README.md

@@ -86,7 +86,7 @@ X-MS-Exchange-CrossTenant-Id: <UUID-of-tenant>
 At last the **ExOTA-Milter** needs an additional policy (JSON file), that provides a mapping of *sender-domain <-> tenant-id* and if DKIM-signatures must be taken under consideration or not. The JSON policy file itself looks like this:
 ```
 {
-  "yad.onmicrosoft.com": {
+  "lalalulu.onmicrosoft.com": {
     "tenant_id": "1234abcd-18c5-45e8-88de-123456789abc",
     "dkim_enabled": true
   }
@@ -157,8 +157,6 @@ services:
       MILTER_TRUSTED_AUTHSERVID: 'my-auth-serv-id'
       MILTER_X509_ENABLED: 'some_value'
       MILTER_X509_TRUSTED_CN: 'mail.protection.outlook.com'
-      MILTER_ADD_HEADER: 'some_value'
-      MILTER_AUTHSERVID: 'my-auth-serv-id'
     volumes:
     - "./data/:/data/:ro"
     - "./socket/:/socket/:rw"

app/exota-milter.py

@@ -37,10 +37,6 @@ g_milter_policy_file = '/data/policy.json'
 g_milter_x509_enabled = False
 # ENV[MILTER_X509_TRUSTED_CN]
 g_milter_x509_trusted_cn = 'mail.protection.outlook.com'
-# ENV[MILTER_ADD_HEADER]
-g_milter_add_header = False
-# ENV[MILTER_AUTHSERVID]
-g_milter_authservid = None
 
 # Another globals
 g_policy_backend = None
@@ -67,37 +63,23 @@ class ExOTAMilter(Milter.Base):
     )
     logging.debug(self.mconn_id + " reset_milter()")
 
-  def smfir_reject(self, **kwargs):
-    message = g_milter_reject_message
-    if 'message' in kwargs:
-      message = kwargs['message']
-    self.setreply('550','5.7.1', message)
-    return Milter.REJECT
-    
-  def smfir_tmpfail(self, **kwargs):
-    message = g_milter_tmpfail_message
-    if 'message' in kwargs:
-      message = kwargs['message']
-    self.setreply('450','4.7.1', message)
-    return Milter.TEMPFAIL
-  
-  def smfir_continue(self):
-    return Milter.CONTINUE
-
   # Not registered/used callbacks
   @Milter.nocallback
   def hello(self, heloname):
-    return self.smfir_continue()
+    return Milter.CONTINUE
   @Milter.nocallback
   def eoh(self):
-    return self.smfir_continue()
+    return Milter.CONTINUE
   @Milter.nocallback
   def body(self, chunk):
-    return self.smfir_continue()
+    return Milter.CONTINUE
 
   def connect(self, IPname, family, hostaddr):
     self.client_ip = hostaddr[0]
-    return self.smfir_continue()
+    logging.debug(self.mconn_id +
+      "/CONNECT client_ip=[" + self.client_ip + "]:" + str(hostaddr[1])
+    )
+    return Milter.CONTINUE
 
   # Mandatory callback
   def envfrom(self, mailfrom, *str):
@@ -110,12 +92,12 @@ class ExOTAMilter(Milter.Base):
     else:
       self.conn_reused = True
       logging.debug(self.mconn_id + "/FROM client_ip={0}".format(self.client_ip))
-    return self.smfir_continue()
+    return Milter.CONTINUE
 
   # Mandatory callback
   def envrcpt(self, to, *str):
     logging.debug(self.mconn_id + "/RCPT 5321.rcpt={0}".format(to))
-    return self.smfir_continue()
+    return Milter.CONTINUE
 
   def header(self, name, hval):
     logging.debug(self.mconn_id + "/" + str(self.getsymval('i')) +
@@ -131,7 +113,8 @@ class ExOTAMilter(Milter.Base):
         logging.error(self.mconn_id  + "/" + str(self.getsymval('i')) + "/HDR " +
           "Could not determine domain-part of 5322.from=" + self.hdr_from
         )
-        return self.smfir_reject()
+        self.setreply('450','4.7.1', g_milter_tmpfail_message)
+        return Milter.TEMPFAIL
       self.hdr_from_domain = m.group(1)
       logging.info(self.mconn_id + "/" + str(self.getsymval('i')) +
         "/HDR: 5322.from={0}, 5322.from_domain={1}".format(
@@ -167,11 +150,11 @@ class ExOTAMilter(Milter.Base):
             logging.debug(self.mconn_id + "/" + str(self.getsymval('i')) +
               "/HDR: Ignoring authentication results of {0}".format(ar.authserv_id)
             )
-        except Exception as e:
+        except:
-          logging.info(self.mconn_id + "/" + str(self.getsymval('i')) +
+          logging.error(self.mconn_id + "/" + str(self.getsymval('i')) +
-            "/HDR: AR-parse exception: {0}".format(str(e))
+            "/HDR: AR-parse exception: " + traceback.format_exc()
           )
-    return self.smfir_continue()
+    return Milter.CONTINUE
 
   # EOM is mandatory as well and thus always called by MTA
   def eom(self):
@@ -184,7 +167,8 @@ class ExOTAMilter(Milter.Base):
         logging.info(self.mconn_id + "/" + str(self.getsymval('i')) 
           + "/EOM: No trusted x509 client CN found - action=reject"
         )
-        return self.smfir_reject()
+        self.setreply('550','5.7.1', g_milter_tmpfail_message)
+        return Milter.REJECT
       else:
         if g_milter_x509_trusted_cn.lower() == cert_subject.lower():
           self.x509_client_valid = True
@@ -195,13 +179,15 @@ class ExOTAMilter(Milter.Base):
           logging.info(self.mconn_id + "/" + str(self.getsymval('i')) +
             "/EOM Untrusted x509 client CN {0} - action=reject".format(cert_subject)
           )
-          return self.smfir_reject()
+          self.setreply('550','5.7.1', g_milter_tmpfail_message)
+          return Milter.REJECT
 
     if self.hdr_from is None:
       logging.error(self.mconn_id + "/" + str(self.getsymval('i')) +
         "/EOM exception: could not determine 5322.from header - action=reject"
       )
-      return self.smfir_reject()
+      self.setreply('550','5.7.1', g_milter_tmpfail_message)
+      return Milter.REJECT
 
     # Get policy for 5322.from_domain
     policy = None
@@ -214,20 +200,23 @@ class ExOTAMilter(Milter.Base):
       logging.info(self.mconn_id + "/" + str(self.getsymval('i')) +
         "/EOM {0}".format(e.message)
       )
-      return self.smfir_reject()
+      self.setreply('550','5.7.1', g_milter_reject_message)
+      return Milter.REJECT
 
     if self.hdr_tenant_id is None:
       logging.error(self.mconn_id + "/" + str(self.getsymval('i')) +
         "/EOM exception: could not determine X-MS-Exchange-CrossTenant-Id - action=reject"
       )
-      return self.smfir_reject()
+      self.setreply('550','5.7.1', g_milter_reject_message)
+      return Milter.REJECT
     if self.hdr_tenant_id_count > 1:
       logging.info(self.mconn_id + "/" + str(self.getsymval('i')) +
         "/EOM: More than one tenant-IDs for {0} found - action=reject".format(
           self.hdr_from_domain
         )
       )
-      return self.smfir_reject()
+      self.setreply('550','5.7.1', g_milter_reject_message)
+      return Milter.REJECT
     if self.hdr_tenant_id == policy.get_tenant_id():
       logging.info(self.mconn_id + "/" + str(self.getsymval('i')) +
         "/EOM: tenant_id={0} status=match".format(self.hdr_tenant_id)
@@ -238,7 +227,8 @@ class ExOTAMilter(Milter.Base):
           self.hdr_tenant_id
         )
       )
-      return self.smfir_reject()
+      self.setreply('550','5.7.1', g_milter_reject_message)
+      return Milter.REJECT
 
     if g_milter_dkim_enabled and policy.is_dkim_enabled():
       logging.debug(self.mconn_id + "/" + str(self.getsymval('i')) +
@@ -266,12 +256,15 @@ class ExOTAMilter(Milter.Base):
         logging.info(self.mconn_id + "/" + str(self.getsymval('i')) +
           "/EOM: No DKIM authentication results (AR headers) found - action=reject"
         )
-        return self.smfir_reject()
+        self.setreply('550','5.7.1', g_milter_reject_message)
+        return Milter.REJECT
       if self.dkim_valid == False:
         logging.info(self.mconn_id + "/" + str(self.getsymval('i')) +
           "/EOM: DKIM authentication failed - action=reject"
         )
-        return self.smfir_reject()
+        self.setreply('550','5.7.1', g_milter_reject_message)
+        return Milter.REJECT
+
     if g_milter_dkim_enabled:
       logging.info(self.mconn_id + "/" + str(self.getsymval('i')) +
         "/EOM: Tenant authentication successful (dkim_enabled={0})".format(
@@ -282,33 +275,18 @@ class ExOTAMilter(Milter.Base):
       logging.info(self.mconn_id + "/" + str(self.getsymval('i')) +
         "/EOM: Tenant successfully authenticated"
       )
-    if g_milter_add_header:
+    return Milter.CONTINUE
-      try:
-        self.addheader("X-ExOTA-Authentication-Results", 
-          "{0};\n  exota=pass header.d={1} dkim={2} x509_client_trust={3}".format(
-            g_milter_authservid, self.hdr_from_domain, policy.is_dkim_enabled(),
-            g_milter_x509_enabled
-          )
-        )
-        logging.debug(self.mconn_id + "/" + str(self.getsymval('i')) +
-        "/EOM: AR-header added"
-        )
-      except Exception as e:
-        logging.info(self.mconn_id + "/" + str(self.getsymval('i')) +
-        "/EOM: addheader(AR) failed: {0}".format(str(e))
-      )
-    return self.smfir_continue()
 
   def abort(self):
     # Client disconnected prematurely
     logging.debug(self.mconn_id + "/ABORT")
-    return self.smfir_continue()
+    return Milter.CONTINUE
 
   def close(self):
     # Always called, even when abort is called.
     # Clean up any external resources here.
     logging.debug(self.mconn_id + "/CLOSE")
-    return self.smfir_continue()
+    return Milter.CONTINUE
 
 if __name__ == "__main__":
   if 'LOG_LEVEL' in os.environ:
@@ -327,7 +305,6 @@ if __name__ == "__main__":
   )
   if 'MILTER_NAME' in os.environ:
     g_milter_name = os.environ['MILTER_NAME']
-  logging.info("ENV[MILTER_NAME]: {0}".format(g_milter_name))
   if 'MILTER_SOCKET' in os.environ:
     g_milter_socket = os.environ['MILTER_SOCKET']
   logging.info("ENV[MILTER_SOCKET]: {0}".format(g_milter_socket))
@@ -355,17 +332,6 @@ if __name__ == "__main__":
   if 'MILTER_POLICY_SOURCE' in os.environ:
     g_milter_policy_source = os.environ['MILTER_POLICY_SOURCE']
   logging.info("ENV[MILTER_POLICY_SOURCE]: {0}".format(g_milter_policy_source))
-  if 'MILTER_ADD_HEADER' in os.environ:
-    g_milter_add_header = True
-    if 'MILTER_AUTHSERVID' in os.environ:
-      g_milter_authservid = os.environ['MILTER_AUTHSERVID']
-      if not re.match(r'^\S+$', g_milter_authservid):
-        logging.error("ENV[MILTER_AUTHSERVID] is invalid: {0}".format(g_milter_authservid))
-      logging.info("ENV[MILTER_AUTHSERVID]: {0}".format(g_milter_authservid))
-    else:
-      logging.error("ENV[MILTER_AUTHSERVID] is mandatory!")
-      sys.exit(1)
-  logging.info("ENV[MILTER_ADD_HEADER]: {0}".format(g_milter_add_header))
   if g_milter_policy_source == 'file':
     if 'MILTER_POLICY_FILE' in os.environ:
       g_milter_policy_file = os.environ['MILTER_POLICY_FILE']
@@ -389,8 +355,6 @@ if __name__ == "__main__":
     timeout = 600
     # Register to have the Milter factory create instances of your class:
     Milter.factory = ExOTAMilter
-    flags = Milter.ADDHDRS
-    Milter.set_flags(flags)
     logging.info("Startup " + g_milter_name +
       "@socket: " + g_milter_socket
     )

tests/README.md

@@ -19,8 +19,6 @@ export MILTER_DKIM_ENABLED=yepp
 export MILTER_TRUSTED_AUTHSERVID=my-auth-serv-id
 export MILTER_X509_ENABLED=yepp
 export MILTER_X509_TRUSTED_CN=mail.protection.outlook.com
-export MILTER_ADD_HEADER=yepp
-export MILTER_AUTHSERVID=my-auth-serv-id
 ```
 
 # Shell-1: start ExOTA-Milter

tests/miltertest.lua

@@ -42,9 +42,6 @@ end
 if mt.header(conn, "Authentication-Results", "wrong-auth-serv-id;\n  dkim=pass header.d=yad.onmicrosoft.com header.s=selector1-yad-onmicrosoft-com header.b=mmmjFpv8") ~= nil then
   error "mt.header(Subject) failed"  
 end
-if mt.header(conn, "Authentication-Results", "my-auth-serv-id;\n  exota=pass") ~= nil then
-  error "mt.header(Subject) failed"  
-end
 if mt.header(conn, "Authentication-Results", "my-auth-serv-id;\n  dkim=pass header.d=yad.onmicrosoft.com header.s=selector1-yad-onmicrosoft-com header.b=mmmjFpv8") ~= nil then
   error "mt.header(Subject) failed"  
 end
@@ -66,10 +63,10 @@ elseif mt.getreply(conn) == SMFIR_REPLYCODE then
   mt.echo("EOM-reject")
 end
 
-if not mt.eom_check(conn, MT_HDRADD, "X-ExOTA-Authentication-Results") then
+if not mt.eom_check(conn, MT_HDRADD, "X-SOS-Milter") then
   mt.echo("no header added")
 else
-  mt.echo("X-ExOTA-Authentication-Results header added")
+  mt.echo("X-SOS-Milter header added -> LDAP-Domain with broken SPF")
 end
 
 -- DISCONNECT