File: //lib/python3.9/site-packages/__pycache__/spf.cpython-39.pyc
a
���bn7 � @ s� d dl mZ dZdZdZdZdZd dlZd dlZd dl Z d dl
Z
d dl Z zd dl m
Z W n d dlZY n0 d dlZd dlmZ zd d lmZ W n ey� d d lmZ Y n0 z d dlZeeu r�d d
lmZ W nJ e�y zd dlZd d
lmZ W n e�y ed � Y n0 Y n0 ddd�Z d�dd�Z zFd dl Z d dl Z d dl Z e!e j"d��srde j"_#e j"j#e j"j$d< e Z%W nR d dl&Z&e!e&j'd��s�de&j'_#de&j'j(d< e&j)j*j+e&j)j*_,e&�-� e Z%Y n0 e�.dej/�Z0e�.dej/�Z1dZ2e�.e2�Z3e�.d�Z4e�.d�Z5e�.d�Z6e�.d�Z7d �8d gd �Z9e�.e9d �Z:e�.d e2 ej/�Z;e�.d!d"d#i ej/�Z<e�.d$d%e9 d&d'� ej/�Z=d(d(d)�Z>d*d+d,d-d*d+d.d/d,d-d0d1d2d3d.d4�Z?d5d6d7d8d9d:d;d<d=d>d?�
Z@dZAd@ZBdAZCdBZDdBZEdBZFdBZGd
ZHd
ZIdCZJdDZKdEdFdFdGdHdI�ZLG dJdK� dKeM�ZNG dLdM� dMeM�ZOG dNdO� dOeM�ZPddeIdPd
fdQdR�ZQd�dSdT�ZRG dUdV� dVeS�ZTdWdX� ZUdYdZ� ZVd[d\� ZWd]d^� ZXd_d`� ZYdadb� ZZd�dcdd�Z[d�dedf�Z\ej]d dCk�r�dgdh� Z^ndidh� Z^djdk� Z_e`dlk�r�d dlaZaz$ea�aejbdmd� dng do��\ZcZbW nF eajd�yL Ze z*eeee�� ee� e�fdC� W Y dZe[en
dZe[e0 0 dPZgd ZhecD ]>\ZiZjeidpv �rpd Zgeidqv �r�ekej�Zhneidrv �rZee� �qZeleb�d k�r�ee� e_� �n�eleb�dmk�rVz*eTdsdtdue �m� dv�Zneen�oebd �� W n^ eO�y" Zp zedwep� W Y dZp[pn8dZp[p0 eP�yP Zp zedxep� W Y dZp[pn
dZp[p0 0 �nbeleb�dyk�r�eb\ZqZrZseTeqerese �m� egehdz�Znen�R� Zted{etenju� etd d0k�r�ed|en�v� enju� enjw�r�enjwjx�r�ed}enjwjx� enjy�r�enjyD ]Zzeez� �q�n�eleb�d k�r�ebdmd� \ZqZrZseTeqerese �m� dPegd~�Znen�Rebd �Zted{etenju� etd d0k�rped|en�v� enju� enjw�r�enjwjx�r�ed}enjwjx� enjy�r�enjyD ]Zzeez� �q�nee� dS )�� )�print_functionz,Terence Way, Stuart Gathman, Scott Kittermanzpyspf@openspf.orgz2.0.14�spfa� To check an incoming mail request:
% python spf.py [-v] {ip} {sender} {helo}
% python spf.py 69.55.226.139 tway@optsw.com mx1.wayforward.net
To test an SPF record:
% python spf.py [-v] "v=spf1..." {ip} {sender} {helo}
% python spf.py "v=spf1 +mx +ip4:10.0.0.1 -all" 10.0.0.1 tway@foo.com a
To fetch an SPF record:
% python spf.py {domain}
% python spf.py wayforward.net
To test this script (and to output this usage message):
% python spf.py
N)�reduce)�Message��Bytesz;ipaddr module required: http://code.google.com/p/ipaddr-py/T� c
C s� z�t j| ||d�}|�� }|jd dkr�|dkr8td��z t j| |d|d�}|�� }W n6 t jy� } z tdt|� ��W Y d }~n
d }~0 0 |jd d
kr�|jd d kr�td |jd
d t|jd � ��dd� |j D �dd� |j
D � W S t �y$ } z tdt|� ��W Y d }~ntd }~0 t�yX } z tdt|� ��W Y d }~n@d }~0 t j�y� } z tdt|� ��W Y d }~n
d }~0 0 d S )N)�qtype�timeoutZtcT� zNDNS: Truncated UDP Reply, SPF records should fit in a UDP packet, retrying TCPZtcp)r Zprotocolr
zDNS: TCP Fallback error: Zrcoder � zError: �statusz RCODE: c S s$ g | ] }|d |d f|d f�qS ��name�typename�data� ��.0�ar r �'/usr/lib/python3.9/site-packages/spf.py�
<listcomp>r s �z#DNSLookup_pydns.<locals>.<listcomp>c S s$ g | ] }|d |d f|d f�qS r r r r r r r t s ��DNS ) �DNSZ
DnsRequest�req�header�AmbiguityWarningZDNSError� TempError�str�IOError�answers�
additional�AttributeError)r r �strictr
r Zresp�xr r r �DNSLookup_pydns] s4 & $���$$r% � c
C sV g }z�t jj| ||d�}|D ]�}|dks0|dkrF|�| |f|jf� q |dkrj|�| |f|j|jff� q |dkr�|�| |f|j�d�f� q |dks�|dkr |�| |f|j f� q W n� t jj
y� Y n� t jj y� Y nr t j j
�y } z td t|� ��W Y d }~nBd }~0 t jj�yP } z td t|� ��W Y d }~n
d }~0 0 |S )
N)Zlifetime�A�AAAA�MX�PTRT�TXT�SPFr )�dnsZresolver�query�appendZaddressZ
preferenceZexchange�targetZto_text�stringsZNoAnswerZNXDOMAIN� exceptionZTimeoutr r Z
NoNameservers)r r Z tcpfallbackr
ZretValr Zrdatar$ r r r �DNSLookup_dnspython~ s* $&r3 r, �c s ^v=spf1$|^v=spf1 z^([a-z][a-z0-9_\-\.]*)=z%(%|_|-|(\{[^\}]*\}))z(?<!%)%[^{%_-]|%$z([0-9]*)(r?)([^0-9a-zA-Z]*)z//(0|[1-9]\d*)$z/(0|[1-9]\d*)$z\.z%(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])� �$zA\.(?:[0-9a-z]*[a-z][0-9a-z]*|[0-9a-z]+-[0-9a-z-]*[0-9a-z])\.?$|%sz%(atext)s+([.]%(atext)s+)*$Zatextz[0-9a-z!#$%&'*+/=?^_`{}|~-]a� (?:%(hex4)s:){6}%(ls32)s$|::(?:%(hex4)s:){5}%(ls32)s$|(?:%(hex4)s)?::(?:%(hex4)s:){4}%(ls32)s$|(?:(?:%(hex4)s:){0,1}%(hex4)s)?::(?:%(hex4)s:){3}%(ls32)s$|(?:(?:%(hex4)s:){0,2}%(hex4)s)?::(?:%(hex4)s:){2}%(ls32)s$|(?:(?:%(hex4)s:){0,3}%(hex4)s)?::%(hex4)s:%(ls32)s$|(?:(?:%(hex4)s:){0,4}%(hex4)s)?::%(ls32)s$|(?:(?:%(hex4)s:){0,5}%(hex4)s)?::%(hex4)s$|(?:(?:%(hex4)s:){0,6}%(hex4)s)?::$z"(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|%s)z
[0-9a-f]{1,4})Zls32Zhex4�.)�l�s�pass�fail�neutral�softfail� permerror� temperror�none�local�trusted� ambiguous)�+�-�?�~r: r; r> �errorr< r= r@ rA rB rC �unknownzsender SPF authorizedzSPF fail - not authorizedz permanent error in processingz!temporary DNS error in processingz)domain owner discourages use of this hostz#access neither permitted nor denied� z!No SPF result due to local policyz$No SPF check - trusted-forwarder.orgz No error, but results may vary)
r: r; r> r? r= r< r@ rA rB rC zv=spf1 a/24 mx/24 ptrz.v=spf1 ?include:spf.trusted-forwarder.org -all�
� )r �mx�ptr�exists�include�ip4�ip6�allrN rQ rR rS )Zprt�ipZipv4Zipv6zall.c @ s" e Zd ZdZddd�Zdd� ZdS )r z SPF Warning - ambiguous resultsNc C s$ t �| ||� || _|| _|| _d S �N�� Exception�__init__�msg�mech�ext��selfrY rZ r[ r r r rX
