Merge branch 'devel' into HEAD

2025-12-11 01:30:19 +00:00 · 2023-06-07 21:25:16 +02:00 · 2023-06-07 21:25:16 +02:00 · 07cf514a9f
commit 07cf514a9f
parent 915ae8a271 abaadbc778
17 changed files with 489 additions and 132 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,15 @@
+venv/
+
+*.pyc
+__pycache__/
+
+instance/
+
+.pytest_cache/
+.coverage
+htmlcov/
+
+dist/
+build/
+*.egg-info/
+
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@ -0,0 +1,4 @@
+{
+    "python.linting.pylintEnabled": true,
+    "python.linting.enabled": true
+}
--- a/1
+++ b/1
@ -1 +0,0 @@
-debian
--- a/1
+++ b/1
@ -1 +0,0 @@
-docker/debian/Dockerfile
--- a/OCI/Dockerfile
+++ b/OCI/Dockerfile
@ -0,0 +1,26 @@
+ARG PARENT_IMAGE=alpine:3.17
+FROM ${PARENT_IMAGE}
+LABEL maintainer="Dominik Chilla <dominik@zwackl.de>"
+LABEL git_repo="https://github.com/chillout2k/sos-milter"
+
+ADD ./requirements.txt /requirements.txt
+
+RUN apk update \
+  && apk add --no-cache python3 python3-dev py3-pip \
+      gcc libc-dev libmilter-dev \
+  && pip3 install -r requirements.txt \
+  && apk del gcc libc-dev libmilter-dev python3-dev py3-pip \
+  && apk add libmilter \
+  && adduser -D sos-milter \
+  && install -d -o sos-milter /socket \
+  && rm -rf /var/cache/apk/* /requirements.txt
+
+ADD ./app/ /app/
+ADD ./OCI/cmd /cmd
+RUN chown -R sos-milter /app /cmd \
+  && chmod -R +x /app /cmd
+
+VOLUME [ "/socket" ]
+
+USER sos-milter
+CMD [ "/cmd" ]
--- a/OCI/README.md
+++ b/OCI/README.md
@ -0,0 +1,11 @@
+# OCI
+**Note:** You need to be in the root path of the repo!
+
+Build local docker image:
+```
+$ docker build -t sos-milter:local -f OCI/Dockerfile .
+```
+Run it (with default ENV-values!):
+```
+$ docker run -d sos-milter:local
+```
--- a/entrypoint.sh
+++ b/entrypoint.sh
--- a/README.md
+++ b/README.md
@ -18,15 +18,36 @@ services:
    image: "sos-milter/debian:19.06_master"
    restart: unless-stopped
    environment:
+      # default: info, possible: info, warning, error, debug
      LOG_LEVEL: debug
      # default: test, possible: test,reject
      MILTER_MODE: reject
+      # Default: sos-milter
      MILTER_NAME: sos-milter
-      #MILTER_SOCKET: inet6:8020
-      #MILTER_REJECT_MESSAGE: Message rejected due to security policy violation!
-      #MILTER_TMPFAIL_MESSAGE: Message temporary rejected. Please try again later ;)
+      # Default socket /socket/${MILTER_NAME}
+      # MILTER_SOCKET: inet6:8020
+      # MILTER_REJECT_MESSAGE: Message rejected due to security policy violation!
+      # MILTER_TMPFAIL_MESSAGE: Message temporary rejected. Please try again later ;)
+
+      # Expected Content of the spf-record, like a specific include
+      # docker-compose pitfall: Dollar-sign ($) must be escaped as $$
      SPF_REGEX: '^.*include:secure-mailgate\.com.*$$'
+
+      # If next-hop relay is one of the following, message will be ignored
      IGNORED_NEXT_HOPS: 'some-mailrelay.xyz:123, another.relay, and.so.on:125'
+
+      # Search for sender domain in LDAP. Can be used to mark (add header)
+      # and identify (log) internal sender domains with broken SPF-records
+      # for further processing (log report or header-based routing).
