SPF-redirect + refactoring + OCI@alpine

BASEOS

@@ -1 +0,0 @@
-debian

OCI/Dockerfile

@@ -0,0 +1,26 @@
+ARG PARENT_IMAGE=alpine:3.17
+FROM ${PARENT_IMAGE}
+LABEL maintainer="Dominik Chilla <dominik@zwackl.de>"
+LABEL git_repo="https://github.com/chillout2k/sos-milter"
+
+ADD ./requirements.txt /requirements.txt
+
+RUN apk update \
+  && apk add --no-cache python3 python3-dev py3-pip \
+      gcc libc-dev libmilter-dev \
+  && pip3 install -r requirements.txt \
+  && apk del gcc libc-dev libmilter-dev python3-dev py3-pip \
+  && apk add libmilter \
+  && adduser -D sos-milter \
+  && install -d -o sos-milter /socket \
+  && rm -rf /var/cache/apk/* /requirements.txt
+
+ADD ./app/ /app/
+ADD ./OCI/cmd /cmd
+RUN chown -R sos-milter /app /cmd \
+  && chmod -R +x /app /cmd
+
+VOLUME [ "/socket" ]
+
+USER sos-milter
+CMD [ "/cmd" ]

VERSION

@@ -1 +0,0 @@
-20.02

activate_venv

@@ -1,2 +0,0 @@
-. venv/bin/activate
-

app/sos-milter.py

@@ -115,35 +115,13 @@ class SOSMilter(Milter.Base):
         except LDAPException:
           logging.error(self.mconn_id + "/FROM " + traceback.format_exc())
         
-      # Get TXT record of sender domain
+      # Get TXT-SPF record of sender domain
-      dns_response = None
+      self.spf_record = self.get_spf_record(self.env_from_domain)
-      try:
-        dns_response = dns.resolver.resolve(self.env_from_domain, 'TXT')
-      except dns.resolver.NoAnswer as e:
-        logging.warning(self.mconn_id + " /FROM " + e.msg)
-        # accept message if DNS-resolver fails
-        return Milter.CONTINUE
-      except dns.resolver.NXDOMAIN as e:
-        logging.warning(self.mconn_id + 
-          " /FROM " + e.msg
-        )
-        # accept message if DNS-resolver fails
-        return Milter.CONTINUE
-      except:
-        logging.error(self.mconn_id + " DNS-Resolver-EXCEPTION: " + traceback.format_exc())
-        # accept message if DNS-resolver fails
-        return Milter.CONTINUE
-      for rdata in dns_response:
-        logging.debug(self.mconn_id + "/FROM DNS-TXT: {0}".format(rdata.to_text()))
-        if re.match(r'^"v=spf1.*"$', rdata.to_text(), re.IGNORECASE):
-          # we´ve got a SPF match!
-          self.spf_record = rdata.to_text()
-          # TODO: check if spf-record is a redirect!?
-          logging.debug(self.mconn_id + "/FROM Found SPFv1: {0}".format(self.spf_record))
-          break
       return Milter.CONTINUE
     except:
-      logging.error(self.mconn_id + " FROM-EXCEPTION: " + traceback.format_exc())
+      logging.error(self.mconn_id + 
+        " FROM-EXCEPTION: " + traceback.format_exc()
+      )
       self.setreply('450','4.7.1', g_milter_tmpfail_message)
       return Milter.TEMPFAIL
 
@@ -152,9 +130,13 @@ class SOSMilter(Milter.Base):
       return Milter.CONTINUE
     self.next_hop = self.getsymval('{rcpt_host}')
     if self.next_hop is None:
-      logging.error(self.mconn_id + "RCPT exception: could not retrieve milter-macro ({rcpt_host})")
+      logging.error(self.mconn_id + 
+        "RCPT exception: could not retrieve milter-macro ({rcpt_host})"
+      )
     else:
-      logging.debug(self.mconn_id + "/RCPT Next-Hop: {0}".format(self.next_hop))
+      logging.debug(self.mconn_id +
+        "/RCPT Next-Hop: {0}".format(self.next_hop)
+      )
     return Milter.CONTINUE
 
