7 @@
\& --cache-no-size skip size for cache-id
\& --no_parent_request_cache disable parent request cache
\& --no_parent_rate_cache disable parent rate cache
-\& --no_parent_dns_cache disable parent dns cache
+\& --no_parent_dns_cache disable parent dns cache (default)
\& --no_parent_cache disable all parent caches
.Ve
.PP
@@ -184,7 +184,7 @@
\& --cleanup-rates cleanup interval in seconds for rate cache
.Ve
.PP
-.Vb 9
+.Vb 12
\& Control:
\& -k, --kill, --stop terminate postfwd2
\& --reload, --hup reload postfwd2
@@ -194,6 +194,9 @@
\& --daemons list of daemons to start
\& --dumpcache show cache contents
\& --dumpstats show statistics
+\& -R, --chroot chroot to before start
+\& --delcache - removes an item from the request cache
+\& --delrate
- removes an item from the rate cache
.Ve
.PP
.Vb 11
@@ -210,7 +213,7 @@
\& --dns_max_mx_lookups max names to look up with sender_mx_addrs
.Ve
.PP
-.Vb 7
+.Vb 10
\& Optional:
\& -t, --test testing, always returns "dunno"
\& -S, --summary
show stats every seconds
@@ -218,12 +221,21 @@
\& --norulestats disables per rule statistics
\& -I, --instantcfg reloads ruleset on every new request
\& --config_timeout parser timeout in seconds
+\& --keep_rates do not clear rate limit counters on reload
+\& --save_rates save and load rate limits on disk
+\& --fast_limit_evaluation evaluate rate limits before ruleset is parsed
.Ve
.PP
-.Vb 9
+.Vb 2
+\& Plugins:
+\& --plugins loads postfwd plugins from file
+.Ve
+.PP
+.Vb 10
\& Logging:
\& -l, --logname label for syslog messages
\& --facility use syslog facility
+\& --socktype use syslog socktype
\& --nodnslog do not log dns results
\& --anydnslog log any dns (even cached) results
\& --norulelog do not log rule actions
@@ -282,7 +294,7 @@
(`;`) and the appropriate desired action:
.PP
.Vb 1
-\& [ [=><~]=; [=><~]=; ... ] action=
+\& [ =; =; ... ] action=
.Ve
.PP
\&\fIExample:\fR
@@ -327,11 +339,23 @@
A ruleset consists of one or multiple rules, which can be loaded from files or passed as command line
arguments. Please see the \s-1COMMAND\s0 \s-1LINE\s0 section below for more information on this topic.
.PP
-Rules can span multiple lines by adding a trailing backslash \*(L"\e\*(R" character:
+Since postfwd version 1.30 rules spanning span multiple lines can be defined by prefixing the following
+lines with one or multiple whitespace characters (or '}' for macros):
.PP
-.Vb 2
-\& id=R_001 ; client_address=192.168.1.0/24; sender==no@bad.local; \e
-\& action=REJECT please use your relay from there
+.Vb 4
+\& id=RULE001
+\& client_address=192.168.1.0/24
+\& sender==no@bad.local
+\& action=REJECT no access
+.Ve
+.PP
+postfwd versions prior to 1.30 require trailing ';' and '\e'\-characters:
+.PP
+.Vb 4
+\& id=RULE001; \e
+\& client_address=192.168.1.0/24; \e
+\& sender==no@bad.local; \e
+\& action=REJECT no access
.Ve
.Sh "\s-1ITEMS\s0"
.IX Subsection "ITEMS"
@@ -416,15 +440,23 @@
\& (whitelisting), as it might be forged.
.Ve
.PP
-.Vb 6
+.Vb 7
\& version - postfwd2 version, contains "postfwd2 n.nn"
\& this enables version based checks in your rulesets
\& (e.g. for migration). works with old versions too,
\& because a non-existing item always returns false:
-\& id=R01; version~=1.10; sender_domain==some.org \e
+\& # version >= 1.10
+\& id=R01; version~=1\e.[1-9][0-9]; sender_domain==some.org \e
\& ; action=REJECT sorry no access
.Ve
.PP
+.Vb 4
+\& ratecount - only available for rate(), size() and rcpt() actions.
+\& contains the actual limit counter:
+\& id=R01; action=rate(sender/200/600/REJECT limit of 200 exceeded [$$ratecount hits])
+\& id=R02; action=rate(sender/100/600/WARN limit of 100 exceeded [$$ratecount hits])
+.Ve
+.PP
Besides these you can specify any attribute of the postfix policy delegation protocol.
Feel free to combine them the way you need it (have a look at the \s-1EXAMPLES\s0 section below).
.PP
@@ -478,27 +510,26 @@
.Ve
.PP
the current list can be found at . Please read carefully about which
-attribute can be used at which level of the smtp transaction (e.g. size will only work reliably at \s-1END_OF_DATA\s0 level).
+attribute can be used at which level of the smtp transaction (e.g. size will only work reliably at END-OF-MESSAGE level).
Pattern matching is performed case insensitive.
.PP
Multiple use of the same item is allowed and will compared as logical \s-1OR\s0, which means that this will work as expected:
.PP
.Vb 5
-\& id=TRUST001; action=OK; encryption_keysize=64; \e
-\& ccert_fingerprint=11:22:33:44:55:66:77:88:99; \e
-\& ccert_fingerprint=22:33:44:55:66:77:88:99:00; \e
-\& ccert_fingerprint=33:44:55:66:77:88:99:00:11; \e
+\& id=TRUST001; action=OK; encryption_keysize=64
+\& ccert_fingerprint=11:22:33:44:55:66:77:88:99
+\& ccert_fingerprint=22:33:44:55:66:77:88:99:00
+\& ccert_fingerprint=33:44:55:66:77:88:99:00:11
\& sender=@domain\e.local$
.Ve
.PP
client_address, rbl and rhsbl items may also be specified as whitespace-or-comma-separated values:
.PP
-.Vb 5
-\& id=SKIP01; action=dunno; \e
+.Vb 4
+\& id=SKIP01; action=dunno
\& client_address=192.168.1.0/24, 172.16.254.23
-\& id=SKIP02; action=dunno; \e
-\& client_address= 10.10.3.32 \e
-\& 10.216.222.0/27
+\& id=SKIP02; action=dunno
+\& client_address= 10.10.3.32 10.216.222.0/27
.Ve
.PP
The following items must be unique:
@@ -510,19 +541,19 @@
Any item can be negated by preceeding '!!' to it, e.g.:
.PP
.Vb 1
-\& id=TLS001 ; hostname=!!^secure\e.trust\e.local$ ; action=REJECT only secure.trust.local please
+\& id=HOST001 ; hostname == !!secure.trust.local ; action=REJECT only secure.trust.local please
.Ve
.PP
or using the right compare operator:
.PP
.Vb 1
-\& id=USER01 ; sasl_username !~ /^(bob|alice)$/ ; action=REJECT who is that?
+\& id=HOST001 ; hostname != secure.trust.local ; action=REJECT only secure.trust.local please
.Ve
.PP
To avoid confusion with regexps or simply for better visibility you can use '!!(...)':
.PP
.Vb 1
-\& id=USER01 ; sasl_username=!!( /^(bob|alice)$/ ) ; action=REJECT who is that?
+\& id=USER01 ; sasl_username =~ !!( /^(bob|alice)$/ ) ; action=REJECT who is that?
.Ve
.PP
Request attributes can be compared by preceeding '$$' characters, e.g.:
@@ -535,6 +566,40 @@
.PP
This is only valid for \s-1PCRE\s0 values (see list above). The comparison will be performed as case insensitive exact match.
Use the '\-vv' option to debug.
+.PP
+These special items will be reset for any new rule:
+.PP
+.Vb 5
+\& rblcount - contains the number of RBL answers
+\& rhsblcount - contains the number of RHSBL answers
+\& matches - contains the number of matched items
+\& dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
+\& rbltype:rblname:; rbltype:rblname:; ...
+.Ve
+.PP
+These special items will be changed for any matching rule:
+.PP
+.Vb 1
+\& request_hits - contains ids of all matching rules
+.Ve
+.PP
+This means that it might be necessary to save them, if you plan to use these values in later rules:
+.PP
+.Vb 6
+\& # set vals
+\& id=RBL01 ; rhsblcount=all; rblcount=all
+\& action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
+\& rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org
+\& rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+\& rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+.Ve
+.PP
+.Vb 4
+\& # compare
+\& id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
+\& id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
+\& id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
+.Ve
.Sh "\s-1FILES\s0"
.IX Subsection "FILES"
Since postfwd1 v1.15 and postfwd2 v0.18 long item lists can be stored in separate files:
@@ -563,20 +628,20 @@
This will ignore the right-hand value. Items can be mixed:
.PP
.Vb 3
-\& id=R002 ; action=REJECT \e
-\& client_name==unknown; \e
+\& id=R002 ; action=REJECT
+\& client_name==unknown
\& client_name==file:/etc/postfwd/blacklisted
.Ve
.PP
and for non pcre (comma separated) items:
.PP
.Vb 2
-\& id=R003 ; action=REJECT \e
+\& id=R003 ; action=REJECT
\& client_address==10.1.1.1, file:/etc/postfwd/blacklisted
.Ve
.PP
.Vb 2
-\& id=R004 ; action=REJECT \e
+\& id=R004 ; action=REJECT
\& rbl=myrbl.home.local, zen.spamhaus.org, file:/etc/postfwd/rbls_changing
.Ve
.PP
@@ -720,8 +785,8 @@
\& please note that is currently limited to postfix actions (no postfwd actions)!