s zAmbiguityWarning.__init__c C s | j rd| j| j f S | jS �N�%s: %s�rZ rY �r] r r r �__str__ s zAmbiguityWarning.__str__)NN��__name__�
__module__� __qualname__�__doc__rX rb r r r r r s
r c @ s" e Zd ZdZddd�Zdd� ZdS )r zTemporary SPF errorNc C s( t �| ||� t|�| _|| _|| _d S rU )rW rX r rY rZ r[ r\ r r r rX s
zTempError.__init__c C s | j rd| j| j f S | jS r^ r` ra r r r rb s zTempError.__str__)NNrc r r r r r s
r c @ s" e Zd ZdZddd�Zdd� ZdS )� PermErrorzPermanent SPF errorNc C s$ t �| ||� || _|| _|| _d S rU rV r\ r r r rX % s zPermError.__init__c C s | j rd| j| j f S | jS r^ r` ra r r r rb * s zPermError.__str__)NNrc r r r r rh # s
rh Fc
C s* t | |||||||d��� \}} }
||
fS )a& Test an incoming MAIL FROM:<s>, from a client with ip address i.
h is the HELO/EHLO domain name. This is the RFC4408/7208 compliant
pySPF2.0 interface. The interface returns an SPF result and explanation
only. SMTP response codes are not returned since neither RFC 4408 nor RFC
7208 does specify receiver policy. Applications updated for RFC 4408 and
RFC 7208 should use this interface. The maximum time, in seconds, this
function is allowed to run before a TempError is returned is controlled by
querytime. When set to 0 the timeout parameter (default 20 seconds)
controls the time allowed for each DNS lookup. When set to a non-zero
value, it total time for all processing related to the SPF check is
limited to querytime (default 20 seconds as recommended in RFC 7208,
paragraph 4.6.4).
Returns (result, explanation) where result in
['pass', 'permerror', 'fail', 'temperror', 'softfail', 'none', 'neutral' ].
Example:
#>>> check2(i='61.51.192.42', s='liukebing@bcc.com', h='bmsi.com')
)�ir9 �hrA �receiverr
�verbose� querytime�r. �check) ri r9 rj rA rk r
rl rm �res�_�expr r r �check2/ s
�rs c C sF t | |||||d��� \}}}|dkr,d}n|dkr<|dk |||fS )a? Test an incoming MAIL FROM:<s>, from a client with ip address i.
h is the HELO/EHLO domain name. This is the pre-RFC SPF Classic interface.
Applications written for pySPF 1.6/1.7 can use this interface to allow
pySPF2 to be a drop in replacement for older versions. With the exception
of result codes, performance in RFC 4408 compliant.
Returns (result, code, explanation) where result in
['pass', 'unknown', 'fail', 'error', 'softfail', 'none', 'neutral' ].
Example:
#>>> check(i='61.51.192.42', s='liukebing@bcc.com', h='bmsi.com')
)ri r9 rj rA rk rl r> rI ZtempfailrH rn ) ri r9 rj rA rk rl rp �coderr r r r ro H s �ro c @ s, e Zd ZdZdddeddfdd�Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
e fdd�Z dDdd�Z
dd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� ZdEd$d%�Zd&d'� ZdFd)d*�Zd+d,� ZdGd.d/�Zd0d1� Zd2d3� Zddddddddd4�Z dHd5d6�Z d7d8� Z d9d:� Z d;d<� Z d=d>� Z!dId@dA�Z"dBdC� Z#dS )Jr. aj A query object keeps the relevant information about a single SPF
query:
i: ip address of SMTP client in dotted notation
s: sender declared in MAIL FROM:<>
l: local part of sender s
d: current domain, initially domain part of sender s
h: EHLO/HELO domain
v: 'in-addr' for IPv4 clients and 'ip6' for IPv6 clients
t: current timestamp
p: SMTP client domain name
o: domain part of sender s
r: receiver
c: pretty ip address (different from i for IPv6)
This is also, by design, the same variables used in SPF macro
expansion.
Also keeps cache: DNS cache.
NTFr c
C s� || | _ | _|s(|r(d| | _ d| _nd| _t||�\| _| _ttt�� ��| _ | j| _
d | _ |rl|| _ nd| _ i | _
tt�| _tt�| _|| _d| _d| _|| _|| _| | _| dkr�| | _d| _d | _|r�| �|� d| _|| _ d | _ d S )Nz postmaster@�helo�mailfromrI r T) r9 rj �ident� split_emailr8 �or �int�time�t�d�p�r�cache�dict� EXPLANATIONS�defexps�exps� libspf_local�lookups� void_lookupsr# r
rm Ztimer�ipaddr�set_ip�default_modifierrl �authserv)
r] ri r9 rj rA rk r# r
rl rm r r r rX s s<
zquery.__init__c C s t d|||f � d S )Nz %s: %s "%s")�print)r] rZ r} r r r r �log� s z query.logc
C sF d| _ |�� dkr g | _ d}n�|�� dkr6g | _ d}n�z4zt�|�| _W n tyf t�|�| _Y n0 W n0 ty� } ztt |���W Y d}~n
d}~0 0 | jj
dkr�| jj r�t� | jj �| _d}q�d}nd}t | j�| _
|�r d| _d| _| j�rd �t| jj�d
d ��� ��| _d | _n$d
| _d| _| j�r<| jj| _d| _dS )z$Set connect ip, and ip6 or ip4 mode.F�listZlist6TN� r( rR r7 �:rJ � r' �in-addr� )�iplist�lower� ipaddressZ
ip_addressr� r" Z IPAddress�
ValueErrorrh r �versionZ ipv4_mappedZ IPv4Address�cr' �v�joinr� Zexploded�replace�upperri �cidrmax)r] ri rR r$ r r r r� � s@ "
z query.set_ipc C s* | j }| j}dD ]}|||< |||< qd S �N)r= r; r> )r� r� )r] rr r� r� ri r r r �set_default_explanation� s
z query.set_default_explanationc C s | j }dD ] }|||< q
d S r� )r� )r] rr r� ri r r r �set_explanation� s zquery.set_explanationc C sf | j s`| �� }|sd| _ nF| j|v r.| j| _ n2d| j }|D ]}|�|�r<|| _ q`q<|d | _ | j S )NrI r7 r )r~ �validated_ptrsr} �endswith)r] r~ Zsfxr} r r r �getp� s
z
query.getpc C sh t �| j�d rdS | j}| �|�\}}}|dkr^| jrP| jjrP| jj\}}}nd\}}|| _|||fS )z�Return a best guess based on a default SPF record.