   # EOM is not optional and thus, always called by MTA
@@ -163,11 +145,15 @@ class SOSMilter(Milter.Base):
     # and therefore not available until DATA command
     self.queue_id = self.getsymval('i')
     if self.queue_id is None:
-      logging.error(self.mconn_id + "EOM exception: could not retrieve milter-macro (i)!")
+      logging.error(self.mconn_id +
+        "EOM exception: could not retrieve milter-macro (i)!"
+      )
       self.setreply('450','4.7.1', g_milter_tmpfail_message)
       return Milter.TEMPFAIL
     else:
-      logging.debug(self.mconn_id + "/EOM Queue-ID: {0}".format(self.queue_id))
+      logging.debug(self.mconn_id + 
+        "/EOM Queue-ID: {0}".format(self.queue_id)
+      )
 
     if self.is_null_sender:
       logging.info(self.mconn_id + '/' + self.queue_id + 
@@ -175,10 +161,12 @@ class SOSMilter(Milter.Base):
       )
       return Milter.CONTINUE
     if self.spf_record is not None:
-      logging.info(self.mconn_id + '/' + self.queue_id + "/EOM " +
+      logging.info(self.mconn_id + 
+        '/' + self.queue_id + "/EOM " +
         "SPFv1: " + str(self.spf_record)
       )
-      logging.debug(self.mconn_id + '/' + self.queue_id + "/EOM " + 
+      logging.debug(self.mconn_id + 
+        '/' + self.queue_id + "/EOM " + 
         "next-hop=" + str(self.next_hop)
       )
       if re.match(r'^".+-all"$', self.spf_record, re.IGNORECASE) is not None:
@@ -194,21 +182,25 @@ class SOSMilter(Milter.Base):
         else:
           # Expected 'include' not found in SPF-record
           if self.next_hop in g_ignored_next_hops:
-            logging.info(self.mconn_id + '/' + self.queue_id + "/EOM " + 
+            logging.info(self.mconn_id + 
+              '/' + self.queue_id + "/EOM " + 
               "Passing message due to ignored next-hop=" + self.next_hop
             )
             return Milter.CONTINUE
           if self.is_env_from_domain_in_ldap and g_milter_mode != 'reject':
-            logging.info(self.mconn_id + '/' + self.queue_id + "/EOM " + 
+            logging.info(self.mconn_id + 
+              '/' + self.queue_id + "/EOM " + 
               "5321_from_domain={0} (LDAP) has a broken SPF-record!".format(self.env_from_domain)
             )
             try:
               self.addheader('X-SOS-Milter', 'failed SPF-expectation')
-              logging.debug(self.mconn_id + '/' + self.queue_id + "/EOM " +
+              logging.debug(self.mconn_id + '/' 
+                + self.queue_id + "/EOM " +
                 'test-mode: X-SOS-Milter header was added. '
               )
             except:
-              logging.error(self.mconn_id + '/' + self.queue_id + "/EOM " + 
+              logging.error(self.mconn_id + 
+                '/' + self.queue_id + "/EOM " + 
                 "addheader() failed: " + traceback.format_exc()
               )
           ex = str(
@@ -224,7 +216,8 @@ class SOSMilter(Milter.Base):
             )
             return Milter.REJECT
     else:
-      logging.debug(self.mconn_id + '/' + self.queue_id + "/EOM " +
+      logging.debug(self.mconn_id + 
+        '/' + self.queue_id + "/EOM " +
         "No SPF-record found for {0}".format(self.env_from_domain)
       )
     return Milter.CONTINUE
@@ -239,6 +232,46 @@ class SOSMilter(Milter.Base):
     # Clean up any external resources here.
     logging.debug(self.mconn_id + "/CLOSE")
     return Milter.CONTINUE
+  
+  def get_spf_record(self, from_domain):
+    dns_response = None
+    try:
+      dns_response = dns.resolver.resolve(from_domain, 'TXT')
+    except dns.resolver.NoAnswer as e:
+      logging.warning(self.mconn_id + "/DNS " + e.msg)
+      # accept message if DNS-resolver fails
+      return None
+    except dns.resolver.NXDOMAIN as e:
+      logging.warning(self.mconn_id + 
+        " /DNS " + e.msg
+      )
+      # accept message if DNS-resolver fails
+      return None
+    except:
+      logging.error(self.mconn_id + 
+        "/DNS Resolver-EXCEPTION: " + traceback.format_exc()
+      )
+      # accept message if DNS-resolver fails
+      return None
+    for rdata in dns_response:
+      if re.match(r'^"v=spf1.*"$', rdata.to_text(), re.IGNORECASE):
+        # we´ve got a SPF match!
+        logging.debug(self.mconn_id + "/DNS SPFv1: {0}".format(rdata.to_text()))
+        # check if spf-record includes a redirect!?
+        m = re.match(
+          r'^.*redirect=(?P<redirect_domain>.+).*"', 
+          rdata.to_text(), 
+          re.IGNORECASE
+        )
+        if m is not None:
+          # SPF redirect clause found
+          spf_redirect_domain = m.group('redirect_domain')
+          logging.info(self.mconn_id + 
+            "/DNS SPF-redirect: {}".format(spf_redirect_domain)
+          )
+          return self.get_spf_record(spf_redirect_domain)
+        else:
+          return rdata.to_text()
 
