filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Anti-SPAM DMARC, HELO, IP and RBL scripts

Browse Source
This commit is contained in:
mdecimus
2023-10-06 16:53:50 +02:00
parent 7824368cf3
commit 4ae0ede9ee
58 changed files with 1995 additions and 5119 deletions
Download Patch File Download Diff File Expand all files Collapse all files

151
tests/resources/smtp/antispam/dmarc.test Normal file
View File

@@ -0,0 +1,151 @@
expect DMARC_NA R_SPF_NA R_DKIM_NA ARC_NA
Subject: test
Test
<!-- NEXT TEST -->
spf.result pass
dkim.result pass
arc.result pass
dmarc.result pass
expect DKIM_SIGNED ARC_SIGNED R_DKIM_ALLOW R_SPF_ALLOW ARC_ALLOW DMARC_POLICY_ALLOW
DKIM-Signature: abc
ARC-Seal: xyz
Subject: test
Test
<!-- NEXT TEST -->
spf.result fail
dkim.result fail
arc.result fail
dmarc.result fail
dmarc.policy quarantine
expect R_SPF_FAIL ARC_REJECT R_DKIM_REJECT DMARC_POLICY_QUARANTINE
Subject: test
Test
<!-- NEXT TEST -->
spf.result neutral
dkim.result temperror
arc.result permerror
dmarc.result fail
dmarc.policy reject
expect R_DKIM_TEMPFAIL R_SPF_NEUTRAL ARC_INVALID DMARC_POLICY_REJECT
Subject: test
Test
<!-- NEXT TEST -->
spf.result softfail
dkim.result permerror
arc.result temperror
dmarc.result permerror
expect ARC_DNSFAIL DMARC_BAD_POLICY R_DKIM_PERMFAIL R_SPF_SOFTFAIL
Subject: test
Test
<!-- NEXT TEST -->
dmarc.result pass
dkim.result pass
spf.result pass
expect ALLOWLIST_DMARC DMARC_POLICY_ALLOW R_DKIM_ALLOW R_SPF_ALLOW ARC_NA
From: user@dmarc-allow.org
Subject: test
Test
<!-- NEXT TEST -->
dmarc.result fail
dkim.result fail
spf.result fail
expect BLOCKLIST_DMARC DMARC_POLICY_SOFTFAIL R_DKIM_REJECT R_SPF_FAIL ARC_NA
From: user@dmarc-allow.org
Subject: test
Test
<!-- NEXT TEST -->
dkim.result pass
dkim.domains spf-dkim-allow.org
spf.result pass
expect ALLOWLIST_SPF_DKIM R_DKIM_ALLOW R_SPF_ALLOW ARC_NA DMARC_NA
From: user@spf-dkim-allow.org
Subject: test
Test
<!-- NEXT TEST -->
dkim.result pass
spf.result pass
arc.result pass
expect ALLOWLIST_SPF_DKIM R_DKIM_ALLOW R_SPF_ALLOW ARC_ALLOW DMARC_NA
From: user@spf-dkim-allow.org
Subject: test
Test
<!-- NEXT TEST -->
spf.result pass
dkim.result fail
expect ALLOWLIST_SPF BLOCKLIST_DKIM R_DKIM_REJECT R_SPF_ALLOW ARC_NA DMARC_NA
From: user@spf-dkim-allow.org
Subject: test
Test
<!-- NEXT TEST -->
spf.result pass
dkim.result temperror
expect ALLOWLIST_SPF R_DKIM_TEMPFAIL R_SPF_ALLOW ARC_NA DMARC_NA
From: user@spf-dkim-allow.org
Subject: test
Test
<!-- NEXT TEST -->
dkim.result pass
dkim.domains spf-dkim-allow.org
spf.result fail
expect BLOCKLIST_SPF ALLOWLIST_DKIM R_DKIM_ALLOW R_SPF_FAIL ARC_NA DMARC_NA
From: user@spf-dkim-allow.org
Subject: test
Test
<!-- NEXT TEST -->
dkim.result pass
dkim.domains spf-dkim-allow.org
spf.result temperror
expect ALLOWLIST_DKIM R_DKIM_ALLOW R_SPF_DNSFAIL ARC_NA DMARC_NA
From: user@spf-dkim-allow.org
Subject: test
Test
<!-- NEXT TEST -->
dkim.result fail
spf.result fail
expect BLOCKLIST_SPF_DKIM R_DKIM_REJECT R_SPF_FAIL ARC_NA DMARC_NA
From: user@spf-dkim-allow.org
Subject: test
Test
<!-- NEXT TEST -->
dkim.result temperror
spf.result temperror
expect R_DKIM_TEMPFAIL R_SPF_DNSFAIL ARC_NA DMARC_NA
From: user@spf-dkim-allow.org
Subject: test
Test

43
tests/resources/smtp/antispam/from.test
View File

@@ -1,14 +1,14 @@
expect MISSING_FROM
X-From: hello@world.com
X-From: hello@domain.org
Test
<!-- NEXT TEST -->
envelope_from hello@world.com
envelope_from hello@domain.org
expect MULTIPLE_FROM FROM_EQ_ENVFROM FROM_NO_DN
From: hello@world.com
From: hello@world.com
From: hello@domain.org
From: hello@domain.org
Test
<!-- NEXT TEST -->
@@ -19,52 +19,52 @@ From: test
Test
<!-- NEXT TEST -->
envelope_from www-data@domain.com
envelope_from www-data@domain.org
expect FROM_SERVICE_ACCT ENVFROM_SERVICE_ACCT FROM_HAS_DN FROM_EQ_ENVFROM
From: "WWW DATA" <www-data@domain.com>
From: "WWW DATA" <www-data@domain.org>
Test
<!-- NEXT TEST -->
envelope_from hello@world.com
envelope_from hello@domain.org
expect FROM_DN_EQ_ADDR FROM_EQ_ENVFROM
From: "hello@world.com" <hello@world.com>
From: "hello@domain.org" <hello@domain.org>
Test
<!-- NEXT TEST -->
envelope_from hello@world.com
envelope_from hello@domain.org
expect SPOOF_DISPLAY_NAME FROM_EQ_ENVFROM FROM_HAS_DN
From: "hello@otherworld.com" <hello@world.com>
From: "hello@otherdomain.org" <hello@domain.org>
Test
<!-- NEXT TEST -->
envelope_from hello@world.co.uk
envelope_from hello@domain.co.uk
expect FROM_NEQ_DISPLAY_NAME FROM_EQ_ENVFROM FROM_HAS_DN
From: "hello@other.world.co.uk" <hello@world.co.uk>
From: "hello@other.domain.co.uk" <hello@domain.co.uk>
Test
<!-- NEXT TEST -->
helo_domain mx.world.co.uk
helo_domain mx.domain.co.uk
expect FROM_EQ_ENVFROM FROM_NEQ_DISPLAY_NAME FROM_HAS_DN HFILTER_FROM_BOUNCE
From: "postmaster@mx.world.co.uk" <postmaster@world.co.uk>
From: "postmaster@mx.domain.co.uk" <postmaster@domain.co.uk>
Test
<!-- NEXT TEST -->
helo_domain mx.world.co.uk
helo_domain mx.domain.co.uk
expect FROM_EQ_ENVFROM FROM_HAS_DN HFILTER_FROM_BOUNCE
From: "Mailer Daemon" <MAILER-DAEMON@world.co.uk>
From: "Mailer Daemon" <MAILER-DAEMON@domain.co.uk>
Test
<!-- NEXT TEST -->
envelope_from mrspammer@domain.com
envelope_from mrspammer@domain.org
expect FROM_NAME_HAS_TITLE FROM_NAME_EXCESS_SPACE FROM_EQ_ENVFROM FROM_HAS_DN
From: "Mr. Money Maker" <mrspammer@domain.com>
From: "Mr. Money Maker" <mrspammer@domain.org>
Test
<!-- NEXT TEST -->
@@ -172,3 +172,10 @@ expect DISPOSABLE_ENVFROM DISPOSABLE_FROM FROM_EQ_ENVFROM FROM_NO_DN
From: hello@custom.disposable.org
Test
<!-- NEXT TEST -->
envelope_from hello@nomx.org
expect HFILTER_FROMHOST_NORES_A_OR_MX FROM_EQ_ENVFROM FROM_NO_DN
From: hello@nomx.org
Test

21
tests/resources/smtp/antispam/headers.test
View File

@@ -56,3 +56,24 @@ expect HEADER_EMPTY_DELIMITER
Subject:test
Test
<!-- NEXT TEST -->
expect MAILLIST
List-Archive: 1
List-Owner: 1
List-Help: 1
List-Post: 1
X-Loop: 1
List-Id: 1
Subject: test
Test
<!-- NEXT TEST -->
expect MAILLIST HAS_LIST_UNSUB
List-Id: 1
List-Subscribe: 1
List-Unsubscribe: 1
Subject: test
Test

65
tests/resources/smtp/antispam/helo.test Normal file
View File

@@ -0,0 +1,65 @@
helo_domain localhost
expect HFILTER_HELO_NOT_FQDN
Subject: test
test
<!-- NEXT TEST -->
helo_domain user
expect RCVD_HELO_USER HFILTER_HELO_NOT_FQDN
Subject: test
test
<!-- NEXT TEST -->
helo_domain 8.8.8.8
remote_ip 8.8.8.8
expect HFILTER_HELO_BAREIP
Subject: test
test
<!-- NEXT TEST -->
helo_domain 8.8.8.8
remote_ip 1.1.1.1
expect HFILTER_HELO_IP_A HFILTER_HELO_BAREIP
Subject: test
test
<!-- NEXT TEST -->
helo_domain domain.org
iprev.ptr domain.org
remote_ip 1.1.1.1
expect
Subject: test
test
<!-- NEXT TEST -->
helo_domain domain.org
iprev.ptr otherdomain.org
remote_ip 1.1.1.1
expect HFILTER_HOSTNAME_UNKNOWN
Subject: test
test
<!-- NEXT TEST -->
helo_domain otherdomain.org
iprev.ptr otherdomain.org
remote_ip 1.1.1.1
expect HFILTER_HELO_NORES_A_OR_MX
Subject: test
test
<!-- NEXT TEST -->
helo_domain otherdomain.org
iprev.ptr otherdomain.net
remote_ip 1.1.1.1
expect HFILTER_HELO_NORES_A_OR_MX HFILTER_HOSTNAME_UNKNOWN
Subject: test
test

17
tests/resources/smtp/antispam/ip.test Normal file
View File

@@ -0,0 +1,17 @@
remote_ip 8.8.8.8
iprev.result temperror
expect RDNS_DNSFAIL
Subject: test
Test
<!-- NEXT TEST -->
remote_ip 8.8.8.8
iprev.result fail
expect RDNS_NONE
Subject: test
Test

143
tests/resources/smtp/antispam/mime.test
View File

@@ -352,3 +352,146 @@ Content-Transfer-Encoding: 7bit
this is a test
--boundary--
<!-- NEXT TEST -->
expect R_MIXED_CHARSET
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
Tést 孔子
<!-- NEXT TEST -->
expect MIME_BAD_EXTENSION MIME_GOOD HAS_ATTACHMENT
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="boundary"
--boundary
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
simple text
--boundary
Content-Type: text/html; charset="utf-8"
Content-Disposition: attachment; filename="test.html"
Content-Transfer-Encoding: 8bit
<html>
<p>hello world</p>
</html>
--boundary--
<!-- NEXT TEST -->
expect MIME_BAD_ATTACHMENT HAS_ATTACHMENT
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="boundary"
--boundary
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
simple text
--boundary
Content-Type: text/x-plain; charset="utf-8"
Content-Disposition: attachment; filename="test.txt"
Content-Transfer-Encoding: 8bit
hello world
--boundary--
<!-- NEXT TEST -->
expect HAS_ATTACHMENT
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="boundary"
--boundary
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
simple text
--boundary
Content-Type: text/plain; charset="utf-8"
Content-Disposition: attachment; filename="test.txt"
Content-Transfer-Encoding: 8bit
hello world
--boundary--
<!-- NEXT TEST -->
expect MIME_DOUBLE_BAD_EXTENSION MIME_GOOD HAS_ATTACHMENT
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="boundary"
--boundary
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
simple text
--boundary
Content-Type: text/html; charset="utf-8"
Content-Disposition: attachment; filename="test.html.html"
Content-Transfer-Encoding: 8bit
<html>
<p>hello world</p>
</html>
--boundary--
<!-- NEXT TEST -->
expect MIME_ARCHIVE_IN_ARCHIVE MIME_GOOD HAS_ATTACHMENT
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="boundary"
--boundary
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
simple text
--boundary
Content-Type: application/zip
Content-Disposition: attachment; filename="test.zip.zip"
Content-Transfer-Encoding: base64
UEsDBAoAAAAAALN6RlcAAAAAAAAAAAAAAAAIABwAdGVzdC5iaW5VVAkAA+IJI
GXiCSBldXgLAAEE9QEAAAQUAAAAUEsBAh4DCgAAAAAAs3pGVwAAAAAAAAAAAA
AAAAgAGAAAAAAAAAAAAKSBAAAAAHRlc3QuYmluVVQFAAPiCSBldXgLAAEE9QE
AAAQUAAAAUEsFBgAAAAABAAEATgAAAEIAAAAAAA==
--boundary--
<!-- NEXT TEST -->
expect MIME_BAD HAS_ATTACHMENT
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="boundary"
--boundary
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
simple text
--boundary
Content-Type: image/png
Content-Disposition: attachment; filename="test.png"
Content-Transfer-Encoding: base64
UEsDBAoAAAAAALN6RlcAAAAAAAAAAAAAAAAIABwAdGVzdC5iaW5VVAkAA+IJI
GXiCSBldXgLAAEE9QEAAAQUAAAAUEsBAh4DCgAAAAAAs3pGVwAAAAAAAAAAAA
AAAAgAGAAAAAAAAAAAAKSBAAAAAHRlc3QuYmluVVQFAAPiCSBldXgLAAEE9QE
AAAQUAAAAUEsFBgAAAAABAAEATgAAAEIAAAAAAA==
--boundary--

30
tests/resources/smtp/antispam/rbl.test Normal file
View File

@@ -0,0 +1,30 @@
remote_ip 192.168.0.1
expect RCVD_IN_DNSWL_LOW RBL_SPAMHAUS
Subject: test
test
<!-- NEXT TEST -->
remote_ip 192.168.0.2
expect RBL_SENDERSCORE RBL_NIXSPAM RBL_SEM RBL_SPAMHAUS_SBL RBL_BARRACUDA RBL_BLOCKLISTDE RBL_VIRUSFREE_BOTNET RBL_SPAMCOP RCVD_IN_DNSWL_MED
Subject: test
test
<!-- NEXT TEST -->
remote_ip 192.168.0.14
expect RWL_MAILSPIKE_NEUTRAL RECEIVED_SPAMHAUS_SBL RBL_SPAMHAUS RECEIVED_SPAMHAUS_XBL RECEIVED_BLOCKLISTDE RCVD_IN_DNSWL_MED
Received: from Agni (localhost [192.168.0.5]) (TLS: TLSv1/SSLv3, 168bits,DES-CBC3-SHA) by agni.forevermore.net
with esmtp; Mon, 28 Oct 2002 14:48:52 -0800
Received: from [192.168.0.14] (79.sub-174-252-72.myvzw.com [192.168.0.8]) by mx.google.com
with ESMTPS id m16sm345129qck.28.2011.06.15.07.42.02 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 15 Jun 2011 07:42:08 -0700 (PDT)
Received: from user (192.168.0.2) by DB6PR07MB3384.eurprd07.prod.outlook.com ([192.168.0.2])
with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1143.11; Thu, 13 Sep 2018 14:47:44 +0000
Subject: test
test

