Fwd: patch for postfix service for logwatch
"Kirk Bauer" <[email protected]>
| Newsgroups | gmane.comp.log.logwatch.devel |
|---|---|
| Message-ID | <[email protected]> |
------------------------------------------------------ Kirk Bauer <[email protected]> http://linux.kaybee.org | www.logwatch.org Author, Automating UNIX & Linux Administration ---------- Forwarded message ---------- From: Alexander Kolesnik <[email protected]> Date: Fri, Sep 19, 2008 at 3:29 AM Subject: patch for postfix service for logwatch To: [email protected] Hello, This patch is intended for postfix logs parser of logwatch version 7.3.6. It enables understanding SPF checks that might be configured in smtpd_data_restrictions check. Putting some checks in smtpd_data_restrictions might be useful, for example, if you want to skip greylisting after successful SPF check. For this to work, your SPF checker must return "OK" to postfix if SPF check returned "passed". I'm also attaching script postfix-policyd-spf-perl (version 2.006), slightly modified by me for that purpose. Hope, that will help someone. -- Best regards, Alexander Kolesnik _______________________________________________ Logwatch-Devel mailing list [email protected] http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel
postfix-policyd-spf-perl
(application/octet-stream, 11.5 KB) - not displayed
postfix.diff
(application/octet-stream, 1.8 KB)
--- postfix.org 2007-05-20 04:24:33.000000000 +0400
+++ postfix 2008-09-19 14:10:05.000000000 +0400
@@ -678,6 +678,7 @@
( $p1 =~ /^Deleted: \d message$/ )
or ( $p1 =~ /: replace: header / )
or ( $p1 =~ /: Greylisted for / ) # Greylisting has it's own statistics tool
+ or ( $p1 =~ /: Greylisted, see / )
#XXX Perhaps the following are candidates for extended statistics
or ( $p1 =~ /certificate verification failed for/o )
or ( $p1 =~ /Server certificate could not be verified/o )
@@ -1162,6 +1163,31 @@
}
# end of $re_QID: reject: RCPT from ...
+ # $re_QID: reject: DATA from ...
+ elsif (($p4) = ($p3 =~ /^DATA from (.*)$/o )) {
+ my ($p5, $p6, $recip);
+ #print "p4: $p4\n";
+
+ # SPF in smtpd_data_restrictions
+
+ if ( $p4 !~ /^([^[]+)\[($re_IP)\]: ($re_DSN) (.*)$/o ) {
+ inc_unmatched('reject1', $OrigLine);
+ next;
+ }
+
+ ($host,$hostip,$dsn,$p5) = ($1,$2,$3,$4);
+ #print "host: $host, hostip: $hostip, dsn: $dsn, p5: \"$p5\"\n";
+ $rej_action = "Temp$rej_action" if ($dsn =~ /^4/);
+
+ if ($reason =~ m{^Please see http://[^/]+/why\.html}) {
+ $reason = 'SPF reject';
+ }
+
+ $Totals{"${rej_action}Recip"}++;
+ $Counts{"${rej_action}Recip"}{"\u$reason"}{"\L$recip"}{formathost($hostip,$host)}++;
+ }
+ # end of $re_QID: reject: DATA from ...
+
# $re_QID: reject: body ...
# $re_QID: reject: header ...
elsif ( ($reason,$host,$to,$reason2) = ($p3 =~ /^(?:header|body) (.*) from ([^;]+); from=<(?:[^ ]*)>(?: to=<([^>]*)>)?(?: proto=[^ ]* helo=<[^ ]*>)?: (.*)$/o )) {