/*      $OpenBSD: grey.c,v 1.67 2023/03/08 04:43:06 guenther Exp $      */

/*
 * Copyright (c) 2004-2006 Bob Beck.  All rights reserved.
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/wait.h>
#include <net/if.h>
#include <netinet/in.h>
#include <net/pfvar.h>
#include <ctype.h>
#include <db.h>
#include <errno.h>
#include <fcntl.h>
#include <pwd.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <time.h>
#include <unistd.h>
#include <netdb.h>

#include "grey.h"
#include "sync.h"

extern time_t passtime, greyexp, whiteexp, trapexp;
extern struct syslog_data sdata;
extern struct passwd *pw;
extern u_short cfg_port;
extern pid_t jail_pid;
extern FILE *trapcfg;
extern FILE *grey;
extern int debug;
extern int syncsend;
extern int greyback[2];

/* From netinet/in.h, but only _KERNEL_ gets them. */
#define satosin(sa)     ((struct sockaddr_in *)(sa))
#define satosin6(sa)    ((struct sockaddr_in6 *)(sa))

void    configure_spamd(char **, u_int, FILE *);
int     configure_pf(char **, int);
char    *dequotetolower(const char *);
void    readsuffixlists(void);
void    freeaddrlists(void);
int     addwhiteaddr(char *);
int     addtrapaddr(char *);
int     db_addrstate(DB *, char *);
int     greyscan(char *);
int     trapcheck(DB *, char *);
int     twupdate(char *, char *, char *, char *, char *);
int     twread(char *);
int     greyreader(void);
void    greyscanner(void);


u_int whitecount, whitealloc;
u_int trapcount, trapalloc;
char **whitelist;
char **traplist;

char *traplist_name = "spamd-greytrap";
char *traplist_msg = "\"Your address %A has mailed to spamtraps here\\n\"";

pid_t db_pid = -1;
int pfdev;

struct db_change {
        SLIST_ENTRY(db_change)  entry;
        char *                  key;
        void *                  data;
        size_t                  dsiz;
        int                     act;
};

#define DBC_ADD 1
#define DBC_DEL 2

/* db pending changes list */
SLIST_HEAD(, db_change) db_changes = SLIST_HEAD_INITIALIZER(db_changes);

struct mail_addr {
        SLIST_ENTRY(mail_addr)  entry;
        char                    addr[MAX_MAIL];
};

/* list of suffixes that must match TO: */
SLIST_HEAD(, mail_addr) match_suffix = SLIST_HEAD_INITIALIZER(match_suffix);
char *alloweddomains_file = PATH_SPAMD_ALLOWEDDOMAINS;

char *low_prio_mx_ip;
time_t startup;

static char *pargv[11]= {
        "pfctl", "-p", "/dev/pf", "-q", "-t",
        "spamd-white", "-T", "replace", "-f", "-", NULL
};

/* If the parent gets a signal, kill off the children and exit */
static void
sig_term_chld(int sig)
{
        if (db_pid != -1)
                kill(db_pid, SIGTERM);
        if (jail_pid != -1)
                kill(jail_pid, SIGTERM);
        _exit(1);
}

/*
 * Greatly simplified version from spamd_setup.c  - only
 * sends one blacklist to an already open stream. Has no need
 * to collapse cidr ranges since these are only ever single
 * host hits.
 */
void
configure_spamd(char **addrs, u_int count, FILE *sdc)
{
        u_int i;

        /* XXX - doesn't support IPV6 yet */
        fprintf(sdc, "%s;", traplist_name);
        if (count != 0) {
                fprintf(sdc, "%s;inet;%u", traplist_msg, count);
                for (i = 0; i < count; i++)
                        fprintf(sdc, ";%s/32", addrs[i]);
        }
        fputc('\n', sdc);
        if (fflush(sdc) == EOF)
                syslog_r(LOG_DEBUG, &sdata, "configure_spamd: fflush failed (%m)");
}

int
configure_pf(char **addrs, int count)
{
        FILE *pf = NULL;
        int i, pdes[2], status;
        pid_t pid;
        char *fdpath;
        struct sigaction sa;

        sigfillset(&sa.sa_mask);
        sa.sa_flags = SA_RESTART;
        sa.sa_handler = sig_term_chld;

        if (debug)
                fprintf(stderr, "configure_pf - device on fd %d\n", pfdev);