42
tests/resources/smtp/antispam/received.test
View File

@@ -29,39 +29,10 @@ Received: from BAY0-HMR08.bay0.hótmail.com (bay0-hmr08.bay0.hótmail.com [65.54
with ESMTP id h2DBpvs24047 for <webmaster@efi.ie>; Thu, 13 Mar 2003 11:51:57 GMT
test
<!-- NEXT TEST -->
helo_domain user
expect RCVD_HELO_USER RCVD_COUNT_ZERO RCVD_NO_TLS_LAST
Subject: test
test
<!-- NEXT TEST -->
helo_domain 100.21.30.40
expect RCVD_IP_SPAM RCVD_COUNT_ZERO RCVD_NO_TLS_LAST
Subject: test
test
<!-- NEXT TEST -->
iprev.ptr host.otherdomain.com
helo_domain HOST.DOMAIN.COM
expect RCVD_HELO_IP_MISMATCH RCVD_COUNT_ZERO RCVD_NO_TLS_LAST
Subject: test
test
<!-- NEXT TEST -->
iprev.ptr host.domain.com
helo_domain HOST.DOMAIN.COM
expect RCVD_COUNT_ZERO RCVD_NO_TLS_LAST
Subject: test
test
<!-- NEXT TEST -->
tls.version TLVv1.3
expect RCVD_TLS_ALL RCVD_HELO_USER RCVD_IP_SPAM FORGED_RCVD_TRAIL PREVIOUSLY_DELIVERED RCVD_COUNT_FIVE
expect RCVD_TLS_ALL RCVD_HELO_USER RCVD_DOUBLE_IP_SPAM FORGED_RCVD_TRAIL PREVIOUSLY_DELIVERED RCVD_COUNT_FIVE
Received: from Agni (localhost [::ffff:127.0.0.1]) (TLS: TLSv1/SSLv3, 168bits,DES-CBC3-SHA) by agni.forevermore.net
with esmtp; Mon, 28 Oct 2002 14:48:52 -0800
@@ -69,9 +40,18 @@ Received: from [10.231.252.223] (79.sub-174-252-72.myvzw.com [174.252.72.79]) by
with ESMTPS id m16sm345129qck.28.2011.06.15.07.42.02 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 15 Jun 2011 07:42:08 -0700 (PDT)
Received: from user (10.175.233.33) by DB6PR07MB3384.eurprd07.prod.outlook.com (10.175.234.11)
with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1143.11; Thu, 13 Sep 2018 14:47:44 +0000
Received: from wmail.tana.it (wmail.tana.it [94.198.96.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested)
Received: from [94.198.96.74] (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested)
by ietfa.amsl.com (Postfix) with ESMTPS id 10B7AC151535 for <user@domain.com>; Mon, 28 Aug 2023 02:21:23 -0700 (PDT)
To: user@domain.com
Subject: test
test
<!-- NEXT TEST -->
expect DIRECT_TO_MX ONCE_RECEIVED RCVD_COUNT_ZERO RCVD_NO_TLS_LAST
To: user@domain.com
X-Mailer: MUA
Subject: test
test

2
tests/resources/smtp/antispam/subject.test
View File

@@ -4,7 +4,7 @@ Subject: HELLO WORLD
Test
<!-- NEXT TEST -->
expect SUBJ_VERY_LONG
expect LONG_SUBJ
Subject: this is an extremely long subject line that
should be truncated to 80 characters and folded

17
tests/resources/smtp/antispam/url.test
View File

@@ -16,13 +16,13 @@ Subject: test
my site is https://192.168.1.1
<!-- NEXT TEST -->
expect CONFUSABLE_URL
expect OMOGRAPH_URL
Subject: test
my site is https://xn--youtue-tg7b.com
<!-- NEXT TEST -->
expect R_MIXED_CHARSET_URL CONFUSABLE_URL
expect R_MIXED_CHARSET_URL
Subject: test
@@ -40,9 +40,9 @@ Subject: nested redirect
login to https://redirect.com/?https://redirect.org/?https://redirect.net/?https://redirect.io/?https://redirect.me/?https://redirect.com
<!-- NEXT TEST -->
expect REDIRECTOR_URL CONFUSABLE_URL
expect REDIRECTOR_URL OMOGRAPH_URL
Subject: redirect to confusable
Subject: redirect to omograph
login to https://www.redirect.com/?https://xn--twiter-507b.com
<!-- NEXT TEST -->
@@ -73,9 +73,12 @@ Subject: plain test
http://url.com/Well-known/../assetlinks.json
http://wp.com/WP-content/content.pdf
<!-- NEXT TEST -->
expect REDIRECTOR_URL
expect PHISHED_OPENPHISH PHISHED_PHISHTANK
Subject: test
Subject: plain test
https://phishing-open.org
https://phishing-tank.com
go to my site https://tinyurl.com/4fbkcb6m

3
tests/resources/smtp/lists/disposable-domains.txt
View File

@@ -1,3 +0,0 @@
# Disposable domains
guerrillamail.com
*.disposable.org

5
tests/resources/smtp/lists/free-domains.txt
View File

@@ -1,5 +0,0 @@
# Free domains
gmail.com
googlemail.com
yahoomail.com
*.freemail.org

8
tests/resources/smtp/lists/redirectors.txt
View File

@@ -1,8 +0,0 @@
bit.ly
redirect.io
redirect.me
redirect.org
redirect.com
redirect.net
t.ly
tinyurl.com