/usr/src/libexec/spamd/grey.c

Bug Summary

File:	src/libexec/spamd/grey.c
Warning:	line 558, column 3 Null pointer passed as 1st argument to memory copy function
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name grey.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/libexec/spamd/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/libexec/spamd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/libexec/spamd/grey.c
1/*	$OpenBSD: grey.c,v 1.66 2018/10/25 06:42:35 mestre Exp $	*/

3/*
* Copyright (c) 2004-2006 Bob Beck.  All rights reserved.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

19#include <sys/types.h>
20#include <sys/socket.h>
21#include <sys/ioctl.h>
22#include <sys/wait.h>
23#include <net/if.h>
24#include <netinet/in.h>
25#include <net/pfvar.h>
26#include <ctype.h>
27#include <db.h>
28#include <errno(*__errno()).h>
29#include <fcntl.h>
30#include <pwd.h>
31#include <signal.h>
32#include <stdio.h>
33#include <stdlib.h>
34#include <string.h>
35#include <syslog.h>
36#include <time.h>
37#include <unistd.h>
38#include <netdb.h>

40#include "grey.h"
41#include "sync.h"

43extern time_t passtime, greyexp, whiteexp, trapexp;
44extern struct syslog_data sdata;
45extern struct passwd *pw;
46extern u_short cfg_port;
47extern pid_t jail_pid;
48extern FILE *trapcfg;
49extern FILE *grey;
50extern int debug;
51extern int syncsend;
52extern int greyback[2];

54/* From netinet/in.h, but only _KERNEL_ gets them. */
55#define satosin(sa)((struct sockaddr_in *)(sa))	((struct sockaddr_in *)(sa))
56#define satosin6(sa)((struct sockaddr_in6 *)(sa))	((struct sockaddr_in6 *)(sa))

58void	configure_spamd(char **, u_int, FILE *);
59int	configure_pf(char **, int);
60char	*dequotetolower(const char *);
61void	readsuffixlists(void);
62void	freeaddrlists(void);
63int	addwhiteaddr(char *);
64int	addtrapaddr(char *);
65int	db_addrstate(DB *, char *);
66int	greyscan(char *);
67int	trapcheck(DB *, char *);
68int	twupdate(char *, char *, char *, char *, char *);
69int	twread(char *);
70int	greyreader(void);
71void	greyscanner(void);


74u_int whitecount, whitealloc;
75u_int trapcount, trapalloc;
76char **whitelist;
77char **traplist;

79char *traplist_name = "spamd-greytrap";
80char *traplist_msg = "\"Your address %A has mailed to spamtraps here\\n\"";

82pid_t db_pid = -1;
83int pfdev;

85struct db_change {
SLIST_ENTRY(db_change)struct { struct db_change *sle_next; }	entry;
char *			key;
void *			data;
size_t			dsiz;
int			act;
91};

93#define DBC_ADD1 1
94#define DBC_DEL2 2

96/* db pending changes list */
97SLIST_HEAD(, db_change)struct { struct db_change *slh_first; } db_changes = SLIST_HEAD_INITIALIZER(db_changes){ ((void *)0) };

99struct mail_addr {
SLIST_ENTRY(mail_addr)struct { struct mail_addr *sle_next; }	entry;
char			addr[MAX_MAIL1024];
102};

104/* list of suffixes that must match TO: */
105SLIST_HEAD(, mail_addr)struct { struct mail_addr *slh_first; } match_suffix = SLIST_HEAD_INITIALIZER(match_suffix){ ((void *)0) };
106char *alloweddomains_file = PATH_SPAMD_ALLOWEDDOMAINS"/etc/mail/spamd.alloweddomains";

108char *low_prio_mx_ip;
109time_t startup;

111static char *pargv[11]= {
"pfctl", "-p", "/dev/pf", "-q", "-t",
"spamd-white", "-T", "replace", "-f", "-", NULL((void *)0)
114};

116/* If the parent gets a signal, kill off the children and exit */
117/* ARGSUSED */
118static void
119sig_term_chld(int sig)
120{
if (db_pid != -1)
kill(db_pid, SIGTERM15);
if (jail_pid != -1)
kill(jail_pid, SIGTERM15);
_exit(1);
126}

128/*
* Greatly simplified version from spamd_setup.c  - only
* sends one blacklist to an already open stream. Has no need
* to collapse cidr ranges since these are only ever single
* host hits.
*/
134void
135configure_spamd(char **addrs, u_int count, FILE *sdc)
136{
u_int i;

/* XXX - doesn't support IPV6 yet */
fprintf(sdc, "%s;", traplist_name);
if (count != 0) {
fprintf(sdc, "%s;inet;%u", traplist_msg, count);
for (i = 0; i < count; i++)
	fprintf(sdc, ";%s/32", addrs[i]);
}
fputc('\n', sdc);
if (fflush(sdc) == EOF(-1))
syslog_r(LOG_DEBUG7, &sdata, "configure_spamd: fflush failed (%m)");
149}

