1# 2# Copyright 2006 Sun Microsystems, Inc. All rights reserved. 3# Use is subject to license terms. 4# 5# ident "%Z%%M% %I% %E% SMI" 6# 7 8The sendmail Mail Filter API (Milter) is designed to allow third-party 9programs access to mail messages as they are being processed in order to 10filter meta-information and content. 11 12This README file describes the steps needed to compile and run a filter, 13through reference to a sample filter which is attached at the end of this 14file. 15 16Note: if you want to write a milter in Java, then see 17http://sendmail-jilter.sourceforge.net/ 18 19+----------------+ 20| SECURITY HINTS | 21+----------------+ 22 23Note: we strongly recommend not to run any milter as root. Libmilter 24does not need root access to communicate with sendmail. It is a 25good security practice to run a program only with root privileges 26if really necessary. A milter should probably check first whether 27it runs as root and refuse to start in that case. libmilter will 28not unlink a socket when running as root. 29 30+-------------------+ 31| BUILDING A FILTER | 32+-------------------+ 33 34The following command presumes that the sample code from the end of this 35README is saved to a file named 'sample.c'. 36 37 cc -D_REENTRANT -o sample sample.c -lmilter 38 39Filters must be thread-safe! 40 41Note that since filters use threads, it may be necessary to alter per 42process limits in your filter. For example, you might look at using 43setrlimit() to increase the number of open file descriptors if your filter 44is going to be busy. 45 46 47+----------------------------------------+ 48| SPECIFYING FILTERS IN SENDMAIL CONFIGS | 49+----------------------------------------+ 50 51Filters are specified with a key letter ``X'' (for ``eXternal''). 52 53For example: 54 55 Xfilter1, S=local:/var/run/f1.sock, F=R 56 Xfilter2, S=inet6:999@localhost, F=T, T=C:10m;S:1s;R:1s;E:5m 57 Xfilter3, S=inet:3333@localhost 58 59specifies three filters. Filters can be specified in your .mc file using 60the following: 61 62 INPUT_MAIL_FILTER(`filter1', `S=local:/var/run/f1.sock, F=R') 63 INPUT_MAIL_FILTER(`filter2', `S=inet6:999@localhost, F=T, T=C:10m;S:1s;R:1s;E:5m') 64 INPUT_MAIL_FILTER(`filter3', `S=inet:3333@localhost') 65 66The first attaches to a Unix-domain socket in the /var/run directory; the 67second uses an IPv6 socket on port 999 of localhost, and the third uses an 68IPv4 socket on port 3333 of localhost. The current flags (F=) are: 69 70 R Reject connection if filter unavailable 71 T Temporary fail connection if filter unavailable 72 4 Shut down connection if filter unavailable 73 (with a 421 temporary error). 74 75If none of these is specified, the message is passed through sendmail 76in case of filter errors as if the failing filters were not present. 77 78Finally, you can override the default timeouts used by sendmail when 79talking to the filters using the T= equate. There are four fields inside 80of the T= equate: 81 82Letter Meaning 83 C Timeout for connecting to a filter (if 0, use system timeout) 84 S Timeout for sending information from the MTA to a filter 85 R Timeout for reading reply from the filter 86 E Overall timeout between sending end-of-message to filter 87 and waiting for the final acknowledgment 88 89Note the separator between each is a ';' as a ',' already separates equates 90and therefore can't separate timeouts. The default values (if not set in 91the config) are: 92 93T=C:5m;S:10s;R:10s;E:5m 94 95where 's' is seconds and 'm' is minutes. 96 97Which filters are invoked and their sequencing is handled by the 98InputMailFilters option. Note: if InputMailFilters is not defined no filters 99will be used. 100 101 O InputMailFilters=filter1, filter2, filter3 102 103This is is set automatically according to the order of the 104INPUT_MAIL_FILTER commands in your .mc file. Alternatively, you can 105reset its value by setting confINPUT_MAIL_FILTERS in your .mc file. 106This options causes the three filters to be called in the same order 107they were specified. It allows for possible future filtering on output 108(although this is not intended for this release). 109 110Also note that a filter can be defined without adding it to the input 111filter list by using MAIL_FILTER() instead of INPUT_MAIL_FILTER() in your 112.mc file. 113 114To test sendmail with the sample filter, the following might be added (in 115the appropriate locations) to your .mc file: 116 117 INPUT_MAIL_FILTER(`sample', `S=local:/var/run/f1.sock') 118 119 120+------------------+ 121| TESTING A FILTER | 122+------------------+ 123 124Once you have compiled a filter, modified your .mc file and restarted 125the sendmail process, you will want to test that the filter performs as 126intended. 127 128The sample filter takes one argument -p, which indicates the local port 129on which to create a listening socket for the filter. Maintaining 130consistency with the suggested options for sendmail.cf, this would be the 131UNIX domain socket located in /var/run/f1.sock. 132 133 % ./sample -p local:/var/run/f1.sock 134 135If the sample filter returns immediately to a command line, there was either 136an error with your command or a problem creating the specified socket. 137Further logging can be captured through the syslogd daemon. Using the 138'netstat -a' command can ensure that your filter process is listening on 139the appropriate local socket. 140 141Email messages must be injected via SMTP to be filtered. There are two 142simple means of doing this; either using the 'sendmail -bs' command, or 143by telnetting to port 25 of the machine configured for milter. Once 144connected via one of these options, the session can be continued through 145the use of standard SMTP commands. 146 147% sendmail -bs 148220 test.sendmail.com ESMTP Sendmail 8.14.0/8.14.0; Thu, 22 Jun 2006 13:05:23 -0500 (EST) 149HELO localhost 150250 test.sendmail.com Hello testy@localhost, pleased to meet you 151MAIL From:<testy> 152250 2.1.0 <testy>... Sender ok 153RCPT To:<root> 154250 2.1.5 <root>... Recipient ok 155DATA 156354 Enter mail, end with "." on a line by itself 157From: testy@test.sendmail.com 158To: root@test.sendmail.com 159Subject: testing sample filter 160 161Sample body 162. 163250 2.0.0 dB73Zxi25236 Message accepted for delivery 164QUIT 165221 2.0.0 test.sendmail.com closing connection 166 167In the above example, the lines beginning with numbers are output by the 168mail server, and those without are your input. If everything is working 169properly, you will find a file in /tmp by the name of msg.XXXXXXXX (where 170the Xs represent any combination of letters and numbers). This file should 171contain the message body and headers from the test email entered above. 172 173If the sample filter did not log your test email, there are a number of 174methods to narrow down the source of the problem. Check your system 175logs written by syslogd and see if there are any pertinent lines. You 176may need to reconfigure syslogd to capture all relevant data. Additionally, 177the logging level of sendmail can be raised with the LogLevel option. 178See the sendmail(8) manual page for more information. 179 180 181$Revision: 8.42 $, Last updated $Date: 2006/06/29 17:10:16 $ 182