Matt Simerson
commit
fd646b0d27
488
plugins/helo
Normal file
488
plugins/helo
Normal file
@ -0,0 +1,488 @@
|
||||
#!perl -w
|
||||
|
||||
=head1 NAME
|
||||
|
||||
helo - validate the HELO message presented by a connecting host.
|
||||
|
||||
=head1 DESCRIPTION
|
||||
|
||||
Validate the HELO hostname. This plugin includes a suite of optional tests,
|
||||
selectable by the I<policy> setting. The policy section details which tests
|
||||
are enforced by each policy option.
|
||||
|
||||
It sets the connection notes helo_forward_match and helo_reverse_match when
|
||||
I<policy rfc> or I<policy strict> are used.
|
||||
|
||||
Adds an X-HELO header with the HELO hostname to the message.
|
||||
|
||||
Using I<policy rfc> will reject a very large portion of the spam from hosts
|
||||
that have yet to get blacklisted.
|
||||
|
||||
=head1 WHY IT WORKS
|
||||
|
||||
The reverse DNS of the zombie PCs is out of the spam operators control. Their
|
||||
only way to get past these tests is to limit themselves to hosts with matching
|
||||
forward and reverse DNS, and then use the proper HELO hostname when spamming.
|
||||
At present, this presents a very high hurdle.
|
||||
|
||||
=head1 HELO VALIDATION TESTS
|
||||
|
||||
=over 4
|
||||
|
||||
=item is_in_badhelo
|
||||
|
||||
Matches in the I<badhelo> config file, including yahoo.com and aol.com, which
|
||||
neither the real Yahoo or the real AOL use, but which spammers use a lot.
|
||||
|
||||
Like qmail with the qregex patch, the B<badhelo> file can also contain perl
|
||||
regular expressions. In addition to normal regexp processing, a pattern can
|
||||
start with a ! character, and get a negated (!~) match.
|
||||
|
||||
=item invalid_localhost
|
||||
|
||||
Assure that if a sender uses the 'localhost' hostname, they are coming from
|
||||
the localhost IP.
|
||||
|
||||
=item is_plain_ip
|
||||
|
||||
Disallow plain IP addresses. They are neither a FQDN nor an address literal.
|
||||
|
||||
=item is_address_literal [N.N.N.N]
|
||||
|
||||
An address literal (an IP enclosed in brackets) is legal but rarely, if ever,
|
||||
encountered from legit senders.
|
||||
|
||||
=item is_forged_literal
|
||||
|
||||
If a literal is presented, make sure it matches the senders IP.
|
||||
|
||||
=item is_not_fqdn
|
||||
|
||||
Makes sure the HELO hostname contains at least one dot and has only those
|
||||
characters specifically allowed in domain names (RFC 1035).
|
||||
|
||||
=item no_forward_dns
|
||||
|
||||
Make sure the HELO hostname resolves.
|
||||
|
||||
=item no_reverse_dns
|
||||
|
||||
Make sure the senders IP address resolves to a hostname.
|
||||
|
||||
=item no_matching_dns
|
||||
|
||||
Make sure the HELO hostname has an A or AAAA record that matches the senders
|
||||
IP address, and make sure that the senders IP has a PTR that resolves to the
|
||||
HELO hostname.
|
||||
|
||||
Since the dawn of SMTP, having matching DNS has been a minimum standard
|
||||
expected and oft required of mail servers. While requiring matching DNS is
|
||||
prudent, requiring an exact match will reject valid email. While testing this
|
||||
plugin with rejection disabled, I noticed that mx0.slc.paypal.com sends email
|
||||
from an IP that reverses to mx1.slc.paypal.com. While that's technically an
|
||||
error, I believe it's an error to reject mail based on it. Especially since
|
||||
SLD and TLD match.
|
||||
|
||||
To avoid snagging false positives, matches are extended to the first
|
||||
3 octets of the IP and the last two labels of the FQDN. The following are
|
||||
considered a match:
|
||||
|
||||
192.0.1.2, 192.0.1.3
|
||||
|
||||
foo.example.com, bar.example.com
|
||||
|
||||
This allows I<no_matching_dns> to be used without rejecting mail from orgs with
|
||||
pools of servers where the HELO name and IP don't exactly match. This list
|
||||
includes Yahoo, Gmail, PayPal, cheaptickets.com, exchange.microsoft.com, and
|
||||
likely many more.