        /* Because /dev/fd/ only contains device nodes for 0-63 */
        if (pfdev < 1 || pfdev > 63)
                return(-1);

        if (asprintf(&fdpath, "/dev/fd/%d", pfdev) == -1)
                return(-1);
        pargv[2] = fdpath;
        if (pipe(pdes) != 0) {
                syslog_r(LOG_INFO, &sdata, "pipe failed (%m)");
                free(fdpath);
                fdpath = NULL;
                return(-1);
        }
        signal(SIGCHLD, SIG_DFL);
        switch (pid = fork()) {
        case -1:
                syslog_r(LOG_INFO, &sdata, "fork failed (%m)");
                free(fdpath);
                fdpath = NULL;
                close(pdes[0]);
                close(pdes[1]);
                sigaction(SIGCHLD, &sa, NULL);
                return(-1);
        case 0:
                /* child */
                close(pdes[1]);
                if (pdes[0] != STDIN_FILENO) {
                        dup2(pdes[0], STDIN_FILENO);
                        close(pdes[0]);
                }
                execvp(PATH_PFCTL, pargv);
                syslog_r(LOG_ERR, &sdata, "can't exec %s:%m", PATH_PFCTL);
                _exit(1);
        }

        /* parent */
        free(fdpath);
        fdpath = NULL;
        close(pdes[0]);
        pf = fdopen(pdes[1], "w");
        if (pf == NULL) {
                syslog_r(LOG_INFO, &sdata, "fdopen failed (%m)");
                close(pdes[1]);
                sigaction(SIGCHLD, &sa, NULL);
                return(-1);
        }
        for (i = 0; i < count; i++)
                if (addrs[i] != NULL)
                        fprintf(pf, "%s/32\n", addrs[i]);
        fclose(pf);

        waitpid(pid, &status, 0);
        if (WIFEXITED(status) && WEXITSTATUS(status) != 0)
                syslog_r(LOG_ERR, &sdata, "%s returned status %d", PATH_PFCTL,
                    WEXITSTATUS(status));
        else if (WIFSIGNALED(status))
                syslog_r(LOG_ERR, &sdata, "%s died on signal %d", PATH_PFCTL,
                    WTERMSIG(status));

        sigaction(SIGCHLD, &sa, NULL);
        return(0);
}

char *
dequotetolower(const char *addr)
{
        static char buf[MAX_MAIL];
        char *cp;

        if (*addr == '<')
                addr++;
        (void) strlcpy(buf, addr, sizeof(buf));
        cp = strrchr(buf, '>');
        if (cp != NULL && cp[1] == '\0')
                *cp = '\0';
        cp = buf;
        while (*cp != '\0') {
                *cp = tolower((unsigned char)*cp);
                cp++;
        }
        return(buf);
}

void
readsuffixlists(void)
{
        FILE *fp;
        char *buf;
        size_t len;
        struct mail_addr *m;

        while (!SLIST_EMPTY(&match_suffix)) {
                m = SLIST_FIRST(&match_suffix);
                SLIST_REMOVE_HEAD(&match_suffix, entry);
                free(m);
        }
        if ((fp = fopen(alloweddomains_file, "r")) != NULL) {
                while ((buf = fgetln(fp, &len))) {
                        /* strip white space-characters */
                        while (len > 0 && isspace((unsigned char)buf[len-1]))
                                len--;
                        while (len > 0 && isspace((unsigned char)*buf)) {
                                buf++;
                                len--;
                        }
                        if (len == 0)
                                continue;
                        /* jump over comments and blank lines */
                        if (*buf == '#' || *buf == '\n')
                                continue;
                        if (buf[len-1] == '\n')
                                len--;
                        if ((len + 1) > sizeof(m->addr)) {
                                syslog_r(LOG_ERR, &sdata,
                                    "line too long in %s - file ignored",
                                    alloweddomains_file);
                                goto bad;
                        }
                        if ((m = malloc(sizeof(struct mail_addr))) == NULL)
                                goto bad;
                        memcpy(m->addr, buf, len);
                        m->addr[len]='\0';
                        syslog_r(LOG_ERR, &sdata, "got suffix %s", m->addr);
                        SLIST_INSERT_HEAD(&match_suffix, m, entry);
                }
        }
        return;
bad:
        while (!SLIST_EMPTY(&match_suffix)) {
                m = SLIST_FIRST(&match_suffix);
                SLIST_REMOVE_HEAD(&match_suffix, entry);
                free(m);
        }
}

void
freeaddrlists(void)
{
        int i;

        if (whitelist != NULL)
                for (i = 0; i < whitecount; i++) {
                        free(whitelist[i]);
                        whitelist[i] = NULL;
                }
        whitecount = 0;
        if (traplist != NULL) {
                for (i = 0; i < trapcount; i++) {
                        free(traplist[i]);
                        traplist[i] = NULL;
                }
        }
        trapcount = 0;
}

