Add SPF checks via qmail-spp-spf (new dependency):

- On "fail", reject
- On "pass", skip any greylisting
- Else, accept mail as we otherwise would.

qmail-spp-spf adds a `Received-SPF:` header to all incoming messages.

Migrate ${PKG_SYSCONFDIR}/tcp.* to ${PKG_SYSCONFDIR}/control/tcprules.

Bump version.

13 files changed, 60 insertions, 46 deletions

diff --git a/mail/qmail-run/DEINSTALL b/mail/qmail-run/DEINSTALL
index a9e61b37418..e9c2df2ceb7 100644
--- a/mail/qmail-run/DEINSTALL
+++ b/mail/qmail-run/DEINSTALL
@@ -1,13 +1,11 @@
-# $NetBSD: DEINSTALL,v 1.1 2018/10/24 15:46:54 schmonz Exp $
-
-PKG_SYSCONFDIR=@PKG_SYSCONFDIR@
+# $NetBSD: DEINSTALL,v 1.2 2018/12/11 17:49:40 schmonz Exp $
 
 case "${STAGE}" in
 
 POST-DEINSTALL)
 	for i in ofmip pop3 smtp; do
-		s="${PKG_SYSCONFDIR}/tcp.${i}"
-		[ -f "${s}.cdb" ] && ! [ -f "${s}" ] && rm -f "${s}.cdb"
+		s="${PKG_SYSCONFDIR}/control/tcprules/${i}"
+		[ -f "${s}.cdb" ] && ! [ -f "${s}" ] && ${RM} -f "${s}.cdb"
 	done
 	;;
 
diff --git a/mail/qmail-run/INSTALL b/mail/qmail-run/INSTALL
index 4b9f4658bc4..4f6585325bb 100644
--- a/mail/qmail-run/INSTALL
+++ b/mail/qmail-run/INSTALL
@@ -1,11 +1,23 @@
-case ${STAGE} in
+# $NetBSD: INSTALL,v 1.10 2018/12/11 17:49:40 schmonz Exp $
 
-POST-INSTALL)
+case "${STAGE}" in
+
+PRE-INSTALL)
 	cd ${PKG_SYSCONFDIR}
 	for i in ofmip pop3 smtp; do
-		${CHMOD} 644 tcp.${i}
-		${PREFIX}/bin/tcprules tcp.${i}.cdb tcp.${i}.tmp < tcp.${i}
-		${CHMOD} 644 tcp.${i}.cdb
+		s="tcp.${i}"
+		[ -f "${s}" ] && ${MV} -f "${s}" "control/tcprules/${i}"
+		[ -f "${s}.cdb" ] && ${RM} -f "${s}.cdb"
+	done
+
+	;;
+
+POST-INSTALL)
+	cd ${PKG_SYSCONFDIR}/control/tcprules
+	for i in ofmip pop3 smtp; do
+		${CHMOD} 644 ${i}
+		${PREFIX}/bin/tcprules ${i}.cdb ${i}.tmp < ${i}
+		${CHMOD} 644 ${i}.cdb
 	done
 
 	;;
diff --git a/mail/qmail-run/Makefile b/mail/qmail-run/Makefile
index 603b3748748..28c24e65b12 100644
--- a/mail/qmail-run/Makefile
+++ b/mail/qmail-run/Makefile
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.62 2018/12/04 17:00:59 schmonz Exp $
+# $NetBSD: Makefile,v 1.63 2018/12/11 17:49:40 schmonz Exp $
 #
 
-DISTNAME=		qmail-run-20181204
+DISTNAME=		qmail-run-20181211
 CATEGORIES=		mail
 MASTER_SITES=		# empty
 DISTFILES=		# empty
@@ -18,6 +18,7 @@ DEPENDS+=		${DEPENDS_QMAIL}
 DEPENDS+=		qmail-acceptutils>=20181128:../../mail/qmail-acceptutils
 DEPENDS+=		qmail-qfilter>1.5nb1:../../mail/qmail-qfilter
 DEPENDS+=		qmail-rejectutils>=20181128:../../mail/qmail-rejectutils
+DEPENDS+=		qmail-spp-spf-[0-9]*:../../mail/qmail-spp-spf
 
