From independence.ecn.ou.edu!rmtodd Thu Jan  8 20:22:26 1998
Return-Path: <rmtodd@independence.ecn.ou.edu>
Received: from whome.planix.com([204.29.161.33]) (13372 bytes) by most.weird.com
	via sendmail with P:esmtp/D:aliases/T:pipe
	(sender: <rmtodd@independence.ecn.ou.edu>) 
	id <m0xmVEr-00077aC@most.weird.com>
	for <smail3-bugs@mail.weird.com>; Sun, 28 Dec 1997 21:47:33 -0500 (EST)
	(Smail-3.2.0.102-Pre 1997-Dec-17 #5 built 1998-Jan-8)
Received: from independence.ecn.uoknor.edu(independence.ecn.ou.edu[129.15.112.69]) (13001 bytes) by whome.planix.com
	via sendmail with P:esmtp/D:aliases/R:inet_hosts/T:smtp
	(sender: <rmtodd@independence.ecn.ou.edu>) 
	id <m0xmVE8-0008VFC@whome.planix.com>
	for <smail-bugs@planix.com>; Sun, 28 Dec 1997 21:46:48 -0500 (EST)
	(Smail-3.2.0.97 1997-Aug-19 #2 built 1997-Aug-25)
Received: (12545 bytes) by independence.ecn.uoknor.edu
	via smail with P:stdio/R:inet_hosts/T:smtp
	(sender: <rmtodd@independence.ecn.ou.edu>) 
	id <m0xmVDW-00082yC@independence.ecn.uoknor.edu>
	for smail-bugs@planix.com; Sun, 28 Dec 1997 20:46:10 -0600 (CST)
	(Smail-3.2.0.101 1997-Dec-17 #3 built 1997-Dec-28)
Message-Id: <m0xmVDW-00082yC@independence.ecn.uoknor.edu>
Date: Sun, 28 Dec 1997 19:14:28 -0600 (CST)
From: rmtodd@independence.ecn.ou.edu
Reply-To: rmtodd@independence.ecn.ou.edu
To: smail-bugs@planix.com
Subject: help block spam by using Vixie's RBL (http://maps.vix.com/rbl)
X-Send-Pr-Version: 3.95

>Number:         348
>Category:       smail
>Synopsis:       help block spam by using Vixie's RBL (http://maps.vix.com/rbl)
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    woods
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   net
>Arrival-Date:   Thu Jan  8 20:41:18 EST 1998
>Last-Modified:  Sun Oct 25 20:26:05 EST 1998
>Originator:     Richard Michael Todd
>Organization:
net
>Release:        3.2.0.101
>Environment:
	
System: BSD/OS independence.ecn.ou.edu 2.1 BSDI BSD/OS 2.1 Kernel #4: Tue Oct 15 15:49:55 CDT 1996 rmtodd@independence.ecn.ou.edu:/usr/src/sys/compile/INDY i386


>Description:
	Paul Vixie has set up a nice system to let remote machines look up
	entries on his large database of known spam mail sites and spam mail
	relay sites.  This patch lets smail check remote addresses of machines
	trying to send mail against the Vixie RBL and block the mail if the
	remote site is on the RBL.
>How-To-Repeat:
	...
>Fix:
--- config.c	1997/12/28 22:26:11	1.2
+++ config.c	1997/12/28 22:28:53
@@ -120,6 +120,9 @@
 char *auth_domains = AUTH_DOMAINS;	/* authoritative domain list */
 long rfc1413_query_timeout = -1;	/* Timeout on RFC1413 queries - initially disabled */
 long resolve_timeout = RESOLVE_TIMEOUT;	/* timeout on directors/routers */
+int vixie_rbl = VIXIE_RBL;
+char *vixie_rbl_force_allow = VIXIE_RBL_FORCE_ALLOW; /* address which we allow mail from, overriding Vixie RBL. */
+
 