151int
152configure_pf(char **addrs, int count)
153{
FILE *pf = NULL((void *)0);
int i, pdes[2], status;
pid_t pid;
char *fdpath;
struct sigaction sa;

sigfillset(&sa.sa_mask);
sa.sa_flags = SA_RESTART0x0002;
sa.sa_handler__sigaction_u.__sa_handler = sig_term_chld;

if (debug)
fprintf(stderr(&__sF[2]), "configure_pf - device on fd %d\n", pfdev);

/* Because /dev/fd/ only contains device nodes for 0-63 */
if (pfdev < 1 || pfdev > 63)
return(-1);

if (asprintf(&fdpath, "/dev/fd/%d", pfdev) == -1)
return(-1);
pargv[2] = fdpath;
if (pipe(pdes) != 0) {
syslog_r(LOG_INFO6, &sdata, "pipe failed (%m)");
free(fdpath);
fdpath = NULL((void *)0);
return(-1);
}
signal(SIGCHLD20, SIG_DFL(void (*)(int))0);
switch (pid = fork()) {
case -1:
syslog_r(LOG_INFO6, &sdata, "fork failed (%m)");
free(fdpath);
fdpath = NULL((void *)0);
close(pdes[0]);
close(pdes[1]);
sigaction(SIGCHLD20, &sa, NULL((void *)0));
return(-1);
case 0:
/* child */
close(pdes[1]);
if (pdes[0] != STDIN_FILENO0) {
	dup2(pdes[0], STDIN_FILENO0);
	close(pdes[0]);
}
execvp(PATH_PFCTL"/sbin/pfctl", pargv);
syslog_r(LOG_ERR3, &sdata, "can't exec %s:%m", PATH_PFCTL"/sbin/pfctl");
_exit(1);
}

/* parent */
free(fdpath);
fdpath = NULL((void *)0);
close(pdes[0]);
pf = fdopen(pdes[1], "w");
if (pf == NULL((void *)0)) {
syslog_r(LOG_INFO6, &sdata, "fdopen failed (%m)");
close(pdes[1]);
sigaction(SIGCHLD20, &sa, NULL((void *)0));
return(-1);
}
for (i = 0; i < count; i++)
if (addrs[i] != NULL((void *)0))
	fprintf(pf, "%s/32\n", addrs[i]);
fclose(pf);

waitpid(pid, &status, 0);
if (WIFEXITED(status)(((status) & 0177) == 0) && WEXITSTATUS(status)(int)(((unsigned)(status) >> 8) & 0xff) != 0)
syslog_r(LOG_ERR3, &sdata, "%s returned status %d", PATH_PFCTL"/sbin/pfctl",
    WEXITSTATUS(status)(int)(((unsigned)(status) >> 8) & 0xff));
else if (WIFSIGNALED(status)(((status) & 0177) != 0177 && ((status) & 0177
) != 0))
syslog_r(LOG_ERR3, &sdata, "%s died on signal %d", PATH_PFCTL"/sbin/pfctl",
    WTERMSIG(status)(((status) & 0177)));

sigaction(SIGCHLD20, &sa, NULL((void *)0));
return(0);
228}

230char *
231dequotetolower(const char *addr)
232{
static char buf[MAX_MAIL1024];
char *cp;

if (*addr == '<')
addr++;
(void) strlcpy(buf, addr, sizeof(buf));
cp = strrchr(buf, '>');
if (cp != NULL((void *)0) && cp[1] == '\0')
*cp = '\0';
cp = buf;
while (*cp != '\0') {
*cp = tolower((unsigned char)*cp);
cp++;
}
return(buf);
248}

250void
251readsuffixlists(void)
252{
FILE *fp;
char *buf;
size_t len;
struct mail_addr *m;

