File: //lib/python3.6/site-packages/__pycache__/spf.cpython-36.opt-1.pyc
3
�f�_\7 � @ @ s� d dl mZ dZdZdZdZdZd dlZd dlZd dl Z d dl
Z
d dl Z yd dl j
ZW n d dlZY nX d dlZd dlmZ yd d lmZ W n ek
r� d d lmZ Y nX y d dlZeekr�d d
lmZ W nN ek
�r yd dlZd d
lmZ W n ek
�r ed � Y nX Y nX d�dd�Z d�dd�Z yFd dl Z d dl Z d dl Z e!e j"d��svde j"_#e j"j#e j"j$d< e Z%W nR d dl&Z&e!e&j'd��s�de&j'_#de&j'j(d< e&j)j*j+e&j)j*_,e&j-� e Z%Y nX ej.dej/�Z0ej.dej/�Z1dZ2ej.e2�Z3ej.d�Z4ej.d�Z5ej.d�Z6ej.d�Z7d j8d gd �Z9ej.e9d �Z:ej.d e2 ej/�Z;ej.d!d"d#i ej/�Z<ej.d$d%e9 d&d'� ej/�Z=d(d(d)�Z>d*d+d,d-d*d+d.d/d,d-d0d1d2d3d.d4�Z?d5d6d7d8d9d:d;d<d=d>d?�
Z@dZAd@ZBdAZCdBZDdBZEdBZFdBZGd
ZHd
ZIdCZJd�ZKdFdIdIdJdKdL�ZLG dMdN� dNeM�ZNG dOdP� dPeM�ZOG dQdR� dReM�ZPddeIdSd
fdTdU�ZQd�dVdW�ZRG dXdY� dYeS�ZTdZd[� ZUd\d]� ZVd^d_� ZWd`da� ZXdbdc� ZYddde� ZZd�dfdg�Z[d�dhdi�Z\ej]d dCk�r�djdk� Z^ndldk� Z^dmdn� Z_e`dok�r�d dlaZay&eajaejbdpd� dqdrdsdtg�\ZcZbW nD eajdk
�rP Ze z$eeee�� ee� ejfdC� W Y ddZe[eX nX dSZgd ZhxFecD ]>\ZiZjeid�k�rvd Zgeid�k�r�ekej�Zhneid�k�r`ee� �q`W eleb�d k�r�ee� e_� �neleb�dpk�rZy*eTd{d|d}e jm� d~�Zneenjoebd �� W nZ eOk
�r( Zp zedep� W Y ddZp[pX n. ePk
�rT Zp zed�ep� W Y ddZp[pX nX �njeleb�d�k�reb\ZqZrZseTeqerese jm� egehd��ZnenjR� Zted�etenju� etd d0k�r�ed�enjv� enju� enjw�r�enjwjx�r�ed�enjwjx� enjy�r�x�enjyD ]Zzeez� �q�W n�eleb�d k�r�ebdpd� \ZqZrZseTeqerese jm� dSegd��ZnenjRebd �Zted�etenju� etd d0k�rxed�enjv� enju� enjw�r�enjwjx�r�ed�enjwjx� enjy�r�x"enjyD ]Zzeez� �q�W nee� dS )�� )�print_functionz,Terence Way, Stuart Gathman, Scott Kittermanzpyspf@openspf.orgz2.0.14�spfa� To check an incoming mail request:
% python spf.py [-v] {ip} {sender} {helo}
% python spf.py 69.55.226.139 tway@optsw.com mx1.wayforward.net
To test an SPF record:
% python spf.py [-v] "v=spf1..." {ip} {sender} {helo}
% python spf.py "v=spf1 +mx +ip4:10.0.0.1 -all" 10.0.0.1 tway@foo.com a
To fetch an SPF record:
% python spf.py {domain}
% python spf.py wayforward.net
To test this script (and to output this usage message):
% python spf.py
N)�reduce)�Message)�Bytesz;ipaddr module required: http://code.google.com/p/ipaddr-py/T� c C s� y�t j| ||d�}|j� }|jd dkr�|dkr8td��y t j| |d|d�}|j� }W n4 t jk
r� } ztdt|� ��W Y d d }~X nX |jd d
kr�|jd d kr�td |jd
d t|jd � ��dd� |j D �dd� |j
D � S t k
�r } ztdt|� ��W Y d d }~X nh tk
�rP } ztdt|� ��W Y d d }~X n6 t jk
�r� } ztdt|� ��W Y d d }~X nX d S )N)�qtype�timeoutZtcT� zNDNS: Truncated UDP Reply, SPF records should fit in a UDP packet, retrying TCPZtcp)r Zprotocolr zDNS: TCP Fallback error: Zrcoder � zError: Zstatusz RCODE: c S s$ g | ] }|d |d f|d f�qS )�name�typename�data� )�.0�ar r �/usr/lib/python3.6/spf.py�
<listcomp>r s z#DNSLookup_pydns.<locals>.<listcomp>c S s$ g | ] }|d |d f|d f�qS )r r
r r )r r r r r r t s zDNS ) �DNSZ
DnsRequest�req�header�AmbiguityWarningZDNSError� TempError�str�IOError�answersZ
additional�AttributeError)r r �strictr r Zresp�xr r r �DNSLookup_pydns] s. " $ r � c C sV g }y�t jj| |�}x�|D ]�}|dks.|dkrD|j| |f|jf� q|dkrh|j| |f|j|jff� q|dkr�|j| |f|jjd�f� q|dks�|dkr|j| |f|j f� qW W n� t jj
k
r� Y n� t jj k
r� Y nn t j j
k
�r } ztdt|� ��W Y d d }~X n8 t jjk
�rP } ztdt|� ��W Y d d }~X nX |S ) N�A�AAAA�MX�PTRT�TXT�SPFzDNS )�dnsZresolver�query�appendZaddressZ
preferenceZexchange�targetZto_textZstringsZNoAnswerZNXDOMAINZ exceptionZTimeoutr r Z
NoNameservers)r r Z tcpfallbackr ZretValr Zrdatar r r r �DNSLookup_dnspython~ s*
"r+ r& �c s ^v=spf1$|^v=spf1 z^([a-z][a-z0-9_\-\.]*)=z%(%|_|-|(\{[^\}]*\}))z(?<!%)%[^{%_-]|%$z([0-9]*)(r?)([^0-9a-zA-Z]*)z//(0|[1-9]\d*)$z/(0|[1-9]\d*)$z\.z%(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])� �$zA\.(?:[0-9a-z]*[a-z][0-9a-z]*|[0-9a-z]+-[0-9a-z-]*[0-9a-z])\.?$|%sz%(atext)s+([.]%(atext)s+)*$Zatextz[0-9a-z!#$%&'*+/=?^_`{}|~-]a� (?:%(hex4)s:){6}%(ls32)s$|::(?:%(hex4)s:){5}%(ls32)s$|(?:%(hex4)s)?::(?:%(hex4)s:){4}%(ls32)s$|(?:(?:%(hex4)s:){0,1}%(hex4)s)?::(?:%(hex4)s:){3}%(ls32)s$|(?:(?:%(hex4)s:){0,2}%(hex4)s)?::(?:%(hex4)s:){2}%(ls32)s$|(?:(?:%(hex4)s:){0,3}%(hex4)s)?::%(hex4)s:%(ls32)s$|(?:(?:%(hex4)s:){0,4}%(hex4)s)?::%(ls32)s$|(?:(?:%(hex4)s:){0,5}%(hex4)s)?::%(hex4)s$|(?:(?:%(hex4)s:){0,6}%(hex4)s)?::$z"(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|%s)z
[0-9a-f]{1,4})Zls32Zhex4�.)�l�s�pass�fail�neutral�softfail� permerror� temperror�none�local�trusted� ambiguous)�+�-�?�~r2 r3 r6 �errorr4 r5 r8 r9 r: r; �unknownzsender SPF authorizedzSPF fail - not authorizedz permanent error in processingz!temporary DNS error in processingz)domain owner discourages use of this hostz#access neither permitted nor denied� z!No SPF result due to local policyz$No SPF check - trusted-forwarder.orgz No error, but results may vary)
r2 r3 r6 r7 r5 r4 r8 r9 r: r; zv=spf1 a/24 mx/24 ptrz.v=spf1 ?include:spf.trusted-forwarder.org -all�
� r �mx�ptr�exists�include�ip4�ip6�all)Zprt�ipZipv4Zipv6zall.c @ s" e Zd ZdZddd�Zdd� ZdS )r z SPF Warning - ambiguous resultsNc C s$ t j| ||� || _|| _|| _d S )N)� Exception�__init__�msg�mech�ext)�selfrO rP rQ r r r rN
s zAmbiguityWarning.__init__c C s | j rd| j| j f S | jS )Nz%s: %s)rP rO )rR r r r �__str__ s zAmbiguityWarning.__str__)NN)�__name__�
__module__� __qualname__�__doc__rN rS r r r r r s
r c @ s" e Zd ZdZddd�Zdd� ZdS )r zTemporary SPF errorNc C s( t j| ||� t|�| _|| _|| _d S )N)rM rN r rO rP rQ )rR rO rP rQ r r r rN s
zTempError.__init__c C s | j rd| j| j f S | jS )Nz%s: %s)rP rO )rR r r r rS s zTempError.__str__)NN)rT rU rV rW rN rS r r r r r s
r c @ s" e Zd ZdZddd�Zdd� ZdS )� PermErrorzPermanent SPF errorNc C s$ t j| ||� || _|| _|| _d S )N)rM rN rO rP rQ )rR rO rP rQ r r r rN % s zPermError.__init__c C s | j rd| j| j f S | jS )Nz%s: %s)rP rO )rR r r r rS * s zPermError.__str__)NN)rT rU rV rW rN rS r r r r rX # s
rX Fc
C s* t | |||||||d�j� \}} }
||
fS )a& Test an incoming MAIL FROM:<s>, from a client with ip address i.
h is the HELO/EHLO domain name. This is the RFC4408/7208 compliant
pySPF2.0 interface. The interface returns an SPF result and explanation
only. SMTP response codes are not returned since neither RFC 4408 nor RFC
7208 does specify receiver policy. Applications updated for RFC 4408 and
RFC 7208 should use this interface. The maximum time, in seconds, this
function is allowed to run before a TempError is returned is controlled by
querytime. When set to 0 the timeout parameter (default 20 seconds)
controls the time allowed for each DNS lookup. When set to a non-zero
value, it total time for all processing related to the SPF check is
limited to querytime (default 20 seconds as recommended in RFC 7208,
paragraph 4.6.4).
Returns (result, explanation) where result in
['pass', 'permerror', 'fail', 'temperror', 'softfail', 'none', 'neutral' ].
Example:
#>>> check2(i='61.51.192.42', s='liukebing@bcc.com', h='bmsi.com')
)�ir1 �hr9 �receiverr �verbose� querytime)r( �check) rY r1 rZ r9 r[ r r\ r] �res�_�expr r r �check2/ s
rb c C sF t | |||||d�j� \}}}|dkr,d}n|dkr<|dk |||fS )a? Test an incoming MAIL FROM:<s>, from a client with ip address i.
h is the HELO/EHLO domain name. This is the pre-RFC SPF Classic interface.
Applications written for pySPF 1.6/1.7 can use this interface to allow
pySPF2 to be a drop in replacement for older versions. With the exception
of result codes, performance in RFC 4408 compliant.
Returns (result, code, explanation) where result in
['pass', 'unknown', 'fail', 'error', 'softfail', 'none', 'neutral' ].
Example:
#>>> check(i='61.51.192.42', s='liukebing@bcc.com', h='bmsi.com')
)rY r1 rZ r9 r[ r\ r6 rA Ztempfailr@ )r( r^ ) rY r1 rZ r9 r[ r\ r_ �codera r r r r^ H s r^ c @ s: e Zd ZdZdddeddfdd�Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
e fdd�Z dHdd�Z
dd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� ZdId$d%�Zd&d'� ZdJd)d*�Zd+d,� ZdKd.d/�Zd0d1� Zd2d3� ZdLddMddNddOddPddQddRddSdiZ dTd9d:�Z d;d<� Z d=d>� Z d?d@� Z dAdB� Z!dUdDdE�Z"dFdG� Z#dS )Vr( aj A query object keeps the relevant information about a single SPF
query:
i: ip address of SMTP client in dotted notation
s: sender declared in MAIL FROM:<>
l: local part of sender s
d: current domain, initially domain part of sender s
h: EHLO/HELO domain
v: 'in-addr' for IPv4 clients and 'ip6' for IPv6 clients
t: current timestamp
p: SMTP client domain name
o: domain part of sender s
r: receiver
c: pretty ip address (different from i for IPv6)
This is also, by design, the same variables used in SPF macro
expansion.
Also keeps cache: DNS cache.
NTFr c
C s� || | _ | _| r*|r*d| | _ d| _nd| _t||�\| _| _tttj� ��| _ | j| _
d | _ |rn|| _ nd| _ i | _
tt�| _tt�| _|| _d| _d| _|| _|| _| | _| dkr�| | _d| _d | _|r�| j|� d| _|| _ d | _ d S )Nz postmaster@�helo�mailfromrA r T) r1 rZ �ident� split_emailr0 �or �int�time�t�d�p�r�cache�dict� EXPLANATIONS�defexps�exps� libspf_local�lookups� void_lookupsr r r] Ztimer�ipaddr�set_ip�default_modifierr\ �authserv)
rR rY r1 rZ r9 r[ r r r\ r] r r r rN s s<
zquery.__init__c C s t d|||f � d S )Nz %s: %s "%s")�print)rR rP rl r r r r �log� s z query.logc C sF d| _ |j� dkr g | _ d}n�|j� dkr6g | _ d}n�y6ytj|�| _W n tk
rh tj|�| _Y nX W n. tk
r� } ztt |���W Y dd}~X nX | jj
dkr�| jj r�tj | jj �| _d}q�d}nd}t | j�| _
|�r d| _d| _| j�rd jt| jjjd
d �j� ��| _d | _n$d
| _d| _| j�r<| jj| _d| _dS )z$Set connect ip, and ip6 or ip4 mode.F�listZlist6TN� r" rJ r/ �:rB � r! zin-addr� )�iplist�lower� ipaddressZ
ip_addressrw r Z IPAddress�
ValueErrorrX r �versionZ ipv4_mappedZ IPv4Address�cr! �v�joinr} Zexploded�replace�upperrY �cidrmax)rR rY rJ r r r r rx � s@
z query.set_ipc C s. | j }| j}x dD ]}|||< |||< qW d S )Nr5 r3 r6 )r5 r3 r6 )rs rr )rR ra rs rr rY r r r �set_default_explanation� s
z query.set_default_explanationc C s | j }xdD ] }|||< q W d S )Nr5 r3 r6 )r5 r3 r6 )rs )rR ra rs rY r r r �set_explanation� s
zquery.set_explanationc C sh | j sb| j� }|sd| _ nH| j|kr.| j| _ n4d| j }x(|D ]}|j|�r>|| _ P q>W |d | _ | j S )NrA r/ r )rm �validated_ptrsrl �endswith)rR rm Zsfxrl r r r �getp� s
z
query.getpc C sh t j| j�d rdS | j}| j|�\}}}|dkr^| jrP| jjrP| jj\}}}nd \}}|| _|||fS )
z�Return a best guess based on a default SPF record.
>>> q = query('1.2.3.4','','SUPERVISION1',receiver='example.com')
>>> q.best_guess()[0]
'none'
r
r8 � rB r6 r4 ���)r8 r� rB )r4 r� )� RE_TOPLAB�splitrl �
perm_errorr^ rQ )rR r Zpern r� �er r r �
best_guess� s zquery.best_guessc C sB g | _ d| _d| _d| _i | _yzd| _|sL| j| j�}| jrL| j d| j|� |r\|j
dd�}| j rr|rrt || j �}| j
|| jd�}| jr�|| j_| j�|S tk
r� } z.|j| _|j r�| j j|j � dddt|� fS d}~X n\ tk
�r< } z>| j�s|| _|j| _|j �r | j j|j � d d
d t|� fS d}~X nX dS ) a�
Returns (result, mta-status-code, explanation) where result
in ['fail', 'softfail', 'neutral' 'permerror', 'pass', 'temperror', 'none']
Examples:
>>> q = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='192.0.2.3')
>>> q.check(spf='v=spf1 ?all')
('neutral', 250, 'access neither permitted nor denied')
>>> q.check(spf='v=spf1 redirect=controlledmail.com exp=_exp.controlledmail.com')
('fail', 550, 'SPF fail - not authorized')
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ?all moo')
('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo')
>>> q.check(spf='v=spf1 ip4:192.0.0.n ?all')
('permerror', 550, 'SPF Permanent Error: Invalid IP4 address: ip4:192.0.0.n')
>>> q.check(spf='v=spf1 ip4:192.0.2.3 ip4:192.0.0.n ?all')
('permerror', 550, 'SPF Permanent Error: Invalid IP4 address: ip4:192.0.0.n')
>>> q.check(spf='v=spf1 ip6:2001:db8:ZZZZ:: ?all')
('permerror', 550, 'SPF Permanent Error: Invalid IP6 address: ip6:2001:db8:ZZZZ::')
>>> q.check(spf='v=spf1 =a ?all moo')
('permerror', 550, 'SPF Permanent Error: Unknown qualifier, RFC 4408 para 4.6.1, found in: =a')
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ~all')
('pass', 250, 'sender SPF authorized')
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 -all moo=')
('pass', 250, 'sender SPF authorized')
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 -all match.sub-domains_9=yes')
('pass', 250, 'sender SPF authorized')
>>> q.strict = False
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 -all moo')
('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo')
>>> q.perm_error.ext
('pass', 250, 'sender SPF authorized')
>>> q.strict = True
>>> q.check(spf='v=spf1 ip4:192.1.0.0/16 moo -all')
('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo')
>>> q.check(spf='v=spf1 ip4:192.1.0.0/16 ~all')
('softfail', 250, 'domain owner discourages use of this host')
>>> q.check(spf='v=spf1 -ip4:192.1.0.0/6 ~all')
('fail', 550, 'SPF fail - not authorized')
# Assumes DNS available
>>> q.check()
('none', 250, '')
>>> q.check(spf='v=spf1 ip4:1.2.3.4 -a:example.net -all')
('fail', 550, 'SPF fail - not authorized')
>>> q.libspf_local='ip4:192.0.2.3 a:example.org'
>>> q.check(spf='v=spf1 ip4:1.2.3.4 -a:example.net -all')
('pass', 250, 'sender SPF authorized')
>>> q.check(spf='v=spf1 ip4:1.2.3.4 -all exp=_exp.controlledmail.com')
('fail', 550, 'Controlledmail.com does not send mail from itself.')
>>> q.check(spf='v=spf1 ip4:1.2.3.4 ?all exp=_exp.controlledmail.com')
('neutral', 250, 'access neither permitted nor denied')
Nr �top�
� r7 i� zSPF Temporary Error: r6 i& zSPF Permanent Error: )rP r� � mechanismrv �optionsru �dns_spfrl r\ r| r� rt �insert_libspf_local_policy�check1rQ r rO �probr) r rX )rR r Zrcr r r r r^ � sB F
z query.checkc C s� |t kr | jrtd��td��y(z| j| }| _| j||�S || _X W nF tk
r� } z*|j| _|j rt| j j
|j � ddd| fS d }~X nX d S )Nz Too many levels of recursionr; r zSPF Ambiguity Warning: %s) �
MAX_RECURSIONr �AssertionErrorrX rl �check0r rO r� rP r) )rR r �domain� recursionZtmpr r r r r� o s z query.check1c G sP | j rt|� �| jsJy t|� �W n( tk
rH } z || _W Y d d }~X nX | jS )N)r rX r� )rR rO r r r r �
note_error� s zquery.note_errorc C s" t j|�d rtd|��| j|�S )z validate and expand domain-specr
z Invalid domain found (use FQDN)r� )r� r� rX �expand)rR �argr r r �
expand_domain� s
zquery.expand_domainc C s� |j d�r"| jd|� |dd!� }t|| j�\}}}}|r^tj|d �}|rZ|dd� }nd}|tkrz| jd|� t| }|dkr�tj|�r�| jd |�}d
}|d"kr�|dkr�d }n|d kr�t d
|��|dkr�d}n|dkr�t d|��| j
dkr�|}�n|d
k�s tj|��r||d
k�r,| jd|� d
| }}|dk �r@t d|��|dk�rPd }n|d k�rdt d
|��tj|��st d|��n�|dk�r�|dk �r�t d|��|dk�r�d}n|dk�r�t d|��t j|��st d|��n.|dk �s�|dk �r�|t k�r�t d|��| j
}|d#k�r�|dk�r*| �r*t d|��| j|�}|�sDt d|��|dk�rx|| jk�rx|dk�rnt d|��t d |��|||||fS |d k�r�|jd ��r�| jd |� |t k�r�|||||fS |dd� t k�r�| jd |�}n | jd|�}|||||fS )$a
Parse and validate a mechanism.
Returns mech,m,arg,cidrlength,result
Examples:
>>> q = query(s='strong-bad@email.example.com.',
... h='mx.example.org', i='192.0.2.3')
>>> q.validate_mechanism('A')
('A', 'a', 'email.example.com', 32, 'pass')
>>> q = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='192.0.2.3')
>>> q.validate_mechanism('A//64')
('A//64', 'a', 'email.example.com', 32, 'pass')
>>> q.validate_mechanism('A/24//64')
('A/24//64', 'a', 'email.example.com', 24, 'pass')
>>> q.validate_mechanism('?mx:%{d}/27')
('?mx:%{d}/27', 'mx', 'email.example.com', 27, 'neutral')
>>> try: q.validate_mechanism('ip4:1.2.3.4/247')
... except PermError as x: print(x)
Invalid IP4 CIDR length: ip4:1.2.3.4/247
>>> try: q.validate_mechanism('ip4:1.2.3.4/33')
... except PermError as x: print(x)
Invalid IP4 CIDR length: ip4:1.2.3.4/33
>>> try: q.validate_mechanism('a:example.com:8080')
... except PermError as x: print(x)
Invalid domain found (use FQDN): example.com:8080
>>> try: q.validate_mechanism('ip4:1.2.3.444/24')
... except PermError as x: print(x)
Invalid IP4 address: ip4:1.2.3.444/24
>>> try: q.validate_mechanism('ip4:1.2.03.4/24')
... except PermError as x: print(x)
Invalid IP4 address: ip4:1.2.03.4/24
>>> try: q.validate_mechanism('-all:3030')
... except PermError as x: print(x)
Invalid all mechanism format - only qualifier allowed with all: -all:3030
>>> q.validate_mechanism('-mx:%%%_/.Clara.de/27')
('-mx:%%%_/.Clara.de/27', 'mx', '% /.Clara.de', 27, 'fail')
>>> q.validate_mechanism('~exists:%{i}.%{s1}.100/86400.rate.%{d}')
('~exists:%{i}.%{s1}.100/86400.rate.%{d}', 'exists', '192.0.2.3.com.100/86400.rate.email.example.com', 32, 'softfail')
>>> q.validate_mechanism('a:mail.example.com.')
('a:mail.example.com.', 'a', 'mail.example.com', 32, 'pass')
>>> try: q.validate_mechanism('a:mail.example.com,')
... except PermError as x: print(x)
Do not separate mechnisms with commas: a:mail.example.com,
>>> q = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='2001:db8:1234::face:b007')
>>> q.validate_mechanism('A//64')
('A//64', 'a', 'email.example.com', 64, 'pass')
>>> q.validate_mechanism('A/16')
('A/16', 'a', 'email.example.com', 128, 'pass')
>>> q.validate_mechanism('A/16//48')
('A/16//48', 'a', 'email.example.com', 48, 'pass')
�,z%Do not separate mechnisms with commasNr
r r2 zUnknown mechanism foundr z'Use the ip4 mechanism for ip4 addressesrI rE r� zInvalid IP4 CIDR lengthr� zInvalid IP6 CIDR lengthrJ z Missing IP4zDual CIDR not allowedzInvalid IP4 addresszInvalid IP6 addresszCIDR not allowedrF rG rH zimplicit exists not allowedz
empty domain:z include has trivial recursionz include mechanism missing domainrK r z>Invalid all mechanism format - only qualifier allowed with allz0Unknown qualifier, RFC 4408 para 4.6.1, found inr� )r rE )r rE rF rG rH )r� r� �parse_mechanismrl �RESULTS�get�COMMON_MISTAKES�RE_IP4�matchrX r� �RE_IP6�ALL_MECHANISMSr� r� �count)rR rP �mr� �
cidrlengthZ cidr6length�resultr r r r �validate_mechanism� s� F
zquery.validate_mechanismc C s� |sddt d fS |jd�}|d j� dkrP| jdkrBtd| j��ddt d fS dd � |dd
� D �}| j}d
}d }g }g }�x�|D �]�}tj|�dd
� } t| �d kr�|j | j
|�� q�| \}
} |
|kr�|
d
kr�t d|��| j d|
|� |j |
� |
dk�rV| �st d| ��| j
| �} | �ry&| j| �} | �rD| �rD| j| � W n Y nX q�|
d
k�r�| j� | j
| �}|�st d| ��q�|
dk�r�| jdk�r�td��| j �r| j�r| j| �} tj| |�}q�|
dk�r|�sx4| jd�D ]}
|
�r�d| j|
< �q�W q�| j| d � q�W �xt|D �]\}} } }}| dk�r�| j� | j| �}| j�r`| jd| |� | j|| |d �\}}}|dk�r�P |dk�r�| j d| |� d }�q �q | dk�r�P �q | d k�r| j� y t| j| d ��dk�r�P W n tk
�r� Y nX �q | d k�r2| j� | j| j| | j �|��r$P n�| d k�r\| j� | j| j | �|��r$P n�| d k�r�| j d!k�r$y| j| g|��r�P W n" t j k
�r� t d"|��Y nX nv| d#k�r | j d#k�r$y| j| g|��r�P W n" t j k
�r� t d"|��Y nX n$| d$k�r | j� t!| j"� | ��r P �q W |�r�| j|�}|�sJt d%|��| j�r`| jd
||� |�sxt#| j$�| _i | _| j|||�S |}d
}|�s�|| _%|d&k�r�|d'|| fS |d|| fS d
S )(z�Test this query information against SPF text.
Returns (result, mta-status-code, explanation) where
result in ['fail', 'unknown', 'pass', 'none']
r8 r� r� r zv=spf1r
zInvalid SPF record inc S s g | ] }|r|�qS r r )r rP r r r r W s z query.check0.<locals>.<listcomp>Nr4 rD �redirectz"redirect= MUST appear at most oncez %s= MUST appear at most oncera zexp has empty domain-spec:zredirect has empty domain:�defaultz"The default= modifier is obsolete.�opr/ TrH r2 z+No valid SPF record for included domain: %srK rG r! r rE rI zin-addrz syntax errorrJ rF z!redirect domain has no SPF recordr3 i& )&rq r� r� r r rl rs � RE_MODIFIER�lenr) r� rX r� r� �get_explanationr� �
check_lookupsry r� r� r� r� r� r\ r| r� �dns_a� cidrmatchr! �dns_mxr� �socketr@ � domainmatchr� rp rr r� )rR r r� rs r� r� ZmechsZ modifiersrP r� �modr� ra r� r� r� rl r_ rc ZtxtZredirect_recordr r r r� = s�
z query.check0c C sB | j d | _ | j td kr*tdtd ��| j tkr>| jd� d S )Nr
r- zMore than %d DNS lookupszToo many DNS lookups)ru �
MAX_LOOKUPrX r� )rR r r r r� � s
zquery.check_lookupsc C sv |r`y8| j |dd�}t|�dkr:t| jt|d �dd��S W qr tk
r\ | jdkrX� Y qrX n| jdkrrtd��dS ) zExpand an explanation.T)� ignore_voidr
r F)�stripdotzEmpty domain-spec on exp=N)�dns_txtr� r r� �to_asciirX r )rR �specr r r r r� � s
zquery.get_explanationc C s� |j d�dkr:t}x&|jd�D ]}|j|�r td|��q W d}d}�xtj|�D �] }||||j� � 7 }||j� |j� � }|dkr�|d7 }n�|dkr�|d7 }n�|d kr�|d
7 }n�|d j � } | d kr�| j
� n| d
kr�|r�td|��t | | | �}
|
�rJ|
| k�rtd|��t |
|dd� t
j| ��} | |d k�rBtj| d�} || 7 }|j� }qPW |||d� 7 }|�r�|jd��r�|dd� }|jd�dk�r�t|�dk�r�||jd�d d� }|S )a% Do SPF RFC macro expansion.
Examples:
>>> q = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='192.0.2.3')
>>> q.p = 'mx.example.org'
>>> q.r = 'example.net'
>>> q.expand('%{d}')
'email.example.com'
>>> q.expand('%{d4}')
'email.example.com'
>>> q.expand('%{d3}')
'email.example.com'
>>> q.expand('%{d2}')
'example.com'
>>> q.expand('%{d1}')
'com'
>>> q.expand('%{p}')
'mx.example.org'
>>> q.expand('%{p2}')
'example.org'
>>> q.expand('%{dr}')
'com.example.email'
>>> q.expand('%{d2r}')
'example.email'
>>> q.expand('%{l}')
'strong-bad'
>>> q.expand('%{l-}')
'strong.bad'
>>> q.expand('%{lr}')
'strong-bad'
>>> q.expand('%{lr-}')
'bad.strong'
>>> q.expand('%{l1r-}')
'strong'
>>> q.expand('%{c}',stripdot=False)
'192.0.2.3'
>>> q.expand('%{r}',stripdot=False)
'example.net'
>>> q.expand('%{ir}.%{v}._spf.%{d2}')
'3.2.0.192.in-addr._spf.example.com'
>>> q.expand('%{lr-}.lp._spf.%{d2}')
'bad.strong.lp._spf.example.com'
>>> q.expand('%{lr-}.lp.%{ir}.%{v}._spf.%{d2}')
'bad.strong.lp.3.2.0.192.in-addr._spf.example.com'
>>> q.expand('%{ir}.%{v}.%{l1r-}.lp._spf.%{d2}')
'3.2.0.192.in-addr.strong.lp._spf.example.com'
>>> try: q.expand('%(ir).%{v}.%{l1r-}.lp._spf.%{d2}')
... except PermError as x: print(x)
invalid-macro-char : %(ir)
>>> q.expand('%{p2}.trusted-domains.example.net')
'example.org.trusted-domains.example.net'
>>> q.expand('%{p2}.trusted-domains.example.net.')
'example.org.trusted-domains.example.net'
>>> q = query(s='@email.example.com',
... h='mx.example.org', i='192.0.2.3')
>>> q.p = 'mx.example.org'
>>> q.expand('%{l}')
'postmaster'
�%r r/ zinvalid-macro-char rB z%%z%_r� z%-z%20rD rm Zcrtz&c,r,t macros allowed in exp= text onlyzUnknown Macro Encounteredr r
r? N� r� r� )�find�RE_INVALID_MACROr� �searchrX �RE_CHAR�finditer�start�endr� r� �getattr�
expand_one�JOINERSr� � urllibparseZquoter� r� r� �index) rR r1 r� Zregex�labelr� r� rY ZmacroZletter� expansionr� r r r r� sL W
z query.expandc C s� x(|j d�D ]}| s"t|�dkr dS q W dd� | j|�D �}t|�dkrd| jr\td| j� td��t|�dkr�| jd k r�t|d
�S | jdk�rLy d d� | j|d d
d�D �}W n8 t k
r� } z | jdkr�t |��g }W Y dd}~X nX t|�dkr�td��t|�dk�rL| jdk�r@t|�dk�r@|d
|d
k�r@t
d��t|d
�S t|�dk�rft|d
�S t �r�dd� | j|d t d
d�D �}t|�dk�r�t|d
�S dS )z�Get the SPF record recorded in DNS for a specific domain
name. Returns None if not found, or if more than one record
is found.
r/ �? Nc S s g | ]}t j|�r|�qS r )�RE_SPFr� )r rk r r r r � s z!query.dns_spf.<locals>.<listcomp>r
zcache=z'Two or more type TXT spf records found.rD r c S s g | ]}t j|�r|�qS r )r� r� )r rk r r r r � s r& T)r� z'Two or more type SPF spf records found.zLv=spf1 records of both type TXT and SPF (type 99) present, but not identicalc S s g | ]}t j|�r|�qS r )r� r� )r rk r r r r � s z._spf.) r� r� r� r\ r{ ro rX r r� r r �DELEGATE)rR r� r� r �br r r r r� � s@
, z
query.dns_spfr% c C st |rpyF| j |||d�}|rHdd� |D �}t|d t�r:|S dd� |D �S W n$ tk
rn td||f ��Y nX g S )z,Get a list of TXT records for a domain name.)r� c S s& g | ] }|r|d dd � j |��qS )r N)r� )r r r r r r � s z!query.dns_txt.<locals>.<listcomp>r c S s g | ]}|j d ��qS )zutf-8)�encode)r r1 r r r r � s z.Non-ascii characters found in %s record for %s)r' �
isinstance�bytes� UnicodeErrorrX )rR �
domainnameZrrr� Zdns_listr r r r r� � s z
query.dns_txtc sz � j |d�}� jrPt}t|�tkr.tdt ��� jdkrXt|�dkrXtd|��ntd }|j� � fdd�|d |� D �S )
zSGet a list of IP addresses for all MX exchanges for a
domain name.
r# z More than %d MX records returnedr
r z$No MX records found for mx mechanismr- c s( g | ] }� j |d � j�D ]}|�qqS )r
)r� r! )r rE r )rR r r r � s z query.dns_mx.<locals>.<listcomp>N)r' r �MAX_MXr� rX r �sort)rR r� Zmxnames�maxr )rR r r� � s
z query.dns_mxr! c C sZ |sg S | j ||�}| jdkr8t|�dkr8td| |��|dkrVttkrVdd� |D �S |S )z5Get a list of IP addresses for a domainname.
r
r zNo %s records found forr" c S s g | ] }t |��qS r )r )r rL r r r r � s z query.dns_a.<locals>.<listcomp>)r' r r� r r� r )rR r� r! rn r r r r� � s z query.dns_ac
s� �j rzt}�j dkr�yJ�j�j�}t|�|krDd| }t|�j��nt|�dkr\td�j��W q� td�j��Y q�X ntd }�j� � �fdd��j�j�d|� D �S ) z=Figure out the validated PTR domain names for the connect IP.r
z!More than %d PTR records returnedr z&No PTR records found for ptr mechanismr- c s& g | ] }�j �j|�j�� �r|�qS r )r� r� r! )r rm )r� rR r r r s z(query.validated_ptrs.<locals>.<listcomp>N)r �MAX_PTR�dns_ptrrY r� r r� r� )rR r� ZptrnamesZwarningr )r� rR r r� � s"
zquery.validated_ptrsc C s | j dt|�| jf d�S )z-Get a list of domain names for an IP address.z
%s.%s.arpar$ )r' � reverse_dotsr� )rR rY r r r r� s z
query.dns_ptrr# �CNAMEr" r$ r& c C s� |s t d��t|�}|jd�r*|dd� }tdd� |jd�d�sDg S |j� }| jj||fg �}|rf|S |df}| jj|�}| jo�|j d �}|r�|d
}�n&t
j } | j d
k r�t
d ��| j | jk r�| j d
kr�| j }
n| j}
tj� } x�t||| j|
�D ]�\} }
|�r
td | |
� | d
j� | d f} | |k�rF|
}| jj||fg �}|�rFP | d dk�sd|| d f| kr�|�rvtd
| |
� | jj| g �j|
� q�W | jj||fg �}| j d
k�r�| j tj� | | _ | �rL|�rL|�s�i }nt|�tk�r�tdt ��|||< |j� jd�|k�r(| jdk�rLtd|��n$| j|||d�}|�rL|| j||f< | �r�| �r�| jd7 _| jt k�r�tdt ��|S )a� DNS query.
If the result is in cache, return that. Otherwise pull the
result from DNS, and cache ALL answers, so additional info
is available for further queries later.
CNAMEs are followed.
If there is no data, [] is returned.
pre: qtype in ['A', 'AAAA', 'MX', 'PTR', 'TXT', 'SPF']
post: isinstance(__return__, types.ListType)
Examples:
>>> c = query(s='strong-bad@email.example.com',
... h='parallel.kitterman.org',i='192.0.2.123')
>>> "".join( chr(x) for x in bytearray(c.dns('parallel.kitterman.org', 'TXT')[0][0]) )
'v=spf1 include:long.kitterman.org include:cname.kitterman.org -all'
z
Invalid queryr/ Nr
c S s | o dt |� k odk S S )Nr �@ )r� )r �yr r r �<lambda>: s zquery.dns.<locals>.<lambda>Tr� zcname.r z)DNS Error: exceeded max query lookup timezresult=z addcache=z Length of CNAME chain exceeds %dz
CNAME loop)�cnamesz Void lookup limit of %d exceededr� ) rM r r� r r� r� ro r� r\ �
startswithr( �
SAFE2CACHEr] r r rj � DNSLookupr r{ �
setdefaultr) r� � MAX_CNAMErX �rstripr r' rv �MAX_VOID_LOOKUPS)rR r r r� r� r� ZcnamekZcname�debugZ
safe2cacher Ztimethen�kr� r r r r' " sp
z query.dnsc C s$ y�ylxfdd� |D �D ]T}|j |d�}t| jt�rB|j| j�rhdS q|| jk rZ| jj|� q| jj|j� qW W n| t k
r� xfdd� |D �D ]T}|j |d�}t| jt�r�|j| j�r�dS q�|| jk r�| jj|� q�| jj|j� q�W Y nX W n0 t
k
�r } zt t |���W Y dd}~X nX dS )aB Match connect IP against a CIDR network of other IP addresses.
Examples:
>>> c = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='192.0.2.3')
>>> c.p = 'mx.example.org'
>>> c.r = 'example.com'
>>> c.cidrmatch(['192.0.2.3'],32)
True
>>> c.cidrmatch(['192.0.2.2'],32)
False
>>> c.cidrmatch(['192.0.2.2'],31)
True
>>> six = query(s='strong-bad@email.example.com',
... h='mx.example.org', i='2001:0db8:0:0:0:0:0:0001')
>>> six.p = 'mx.example.org'
>>> six.r = 'example.com'
>>> six.cidrmatch(['2001:0DB8::'],127)
True
>>> six.cidrmatch(['2001:0DB8::'],128)
False
>>> six.cidrmatch(['2001:0DB8:0:0:0:0:0:0001'],128)
True
c S s g | ]}t j|��qS r )r� Z
ip_network)r rL r r r r � s z#query.cidrmatch.<locals>.<listcomp>)Z
new_prefixTc S s g | ]}t j|d d��qS )F)r )r� Z IPNetwork)r rL r r r r � s NF)
Zsupernetr� r� �bool� __contains__rw r� r) rL r r� rX r )rR Zipaddrs�nZnetwrkZnetworkr r r r r� s s,
zquery.cidrmatchc C s� ddl }djdd� |jd�D ��}|jj|�}xr|jD ]h}|jdkr6|j| _|j | _ |j
d j dkr�|j
d j | _
|j
d j | _|j
d j d kr6|j
d j | _q6W dS )
ac Set SPF values from RFC 5451 Authentication Results header.
Useful when SPF has already been run on a trusted gateway machine.
Expects the entire header as an input.
Examples:
>>> q = query('192.0.2.3','strong-bad@email.example.com','mx.example.org')
>>> q.mechanism = 'unknown'
>>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=neutral \n (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) \n smtp.mailfrom=email.example.com \n (sender=strong-bad@email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=?all)''')
>>> q.get_header(q.result, header_type='authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=neutral (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=email.example.com (sender=email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)'
>>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=None (mail.bmsi.com: test; client-ip=163.247.46.150) smtp.mailfrom=admin@squiebras.cl (helo=mail.squiebras.cl; receiver=mail.bmsi.com;\n mechanism=mx/24)''')
>>> q.get_header(q.result, header_type='authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=none (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=admin@squiebras.cl (sender=admin@squiebras.cl; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)'
r Nr� c s s | ]}|j � V qd S )N)�strip)r r1 r r r � <genexpr>� s z(query.parse_header_ar.<locals>.<genexpr>r� r re rd )�authresr� r� �AuthenticationResultsHeader�parse�results�method� authserv_idrz r� Z
propertiesr �valuerl r1 rZ )rR �valr� ZarobjZresobjr r r �parse_header_ar� s
zquery.parse_header_arc C sX |j dd�}|d j� | _d| _t|�dk r0dS |d }|jd�rx|jd�}|dk rZ| jS |d|� | _||d d� }t� }|j dd | � i }x�|j
dd
�D ]�\}}|d kr�| j |� q�|d kr�|| _ q�|d
kr�|| _
q�|dkr�|| _q�|dkr�|| _q�|dk�r|| _q�|dk�r || _q�|jd�r�|||dd� < q�W t| j | j
�\| _| _|S )a� Set SPF values from Received-SPF header.
Useful when SPF has already been run on a trusted gateway machine.
Examples:
>>> q = query('0.0.0.0','','')
>>> p = q.parse_header_spf('''Pass (test) client-ip=70.98.79.77;
... envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com;
... receiver=mail.bmsi.com; mechanism=a; identity=mailfrom''')
>>> q.get_header(q.result)
'Pass (test) client-ip=70.98.79.77; envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com; receiver=mail.bmsi.com; mechanism=a; identity=mailfrom'
>>> o = q.parse_header_spf('''None (mail.bmsi.com: test)
... client-ip=163.247.46.150; envelope-from="admin@squiebras.cl";
... helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24;
... x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom''')
>>> q.get_header(q.result,**o)
'None (mail.bmsi.com: test) client-ip=163.247.46.150; envelope-from="admin@squiebras.cl"; helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24; x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom'
>>> o['bestguess']
'pass'
Nr
r rD r8 �(�)z Received-SPFz; )r z client-ipz
envelope-fromrd r[ �problemr� �identityzx-)r� r� r� r� r� r� r� �commentr Z
add_headerZ
get_paramsrx r1 rZ rn rP rf rg r0 rh )rR r r �posrO rm r� r� r r r �parse_header_spf� sD
zquery.parse_header_spfc C s" |j d�r| j|�S | j|�S dS )a�
Set SPF values from Received-SPF or RFC 5451 Authentication Results header.
Useful when SPF has already been run on a trusted gateway machine. Auto
detects the header type and parses it. Use parse_header_spf or parse_header_ar
for each type if required.
Examples:
>>> q = query('0.0.0.0','','')
>>> p = q.parse_header('''Pass (test) client-ip=70.98.79.77;
... envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com;
... receiver=mail.bmsi.com; mechanism=a; identity=mailfrom''')
>>> q.get_header(q.result)
'Pass (test) client-ip=70.98.79.77; envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com; receiver=mail.bmsi.com; mechanism=a; identity=mailfrom'
>>> r = q.parse_header('''None (mail.bmsi.com: test)
... client-ip=163.247.46.150; envelope-from="admin@squiebras.cl";
... helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24;
... x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom''')
>>> q.get_header(q.result,**r)
'None (mail.bmsi.com: test) client-ip=163.247.46.150; envelope-from="admin@squiebras.cl"; helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24; x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom'
>>> r['bestguess']
'pass'
>>> q = query('192.0.2.3','strong-bad@email.example.com','mx.example.org')
>>> q.mechanism = 'unknown'
>>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=neutral \n (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) \n smtp.mailfrom=email.example.com \n (sender=strong-bad@email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=?all)''')
>>> q.get_header(q.result, header_type='authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=neutral (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=email.example.com (sender=email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)'
>>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=None (mail.bmsi.com: test; client-ip=163.247.46.150) smtp.mailfrom=admin@squiebras.cl (helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24)''')
>>> q.get_header(q.result, header_type='authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=none (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=admin@squiebras.cl (sender=admin@squiebras.cl; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)'
zAuthentication-Results:N)r� r r
)rR r r r r � parse_header� s
zquery.parse_headerr c
K s |dkr |st d��ddl}|s&| j}| j}t| j�}ddddd d
d d �} | j}
|
d
kr^d} n
t| j�} | | } |dkr�| jr�tdj | j��}
nd}
t| j
�}t | d�r�| j }nd|| j
|�f }d| |f g}|dk�rpx4d%D ],}t� | }|r�|jd|jdd�|f � q�W xBtt|j� ��D ].\}}|�r"|jd |jdd�t|�f � �q"W |jd d |
f � dj |�S |dk�r�| �r�t|j||j| || jd j| j| j| j| j|�d �gd!��S t|j||j| || jd"j| j| j| j|�d#�gd!��S nt d$j|���dS )&aD
Generate Received-SPF or Authentication Results header based on the
last lookup.
>>> q = query(s='strong-bad@email.example.com', h='mx.example.org',
... i='192.0.2.3')
>>> q.r='abuse@kitterman.com'
>>> q.check(spf='v=spf1 ?all')
('neutral', 250, 'access neither permitted nor denied')
>>> q.get_header('neutral')
'Neutral (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; mechanism=?all; identity=mailfrom'
>>> q.check(spf='v=spf1 redirect=controlledmail.com exp=_exp.controlledmail.com')
('fail', 550, 'SPF fail - not authorized')
>>> q.get_header('fail')
'Fail (abuse@kitterman.com: domain of email.example.com does not designate 192.0.2.3 as permitted sender) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; mechanism=-all; identity=mailfrom'
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ?all moo')
('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo')
>>> q.get_header('permerror')
'PermError (abuse@kitterman.com: permanent error in processing domain of email.example.com: Unknown mechanism found) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; problem=moo; identity=mailfrom'
>>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ~all')
('pass', 250, 'sender SPF authorized')
>>> q.get_header('pass')
'Pass (abuse@kitterman.com: domain of email.example.com designates 192.0.2.3 as permitted sender) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; mechanism="ip4:192.0.0.0/8"; identity=mailfrom'
>>> q.check(spf='v=spf1 ?all')
('neutral', 250, 'access neither permitted nor denied')
>>> q.get_header('neutral', header_type = 'authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=neutral (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=email.example.com (sender=strong-bad@email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=?all)'
>>> p = query(s='strong-bad@email.example.com', h='mx.example.org',
... i='192.0.2.3')
>>> p.r='abuse@kitterman.com'
>>> p.check(spf='v=spf1 redirect=controlledmail.com exp=_exp.controlledmail.com')
('fail', 550, 'SPF fail - not authorized')
>>> p.ident = 'helo'
>>> p.get_header('fail', header_type = 'authres', aid='bmsi.com')
'Authentication-Results: bmsi.com; spf=fail (abuse@kitterman.com: domain of email.example.com does not designate 192.0.2.3 as permitted sender) smtp.helo=mx.example.org (sender=strong-bad@email.example.com; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=-all)'
>>> q.check(spf='v=spf1 ?all')
('neutral', 250, 'access neither permitted nor denied')
>>> try: q.get_header('neutral', header_type = 'dkim')
... except SyntaxError as x: print(x)
Unknown results header type: dkim
r� zKauthserv-id missing for Authentication Results header type, see RFC5451 2.3r NZPassZNeutralZFailZSoftFail�Noner rX )r2 r4 r3 r5 r8 r7 r6 rd r6 r� r z%s: %sz%s (%s)r � client_ip�
envelope_fromr[ r r� z%s=%s;r` r= zx-%s=%s;z%s=%sr
z@sender={0}; helo={1}; client-ip={2}; receiver={3}; mechanism={4})r� �result_commentZ
smtp_mailfromZsmtp_mailfrom_comment)r r z6sender={0}; client-ip={1}; receiver={2}; mechanism={3})r� r Z smtp_heloZsmtp_helo_commentz Unknown results header type: {0})r r rd r[ r r� )� SyntaxErrorr� rn r� � quote_valuerZ rf r1 rP r� r� �hasattrr �get_header_comment�localsr) r� �sortedr} �itemsr r� ZSPFAuthenticationResultrl �format)rR r_ r[ Z header_typeZaidZkvr� r rd Zresmapr
r �tagr r� r r� r� r r r �
get_header s` 1
$
zquery.get_headerc C s� | j }|dkr d|| jf S |dkr2d|| jf S |dkrHd| j|f S |dkr^d| j|f S |dkrtd || jf S |d
kr�d | S |d kr�d
|| jf S td| ��dS )z)Return comment for Received-SPF header. r2 z.domain of %s designates %s as permitted senderr5 zDtransitioning domain of %s does not designate %s as permitted senderr4 z2%s is neither permitted nor denied by domain of %sr8 r6 z.permanent error in processing domain of %s: %sr7 z1temporary error in processing during lookup of %sr3 z6domain of %s does not designate %s as permitted senderz'invalid SPF result for header comment: N)rh r� r� r� )rR r_ Zsenderr r r r � s, zquery.get_header_comment)N)T)r% F)r! )r# r! )r# r# )r� r! )r! r! )r" r" )r$ r$ )r% r% )r& r& )NF)Nr N)$rT rU rV rW �MAX_PER_LOOKUP_TIMErN r| rx r� r� r� � DEFAULT_SPFr� r^ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r' r� r r
r r r r r r r r( ^ sT 0(
p " ,
9
Q7!/%
ir( c C sL | s d|fS | j dd�}|d dkr,d|d< t|�dkr@t|�S d| fS dS )at Given a sender email s and a HELO domain h, create a valid tuple
(l, d) local-part and domain-part.
Examples:
>>> split_email('', 'wayforward.net')
('postmaster', 'wayforward.net')
>>> split_email('foo.com', 'wayforward.net')
('postmaster', 'foo.com')
>>> split_email('terry@wayforward.net', 'optsw.com')
('terry', 'wayforward.net')
Z
postmaster�@r
r rB rD N)r� r� �tuple)r1 rZ �partsr r r rg � s rg c C s: | dkst j| �r| S d| jdd�jdd�jdd� d S )a Quote the value for a key-value pair in Received-SPF header field
if needed. No quoting needed for a dot-atom value.
Examples:
>>> quote_value('foo@bar.com')
'"foo@bar.com"'
>>> quote_value('mail.example.com')
'mail.example.com'
>>> quote_value('A:1.2.3.4')
'"A:1.2.3.4"'
>>> quote_value('abc"def')
'"abc\\"def"'
>>> quote_value(r'abc\def')
'"abc\\\\def"'
>>> quote_value('abc..def')
'"abc..def"'
>>> quote_value('')
'""'
>>> quote_value(None)
N�"�\z\\z\"� z\x00)� RE_DOT_ATOMr� r� )r1 r r r r � s r c C s� t j| �}t|�dkr.|d t|d � } }nd}tj| �}t|�dkr`|d t|d � } }nd}| jdd�}t|�dk r�| j� } | dkr�d}| |||fS |d j� |d ||fS )a� Breaks A, MX, IP4, and PTR mechanisms into a (name, domain,
cidr,cidr6) tuple. The domain portion defaults to d if not present,
the cidr defaults to 32 if not present.
Examples:
>>> parse_mechanism('a', 'foo.com')
('a', 'foo.com', None, None)
>>> parse_mechanism('exists','foo.com')
('exists', None, None, None)
>>> parse_mechanism('a:bar.com', 'foo.com')
('a', 'bar.com', None, None)
>>> parse_mechanism('a/24', 'foo.com')
('a', 'foo.com', 24, None)
>>> parse_mechanism('A:foo:bar.com/16//48', 'foo.com')
('a', 'foo:bar.com', 16, 48)
>>> parse_mechanism('-exists:%{i}.%{s1}.100/86400.rate.%{d}','foo.com')
('-exists', '%{i}.%{s1}.100/86400.rate.%{d}', None, None)
>>> parse_mechanism('mx:%%%_/.Claranet.de/27','foo.com')
('mx', '%%%_/.Claranet.de', 27, None)
>>> parse_mechanism('mx:%{d}//97','foo.com')
('mx', '%{d}', None, 97)
>>> parse_mechanism('iP4:192.0.0.0/8','foo.com')
('ip4', '192.0.0.0', 8, None)
r r r
Nr rD rG )� RE_DUAL_CIDRr� r� ri �RE_CIDRr� )r rl r Zcidr6Zcidrr r r r� � s "
r� c C s | j d�}|j� dj|�S )z�Reverse dotted IP addresses or domain names.
Example:
>>> reverse_dots('192.168.0.145')
'145.0.168.192'
>>> reverse_dots('email.example.com')
'com.example.email'
r/ )r� �reverser� )r r r r r r� s
r� c C s< |j � }x.| D ]&}|j � }||ks0|jd| �rdS qW dS )a grep for a given domain suffix against a list of validated PTR
domain names.
Examples:
>>> domainmatch(['FOO.COM'], 'foo.com')
1
>>> domainmatch(['moo.foo.com'], 'FOO.COM')
1
>>> domainmatch(['moo.bar.com'], 'foo.com')
0
r/ TF)r� r� )ZptrsZ domainsuffixrF r r r r� s
r� c C sh |s| S t j|�dd� \}}}|s(d}t| ||�} |r@| j� |r^| t|� d d d � } dj| �S )Nr
r- r/ rD rB )�RE_ARGSr� r( ri r� )r� r �joiner�lnr( �
delimitersr r r r� 6 s r� c C s` g d }}xF| D ]>}||krF|j |� d}|r:|j |� qN|j |� q||7 }qW |j |� |S )a� Split a string into pieces by a set of delimiter characters. The
resulting list is delimited by joiner, or the original delimiter if
joiner is not specified.
Examples:
>>> split('192.168.0.45', '.')
['192', '.', '168', '.', '0', '.', '45']
>>> split('terry@wayforward.net', '@.')
['terry', '@', 'wayforward', '.', 'net']
>>> split('terry@wayforward.net', '@.', '.')
['terry', '.', 'wayforward', '.', 'net']
rB )r) )r r, r* r� �elementr� r r r r� A s
r� c C sx |s| S | j � dd� }|rp|j� xJ|D ]>}tj|d �s*|j|�}|g|||�< |j� dj|�}P q*W | S d| S )a� Returns spftxt with local inserted just before last non-fail
mechanism. This is how the libspf{2} libraries handle "local-policy".
Examples:
>>> insert_libspf_local_policy('v=spf1 -all')
'v=spf1 -all'
>>> insert_libspf_local_policy('v=spf1 -all','mx')
'v=spf1 -all'
>>> insert_libspf_local_policy('v=spf1','a mx ptr')
'v=spf1 a mx ptr'
>>> insert_libspf_local_policy('v=spf1 mx -all','a ptr')
'v=spf1 mx a ptr -all'
>>> insert_libspf_local_policy('v=spf1 mx -include:foo.co +all','a ptr')
'v=spf1 mx a ptr -include:foo.co +all'
# FIXME: is this right? If so, "last non-fail" is a bogus description.
>>> insert_libspf_local_policy('v=spf1 mx ?include:foo.co +all','a ptr')
'v=spf1 mx a ptr ?include:foo.co +all'
>>> spf='v=spf1 ip4:1.2.3.4 -a:example.net -all'
>>> local='ip4:192.0.2.3 a:example.org'
>>> insert_libspf_local_policy(spf,local)
'v=spf1 ip4:1.2.3.4 ip4:192.0.2.3 a:example.org -a:example.net -all'
r
Nr r� zv=spf1 )r� r( r� r� r� r� )Zspftxtr9 r rP �wherer r r r� ^ s
r� c C s2 y
| j d�S tk
r, tdt| ���Y nX dS )z*Raise PermError if arg is not 7-bit ascii.�asciizNon-ascii characters foundN)r� r� rX �repr)r1 r r r r� � s
r� c C s2 y
| j d�S tk
r, tdt| ���Y nX dS )z*Raise PermError if arg is not 7-bit ascii.r/ zNon-ascii characters foundN)�decoder� rX r0 )r1 r r r r� � s
c C s dd l } dd l}| j|�S )Nr )�doctestr Ztestmod)r2 r r r r �_test� s r3 �__main__r
zhvs:�helpr\ r �-v� --verbose�-s�--strict�-h�--helpz 127.0.0.1Z localhostrA )rY r1 rZ r[ zTemporary DNS error: z PermError: r )rY r1 rZ r[ r\ r zresult:zguessed:zlax:)rY r1 rZ r[ r r\ )Tr )Tr )r rE rF rG rH rI rJ rK )NNF)N)N)r6 r7 )r8 r9 )r: r; ){Z
__future__r �
__author__Z __email__� __version__ZMODULEZUSAGE�re�sysr� �structrj Z urllib.parser r� Zurllib� functoolsr Z
email.messager � ImportErrorZ
email.Messager� r� r r rw r{ r r+ r' Z dns.resolverZ
dns.exceptionr Z rdatatyper& Z_by_textr� r ZTypeZtypemapZLibZ
RRunpackerZ
getTXTdataZ
getSPFdataZDiscoverNameServers�compile�
IGNORECASEr� r� ZPAT_CHARr� r� r) r& r' r� ZPAT_IP4r� r� r% r� r� r� rq r� r ZTRUSTED_FORWARDERSr� r� r� r� r� r r� r� r� rM r r rX rb r^ �objectr( rg r r� r� r� r� r� r� � version_infor� r3 rT Zgetopt�argvZoptsZ GetoptError�err�exitr\ r rh r ri r� Z gethostname�qr� r rY r1 rZ rn r� r� r� rQ r� rL r r r r �<module> sh +
!
O!4
3