 #ifdef HAVE_LIBWRAP
 
--- config.h	1997/12/28 22:26:11	1.2
+++ config.h	1997/12/28 23:08:11
@@ -852,6 +852,21 @@
 #endif
 
 /*
+ * Whether or not to look up inbound IP addresses in the Vixie RBL.
+ */
+#ifndef VIXIE_RBL
+# define VIXIE_RBL	0 /* Default to off. */
+#endif
+
+/*
+ * IP Addresses which we allow to override the Vixie RBL (i.e. forcing smail
+ * to allow mail from these IPs even if they're in the RBL.
+ */
+#ifndef VIXIE_RBL_FORCE_ALLOW
+# define VIXIE_RBL_FORCE_ALLOW	NULL /* none by default. */
+#endif
+
+/*
  * Set this to a string defining the mode to use for delivery of new
  * incoming mail messages.  It should be one of:
  *
--- extern.h	1997/12/28 22:26:11	1.2
+++ extern.h	1997/12/28 23:13:05
@@ -114,6 +114,9 @@
 extern char *auth_domains;		/* authoritative domain list */
 extern long rfc1413_query_timeout;	/* Timeout on RFC1413 queries - initially disabled */
 extern long resolve_timeout;		/* timeout on directors/routers */
+extern int vixie_rbl;			/* check IP address againsst Vixie RBL */
+extern char *vixie_rbl_force_allow;	/* IP addrs that can override the Vixie RBL blocking. */
+
 
 /* external variables defined in copyright.c */
 extern char copyright[];		/* the program copyright notice */
--- modes.c	1997/12/28 22:26:11	1.2
+++ modes.c	1997/12/28 22:47:39
@@ -136,10 +136,10 @@
 
 # include <tcpd.h>  
 
-int smtp_session_denied = 0;		/* used in smtprecv.c */
-
 #endif /* HAVE_LIBWRAP */
 
+int smtp_session_denied = 0;		/* used in smtprecv.c */
+
 /* variables exported from this file */
 int daemon_pid = 0;
 
@@ -1259,6 +1259,8 @@
 #ifdef SIGCHLD
 	(void) signal(SIGCHLD, SIG_DFL); /* child may fork() in delivery */
 #endif
+
+	smtp_session_denied = FALSE; /* start off not denied. */
 
 #ifdef HAVE_LIBWRAP
 	request_init(&req, RQ_DAEMON, program, RQ_FILE, fd, NULL);
--- smailconf.c	1997/12/28 22:26:11	1.2
+++ smailconf.c	1997/12/28 22:28:54
@@ -163,6 +163,8 @@
     { "uucp_name", t_string, NULL, (tup *)&uucp_name, 0 },
     { "version", t_infoproc, NULL, (tup *)version, 0 },
     { "visible_name", t_string, NULL, (tup *)&visible_name, 0 },
+    { "vixie_rbl", t_boolean, NULL, (tup *)&vixie_rbl, 0},
+    { "vixie_rbl_force_allow", t_string, NULL, (tup *)&vixie_rbl_force_allow, 0},
 };
 struct attr_table *end_conf_attributes = ENDTABLE(conf_attributes);
 
--- smtprecv.c	1997/12/28 21:33:51	1.1
+++ smtprecv.c	1997/12/28 23:25:31
@@ -58,9 +58,7 @@
 #include <ident.h>
 #endif /* HAVE_RFC1413 */
 
-#ifdef HAVE_LIBWRAP
 extern int smtp_session_denied;		/* from modes.c */
-#endif
 
