Download | Plain Text | Line Numbers
diff -Naur qmail-1.03.orig/Makefile qmail-1.03/Makefile
--- qmail-1.03.orig/Makefile Sun Dec 24 15:24:55 2006
+++ qmail-1.03/Makefile Mon Dec 25 23:42:18 2006
@@ -1,5 +1,9 @@
# Don't edit Makefile! Use conf-* for configuration.
+VPOPMAIL_HOME=/usr/local/vpopmail
+SMTPD_CHKUSER_OBJ=chkuser.o
+VPOPMAIL_LIBS=`head -1 $(VPOPMAIL_HOME)/etc/lib_deps`
+
SHELL=/bin/sh
default: it
@@ -312,6 +316,10 @@
exit.h auto_spawn.h
./compile chkspawn.c
+chkuser.o: \
+compile chkuser.c chkuser.h chkuser_settings.h
+ ./compile chkuser.c
+
clean: \
TARGETS
rm -f `cat TARGETS`
@@ -1598,21 +1606,21 @@
timeoutwrite.o ip.o ipme.o ipalloc.o strsalloc.o control.o constmap.o \
received.o date822fmt.o now.o qmail.o spf.o dns.o cdb.a fd.a wait.a \
datetime.a getln.a open.a sig.a case.a env.a stralloc.a alloc.a substdio.a \
-error.a str.a fs.a auto_qmail.o base64.o qmail-spp.o socket.lib dns.lib
- ./load qmail-smtpd rcpthosts.o commands.o timeoutread.o \
+error.a str.a fs.a auto_qmail.o base64.o qmail-spp.o socket.lib dns.lib $(SMTPD_CHKUSER_OBJ)
+ ./load qmail-smtpd $(SMTPD_CHKUSER_OBJ) rcpthosts.o commands.o timeoutread.o \
timeoutwrite.o ip.o ipme.o ipalloc.o strsalloc.o control.o \
tls.o ssl_timeoutio.o ndelay.a -L/usr/lib -lssl -lcrypto \
constmap.o received.o date822fmt.o now.o qmail.o spf.o dns.o cdb.a \
fd.a wait.a datetime.a getln.a open.a sig.a case.a qmail-spp.o env.a stralloc.a \
alloc.a substdio.a error.a fs.a auto_qmail.o base64.o \
- str.a `cat socket.lib` `cat dns.lib`
+ str.a `cat socket.lib` $(VPOPMAIL_LIBS) `cat dns.lib`
qmail-smtpd.0: \
qmail-smtpd.8
nroff -man qmail-smtpd.8 > qmail-smtpd.0
qmail-smtpd.o: \
-compile qmail-smtpd.c sig.h readwrite.h stralloc.h gen_alloc.h \
+compile qmail-smtpd.c chkuser.h sig.h readwrite.h stralloc.h gen_alloc.h \
substdio.h alloc.h auto_qmail.h control.h received.h constmap.h \
error.h ipme.h ip.h ipalloc.h strsalloc.h ip.h gen_alloc.h ip.h qmail.h qmail-spp.h \
substdio.h str.h fmt.h scan.h byte.h case.h env.h now.h datetime.h \
diff -Naur qmail-1.03.orig/TARGETS qmail-1.03/TARGETS
--- qmail-1.03.orig/TARGETS Sun Dec 24 15:24:55 2006
+++ qmail-1.03/TARGETS Mon Dec 25 23:42:42 2006
@@ -407,3 +407,4 @@
man
setup
check
+chkuser.o
diff -Naur qmail-1.03.orig/chkuser.c qmail-1.03/chkuser.c
--- qmail-1.03.orig/chkuser.c Thu Jan 1 01:00:00 1970
+++ qmail-1.03/chkuser.c Mon Dec 25 23:42:27 2006
@@ -0,0 +1,1156 @@
+
+/*
+ *
+ * 'chkuser.c' v.2.0.8
+ * for qmail/netqmail > 1.0.3 and vpopmail > 5.3.x
+ *
+ * Author: Antonio Nati tonix@interazioni.it
+ * All rights on this software and
+ * the identifying words chkusr and chkuser kept by the author
+ *
+ * This software may be freely used, modified and distributed,
+ * but this lines must be kept in every original or derived version.
+ * Original author "Antonio Nati" and the web URL
+ * "http://www.interazioni.it/opensource"
+ * must be indicated in every related work or web page
+ *
+ */
+
+#include <pwd.h>
+
+/* required by vpopmail */
+#include <stdio.h>
+
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "dns.h"
+#include "env.h"
+#include "ipme.h"
+#include "now.h"
+#include "open.h"
+#include "subfd.h"
+#include "substdio.h"
+#include "stralloc.h"
+
+#include "vpopmail.h"
+#include "vauth.h"
+#include "vpopmail_config.h"
+
+#include "chkuser.h"
+#include "chkuser_settings.h"
+
+#if defined _exit
+#undef _exit
+#endif
+
+extern void flush();
+extern void out (char *s);
+
+extern char *remotehost;
+extern char *remoteip;
+extern char *remoteinfo;
+extern char *relayclient;
+extern char *fakehelo;
+
+extern void die_nomem();
+
+#define DIE_NOMEM() die_nomem()
+
+#if defined CHKUSER_DEBUG
+
+#if defined CHKUSER_DEBUG_STDERR
+
+#define CHKUSER_DBG(a) write (STDERR_FILENO, a, strlen (a))
+#define CHKUSER_DBG_INT(a) { int x; char str[30]; sprintf (str, "%d", a); write (STDERR_FILENO, str, strlen (str));}
+
+#else
+
+#define CHKUSER_DBG(a) write (STDOUT_FILENO, a, strlen (a))
+#define CHKUSER_DBG_INT(a) { int x; char str[30]; sprintf (str, "%d", a); write (STDOUT_FILENO, str, strlen (str));}
+
+#endif
+#else
+
+#define CHKUSER_DBG(a) /* DBG dummy */
+#define CHKUSER_DBG_INT(a) /* DBG dummy */
+
+#endif
+
+static int INTRUSION_threshold_reached = 0;
+static int first_time_init_flag = 1;
+
+static int recipients = 0;
+static int wrong_recipients = 0;
+
+static stralloc user = {0};
+static stralloc domain = {0};
+static stralloc domain_path = {0};
+static stralloc tmp_path = {0};
+static stralloc alias_path = {0};
+
+#if defined CHKUSER_IDENTIFY_REMOTE_VARIABLE
+ static char *identify_remote;
+#endif
+
+#if defined CHKUSER_ENABLE_EXTENSIONS
+#define CHKUSER_ENABLE_USERS_EXTENSIONS
+#endif
+
+#if defined CHKUSER_ENABLE_LISTS
+#define CHKUSER_ENABLE_EZMLM_LISTS
+#endif
+
+#if defined CHKUSER_EXTENSION_DASH
+#define CHKUSER_USERS_DASH CHKUSER_EXTENSION_DASH
+#endif
+
+
+#if defined CHKUSER_ENABLE_VAUTH_OPEN
+ static int db_already_open = 0;
+#endif
+
+#if !defined CHKUSER_ALWAYS_ON && defined CHKUSER_STARTING_VARIABLE
+ static char *starting_string = 0;
+ static int starting_value = -1;
+#endif
+
+#if defined CHKUSER_RCPT_LIMIT_VARIABLE
+ static char *maxrcpt_string = 0;
+ static int maxrcpt_limit = 0;
+ static int maxrcpt_limit_reached = 0;
+#endif
+
+#if defined CHKUSER_WRONGRCPT_LIMIT_VARIABLE
+ static char *maxwrongrcpt_string = 0;
+ static int maxwrongrcpt_limit = 0;
+ static int maxwrongrcpt_limit_reached = 0;
+#endif
+
+#if defined CHKUSER_MBXQUOTA_VARIABLE
+ static char *maxmbxquota_string = 0;
+ static int maxmbxquota_limit = 0;
+#endif
+
+#if defined CHKUSER_SENDER_NOCHECK_VARIABLE
+
+ static unsigned int sender_nocheck = 0;
+
+#endif
+
+#if defined CHKUSER_SENDER_FORMAT || defined CHKUSER_SENDER_MX
+static stralloc sender_user = {0};
+static stralloc sender_domain = {0};
+#endif
+
+
+#if defined CHKUSER_ERROR_DELAY
+
+ static int chkuser_delay_interval = CHKUSER_ERROR_DELAY * 1000;
+