/* validate, then add to list of addrs to whitelist */
int
addwhiteaddr(char *addr)
{
        struct addrinfo hints, *res;
        char ch;

        memset(&hints, 0, sizeof(hints));
        hints.ai_family = AF_INET;              /*for now*/
        hints.ai_socktype = SOCK_DGRAM;         /*dummy*/
        hints.ai_protocol = IPPROTO_UDP;        /*dummy*/
        hints.ai_flags = AI_NUMERICHOST;

        if (getaddrinfo(addr, NULL, &hints, &res) != 0)
                return(-1);

        /* Check spamd blacklists in main process. */
        if (send(greyback[0], res->ai_addr, res->ai_addr->sa_len, 0) == -1) {
                syslog_r(LOG_ERR, &sdata, "%s: send: %m", __func__);
        } else {
                if (recv(greyback[0], &ch, sizeof(ch), 0) == 1) {
                        if (ch == '1') {
                                syslog_r(LOG_DEBUG, &sdata,
                                    "%s blacklisted, removing from whitelist",
                                    addr);
                                freeaddrinfo(res);
                                return(-1);
                        }
                }
        }

        if (whitecount == whitealloc) {
                char **tmp;

                tmp = reallocarray(whitelist,
                    whitealloc + 1024, sizeof(char *));
                if (tmp == NULL) {
                        freeaddrinfo(res);
                        return(-1);
                }
                whitelist = tmp;
                whitealloc += 1024;
        }
        whitelist[whitecount] = strdup(addr);
        if (whitelist[whitecount] == NULL) {
                freeaddrinfo(res);
                return(-1);
        }
        whitecount++;
        freeaddrinfo(res);
        return(0);
}

/* validate, then add to list of addrs to traplist */
int
addtrapaddr(char *addr)
{
        struct addrinfo hints, *res;

        memset(&hints, 0, sizeof(hints));
        hints.ai_family = AF_INET;              /*for now*/
        hints.ai_socktype = SOCK_DGRAM;         /*dummy*/
        hints.ai_protocol = IPPROTO_UDP;        /*dummy*/
        hints.ai_flags = AI_NUMERICHOST;

        if (getaddrinfo(addr, NULL, &hints, &res) == 0) {
                if (trapcount == trapalloc) {
                        char **tmp;

                        tmp = reallocarray(traplist,
                            trapalloc + 1024, sizeof(char *));
                        if (tmp == NULL) {
                                freeaddrinfo(res);
                                return(-1);
                        }
                        traplist = tmp;
                        trapalloc += 1024;
                }
                traplist[trapcount] = strdup(addr);
                if (traplist[trapcount] == NULL) {
                        freeaddrinfo(res);
                        return(-1);
                }
                trapcount++;
                freeaddrinfo(res);
        } else
                return(-1);
        return(0);
}

static int
queue_change(char *key, char *data, size_t dsiz, int act)
{
        struct db_change *dbc;

        if ((dbc = malloc(sizeof(*dbc))) == NULL) {
                syslog_r(LOG_DEBUG, &sdata, "malloc failed (queue change)");
                return(-1);
        }
        if ((dbc->key = strdup(key)) == NULL) {
                syslog_r(LOG_DEBUG, &sdata, "malloc failed (queue change)");
                free(dbc);
                return(-1);
        }
        if ((dbc->data = malloc(dsiz)) == NULL) {
                syslog_r(LOG_DEBUG, &sdata, "malloc failed (queue change)");
                free(dbc->key);
                free(dbc);
                return(-1);
        }
        memcpy(dbc->data, data, dsiz);
        dbc->dsiz = dsiz;
        dbc->act = act;
        syslog_r(LOG_DEBUG, &sdata,
            "queueing %s of %s", ((act == DBC_ADD) ? "add" : "deletion"),
            dbc->key);
        SLIST_INSERT_HEAD(&db_changes, dbc, entry);
        return(0);
}