while (!SLIST_EMPTY(&match_suffix)(((&match_suffix)->slh_first) == ((void *)0))) {
m = SLIST_FIRST(&match_suffix)((&match_suffix)->slh_first);
SLIST_REMOVE_HEAD(&match_suffix, entry)do { (&match_suffix)->slh_first = (&match_suffix)->
slh_first->entry.sle_next; } while (0);
free(m);
}
if ((fp = fopen(alloweddomains_file, "r")) != NULL((void *)0)) {
while ((buf = fgetln(fp, &len))) {
	/* strip white space-characters */
	while (len > 0 && isspace((unsigned char)buf[len-1]))
		len--;
	while (len > 0 && isspace((unsigned char)*buf)) {
		buf++;
		len--;
	}
	if (len == 0)
		continue;
	/* jump over comments and blank lines */
	if (*buf == '#' || *buf == '\n')
		continue;
	if (buf[len-1] == '\n')
		len--;
	if ((len + 1) > sizeof(m->addr)) {
		syslog_r(LOG_ERR3, &sdata,
		    "line too long in %s - file ignored",
		    alloweddomains_file);
		goto bad;
	}
	if ((m = malloc(sizeof(struct mail_addr))) == NULL((void *)0))
		goto bad;
	memcpy(m->addr, buf, len);
	m->addr[len]='\0';
	syslog_r(LOG_ERR3, &sdata, "got suffix %s", m->addr);
	SLIST_INSERT_HEAD(&match_suffix, m, entry)do { (m)->entry.sle_next = (&match_suffix)->slh_first
; (&match_suffix)->slh_first = (m); } while (0);
}
}
return;
294bad:
while (!SLIST_EMPTY(&match_suffix)(((&match_suffix)->slh_first) == ((void *)0))) {
 	m = SLIST_FIRST(&match_suffix)((&match_suffix)->slh_first);
SLIST_REMOVE_HEAD(&match_suffix, entry)do { (&match_suffix)->slh_first = (&match_suffix)->
slh_first->entry.sle_next; } while (0);
free(m);
}
300}

302void
303freeaddrlists(void)
304{
int i;

if (whitelist != NULL((void *)0))
for (i = 0; i < whitecount; i++) {
	free(whitelist[i]);
	whitelist[i] = NULL((void *)0);
}
whitecount = 0;
if (traplist != NULL((void *)0)) {
for (i = 0; i < trapcount; i++) {
	free(traplist[i]);
	traplist[i] = NULL((void *)0);
}
}
trapcount = 0;
320}

322/* validate, then add to list of addrs to whitelist */
323int
324addwhiteaddr(char *addr)
325{
struct addrinfo hints, *res;
char ch;

memset(&hints, 0, sizeof(hints));
hints.ai_family = AF_INET2;		/*for now*/
hints.ai_socktype = SOCK_DGRAM2;		/*dummy*/
hints.ai_protocol = IPPROTO_UDP17;	/*dummy*/
hints.ai_flags = AI_NUMERICHOST4;

if (getaddrinfo(addr, NULL((void *)0), &hints, &res) != 0)
return(-1);

/* Check spamd blacklists in main process. */
if (send(greyback[0], res->ai_addr, res->ai_addr->sa_len, 0) == -1) {
syslog_r(LOG_ERR3, &sdata, "%s: send: %m", __func__);
} else {
if (recv(greyback[0], &ch, sizeof(ch), 0) == 1) {
	if (ch == '1') {
		syslog_r(LOG_DEBUG7, &sdata,
		    "%s blacklisted, removing from whitelist",
		    addr);
		freeaddrinfo(res);
		return(-1);
	}
}
}

if (whitecount == whitealloc) {
char **tmp;

tmp = reallocarray(whitelist,
    whitealloc + 1024, sizeof(char *));
if (tmp == NULL((void *)0)) {
	freeaddrinfo(res);
	return(-1);
}
whitelist = tmp;
whitealloc += 1024;
}
whitelist[whitecount] = strdup(addr);
if (whitelist[whitecount] == NULL((void *)0)) {
freeaddrinfo(res);
return(-1);
}
whitecount++;
freeaddrinfo(res);
return(0);
373}

375/* validate, then add to list of addrs to traplist */
376int
377addtrapaddr(char *addr)
378{
struct addrinfo hints, *res;

memset(&hints, 0, sizeof(hints));
hints.ai_family = AF_INET2;		/*for now*/
hints.ai_socktype = SOCK_DGRAM2;		/*dummy*/
hints.ai_protocol = IPPROTO_UDP17;	/*dummy*/
hints.ai_flags = AI_NUMERICHOST4;

if (getaddrinfo(addr, NULL((void *)0), &hints, &res) == 0) {
if (trapcount == trapalloc) {
	char **tmp;

	tmp = reallocarray(traplist,
	    trapalloc + 1024, sizeof(char *));
	if (tmp == NULL((void *)0)) {
		freeaddrinfo(res);
		return(-1);
	}
	traplist = tmp;
	trapalloc += 1024;
}
traplist[trapcount] = strdup(addr);
if (traplist[trapcount] == NULL((void *)0)) {
	freeaddrinfo(res);
	return(-1);
}
trapcount++;
freeaddrinfo(res);
} else
return(-1);
return(0);
410}