+#define CHKUSER_DELAY() chkuser_delay()
+
+void chkuser_delay (void) {
+
+ usleep (chkuser_delay_interval);
+
+#if defined CHKUSER_ERROR_DELAY_INCREASE
+ chkuser_delay_interval += CHKUSER_ERROR_DELAY_INCREASE * 1000;
+#endif
+}
+
+#if defined CHKUSER_RCPT_DELAY_ANYERROR
+#define CHKUSER_RCPT_DELAY_ANY() chkuser_delay()
+#else
+#define CHKUSER_RCPT_DELAY_ANY() /* no delay for any error */
+#endif
+
+#if defined CHKUSER_SENDER_DELAY_ANYERROR
+#define CHKUSER_SENDER_DELAY_ANY() chkuser_delay()
+#else
+#define CHKUSER_SENDER_DELAY_ANY() /* no delay for any error */
+#endif
+
+
+#else
+#define CHKUSER_DELAY() /* no delay */
+#define CHKUSER_RCPT_DELAY_ANY() /* no delay */
+#define CHKUSER_SENDER_DELAY_ANY() /* no delay */
+#endif
+
+#if defined CHKUSER_ENABLE_LOGGING
+
+static stralloc logstr = { 0 };
+
+static void chkuser_commonlog (char *sender, char *rcpt, char *title, char *description) {
+
+ substdio_puts (subfderr, "CHKUSER ");
+ substdio_puts (subfderr, title);
+ substdio_puts (subfderr, ": from <");
+ substdio_puts (subfderr, sender);
+ substdio_puts (subfderr, ":" );
+ if (remoteinfo) {
+ substdio_puts (subfderr, remoteinfo);
+ }
+ substdio_puts (subfderr, ":" );
+#if defined CHKUSER_IDENTIFY_REMOTE_VARIABLE
+ if (identify_remote) substdio_puts (subfderr, identify_remote);
+#endif
+ substdio_puts (subfderr, "> remote <");
+ if (fakehelo) substdio_puts (subfderr, fakehelo);
+ substdio_puts (subfderr, ":" );
+ if (remotehost) substdio_puts (subfderr, remotehost);
+ substdio_puts (subfderr, ":" );
+ if (remoteip) substdio_puts (subfderr, remoteip);
+ substdio_puts (subfderr, "> rcpt <");
+ substdio_puts (subfderr, rcpt);
+ substdio_puts (subfderr, "> : ");
+ substdio_puts (subfderr, description);
+ substdio_puts (subfderr, "\n");
+ substdio_flush (subfderr);
+}
+
+#else
+#define chkuser_commonlog(a,b,c,d) /* no log */
+#endif
+
+#if defined CHKUSER_SENDER_FORMAT
+
+static int check_sender_address_format (stralloc *user, stralloc *domain) {
+
+ int x;
+
+ for (x = 0; x < (user->len -1); ++x) {
+ if ((!isalnum (user->s[x]))
+
+#if defined CHKUSER_ALLOW_SENDER_SRS
+ && (user->s[x] != '#')
+ && (user->s[x] != '+')
+#endif
+#if defined CHKUSER_ALLOW_SENDER_CHAR_1
+ && (user->s[x] != CHKUSER_ALLOW_SENDER_CHAR_1)
+#endif
+#if defined CHKUSER_ALLOW_SENDER_CHAR_2
+ && (user->s[x] != CHKUSER_ALLOW_SENDER_CHAR_2)
+#endif
+#if defined CHKUSER_ALLOW_SENDER_CHAR_3
+ && (user->s[x] != CHKUSER_ALLOW_SENDER_CHAR_3)
+#endif
+#if defined CHKUSER_ALLOW_SENDER_CHAR_4
+ && (user->s[x] != CHKUSER_ALLOW_SENDER_CHAR_4)
+#endif
+#if defined CHKUSER_ALLOW_SENDER_CHAR_5
+ && (user->s[x] != CHKUSER_ALLOW_SENDER_CHAR_5)
+#endif
+ && (user->s[x] != '_') && (user->s[x] != '-') && (user->s[x] != '.') && (user->s[x] != '=')) {
+ return 0;
+ }
+ }
+
+/*
+ * Be careful, this is a base check
+ * Minimum is x.xx + ending \0
+ * Minimum characters needed are 5
+ */
+#if defined CHKUSER_MIN_DOMAIN_LEN
+ if (domain->len < (CHKUSER_MIN_DOMAIN_LEN +1)) {
+ return 0;
+ }
+#endif
+
+/*
+ * This is a safety check
+ */
+#if defined CHKUSER_MIN_DOMAIN_LEN
+ if (domain->len < 2) {
+ return 0;
+ }
+#endif
+
+ for (x = 0; x < (domain->len -1); ++x) {
+ if ((!isalnum (domain->s[x])) && (domain->s[x] != '-') && (domain->s[x] != '.')) {
+ return 0;
+ }
+ }
+
+ if ((domain->s[0] == '-') || (domain->s[domain->len -2] == '-') || (domain->s[0] == '.') || (domain->s[domain->len -2] == '.')) {
+ return 0;
+ }
+ if (strstr (domain->s, "..") != NULL) {
+ return 0;
+ }
+ if (strncmp (domain->s, "xn--", 4) == 0) {
+ if (strstr (&domain->s[4], "--") != NULL)
+ return 0;
+ } else {
+ if (strstr (domain->s, "--") != NULL)
+ return 0;
+ }
+ if (strstr (domain->s, ".-") != NULL) {
+ return 0;
+ }
+ if (strstr (domain->s, "-.") != NULL) {
+ return 0;
+ }
+ if (strchr (domain->s, '.') == NULL) {
+ return 0;
+ }
+
+ return 1;
+}
+
+#endif
+
+#if defined CHKUSER_RCPT_FORMAT
+
+static int check_rcpt_address_format (stralloc *user, stralloc *domain) {
+
+ int x;
+
+ for (x = 0; x < (user->len -1); ++x) {
+ if ((!isalnum (user->s[x]))
+#if defined CHKUSER_ALLOW_RCPT_SRS
+ && (user->s[x] != '#')
+ && (user->s[x] != '+')
+#endif
+#if defined CHKUSER_ALLOW_RCPT_CHAR_1
+ && (user->s[x] != CHKUSER_ALLOW_SENDER_CHAR_1)
+#endif
+#if defined CHKUSER_ALLOW_RCPT_CHAR_2
+ && (user->s[x] != CHKUSER_ALLOW_SENDER_CHAR_2)
+#endif
+#if defined CHKUSER_ALLOW_RCPT_CHAR_3
+ && (user->s[x] != CHKUSER_ALLOW_SENDER_CHAR_3)
+#endif
+#if defined CHKUSER_ALLOW_RCPT_CHAR_4
+ && (user->s[x] != CHKUSER_ALLOW_SENDER_CHAR_4)
+#endif
+#if defined CHKUSER_ALLOW_RCPT_CHAR_5
+ && (user->s[x] != CHKUSER_ALLOW_SENDER_CHAR_5)
+#endif
+
+ && (user->s[x] != '_') && (user->s[x] != '-') && (user->s[x] != '.') && (user->s[x] != '=')) {
+ return 0;
+ }
+ }
+
+/*
+ * Be careful, this is a base check
+ * Minimum is x.xx + ending \0
+ * Minimum characters needed are 5
+ */
+#if defined CHKUSER_MIN_DOMAIN_LEN
+ if (domain->len < (CHKUSER_MIN_DOMAIN_LEN +1)) {
+ return 0;
+ }
+#endif
+
+/*
+ * This is a safety check
+ */
+#if defined CHKUSER_MIN_DOMAIN_LEN
+ if (domain->len < 2) {
+ return 0;
+ }
+#endif
+ for (x = 0; x < (domain->len -1); ++x) {
+ if ((!isalnum (domain->s[x])) && (domain->s[x] != '-') && (domain->s[x] != '.')) {
+ return 0;
+ }
+ }
+
+ if ((domain->s[0] == '-') || (domain->s[domain->len -2] == '-') || (domain->s[0] == '.') || (domain->s[domain->len -2] == '.')) {
+ return 0;
+ }
+ if (strstr (domain->s, "..") != NULL) {
+ return 0;
+ }
+ if (strncmp (domain->s, "xn--", 4) == 0) {
+ if (strstr (&domain->s[4], "--") != NULL)
+ return 0;
+ } else {
+ if (strstr (domain->s, "--") != NULL)
+ return 0;
+ }
+ if (strstr (domain->s, ".-") != NULL) {
+ return 0;
+ }
+ if (strstr (domain->s, "-.") != NULL) {
+ return 0;
+ }
+ if (strchr (domain->s, '.') == NULL) {
+ return 0;
+ }
+
+ return 1;
+}
+
+#endif
+
+#if defined CHKUSER_SENDER_MX || defined CHKUSER_RCPT_MX
+
+static unsigned long mx_random;