 if __name__ == "__main__":
   if 'LOG_LEVEL' in os.environ:
@@ -301,7 +334,7 @@ if __name__ == "__main__":
       sys.exit(1)
     try:
       set_config_parameter("RESTARTABLE_SLEEPTIME", 2)
-      set_config_parameter("RESTARTABLE_TRIES", True)
+      set_config_parameter("RESTARTABLE_TRIES", 2)
       set_config_parameter('DEFAULT_SERVER_ENCODING', 'utf-8')
       set_config_parameter('DEFAULT_CLIENT_ENCODING', 'utf-8')
       server = Server(os.environ['LDAP_SERVER_URI'], get_info=NONE)

app/sos-milter_eom.py

@@ -1,322 +0,0 @@
-import Milter
-import sys
-import traceback
-import os
-import logging
-import string
-import random
-import re
-import dns.resolver
-from ldap3 import (
-  Server, Connection, NONE, ALL, set_config_parameter, ALL_ATTRIBUTES, 
-  ALL_OPERATIONAL_ATTRIBUTES, MODIFY_REPLACE, HASHED_NONE, HASHED_SALTED_SHA,
-)
-from ldap3.core.exceptions import LDAPException
-
-# Globals with mostly senseless defaults ;)
-g_milter_name = 'sos-milter'
-g_milter_socket = '/socket/' + g_milter_name
-g_milter_reject_message = 'Security policy violation!'
-g_milter_tmpfail_message = 'Service temporarily not available! Please try again later.'
-g_re_domain = re.compile(r'^.*@(\S+)$', re.IGNORECASE)
-g_re_spf_regex = re.compile(r'.*', re.IGNORECASE)
-g_re_expected_txt_data = ''
-g_loglevel = logging.INFO
-g_milter_mode = 'test'
-g_ignored_next_hops = {}
-g_ldap_conn = None
-g_ldap_binddn = ''
-g_ldap_bindpw = ''
-
-class SOSMilter(Milter.Base):
-  # Each new connection is handled in an own thread
-  def __init__(self):
-    self.is_null_sender = False
-    self.env_from = None
-    self.env_from_domain = None
-    self.is_env_from_domain_in_ldap = False
-    self.spf_record = None
-    self.queue_id = None
-    self.next_hop = None
-    # https://stackoverflow.com/a/2257449
-    self.mconn_id = g_milter_name + ': ' + ''.join(
-      random.choice(string.ascii_lowercase + string.digits) for _ in range(8)
-    )
-
-  # Not registered/used callbacks
-  @Milter.nocallback
-  def connect(self, IPname, family, hostaddr):
-    return Milter.CONTINUE
-  @Milter.nocallback
-  def hello(self, heloname):
-    return Milter.CONTINUE
-  @Milter.nocallback
-  def data(self):
-    return Milter.CONTINUE
-  @Milter.nocallback
-  def header(self, name, hval):
-    return Milter.CONTINUE
-  @Milter.nocallback
-  def eoh(self):
-    return Milter.CONTINUE
-  @Milter.nocallback
-  def body(self, chunk):
-    return Milter.CONTINUE
-
-  def envfrom(self, mailfrom, *str):
-    try:
-      # DSNs/bounces are not relevant
-      if(mailfrom == '<>'):
-        self.is_null_sender = True
-        return Milter.CONTINUE
-      mailfrom = mailfrom.replace("<","")
-      mailfrom = mailfrom.replace(">","")
-      self.env_from = mailfrom
-      m = g_re_domain.match(self.env_from)
-      if m is None:
-        logging.error(self.mconn_id + "/FROM " +
-          "Could not determine domain of 5321.from=" + self.env_from
-        )
-        self.is_null_sender = True
-        return Milter.CONTINUE
-      self.env_from_domain = m.group(1)
-      logging.debug(self.mconn_id +
-        "/FROM 5321_from_domain=" + self.env_from_domain
-      )
-      # Check if env_from_domain is in ldap
-      if(g_ldap_conn is not None):
-        filter = os.environ['LDAP_QUERY_FILTER']
-        filter = filter.replace("%d", self.env_from_domain)
-        try:
-          g_ldap_conn.search(os.environ['LDAP_SEARCH_BASE'],
-            filter,
-            attributes=[ALL_ATTRIBUTES]
-          )
-          if len(g_ldap_conn.entries) != 0:
-            self.is_env_from_domain_in_ldap = True
-            logging.info(self.mconn_id + 
-              "/FROM Domain {0} found in LDAP".format(self.env_from_domain)
-            )
-        except LDAPException:
-          logging.error(self.mconn_id + "/FROM " + traceback.format_exc())
-        
-      # Get TXT record of sender domain
-      dns_response = None
-      try:
-        dns_response = dns.resolver.resolve(self.env_from_domain, 'TXT')
-      except dns.resolver.NoAnswer as e:
-        logging.error(self.mconn_id + 
-          " /FROM " + e.msg
-        )
-        # accept message if DNS-resolver fails
-        return Milter.CONTINUE
-      except dns.resolver.NXDOMAIN as e:
-        logging.error(self.mconn_id + 
-          " /FROM " + e.msg
-        )
-        # accept message if DNS-resolver fails
-        return Milter.CONTINUE
-      except:
-        logging.error(self.mconn_id + " DNS-Resolver-EXCEPTION: " + traceback.format_exc())
-        # accept message if DNS-resolver fails
-        return Milter.CONTINUE
-      for rdata in dns_response:
-        logging.debug(self.mconn_id + "/FROM DNS-TXT: {0}".format(rdata.to_text()))
-        if re.match(r'^"v=spf1.*"$', rdata.to_text(), re.IGNORECASE):
-          # we´ve got a SPF match!
-          self.spf_record = rdata.to_text()
-          # TODO: check if spf-record is a redirect!?
-          logging.debug(self.mconn_id + "/FROM Found SPFv1: {0}".format(self.spf_record))
-          break
-      return Milter.CONTINUE
-    except:
-      logging.error(self.mconn_id + " FROM-EXCEPTION: " + traceback.format_exc())
-      self.setreply('450','4.7.1', g_milter_tmpfail_message)
-      return Milter.TEMPFAIL
-
-  def envrcpt(self, to, *str):
-    if self.is_null_sender == True:
-      return Milter.CONTINUE
-    self.next_hop = self.getsymval('{rcpt_host}')
-    if self.next_hop is None:
-      logging.error(self.mconn_id + "RCPT exception: could not retrieve milter-macro ({rcpt_host})")
-    else:
-      logging.debug(self.mconn_id + "/RCPT Next-Hop: {0}".format(self.next_hop))
-    return Milter.CONTINUE
-
-  # EOM is not optional and thus, always called by MTA
-  def eom(self):
-    # A queue-id will be generated after the first accepted RCPT TO
-    # and therefore not available until DATA command
-    self.queue_id = self.getsymval('i')
-    if self.queue_id is None:
-      logging.error(self.mconn_id + "EOM exception: could not retrieve milter-macro (i)!")
-      self.setreply('450','4.7.1', g_milter_tmpfail_message)
-      return Milter.TEMPFAIL
-    else:
-      logging.debug(self.mconn_id + "/EOM Queue-ID: {0}".format(self.queue_id))
-
-    if self.is_null_sender:
-      logging.info(self.mconn_id + '/' + self.queue_id + 
-        "/EOM Skipping bounce/DSN message"
-      )
-      return Milter.CONTINUE
-    if self.spf_record is not None:
-      logging.info(self.mconn_id + '/' + self.queue_id + "/EOM " +
-        "SPFv1: " + str(self.spf_record)
-      )
-      logging.debug(self.mconn_id + '/' + self.queue_id + "/EOM " + 
-        "next-hop=" + str(self.next_hop)
-      )
-      if re.match(r'^".+-all"$', self.spf_record, re.IGNORECASE) is not None:
-        # SPF record is in restrictive mode
-        logging.debug(self.mconn_id + '/' + self.queue_id + "/EOM " +
-          "SPF-record is signaling a FAIL-policy (-all)"
-        )
-        if g_re_spf_regex.match(self.spf_record) is not None:
-          logging.debug(self.mconn_id + '/' + self.queue_id + "/EOM" +
-            " SPF-record of 5321_from_domain=" + self.env_from_domain +
-            " permits us to relay this message"
-          )
-        else:
-          # Expected 'include' not found in SPF-record
-          if self.next_hop in g_ignored_next_hops:
-            logging.info(self.mconn_id + '/' + self.queue_id + "/EOM " + 
-              "Passing message due to ignored next-hop=" + self.next_hop
-            )
-            return Milter.CONTINUE
-          if self.is_env_from_domain_in_ldap:
-            logging.info(self.mconn_id + '/' + self.queue_id + "/EOM " + 
-              "5321_from_domain={0} (LDAP) has a broken SPF-record!".format(self.env_from_domain)
-            )
-          ex = str(
-            "SPF-record (-all) of 5321_from_domain=" 
-            + self.env_from_domain + " does not permit us to relay this message!"
-          )
-          if g_milter_mode == 'test':
-            logging.info(self.mconn_id + '/' + self.queue_id + "/EOM " + ex)
-            try:
-              self.addheader(
-                'X-SOS-Milter',
-                self.mconn_id + ' ' + self.env_from_domain + ': failed SPF-expectation'
-              )
-              logging.debug(self.mconn_id + '/' + self.queue_id + "/EOM " +
-                'test-mode: X-SOS-Milter header was added. '
-              )
-            except:
-              logging.error(self.mconn_id + '/' + self.queue_id + "/EOM " + 
-                "addheader() failed: " + traceback.format_exc()
-              )
-          else: 
-            logging.warning(self.mconn_id + '/' + self.queue_id + "/EOM " + ex)
-            self.setreply('550','5.7.1',
-              self.mconn_id + ' ' + ex + ' ' + g_milter_reject_message
-            )
-            return Milter.REJECT
-    else:
-      logging.debug(self.mconn_id + '/' + self.queue_id + "/EOM " +
-        "No SPF-record found for {0}".format(self.env_from_domain)
-      )
-    return Milter.CONTINUE
-
-  def abort(self):
-    # Client disconnected prematurely
-    return Milter.CONTINUE
-
-  def close(self):
-    # Always called, even when abort is called.
-    # Clean up any external resources here.
-    return Milter.CONTINUE
-
-if __name__ == "__main__":
-  if 'LOG_LEVEL' in os.environ:
-    if re.match(r'^info$', os.environ['LOG_LEVEL'], re.IGNORECASE):
-      g_loglevel = logging.INFO
-    elif re.match(r'^warn|warning$', os.environ['LOG_LEVEL'], re.IGNORECASE):
-      g_loglevel = logging.WARN
-    elif re.match(r'^error$', os.environ['LOG_LEVEL'], re.IGNORECASE):
-      g_loglevel = logging.ERROR
-    elif re.match(r'debug', os.environ['LOG_LEVEL'], re.IGNORECASE):
-      g_loglevel = logging.DEBUG
-  logging.basicConfig(
-    filename=None, # log to stdout
-    format='%(asctime)s: %(levelname)s %(message)s',
-    level=g_loglevel
-  )
-  if 'MILTER_MODE' in os.environ:
-    if re.match(r'^test|reject$',os.environ['MILTER_MODE'], re.IGNORECASE):
-      g_milter_mode = os.environ['MILTER_MODE']
-  if 'MILTER_NAME' in os.environ:
-    g_milter_name = os.environ['MILTER_NAME']
-  if 'MILTER_SOCKET' in os.environ:
-    g_milter_socket = os.environ['MILTER_SOCKET']
-  if 'MILTER_REJECT_MESSAGE' in os.environ:
-    g_milter_reject_message = os.environ['MILTER_REJECT_MESSAGE']
-  if 'MILTER_TMPFAIL_MESSAGE' in os.environ:
-    g_milter_tmpfail_message = os.environ['MILTER_TMPFAIL_MESSAGE']
-  if 'SPF_REGEX' in os.environ:
-    try:
-      g_re_spf_regex = re.compile(os.environ['SPF_REGEX'], re.IGNORECASE)
-    except:
-      logging.error("ENV[SPF_REGEX] exception: " + traceback.format_exc())
-      sys.exit(1)
-  if 'IGNORED_NEXT_HOPS' in os.environ:
-    try:
-      tmp_hops = os.environ['IGNORED_NEXT_HOPS'].split(',')
-      for next_hop in tmp_hops:
-        g_ignored_next_hops[next_hop] = 'ignore'
-      logging.debug("next-hops: " + str(g_ignored_next_hops))
-    except:
-      logging.error("ENV[IGNORED_NEXT_HOPS] exception: " + traceback.format_exc())
-      sys.exit(1)
-  if 'LDAP_ENABLED' in os.environ:
-    if 'LDAP_SERVER_URI' not in os.environ:
-      logging.error("ENV[LDAP_SERVER_URI] is mandatory!")
-      sys.exit(1)
-    if 'LDAP_BINDDN' not in os.environ:
-      logging.info("ENV[LDAP_BINDDN] not set! Continue...")
-    else:
-      g_ldap_binddn = os.environ['LDAP_BINDDN']
-    if 'LDAP_BINDPW' not in os.environ:
-      logging.info("ENV[LDAP_BINDPW] not set! Continue...")
-    else:
-      g_ldap_bindpw = os.environ['LDAP_BINDPW']
-    if 'LDAP_SEARCH_BASE' not in os.environ:
-      logging.error("ENV[LDAP_SEARCH_BASE] is mandatory!")
-      sys.exit(1)
-    if 'LDAP_QUERY_FILTER' not in os.environ:
-      logging.error("ENV[LDAP_QUERY_FILTER] is mandatory!")
-      sys.exit(1)
-    try:
-      set_config_parameter("RESTARTABLE_SLEEPTIME", 2)
-      set_config_parameter("RESTARTABLE_TRIES", True)
-      set_config_parameter('DEFAULT_SERVER_ENCODING', 'utf-8')
-      set_config_parameter('DEFAULT_CLIENT_ENCODING', 'utf-8')
-      server = Server(os.environ['LDAP_SERVER_URI'], get_info=NONE)
-      g_ldap_conn = Connection(server,
-        g_ldap_binddn,
-        g_ldap_bindpw,
-        auto_bind=True, 
-        raise_exceptions=True,
-        client_strategy='RESTARTABLE'
-      )
-      logging.info("LDAP-Connection steht. PID: " + str(os.getpid()))
-    except LDAPException as e:
-      print("LDAP-Exception: " + traceback.format_exc())
-      sys.exit(1)
-      
-  try:
-    timeout = 600
-    # Register to have the Milter factory create instances of your class:
-    Milter.factory = SOSMilter
-    # Tell the MTA which features we use
-    flags = Milter.ADDHDRS
-    Milter.set_flags(flags)
-    logging.info("Startup " + g_milter_name +
-      "@socket: " + g_milter_socket +
-      " in mode: " + g_milter_mode
-    )
-    Milter.runmilter(g_milter_name,g_milter_socket,timeout,True)
-    logging.info("Shutdown " + g_milter_name)
-  except:
-    logging.error("MAIN-EXCEPTION: " + traceback.format_exc())

docker-build.sh

@@ -1,28 +0,0 @@
-#!/bin/sh
-
-BRANCH="$(/usr/bin/git branch|/bin/grep \*|/usr/bin/awk {'print $2'})"
-VERSION="$(/bin/cat VERSION)"
-BASEOS="$(/bin/cat BASEOS)"
-GO=""
-
-while getopts g opt
-do
-  case $opt in
-    g) GO="go";;
-  esac
-done
-
-if [ -z "${GO}" ] ; then
-  echo "Building sos-milter@docker on '${BASEOS}' for version '${VERSION}' in branch '${BRANCH}'!"
-  echo "GO serious with '-g'!"
-  exit 1
-fi
-
-IMAGES="sos-milter"
-
-for IMAGE in ${IMAGES}; do
-  /usr/bin/docker build \
-    --pull=true \
-    -t "${IMAGE}/${BASEOS}:${VERSION}_${BRANCH}" \
-    -f "docker/${BASEOS}/Dockerfile" .
-done

docker/debian/Dockerfile

@@ -1,26 +0,0 @@
-ARG http_proxy
-ARG https_proxy
-FROM debian
-LABEL maintainer="Dominik Chilla <dominik@zwackl.de>"
-LABEL git_repo="https://github.com/chillout2k/sos-milter"
-
-ENV DEBIAN_FRONTEND=noninteractive \
- TZ=Europe/Berlin
-
-RUN env; set -ex ; \
-    apt-get -qq update \
- && apt-get -qq --no-install-recommends install \
-     python3-pip python3-setuptools \
-     libmilter1.0.1 libmilter-dev procps net-tools \
-     gcc python3-dev \
- && /usr/bin/pip3 install pymilter \
- && /usr/bin/pip3 install dnspython \
- && /usr/bin/pip3 install ldap3 \
- && /bin/mkdir /config /socket /app \
- && apt-get clean \
- && rm -rf /var/lib/apt/lists/*
-
-COPY app/*.py /app/
-COPY entrypoint.sh /entrypoint.sh
-
-ENTRYPOINT ["/entrypoint.sh"]

requirements.txt

@@ -0,0 +1,3 @@
+pymilter==1.0.5
+dnspython==2.3.0
+ldap3==2.9.1

tests/miltertest.lua

@@ -10,51 +10,17 @@ end
 mt.set_timeout(3)
 
 -- 5321.FROM + MACROS
-mt.macro(conn, SMFIC_MAIL, '{client_addr}', "127.128.129.130", "i", "TestQueueId",'{rcpt_host}', "test.next-host")
+mt.macro(conn, SMFIC_MAIL, '{client_addr}', "127.128.129.130")
-if mt.mailfrom(conn, "dominik@dc-it-con.de") ~= nil then
+if mt.mailfrom(conn, "postmaster@staging.zwackl.de") ~= nil then
   error "mt.mailfrom() failed"
 end
 if mt.getreply(conn) ~= SMFIR_CONTINUE then
   error "mt.mailfrom() unexpected reply"
 end
 
--- 5321.RCPT
+-- 5321.RCPT + MACROS
-if mt.rcptto(conn, "info@dc-it-con.de") ~= nil then
+mt.macro(conn, SMFIC_RCPT, "i", "TestQueueId-1",'{rcpt_host}', "test.next-host")
-  error "mt.rcptto() failed"
+if mt.rcptto(conn, "some@recipient.somewhere") ~= nil then
-end
-if mt.getreply(conn) ~= SMFIR_CONTINUE then
-  error "mt.rcptto() unexpected reply"
-end
-
--- EOM
-if mt.eom(conn) ~= nil then
-  error "mt.eom() failed"
-end
-mt.echo("EOM: " .. mt.getreply(conn))
-if mt.getreply(conn) == SMFIR_CONTINUE then
-  mt.echo("EOM-continue")
-elseif mt.getreply(conn) == SMFIR_REPLYCODE then
-  mt.echo("EOM-reject")
-end
-
-if not mt.eom_check(conn, MT_HDRADD, "X-SOS-Milter") then
-  mt.echo("no header added")
-else
-  mt.echo("X-SOS-Milter header added -> LDAP-Domain with broken SPF")
-end
-
---asdf
--- 5321.FROM + MACROS
-mt.macro(conn, SMFIC_MAIL, '{client_addr}', "127.128.129.130", "i", "TestQueueId",'{rcpt_host}', "test.next-hostx")
-if mt.mailfrom(conn, "dominik@dc-it-con.de") ~= nil then
-  error "mt.mailfrom() failed"
-end
-if mt.getreply(conn) ~= SMFIR_CONTINUE then
-  error "mt.mailfrom() unexpected reply"
-end
-
--- 5321.RCPT
-if mt.rcptto(conn, "info@dc-it-con.de") ~= nil then
   error "mt.rcptto() failed"
 end
 if mt.getreply(conn) ~= SMFIR_CONTINUE then

tests/miltertest_conn_reuse.lua

@@ -0,0 +1,85 @@
+-- https://mopano.github.io/sendmail-filter-api/constant-values.html#com.sendmail.milter.MilterConstants
+-- http://www.opendkim.org/miltertest.8.html
+
+-- socket must be defined as miltertest global variable (-D)
+conn = mt.connect(socket)
+if conn == nil then
+  error "mt.connect() failed"
+end
+
+mt.set_timeout(3)
+
+-- First message within smtp-session
+-- 5321.FROM + MACROS
+mt.macro(conn, SMFIC_MAIL, '{client_addr}', "127.128.129.130")
+if mt.mailfrom(conn, "postmaster@staging.zwackl.de") ~= nil then
+  error "mt.mailfrom() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.mailfrom() unexpected reply"
+end
+
+-- 5321.RCPT + MACROS
+mt.macro(conn, SMFIC_RCPT, "i", "TestQueueId-1",'{rcpt_host}', "test.next-host")
+if mt.rcptto(conn, "some@recipient.somewhere") ~= nil then
+  error "mt.rcptto() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.rcptto() unexpected reply"
+end
+
+-- EOM
+if mt.eom(conn) ~= nil then
+  error "mt.eom() failed"
+end
+mt.echo("EOM: " .. mt.getreply(conn))
+if mt.getreply(conn) == SMFIR_CONTINUE then
+  mt.echo("EOM-continue")
+elseif mt.getreply(conn) == SMFIR_REPLYCODE then
+  mt.echo("EOM-reject")
+end
+
+if not mt.eom_check(conn, MT_HDRADD, "X-SOS-Milter") then
+  mt.echo("no header added")
+else
+  mt.echo("X-SOS-Milter header added -> LDAP-Domain with broken SPF")
+end
+
+-- Second message
+-- 5321.FROM + MACROS
+mt.macro(conn, SMFIC_MAIL, '{client_addr}', "127.128.129.130")
+if mt.mailfrom(conn, "info@staging.zwackl.de") ~= nil then
+  error "mt.mailfrom() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.mailfrom() unexpected reply"
+end
+
+-- 5321.RCPT + MACROS
+mt.macro(conn, SMFIC_RCPT, "i", "TestQueueId-2",'{rcpt_host}', "test.next-host")
+if mt.rcptto(conn, "some@recipient.somewhere") ~= nil then
+  error "mt.rcptto() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.rcptto() unexpected reply"
+end
+
+-- EOM
+if mt.eom(conn) ~= nil then
+  error "mt.eom() failed"
+end
+mt.echo("EOM: " .. mt.getreply(conn))
+if mt.getreply(conn) == SMFIR_CONTINUE then
+  mt.echo("EOM-continue")
+elseif mt.getreply(conn) == SMFIR_REPLYCODE then
+  mt.echo("EOM-reject")
+end
+
+if not mt.eom_check(conn, MT_HDRADD, "X-SOS-Milter") then
+  mt.echo("no header added")
+else
+  mt.echo("X-SOS-Milter header added -> LDAP-Domain with broken SPF")
+end
+
+-- DISCONNECT
+mt.disconnect(conn)

tests/miltertest_redirect.lua

@@ -0,0 +1,49 @@
+-- https://mopano.github.io/sendmail-filter-api/constant-values.html#com.sendmail.milter.MilterConstants
+-- http://www.opendkim.org/miltertest.8.html
+
+-- socket must be defined as miltertest global variable (-D)
+conn = mt.connect(socket)
+if conn == nil then
+  error "mt.connect() failed"
+end
+
+mt.set_timeout(3)
+
+-- First message within smtp-session
+-- 5321.FROM + MACROS
+mt.macro(conn, SMFIC_MAIL, '{client_addr}', "127.128.129.130")
+if mt.mailfrom(conn, "blubb@gmx.de") ~= nil then
+  error "mt.mailfrom() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.mailfrom() unexpected reply"
+end
+
+-- 5321.RCPT + MACROS
+mt.macro(conn, SMFIC_RCPT, "i", "TestQueueId-1",'{rcpt_host}', "test.next-hostx")
+if mt.rcptto(conn, "some@recipient.somewhere") ~= nil then
+  error "mt.rcptto() failed"
+end
+if mt.getreply(conn) ~= SMFIR_CONTINUE then
+  error "mt.rcptto() unexpected reply"
+end
+
+-- EOM
+if mt.eom(conn) ~= nil then
+  error "mt.eom() failed"
+end
+mt.echo("EOM: " .. mt.getreply(conn))
+if mt.getreply(conn) == SMFIR_CONTINUE then
+  mt.echo("EOM-continue")
+elseif mt.getreply(conn) == SMFIR_REPLYCODE then
+  mt.echo("EOM-reject")
+end
+
+if not mt.eom_check(conn, MT_HDRADD, "X-SOS-Milter") then
+  mt.echo("no header added")
+else
+  mt.echo("X-SOS-Milter header added -> LDAP-Domain with broken SPF")
+end
+
+-- DISCONNECT
+mt.disconnect(conn)