>>> q = query('1.2.3.4','','SUPERVISION1',receiver='example.com')
>>> q.best_guess()[0]
'none'
���)r@ � rJ r> )r< r� )� RE_TOPLAB�splitr} �
perm_errorro r[ )r] r Zper r� �er r r �
best_guess� s zquery.best_guessc
C sT g | _ d| _d| _d| _i | _z|d| _|sL| �| j�}| jrL| � d| j|� |r\|�
dd�}| j rr|rrt || j �}| �
|| jd�}| jr�|| j_| j�|W S ty� } z:|j| _|j r�| j �|j � dddt|� fW Y d}~S d}~0 t�yN } zJ| j�s
|| _|j| _|j �r(| j �|j � d d
d t|� fW Y d}~S d}~0 0 dS ) a�
Returns (result, mta-status-code, explanation) where result
in ['fail', 'softfail', 'neutral' 'permerror', 'pass', 'temperror', 'none']
Examples:
>>> q = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='192.0.2.3')
>>> q.check(spf='v=spf1 ?all')
('neutral', 250, 'access neither permitted nor denied')
>>> q.check(spf='v=spf1 redirect=controlledmail.com exp=_exp.controlledmail.com')
('fail', 550, 'SPF fail - not authorized')
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ?all moo')
('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo')
>>> q.check(spf='v=spf1 ip4:192.0.0.n ?all')
('permerror', 550, 'SPF Permanent Error: Invalid IP4 address: ip4:192.0.0.n')
>>> q.check(spf='v=spf1 ip4:192.0.2.3 ip4:192.0.0.n ?all')
('permerror', 550, 'SPF Permanent Error: Invalid IP4 address: ip4:192.0.0.n')
>>> q.check(spf='v=spf1 ip6:2001:db8:ZZZZ:: ?all')
('permerror', 550, 'SPF Permanent Error: Invalid IP6 address: ip6:2001:db8:ZZZZ::')
>>> q.check(spf='v=spf1 =a ?all moo')
('permerror', 550, 'SPF Permanent Error: Unknown qualifier, RFC 4408 para 4.6.1, found in: =a')
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ~all')
('pass', 250, 'sender SPF authorized')
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 -all moo=')
('pass', 250, 'sender SPF authorized')
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 -all match.sub-domains_9=yes')
('pass', 250, 'sender SPF authorized')
>>> q.strict = False
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 -all moo')
('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo')
>>> q.perm_error.ext
('pass', 250, 'sender SPF authorized')
>>> q.strict = True
>>> q.check(spf='v=spf1 ip4:192.1.0.0/16 moo -all')
('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo')
>>> q.check(spf='v=spf1 ip4:192.1.0.0/16 ~all')
('softfail', 250, 'domain owner discourages use of this host')
>>> q.check(spf='v=spf1 -ip4:192.1.0.0/6 ~all')
('fail', 550, 'SPF fail - not authorized')
# Assumes DNS available
>>> q.check()
('none', 250, '')
>>> q.check(spf='v=spf1 ip4:1.2.3.4 -a:example.net -all')
('fail', 550, 'SPF fail - not authorized')
>>> q.libspf_local='ip4:192.0.2.3 a:example.org'
>>> q.check(spf='v=spf1 ip4:1.2.3.4 -a:example.net -all')
('pass', 250, 'sender SPF authorized')
>>> q.check(spf='v=spf1 ip4:1.2.3.4 -all exp=_exp.controlledmail.com')
('fail', 550, 'Controlledmail.com does not send mail from itself.')
>>> q.check(spf='v=spf1 ip4:1.2.3.4 ?all exp=_exp.controlledmail.com')
('neutral', 250, 'access neither permitted nor denied')
Nr �top�
� r? i� zSPF Temporary Error: r> �& zSPF Permanent Error: )rZ r� � mechanismr� �optionsr� �dns_spfr} rl r� r� r� �insert_libspf_local_policy�check1r[ r rY �probr/ r rh )r] r �rcr$ r r r ro � s@ F
�&z query.checkc
C s� |t kr | jrtd��td��z2z$| j| }| _| �||�W || _W S || _0 W nN ty� } z6|j| _|j r|| j �
|j � ddd| fW Y d }~S d }~0 0 d S )Nz Too many levels of recursionrC r zSPF Ambiguity Warning: %s) �
MAX_RECURSIONr# �AssertionErrorrh r} �check0r rY r� rZ r/ )r] r �domain� recursion�tmpr$ r r r r� o s � z query.check1c
G sR | j rt|� �| jsLz t|� �W n* tyJ } z|| _W Y d }~n
d }~0 0 | jS rU )r# rh r� )r] rY r$ r r r �
note_error� s zquery.note_errorc C s" t �|�d rtd|��| �|�S )z validate and expand domain-specr� z Invalid domain found (use FQDN))r� r� rh �expand)r] �argr r r �
expand_domain� s
zquery.expand_domainc C s� |� d�r"| �d|� |dd� }t|| j�\}}}}|r^t�|d �}|rZ|dd� }nd}|tv rz| �d|� t| }|d kr�t�|�r�| �d
|�}d }|d v r�|du r�d
}n|d
kr�t d|��|du r�d}n|dkr�t d|��| j
dkr�|}�n|d k�s t�|��r||d k�r,| �d|� d | }}|du�r@t d|��|du �rPd
}n|d
k�rdt d|��t�|��st d|��n�|dk�r�|du�r�t d|��|du �r�d}n|dk�r�t d|��t �|��st d|��n.|du�s�|du�r�|t v �r�t d|��| j
}|dv �r�|dk�r(|�s(t d|��| �|�}|�sBt d|��|dk�rv|| jk�rv|dk�rlt d |��t d |��|||||fS |d k�r�|�d ��r�| �d |� |t v �r�|||||fS |dd� t v �r�| �d!|�}n | �d|�}|||||fS )"a
Parse and validate a mechanism.