+static ipalloc mx_ip = {0};
+
+static int chkuser_mx_lookup (stralloc *domain) {
+
+ int status;
+
+ mx_random = now() + getpid();
+ dns_init(0);
+ status = dns_mxip (&mx_ip, domain, mx_random);
+
+ if (status == DNS_MEM) DIE_NOMEM();
+
+ return status;
+}
+
+#endif
+
+
+void chkuser_cleanup (int exit_value) {
+
+#if defined CHKUSER_DB_CLEANUP
+ vclose ();
+#endif
+ _exit (exit_value);
+}
+
+static void first_time_init (void) {
+
+ char * temp_string;
+
+#if !defined CHKUSER_ALWAYS_ON && defined CHKUSER_STARTING_VARIABLE
+ starting_string = env_get (CHKUSER_STARTING_VARIABLE);
+ if (starting_string) {
+ if (strcasecmp(starting_string, "ALWAYS") == 0) {
+ starting_value = 1;
+ } else if (strcasecmp(starting_string, "DOMAIN") == 0) {
+ starting_value = 0;
+ }
+ } else {
+ starting_string = "";
+ }
+#endif
+
+#if defined CHKUSER_RCPT_LIMIT_VARIABLE
+ maxrcpt_string = env_get (CHKUSER_RCPT_LIMIT_VARIABLE);
+ if (maxrcpt_string) {
+ maxrcpt_limit = atoi (maxrcpt_string);
+ if (maxrcpt_limit < 1) {
+ maxrcpt_limit = 0;
+ }
+ } else {
+ maxrcpt_string = "";;
+ }
+#endif
+
+#if defined CHKUSER_WRONGRCPT_LIMIT_VARIABLE
+ maxwrongrcpt_string = env_get (CHKUSER_WRONGRCPT_LIMIT_VARIABLE);
+ if (maxwrongrcpt_string) {
+ maxwrongrcpt_limit = atoi (maxwrongrcpt_string);
+ if (maxwrongrcpt_limit < 1) {
+ maxwrongrcpt_limit = 0;
+ }
+ } else {
+ maxwrongrcpt_string = "";
+ }
+#endif
+
+#if defined CHKUSER_MBXQUOTA_VARIABLE
+ maxmbxquota_string = env_get (CHKUSER_MBXQUOTA_VARIABLE);
+ if (maxmbxquota_string) {
+ maxmbxquota_limit = atoi (maxmbxquota_string);
+ if (maxmbxquota_limit < 1) {
+ maxmbxquota_limit = 0;
+ }
+ } else {
+ maxmbxquota_string = "";
+ }
+#endif
+
+#if defined CHKUSER_SENDER_NOCHECK_VARIABLE
+
+ temp_string = env_get (CHKUSER_SENDER_NOCHECK_VARIABLE);
+ if (temp_string) {
+ sender_nocheck = 1;
+ } else {
+ sender_nocheck = 0;
+ }
+
+#endif
+
+#if defined CHKUSER_IDENTIFY_REMOTE_VARIABLE
+
+ identify_remote = env_get (CHKUSER_IDENTIFY_REMOTE_VARIABLE);
+ if (identify_remote) {
+ }
+
+#endif
+
+ if (!stralloc_ready (&user, 300)) DIE_NOMEM();
+ if (!stralloc_ready (&domain, 500)) DIE_NOMEM();
+ if (!stralloc_ready (&domain_path, 1000)) DIE_NOMEM();
+ if (!stralloc_ready (&tmp_path, 1000)) DIE_NOMEM();
+ if (!stralloc_ready (&alias_path, 1000)) DIE_NOMEM();
+
+ first_time_init_flag = 0;
+
+}
+
+/*
+ * realrcpt ()
+ *
+ * Returns:
+ *
+ * CHKUSER_OK = 1 = Ok, recipients does exists
+ *
+ * 0 = Not in rcpthosts
+ *
+ * < 0 various errors
+ *
+ *
+ * Parameters:
+ * stralloc *sender = sender address
+ * stralloc *rcpt = rcpt address to check
+ *
+ *
+*/
+
+static int realrcpt (stralloc *sender, stralloc *rcpt)
+{
+ int count;
+ int retstat = CHKUSER_KO;
+ struct vqpasswd *user_passwd = NULL;
+ int fd_file = -1;
+ int read_char;
+ int offset;
+ char read_buf[1024];
+
+#if defined CHKUSER_ENABLE_UIDGID
+ uid_t eff_uid;
+ gid_t eff_gid;
+#endif
+
+#if !defined CHKUSER_ALWAYS_ON && defined CHKUSER_STARTING_VARIABLE
+ if (starting_value == -1) {
+ if (addrallowed()) {
+ return CHKUSER_OK;
+ } else {
+ if (relayclient) {
+ return CHKUSER_RELAYING;
+ }
+
+ return CHKUSER_NORCPTHOSTS;
+ }
+ }
+#endif
+
+ if (INTRUSION_threshold_reached == 1) {
+ return CHKUSER_ERR_INTRUSION_THRESHOLD;
+ }
+
+#if defined CHKUSER_RCPT_LIMIT_VARIABLE
+
+ ++recipients;
+ if ((maxrcpt_limit > 0) && (recipients >= maxrcpt_limit)) {
+ chkuser_commonlog (sender->s, rcpt->s, "intrusion threshold", "max number of allowed rcpt");
+ INTRUSION_threshold_reached = 1;
+ return CHKUSER_ERR_MAXRCPT;
+ }
+#endif
+
+/* Search the '@' character */
+ count = byte_rchr(rcpt->s,rcpt->len,'@');
+
+ if (count < rcpt->len) {
+ if (!stralloc_copyb (&user, rcpt->s, count)) DIE_NOMEM();
+ if (!stralloc_copys (&domain, rcpt->s + count + 1)) DIE_NOMEM();
+ }
+ else {
+ if (!stralloc_copys (&user, rcpt->s)) DIE_NOMEM();
+ domain.len = 0;
+ }
+ if (!stralloc_0 (&user)) DIE_NOMEM();
+ if (!stralloc_0 (&domain)) DIE_NOMEM();
+
+#if defined CHKUSER_ENABLE_UIDGID
+
+/* qmail-smtpd is running now as (effective) qmaild:nofiles */
+/* Save the effective UID & GID (qmaild:nofiles) */
+ eff_uid = geteuid ();
+ eff_gid = getegid ();
+
+/* Now set new effective UID & GID, getting it from real UID & GID (vpopmail:vchkpw) */
+ setegid (getgid());
+ seteuid (getuid());
+
+/* qmail-smtpd is running now as effective vpopmail:vchkpw */
+#endif
+
+
+/*
+ *
+ * Now let's start the test/setting suite
+ *
+ **/
+
+ switch (0) {
+
+ case 0:
+/* These are some preliminary settings */
+ case_lowers (user.s);
+ case_lowers (domain.s);
+
+ case 1:
+
+ if (domain.len == 1) {
+#if defined CHKUSER_DOMAIN_WANTED
+ retstat = CHKUSER_ERR_DOMAIN_MISSING;
+ break;
+#else
+ if (!stralloc_copys (&domain, DEFAULT_DOMAIN)) DIE_NOMEM();
+ if (!stralloc_0 (&domain)) DIE_NOMEM();
+#endif
+ }
+
+ case 2:
+
+#if defined CHKUSER_RCPT_FORMAT
+
+ if (check_rcpt_address_format (&user, &domain) == 0) {
+ retstat = CHKUSER_ERR_RCPT_FORMAT;
+ break;
+ }
+#endif
+
+ case 3:
+
+ if (!addrallowed()) {
+
+#if defined CHKUSER_RCPT_MX
+ switch (chkuser_mx_lookup(&domain)) {
+
+ case DNS_HARD:
+ retstat = CHKUSER_ERR_RCPT_MX;
+ break;
+
+ case DNS_SOFT:
+ retstat = CHKUSER_ERR_RCPT_MX_TMP;
+ break;
+ }
+
+ if (retstat != CHKUSER_KO) {
+ break;
+ }
+#endif
+
+ if (relayclient) {
+ retstat = CHKUSER_RELAYING;
+ break;
+ }
+
+ retstat = CHKUSER_NORCPTHOSTS;
+ break;
+ }
+
+ case 4:
+
+#if defined CHKUSER_ENABLE_VAUTH_OPEN
+ if (db_already_open != 1) {
+ if (vauth_open () == 0) {
+ db_already_open == 1;
+ } else {
+ retstat = CHKUSER_ERR_AUTH_RESOURCE;
+ }
+ };
+#endif
+
+ case 5:
+
+#if defined CHKUSER_ENABLE_VGET_REAL_DOMAIN
+/* Check if domain is a real domain */
+
+ vget_real_domain(domain.s, domain.a);
+
+ domain.len = strlen (domain.s) +1;
+ if (domain.len > (domain.a - 1)) DIE_NOMEM();
+#endif
+
+/* Let's get domain's real path */
+ if (vget_assign(domain.s, domain_path.s, domain_path.a -1, NULL, NULL) == NULL) {