|
||||
|
||||
=back
|
||||
|
||||
=head1 CONFIGURATION
|
||||
|
||||
=head2 policy [ lenient | rfc | strict ]
|
||||
|
||||
Default: lenient
|
||||
|
||||
=head3 lenient
|
||||
|
||||
Reject failures of the following tests: is_in_badhelo, invalid_localhost, and
|
||||
is_forged_literal.
|
||||
|
||||
This setting is lenient enough not to cause problems for your Windows users.
|
||||
It is comparable to running check_spamhelo, but with the addition of regexp
|
||||
support and the prevention of forged localhost and forged IP literals.
|
||||
|
||||
=head3 rfc
|
||||
|
||||
Per RFC 2821, the HELO hostname is the FQDN of the sending server or an
|
||||
address literal. When I<policy rfc> is selected, all the lenient checks and
|
||||
the following are enforced: is_plain_ip, is_not_fqdn, no_forward_dns, and
|
||||
no_reverse_dns.
|
||||
|
||||
If you have Windows users that send mail via your server, do not choose
|
||||
I<policy rfc> without I<reject naughty> and the B<naughty> plugin. Windows
|
||||
users often send unqualified HELO names and will have trouble sending mail.
|
||||
<Naughty> can defer the rejection, and if the user subsequently authenticates,
|
||||
the rejection will be cancelled.
|
||||
|
||||
=head3 strict
|
||||
|
||||
Strict includes all the RFC tests and the following: no_matching_dns, and
|
||||
is_address_literal.
|
||||
|
||||
I have yet to see an address literal being used by a hammy sender. But I am
|
||||
not certain that blocking them all is prudent.
|
||||
|
||||
It is recommended that I<policy strict> be used with <reject 0> and that you
|
||||
monitor your logs for false positives before enabling rejection.
|
||||
|
||||
=head2 badhelo
|
||||
|
||||
Add domains, hostnames, or perl regexp patterns to the F<badhelo> config
|
||||
file; one per line.
|
||||
|
||||
=head2 timeout [seconds]
|
||||
|
||||
Default: 5
|
||||
|
||||
The number of seconds before DNS queries timeout.
|
||||
|
||||
=head2 reject [ 0 | 1 | naughty ]
|
||||
|
||||
Default: 1
|
||||
|
||||
0: do not reject
|
||||
|
||||
1: reject
|
||||
|
||||
naughty: naughty plugin handles rejection
|
||||
|
||||
=head2 reject_type [ temp | perm | disconnect ]
|
||||
|
||||
Default: disconnect
|
||||
|
||||
What type of rejection should be sent? See docs/config.pod
|
||||
|
||||
=head2 loglevel
|
||||
|
||||
Adjust the quantity of logging for this plugin. See docs/logging.pod
|
||||
|
||||
=head1 RFC 2821
|
||||
|
||||
=head2 4.1.1.1
|
||||
|
||||
The HELO hostname "...contains the fully-qualified domain name of the SMTP
|
||||
client if one is available. In situations in which the SMTP client system
|
||||
does not have a meaningful domain name (e.g., when its address is dynamically
|
||||
allocated and no reverse mapping record is available), the client SHOULD send
|
||||
an address literal (see section 4.1.3), optionally followed by information
|
||||
that will help to identify the client system."
|
||||
|
||||
=head2 2.3.5
|
||||
|
||||
The domain name, as described in this document and in [22], is the
|
||||
entire, fully-qualified name (often referred to as an "FQDN"). A domain name
|
||||
that is not in FQDN form is no more than a local alias. Local aliases MUST
|
||||
NOT appear in any SMTP transaction.
