From Code to Community: Sponsoring The Perl and Raku Conference 2025 Learn more

SIDNEY / Mail-SpamAssassin-4.0.1-pre1d-TRIAL / spamd-apache2 / lib / Mail / SpamAssassin / Spamd / Apache2 / AclRFC1413.pm 

            

              
1
2
3
4
5
6
7
8
9
10
11
12
13
14
—
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
—
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
—
110
111
112
113
114
115
116
117
118
119
120
—
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138

              
package Mail::SpamAssassin::Spamd::Apache2::AclRFC1413;
use strict;
use Apache2::Const -compile => qw(OK FORBIDDEN SERVER_ERROR);
use Apache2::Connection  ();
use Apache2::RequestUtil ();    # RequestRec->new
use Apache2::RequestRec  ();
use Apache2::Access      ();    # $r->get_remote_logname
use Apache::Test;
use constant APACHE24   => have_min_apache_version('2.4.0');
use APR::SockAddr ();           # $c->remote_addr->...
use APR::Table    ();           # $c->notes
=head1 NAME
Mail::SpamAssassin::Spamd::Apache2::AclRFC1413 - check spamd's client ident
=head1 SYNOPSIS
 ##### in httpd.conf:
 # engine; module has been separated in Apache 2.1
 LoadModule ident_module modules/mod_ident.so
 IdentityCheck   on
 IdentityTimeout 4
 # enable check
 PerlLoadModule Mail::SpamAssassin::Spamd::Apache2::Config
 SAident on
 ##### in PerlProcessConnectionHandler:
 Mail::SpamAssassin::Spamd::Apache2::AclRFC1413::check_ident($c, "user")
   or return Apache2::Const::FORBIDDEN;
 # or like this:
 my $remote_logname =
   Mail::SpamAssassin::Spamd::Apache2::AclRFC1413::get_ident($c)
=head1 DESCRIPTION
Queries remote ident server using mod_ident.so, saves result in
C<$c-E<gt>notes()>.
Returns C<Apache2::Const::FORBIDDEN> on failure.
The C<SAident On> directive actually does this:
 PerlPreConnectionHandler Mail::SpamAssassin::Spamd::Apache2::AclRFC1413
=head1 NOTE
Doing ident for non-localhost users is rather pointless.  Unless you
know what you're doing, listen only on C<127.0.0.1> and/or C<::1>, if
you want to prevent users from lying about their identity.  Or use SSL
with client certificates (refer to C<mod_ssl> documentation for details).
=head1 FUNCTIONS
=cut
sub handler {
  my ($c) = @_;
  # is there a point in doing ident for remote users?
  #$c->remote_ip eq $c->local_ip
  #  or return Apache2::Const::FORBIDDEN;
  my $r = Apache2::RequestRec->new($c)
    or die 'Apache2::RequestRec->new($c) failed';
  my $remote_user = $r->get_remote_logname;
  unless (defined $remote_user && length $remote_user) {
    warn 'rfc1413 check: failed to obtain info for '
      . APACHE24 ? $c->client_addr->ip_get() : $c->remote_addr->ip_get() . ':'
      . APACHE24 ? $c->client_addr->port() : $c->remote_addr->port() . "\n";
    return Apache2::Const::FORBIDDEN;
  }
  my $notes = $c->notes    # APR::Table
    or die '$c->notes failed';
  $notes->{remote_user} = $remote_user;
  $c->notes($notes);
  return Apache2::Const::OK;
}
=head2 check_ident($c, $username)
Returns remote username (might be "0"), as returned by the ident server, if it
matches supplied $username; undef otherwise.
=cut
sub check_ident {
  my ($c, $user) = @_;
  my $remote_user = $c->notes->{remote_user};
  die "rfc1413 check: no query result for user=$user ip="
    . APACHE24 ? $c->client_addr->ip_get() : $c->remote_addr->ip_get()
    . ' port='
    . APACHE24 ? $c->client_addr->port() : $c->remote_addr->port()
    unless defined $remote_user && length $remote_user;
  return $remote_user if $user eq $remote_user;
  warn "ident mismatch for [$user] from "
    . APACHE24 ? $c->client_addr->ip_get() : $c->remote_addr->ip_get() . ':'
    . APACHE24 ? $c->client_addr->port() : $c->remote_addr->port()
    . "; remote identd returned [$remote_user]\n";
  0;
}
=head2 get_ident($c)
Returns remote username (might be "0"), as returned by the ident server.
=cut
sub get_ident {
  my ($c) = @_;
  $c->notes->{remote_user};
}
=head1 EXPORTS
Nothing.
=head1 BUGS
See E<lt>http://bugzilla.spamassassin.org/E<gt>
=head1 SEE ALSO
C<Mail::SpamAssassin::Spamd::Apache2::Config(3)>
=cut
1;
# vim: ts=8 sw=2 et