⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.19
Server IP:
178.33.27.10
Server:
Linux cpanel.dev-unit.com 3.10.0-1160.108.1.el7.x86_64 #1 SMP Thu Jan 25 16:17:31 UTC 2024 x86_64
Server Software:
Apache/2.4.57 (Unix) OpenSSL/1.0.2k-fips
PHP Version:
8.2.11
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
usr
/
lib
/
python2.7
/
site-packages
/
View File Name :
spf.pyo
� +f�_c @ s2 d d l m Z d Z d Z d Z d Z d Z d d l Z d d l Z d d l Z d d l Z d d l Z y d d l j Z Wn d d l Z n Xd d l Z d d l m Z y d d l m Z Wn! e k r� d d l m Z n Xy d d l Z Wn e k re d � n Xe d d � Z e d d � Z yf d d l Z d d l Z d d l Z e e j d � r�d e j _! e j j! e j j" d <n e Z# Wnm d d l$ Z$ e e$ j% d � r�d e$ j% _! d e$ j% j& d <e$ j' j( j) e$ j' j( _* n e$ j+ � e Z# n Xe j, d e j- � Z. e j, d e j- � Z/ d Z0 e j, e0 � Z1 e j, d � Z2 e j, d � Z3 e j, d � Z4 e j, d � Z5 d j6 d g d � Z7 e j, e7 d � Z8 e j, d e0 e j- � Z9 e j, d i d d 6e j- � Z: e j, d i d! e7 d" 6d# d$ 6e j- � Z; i d% d& 6d% d' 6Z< i d( d) 6d* d+ 6d, d- 6d. d/ 6d( d( 6d* d* 6d0 d0 6d1 d2 6d, d, 6d. d. 6d3 d3 6d4 d4 6d5 d5 6d6 d6 6d0 d7 6Z= i d8 d( 6d9 d* 6d: d0 6d; d1 6d< d. 6d= d, 6d> d3 6d? d4 6d@ d5 6dA d6 6Z> e? Z@ dB ZA dC ZB dD ZC dD ZD dD ZE dD ZF d ZG d ZH dE ZI dF dG dH dI dJ dK dL dM f ZJ i dH dN 6dK dO 6dK dP 6dL dQ 6dM dR 6ZK dS eL f dT � � YZM dU eL f dV � � YZN dW eL f dX � � YZO e? e? eH eP d dY � ZQ e? e? eP dZ � ZR d[ eS f d\ � � YZT d] � ZU d^ � ZV d_ � ZW d` � ZX da � ZY db � ZZ e? dc � Z[ e? dd � Z\ e j] de dE k rRdf � Z^ n dg � Z^ dh � Z_ e` di k r. d d la Za y/ ea ja e jb dj dk dl dm dn g � \ Zc Zb Wn= ea jd k r�Ze e ef ee � � e e � e jg dE � n XeP Zh e Zi xo ec D]g \ Zj Zk ej do dp f k r%e Zh n ej dq dr f k rFel ek � Zi n ej ds dt f k ree e � n q�Wem eb � de k r�e e � e_ � n�em eb � dj k r(yB eT du dv d' dw dx d7 dy e jn � � Zo e eo jp eb de � � Wn? eN k rZq e dz eq � n eO k r$Zq e d{ eq � n Xnem eb � d| k r eb \ Zr Zs Zt eT du er d' es dx et dy e jn � dm eh dn ei � Zo eo jR � Zu e d} eu eo jv � eu de d3 k r�e d~ eo jw � eo jv � n eo jx o�eo jx jy r�e d eo jx jy � n eo jz r x eo jz D] Z{ e e{ � qWn n em eb � d k r! eb dj \ Zr Zs Zt eT du er d' es dx et dy e jn � dn eP dm eh � Zo eo jR eb de � Zu e d} eu eo jv � eu de d3 k r�e d~ eo jw � eo jv � n eo jx o�eo jx jy r�e d eo jx jy � n eo jz r x eo jz D] Z{ e e{ � q Wn n e e � n d S(� i����( t print_functions, Terence Way, Stuart Gathman, Scott Kittermans pyspf@openspf.orgs 2.0.14t spfs� To check an incoming mail request: % python spf.py [-v] {ip} {sender} {helo} % python spf.py 69.55.226.139 tway@optsw.com mx1.wayforward.net To test an SPF record: % python spf.py [-v] "v=spf1..." {ip} {sender} {helo} % python spf.py "v=spf1 +mx +ip4:10.0.0.1 -all" 10.0.0.1 tway@foo.com a To fetch an SPF record: % python spf.py {domain} % python spf.py wayforward.net To test this script (and to output this usage message): % python spf.py N( t reduce( t Messages; ipaddr module required: http://code.google.com/p/ipaddr-py/i c C s� yut j | d | d | �} | j � } | j d t k r| d k rX t d � � n y1 t j | d | d d d | �} | j � } Wn, t j k r� } t d t | � � � n X| j d d k r| j d d k rt d | j d d t | j d � � � qn g | j D]$ } | d | d f | d f ^ qg | j D]$ } | d | d f | d f ^ qKSWn| t k r�} t d t | � � � nT t k r�} t d t | � � � n, t j k r�} t d t | � � � n Xd S( Nt qtypet timeoutt tci sN DNS: Truncated UDP Reply, SPF records should fit in a UDP packet, retrying TCPt protocolt tcps DNS: TCP Fallback error: t rcodei i s Error: t statuss RCODE: t namet typenamet datas DNS ( t DNSt DnsRequestt reqt headert Truet AmbiguityWarningt DNSErrort TempErrort strt IOErrort answerst additionalt AttributeError( R R t strictR R t respt xt a( ( s' /usr/lib/python2.7/site-packages/spf.pyt DNSLookup_pydnsW s. !&2.4i c C s� g } y t j j | | � } x� | D]� } | d k sC | d k rb | j | | f | j f � q% | d k r� | j | | f | j | j f f � q% | d k r� | j | | f | j j t � f � q% | d k s� | d k r% | j | | f | j f � q% q% WWn� t j j k r ns t j j k r5n] t j j k rc} t d t | � � � n/ t j j k r�} t d t | � � � n X| S( Nt At AAAAt MXt PTRt TXTt SPFs DNS ( t dnst resolvert queryt appendt addresst preferencet exchanget targett to_textR t stringst NoAnswert NXDOMAINt exceptiont TimeoutR R t NoNameservers( R R t tcpfallbackR t retValR t rdataR ( ( s' /usr/lib/python2.7/site-packages/spf.pyt DNSLookup_dnspythonx s* ( ('R% ic s ^v=spf1$|^v=spf1 s ^([a-z][a-z0-9_\-\.]*)=s %(%|_|-|(\{[^\}]*\}))s (?<!%)%[^{%_-]|%$s ([0-9]*)(r?)([^0-9a-zA-Z]*)s //(0|[1-9]\d*)$s /(0|[1-9]\d*)$s \.s% (?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])i t $sA \.(?:[0-9a-z]*[a-z][0-9a-z]*|[0-9a-z]+-[0-9a-z-]*[0-9a-z])\.?$|%ss %(atext)s+([.]%(atext)s+)*$s [0-9a-z!#$%&'*+/=?^_`{}|~-]t atexts� (?:%(hex4)s:){6}%(ls32)s$|::(?:%(hex4)s:){5}%(ls32)s$|(?:%(hex4)s)?::(?:%(hex4)s:){4}%(ls32)s$|(?:(?:%(hex4)s:){0,1}%(hex4)s)?::(?:%(hex4)s:){3}%(ls32)s$|(?:(?:%(hex4)s:){0,2}%(hex4)s)?::(?:%(hex4)s:){2}%(ls32)s$|(?:(?:%(hex4)s:){0,3}%(hex4)s)?::%(hex4)s:%(ls32)s$|(?:(?:%(hex4)s:){0,4}%(hex4)s)?::%(ls32)s$|(?:(?:%(hex4)s:){0,5}%(hex4)s)?::%(hex4)s$|(?:(?:%(hex4)s:){0,6}%(hex4)s)?::$s" (?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|%s)t ls32s [0-9a-f]{1,4}t hex4t .t lt st passt +t failt -t neutralt ?t softfailt ~t permerrort temperrort errort nonet localt trustedt ambiguoust unknowns sender SPF authorizeds SPF fail - not authorizeds permanent error in processings! temporary DNS error in processings) domain owner discourages use of this hosts# access neither permitted nor deniedt s! No SPF result due to local policys$ No SPF check - trusted-forwarder.orgs No error, but results may varys v=spf1 a/24 mx/24 ptrs. v=spf1 ?include:spf.trusted-forwarder.org -alli i R t mxt ptrt existst includet ip4t ip6t allt prtt ipt ipv4t ipv6s all.R c B s& e Z d Z d d d � Z d � Z RS( s SPF Warning - ambiguous resultsc C s2 t j | | | � | | _ | | _ | | _ d S( N( t Exceptiont __init__t msgt mecht ext( t selfR^ R_ R` ( ( s' /usr/lib/python2.7/site-packages/spf.pyR] s c C s$ | j r d | j | j