spf_update_pf

#!/bin/sh

#
# Copyright (c) 2016 Aaron Poffenberger <akp@hypernote.com>
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
#

__progname=$(basename "$0")

TRUE=0
FALSE=1

PREFIX=''
PREFIX_DEF='common'

COMMENTS=$FALSE
FILE="/etc/mail/${PREFIX_DEF}_domains"
FILE_BASE=$(basename "${FILE}")
REMOVE=$FALSE
# 36 days -- same as spamd(8)
SECONDS=3110400
TABLE="${PREFIX_DEF}_white"

smtpctl spf 2>&1 | grep spf
if [ $? -eq 0 ]; then
	WALKER="smtpctl spf walk"
else
	WALKER="spf_fetch"
fi
WALKER_ARGS=''

CMD=run
VERSION=1.0

function log_msg {
	local OPTIND o a
	while getopts :p: opt ; do
		case $opt in
			p)
				PAD=$OPTARG
				;;
			*)
				;;
		esac
	done
	shift $(( OPTIND - 1 ))
	msg=$@

	if [ -z "$msg" ] ; then
		return 0
	fi

	if [ -n "$PAD" ] ; then
		printf -v padding "%-${PAD}s" ' '
	fi

	echo "${padding}${msg}"
}

TMPFILE=`mktemp -q /tmp/$__progname.XXXXXXXXXX` ||
	(log_msg "Unable to create $__progname tmp file ... aborting" ; \
	 exit $err_exit)

TMPCOPY=`mktemp -q /tmp/$__progname.XXXXXXXXXX` ||
	(log_msg "Unable to create $__progname tmp file ... aborting" ; \
	 exit $err_exit)

trap "rm -f '$TMPFILE' '$TMPCOPY'" EXIT
trap "log_msg $__progname aborted by user;exit 1" INT

function remove {
	cp "$FILE" "$TMPCOPY"
	cutoff=$(expr `date +'%s'` - $SECONDS)
	while read LINE ; do
		timestamp=$(echo "$LINE" \
				    | cut -d '#' -f 2 \
				    | tr -d ' ' | \
				    egrep '^[0-9]+'
			 )
		# if there's a timestamp, compare it
		if [ -n "$timestamp" ] ; then
			if [ $timestamp -ge $cutoff ] ; then
				echo "$LINE" >> "$TMPFILE"
			fi
		else
			# otherwise leave it alone
			echo "$LINE" >> "$TMPFILE"
		fi
	done < "$TMPCOPY"

	cat "$TMPFILE" > "$FILE"

	rm -f "$TMPCOPY" "$TMPFILE"
}

function run {
	has_table=$(pfctl -s Tables | grep "$TABLE")

	if [ -z "$has_table" ] ; then
		echo Table not found: $TABLE
		exit 2
	elif [ ! -e "$FILE" ] ; then
		echo File not found: $FILE
		exit 1
	else
		# remove entries older than SECONDS if REMOVE specified
		if [ $REMOVE -eq $TRUE ] ; then
			remove
		fi

		OUTPUT="/var/db/${FILE_BASE}_ips"

		${WALKER} $WALKER_ARGS < "$FILE" > "${OUTPUT}"

		pfctl -t "$TABLE" -T replace -f "${OUTPUT}"
	fi
}

function version {
	log_msg "$__basename $VERSION"
}

function usage {
	# dispose of stdin data
	if [ ! -t 0 ] ; then
		cat > /dev/null
	fi

	usage="usage: $__progname"
	length=$(expr ${#usage} + 1)

	log_msg "$usage [-afhprstv] [-a spf_fetch_args] [-f file] [-h] [-p prefix]"
	log_msg -p $length "[-r] [-s seconds] [-t table] [-v]"
}

while getopts :a:f:hp:rs:t:v opt ; do
	case $opt in
		a)
			WALKER_ARGS=$OPTARG
			;;
		f)
			FILE=$OPTARG
			;;
		h)
			CMD="usage"
			;;
		p)
			PREFIX=$OPTARG
			;;
		r)
			REMOVE=$TRUE
			;;
		s)
			SECONDS=$OPTARG
			;;
		t)
			TABLE=$OPTARG
			;;
		v)
			CMD="VERSION"
			;;
		:)
			log_msg $__progname: option requires an argument \
				-- $OPTARG
			log_msg
			CMD=abort
			;;
		\?)
			log_msg $__progname: invalid option -- $OPTARG
			log_msg
			CMD=abort
			;;
	esac
done
shift $(( OPTIND - 1 ))

# override FILE and TABLE if PREFIX set
if [ -n "$PREFIX" ] ; then
	FILE="/etc/mail/${PREFIX}_domains"
	TABLE="${PREFIX}_white"
fi

case $CMD in
	run)
		run
		;;
	usage)
		usage
		;;
	version)
		version
		;;
	*)
		usage
		;;
esac