summaryrefslogtreecommitdiffstats
path: root/libexec/spamd (follow)
Commit message (Collapse)AuthorAgeFilesLines
* By now we are already confident that pledge(2) "just works(tm)" and that it canmestre2019-08-061-10/+1
| | | | | | | | | | | be used to effectively remove filesystem access. That being said, in spamd(8) when I pledge(2)d it the main priv process got "stdio inet" which means there's no fs access at all so calling chroot(2)/chdir(2) here doesn't get us any additional protection. Just remove them. OK deraadt@ and no objections from schwarze@
* Ever since I introduced pledge(2) on spamd(8) the chroot'ed process, if runningmestre2019-07-241-16/+2
| | | | | | | | | | in default, cannot get anywhere near the filesystem since its only promises are "stdio inet". Furthermore, in blacklist mode this same codepath is not chroot'ed but once again it gets the same pledge(2). Therefore we can remove the BUGS section from spamd(8)'s manpage. OK millert@ deraadt@
* When system calls indicate an error they return -1, not some arbitraryderaadt2019-06-281-2/+2
| | | | | | value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
* I am retiring my old email address; replace it with my OpenBSD one.millert2019-01-251-1/+1
|
* When spamd(8) runs in greylist mode in the parent process (which runsmestre2018-10-251-1/+13
| | | | | | | | greywatcher()) we know that the only files that it will ever access are PATH_SPAMD_DB in rw mode, alloweddomains_file in r and that it will need to execute PATH_PFCTL so we can unveil(2) them with those permissions. OK deraadt@ millert@ beck@
* More "explicitely" -> "explicitly" in various comments.krw2018-10-221-2/+2
| | | | ok guenther@ tb@ deraadt@
* nuke trailing whitespacebeck2018-04-261-3/+3
|
* Make blacklist entries override the whitelist. When running spamdmillert2017-10-184-17/+133
| | | | | | | | in greylisting mode, it is not uncommon for an IP to get whitelisted before it shows up on a spam blacklist. With this change, spamd will check its blacklists before adding a WHITE entry to the <spamd-white> pf table. If the IP matches a blacklist, the WHITE entry will be removed. OK phessler@
* Use a binary search to speed up blacklist lookups. OK phessler@millert2017-10-172-38/+132
|
* Check for asprintf() returning -1 instead of assuming that themillert2017-10-121-2/+3
| | | | pointer will remain unchanged when fails. OK deraadt@
* fix missing \ on \n, spotted by Edgar Pettijohnbeck2017-04-061-2/+2
|
* note that some hosts never generate tuples and are ignored;jmc2017-04-021-2/+4
| | | | ok beck
* define the role of spamd-setup a little better;jmc2017-03-161-5/+7
|
* use one way to show filter rules, not two. the bits and pieces of thejmc2017-03-161-5/+3
| | | | | | spamd setup are complex enough without freestyling the pf rules; while here, Bk/Ek no longer required
* check EAGAIN in the correct place,beck2017-01-231-3/+3
| | | | noticed and ok phessler@
* Switch spamd to nonblocking descriptors so we can count on getting abeck2017-01-231-2/+9
| | | | | short write when the socket buffers are full, instead of blocking. ok benno@ claudio@
* - spamd(8)'s -l accepts an IP address as argument to bind(2) and it callsmestre2017-01-171-11/+17
| | | | | | | | | | | | | | | | | inet_pton(3) to check if it's valid and since that function doesn't provide a proper errno (POSIX doesn't mandate to do so) then if a string is given we may get this message: spamd: inet_pton: Undefined error: 0 - Instead replace that code to use getaddrinfo(3) from which is possible to get a proper error message, and at the same time being able to parse IPs and hostnames (if either the IP or host is not local then the next bind(2) will fail) - By default without arguments, spamd(8) will still bind(2) to 127.0.0.1 as it did before With feedback from deraadt@ and OK beck@
* Check return value of tls_config_set_protocols(3) and bail out in case ofmestre2016-11-301-2/+3
| | | | | | failure Feedback and OK jsing@
* Remove redundant & when clearing hostname variable, as per otto@'s requestmestre2016-11-081-2/+2
|
* Replace bzero(3) with memset(3)mestre2016-11-071-2/+2
| | | | OK deraadt@
* - Remove useless var assignmentmestre2016-10-202-20/+18
| | | | | | | | - Use memset(*b, 0, len) instead of bzero(*b, len) - Use memcpy(*dst, *src, len) instead of bcopy(*src, *dst, len) - Use explicit_bzero(3) instead of bzero(3) to clean temporary HMAC Remarks from deraadt@ (duly noted!!), reviewed and OK by henning@ and tb@
* must close our fd unconditionally and not just in the !TLS case; tls_closehenning2016-09-061-3/+3
| | | | | | | | | doesn't do that for us. found, analyzed and patch supplied by Martin Proyer <martin at proyer dot net>, many thanks! ok bcook funny since I just discussed a somewhat mysterious spamd-TLS issue with bob and brent over breakfast yesterday in cambridge - not sure it is this one, if it is I've been intensively digging in the wrong corner, almost "missing the obvious"
* Adjust existing tls_config_set_cipher() callers for TLS cipher groupjsing2016-07-131-2/+2
| | | | | | | changes - map the previous configuration to the equivalent in the new groups. This will be revisited post release. Discussed with beck@
* tyopjca2016-05-171-2/+2
|
* Remove pledge(2)'s that are called before chroot(2) since in the near futuremestre2016-04-271-4/+1
| | | | | | | this will be forbidden. The remaining pledge(2) calls after chroot(2) are still kept. OK semarie@ "it is time now"
* per rfc, ehlo responses contain hostname, then options. from dyn+bsdtedu2016-04-101-2/+4
|
* - Both checks for pw are not needed since it was already done at the start ofmestre2016-03-252-16/+11
| | | | | | | | the program - Add error message to syslog if privdrop didn't succeed and then exit - Remove lint comments OK beck@ after his suggestion and also looks good to jca@
* - add a define for "_spamd" user like others OpenBSD daemons;gsoares2016-03-101-5/+14
| | | | | | | | - check for root privileges, otherwise exit early with an appropriate status code and a formatted string; - be more specific with chroot()/chdir() checks. OK beck@
* Remove NULL-checks before free(). ok tb@mmcc2015-12-121-5/+3
|
* tighten the pledge for spamd, from Ricardo Mestre <serial@helheim.mooo.com>beck2015-12-102-28/+42
| | | | | this loads the tls certificate files pre-pledge then does the bulk of the tls setup goo pledged.