412static int
413queue_change(char *key, char *data, size_t dsiz, int act)
414{
struct db_change *dbc;

if ((dbc = malloc(sizeof(*dbc))) == NULL((void *)0)) {
syslog_r(LOG_DEBUG7, &sdata, "malloc failed (queue change)");
return(-1);
}
if ((dbc->key = strdup(key)) == NULL((void *)0)) {
syslog_r(LOG_DEBUG7, &sdata, "malloc failed (queue change)");
free(dbc);
return(-1);
}
if ((dbc->data = malloc(dsiz)) == NULL((void *)0)) {
syslog_r(LOG_DEBUG7, &sdata, "malloc failed (queue change)");
free(dbc->key);
free(dbc);
return(-1);
}
memcpy(dbc->data, data, dsiz);
dbc->dsiz = dsiz;
dbc->act = act;
syslog_r(LOG_DEBUG7, &sdata,
   "queueing %s of %s", ((act == DBC_ADD1) ? "add" : "deletion"),
   dbc->key);
SLIST_INSERT_HEAD(&db_changes, dbc, entry)do { (dbc)->entry.sle_next = (&db_changes)->slh_first
; (&db_changes)->slh_first = (dbc); } while (0);
return(0);
440}

442static int
443do_changes(DB *db)
444{
DBT			dbk, dbd;
struct db_change	*dbc;
int ret = 0;

while (!SLIST_EMPTY(&db_changes)(((&db_changes)->slh_first) == ((void *)0))) {
dbc = SLIST_FIRST(&db_changes)((&db_changes)->slh_first);
switch (dbc->act) {
case DBC_ADD1:
	memset(&dbk, 0, sizeof(dbk));
	dbk.size = strlen(dbc->key);
	dbk.data = dbc->key;
	memset(&dbd, 0, sizeof(dbd));
	dbd.size = dbc->dsiz;
	dbd.data = dbc->data;
	if (db->put(db, &dbk, &dbd, 0)) {
		db->sync(db, 0);
		syslog_r(LOG_ERR3, &sdata,
		    "can't add %s to spamd db (%m)", dbc->key);
		ret = -1;
	}
	db->sync(db, 0);
	break;
case DBC_DEL2:
	memset(&dbk, 0, sizeof(dbk));
	dbk.size = strlen(dbc->key);
	dbk.data = dbc->key;
	if (db->del(db, &dbk, 0)) {
		syslog_r(LOG_ERR3, &sdata,
		    "can't delete %s from spamd db (%m)",
		    dbc->key);
		ret = -1;
	}
	break;
default:
	syslog_r(LOG_ERR3, &sdata, "Unrecognized db change");
	ret = -1;
}
free(dbc->key);
dbc->key = NULL((void *)0);
free(dbc->data);
dbc->data = NULL((void *)0);
dbc->act = 0;
dbc->dsiz = 0;
SLIST_REMOVE_HEAD(&db_changes, entry)do { (&db_changes)->slh_first = (&db_changes)->
slh_first->entry.sle_next; } while (0);
free(dbc);

}
return(ret);
493}

495/* -1=error, 0=notfound, 1=TRAPPED, 2=WHITE */
496int
497db_addrstate(DB *db, char *key)
498{
DBT			dbk, dbd;
struct gdata		gd;

memset(&dbk, 0, sizeof(dbk));
dbk.size = strlen(key);
dbk.data = key;
memset(&dbd, 0, sizeof(dbd));
switch (db->get(db, &dbk, &dbd, 0)) {
case 1:
/* not found */
return (0);
case 0:
if (gdcopyin(&dbd, &gd) != -1)
	return (gd.pcount == -1 ? 1 : 2);
/* FALLTHROUGH */
default:
/* error */
return (-1);
}
518}


521int
522greyscan(char *dbname)
523{
HASHINFO	hashinfo;
DBT		dbk, dbd;
DB		*db;
struct gdata	gd;
int		r;
char		*a = NULL((void *)0);
13
←
'a' initialized to a null pointer value→
size_t		asiz = 0;
time_t now = time(NULL((void *)0));

/* walk db, expire, and whitelist */
memset(&hashinfo, 0, sizeof(hashinfo));
db = dbopen(dbname, O_EXLOCK0x0020|O_RDWR0x0002, 0600, DB_HASH, &hashinfo);
if (db == NULL((void *)0)) {
14
←
Assuming 'db' is not equal to NULL→
15
←
Taking false branch→
syslog_r(LOG_INFO6, &sdata, "dbopen failed (%m)");
return(-1);
}
memset(&dbk, 0, sizeof(dbk));
memset(&dbd, 0, sizeof(dbd));
for (r = db->seq(db, &dbk, &dbd, R_FIRST3); !r;
16
←
Assuming 'r' is 0→
17
←
Loop condition is true.  Entering loop body→
   r = db->seq(db, &dbk, &dbd, R_NEXT7)) {
if ((dbk.size < 1) || gdcopyin(&dbd, &gd) == -1) {
18
←
Assuming field 'size' is >= 1→
19
←
Assuming the condition is false→
20
←
Taking false branch→
	syslog_r(LOG_ERR3, &sdata, "bogus entry in spamd database");
	goto bad;
}
if (asiz < dbk.size + 1) {
21
←
Assuming the condition is false→
22
←
Taking false branch→
	char *tmp;

