milter-limit/0.16
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| text!/path/map.txt | R/O text file, memory hash |
| /path/map.db | Berkeley DB hash format |
| db!/path/map.db | Berkeley DB hash format |
| db!btree!/path/map.db | Berkeley DB btree format |
| sql!/path/database | An SQLite3 database |
| socketmap!host:port | Sendmail style socket-map |
| socketmap!/path/local/socket | Sendmail style socket-map |
| socketmap!123.45.67.89:port | Sendmail style socket-map |
| socketmap![2001:0DB8::1234]:port | Sendmail style socket-map |
If :port is omitted, the default is 7953.
The access-db contains key-value pairs. Lookups are performed from most to least specific, stopping on the first entry found. Keys are case-insensitive.
An IPv4 lookup is repeated several times reducing the IP address by one octet from right to left until a match is found.
tag:192.0.2.9 tag:192.0.2 tag:192.0 tag:192
An IPv6 lookup is repeated several times reducing the IP address by one 16-bit word from right to left until a match is found.
tag:2001:0DB8:0:0:0:0:1234:5678 tag:2001:0DB8:0:0:0:0:1234 tag:2001:0DB8:0:0:0:0 tag:2001:0DB8:0:0:0 tag:2001:0DB8:0:0 tag:2001:0DB8:0:0 tag:2001:0DB8:0 tag:2001:0DB8 tag:2001
A domain lookup is repeated several times reducing the domain by one label from left to right until a match is found.
tag:[ipv6:2001:0DB8::1234:5678] tag:[192.0.2.9] tag:sub.domain.tld tag:domain.tld tag:tld tag:
An email lookup is similar to a domain lookup, the exact address is first tried, then the address's domain, and finally the local part of the address.
tag:account@sub.domain.tld tag:sub.domain.tld tag:domain.tld tag:tld tag:account@ tag:
If a key is found and is a milter specific tag (ie. milter-limit-Connect, milter-limit-From, milter-limit-Auth, milter-limit-To), then the value is processed as a pattern list and the result returned. A pattern list is a whitespace separated list of pattern-limit pairs followed by an optional default limit. The supported patterns are:
[network/cidr]limit Classless Inter-Domain Routing !pattern!limit Simple fast text matching. /regex/limit POSIX Extended Regular Expressions
The CIDR will only ever match for IP address related lookups.
A !pattern! uses an astrisk (*) for a wildcard, scanning over zero or more characters; a question-mark (?) matches any single character; a backslash followed by any character treats it as a literal (it loses any special meaning).
!abc! exact match for 'abc' !abc*! match 'abc' at start of string !*abc! match 'abc' at the end of string !abc*def! match 'abc' at the start and match 'def' at the end, maybe with stuff in between. !*abc*def*! find 'abc', then find 'def'
For black-white lookups, the following actions are recognised: OK or RELAY (white list), REJECT or ERROR (black list), DISCARD (accept & discard), SKIP or DUNNO (stop lookup, no result), and NEXT (opposite of SKIP, resume lookup). Its possible to specify an empty action after a pattern, which is treated like SKIP returning an undefined result. Other options may specify other actions.
Below is a list of supported tags. Other options may specify additional tags.