|
||||
|
||||
|
||||
=head1 AUTHOR
|
||||
|
||||
2012 - Matt Simerson
|
||||
|
||||
=head1 ACKNOWLEDGEMENTS
|
||||
|
||||
badhelo processing from check_badhelo plugin
|
||||
|
||||
badhelo regex processing idea from qregex patch
|
||||
|
||||
additional check ideas from Hakura helo plugin
|
||||
|
||||
=cut
|
||||
|
||||
use strict;
|
||||
use warnings;
|
||||
|
||||
use Qpsmtpd::Constants;
|
||||
|
||||
use Net::DNS;
|
||||
|
||||
sub register {
|
||||
my ($self, $qp) = shift, shift;
|
||||
$self->{_args} = { @_ };
|
||||
$self->{_args}{reject_type} = 'disconnect';
|
||||
$self->{_args}{policy} ||= 'lenient';
|
||||
$self->{_args}{timeout} ||= 5;
|
||||
|
||||
if ( ! defined $self->{_args}{reject} ) {
|
||||
$self->{_args}{reject} = 1;
|
||||
};
|
||||
|
||||
$self->populate_tests();
|
||||
$self->init_resolver();
|
||||
|
||||
$self->register_hook('helo', 'helo_handler');
|
||||
$self->register_hook('ehlo', 'helo_handler');
|
||||
$self->register_hook('data_post', 'data_post_handler');
|
||||
};
|
||||
|
||||
sub helo_handler {
|
||||
my ($self, $transaction, $host) = @_;
|
||||
|
||||
if ( ! $host ) {
|
||||
$self->log(LOGINFO, "fail, no helo host");
|
||||
return DECLINED;
|
||||
};
|
||||
|
||||
return DECLINED if $self->is_immune();
|
||||
|
||||
foreach my $test ( @{ $self->{_helo_tests} } ) {
|
||||
my @err = $self->$test( $host );
|
||||
return $self->get_reject( @err ) if scalar @err;
|
||||
};
|
||||
|
||||
$self->log(LOGINFO, "pass");
|
||||
return DECLINED;
|
||||
}
|
||||
|
||||
sub data_post_handler {
|
||||
my ($self, $transaction) = @_;
|
||||
|
||||
$transaction->header->delete('X-HELO');
|
||||
$transaction->header->add('X-HELO', $self->qp->connection->hello_host, 0 );
|
||||
|
||||
return (DECLINED);
|
||||
};
|
||||
|
||||
sub populate_tests {
|
||||
my $self = shift;
|
||||
|
||||
my $policy = $self->{_args}{policy};
|
||||
@{ $self->{_helo_tests} } = qw/ is_in_badhelo invalid_localhost is_forged_literal /;
|
||||
|
||||
if ( $policy eq 'rfc' || $policy eq 'strict' ) {
|
||||
push @{ $self->{_helo_tests} }, qw/ is_plain_ip is_not_fqdn no_forward_dns
|
||||
no_reverse_dns /;
|
||||
};
|
||||
|
||||
if ( $policy eq 'strict' ) {
|
||||
push @{ $self->{_helo_tests} }, qw/ is_address_literal no_matching_dns /;
|
||||
};
|
||||
};
|
||||
|
||||
sub init_resolver {
|
||||
my $self = shift;
|
||||
return $self->{_resolver} if $self->{_resolver};
|
||||
$self->log( LOGDEBUG, "initializing Net::DNS::Resolver");
|
||||
$self->{_resolver} = Net::DNS::Resolver->new(dnsrch => 0);
|
||||
my $timeout = $self->{_args}{timeout} || 5;
|
||||
$self->{_resolver}->tcp_timeout($timeout);
|
||||
$self->{_resolver}->udp_timeout($timeout);
|
||||
return $self->{_resolver};
|
||||
};
|
||||
|
||||
sub is_in_badhelo {
|
||||
my ( $self, $host ) = @_;
|
||||
|
||||
my $error = "I do not believe you are $host.";
|
||||
|
||||
$host = lc $host;
|
||||
foreach my $bad ($self->qp->config('badhelo')) {
|
||||
if ( $bad =~ /[\{\}\[\]\(\)\^\$\|\*\+\?\\\!]/ ) { # it's a regexp
|
||||
return $self->is_regex_match( $host, $bad );
|
||||
};
|
||||
if ( $host eq lc $bad) {
|
||||
return ($error, "in badhelo");