* Initially pledge spamdbeck2015-12-082-17/+27
| | | | All the work done by Ricardo Mestre <serial@helheim.mooo.com> - Thanks.
* adjust to newer tls_read/_write semantics.henning2015-12-051-21/+53
| | | | | | | quite involved, due to tls_read potentially needing to write and tls_write potentially needing to read (in the reneg case); that not fitting the spamd model too well - it needs to keep a little more state. help & ok bluhm & beck
* in response to EHLO, don't offer STARTTLS if we already completed thehenning2015-12-021-2/+3
| | | | STARTTLS dance. ok millert
* I misread the standard when adding TLS; clients are supposed to start overhenning2015-12-021-2/+2
| | | | | | and issue a new EHLO after STARTTLS. The misunderstaning seems to be common, so we'll still grok MAIL FROM right after the STARTTLS dance, as well as accepting a second EHLO. ok phessler beck millert
* fix error messages to say tls_write after tls_write and not tls_read...henning2015-12-021-3/+4
| | | | with bluhm
* Document that the pfdev check for 63 is /dev/fd/ only contains those nodesderaadt2015-11-291-1/+4
|
* read, tls_read, and tls_write return ssize_tbeck2015-09-101-3/+3
| | | | jointly with jsing@
* fix after libtls api changesbeck2015-09-101-12/+17
| | | | ok jsing@
* start replacing some \*([GL]t;jmc2015-08-121-13/+9
|
* divert-to a table needs an address family;jmc2015-08-121-3/+3
| | | | | | from steve shockley ok sthen
* use file system path (.Pa) semantic markup macros where appropriate.sobrado2015-07-271-6/+6
| | | | ok jmc@
* Change spamd to use divert-to instead of rdr-to.reyk2015-05-184-105/+18
| | | | | | | | | | | | | | | | | | | | | divert-to has many advantages over rdr-to for proxies. For example, it is much easier to use, requires less code, does not depend on /dev/pf, works in-band without the asynchronous lookup (DIOCNATLOOK ioctl), saves us from additional port allocations by the rdr/NAT code, and even avoids potential collisions and race conditions that could theoretically happen with the lookup. Heads up: users will have to update their spamd PF rules from rdr-to to divert-to. spamd now also listens to 127.0.0.1 instead of "any" (0.0.0.0) by default which should be fine with most setups but has to be considered for some special configurations. Based on a diff is almost two years old but got delayed several times ... beck@: "now is the time to get it in" :) Tested by many With help from okan@ OK okan@ beck@ millert@
* Convert many atoi() calls to strtonum(), adding range checks and failurederaadt2015-04-181-18/+15
| | | | | handling along the way. Reviews by Brendan MacDonell, Jeremy Devenport, florian, doug, millert
* wrap a long linederaadt2015-04-141-4/+4
|
* Use poll(2) instead of select(2). A pointer to the struct pollfdmillert2015-03-121-97/+103
| | | | | is embedded in each struct con so the descriptors can't get out of sync with the pfd[] array. OK deraadt@
* Set the TLS ciphers to "compat" mode, restoring the previous behaviour.jsing2015-02-221-2/+5
|
* Don't use Aq macros when <> is intended; they are not the same thing.bentley2015-02-151-7/+7
| | | | ok schwarze@
* Change TLS_PROTOCOLS_DEFAULT to be TLSv1.2 only. Add a TLS_PROTOCOLS_ALLjsing2015-02-121-1/+3
| | | | | | | | that includes all currently supported protocols (TLSv1.0, TLSv1.1 and TLSv1.2). Change all users of libtls to use TLS_PROTOCOLS_ALL so that they maintain existing behaviour. Discussed with tedu@ and reyk@.
* put -G and it's args back onto one line in SYNOPSIS, to avoid having mandocjmc2015-02-071-7/+4
| | | | split it; while here, zap trailing whitespace;
* add STARTTLS support, using the shiny libtls.henning2015-02-073-17/+135
| | | | | | | | | | | | Rationale: when you publish DANE records for certificate pinning, you MUST offer TLS on the indicated service. Not offering TLS is verboten since that would re-open the door for a MitM. This is obviously fundamentally incompatible with having spamd in front of your mailservers - spamd kinda is a MitM here, but intentional and utterly valid. DANE is desirable because it allows one to not have to trust the broken SSL CA model, and, depending on the mode chosen, even show the SSL cert mafia the middle finger by not needing them at all. ok reyk jsing bob
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.