Post by Andreas S. KerberWould you mind sharing this 'perlsrs' file? I can't seem to find it
and I'd like to take a look.
Not at all.
It's actually multiple files.
- perlsrs-old.m4 - the original version I found and started with
- perlsrs.m4 - a test modification of perlsrs-old.m4 to use socketmap
- socketmap.m4 - a version of (socketmap) perlsrs.m4 I used for a while
- envfrom2srs.pl - script to convert from SRS form to raw form
- srs2envto.pl - script to convert from raw form to SRS form
- socketmapd*.pl - socketmap of above Perl to avoid startup delay
I only used the socketmap version on one system for a few years before
giving up on it b/c I'd forget to start the socketmap daemon when the
system would reboot (patching / etc.).
I've never had any noticeable performance problems with the
perlsrs-old.m4 / envfrom2srs.pl / srs2envto.pl versions and they just
work without needing to remember start anything.
N.B. you need to change the $secret and $fwdomain. $secret is data
meant to prevent others from predicting your SRS values. $fwdomain is
mean to be the domain that you forward emailas; I use the hosts FQDN.
I save these files in the /etc/mail/srs directory.
I create a sym-link to the m4 files from where Sendmail / m4 looks for
hacks (/usr/share/sendmail-cf/hack on my system).
Then I include the following at the end of my sendmail.mc file:
HACK(`perlsrs-old')dnl
The premise behind the m4 is to check to see if the envelope from is in
class w, and if not, apply SRS to the envelope.
It's been a long time since I looked at this and I just confirmed that
it is still working.
--8<--perlsrs-old.m4--8<--
divert(-1)
# Copyright (c) 2004 by Mark Kramer <***@asarian-host.net>
# All rights reserved.
# Copyright (c) 1988, 1993
# The Regents of the University of California. All rights reserved.
#
# By using this file, you agree to the terms and conditions set
# forth in the LICENSE file which can be found at the top level of
# the sendmail distribution.
#
#
divert(0)
VERSIONID(`$Id: perlsrs.m4,v 1.2 2004/04/01 20:37:09 mkramer Exp $')
ifdef(`_MAILER_DEFINED_',,`errprint(`*** WARNING: MAILER() should be
before HACK(perlsrs)')')
LOCAL_CONFIG
# Forward SRS program map
Kenvfrom2srs program /etc/mail/srs/envfrom2srs.pl
# Reverse SRS program map
Ksrs2envto program /etc/mail/srs/srs2envto.pl
# SRS regex map
Kis_srs regex ^<?SRS[01][=+-].*
MAILER_DEFINITIONS
SEnvFromSMTP
R$*@$=w$* $@ $1@$2$3 Don't SRS
rewrite local (class w) sending domains.
R$* $: $(envfrom2srs $1 $) SRS rewrite
non-local (!class w) sending domains.
LOCAL_RULESETS
###################################################################
### Local SRS Macros ###
###################################################################
SIsSRS
R$* $: $(is_srs $1 $)
R$@ $@ YES
R$* $@ NO
SReverseSrs
R$* $: $1 $>IsSRS $1
R$* NO $@ $1
R$* YES $@ $(srs2envto $1 $)
LOCAL_RULE_0
# Do we need to reverse SRS address?
R$* $: $>ReverseSrs $1
-->8--perlsrs-old.m4-->8--
--8<--perlsrs.m4--8<--
divert(-1)