f S| j S( Ns %s: %s( R_ R^ ( Ra ( ( s' /usr/lib/python2.7/site-packages/spf.pyt __str__ s N( t __name__t __module__t __doc__t NoneR] Rb ( ( ( s' /usr/lib/python2.7/site-packages/spf.pyR s R c B s& e Z d Z d d d � Z d � Z RS( s Temporary SPF errorc C s8 t j | | | � t | � | _ | | _ | | _ d S( N( R\ R] R R^ R_ R` ( Ra R^ R_ R` ( ( s' /usr/lib/python2.7/site-packages/spf.pyR] s c C s$ | j r d | j | j f S| j S( Ns %s: %s( R_ R^ ( Ra ( ( s' /usr/lib/python2.7/site-packages/spf.pyRb s N( Rc Rd Re Rf R] Rb ( ( ( s' /usr/lib/python2.7/site-packages/spf.pyR s t PermErrorc B s& e Z d Z d d d � Z d � Z RS( s Permanent SPF errorc C s2 t j | | | � | | _ | | _ | | _ d S( N( R\ R] R^ R_ R` ( Ra R^ R_ R` ( ( s' /usr/lib/python2.7/site-packages/spf.pyR] s c C s$ | j r d | j | j f S| j S( Ns %s: %s( R_ R^ ( Ra ( ( s' /usr/lib/python2.7/site-packages/spf.pyRb $ s N( Rc Rd Re Rf R] Rb ( ( ( s' /usr/lib/python2.7/site-packages/spf.pyRg s c C sR t d | d | d | d | d | d | d | d | � j � \ } } } | | f S( s& Test an incoming MAIL FROM:<s>, from a client with ip address i. h is the HELO/EHLO domain name. This is the RFC4408/7208 compliant pySPF2.0 interface. The interface returns an SPF result and explanation only. SMTP response codes are not returned since neither RFC 4408 nor RFC 7208 does specify receiver policy. Applications updated for RFC 4408 and RFC 7208 should use this interface. The maximum time, in seconds, this function is allowed to run before a TempError is returned is controlled by querytime. When set to 0 the timeout parameter (default 20 seconds) controls the time allowed for each DNS lookup. When set to a non-zero value, it total time for all processing related to the SPF check is limited to querytime (default 20 seconds as recommended in RFC 7208, paragraph 4.6.4). Returns (result, explanation) where result in ['pass', 'permerror', 'fail', 'temperror', 'softfail', 'none', 'neutral' ]. Example: #>>> check2(i='61.51.192.42', s='liukebing@bcc.com', h='bmsi.com') t iR? t hRL t receiverR t verboset querytime( R( t check( Rh R? Ri RL Rj R Rk Rl t rest _t exp( ( s' /usr/lib/python2.7/site-packages/spf.pyt check2) s *c C sw t d | d | d | d | d | d | � j � \ } } } | d k rQ d } n | d k rj | d k n | | | f S( s? Test an incoming MAIL FROM:<s>, from a client with ip address i. h is the HELO/EHLO domain name. This is the pre-RFC SPF Classic interface. Applications written for pySPF 1.6/1.7 can use this interface to allow pySPF2 to be a drop in replacement for older versions. With the exception of result codes, performance in RFC 4408 compliant. Returns (result, code, explanation) where result in ['pass', 'unknown', 'fail', 'error', 'softfail', 'none', 'neutral' ]. Example: #>>> check(i='61.51.192.42', s='liukebing@bcc.com', h='bmsi.com') Rh R? Ri RL Rj Rk RH RO t tempfailRJ ( R( Rm ( Rh R? Ri RL Rj Rk Rn t codeRp ( ( s' /usr/lib/python2.7/site-packages/spf.pyRm B s $ R( c B s� e Z d Z d' d' e e e d d � Z d � Z d � Z d � Z d � Z d � Z e d � Z d' d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z e d � Z d � Z d e d � Z d � Z d d � Z d � Z d � Z i d' d( 6d' d) 6d' d* 6d' d+ 6d' d, 6d' d- 6d' d. 6d' d/ 6Z d' e d � Z d � Z d! � Z! d" � Z" d# � Z# d' d$ d' d% � Z$ d& � Z% RS(0 sj A query object keeps the relevant information about a single SPF query: i: ip address of SMTP client in dotted notation s: sender declared in MAIL FROM:<> l: local part of sender s d: current domain, initially domain part of sender s h: EHLO/HELO domain v: 'in-addr' for IPv4 clients and 'ip6' for IPv6 clients t: current timestamp p: SMTP client domain name o: domain part of sender s r: receiver c: pretty ip address (different from i for IPv6) This is also, by design, the same variables used in SPF macro expansion. Also keeps cache: DNS cache. i c C sd | | | _ | _ | r9 | r9 d | | _ d | _ n d | _ t | | � \ | _ | _ t t t j � � � | _ | j | _ d | _ | r� | | _ n d | _ i | _ t t � | _ t t � | _ | | _ d | _ d | _ | | _ | | _ | | _ | d k r | | _ n d | _ d | _ | rE| j | � n t | _ | | _ d | _ d S( Ns postmaster@t helot mailfromRO i ( R? Ri t identt split_emailR> t oR t intt timet tt dRf t pt rt cachet dictt EXPLANATIONSt defexpst expst libspf_localt lookupst void_lookupsR R Rl t timert ipaddrt set_ipR t default_modifierRk t authserv( Ra Rh R? Ri RL Rj R R Rk Rl ( ( s' /usr/lib/python2.7/site-packages/spf.pyR] m s< c C s t d | | | f � d S( Ns %s: %s "%s"( t print( Ra R_ R| R ( ( s' /usr/lib/python2.7/site-packages/spf.pyt log� s c C s� t | _ | j � d k r- g | _ t } n"| j � d k rQ g | _ t } n� t j j d k r� t | t � r� | j d � } q� n y@ y t j | � | _ Wn# t k r� t j | � | _ n XWn% t k r� } t t | � � � n X| j j d k r7| j j r.t j | j j � | _ t } q=t } n t } t | j � | _ | r�d | _ d | _ | j r�d j t | j j j d d � j � � � | _ n d | _ n6 d | _ d | _ | j r�| j j | _ n d | _ d S( s$ Set connect ip, and ip6 or ip4 mode.t listt list6i t asciii R! RV R= t :RP i� R s in-addri N( t Falset iplistt lowerR t syst version_infot majort isinstanceR t decodet ipaddresst ip_addressR� R t IPAddresst ValueErrorRg t versiont ipv4_mappedt IPv4Addresst cR t vt joinR� t explodedt replacet upperRh t cidrmax( Ra Rh RV R ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� � sF 3 c C s; | j } | j } x" d D] } | | | <| | | <q Wd S( NRF RB RH ( RF RB s permerror( R� R� ( Ra Rp R� R� Rh ( ( s' /usr/lib/python2.7/site-packages/spf.pyt set_default_explanation� s c C s( | j } x d D] } | | | <q Wd S( NRF RB RH ( s softfails fails permerror( R� ( Ra Rp R� Rh ( ( s' /usr/lib/python2.7/site-packages/spf.pyt set_explanation� s c C s� | j s� | j � } | s' d | _ q� | j | k rE | j | _ q� d | j } x: | D]" } | j | � rY | | _ PqY qY W| d | _ n | j S( NRO R= i ( R} t validated_ptrsR| t endswith( Ra R} t sfxR| ( ( s' /usr/lib/python2.7/site-packages/spf.pyt getp� s c C s� t j | j � d r d S| j } | j | � \ } } } | d k r� | j rt | j j rt | j j \ } } } n d \ } } | | _ n | | | f S( s� Return a best guess based on a default SPF record. >>> q = query('1.2.3.4','','SUPERVISION1',receiver='example.com') >>> q.best_guess()[0] 