Returns mech,m,arg,cidrlength,result
Examples:
>>> q = query(s='strong-bad@email.example.com.',
... h='mx.example.org', i='192.0.2.3')
>>> q.validate_mechanism('A')
('A', 'a', 'email.example.com', 32, 'pass')
>>> q = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='192.0.2.3')
>>> q.validate_mechanism('A//64')
('A//64', 'a', 'email.example.com', 32, 'pass')
>>> q.validate_mechanism('A/24//64')
('A/24//64', 'a', 'email.example.com', 24, 'pass')
>>> q.validate_mechanism('?mx:%{d}/27')
('?mx:%{d}/27', 'mx', 'email.example.com', 27, 'neutral')
>>> try: q.validate_mechanism('ip4:1.2.3.4/247')
... except PermError as x: print(x)
Invalid IP4 CIDR length: ip4:1.2.3.4/247
>>> try: q.validate_mechanism('ip4:1.2.3.4/33')
... except PermError as x: print(x)
Invalid IP4 CIDR length: ip4:1.2.3.4/33
>>> try: q.validate_mechanism('a:example.com:8080')
... except PermError as x: print(x)
Invalid domain found (use FQDN): example.com:8080
>>> try: q.validate_mechanism('ip4:1.2.3.444/24')
... except PermError as x: print(x)
Invalid IP4 address: ip4:1.2.3.444/24
>>> try: q.validate_mechanism('ip4:1.2.03.4/24')
... except PermError as x: print(x)
Invalid IP4 address: ip4:1.2.03.4/24
>>> try: q.validate_mechanism('-all:3030')
... except PermError as x: print(x)
Invalid all mechanism format - only qualifier allowed with all: -all:3030
>>> q.validate_mechanism('-mx:%%%_/.Clara.de/27')
('-mx:%%%_/.Clara.de/27', 'mx', '% /.Clara.de', 27, 'fail')
>>> q.validate_mechanism('~exists:%{i}.%{s1}.100/86400.rate.%{d}')
('~exists:%{i}.%{s1}.100/86400.rate.%{d}', 'exists', '192.0.2.3.com.100/86400.rate.email.example.com', 32, 'softfail')
>>> q.validate_mechanism('a:mail.example.com.')
('a:mail.example.com.', 'a', 'mail.example.com', 32, 'pass')
>>> try: q.validate_mechanism('a:mail.example.com,')
... except PermError as x: print(x)
Do not separate mechnisms with commas: a:mail.example.com,
>>> q = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='2001:db8:1234::face:b007')
>>> q.validate_mechanism('A//64')
('A//64', 'a', 'email.example.com', 64, 'pass')
>>> q.validate_mechanism('A/16')
('A/16', 'a', 'email.example.com', 128, 'pass')
>>> q.validate_mechanism('A/16//48')
('A/16//48', 'a', 'email.example.com', 48, 'pass')
�,z%Do not separate mechnisms with commasNr� r r r: zUnknown mechanism foundr z'Use the ip4 mechanism for ip4 addressesrQ )r rM r� zInvalid IP4 CIDR lengthr� zInvalid IP6 CIDR lengthrR z Missing IP4zDual CIDR not allowedzInvalid IP4 addresszInvalid IP6 addresszCIDR not allowed)r rM rN rO rP rO zimplicit exists not allowedz
empty domain:rP z include has trivial recursionz include mechanism missing domainrS r� z>Invalid all mechanism format - only qualifier allowed with allz0Unknown qualifier, RFC 4408 para 4.6.1, found in)r� r� �parse_mechanismr} �RESULTS�get�COMMON_MISTAKES�RE_IP4�matchrh r� �RE_IP6�ALL_MECHANISMSr� r� �count)r] rZ �mr� �
cidrlengthZ cidr6length�resultr$ r r r �validate_mechanism� s� F
�
�
� zquery.validate_mechanismc C s� |sddt d fS |�d�}|d �� dkrP| jdkrBtd| j��ddt d fS dd � |dd
� D �}| j}d
}d }g }g }|D �]�}t�|�dd
� } t| �d kr�|� | �
|�� q�| \}
} |
|v r�|
d
kr�t d|��| � d|
|� |� |
� |
dk�rP| �s t d| ��| �
| �} | �rz$| �| �} | �r>|�s>| �| � W n Y n0 q�|
d
k�r~| �� | �
| �}|�st d| ��q�|
dk�r�| jdk�r�td��| j�s| j�r| �| �} t�| |�}q�|
dk�r�|�s| �d�D ]}
|
�r�d| j|
< �q�q�| �| d � q�|D �](\}} } }}| dk�r�| �� | �| �}| j�rN| �d| |� | �|| |d �\}}}|dk�rv �q�|dk�r�| � d| |� d }�q �q | dk�r� �q��q | d k�r�| �� z"t| �| d ��dk�r�W �q�W n t�y� Y n0 �q | d k�r2| �� | �| �| | j �|��r4 �q��q | d k�r`| �� | �| � | �|��r4 �q�n�| d k�r�| j d!k�r4z | �| g|��r�W �q�W n t j �y� t d"|��Y n0 n~| d#k�r | j d#k�r4z | �| g|��r�W �q�W n t j �y t d"|��Y n0 n(| d$k�r | �� t!| �"� | ��r �q��q |�r�| �|�}|�sXt d%|��| j�rn| �d
||� |�s�t#| j$�| _i | _| �|||�S |}d
}|�s�|| _%|d&k�r�|d'|| fS |d|| fS d
S )(z�Test this query information against SPF text.
Returns (result, mta-status-code, explanation) where
result in ['fail', 'unknown', 'pass', 'none']
r@ r� r� r zv=spf1r zInvalid SPF record inc S s g | ] }|r|�qS r r )r rZ r r r r W � z query.check0.<locals>.<listcomp>Nr< rL �redirectz"redirect= MUST appear at most oncez %s= MUST appear at most oncerr zexp has empty domain-spec:zredirect has empty domain:�defaultz"The default= modifier is obsolete.�opr7 TrP r: z+No valid SPF record for included domain: %srS rO r' r rM rQ r� z syntax errorrR rN z!redirect domain has no SPF recordr; r� )&r� r� r� r# r r} r� � RE_MODIFIER�lenr/ r� rh r� r� �get_explanationr� �
check_lookupsr� r� r� r� r� r� rl r� r� �dns_a� cidrmatchr' �dns_mxr� �socketrH � domainmatchr� r� r� r� )r] r r� r� r� r� Zmechs� modifiersrZ r� �modr� rr r� r� r� r} rp rt ZtxtZredirect_recordr r r r� = s�
�
�
z query.check0c C sB | j d | _ | j td kr*tdtd ��| j tkr>| �d� d S )Nr r5 zMore than %d DNS lookupszToo many DNS lookups)r� �
MAX_LOOKUPrh r� ra r r r r� � s
zquery.check_lookupsc C sv |r`z:| j |dd�}t|�dkr<t| jt|d �dd��W S W qr ty\ | jdkrX� Y qr0 n| jdkrrtd��dS ) zExpand an explanation.T�� ignore_voidr r F)�stripdotzEmpty domain-spec on exp=N)�dns_txtr� r r� �to_asciirh r# )r] �specr r r r r� � s
zquery.get_explanationc C s� |� d�dkr6t}|�d�D ]}|�|�r td|��q d}d}t�|�D �] }||||�� � 7 }||�� |�� � }|dkr�|d7 }n�|dkr�|d7 }n�|d kr�|d
7 }n�|d � � } | d kr�| �
� n| d
v r�|r�td|��t | | | �}
|
�rB|
| k�rtd|��t |
|dd� t
�| ��} | |d k�r:t�| d�} || 7 }|�� }qH|||d� 7 }|�rz|�d��rz|dd� }|�d�dk�r�t|�dk�r�||�d�d d� }|S )a% Do SPF RFC macro expansion.