# Copyright (c) 2004 by Mark Kramer <***@asarian-host.net>
# All rights reserved.
# Copyright (c) 1988, 1993
# The Regents of the University of California. All rights reserved.
#
# By using this file, you agree to the terms and conditions set
# forth in the LICENSE file which can be found at the top level of
# the sendmail distribution.
#
#
divert(0)
VERSIONID(`$Id: 8.13.perlsrs.m4,v 1.0 2004/08/21 13:15:43 mkramer Exp $')
ifdef(`_MAILER_DEFINED_',,`errprint(`*** WARNING: MAILER() should be
before HACK(perlsrs)')')
LOCAL_CONFIG
# SRS socket maps
Kreverse_srs socket local:/var/run/socketmapd.sock
Kmake_srs socket local:/var/run/socketmapd.sock
# SRS regex map
Kis_srs regex ^<?SRS[01][=+-].*
MAILER_DEFINITIONS
SEnvFromSMTP
R$* $: $(make_srs $1 $)
LOCAL_RULESETS
###################################################################
### Local SRS Macros ###
###################################################################
SIsSrs
R$* $: $(is_srs $1 $)
R$@ $@ YES
R$* $@ NO
SReverseSrs
R$* $: $1 $>IsSrs $1
R$* NO $@ $1
R$* YES $@ $(reverse_srs $1 $)
LOCAL_RULE_0
# Do we need to reverse SRS address?
R$* $: $>ReverseSrs $1
-->8--perlsrs.m4-->8--
--8<--socketmap.m4--8<--
divert(-1)
# Copyright (c) 2004 by Mark Kramer <***@asarian-host.net>
# All rights reserved.
# Copyright (c) 1988, 1993
# The Regents of the University of California. All rights reserved.
#
# By using this file, you agree to the terms and conditions set
# forth in the LICENSE file which can be found at the top level of
# the sendmail distribution.
#
#
divert(0)
VERSIONID(`$Id: socketmap.m4,v 1.0 2004/11/09 13:15:43 mkramer Exp $')
ifdef(`_MAILER_DEFINED_',,`errprint(`*** WARNING: MAILER() should be
before HACK(socketmap)')')
LOCAL_CONFIG
# SRS socket maps
Kreverse_srs socket local:/var/run/socketmapd.sock
Kmake_srs socket local:/var/run/socketmapd.sock
# SRS regex map
Kis_srs regex ^<?SRS[01][-+=].*
MAILER_DEFINITIONS
SEnvFromSMTP
R$*@$=w$* $@ $1@$2$3 Don't SRS rewrite local (class
w) sending domains.
R$* $: $(make_srs $1 $) SRS rewrite non-local (!class w)
sending domains.
LOCAL_RULESETS
###################################################################
### Local SRS Macros ###
###################################################################
SIsSrs
R$* $: $(is_srs $1 $)
R$@ $@ YES
R$* $@ NO
SReverseSrs
R$* $: $1 $>IsSrs $1
R$* NO $@ $1
R$* YES $@ $(reverse_srs $1 $)
LOCAL_RULE_0
# Do we need to reverse SRS address?
R$* $: $>ReverseSrs $1
-->8--socketmap.m4-->8--
--8<--envfrom2srs.pl--8<--
#!/usr/bin/perl
#
# Sendmail "program" map script to rewrite envelope-from
# address to SRS0 address. Called from macro EnvFromSMTP.
#
# Code by Mark Kramer <***@asarian-host.net>
#
# Version 0.30
#
# Last revision: March 24, 2004
#
# Licensed under GPL
#
# For detailed installation notes, read:
#
# http://asarian-host.net/srs/sendmailsrs.htm
#
# See also: http://www.anarres.org/projects/srs/
# http://spf.pobox.com/
#
# This version requires at least Sendmail 8.12.10 + Mail::SRS 0.30
use Mail::SRS;
use strict;
# No funny business in our output, please
close (STDERR);
my $old_address = $ARGV[0];
my $secret = 'REDACTED';
my ($new_address, $use_address);
my $fwdomain = 'REDACTED';
my $srs = new Mail::SRS (Secret => $secret, HashLength => 8,
AlwaysRewrite => 1);
###
open(my $fh, '>>', '/tmp/mylog.txt');
print $fh "$old_address\n";
close $fh;
###
# Our original envelope-from may look funny on entry
# of this Ruleset:
#
# admin<@asarian-host.net.>
#
# We need to preprocess it some:
($use_address = $old_address) =~ s/[<>]//g;
$use_address =~ s/\.$//g;
