Milter-greylist

Hi, Please find enclosed a small patch that adds a footer to the dump file.  This footer contains the count of records, greylisted tuples and auto-whitelisted

On Wed, Oct 13, 2004 at 09:56:46AM +0200, Remy Card wrote:
> 	Please find enclosed a small patch that adds a footer to the dump
> file.  This footer contains the count of records, greylisted tuples and
> auto-whitelisted tuples.  It helps me to establish statistics.

Thank you for that one: simple but efficient. I commited it.

Here is the Changelog so far:
1.5.9:
        Quick statistics at the end of the dump file (Remy Card)
	Fix build on Tru64 Unix (Attila Bruncsak)
	Fix a SPF log problem (Alexandre Cherif)

I have other pending patches:
- IPv6 build problem on Tru64 (I'm awaiting a configure test for -D_OSF_SOURCE)
- libspf2 support (the proposed patch break on recent versions of libspf2)
- Properly formatted man pages on Solaris
- Allow local address to be specified by peer statement (patch not tested)

And the one that have issues, to be replaced by a more general ACL mecanism,
or to be contributed as ifdef'ed out
- per domain config (Remy Card)
- from/to pairs in whitelist config (Dan Hollis)

Is it time to release 1.5.9, or is someone willing to finish the work for one
of the above before we do? The local addresses patch just need some testing, 
any volunteer?

-- 
Emmanuel Dreyfus
manu@...

Hi,

>>>>> On Wed, 13 Oct 2004 09:41:01 +0000
>>>>> Emmanuel Dreyfus <manu@...> said:

manu> - IPv6 build problem on Tru64 (I'm awaiting a configure test for -D_OSF_SOURCE)

It seems that protecting IPv6 related code by #ifdef AF_INET6 is not a
good idea.  So, it may better to change it to #ifdef HAVE_INET6, and
to add test into configure if struct sockadder_in6 is present.  I've
already made such patch here, but I cannot submit it for now.
If -D_OSF_SOURCE approach fails on Tru64, I'll submit the patch.

Sincerely,

--
Hajimu UMEMOTO @ Internet Mutual Aid Society Yokohama, Japan
ume@...  ume@{,jp.}FreeBSD.org
http://www.imasy.org/~ume/

> I have other pending patches:
> - IPv6 build problem on Tru64 (I'm awaiting a configure test 
> for -D_OSF_SOURCE)

I used autoconf on linux to get the configure script.
The configure script correctly recognize now the need of
-D_OSF_SOURCE flag on Tru64 UNIX for IPV6 support.

Bests,
Attila

Hi,

>>>>> On Wed, 13 Oct 2004 16:07:45 +0200
>>>>> attila.bruncsak@... said:

attila.bruncsak> I used autoconf on linux to get the configure script.
attila.bruncsak> The configure script correctly recognize now the need of
attila.bruncsak> -D_OSF_SOURCE flag on Tru64 UNIX for IPV6 support.

Okay, it's fine.

Sincerely,

--
Hajimu UMEMOTO @ Internet Mutual Aid Society Yokohama, Japan
ume@...  ume@{,jp.}FreeBSD.org
http://www.imasy.org/~ume/

Hi all

Following the "release early, release often", I released 1.5.9, we'll
quickly do an 1.5.10 with the other pending patches.

Pending patches:
- libspf2 support (the proposed patch break on recent versions of
libspf2, awaiting new patch from Alexandre Cherif)
- Properly formatted man pages on Solaris
- Allow local address to be specified by peer statement (patch not
tested, awaiting feedback from Klas Heggemann)

Patches that should be checked-in as optionnal (ifdef out by default)
- per domain config (from Remy Card)
- from/to pairs in whitelist config (Dan Hollis)

-- 
Emmanuel Dreyfus
Il y a 10 sortes de personnes dans le monde: ceux qui comprennent 
le binaire et ceux qui ne le comprennent pas.
manu@...

Hi,

>>>>> On Wed, 13 Oct 2004 23:46:13 +0200
>>>>> manu@... said:

manu> Following the "release early, release often", I released 1.5.9, we'll
manu> quickly do an 1.5.10 with the other pending patches.

I found two problems.  Here is a patch.

- If AF_INET6 is not defined, it cannot be compiled.  subnetmatch6
  code is not protected by #ifdef AF_INET6.

- The correction in milter-greylist.c is incomplete.  Since the
  failure of iptostring() affects only syslog output, the rest should
  be executed even when iptostring() fails.