Examples:
>>> q = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='192.0.2.3')
>>> q.p = 'mx.example.org'
>>> q.r = 'example.net'
>>> q.expand('%{d}')
'email.example.com'
>>> q.expand('%{d4}')
'email.example.com'
>>> q.expand('%{d3}')
'email.example.com'
>>> q.expand('%{d2}')
'example.com'
>>> q.expand('%{d1}')
'com'
>>> q.expand('%{p}')
'mx.example.org'
>>> q.expand('%{p2}')
'example.org'
>>> q.expand('%{dr}')
'com.example.email'
>>> q.expand('%{d2r}')
'example.email'
>>> q.expand('%{l}')
'strong-bad'
>>> q.expand('%{l-}')
'strong.bad'
>>> q.expand('%{lr}')
'strong-bad'
>>> q.expand('%{lr-}')
'bad.strong'
>>> q.expand('%{l1r-}')
'strong'
>>> q.expand('%{c}',stripdot=False)
'192.0.2.3'
>>> q.expand('%{r}',stripdot=False)
'example.net'
>>> q.expand('%{ir}.%{v}._spf.%{d2}')
'3.2.0.192.in-addr._spf.example.com'
>>> q.expand('%{lr-}.lp._spf.%{d2}')
'bad.strong.lp._spf.example.com'
>>> q.expand('%{lr-}.lp.%{ir}.%{v}._spf.%{d2}')
'bad.strong.lp.3.2.0.192.in-addr._spf.example.com'
>>> q.expand('%{ir}.%{v}.%{l1r-}.lp._spf.%{d2}')
'3.2.0.192.in-addr.strong.lp._spf.example.com'
>>> try: q.expand('%(ir).%{v}.%{l1r-}.lp._spf.%{d2}')
... except PermError as x: print(x)
invalid-macro-char : %(ir)
>>> q.expand('%{p2}.trusted-domains.example.net')
'example.org.trusted-domains.example.net'
>>> q.expand('%{p2}.trusted-domains.example.net.')
'example.org.trusted-domains.example.net'
>>> q = query(s='@email.example.com',
... h='mx.example.org', i='192.0.2.3')
>>> q.p = 'mx.example.org'
>>> q.expand('%{l}')
'postmaster'
�%r r7 zinvalid-macro-char rJ z%%z%_r� z%-z%20rL r~ Zcrtz&c,r,t macros allowed in exp= text onlyzUnknown Macro Encounteredr r� rG N� r )�find�RE_INVALID_MACROr� �searchrh �RE_CHAR�finditer�start�endr� r� �getattr�
expand_one�JOINERSr� � urllibparse�quoter� r� r� �index) r] r9 r� Zregex�labelr� r� ri ZmacroZletter� expansionr� r r r r� sN W
�
z query.expandc
C s� |� d�D ]}|r t|�dkr
dS q
dd� | �|�D �}t|�dkr`| jrXtd| j� td��t|�dkr�| jd k r�t|d
�S | jdk�rJz d d� | j|d d
d�D �}W n: t y� } z"| jdkr�t |��g }W Y d}~n
d}~0 0 t|�dkr�td��t|�dk�rJ| jdk�r>t|�dk�r>|d
|d
k�r>t
d��t|d
�S t|�dk�rdt|d
�S t �r�dd� | j|d t d
d�D �}t|�dk�r�t|d
�S dS )z�Get the SPF record recorded in DNS for a specific domain
name. Returns None if not found, or if more than one record
is found.
r7 �? Nc S s g | ]}t �|�r|�qS r ��RE_SPFr� �r r| r r r r � r� z!query.dns_spf.<locals>.<listcomp>r zcache=z'Two or more type TXT spf records found.rL r c S s g | ]}t �|�r|�qS r r� r� r r r r � s
�r, Tr� z'Two or more type SPF spf records found.zLv=spf1 records of both type TXT and SPF (type 99) present, but not identicalc S s g | ]}t �|�r|�qS r r� r� r r r r � s
�z._spf.) r� r� r� rl r� r� rh r# r� r r �DELEGATE)r] r� r� r �br$ r r r r� � s> ,� �z
query.dns_spfr+ c C sv |rrzJ| j |||d�}|rLdd� |D �}t|d t�r<|W S dd� |D �W S W n" typ td||f ��Y n0 g S )z,Get a list of TXT records for a domain name.r� c S s& g | ] }|r|d dd � � |��qS )r N)r� r r r r r � r� z!query.dns_txt.<locals>.<listcomp>r c S s g | ]}|� d ��qS )zutf-8)�encode�r r9 r r r r � r� z.Non-ascii characters found in %s record for %s)r- �
isinstance�bytes� UnicodeErrorrh )r] �
domainnameZrrr� Zdns_listr r r r r� � s � z
query.dns_txtc sz � � |d�}� jrPt}t|�tkr.tdt ��� jdkrXt|�dkrXtd|��ntd }|�� � fdd�|d |� D �S )
zSGet a list of IP addresses for all MX exchanges for a
domain name.
r) z More than %d MX records returnedr r z$No MX records found for mx mechanismr5 c s( g | ] }� � |d � j�D ]}|�qqS )r )r� r' )r rM r ra r r r � r� z query.dns_mx.<locals>.<listcomp>N)r- r# �MAX_MXr� rh r �sort)r] r Zmxnames�maxr ra r r� � s �
�z query.dns_mxr' c C sZ |sg S | � ||�}| jdkr8t|�dkr8td| |��|dkrVttu rVdd� |D �S |S )z5Get a list of IP addresses for a domainname.
r r zNo %s records found forr( c S s g | ] }t |��qS r r �r rT r r r r � r� z query.dns_a.<locals>.<listcomp>)r- r# r� r r� r )r] r r' r r r r r� � s �z query.dns_ac s� �j rzt}�j dkr�zJ���j�}t|�|krDd| }t|�j��nt|�dkr\td�j��W q� td�j��Y q�0 ntd }�j� � �fdd����j�d|� D �S ) z=Figure out the validated PTR domain names for the connect IP.r z!More than %d PTR records returnedr z&No PTR records found for ptr mechanismr5 c s& g | ] }�� ��|�j�� �r|�qS r )r� r� r' )r r~ �r� r] r r r s �z(query.validated_ptrs.<locals>.<listcomp>N)r# �MAX_PTR�dns_ptrri r� r r� r� )r] r ZptrnamesZwarningr r r r� � s&
�� zquery.validated_ptrsc C s | � dt|�| jf d�S )z-Get a list of domain names for an IP address.z
%s.%s.arpar* )r- � reverse_dotsr� )r] ri r r r r s z
query.dns_ptr))r) r' )r) r) )�CNAMEr' )r' r' )r( r( )r* r* )r+ r+ )r, r, c C s� |s t d��t|�}|�d�r*|dd� }tdd� |�d�d�sDg S |�� }| j�||fg �}|rf|S |df}| j�|�}| jo�|� d �}|r�|d
}�n&t
j } | j d
k r�t
d ��| j | jk r�| j d
kr�| j }
n| j}
t�� } t||| j|
�D ]�\} }
|�rtd | |
� | d
�� | d
f} | |k�rH|
}| j�||fg �}|�rH �q�| d
dk�sf|| d
f| v r�|�rxtd| |
� | j�| g ��|
� q�| j�||fg �}| j d
k�r�| j t�� | | _ |�sJ|�rJ|�s�i }nt|�tk�r�tdt ��|||< |�� �d�|v �r&| jd
k�rJtd|��n$| j|||d�}|�rJ|| j||f< |�s||�s|| jd
7 _| jt k�r|tdt ��|S )a� DNS query.
