Initial commit of source code and docs
This commit is contained in:
292
pyquarantine/__init__.py
Normal file
292
pyquarantine/__init__.py
Normal file
@@ -0,0 +1,292 @@
|
||||
#!/usr/bin/env python2
|
||||
#
|
||||
# PyQuarantine-Milter is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# PyQuarantine-Milter is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with PyQuarantineMilter. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
__all__ = ["QuarantineMilter", "generate_milter_config", "reload_config", "mailer", "notifications", "run", "quarantines", "whitelists"]
|
||||
|
||||
import ConfigParser
|
||||
import Milter
|
||||
import StringIO
|
||||
import logging
|
||||
import os
|
||||
import re
|
||||
import sys
|
||||
|
||||
import mailer
|
||||
import quarantines
|
||||
import notifications
|
||||
import whitelists
|
||||
|
||||
from Milter.utils import parse_addr
|
||||
|
||||
|
||||
|
||||
class QuarantineMilter(Milter.Base):
|
||||
"""QuarantineMilter based on Milter.Base to implement milter communication
|
||||
|
||||
The class variable config needs to be filled with the result of the generate_milter_config function.
|
||||
|
||||
"""
|
||||
config = None
|
||||
|
||||
# list of default config files
|
||||
_config_files = ["/etc/pyquarantine/pyquarantine.conf", os.path.expanduser('~/pyquarantine.conf'), "pyquarantine.conf"]
|
||||
# list of possible actions
|
||||
_actions = {"ACCEPT": Milter.ACCEPT, "REJECT": Milter.REJECT, "DISCARD": Milter.DISCARD}
|
||||
|
||||
|
||||
def __init__(self):
|
||||
self.logger = logging.getLogger(__name__)
|
||||
# save config, it must not change during runtime
|
||||
self.config = QuarantineMilter.config
|
||||
|
||||
@staticmethod
|
||||
def get_configfiles():
|
||||
return QuarantineMilter._config_files
|
||||
|
||||
@staticmethod
|
||||
def get_actions():
|
||||
return QuarantineMilter._actions
|
||||
|
||||
@staticmethod
|
||||
def set_configfiles(config_files):
|
||||
QuarantineMilter._config_files = config_files
|
||||
|
||||
@Milter.noreply
|
||||
def envfrom(self, mailfrom, *str):
|
||||
self.mailfrom = "@".join(parse_addr(mailfrom)).lower()
|
||||
self.recipients = set()
|
||||
return Milter.CONTINUE
|
||||
|
||||
@Milter.noreply
|
||||
def envrcpt(self, to, *str):
|
||||
self.recipients.add("@".join(parse_addr(to)).lower())
|
||||
return Milter.CONTINUE
|
||||
|
||||
@Milter.noreply
|
||||
def data(self):
|
||||
self.queueid = self.getsymval('i')
|
||||
self.logger.debug("{}: received queue-id from MTA".format(self.queueid))
|
||||
self.recipients = list(self.recipients)
|
||||
self.headers = []
|
||||
self.subject = ""
|
||||
return Milter.CONTINUE
|
||||
|
||||
@Milter.noreply
|
||||
def header(self, name, value):
|
||||
self.headers.append("{}: {}".format(name, value))
|
||||
if name.lower() == "subject":
|
||||
self.subject = value
|
||||
return Milter.CONTINUE
|
||||
|
||||
def eoh(self):
|
||||
self.matched = None
|
||||
self.whitelist = whitelists.WhitelistCache()
|
||||
# iterate email headers
|
||||
for header in self.headers:
|
||||
self.logger.debug("{}: checking header '{}' against regex of every configured quarantine".format(self.queueid, header))
|
||||
# iterate quarantines
|
||||
for name, quarantine in self.config.items():
|
||||
if self.matched != None and quarantine["index"] == self.matched["index"]:
|
||||
# a quarantine with higher precedence already matched, skip checks of quarantines with lower precedence
|
||||
self.logger.debug("{}: quarantine '{}' matched already, skip further checks of this header".format(self.queueid, name))
|
||||
break
|
||||
self.logger.debug("{}: checking header against quarantine '{}'".format(self.queueid, name))
|
||||
# check if header matches regex
|
||||
if quarantine["regex_compiled"].match(header):
|
||||
if quarantine["whitelist"] != None and \
|
||||
len(self.whitelist.get_whitelisted_recipients(quarantine["whitelist"], self.mailfrom, self.recipients)) == len(self.recipients):
|
||||
# all recipients are whitelisted, continue with header checks
|
||||
self.logger.debug("{}: header matched regex, but all recipients are whitelisted in quarantine '{}', continue checking this header".format(self.queueid, name))