static int
do_changes(DB *db)
{
        DBT                     dbk, dbd;
        struct db_change        *dbc;
        int ret = 0;

        while (!SLIST_EMPTY(&db_changes)) {
                dbc = SLIST_FIRST(&db_changes);
                switch (dbc->act) {
                case DBC_ADD:
                        memset(&dbk, 0, sizeof(dbk));
                        dbk.size = strlen(dbc->key);
                        dbk.data = dbc->key;
                        memset(&dbd, 0, sizeof(dbd));
                        dbd.size = dbc->dsiz;
                        dbd.data = dbc->data;
                        if (db->put(db, &dbk, &dbd, 0)) {
                                db->sync(db, 0);
                                syslog_r(LOG_ERR, &sdata,
                                    "can't add %s to spamd db (%m)", dbc->key);
                                ret = -1;
                        }
                        db->sync(db, 0);
                        break;
                case DBC_DEL:
                        memset(&dbk, 0, sizeof(dbk));
                        dbk.size = strlen(dbc->key);
                        dbk.data = dbc->key;
                        if (db->del(db, &dbk, 0)) {
                                syslog_r(LOG_ERR, &sdata,
                                    "can't delete %s from spamd db (%m)",
                                    dbc->key);
                                ret = -1;
                        }
                        break;
                default:
                        syslog_r(LOG_ERR, &sdata, "Unrecognized db change");
                        ret = -1;
                }
                free(dbc->key);
                dbc->key = NULL;
                free(dbc->data);
                dbc->data = NULL;
                dbc->act = 0;
                dbc->dsiz = 0;
                SLIST_REMOVE_HEAD(&db_changes, entry);
                free(dbc);

        }
        return(ret);
}

/* -1=error, 0=notfound, 1=TRAPPED, 2=WHITE */
int
db_addrstate(DB *db, char *key)
{
        DBT                     dbk, dbd;
        struct gdata            gd;

        memset(&dbk, 0, sizeof(dbk));
        dbk.size = strlen(key);
        dbk.data = key;
        memset(&dbd, 0, sizeof(dbd));
        switch (db->get(db, &dbk, &dbd, 0)) {
        case 1:
                /* not found */
                return (0);
        case 0:
                if (gdcopyin(&dbd, &gd) != -1)
                        return (gd.pcount == -1 ? 1 : 2);
                /* FALLTHROUGH */
        default:
                /* error */
                return (-1);
        }
}


int
greyscan(char *dbname)
{
        HASHINFO        hashinfo;
        DBT             dbk, dbd;
        DB              *db;
        struct gdata    gd;
        int             r;
        char            *a = NULL;
        size_t          asiz = 0;
        time_t now = time(NULL);

        /* walk db, expire, and whitelist */
        memset(&hashinfo, 0, sizeof(hashinfo));
        db = dbopen(dbname, O_EXLOCK|O_RDWR, 0600, DB_HASH, &hashinfo);
        if (db == NULL) {
                syslog_r(LOG_INFO, &sdata, "dbopen failed (%m)");
                return(-1);
        }
        memset(&dbk, 0, sizeof(dbk));
        memset(&dbd, 0, sizeof(dbd));
        for (r = db->seq(db, &dbk, &dbd, R_FIRST); !r;
            r = db->seq(db, &dbk, &dbd, R_NEXT)) {
                if ((dbk.size < 1) || gdcopyin(&dbd, &gd) == -1) {
                        syslog_r(LOG_ERR, &sdata, "bogus entry in spamd database");
                        goto bad;
                }
                if (asiz < dbk.size + 1) {
                        char *tmp;

                        tmp = reallocarray(a, dbk.size, 2);
                        if (tmp == NULL)
                                goto bad;
                        a = tmp;
                        asiz = dbk.size * 2;
                }
                memset(a, 0, asiz);
                memcpy(a, dbk.data, dbk.size);
                if (gd.expire <= now && gd.pcount != -2) {
                        /* get rid of entry */
                        if (queue_change(a, NULL, 0, DBC_DEL) == -1)
                                goto bad;
                } else if (gd.pcount == -1)  {
                        /* this is a greytrap hit */
                        if ((addtrapaddr(a) == -1) &&
                            (queue_change(a, NULL, 0, DBC_DEL) == -1))
                                goto bad;
                } else if (gd.pcount >= 0 && gd.pass <= now) {
                        int tuple = 0;
                        char *cp;
                        int state;