+ retstat = CHKUSER_OK;
+ break;
+ }
+
+ domain_path.len = strlen (domain_path.s);
+
+ case 6:
+
+/* Check if domain has bouncing enabled */
+
+#if !defined CHKUSER_ALWAYS_ON
+
+#if defined CHKUSER_STARTING_VARIABLE
+ if (starting_value == 0) {
+#endif
+
+ if (!stralloc_copy (&tmp_path, &domain_path)) DIE_NOMEM();
+
+#if defined CHKUSER_SPECIFIC_BOUNCING
+ if (!stralloc_cats (&tmp_path, "/")) DIE_NOMEM();
+ if (!stralloc_cats (&tmp_path, CHKUSER_SPECIFIC_BOUNCING)) DIE_NOMEM();
+ if (!stralloc_0 (&tmp_path)) DIE_NOMEM();
+ fd_file = open_read (tmp_path.s);
+ if (fd_file != -1) {
+ close (fd_file);
+ } else {
+ retstat = CHKUSER_OK;
+ break;
+ }
+#else
+ if (!stralloc_cats (&tmp_path, "/.qmail-default")) DIE_NOMEM();
+ if (!stralloc_0 (&tmp_path)) DIE_NOMEM();
+
+ read_char = 0;
+ fd_file = open_read (tmp_path.s);
+ if (fd_file != -1) {
+ read_char = read (fd_file, read_buf, sizeof(read_buf) - 1);
+ close (fd_file);
+ if (read_char < 0) read_char = 0;
+ }
+ read_buf[read_char] = 0;
+
+ if ( strstr(read_buf, CHKUSER_BOUNCE_STRING) == NULL ) {
+ retstat = CHKUSER_OK;
+ break;
+ }
+#endif
+#if defined CHKUSER_STARTING_VARIABLE
+ }
+#endif
+#endif
+
+ case 7:
+#if defined VALIAS
+/* Check for aliases/forwards - valias*/
+
+ if (valias_select (user.s, domain.s) != NULL) {
+ retstat = CHKUSER_OK;
+ break;
+ }
+#endif
+
+ case 8:
+#if defined CHKUSER_ENABLE_ALIAS
+/* Check for aliases/forwards - .qmail.x files */
+
+ if (!stralloc_copy (&tmp_path, &user)) DIE_NOMEM();
+ /* Change all '.' in ':' before continuing on aliases */
+ for (count = 0; count < tmp_path.len; ++count)
+ if (*(tmp_path.s + count) == '.') *(tmp_path.s + count) = ':';
+
+ if (!stralloc_copy (&alias_path, &domain_path)) DIE_NOMEM();
+ if (!stralloc_cats (&alias_path, "/.qmail-")) DIE_NOMEM();
+ if (!stralloc_cats (&alias_path, tmp_path.s)) DIE_NOMEM();
+ if (!stralloc_0 (&alias_path)) DIE_NOMEM();
+
+ fd_file = open_read (alias_path.s);
+ if (fd_file != -1) {
+ close (fd_file);
+ retstat = CHKUSER_OK;
+ break;
+ }
+#endif
+
+ case 9:
+
+#if defined CHKUSER_ENABLE_ALIAS_DEFAULT
+
+ if (!stralloc_copy (&tmp_path, &user)) DIE_NOMEM();
+ /* Change all '.' in ':' before continuing on aliases */
+ for (count = 0; count < tmp_path.len; ++count)
+ if (*(tmp_path.s + count) == '.') *(tmp_path.s + count) = ':';
+
+ /* Search for the outer '-' character */
+ for (offset = user.len - 1; offset > 0; --offset)
+ if (*(user.s + offset) == CHKUSER_USERS_DASH) {
+ if (!stralloc_copy (&alias_path, &domain_path)) die_nomem();
+ if (!stralloc_cats (&alias_path, "/.qmail-")) die_nomem();
+ if (!stralloc_catb (&alias_path, user.s, offset)) die_nomem();
+ if (!stralloc_cats (&alias_path, "-default")) die_nomem();
+ if (!stralloc_0 (&alias_path)) die_nomem();
+
+ fd_file = open_read (alias_path.s);
+ if (fd_file != -1) {
+ close (fd_file);
+ retstat = CHKUSER_OK;
+ break;
+ }
+ }
+
+ if (retstat != CHKUSER_KO) {
+ break;
+ }
+
+#endif
+
+ case 10:
+#if defined CHKUSER_ENABLE_USERS
+/* User control: check the existance of a real user */
+
+ user_passwd = vauth_getpw (user.s, domain.s);
+
+#if defined CHKUSER_ENABLE_USERS_EXTENSIONS
+ if (user_passwd == NULL) {
+ count = 0;
+ while ((count < (user.len -1)) && (user_passwd == NULL)) {
+ count += byte_chr(&user.s[count], user.len - count, CHKUSER_USERS_DASH);
+ if (count < user.len) {
+ if (!stralloc_copyb (&tmp_path, user.s, count)) DIE_NOMEM();
+ if (!stralloc_0 (&tmp_path)) DIE_NOMEM();
+ user_passwd = vauth_getpw (tmp_path.s, domain.s);
+ ++count;
+ }
+ }
+ }
+
+#endif
+ if (user_passwd != NULL) {
+
+ /* If user exists check if he has BOUNCE_MAIL flag set */
+
+ if (user_passwd->pw_gid & BOUNCE_MAIL)
+ retstat = CHKUSER_KO;
+ else {
+ retstat = CHKUSER_OK;
+#if defined CHKUSER_MBXQUOTA_VARIABLE
+ if ((maxmbxquota_limit > 0) && (strcasecmp(user_passwd->pw_shell, "NOQUOTA") != 0)) {
+ if (!stralloc_copys (&tmp_path, user_passwd->pw_dir)) DIE_NOMEM();
+ if (!stralloc_cats (&tmp_path, "/Maildir")) DIE_NOMEM();
+ if (!stralloc_0 (&tmp_path)) DIE_NOMEM();
+
+ if (vmaildir_readquota(tmp_path.s,format_maildirquota(user_passwd->pw_shell))
+ >= maxmbxquota_limit) {
+ retstat = CHKUSER_ERR_MBXFULL;
+ }
+ }
+#endif
+ }
+ break;
+ }
+#endif
+
+ case 11:
+#if defined CHKUSER_ENABLE_EZMLM_LISTS
+/* Let's check for mailing lists */
+
+ /* Search for the outer CHKUSER_EZMLM_DASH character */
+ for (offset = user.len - 2; offset > 0; --offset) {
+ if (*(user.s + offset) == CHKUSER_EZMLM_DASH) {
+ if (!stralloc_copy (&tmp_path, &domain_path)) DIE_NOMEM();
+ if (!stralloc_cats (&tmp_path, "/")) DIE_NOMEM();
+ if (!stralloc_catb (&tmp_path, user.s, offset)) DIE_NOMEM();
+ if (!stralloc_cats (&tmp_path, "/mailinglist")) DIE_NOMEM();
+ if (!stralloc_0 (&tmp_path)) DIE_NOMEM();
+ fd_file = open_read (tmp_path.s);
+ if (fd_file != -1) {
+ close (fd_file);
+ retstat = CHKUSER_OK;
+ break;
+ }
+ }
+ }
+ if (retstat != CHKUSER_KO) {
+ break;
+ }
+#endif
+
+ case 12:
+#if defined CHKUSER_ENABLE_MAILMAN_LISTS
+/* Let's check for mailing lists */
+
+ /* Search for the outer CHKUSER_MAILMAN_DASH character */
+ for (offset = user.len - 2; offset > 0; --offset) {
+ if (*(user.s + offset) == CHKUSER_MAILMAN_DASH) {
+ if (!stralloc_copy (&tmp_path, &domain_path)) DIE_NOMEM();
+ if (!stralloc_cats (&tmp_path, "/")) DIE_NOMEM();
+ if (!stralloc_cats (&alias_path, "/.qmail-")) DIE_NOMEM();
+ if (!stralloc_catb (&tmp_path, user.s, offset)) DIE_NOMEM();
+ if (!stralloc_0 (&tmp_path)) DIE_NOMEM();
+ fd_file = open_read (tmp_path.s);
+ read_char = 0;
+ if (fd_file != -1) {
+ read_char = read (fd_file, read_buf, sizeof(read_buf) - 1);
+ close (fd_file);
+ if (read_char < 0) read_char = 0;
+ }
+ read_buf[read_char] = 0;
+
+ if ( strstr(read_buf, CHKUSER_MAILMAN_STRING) == NULL ) {
+ retstat = CHKUSER_OK;
+ break;
+ }
+
+ }
+ }
+ if (retstat != CHKUSER_KO) {
+ break;
+ }
+#endif
+
+/*
+ * Add this code if another case is following
+ case xx:
+ code ....
