Merge pull request #3461 from korgoth1/master

[TEST] PHISH Senders
rspamd · Aug 13, 2020 · a24602d · a24602d
2 parents ea826b7 + 4fa9b56
commit a24602d
Show file tree

Hide file tree

Showing 7 changed files with 115 additions and 0 deletions.
diff --git a/test/functional/cases/280_rules.robot b/test/functional/cases/280_rules.robot
@@ -84,6 +84,30 @@ FROM_NEQ_ENVFROM
   ${result} =  Scan Message With Rspamc  ${MESSAGE8}  --from  test@test.net
   Check Rspamc  ${result}  FROM_NEQ_ENVFROM
 
+PHISH_SENDER_A
+  ${result} =  Scan Message With Rspamc  ${TESTDIR}/messages/phish_sender.eml
+  Should Contain  ${result.stdout}  MULTIPLE_FROM (9.00)[any@attack.com,admin@legitimate.com]
+  Should Contain  ${result.stdout}  MULTIPLE_UNIQUE_HEADERS (7.00)[From]
+
+PHISH_SENDER_B
+  ${result} =  Scan Message With Rspamc  ${TESTDIR}/messages/phish_sender2.eml
+  Should Contain  ${result.stdout}  SOMETHING
+
+PHISH_SENDER_C
+  ${result} =  Scan Message With Rspamc  ${TESTDIR}/messages/phish_sender3.eml
+  Should Contain  ${result.stdout}  SOMETHING
+
+PHISH_SENDER_D
+  ${result} =  Scan Message With Rspamc  ${TESTDIR}/messages/phish_sender4.eml
+  Should Contain  ${result.stdout}  SOMETHING
+
+PHISH_SENDER_E
+  ${result} =  Scan Message With Rspamc  ${TESTDIR}/messages/phish_sender5.eml
+  Should Contain  ${result.stdout}  SOMETHING
+
+PHISH_SENDER_ROUTING_PART
+  ${result} =  Scan Message With Rspamc  ${TESTDIR}/messages/phish_sender6.eml
+  Should Contain  ${result.stdout}  SOMETHING
 
