5.3.1.2 smtpd_check_*函数的ACL验证方法

来源：互联网发布：ios运行windows程序编辑：程序博客网时间：2024/05/17 07:23

我们来看一下smtp协议解析中ACL函数的实现：

smtpd_check_client, smtpd_check_helo：

这两个函数直接使用generic_checks函数做ACL验证：

smtpd_check_client：status = generic_checks(state,client_restrctions, state->namaddr,SMTPD_NAME_CLIENT, CHECK_CLIENT_ACL);return (status == SMTPD_CHECK_REJECT ?STR(error_text) : 0);

smtpd_check_helo：status = generic_checks(state,helo_restrctions, state->helo_name,SMTPD_NAME_HELO, CHECK_HELO_ACL);SMTPD_CHECK_HELO_RETURN(status ==SMTPD_CHECK_REJECT ? STR(error_text) : 0);

smtpd_check_mail:

首先用generic_checks做验证

status = generic_checks(state,mail_restrctions, sender,SMTPD_NAME_SENDER,CHECK_SENDER_ACL);

如果定义了smtpd_reject_unlisted_sender参数，再用check_sender_rcpt_maps函数来验证。smtpd_reject_unlisted_sender表示拒绝未知发件人，默认为no：

  /*    * If the "reject_unlisted_sender" restriction still needs tobe applied,    * validate the sender here.    */   if (var_smtpd_rej_unl_from         &&status != SMTPD_CHECK_REJECT && state->sender_rcptmap_checked == 0         &&state->discard == 0 && *sender)         status= check_sender_rcpt_maps(state, sender);

SMTPD_CHECK_MAIL_RETURN(status== SMTPD_CHECK_REJECT ? STR(error_text) : 0);

smtpd_check_rcpt：

RCPT命令的ACL规则涉及到参数smtpd_delay_reject，该参数指定将挡信行为延迟到RCPT命令执行，这样做的目的是为了在日志中保留对方更详尽的信息。

1如果设定了smtpd_delay_reject参数，因为smtpd_check_rcpt函数被调用的时候说明已经执行到RCPT命令了，所以这里可以“结算”所累积的错误:

    if (var_smtpd_delay_reject)         if ((err = smtpd_check_client(state)) !=0            || (err = smtpd_check_helo(state, state->helo_name)) != 0            || (err = smtpd_check_mail(state, state->sender)) != 0)            SMTPD_CHECK_RCPT_RETURN(err);

2 综合smtp_relay_restrictions和smtp_recipient_restrictionACL规则的设定计算generic_checks:

 restrctions[0] = relay_restrctions;   restrctions[1] = rcpt_restrctions;   for (n = 0; n < 2; n++) {         status= setjmp(smtpd_check_buf);         if(status == 0 && restrctions[n]->argc)             status = generic_checks(state,restrctions[n],                              recipient, SMTPD_NAME_RECIPIENT,CHECK_RECIP_ACL);         if(status == SMTPD_CHECK_REJECT)             break;        }

3 smtpd_reject_unlisted_recipient参数表示postfix拒绝向不可识别的地址发送邮件，默认为yes。如果群发邮件时有至少一个地址是不能解析的，则postfix拒绝发送此邮件。如果定义了该项，则用check_recipient_rcpt_maps函数检查收件列表

   /*    * If the "reject_unlisted_recipient" restriction still needsto be    * applied, validate the recipient here.    */   if (var_smtpd_rej_unl_rcpt         &&status != SMTPD_CHECK_REJECT         &&state->recipient_rcptmap_checked == 0         &&state->discard == 0)         status= check_recipient_rcpt_maps(state, recipient);

0 0