 /* Declare the ident variables - even if HAVE_RFC1413 is not defined, so that configs
  * can be kept consistant
@@ -97,6 +95,7 @@
 static int verify_sender(char *, char *, FILE *);
 static int verify_addr(char *, FILE *, int);
 static char *verify_host(char *, struct sockaddr_in *, struct hostent*, char const **);
+static int check_vixie_rbl(struct sockaddr_in *);
 static void smtp_input_signals(void);
 static void smtp_processing_signals(void);
 static void set_term_signal(int);
@@ -112,6 +111,7 @@
 static int verify_sender();
 static int verify_addr();
 static char *verify_host();
+static int check_vixie_rbl();
 static void smtp_input_signals();
 static void smtp_processing_signals();
 static void set_term_signal();
@@ -202,6 +202,7 @@
     int temp, i, c;
     char *rest;
     int ehlo_p = 0;
+    int smtp_denied_by_rbl = FALSE;
     long accepted_msg_size = max_message_size;
 #ifdef HAVE_BSD_NETWORKING
     struct sockaddr_in from_sa;
@@ -353,6 +354,19 @@
     }
 #endif /* HAVE_RFC1413 */
 
+#ifdef HAVE_BSD_NETWORKING
+    /*
+     * check incoming IP against Vixie RBL database. (Don't bother if we've
+     * already denied the session, say from libwrap.)
+     */
+    if (out && vixie_rbl && !smtp_session_denied) {
+        if (check_vixie_rbl(&from_sa)) {
+	    smtp_session_denied = TRUE;
+	    smtp_denied_by_rbl = TRUE;
+	}
+    }
+#endif /* HAVE_BSD_NETWORKING */
+
     while (! term_signal || out == NULL) {
 	char *orig_data = NULL;
 
@@ -365,9 +379,9 @@
 	    sender_proto = (out? "esmtp": "ebsmtp");
 	    /* FALLTHRU */
 	case HELO_CMD:
-#ifdef HAVE_LIBWRAP
 	    if (out && smtp_session_denied) {
-		fprintf(out, "550 You are not permitted to send mail\r\n");
+		fprintf(out, "550 You are not permitted to send mail%s.\r\n",
+			smtp_denied_by_rbl ? "-- see http://maps.vix.com/rbl" : "");
 		fflush(out);
 		write_log(LOG_SYS, "remote %s: refusing SMTP connection from %s%s%s%s%s.",
 			  ehlo_p ? "EHLO" : "HELO",
@@ -377,7 +391,6 @@
 			  sender_host_addr ? "]" : "");
 		break;
 	    }
-#endif
 	    orig_data = COPY_STRING(data);
 	    strip_rfc822_comments(data); /* XXX not required by RFC 821 */
 	    if (out) {
@@ -490,15 +503,15 @@
 	    break;
 
 	case MAIL_CMD:
-#ifdef HAVE_LIBWRAP
 	    if (out && smtp_session_denied) {
-		fprintf(out, "550 You%s%s%s are not permitted to send mail%s%s%s.\r\n",
+		fprintf(out, "550 You%s%s%s are not permitted to send mail%s%s%s%s.\r\n",
 			sender_host_really ? " (" : "",
 			sender_host_really ? sender_host_really : "",
 			sender_host_really ? ")" : "",
 			sender_host_addr ? "from [" : "",
 			sender_host_addr ? sender_host_addr : "",
-			sender_host_addr ? "]" : "");
+			sender_host_addr ? "]" : "",
+			smtp_denied_by_rbl ? "-- see http://maps.vix.com/rbl" : "");
 		fflush(out);
 		write_log(LOG_SYS, "remote MAIL FROM: '%s' refusing SMTP connection from %s%s%s%s%s%s%s%s%s%s",
 			  data, ident_sender ? ident_sender : "", ident_sender ? "@" : "",
@@ -511,7 +524,6 @@
 			  sender_host_addr ? "]" : "");
 		break;
 	    }
-#endif
 	    orig_data = COPY_STRING(data);
 	    strip_rfc822_comments(data);
 	    if (out && data[0] == '\0') {
@@ -675,15 +687,15 @@
 	    break;
 