|
||||
continue
|
||||
self.matched = quarantine
|
||||
# skip checks of this header with quarantines with lower precedence
|
||||
self.logger.debug("{}: header matched regex in quarantine '{}', further checks of this header will be skipped".format(self.queueid, name))
|
||||
break
|
||||
if self.matched != None and self.matched["index"] == 0:
|
||||
self.logger.debug("{}: skipping checks of remaining headers, the quarantine with highest precedence matched already".format(self.queueid))
|
||||
break
|
||||
if self.matched != None:
|
||||
self.logger.info("{}: email matched quarantine '{}'".format(self.queueid, self.matched["name"]))
|
||||
# one of the configured quarantines matched
|
||||
if self.matched["quarantine"] != None or self.matched["notification"] != None:
|
||||
self.logger.debug("{}: initializing memory buffer to save email data".format(self.queueid))
|
||||
# quarantine or notification configured, initialize memory buffer to save mail
|
||||
self.fp = StringIO.StringIO()
|
||||
# write email headers to memory buffer
|
||||
self.fp.write("{}\n".format("\n".join(self.headers)))
|
||||
else:
|
||||
# quarantine and notification disabled, return configured action
|
||||
self.logger.debug("{}: ".format(self.queueid))
|
||||
self.logger.info("{}: quarantine and notification disabled, responding with configured action: {}".format(self.queueid, self.matched["action"].upper()))
|
||||
return self.matched["milter_action"]
|
||||
else:
|
||||
# no quarantine matched, accept mail
|
||||
self.logger.info("{}: email passed clean".format(self.queueid))
|
||||
return Milter.ACCEPT
|
||||
return Milter.CONTINUE
|
||||
|
||||
def body(self, chunk):
|
||||
# save received body chunk
|
||||
self.fp.write(chunk)
|
||||
return Milter.CONTINUE
|
||||
|
||||
def eom(self):
|
||||
if self.matched["whitelist"] != None:
|
||||
whitelisted_recipients = self.whitelist.get_whitelisted_recipients(self.matched["whitelist"], self.mailfrom, self.recipients)
|
||||
if len(whitelisted_recipients) > 0:
|
||||
for recipient in whitelisted_recipients:
|
||||
self.recipients.remove(recipient)
|
||||
self.fp.seek(0)
|
||||
self.logger.info("{}: sending original email to whitelisted recipient(s): {}".format(self.queueid, "<{}>".format(">,<".join(whitelisted_recipients))))
|
||||
try:
|
||||
mailer.sendmail(self.matched["smtp_host"], self.matched["smtp_port"], self.queueid, self.mailfrom, whitelisted_recipients, self.fp.read())
|
||||
except Exception as e:
|
||||
self.logger.error("{}: unable to send original email: {}".format(self.queueid, e))
|
||||
return Milter.TEMPFAIL
|
||||
if len(self.recipients) > 0:
|
||||
quarantine_id = ""
|
||||
if self.matched["quarantine"] != None:
|
||||
# add email to quarantine
|
||||
self.fp.seek(0)
|
||||
try:
|
||||
quarantine_id = self.matched["quarantine"].add(self.queueid, self.mailfrom, self.recipients, fp=self.fp)
|
||||
except Exception as e:
|
||||
self.logger.error("{}: unable to add email to quarantine: {}".format(self.queueid, e))
|
||||
return Milter.TEMPFAIL
|
||||
else:
|
||||
self.logger.info("{}: added email to quarantine of recipient(s): {}".format(self.queueid, "<{}>".format(">,<".join(self.recipients))))
|
||||
if self.matched["notification"] != None:
|
||||
# notify
|
||||
self.fp.seek(0)
|
||||
try:
|
||||
self.matched["notification"].notify(self.queueid, quarantine_id, self.subject, self.mailfrom, self.recipients, fp=self.fp)
|
||||
except Exception as e:
|
||||
self.logger.error("{}: unable to send notification(s): {}".format(self.queueid, e))
|
||||
return Milter.TEMPFAIL
|
||||
else:
|
||||
self.logger.info("{}: sent notification(s) to: {}".format(self.queueid, "<{}>".format(">,<".join(self.recipients))))
|
||||
self.fp.close()
|
||||
# return configured action
|
||||
self.logger.info("{}: responding with configured action: {}".format(self.queueid, self.matched["action"].upper()))
|
||||
return self.matched["milter_action"]
|
||||
|
||||
|
||||
|
||||
def generate_milter_config(configtest=False):
|
||||
"Generate the configuration for QuarantineMilter class."