	tmp = reallocarray(a, dbk.size, 2);
	if (tmp == NULL((void *)0))
		goto bad;
	a = tmp;
	asiz = dbk.size * 2;
}
memset(a, 0, asiz);
memcpy(a, dbk.data, dbk.size);
23
←
Null pointer passed as 1st argument to memory copy function
if (gd.expire <= now && gd.pcount != -2) {
	/* get rid of entry */
	if (queue_change(a, NULL((void *)0), 0, DBC_DEL2) == -1)
		goto bad;
} else if (gd.pcount == -1)  {
	/* this is a greytrap hit */
	if ((addtrapaddr(a) == -1) &&
	    (queue_change(a, NULL((void *)0), 0, DBC_DEL2) == -1))
		goto bad;
} else if (gd.pcount >= 0 && gd.pass <= now) {
	int tuple = 0;
	char *cp;
	int state;

	/*
	 * if not already TRAPPED,
	 * add address to whitelist
	 * add an address-keyed entry to db
	 */
	cp = strchr(a, '\n');
	if (cp != NULL((void *)0)) {
		tuple = 1;
		*cp = '\0';
	}

	state = db_addrstate(db, a);
	if (state != 1 && addwhiteaddr(a) == -1) {
		if (cp != NULL((void *)0))
			*cp = '\n';
		if (queue_change(a, NULL((void *)0), 0, DBC_DEL2) == -1)
			goto bad;
	}

	if (tuple && state <= 0) {
		if (cp != NULL((void *)0))
			*cp = '\0';
		/* re-add entry, keyed only by ip */
		gd.expire = now + whiteexp;
		dbd.size = sizeof(gd);
		dbd.data = &gd;
		if (queue_change(a, (void *) &gd, sizeof(gd),
		    DBC_ADD1) == -1)
			goto bad;
		syslog_r(LOG_DEBUG7, &sdata,
		    "whitelisting %s in %s", a, dbname);
	}
	if (debug)
		fprintf(stderr(&__sF[2]), "whitelisted %s\n", a);
}
}
(void) do_changes(db);
db->close(db);
db = NULL((void *)0);
configure_pf(whitelist, whitecount);
configure_spamd(traplist, trapcount, trapcfg);

freeaddrlists();
free(a);
a = NULL((void *)0);
return(0);
bad:
(void) do_changes(db);
db->close(db);
db = NULL((void *)0);
freeaddrlists();
free(a);
a = NULL((void *)0);
return(-1);
627}

629int
630trapcheck(DB *db, char *to)
631{
int			i, j, smatch = 0;
DBT			dbk, dbd;
struct mail_addr	*m;
char *			trap;
size_t			s;

trap = dequotetolower(to);
if (!SLIST_EMPTY(&match_suffix)(((&match_suffix)->slh_first) == ((void *)0))) {
s = strlen(trap);
SLIST_FOREACH(m, &match_suffix, entry)for((m) = ((&match_suffix)->slh_first); (m) != ((void *
)0); (m) = ((m)->entry.sle_next)) {
	j = s - strlen(m->addr);
	if ((j >= 0) && (strcasecmp(trap+j, m->addr) == 0))
		smatch = 1;
}
if (!smatch)
	/* no suffixes match, so trap it */
	return (0);
}
memset(&dbk, 0, sizeof(dbk));
dbk.size = strlen(trap);
dbk.data = trap;
memset(&dbd, 0, sizeof(dbd));
i = db->get(db, &dbk, &dbd, 0);
if (i == -1)
return (-1);
if (i)
/* didn't exist - so this doesn't match a known spamtrap  */
return (1);
else
/* To: address is a spamtrap, so add as a greytrap entry */
return (0);
663}

665int
666twupdate(char *dbname, char *what, char *ip, char *source, char *expires)
667{
/* we got a TRAP or WHITE update from someone else */
HASHINFO	hashinfo;
DBT		dbk, dbd;
DB		*db;
struct gdata	gd;
time_t		now, expire;
int		r, spamtrap;

now = time(NULL((void *)0));
/* expiry times have to be in the future */
expire = strtonum(expires, now,
   sizeof(time_t) == sizeof(int) ? INT_MAX2147483647 : LLONG_MAX9223372036854775807LL, NULL((void *)0));
if (expire == 0)
return(-1);

if (strcmp(what, "TRAP") == 0)
spamtrap = 1;
else if (strcmp(what, "WHITE") == 0)
spamtrap = 0;
else
return(-1);