|
||||
}
|
||||
}
|
||||
return;
|
||||
};
|
||||
|
||||
sub is_regex_match {
|
||||
my ( $self, $host, $pattern ) = @_;
|
||||
|
||||
my $error = "Your HELO hostname is not allowed";
|
||||
|
||||
#$self->log( LOGDEBUG, "is regex ($pattern)");
|
||||
if ( substr( $pattern, 0, 1) eq '!' ) {
|
||||
$pattern = substr $pattern, 1;
|
||||
if ( $host !~ /$pattern/ ) {
|
||||
#$self->log( LOGDEBUG, "matched ($pattern)");
|
||||
return ($error, "badhelo pattern match ($pattern)");
|
||||
};
|
||||
return;
|
||||
}
|
||||
if ( $host =~ /$pattern/ ) {
|
||||
#$self->log( LOGDEBUG, "matched ($pattern)");
|
||||
return ($error, "badhelo pattern match ($pattern)");
|
||||
};
|
||||
return;
|
||||
}
|
||||
|
||||
sub invalid_localhost {
|
||||
my ( $self, $host ) = @_;
|
||||
return if lc $host ne 'localhost';
|
||||
if ( $self->qp->connection->remote_ip ne '127.0.0.1' ) {
|
||||
#$self->log( LOGINFO, "fail, not localhost" );
|
||||
return ("You are not localhost", "invalid localhost");
|
||||
};
|
||||
$self->log( LOGDEBUG, "pass, is localhost" );
|
||||
return;
|
||||
};
|
||||
|
||||
sub is_plain_ip {
|
||||
my ( $self, $host ) = @_;
|
||||
return if $host =~ /[^\d\.]+/; # has chars other than digits and a dot
|
||||
return if $host !~ m/^(\d{1,3}\.){3}\d{1,3}$/;
|
||||
|
||||
$self->log( LOGDEBUG, "fail, plain IP" );
|
||||
return ("Plain IP is invalid HELO hostname (RFC 2821)", "plain IP");
|
||||
};
|
||||
|
||||
sub is_address_literal {
|
||||
my ( $self, $host ) = @_;
|
||||
return if $host !~ m/^\[(\d{1,3}\.){3}\d{1,3}\]$/;
|
||||
|
||||
$self->log( LOGDEBUG, "fail, bracketed IP" );
|
||||
return ("RFC 2821 allows an address literal, but we do not", "bracketed IP");
|
||||
};
|
||||
|
||||
sub is_forged_literal {
|
||||
my ( $self, $host ) = @_;
|
||||
return if $host !~ m/^\[(\d{1,3}\.){3}\d{1,3}\]$/;
|
||||
|
||||
$host = substr $host, 1, -1;
|
||||
return if $host eq $self->qp->connection->remote_ip;
|
||||
return ("Forged IPs not accepted here", "forged IP literal");
|
||||
};
|
||||
|
||||
sub is_not_fqdn {
|
||||
my ($self, $host) = @_;
|
||||
return if $host =~ m/^\[(\d{1,3}\.){3}\d{1,3}\]$/; # address literal, skip
|
||||
if ( $host !~ /\./ ) { # has no dots
|
||||
return ("HELO name is not fully qualified. Read RFC 2821", "not FQDN");
|
||||
};
|
||||
if ( $host =~ /[^a-zA-Z0-9\-\.]/ ) {
|
||||
return ("HELO name contains invalid FQDN characters. Read RFC 1035", "invalid FQDN chars");
|
||||
};
|
||||
return;
|
||||
};
|
||||
|
||||
sub no_forward_dns {
|
||||
my ( $self, $host ) = @_;
|
||||
|
||||
my $res = $self->init_resolver();
|
||||
|
||||
$host = "$host." if $host !~ /\.$/; # fully qualify name
|
||||
my $query = $res->search($host);
|
||||
|
||||
if (! $query) {
|
||||
if ( $res->errorstring eq 'NXDOMAIN' ) {
|
||||
return ("HELO hostname does not exist", "HELO hostname does not exist");
|
||||
}
|
||||
$self->log(LOGERROR, "skip, query failed (", $res->errorstring, ")" );
|
||||
return;
|
||||
};
|
||||
my $hits = 0;
|
||||
foreach my $rr ($query->answer) {
|
||||
next unless $rr->type =~ /^(?:A|AAAA)$/;
|
||||
$self->check_ip_match( $rr->address );
|
||||
$hits++;