|
||||
logger = logging.getLogger(__name__)
|
||||
# read config file
|
||||
parser = ConfigParser.ConfigParser()
|
||||
config_files = parser.read(QuarantineMilter.get_configfiles())
|
||||
if len(config_files) == 0:
|
||||
raise RuntimeError("config file not found")
|
||||
QuarantineMilter.set_configfiles(config_files)
|
||||
os.chdir(os.path.dirname(config_files[0]))
|
||||
# check if mandatory config options in global section are present
|
||||
if "global" not in parser.sections():
|
||||
raise RuntimeError("mandatory section 'global' not present in config file")
|
||||
for option in ["quarantines"]:
|
||||
if not parser.has_option("global", option):
|
||||
raise RuntimeError("mandatory option '{}' not present in config section 'global'".format(option))
|
||||
config = {}
|
||||
config["global"] = dict(parser.items("global"))
|
||||
# iterate configured quarantines
|
||||
quarantine_names = list(set(map(str.strip, parser.get("global", "quarantines").split(","))))
|
||||
if "global" in quarantine_names:
|
||||
logger.warning("removed illegal quarantine name 'global' from list of active quarantines")
|
||||
del(quarantine_names["global"])
|
||||
if len(quarantine_names) == 0:
|
||||
raise RuntimeError("no quarantines configured")
|
||||
idx = 0
|
||||
for name in quarantine_names:
|
||||
name = name.strip()
|
||||
# check if config section for current quarantine is present
|
||||
if name not in parser.sections():
|
||||
raise RuntimeError("config section '{}' is not present".format(name))
|
||||
config[name] = dict(parser.items(name))
|
||||
config[name]["name"] = name
|
||||
# check if mandatory config options are present in config
|
||||
for option in ["regex", "type", "notification", "action", "whitelist", "smtp_host", "smtp_port"]:
|
||||
if option not in config[name].keys() and \
|
||||
option in config["global"].keys():
|
||||
config[name][option] = config["global"][option]
|
||||
if option not in config[name].keys():
|
||||
raise RuntimeError("mandatory option '{}' not present in config section '{}' or 'global'".format(option, name))
|
||||
logger.debug("preparing configuration for quarantine '{}' ...".format(name))
|
||||
## add the index
|
||||
config[name]["index"] = idx
|
||||
idx += 1
|
||||
# compile regex
|
||||
regex = config[name]["regex"]
|
||||
logger.debug("=> compiling regex '{}'".format(regex))
|
||||
config[name]["regex_compiled"] = re.compile(regex)
|
||||
# create quarantine instance
|
||||
quarantine_type = config[name]["type"].lower()
|
||||
if quarantine_type in quarantines.quarantine_types.keys():
|
||||
logger.debug("=> initializing quarantine type '{}'".format(quarantine_type))
|
||||
quarantine = quarantines.quarantine_types[quarantine_type](name, config, configtest)
|
||||
elif quarantine_type == "none":
|
||||
logger.debug("=> setting quarantine to NONE")
|
||||
quarantine = None
|
||||
else:
|
||||
raise RuntimeError("unknown quarantine_type '{}'".format(quarantine_type))
|
||||
config[name]["quarantine"] = quarantine
|
||||
# create whitelist instance
|
||||
whitelist = config[name]["whitelist"]
|
||||
if whitelist.lower() == "none":
|
||||
logger.debug("=> setting whitelist to NONE")
|
||||
config[name]["whitelist"] = None
|
||||
else:
|
||||
logger.debug("=> initializing whitelist database")
|
||||
config[name]["whitelist"] = whitelists.Whitelist(name, config, configtest)
|
||||
# create notification instance
|
||||
notification_type = config[name]["notification"].lower()
|
||||
if notification_type in notifications.notification_types.keys():
|
||||
logger.debug("=> initializing notification type '{}'".format(notification_type))
|
||||
notification = notifications.notification_types[notification_type](name, config, configtest)
|
||||
elif notification_type == "none":
|
||||
logger.debug("=> setting notification to NONE")
|
||||
notification = None
|
||||
else:
|
||||
raise RuntimeError("unknown notification type '{}'".format(notification_type))
|
||||
config[name]["notification"] = notification
|
||||
# determining milter action for this quarantine
|
||||
action = config[name]["action"].upper()
|
||||
if action in QuarantineMilter.get_actions().keys():
|
||||
logger.debug("=> setting action to {}".format(action))
|
||||
config[name]["milter_action"] = QuarantineMilter.get_actions()[action]
|
||||
else:
|
||||
raise RuntimeError("unknown action '{}' configured for quarantine '{}'".format(action, name))
|
||||
# remove global section from config, every section should be a quarantine
|
||||
del(config["global"])
|
||||
if configtest:
|
||||
print("Configuration ok")
|
||||
return config
|
||||
|
||||
|
||||
|
||||
def reload_config():
|
||||
"Reload the configuration of QuarantineMilter class."
