mirror of
https://github.com/mailcow/mailcow-dockerized.git
synced 2026-11-08 17:38:20 +00:00
297 lines
18 KiB
PHP
297 lines
18 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Mailcow\Tests\MailPolicy\Service;
|
|
|
|
use Mailcow\MailPolicy\Model\Policy;
|
|
use Mailcow\MailPolicy\Service\PolicyEngine;
|
|
use Mailcow\Tests\Support\FakeMailPolicyLookup;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
class PolicyEngineTest extends TestCase
|
|
{
|
|
private FakeMailPolicyLookup $lookup;
|
|
private PolicyEngine $engine;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
$this->lookup = new FakeMailPolicyLookup();
|
|
$this->lookup->domains = ['firma.de', 'tochter.de'];
|
|
$this->lookup->aliasDomains = ['firma.com' => 'firma.de'];
|
|
$this->lookup->mailboxes = [
|
|
'azubi@firma.de' => 'firma.de',
|
|
'kollege@firma.de' => 'firma.de',
|
|
'chef@firma.de' => 'firma.de',
|
|
'info@firma.de' => 'firma.de',
|
|
'andere@tochter.de' => 'tochter.de',
|
|
];
|
|
$this->lookup->groups = [
|
|
7 => ['address' => 'azubis@firma.de', 'members' => ['azubi@firma.de']],
|
|
8 => ['address' => 'vorstand@firma.de', 'members' => ['chef@firma.de']],
|
|
];
|
|
$this->engine = new PolicyEngine($this->lookup);
|
|
}
|
|
|
|
private static function policy(int $id, array $values): Policy
|
|
{
|
|
$policy = new Policy();
|
|
$policy->id = $id;
|
|
$policy->domain = 'firma.de';
|
|
$policy->name = 'policy ' . $id;
|
|
foreach ($values as $property => $value) {
|
|
$policy->$property = $value;
|
|
}
|
|
return $policy;
|
|
}
|
|
|
|
/** [allowed, side] of a check */
|
|
private function check(string $sender, string $recipient, string $login = '', int $port = 587, string $helo = ''): array
|
|
{
|
|
$decision = $this->engine->check($sender, $recipient, $login, $port, $helo);
|
|
return [$decision->allowed, $decision->side];
|
|
}
|
|
|
|
public function testWithoutPoliciesEverythingPasses(): void
|
|
{
|
|
$this->assertSame([true, ''], $this->check('x@extern.example', 'azubi@firma.de'));
|
|
$this->assertSame('DUNNO', $this->engine->check('azubi@firma.de', 'x@extern.example', 'azubi@firma.de')->action());
|
|
}
|
|
|
|
public function testSendOnlyInternalWithAllowedAndBlockedEntries(): void
|
|
{
|
|
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(1, [
|
|
'sendMode' => 'internal', 'sendAllow' => ['partner.de', 'kunde@extern.example'], 'sendBlock' => ['chef@firma.de'],
|
|
])];
|
|
|
|
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'kollege@firma.de', 'azubi@firma.de'));
|
|
// alias domain and sub-address are internal
|
|
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'Kollege+x@firma.com', 'azubi@firma.de'));
|
|
$this->assertSame([false, 'send'], $this->check('azubi@firma.de', 'x@extern.example', 'azubi@firma.de'));
|
|
// another domain of the same mailcow is not internal
|
|
$this->assertSame([false, 'send'], $this->check('azubi@firma.de', 'andere@tochter.de', 'azubi@firma.de'));
|
|
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'jemand@partner.de', 'azubi@firma.de'));
|
|
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'kunde@extern.example', 'azubi@firma.de'));
|
|
$this->assertSame([false, 'send'], $this->check('azubi@firma.de', 'chef@firma.de', 'azubi@firma.de'));
|
|
// the rules belong to the login: without it nothing is sent as azubi
|
|
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'x@extern.example'));
|
|
}
|
|
|
|
public function testSendOnlyListedRecipientsThroughAGroup(): void