\& # no more than 3 requests per 5 minutes
\& # from the same "unknown" client
-\& id=RATE01 ; client_name==unknown ; \e
-\& action==rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
+\& id=RATE01 ; client_name==unknown
+\& action=rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
.Ve
.PP
.Vb 7
@@ -730,8 +795,8 @@
\& increased by the request's size attribute. to do this reliably you should call postfwd2 from
\& smtpd_end_of_data_restrictions. if you want to be sure, you could check it within the ruleset:
\& # size limit 1.5mb per hour per client
-\& id=SIZE01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \e
-\& action==size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
+\& id=SIZE01 ; protocol_state==END-OF-MESSAGE ; client_address==!!(10.1.1.1)
+\& action=size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
.Ve
.PP
.Vb 8
@@ -741,8 +806,8 @@
\& from smtpd_data_restrictions or smtpd_end_of_data_restrictions. if you want to be sure, you could
\& check it within the ruleset:
\& # recipient count limit 3 per hour per client
-\& id=RCPT01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \e
-\& action==rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
+\& id=RCPT01 ; protocol_state==END-OF-MESSAGE ; client_address==!!(10.1.1.1)
+\& action=rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
.Ve
.PP
.Vb 9
@@ -757,6 +822,13 @@
\& id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031:^dunno$)
.Ve
.PP
+.Vb 4
+\& mail(server/helo/from/to/subject/body)
+\& Very basic mail command, that sends a message with the given arguments. LIMITATIONS:
+\& This basically performs a telnet. No authentication or TLS are available. Additionally it does
+\& not track notification state and will notify you any time, the corresponding rule hits.
+.Ve
+.PP
.Vb 3
\& wait ()
\& pauses the program execution for seconds. use this for
@@ -766,7 +838,7 @@
.Vb 3
\& note ()
\& just logs the given string and continues parsing the ruleset.
-\& if the string is empty, nothing will be logged.
+\& if the string is empty, nothing will be logged (noop).
.Ve
.PP
.Vb 3
@@ -780,40 +852,6 @@
.Vb 1
\& id=R-HELO ; helo_name=^[^\e.]+$ ; action=REJECT invalid helo '$$helo_name'
.Ve
-.PP
-These special attributes will be reset for any new rule:
-.PP
-.Vb 5
-\& rblcount - contains the number of RBL answers
-\& rhsblcount - contains the number of RHSBL answers
-\& matches - contains the number of matched items
-\& dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
-\& rbltype:rblname:; rbltype:rblname:; ...
-.Ve
-.PP
-These special attributes will be changed for any matching rule:
-.PP
-.Vb 1
-\& request_hits - contains ids of all matching rules
-.Ve
-.PP
-This means that it might be necessary to save them, if you plan to use these values in later rules:
-.PP
-.Vb 6
-\& # set vals
-\& id=RBL01 ; rhsblcount=all ; rblcount=all ; \e
-\& rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org ; \e
-\& rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \e
-\& rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \e
-\& action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
-.Ve
-.PP
-.Vb 4
-\& # compare
-\& id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
-\& id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
-\& id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
-.Ve
.Sh "\s-1MACROS/ACLS\s0"
.IX Subsection "MACROS/ACLS"
Multiple use of long items or combinations of them may be abbreviated by macros. Those must be prefixed by '&&' (two '&' characters).
@@ -845,18 +883,18 @@
Macros can contain macros, too:
.PP
.Vb 16
-\& # definition (note the trailing "\e" characters)
-\& &&RBLS { \e
-\& rbl=zen.spamhaus.org ; \e
-\& rbl=list.dsbl.org ; \e
-\& rbl=bl.spamcop.net ; \e
-\& rbl=dnsbl.sorbs.net ; \e
-\& rbl=ix.dnsbl.manitu.net ; \e
+\& # definition
+\& &&RBLS{
+\& rbl=zen.spamhaus.org
+\& rbl=list.dsbl.org
+\& rbl=bl.spamcop.net
+\& rbl=dnsbl.sorbs.net
+\& rbl=ix.dnsbl.manitu.net
\& };
-\& &&DYNAMIC { \e
-\& client_name=^unknown$ ; \e
-\& client_name=(\ed+[\e.-_]){4} ; \e
-\& client_name=[\e.-_](adsl|dynamic|ppp|)[\e.-_] ; \e
+\& &&DYNAMIC{
+\& client_name=^unknown$
+\& client_name=(\ed+[\e.-_]){4}
+\& client_name=[\e.-_](adsl|dynamic|ppp|)[\e.-_]
\& };
\& &&GOAWAY { &&RBLS; &&DYNAMIC; };
\& # rules
@@ -866,7 +904,194 @@
Basically macros are simple text substitutions \- see the \*(L"\s-1PARSER\s0\*(R" section for more information.
.Sh "\s-1PLUGINS\s0"
.IX Subsection "PLUGINS"
-Please visit
+\&\fBDescription\fR
+.PP
+The plugin interface allow you to define your own checks and enhance postfwd's
+functionality. Feel free to share useful things!
+.PP
+\&\fBWarning\fR
+.PP
+Note that the plugin interface is still at devel stage. Please test your plugins
+carefully, because errors may cause postfwd to break! It is also
+allowed to override attributes or built-in functions, but be sure that you know
+what you do because some of them are used internally.
+.PP
+Please keep security in mind, when you access sensible ressources and never, ever
+run postfwd as privileged user! Also never trust your input (especially hostnames,
+and e\-mail addresses).
+.PP
+\&\fB\s-1ITEMS\s0\fR
+.PP
+Item plugins are perl subroutines which integrate additional attributes to requests
+before they are evaluated against postfwd's ruleset like any other item of the
+policy delegation protocol. This allows you to create your own checks.
+.PP
+plugin-items can not be used selective. these functions will be executed for every
+request postfwd receives, so keep performance in mind.
+.PP
+.Vb 1
+\& SYNOPSIS: %result = postfwd_items_plugin{}(%request)
+.Ve
+.PP
+means that your subroutine, called , has access to a hash called \f(CW%request\fR,
+which contains all request attributes, like \f(CW$request\fR{client_name} and must
+return a value in the following form:
+.PP
+.Vb 1
+\& save: $result{- } =
+.Ve
+.PP
+this creates the new item - containing
, which will be integrated in
+the policy delegation request and therefore may be used in postfwd's ruleset.
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& %postfwd_items_plugin = (
+.Ve
+.PP
+.Vb 1
+\& # EXAMPLES - integrated in postfwd. no need to activate them here.
+.Ve
+.PP
+.Vb 8
+\& # allows to check postfwd version in ruleset
+\& "version" => sub {
+\& my(%request) = @_;
+\& my(%result) = (
+\& "version" => $NAME." ".$VERSION,
+\& );
+\& return %result;
+\& },
+.Ve
+.PP
+.Vb 10
+\& # sender_domain and recipient_domain
+\& "address_parts" => sub {
+\& my(%request) = @_;
+\& my(%result) = ();
+\& $request{sender} =~ /@([^@]*)$/;
+\& $result{sender_domain} = ($1 || '');
+\& $request{recipient} =~ /@([^@]*)$/;
+\& $result{recipient_domain} = ($1 || '');
+\& return %result;
+\& },
+.Ve
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& );
+.Ve
+.PP
+\&\fB\s-1COMPARE\s0\fR
+.PP
+Compare plugins allow you to define how your new items should be compared to the ruleset.
+These are optional. If you don't specify one, the default (== for exact match, =~ for \s-1PCRE\s0, ...)
+will be used.
+.PP
+.Vb 1
+\& SYNOPSIS: - => sub { return &{$postfwd_compare{
}}(@_); },
+.Ve
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& %postfwd_compare_plugin = (
+.Ve
+.PP
+.Vb 1
+\& EXAMPLES - integrated in postfwd. no need to activate them here.
+.Ve
+.PP
+.Vb 5
+\& # Simple example
+\& # SYNOPSIS: = - (return &{$postfwd_compare{
}}(@_))
+\& "client_address" => sub { return &{$postfwd_compare{cidr}}(@_); },
+\& "size" => sub { return &{$postfwd_compare{numeric}}(@_); },
+\& "recipient_count" => sub { return &{$postfwd_compare{numeric}}(@_); },
+.Ve
+.PP
+.Vb 22
+\& # Complex example
+\& # SYNOPSIS: = - (
, , , )
+\& "numeric" => sub {
+\& my($cmp,$val,$myitem,%request) = @_;
+\& my($myresult) = undef; $myitem ||= "0"; $val ||= "0";
+\& if ($cmp eq '==') {
+\& $myresult = ($myitem == $val);
+\& } elsif ($cmp eq '=<') {
+\& $myresult = ($myitem <= $val);
+\& } elsif ($cmp eq '=>') {
+\& $myresult = ($myitem >= $val);
+\& } elsif ($cmp eq '!=') {
+\& $myresult = not($myitem == $val);
+\& } elsif ($cmp eq '!<') {
+\& $myresult = not($myitem <= $val);
+\& } elsif ($cmp eq '!>') {
+\& $myresult = not($myitem >= $val);
+\& } else {
+\& $myresult = ($myitem >= $val);
+\& };
+\& return $myresult;
+\& },
+.Ve
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& );
+.Ve
+.PP
+\&\fB\s-1ACTIONS\s0\fR
+.PP
+Action plugins allow to define new postfwd actions. By setting the \f(CW$stop\fR\-flag you can decide to
+continue or to stop parsing the ruleset.
