inbound-antispam-panel: inbound journal milter on port 25
Step 3/12 of docs/plans/inbound-antispam-panel.md. The panel serves a second milter while the inbound relay is on (internal/milter/inbound.go, socket INBOUND_JOURNAL_MILTER_SOCKET, default /run/selfpost/inbound-journal.sock). build/postfix-config.sh puts it last on port 25, after the optional antispam milter, with default_action=accept; postfix-wrapper.sh waits for its socket. At end-of-message it writes one inbound_spam_log row per recipient at an inbound domain - other port-25 recipients (DMARC report addresses) get none - and always accepts. With a filter attached it reads the verdict from X-Rspamd-Action and X-Spamd-Result (action, score, up to six weighted symbols, only what the patterns recognise, 255 bytes); without one those headers are the sender's and are not read. The plan named X-Rspamd-Score, which rspamd does not have. The antispam compose fragment mounts rspamd/milter_headers.conf into the sidecar so that it adds the two headers (checked in rspamd 3.11: both routines exist and remove a sender's own headers of those names). Store: InsertInboundSpam, IsInboundDomain. Checked on the test server, uncommitted tree: go vet ./... ok, go test ./... ok (22 packages), make e2e ok - the relayed message of inbound_relay_delivers_and_refuses has its journal row (accept by selfpost) and the DMARC report sent through the same listener has none. Not yet seen in a real run: a verdict written by rspamd reaching this milter. The e2e stand has no filter, and the test server's only inbound domain has no upstream, so it accepts no mail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,229 @@
|
||||
package milter
|
||||
|
||||
import (
|
||||
"context"
|
||||
"log"
|
||||
"net"
|
||||
"net/textproto"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/emersion/go-milter"
|
||||
|
||||
"github.com/mixeme/selfpost/internal/mailhdr"
|
||||
"github.com/mixeme/selfpost/internal/store"
|
||||
)
|
||||
|
||||
// InboundStore is what the inbound journal milter needs: the journal itself
|
||||
// and the list of inbound domains, since port 25 also takes mail that is not
|
||||
// the relay's. *store.Store satisfies it; tests substitute a fake.
|
||||
type InboundStore interface {
|
||||
InsertInboundSpam(e store.InboundSpamEntry) error
|
||||
IsInboundDomain(name string) (bool, error)
|
||||
}
|
||||
|
||||
// inboundSession is the inbound journal milter: the last milter on port 25,
|
||||
// after the optional external filter. It writes one journal row per recipient
|
||||
// of a message that reached end-of-message - that is, one the filter did not
|
||||
// refuse; refusals never get this far and are read from mail.log instead.
|
||||
//
|
||||
// Like the send-log milter it only watches: every callback continues or
|
||||
// accepts, and Postfix attaches the socket with default_action=accept, so
|
||||
// neither an error here nor the panel being down holds up inbound mail.
|
||||
type inboundSession struct {
|
||||
milter.NoOpMilter
|
||||
rec InboundStore
|
||||
// filter says whether an external filter is attached in front of this
|
||||
// milter. Without one the verdict headers below can only have been written
|
||||
// by the sender, and are not read.
|
||||
filter bool
|
||||
|
||||
clientIP string // once per connection
|
||||
|
||||
from string
|
||||
rcpts []string
|
||||
subject string
|
||||
action string // X-Rspamd-Action
|
||||
result string // X-Spamd-Result
|
||||
seen bool // any verdict header of the filter
|
||||
}
|
||||
|
||||
func (s *inboundSession) Connect(host, family string, port uint16, addr net.IP, m *milter.Modifier) (milter.Response, error) {
|
||||
if addr != nil {
|
||||
s.clientIP = addr.String()
|
||||
}
|
||||
return milter.RespContinue, nil
|
||||
}
|
||||
|
||||
// MailFrom starts a message: a connection may carry several.