|
|
{
|
|
$this->lookup->groupPolicies[7] = [self::policy(2, ['sendMode' => 'list', 'sendAllow' => ['group:8']])];
|
|
|
|
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'vorstand@firma.de', 'azubi@firma.de'));
|
|
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'chef@firma.de', 'azubi@firma.de'));
|
|
$this->assertSame([false, 'send'], $this->check('azubi@firma.de', 'kollege@firma.de', 'azubi@firma.de'));
|
|
// not a member: no rule
|
|
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'x@extern.example', 'kollege@firma.de'));
|
|
}
|
|
|
|
public function testSendingAsAnotherMailboxAppliesItsPolicyToo(): void
|
|
{
|
|
$this->lookup->mailboxPolicies['info@firma.de'] = [self::policy(3, ['sendMode' => 'internal'])];
|
|
|
|
$this->assertSame([false, 'send'], $this->check('info@firma.de', 'x@extern.example', 'chef@firma.de'));
|
|
$this->assertSame([true, ''], $this->check('chef@firma.de', 'x@extern.example', 'chef@firma.de'));
|
|
}
|
|
|
|
public function testReceiveOnlyInternalCannotBeForged(): void
|
|
{
|
|
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(4, ['receiveMode' => 'internal', 'receiveAllow' => ['partner.de'],
|
|
'receiveBlock' => ['chef@firma.de']])];
|
|
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'azubi@firma.de', '', 25));
|
|
// a forged internal sender is external
|
|
$this->assertSame([false, 'receive'], $this->check('kollege@firma.de', 'azubi@firma.de', '', 25));
|
|
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'azubi+news@firma.com', 'kollege@firma.de'));
|
|
$this->assertSame([false, 'receive'], $this->check('andere@tochter.de', 'azubi@firma.de', 'andere@tochter.de'));
|
|
// an external domain on the list is compared with the envelope sender
|
|
$this->assertSame([true, ''], $this->check('jemand@partner.de', 'azubi@firma.de', '', 25));
|
|
$this->assertSame([false, 'receive'], $this->check('chef@firma.de', 'azubi@firma.de', 'chef@firma.de'));
|
|
// null sender (bounces) is external
|
|
$this->assertSame([false, 'receive'], $this->check('', 'azubi@firma.de', '', 25));
|
|
}
|
|
|
|
public function testListedLocalSendersMustBeLoggedIn(): void
|
|
{
|
|
$this->lookup->mailboxPolicies['chef@firma.de'] = [self::policy(5, ['receiveMode' => 'list',
|
|
'receiveAllow' => ['kollege@firma.de', 'group:7', 'tochter.de']])];
|
|
|
|
$this->assertSame([false, 'receive'], $this->check('kollege@firma.de', 'chef@firma.de', '', 25));
|
|
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'chef@firma.de', 'kollege@firma.de'));
|
|
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'chef@firma.de', 'azubi@firma.de'));
|
|
$this->assertSame([false, 'receive'], $this->check('azubi@firma.de', 'chef@firma.de', '', 25));
|
|
$this->assertSame([true, ''], $this->check('andere@tochter.de', 'chef@firma.de', 'andere@tochter.de'));
|
|
$this->assertSame([false, 'receive'], $this->check('andere@tochter.de', 'chef@firma.de', '', 25));
|
|
}
|
|
|
|
public function testGroupAddressAndMembersAsRecipients(): void
|
|
{
|
|
$this->lookup->groupPolicies[8] = [self::policy(6, ['receiveMode' => 'internal', 'receiveBlock' => ['group:7']])];
|
|
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'vorstand@firma.de', '', 25));
|
|
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'vorstand@firma.de', 'kollege@firma.de'));
|
|
// the policy of a group applies to its members as well
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'chef@firma.de', '', 25));
|
|