+.PP
+.Vb 2
+\& SYNOPSIS: (, , , , ) =
+\& (, , , , , )
+.Ve
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& %postfwd_actions_plugin = (
+.Ve
+.PP
+.Vb 1
+\& # EXAMPLES - integrated in postfwd. no need to activate them here.
+.Ve
+.PP
+.Vb 7
+\& # note() command
+\& "note" => sub {
+\& my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+\& my($myaction) = $default_action; my($stop) = 0;
+\& mylogs 'info', "[RULES] ".$myline." - note: ".$myarg if $myarg;
+\& return ($stop,$index,$myaction,$myline,%request);
+\& },
+.Ve
+.PP
+.Vb 7
+\& # skips next rules
+\& "skip" => sub {
+\& my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+\& my($myaction) = $default_action; my($stop) = 0;
+\& $index += $myarg if ( $myarg and not(($index + $myarg) > $#Rules) );
+\& return ($stop,$index,$myaction,$myline,%request);
+\& },
+.Ve
+.PP
+.Vb 7
+\& # dumps current request contents to syslog
+\& "dumprequest" => sub {
+\& my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+\& my($myaction) = $default_action; my($stop) = 0;
+\& map { mylogs 'info', "[DUMP] rule=$index, Attribute: $_=$request{$_}" } (keys %request);
+\& return ($stop,$index,$myaction,$myline,%request);
+\& },
+.Ve
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& );
+.Ve
.Sh "\s-1COMMAND\s0 \s-1LINE\s0"
.IX Subsection "COMMAND LINE"
\&\fIRuleset\fR
@@ -886,14 +1111,6 @@
\& strings that contain whitespaces or shell characters.
.Ve
.PP
-\&\fIPlugins\fR
-.PP
-.Vb 3
-\& --plugins
-\& A file containing plugin routines for postfwd. Please see the
-\& PLUGINS section for more information.
-.Ve
-.PP
\&\fIScoring\fR
.PP
.Vb 2
@@ -904,7 +1121,7 @@
Multiple usage is allowed. Just chain your arguments, like:
.PP
.Vb 3
-\& postfwd2 -r "- =
;action=" -f -f --plugins ...
+\& postfwd2 -r "- =
;action=" -f -f ...
\& or
\& postfwd2 --scores 4.5="WARN high score" --scores 5.0="REJECT postfwd2 score too high" ...
.Ve
@@ -920,7 +1137,7 @@
.Vb 3
\& -d, --daemon
\& postfwd2 will run as daemon and listen on the network for incoming
-\& queries (default 127.0.0.1:10040).
+\& queries (default 127.0.0.1:10045).
.Ve
.PP
.Vb 2
@@ -930,7 +1147,7 @@
.PP
.Vb 2
\& -p, --port
-\& postfwd2 listens on the specified port (default tcp/10040).
+\& postfwd2 listens on the specified port (default tcp/10045).
.Ve
.PP
.Vb 4
@@ -970,7 +1187,7 @@
.Vb 3
\& -R, --chroot
\& Chroot the process to the specified path.
-\& Test this before using - you might need some libs there.
+\& Please look at http://postfwd.org/postfwd2-chroot.html before use!
.Ve
.PP
.Vb 2
@@ -978,6 +1195,17 @@
\& The process id will be saved in the specified file.
.Ve
.PP
+.Vb 2
+\& --facility
+\& sets the syslog facility, default is 'mail'
+.Ve
+.PP
+.Vb 3
+\& --socktype
+\& sets the Sys::Syslog socktype to 'native', 'inet' or 'unix'.
+\& Default is to auto-detect this depening on module version and os.
+.Ve
+.PP
.Vb 3
\& -l, --logname
\& Labels the syslog messages. Useful when running multiple
@@ -989,6 +1217,14 @@
\& Truncates any syslog message after characters.
.Ve
.PP
+\&\fIPlugins\fR
+.PP
+.Vb 3
+\& --plugins
+\& Loads postfwd plugins from file. Please see http://postfwd.org/postfwd.plugins
+\& or the plugins.postfwd.sample that is available from the tarball for more info.
+.Ve
+.PP
\&\fIOptional arguments\fR
.PP
These parameters influence the way postfwd2 is working. Any of them can be combined.
@@ -1168,6 +1404,28 @@
\& be skipped. this is used to prevent problems due to large files or loops.
.Ve
.PP
+.Vb 4
+\& --keep_rates (default=0)
+\& With this option set postfwd2 does not clear the rate limit counters on reload. Please
+\& note that you have to restart (not reload) postfwd with this option if you change
+\& any rate limit rules.
+.Ve
+.PP
+.Vb 4
+\& --save_rates (default=none)
+\& With this option postfwd saves existing rate limit counters to disk and reloads them
+\& on program start. This allows persistent rate limits across program restarts or reboots.
+\& Please note that postfwd needs read and write access to the specified file.
+.Ve
+.PP
+.Vb 5
+\& --fast_limit_evaluation (default=0)
+\& Once a ratelimit was set by the ruleset, future requests will be evaluated against it
+\& before consulting the ruleset. This mode was the default behaviour until v1.30.
+\& With this mode rate limits will be faster, but also eventually set up
+\& whitelisting-rules within the ruleset might not work as expected.
+.Ve
+.PP
\&\fIInformational arguments\fR
.PP
These arguments are for command line usage only. Never ever use them with postfix!
@@ -1202,6 +1460,34 @@
\& This option turns of any syslogging and output. It is included
\& for performance testing.
.Ve
+.PP
+.Vb 2
+\& --dumpstats
+\& Displays program usage statistics.
+.Ve
+.PP
+.Vb 2
+\& --dumpcache
+\& Displays cache contents.
+.Ve
+.PP
+.Vb 10
+\& --delcache -
+\& Removes an item from the request cache. Use --dumpcache to identify objects.
+\& E.g.:
+\& # postfwd --dumpcache
+\& ...
+\& %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @count -> '1'
+\& %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @maxcount -> '2'
+\& ...
+\& # postfwd --delrate="sender=gmato@jqvo.org"
+\& rate cache item 'sender=gmato@jqvo.org' removed
+.Ve
+.PP
+.Vb 2
+\& --delrate
-
+\& Removes an item from the rate cache. Use --dumpcache to identify objects.
+.Ve
.Sh "\s-1REFRESH\s0"
.IX Subsection "REFRESH"
In daemon mode postfwd2 reloads it's ruleset after receiving a \s-1HUP\s0 signal. Please see the description of
@@ -1245,20 +1531,27 @@
\& # 1. 30MB for systems in *.customer1.tld
\& # 2. 20MB for SASL user joejob
\& # 3. 10MB default
-\& id=SZ001; state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\e.customer1.tld$
-\& id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
-\& id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=10000000
-\& id=SZ100; state==END-OF-MESSAGE; action=REJECT message too large
+\& id=SZ001; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\e.customer1.tld$
+\& id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
+\& id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=10000000
+\& id=SZ100; protocol_state==END-OF-MESSAGE; action=REJECT message too large
.Ve
.PP
-.Vb 7
+.Vb 14
\& ## Selective Greylisting
+\& ##
+\& ## Note that postfwd does not include greylisting. This setup requires a running postgrey service
+\& ## at port 10031 and the following postfix restriction class in your main.cf:
+\& ##
+\& ## smtpd_restriction_classes = check_postgrey, ...
+\& ## check_postgrey = check_policy_service inet:127.0.0.1:10031
+\& #
\& # 1. if listed on zen.spamhaus.org with results 127.0.0.10 or .11, dns cache timeout 1200s
\& # 2. Client has no rDNS
\& # 3. Client comes from several dialin domains
-\& id=GR001; action=greylisting ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
-\& id=GR002; action=greylisting ; client_name=^unknown$
-\& id=GR003; action=greylisting ; client_name=\e.(t-ipconnect|alicedsl|ish)\e.de$
+\& id=GR001; action=check_postgrey ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
+\& id=GR002; action=check_postgrey ; client_name=^unknown$
+\& id=GR003; action=check_postgrey ; client_name=\e.(t-ipconnect|alicedsl|ish)\e.de$
.Ve
.PP
.Vb 7
@@ -1268,7 +1561,7 @@
\& time=-07:00:00 ; sasl_username=jim ; action=450 4.7.1 to early for you, jim
\& time=22:00:00- ; sasl_username=jim ; action=450 4.7.1 to late now, jim
\& months=-Apr ; action=450 4.7.1 see you in may
-\& days=!!Mon-Fri ; action=greylist
+\& days=!!Mon-Fri ; action=check_postgrey
.Ve
.PP
.Vb 10
@@ -1280,8 +1573,8 @@
\& id=R003 ; action=jump(R100) ; ccert_fingerprint=AA:BB:CC:DD:...
\& id=R004 ; action=jump(R100) ; ccert_fingerprint=AF:BE:CD:DC:...
\& id=R005 ; action=jump(R100) ; ccert_fingerprint=DD:CC:BB:DD:...