|
||||
logger = logging.getLogger(__name__)
|
||||
logger.debug("received SIGUSR1")
|
||||
try:
|
||||
config = generate_milter_config()
|
||||
except RuntimeError as e:
|
||||
logger.info(e)
|
||||
logger.info("daemon is still running with previous configuration")
|
||||
else:
|
||||
logger.info("reloading configuration")
|
||||
QuarantineMilter.config = config
|
||||
65
pyquarantine/mailer.py
Normal file
65
pyquarantine/mailer.py
Normal file
@@ -0,0 +1,65 @@
|
||||
#!/usr/bin/env python2
|
||||
#
|
||||
# PyQuarantine-Milter is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# PyQuarantine-Milter is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with PyQuarantineMilter. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import logging
|
||||
import smtplib
|
||||
import sys
|
||||
from multiprocessing import Process, Queue
|
||||
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
queue = Queue(maxsize=50)
|
||||
process = None
|
||||
|
||||
|
||||
|
||||
def mailprocess():
|
||||
"Mailer process to send emails asynchronously."
|
||||
global logger
|
||||
global queue
|
||||
try:
|
||||
while True:
|
||||
m = queue.get()
|
||||
if not m: break
|
||||
smtp_host, smtp_port, queueid, mailfrom, recipient, mail = m
|
||||
try:
|
||||
s = smtplib.SMTP(host=smtp_host, port=smtp_port)
|
||||
s.sendmail(mailfrom, [recipient], mail)
|
||||
except Exception as e:
|
||||
logger.error("{}: error while sending email to <{}> via {}: {}".format(queueid, recipient, smtp_host, e))
|
||||
else:
|
||||
logger.info("{}: email to <{}> sent successfully".format(queueid, recipient))
|
||||
s.quit()
|
||||
except KeyboardInterrupt:
|
||||
pass
|
||||
logger.debug("mailer process terminated")
|
||||
|
||||
|
||||
def sendmail(smtp_host, smtp_port, queueid, mailfrom, recipients, mail):
|
||||
"Send an email."
|
||||
global logger
|
||||
global process
|
||||
global queue
|
||||
if type(recipients) == str:
|
||||
recipients = [recipients]
|
||||
# start mailprocess if it is not started yet
|
||||
if process == None:
|
||||
process = Process(target=mailprocess)
|
||||
process.daemon = True
|
||||
logger.debug("starting mailer process")
|
||||
process.start()
|
||||
for recipient in recipients:
|
||||
queue.put((smtp_host, smtp_port, queueid, mailfrom, recipient, mail))
|
||||
216
pyquarantine/notifications.py
Normal file
216
pyquarantine/notifications.py
Normal file
@@ -0,0 +1,216 @@
|
||||
#!/usr/bin/env python2
|
||||
#
|
||||
# PyQuarantine-Milter is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# PyQuarantine-Milter is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with PyQuarantineMilter. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import email
|
||||
import logging
|
||||
import mailer
|
||||
import re
|
||||
|
||||
from bs4 import BeautifulSoup
|
||||
from email.mime.multipart import MIMEMultipart
|
||||
from email.mime.text import MIMEText
|
||||
from email.mime.image import MIMEImage
|
||||
|
||||
|
||||
|
||||
class BaseNotification(object):
|
||||
"Notification base class"
|
||||
def __init__(self, quarantine_name, config, configtest=False):
|
||||
self.quarantine_name = quarantine_name
|
||||
self.config = config[quarantine_name]
|
||||
self.global_config = config["global"]
|
||||
self.logger = logging.getLogger(__name__)
|
||||
|
||||
def notify(self, queueid, quarantine_id, subject, mailfrom, recipients, fp):
|
||||
pass
|
||||
|
||||
|
||||
|
||||
class EMailNotification(BaseNotification):
|
||||
"Notification class to send notifications via mail."
|
||||
_html_text = "text/html"
|
||||
_plain_text = "text/plain"
|
||||
_bad_tags = [
|
||||
"applet",
|
||||
"embed",
|
||||
"frame",
|
||||
"frameset",
|
||||
"head",
|
||||
"iframe",
|
||||
"script"
|
||||
]
|
||||
_good_tags = [
|
||||
"a",
|
||||
"b",
|
||||
"br",
|
||||
"center",
|
||||
"div",
|
||||
"font",
|
||||
"h1",
|
||||
"h2",
|
||||
"h3",
|
||||
"h4",
|
||||
"h5",
|
||||
"h6",
|
||||
"i",
|
||||
"img",
|
||||
"li",
|
||||
"span",
|
||||
"table",
|
||||
"td",
|
||||
"th",
|
||||
"tr",
|
||||
"tt",
|
||||
"u",
|
||||
"ul"
|
||||
]
|
||||
good_attributes = [
|
||||
"align",
|
||||