|
||||
func (s *inboundSession) MailFrom(from string, m *milter.Modifier) (milter.Response, error) {
|
||||
s.reset()
|
||||
s.from = cleanAddress(from)
|
||||
return milter.RespContinue, nil
|
||||
}
|
||||
|
||||
func (s *inboundSession) RcptTo(rcpt string, m *milter.Modifier) (milter.Response, error) {
|
||||
s.rcpts = append(s.rcpts, cleanAddress(rcpt))
|
||||
return milter.RespContinue, nil
|
||||
}
|
||||
|
||||
// Header keeps the first Subject and the filter's verdict. Postfix hands the
|
||||
// message to its milters one after another at end-of-message, each seeing what
|
||||
// the one before added, which is how the filter's headers arrive here. The
|
||||
// filter replaces headers of these names, so the last one read is its own.
|
||||
func (s *inboundSession) Header(name, value string, m *milter.Modifier) (milter.Response, error) {
|
||||
switch textproto.CanonicalMIMEHeaderKey(name) {
|
||||
case "Subject":
|
||||
if s.subject == "" {
|
||||
s.subject = mailhdr.DecodeSubject(value)
|
||||
}
|
||||
case "X-Rspamd-Action":
|
||||
if s.filter {
|
||||
s.action, s.seen = value, true
|
||||
}
|
||||
case "X-Spamd-Result":
|
||||
if s.filter {
|
||||
s.result, s.seen = value, true
|
||||
}
|
||||
}
|
||||
return milter.RespContinue, nil
|
||||
}
|
||||
|
||||
// Body fires at end-of-message: the message is about to be queued for its
|
||||
// upstream.
|
||||
func (s *inboundSession) Body(m *milter.Modifier) (milter.Response, error) {
|
||||
s.record()
|
||||
s.reset()
|
||||
return milter.RespAccept, nil
|
||||
}
|
||||
|
||||
func (s *inboundSession) Abort(m *milter.Modifier) error {
|
||||
s.reset()
|
||||
return nil
|
||||
}
|
||||
|
||||
func (s *inboundSession) reset() {
|
||||
s.from, s.rcpts, s.subject = "", nil, ""
|
||||
s.action, s.result, s.seen = "", "", false
|
||||
}
|
||||
|
||||
// record writes one row per recipient at an inbound domain. Other recipients
|
||||
// of port 25 (a DMARC report address at the server's own name) are not the
|
||||
// relay's mail and get no row. Failures are logged, never propagated.
|
||||
func (s *inboundSession) record() {
|
||||
e := store.InboundSpamEntry{
|
||||
ClientIP: s.clientIP,
|
||||
From: s.from,
|
||||
Subject: s.subject,
|
||||
Decision: store.SpamDecisionAccept,
|
||||
Engine: store.SpamEngineSelfPost,
|
||||
}
|
||||
if s.seen {
|
||||
action, detail := rspamdVerdict(s.action, s.result)
|
||||
e.Engine, e.Detail = store.SpamEngineRspamd, detail
|
||||
if action == "quarantine" {
|
||||
e.Decision = store.SpamDecisionQuarantine
|
||||
}
|
||||
}
|
||||
for _, to := range s.rcpts {
|
||||
domain := domainOf(to)
|
||||
ok, err := s.rec.IsInboundDomain(domain)
|
||||
if err != nil {
|
||||
log.Printf("inbound-journal: look up %s: %v", domain, err)
|
||||
continue
|
||||
}
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
e.InboundDomain, e.To = domain, to
|
||||
if err := s.rec.InsertInboundSpam(e); err != nil {
|
||||
log.Printf("inbound-journal: record %s -> %s: %v", s.from, to, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// What the journal keeps of a verdict: enough to see why, on one table row.
|
||||
const (
|
||||
verdictMaxSymbols = 6
|
||||
verdictMaxBytes = 255
|
||||
)
|
||||
|
||||
var (
|
||||
// "default: False [7.20 / 15.00]" - the score and the reject threshold.
|
||||
rspamdScore = regexp.MustCompile(`\[(-?[0-9]+(?:\.[0-9]+)?) / (-?[0-9]+(?:\.[0-9]+)?)\]`)
|
||||
// "BAYES_SPAM(5.10)[100.00%]" - a symbol and its weight.
|
||||
rspamdSymbol = regexp.MustCompile(`([A-Z][A-Z0-9_]{1,63})\((-?[0-9]+(?:\.[0-9]+)?)\)`)
|
||||
)
|
||||
|
||||
// rspamdVerdict reduces the filter's headers to an action and a one-line
|
||||
// summary: the action, the score against the threshold, and the first few
|
||||
// symbols that carried weight. It reads only what it recognises - the headers
|
||||
// are the filter's when it is up, but the sender's own when it is not (it is
|
||||
// attached fail-open), so nothing of them is kept verbatim except through
|
||||
// these patterns.
|
||||
func rspamdVerdict(actionHeader, resultHeader string) (action, detail string) {
|
||||
action = strings.ToLower(strings.TrimSpace(actionHeader))
|
||||
for _, r := range action {
|
||||
if (r < 'a' || r > 'z') && r != ' ' {
|
||||
action = ""
|
||||
break
|
||||
}
|
||||
}
|
||||
if len(action) > 32 {
|
||||
action = ""
|
||||
}
|
||||
|
||||
var parts []string
|
||||
if action != "" {
|
||||
parts = append(parts, action)
|
||||
}
|
||||
if m := rspamdScore.FindStringSubmatch(resultHeader); m != nil {
|
||||
parts = append(parts, "score "+m[1]+" / "+m[2])
|
||||
}
|
||||
detail = strings.Join(parts, ", ")
|
||||
|
||||
var symbols []string
|
||||
for _, m := range rspamdSymbol.FindAllStringSubmatch(resultHeader, -1) {
|
||||
if strings.Trim(m[2], "-0.") == "" { // weight zero: informational
|
||||
continue
|
||||
}
|
||||
symbols = append(symbols, m[1]+"("+m[2]+")")
|
||||
if len(symbols) == verdictMaxSymbols {
|
||||
break
|
||||
}
|
||||
}
|
||||
if len(symbols) > 0 {
|
||||
if detail != "" {
|
||||
detail += "; "
|
||||
}
|
||||
detail += strings.Join(symbols, " ")
|
||||
}
|
||||
if len(detail) > verdictMaxBytes {
|
||||
detail = detail[:verdictMaxBytes]
|
||||
}
|
||||
return action, detail
|
||||
}
|
||||
|
||||
// ServeInbound runs the inbound journal milter on ln until ctx is cancelled.
|
||||
// filter says whether an external filter is attached in front of it
|
||||
// (INBOUND_ANTISPAM_MILTER). It returns nil on a clean shutdown.
|
||||
func ServeInbound(ctx context.Context, ln net.Listener, rec InboundStore, filter bool) error {
|
||||
srv := &milter.Server{
|
||||
NewMilter: func() milter.Milter { return &inboundSession{rec: rec, filter: filter} },
|
||||
Actions: 0, // read-only
|
||||
Protocol: milter.OptNoBody, // headers and end-of-message, not the body
|
||||
}
|
||||
|
||||
go func() {
|
||||
<-ctx.Done()
|
||||
_ = srv.Close()
|
||||
}()
|
||||
|
||||
if err := srv.Serve(ln); err != nil {
|
||||
if ctx.Err() != nil {
|
||||
return nil
|
||||
}
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@@ -0,0 +1,224 @@
|
||||
package milter
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/emersion/go-milter"
|
||||
|
||||
"github.com/mixeme/selfpost/internal/store"
|
||||
)
|
||||
|
||||
// fakeInbound is the journal and the inbound-domain list of one test.
|
||||
type fakeInbound struct {
|
||||
domains map[string]bool
|
||||
rows []store.InboundSpamEntry
|
||||
insertErr error
|
||||
lookupErr error
|
||||
}
|
||||
|
||||
func (f *fakeInbound) InsertInboundSpam(e store.InboundSpamEntry) error {
|
||||
if f.insertErr != nil {
|
||||
return f.insertErr
|
||||
}
|
||||
f.rows = append(f.rows, e)
|
||||
return nil
|
||||
}
|
||||
|
||||
func (f *fakeInbound) IsInboundDomain(name string) (bool, error) {
|
||||
if f.lookupErr != nil {
|
||||
return false, f.lookupErr
|
||||
}
|
||||
return f.domains[name], nil
|
||||
}
|
||||
|
||||
// A header of the kind the documented rspamd sidecar adds.