+ code ....
+ code ....
+ code ....
+
+ if (xxxxxxxx) {
+ retstat != CHKUSER_KO)
+ break;
+ }
+*/
+
+ default:
+ retstat = CHKUSER_KO;
+
+ } /* end switch */
+
+#if defined CHKUSER_ENABLE_UIDGID
+/* Now switch back effective to saved UID & GID (qmaild:nofiles) */
+
+ setegid (eff_gid);
+ seteuid (eff_uid);
+
+/* qmail-smtpd is running again as (effective) qmaild:nofiles */
+#endif
+
+ return retstat;
+
+}
+
+
+
+/*
+ * chkuser_realrcpt ()
+ *
+ * Returns a simple status:
+ *
+ * CHKUSER_OK = 1 = Ok, recipients does exists
+ *
+ * CHKUSER_NORCPTHOSTS = Not in rcpthosts
+ *
+ * CHKUSER_KO = ERROR
+ *
+ *
+ * Parameters:
+ * stralloc *sender = sender address
+ * stralloc *rcpt = rcpt address to check
+ *
+ *
+*/
+
+int chkuser_realrcpt (stralloc *sender, stralloc *rcpt) {
+
+int retstat;
+
+ if (first_time_init_flag) {
+ first_time_init ();
+ }
+
+ retstat = realrcpt (sender, rcpt);
+
+ switch (retstat) {
+
+ case CHKUSER_OK:
+#if defined CHKUSER_LOG_VALID_RCPT
+ chkuser_commonlog (sender->s, rcpt->s, "accepted rcpt", "found existing recipient");
+#endif
+ return CHKUSER_OK;
+ break;
+
+ case CHKUSER_RELAYING:
+#if defined CHKUSER_LOG_VALID_RCPT
+ chkuser_commonlog (sender->s, rcpt->s, "relaying rcpt", "client allowed to relay");
+#endif
+ return CHKUSER_RELAYING;
+ break;
+
+ case CHKUSER_NORCPTHOSTS:
+ chkuser_commonlog (sender->s, rcpt->s, "rejected relaying", "client not allowed to relay");
+ CHKUSER_RCPT_DELAY_ANY();
+ out(CHKUSER_NORELAY_STRING);
+ break;
+
+ case CHKUSER_KO:
+ chkuser_commonlog (sender->s, rcpt->s, "rejected rcpt", "not existing recipient");
+ CHKUSER_DELAY();
+ out(CHKUSER_NORCPT_STRING);
+ break;
+
+ case CHKUSER_ERR_AUTH_RESOURCE:
+ chkuser_commonlog (sender->s, rcpt->s, "no auth resource", "no auth resource available");
+ CHKUSER_RCPT_DELAY_ANY();
+ out(CHKUSER_RESOURCE_STRING);
+ break;
+
+ case CHKUSER_ERR_MBXFULL:
+ chkuser_commonlog (sender->s, rcpt->s, "mbx overquota", "rcpt mailbox is overquota");
+ CHKUSER_RCPT_DELAY_ANY();
+ out(CHKUSER_MBXFULL_STRING);
+ break;
+
+ case CHKUSER_ERR_MAXRCPT:
+ chkuser_commonlog (sender->s, rcpt->s, "rejected rcpt", "max number of recipients");
+ CHKUSER_DELAY ();
+ out(CHKUSER_MAXRCPT_STRING);
+ break;
+
+ case CHKUSER_ERR_MAXWRONGRCPT:
+ chkuser_commonlog (sender->s, rcpt->s, "rejected rcpt", "max number of invalid recipients");
+ CHKUSER_DELAY ();
+ out(CHKUSER_MAXWRONGRCPT_STRING);
+ break;
+
+ case CHKUSER_ERR_INTRUSION_THRESHOLD:
+ chkuser_commonlog (sender->s, rcpt->s, "rejected intrusion", "rcpt ignored, session over INTRUSION threshold");
+ CHKUSER_DELAY ();
+ out(CHKUSER_INTRUSIONTHRESHOLD_STRING);
+ break;
+
+ case CHKUSER_ERR_DOMAIN_MISSING:
+ CHKUSER_DELAY ();
+ out(CHKUSER_DOMAINMISSING_STRING);
+ break;
+
+ case CHKUSER_ERR_RCPT_FORMAT:
+ chkuser_commonlog (sender->s, rcpt->s, "rejected rcpt", "invalid rcpt address format");
+ CHKUSER_RCPT_DELAY_ANY();
+ out(CHKUSER_RCPTFORMAT_STRING);
+ break;
+
+ case CHKUSER_ERR_RCPT_MX:
+ chkuser_commonlog (sender->s, rcpt->s, "rejected rcpt", "invalid rcpt MX domain");
+ CHKUSER_RCPT_DELAY_ANY();
+ out(CHKUSER_RCPTMX_STRING);
+ break;
+
+ case CHKUSER_ERR_RCPT_MX_TMP:
+ chkuser_commonlog (sender->s, rcpt->s, "rejected rcpt", "temporary DNS problem");
+ CHKUSER_RCPT_DELAY_ANY();
+ out(CHKUSER_RCPTMX_TMP_STRING);
+ break;
+ }
+
+
+
+#if defined CHKUSER_WRONGRCPT_LIMIT_VARIABLE
+ if ((retstat == CHKUSER_KO) || (retstat == CHKUSER_ERR_DOMAIN_MISSING)) {
+ ++wrong_recipients;
+ if ((INTRUSION_threshold_reached == 0) && (maxwrongrcpt_limit > 0) && (wrong_recipients >= maxwrongrcpt_limit)) {
+ chkuser_commonlog (sender->s, rcpt->s, "intrusion threshold", "max number of allowed invalid rcpt");
+ INTRUSION_threshold_reached = 1;
+ }
+ }
+#endif
+
+ return CHKUSER_KO;
+}
+
+
+/*
+ *
+ * This routine checks for sender format and MX
+ *
+ */
+
+
+int chkuser_sender (stralloc *sender) {
+
+int count;
+
+ if (first_time_init_flag) {
+ first_time_init ();
+ }
+
+#if !defined CHKUSER_ALWAYS_ON && defined CHKUSER_STARTING_VARIABLE
+ if (starting_value == -1) {
+ return CHKUSER_OK;
+ }
+#endif
+
+#if defined CHKUSER_SENDER_FORMAT || defined CHKUSER_SENDER_MX
+
+#if defined CHKUSER_SENDER_NOCHECK_VARIABLE
+
+ if (sender_nocheck == 1) {
+ return CHKUSER_OK;
+ }
+#endif
+
+ if (sender->len <= 1) {
+#if defined CHKUSER_LOG_VALID_SENDER
+ chkuser_commonlog (sender->s, "", "accepted null sender", "accepted null sender always");
+#endif
+ return CHKUSER_OK;
+ }
+
+ count = byte_rchr(sender->s,sender->len,'@');
+ if (count < sender->len) {