-\& id=R099 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
-\& id=R100 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
+\& id=R099 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
+\& id=R100 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
.Ve
.PP
.Vb 14
@@ -1291,8 +1584,8 @@
\& # - is listed in 1 RBL or 1 RHSBL and has no correct rDNS
\& # - other clients without correct rDNS will be greylist-checked
\& # - some whitelists are used to lower the score
-\& id=S01 ; score=2.6 ; action=greylisting
-\& id=S02 ; score=5.0 ; action=REJECT postfwd2 score too high
+\& id=S01 ; score=2.6 ; action=check_postgrey
+\& id=S02 ; score=5.0 ; action=REJECT postfwd score too high
\& id=R00 ; action=score(-1.0) ; rbl=exemptions.ahbl.org,list.dnswl.org,query.bondedsender.org,spf.trusted-forwarder.org
\& id=R01 ; action=score(2.5) ; rbl=bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
\& id=R02 ; action=score(2.5) ; rhsbl=rhsbl.ahbl.org, rhsbl.sorbs.net
@@ -1306,10 +1599,10 @@
\& # The following temporary rejects requests from "unknown" clients, if they
\& # 1. exceeded 30 requests per hour or
\& # 2. tried to send more than 1.5mb within 10 minutes
-\& id=RATE01 ; client_name==unknown ; state==RCPT ; \e
-\& action==rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
-\& id=SIZE01 ; client_name==unknown ; state==END_OF_DATA ; \e
-\& action==size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
+\& id=RATE01 ; client_name==unknown ; protocol_state==RCPT
+\& action=rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
+\& id=SIZE01 ; client_name==unknown ; protocol_state==END-OF-MESSAGE
+\& action=size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
.Ve
.PP
.Vb 8
@@ -1326,34 +1619,34 @@
.Vb 34
\& ## Groups
\& # definition
-\& &&RBLS { \e
-\& rbl=zen.spamhaus.org ; \e
-\& rbl=list.dsbl.org ; \e
-\& rbl=bl.spamcop.net ; \e
-\& rbl=dnsbl.sorbs.net ; \e
-\& rbl=ix.dnsbl.manitu.net ; \e
+\& &&RBLS{
+\& rbl=zen.spamhaus.org
+\& rbl=list.dsbl.org
+\& rbl=bl.spamcop.net
+\& rbl=dnsbl.sorbs.net
+\& rbl=ix.dnsbl.manitu.net
\& };
-\& &&RHSBLS { \e
+\& &&RHSBLS{
\& ...
\& };
-\& &&DYNAMIC { \e
-\& client_name==unknown ; \e
-\& client_name~=(\ed+[\e.-_]){4} ; \e
-\& client_name~=[\e.-_](adsl|dynamic|ppp|)[\e.-_] ; \e
+\& &&DYNAMIC{
+\& client_name==unknown
+\& client_name~=(\ed+[\e.-_]){4}
+\& client_name~=[\e.-_](adsl|dynamic|ppp|)[\e.-_]
\& ...
\& };
-\& &&BAD_HELO { \e
-\& helo_name==my.name.tld; \e
-\& helo_name~=^([^\e.]+)$; \e
-\& helo_name~=\e.(local|lan)$; \e
+\& &&BAD_HELO{
+\& helo_name==my.name.tld
+\& helo_name~=^([^\e.]+)$
+\& helo_name~=\e.(local|lan)$
\& ...
\& };
-\& &&MAINTENANCE { \e
-\& date=15.01.2007 ; \e
-\& date=15.04.2007 ; \e
-\& date=15.07.2007 ; \e
-\& date=15.10.2007 ; \e
-\& time=03:00:00 - 04:00:00 ; \e
+\& &&MAINTENANCE{
+\& date=15.01.2007
+\& date=15.04.2007
+\& date=15.07.2007
+\& date=15.10.2007
+\& time=03:00:00 - 04:00:00
\& };
\& # rules
\& id=COMBINED ; &&RBLS ; &&DYNAMIC ; action=REJECT dynamic client and listed on RBL
@@ -1374,7 +1667,7 @@
.Vb 5
\& ## combined with enhanced rbl features
\& #
-\& id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS ; \e
+\& id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS
\& action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,HIT_dnstxt=$$dnsbltext)
\& id=RBL02 ; HIT_dnsbls>=2 ; action=554 5.7.1 blocked using $$HIT_dnsbls DNSBLs [INFO: $$HIT_dnstxt]
.Ve
@@ -1526,7 +1819,7 @@
the prefered way to use postfwd2 in high volume environments. Start postfwd2 with the following parameters:
.PP
.Vb 1
-\& postfwd2 -d -f /etc/postfwd.cf -i 127.0.0.1 -p 10040 -u nobody -g nobody -S
+\& postfwd2 -d -f /etc/postfwd.cf -i 127.0.0.1 -p 10045 -u nobody -g nobody -S
.Ve
.PP
For efficient caching you should check if you can use the options \-\-cacheid, \-\-cache\-rdomain\-only,
@@ -1538,19 +1831,19 @@
\& Aug 9 23:00:24 mail postfwd[5158]: postfwd2 n.nn ready for input
.Ve
.PP
-and use `netstat \-an|grep 10040` to check for something like
+and use `netstat \-an|grep 10045` to check for something like
.PP
.Vb 1
-\& tcp 0 0 127.0.0.1:10040 0.0.0.0:* LISTEN
+\& tcp 0 0 127.0.0.1:10045 0.0.0.0:* LISTEN
.Ve
.PP
If everything works, open your postfix main.cf and insert the following
.PP
.Vb 4
-\& 127.0.0.1:10040_time_limit = 3600 <--- integration
+\& 127.0.0.1:10045_time_limit = 3600 <--- integration
\& smtpd_recipient_restrictions = permit_mynetworks <--- recommended
\& reject_unauth_destination <--- recommended
-\& check_policy_service inet:127.0.0.1:10040 <--- integration
+\& check_policy_service inet:127.0.0.1:10045 <--- integration
.Ve
.PP
Reload your configuration with `postfix reload` and watch your logs. In it works you should see
@@ -1575,11 +1868,11 @@
.Vb 3
\& # Restriction Classes
\& smtpd_restriction_classes = postfwdcheck,
... <--- integration
-\& postfwdcheck = check_policy_service inet:127.0.0.1:10040 <--- integration
+\& postfwdcheck = check_policy_service inet:127.0.0.1:10045 <--- integration
.Ve
.PP
.Vb 6
-\& 127.0.0.1:10040_time_limit = 3600 <--- integration
+\& 127.0.0.1:10045_time_limit = 3600 <--- integration
\& smtpd_recipient_restrictions = permit_mynetworks, <--- recommended
\& reject_unauth_destination, <--- recommended
\& ... <--- optional
@@ -1612,7 +1905,7 @@
For network tests I use netcat:
.PP
.Vb 1
-\& nc 127.0.0.1 10040 reads rules from
-\& -r, --rule adds to config
+\& -f, --file reads rules from
+\& -r, --rule adds to config
.Ve
.PP
.Vb 2
\& Scoring:
-\& -s, --scores = returns when score exceeds
+\& -s, --scores = returns when score exceeds
.Ve
.PP
-.Vb 12
+.Vb 8
+\& Control:
+\& -d, --daemon run postfwd as daemon
+\& -k, --kill stops daemon
+\& --reload reloads configuration
+\& --dumpstats displays usage statistics
+\& --dumpcache displays cache contents
+\& --delcache - removes an item from the request cache
+\& --delrate
- removes an item from the rate cache
+.Ve
+.PP
+.Vb 13
\& Networking:
-\& -d, --daemon run postfwd as daemon
-\& -i, --interface
listen on interface
-\& -p, --port listen on port
-\& --proto socket type (tcp or unix)
-\& -u, --user set uid to user
-\& -g, --group set gid to group
-\& --umask set umask for file permissions
-\& -R, --chroot chroot the daemon to
-\& --pidfile create pidfile under
-\& -l, --logname label for syslog messages
-\& --loglen truncates syslogs after chars
+\& -i, --interface listen on interface
+\& -p, --port listen on port
+\& --proto socket type (tcp or unix)
+\& -u, --user set uid to user
+\& -g, --group set gid to group
+\& --umask set umask for file permissions
+\& -R, --chroot chroot the daemon to
+\& --pidfile create pidfile under
+\& --facility syslog facility
+\& --socktype syslog socktype
+\& -l, --logname label for syslog messages
+\& --loglen truncates syslogs after chars
.Ve
.PP
.Vb 11
\& Caching:
-\& -c, --cache sets the request-cache timeout to seconds
-\& --cache-no-size ignores size attribute for caching
-\& --cache-no-sender ignores sender address in cache
-\& --cache-rdomain-only ignores localpart of recipient address in cache
-\& --cache-rbl-timeout default rbl timeout, if not specified in ruleset
-\& --cache-rbl-default default rbl response pattern to match (regexp)
-\& --cacheid - , .. list of attributes for request cache identifier
-\& --cleanup-requests cleanup interval in seconds for request cache
-\& --cleanup-rbls cleanup interval in seconds for rbl cache
-\& --cleanup-rates cleanup interval in seconds for rate cache
+\& -c, --cache
sets the request-cache timeout to seconds
+\& --cache-no-size ignores size attribute for caching
+\& --cache-no-sender ignores sender address in cache
+\& --cache-rdomain-only ignores localpart of recipient address in cache
+\& --cache-rbl-timeout default rbl timeout, if not specified in ruleset
+\& --cache-rbl-default default rbl response pattern to match (regexp)
+\& --cacheid - , .. list of attributes for request cache identifier
+\& --cleanup-requests cleanup interval in seconds for request cache
+\& --cleanup-rbls cleanup interval in seconds for rbl cache
+\& --cleanup-rates cleanup interval in seconds for rate cache
.Ve
.PP
-.Vb 17
+.Vb 20
\& Optional:
-\& -t, --test testing, always returns "dunno"
-\& -v, --verbose verbose logging, use twice (-vv) to increase level
-\& -S, --summary
show some usage statistics every seconds
-\& --norulelog disbles rule logging
-\& --norulestats disables per rule statistics
-\& --noidlestats disables statistics when idle
-\& -n, --nodns disable dns