'none' i����RK i� RP RH RD ( RK i� RP ( RD i� ( t RE_TOPLABt splitR| t perm_errorRm R` ( Ra R t peR~ R� t e( ( s' /usr/lib/python2.7/site-packages/spf.pyt best_guess� s c C s� g | _ d | _ d | _ d | _ i | _ y� d | _ | sv | j | j � } | j rv | j d | j | � qv n | r� | j d d � } n | j r� | r� t | | j � } n | j | | j d � } | j r� | | j _ | j � n | SWn� t k rG} | j | _ | j r0| j j | j � n d d d t | � f St k r�} | j sk| | _ n | j | _ | j r�| j j | j � n d d d t | � f SXd S( s� Returns (result, mta-status-code, explanation) where result in ['fail', 'softfail', 'neutral' 'permerror', 'pass', 'temperror', 'none'] Examples: >>> q = query(s='strong-bad@email.example.com', ... h='mx.example.org', i='192.0.2.3') >>> q.check(spf='v=spf1 ?all') ('neutral', 250, 'access neither permitted nor denied') >>> q.check(spf='v=spf1 redirect=controlledmail.com exp=_exp.controlledmail.com') ('fail', 550, 'SPF fail - not authorized') >>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ?all moo') ('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo') >>> q.check(spf='v=spf1 ip4:192.0.0.n ?all') ('permerror', 550, 'SPF Permanent Error: Invalid IP4 address: ip4:192.0.0.n') >>> q.check(spf='v=spf1 ip4:192.0.2.3 ip4:192.0.0.n ?all') ('permerror', 550, 'SPF Permanent Error: Invalid IP4 address: ip4:192.0.0.n') >>> q.check(spf='v=spf1 ip6:2001:db8:ZZZZ:: ?all') ('permerror', 550, 'SPF Permanent Error: Invalid IP6 address: ip6:2001:db8:ZZZZ::') >>> q.check(spf='v=spf1 =a ?all moo') ('permerror', 550, 'SPF Permanent Error: Unknown qualifier, RFC 4408 para 4.6.1, found in: =a') >>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ~all') ('pass', 250, 'sender SPF authorized') >>> q.check(spf='v=spf1 ip4:192.0.0.0/8 -all moo=') ('pass', 250, 'sender SPF authorized') >>> q.check(spf='v=spf1 ip4:192.0.0.0/8 -all match.sub-domains_9=yes') ('pass', 250, 'sender SPF authorized') >>> q.strict = False >>> q.check(spf='v=spf1 ip4:192.0.0.0/8 -all moo') ('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo') >>> q.perm_error.ext ('pass', 250, 'sender SPF authorized') >>> q.strict = True >>> q.check(spf='v=spf1 ip4:192.1.0.0/16 moo -all') ('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo') >>> q.check(spf='v=spf1 ip4:192.1.0.0/16 ~all') ('softfail', 250, 'domain owner discourages use of this host') >>> q.check(spf='v=spf1 -ip4:192.1.0.0/6 ~all') ('fail', 550, 'SPF fail - not authorized') # Assumes DNS available >>> q.check() ('none', 250, '') >>> q.check(spf='v=spf1 ip4:1.2.3.4 -a:example.net -all') ('fail', 550, 'SPF fail - not authorized') >>> q.libspf_local='ip4:192.0.2.3 a:example.org' >>> q.check(spf='v=spf1 ip4:1.2.3.4 -a:example.net -all') ('pass', 250, 'sender SPF authorized') >>> q.check(spf='v=spf1 ip4:1.2.3.4 -all exp=_exp.controlledmail.com') ('fail', 550, 'Controlledmail.com does not send mail from itself.') >>> q.check(spf='v=spf1 ip4:1.2.3.4 ?all exp=_exp.controlledmail.com') ('neutral', 250, 'access neither permitted nor denied') i t tops t RI i� s SPF Temporary Error: RH i& s SPF Permanent Error: N( R_ Rf R� t mechanismR� t optionsR� t dns_spfR| Rk R� R� R� t insert_libspf_local_policyt check1R` R R^ t probR) R Rg ( Ra R t rcR ( ( s' /usr/lib/python2.7/site-packages/spf.pyRm � sB F c C s� | t k r3 | j r$ t d � � n t d � � n y8 z' | j | } | _ | j | | � SWd | | _ XWnL t k r� } | j | _ | j r� | j j | j � n d d d | f SXd S( Ns Too many levels of recursionRN i s SPF Ambiguity Warning: %s( t MAX_RECURSIONR t AssertionErrorRg R| t check0R R^ R� R_ R) ( Ra R t domaint recursiont tmpR ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� l s c G sZ | j r t | � � n | j sS y t | � � WqS t k rO } | | _ qS Xn | j S( N( R Rg R� ( Ra R^ R ( ( s' /usr/lib/python2.7/site-packages/spf.pyt note_error� s c C s2 t j | � d r% t d | � � n | j | � S( s validate and expand domain-speci����s Invalid domain found (use FQDN)( R� R� Rg t expand( Ra t arg( ( s' /usr/lib/python2.7/site-packages/spf.pyt expand_domain� s c C s: | j d � r, | j d | � | d } n t | | j � \ } } } } | r t j | d � } | rv | d } q d } n | t k r� | j d | � t | } n | d k r� t j | � r� | j d | � } d } n | d! k rk| d" k r� d } n | d k r t d | � � n | d" k r2d } n | d k rPt d | � � n | j d k r�| } q�n| d k s�t j | � r'| d k r�| j d | � d | } } n | d" k r�t d | � � n | d" k r�d } n | d k rt d | � � n t j | � s�t d | � � q�n� | d k r�| d" k rQt d | � � n | d" k rfd } n | d k r�t d | � � n t j | � s�t d | � � q�nB | d" k s�| d" k r�| t k r�t d | � � q�n | j } | d# k r�| d k r| rt d | � � n | j | � } | sBt d | � � n | d k r�| | j k r�| d k r{t d | � � n t d | � � q�n | | | | | f S| d k r�| j d � r�| j d | � n | t k r�| | | | | f S| d t k r| j d | � } n | j d | � } | | | | | f S($ s Parse and validate a mechanism. Returns mech,m,arg,cidrlength,result Examples: >>> q = query(s='strong-bad@email.example.com.', ... h='mx.example.org', i='192.0.2.3') >>> q.validate_mechanism('A') ('A', 'a', 'email.example.com', 32, 'pass') >>> q = query(s='strong-bad@email.example.com', ... h='mx.example.org', i='192.0.2.3') >>> q.validate_mechanism('A//64') ('A//64', 'a', 'email.example.com', 32, 'pass') >>> q.validate_mechanism('A/24//64') ('A/24//64', 'a', 'email.example.com', 24, 'pass') >>> q.validate_mechanism('?mx:%{d}/27') ('?mx:%{d}/27', 'mx', 'email.example.com', 27, 'neutral') >>> try: q.validate_mechanism('ip4:1.2.3.4/247') ... except PermError as x: print(x) Invalid IP4 CIDR length: ip4:1.2.3.4/247 >>> try: q.validate_mechanism('ip4:1.2.3.4/33') ... except PermError as x: print(x) Invalid IP4 CIDR length: ip4:1.2.3.4/33 >>> try: q.validate_mechanism('a:example.com:8080') ... except PermError as x: print(x) Invalid domain found (use FQDN): example.com:8080 >>> try: q.validate_mechanism('ip4:1.2.3.444/24') ... except PermError as x: print(x) Invalid IP4 address: ip4:1.2.3.444/24 >>> try: q.validate_mechanism('ip4:1.2.03.4/24') ... except PermError as x: print(x) Invalid IP4 address: ip4:1.2.03.4/24 >>> try: q.validate_mechanism('-all:3030') ... except PermError as x: print(x) Invalid all mechanism format - only qualifier allowed with all: -all:3030 >>> q.validate_mechanism('-mx:%%%_/.Clara.de/27') ('-mx:%%%_/.Clara.de/27', 'mx', '% /.Clara.de', 27, 'fail') >>> q.validate_mechanism('~exists:%{i}.