                        /*
                         * if not already TRAPPED,
                         * add address to whitelist
                         * add an address-keyed entry to db
                         */
                        cp = strchr(a, '\n');
                        if (cp != NULL) {
                                tuple = 1;
                                *cp = '\0';
                        }

                        state = db_addrstate(db, a);
                        if (state != 1 && addwhiteaddr(a) == -1) {
                                if (cp != NULL)
                                        *cp = '\n';
                                if (queue_change(a, NULL, 0, DBC_DEL) == -1)
                                        goto bad;
                        }

                        if (tuple && state <= 0) {
                                if (cp != NULL)
                                        *cp = '\0';
                                /* re-add entry, keyed only by ip */
                                gd.expire = now + whiteexp;
                                dbd.size = sizeof(gd);
                                dbd.data = &gd;
                                if (queue_change(a, (void *) &gd, sizeof(gd),
                                    DBC_ADD) == -1)
                                        goto bad;
                                syslog_r(LOG_DEBUG, &sdata,
                                    "whitelisting %s in %s", a, dbname);
                        }
                        if (debug)
                                fprintf(stderr, "whitelisted %s\n", a);
                }
        }
        (void) do_changes(db);
        db->close(db);
        db = NULL;
        configure_pf(whitelist, whitecount);
        configure_spamd(traplist, trapcount, trapcfg);

        freeaddrlists();
        free(a);
        a = NULL;
        return(0);
 bad:
        (void) do_changes(db);
        db->close(db);
        db = NULL;
        freeaddrlists();
        free(a);
        a = NULL;
        return(-1);
}

int
trapcheck(DB *db, char *to)
{
        int                     i, j, smatch = 0;
        DBT                     dbk, dbd;
        struct mail_addr        *m;
        char *                  trap;
        size_t                  s;

        trap = dequotetolower(to);
        if (!SLIST_EMPTY(&match_suffix)) {
                s = strlen(trap);
                SLIST_FOREACH(m, &match_suffix, entry) {
                        j = s - strlen(m->addr);
                        if ((j >= 0) && (strcasecmp(trap+j, m->addr) == 0))
                                smatch = 1;
                }
                if (!smatch)
                        /* no suffixes match, so trap it */
                        return (0);
        }
        memset(&dbk, 0, sizeof(dbk));
        dbk.size = strlen(trap);
        dbk.data = trap;
        memset(&dbd, 0, sizeof(dbd));
        i = db->get(db, &dbk, &dbd, 0);
        if (i == -1)
                return (-1);
        if (i)
                /* didn't exist - so this doesn't match a known spamtrap  */
                return (1);
        else
                /* To: address is a spamtrap, so add as a greytrap entry */
                return (0);
}

int
twupdate(char *dbname, char *what, char *ip, char *source, char *expires)
{
        /* we got a TRAP or WHITE update from someone else */
        HASHINFO        hashinfo;
        DBT             dbk, dbd;
        DB              *db;
        struct gdata    gd;
        time_t          now, expire;
        int             r, spamtrap;

        now = time(NULL);
        /* expiry times have to be in the future */
        expire = strtonum(expires, now,
            sizeof(time_t) == sizeof(int) ? INT_MAX : LLONG_MAX, NULL);
        if (expire == 0)
                return(-1);

        if (strcmp(what, "TRAP") == 0)
                spamtrap = 1;
        else if (strcmp(what, "WHITE") == 0)
                spamtrap = 0;
        else
                return(-1);

        memset(&hashinfo, 0, sizeof(hashinfo));
        db = dbopen(dbname, O_EXLOCK|O_RDWR, 0600, DB_HASH, &hashinfo);
        if (db == NULL)
                return(-1);