"alt",
|
||||
"bgcolor",
|
||||
"border",
|
||||
"cellpadding",
|
||||
"cellspacing",
|
||||
"colspan",
|
||||
"dir",
|
||||
"headers",
|
||||
"height",
|
||||
"name",
|
||||
"rowspan",
|
||||
"size",
|
||||
"src",
|
||||
"style",
|
||||
"title",
|
||||
"type",
|
||||
"value",
|
||||
"width"
|
||||
]
|
||||
|
||||
def __init__(self, quarantine_name, config, configtest=False):
|
||||
super(EMailNotification, self).__init__(quarantine_name, config, configtest)
|
||||
# check if mandatory options are present in config
|
||||
for option in ["smtp_host", "smtp_port", "notification_email_from", "notification_email_subject", "notification_email_template", "notification_email_replacement_img"]:
|
||||
if option not in self.config.keys() and option in self.global_config.keys():
|
||||
self.config[option] = self.global_config[option]
|
||||
if option not in self.config.keys():
|
||||
raise RuntimeError("mandatory option '{}' not present in config section '{}' or 'global'".format(option, self.quarantine_name))
|
||||
self.smtp_host = self.config["smtp_host"]
|
||||
self.smtp_port = self.config["smtp_port"]
|
||||
self.mailfrom = self.config["notification_email_from"]
|
||||
self.subject = self.config["notification_email_subject"]
|
||||
try:
|
||||
self.template = open(self.config["notification_email_template"], "rb").read()
|
||||
except Exception as e:
|
||||
raise RuntimeError("error reading email template: {}".format(e))
|
||||
try:
|
||||
self.replacement_img = MIMEImage(open(self.config["notification_email_replacement_img"], "rb").read())
|
||||
except Exception as e:
|
||||
raise RuntimeError("error reading email replacement image: {}".format(e))
|
||||
else:
|
||||
self.replacement_img.add_header("Content-ID", "<removed_for_security_reasons>")
|
||||
|
||||
def get_text(self, part):
|
||||
"Get the mail text in html form from email part."
|
||||
mimetype = part.get_content_type()
|
||||
text = part.get_payload(decode=True)
|
||||
if mimetype == EMailNotification._plain_text:
|
||||
text = re.sub(r"^(.*)$", r"\1<br/>\n", text, flags=re.MULTILINE)
|
||||
soup = BeautifulSoup(text, "lxml", from_encoding=part.get_content_charset())
|
||||
return soup
|
||||
|
||||
def get_text_multipart(self, msg, preferred=_html_text):
|
||||
"Get the mail text of a multipart email in html form."
|
||||
soup = None
|
||||
for part in msg.get_payload():
|
||||
mimetype = part.get_content_type()
|
||||
if mimetype in [EMailNotification._plain_text, EMailNotification._html_text]:
|
||||
soup = self.get_text(part)
|
||||
elif mimetype.startswith("multipart"):
|
||||
soup = self.get_text_multipart(part, preferred)
|
||||
if soup != None and mimetype == preferred:
|
||||
break
|
||||
return soup
|
||||
|
||||
def sanitize(self, soup):
|
||||
"Sanitize mail html text."
|
||||
# completly remove bad elements
|
||||
for element in soup(EMailNotification._bad_tags):
|
||||
element.extract()
|
||||
# remove not whitelisted elements, but keep their content
|
||||
for element in soup.find_all(True):
|
||||
if element.name not in EMailNotification._good_tags:
|
||||
element.replaceWithChildren()
|
||||
# remove not whitelisted attributes
|
||||
for element in soup.find_all(True):
|
||||
for attribute in element.attrs.keys():
|
||||
if attribute not in EMailNotification.good_attributes:
|
||||
del(element.attrs[attribute])
|
||||
# set href attribute for all a-tags to #
|
||||
for element in soup("a"):
|
||||
element["href"] = "#"
|
||||
return soup
|
||||
|
||||
def get_html_text_part(self, msg):
|
||||
"Get the mail text of an email in html form."
|
||||
soup = None
|
||||
mimetype = msg.get_content_type()
|
||||
if mimetype in [EMailNotification._plain_text, EMailNotification._html_text]:
|
||||
soup = self.get_text(msg)
|
||||
elif mimetype.startswith("multipart"):
|
||||
soup = self.get_text_multipart(msg)
|
||||
if soup == None:
|
||||
text = "ERROR: unable to extract text from email body"
|
||||
soup = BeautifulSoup(text, "lxml", "UTF-8")
|
||||
return soup
|
||||
|
||||
def notify(self, queueid, quarantine_id, subject, mailfrom, recipients, fp):
|
||||
"Notify recipients via email."