+ if (!stralloc_copyb (&sender_user, sender->s, count)) DIE_NOMEM();
+ if (!stralloc_copys (&sender_domain, sender->s + count + 1)) DIE_NOMEM();
+ } else {
+ if (!stralloc_copys (&sender_user, sender->s)) DIE_NOMEM();
+ sender_domain.len = 0;
+ }
+ if (!stralloc_0 (&sender_user)) DIE_NOMEM();
+ if (!stralloc_0 (&sender_domain)) DIE_NOMEM();
+
+#if defined CHKUSER_SENDER_FORMAT
+ if (check_sender_address_format (&sender_user, &sender_domain) == 0) {
+ chkuser_commonlog (sender->s, "", "rejected sender", "invalid sender address format");
+ CHKUSER_SENDER_DELAY_ANY();
+ out(CHKUSER_SENDERFORMAT_STRING);
+ return CHKUSER_ERR_SENDER_FORMAT;
+ }
+
+#endif
+
+#if defined CHKUSER_SENDER_MX
+
+ switch (chkuser_mx_lookup(&sender_domain)) {
+
+ case DNS_HARD:
+ CHKUSER_SENDER_DELAY_ANY();
+ out(CHKUSER_SENDERMX_STRING);
+ chkuser_commonlog (sender->s, "", "rejected sender", "invalid sender MX domain");
+ return CHKUSER_ERR_SENDER_MX;
+ break;
+
+ case DNS_SOFT:
+ CHKUSER_SENDER_DELAY_ANY();
+ out(CHKUSER_SENDERMX_TMP_STRING);
+ chkuser_commonlog (sender->s, "", "rejected sender", "temporary DNS problem");
+ return CHKUSER_ERR_SENDER_MX_TMP;
+ break;
+ }
+
+#if defined CHKUSER_LOG_VALID_SENDER
+ chkuser_commonlog (sender->s, "", "accepted sender", "sender accepted");
+#endif
+
+ return CHKUSER_OK;
+#endif
+
+#else
+
+ return CHKUSER_OK;
+
+#endif
+
+}
+
+
diff -Naur qmail-1.03.orig/chkuser.h qmail-1.03/chkuser.h
--- qmail-1.03.orig/chkuser.h Thu Jan 1 01:00:00 1970
+++ qmail-1.03/chkuser.h Mon Dec 25 23:42:27 2006
@@ -0,0 +1,51 @@
+
+/*
+ *
+ * 'chkuser.h' v.2.0.8
+ * for qmail/netqmail > 1.0.3 and vpopmail > 5.3.x
+ *
+ * Author: Antonio Nati tonix@interazioni.it
+ * All rights on this software and
+ * the identifying words chkusr and chkuser kept by the author
+ *
+ * This software may be freely used, modified and distributed,
+ * but this lines must be kept in every original or derived version.
+ * Original author "Antonio Nati" and the web URL
+ * "http://www.interazioni.it/opensource"
+ * must be indicated in every related work or web page
+ *
+ */
+
+#define CHKUSER
+#define CHKUSER_VERSION "2.0.8"
+#define CHKUSER_VERSION_RL 2
+#define CHKUSER_VERSION_MJ 0
+#define CHKUSER_VERSION_MN 8
+
+#define CHKUSER_OK 1
+#define CHKUSER_RELAYING 0
+#define CHKUSER_KO -1
+#define CHKUSER_NORCPTHOSTS -10
+#define CHKUSER_ERR_AUTH_RESOURCE -20
+#define CHKUSER_ERR_MBXFULL -30
+#define CHKUSER_ERR_MAXRCPT -40
+#define CHKUSER_ERR_MAXWRONGRCPT -50
+#define CHKUSER_ERR_DOMAIN_MISSING -60
+#define CHKUSER_ERR_RCPT_FORMAT -70
+#define CHKUSER_ERR_RCPT_MX -75
+#define CHKUSER_ERR_RCPT_MX_TMP -76
+#define CHKUSER_ERR_SENDER_FORMAT -80
+#define CHKUSER_ERR_SENDER_MX -85
+#define CHKUSER_ERR_SENDER_MX_TMP -86
+#define CHKUSER_ERR_INTRUSION_THRESHOLD -90
+
+void chkuser_cleanup (int exit_value);
+int chkuser_realrcpt (stralloc *sender, stralloc *rcpt);
+int chkuser_sender (stralloc *sender);
+
+#ifdef TLS_H
+#undef _exit
+#define _exit(value) { if (ssl) ssl_free(ssl); chkuser_cleanup(value); }
+#else
+#define _exit(value) chkuser_cleanup(value);
+#endif
diff -Naur qmail-1.03.orig/chkuser_settings.h qmail-1.03/chkuser_settings.h
--- qmail-1.03.orig/chkuser_settings.h Thu Jan 1 01:00:00 1970
+++ qmail-1.03/chkuser_settings.h Mon Dec 25 23:42:27 2006
@@ -0,0 +1,373 @@
+
+/*
+ *
+ * 'chkuser_settings.h' v.2.0.8
+ * for qmail/netqmail > 1.0.3 and vpopmail > 5.3.x
+ *
+ * Author: Antonio Nati tonix@interazioni.it
+ * All rights on this software and
+ * the identifying words chkusr and chkuser kept by the author
+ *
+ * This software may be freely used, modified and distributed,
+ * but this lines must be kept in every original or derived version.
+ * Original author "Antonio Nati" and the web URL
+ * "http://www.interazioni.it/opensource"
+ * must be indicated in every related work or web page
+ *
+ */
+
+/*
+ * the following line enables debugging of chkuser
+ */
+/* #define CHKUSER_DEBUG */
+
+/*
+ * The following line moves DEBUG output from STDOUT (default) to STDERR
+ * Example of usage within sh: ./qmail-smtpd 2> /var/log/smtpd-debug.log
+ */
+/* #define CHKUSER_DEBUG_STDERR */
+
+/*
+ * Uncomment the following define if you want chkuser ALWAYS enabled.
+ * If uncommented, it will check for rcpt existance despite any .qmail-default
+ * setting.
+ * So, unsomments this if you are aware that ALL rcpt in all domains will be
+ * ALWAYS checked.
+ */
+/* #define CHKUSER_ALWAYS_ON */
+
+/*
+ * The following defines which virtual manager is used.
+ * Up to know, only vpopmail, but versions with pure qmail are in the mind.