%{s1}.100/86400.rate.%{d}') ('~exists:%{i}.%{s1}.100/86400.rate.%{d}', 'exists', '192.0.2.3.com.100/86400.rate.email.example.com', 32, 'softfail') >>> q.validate_mechanism('a:mail.example.com.') ('a:mail.example.com.', 'a', 'mail.example.com', 32, 'pass') >>> try: q.validate_mechanism('a:mail.example.com,') ... except PermError as x: print(x) Do not separate mechnisms with commas: a:mail.example.com, >>> q = query(s='strong-bad@email.example.com', ... h='mx.example.org', i='2001:db8:1234::face:b007') >>> q.validate_mechanism('A//64') ('A//64', 'a', 'email.example.com', 64, 'pass') >>> q.validate_mechanism('A/16') ('A/16', 'a', 'email.example.com', 128, 'pass') >>> q.validate_mechanism('A/16//48') ('A/16//48', 'a', 'email.example.com', 48, 'pass') t ,s% Do not separate mechnisms with commasi����i i R@ s Unknown mechanism foundR s' Use the ip4 mechanism for ip4 addressesRU RQ i s Invalid IP4 CIDR lengthi� s Invalid IP6 CIDR lengthRV s Missing IP4s Dual CIDR not alloweds Invalid IP4 addresss Invalid IP6 addresss CIDR not allowedRR RS RT s implicit exists not alloweds empty domain:s include has trivial recursions include mechanism missing domainRW R� s> Invalid all mechanism format - only qualifier allowed with alls0 Unknown qualifier, RFC 4408 para 4.6.1, found in( R s mxN( R s mxs ptrs existss include( R� R� t parse_mechanismR| t RESULTSt gett COMMON_MISTAKESt RE_IP4t matchRf Rg R� t RE_IP6t ALL_MECHANISMSR� R� t count( Ra R_ t mR� t cidrlengtht cidr6lengtht resultR ( ( s' /usr/lib/python2.7/site-packages/spf.pyt validate_mechanism� s� F c C sB | s d d t d f S| j d � } | d j � d k rq | j d k r` t d | j � � n d d t d f Sg | d D] } | r| | ^ q| } | j } d$ } d } g } g } x | D]} t j | � d } t | � d k r| j | j | � � q� n | \ } } | | k rP| d k r9t d | � � n | j d | | � n | j | � | d k r�| s�t d | � � n | j | � } | r�y0 | j | � } | r�| r�| j | � n Wq�q�Xq�q� | d k r| j � | j | � } | s�t d | � � q�q� | d k rz| j d k r@t d � � n | j r�| j r�| j | � } t j | | � } q�q� | d k r�| s�x0 | j d � D] } | r�t | j | <q�q�Wq�q� | j | d � q� Wx$| D]�\ } } } } } | d k r�| j � | j | � } | j r7| j d | | � n | j | | | d � \ } } } | d k riPn | d k r�| j d | | � n d } q�q�| d k r�Pq�| d k r�| j � y& t | j | d � � d k r�Pn Wqkt k r�qkXq�| d k r9| j � | j | j | | j � | � rkPqkq�| d k rq| j � | j | j | � | � rkPqkq�| d k r�| j d k rky | j | g | � r�Pn Wq�t! j" k r�t d | � � q�Xqkq�| d k r9| j d k rky | j | g | � r Pn Wq6t! j" k r2t d | � � q6Xqkq�| d k r�| j � t# | j$ � | � rkPqkq�q�W| r�| j | � } | s�t d! | � � n | j r�| j d | | � n | s�t% | j& � | _ i | _ n | j | | | � S| } d$ } | s| | _' n | d" k r-| d# | | f S| d | | f Sd$ S(% s� Test this query information against SPF text. Returns (result, mta-status-code, explanation) where result in ['fail', 'unknown', 'pass', 'none'] RK i� R� i s v=spf1i s Invalid SPF record inRD i t redirects" redirect= MUST appear at most onces %s= MUST appear at most onceRp s exp has empty domain-spec:s redirect has empty domain:t defaults" The default= modifier is obsolete.t opR= RT R@ s+ No valid SPF record for included domain: %sRW RS R R RQ RU s in-addrs syntax errorRV RR s! redirect domain has no SPF recordRB i& N(( R� R� R� R R R| R� Rf t RE_MODIFIERt lenR) R� Rg R� R� t get_explanationR� t check_lookupsR� R� R� R� R R� R� Rk R� R� t dns_at cidrmatchR t dns_mxR� t socketRJ t domainmatchR� R� R� R� ( Ra R R� R_ R� R� R� t mechst modifiersR� t modR� Rp R� R� R� R| Rn Rs t txtt redirect_record( ( s' /usr/lib/python2.7/site-packages/spf.pyR� : s� # " ! c C s] | j d | _ | j t d k r: t d t d � � n | j t k rY | j d � n d S( Ni i s More than %d DNS lookupss Too many DNS lookups( R� t MAX_LOOKUPRg R� ( Ra ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� � s c C s� | r� yN | j | d t �} t | � d k rS t | j t | d � d t �� SWq� t k r| | j d k r} � q} q� Xn | j d k r� t d � � n d S( s Expand an explanation.t ignore_voidi i t stripdots Empty domain-spec on exp=N( t dns_txtR R� R R� t to_asciiR� Rg R Rf ( Ra t specR ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� � s ' c C sU | j d � d k rY t } x; | j d � D]' } | j | � r+ t d | � � q+ q+ Wn d } d } xut j | � D]d} | | | | j � !7} | | j � | j � !} | d k r� | d 7} n | d k r� | d 7} n� | d k r� | d 7} n� | d j � } | d k r | j � n$ | d k rC| rCt d | � � n t | | | � } | r�| | k ryt d | � � n t | | d d !t j | � � } | | d k r�t j | d � } n | | 7} n | j � } qu W| | | 7} | r | j d � r | d } n | j d � d k rQt | � d k rQ| | j d � d } qQn | S( s% Do SPF RFC macro expansion. Examples: >>> q = query(s='strong-bad@email.example.com', ... h='mx.example.org', i='192.0.2.3') >>> q.p = 'mx.example.org' >>> q.r = 'example.net' >>> q.expand('%{d}') 'email.example.com' >>> q.expand('%{d4}') 'email.example.com' >>> q.expand('%{d3}') 'email.example.com' >>> q.expand('%{d2}') 'example.com' >>> q.expand('%{d1}') 'com' >>> q.expand('%{p}') 'mx.example.org' >>> q.expand('%{p2}') 'example.org' >>> q.expand('%{dr}') 'com.example.email' >>> q.expand('%{d2r}') 'example.email' >>> q.expand('%{l}') 'strong-bad' >>> q.expand('%{l-}') 'strong.bad' >>> q.expand('%{lr}') 'strong-bad' >>> q.expand('%{lr-}') 'bad.strong' >>> q.expand('%{l1r-}') 'strong' >>> q.expand('%{c}',stripdot=False) '192.0.2.3' >>> q.expand('%{r}',stripdot=False) 'example.net' >>> q.expand('%{ir}.%{v}._spf.%{d2}') '3.2.0.192.in-addr._spf.example.com' >>> q.expand('%{lr-}.lp._spf.%{d2}') 'bad.strong.lp._spf.example.com' >>> q.expand('%{lr-}.lp.%{ir}.%{v}._spf.%{d2}') 'bad.strong.lp.3.2.0.192.in-addr._spf.example.com' >>> q.expand('%{ir}.%{v}.%{l1r-}.lp._spf.%{d2}') '3.2.0.192.in-addr.strong.lp._spf.example.com' >>> try: q.expand('%(ir).%{v}.%{l1r-}.lp._spf.