Index: conf_yacc.y
diff -u conf_yacc.y.orig conf_yacc.y
--- conf_yacc.y.orig	Tue Oct 12 05:57:42 2004
+++ conf_yacc.y	Thu Oct 14 15:23:54 2004
@@ -203,9 +203,15 @@
 					prefix2mask4($2, &conf.c_match_mask);
 				}
 	;	
-subnetmatch6:	SUBNETMATCH6 CIDR{ if (C_NOTFORCED(C_MATCHMASK6))
-					prefix2mask6($2, &conf.c_match_mask6);
-				}
+subnetmatch6:	SUBNETMATCH6 CIDR{
+#ifdef AF_INET6
+			if (C_NOTFORCED(C_MATCHMASK6))
+				prefix2mask6($2, &conf.c_match_mask6);
+#else
+			printf("IPv6 is not supported, ignore line %d\n",
+			    conf_line);
+#endif
+		}
 	;
 socket:		SOCKET PATH	{ if (C_NOTFORCED(C_SOCKET)) 
 					conf.c_socket = 
Index: milter-greylist.c
diff -u -p milter-greylist.c.orig milter-greylist.c
--- milter-greylist.c.orig	Wed Oct  6 15:31:51 2004
+++ milter-greylist.c	Thu Oct 14 15:19:43 2004
@@ -276,11 +276,11 @@ mlfi_envfrom(ctx, envfrom)
 			syslog(LOG_DEBUG, 
 			    "Sender IP %s and address %s are SPF-compliant, "
 			    "bypassing greylist", ipstr, *envfrom);
-			priv->priv_elapsed = 0;
-			priv->priv_whitelist = EXF_SPF;
-
-			return SMFIS_CONTINUE;
 		}
+		priv->priv_elapsed = 0;
+		priv->priv_whitelist = EXF_SPF;
+
+		return SMFIS_CONTINUE;
 	}
 
 	return SMFIS_CONTINUE;


Sincerely,

--
Hajimu UMEMOTO @ Internet Mutual Aid Society Yokohama, Japan
ume@...  ume@{,jp.}FreeBSD.org
http://www.imasy.org/~ume/

Hajimu UMEMOTO <ume@...> wrote:

> I found two problems.  Here is a patch.
> 
> - If AF_INET6 is not defined, it cannot be compiled.  subnetmatch6
>   code is not protected by #ifdef AF_INET6.
> 
> - The correction in milter-greylist.c is incomplete.  Since the
>   failure of iptostring() affects only syslog output, the rest should
>   be executed even when iptostring() fails.

Fixed in 1.5.10:
ftp://ftp.espci.fr/pub/milter-greylist/milter-greylist-1.5.10.tgz
MD5 (milter-greylist-1.5.10.tgz) = df1c8ce0be5f8a9d2d6599a480296ad1

Please don't tell me you found another bug :)

-- 
Emmanuel Dreyfus
Il y a 10 sortes de personnes dans le monde: ceux qui comprennent 
le binaire et ceux qui ne le comprennent pas.
manu@...

--- In milter-greylist@yahoogroups.com, manu@n... wrote:
> Patches that should be checked-in as optionnal (ifdef out by default)
> - per domain config (from Remy Card)
> - from/to pairs in whitelist config (Dan Hollis)

do you still need me to write a patch for 1.5.x?

-Dan

On Wed, Nov 24, 2004 at 03:34:39PM -0800, Dan Hollis wrote:
> > Patches that should be checked-in as optionnal (ifdef out by default)
> > - per domain config (from Remy Card)
> > - from/to pairs in whitelist config (Dan Hollis)
> 
> do you still need me to write a patch for 1.5.x?

No, as Remy's ACL qill superseed this functionnality.

-- 
Emmanuel Dreyfus
manu@...

On Thu, 25 Nov 2004, Emmanuel Dreyfus wrote:
> On Wed, Nov 24, 2004 at 03:34:39PM -0800, Dan Hollis wrote:
> > > Patches that should be checked-in as optionnal (ifdef out by default)
> > > - per domain config (from Remy Card)
> > > - from/to pairs in whitelist config (Dan Hollis)
> > do you still need me to write a patch for 1.5.x?
> No, as Remy's ACL qill superseed this functionnality.

What about until then?

-Dan

Dan Hollis <goemon@...> wrote:

> > No, as Remy's ACL qill superseed this functionnality.
> What about until then?

It shoulnd't be long now.

-- 
Emmanuel Dreyfus
Il y a 10 sortes de personnes dans le monde: ceux qui comprennent 
le binaire et ceux qui ne le comprennent pas.
manu@...

On Wed, Dec 01, 2004 at 07:38:56AM +0100, manu@... wrote:
> Dan Hollis <goemon@...> wrote:
> 
> > > No, as Remy's ACL qill superseed this functionnality.
> > What about until then?
> 
> It shoulnd't be long now.

	Yep.  I have the access-list version running on my mail servers.
It seems to run fine.  I want to spend some more time checking that there
is not problem (and I will probably need to spend some time to clean up the
code before I make it available :-).  I plan to release a patch against 1.6rc1
in a few days.

	Cheers

		R\ufffdmy