+ */
+#define CHKUSER_VPOPMAIL
+
+/*
+ * Uncomment the following line if you want chkuser to work depending on a VARIABLE setting
+ * VALUE HERE DEFINED is the name of the variable
+ * Values admitted inside the variable: NONE | ALWAYS | DOMAIN
+ * NONE = chkuser will not work
+ * ALWAYS = chkuser will work always
+ * DOMAIN = chkuser will work depending by single domain settings
+ * if CHKUSER_ALWAYS_ON is defined, this define is useless
+ * if CHKUSER_STARTING_VARIABLE is defined, and no variable or no value is set, then chkuser is disabled
+ */
+/* #define CHKUSER_STARTING_VARIABLE "CHKUSER_START" */
+
+/*
+ * Uncomment this to enable uid/gid changing
+ * (switching UID/GID is NOT compatible with TLS; you may keep this commented if you have TLS)
+ */
+/* EDIT #define CHKUSER_ENABLE_UIDGID */
+
+/*
+ * Uncomment this to check if a domain is ALWAYS specified in rcpt addresses
+ */
+/* EDIT #define CHKUSER_DOMAIN_WANTED */
+
+/*
+ * Uncomment this to check for vpopmail users
+ */
+#define CHKUSER_ENABLE_USERS
+
+/*
+ * Uncomment this to check for alias
+ */
+#define CHKUSER_ENABLE_ALIAS
+
+/*
+ * The following #define set the character used for lists extensions
+ * be careful: this is a single char '-' definition, not a "string"
+ */
+#define CHKUSER_EZMLM_DASH '-'
+
+/*
+ * Uncomment this to set an alternative way to check for bouncing enabling;
+ * with this option enabled, the file here defined
+ * will be searched, inside the domain dir, in order to check if bouncing is enabled
+ * The content of this file is not important, just it's existence is enough
+ */
+/* #define CHKUSER_SPECIFIC_BOUNCING ".qmailchkuser-bouncing" */
+
+/*
+ * This is the string to look for inside .qmail-default
+ * Be careful, chkuser looks within the first 1023 characters of .qmail-default for
+ * this string (despite the line containing the string is working or commented).
+ */
+#define CHKUSER_BOUNCE_STRING "bounce-no-mailbox"
+
+/*
+ * This is to enable auth open checking
+ * it is useful to avoid bouncing if MySQL/LDAP/PostGRES/etc are down or not reachable
+ */
+/* #define CHKUSER_ENABLE_VAUTH_OPEN */
+
+/*
+ * Uncomment to enable logging of rejected recipients and variuos limits reached
+ */
+#define CHKUSER_ENABLE_LOGGING
+
+/*
+ * Uncomment to enable logging of "good" rcpts
+ * valid only if CHKUSER_ENABLE_LOGGING is defined
+ */
+#define CHKUSER_LOG_VALID_RCPT
+
+/*
+ * Uncomment to enable usage of a variable escluding any check on the sender.
+ * The variable should be set in tcp.smtp for clients, with static IP, whose mailer
+ * is composing bad sender addresses
+ */
+/* #define CHKUSER_SENDER_NOCHECK_VARIABLE "SENDER_NOCHECK" */
+
+/*
+ * Uncomment to enable usage of "#" and "+" characters within sender address
+ * This is used by SRS (Sender Rewriting Scheme) products
+ */
+#define CHKUSER_ALLOW_SENDER_SRS
+
+/*
+ * If you need more additional characters to be accepted within sender address
+ * uncomment one of the following #define and edit the character value.
+ * Be careful to use '*' (single hiphen) and NOT "*" (double hiphen) around the
+ * wanted char.
+ */
+/* #define CHKUSER_ALLOW_SENDER_CHAR_1 '$' */
+/* #define CHKUSER_ALLOW_SENDER_CHAR_2 '%' */
+/* #define CHKUSER_ALLOW_SENDER_CHAR_3 '£' */
+/* #define CHKUSER_ALLOW_SENDER_CHAR_4 '?' */
+/* #define CHKUSER_ALLOW_SENDER_CHAR_5 '*' */
+
+/*
+ * The following #define sets the minimum length of a domain:
+ * as far as I know, "k.st" is the shortest domain, so 4 characters is the
+ * minimum length.
+ * This value is used to check formally a domain name validity.
+ * if CHKUSER_SENDER_FORMAT is undefined, no check on length is done.
+ * If you comment this define, no check on length is done.
+ */
+#define CHKUSER_MIN_DOMAIN_LEN 4
+
+/*
+ * Uncomment to enable logging of "good" senders
+ * valid only if CHKUSER_ENABLE_LOGGING is defined
+ */
+#define CHKUSER_LOG_VALID_SENDER
+
+/*
+ * Uncomment to define a variable which contains the max recipients number
+ * this will return always error if total recipients exceed this limit.
+ * The first reached, between CHKUSER_RCPT_LIMIT_VARIABLE and CHKUSER_WRONGRCPT_LIMIT_VARIABLE,
+ * makes chkuser rejecting everything else
+ */
+#define CHKUSER_RCPT_LIMIT_VARIABLE "CHKUSER_RCPTLIMIT"
+
+/*
+ * Uncomment to define a variable which contains the max unknown recipients number
+ * this will return always error if not existing recipients exceed this limit.
+ * The first reached, between CHKUSER_RCPT_LIMIT_VARIABLE and CHKUSER_WRONGRCPT_LIMIT_VARIABLE,
+ * makes chkuser rejecting everything else
+ */
+#define CHKUSER_WRONGRCPT_LIMIT_VARIABLE "CHKUSER_WRONGRCPTLIMIT"
+
+/*
+ * Uncomment to define the variable containing the percent to check for.
+ * Remember to define externally (i.e. in tcp.smtp) the environment variable containing
+ * the limit percent.
+ * If the variable is not defined, or it is <= 0, quota checking is not performed.
+ */
+#define CHKUSER_MBXQUOTA_VARIABLE "CHKUSER_MBXQUOTA"
+
+/*
+ * Delay to wait for each not existing recipient
+ * value is expressed in milliseconds
+ */
+#define CHKUSER_ERROR_DELAY 1000
+
+/*
+ * Uncomment to consider rcpt errors on address format and MX as intrusive
+ *
+ */
+#define CHKUSER_RCPT_DELAY_ANYERROR
+
+/*
+ * Uncomment to consider sender errors on address format and MX as intrusive
+ *
+ */
+#define CHKUSER_SENDER_DELAY_ANYERROR
+
+#define CHKUSER_NORCPT_STRING "511 sorry, no mailbox here by that name (#5.1.1 - chkuser)\r\n"
+#define CHKUSER_RESOURCE_STRING "430 system temporary unavailable, try again later (#4.3.0 - chkuser)\r\n"
+#define CHKUSER_MBXFULL_STRING "522 sorry, recipient mailbox is full (#5.2.2 - chkuser)\r\n"
+#define CHKUSER_MAXRCPT_STRING "571 sorry, reached maximum number of recipients for one session (#5.7.1 - chkuser)\r\n"
+#define CHKUSER_MAXWRONGRCPT_STRING "571 sorry, you are violating our security policies (#5.1.1 - chkuser)\r\n"
+#define CHKUSER_DOMAINMISSING_STRING "511 sorry, you must specify a domain (#5.1.1 - chkuser)\r\n"
+#define CHKUSER_RCPTFORMAT_STRING "511 sorry, recipient address has invalid format (#5.1.1 - chkuser)\r\n"
+#define CHKUSER_RCPTMX_STRING "511 sorry, can't find a valid MX for rcpt domain (#5.1.1 - chkuser)\r\n"
+#define CHKUSER_SENDERFORMAT_STRING "571 sorry, sender address has invalid format (#5.7.1 - chkuser)\r\n"
+#define CHKUSER_SENDERMX_STRING "511 sorry, can't find a valid MX for sender domain (#5.1.1 - chkuser)\r\n"
+#define CHKUSER_INTRUSIONTHRESHOLD_STRING "571 sorry, you are violating our security policies (#5.7.1 - chkuser)\r\n"
+#define CHKUSER_NORELAY_STRING "553 sorry, that domain isn't in my list of allowed rcpthosts (#5.5.3 - chkuser)\r\n"
+
+/***************************************************
+ *
+ * new/modified defines in/from 2.0.6
+ *
+ **************************************************/
+
+/*
+ * Before version 5.3.25, vpopmail used the function vget_real_domain()
+ * to get the real name of a domain (useful if rcpt domain is aliasing
+ * another domain).
+ * From version 5.3.25, this call is not available and has been
+ * substituted by other calls.