# Here, at EnvFromSMTP, we do not loop our address through an
# extra IsSrs macro: we want SRS1 forwarding functionality!
# (relaying reversed third-party SRS1 addresses is a
# different story, though; but here we just allow for SRS0
# addresses to be promoted to SRS1 ones).
#
# Ok, first check whether we already have a signed SRS address;
# if so, just return the old address: we do not want to double-sign
# by accident! (Non-locally generated SRS0 addresses, by nature
# of the protocol, will not 'eval'; so, they will simply become
# SRS1 addresses. Thus, only locally generated SRS0 addresses are
# exempted from double-signing.)
#
# Else, gimme a valid SRS signed address, munge it back the way
# sendmail wants it at this point; or just return the old address,
# in case nothing went.
if (eval {$new_address = $srs -> reverse ($use_address)}) {
print "$old_address\n";
} elsif (eval {$new_address = $srs -> forward ($use_address, $fwdomain)}) {
$new_address .= '.>';
$new_address =~ s/\@/<@/;
print "$new_address\n";
} else {
print "$old_address\n";
}
exit 0;
-->8--envfrom2srs.pl-->8--
--8<--srs2envto.pl--8<--
#!/usr/bin/perl
#
# Sendmail "program" map script to revert SRS0 or SRS1 address
# back to regular recipient. Called from macro ParseLocal.
#
# Code by Mark Kramer <***@asarian-host.net>
#
# Version 0.30
#
# Last revision: March 24, 2004
#
# Licensed under GPL
#
# For detailed installation notes, read:
#
# http://asarian-host.net/srs/sendmailsrs.htm
#
# See also: http://www.anarres.org/projects/srs/
# http://spf.pobox.com/
#
# This version requires at least Sendmail 8.12.10 + Mail::SRS 0.30
use Mail::SRS;
use strict;
# No funny business in our output, please
close (STDERR);
my $old_address = $ARGV[0];
my $secret = 'REDACTED';
my $use_address;
my $srs = new Mail::SRS (Secret => $secret, HashLength => 8,
AlwaysRewrite => 1);
# Munge ParseLocal recipient in the same manner as required
# in EnvFromSMTP.
($use_address = $old_address) =~ s/[<>]//g;
$use_address =~ s/\.$//g;
# Just try and reverse the address. If we succeed, return this
# new address; else, return the old address (quoted if it was
# a piped alias).
#
# We do an exhaustive while loop, so that SRS1 address may
# become SRS0, which, in turn, may become reverted to
# a local recipient.
#
# Mail:SRS, as of 0.30, is now case-insensitive. Added the
# /i switch to accomodate for the change.
if ($use_address =~ /^SRS[01][=+-]/i) {
$use_address = $_ while (eval {$_ = $srs -> reverse ($use_address)});
$use_address .= '.>';
$use_address =~ s/\@/<@/;
print "$use_address\n";
} elsif ($use_address =~ /^\|/) {
print "\"$old_address\"\n";
} else {
print "$old_address\n";
}
exit 0;