milter-limit-Connect:client-ip limit § Can be a pattern list. milter-limit-Connect:[client-ip] limit § Can be a pattern list. milter-limit-Connect:client-domain limit § Can be a pattern list. milter-limit-Connect: limit § Can be a pattern list. Specify the number of messages a connected client-ip, unresolved client-ip address, or IP addresses that resolve to a client-domain may send. See below concerning the format of limit. milter-limit-Rcpt-Connect:client-ip number § Can be a pattern list. milter-limit-Rcpt-Connect:[client-ip] number § Can be a pattern list. milter-limit-Rcpt-Connect:client-domain number § Can be a pattern list. milter-limit-Rcpt-Connect: number § Can be a pattern list. Specify the maximum number of recipients per message a connected client-ip, unresolved client-ip address, or IP addresses that resolve to a client-domain may address. Specify -1 to allow for an unlimited number of recipients (subject to sendmail's global limit). milter-limit-Rcpt-Connect: has the lowest precedence of the milter-limit-Rcpt-*: tags. milter-limit-From:sender-address limit § Can be a pattern list. milter-limit-From:sender-domain limit § Can be a pattern list. milter-limit-From:sender@ limit § Can be a pattern list. milter-limit-From: limit § Can be a pattern list. Specify the number of messages the sender-address, sender-domain, or that begins with sender may send. In the case of a +detailed email address, the left hand side of the +detail is used for the sender@ lookup. See below concerning the format of limit. milter-limit-Rcpt-From:sender-address number § Can be a pattern list. milter-limit-Rcpt-From:sender-domain number § Can be a pattern list. milter-limit-Rcpt-From:sender@ number § Can be a pattern list. milter-limit-Rcpt-From: number § Can be a pattern list. Specify the maximum number of recipients per message the sender-address, sender-domain, or that begins with sender may address. In the case of a +detailed email address, the left hand side of the +detail is used for the sender@ lookup. Specify -1 to allow for an unlimited number of recipients (subject to sendmail's global limit). milter-limit-Rcpt-From: has higher precedence than milter-limit-Rcpt-Connect: and lower than milter-limit-Rcpt-Auth: milter-limit-To:recipient-address limit § Can be a pattern list. milter-limit-To:recipient-domain limit § Can be a pattern list. milter-limit-To:recipient@ limit § Can be a pattern list. milter-limit-To: limit § Can be a pattern list. Specify the number of messages the recipient-address, recipient-domain, or that begins with recipient may recieve. In the case of a +detailed email address, the left hand side of the +detail is used for the recipient@ lookup. See below concerning the format of limit. milter-limit-Auth:auth_authen limit § Can be a pattern list. milter-limit-Auth: limit § Can be a pattern list. Specify the number of messages the authenticated sender, as given by sendmail's {auth_authen} macro, may send. The string searched by the pattern list will be the sender-address. The empty form of milter-limit-Auth: allows for a milter specific default only when {auth_authen} is defined. See below concerning the format of value.milter-limit-Rcpt-Auth:auth_authen number § Can be a pattern list. milter-limit-Rcpt-Auth: number § Can be a pattern list. Specify the maximum number of recipients per message the authenticated sender, as given by sendmail's {auth_authen} macro, may address. The string searched by the pattern list will be the sender-address. The empty form of milter-limit-Auth: allows for a milter specific default only when {auth_authen} is defined. Specify -1 to allow for an unlimited number of recipients (subject to sendmail's global limit). milter-limit-Rcpt-Auth: has the highest precedence of the milter-limit-Rcpt-*: tags.
The limit is
messages '/' time [unit]where messages is the number of messages allowed in a given time interval and time is a number with an optional time unit specifier. Without the unit specifier, the value time is in seconds. The unit specifier can be one of week, day, hour, minute, or seconds (note only the first letter is significant). Its possible to disable message limits by specifying a negative number for messages.
milter-limit-Connect:80.94 [80.94.96.0/20]-1/1 500/3d All the mail from netblock 80.94.96.0/20 (80.94.96.0 through to 80.94.111.255) have no message limit, while anything else in 80.94.0.0/16 is limited to 500 for every 3 days milter-limit-Connect:192.0.2 100/1h All the mail from the network in 192.0.2.0/24 is limited to 100 messages per hour. milter-limit-Connect:192.0.2 /^192\.0\.2\.8[0-9]/100/1h 50/1h Mail sent from IP addresses 192.0.2.80 through to 192.0.2.89 is limited to 100 per hour, while the rest of the network in 192.0.2.0/24 is limited to 50 per hour.