|
||||
}
|
||||
if ( $hits ) {
|
||||
$self->log(LOGDEBUG, "pass, forward DNS") if $hits;
|
||||
return;
|
||||
};
|
||||
return ("helo hostname did not resolve", "fail, HELO forward DNS");
|
||||
};
|
||||
|
||||
sub no_reverse_dns {
|
||||
my ( $self, $host, $ip ) = @_;
|
||||
|
||||
my $res = $self->init_resolver();
|
||||
$ip ||= $self->qp->connection->remote_ip;
|
||||
|
||||
my $query = $res->query( $ip ) or do {
|
||||
if ( $res->errorstring eq 'NXDOMAIN' ) {
|
||||
return ("no rDNS for $ip", "no rDNS");
|
||||
};
|
||||
$self->log( LOGINFO, $res->errorstring );
|
||||
return ("error getting reverse DNS for $ip", "rDNS " . $res->errorstring);
|
||||
};
|
||||
|
||||
my $hits = 0;
|
||||
for my $rr ($query->answer) {
|
||||
next if $rr->type ne 'PTR';
|
||||
$self->log(LOGDEBUG, "PTR: " . $rr->ptrdname );
|
||||
$self->check_name_match( lc $rr->ptrdname, lc $host );
|
||||
$hits++;
|
||||
};
|
||||
if ( $hits ) {
|
||||
$self->log(LOGDEBUG, "has rDNS");
|
||||
return;
|
||||
};
|
||||
return ("no reverse DNS for $ip", "no rDNS");
|
||||
};
|
||||
|
||||
sub no_matching_dns {
|
||||
my ( $self, $host ) = @_;
|
||||
|
||||
if ( $self->connection->notes('helo_forward_match') &&
|
||||
$self->connection->notes('helo_reverse_match') ) {
|
||||
$self->log( LOGDEBUG, "foward and reverse match" );
|
||||
# TODO: consider adding some karma here
|
||||
return;
|
||||
};
|
||||
|
||||
if ( $self->connection->notes('helo_forward_match') ) {
|
||||
$self->log( LOGDEBUG, "name matches IP" );
|
||||
return;
|
||||
}
|
||||
if ( $self->connection->notes('helo_reverse_match') ) {
|
||||
$self->log( LOGDEBUG, "reverse matches name" );
|
||||
return;
|
||||
};
|
||||
|
||||
$self->log( LOGINFO, "fail, no forward or reverse DNS match" );
|
||||
return ("That HELO hostname fails forward and reverse DNS checks", "no matching DNS");
|
||||
};
|
||||
|
||||
sub check_ip_match {
|
||||
my $self = shift;
|
||||
my $ip = shift or return;
|
||||
|
||||
if ( $ip eq $self->qp->connection->remote_ip ) {
|
||||
$self->log( LOGDEBUG, "forward ip match" );
|
||||
$self->connection->notes('helo_forward_match', 1);
|
||||
return;
|
||||
};
|
||||
|
||||
my $dns_net = join('.', (split('\.', $ip))[0,1,2] );
|
||||
my $rem_net = join('.', (split('\.', $self->qp->connection->remote_ip))[0,1,2] );
|
||||
|
||||
if ( $dns_net eq $rem_net ) {
|
||||
$self->log( LOGNOTICE, "forward network match" );
|
||||
$self->connection->notes('helo_forward_match', 1);
|
||||
};
|
||||
};
|
||||
|
||||
sub check_name_match {
|
||||
my $self = shift;
|
||||
my ($dns_name, $helo_name) = @_;
|
||||
|
||||
if ( $dns_name eq $helo_name ) {
|
||||
$self->log( LOGDEBUG, "reverse name match" );
|
||||
$self->connection->notes('helo_reverse_match', 1);
|
||||
return;
|
||||
};
|
||||
|
||||
my $dns_dom = join('.', (split('\.', $dns_name ))[-2,-1] );
|
||||
my $helo_dom = join('.', (split('\.', $helo_name))[-2,-1] );
|
||||
|
||||
if ( $dns_dom eq $helo_dom ) {
|
||||
$self->log( LOGNOTICE, "reverse domain match" );
|
||||
$self->connection->notes('helo_reverse_match', 1);
|
||||
};
|
||||
};
|
||||
|
||||
179
t/plugin_tests/helo
Normal file
179