memset(&hashinfo, 0, sizeof(hashinfo));
db = dbopen(dbname, O_EXLOCK0x0020|O_RDWR0x0002, 0600, DB_HASH, &hashinfo);
if (db == NULL((void *)0))
return(-1);

memset(&dbk, 0, sizeof(dbk));
dbk.size = strlen(ip);
dbk.data = ip;
memset(&dbd, 0, sizeof(dbd));
r = db->get(db, &dbk, &dbd, 0);
if (r == -1)
goto bad;
if (r) {
/* new entry */
memset(&gd, 0, sizeof(gd));
gd.first = now;
gd.pcount = spamtrap ? -1 : 0;
gd.expire = expire;
memset(&dbk, 0, sizeof(dbk));
dbk.size = strlen(ip);
dbk.data = ip;
memset(&dbd, 0, sizeof(dbd));
dbd.size = sizeof(gd);
dbd.data = &gd;
r = db->put(db, &dbk, &dbd, 0);
db->sync(db, 0);
if (r)
	goto bad;
if (debug)
	fprintf(stderr(&__sF[2]), "added %s %s\n",
	    spamtrap ? "trap entry for" : "", ip);
syslog_r(LOG_DEBUG7, &sdata,
    "new %s from %s for %s, expires %s", what, source, ip,
    expires);
} else {
/* existing entry */
if (gdcopyin(&dbd, &gd) == -1) {
	/* whatever this is, it doesn't belong */
	db->del(db, &dbk, 0);
	db->sync(db, 0);
	goto bad;
}
if (spamtrap) {
	gd.pcount = -1;
	gd.bcount++;
} else
	gd.pcount++;
memset(&dbk, 0, sizeof(dbk));
dbk.size = strlen(ip);
dbk.data = ip;
memset(&dbd, 0, sizeof(dbd));
dbd.size = sizeof(gd);
dbd.data = &gd;
r = db->put(db, &dbk, &dbd, 0);
db->sync(db, 0);
if (r)
	goto bad;
if (debug)
	fprintf(stderr(&__sF[2]), "updated %s\n", ip);
}
db->close(db);
return(0);
bad:
db->close(db);
return(-1);

756}

758int
759greyupdate(char *dbname, char *helo, char *ip, char *from, char *to, int sync,
  char *cip)
761{
HASHINFO	hashinfo;
DBT		dbk, dbd;
DB		*db;
char		*key = NULL((void *)0);
char		*lookup;
struct gdata	gd;
time_t		now, expire;
int		r, spamtrap;

now = time(NULL((void *)0));

/* open with lock, find record, update, close, unlock */
memset(&hashinfo, 0, sizeof(hashinfo));
db = dbopen(dbname, O_EXLOCK0x0020|O_RDWR0x0002, 0600, DB_HASH, &hashinfo);
if (db == NULL((void *)0))
return(-1);
if (asprintf(&key, "%s\n%s\n%s\n%s", ip, helo, from, to) == -1)
goto bad;
r = trapcheck(db, to);
switch (r) {
case 1:
/* do not trap */
spamtrap = 0;
lookup = key;
expire = greyexp;
break;
case 0:
/* trap */
spamtrap = 1;
lookup = ip;
expire = trapexp;
syslog_r(LOG_DEBUG7, &sdata, "Trapping %s for tuple %s", ip,
    key);
break;
default:
goto bad;
break;
}
memset(&dbk, 0, sizeof(dbk));
dbk.size = strlen(lookup);
dbk.data = lookup;
memset(&dbd, 0, sizeof(dbd));
r = db->get(db, &dbk, &dbd, 0);
if (r == -1)
goto bad;
if (r) {
/* new entry */
if (sync &&  low_prio_mx_ip &&
    (strcmp(cip, low_prio_mx_ip) == 0) &&
    ((startup + 60)  < now)) {
	/* we haven't seen a greylist entry for this tuple,
	 * and yet the connection was to a low priority MX
	 * which we know can't be hit first if the client
	 * is adhering to the RFC's - soo.. kill it!
	 */
	spamtrap = 1;
	lookup = ip;
	expire = trapexp;
	syslog_r(LOG_DEBUG7, &sdata,
	    "Trapping %s for trying %s first for tuple %s",
	    ip, low_prio_mx_ip, key);
}
memset(&gd, 0, sizeof(gd));
gd.first = now;
gd.bcount = 1;
gd.pcount = spamtrap ? -1 : 0;
gd.pass = now + expire;
gd.expire = now + expire;
memset(&dbk, 0, sizeof(dbk));
dbk.size = strlen(lookup);
dbk.data = lookup;
memset(&dbd, 0, sizeof(dbd));
dbd.size = sizeof(gd);
dbd.data = &gd;
r = db->put(db, &dbk, &dbd, 0);
db->sync(db, 0);
if (r)
	goto bad;
if (debug)
	fprintf(stderr(&__sF[2]), "added %s %s\n",
	    spamtrap ? "greytrap entry for" : "", lookup);
syslog_r(LOG_DEBUG7, &sdata,
    "new %sentry %s from %s to %s, helo %s",
    spamtrap ? "greytrap " : "", ip, from, to, helo);
} else {
/* existing entry */
if (gdcopyin(&dbd, &gd) == -1) {
	/* whatever this is, it doesn't belong */
	db->del(db, &dbk, 0);
	db->sync(db, 0);
	goto bad;
}
gd.bcount++;
gd.pcount = spamtrap ? -1 : 0;
if (gd.first + passtime < now)
	gd.pass = now;
memset(&dbk, 0, sizeof(dbk));
dbk.size = strlen(lookup);
dbk.data = lookup;
memset(&dbd, 0, sizeof(dbd));
dbd.size = sizeof(gd);
dbd.data = &gd;
r = db->put(db, &dbk, &dbd, 0);
db->sync(db, 0);
if (r)
	goto bad;
if (debug)
	fprintf(stderr(&__sF[2]), "updated %s\n", lookup);
}
free(key);
key = NULL((void *)0);
db->close(db);
db = NULL((void *)0);