This example is rather contrived to show some of what is possible with patterns and is the equivalent of ten simple milter-limit-connect: entries. When using patterns, weigh the need vs. simplicity, readability, and administration.milter-limit-From:example.com /^[^+]+@/100/1d Mail from within example.com, where the sender's address does not contain a plus-detail, is limited to 100 messages per day, otherwise no limit is imposed. milter-limit-To:example.net !*+*@*! /^[0-9].*/10/20m !*smith*@*!100/2w 200/1d Mail to addresses within example.net containing a plus-detail have no limit; those starting with a digit are limited to 10 messages every 20 minutes; mail to anyone with "smith" as part of their address is limited to 100 every two weeks, while the rest of the domain is limited to 200 per day.
bdb,
flatfile, hash.
milter-limit.
Typically a unix named socket or a host:port. This value must match the value specified for
the INPUT_MAIL_FILTER() macro in the sendmail.mc file. The accepted syntax is:
{unix|local}:/path/to/file- A named pipe. (default)
inet:port@{hostname|ip-address}- An IPV4 socket.
inet6:port@{hostname|ip-address}- An IPV6 socket.
none Do nothing. tag Tag the message subject. See subject-tag. quarantine Quarantine the message. See sendmail's queue management options -qQ and -Q. later Temporary rejection of the message. The server should try again later. reject Reject the message (default). discard Discard the message.
kill -QUIT `cat /var/run/milter/milter-limit.pid`milter-limit-auth: tag (access-db=)
for finer granularity of control.
§ all All messages § 0 Log nothing. § info General info messages. (default) § trace Trace progress through the milter. § parse Details from parsing addresses or special strings. debug Lots of debug messages. dialog I/O from Communications dialog state State transitions of message body scanner. dns Trace & debug of DNS operations § cache Cache get/put/gc operations. § database Sendmail database lookups. socket-fd Socket open & close calls socket-all All socket operations & I/O § libmilter libmilter engine diagnostics
SMTP Responses
This is the list of possible SMTP responses generated by milter-limit.
- 553 5.1.0 imbalanced angle brackets in path
- The path given for a MAIL or RCPT command is missing a closing angle bracket
- 553 5.1.0 address does not conform to RFC 2821 syntax
- The address is missing the angle brackets, < and >, as required by the RFC grammar.
- 553 5.1.0 local-part too long
- The stuff before the @ is too long.
- 553 5.1.[37] invalid local part
- The stuff before the @ sign contains unacceptable characters.
- 553 5.1.0 domain name too long
- The stuff after the @ is too long.
- 553 5.1.7 address incomplete
- Expecting a domain.tld after the @ sign and found none.
- 553 5.1.[37] invalid domain name
- The domain after the @ sign contains unacceptable characters.
- 450 4.7.1 [^ ]+ has exceeded [0-9]+ message%s per [0-9]+ [a-z]+
- The connecting client IP, sender, or recipient named has exceeded a set message limit.
Installation
Download:
milter-limit/0.16 md5sum Change Log LibSnert md5sum Change Log Sendmail 8.13 http://www.sendmail.org/ Berkeley DB http://www.sleepycat.com/ -
In order to support B/W lists
milter-limitrequires Berkeley DB 3 or better. If you do not require support for Sendmail's access database, skip this step.You should build and install Berkeley DB library first, if you do not already have it. Please read the Berkeley DB documentation on how to build the library. Briefly, it should be something like this:
cd (path to)/db-4.3.27/build_unix ../dist/configure make make install
If your system is Linux and you install Berkeley DB in the default, non- standard, location then you must remember to update
/etc/ld.so.confand runldconfig. You can change the default install location by specifying the../dist/configureoption--prefix=/usr/localfor example.-
Note that Sendmail will probably have to be rebuilt to use Berkeley DB, especially if the library was never installed and/or Sendmail was built against an older version of Berkeley DB. Please see the Sendmail documentation as to how this is done. The following is a brief outline, however be sure to read
devtools/README,devtools/Site/README, and "Using Berkeley DB with Sendmail" for details on how to configure the Sendmail build process. Outline of stepscd (path to)/sendmail-8.13.4 vi devtools/Site/site.config.m4 sh Build -c sh Build install
-
If you have never built a milter for Sendmail, then please make sure that you build and install
libmilter, which is not built by default when you build Sendmail. Please read thelibmilterdocumentation. Briefly, it should be something like this:cd (path to)/sendmail-8.13.4/libmilter sh Build -c sh Build install
-
The build process for
libsnertandmilter-limitis pretty straight forward once you havelibmilterinstalled:cd (path to)/com/snert/src/lib ./configure make build cd ../milter-limit ./configure make build make install
Both configuration scripts have some options that allow you to override defaults. Those options are listed with:
./configure --help
-
An example
/usr/local/share/examples/milter-limit/milter-limit.mcis supplied. This file should be reviewed and the necessary elements inserted into your Sendmail.mcfile andsendmail.cfrebuilt. Please note the comments on the general milter flags. -
Once installed and configured, start
milter-limitand then restart Sendmail. An example startup script is provided in/usr/local/share/examples/milter-limit/milter-limit.sh. The default options can be altered by specifying them on the command-line or within a/etc/mail/milter-limit.cf. Themilter-limit.cfis parsed first followed by the command-line options.