 WRKSRC=			${WRKDIR}
 NO_BUILD=		yes
@@ -40,9 +41,11 @@ EGDIR=			share/examples/qmail-run
 CONF_FILES+=		${PREFIX}/${EGDIR}/${f} \
 			${PKG_SYSCONFDIR}/control/${f}
 .endfor
-.for f in tcp.ofmip tcp.pop3 tcp.smtp
-CONF_FILES+=		${PREFIX}/${EGDIR}/${f} \
-			${PKG_SYSCONFDIR}/${f}
+TCPRULESDIR=		${PKG_SYSCONFDIR}/control/tcprules
+OWN_DIRS+=		${TCPRULESDIR}
+.for f in ofmip pop3 smtp
+CONF_FILES+=		${PREFIX}/${EGDIR}/tcprules-${f} \
+			${TCPRULESDIR}/${f}
 .endfor
 GREYLISTDIR=		${PKG_SYSCONFDIR}/control/greylist
 OWN_DIRS_PERMS+=	${GREYLISTDIR} ${QMAIL_DAEMON_USER} ${QMAIL_QMAIL_GROUP} 775
@@ -77,7 +80,7 @@ SUBST_STAGE.paths=	pre-configure
 SUBST_FILES.paths=	mailer.conf
 SUBST_FILES.paths+=	greylisting-spp-with-exemptions ofmipd-with-user-cdb
 SUBST_FILES.paths+=	qmail-isspam-* qmail-procmail qmail-qread-client
-SUBST_FILES.paths+=	rcptchecks ofmipfilters smtpfilters smtpplugins tcp.*
+SUBST_FILES.paths+=	rcptchecks ofmipfilters smtpfilters smtpplugins tcprules-*
 SUBST_VARS.paths=	PKGNAME PKG_SYSCONFDIR PREFIX
 SUBST_VARS.paths+=	CAT ECHO GREP SED SH SORT TRUE
 
@@ -87,7 +90,7 @@ post-extract:
 		ofmipfilters smtpfilters \
 		pop3capabilities smtpcapabilities smtpplugins \
 		concurrencyincoming concurrencypop3 concurrencysubmission \
-		tcp.ofmip tcp.pop3 tcp.smtp; do \
+		tcprules-ofmip tcprules-pop3 tcprules-smtp; do \
 		${CP} ${FILESDIR}/$$f ${WRKDIR}/$$f; \
 	done; \
 	for f in greylisting-spp-with-exemptions ofmipd-with-user-cdb \
@@ -108,7 +111,7 @@ do-install:
 		ofmipfilters smtpfilters \
 		pop3capabilities smtpcapabilities smtpplugins \
 		concurrencyincoming concurrencypop3 concurrencysubmission \
-		tcp.ofmip tcp.pop3 tcp.smtp; do \
+		tcprules-ofmip tcprules-pop3 tcprules-smtp; do \
 		${INSTALL_DATA} ${WRKDIR}/$${f} \
 			${DESTDIR}${PREFIX}/${EGDIR}; \
 	done; \
diff --git a/mail/qmail-run/PLIST b/mail/qmail-run/PLIST
index 9f2424da3c4..a1b07aeeaf7 100644
--- a/mail/qmail-run/PLIST
+++ b/mail/qmail-run/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.18 2018/11/28 16:22:41 schmonz Exp $
+@comment $NetBSD: PLIST,v 1.19 2018/12/11 17:49:40 schmonz Exp $
 bin/greylisting-spp-with-exemptions
 bin/ofmipd-with-user-cdb
 bin/qmail-isspam-rspamd
@@ -22,6 +22,6 @@ share/examples/qmail-run/signatures
 share/examples/qmail-run/smtpcapabilities
 share/examples/qmail-run/smtpfilters
 share/examples/qmail-run/smtpplugins
-share/examples/qmail-run/tcp.ofmip
-share/examples/qmail-run/tcp.pop3
-share/examples/qmail-run/tcp.smtp
+share/examples/qmail-run/tcprules-ofmip
+share/examples/qmail-run/tcprules-pop3
+share/examples/qmail-run/tcprules-smtp
diff --git a/mail/qmail-run/files/README.pkgsrc b/mail/qmail-run/files/README.pkgsrc
index 95244be736c..1c67cdda774 100644
--- a/mail/qmail-run/files/README.pkgsrc
+++ b/mail/qmail-run/files/README.pkgsrc
@@ -42,5 +42,5 @@ LWQ suggests doing some things that the qmail-run package doesn't do:
 Instead, the qmail-run package:
 * Provides NetBSD-style rc.d scripts, including one very similar to qmailctl.
 * Sends log messages to syslog(3) by default.
-* Stores tcp.smtp{,cdb} and tcp.pop3{,cdb} in ${PKG_SYSCONFDIR}.
+* Stores tcprules in ${PKG_SYSCONFDIR}/control/tcprules.
 * Uses mailwrapper(8) and mailer.conf(5).
diff --git a/mail/qmail-run/files/qmailofmipd.sh b/mail/qmail-run/files/qmailofmipd.sh
index ed22f24f12e..4f366a09507 100644
--- a/mail/qmail-run/files/qmailofmipd.sh
+++ b/mail/qmail-run/files/qmailofmipd.sh
@@ -1,6 +1,6 @@
 #!@RCD_SCRIPTS_SHELL@
 #
-# $NetBSD: qmailofmipd.sh,v 1.18 2018/11/28 16:42:44 schmonz Exp $
+# $NetBSD: qmailofmipd.sh,v 1.19 2018/12/11 17:49:41 schmonz Exp $
 #
 # @PKGNAME@ script to control ofmipd (SMTP submission service).
 #
@@ -41,7 +41,7 @@ required_files="${required_files} @PKG_SYSCONFDIR@/control/concurrencysubmission
 required_files="${required_files} @PKG_SYSCONFDIR@/control/rcpthosts"
 required_files="${required_files} @PKG_SYSCONFDIR@/control/smtpcapabilities"
 required_files="${required_files} @PKG_SYSCONFDIR@/control/fixsmtpio"
-required_files="${required_files} @PKG_SYSCONFDIR@/tcp.ofmip.cdb"
+required_files="${required_files} @PKG_SYSCONFDIR@/control/tcprules/ofmip.cdb"
 command="${qmailofmipd_tcpserver}"
 procname=nb${name}
 start_precmd="qmailofmipd_precmd"
@@ -90,7 +90,7 @@ qmailofmipd_precmd()
 	command="@PREFIX@/bin/pgrphack @SETENV@ - ${qmailofmipd_postenv}
 @PREFIX@/bin/softlimit -m ${qmailofmipd_datalimit} ${qmailofmipd_pretcpserver}
 @PREFIX@/bin/argv0 ${qmailofmipd_tcpserver} ${procname}
-${qmailofmipd_tcpflags} -x @PKG_SYSCONFDIR@/tcp.ofmip.cdb
+${qmailofmipd_tcpflags} -x @PKG_SYSCONFDIR@/control/tcprules/ofmip.cdb
 -c `@HEAD@ -1 @PKG_SYSCONFDIR@/control/concurrencysubmission`
 ${qmailofmipd_tcphost} ${qmailofmipd_tcpport}
 ${qmailofmipd_precheckpassword} ${qmailofmipd_checkpassword}
@@ -128,10 +128,10 @@ qmailofmipd_cont()
 
 qmailofmipd_cdb()
 {
-	@ECHO@ "Reloading @PKG_SYSCONFDIR@/tcp.ofmip."
-	cd @PKG_SYSCONFDIR@
-	@PREFIX@/bin/tcprules tcp.ofmip.cdb tcp.ofmip.tmp < tcp.ofmip
-	@CHMOD@ 644 tcp.ofmip.cdb
+	@ECHO@ "Reloading @PKG_SYSCONFDIR@/control/tcprules/ofmip"
+	cd @PKG_SYSCONFDIR@/control/tcprules
+	@PREFIX@/bin/tcprules ofmip.cdb ofmip.tmp < ofmip
+	@CHMOD@ 644 ofmip.cdb
 }
 
 if [ -f /etc/rc.subr ]; then
diff --git a/mail/qmail-run/files/qmailpop3d.sh b/mail/qmail-run/files/qmailpop3d.sh
index 1dfdd57e057..7e758dc5e9c 100644
--- a/mail/qmail-run/files/qmailpop3d.sh
+++ b/mail/qmail-run/files/qmailpop3d.sh
@@ -1,6 +1,6 @@
 #!@RCD_SCRIPTS_SHELL@
 #
-# $NetBSD: qmailpop3d.sh,v 1.26 2018/11/28 16:42:44 schmonz Exp $
+# $NetBSD: qmailpop3d.sh,v 1.27 2018/12/11 17:49:41 schmonz Exp $
 #
 # @PKGNAME@ script to control qmail-pop3d (POP3 server for Maildirs).
 #
@@ -38,7 +38,7 @@ rcvar=${name}
 required_files="@PKG_SYSCONFDIR@/control/me"
 required_files="${required_files} @PKG_SYSCONFDIR@/control/concurrencypop3"
 required_files="${required_files} @PKG_SYSCONFDIR@/control/pop3capabilities"
-required_files="${required_files} @PKG_SYSCONFDIR@/tcp.pop3.cdb"
+required_files="${required_files} @PKG_SYSCONFDIR@/control/tcprules/pop3.cdb"
 command="${qmailpop3d_tcpserver}"
 procname=nb${name}
 start_precmd="qmailpop3d_precmd"
@@ -87,7 +87,7 @@ qmailpop3d_precmd()
 	command="@PREFIX@/bin/pgrphack @SETENV@ - ${qmailpop3d_postenv}
 @PREFIX@/bin/softlimit -m ${qmailpop3d_datalimit} ${qmailpop3d_pretcpserver}
 @PREFIX@/bin/argv0 ${qmailpop3d_tcpserver} ${procname}
-${qmailpop3d_tcpflags} -x @PKG_SYSCONFDIR@/tcp.pop3.cdb
+${qmailpop3d_tcpflags} -x @PKG_SYSCONFDIR@/control/tcprules/pop3.cdb
 -c `@HEAD@ -1 @PKG_SYSCONFDIR@/control/concurrencypop3`
 ${qmailpop3d_tcphost} ${qmailpop3d_tcpport}
 ${qmailpop3d_precheckpassword} ${qmailpop3d_checkpassword}
@@ -125,10 +125,10 @@ qmailpop3d_cont()
 
 qmailpop3d_cdb()
 {
-	@ECHO@ "Reloading @PKG_SYSCONFDIR@/tcp.pop3."
-	cd @PKG_SYSCONFDIR@
-	@PREFIX@/bin/tcprules tcp.pop3.cdb tcp.pop3.tmp < tcp.pop3
-	@CHMOD@ 644 tcp.pop3.cdb
+	@ECHO@ "Reloading @PKG_SYSCONFDIR@/control/tcprules/pop3."
+	cd @PKG_SYSCONFDIR@/control/tcprules
+	@PREFIX@/bin/tcprules pop3.cdb pop3.tmp < pop3
+	@CHMOD@ 644 pop3.cdb
 }
 
 if [ -f /etc/rc.subr ]; then
diff --git a/mail/qmail-run/files/qmailsmtpd.sh b/mail/qmail-run/files/qmailsmtpd.sh
index 2cbb4978d83..62e9cd5526c 100644
--- a/mail/qmail-run/files/qmailsmtpd.sh
+++ b/mail/qmail-run/files/qmailsmtpd.sh
@@ -1,6 +1,6 @@
 #!@RCD_SCRIPTS_SHELL@
 #
-# $NetBSD: qmailsmtpd.sh,v 1.23 2018/11/28 16:42:44 schmonz Exp $
+# $NetBSD: qmailsmtpd.sh,v 1.24 2018/12/11 17:49:41 schmonz Exp $
 #
 # @PKGNAME@ script to control qmail-smtpd (SMTP service).
 #
@@ -37,7 +37,7 @@ rcvar=${name}
 required_files="@PKG_SYSCONFDIR@/control/me"
 required_files="${required_files} @PKG_SYSCONFDIR@/control/concurrencyincoming"
 required_files="${required_files} @PKG_SYSCONFDIR@/control/rcpthosts"
-required_files="${required_files} @PKG_SYSCONFDIR@/tcp.smtp.cdb"
+required_files="${required_files} @PKG_SYSCONFDIR@/control/tcprules/smtp.cdb"
 command="${qmailsmtpd_tcpserver}"
 procname=nb${name}
 start_precmd="qmailsmtpd_precmd"
@@ -86,7 +86,7 @@ qmailsmtpd_precmd()
 	command="@PREFIX@/bin/pgrphack @SETENV@ - ${qmailsmtpd_postenv}
 @PREFIX@/bin/softlimit -m ${qmailsmtpd_datalimit} ${qmailsmtpd_pretcpserver}
 @PREFIX@/bin/argv0 ${qmailsmtpd_tcpserver} ${procname}
-${qmailsmtpd_tcpflags} -x @PKG_SYSCONFDIR@/tcp.smtp.cdb
+${qmailsmtpd_tcpflags} -x @PKG_SYSCONFDIR@/control/tcprules/smtp.cdb
 -c `@HEAD@ -1 @PKG_SYSCONFDIR@/control/concurrencyincoming`
 -u `@ID@ -u @QMAIL_DAEMON_USER@` -g `@ID@ -g @QMAIL_DAEMON_USER@`
 ${qmailsmtpd_tcphost} ${qmailsmtpd_tcpport}
@@ -124,10 +124,10 @@ qmailsmtpd_cont()
 
 qmailsmtpd_cdb()
 {
-	@ECHO@ "Reloading @PKG_SYSCONFDIR@/tcp.smtp."
-	cd @PKG_SYSCONFDIR@
-	@PREFIX@/bin/tcprules tcp.smtp.cdb tcp.smtp.tmp < tcp.smtp
-	@CHMOD@ 644 tcp.smtp.cdb
+	@ECHO@ "Reloading @PKG_SYSCONFDIR@/control/tcprules/smtp."
+	cd @PKG_SYSCONFDIR@/control/tcprules
+	@PREFIX@/bin/tcprules smtp.cdb smtp.tmp < smtp
+	@CHMOD@ 644 smtp.cdb
 }
 
 if [ -f /etc/rc.subr ]; then
diff --git a/mail/qmail-run/files/smtpplugins b/mail/qmail-run/files/smtpplugins
index 07ca0c318b7..94b68ce17e4 100644
--- a/mail/qmail-run/files/smtpplugins
+++ b/mail/qmail-run/files/smtpplugins
@@ -8,6 +8,7 @@
 
 # plugins to execute on MAIL command
 [mail]
+@PREFIX@/bin/qmail-spp-spf
 
 # plugins to execute on RCPT command
 [rcpt]
diff --git a/mail/qmail-run/files/tcp.smtp b/mail/qmail-run/files/tcp.smtp
deleted file mode 100644
index b496daf5b07..00000000000
--- a/mail/qmail-run/files/tcp.smtp
+++ /dev/null
@@ -1,2 +0,0 @@
-127.:allow,RELAYCLIENT=""
-:allow,UCSPITLS="",GREETDELAY="2",GL_DATABASE="@PKG_SYSCONFDIR@/control/greylist/database",GL_VERBOSE="1",QMAILQUEUE="@PREFIX@/bin/qmail-qfilter-queue",QMAILQUEUEFILTERS="control/smtpfilters"
diff --git a/mail/qmail-run/files/tcp.ofmip b/mail/qmail-run/files/tcprules-ofmip
index 89209beb3cf..89209beb3cf 100644
--- a/mail/qmail-run/files/tcp.ofmip
+++ b/mail/qmail-run/files/tcprules-ofmip
diff --git a/mail/qmail-run/files/tcp.pop3 b/mail/qmail-run/files/tcprules-pop3
index 9f52f0e93d5..9f52f0e93d5 100644
--- a/mail/qmail-run/files/tcp.pop3
+++ b/mail/qmail-run/files/tcprules-pop3
diff --git a/mail/qmail-run/files/tcprules-smtp b/mail/qmail-run/files/tcprules-smtp
new file mode 100644
index 00000000000..eb9a0172404
--- /dev/null
+++ b/mail/qmail-run/files/tcprules-smtp
@@ -0,0 +1,2 @@
+127.:allow,RELAYCLIENT=""
+:allow,UCSPITLS="",GREETDELAY="2",SPP_SPF_RESULT_FAIL="E550 spf_smtp_msg",SPP_SPF_RESULT_PASS="SGL_WHITELISTED=1",GL_DATABASE="@PKG_SYSCONFDIR@/control/greylist/database",GL_VERBOSE="1",QMAILQUEUE="@PREFIX@/bin/qmail-qfilter-queue",QMAILQUEUEFILTERS="control/smtpfilters"