+      # After a message was marked with an additional header, it can be
+      # routed other than usual (e.g. through a bounce-/fwd-relay)
+      LDAP_ENABLED: 'some_value'
+      LDAP_SERVER_URI: 'ldaps://some.ldap.server'
+      LDAP_BINDDN: 'some-ldap-user-dn'
+      LDAP_BINDPW: 'some-secret-pw'
+      LDAP_SEARCH_BASE: 'ou=domains,dc=SLD,dc=TLD'
+      # %d will be replaced by recognized 5321.env_from_domain
+      LDAP_QUERY_FILTER: '(dc=%d)'
    hostname: sos-milter
    volumes:
    - "sosm_socket:/socket/:rw"
--- a/1
+++ b/1
@ -1 +0,0 @@
-20.02
--- a/app/sos-milter.py
+++ b/app/sos-milter.py
@ -7,37 +7,45 @@ import string
 import random
 import re
 import dns.resolver
-from timeit import default_timer as timer
-import pprint
+from ldap3 import (
+  Server, Connection, NONE, set_config_parameter
+)
+from ldap3.core.exceptions import LDAPException

 # Globals with mostly senseless defaults ;)
 g_milter_name = 'sos-milter'
 g_milter_socket = '/socket/' + g_milter_name
 g_milter_reject_message = 'Security policy violation!'
 g_milter_tmpfail_message = 'Service temporarily not available! Please try again later.'
-g_re_domain = re.compile(r'^\S*@(\S+)$', re.IGNORECASE)
+g_re_domain = re.compile(r'^.*@(\S+)$', re.IGNORECASE)
 g_re_spf_regex = re.compile(r'.*', re.IGNORECASE)
-g_re_expected_txt_data = ''
 g_loglevel = logging.INFO
 g_milter_mode = 'test'
 g_ignored_next_hops = {}
+g_ldap_conn = None
+g_ldap_binddn = ''
+g_ldap_bindpw = ''

 class SOSMilter(Milter.Base):
  # Each new connection is handled in an own thread
  def __init__(self):
-    self.time_start = timer()
-    self.null_sender = False
+    self.reset()
+
+  def reset(self):
+    self.client_ip = None
+    self.is_null_sender = False
    self.env_from = None
    self.env_from_domain = None
+    self.is_env_from_domain_in_ldap = False
    self.spf_record = None
-    self.add_header = False
    self.queue_id = None
    self.next_hop = None
-    
    # https://stackoverflow.com/a/2257449
    self.mconn_id = g_milter_name + ': ' + ''.join(
      random.choice(string.ascii_lowercase + string.digits) for _ in range(8)
    )
+    logging.debug(self.mconn_id + " RESET")
+
  # Not registered/used callbacks
  @Milter.nocallback
  def connect(self, IPname, family, hostaddr):
@ -46,6 +54,9 @@ class SOSMilter(Milter.Base):
  def hello(self, heloname):
    return Milter.CONTINUE
  @Milter.nocallback
+  def data(self):
+    return Milter.CONTINUE
+  @Milter.nocallback
  def header(self, name, hval):
    return Milter.CONTINUE
  @Milter.nocallback
@ -56,10 +67,22 @@ class SOSMilter(Milter.Base):
    return Milter.CONTINUE

  def envfrom(self, mailfrom, *str):
+    # Instance member values remain within reused SMTP-connections!
+    if self.client_ip is not None:
+      # Milter connection reused!
+      logging.debug(self.mconn_id + "/FROM connection reused!")
+      self.reset()
+    self.client_ip = self.getsymval('{client_addr}')
+    if self.client_ip is None:
+      logging.error(self.mconn_id + " FROM exception: could not retrieve milter-macro ({client_addr})!")