Notes
Currently tested platforms:
Cobalt Qube 1 with Linux RH 5.1 (mips 2.0.34 kernel);Linux RH 5.1 (Intel x386 2.2.25 kernel);FreeBSD 4.8, 4.9 (Intel x386);OpenBSD 3.6 (Intel x386)Currently SMTP+AUTH authenticated messages are allowed to by-pass the milter.
-
The minimum desired file ownership and permissions are as follows for a typical Linux system. For FreeBSD, NetBSD, and OpenBSD the binary and cache locations may differ, but have the same permissions.
Process user ``milter'' is primary member of group ``milter'' and secondary member of group ``smmsp''. Note that the milter should be started as root, so that it can create a .pid file and .socket file in /var/run; after which it will switch process ownership to milter:milter before starting the accept socket thread.
/etc/mail/ root:smmsp 0750 drwxr-x--- /etc/mail/access.db root:smmsp 0640 -rw-r----- /etc/mail/sendmail.cf root:smmsp 0640 -rw-r----- /etc/mail/milter-limit.cf root:root 0644 -rw-r--r-- /var/run/milter/milter-limit.pid milter:milter 0644 -rw-r--r-- /var/run/milter/milter-limit.socket milter:milter 0644 srw-r--r-- /var/db/milter-limit milter:milter 0644 -rw-r--r-- (*BSD) /var/cache/milter-limit milter:milter 0644 -rw-r--r-- (linux) /usr/local/libexec/milter-limit root:milter 0550 -r-xr-x--- I would like to express my thanks to Derek Balling for his support at http://www.milter.org/.
License Agreement 1.8
SNERTSOFT & CO. ARE WILLING TO LICENSE THE SOFTWARE IDENTIFIED ABOVE TO YOU ONLY UPON THE CONDITION THAT YOU ACCEPT ALL OF THE TERMS CONTAINED IN THIS LICENSE AGREEMENT. PLEASE READ THE AGREEMENT CAREFULLY. BY DOWNLOADING OR INSTALLING THIS SOFTWARE, YOU ACCEPT THE TERMS OF THE AGREEMENT.
Definitions
``Package'' means the identified above in source and/or binary form, any other machine readable materials provided (including, but not limited to documentation, sample files, data files), any updates or error corrections, and its derivative works.
``Organisation'' means a legal entity or an individual.
``You'' (or ``Your'') means an Organisation exercising rights under, and complying with all of the terms of, this License or a future version of this License issued under Section 6.1. For legal entities, ``You'' includes any entity which controls, is controlled by, or is under common control with You. For purposes of this definition,``control'' means (a) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (b) ownership of more than fifty percent (50%) of the outstanding shares or beneficial ownership of such entity.
``SnertSoft'' means Anthony C. Howe situated in Cannes, France (SIRET #489 259 937 00014).
``SnertSoft & Co.'' means SnertSoft and all authorised & licensed partners, such as value-added resellers or appliance manufacturers.