 *** Keywords ***
 Rules Setup

diff --git a/test/functional/messages/phish_sender.eml b/test/functional/messages/phish_sender.eml
@@ -0,0 +1,15 @@
+Received: by mail-lf1-f54.gulugulu.com with SMTP id j14so14439709lfg.9
+        for <test@test.ru>; Mon, 27 Apr 2020 09:54:21 -0700 (PDT)
+From: <any@attack.com>
+From: <admin@legitimate.com>
+Date: Mon, 27 Apr 2020 19:54:10 +0300
+Message-ID: <CA+1S=h4aGimA6vSBJF=t1F+5z-Mua5+Cimf+NU_NDWJk8ZNOcw@mail.gmail.com>
+Subject: Fwd:
+To: <test@test.ru>
+Content-Type: multipart/alternative; boundary="00000000000004de7805a4489190"
+
+--0000000000004bee6805a4484c02
+Content-Type: text/plain; charset="UTF-8"
+Content-Transfer-Encoding: 8bit
+
+sadsad
diff --git a/test/functional/messages/phish_sender2.eml b/test/functional/messages/phish_sender2.eml
@@ -0,0 +1,16 @@
+Received: by mail-lf1-f54.gulugulu.com with SMTP id j14so14439709lfg.9
+        for <test@test.ru>; Mon, 27 Apr 2020 09:54:21 -0700 (PDT)
+From
+: <any@attack.com>
+From: <admin@legitimate.com>
+Date: Mon, 27 Apr 2020 19:54:10 +0300
+Message-ID: <CA+1S=h4aGimA6vSBJF=t1F+5z-Mua5+Cimf+NU_NDWJk8ZNOcw@mail.gmail.com>
+Subject: Fwd:
+To: <test@test.ru>
+Content-Type: multipart/alternative; boundary="00000000000004de7805a4489190"
+
+--0000000000004bee6805a4484c02
+Content-Type: text/plain; charset="UTF-8"
+Content-Transfer-Encoding: 8bit
+
+sadsad
diff --git a/test/functional/messages/phish_sender3.eml b/test/functional/messages/phish_sender3.eml
@@ -0,0 +1,15 @@
+Received: by mail-lf1-f54.gulugulu.com with SMTP id j14so14439709lfg.9
+        for <test@test.ru>; Mon, 27 Apr 2020 09:54:21 -0700 (PDT)
+From: <any@attack.com>
+From : <admin@legitimate.com>
+Date: Mon, 27 Apr 2020 19:54:10 +0300
+Message-ID: <CA+1S=h4aGimA6vSBJF=t1F+5z-Mua5+Cimf+NU_NDWJk8ZNOcw@mail.gmail.com>
+Subject: Fwd:
+To: <test@test.ru>
+Content-Type: multipart/alternative; boundary="00000000000004de7805a4489190"
+
+--0000000000004bee6805a4484c02
+Content-Type: text/plain; charset="UTF-8"
+Content-Transfer-Encoding: 8bit
+
+sadsad
diff --git a/test/functional/messages/phish_sender4.eml b/test/functional/messages/phish_sender4.eml
@@ -0,0 +1,16 @@
+Received: by mail-lf1-f54.gulugulu.com with SMTP id j14so14439709lfg.9
+        for <test@test.ru>; Mon, 27 Apr 2020 09:54:21 -0700 (PDT)
+From
+: <any@attack.com>
+Sender: <admin@legitimate.com>
+Date: Mon, 27 Apr 2020 19:54:10 +0300
+Message-ID: <CA+1S=h4aGimA6vSBJF=t1F+5z-Mua5+Cimf+NU_NDWJk8ZNOcw@mail.gmail.com>
+Subject: Fwd:
+To: <test@test.ru>
+Content-Type: multipart/alternative; boundary="00000000000004de7805a4489190"
+
+--0000000000004bee6805a4484c02
+Content-Type: text/plain; charset="UTF-8"
+Content-Transfer-Encoding: 8bit
+
+sadsad
diff --git a/test/functional/messages/phish_sender5.eml b/test/functional/messages/phish_sender5.eml
@@ -0,0 +1,15 @@
+Received: by mail-lf1-f54.gulugulu.com with SMTP id j14so14439709lfg.9
+        for <test@test.ru>; Mon, 27 Apr 2020 09:54:21 -0700 (PDT)
+From: <any@attack.com>, <any2@attack.com> 
+Sender: <admin@legitimate.com>
+Date: Mon, 27 Apr 2020 19:54:10 +0300
+Message-ID: <CA+1S=h4aGimA6vSBJF=t1F+5z-Mua5+Cimf+NU_NDWJk8ZNOcw@mail.gmail.com>
+Subject: Fwd:
+To: <test@test.ru>
+Content-Type: multipart/alternative; boundary="00000000000004de7805a4489190"
+
+--0000000000004bee6805a4484c02
+Content-Type: text/plain; charset="UTF-8"
+Content-Transfer-Encoding: 8bit
+
+sadsad
diff --git a/test/functional/messages/phish_sender6.eml b/test/functional/messages/phish_sender6.eml
@@ -0,0 +1,14 @@
+Received: by mail-lf1-f54.gulugulu.com with SMTP id j14so14439709lfg.9
+        for <test@test.ru>; Mon, 27 Apr 2020 09:54:21 -0700 (PDT)
+From: <@test.com, @test.ru:test@attack.com>
+Date: Mon, 27 Apr 2020 19:54:10 +0300
+Message-ID: <CA+1S=h4aGimA6vSBJF=t1F+5z-Mua5+Cimf+NU_NDWJk8ZNOcw@mail.gmail.com>
+Subject: Fwd:
+To: <test@test.ru>
+Content-Type: multipart/alternative; boundary="00000000000004de7805a4489190"
+
+--0000000000004bee6805a4484c02
+Content-Type: text/plain; charset="UTF-8"
+Content-Transfer-Encoding: 8bit
+
+sadsad