%{d2}') ... except PermError as x: print(x) invalid-macro-char : %(ir) >>> q.expand('%{p2}.trusted-domains.example.net') 'example.org.trusted-domains.example.net' >>> q.expand('%{p2}.trusted-domains.example.net.') 'example.org.trusted-domains.example.net' >>> q = query(s='@email.example.com', ... h='mx.example.org', i='192.0.2.3') >>> q.p = 'mx.example.org' >>> q.expand('%{l}') 'postmaster' t %i R= s invalid-macro-char RP s %%s %_R� s %-s %20i R} t crts& c,r,t macros allowed in exp= text onlys Unknown Macro Encounteredi i����RG i� i ( t findt RE_INVALID_MACROR� t searchRg t RE_CHARt finditert startt endR� R� t getattrt expand_onet JOINERSR� t urllibparset quoteR� R� R� t index( Ra R? R� t regext labelR� R� Rh t macrot lettert expansionR� ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� � sL W " c C so x4 | j d � D]# } | s/ t | � d k r d Sq Wg | j | � D] } t j | � rG | ^ qG } t | � d k r� | j r� t d | j � n t d � � n t | � d k r� | j d k r� t | d � S| j d k r�y> g | j | d d t �D] } t j | � r� | ^ q� } Wn7 t k rZ} | j d k rQt | � � n g } n Xt | � d k r|t d � � n t | � d k r�| j d k r�t | � d k r�| d | d k r�t d � � n t | d � Sn t | � d k rt | d � St rkg | j | d t d t �D] } t j | � r'| ^ q'} t | � d k rkt | d � Sn d S( s� Get the SPF record recorded in DNS for a specific domain name. Returns None if not found, or if more than one record is found. R= i? i s cache=s' Two or more type TXT spf records found.i i R% R� s' Two or more type SPF spf records found.sL v=spf1 records of both type TXT and SPF (type 99) present, but not identicals ._spf.N( R� R� Rf R� t RE_SPFR� Rk R� R Rg R R� R R R t DELEGATE( Ra R� R� R{ R t bR ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� sD 1 ! 5 ! R$ c C s� | r� y� | j | | d | �} | r� g | D]# } | r. | d d j | � ^ q. } t | d t � rn | Sg | D] } | j d � ^ qu SWq� t k r� t d | | f � � q� Xn g S( s, Get a list of TXT records for a domain name.R� i s utf-8s. Non-ascii characters found in %s record for %s( R& R� R� t bytest encodet UnicodeErrorRg ( Ra t domainnamet rrR� t dns_listR R? ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� � s 0$ c C s� | j | d � } | j r t } t | � t k rF t d t � � n | j d k r� t | � d k r| t d | � � q| q� n t d } | j � g | | D], } | j | d | j � D] } | ^ q� q� S( sS Get a list of IP addresses for all MX exchanges for a domain name. R" s More than %d MX records returnedi i s$ No MX records found for mx mechanismi ( R& R t MAX_MXR� Rg R t sortR� R ( Ra R t mxnamest maxRQ R ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� � s R c C s� | s g S| j | | � } | j d k rS t | � d k rS t d | | � � n | d k r� t t k r� g | D] } t j | � ^ qr S| S( s5 Get a list of IP addresses for a domainname. i i s No %s records found forR! ( R& R R� R R R R� t Bytes( Ra R R R~ RY ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� � s ! c C s | j r� t } | j d k r� yn | j | j � } t | � | k rd d | } t | | j � � n' t | � d k r� t d | j � � n Wq� t d | j � � q� Xq� n t d } | j } g | j | j � | D]- } | j | j | | j � | � r� | ^ q� S( s= Figure out the validated PTR domain names for the connect IP.i s! More than %d PTR records returnedi s& No PTR records found for ptr mechanismi ( R t MAX_PTRt dns_ptrRh R� R R� R� R� R� R ( Ra R t ptrnamest warningR� R} ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� � s$ c C s# | j d t | � | j f d � S( s- Get a list of domain names for an IP address.s %s.%s.arpaR# ( R& t reverse_dotsR� ( Ra Rh ( ( s' /usr/lib/python2.7/site-packages/spf.pyR s R" t CNAMER! R# R% c C s� | s t d � � n t | � } | j d � r= | d } n t d � | j d � t � s_ g S| j � } | j j | | f g � } | r� | S| d f } | j j | � } | j o� | j d � } | r� | d } n�t j } | j d k r t d � � n | j | j k r-| j d k r-| j } n | j } t j � } x� t | | | j | � D]� \ } } | r�t d | | � n | d j � | d f } | | k r�| } | j j | | f g � } | r�Pq�n | d d k s�| | d f | k r[| rt d | | � n | j j | g � j | � q[q[W| j j | | f g � } | j d k r}| j t j � | | _ n | r>| r>| s�i } n% t | � t k r�t d t � � n | | | <| j � j d � | k r| j d k r;t d | � � q;q>| j | | d | �} | r>| | j | | f <q>n | r�| r�| j d 7_ | j t k r�t d t � � q�n | S( s� DNS query. If the result is in cache, return that. Otherwise pull the result from DNS, and cache ALL answers, so additional info is available for further queries later. CNAMEs are followed. If there is no data, [] is returned. pre: qtype in ['A', 'AAAA', 'MX', 'PTR', 'TXT', 'SPF'] post: isinstance(__return__, types.ListType) Examples: >>> c = query(s='strong-bad@email.example.com', ... h='parallel.kitterman.org',i='192.0.2.123') >>> "".join( chr(x) for x in bytearray(c.dns('parallel.kitterman.org', 'TXT')[0][0]) ) 'v=spf1 include:long.kitterman.org include:cname.kitterman.org -all' s Invalid queryR= i����c S s$ | o# d t | � k o! d k SS( Ni i@ ( R� ( R t y( ( s' /usr/lib/python2.7/site-packages/spf.pyt <lambda>7 s R s cname.i s) DNS Error: exceeded max query lookup times result=i s addcache=s Length of CNAME chain exceeds %ds CNAME loopt cnamess Void lookup limit of %d exceeded( R\ R R� R R� R R� R R� Rk t startswithR( t SAFE2CACHERl R R Rz t DNSLookupR R� t setdefaultR) R� t MAX_CNAMERg t rstripR R& R� t MAX_VOID_LOOKUPS( Ra R R R R� R� t cnamekt cnamet debugt safe2cacheR t timethent kR� ( ( s' /usr/lib/python2.7/site-packages/spf.pyR& sp ! % & # c C s� y�yt j j d k re xJ t | � D]9 \ } } t | | t � r% | | j d � | | <q% q% Wn x� g | D] } t j | � ^ qo D]x } | j d | � } t | j t � r� | j | j � r t Sq� | | j k r� | j j | � q� | j j | j � q� WWn� t k r�x� g | D] } t j | d t �^ q D]x } | j d | � } t | j t � r�| j | j � r�t Sq>| | j k r�| j j | � q>| j j | j � q>Wn XWn% t k r�} t t | � � � n Xt S( sB Match connect IP against a CIDR network of other IP addresses. Examples: >>> c = query(s='strong-bad@email.example.com', ... h='mx.example.org', i='192.0.2.3') >>> c.p = 'mx.example.org' >>> c.r = 'example.com' >>> c.cidrmatch(['192.0.2.3'],32) True >>> c.cidrmatch(['192.0.2.2'],32) False >>> c.cidrmatch(['192.0.2.2'],31) True >>> six = query(s='strong-bad@email.example.com', ... h='mx.example.org', i='2001:0db8:0:0:0:0:0:0001') >>> six.p = 'mx.example.org' >>> six.r = 'example.com' >>> six.cidrmatch(['2001:0DB8::'],127) True >>> six.cidrmatch(['2001:0DB8::'],128) False >>> six.cidrmatch(['2001:0DB8:0:0:0:0:0:0001'],128) True i R� t new_prefixR ( R� R� R� t enumerateR� R R� R� t ip_networkt supernetR� t boolt __contains__R� R R� R) RY R t IPNetworkR� R� Rg ( Ra t ipaddrst nt idxRY t netwrkt networkR ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� p s4 !) / c C s� d d l } d j d � | j d � D� � } | j j | � } x� | j D]� } | j d k rJ | j | _ | j | _ | j d j d k r� | j d j | _ | j d j | _ n | j d j d k r� | j d j | _ q� qJ qJ Wd S( sc Set SPF values from RFC 5451 Authentication Results header. Useful when SPF has already been run on a trusted gateway machine. Expects the entire header as an input. Examples: >>> q = query('192.0.2.3','strong-bad@email.example.com','mx.example.org') >>> q.mechanism = 'unknown' >>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=neutral \n (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) \n smtp.mailfrom=email.example.com \n (sender=strong-bad@email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=?all)''') >>> q.get_header(q.result, header_type='authres', aid='bmsi.com') 'Authentication-Results: bmsi.com; spf=neutral (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=email.example.com (sender=email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)' >>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=None (mail.bmsi.com: test; client-ip=163.247.46.150) smtp.mailfrom=admin@squiebras.cl (helo=mail.squiebras.cl; receiver=mail.bmsi.com;\n mechanism=mx/24)''') >>> q.get_header(q.result, header_type='authres', aid='bmsi.com') 'Authentication-Results: bmsi.com; spf=none (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=admin@squiebras.cl (sender=admin@squiebras.cl; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)' i����NR� c s s | ] } | j � Vq d S( N( t strip( t .0R? ( ( s' /usr/lib/python2.7/site-packages/spf.pys <genexpr>� s s R i Ru Rt ( t authresR� R� t AuthenticationResultsHeadert parset resultst methodt authserv_idR� R� t propertiesR t valueR| R? Ri ( Ra t valR3 t arobjt resobj( ( s' /usr/lib/python2.7/site-packages/spf.pyt parse_header_ar� s " c C s� | j d d � } | d j � | _ d | _ t | � d k rD d S| d } | j d � r� | j d � } | d k r | j S| d | !| _ | | d } n t � } | j d d | � i } x� | j d d � D]� \ } } | d k r� | j | � q� | d k r| | _ q� | d k r.| | _ q� | d k rF| | _ q� | d k r^| | _ q� | d k rv| | _ q� | d k r�| | _ q� | j d � r� | | | d <q� q� Wt | j | j � \ | _ | _ | S( s� Set SPF values from Received-SPF header. Useful when SPF has already been run on a trusted gateway machine. Examples: >>> q = query('0.0.0.0','','') >>> p = q.parse_header_spf('''Pass (test) client-ip=70.98.79.77; ... envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com; ... receiver=mail.bmsi.com; mechanism=a; identity=mailfrom''') >>> q.get_header(q.result) 'Pass (test) client-ip=70.98.79.77; envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com; receiver=mail.bmsi.com; mechanism=a; identity=mailfrom' >>> o = q.parse_header_spf('''None (mail.bmsi.com: test) ... client-ip=163.247.46.150; envelope-from="admin@squiebras.cl"; ... helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24; ... x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom''') >>> q.get_header(q.result,**o) 'None (mail.bmsi.com: test) client-ip=163.247.46.150; envelope-from="admin@squiebras.cl"; helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24; x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom' >>> o['bestguess'] 'pass' i i i RK t (t )s Received-SPFs ; R s client-ips envelope-fromRt Rj t problemR� t identitys x-N( R� Rf R� R� R� R� R R� t commentR t add_headert get_paramsR� R? Ri R~ R_ Rv Rw R> Rx ( Ra R; R t posR^ R} R$ R� ( ( s' /usr/lib/python2.7/site-packages/spf.pyt parse_header_spf� sD !c C s- | j d � r | j | � S| j | � Sd S( s� Set SPF values from Received-SPF or RFC 5451 Authentication Results header. Useful when SPF has already been run on a trusted gateway machine. Auto detects the header type and parses it. Use parse_header_spf or parse_header_ar for each type if required. Examples: >>> q = query('0.0.0.0','','') >>> p = q.parse_header('''Pass (test) client-ip=70.98.79.77; ... envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com; ... receiver=mail.bmsi.com; mechanism=a; identity=mailfrom''') >>> q.get_header(q.result) 'Pass (test) client-ip=70.98.79.77; envelope-from="evelyn@subjectsthum.com"; helo=mail.subjectsthum.com; receiver=mail.bmsi.com; mechanism=a; identity=mailfrom' >>> r = q.parse_header('''None (mail.bmsi.com: test) ... client-ip=163.247.46.150; envelope-from="admin@squiebras.cl"; ... helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24; ... x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom''') >>> q.get_header(q.result,**r) 'None (mail.bmsi.com: test) client-ip=163.247.46.150; envelope-from="admin@squiebras.cl"; helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24; x-bestguess=pass; x-helo-spf=neutral; identity=mailfrom' >>> r['bestguess'] 'pass' >>> q = query('192.0.2.3','strong-bad@email.example.com','mx.example.org') >>> q.mechanism = 'unknown' >>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=neutral \n (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) \n smtp.mailfrom=email.example.com \n (sender=strong-bad@email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=?all)''') >>> q.get_header(q.result, header_type='authres', aid='bmsi.com') 'Authentication-Results: bmsi.com; spf=neutral (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=email.example.com (sender=email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)' >>> p = q.parse_header_ar('''Authentication-Results: bmsi.com; spf=None (mail.bmsi.com: test; client-ip=163.247.46.150) smtp.mailfrom=admin@squiebras.cl (helo=mail.squiebras.cl; receiver=mail.bmsi.com; mechanism=mx/24)''') >>> q.get_header(q.result, header_type='authres', aid='bmsi.com') 