If the result is in cache, return that. Otherwise pull the
result from DNS, and cache ALL answers, so additional info
is available for further queries later.
CNAMEs are followed.
If there is no data, [] is returned.
pre: qtype in ['A', 'AAAA', 'MX', 'PTR', 'TXT', 'SPF']
post: isinstance(__return__, types.ListType)
Examples:
>>> c = query(s='strong-bad@email.example.com',
... h='parallel.kitterman.org',i='192.0.2.123')
>>> "".join( chr(x) for x in bytearray(c.dns('parallel.kitterman.org', 'TXT')[0][0]) )
'v=spf1 include:long.kitterman.org include:cname.kitterman.org -all'
z
Invalid queryr7 Nr� c S s | o dt |� k odk S S )Nr �@ )r� )r$ �yr r r �<lambda>: r� zquery.dns.<locals>.<lambda>Tr
zcname.r z)DNS Error: exceeded max query lookup timezresult=r z addcache=z Length of CNAME chain exceeds %dz
CNAME loop)�cnamesz Void lookup limit of %d exceeded) rW r r� r r� r� r� r� rl �
startswithr. �
SAFE2CACHErm r r
r{ � DNSLookupr# r� �
setdefaultr/ r� � MAX_CNAMErh �rstripr r- r� �MAX_VOID_LOOKUPS)r] r r r r� r� ZcnamekZcname�debugZ
safe2cacher
Ztimethen�kr� r r r r- " sd
z query.dnsc
C s( z�zndd� |D �D ]Z}|j |d�}t| jt�rF|�| j�rl W W dS q|| jk r^| j�|� q| j�|j� qW n| t y� dd� |D �D ]Z}|j |d�}t| jt�r�|�| j�r� Y W dS q�|| jk r�| j�|� q�| j�|j� q�Y n0 W n2 t
�y" } zt t |���W Y d}~n
d}~0 0 dS )aB Match connect IP against a CIDR network of other IP addresses.
Examples:
>>> c = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='192.0.2.3')
>>> c.p = 'mx.example.org'
>>> c.r = 'example.com'
>>> c.cidrmatch(['192.0.2.3'],32)
True
>>> c.cidrmatch(['192.0.2.2'],32)
False
>>> c.cidrmatch(['192.0.2.2'],31)
True
>>> six = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='2001:0db8:0:0:0:0:0:0001')
>>> six.p = 'mx.example.org'
>>> six.r = 'example.com'
>>> six.cidrmatch(['2001:0DB8::'],127)
True
>>> six.cidrmatch(['2001:0DB8::'],128)
False
>>> six.cidrmatch(['2001:0DB8:0:0:0:0:0:0001'],128)
True
c S s g | ]}t �|��qS r )r� Z
ip_networkr r r r r � r� z#query.cidrmatch.<locals>.<listcomp>)Z
new_prefixTc S s g | ]}t j|d d��qS )F)r# )r� Z IPNetworkr r r r r � r� NF)
Zsupernetr� r� �bool� __contains__r� r� r/ rT r" r� rh r )r] Zipaddrs�nZnetwrkZnetworkr$ r r r r� s s,
"zquery.cidrmatchc C s� ddl }d�dd� |�d�D ��}|j�|�}|jD ]h}|jdkr4|j| _|j | _ |j
d j dkr~|j
d j | _
|j
d j | _|j
d j d kr4|j
d j | _q4dS )
ac Set SPF values from RFC 5451 Authentication Results header.
Useful when SPF has already been run on a trusted gateway machine.
Expects the entire header as an input.
Examples:
>>> q = query('192.0.2.3','strong-bad@email.example.com','mx.example.org')
>>> q.mechanism = 'unknown'
>>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=neutral \n (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) \n smtp.mailfrom=email.example.com \n (sender=strong-bad@email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=?all)''')
>>> q.get_header(q.result, header_type='authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=neutral (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=email.example.com (sender=email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)'
>>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=None (mail.bmsi.com: test; client-ip=163.247.46.150) smtp.mailfrom=admin@squiebras.cl (helo=mail.squiebras.cl; receiver=mail.bmsi.com;\n mechanism=mx/24)''')
>>> q.get_header(q.result, header_type='authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=none (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=admin@squiebras.cl (sender=admin@squiebras.cl; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)'
r Nr� c s s | ]}|� � V qd S rU )�stripr� r r r � <genexpr>� r� z(query.parse_header_ar.<locals>.<genexpr>r� r rv ru )�authresr� r� �AuthenticationResultsHeader�parse�results�method� authserv_idr� r� Z
propertiesr �valuer} r9 rj )r] �valr ZarobjZresobjr r r �parse_header_ar� s
zquery.parse_header_arc C sT |� dd�}|d �� | _d| _t|�dk r0dS |d }|�d�rx|�d�}|dk rZ| jS |d|� | _||d d� }t� }|� dd | � i }|j
dd
�D ]�\}}|d kr�| � |� q�|d kr�|| _ q�|d
kr�|| _
q�|dkr�|| _q�|dkr�|| _q�|dk�r || _q�|dk�r || _q�|�d�r�|||dd� < q�t| j | j
�\| _| _|S )a� Set SPF values from Received-SPF header.
Useful when SPF has already been run on a trusted gateway machine.
Examples:
>>> q = query('0.0.0.0','','')
>>> p = q.parse_header_spf('''Pass (test) client-ip=70.98.79.77;
... envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com;
... receiver=mail.bmsi.com; mechanism=a; identity=mailfrom''')
>>> q.get_header(q.result)
'Pass (test) client-ip=70.98.79.77; envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com; receiver=mail.bmsi.com; mechanism=a; identity=mailfrom'
>>> o = q.parse_header_spf('''None (mail.bmsi.com: test)
... client-ip=163.247.46.150; envelope-from="admin@squiebras.cl";
... helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24;
... x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom''')
>>> q.get_header(q.result,**o)
'None (mail.bmsi.com: test) client-ip=163.247.46.150; envelope-from="admin@squiebras.cl"; helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24; x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom'
>>> o['bestguess']
'pass'
Nr r rL r@ �(�)z Received-SPFz; )r z client-ipz
envelope-fromru rk �problemr� �identityzx-)r� r� r� r� r� r r� �commentr Z
add_headerZ
get_paramsr� r9 rj r rZ rw rx r8 ry )r] r$ r �posrY r~ r r� r r r �parse_header_spf� s2
zquery.parse_header_spfc C s" |� d�r| �|�S | �|�S dS )a�
Set SPF values from Received-SPF or RFC 5451 Authentication Results header.
Useful when SPF has already been run on a trusted gateway machine. Auto
detects the header type and parses it. Use parse_header_spf or parse_header_ar
for each type if required.