        memset(&dbk, 0, sizeof(dbk));
        dbk.size = strlen(ip);
        dbk.data = ip;
        memset(&dbd, 0, sizeof(dbd));
        r = db->get(db, &dbk, &dbd, 0);
        if (r == -1)
                goto bad;
        if (r) {
                /* new entry */
                memset(&gd, 0, sizeof(gd));
                gd.first = now;
                gd.pcount = spamtrap ? -1 : 0;
                gd.expire = expire;
                memset(&dbk, 0, sizeof(dbk));
                dbk.size = strlen(ip);
                dbk.data = ip;
                memset(&dbd, 0, sizeof(dbd));
                dbd.size = sizeof(gd);
                dbd.data = &gd;
                r = db->put(db, &dbk, &dbd, 0);
                db->sync(db, 0);
                if (r)
                        goto bad;
                if (debug)
                        fprintf(stderr, "added %s %s\n",
                            spamtrap ? "trap entry for" : "", ip);
                syslog_r(LOG_DEBUG, &sdata,
                    "new %s from %s for %s, expires %s", what, source, ip,
                    expires);
        } else {
                /* existing entry */
                if (gdcopyin(&dbd, &gd) == -1) {
                        /* whatever this is, it doesn't belong */
                        db->del(db, &dbk, 0);
                        db->sync(db, 0);
                        goto bad;
                }
                if (spamtrap) {
                        gd.pcount = -1;
                        gd.bcount++;
                } else
                        gd.pcount++;
                memset(&dbk, 0, sizeof(dbk));
                dbk.size = strlen(ip);
                dbk.data = ip;
                memset(&dbd, 0, sizeof(dbd));
                dbd.size = sizeof(gd);
                dbd.data = &gd;
                r = db->put(db, &dbk, &dbd, 0);
                db->sync(db, 0);
                if (r)
                        goto bad;
                if (debug)
                        fprintf(stderr, "updated %s\n", ip);
        }
        db->close(db);
        return(0);
 bad:
        db->close(db);
        return(-1);

}

int
greyupdate(char *dbname, char *helo, char *ip, char *from, char *to, int sync,
    char *cip)
{
        HASHINFO        hashinfo;
        DBT             dbk, dbd;
        DB              *db;
        char            *key = NULL;
        char            *lookup;
        struct gdata    gd;
        time_t          now, expire;
        int             r, spamtrap;

        now = time(NULL);

        /* open with lock, find record, update, close, unlock */
        memset(&hashinfo, 0, sizeof(hashinfo));
        db = dbopen(dbname, O_EXLOCK|O_RDWR, 0600, DB_HASH, &hashinfo);
        if (db == NULL)
                return(-1);
        if (asprintf(&key, "%s\n%s\n%s\n%s", ip, helo, from, to) == -1)
                goto bad;
        r = trapcheck(db, to);
        switch (r) {
        case 1:
                /* do not trap */
                spamtrap = 0;
                lookup = key;
                expire = greyexp;
                break;
        case 0:
                /* trap */
                spamtrap = 1;
                lookup = ip;
                expire = trapexp;
                syslog_r(LOG_DEBUG, &sdata, "Trapping %s for tuple %s", ip,
                    key);
                break;
        default:
                goto bad;
                break;
        }
        memset(&dbk, 0, sizeof(dbk));
        dbk.size = strlen(lookup);
        dbk.data = lookup;
        memset(&dbd, 0, sizeof(dbd));
        r = db->get(db, &dbk, &dbd, 0);
        if (r == -1)
                goto bad;
        if (r) {
                /* new entry */
                if (sync &&  low_prio_mx_ip &&
                    (strcmp(cip, low_prio_mx_ip) == 0) &&
                    ((startup + 60)  < now)) {
                        /* we haven't seen a greylist entry for this tuple,
                         * and yet the connection was to a low priority MX
                         * which we know can't be hit first if the client
                         * is adhering to the RFC's - soo.. kill it!
                         */
                        spamtrap = 1;
                        lookup = ip;
                        expire = trapexp;
                        syslog_r(LOG_DEBUG, &sdata,
                            "Trapping %s for trying %s first for tuple %s",
                            ip, low_prio_mx_ip, key);
                }
                memset(&gd, 0, sizeof(gd));
                gd.first = now;
                gd.bcount = 1;
                gd.pcount = spamtrap ? -1 : 0;
                gd.pass = now + expire;
                gd.expire = now + expire;
                memset(&dbk, 0, sizeof(dbk));
                dbk.size = strlen(lookup);
                dbk.data = lookup;
                memset(&dbd, 0, sizeof(dbd));
                dbd.size = sizeof(gd);
                dbd.data = &gd;
                r = db->put(db, &dbk, &dbd, 0);
                db->sync(db, 0);
                if (r)
                        goto bad;
                if (debug)
                        fprintf(stderr, "added %s %s\n",
                            spamtrap ? "greytrap entry for" : "", lookup);
                syslog_r(LOG_DEBUG, &sdata,
                    "new %sentry %s from %s to %s, helo %s",
                    spamtrap ? "greytrap " : "", ip, from, to, helo);
        } else {
                /* existing entry */
                if (gdcopyin(&dbd, &gd) == -1) {
                        /* whatever this is, it doesn't belong */
                        db->del(db, &dbk, 0);
                        db->sync(db, 0);
                        goto bad;
                }
                gd.bcount++;
                gd.pcount = spamtrap ? -1 : 0;
                if (gd.first + passtime < now)
                        gd.pass = now;
                memset(&dbk, 0, sizeof(dbk));
                dbk.size = strlen(lookup);
                dbk.data = lookup;
                memset(&dbd, 0, sizeof(dbd));
                dbd.size = sizeof(gd);
                dbd.data = &gd;
                r = db->put(db, &dbk, &dbd, 0);
                db->sync(db, 0);
                if (r)
                        goto bad;
                if (debug)
                        fprintf(stderr, "updated %s\n", lookup);
        }
        free(key);
        key = NULL;
        db->close(db);
        db = NULL;