|
||||
super(EMailNotification, self).notify(queueid, quarantine_id, subject, mailfrom, recipients, fp)
|
||||
self.logger.debug("{}: generating notification email".format(queueid))
|
||||
# extract html text from email
|
||||
self.logger.debug("{}: extraction email text from original email".format(queueid))
|
||||
soup = self.get_html_text_part(email.message_from_file(fp))
|
||||
# replace picture sources
|
||||
picture_replaced = False
|
||||
for element in soup("img"):
|
||||
if "src" in element:
|
||||
self.logger.debug("{}: replacing image: {}".format(queueid, element["src"]))
|
||||
element["src"] = "cid:removed_for_security_reasons"
|
||||
picture_replaced = True
|
||||
for recipient in recipients:
|
||||
self.logger.debug("{}: sending notification to <{}>".format(queueid, recipient))
|
||||
self.logger.debug("{}: parsing email template".format(queueid))
|
||||
htmltext = self.template.format( \
|
||||
EMAIL_HTML_TEXT=self.sanitize(soup), \
|
||||
EMAIL_FROM=mailfrom, \
|
||||
EMAIL_TO=recipient, \
|
||||
EMAIL_SUBJECT=subject, \
|
||||
EMAIL_QUARANTINE_ID=quarantine_id
|
||||
)
|
||||
msg = MIMEMultipart('alternative')
|
||||
msg["Subject"] = self.subject
|
||||
msg["From"] = "<{}>".format(self.mailfrom)
|
||||
msg["To"] = "<{}>".format(recipient)
|
||||
msg["Date"] = email.utils.formatdate()
|
||||
msg.attach(MIMEText(htmltext, "html", 'UTF-8'))
|
||||
if picture_replaced:
|
||||
msg.attach(self.replacement_img)
|
||||
mailer.sendmail(self.smtp_host, self.smtp_port, queueid, self.mailfrom, recipient, msg.as_string())
|
||||
|
||||
|
||||
|
||||
# list of notification types and their related notification classes
|
||||
notification_types = {"email": EMailNotification}
|
||||
74
pyquarantine/quarantines.py
Normal file
74
pyquarantine/quarantines.py
Normal file
@@ -0,0 +1,74 @@
|
||||
#!/usr/bin/env python2
|
||||
#
|
||||
# PyQuarantine-Milter is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# PyQuarantine-Milter is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with PyQuarantineMilter. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import datetime
|
||||
import json
|
||||
import logging
|
||||
import os
|
||||
|
||||
from shutil import copyfileobj
|
||||
|
||||
|
||||
|
||||
class BaseQuarantine(object):
|
||||
"Quarantine base class"
|
||||
def __init__(self, name, config, configtest=False):
|
||||
self.name = name
|
||||
self.config = config[name]
|
||||
self.global_config = config["global"]
|
||||
self.logger = logging.getLogger(__name__)
|
||||
|
||||
def add(self, queueid, mailfrom, recipients, fp):
|
||||
"Add mail to quarantine."
|
||||
return ""
|
||||
|
||||
|
||||
|
||||
class FileQuarantine(BaseQuarantine):
|
||||
"Quarantine class to store mails on filesystem."
|
||||
def __init__(self, name, config, configtest=False):
|
||||
super(FileQuarantine, self).__init__(name, config, configtest)
|
||||
# check if mandatory options are present in config
|
||||
for option in ["directory"]:
|
||||
if option not in self.config.keys() and option in self.global_config.keys():
|
||||
self.config[option] = self.global_config[option]
|
||||
if option not in self.config.keys():
|
||||
raise RuntimeError("mandatory option '{}' not present in config section '{}' or 'global'".format(option, self.name))
|
||||
self.directory = self.config["directory"]
|
||||
# check if quarantine directory exists and is writable
|
||||
if not os.path.isdir(self.directory) or not os.access(self.directory, os.W_OK):
|
||||
raise RuntimeError("file quarantine directory '{}' does not exist or is not writable".format(self.directory))
|
||||
|
||||
def add(self, queueid, mailfrom, recipients, fp):
|
||||
"Add mail to file quarantine and return quarantine-id."
|
||||
super(FileQuarantine, self).add(queueid, mailfrom, recipients, fp)
|
||||
quarantine_id = "{}_{}".format(datetime.datetime.now().strftime("%Y-%m-%d_%H%M%S"), queueid)
|
||||
# save mail
|
||||
with open(os.path.join(self.directory, quarantine_id), "wb") as f:
|
||||
copyfileobj(fp, f)
|
||||
# save metadata
|
||||
metadata = {
|
||||
"from": mailfrom,
|
||||
"recipients": recipients
|
||||
}
|
||||
with open(os.path.join(self.directory, "{}.metadata".format(quarantine_id)), "wb") as f:
|
||||
json.dump(metadata, f, indent=2)
|
||||
return quarantine_id
|
||||
|
||||
|
||||
|
||||
# list of quarantine types and their related quarantine classes
|
||||
quarantine_types = {"file": FileQuarantine}
|
||||
98
pyquarantine/run.py
Normal file
98
pyquarantine/run.py
Normal file
@@ -0,0 +1,98 @@
|
||||
#!/usr/bin/env python2
|
||||
#
|
||||
# PyQuarantine-Milter is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# PyQuarantine-Milter is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with PyQuarantineMilter. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import Milter
|
||||
import argparse
|
||||
import logging
|
||||
import logging.handlers
|
||||
import sys
|
||||
|
||||
import pyquarantine
|
||||
|
||||
|
||||
|
||||
def main():
|
||||
"Run PyQuarantine-Milter."