+ *
+ * must be enabled if vpopmail version< 5.3.5
+ * must be disabled if vpopmail version => 5.3.5 *
+ */
+/* #define CHKUSER_ENABLE_VGET_REAL_DOMAIN */
+
+/***************************************************
+ *
+ * new/modified defines in/from 2.0.7
+ *
+ **************************************************/
+
+/*
+ * Uncomment next define to accept recipients for
+ * aliases that have a -default extension
+ */
+#define CHKUSER_ENABLE_ALIAS_DEFAULT
+
+
+/*
+ * Uncomment to enable usage of "#" and "+" characters within rcpt address
+ * This is used by SRS (Sender Rewriting Scheme) products
+ */
+#define CHKUSER_ALLOW_RCPT_SRS
+
+/*
+ * If you need more additional characters to be accepted within rcpt address
+ * uncomment one of the following #define and edit the character value.
+ * Be careful to use '*' (single hiphen) and NOT "*" (double hiphen) around the
+ * wanted char.
+ */
+/* #define CHKUSER_ALLOW_RCPT_CHAR_1 '$' */
+/* #define CHKUSER_ALLOW_RCPT_CHAR_2 '%' */
+/* #define CHKUSER_ALLOW_RCPT_CHAR_3 '£' */
+/* #define CHKUSER_ALLOW_RCPT_CHAR_4 '?' */
+/* #define CHKUSER_ALLOW_RCPT_CHAR_5 '*' */
+
+/*
+ * This define has been eliminated.
+ * Turning it ON or OFF has no effect, as we consider the existence
+ * of #define VALIAS inside ~vpopmail/include/vpopmail_config.h
+ */
+/* #define CHKUSER_ENABLE_VALIAS */
+
+/*
+ * Uncomment this to enable user extension on names (i.e. TMDA)
+ * (for mailing lists this is done without checking this define)
+ * This define substitutes #define CHKUSER_ENABLE_EXTENSIONS
+ */
+/* #define CHKUSER_ENABLE_USERS_EXTENSIONS */
+
+/*
+ * Enables checking for EZMLM lists
+ * this define substitutes #define CHKUSER_ENABLE_LISTS
+ *
+ */
+#define CHKUSER_ENABLE_EZMLM_LISTS
+
+/*
+ * Help identifying remote authorized IPs giving them a descriptive name
+ * Can be put in tcp.smtp, and will be displayed inside chkuser log
+ * Substitutes RELAYCLIENT in chkuser logging
+ */
+#define CHKUSER_IDENTIFY_REMOTE_VARIABLE "CHKUSER_IDENTIFY"
+
+/*
+ * The following #define set the character used for users extensions
+ * be careful: this is a single char '-' definition, not a "string"
+ * this define substitutes #define CHKUSER_EXTENSION_DASH
+ * MUST be defined if CHKUSER_ENABLE_USERS_EXTENSIONS is defined
+ */
+#define CHKUSER_USERS_DASH '-'
+
+/*
+ * New error strings for SOFT DNS problems
+ */
+#define CHKUSER_RCPTMX_TMP_STRING "451 DNS temporary failure (#4.5.1 - chkuser)\r\n"
+#define CHKUSER_SENDERMX_TMP_STRING "451 DNS temporary failure (#4.5.1 - chkuser)\r\n"
+
+/*
+ * Enables checking for mailman lists
+ *
+ */
+/* #define CHKUSER_ENABLE_MAILMAN_LISTS */
+
+/*
+ * Identifies the pattern string to be searched within mailman aliases
+ *
+ */
+#define CHKUSER_MAILMAN_STRING "mailman"
+
+/*
+ * The following #define set the character used for mailman lists extensions
+ * be careful: this is a single char '-' definition, not a "string"
+ */
+#define CHKUSER_MAILMAN_DASH '-'
+
+
+/*
+ * Enables final clean-up routine of chkuser
+ * This routine cleans open DB connections used for checking users and valiases
+ */
+#define CHKUSER_DB_CLEANUP
+
+/***************************************************
+ *
+ * new/modified defines in/from 2.0.8
+ *
+ **************************************************/
+
+/*
+ * The following defines are NO MORE used. NULL SENDER rejecting breaks RFC
+ * compatibility, and makes harder to handle e-mail receipts.
+ * Please comment or delete them from your chkuser_settings.h.
+ */
+/* #define CHKUSER_ACCEPT_NULL_SENDER */
+/* #define CHKUSER_ENABLE_NULL_SENDER_WITH_TCPREMOTEHOST */
+
+/*
+ * Uncomment to enable checking of user and domain format for rcpt addresses
+ * user = [a-z0-9_-]
+ * domain = [a-z0-9-.] with not consecutive "-.", not leading or ending "-."
+ */
+/* #define CHKUSER_RCPT_FORMAT */
+
+/*
+ * Uncomment to enable checking of domain MX for rcpt addresses
+ * It works on any rcpt address domain that is not inside rcpthosts
+ */
+/* #define CHKUSER_RCPT_MX */
+
+/*
+ * Uncomment to enable checking of user and domain format for sender address
+ * user = [a-z0-9_-]
+ * domain = [a-z0-9-.] with not consecutive "-.", not leading or ending "-."
+ */
+/* #define CHKUSER_SENDER_FORMAT */
+
+/*
+ * Uncomment to enable checking of domain MX for sender address
+ * it works on the first rcpt address, despite of any domain setting on chkuser
+ */
+/* #define CHKUSER_SENDER_MX */
+
+/*
+ * Delay to add, for each not existing recipient, to the initial CHKUSER_ERROR_DELAY value
+ * value is expressed in milliseconds
+ */
+#define CHKUSER_ERROR_DELAY_INCREASE 300
+
diff -Naur qmail-1.03.orig/conf-cc qmail-1.03/conf-cc
--- qmail-1.03.orig/conf-cc Sun Dec 24 15:24:55 2006
+++ qmail-1.03/conf-cc Mon Dec 25 23:42:57 2006
@@ -1 +1 @@
-cc -O -pipe -funroll-loops -march=pentiumpro -I/usr/include -L/usr/lib -DTLS
+cc -O -pipe -funroll-loops -march=pentiumpro -I/usr/include -L/usr/lib -DTLS -I/usr/local/vpopmail/include
diff -Naur qmail-1.03.orig/qmail-smtpd.c qmail-1.03/qmail-smtpd.c
--- qmail-1.03.orig/qmail-smtpd.c Mon Dec 25 23:39:28 2006
+++ qmail-1.03/qmail-smtpd.c Mon Dec 25 23:41:17 2006
@@ -45,6 +45,10 @@
int ssl_rfd = -1, ssl_wfd = -1; /* SSL_get_Xfd() are broken */
#endif
+/* start chkuser code */
+#include "chkuser.h"
+/* end chkuser code */
+
int safewrite(fd,buf,len) int fd; char *buf; int len;
{
int r;
@@ -330,6 +334,9 @@
flagsize = 0;
mailfrom_parms(arg);
if (flagsize) { err_size(); return; }
+/* start chkuser code */
+ if (chkuser_sender (&addr) != CHKUSER_OK) { return; }
+/* end chkuser code */
if (!(spp_val = spp_mail())) return;
flagbarfspf = 0;
if (spp_val == 1) {
@@ -397,9 +404,8 @@
if (!addrparse(arg)) { err_syntax(); return; }
if (flagbarf) { err_bmf(); return; }
if (flagbarfspf) { err_spf(); return; }
- if (!relayclient) allowed = addrallowed();
- else allowed = 1;
- if (!(spp_val = spp_rcpt(allowed))) return;
+/*
+ * Original code substituted by chkuser code
if (relayclient) {
--addr.len;
if (!stralloc_cats(&addr,relayclient)) die_nomem();
@@ -404,6 +413,23 @@
else if (spp_val == 1) {
if (!allowed) { err_nogateway(); return; }
}
+ * end of substituted code
+ */
+
+/* start chkuser code */
+ switch (chkuser_realrcpt (&mailfrom, &addr)) {
+ case CHKUSER_KO:
+ return;
+ break;
+
+ case CHKUSER_RELAYING:
+ --addr.len;
+ if (!stralloc_cats(&addr,relayclient)) die_nomem();
+ if (!stralloc_0(&addr)) die_nomem();
+ break;
+ }
+/* end chkuser code */
+ if (!(spp_val = spp_rcpt(1))) return;
spp_rcpt_accepted();
if (!stralloc_cats(&rcptto,"T")) die_nomem();
if (!stralloc_cats(&rcptto,addr.s)) die_nomem();