+      self.setreply('450','4.7.1', g_milter_tmpfail_message)
+      return Milter.TEMPFAIL
+    else:
+      logging.debug(self.mconn_id + "/FROM client_ip={0}".format(self.client_ip))
    try:
      # DSNs/bounces are not relevant
      if(mailfrom == '<>'):
-        self.null_sender = True
+        self.is_null_sender = True
        return Milter.CONTINUE
      mailfrom = mailfrom.replace("<","")
      mailfrom = mailfrom.replace(">","")
@ -69,115 +92,186 @@ class SOSMilter(Milter.Base):
        logging.error(self.mconn_id + "/FROM " +
          "Could not determine domain of 5321.from=" + self.env_from
        )
-        self.setreply('450','4.7.1', g_milter_tmpfail_message)
-        return Milter.TEMPFAIL
+        self.is_null_sender = True
+        return Milter.CONTINUE
      self.env_from_domain = m.group(1)
      logging.debug(self.mconn_id +
-        "/FROM 5321.from-domain=" + self.env_from_domain
+        "/FROM 5321_from_domain=" + self.env_from_domain
      )
-      # Get TXT record of sender domain
-      dns_response = None
-      try:
-        dns_response = dns.resolver.query(self.env_from_domain, 'TXT')
-      except dns.resolver.NoAnswer as e:
-        logging.error(self.mconn_id + 
-          " /FROM " + e.msg
-        )
-        # accept message if DNS-resolver fails
-        return Milter.CONTINUE
-      except dns.resolver.NXDOMAIN as e:
-        logging.error(self.mconn_id + 
-          " /FROM " + e.msg
-        )
-        # accept message if DNS-resolver fails
-        return Milter.CONTINUE
-      except:
-        logging.error(self.mconn_id + " DNS-Resolver-EXCEPTION: " + traceback.format_exc())
-        # accept message if DNS-resolver fails
-        return Milter.CONTINUE
-      for rdata in dns_response:
-        if re.match(r'^"v=spf1.*"$', rdata.to_text(), re.IGNORECASE):
-          # we´ve got a SPF match!
-          self.spf_record = rdata.to_text() 
-          break 
+      # Check if env_from_domain is in ldap
+      if(g_ldap_conn is not None):
+        filter = os.environ['LDAP_QUERY_FILTER']
+        filter = filter.replace("%d", self.env_from_domain)
+        try:
+          g_ldap_conn.search(os.environ['LDAP_SEARCH_BASE'],
+            filter,
+            attributes=[]
+          )
+          if len(g_ldap_conn.entries) != 0:
+            self.is_env_from_domain_in_ldap = True
+            logging.info(self.mconn_id + 
+              "/FROM Domain {0} found in LDAP".format(self.env_from_domain)
+            )
+        except LDAPException:
+          logging.error(self.mconn_id + "/FROM " + traceback.format_exc())
+        
+      # Get TXT-SPF record of sender domain
+      self.spf_record = self.get_spf_record(self.env_from_domain)
      return Milter.CONTINUE
    except:
-      logging.error(self.mconn_id + " FROM-EXCEPTION: " + traceback.format_exc())
+      logging.error(self.mconn_id + 
+        " FROM-EXCEPTION: " + traceback.format_exc()
+      )
      self.setreply('450','4.7.1', g_milter_tmpfail_message)
      return Milter.TEMPFAIL

  def envrcpt(self, to, *str):
-    if self.null_sender == True:
+    if self.is_null_sender == True:
      return Milter.CONTINUE
-    try:
-      self.next_hop = self.getsymval('{rcpt_host}')
-    except:
-      logging.error(self.mconn_id + "RCPT exception: " + traceback.format_exc())
-      sys.exit(1)
+    self.next_hop = self.getsymval('{rcpt_host}')
+    if self.next_hop is None:
+      logging.error(self.mconn_id + 
+        "RCPT exception: could not retrieve milter-macro ({rcpt_host})"
+      )
+    else:
+      logging.debug(self.mconn_id +
+        "/RCPT Next-Hop: {0}".format(self.next_hop)
+      )
    return Milter.CONTINUE

-  def data(self):
+  # EOM is not optional and thus, always called by MTA
+  def eom(self):
    # A queue-id will be generated after the first accepted RCPT TO
    # and therefore not available until DATA command
    self.queue_id = self.getsymval('i')
-    if self.null_sender:
+    if self.queue_id is None:
+      logging.error(self.mconn_id +
+        "EOM exception: could not retrieve milter-macro (i)!"