-\& --nodnslog disable dns logging
-\& --dns_async_txt perform dnsbl A and TXT lookups simultaneously
-\& --dns_timeout timeout in seconds for asynchonous dns queries
-\& --dns_timeout_max maximum of dns timeouts until a dnsbl will be deactivated
-\& --dns_timeout_interval interval in seconds for dns timeout maximum counter
-\& --dns_max_ns_lookups max names to look up with sender_ns_addrs
-\& --dns_max_mx_lookups max names to look up with sender_mx_addrs
-\& -I, --instantcfg re-reads rulefiles for every new request
-\& --config_timeout parser timeout in seconds
+\& -t, --test testing, always returns "dunno"
+\& -v, --verbose verbose logging, use twice (-vv) to increase level
+\& -S, --summary show some usage statistics every seconds
+\& --norulelog disbles rule logging
+\& --norulestats disables per rule statistics
+\& --noidlestats disables statistics when idle
+\& -n, --nodns disable dns
+\& --nodnslog disable dns logging
+\& --dns_async_txt perform dnsbl A and TXT lookups simultaneously
+\& --dns_timeout timeout in seconds for asynchonous dns queries
+\& --dns_timeout_max maximum of dns timeouts until a dnsbl will be deactivated
+\& --dns_timeout_interval interval in seconds for dns timeout maximum counter
+\& --dns_max_ns_lookups max names to look up with sender_ns_addrs
+\& --dns_max_mx_lookups max names to look up with sender_mx_addrs
+\& -I, --instantcfg re-reads rulefiles for every new request
+\& --config_timeout parser timeout in seconds
+\& --keep_rates do not clear rate limit counters on reload
+\& --save_rates save and load rate limits on disk
+\& --fast_limit_evaluation evaluate rate limits before ruleset is parsed
+.Ve
+.PP
+.Vb 2
+\& Plugins:
+\& --plugins loads postfwd plugins from file
.Ve
.PP
.Vb 7
@@ -205,11 +225,6 @@
\& -h, --help shows usage
\& -m, --manual shows program manual
.Ve
-.PP
-.Vb 2
-\& Plugins:
-\& --plugins loads plugins from
-.Ve
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
.Sh "\s-1INTRODUCTION\s0"
@@ -245,7 +260,7 @@
(`;`) and the appropriate desired action:
.PP
.Vb 1
-\& [ [=><~]=; [=><~]=; ... ] action=
+\& [ =; =; ... ] action=
.Ve
.PP
\&\fIExample:\fR
@@ -290,11 +305,23 @@
A ruleset consists of one or multiple rules, which can be loaded from files or passed as command line
arguments. Please see the \s-1COMMAND\s0 \s-1LINE\s0 section below for more information on this topic.
.PP
-Rules can span multiple lines by adding a trailing backslash \*(L"\e\*(R" character:
+Since postfwd version 1.30 rules spanning span multiple lines can be defined by prefixing the following
+lines with one or multiple whitespace characters (or '}' for macros):
.PP
-.Vb 2
-\& id=R_001 ; client_address=192.168.1.0/24; sender==no@bad.local; \e
-\& action=REJECT please use your relay from there
+.Vb 4
+\& id=RULE001
+\& client_address=192.168.1.0/24
+\& sender==no@bad.local
+\& action=REJECT no access
+.Ve
+.PP
+postfwd versions prior to 1.30 require trailing ';' and '\e'\-characters:
+.PP
+.Vb 4
+\& id=RULE001; \e
+\& client_address=192.168.1.0/24; \e
+\& sender==no@bad.local; \e
+\& action=REJECT no access
.Ve
.Sh "\s-1ITEMS\s0"
.IX Subsection "ITEMS"
@@ -379,15 +406,23 @@
\& (whitelisting), as it might be forged.
.Ve
.PP
-.Vb 6
+.Vb 7
\& version - postfwd version, contains "postfwd n.nn"
\& this enables version based checks in your rulesets
\& (e.g. for migration). works with old versions too,
\& because a non-existing item always returns false:
-\& id=R01; version~=1.10; sender_domain==some.org \e
+\& # version >= 1.10
+\& id=R01; version~=1\e.[1-9][0-9]; sender_domain==some.org \e
\& ; action=REJECT sorry no access
.Ve
.PP
+.Vb 4
+\& ratecount - only available for rate(), size() and rcpt() actions.
+\& contains the actual limit counter:
+\& id=R01; action=rate(sender/200/600/REJECT limit of 200 exceeded [$$ratecount hits])
+\& id=R02; action=rate(sender/100/600/WARN limit of 100 exceeded [$$ratecount hits])
+.Ve
+.PP
Besides these you can specify any attribute of the postfix policy delegation protocol.
Feel free to combine them the way you need it (have a look at the \s-1EXAMPLES\s0 section below).
.PP
@@ -441,27 +476,26 @@
.Ve
.PP
the current list can be found at . Please read carefully about which
-attribute can be used at which level of the smtp transaction (e.g. size will only work reliably at \s-1END_OF_DATA\s0 level).
+attribute can be used at which level of the smtp transaction (e.g. size will only work reliably at END-OF-MESSAGE level).
Pattern matching is performed case insensitive.
.PP
Multiple use of the same item is allowed and will compared as logical \s-1OR\s0, which means that this will work as expected:
.PP
.Vb 5
-\& id=TRUST001; action=OK; encryption_keysize=64; \e
-\& ccert_fingerprint=11:22:33:44:55:66:77:88:99; \e
-\& ccert_fingerprint=22:33:44:55:66:77:88:99:00; \e
-\& ccert_fingerprint=33:44:55:66:77:88:99:00:11; \e
+\& id=TRUST001; action=OK; encryption_keysize=64
+\& ccert_fingerprint=11:22:33:44:55:66:77:88:99
+\& ccert_fingerprint=22:33:44:55:66:77:88:99:00
+\& ccert_fingerprint=33:44:55:66:77:88:99:00:11
\& sender=@domain\e.local$
.Ve
.PP
client_address, rbl and rhsbl items may also be specified as whitespace-or-comma-separated values:
.PP
-.Vb 5
-\& id=SKIP01; action=dunno; \e
+.Vb 4
+\& id=SKIP01; action=dunno
\& client_address=192.168.1.0/24, 172.16.254.23
-\& id=SKIP02; action=dunno; \e
-\& client_address= 10.10.3.32 \e
-\& 10.216.222.0/27
+\& id=SKIP02; action=dunno
+\& client_address=10.10.3.32 10.216.222.0/27
.Ve
.PP
The following items currently have to be unique:
@@ -473,19 +507,19 @@
Any item can be negated by preceeding '!!' to it, e.g.:
.PP
.Vb 1
-\& id=TLS001 ; hostname=!!^secure\e.trust\e.local$ ; action=REJECT only secure.trust.local please
+\& id=HOST001 ; hostname == !!secure.trust.local ; action=REJECT only secure.trust.local please
.Ve
.PP
or using the right compare operator:
.PP
.Vb 1
-\& id=USER01 ; sasl_username !~ /^(bob|alice)$/ ; action=REJECT who is that?
+\& id=HOST001 ; hostname != secure.trust.local ; action=REJECT only secure.trust.local please
.Ve
.PP
To avoid confusion with regexps or simply for better visibility you can use '!!(...)':
.PP
.Vb 1
-\& id=USER01 ; sasl_username=!!( (bob|alice) ) ; action=REJECT who is that?
+\& id=USER01 ; sasl_username = !!( (bob|alice) ) ; action=REJECT who is that?
.Ve
.PP
Request attributes can be compared by preceeding '$$' characters, e.g.:
@@ -498,6 +532,40 @@
.PP
This is only valid for \s-1PCRE\s0 values (see list above). The comparison will be performed as case insensitive exact match.
Use the '\-vv' option to debug.
+.PP
+These special items will be reset for any new rule:
+.PP
+.Vb 5
+\& rblcount - contains the number of RBL answers
+\& rhsblcount - contains the number of RHSBL answers
+\& matches - contains the number of matched items
+\& dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
+\& rbltype:rblname:; rbltype:rblname:; ...
+.Ve
+.PP
+These special items will be changed for any matching rule:
+.PP
+.Vb 1
+\& request_hits - contains ids of all matching rules
+.Ve
+.PP
+This means that it might be necessary to save them, if you plan to use these values in later rules:
+.PP
+.Vb 6
+\& # set vals
+\& id=RBL01 ; rhsblcount=all; rblcount=all
+\& action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
+\& rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org
+\& rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+\& rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net
+.Ve
+.PP
+.Vb 4
+\& # compare
+\& id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
+\& id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
+\& id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
+.Ve
.Sh "\s-1FILES\s0"
.IX Subsection "FILES"
Since postfwd1 v1.15 and postfwd2 v0.18 long item lists can be stored in separate files:
@@ -526,20 +594,20 @@
This will ignore the right-hand value. Items can be mixed:
.PP
.Vb 3
-\& id=R002 ; action=REJECT \e
-\& client_name==unknown; \e
+\& id=R002 ; action=REJECT
+\& client_name==unknown
\& client_name==file:/etc/postfwd/blacklisted
.Ve
.PP
and for non pcre (comma separated) items:
.PP
.Vb 2
-\& id=R003 ; action=REJECT \e
+\& id=R003 ; action=REJECT
\& client_address==10.1.1.1, file:/etc/postfwd/blacklisted
.Ve
.PP
.Vb 2
-\& id=R004 ; action=REJECT \e
+\& id=R004 ; action=REJECT
\& rbl=myrbl.home.local, zen.spamhaus.org, file:/etc/postfwd/rbls_changing
.Ve
.PP
@@ -675,7 +743,7 @@
\& by "," characters.