|
||||
# parse command line
|
||||
parser = argparse.ArgumentParser(description="Quarantine milter daemon",
|
||||
formatter_class=lambda prog: argparse.HelpFormatter(prog, max_help_position=45, width=140))
|
||||
parser.add_argument('-c', '--config', help='list of config files', nargs='+',
|
||||
default=pyquarantine.QuarantineMilter.get_configfiles())
|
||||
parser.add_argument('-s', '--socket', help='socket used to communicatewith the MTA', required=True)
|
||||
parser.add_argument('-d', '--debug', help='log debugging messages', action='store_true')
|
||||
parser.add_argument('-t', '--test', help='check configuration', action='store_true')
|
||||
args = parser.parse_args()
|
||||
# setup logging
|
||||
loglevel = logging.INFO
|
||||
logname = "pyquarantine-milter"
|
||||
syslog_name = logname
|
||||
if args.debug:
|
||||
loglevel = logging.DEBUG
|
||||
logname = "{}[%(name)s]".format(logname)
|
||||
syslog_name = "{}: [%(name)s] %(levelname)s".format(syslog_name)
|
||||
# set config files for milter class
|
||||
pyquarantine.QuarantineMilter.set_configfiles(args.config)
|
||||
logger = logging.getLogger()
|
||||
logger.setLevel(loglevel)
|
||||
# setup console log
|
||||
stdouthandler = logging.StreamHandler(sys.stdout)
|
||||
stdouthandler.setLevel(logging.DEBUG)
|
||||
formatter = logging.Formatter("%(message)s".format(logname))
|
||||
stdouthandler.setFormatter(formatter)
|
||||
logger.addHandler(stdouthandler)
|
||||
logger = logging.getLogger(__name__)
|
||||
if args.test:
|
||||
try:
|
||||
pyquarantine.generate_milter_config(args.test)
|
||||
except RuntimeError as e:
|
||||
logger.error(e)
|
||||
sys.exit(255)
|
||||
else:
|
||||
sys.exit(0)
|
||||
formatter = logging.Formatter("%(asctime)s {}: %(levelname)s - %(message)s".format(logname), datefmt="%Y-%m-%d %H:%M:%S")
|
||||
stdouthandler.setFormatter(formatter)
|
||||
# setup syslog
|
||||
sysloghandler = logging.handlers.SysLogHandler(address="/dev/log", facility=logging.handlers.SysLogHandler.LOG_MAIL)
|
||||
sysloghandler.setLevel(loglevel)
|
||||
formatter = logging.Formatter("{}: %(message)s".format(syslog_name))
|
||||
sysloghandler.setFormatter(formatter)
|
||||
logger.addHandler(sysloghandler)
|
||||
logger.info("PyQuarantine-Milter starting")
|
||||
try:
|
||||
# generate milter config
|
||||
pyquarantine.QuarantineMilter.config = pyquarantine.generate_milter_config()
|
||||
except RuntimeError as e:
|
||||
logger.error(e)
|
||||
sys.exit(255)
|
||||
# register to have the Milter factory create instances of your class:
|
||||
Milter.factory = pyquarantine.QuarantineMilter
|
||||
Milter.set_exception_policy(Milter.TEMPFAIL)
|
||||
#Milter.set_flags(0) # tell sendmail which features we use
|
||||
# run milter
|
||||
rc = 0
|
||||
try:
|
||||
Milter.runmilter("pyquarantine-milter", socketname=args.socket, timeout=300)
|
||||
except Milter.milter.error as e:
|
||||
logger.error(e)
|
||||
rc = 255
|
||||
pyquarantine.mailer.queue.put(None)
|
||||
logger.info("PyQuarantine-Milter terminated")
|
||||
sys.exit(rc)
|
||||
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
141
pyquarantine/whitelists.py
Normal file
141
pyquarantine/whitelists.py
Normal file
@@ -0,0 +1,141 @@
|
||||
#!/usr/bin/env python2
|
||||
#
|
||||
# PyQuarantine-Milter is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# PyQuarantine-Milter is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with PyQuarantineMilter. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
|
||||
import datetime
|
||||
import logging
|
||||
import peewee
|
||||
import re
|
||||
import sys
|
||||
from playhouse.db_url import connect
|
||||
|
||||
|
||||
|
||||
class WhitelistModel(peewee.Model):
|
||||
mailfrom = peewee.CharField()
|
||||
recipient = peewee.CharField()
|
||||
created = peewee.DateTimeField(default=datetime.datetime.now)
|
||||
last_used = peewee.DateTimeField(default=datetime.datetime.now)
|
||||
comment = peewee.TextField(default="")
|
||||
permanent = peewee.BooleanField(default=False)
|
||||
|
||||
|
||||
|
||||
class Meta(object):
|
||||
indexes = (
|
||||
(('mailfrom', 'recipient'), True), # trailing comma is mandatory if only one index should be created
|