+      )
+      self.setreply('450','4.7.1', g_milter_tmpfail_message)
+      return Milter.TEMPFAIL
+    else:
+      logging.debug(self.mconn_id + 
+        "/EOM Queue-ID: {0}".format(self.queue_id)
+      )
+
+    if self.is_null_sender:
      logging.info(self.mconn_id + '/' + self.queue_id + 
-        "/DATA Skipping bounce/DSN message"
+        "/EOM Skipping bounce/DSN message"
      )
      return Milter.CONTINUE
    if self.spf_record is not None:
-      logging.info(self.mconn_id + '/' + self.queue_id + "/DATA " +
-        "SPFv1: " + self.spf_record
+      logging.info(self.mconn_id + 
+        '/' + self.queue_id + "/EOM " +
+        "SPFv1: " + str(self.spf_record)
      )
-      logging.debug(self.mconn_id + '/' + self.queue_id + "/DATA " + 
-        "next-hop=" + self.next_hop
+      logging.debug(self.mconn_id + 
+        '/' + self.queue_id + "/EOM " + 
+        "next-hop=" + str(self.next_hop)
      )
      if re.match(r'^".+-all"$', self.spf_record, re.IGNORECASE) is not None:
        # SPF record is in restrictive mode
+        logging.debug(self.mconn_id + '/' + self.queue_id + "/EOM " +
+          "SPF-record is signaling a FAIL-policy (-all)"
+        )
        if g_re_spf_regex.match(self.spf_record) is not None:
-          logging.debug(self.mconn_id + '/' + self.queue_id + "/DATA" +
-            " SPF-record of 5321.from-domain=" + self.env_from_domain +
+          logging.debug(self.mconn_id + '/' + self.queue_id + "/EOM" +
+            " SPF-record of 5321_from_domain=" + self.env_from_domain +
            " permits us to relay this message"
          )
        else:
          # Expected 'include' not found in SPF-record
          if self.next_hop in g_ignored_next_hops:
-            logging.info(self.mconn_id + '/' + self.queue_id + "/DATA " + 
+            logging.info(self.mconn_id + 
+              '/' + self.queue_id + "/EOM " + 
              "Passing message due to ignored next-hop=" + self.next_hop
            )
            return Milter.CONTINUE
-          ex = "Restrictive SPF-record (-all) of 5321.from-domain=" + self.env_from_domain + " does not permit us to relay this message!"
-          if g_milter_mode == 'test':
-            logging.info(self.mconn_id + '/' + self.queue_id + "/DATA " + ex)
-            logging.debug(self.mconn_id + '/' + self.queue_id + "/DATA " +
-              'test-mode: X-SOS-Milter header will be added. '
+          if self.is_env_from_domain_in_ldap and g_milter_mode != 'reject':
+            logging.info(self.mconn_id + 
+              '/' + self.queue_id + "/EOM " + 
+              "5321_from_domain={0} (LDAP) has a broken SPF-record!".format(self.env_from_domain)
            )
-            self.add_header = True
-          else: 
-            logging.error(self.mconn_id + '/' + self.queue_id + "/DATA " + ex)
+            try:
+              self.addheader('X-SOS-Milter', 'failed SPF-expectation')
+              logging.debug(self.mconn_id + '/' 
+                + self.queue_id + "/EOM " +
+                'test-mode: X-SOS-Milter header was added. '
+              )
+            except:
+              logging.error(self.mconn_id + 
+                '/' + self.queue_id + "/EOM " + 
+                "addheader() failed: " + traceback.format_exc()
+              )
+          ex = str(
+            "SPF-record (-all) of 5321_from_domain=" 
+            + self.env_from_domain + " does not permit us to relay this message!"