        /* Entry successfully update, sent out sync message */
        if (syncsend && sync) {
                if (spamtrap) {
                        syslog_r(LOG_DEBUG, &sdata,
                            "sync_trap %s", ip);
                        sync_trapped(now, now + expire, ip);
                }
                else
                        sync_update(now, helo, ip, from, to);
        }
        return(0);
 bad:
        free(key);
        key = NULL;
        db->close(db);
        db = NULL;
        return(-1);
}

int
twread(char *buf)
{
        if ((strncmp(buf, "WHITE:", 6) == 0) ||
            (strncmp(buf, "TRAP:", 5) == 0)) {
                char **ap, *argv[5];
                int argc = 0;

                for (ap = argv;
                    ap < &argv[4] && (*ap = strsep(&buf, ":")) != NULL;) {
                        if (**ap != '\0')
                                ap++;
                        argc++;
                }
                *ap = NULL;
                if (argc != 4)
                        return (-1);
                twupdate(PATH_SPAMD_DB, argv[0], argv[1], argv[2], argv[3]);
                return (0);
        } else
                return (-1);
}

int
greyreader(void)
{
        char cip[32], ip[32], helo[MAX_MAIL], from[MAX_MAIL], to[MAX_MAIL];
        char *buf;
        size_t len;
        int state, sync;
        struct addrinfo hints, *res;

        memset(&hints, 0, sizeof(hints));
        hints.ai_family = AF_INET;              /*for now*/
        hints.ai_socktype = SOCK_DGRAM;         /*dummy*/
        hints.ai_protocol = IPPROTO_UDP;        /*dummy*/
        hints.ai_flags = AI_NUMERICHOST;

        state = 0;
        sync = 1;
        if (grey == NULL) {
                syslog_r(LOG_ERR, &sdata, "No greylist pipe stream!\n");
                return (-1);
        }

        /* grab trap suffixes */
        readsuffixlists();

        while ((buf = fgetln(grey, &len))) {
                if (buf[len - 1] == '\n')
                        buf[len - 1] = '\0';
                else
                        /* all valid lines end in \n */
                        continue;
                if (strlen(buf) < 4)
                        continue;

                if (strcmp(buf, "SYNC") == 0) {
                        sync = 0;
                        continue;
                }

                switch (state) {
                case 0:
                        if (twread(buf) == 0) {
                                state = 0;
                                break;
                        }
                        if (strncmp(buf, "HE:", 3) != 0) {
                                if (strncmp(buf, "CO:", 3) == 0)
                                        strlcpy(cip, buf+3, sizeof(cip));
                                state = 0;
                                break;
                        }
                        strlcpy(helo, buf+3, sizeof(helo));
                        state = 1;
                        break;
                case 1:
                        if (strncmp(buf, "IP:", 3) != 0)
                                break;
                        strlcpy(ip, buf+3, sizeof(ip));
                        if (getaddrinfo(ip, NULL, &hints, &res) == 0) {
                                freeaddrinfo(res);
                                state = 2;
                        } else
                                state = 0;
                        break;
                case 2:
                        if (strncmp(buf, "FR:", 3) != 0) {
                                state = 0;
                                break;
                        }
                        strlcpy(from, buf+3, sizeof(from));
                        state = 3;
                        break;
                case 3:
                        if (strncmp(buf, "TO:", 3) != 0) {
                                state = 0;
                                break;
                        }
                        strlcpy(to, buf+3, sizeof(to));
                        if (debug)
                                fprintf(stderr,
                                    "Got Grey HELO %s, IP %s from %s to %s\n",
                                    helo, ip, from, to);
                        greyupdate(PATH_SPAMD_DB, helo, ip, from, to, sync, cip);
                        sync = 1;
                        state = 0;
                        break;
                }
        }
        return (0);
}