t/plugin_tests/helo
Normal file
@ -0,0 +1,179 @@
|
||||
#!perl -w
|
||||
|
||||
use strict;
|
||||
use warnings;
|
||||
|
||||
use Qpsmtpd::Constants;
|
||||
|
||||
sub register_tests {
|
||||
my $self = shift;
|
||||
|
||||
$self->register_test('test_init_resolver', 2);
|
||||
$self->register_test('test_is_in_badhelo', 2);
|
||||
$self->register_test('test_is_regex_match', 3);
|
||||
$self->register_test('test_invalid_localhost', 4);
|
||||
$self->register_test('test_is_plain_ip', 3);
|
||||
$self->register_test('test_is_address_literal', 3);
|
||||
$self->register_test('test_no_forward_dns', 2);
|
||||
$self->register_test('test_no_reverse_dns', 2);
|
||||
$self->register_test('test_no_matching_dns', 4);
|
||||
$self->register_test('test_no_matching_dns', 4);
|
||||
$self->register_test('test_helo_handler', 1);
|
||||
$self->register_test('test_check_ip_match', 4);
|
||||
$self->register_test('test_check_name_match', 4);
|
||||
}
|
||||
|
||||
sub test_helo_handler {
|
||||
my $self = shift;
|
||||
|
||||
cmp_ok( $self->helo_handler(undef, undef), '==', DECLINED, "empty host");
|
||||
};
|
||||
|
||||
sub test_init_resolver {
|
||||
my $self = shift;
|
||||
my $net_dns = $self->init_resolver();
|
||||
ok( $net_dns, "net::dns" );
|
||||
cmp_ok( ref $net_dns, 'eq', 'Net::DNS::Resolver', "ref ok");
|
||||
};
|
||||
|
||||
sub test_is_in_badhelo {
|
||||
my $self = shift;
|
||||
|
||||
my ($err, $why) = $self->is_in_badhelo('yahoo.com');
|
||||
ok( $err, "yahoo.com, $why");
|
||||
|
||||
($err, $why) = $self->is_in_badhelo('example.com');
|
||||
ok( ! $err, "example.com");
|
||||
};
|
||||
|
||||
sub test_is_regex_match {
|
||||
my $self = shift;
|
||||
|
||||
my ($err, $why) = $self->is_regex_match('yahoo.com', 'ya.oo\.com$' );
|
||||
ok( $err, "yahoo.com, $why");
|
||||
|
||||
($err, $why) = $self->is_regex_match('yoda.com', 'ya.oo\.com$' );
|
||||
ok( ! $err, "yahoo.com");
|
||||
|
||||
($err, $why) = $self->is_regex_match('host-only', '!\.' );
|
||||
ok( $err, "negated pattern, $why");
|
||||
};
|
||||
|
||||
sub test_invalid_localhost {
|
||||
my $self = shift;
|
||||
|
||||
$self->qp->connection->remote_ip(undef);
|
||||
my ($err, $why) = $self->invalid_localhost('localhost' );
|
||||
ok( $err, "localhost, undefined remote IP: $why");
|
||||
|
||||
$self->qp->connection->remote_ip('');
|
||||
($err, $why) = $self->invalid_localhost('localhost' );
|
||||
ok( $err, "localhost, empty remote IP: $why");
|
||||
|
||||
$self->qp->connection->remote_ip('192.0.99.5');
|
||||
($err, $why) = $self->invalid_localhost('localhost');
|
||||
ok( $err, "localhost, invalid remote IP: $why");
|
||||
|
||||
$self->qp->connection->remote_ip('127.0.0.1');
|
||||
($err, $why) = $self->invalid_localhost('localhost');
|
||||
ok( ! $err, "localhost, correct remote IP");
|
||||
};
|
||||
|
||||
sub test_is_plain_ip {
|
||||
my $self = shift;
|
||||
|
||||
my ($err, $why) = $self->is_plain_ip('0.0.0.0');
|
||||
ok( $err, "plain IP, $why");
|
||||
|
||||
($err, $why) = $self->is_plain_ip('255.255.255.255');
|
||||
ok( $err, "plain IP, $why");
|
||||
|
||||
($err, $why) = $self->is_plain_ip('[255.255.255.255]');