$this->assertSame([false, 'receive'], $this->check('azubi@firma.de', 'chef@firma.de', 'azubi@firma.de'));
|
|
}
|
|
|
|
public function testInternalFlagOfAliasesAndGroups(): void
|
|
{
|
|
$this->lookup->aliases['team@firma.de'] = ['domain' => 'firma.de', 'internal' => true];
|
|
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'team@firma.de', '', 25));
|
|
// the old rspamd rule let forged senders of the domain pass
|
|
$this->assertSame([false, 'receive'], $this->check('kollege@firma.de', 'team@firma.com', '', 25));
|
|
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'team@firma.de', 'kollege@firma.de'));
|
|
$this->assertSame([false, 'receive'], $this->check('andere@tochter.de', 'team@firma.de', 'andere@tochter.de'));
|
|
}
|
|
|
|
public function testTheStrictestPolicyWins(): void
|
|
{
|
|
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(9, ['sendMode' => 'all'])];
|
|
$this->lookup->groupPolicies[7] = [self::policy(10, ['sendMode' => 'internal', 'rejectText' => 'Azubis senden nur intern'])];
|
|
|
|
$decision = $this->engine->check('azubi@firma.de', 'x@extern.example', 'azubi@firma.de', 587);
|
|
$this->assertSame(['send', 10, '550 5.7.1 Azubis senden nur intern'], [$decision->side, $decision->policy->id, $decision->action()]);
|
|
}
|
|
|
|
public function testDefaultTextsAndOwnDeliveries(): void
|
|
{
|
|
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(11, ['sendMode' => 'internal', 'receiveMode' => 'internal'])];
|
|
|
|
$this->assertSame('550 5.7.1 Sending to this recipient is not allowed by the mail policy of the sender',
|
|
$this->engine->check('azubi@firma.de', 'x@extern.example', 'azubi@firma.de', 587)->action());
|
|
$this->assertSame('550 5.7.1 This recipient does not accept mail from this sender',
|
|
$this->engine->check('x@extern.example', 'azubi@firma.de', '', 25)->action());
|
|
// quarantine release (590) and BCC/archive copies (591) are not checked
|
|
$this->assertSame([true, ''], $this->check('x@extern.example', 'azubi@firma.de', '', 590));
|
|
$this->assertSame([true, ''], $this->check('x@extern.example', 'azubi@firma.de', '', 591));
|
|
}
|
|
|
|
public function testDovecotSubmissionsCountAsTheMailbox(): void
|
|
{
|
|
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(12, ['sendMode' => 'internal'])];
|
|
$this->lookup->mailboxPolicies['chef@firma.de'] = [self::policy(13, ['receiveMode' => 'internal'])];
|
|
$this->lookup->aliases['team@firma.de'] = ['domain' => 'firma.de', 'internal' => true];
|
|
|
|
// a Sieve redirect of azubi to an external address follows its send rules
|
|
$this->assertSame([false, 'send'], $this->check('azubi+x@firma.de', 'x@extern.example', '', 588));
|
|
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'chef@firma.de', '', 588));
|
|
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'team@firma.de', '', 588));
|
|
// other senders are checked like mail from outside
|
|
$this->assertSame([false, 'receive'], $this->check('quota-warning@localhost', 'chef@firma.de', '', 588));
|
|
// the quota warning copies of Dovecot carry the address of the mailbox over its quota
|
|
$this->assertSame([true, ''], $this->check('azubi@firma.de', 'x@extern.example', '', 588, 'quotanotification'));
|
|
// on other ports the sender address is no login
|
|
$this->assertSame([false, 'receive'], $this->check('kollege@firma.de', 'team@firma.de', '', 25));
|
|
}
|
|
|
|
public function testDovecotMailWithoutMailboxSender(): void
|
|
{
|
|