 	case RCPT_CMD:
-#ifdef HAVE_LIBWRAP
 	    if (out && smtp_session_denied) {
-		fprintf(out, "550 You%s%s%s are not permitted to send mail%s%s%s.\r\n",
+		fprintf(out, "550 You%s%s%s are not permitted to send mail%s%s%s%s.\r\n",
 			sender_host_really ? " (" : "",
 			sender_host_really ? sender_host_really : "",
 			sender_host_really ? ")" : "",
 			sender_host_addr ? "from [" : "",
 			sender_host_addr ? sender_host_addr : "",
-			sender_host_addr ? "]" : "");
+			sender_host_addr ? "]" : "",
+			smtp_denied_by_rbl ? "-- see http://maps.vix.com/rbl" : "");
 		fflush(out);
 		write_log(LOG_SYS, "remote MAIL TO: '%s' refusing SMTP connection from %s%s%s%s%s%s%s%s%s%s",
 			  data, ident_sender ? ident_sender : "", ident_sender ? "@" : "",
@@ -696,7 +708,6 @@
 			  sender_host_addr ? "]" : "");
 		break;
 	    }
-#endif
 	    orig_data = COPY_STRING(data);
 	    strip_rfc822_comments(data);
 	    if (out && data[0] == '\0') {
@@ -858,15 +869,15 @@
 	    break;
 
 	case EXPN_CMD:
-#ifdef HAVE_LIBWRAP
 	    if (out && smtp_session_denied) {
-		fprintf(out, "550 You%s%s%s are not permitted to view lists%s%s%s.\r\n",
+		fprintf(out, "550 You%s%s%s are not permitted to view lists%s%s%s%s.\r\n",
 			sender_host_really ? " (" : "",
 			sender_host_really ? sender_host_really : "",
 			sender_host_really ? ")" : "",
 			sender_host_addr ? "from [" : "",
 			sender_host_addr ? sender_host_addr : "",
-			sender_host_addr ? "]" : "");
+			sender_host_addr ? "]" : "",
+			smtp_denied_by_rbl ? "-- see http://maps.vix.com/rbl" : "");
 		fflush(out);
 		write_log(LOG_SYS, "remote EXPN: '%s' refusing SMTP connection from %s%s%s%s%s%s%s%s%s%s",
 			  data, ident_sender ? ident_sender : "", ident_sender ? "@" : "",
@@ -879,7 +890,6 @@
 			  sender_host_addr ? "]" : "");
 		break;
 	    }
-#endif
 	    if (out) {
 #ifdef NO_SMTP_EXPN			/* XXX should be a variable ala smtp_debug */
 		fprintf(out, "502 Command not implemented\r\n");
@@ -923,15 +933,15 @@
 	    break;
 
 	case DEBUG_CMD:
-#ifdef HAVE_LIBWRAP
 	    if (out && smtp_session_denied) {
-		fprintf(out, "550 You%s%s%s are not permitted to use this command%s%s%s.\r\n",
+		fprintf(out, "550 You%s%s%s are not permitted to use this command%s%s%s%s.\r\n",
 			sender_host_really ? " (" : "",
 			sender_host_really ? sender_host_really : "",
 			sender_host_really ? ")" : "",
 			sender_host_addr ? "from [" : "",
 			sender_host_addr ? sender_host_addr : "",
-			sender_host_addr ? "]" : "");
+			sender_host_addr ? "]" : "",
+			smtp_denied_by_rbl ? "-- see http://maps.vix.com/rbl" : "");
 		fflush(out);
 		write_log(LOG_SYS, "remote DEBUG: '%s' refusing SMTP connection from %s%s%s%s%s%s%s%s%s%s",
 			  data, ident_sender ? ident_sender : "", ident_sender ? "@" : "",
@@ -944,7 +954,6 @@
 			  sender_host_addr ? "]" : "");
 		break;
 	    }
-#endif
 	    if (out) {
 #ifndef NODEBUG
 		if (smtp_debug) {
@@ -1505,6 +1514,45 @@
 
