home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
ftp.f-secure.com
/
2014.06.ftp.f-secure.com.tar
/
ftp.f-secure.com
/
support
/
hotfix
/
fsis
/
IS-SpamControl.fsfix
/
iufssc
/
lib
/
FS
/
FromSPF.pm
< prev
next >
Wrap
Text File
|
2006-11-29
|
4KB
|
192 lines
# FS::FromSPF.pm -- era Tue Sep 6 03:42:25 PM 2005
# $Id: FromSPF.pm 3971 2006-10-17 07:34:01Z eriker $
# Copyright (C) 2005 F-Secure Corporation
=head1 NAME
FS::FromSPF - SpamAssassin plugin for SPF check of From: header
=head1 SYNOPSIS
loadplugin FS::FromSPF
header SPF_FROM_FAIL_PAYBAY eval:from_spf_fail("paypal.com", "ebay.com")
describe SPF_FROM_FAIL_PAYBAY From: PayPal/Ebay, but fails their SPF
score SPF_FROM_FAIL_PAYBAY 9
tflags SPF_FROM_FAIL_PAYBAY net
=head1 DESCRIPTION
B<FS::FromSPF> checks the domain on the From: header
against the domains listed in the call to B<eval:from_spf_fail>,
and if it matches, it goes ahead and performs an SPF lookup
against the domain in the From: header.
If the SPF check returns a 'softfail' or 'fail' status,
or even 'neutral',
the corresponding rule triggers.
=cut
# Cruft cased and pasted from Mail::SpamAssassin::Plugin::Test
package FS::FromSPF;
use Mail::SpamAssassin::Plugin;
use strict;
use bytes;
our @ISA = qw(Mail::SpamAssassin::Plugin);
our $VERSION = '0.001'; ######## TODO: remember to update
sub new {
my $class = shift;
my $mailsaobject = shift;
# some boilerplate...
$class = ref($class) || $class;
my $self = $class->SUPER::new($mailsaobject);
bless ($self, $class);
$self->{conf} = $mailsaobject->{conf};
$self->register_eval_rule ("from_spf_fail");
dbg("plugin: registered FS::FromSPF plugin");
return $self;
}
use Mail::SPF::Query;
*dbg = *Mail::SpamAssassin::Plugin::dbg;
sub from_spf_fail
{
my ($self, $permsgstatus, @args) = @_;
die "from_spf_fail called without arguments" unless (@args);
return unless $permsgstatus->is_dns_available();
dbg("fromspf: from_spf_fail (" . join (";", @args) . ")");
my $from = $permsgstatus->get ("From:addr");
my ($dom) = $from;
$dom =~ s/.*\@//;
my $fqdn =
lc(Mail::SpamAssassin::Util::RegistrarBoundaries::trim_domain ($dom));
return 0 unless (grep { lc($_) eq $fqdn } @args);
# Mostly case and paste from Mail::SpamAssassin::Plugin::SPF
my $lasthop = $permsgstatus->{relays_untrusted}->[0];
unless (defined $lasthop)
{
dbg("fromspf: message was delivered entirely via trusted relays");
return 0;
}
# else
my $ip = $lasthop->{ip};
my $helo = $lasthop->{helo};
dbg ("fromspf: querying $from [ip=$ip, helo=$helo]");
my $query = Mail::SPF::Query->new (
ip => $ip,
sender => $from,
helo => $helo,
debug => $Mail::SpamAssassin::Debug->{rbl},
trusted => 1,
);
my ($result, $comment);
my $timeout = 5;
eval {
local $SIG{ALRM} = sub { die "__alarm__\n" };
alarm ($timeout);
($result, $comment) = $query->result();
dbg ("fromspf: result '$result' ($comment)");
alarm (0);
};
alarm (0);
if ($@)
{
if ($@ =~ /^__alarm__$/)
{
dbg ("fromspf: lookup timed out after $timeout seconds.");
}
else
{
warn "FromSPF: lookup failed: $@\n";
}
return 0;
}
# else
if ($result eq 'fail' || $result eq 'softfail' || $result eq 'neutral')
######## FIXME: should we have this too? || ! $result)
{
$comment ||= '';
$comment =~ s/\s+/ /gs;
$permsgstatus->{from_spf_comment} = "FromSPF: '$result' ($comment)";
$permsgstatus->{from_spf_result} = $result;
return 1;
}
#else
return 0;
}
1;
=head1 BUGS
We are stretching the semantics of SPF here.
Checking the F<From:> header field is not
supported in the basic SPF spec,
although proposals codifying this
have been circulated.
The plugin returns a match for
'softfail' or even 'neutral' --
it should only be used for when
you really, really require an
affirmation from the SPF lookup.
This is intended primarily for
checking against domains which
are very widely forged,
and which publish well-formed
SPF records.
(The 'neutral' response might
be given when the final
SPF entry is F<?all> but there
are other entries which
would have returned a pass;
we consider the fallback
to be a failure indication
in this case.)
=head1 SEE ALSO
L<Mail::SpamAssassin::Plugin>,
L<Mail::SpamAssassin::Plugin::SPF>,
L<Mail::SPF::Query>;
L<http://spf.pobox.com/>;
various SPF/From: extension proposals.
=head1 COPYRIGHT
Copyright (C) 2005 F-Secure Corp.
L<http://www.f-secure.com>
All rights reserved.
=cut