.Ve
.PP
-.Vb 9
+.Vb 18
\& rate (- /
//)
\& this command creates a counter for the given - , which will be increased any time a request
\& containing it arrives. if it exceeds
within seconds it will return to postfix.
@@ -683,8 +751,17 @@
\& please note that is currently limited to postfix actions (no postfwd actions)!
\& # no more than 3 requests per 5 minutes
\& # from the same "unknown" client
-\& id=RATE01 ; client_name==unknown ; \e
-\& action==rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
+\& id=RATE01 ; client_name==unknown
+\& action=rate(client_address/3/300/450 4.7.1 sorry, max 3 requests per 5 minutes)
+\& Please note also that the order of rate limits in your ruleset is important, which means
+\& that this:
+\& # works as expected
+\& id=R001; action=rcpt(sender/500/3600/REJECT limit of 500 recipients per hour for sender $$sender exceeded)
+\& id=R002; action=rcpt(sender/200/3600/WARN state YELLOW for sender $$sender)
+\& leads to different results than this:
+\& # rule R002 never gets executed
+\& id=R001; action=rcpt(sender/200/3600/WARN state YELLOW for sender $$sender)
+\& id=R002; action=rcpt(sender/500/3600/REJECT limit of 500 recipients per hour for sender $$sender exceeded)
.Ve
.PP
.Vb 7
@@ -693,8 +770,8 @@
\& increased by the request's size attribute. to do this reliably you should call postfwd from
\& smtpd_end_of_data_restrictions. if you want to be sure, you could check it within the ruleset:
\& # size limit 1.5mb per hour per client
-\& id=SIZE01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \e
-\& action==size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
+\& id=SIZE01 ; protocol_state==END-OF-MESSAGE ; client_address!=10.1.1.1
+\& action=size(client_address/1572864/3600/450 4.7.1 sorry, max 1.5mb per hour)
.Ve
.PP
.Vb 8
@@ -704,8 +781,8 @@
\& from smtpd_data_restrictions or smtpd_end_of_data_restrictions. if you want to be sure, you could
\& check it within the ruleset:
\& # recipient count limit 3 per hour per client
-\& id=RCPT01 ; state==END_OF_DATA ; client_address==!!(10.1.1.1); \e
-\& action==rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
+\& id=RCPT01 ; protocol_state==END-OF-MESSAGE ; client_address!=10.1.1.1
+\& action=rcpt(client_address/3/3600/450 4.7.1 sorry, max 3 recipients per hour)
.Ve
.PP
.Vb 9
@@ -715,11 +792,18 @@
\& specified to tell postfwd to ignore certain answers and go on parsing the ruleset:
\& # example1: query postgrey and return it's answer to postfix
\& id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031)
-\& # example2: query postgrey but ignore it's answer, if it matches 'DUNNO'
+\& # example2: query postgrey but ignore the answer, if it matches 'DUNNO'
\& # and continue parsing postfwd's ruleset
\& id=GREY; client_address==10.1.1.1; action=ask(127.0.0.1:10031:^dunno$)
.Ve
.PP
+.Vb 4
+\& mail(server/helo/from/to/subject/body)
+\& Very basic mail command, that sends a message with the given arguments. LIMITATIONS:
+\& This basically performs a telnet. No authentication or TLS are available. Additionally it does
+\& not track notification state and will notify you any time, the corresponding rule hits.
+.Ve
+.PP
.Vb 3
\& wait ()
\& pauses the program execution for seconds. use this for
@@ -729,7 +813,7 @@
.Vb 3
\& note ()
\& just logs the given string and continues parsing the ruleset.
-\& if the string is empty, nothing will be logged.
+\& if the string is empty, nothing will be logged (noop).
.Ve
.PP
.Vb 3
@@ -743,40 +827,6 @@
.Vb 1
\& id=R-HELO ; helo_name=^[^\e.]+$ ; action=REJECT invalid helo '$$helo_name'
.Ve
-.PP
-These special attributes will be reset for any new rule:
-.PP
-.Vb 5
-\& rblcount - contains the number of RBL answers
-\& rhsblcount - contains the number of RHSBL answers
-\& matches - contains the number of matched items
-\& dnsbltext - contains the dns TXT part of all RBL and RHSBL replies in the form
-\& rbltype:rblname:; rbltype:rblname:; ...
-.Ve
-.PP
-These special attributes will be changed for any matching rule:
-.PP
-.Vb 1
-\& request_hits - contains ids of all matching rules
-.Ve
-.PP
-This means that it might be necessary to save them, if you plan to use these values in later rules:
-.PP
-.Vb 6
-\& # set vals
-\& id=RBL01 ; rhsblcount=all ; rblcount=all ; \e
-\& rbl=list.dsbl.org, bl.spamcop.net, dnsbl.sorbs.net, zen.spamhaus.org ; \e
-\& rhsbl_client=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \e
-\& rhsbl_sender=rddn.dnsbl.net.au, rhsbl.ahbl.org, rhsbl.sorbs.net ; \e
-\& action=set(HIT_rhls=$$rhsblcount,HIT_rbls=$$rblcount,HIT_txt=$$dnsbltext)
-.Ve
-.PP
-.Vb 4
-\& # compare
-\& id=RBL02 ; HIT_rhls>=1 ; HIT_rbls>=1 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs and $$HIT_rbls RBLs [INFO: $$HIT_txt]
-\& id=RBL03 ; HIT_rhls>=2 ; action=554 5.7.1 blocked using $$HIT_rhls RHSBLs [INFO: $$HIT_txt]
-\& id=RBL04 ; HIT_rbls>=2 ; action=554 5.7.1 blocked using $$HIT_rbls RBLs [INFO: $$HIT_txt]
-.Ve
.Sh "\s-1MACROS/ACLS\s0"
.IX Subsection "MACROS/ACLS"
Multiple use of long items or combinations of them may be abbreviated by macros. Those must be prefixed by '&&' (two '&' characters).
@@ -808,18 +858,18 @@
Macros can contain macros, too:
.PP
.Vb 16
-\& # definition (note the trailing "\e" characters)
-\& &&RBLS { \e
-\& rbl=zen.spamhaus.org ; \e
-\& rbl=list.dsbl.org ; \e
-\& rbl=bl.spamcop.net ; \e
-\& rbl=dnsbl.sorbs.net ; \e
-\& rbl=ix.dnsbl.manitu.net ; \e
+\& # definition
+\& &&RBLS{
+\& rbl=zen.spamhaus.org
+\& rbl=list.dsbl.org
+\& rbl=bl.spamcop.net
+\& rbl=dnsbl.sorbs.net
+\& rbl=ix.dnsbl.manitu.net
\& };
-\& &&DYNAMIC { \e
-\& client_name=^unknown$ ; \e
-\& client_name=(\ed+[\e.-_]){4} ; \e
-\& client_name=[\e.-_](adsl|dynamic|ppp|)[\e.-_] ; \e
+\& &&DYNAMIC{
+\& client_name=^unknown$
+\& client_name=(\ed+[\e.-_]){4}
+\& client_name=[\e.-_](adsl|dynamic|ppp|)[\e.-_]
\& };
\& &&GOAWAY { &&RBLS; &&DYNAMIC; };
\& # rules
@@ -829,7 +879,194 @@
Basically macros are simple text substitutions \- see the \*(L"\s-1PARSER\s0\*(R" section for more information.
.Sh "\s-1PLUGINS\s0"
.IX Subsection "PLUGINS"
-Please visit
+\&\fBDescription\fR
+.PP
+The plugin interface allow you to define your own checks and enhance postfwd's
+functionality. Feel free to share useful things!
+.PP
+\&\fBWarning\fR
+.PP
+Note that the plugin interface is still at devel stage. Please test your plugins
+carefully, because errors may cause postfwd to break! It is also
+allowed to override attributes or built-in functions, but be sure that you know
+what you do because some of them are used internally.
+.PP
+Please keep security in mind, when you access sensible ressources and never, ever
+run postfwd as privileged user! Also never trust your input (especially hostnames,
+and e\-mail addresses).
+.PP
+\&\fB\s-1ITEMS\s0\fR
+.PP
+Item plugins are perl subroutines which integrate additional attributes to requests
+before they are evaluated against postfwd's ruleset like any other item of the
+policy delegation protocol. This allows you to create your own checks.
+.PP
+plugin-items can not be used selective. these functions will be executed for every
+request postfwd receives, so keep performance in mind.
+.PP
+.Vb 1
+\& SYNOPSIS: %result = postfwd_items_plugin{}(%request)
+.Ve
+.PP
+means that your subroutine, called , has access to a hash called \f(CW%request\fR,
+which contains all request attributes, like \f(CW$request\fR{client_name} and must
+return a value in the following form:
+.PP
+.Vb 1
+\& save: $result{- } =
+.Ve
+.PP
+this creates the new item - containing
, which will be integrated in
+the policy delegation request and therefore may be used in postfwd's ruleset.