void
greyscanner(void)
{
        for (;;) {
                if (greyscan(PATH_SPAMD_DB) == -1)
                        syslog_r(LOG_NOTICE, &sdata, "scan of %s failed",
                            PATH_SPAMD_DB);
                sleep(DB_SCAN_INTERVAL);
        }
}

static void
drop_privs(void)
{
        /*
         * lose root, continue as non-root user
         */
        if (setgroups(1, &pw->pw_gid) ||
            setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
            setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid)) {
                syslog_r(LOG_ERR, &sdata, "failed to drop privs (%m)");
                exit(1);
        }
}

void
check_spamd_db(void)
{
        HASHINFO hashinfo;
        int i = -1;
        DB *db;

        /* check to see if /var/db/spamd exists, if not, create it */
        memset(&hashinfo, 0, sizeof(hashinfo));
        db = dbopen(PATH_SPAMD_DB, O_EXLOCK|O_RDWR, 0600, DB_HASH, &hashinfo);

        if (db == NULL) {
                switch (errno) {
                case ENOENT:
                        i = open(PATH_SPAMD_DB, O_RDWR|O_CREAT, 0644);
                        if (i == -1) {
                                syslog_r(LOG_ERR, &sdata,
                                    "create %s failed (%m)", PATH_SPAMD_DB);
                                exit(1);
                        }
                        /* if we are dropping privs, chown to that user */
                        if (pw && (fchown(i, pw->pw_uid, pw->pw_gid) == -1)) {
                                syslog_r(LOG_ERR, &sdata,
                                    "chown %s failed (%m)", PATH_SPAMD_DB);
                                exit(1);
                        }
                        close(i);
                        return;
                        break;
                default:
                        syslog_r(LOG_ERR, &sdata, "open of %s failed (%m)",
                            PATH_SPAMD_DB);
                        exit(1);
                }
        }
        db->sync(db, 0);
        db->close(db);
}


int
greywatcher(void)
{
        struct sigaction sa;

        drop_privs();

        if (unveil(PATH_SPAMD_DB, "rw") == -1) {
                syslog_r(LOG_ERR, &sdata, "unveil failed (%m)");
                exit(1);
        }
        if (unveil(alloweddomains_file, "r") == -1) {
                syslog_r(LOG_ERR, &sdata, "unveil failed (%m)");
                exit(1);
        }
        if (unveil(PATH_PFCTL, "x") == -1) {
                syslog_r(LOG_ERR, &sdata, "unveil failed (%m)");
                exit(1);
        }
        if (pledge("stdio rpath wpath inet flock proc exec", NULL) == -1) {
                syslog_r(LOG_ERR, &sdata, "pledge failed (%m)");
                exit(1);
        }
                
        startup = time(NULL);
        db_pid = fork();
        switch (db_pid) {
        case -1:
                syslog_r(LOG_ERR, &sdata, "fork failed (%m)");
                exit(1);
        case 0:
                /*
                 * child, talks to jailed spamd over greypipe,
                 * updates db. has no access to pf.
                 */
                close(pfdev);
                setproctitle("(%s update)", PATH_SPAMD_DB);
                if (greyreader() == -1) {
                    syslog_r(LOG_ERR, &sdata, "greyreader failed (%m)");
                    _exit(1);
                }
                _exit(0);
        }


        fclose(grey);
        /*
         * parent, scans db periodically for changes and updates
         * pf whitelist table accordingly.
         */

        sigfillset(&sa.sa_mask);
        sa.sa_flags = SA_RESTART;
        sa.sa_handler = sig_term_chld;
        sigaction(SIGTERM, &sa, NULL);
        sigaction(SIGHUP, &sa, NULL);
        sigaction(SIGCHLD, &sa, NULL);
        sigaction(SIGINT, &sa, NULL);

        setproctitle("(pf <spamd-white> update)");
        greyscanner();
        exit(1);
}