||||
)
|
||||
|
||||
|
||||
|
||||
class Whitelist(object):
|
||||
"Whitelist base class"
|
||||
_whitelists = {}
|
||||
|
||||
def __init__(self, name, config, configtest=False):
|
||||
self.name = name
|
||||
self.config = config[name]
|
||||
self.global_config = config["global"]
|
||||
self.logger = logging.getLogger(__name__)
|
||||
# check if mandatory options are present in config
|
||||
for option in ["whitelist_table"]:
|
||||
if option not in self.config.keys() and option in self.global_config.keys():
|
||||
self.config[option] = self.global_config[option]
|
||||
if option not in self.config.keys():
|
||||
raise RuntimeError("mandatory option '{}' not present in config section '{}' or 'global'".format(option, self.name))
|
||||
self.tablename = self.config["whitelist_table"]
|
||||
connection_string = self.config["whitelist"]
|
||||
if connection_string in Whitelist._whitelists.keys():
|
||||
self.db = Whitelist._whitelists[connection_string]
|
||||
return
|
||||
try:
|
||||
# connect to database
|
||||
self.logger.debug("connecting to database '{}'".format(re.sub(r"(.*?://.*?):.*?(@.*)", r"\1:<PASSWORD>\2", connection_string)))
|
||||
self.db = connect(connection_string)
|
||||
except Exception as e:
|
||||
raise RuntimeError("unable to connect to database: {}".format(e))
|
||||
else:
|
||||
Whitelist._whitelists[connection_string] = self.db
|
||||
if configtest: return
|
||||
self.Meta = Meta
|
||||
self.Meta.database = self.db
|
||||
self.Meta.table_name = self.tablename
|
||||
self.Whitelist = type("WhitelistModel_{}".format(name), (WhitelistModel,), {
|
||||
"Meta": self.Meta
|
||||
})
|
||||
try:
|
||||
self.db.create_tables([self.Whitelist])
|
||||
except Exception as e:
|
||||
raise RuntimeError("unable to initialize table '{}': {}".format(self.tablename, e))
|
||||
|
||||
def get_weight(self, entry):
|
||||
value = 0
|
||||
for address in [entry.mailfrom, entry.recipient]:
|
||||
if address == "":
|
||||
value += 2
|
||||
elif address[0] == "@":
|
||||
value += 1
|
||||
return value
|
||||
|
||||
def check(self, mailfrom, recipient):
|
||||
# generate list of possible mailfroms
|
||||
self.logger.debug("query database for whitelist entries from <{}> to <{}>".format(mailfrom, recipient))
|
||||
mailfroms = [""]
|
||||
if "@" in mailfrom:
|
||||
mailfroms.append("@{}".format(mailfrom.split("@")[1]))
|
||||
mailfroms.append(mailfrom)
|
||||
# generate list of possible recipients
|
||||
recipients = [""]
|
||||
if "@" in recipient:
|
||||
recipients.append("@{}".format(recipient.split("@")[1]))
|
||||
recipients.append(recipient)
|
||||
# query the database
|
||||
try:
|
||||
entries = list(self.Whitelist.select().where(self.Whitelist.mailfrom.in_(mailfroms), self.Whitelist.recipient.in_(recipients)))
|
||||
except Exception as e:
|
||||
entries = []
|
||||
self.logger.error("unable to query whitelist database: {}".format(e))
|
||||
if len(entries) == 0:
|
||||
# no whitelist entry found
|
||||
return False
|
||||
print(entries)
|
||||
if len(entries) > 1:
|
||||
entries.sort(key=lambda x: self.get_weight(x))
|
||||
# use entry with the highest weight
|
||||
entry = entries[-1]
|
||||
entry.last_used = datetime.datetime.now()
|
||||
entry.save()
|
||||
return True
|
||||
|
||||
|
||||
|
||||
class WhitelistCache(object):
|
||||
def __init__(self):
|
||||
self.cache = {}
|
||||
|
||||
def load(self, whitelist, mailfrom, recipients):
|
||||
for recipient in recipients:
|
||||
self.check(whitelist, mailfrom, recipient)
|
||||
|
||||
def check(self, whitelist, mailfrom, recipient):
|
||||
if whitelist not in self.cache.keys(): self.cache[whitelist] = {}
|
||||
if recipient not in self.cache[whitelist].keys(): self.cache[whitelist][recipient] = None
|
||||
if self.cache[whitelist][recipient] == None:
|
||||
self.cache[whitelist][recipient] = whitelist.check(mailfrom, recipient)
|
||||
return self.cache[whitelist][recipient]
|
||||
|
||||
def get_whitelisted_recipients(self, whitelist, mailfrom, recipients):
|
||||
self.load(whitelist, mailfrom, recipients)
|
||||
return filter(lambda x: self.cache[whitelist][x] == True, self.cache[whitelist].keys())
|
||||
Reference in New Issue
Block a user