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& %postfwd_items_plugin = (
+.Ve
+.PP
+.Vb 1
+\& # EXAMPLES - integrated in postfwd. no need to activate them here.
+.Ve
+.PP
+.Vb 8
+\& # allows to check postfwd version in ruleset
+\& "version" => sub {
+\& my(%request) = @_;
+\& my(%result) = (
+\& "version" => $NAME." ".$VERSION,
+\& );
+\& return %result;
+\& },
+.Ve
+.PP
+.Vb 10
+\& # sender_domain and recipient_domain
+\& "address_parts" => sub {
+\& my(%request) = @_;
+\& my(%result) = ();
+\& $request{sender} =~ /@([^@]*)$/;
+\& $result{sender_domain} = ($1 || '');
+\& $request{recipient} =~ /@([^@]*)$/;
+\& $result{recipient_domain} = ($1 || '');
+\& return %result;
+\& },
+.Ve
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& );
+.Ve
+.PP
+\&\fB\s-1COMPARE\s0\fR
+.PP
+Compare plugins allow you to define how your new items should be compared to the ruleset.
+These are optional. If you don't specify one, the default (== for exact match, =~ for \s-1PCRE\s0, ...)
+will be used.
+.PP
+.Vb 1
+\& SYNOPSIS: - => sub { return &{$postfwd_compare{
}}(@_); },
+.Ve
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& %postfwd_compare_plugin = (
+.Ve
+.PP
+.Vb 1
+\& EXAMPLES - integrated in postfwd. no need to activate them here.
+.Ve
+.PP
+.Vb 5
+\& # Simple example
+\& # SYNOPSIS: = - (return &{$postfwd_compare{
}}(@_))
+\& "client_address" => sub { return &{$postfwd_compare{cidr}}(@_); },
+\& "size" => sub { return &{$postfwd_compare{numeric}}(@_); },
+\& "recipient_count" => sub { return &{$postfwd_compare{numeric}}(@_); },
+.Ve
+.PP
+.Vb 22
+\& # Complex example
+\& # SYNOPSIS: = - (
, , , )
+\& "numeric" => sub {
+\& my($cmp,$val,$myitem,%request) = @_;
+\& my($myresult) = undef; $myitem ||= "0"; $val ||= "0";
+\& if ($cmp eq '==') {
+\& $myresult = ($myitem == $val);
+\& } elsif ($cmp eq '=<') {
+\& $myresult = ($myitem <= $val);
+\& } elsif ($cmp eq '=>') {
+\& $myresult = ($myitem >= $val);
+\& } elsif ($cmp eq '!=') {
+\& $myresult = not($myitem == $val);
+\& } elsif ($cmp eq '!<') {
+\& $myresult = not($myitem <= $val);
+\& } elsif ($cmp eq '!>') {
+\& $myresult = not($myitem >= $val);
+\& } else {
+\& $myresult = ($myitem >= $val);
+\& };
+\& return $myresult;
+\& },
+.Ve
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& );
+.Ve
+.PP
+\&\fB\s-1ACTIONS\s0\fR
+.PP
+Action plugins allow to define new postfwd actions. By setting the \f(CW$stop\fR\-flag you can decide to
+continue or to stop parsing the ruleset.
+.PP
+.Vb 2
+\& SYNOPSIS: (, , , , ) =
+\& (, , , , , )
+.Ve
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& %postfwd_actions_plugin = (
+.Ve
+.PP
+.Vb 1
+\& # EXAMPLES - integrated in postfwd. no need to activate them here.
+.Ve
+.PP
+.Vb 7
+\& # note() command
+\& "note" => sub {
+\& my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+\& my($myaction) = $default_action; my($stop) = 0;
+\& mylogs 'info', "[RULES] ".$myline." - note: ".$myarg if $myarg;
+\& return ($stop,$index,$myaction,$myline,%request);
+\& },
+.Ve
+.PP
+.Vb 7
+\& # skips next rules
+\& "skip" => sub {
+\& my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+\& my($myaction) = $default_action; my($stop) = 0;
+\& $index += $myarg if ( $myarg and not(($index + $myarg) > $#Rules) );
+\& return ($stop,$index,$myaction,$myline,%request);
+\& },
+.Ve
+.PP
+.Vb 7
+\& # dumps current request contents to syslog
+\& "dumprequest" => sub {
+\& my($index,$now,$mycmd,$myarg,$myline,%request) = @_;
+\& my($myaction) = $default_action; my($stop) = 0;
+\& map { mylogs 'info', "[DUMP] rule=$index, Attribute: $_=$request{$_}" } (keys %request);
+\& return ($stop,$index,$myaction,$myline,%request);
+\& },
+.Ve
+.PP
+.Vb 2
+\& # do NOT remove the next line
+\& );
+.Ve
.Sh "\s-1COMMAND\s0 \s-1LINE\s0"
.IX Subsection "COMMAND LINE"
\&\fIRuleset\fR
@@ -849,14 +1086,6 @@
\& strings that contain whitespaces or shell characters.
.Ve
.PP
-\&\fIPlugins\fR
-.PP
-.Vb 3
-\& --plugins
-\& A file containing plugin routines for postfwd. Please see the
-\& PLUGINS section for more information.
-.Ve
-.PP
\&\fIScoring\fR
.PP
.Vb 2
@@ -867,7 +1096,7 @@
Multiple usage is allowed. Just chain your arguments, like:
.PP
.Vb 3
-\& postfwd -r "- =
;action=" -f -f --plugins ...
+\& postfwd -r "- =
;action=" -f -f ...
\& or
\& postfwd --scores 4.5="WARN high score" --scores 5.0="REJECT postfwd score too high" ...
.Ve
@@ -875,10 +1104,7 @@
In case of multiple scores, the highest match will count. The order of the arguments will be
reflected in the postfwd ruleset.
.PP
-\&\fINetworking\fR
-.PP
-postfwd can be run as daemon so that it listens on the network for incoming requests.
-The following arguments will control it's behaviour in this case.
+\&\fIControl\fR
.PP
.Vb 3
\& -d, --daemon
@@ -887,6 +1113,49 @@
.Ve
.PP
.Vb 2
+\& -k, --kill
+\& Stops a running postfwd daemon.
+.Ve
+.PP
+.Vb 2
+\& --reload
+\& Reloads configuration.
+.Ve
+.PP
+.Vb 2
+\& --dumpstats
+\& Displays program usage statistics.
+.Ve
+.PP
+.Vb 2
+\& --dumpcache
+\& Displays cache contents.
+.Ve
+.PP
+.Vb 10
+\& --delcache -
+\& Removes an item from the request cache. Use --dumpcache to identify objects.
+\& E.g.:
+\& # postfwd --dumpcache
+\& ...
+\& %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @count -> '1'
+\& %rate_cache -> %sender=gmato@jqvo.org -> %RATE002+2_600 -> @maxcount -> '2'
+\& ...
+\& # postfwd --delrate="sender=gmato@jqvo.org"
+\& rate cache item 'sender=gmato@jqvo.org' removed
+.Ve
+.PP
+.Vb 2
+\& --delrate
-
+\& Removes an item from the rate cache. Use --dumpcache to identify objects.
+.Ve
+.PP
+\&\fINetworking\fR
+.PP
+postfwd can be run as daemon so that it listens on the network for incoming requests.
+The following arguments will control it's behaviour in this case.
+.PP
+.Vb 2
\& -i, --interface
\& Bind postfwd to the specified interface (default 127.0.0.1).
.Ve
@@ -931,6 +1200,17 @@
\& The process id will be saved in the specified file.
.Ve
.PP
+.Vb 2
+\& --facility
+\& sets the syslog facility, default is 'mail'
+.Ve
+.PP
+.Vb 3
+\& --socktype
+\& sets the Sys::Syslog socktype to 'native', 'inet' or 'unix'.
+\& Default is to auto-detect this depening on module version and os.
+.Ve
+.PP
.Vb 3
\& -l, --logname
\& Labels the syslog messages. Useful when running multiple
@@ -942,6 +1222,14 @@
\& Truncates any syslog message after characters.
.Ve
.PP
+\&\fIPlugins\fR
+.PP
+.Vb 3
+\& --plugins
+\& Loads postfwd plugins from file. Please see http://postfwd.org/postfwd.plugins
+\& or the plugins.postfwd.sample that is available from the tarball for more info.
+.Ve
+.PP
\&\fIOptional arguments\fR
.PP
These parameters influence the way postfwd is working. Any of them can be combined.
@@ -1121,6 +1409,28 @@
\& be skipped. this is used to prevent problems due to large files or loops.
.Ve
.PP
+.Vb 4
+\& --keep_rates (default=0)
+\& With this option set postfwd does not clear the rate limit counters on reload. Please
+\& note that you have to restart (not reload) postfwd with this option if you change
+\& any rate limit rules.
+.Ve
+.PP
+.Vb 4
+\& --save_rates (default=none)
+\& With this option postfwd saves existing rate limit counters to disk and reloads them
+\& on program start. This allows persistent rate limits across program restarts or reboots.
+\& Please note that postfwd needs read and write access to the specified file.
+.Ve
+.PP
+.Vb 5
+\& --fast_limit_evaluation (default=0)
+\& Once a ratelimit was set by the ruleset, future requests will be evaluated against it
+\& before consulting the ruleset. This mode was the default behaviour until v1.30.
