#!/bin/bash

#✅ Valid Actions for Postfix Policy Services
#
#Here are the accepted action= values (as per Postfix documentation):
#action= Value Description
#DUNNO Neutral — continue to next rule
#OK Permit the request (equivalent to permit)
#REJECT Reject the request
#DISCARD Accept but silently discard the message
#DEFER Temporary failure (always)
#DEFER_IF_PERMIT Defer only if later rules would allow
#DEFER_IF_REJECT Defer only if later rules would reject
#HOLD Put message in mail queue and await manual release
#REDIRECT [email protected] Redirect message to another address







DNSWL_ZONES=(
"list.dnswl.org"
"rep.mailspike.net"
"dnswl.spfbl.net"
"wl.rbl.debacom.pl"
"white.dnsbl.brukalai.lt"
"0badxxxxxxx7e.white.mail.abusix.zone"
)

SYSLOG_TAG="postfix-dnswl"

# Function to reverse the IP
reverse_ip() {
echo "$1" | awk -F. '{print $4"."$3"."$2"."$1}'
}

# Function to check DNSWL
check_dnswl() {
local ip="$1"
local zone="$2"
local reversed_ip
local fqdn
local result

reversed_ip=$(reverse_ip "$ip")
fqdn="${reversed_ip}.${zone}"

result=$(dig +short "$fqdn" A)

if [[ -n "$result" ]]; then
# logger -t "$SYSLOG_TAG" "Match: $ip in $zone: returned $result, for recipient $recipient, replace with 127.0.0.2"
logger -t "$SYSLOG_TAG" "Match: $ip in $zone: returned $result, $sender > $recipient"
# echo "action=PERMIT"
echo -e "action=OK\n\n"
# echo ""
return 0
fi

return 1
}

# Read client IP from stdin (Postfix policy protocol)
client_ip=""
sender=""
recipient=""

while read -r line; do
[[ "$line" == "" ]] && break
if [[ "$line" =~ ^client_address= ]]; then
client_ip="${line#client_address=}"
elif [[ "$line" =~ ^recipient= ]]; then
recipient="${line#recipient=}"
elif [[ "$line" =~ ^sender= ]]; then
sender="${line#sender=}"
fi


# if [[ "$line" =~ ^client_address= ]]; then
# client_ip="${line#client_address=}"
## recipient="${line#recipient=}"
# fi
done

# If no client IP, fallback
if [[ -z "$client_ip" ]]; then
echo -e "action=DUNNO\n\n"
# echo "action=DUNNO"
# echo ""
# Postfix expects two newlines at the end — the last one terminates the response.
exit 0
fi

#logger -t "$SYSLOG_TAG" "Checking client $client_ip against DNSWLs..."

# Check all DNSWL zones
for zone in "${DNSWL_ZONES[@]}"; do
if check_dnswl "$client_ip" "$zone"; then
exit 0
fi
done

logger -t "$SYSLOG_TAG" "No DNSWL match in any of the queried lists for $client_ip — not whitelisted $line"
echo -e "action=DUNNO\n\n"
#echo -e "action=OK\n"
#echo ""


exit 0