+          )
+          logging.info(self.mconn_id + '/' + self.queue_id + "/EOM " +
+            "mode=" + g_milter_mode + ' client=' + self.client_ip + ' ' + ex
+          )
+          if g_milter_mode == 'reject': 
            self.setreply('550','5.7.1',
              self.mconn_id + ' ' + ex + ' ' + g_milter_reject_message
            )
            return Milter.REJECT
-    return Milter.CONTINUE
-
-  def eom(self):
-    # EOM is not optional and thus, always called by MTA
-    if self.add_header == True:
-      self.addheader(
-        'X-SOS-Milter',
-        self.mconn_id + ' ' + self.env_from_domain + ': failed SPF-expectation'
+    else:
+      logging.debug(self.mconn_id + 
+        '/' + self.queue_id + "/EOM " +
+        "No SPF-record found for {0}".format(self.env_from_domain)
      )
    return Milter.CONTINUE

  def abort(self):
    # Client disconnected prematurely
+    logging.debug(self.mconn_id + "/ABORT")
    return Milter.CONTINUE

  def close(self):
    # Always called, even when abort is called.
    # Clean up any external resources here.
+    logging.debug(self.mconn_id + "/CLOSE")
    return Milter.CONTINUE
+  
+  def get_spf_record(self, from_domain):
+    dns_response = None
+    try:
+      dns_response = dns.resolver.resolve(from_domain, 'TXT')
+    except dns.resolver.NoAnswer as e:
+      logging.warning(self.mconn_id + "/DNS " + e.msg)
+      # accept message if DNS-resolver fails
+      return None
+    except dns.resolver.NXDOMAIN as e:
+      logging.warning(self.mconn_id + 
+        " /DNS " + e.msg
+      )
+      # accept message if DNS-resolver fails
+      return None
+    except:
+      logging.error(self.mconn_id + 
+        "/DNS Resolver-EXCEPTION: " + traceback.format_exc()
+      )
+      # accept message if DNS-resolver fails
+      return None
+    for rdata in dns_response:
+      if re.match(r'^"v=spf1.*"$', rdata.to_text(), re.IGNORECASE):
+        # we´ve got a SPF match!
+        logging.debug(self.mconn_id + "/DNS SPFv1: {0}".format(rdata.to_text()))
+        # check if spf-record includes a redirect!?
+        m = re.match(
+          r'^.*redirect=(?P<redirect_domain>.+).*"', 
+          rdata.to_text(), 
+          re.IGNORECASE
+        )
+        if m is not None:
+          # SPF redirect clause found
+          spf_redirect_domain = m.group('redirect_domain')
+          logging.info(self.mconn_id + 
+            "/DNS SPF-redirect: {}".format(spf_redirect_domain)
+          )
+          return self.get_spf_record(spf_redirect_domain)
+        else:
+          return rdata.to_text()

 if __name__ == "__main__":
  if 'LOG_LEVEL' in os.environ:
@ -216,10 +310,45 @@ if __name__ == "__main__":
      tmp_hops = os.environ['IGNORED_NEXT_HOPS'].split(',')
      for next_hop in tmp_hops:
        g_ignored_next_hops[next_hop] = 'ignore'
-      logging.error("next-hops: " + str(g_ignored_next_hops))
+      logging.debug("next-hops: " + str(g_ignored_next_hops))
    except:
      logging.error("ENV[IGNORED_NEXT_HOPS] exception: " + traceback.format_exc())
      sys.exit(1)
+  if 'LDAP_ENABLED' in os.environ:
+    if 'LDAP_SERVER_URI' not in os.environ:
+      logging.error("ENV[LDAP_SERVER_URI] is mandatory!")
+      sys.exit(1)
+    if 'LDAP_BINDDN' not in os.environ:
+      logging.info("ENV[LDAP_BINDDN] not set! Continue...")
+    else:
+      g_ldap_binddn = os.environ['LDAP_BINDDN']
+    if 'LDAP_BINDPW' not in os.environ:
+      logging.info("ENV[LDAP_BINDPW] not set! Continue...")
+    else:
+      g_ldap_bindpw = os.environ['LDAP_BINDPW']
+    if 'LDAP_SEARCH_BASE' not in os.environ:
+      logging.error("ENV[LDAP_SEARCH_BASE] is mandatory!")
+      sys.exit(1)
+    if 'LDAP_QUERY_FILTER' not in os.environ:
+      logging.error("ENV[LDAP_QUERY_FILTER] is mandatory!")
+      sys.exit(1)
+    try:
+      set_config_parameter("RESTARTABLE_SLEEPTIME", 2)
+      set_config_parameter("RESTARTABLE_TRIES", 2)
+      set_config_parameter('DEFAULT_SERVER_ENCODING', 'utf-8')
+      set_config_parameter('DEFAULT_CLIENT_ENCODING', 'utf-8')
+      server = Server(os.environ['LDAP_SERVER_URI'], get_info=NONE)
+      g_ldap_conn = Connection(server,
+        g_ldap_binddn,
+        g_ldap_bindpw,
+        auto_bind=True, 
+        raise_exceptions=True,
+        client_strategy='RESTARTABLE'
+      )
+      logging.info("LDAP-Connection established. PID: " + str(os.getpid()))
+    except LDAPException as e:
+      print("LDAP-Exception: " + traceback.format_exc())
+      sys.exit(1)
      
  try:
    timeout = 600
@ -235,4 +364,4 @@ if __name__ == "__main__":
    Milter.runmilter(g_milter_name,g_milter_socket,timeout,True)
    logging.info("Shutdown " + g_milter_name)
  except:
-    logging.error("MAIN-EXCEPTION: " + traceback.format_exc())
+    logging.error("MAIN-EXCEPTION: " + traceback.format_exc())
--- a/docker-build.sh
+++ b/docker-build.sh
@ -1,28 +0,0 @@
-#!/bin/sh
-
-BRANCH="$(/usr/bin/git branch|/bin/grep \*|/usr/bin/awk {'print $2'})"
-VERSION="$(/bin/cat VERSION)"
-BASEOS="$(/bin/cat BASEOS)"
-GO=""
-
-while getopts g opt
-do
-  case $opt in
-    g) GO="go";;
-  esac
-done
-
-if [ -z "${GO}" ] ; then
-  echo "Building sos-milter@docker on '${BASEOS}' for version '${VERSION}' in branch '${BRANCH}'!"
-  echo "GO serious with '-g'!"
-  exit 1
-fi
-
-IMAGES="sos-milter"
-
-for IMAGE in ${IMAGES}; do
-  /usr/bin/docker build \
-    --pull=true \
-    -t "${IMAGE}/${BASEOS}:${VERSION}_${BRANCH}" \
-    -f "docker/${BASEOS}/Dockerfile" .
-done
--- a/docker/debian/Dockerfile
+++ b/docker/debian/Dockerfile
@ -1,26 +0,0 @@
-ARG http_proxy
-ARG https_proxy
-FROM debian
-LABEL maintainer="Dominik Chilla <dominik@zwackl.de>"
-LABEL git_repo="https://github.com/chillout2k/sos-milter"
-
-ENV DEBIAN_FRONTEND=noninteractive \
- TZ=Europe/Berlin
-
-RUN env; set -ex ; \
-    apt-get -qq update \
- && apt-get -qq --no-install-recommends install \
-     python3-pip python3-setuptools \
-     libmilter1.0.1 libmilter-dev procps net-tools \
-     gcc python3-dev netcat-traditional \
- && /usr/bin/pip3 install pymilter \
- && /usr/bin/pip3 install dnspython \
- && /bin/mkdir /config /socket /app \
- && apt-get clean \
- && rm -rf /var/lib/apt/lists/*
-
-COPY app/*.py /app/
-COPY entrypoint.sh /entrypoint.sh
-
-ENTRYPOINT ["/entrypoint.sh"]
-CMD ["/usr/bin/python3", "/app/sos-milter.py"]
--- a/requirements.txt
+++ b/requirements.txt
@ -0,0 +1,3 @@
+pymilter==1.0.5
+dnspython==2.3.0
+ldap3==2.9.1
--- a/tests/README.md
+++ b/tests/README.md
@ -0,0 +1,23 @@
+# prepare testing env
+```
+export TLD=de
+export SLD=domain
+export MILTER_MODE=reject
+export MILTER_SOCKET=inet:12345
+export LOG_LEVEL=debug
+export SPF_REGEX="^.*include:_spf\.blah\.blub.*$"
+export LDAP_ENABLED=yepp
+export LDAP_SERVER_URI="ldap://ldap-master-staging.int.${SLD}.${TLD}"
+export LDAP_SEARCH_BASE="ou=domains,dc=${SLD},dc=${TLD}"
+export LDAP_QUERY_FILTER='(dc=%d)'
+export IGNORED_NEXT_HOPS=test.next-host
+```
+
+# start milter
+`python3 app/sos-milter.py`
+
+# execute `miltertest`
+First of all install the `miltertest` binary. Under debian based distros 
+it´s located in the `opendkim-tools` package.
+
+`miltertest -v -D socket=inet:12345@127.0.0.111 -s tests/miltertest.lua`
--- a/tests/miltertest.lua
+++ b/tests/miltertest.lua
@ -0,0 +1,48 @@
+-- https://mopano.github.io/sendmail-filter-api/constant-values.html#com.sendmail.milter.MilterConstants
+-- http://www.opendkim.org/miltertest.8.html
+
+-- socket must be defined as miltertest global variable (-D)
+conn = mt.connect(socket)
+if conn == nil then
+  error "mt.connect() failed"
+end
+
+mt.set_timeout(3)
+
+-- 5321.FROM + MACROS
+mt.macro(conn, SMFIC_MAIL, '{client_addr}', "127.128.129.130")
+if mt.mailfrom(conn, "postmaster@staging.zwackl.de") ~= nil then
+  error "mt.mailfrom() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.mailfrom() unexpected reply"
+end
+
+-- 5321.RCPT + MACROS
+mt.macro(conn, SMFIC_RCPT, "i", "TestQueueId-1",'{rcpt_host}', "test.next-host")
+if mt.rcptto(conn, "some@recipient.somewhere") ~= nil then
+  error "mt.rcptto() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.rcptto() unexpected reply"
+end
+
+-- EOM
+if mt.eom(conn) ~= nil then
+  error "mt.eom() failed"
+end
+mt.echo("EOM: " .. mt.getreply(conn))
+if mt.getreply(conn) == SMFIR_CONTINUE then
+  mt.echo("EOM-continue")
+elseif mt.getreply(conn) == SMFIR_REPLYCODE then
+  mt.echo("EOM-reject")
+end
+
+if not mt.eom_check(conn, MT_HDRADD, "X-SOS-Milter") then
+  mt.echo("no header added")
+else
+  mt.echo("X-SOS-Milter header added -> LDAP-Domain with broken SPF")
+end
+
+-- DISCONNECT
+mt.disconnect(conn)
--- a/tests/miltertest_conn_reuse.lua
+++ b/tests/miltertest_conn_reuse.lua
@ -0,0 +1,85 @@
+-- https://mopano.github.io/sendmail-filter-api/constant-values.html#com.sendmail.milter.MilterConstants
+-- http://www.opendkim.org/miltertest.8.html
+
+-- socket must be defined as miltertest global variable (-D)
+conn = mt.connect(socket)
+if conn == nil then
+  error "mt.connect() failed"
+end
+
+mt.set_timeout(3)
+
+-- First message within smtp-session
+-- 5321.FROM + MACROS
+mt.macro(conn, SMFIC_MAIL, '{client_addr}', "127.128.129.130")
+if mt.mailfrom(conn, "postmaster@staging.zwackl.de") ~= nil then
+  error "mt.mailfrom() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.mailfrom() unexpected reply"
+end
+
+-- 5321.RCPT + MACROS
+mt.macro(conn, SMFIC_RCPT, "i", "TestQueueId-1",'{rcpt_host}', "test.next-host")
+if mt.rcptto(conn, "some@recipient.somewhere") ~= nil then
+  error "mt.rcptto() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.rcptto() unexpected reply"
+end
+
+-- EOM
+if mt.eom(conn) ~= nil then
+  error "mt.eom() failed"
+end
+mt.echo("EOM: " .. mt.getreply(conn))
+if mt.getreply(conn) == SMFIR_CONTINUE then
+  mt.echo("EOM-continue")
+elseif mt.getreply(conn) == SMFIR_REPLYCODE then
+  mt.echo("EOM-reject")
+end
+
+if not mt.eom_check(conn, MT_HDRADD, "X-SOS-Milter") then
+  mt.echo("no header added")
+else
+  mt.echo("X-SOS-Milter header added -> LDAP-Domain with broken SPF")
+end
+
+-- Second message
+-- 5321.FROM + MACROS
+mt.macro(conn, SMFIC_MAIL, '{client_addr}', "127.128.129.130")
+if mt.mailfrom(conn, "info@staging.zwackl.de") ~= nil then
+  error "mt.mailfrom() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.mailfrom() unexpected reply"
+end
+
+-- 5321.RCPT + MACROS
+mt.macro(conn, SMFIC_RCPT, "i", "TestQueueId-2",'{rcpt_host}', "test.next-host")
+if mt.rcptto(conn, "some@recipient.somewhere") ~= nil then
+  error "mt.rcptto() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.rcptto() unexpected reply"
+end
+
+-- EOM
+if mt.eom(conn) ~= nil then
+  error "mt.eom() failed"
+end
+mt.echo("EOM: " .. mt.getreply(conn))
+if mt.getreply(conn) == SMFIR_CONTINUE then
+  mt.echo("EOM-continue")
+elseif mt.getreply(conn) == SMFIR_REPLYCODE then
+  mt.echo("EOM-reject")
+end
+
+if not mt.eom_check(conn, MT_HDRADD, "X-SOS-Milter") then
+  mt.echo("no header added")
+else
+  mt.echo("X-SOS-Milter header added -> LDAP-Domain with broken SPF")
+end
+
+-- DISCONNECT
+mt.disconnect(conn)
--- a/tests/miltertest_redirect.lua
+++ b/tests/miltertest_redirect.lua
@ -0,0 +1,49 @@
+-- https://mopano.github.io/sendmail-filter-api/constant-values.html#com.sendmail.milter.MilterConstants
+-- http://www.opendkim.org/miltertest.8.html
+
+-- socket must be defined as miltertest global variable (-D)
+conn = mt.connect(socket)
+if conn == nil then
+  error "mt.connect() failed"
+end
+
+mt.set_timeout(3)
+
+-- First message within smtp-session
+-- 5321.FROM + MACROS
+mt.macro(conn, SMFIC_MAIL, '{client_addr}', "127.128.129.130")
+if mt.mailfrom(conn, "blubb@gmx.de") ~= nil then
+  error "mt.mailfrom() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.mailfrom() unexpected reply"
+end
+
+-- 5321.RCPT + MACROS
+mt.macro(conn, SMFIC_RCPT, "i", "TestQueueId-1",'{rcpt_host}', "test.next-hostx")
+if mt.rcptto(conn, "some@recipient.somewhere") ~= nil then
+  error "mt.rcptto() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.rcptto() unexpected reply"
+end
+
+-- EOM
+if mt.eom(conn) ~= nil then
+  error "mt.eom() failed"
+end
+mt.echo("EOM: " .. mt.getreply(conn))
+if mt.getreply(conn) == SMFIR_CONTINUE then
+  mt.echo("EOM-continue")
+elseif mt.getreply(conn) == SMFIR_REPLYCODE then
+  mt.echo("EOM-reject")
+end
+
+if not mt.eom_check(conn, MT_HDRADD, "X-SOS-Milter") then
+  mt.echo("no header added")
+else
+  mt.echo("X-SOS-Milter header added -> LDAP-Domain with broken SPF")
+end
+
+-- DISCONNECT
+mt.disconnect(conn)