|
||||
ok( ! $err, "address literal");
|
||||
};
|
||||
|
||||
sub test_is_address_literal {
|
||||
my $self = shift;
|
||||
|
||||
my ($err, $why) = $self->is_address_literal('[0.0.0.0]');
|
||||
ok( $err, "plain IP, $why");
|
||||
|
||||
($err, $why) = $self->is_address_literal('[255.255.255.255]');
|
||||
ok( $err, "plain IP, $why");
|
||||
|
||||
($err, $why) = $self->is_address_literal('255.255.255.255');
|
||||
ok( ! $err, "address literal");
|
||||
};
|
||||
|
||||
sub test_no_forward_dns {
|
||||
my $self = shift;
|
||||
|
||||
my ($err, $why) = $self->no_forward_dns('perl.org');
|
||||
ok( ! $err, "perl.org");
|
||||
|
||||
# reserved .test TLD: http://tools.ietf.org/html/rfc2606
|
||||
($err, $why) = $self->no_forward_dns('perl.org.test');
|
||||
ok( $err, "test.perl.org.test");
|
||||
};
|
||||
|
||||
sub test_no_reverse_dns {
|
||||
my $self = shift;
|
||||
|
||||
my ($err, $why) = $self->no_reverse_dns('test-host', '192.0.2.0');
|
||||
ok( $err, "192.0.2.0, $why");
|
||||
|
||||
($err, $why) = $self->no_reverse_dns('test-host', '192.0.2.1');
|
||||
ok( $err, "192.0.2.1, $why");
|
||||
|
||||
($err, $why) = $self->no_reverse_dns('mail.theartfarm.com', '208.75.177.101');
|
||||
ok( ! $err, "208.75.177.101");
|
||||
};
|
||||
|
||||
sub test_no_matching_dns {
|
||||
my $self = shift;
|
||||
|
||||
$self->qp->connection->notes('helo_forward_match', undef);
|
||||
$self->qp->connection->notes('helo_reverse_match', undef);
|
||||
|
||||
my ($err, $why) = $self->no_matching_dns('matt.test');
|
||||
ok( $err, "fail, $why");
|
||||
|
||||
$self->qp->connection->notes('helo_forward_match', 1);
|
||||
($err, $why) = $self->no_matching_dns('matt.test');
|
||||
ok( ! $err, "pass");
|
||||
};
|
||||
|
||||
sub test_check_ip_match {
|
||||
my $self = shift;
|
||||
|
||||
$self->qp->connection->remote_ip('192.0.2.1');
|
||||
|
||||
$self->connection->notes('helo_forward_match', 0);
|
||||
$self->check_ip_match('192.0.2.1');
|
||||
ok( $self->connection->notes('helo_forward_match'), "exact";
|
||||
|
||||
$self->connection->notes('helo_forward_match', 0);
|
||||
$self->check_ip_match('192.0.2.2');
|
||||
ok( $self->connection->notes('helo_forward_match'), "network";
|
||||
|
||||
$self->connection->notes('helo_forward_match', 0);
|
||||
$self->check_ip_match('192.0.1.1');
|
||||
ok( ! $self->connection->notes('helo_forward_match'), "miss";
|
||||
};
|
||||
|
||||
sub test_check_name_match {
|
||||
my $self = shift;
|
||||
|
||||
$self->connection->notes('helo_reverse_match', 0);
|
||||
$self->check_name_match('mx0.example.com', 'mx0.example.com');
|
||||
ok( $self->connection->notes('helo_reverse_match'), "exact");
|
||||
|
||||
$self->connection->notes('helo_reverse_match', 0);
|
||||
$self->check_name_match('mx0.example.com', 'mx1.example.com');
|
||||
ok( $self->connection->notes('helo_reverse_match'), "domain");
|
||||
|
||||
$self->connection->notes('helo_reverse_match', 0);
|
||||
$self->check_name_match('mx0.example.com', 'mx0.example.net');
|
||||
ok( ! $self->connection->notes('helo_reverse_match'), "domain");
|
||||
};
|
||||
|
||||
Loading…
Reference in New Issue
Block a user