-->8--srs2envto.pl-->8--
--8<--socketmapd.0.31.pl--8<--
#!/usr/bin/perl
# Sendmail "socket" map script to perform SRS functions.
#
# Code by Mark Kramer <***@asarian-host.net>
#
# Version 0.31
#
# Last revision: November 2, 2004
#
# With thanks to Jim Allen for pointing out a missing
# "while (!eof($client))" loop, causing BROKEN PIPE errors
# on concurrent connections.
#
# Licensed under GPL
#
# For detailed installation notes, read:
#
# http://asarian-host.net/srs/sendmailsrs.htm
#
# See also: http://www.anarres.org/projects/srs/
# http://spf.pobox.com/
#
# This version requires at least Sendmail 8.13.0 + Mail::SRS 0.30
use IO::Socket;
use POSIX qw (:sys_wait_h);
use Sys::Syslog qw (:DEFAULT setlogsock);
use Mail::SRS;
use strict;
my ($user, $login, $pass, $uid, $gid, $data, $socket_map, $old_address,
$new_address, $use_address, $client, $sock);
my $secret = 'REDACTED';
my $fwdomain = 'REDACTED';
my $srs = new Mail::SRS (Secret => $secret, MaxAge => 8, HashLength =>
8, AlwaysRewrite => 1);
sub write_syslog {
setlogsock ('unix');
openlog ('socketmapd', 'pid,cons', 'lpr') or exit 1;
syslog ('info', @_);
closelog ();
}
sub log_error_and_exit {
write_syslog (@_);
exit 1;
}
sub netstringRead {
my $sock = shift;
my $saveSeparator = $/;
$/ = ':';
my $dataLength = <$sock>;
write_syslog ("WARNING: cannot read netstring length") unless
defined ($dataLength);
chomp ($dataLength);
my $data;
if ($sock -> read ($data, $dataLength) == $dataLength) {
($sock -> getc () eq ',') or write_syslog ("WARNING: data
misses closing ,");
} else {
write_syslog ("WARNING: received only " . length ($data) . " of
$dataLength bytes");
}
$/ = $saveSeparator;
return $data;
}
sub netstringWrite {
my $sock = shift;
my $data = "OK " . shift;
write_syslog ("WARNING: $@") if (not eval {print $sock length
($data) . ':' . $data . ','});
}
sub handleChildConnection {
my $client = shift;
while (not eval {eof ($client)}) {
if (eval {$data = netstringRead ($client)}) {
if ($data =~ /^(\S+) (\S+)$/) {
$socket_map = $1;
$old_address = $2;
($use_address = $old_address) =~ s/[<>]//g;
$use_address =~ s/\.$//g;
if ($socket_map eq 'reverse_srs') {
if ($use_address =~ /^SRS[01][-+=]/i) {
$use_address = $_ while (eval {$_ = $srs ->
reverse ($use_address)});
$use_address .= '.>';
$use_address =~ s/\@/<@/;
netstringWrite ($client, $use_address);
} elsif ($use_address =~ /^\|/) {
netstringWrite ($client, "\"$old_address\"");
} else {
netstringWrite ($client, $old_address);
}
} elsif ($socket_map eq 'make_srs') {
if (eval {$new_address = $srs -> reverse
($use_address)}) {
netstringWrite ($client, $old_address);
} elsif (eval {$new_address = $srs -> forward
($use_address, $fwdomain)}) {
$new_address .= '.>';
$new_address =~ s/\@/<@/;
netstringWrite ($client, $new_address);
} else {
netstringWrite ($client, $old_address);
}
} else {
write_syslog ("WARNING: unknown socketmap,
'$socket_map'");
}
} else {
write_syslog ("WARNING: incomplete data, '$data'");
}
} else {
write_syslog ("WARNING: unable to read from client");
}
}
}
if (not $user = lc ($ARGV[0])) {
print STDERR "Missing user\n";
print STDERR "Usage: $0 <user to run as>\n";
exit 1;
} elsif ($>) {
print STDERR "You need to start socketmapd as root!\n";
exit 1;
} else {
($login, $pass, $uid, $gid) = getpwnam ($user);
if (not defined ($uid)) {
log_error_and_exit ("$user is not a valid user on this system!");
} elsif (not $uid) {
log_error_and_exit ("You cannot run socketmapd as root!");
}
}
open (STDIN, '/dev/null');
open (STDOUT, '>/dev/null');
open (STDERR, '>&STDOUT');
umask (0027);
unlink ('/var/run/socketmapd.pid');
unlink ('/var/run/socketmapd.sock');
if ($_ = fork ()) {
open (USERLOG, ">".'/var/run/socketmapd.pid') or exit 1;
flock (USERLOG, 2);
seek (USERLOG, 0, 0);
print USERLOG " $_";
close (USERLOG);
exit 0;
}
POSIX::setsid () || exit 1;
if (not (eval {$sock = new IO::Socket::UNIX (
Listen => SOMAXCONN,
Type => SOCK_STREAM,
Local => '/var/run/socketmapd.sock')})) {
log_error_and_exit ("ERROR: Unable to create UNIX domain socket!");
}
chown $uid, $gid, '/var/run/socketmapd.sock';
$0 = 'socketmapd';
$) = $gid;
$( = $gid;
$> = $uid;
$< = $uid;
write_syslog ("Dropped privileges on socketmap daemon");
while (eval {$client = $sock -> accept ()}) {
if (fork) {
eval {$client -> close ()};
wait;
} elsif (fork) {
exit 0;
} else {
eval {$sock -> close ()};
eval {handleChildConnection ($client)};
eval {$client -> close ()};
exit 0;
}
}
write_syslog ("Unsuccessful exit from the socketmap daemon: $!");
eval {$sock -> close ()};
exit 0;
-->8--socketmapd.0.31.pl-->8--
--
Grant. . . .