// bounces redirected with the null sender, notifications of other senders: local recipients only while
|
|
// a policy restricts sending, as the sending mailbox is unknown
|
|
$this->assertSame([true, ''], $this->check('', 'x@extern.example', '', 588));
|
|
$this->lookup->sendRules = true;
|
|
$this->assertSame([false, 'send'], $this->check('', 'x@extern.example', '', 588));
|
|
$this->assertSame([false, 'send'], $this->check('irgendwer@nirgends.example', 'x@extern.example', '', 588));
|
|
$this->assertSame([true, ''], $this->check('', 'kollege@firma.com', '', 588));
|
|
// local recipients: receive rules as for mail from outside
|
|
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(14, ['sendMode' => 'internal', 'receiveMode' => 'internal'])];
|
|
$this->assertSame([false, 'receive'], $this->check('', 'azubi@firma.de', '', 588));
|
|
// SOGo reminders log in with the Dovecot master user
|
|
$this->assertSame([false, 'send'], $this->check('azubi@firma.de', 'x@extern.example', 'abc@mailcow.local', 588));
|
|
$this->assertSame([false, 'send'], $this->check('', 'x@extern.example', 'abc@mailcow.local', 588));
|
|
}
|
|
|
|
public function testRecipientsAreComparedAsPostfixDeliversThem(): void
|
|
{
|
|
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(15, ['receiveMode' => 'internal'])];
|
|
|
|
// trailing dot and quotes are dropped by Postfix
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'Azubi@Firma.de.', '', 25));
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', '"azubi+a b"@firma.com', '', 25));
|
|
// routes through another address are refused, Postfix would deliver them to the routed address
|
|
foreach (['azubi@firma.de@localhost', 'azubi%firma.de@localhost', 'firma.de!azubi@localhost.localdomain', 'x@extern.example@localhost',
|
|
'azubi%firma.de@[192.0.2.1]', 'abuse'] as $recipient) {
|
|
$this->assertSame([false, 'address'], $this->check('x@extern.example', $recipient, '', 25), $recipient);
|
|
}
|
|
// in other domains %, ! and @ in the local part are ordinary characters
|
|
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'a!b@extern.example', 'kollege@firma.de'));
|
|
$this->assertSame([true, ''], $this->check('x@extern.example', 'sales%x@firma.de', '', 25));
|
|
$this->assertSame([true, ''], $this->check('x@extern.example', 'postmaster', '', 25));
|
|
$this->assertSame('550 5.7.1 This form of the recipient address is not allowed by the mail policy',
|
|
$this->engine->check('azubi@firma.de', 'x%extern.example@localhost', 'azubi@firma.de', 587)->action());
|
|
}
|
|
|
|
public function testSendersAreComparedAsPostfixResolvesThem(): void
|
|
{
|
|
$this->lookup->mailboxPolicies['kollege@firma.de'] = [self::policy(16, ['sendBlock' => ['konkurrenz.example']])];
|
|
$this->lookup->mailboxPolicies['info@firma.de'] = [self::policy(17, ['sendMode' => 'internal'])];
|
|
|
|
$this->assertSame([false, 'send'], $this->check('kollege@firma.de', 'x@konkurrenz.example.', 'kollege@firma.de'));
|
|
// sending as info@ with a trailing dot keeps the policy of info@
|
|
$this->assertSame([false, 'send'], $this->check('Info@firma.de.', 'x@extern.example', 'chef@firma.de'));
|
|
}
|
|
|
|
public function testTemporaryAliasesFollowTheirOwner(): void
|
|
{
|
|
$this->lookup->temporaryAliases['einmal.xyz@firma.de'] = 'azubi@firma.de';
|
|
$this->lookup->mailboxPolicies['azubi@firma.de'] = [self::policy(18, ['receiveMode' => 'internal'])];
|
|
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'einmal.xyz@firma.de', '', 25));
|
|