+\& With this mode rate limits will be faster, but also eventually set up
+\& whitelisting-rules within the ruleset might not work as expected.
+.Ve
+.PP
\&\fIInformational arguments\fR
.PP
These arguments are for command line usage only. Never ever use them with postfix spawn!
@@ -1193,20 +1503,27 @@
\& # 1. 30MB for systems in *.customer1.tld
\& # 2. 20MB for SASL user joejob
\& # 3. 10MB default
-\& id=SZ001; state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\e.customer1.tld$
-\& id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
-\& id=SZ002; state==END-OF-MESSAGE; action=DUNNO; size<=10000000
-\& id=SZ100; state==END-OF-MESSAGE; action=REJECT message too large
+\& id=SZ001; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=30000000 ; client_name=\e.customer1.tld$
+\& id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=20000000 ; sasl_username==joejob
+\& id=SZ002; protocol_state==END-OF-MESSAGE; action=DUNNO; size<=10000000
+\& id=SZ100; protocol_state==END-OF-MESSAGE; action=REJECT message too large
.Ve
.PP
-.Vb 7
+.Vb 14
\& ## Selective Greylisting
+\& ##
+\& ## Note that postfwd does not include greylisting. This setup requires a running postgrey service
+\& ## at port 10031 and the following postfix restriction class in your main.cf:
+\& ##
+\& ## smtpd_restriction_classes = check_postgrey, ...
+\& ## check_postgrey = check_policy_service inet:127.0.0.1:10031
+\& #
\& # 1. if listed on zen.spamhaus.org with results 127.0.0.10 or .11, dns cache timeout 1200s
\& # 2. Client has no rDNS
\& # 3. Client comes from several dialin domains
-\& id=GR001; action=greylisting ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
-\& id=GR002; action=greylisting ; client_name=^unknown$
-\& id=GR003; action=greylisting ; client_name=\e.(t-ipconnect|alicedsl|ish)\e.de$
+\& id=GR001; action=check_postgrey ; rbl=dul.dnsbl.sorbs.net, zen.spamhaus.org/127.0.0.1[01]/1200
+\& id=GR002; action=check_postgrey ; client_name=^unknown$
+\& id=GR003; action=check_postgrey ; client_name=\e.(t-ipconnect|alicedsl|ish)\e.de$
.Ve
.PP
.Vb 7
@@ -1216,7 +1533,7 @@
\& time=-07:00:00 ; sasl_username=jim ; action=450 4.7.1 to early for you, jim
\& time=22:00:00- ; sasl_username=jim ; action=450 4.7.1 to late now, jim
\& months=-Apr ; action=450 4.7.1 see you in may
-\& days=!!Mon-Fri ; action=greylist
+\& days=!!Mon-Fri ; action=check_postgrey
.Ve
.PP
.Vb 10
@@ -1228,8 +1545,8 @@
\& id=R003 ; action=jump(R100) ; ccert_fingerprint=AA:BB:CC:DD:...
\& id=R004 ; action=jump(R100) ; ccert_fingerprint=AF:BE:CD:DC:...
\& id=R005 ; action=jump(R100) ; ccert_fingerprint=DD:CC:BB:DD:...
-\& id=R099 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
-\& id=R100 ; state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
+\& id=R099 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 10MB); size=10000000
+\& id=R100 ; protocol_state==END-OF-MESSAGE; action=REJECT message too big (max. 30MB); size=30000000
.Ve
.PP
.Vb 14
@@ -1239,7 +1556,7 @@
\& # - is listed in 1 RBL or 1 RHSBL and has no correct rDNS
\& # - other clients without correct rDNS will be greylist-checked
\& # - some whitelists are used to lower the score
-\& id=S01 ; score=2.6 ; action=greylisting
+\& id=S01 ; score=2.6 ; action=check_postgrey
\& id=S02 ; score=5.0 ; action=REJECT postfwd score too high
\& id=R00 ; action=score(-1.0) ; rbl=exemptions.ahbl.org,list.dnswl.org,query.bondedsender.org,spf.trusted-forwarder.org
\& id=R01 ; action=score(2.5) ; rbl=bl.spamcop.net, list.dsbl.org, dnsbl.sorbs.net
@@ -1254,10 +1571,10 @@
\& # The following temporary rejects requests from "unknown" clients, if they
\& # 1. exceeded 30 requests per hour or
\& # 2. tried to send more than 1.5mb within 10 minutes
-\& id=RATE01 ; client_name==unknown ; state==RCPT ; \e
-\& action==rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
-\& id=SIZE01 ; client_name==unknown ; state==END_OF_DATA ; \e
-\& action==size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
+\& id=RATE01 ; client_name==unknown ; protocol_state==RCPT
+\& action=rate(client_address/30/3600/450 4.7.1 sorry, max 30 requests per hour)
+\& id=SIZE01 ; client_name==unknown ; protocol_state==END-OF-MESSAGE
+\& action=size(client_address/1572864/600/450 4.7.1 sorry, max 1.5mb per 10 minutes)
.Ve
.PP
.Vb 8
@@ -1274,34 +1591,34 @@
.Vb 34
\& ## Groups
\& # definition
-\& &&RBLS { \e
-\& rbl=zen.spamhaus.org ; \e
-\& rbl=list.dsbl.org ; \e
-\& rbl=bl.spamcop.net ; \e
-\& rbl=dnsbl.sorbs.net ; \e
-\& rbl=ix.dnsbl.manitu.net ; \e
+\& &&RBLS{
+\& rbl=zen.spamhaus.org
+\& rbl=list.dsbl.org
+\& rbl=bl.spamcop.net
+\& rbl=dnsbl.sorbs.net
+\& rbl=ix.dnsbl.manitu.net
\& };
-\& &&RHSBLS { \e
+\& &&RHSBLS{
\& ...
\& };
-\& &&DYNAMIC { \e
-\& client_name==unknown ; \e
-\& client_name~=(\ed+[\e.-_]){4} ; \e
-\& client_name~=[\e.-_](adsl|dynamic|ppp|)[\e.-_] ; \e
+\& &&DYNAMIC{
+\& client_name==unknown
+\& client_name~=(\ed+[\e.-_]){4}
+\& client_name~=[\e.-_](adsl|dynamic|ppp|)[\e.-_]
\& ...
\& };
-\& &&BAD_HELO { \e
-\& helo_name==my.name.tld; \e
-\& helo_name~=^([^\e.]+)$; \e
-\& helo_name~=\e.(local|lan)$; \e
+\& &&BAD_HELO{
+\& helo_name==my.name.tld
+\& helo_name~=^([^\e.]+)$
+\& helo_name~=\e.(local|lan)$
\& ...
\& };
-\& &&MAINTENANCE { \e
-\& date=15.01.2007 ; \e
-\& date=15.04.2007 ; \e
-\& date=15.07.2007 ; \e
-\& date=15.10.2007 ; \e
-\& time=03:00:00 - 04:00:00 ; \e
+\& &&MAINTENANCE{
+\& date=15.01.2007
+\& date=15.04.2007
+\& date=15.07.2007
+\& date=15.10.2007
+\& time=03:00:00 - 04:00:00
\& };
\& # rules
\& id=COMBINED ; &&RBLS ; &&DYNAMIC ; action=REJECT dynamic client and listed on RBL
@@ -1322,7 +1639,7 @@
.Vb 5
\& ## combined with enhanced rbl features
\& #
-\& id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS ; \e
+\& id=RBL01 ; rhsblcount=all ; rblcount=all ; &&RBLS ; &&RHSBLS
\& action=set(HIT_dnsbls=$$rhsblcount,HIT_dnsbls+=$$rblcount,HIT_dnstxt=$$dnsbltext)
\& id=RBL02 ; HIT_dnsbls>=2 ; action=554 5.7.1 blocked using $$HIT_dnsbls DNSBLs [INFO: $$HIT_dnstxt]
.Ve
diff -Nru postfwd-1.20/plugins/postfwd.plugins.sample postfwd-1.32/plugins/postfwd.plugins.sample
--- postfwd-1.20/plugins/postfwd.plugins.sample 1970-01-01 00:00:00.000000000 +0000
+++ postfwd-1.32/plugins/postfwd.plugins.sample 2011-08-20 23:33:55.000000000 +0000
@@ -0,0 +1,167 @@
+#
+#
+# Example plugin file for postfwd - see http://postfwd.org
+#
+#
+# Description:
+#
+# The plugin interface allow you to define your own checks and enhance postfwd's
+# functionality. Feel free to share useful things!
+#
+#
+# Warning:
+#
+# Check changes carefully, because errors may cause postfwd to break! It is also
+# allowed to override attributes or built-in functions, but be sure that you know
+# what you do because some of them are used internally.
+# Please keep security in mind, when you access sensible ressources and never, ever
+# run postfwd as privileged user! Also never trust your input (especially hostnames,
+# and e-mail addresses).
+
+
+#
+# ITEMS
+# =====
+#
+# Item plugins are perl subroutines which integrate additional attributes to requests
+# before they are evaluated against postfwd's ruleset like any other item of the
+# policy delegation protocol. This allows you to create your own checks.
+#
+# plugin-items can not be used selective. these functions will be executed for every
+# request postfwd receives, so keep performance in mind.
+#
+# SYNOPSIS: %result = postfwd_items_plugin{}(%request)
+#
+# means that your subroutine, called , has access to a hash called %request,
+# which contains all request attributes, like $request{client_name} and must
+# return a value in the following form:
+#
+# save: $result{- } =
+#
+# this creates the new item