/* Entry successfully update, sent out sync message */
if (syncsend && sync) {
if (spamtrap) {
	syslog_r(LOG_DEBUG7, &sdata,
	    "sync_trap %s", ip);
	sync_trapped(now, now + expire, ip);
}
else
	sync_update(now, helo, ip, from, to);
}
return(0);
bad:
free(key);
key = NULL((void *)0);
db->close(db);
db = NULL((void *)0);
return(-1);
893}

895int
896twread(char *buf)
897{
if ((strncmp(buf, "WHITE:", 6) == 0) ||
   (strncmp(buf, "TRAP:", 5) == 0)) {
char **ap, *argv[5];
int argc = 0;

for (ap = argv;
    ap < &argv[4] && (*ap = strsep(&buf, ":")) != NULL((void *)0);) {
	if (**ap != '\0')
		ap++;
	argc++;
}
*ap = NULL((void *)0);
if (argc != 4)
	return (-1);
twupdate(PATH_SPAMD_DB"/var/db/spamd", argv[0], argv[1], argv[2], argv[3]);
return (0);
} else
return (-1);
916}

918int
919greyreader(void)
920{
char cip[32], ip[32], helo[MAX_MAIL1024], from[MAX_MAIL1024], to[MAX_MAIL1024];
char *buf;
size_t len;
int state, sync;
struct addrinfo hints, *res;

memset(&hints, 0, sizeof(hints));
hints.ai_family = AF_INET2;		/*for now*/
hints.ai_socktype = SOCK_DGRAM2;		/*dummy*/
hints.ai_protocol = IPPROTO_UDP17;	/*dummy*/
hints.ai_flags = AI_NUMERICHOST4;

state = 0;
sync = 1;
if (grey == NULL((void *)0)) {
syslog_r(LOG_ERR3, &sdata, "No greylist pipe stream!\n");
return (-1);
}

/* grab trap suffixes */
readsuffixlists();

while ((buf = fgetln(grey, &len))) {
if (buf[len - 1] == '\n')
	buf[len - 1] = '\0';
else
	/* all valid lines end in \n */
	continue;
if (strlen(buf) < 4)
	continue;

if (strcmp(buf, "SYNC") == 0) {
	sync = 0;
	continue;
}

switch (state) {
case 0:
	if (twread(buf) == 0) {
		state = 0;
		break;
	}
	if (strncmp(buf, "HE:", 3) != 0) {
		if (strncmp(buf, "CO:", 3) == 0)
			strlcpy(cip, buf+3, sizeof(cip));
		state = 0;
		break;
	}
	strlcpy(helo, buf+3, sizeof(helo));
	state = 1;
	break;
case 1:
	if (strncmp(buf, "IP:", 3) != 0)
		break;
	strlcpy(ip, buf+3, sizeof(ip));
	if (getaddrinfo(ip, NULL((void *)0), &hints, &res) == 0) {
		freeaddrinfo(res);
		state = 2;
	} else
		state = 0;
	break;
case 2:
	if (strncmp(buf, "FR:", 3) != 0) {
		state = 0;
		break;
	}
	strlcpy(from, buf+3, sizeof(from));
	state = 3;
	break;
case 3:
	if (strncmp(buf, "TO:", 3) != 0) {
		state = 0;
		break;
	}
	strlcpy(to, buf+3, sizeof(to));
	if (debug)
		fprintf(stderr(&__sF[2]),
		    "Got Grey HELO %s, IP %s from %s to %s\n",
		    helo, ip, from, to);
	greyupdate(PATH_SPAMD_DB"/var/db/spamd", helo, ip, from, to, sync, cip);
	sync = 1;
	state = 0;
	break;
}
}
return (0);
1007}

