Skip to content

Commit

Permalink
prettier
Browse files Browse the repository at this point in the history
  • Loading branch information
msimerson committed Apr 23, 2024
1 parent 1dbfc8f commit 731c333
Show file tree
Hide file tree
Showing 18 changed files with 918 additions and 934 deletions.
8 changes: 4 additions & 4 deletions .codeclimate.yml
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
engines:
eslint:
enabled: true
channel: "eslint-8"
channel: 'eslint-8'
config:
config: ".eslintrc.yaml"
config: '.eslintrc.yaml'

checks:
return-statements:
Expand All @@ -15,5 +15,5 @@ checks:
threshold: 10

ratings:
paths:
- "**.js"
paths:
- '**.js'
2 changes: 1 addition & 1 deletion .eslintrc.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,4 @@ env:
extends: ['@haraka']

rules:
no-unused-vars: 1
no-unused-vars: 1
8 changes: 4 additions & 4 deletions .github/dependabot.yml
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@

version: 2
updates:
- package-ecosystem: "npm"
directory: "/" # Location of package manifests
- package-ecosystem: 'npm'
directory: '/' # Location of package manifests
schedule:
interval: "weekly"
interval: 'weekly'
allow:
- dependency-type: "production"
- dependency-type: 'production'
9 changes: 4 additions & 5 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -1,20 +1,19 @@
name: CI

on: [ push, pull_request ]
on: [push, pull_request]

env:
CI: true

jobs:

lint:
uses: haraka/.github/.github/workflows/lint.yml@master

ubuntu:
needs: [ lint ]
needs: [lint]
uses: haraka/.github/.github/workflows/ubuntu.yml@master

windows:
needs: [ lint ]
needs: [lint]
uses: haraka/.github/.github/workflows/windows.yml@master
if: ${{ false }} # disabled, until Redis for GHA Windows exists
if: ${{ false }} # disabled, until Redis for GHA Windows exists
4 changes: 2 additions & 2 deletions .github/workflows/codeql.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,10 @@ name: CodeQL

on:
push:
branches: [ master ]
branches: [master]
pull_request:
# The branches below must be a subset of the branches above
branches: [ master ]
branches: [master]
schedule:
- cron: '18 7 * * 4'

Expand Down
2 changes: 2 additions & 0 deletions .prettierrc.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
singleQuote: true
semi: false
2 changes: 1 addition & 1 deletion .release
Submodule .release updated 1 files
+1 −0 contributors.js
16 changes: 3 additions & 13 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,84 +2,74 @@

The format is based on [Keep a Changelog](https://keepachangelog.com/).


### Unreleased

### [1.2.2] - 2024-04-22

- populate [files] in package.json. Delete .npmignore.
- dep: eslint-plugin-haraka -> @haraka/eslint-config
- lint: remove duplicate / stale rules from .eslintrc
- deps: bump versions
- format: prettier

### [1.2.1] - 2024-03-20

- deps: bump versions
- fix: undo increment if the email sending is delayed (#56)


### [1.2.0] - 2023-12-27

- disable history by default (match docs)
- ci: use shared workflows


### [1.1.1] - 2022-12-18

- package.json: remove deprecated 'main'


### [1.1.0] - 2022-08-18

- initialize redis when only concurrency is enabled (#42)


### [1.0.7] - 2022-06-03

- chore: add .release as a submodule
- ci: limit dependabot updates to production deps
- ci: populate test matrix with Node.js LTS versions
- cfg: rename redis.db -> redis.database, pi-redis 2+ does this automatically, causing a test failure


### 1.0.6 - 2022-05-25

- feat: update redis commands to be v4 compatible
- feat: only load redis when needed, fixes #23
- style: replaced callbacks with async/await in:
get_host_key, get_mail_key, and rate_limit
get_host_key, get_mail_key, and rate_limit
- dep(eslint): v6 -> v8
- dep(redis): 3 -> 4
- ci: add codeql & publish


### 1.0.5 - 2022-03-08

- fix invalid main field in package.json


### 1.0.4 - 2017-03-23

- for outbound, find domain at hmail.todo.domain then hmail.domain.
- noop: use es6 arrow functions


### 1.0.3 - 2017-03-09

- add `enabled=false` flag for each limit type, defaults to off, matching the docs.