Statement of Original Work
The Package is an original work written by SnertSoft, with exception of following third party code:
MD5 routines written by L. Peter Deutsch, based on RFC 1321;
SQLite3 package is written by D. Richard Hipp of Hwaci and is in the public domain.
strnatcmp.c is written by Martin Pool of sourcefrog.net and has a BSD style license.
Protothreads headers originally written by Adam Dunkels and has a BSD style license.
License To Use
You may install and use this Package, without modifications, exclusively on machines for which You have purchased a license, provided You retain this notice, SnertSoft's copyright notice, any and all license control methods (see below), and any links within the Package back to the most current online versions of this License and Disclaimer.
You may copy, share, distribute, modify, and create derivative works from the user manuals and any related documentation solely for Your internal business purposes, such as in-house documentation, training manuals, or reference material.
Restrictions
Redistribution, including but not limited to books, CDROMS, download mirrors, floppy diskettes, hard disks, hardcopy print outs, online archives, solid state disks, streaming tapes, or other current or future forms of storage or communication media of the Package, with or without modifications, including any and all derivative works such as source patches, binaries, binary patches, or similar is expressly forbidden without prior written permission in hardcopy (ie. letter or fax) signed and dated by SnertSoft.
It is expressly forbidden for You to use the Package, in whole or in part, in any other software or appliance without prior written permission in hardcopy (ie. letter or fax) signed and dated by SnertSoft.
It is expressly forbidden for You to use the Package to develop any software or other technology having the same primary function as the Package, including but not limited to using the Package in any development or test procedure that seeks to develop like software or other technology, or determine if such software or other technology performs in a similar manner as the Package.
You may not sell, rent, lease, or transfer the Package to third parties without prior written permission in hardcopy (ie. letter or fax) signed and dated by SnertSoft.
Termination
This Agreement is effective until terminated. You may terminate this Agreement at any time by destroying all copies of the Package.
This Agreement will terminate immediately without notice from SnertSoft if You fail to comply with any provision of this Agreement.
Either party may terminate this Agreement immediately should any portion of the Package become, or in either party's opinion be likely to become, the subject of a claim of infringement of any intellectual property right. Upon Termination, You must destroy all copies of the Package.
Versions Of The License
New Versions. SnertSoft may publish revised and/or new versions of the License from time to time. Each version will be given a distinguishing version number.
Effect of New Versions. Once a version of the Package has been published under a particular version of the License, You may always continue to use it under the terms of that License version. You may also choose to use such Package under the terms of the most current version of the License published by SnertSoft.
No one other than SnertSoft has the right to modify the terms applicable to the Package created under this License.
Disclaimer
THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO WAY SHALL SNERTSOFT OR LICENSEE BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License Control
The Package may use one or more license control methods including, but not limited to, license key activation, periodic reporting of Package details and IP address of installation to SnertSoft & Co., or remote license verification by SnertSoft & Co.. Any information reported to or gathered by SnertSoft & Co. shall remain strictly confidential and the private property of SnertSoft & Co.. Under no circumstances will SnertSoft & Co. resell or release this information to third parties, unless demanded by court order.
Support
Support is provided for one year from date of purchase and only for SnertSoft's original Package that was purchased directly from SnertSoft. Additional support beyond the first year can be obtained from SnertSoft on time & materials basis or from one of SnertSoft's authorised partners.
Support for the Package obtained from authorised partners, such as value-added resllers or appliance manufacturers, will be supplied by those partners. SnertSoft will not support the Package without proof of purchase from SnertSoft, such as an Order N° or Invoice N°.
Package enhancements requests and product suggestions are always welcome. A community mailing list is available; please refer to SnertSoft web site Support area for details.
Gifts
Gifts from the author's Amazon US or Amazon UK wishlist (search by mail address <achowe at snert dot com>) are welcomed for the continued encouragement, moral support, and ego pumping needed to work in foreign non-english speaking lands.
kilometers per hour since 13 August 2004