Examples:
>>> q = query('0.0.0.0','','')
>>> p = q.parse_header('''Pass (test) client-ip=70.98.79.77;
... envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com;
... receiver=mail.bmsi.com; mechanism=a; identity=mailfrom''')
>>> q.get_header(q.result)
'Pass (test) client-ip=70.98.79.77; envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com; receiver=mail.bmsi.com; mechanism=a; identity=mailfrom'
>>> r = q.parse_header('''None (mail.bmsi.com: test)
... client-ip=163.247.46.150; envelope-from="admin@squiebras.cl";
... helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24;
... x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom''')
>>> q.get_header(q.result,**r)
'None (mail.bmsi.com: test) client-ip=163.247.46.150; envelope-from="admin@squiebras.cl"; helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24; x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom'
>>> r['bestguess']
'pass'
>>> q = query('192.0.2.3','strong-bad@email.example.com','mx.example.org')
>>> q.mechanism = 'unknown'
>>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=neutral \n (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) \n smtp.mailfrom=email.example.com \n (sender=strong-bad@email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=?all)''')
>>> q.get_header(q.result, header_type='authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=neutral (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=email.example.com (sender=email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)'
>>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=None (mail.bmsi.com: test; client-ip=163.247.46.150) smtp.mailfrom=admin@squiebras.cl (helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24)''')
>>> q.get_header(q.result, header_type='authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=none (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=admin@squiebras.cl (sender=admin@squiebras.cl; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)'
zAuthentication-Results:N)r r% r, )r] r$ r r r � parse_header� s
zquery.parse_headerr c K s� |dkr |st d��ddl}|s&| j}| j}t| j�}ddddd d
d d �} | j}
|
d
kr^d} n
t| j�} | | } |dkr�| jr�td� | j��}
nd}
t| j
�}t | d�r�| j }nd|| �
|�f }d| |f g}|dk�rhdD ],}t� | }|r�|�d|�dd�|f � q�tt|�� ��D ].\}}|�r |�d|�dd�t|�f � �q |�dd|
f � d� |�S |dk�r�| �r�t|j||j| || jd�| j| j| j| j|�d �gd ��S t|j||j| || jd �| j| j| j|�d �gd ��S nt d �|���dS )!aD
Generate Received-SPF or Authentication Results header based on the
last lookup.
>>> q = query(s='strong-bad@email.example.com', h='mx.example.org',
... i='192.0.2.3')
>>> q.r='abuse@kitterman.com'
>>> q.check(spf='v=spf1 ?all')
('neutral', 250, 'access neither permitted nor denied')
>>> q.get_header('neutral')
'Neutral (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; mechanism=?all; identity=mailfrom'
>>> q.check(spf='v=spf1 redirect=controlledmail.com exp=_exp.controlledmail.com')
('fail', 550, 'SPF fail - not authorized')
>>> q.get_header('fail')
'Fail (abuse@kitterman.com: domain of email.example.com does not designate 192.0.2.3 as permitted sender) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; mechanism=-all; identity=mailfrom'
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ?all moo')
('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo')
>>> q.get_header('permerror')
'PermError (abuse@kitterman.com: permanent error in processing domain of email.example.com: Unknown mechanism found) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; problem=moo; identity=mailfrom'
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ~all')
('pass', 250, 'sender SPF authorized')
>>> q.get_header('pass')
'Pass (abuse@kitterman.com: domain of email.example.com designates 192.0.2.3 as permitted sender) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; mechanism="ip4:192.0.0.0/8"; identity=mailfrom'
>>> q.check(spf='v=spf1 ?all')
('neutral', 250, 'access neither permitted nor denied')
>>> q.get_header('neutral', header_type = 'authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=neutral (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=email.example.com (sender=strong-bad@email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=?all)'
>>> p = query(s='strong-bad@email.example.com', h='mx.example.org',
... i='192.0.2.3')
>>> p.r='abuse@kitterman.com'
>>> p.check(spf='v=spf1 redirect=controlledmail.com exp=_exp.controlledmail.com')
('fail', 550, 'SPF fail - not authorized')
>>> p.ident = 'helo'
>>> p.get_header('fail', header_type = 'authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=fail (abuse@kitterman.com: domain of email.example.com does not designate 192.0.2.3 as permitted sender) smtp.helo=mx.example.org (sender=strong-bad@email.example.com; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=-all)'
>>> q.check(spf='v=spf1 ?all')
('neutral', 250, 'access neither permitted nor denied')
>>> try: q.get_header('neutral', header_type = 'dkim')
... except SyntaxError as x: print(x)
Unknown results header type: dkim
r zKauthserv-id missing for Authentication Results header type, see RFC5451 2.3r NZPassZNeutralZFailZSoftFail�Noner rh )r: r< r; r= r@ r? r> ru r> r� r* r_ z%s (%s)r )� client_ip�
envelope_fromru rk r( r� z%s=%s;rq rE zx-%s=%s;z%s=%sr) z@sender={0}; helo={1}; client-ip={2}; receiver={3}; mechanism={4})r� �result_commentZ
smtp_mailfromZsmtp_mailfrom_comment)r" r z6sender={0}; client-ip={1}; receiver={2}; mechanism={3})r� r1 Z smtp_heloZsmtp_helo_commentz Unknown results header type: {0})� SyntaxErrorr r r� � quote_valuerj rw r9 rZ r� r� �hasattrr* �get_header_comment�localsr/ r� �sortedr� �itemsr r ZSPFAuthenticationResultr} �format)r] rp rk Z header_typeZaidZkvr r/ ru Zresmapr) r0 �tagr( r� r* r r� r r r �
get_header sh 1
�
(
���
���
zquery.get_headerc C s� | j }|dkr d|| jf S |dkr2d|| jf S |dkrHd| j|f S |dkr^d| j|f S |dkrtd || jf S |d
kr�d | S |d kr�d
|| jf S td| ��dS )z)Return comment for Received-SPF header. r: z.domain of %s designates %s as permitted senderr= zDtransitioning domain of %s does not designate %s as permitted senderr< z2%s is neither permitted nor denied by domain of %sr@ r> z.permanent error in processing domain of %s: %sr? z1temporary error in processing during lookup of %sr; z6domain of %s does not designate %s as permitted senderz'invalid SPF result for header comment: N)ry r� r� r� )r] rp Zsenderr r r r5 � sF �������������zquery.get_header_comment)N)T)r+ F)r' )NF)Nr N)$rd re rf rg �MAX_PER_LOOKUP_TIMErX r� r� r� r� r� � DEFAULT_SPFr� ro r� r� r� r� r� r� r� r� r� r� r� r� r� r r r- r� r% r, r- r; r5 r r r r r. ^ sX �
1(
p " ,
9
�
Q7!/%
ir. c C sL | s d|fS | � dd�}|d dkr,d|d< t|�dkr@t|�S d| fS dS )at Given a sender email s and a HELO domain h, create a valid tuple
(l, d) local-part and domain-part.
Examples:
>>> split_email('', 'wayforward.net')
('postmaster', 'wayforward.net')
>>> split_email('foo.com', 'wayforward.net')
('postmaster', 'foo.com')
>>> split_email('terry@wayforward.net', 'optsw.com')
('terry', 'wayforward.net')
Z
postmaster�@r r rJ rL N)r� r� �tuple)r9 rj �partsr r r rx � s rx c C s: | du st �| �r| S d| �dd��dd��dd� d S )a Quote the value for a key-value pair in Received-SPF header field
if needed. No quoting needed for a dot-atom value.