 
 #ifdef HAVE_BSD_NETWORKING
+/*
+ * Check incoming IP address a.b.c.d against the Vixie RBL to see if sender
+ * is a known spam site.  We do this via a DNS query of 
+ * "d.c.b.a.rbl.maps.vix.com"
+ */
+static int
+check_vixie_rbl(saddrp)
+    struct sockaddr_in *saddrp;
+{
+    struct hostent *hp;
+    char p[64]; /* Note: query string can never be > 32 chars. */
+    unsigned char a,b,c,d;
+    unsigned char *p2;
+
+    /* Check against override list -- if IP is on the list, allow regardless. */
+    if (vixie_rbl_force_allow &&
+	match_ip(inet_ntoa(saddrp->sin_addr), vixie_rbl_force_allow)) return 0;
+
+    /* break addr. up into bytes. code inspired by FreeBSD inet_ntoa.c */
+    p2 = (unsigned char *)&saddrp->sin_addr.s_addr;
+    a = p2[0];
+    b = p2[1];
+    c = p2[2];
+    d = p2[3];
+
+    /* now construct string to look up. */
+    sprintf(p, "%u.%u.%u.%u.rbl.maps.vix.com", d, c, b, a);
+    /* if the lookup fails, assume host is allowed. */
+    if (!(hp = gethostbyname(p))) {
+        /* lookup failed, return 0 for no deny. */
+        DEBUG1(DBG_REMOTE_LO, "check_vixie_rbl(): %s not found.\n", p);
+        return 0;
+    }
+    DEBUG1(DBG_REMOTE_LO, "check_vixie_rbl(): %s found in RBL.\n", p);
+    /* Log it in the log as well. */
+    write_log(LOG_SYS, "check_vixie_rbl(): RBL blocked conn from %u.%u.%u.%u.\n", a, b, c, d);
+    return 1;
+}
+    
 /*
  * verify_host - verify the sender hostname in the DNS
  *
--- ../man/man5/smailconf.an	1997/12/29 00:56:53	1.2
+++ ../man/man5/smailconf.an	1997/12/29 01:06:51
@@ -1172,6 +1172,23 @@
 .Sp
 For compatibility with earlier versions of smail3.1, the \fBdomains\fR
 list can also be specified as \fBvisible_domains\fR.
+.Ip "\fIvixie_rbl\fR" 4
+type: \fIboolean\fR
+.Sp
+default value: \fIoff\fR
+.Sp
+This flag tells smail to look up the address of each incoming connection in
+the Vixie Realtime Blocking List (\fBhttp://maps.vix.com/rbl\fR).  If the 
+remote host's IP address is on the list, smail will refuse to talk to the
+host.
+.Ip "\fIvixie_rbl_force_allow\fR" 4
+type: \fIstring\fR
+.Sp
+default value: \fInone\fR
+.Sp
+A colon-separated list of host IP patterns that are allowed to deliver 
+mail even if they are on the Vixie RBL, thus allowing the local administrator
+to override the Vixie RBL if needed.
 .\"
 .SH "FILES"
 .Ip "\fIX_LIB_DIR_X/config\fR" 4
>Audit-Trail:

State-Changed-From-To: open-closed
State-Changed-By: woods
State-Changed-When: Sun Oct 25 20:21:55 1998
State-Changed-Why:

I'm going to include your patch (or rather a copy of this PR) in the
contrib sub-directory along with Jim Mercer's similar patch.

Even though direct support of features like the RBL affords better error
reporting, I'd much rather avoid adding too many new features to smail
before the next release.

The patch I created to add RBL-stle blocking to TCP Wrappers also offers
the second feature of your patch (i.e. the implementation of exceptions
to the RBL), and since it doesn't require further changes to smail I'm
going to leave it as the recommended approach until after 3.2.1.

>Unformatted:

