#!/bin/sh
# $Id$
#

#
# This is an example script for filtering overly aggressive SMTP
# clients using OpenBSD's pf packet filter.  To use this script, you
# must add a table declaration like the following to the top of your
# pf.conf file:
#
#    table <bad_smtp_clients> persist
#
# Then in the rules section of the file, filter incoming SYN packets
# to port 25, as follows:
#
#    block drop in proto tcp from <bad_smtp_clients> \
#            to any port = 25 flags S/SA
#
# Note it is very important that you only filter packets with flags
# S/SA.  The filter may be installed while there are open connections
# from the client.  The filtering should not interfere with open
# client connections, just prevent more from being opened, as that
# would be too many TCP sockets dedicated to the same client.
# 
# Once you have configured pf to have a <bad_smtp_clients> hook,
# simply copy this script to /etc/avenger/smtp-filter, and add the
# following line to /etc/avenger/asmtpd.conf:
#
#     SMTPFilter /etc/avenger/smtp-filter
#

#
# To port this script to another OS, replace the bodies of the
# filter_add, filter_del, and filter_clear functions with appropriate
# commands to add to, delete from, and clear the list of filtered
# client IP addresses.  See the asmtpd.conf(5) man page for more
# information.
#

PFCTL=/sbin/pfctl
TABLE=bad_smtp_clients

filter_add () {
    exec $PFCTL -q -t $TABLE -T add "$1"
}

filter_del () {
    exec $PFCTL -q -t $TABLE -T delete "$1"
}

filter_clear () {
    exec $PFCTL -q -t $TABLE -T flush
}


usage () {
    echo "usage: $0 add <ip-addr>" >&2
    echo "       $0 del <ip-addr>" >&2
    echo "       $0 clear" >&2
    exit 2
}

case $1 in
    add)
	test "$#" -ne 2 && usage
	filter_add "$2"
	;;
    del)
	test "$#" -ne 2 && usage
	filter_del "$2"
	;;
    clear)
	test "$#" -ne 1 && usage
	filter_clear
	;;
    *)
	usage
	;;
esac