Examples:
>>> quote_value('foo@bar.com')
'"foo@bar.com"'
>>> quote_value('mail.example.com')
'mail.example.com'
>>> quote_value('A:1.2.3.4')
'"A:1.2.3.4"'
>>> quote_value('abc"def')
'"abc\\"def"'
>>> quote_value(r'abc\def')
'"abc\\\\def"'
>>> quote_value('abc..def')
'"abc..def"'
>>> quote_value('')
'""'
>>> quote_value(None)
N�"�\z\\z\"� z\x00)� RE_DOT_ATOMr� r� �r9 r r r r3 � s ��r3 c C s� t �| �}t|�dkr.|d t|d � } }nd}t�| �}t|�dkr`|d t|d � } }nd}| �dd�}t|�dk r�| �� } | dkr�d}| |||fS |d �� |d ||fS )a� Breaks A, MX, IP4, and PTR mechanisms into a (name, domain,
cidr,cidr6) tuple. The domain portion defaults to d if not present,
the cidr defaults to 32 if not present.
Examples:
>>> parse_mechanism('a', 'foo.com')
('a', 'foo.com', None, None)
>>> parse_mechanism('exists','foo.com')
('exists', None, None, None)
>>> parse_mechanism('a:bar.com', 'foo.com')
('a', 'bar.com', None, None)
>>> parse_mechanism('a/24', 'foo.com')
('a', 'foo.com', 24, None)
>>> parse_mechanism('A:foo:bar.com/16//48', 'foo.com')
('a', 'foo:bar.com', 16, 48)
>>> parse_mechanism('-exists:%{i}.%{s1}.100/86400.rate.%{d}','foo.com')
('-exists', '%{i}.%{s1}.100/86400.rate.%{d}', None, None)
>>> parse_mechanism('mx:%%%_/.Claranet.de/27','foo.com')
('mx', '%%%_/.Claranet.de', 27, None)
>>> parse_mechanism('mx:%{d}//97','foo.com')
('mx', '%{d}', None, 97)
>>> parse_mechanism('iP4:192.0.0.0/8','foo.com')
('ip4', '192.0.0.0', 8, None)
r r r Nr� rL rO )� RE_DUAL_CIDRr� r� rz �RE_CIDRr� )r r} r Zcidr6Zcidrr r r r� � s "
r� c C s | � d�}|�� d�|�S )z�Reverse dotted IP addresses or domain names.
Example:
>>> reverse_dots('192.168.0.145')
'145.0.168.192'
>>> reverse_dots('email.example.com')
'com.example.email'
r7 )r� �reverser� )r r r r r r s
r c C s: |� � }| D ](}|� � }||ks.|�d| �r dS q dS )a grep for a given domain suffix against a list of validated PTR
domain names.
Examples:
>>> domainmatch(['FOO.COM'], 'foo.com')
1
>>> domainmatch(['moo.foo.com'], 'FOO.COM')
1
>>> domainmatch(['moo.bar.com'], 'foo.com')
0
r7 TF)r� r� )ZptrsZ domainsuffixrN r r r r� s r� c C sh |s| S t �|�dd� \}}}|s(d}t| ||�} |r@| �� |r^| t|� d d d � } d�| �S )Nr r5 r7 rL rJ )�RE_ARGSr� rH rz r� )r� r �joinerZlnrH �
delimitersr r r r� 6 s r� c C s\ g d }}| D ]>}||v rD|� |� d}|r8|� |� qL|� |� q||7 }q|� |� |S )a� Split a string into pieces by a set of delimiter characters. The
resulting list is delimited by joiner, or the original delimiter if
joiner is not specified.
Examples:
>>> split('192.168.0.45', '.')
['192', '.', '168', '.', '0', '.', '45']
>>> split('terry@wayforward.net', '@.')
['terry', '@', 'wayforward', '.', 'net']
>>> split('terry@wayforward.net', '@.', '.')
['terry', '.', 'wayforward', '.', 'net']
rJ )r/ )r rK rJ r� �elementr� r r r r� A s
r� c C sv |s| S | � � dd� }|rn|�� |D ]@}t�|d �s(|�|�}|g|||�< |�� d�|�} qnq(| S d| S )a� Returns spftxt with local inserted just before last non-fail
mechanism. This is how the libspf{2} libraries handle "local-policy".
Examples:
>>> insert_libspf_local_policy('v=spf1 -all')
'v=spf1 -all'
>>> insert_libspf_local_policy('v=spf1 -all','mx')
'v=spf1 -all'
>>> insert_libspf_local_policy('v=spf1','a mx ptr')
'v=spf1 a mx ptr'
>>> insert_libspf_local_policy('v=spf1 mx -all','a ptr')
'v=spf1 mx a ptr -all'
>>> insert_libspf_local_policy('v=spf1 mx -include:foo.co +all','a ptr')
'v=spf1 mx a ptr -include:foo.co +all'
# FIXME: is this right? If so, "last non-fail" is a bogus description.
>>> insert_libspf_local_policy('v=spf1 mx ?include:foo.co +all','a ptr')
'v=spf1 mx a ptr ?include:foo.co +all'
>>> spf='v=spf1 ip4:1.2.3.4 -a:example.net -all'
>>> local='ip4:192.0.2.3 a:example.org'
>>> insert_libspf_local_policy(spf,local)
'v=spf1 ip4:1.2.3.4 ip4:192.0.2.3 a:example.org -a:example.net -all'
r Nr r� zv=spf1 )r� rH r� r� r� r� )ZspftxtrA r rZ �wherer r r r� ^ s
r� c C s2 z | � d�W S ty, tdt| ���Y n0 dS �z*Raise PermError if arg is not 7-bit ascii.�asciizNon-ascii characters foundN)r� r rh �reprrE r r r r� � s r� c C s2 z | � d�W S ty, tdt| ���Y n0 dS rN )�decoder rh rP rE r r r r� � s c C s dd l } dd l}| �|�S )Nr )�doctestr Ztestmod)rR r r r r �_test� s rS �__main__r zhvs:)�helprl r# )z-vz --verbose)z-sz--strict)z-hz--helpz 127.0.0.1Z localhostrI )ri r9 rj rk zTemporary DNS error: z PermError: r )ri r9 rj rk rl r# zresult:zguessed:zlax:)ri r9 rj rk r# rl )Tr )Tr& )NNF)N)N){Z
__future__r �
__author__Z __email__� __version__ZMODULEZUSAGE�re�sysr� �structr{ � urllib.parser r� Zurllib� functoolsr Z
email.messager � ImportErrorZ
email.Messager� r� r r r� r� r% r3 r- Z dns.resolverZ
dns.exceptionr4 Z rdatatyper, Z_by_textr r �TypeZtypemapZLibZ
RRunpackerZ
getTXTdataZ
getSPFdataZDiscoverNameServers�compile�
IGNORECASEr� r� ZPAT_CHARr� r� rI rF rG r� ZPAT_IP4r� r� rD r� r� r� r� r� r= ZTRUSTED_FORWARDERSr� r r r r� r< r r� r� rW r r rh rs ro �objectr. rx r3 r� r r� r� r� r� � version_infor� rS rd �getopt�argvZopts� GetoptError�err�exitrl r# ry r rz r� Z gethostname�qr� r$ ri r9 rj r r� r� r� r[ r� rT r r r r �<module> s� +
!
����
�� �
��
�
O!4
3
�
� $
�
