Haraka 3.1.6 → 3.1.7

package/test/plugins/block_me.js

@@ -0,0 +1,157 @@
+'use strict'
+
+const fs = require('node:fs')
+const path = require('node:path')
+const assert = require('node:assert/strict')
+const { describe, it, beforeEach, after } = require('node:test')
+
+const fixtures = require('haraka-test-fixtures')
+const { Address } = require('address-rfc2821')
+require('haraka-constants').import(global)
+
+// block_me appends to <config>/mail_from.blocklist when a sender is blocked;
+// remove the artifact the 'sets block_me note' test produces.
+after(() => {
+    fs.rmSync(path.resolve('test/config/mail_from.blocklist'), { force: true })
+})
+
+function makeConnection({
+    relaying = false,
+    mailFrom = 'sender@example.com',
+    rcptTo = ['blocklist@example.com'],
+} = {}) {
+    const conn = fixtures.connection.createConnection()
+    conn.init_transaction()
+    conn.relaying = relaying
+    conn.transaction.mail_from = new Address(`<${mailFrom}>`)
+    conn.transaction.rcpt_to = rcptTo.map((r) => new Address(`<${r}>`))
+    conn.transaction.body = { bodytext: '', children: [] }
+    return conn
+}
+
+describe('block_me', () => {
+    let plugin
+
+    // Read config (block_me.recipient, block_me.senders) from test/config rather
+    // than the real config dir. block_me also appends matched senders to
+    // mail_from.blocklist; with this override that write lands in test/config too.
+    beforeEach(() => {
+        plugin = new fixtures.plugin('block_me')
+        plugin.config = plugin.config.module_config(path.resolve('test'))
+    })
+
+    describe('hook_data', () => {
+        it('enables body parsing and calls next', (t, done) => {
+            const conn = makeConnection()
+            conn.transaction.parse_body = false
+            plugin.hook_data((rc) => {
+                assert.equal(rc, undefined)
+                assert.equal(conn.transaction.parse_body, true)
+                done()
+            }, conn)
+        })
+    })
+
+    describe('hook_data_post', () => {
+        it('calls next when not relaying', (t, done) => {
+            const conn = makeConnection({ relaying: false })
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next when transaction is missing', (t, done) => {
+            const conn = fixtures.connection.createConnection()
+            conn.relaying = true
+            conn.transaction = null
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next when more than one recipient', (t, done) => {
+            const conn = makeConnection({
+                relaying: true,
+                rcptTo: ['blocklist@example.com', 'other@example.com'],
+            })
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next when recipient does not match configured address', (t, done) => {
+            const conn = makeConnection({ relaying: true, rcptTo: ['other@example.com'] })
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('denies when sender is not in the allowed senders list', (t, done) => {
+            const conn = makeConnection({
+                relaying: true,
+                mailFrom: 'notallowed@example.com',
+                rcptTo: ['blocklist@example.com'],
+            })
+            plugin.hook_data_post((rc, msg) => {
+                assert.equal(rc, DENY)
+                assert.ok(msg.includes('not allowed'))
+                done()
+            }, conn)
+        })
+
+        it('calls next when no From header found in body', (t, done) => {
+            const conn = makeConnection({
+                relaying: true,
+                mailFrom: 'sender@example.com',
+                rcptTo: ['blocklist@example.com'],
+            })
+            conn.transaction.body = { bodytext: 'No from header here', children: [] }
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                // note should not be set since no From header
+                assert.equal(conn.transaction.notes.block_me, undefined)
+                done()
+            }, conn)
+        })
+
+        it('sets block_me note and calls next when From is extracted', (t, done) => {
+            const conn = makeConnection({
+                relaying: true,
+                mailFrom: 'sender@example.com',
+                rcptTo: ['blocklist@example.com'],
+            })
+            conn.transaction.body = {
+                bodytext: 'From: Test User <block_target@example.com>',
+                children: [],
+            }
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                assert.equal(conn.transaction.notes.block_me, 1)
+                done()
+            }, conn)
+        })
+    })
+
+    describe('hook_queue', () => {
+        it('returns OK when block_me note is set on transaction', (t, done) => {
+            const conn = makeConnection()
+            conn.transaction.notes.block_me = 1
+            plugin.hook_queue((rc) => {
+                assert.equal(rc, OK)
+                done()
+            }, conn)
+        })
+
+        it('calls next when block_me note is not set', (t, done) => {
+            const conn = makeConnection()
+            plugin.hook_queue((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+    })
+})

package/test/plugins/data.signatures.js

@@ -0,0 +1,114 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const { describe, it, beforeEach } = require('node:test')
+
+const fixtures = require('haraka-test-fixtures')
+require('haraka-constants').import(global)
+
+function makeConnection(bodytext = '', children = []) {
+    const conn = fixtures.connection.createConnection()
+    conn.init_transaction()
+    conn.transaction.body = { bodytext, children }
+    return conn
+}
+
+describe('data.signatures', () => {
+    let plugin
+
+    beforeEach(() => {
+        plugin = new fixtures.plugin('data.signatures')
+    })
+
+    describe('hook_data', () => {
+        it('enables body parsing', (t, done) => {
+            const conn = makeConnection()
+            conn.transaction.parse_body = false
+            plugin.hook_data((rc) => {
+                assert.equal(rc, undefined)
+                assert.equal(conn.transaction.parse_body, true)
+                done()
+            }, conn)
+        })
+
+        it('calls next when there is no transaction', (t, done) => {
+            const conn = fixtures.connection.createConnection()
+            conn.transaction = null
+            plugin.hook_data((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+    })
+
+    describe('hook_data_post', () => {
+        it('calls next when there is no transaction', (t, done) => {
+            const conn = fixtures.connection.createConnection()
+            conn.transaction = null
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next when signature list is empty', (t, done) => {
+            plugin.config.get = (name, type) => (type === 'list' ? [] : {})
+            const conn = makeConnection('This is some email body text')
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('denies when body matches a signature', (t, done) => {
+            plugin.config.get = (name, type) => (type === 'list' ? ['spam_signature_text'] : {})
+            const conn = makeConnection('Buy cheap meds! spam_signature_text here')
+            plugin.hook_data_post((rc, msg) => {
+                assert.equal(rc, DENY)
+                assert.ok(msg.includes('spam'))
+                done()
+            }, conn)
+        })
+
+        it('calls next when body does not match any signature', (t, done) => {
+            plugin.config.get = (name, type) => (type === 'list' ? ['bad_pattern'] : {})
+            const conn = makeConnection('Totally normal email body')
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('denies when a child body part matches a signature', (t, done) => {
+            plugin.config.get = (name, type) => (type === 'list' ? ['spam_in_child'] : {})
+            const conn = fixtures.connection.createConnection()
+            conn.init_transaction()
+            conn.transaction.body = {
+                bodytext: 'clean parent text',
+                children: [{ bodytext: 'spam_in_child content here', children: [] }],
+            }
+            plugin.hook_data_post((rc, msg) => {
+                assert.equal(rc, DENY)
+                done()
+            }, conn)
+        })
+
+        it('calls next when multiple signatures do not match', (t, done) => {
+            plugin.config.get = (name, type) => (type === 'list' ? ['sig_one', 'sig_two', 'sig_three'] : {})
+            const conn = makeConnection('No matching signatures here at all')
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('matches the first of multiple signatures', (t, done) => {
+            plugin.config.get = (name, type) => (type === 'list' ? ['no_match', 'buy_cheap_pills'] : {})
+            const conn = makeConnection('This message has buy_cheap_pills for you')
+            plugin.hook_data_post((rc) => {
+                assert.equal(rc, DENY)
+                done()
+            }, conn)
+        })
+    })
+})

package/test/plugins/delay_deny.js

@@ -0,0 +1,263 @@
+'use strict'
+
+const assert = require('node:assert/strict')
+const { describe, it, beforeEach } = require('node:test')
+
+const fixtures = require('haraka-test-fixtures')
+require('haraka-constants').import(global)
+
+// params layout: [code, msg, pi_name, pi_function, pi_params, pi_hook]
+function makeParams({ code = DENY, msg = 'test deny', name = 'some_plugin', fn = 'hook_fn', hook = 'ehlo' } = {}) {
+    return [code, msg, name, fn, null, hook]
+}
+
+describe('delay_deny', () => {
+    let plugin, conn
+
+    beforeEach(() => {
+        plugin = new fixtures.plugin('delay_deny')
+        plugin.config.get = () => ({ main: {} })
+        conn = fixtures.connection.createConnection()
+        conn.init_transaction()
+    })
+
+    describe('hook_deny', () => {
+        it('skips itself (pi_name === delay_deny)', (t, done) => {
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, undefined)
+                    done()
+                },
+                conn,
+                makeParams({ name: 'delay_deny' }),
+            )
+        })
+
+        it('stores connection-level pre-DATA deny for ehlo hook', (t, done) => {
+            const params = makeParams({ hook: 'ehlo' })
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, OK)
+                    assert.equal(conn.notes.delay_deny_pre.length, 1)
+                    assert.equal(conn.notes.delay_deny_pre[0], params)
+                    assert.equal(conn.notes.delay_deny_pre_fail['some_plugin'], 1)
+                    done()
+                },
+                conn,
+                params,
+            )
+        })
+
+        it('stores connection-level pre-DATA deny for connect hook', (t, done) => {
+            const params = makeParams({ hook: 'connect' })
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, OK)
+                    assert.ok(conn.notes.delay_deny_pre.includes(params))
+                    done()
+                },
+                conn,
+                params,
+            )
+        })
+
+        it('stores transaction-level pre-DATA deny for mail hook', (t, done) => {
+            const params = makeParams({ hook: 'mail' })
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, OK)
+                    assert.equal(conn.transaction.notes.delay_deny_pre.length, 1)
+                    assert.equal(conn.transaction.notes.delay_deny_pre[0], params)
+                    assert.equal(conn.transaction.notes.delay_deny_pre_fail['some_plugin'], 1)
+                    done()
+                },
+                conn,
+                params,
+            )
+        })
+
+        it('stores transaction-level pre-DATA deny for rcpt hook', (t, done) => {
+            const params = makeParams({ hook: 'rcpt' })
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, OK)
+                    assert.equal(conn.transaction.notes.delay_deny_pre.length, 1)
+                    assert.equal(conn.transaction.notes.delay_deny_pre[0], params)
+                    done()
+                },
+                conn,
+                params,
+            )
+        })
+
+        it('calls next (no delay) for data_post hook', (t, done) => {
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, undefined)
+                    done()
+                },
+                conn,
+                makeParams({ hook: 'data_post' }),
+            )
+        })
+
+        it('calls next (no delay) for data hook', (t, done) => {
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, undefined)
+                    done()
+                },
+                conn,
+                makeParams({ hook: 'data' }),
+            )
+        })
+
+        it('delays when plugin is in included_plugins list', (t, done) => {
+            plugin.config.get = () => ({ main: { included_plugins: 'allowed_plugin' } })
+            const params = makeParams({ name: 'allowed_plugin', hook: 'ehlo' })
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, OK)
+                    done()
+                },
+                conn,
+                params,
+            )
+        })
+
+        it('passes through when plugin is not in included_plugins list', (t, done) => {
+            plugin.config.get = () => ({ main: { included_plugins: 'allowed_plugin' } })
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, undefined)
+                    done()
+                },
+                conn,
+                makeParams({ name: 'other_plugin', hook: 'ehlo' }),
+            )
+        })
+
+        it('passes through when plugin is in excluded_plugins list', (t, done) => {
+            plugin.config.get = () => ({ main: { excluded_plugins: 'skip_plugin' } })
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, undefined)
+                    done()
+                },
+                conn,
+                makeParams({ name: 'skip_plugin', hook: 'ehlo' }),
+            )
+        })
+
+        it('delays when plugin is not in excluded_plugins list', (t, done) => {
+            plugin.config.get = () => ({ main: { excluded_plugins: 'skip_plugin' } })
+            const params = makeParams({ name: 'other_plugin', hook: 'ehlo' })
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, OK)
+                    done()
+                },
+                conn,
+                params,
+            )
+        })
+
+        it('can exclude by plugin:hook format', (t, done) => {
+            plugin.config.get = () => ({ main: { excluded_plugins: 'some_plugin:helo' } })
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, undefined)
+                    done()
+                },
+                conn,
+                makeParams({ name: 'some_plugin', hook: 'helo' }),
+            )
+        })
+
+        it('can exclude by plugin:hook:function format', (t, done) => {
+            plugin.config.get = () => ({ main: { excluded_plugins: 'some_plugin:ehlo:hook_fn' } })
+            plugin.hook_deny(
+                (rc) => {
+                    assert.equal(rc, undefined)
+                    done()
+                },
+                conn,
+                makeParams({ name: 'some_plugin', fn: 'hook_fn', hook: 'ehlo' }),
+            )
+        })
+    })
+
+    describe('hook_rcpt_ok', () => {
+        it('calls next when there is no transaction', (t, done) => {
+            conn.transaction = null
+            plugin.hook_rcpt_ok((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('bypasses all denies when connection is relaying', (t, done) => {
+            conn.relaying = true
+            conn.notes.delay_deny_pre = [makeParams({ hook: 'ehlo' })]
+            plugin.hook_rcpt_ok((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('applies deferred connection-level deny', (t, done) => {
+            conn.relaying = false
+            conn.notes.delay_deny_pre = [[DENY, 'deferred ehlo deny', 'check_relay', 'fn', null, 'ehlo']]
+            plugin.hook_rcpt_ok((rc, msg) => {
+                assert.equal(rc, DENY)
+                assert.equal(msg, 'deferred ehlo deny')
+                done()
+            }, conn)
+        })
+
+        it('applies deferred transaction-level deny', (t, done) => {
+            conn.relaying = false
+            conn.transaction.notes.delay_deny_pre = [[DENYSOFT, 'deferred mail deny', 'check_helo', 'fn', null, 'mail']]
+            plugin.hook_rcpt_ok((rc, msg) => {
+                assert.equal(rc, DENYSOFT)
+                assert.equal(msg, 'deferred mail deny')
+                done()
+            }, conn)
+        })
+
+        it('calls next when no deferred denies are present', (t, done) => {
+            conn.relaying = false
+            plugin.hook_rcpt_ok((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+    })
+
+    describe('hook_data', () => {
+        it('calls next when no pre-DATA failures exist', (t, done) => {
+            plugin.hook_data((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next when transaction is missing', (t, done) => {
+            conn.transaction = null
+            plugin.hook_data((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+
+        it('calls next with no action when transaction has pre-DATA failures', (t, done) => {
+            // Note: fails.push.apply(Object.keys(...)) in the plugin is a pre-existing bug —
+            // the array receives no items so the header is never added.
+            conn.transaction.notes.delay_deny_pre_fail = { bad_plugin: 1, another_plugin: 1 }
+            plugin.hook_data((rc) => {
+                assert.equal(rc, undefined)
+                done()
+            }, conn)
+        })
+    })
+})