1009void
1010greyscanner(void)
1011{
for (;;) {
11
←
Loop condition is true.  Entering loop body→
if (greyscan(PATH_SPAMD_DB"/var/db/spamd") == -1)
12
←
Calling 'greyscan'→
	syslog_r(LOG_NOTICE5, &sdata, "scan of %s failed",
	    PATH_SPAMD_DB"/var/db/spamd");
sleep(DB_SCAN_INTERVAL60);
}
1018}

1020static void
1021drop_privs(void)
1022{
/*
* lose root, continue as non-root user
*/
if (setgroups(1, &pw->pw_gid) ||
   setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
   setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid)) {
syslog_r(LOG_ERR3, &sdata, "failed to drop privs (%m)");
exit(1);
}
1032}

1034void
1035check_spamd_db(void)
1036{
HASHINFO hashinfo;
int i = -1;
DB *db;

/* check to see if /var/db/spamd exists, if not, create it */
memset(&hashinfo, 0, sizeof(hashinfo));
db = dbopen(PATH_SPAMD_DB"/var/db/spamd", O_EXLOCK0x0020|O_RDWR0x0002, 0600, DB_HASH, &hashinfo);

if (db == NULL((void *)0)) {
switch (errno(*__errno())) {
case ENOENT2:
	i = open(PATH_SPAMD_DB"/var/db/spamd", O_RDWR0x0002|O_CREAT0x0200, 0644);
	if (i == -1) {
		syslog_r(LOG_ERR3, &sdata,
		    "create %s failed (%m)", PATH_SPAMD_DB"/var/db/spamd");
		exit(1);
	}
	/* if we are dropping privs, chown to that user */
	if (pw && (fchown(i, pw->pw_uid, pw->pw_gid) == -1)) {
		syslog_r(LOG_ERR3, &sdata,
		    "chown %s failed (%m)", PATH_SPAMD_DB"/var/db/spamd");
		exit(1);
	}
	close(i);
	return;
	break;
default:
	syslog_r(LOG_ERR3, &sdata, "open of %s failed (%m)",
	    PATH_SPAMD_DB"/var/db/spamd");
	exit(1);
}
}
db->sync(db, 0);
db->close(db);
1071}


1074int
1075greywatcher(void)
1076{
struct sigaction sa;

drop_privs();

if (unveil(PATH_SPAMD_DB"/var/db/spamd", "rw") == -1) {
1
Assuming the condition is false→
2
←
Taking false branch→
syslog_r(LOG_ERR3, &sdata, "unveil failed (%m)");
exit(1);
}
if (unveil(alloweddomains_file, "r") == -1) {
3
←
Assuming the condition is false→
4
←
Taking false branch→
syslog_r(LOG_ERR3, &sdata, "unveil failed (%m)");
exit(1);
}
if (unveil(PATH_PFCTL"/sbin/pfctl", "x") == -1) {
5
←
Assuming the condition is false→
6
←
Taking false branch→
syslog_r(LOG_ERR3, &sdata, "unveil failed (%m)");
exit(1);
}
if (pledge("stdio rpath wpath inet flock proc exec", NULL((void *)0)) == -1) {
7
←
Assuming the condition is false→
8
←
Taking false branch→
syslog_r(LOG_ERR3, &sdata, "pledge failed (%m)");
exit(1);
}

startup = time(NULL((void *)0));
db_pid = fork();
switch (db_pid) {
9
←
'Default' branch taken. Execution continues on line 1119→
case -1:
syslog_r(LOG_ERR3, &sdata, "fork failed (%m)");
exit(1);
case 0:
/*
 * child, talks to jailed spamd over greypipe,
 * updates db. has no access to pf.
 */
close(pfdev);
setproctitle("(%s update)", PATH_SPAMD_DB"/var/db/spamd");
if (greyreader() == -1) {
    syslog_r(LOG_ERR3, &sdata, "greyreader failed (%m)");
    _exit(1);
}
_exit(0);
}


fclose(grey);
/*
* parent, scans db periodically for changes and updates
* pf whitelist table accordingly.
*/

sigfillset(&sa.sa_mask);
sa.sa_flags = SA_RESTART0x0002;
sa.sa_handler__sigaction_u.__sa_handler = sig_term_chld;
sigaction(SIGTERM15, &sa, NULL((void *)0));
sigaction(SIGHUP1, &sa, NULL((void *)0));
sigaction(SIGCHLD20, &sa, NULL((void *)0));
sigaction(SIGINT2, &sa, NULL((void *)0));

setproctitle("(pf <spamd-white> update)");
greyscanner();
10
←
Calling 'greyscanner'→
exit(1);
1136}