'Authentication-Results: bmsi.com; spf=none (unknown: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=admin@squiebras.cl (sender=admin@squiebras.cl; helo=mx.example.org; client-ip=192.0.2.3; receiver=unknown; mechanism=unknown)' s Authentication-Results:N( R R> RG ( Ra R; ( ( s' /usr/lib/python2.7/site-packages/spf.pyt parse_header� s R c K s | d k r0 | s! t d � � n d d l } n | sB | j } n | j } t | j � } i d d 6d d 6d d 6d d 6d d 6d d 6d d 6} | j } | d k r� d } n t | j � } | | } | d k r� | j r� t d j | j � � } n d } t | j � } t | d � r(| j } n d | | j | � f } d | | f g } | d k r)xG d/ D]? } t � | } | rg| j d | j d d � | f � qgqgWxX t t | j � � � D]> \ } } | r�| j d! | j d d � t | � f � q�q�W| j d" d# | f � d j | � S| d k r�| r�t | j d$ | d% | j d& | d' | d( | j d) d* j | j | j | j | j | � � g � � St | j d$ | d% | j d& | d' | d+ | j d, d- j | j | j | j | � � g � � Sn t d. j | � � � d S(0 sD Generate Received-SPF or Authentication Results header based on the last lookup. >>> q = query(s='strong-bad@email.example.com', h='mx.example.org', ... i='192.0.2.3') >>> q.r='abuse@kitterman.com' >>> q.check(spf='v=spf1 ?all') ('neutral', 250, 'access neither permitted nor denied') >>> q.get_header('neutral') 'Neutral (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; mechanism=?all; identity=mailfrom' >>> q.check(spf='v=spf1 redirect=controlledmail.com exp=_exp.controlledmail.com') ('fail', 550, 'SPF fail - not authorized') >>> q.get_header('fail') 'Fail (abuse@kitterman.com: domain of email.example.com does not designate 192.0.2.3 as permitted sender) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; mechanism=-all; identity=mailfrom' >>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ?all moo') ('permerror', 550, 'SPF Permanent Error: Unknown mechanism found: moo') >>> q.get_header('permerror') 'PermError (abuse@kitterman.com: permanent error in processing domain of email.example.com: Unknown mechanism found) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; problem=moo; identity=mailfrom' >>> q.check(spf='v=spf1 ip4:192.0.0.0/8 ~all') ('pass', 250, 'sender SPF authorized') >>> q.get_header('pass') 'Pass (abuse@kitterman.com: domain of email.example.com designates 192.0.2.3 as permitted sender) client-ip=192.0.2.3; envelope-from="strong-bad@email.example.com"; helo=mx.example.org; receiver=abuse@kitterman.com; mechanism="ip4:192.0.0.0/8"; identity=mailfrom' >>> q.check(spf='v=spf1 ?all') ('neutral', 250, 'access neither permitted nor denied') >>> q.get_header('neutral', header_type = 'authres', aid='bmsi.com') 'Authentication-Results: bmsi.com; spf=neutral (abuse@kitterman.com: 192.0.2.3 is neither permitted nor denied by domain of email.example.com) smtp.mailfrom=email.example.com (sender=strong-bad@email.example.com; helo=mx.example.org; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=?all)' >>> p = query(s='strong-bad@email.example.com', h='mx.example.org', ... i='192.0.2.3') >>> p.r='abuse@kitterman.com' >>> p.check(spf='v=spf1 redirect=controlledmail.com exp=_exp.controlledmail.com') ('fail', 550, 'SPF fail - not authorized') >>> p.ident = 'helo' >>> p.get_header('fail', header_type = 'authres', aid='bmsi.com') 'Authentication-Results: bmsi.com; spf=fail (abuse@kitterman.com: domain of email.example.com does not designate 192.0.2.3 as permitted sender) smtp.helo=mx.example.org (sender=strong-bad@email.example.com; client-ip=192.0.2.3; receiver=abuse@kitterman.com; mechanism=-all)' >>> q.check(spf='v=spf1 ?all') ('neutral', 250, 'access neither permitted nor denied') >>> try: q.get_header('neutral', header_type = 'dkim') ... except SyntaxError as x: print(x) Unknown results header type: dkim R3 sK authserv-id missing for Authentication Results header type, see RFC5451 2.3i����Nt PassR@ t NeutralRD t FailRB t SoftFailRF Rf RK R RI Rg RH Rt R� RC s %s: %ss %s (%s)R t client_ipt envelope_fromRj RA R� s %s=%s;Ro RC s x-%s=%s;s %s=%sRB R8 R6 R� t result_commentt smtp_mailfromt smtp_mailfrom_comments@ sender={0}; helo={1}; client-ip={2}; receiver={3}; mechanism={4}t smtp_helot smtp_helo_comments6 sender={0}; client-ip={1}; receiver={2}; mechanism={3}s Unknown results header type: {0}( s client_ips envelope_froms helos receivers problems mechanism( t SyntaxErrorR3 R~ R� t quote_valueRi Rv Rf R? R_ R� R� t hasattrRC t get_header_commentt localsR) R� t sortedR� t itemsR R4 t SPFAuthenticationResultR| t format( Ra Rn Rj t header_typet aidt kvR3 RM Rt t resmapRB RN t tagRA R� RC R$ R� ( ( s' /usr/lib/python2.7/site-packages/spf.pyt get_header s` 1 *% 0 % "c C s� | j } | d k r& d | | j f S| d k rC d | | j f S| d k r` d | j | f S| d k r} d | j | f S| d k r� d | | j f S| d k r� d | S| d k r� d | | j f St d | � � d S( s) Return comment for Received-SPF header. R@ s. domain of %s designates %s as permitted senderRF sD transitioning domain of %s does not designate %s as permitted senderRD s2 %s is neither permitted nor denied by domain of %sRK RH s. permanent error in processing domain of %s: %sRI s1 temporary error in processing during lookup of %sRB s6 domain of %s does not designate %s as permitted senders' invalid SPF result for header comment: N( Rx R� R� R� ( Ra Rn t sender( ( s' /usr/lib/python2.7/site-packages/spf.pyRW � s, N( s MXR ( s MXs MX( s CNAMER ( R R ( s AAAAs AAAA( s PTRs PTR( s TXTs TXT( s SPFs SPF(& Rc Rd Re Rf R t MAX_PER_LOOKUP_TIMER� R] R� R� R� R� R� t DEFAULT_SPFR� Rm R� R� R� R� R� R� R� R� R� R� R� R� R� R R R& R� R> RG RH Rb RW ( ( ( s' /usr/lib/python2.7/site-packages/spf.pyR( X sP 0 + p � � � 9 Q ; ! / %ic C si | s d | f S| j d d � } | d d k r? d | d <n t | � d k r[ t | � Sd | f Sd S( st Given a sender email s and a HELO domain h, create a valid tuple (l, d) local-part and domain-part. Examples: >>> split_email('', 'wayforward.net') ('postmaster', 'wayforward.net') >>> split_email('foo.com', 'wayforward.net') ('postmaster', 'foo.com') >>> split_email('terry@wayforward.net', 'optsw.com') ('terry', 'wayforward.net') t postmastert @i i RP i N( R� R� t tuple( R? Ri t parts( ( s' /usr/lib/python2.7/site-packages/spf.pyRw � s c C sO | d k s t j | � r | Sd | j d d � j d d � j d d � d S( s Quote the value for a key-value pair in Received-SPF header field if needed. No quoting needed for a dot-atom value. Examples: >>> quote_value('foo@bar.com') '"foo@bar.com"' >>> quote_value('mail.example.com') 'mail.example.com' >>> quote_value('A:1.2.3.4') '"A:1.2.3.4"' >>> quote_value('abc"def') '"abc\\"def"' >>> quote_value(r'abc\def') '"abc\\\\def"' >>> quote_value('abc..def') '"abc..def"' >>> quote_value('') '""' >>> quote_value(None) t "s \s \\s \"t s \x00N( Rf t RE_DOT_ATOMR� R� ( R? ( ( s' /usr/lib/python2.7/site-packages/spf.pyRU � s c C s� t j | � } t | � d k r? | d t | d � } } n d } t j | � } t | � d k r� | d t | d � } } n d } | j d d � } t | � d k r� | j � } | d k r� d } n | | | | f S| d j � | d | | f S( s� Breaks A, MX, IP4, and PTR mechanisms into a (name, domain, cidr,cidr6) tuple. The domain portion defaults to d if not present, the cidr defaults to 32 if not present. Examples: >>> parse_mechanism('a', 'foo.com') ('a', 'foo.com', None, None) >>> parse_mechanism('exists','foo.com') ('exists', None, None, None) >>> parse_mechanism('a:bar.com', 'foo.com') ('a', 'bar.com', None, None) >>> parse_mechanism('a/24', 'foo.com') ('a', 'foo.com', 24, None) >>> parse_mechanism('A:foo:bar.com/16//48', 'foo.com') ('a', 'foo:bar.com', 16, 48) >>> parse_mechanism('-exists:%{i}.%{s1}.100/86400.rate.%{d}','foo.com') ('-exists', '%{i}.%{s1}.100/86400.rate.%{d}', None, None) >>> parse_mechanism('mx:%%%_/.Claranet.de/27','foo.com') ('mx', '%%%_/.Claranet.de', 27, None) >>> parse_mechanism('mx:%{d}//97','foo.com') ('mx', '%{d}', None, 97) >>> parse_mechanism('iP4:192.0.0.0/8','foo.com') ('ip4', '192.0.0.0', 8, None) i i i R� i RS N( t RE_DUAL_CIDRR� R� Ry Rf t RE_CIDRR� ( R R| R t cidr6t cidr( ( s' /usr/lib/python2.7/site-packages/spf.pyR� � s " c C s& | j d � } | j � d j | � S( s� Reverse dotted IP addresses or domain names. Example: >>> reverse_dots('192.168.0.145') '145.0.168.192' >>> reverse_dots('email.example.com') 'com.example.email' R= ( R� t reverseR� ( R R ( ( s' /usr/lib/python2.7/site-packages/spf.pyR s c C sP | j � } x= | D]5 } | j � } | | k sD | j d | � r t Sq Wt S( s grep for a given domain suffix against a list of validated PTR domain names. Examples: >>> domainmatch(['FOO.COM'], 'foo.com') 1 >>> domainmatch(['moo.foo.com'], 'FOO.COM') 1 >>> domainmatch(['moo.bar.com'], 'foo.com') 0 R= ( R� R� R R� ( t ptrst domainsuffixRR ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� s c C s� | s | St j | � d d !\ } } } | s8 d } n t | | | � } | r] | j � n | r | t | � d d } n d j | � S( Ni i R= i RP ( t RE_ARGSR� Rq Ry R� ( R R t joinert lnRq t delimiters( ( s' /usr/lib/python2.7/site-packages/spf.pyR� 7 s c C s~ g d } } x] | D]U } | | k r_ | j | � d } | rO | j | � qi | j | � q | | 7} q W| j | � | S( s� Split a string into pieces by a set of delimiter characters. The resulting list is delimited by joiner, or the original delimiter if joiner is not specified. Examples: >>> split('192.168.0.45', '.') ['192', '.', '168', '.', '0', '.', '45'] >>> split('terry@wayforward.net', '@.') ['terry', '@', 'wayforward', '.', 'net'] >>> split('terry@wayforward.net', '@.', '.') ['terry', '.', 'wayforward', '.', 'net'] RP ( R) ( R Rw Ru R� t elementR� ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� B s c C s� | s | S| j � d } | r� | j � xd | D]U } t j | d � s1 | j | � } | g | | | +| j � d j | � } Pq1 q1 W| Sn d | S( s� Returns spftxt with local inserted just before last non-fail mechanism. This is how the libspf{2} libraries handle "local-policy". Examples: >>> insert_libspf_local_policy('v=spf1 -all') 'v=spf1 -all' >>> insert_libspf_local_policy('v=spf1 -all','mx') 'v=spf1 -all' >>> insert_libspf_local_policy('v=spf1','a mx ptr') 'v=spf1 a mx ptr' >>> insert_libspf_local_policy('v=spf1 mx -all','a ptr') 'v=spf1 mx a ptr -all' >>> insert_libspf_local_policy('v=spf1 mx -include:foo.co +all','a ptr') 'v=spf1 mx a ptr -include:foo.co +all' # FIXME: is this right? If so, "last non-fail" is a bogus description. >>> insert_libspf_local_policy('v=spf1 mx ?include:foo.co +all','a ptr') 'v=spf1 mx a ptr ?include:foo.co +all' >>> spf='v=spf1 ip4:1.2.3.4 -a:example.net -all' >>> local='ip4:192.0.2.3 a:example.org' >>> insert_libspf_local_policy(spf,local) 'v=spf1 ip4:1.2.3.4 ip4:192.0.2.3 a:example.org -a:example.net -all' i i R� s v=spf1 ( R� Rq R� R� R� R� ( t spftxtRL R R_ t where( ( s' /usr/lib/python2.7/site-packages/spf.pyR� _ s i c C s> y | j d � SWn& t k r9 t d t | � � � n Xd S( s* Raise PermError if arg is not 7-bit ascii.R� s Non-ascii characters foundN( R R Rg t repr( R? ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� � s c C s> y | j d � SWn& t k r9 t d t | � � � n Xd S( s* Raise PermError if arg is not 7-bit ascii.R� s Non-ascii characters foundN( R� R Rg R{ ( R? ( ( s' /usr/lib/python2.7/site-packages/spf.pyR� � s c C s% d d l } d d l } | j | � S( Ni����( t doctestR t testmod( R| R ( ( s' /usr/lib/python2.7/site-packages/spf.pyt _test� s t __main__i s hvs:t helpRk R s -vs --verboses -ss --stricts -hs --helpRh s 127.0.0.1t localhostRi Rj s Temporary DNS error: s PermError: i s result:s guessed:s lax:(| t __future__R t __author__t __email__t __version__t MODULEt USAGEt reR� R� t structRz t urllib.parseR5 R� t urllibt functoolsR t email.messageR t ImportErrort email.MessageR� R� R� R R R8 R& t dns.resolvert dns.exceptionRV t rdatatypeR% t _by_textR R t Typet typemapt Libt RRunpackert getTXTdatat getSPFdatat DiscoverNameServerst compilet IGNORECASER R� t PAT_CHARR� R� Rt Rm Rn R� t PAT_IP4R� R� Rl R� R� R� R� Rf R Re t TRUSTED_FORWARDERSR� R R R R� Rd R R� R� R\ R R Rg R� Rq Rm t objectR( Rw RU R� R R� R� R� R� R� R� R~ Rc t getoptt argvt optst GetoptErrort errR t exitRk R Rx R Ry R� t gethostnamet qR� R Rh R? Ri R~ R� R� R� R` R� RY ( ( ( s' /usr/lib/python2.7/site-packages/spf.pyt <module> sV + ! & � � � � � Q ! 4 3 * $