### 1.0.2 - 2017-02-06

- when redis handle goes away, skip processing
- add a 5 minute expiration on outbound rate limit entries


### 1.0.1 - 2017-01-28

- increment rate_conn on connect_init
- increment rate_rcpt_host on rcpt/rcpt_ok


[1.0.6]: https://github.com/haraka/haraka-plugin-limit/releases/tag/1.0.6
[1.0.7]: https://github.com/haraka/haraka-plugin-limit/releases/tag/1.0.7
[1.1.0]: https://github.com/haraka/haraka-plugin-limit/releases/tag/1.1.0
Expand Down
4 changes: 2 additions & 2 deletions CONTRIBUTORS.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

This handcrafted artisinal software is brought to you by:

| <img height="80" src="https://avatars.githubusercontent.com/u/261635?v=4"><br><a href="https://github.com/msimerson">msimerson</a> (<a href="https://github.com/haraka/haraka-plugin-limit/commits?author=msimerson">68</a>)| <img height="80" src="https://avatars.githubusercontent.com/u/48183131?v=4"><br><a href="https://github.com/divine">divine</a> (<a href="https://github.com/haraka/haraka-plugin-limit/commits?author=divine">6</a>)| <img height="80" src="https://avatars.githubusercontent.com/u/82041?v=4"><br><a href="https://github.com/gramakri">gramakri</a> (<a href="https://github.com/haraka/haraka-plugin-limit/commits?author=gramakri">2</a>)| <img height="80" src="https://avatars.githubusercontent.com/u/28440072?v=4"><br><a href="https://github.com/leadbi">leadbi</a> (<a href="https://github.com/haraka/haraka-plugin-limit/commits?author=leadbi">1</a>)| <img height="80" src="https://avatars.githubusercontent.com/u/19733683?v=4"><br><a href="https://github.com/snyk-bot">snyk-bot</a> (<a href="https://github.com/haraka/haraka-plugin-limit/commits?author=snyk-bot">1</a>)|
| :---: | :---: | :---: | :---: | :---: |
| <img height="80" src="https://avatars.githubusercontent.com/u/261635?v=4"><br><a href="https://github.com/msimerson">msimerson</a> (<a href="https://github.com/haraka/haraka-plugin-limit/commits?author=msimerson">68</a>)| <img height="80" src="https://avatars.githubusercontent.com/u/48183131?v=4"><br><a href="https://github.com/divine">divine</a> (<a href="https://github.com/haraka/haraka-plugin-limit/commits?author=divine">6</a>)| <img height="80" src="https://avatars.githubusercontent.com/u/82041?v=4"><br><a href="https://github.com/gramakri">gramakri</a> (<a href="https://github.com/haraka/haraka-plugin-limit/commits?author=gramakri">2</a>)| <img height="80" src="https://avatars.githubusercontent.com/u/28440072?v=4"><br><a href="https://github.com/leadbi">leadbi</a> (<a href="https://github.com/haraka/haraka-plugin-limit/commits?author=leadbi">1</a>)|
| :---: | :---: | :---: | :---: |

<sub>this file is maintained by [.release](https://github.com/msimerson/.release)</sub>
53 changes: 17 additions & 36 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ Apply many types of limits to SMTP connections:
- by sender
- max null recipients / period


## Installation

```sh
Expand All @@ -37,67 +36,57 @@ Each limit type is disabled until `enabled=true` is set within its block in limi

Haraka's config loader loads the defaults from limit.ini within this plugins installed config directory and applies any overrides found in the limit.ini within your Haraka install/config directory.


### [main]

- tarpit_delay = seconds *(optional)*
- tarpit_delay = seconds _(optional)_

Set this to the length in seconds that you want to delay every SMTP response to a remote client that has exceeded the rate limits.


## [redis]

Redis is the cluster-safe storage backend for maintaining the counters necessary to impose limits reliably.

- host (default: 127.0.0.1)
- port (default: 6379)
- db (default: 0)
- db (default: 0)

If this [redis] section or any values are missing, the defaults from redis.ini are used.


## concurrency

When `[concurrency]max` is defined, it limits the maximum number of simultaneous connections per IP address. Connection attempts in excess of the limit are optionally delayed before being disconnected.

This works well in conjunction with a history / reputation database, so that one can assign very low concurrency (1) to bad or unknown senders and higher limits for reputable mail servers.


### History

History: when enabled, the `history` setting is the name of a plugin that stores IP history / reputation results. The result store must have a positive value for good connections and negative integers for poor / undesirable connections. Karma is one such plugin.


## recipients

When `[recipients]max` is defined, each connection is limited to that number of recipients. The limit is imposed against **all** recipient attempts. Attempts in excess of the limit are issued a temporary failure.


## unrecognized_commands

When `[unrecognized_commands]max` is set, a connection that exceeeds the limit is disconnected.

Unrecognized commands are normally SMTP verbs invalidly issued by the client. Examples:

* issuing AUTH when we didn't advertise AUTH extension
* issuing STARTTLS when we didn't advertise STARTTLS
* invalid SMTP verbs

- issuing AUTH when we didn't advertise AUTH extension
- issuing STARTTLS when we didn't advertise STARTTLS
- invalid SMTP verbs

### Limitations

The unrecognized_command hook is used by the `tls` and `auth` plugins, so running this plugin before those would result in valid operations getting counted against that connections limits. The solution is simple: list `limit` in config/plugins after those.


## errors

When `[errors]max` is set, a connection that exceeeds the limit is disconnected. Errors that count against this limit include:

* issuing commands out of turn (MAIL before EHLO, RCPT before MAIL, etc)
* attempting MAIL on port 465/587 without AUTH
* MAIL or RCPT addresses that fail to parse


- issuing commands out of turn (MAIL before EHLO, RCPT before MAIL, etc)
- attempting MAIL on port 465/587 without AUTH
- MAIL or RCPT addresses that fail to parse

# Rate Limits

Expand All @@ -108,15 +97,15 @@ Missing sections disable that particular test.

They all use a common configuration format:

- \<lookup\> = \<limit\>[/time[unit]] *(optional)*
- \<lookup\> = \<limit\>[/time[unit]] _(optional)_

'lookup' is based upon the limit being enforced and is either an IP address, rDNS name, sender address or recipient address either in full or part.

The lookup order is as follows and the first match in this order is returned and is used as the record key in Redis (except for 'default' which always uses the full lookup for that test as the record key):

**IPv4/IPv6 address or rDNS hostname:**