|
||||
const spamdResult = "default: False [7.20 / 15.00];\n\tBAYES_SPAM(5.10)[100.00%];\n\tMIME_GOOD(-0.10)[text/plain];\n\tARC_NA(0.00)[];\n\tRCVD_COUNT_ZERO(0.00)[0];\n\tR_DKIM_NA(2.20)[]"
|
||||
|
||||
// message replays one message through s: envelope, headers in order, end.
|
||||
func message(t *testing.T, s *inboundSession, from string, rcpts []string, headers [][2]string) milter.Response {
|
||||
t.Helper()
|
||||
if _, err := s.MailFrom(from, mods(nil)); err != nil {
|
||||
t.Fatalf("MailFrom: %v", err)
|
||||
}
|
||||
for _, r := range rcpts {
|
||||
if _, err := s.RcptTo(r, mods(nil)); err != nil {
|
||||
t.Fatalf("RcptTo: %v", err)
|
||||
}
|
||||
}
|
||||
for _, h := range headers {
|
||||
if _, err := s.Header(h[0], h[1], mods(nil)); err != nil {
|
||||
t.Fatalf("Header: %v", err)
|
||||
}
|
||||
}
|
||||
resp, err := s.Body(mods(map[string]string{"i": "ABC123"}))
|
||||
if err != nil {
|
||||
t.Fatalf("Body: %v", err)
|
||||
}
|
||||
return resp
|
||||
}
|
||||
|
||||
func inboundSessionFor(t *testing.T, rec InboundStore, filter bool) *inboundSession {
|
||||
t.Helper()
|
||||
s := &inboundSession{rec: rec, filter: filter}
|
||||
if _, err := s.Connect("mx.example.net", "tcp4", 0, net.ParseIP("203.0.113.7"), mods(nil)); err != nil {
|
||||
t.Fatalf("Connect: %v", err)
|
||||
}
|
||||
return s
|
||||
}
|
||||
|
||||
// With no filter attached an accepted message is a plain row, one per
|
||||
// recipient, decided by nobody.
|
||||
func TestInboundRecordsAcceptedMessage(t *testing.T) {
|
||||
rec := &fakeInbound{domains: map[string]bool{"in.example.com": true}}
|
||||
s := inboundSessionFor(t, rec, false)
|
||||
resp := message(t, s, "<sender@example.net> SIZE=1200",
|
||||
[]string{"<a@in.example.com>", "b@IN.example.com"},
|
||||
[][2]string{{"Subject", "=?utf-8?Q?Sch=C3=B6n?="}})
|
||||
if resp != milter.RespAccept {
|
||||
t.Errorf("end-of-message response = %v, want accept", resp)
|
||||
}
|
||||
if len(rec.rows) != 2 {
|
||||
t.Fatalf("rows = %+v, want one per recipient", rec.rows)
|
||||
}
|
||||
want := store.InboundSpamEntry{
|
||||
InboundDomain: "in.example.com", ClientIP: "203.0.113.7",
|
||||
From: "sender@example.net", To: "a@in.example.com", Subject: "Schön",
|
||||
Decision: store.SpamDecisionAccept, Engine: store.SpamEngineSelfPost,
|
||||
}
|
||||
if rec.rows[0] != want {
|
||||
t.Errorf("row = %+v\nwant %+v", rec.rows[0], want)
|
||||
}
|
||||
if rec.rows[1].To != "b@IN.example.com" || rec.rows[1].InboundDomain != "in.example.com" {
|
||||
t.Errorf("second row = %+v", rec.rows[1])
|
||||
}
|
||||
}
|
||||
|
||||
// Port 25 also takes DMARC reports for the server's own name. They are not
|
||||
// the relay's mail and the journal says nothing about them.
|
||||
func TestInboundSkipsRecipientsOutsideInboundDomains(t *testing.T) {
|
||||
rec := &fakeInbound{domains: map[string]bool{"in.example.com": true}}
|
||||
s := inboundSessionFor(t, rec, false)
|
||||
message(t, s, "noreply-dmarc@google.com",
|
||||
[]string{"dmarc-example.com@mail.example.org", "a@in.example.com"}, nil)
|
||||
if len(rec.rows) != 1 || rec.rows[0].To != "a@in.example.com" {
|
||||
t.Errorf("rows = %+v, want the inbound recipient alone", rec.rows)
|
||||
}
|
||||
}
|
||||
|
||||
// With the filter attached its verdict headers become the engine and detail.
|
||||
func TestInboundReadsTheFiltersVerdict(t *testing.T) {
|
||||
rec := &fakeInbound{domains: map[string]bool{"in.example.com": true}}
|
||||
s := inboundSessionFor(t, rec, true)
|
||||
message(t, s, "sender@example.net", []string{"a@in.example.com"}, [][2]string{
|
||||
{"Subject", "Cheap pills"},
|
||||
{"X-Rspamd-Action", "add header"},
|
||||
{"X-Spamd-Result", spamdResult},
|
||||
})
|
||||
if len(rec.rows) != 1 {
|
||||
t.Fatalf("rows = %+v", rec.rows)
|
||||
}
|
||||
got := rec.rows[0]
|
||||
if got.Engine != store.SpamEngineRspamd || got.Decision != store.SpamDecisionAccept {
|
||||
t.Errorf("engine %q, decision %q", got.Engine, got.Decision)
|
||||
}
|
||||
if want := "add header, score 7.20 / 15.00; BAYES_SPAM(5.10) MIME_GOOD(-0.10) R_DKIM_NA(2.20)"; got.Detail != want {
|
||||
t.Errorf("detail = %q\nwant %q", got.Detail, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInboundQuarantineAction(t *testing.T) {
|
||||
rec := &fakeInbound{domains: map[string]bool{"in.example.com": true}}
|
||||
s := inboundSessionFor(t, rec, true)
|
||||
message(t, s, "sender@example.net", []string{"a@in.example.com"},
|
||||
[][2]string{{"x-rspamd-action", "quarantine"}})
|
||||
if len(rec.rows) != 1 || rec.rows[0].Decision != store.SpamDecisionQuarantine || rec.rows[0].Detail != "quarantine" {
|
||||
t.Errorf("rows = %+v", rec.rows)
|
||||
}
|
||||
}
|
||||
|
||||
// Without a filter in front, a verdict header is the sender's own writing.
|
||||
func TestInboundIgnoresVerdictHeadersWithoutAFilter(t *testing.T) {
|
||||
rec := &fakeInbound{domains: map[string]bool{"in.example.com": true}}
|
||||
s := inboundSessionFor(t, rec, false)
|
||||
message(t, s, "sender@example.net", []string{"a@in.example.com"}, [][2]string{
|
||||
{"X-Rspamd-Action", "no action"},
|
||||
{"X-Spamd-Result", spamdResult},
|
||||
})
|
||||
if len(rec.rows) != 1 || rec.rows[0].Engine != store.SpamEngineSelfPost || rec.rows[0].Detail != "" {
|
||||
t.Errorf("rows = %+v", rec.rows)
|
||||
}
|
||||
}
|
||||
|
||||
// The filter is attached fail-open, so with it down the headers are again the
|
||||
// sender's: nothing of them reaches the journal except through the patterns.
|
||||
func TestRspamdVerdictKeepsOnlyWhatItRecognises(t *testing.T) {
|
||||
action, detail := rspamdVerdict("<script>alert(1)</script>", "default: False [1 / 15]; <b>HTML</b> lower_case(9.9) \x1b[31m")
|
||||
if action != "" {
|
||||
t.Errorf("action = %q, want it dropped", action)
|
||||
}
|
||||
if detail != "score 1 / 15" {
|
||||
t.Errorf("detail = %q", detail)
|
||||
}
|
||||
|
||||
var many strings.Builder
|
||||
for i := 0; i < 400; i++ {
|
||||
many.WriteString("SYMBOL_WITH_A_LONG_NAME_" + strings.Repeat("X", 30) + "(1.00)[];")
|
||||
}
|
||||
if _, detail := rspamdVerdict("reject", many.String()); len(detail) > verdictMaxBytes || strings.Count(detail, "(") > verdictMaxSymbols {
|
||||
t.Errorf("detail of %d bytes with %d symbols", len(detail), strings.Count(detail, "("))
|
||||
}
|
||||
if action, _ := rspamdVerdict(strings.Repeat("a", 33), ""); action != "" {
|
||||
t.Errorf("an action of 33 letters was kept")
|
||||
}
|
||||
}
|
||||
|
||||
// A second message on the same connection starts clean.
|
||||
func TestInboundResetsBetweenMessages(t *testing.T) {
|
||||
rec := &fakeInbound{domains: map[string]bool{"in.example.com": true}}
|
||||
s := inboundSessionFor(t, rec, true)
|
||||
message(t, s, "one@example.net", []string{"a@in.example.com"}, [][2]string{
|
||||
{"Subject", "First"}, {"X-Rspamd-Action", "add header"},
|
||||
})
|
||||
message(t, s, "two@example.net", []string{"b@in.example.com"}, nil)
|
||||
if len(rec.rows) != 2 {
|
||||
t.Fatalf("rows = %+v", rec.rows)
|
||||
}
|
||||
want := store.InboundSpamEntry{
|
||||
InboundDomain: "in.example.com", ClientIP: "203.0.113.7",
|
||||
From: "two@example.net", To: "b@in.example.com",
|
||||
Decision: store.SpamDecisionAccept, Engine: store.SpamEngineSelfPost,
|
||||
}
|
||||
if rec.rows[1] != want {
|
||||
t.Errorf("second row = %+v\nwant %+v", rec.rows[1], want)
|
||||
}
|
||||
|
||||
// An aborted transaction leaves nothing behind for the next one either.
|
||||
if _, err := s.MailFrom("three@example.net", mods(nil)); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := s.RcptTo("c@in.example.com", mods(nil)); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := s.Abort(mods(nil)); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(rec.rows) != 2 || len(s.rcpts) != 0 {
|
||||
t.Errorf("after an abort: rows %d, pending recipients %v", len(rec.rows), s.rcpts)
|
||||
}
|
||||
}
|
||||
|
||||
// The journal failing is never the mail's problem.
|
||||
func TestInboundAcceptsWhenTheStoreFails(t *testing.T) {
|
||||
for name, rec := range map[string]*fakeInbound{
|
||||
"insert": {domains: map[string]bool{"in.example.com": true}, insertErr: errors.New("boom")},
|
||||
"lookup": {lookupErr: errors.New("boom")},
|
||||
} {
|
||||
s := inboundSessionFor(t, rec, false)
|
||||
if resp := message(t, s, "sender@example.net", []string{"a@in.example.com"}, nil); resp != milter.RespAccept {
|
||||
t.Errorf("%s failure: response = %v, want accept", name, resp)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
package store
|
||||
|
||||
import (
|
||||
"database/sql"
|
||||
"errors"
|
||||
"fmt"
|
||||
"strings"
|
||||
"time"
|
||||
)
|
||||
|
||||
// Decisions of the inbound antispam journal. Kept in sync with the CHECK
|
||||
// constraint of inbound_spam_log.
|
||||
const (
|
||||
SpamDecisionAccept = "accept"
|
||||
SpamDecisionReject = "reject"
|
||||
SpamDecisionTempfail = "tempfail"
|
||||
SpamDecisionQuarantine = "quarantine"
|
||||
)
|
||||
|
||||
// Who made a decision of the inbound antispam journal. Kept in sync with the
|
||||
// CHECK constraint of inbound_spam_log.
|
||||
const (
|
||||
SpamEngineRspamd = "rspamd" // the external filter
|
||||
SpamEnginePostfix = "postfix" // Postfix's own policy: unknown recipient, size, rate
|
||||
SpamEngineSelfPost = "selfpost" // nobody: relayed with no filter attached
|
||||
)
|
||||
|
||||
// InboundSpamEntry is one row of the inbound antispam journal: what happened
|
||||
// to a message offered on port 25 for one recipient. Metadata only - the
|
||||
// message itself is relayed, not stored. Subject and Detail may be empty.
|
||||
type InboundSpamEntry struct {
|
||||
InboundDomain string
|
||||
ClientIP string
|
||||
From string
|
||||
To string
|
||||
Subject string
|
||||
Decision string
|
||||
Engine string
|
||||
Detail string
|
||||
}
|
||||
|
||||
// InsertInboundSpam records one journal row. It is called from the inbound
|
||||
// journal milter's hot path and from the log tailer, so it returns any error
|
||||
// for the caller to log; neither of them may hold up mail over it.
|
||||
func (s *Store) InsertInboundSpam(e InboundSpamEntry) error {
|
||||
_, err := s.db.Exec(
|
||||
`INSERT INTO inbound_spam_log
|
||||
(inbound_domain, client_ip, from_addr, to_addr, subject, decision, engine, detail, created_at)
|
||||
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||
e.InboundDomain, e.ClientIP, e.From, e.To, e.Subject, e.Decision, e.Engine, e.Detail,
|
||||
time.Now().UTC().Format(time.RFC3339),
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("insert inbound_spam_log: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// IsInboundDomain reports whether name is a configured inbound domain. Port 25
|
||||
// also takes mail that is not the relay's - DMARC reports for the server's own
|
||||
// name - and the journal keeps rows for inbound domains only.
|
||||
func (s *Store) IsInboundDomain(name string) (bool, error) {
|
||||
var one int
|
||||
err := s.db.QueryRow("SELECT 1 FROM inbound_domains WHERE name = ?", strings.ToLower(name)).Scan(&one)
|
||||
if errors.Is(err, sql.ErrNoRows) {
|
||||
return false, nil
|
||||
}
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("look up inbound domain: %w", err)
|
||||
}
|
||||
return true, nil
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
package store
|
||||
|
||||
import (
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
func TestInsertInboundSpam(t *testing.T) {
|
||||
st := openTestStore(t)
|
||||
e := InboundSpamEntry{
|
||||
InboundDomain: "in.example.com", ClientIP: "203.0.113.7",
|
||||
From: "sender@example.net", To: "a@in.example.com", Subject: "Hello",
|
||||
Decision: SpamDecisionAccept, Engine: SpamEngineRspamd, Detail: "no action, score 0.10 / 15.00",
|
||||
}
|
||||
if err := st.InsertInboundSpam(e); err != nil {
|
||||
t.Fatalf("InsertInboundSpam: %v", err)
|
||||
}
|
||||
var got InboundSpamEntry
|
||||
var created string
|
||||
err := st.db.QueryRow(
|
||||
"SELECT inbound_domain, client_ip, from_addr, to_addr, subject, decision, engine, detail, created_at FROM inbound_spam_log",
|
||||
).Scan(&got.InboundDomain, &got.ClientIP, &got.From, &got.To, &got.Subject, &got.Decision, &got.Engine, &got.Detail, &created)
|
||||
if err != nil {
|
||||
t.Fatalf("read back: %v", err)
|
||||
}
|
||||
if got != e {
|
||||
t.Errorf("row = %+v\nwant %+v", got, e)
|
||||
}
|
||||
if at, err := time.Parse(time.RFC3339, created); err != nil || time.Since(at) > time.Minute {
|
||||
t.Errorf("created_at = %q (%v)", created, err)
|
||||
}
|
||||
|
||||
// Every decision and engine the code names is one the table takes.
|
||||
for _, d := range []string{SpamDecisionAccept, SpamDecisionReject, SpamDecisionTempfail, SpamDecisionQuarantine} {
|
||||
for _, eng := range []string{SpamEngineRspamd, SpamEnginePostfix, SpamEngineSelfPost} {
|
||||
e.Decision, e.Engine = d, eng
|
||||
if err := st.InsertInboundSpam(e); err != nil {
|
||||
t.Errorf("decision %s by %s: %v", d, eng, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
e.Decision = "bounce"
|
||||
if err := st.InsertInboundSpam(e); err == nil {
|
||||
t.Error("an unknown decision was stored")
|
||||
}
|
||||
}
|
||||
|
||||
func TestIsInboundDomain(t *testing.T) {
|
||||
st := openTestStore(t)
|
||||
if _, err := st.AddInboundDomain("in.example.com"); err != nil {
|
||||
t.Fatalf("AddInboundDomain: %v", err)
|
||||
}
|
||||
for name, want := range map[string]bool{
|
||||
"in.example.com": true, "IN.Example.COM": true,
|
||||
"example.com": false, "": false, "other.example.com": false,
|
||||
} {
|
||||
if got, err := st.IsInboundDomain(name); err != nil || got != want {
|
||||
t.Errorf("IsInboundDomain(%q) = %v, %v; want %v", name, got, err, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user