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'einmal.xyz@firma.de', 'kollege@firma.de'));
|
|
}
|
|
|
|
public function testInternalFlagFollowsThePostfixLookup(): void
|
|
{
|
|
// an alias of its own in an alias domain; senders of the target domain are internal
|
|
$this->lookup->aliases['team2@firma.com'] = ['domain' => 'firma.com', 'internal' => true];
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'team2@firma.com', '', 25));
|
|
$this->assertSame([true, ''], $this->check('kollege@firma.de', 'team2@firma.com', 'kollege@firma.de'));
|
|
// the full address first, then without +tag
|
|
$this->lookup->aliases['team+ext@firma.de'] = ['domain' => 'firma.de', 'internal' => true];
|
|
$this->lookup->aliases['team@firma.de'] = ['domain' => 'firma.de', 'internal' => false];
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'team+ext@firma.de', '', 25));
|
|
$this->assertSame([true, ''], $this->check('x@extern.example', 'team+other@firma.de', '', 25));
|
|
// an internal catch-all alias covers the whole domain, also through its alias domain
|
|
$this->lookup->internalCatchAlls = ['tochter.de'];
|
|
$this->lookup->aliasDomains['tochter.com'] = 'tochter.de';
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'andere@tochter.de', '', 25));
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'unbekannt@tochter.com', '', 25));
|
|
$this->assertSame([true, ''], $this->check('andere@tochter.de', 'unbekannt@tochter.de', 'andere@tochter.de'));
|
|
}
|
|
|
|
public function testAddressesAreComparedInTheirStoredSpelling(): void
|
|
{
|
|
// MySQL ignores accents: Postfix delivers chéf@ to chef@ and töchter.de to tochter.de
|
|
$this->lookup->spellings = ['chéf@firma.de' => 'chef@firma.de', 'töchter.de' => 'tochter.de', 'köllege@firma.de' => 'kollege@firma.de'];
|
|
$this->lookup->mailboxPolicies['kollege@firma.de'] = [self::policy(20, ['sendBlock' => ['chef@firma.de', 'tochter.de']])];
|
|
$this->lookup->mailboxPolicies['chef@firma.de'] = [self::policy(21, ['receiveBlock' => ['kollege@firma.de']])];
|
|
|
|
$this->assertSame([false, 'send'], $this->check('kollege@firma.de', 'chéf@firma.de', 'kollege@firma.de'));
|
|
$this->assertSame([false, 'send'], $this->check('kollege@firma.de', 'x@töchter.de', 'kollege@firma.de'));
|
|
$this->assertSame([false, 'receive'], $this->check('köllege@firma.de', 'chef@firma.de', '', 25));
|
|
}
|
|
|
|
public function testTaggedAliasThroughAnAliasDomain(): void
|
|
{
|
|
// Postfix maps chef@firma.com to chef@firma.de and looks up chef+intern@firma.de again
|
|
$this->lookup->aliases['chef+intern@firma.de'] = ['domain' => 'firma.de', 'internal' => true];
|
|
|
|
$this->assertSame([false, 'receive'], $this->check('x@extern.example', 'chef+intern@firma.com', '', 25));
|
|
$this->assertSame([true, ''], $this->check('x@extern.example', 'chef+other@firma.com', '', 25));
|
|
}
|
|
|
|
public function testBlockEntriesAlsoMatchTheEnvelopeSender(): void
|
|
{
|
|
$this->lookup->mailboxPolicies['chef@firma.de'] = [self::policy(19, ['receiveBlock' => ['kollege@firma.de', 'group:7', 'tochter.de']])];
|
|
|
|
$this->assertSame([false, 'receive'], $this->check('kollege@firma.de', 'chef@firma.de', '', 25));
|
|
$this->assertSame([false, 'receive'], $this->check('azubi@firma.de', 'chef@firma.de', '', 25));
|
|
$this->assertSame([false, 'receive'], $this->check('andere@tochter.de', 'chef@firma.de', '', 25));
|
|
$this->assertSame([true, ''], $this->check('info@firma.de', 'chef@firma.de', '', 25));
|
|
}
|
|
}
|