````
```
fe80:0:0:0:202:b3ff:fe1e:8329
fe80:0:0:0:202:b3ff:fe1e
fe80:0:0:0:202:b3ff
Expand All @@ -134,7 +123,7 @@ The lookup order is as follows and the first match in this order is returned and
domain.com
com
default
````
```

**Sender or Recipient address:**

Expand All @@ -146,55 +135,49 @@ The lookup order is as follows and the first match in this order is returned and
domain.com
com
default
````
```

In all tests 'default' is used to specify a default limit if nothing else has matched.

'limit' specifies the limit for this lookup. Specify 0 (zero) to disable limits on a matching lookup.
'limit' specifies the limit for this lookup. Specify 0 (zero) to disable limits on a matching lookup.

'time' is optional and if missing defaults to 60 seconds. You can optionally specify the following time units (case-insensitive):

- s (seconds)
- m (minutes)
- h (hours)
- d (days)

- s (seconds)
- m (minutes)
- h (hours)
- d (days)

### [rate_conn]

This section limits the number of connections per interval from a given host or set of hosts.

IP and rDNS names are looked up by this test.


### [rate_rcpt_host]

This section limits the number of recipients per interval from a given host or set of hosts.

IP and rDNS names are looked up by this test.


### [rate_rcpt_sender]

This section limits the number of recipients per interval from a sender or sender domain.

The sender is looked up by this test.


### [rate_rcpt]

This section limits the rate which a recipient or recipient domain can receive messages over an interval.

Each recipient is looked up by this test.


### [rate_rcpt_null]

This section limits the rate at which a recipient can receive messages from a null sender (e.g. DSN, MDN etc.) over an interval.

Each recipient is looked up by this test.


### [outbound]

enabled=true
Expand All @@ -205,7 +188,6 @@ The number after the domain is the maximum concurrency limit for that domain.

Delay is the number of seconds to wait before retrying this message. Outbound concurrency is checked on every attempt to deliver.


## CAUTION

Applying strict connection and rate limits is an effective way to reduce spam delivery. It's also an effective way to inflict a stampeding herd on your mail server. When spam/malware is delivered by MTAs that have queue retries, if you disconnect early (which the rate limits do) with a 400 series code (a sane default), the remote is likely to try again. And again. And again. And again. This can cause an obscene rise in the number of connections your mail server handles. Plan a strategy for handling that.
Expand All @@ -215,7 +197,6 @@ Applying strict connection and rate limits is an effective way to reduce spam de
- Don't enforce limits early. I use karma and wait until DATA before disconnecting. By then, the score of the connection is determinate and I can return a 500 series code telling the remote not to try again.
- enforce rate limits with your firewall instead


[ci-img]: https://github.com/haraka/haraka-plugin-limit/actions/workflows/ci.yml/badge.svg
[ci-url]: https://github.com/haraka/haraka-plugin-limit/actions/workflows/ci.yml
[clim-img]: https://codeclimate.com/github/haraka/haraka-plugin-limit/badges/gpa.svg
Expand Down

0 comments on commit 731c333

Please sign in to comment.