#!/usr/bin/perl5.8.4
#
# bin/relay.sara
#
# $Id: relay.sara,v 1.3 2000/03/17 16:52:22 rader Exp rader $
# Modified to reflect problems with Multinet and Microsoft servers
# Last mod 2000/08/23 15:00:00 EDT  by toddr
#

require 'config/paths.pl';
require 'config/sara.cf';
require 'perl/misc.pl';
require 'perllib/getopts.pl';

if ( $ARGV[0] =~ /^-v/ ) {
  $debug = 1;
  shift @ARGV;
}

$target = $ARGV[0];
$port = "25";
$status = "a";
$severity = "g";
$service = "smtp";
$ttw = "30";
$cnt = 0;
$maxcnt = 0;
$ms_flag = "";

if ( $#ARGV != 0 ) {
   die "usage: bin/relay.sara [-v] hostname\n";
}

# TODO This test requires a reverse lookup of $target...
#  [ "<sara\@[198.150.3.199]>", "<sara\@mail-abuse.org>"	  ],

@tests = (
  [ "<sara\@mail-abuse.org>",	"<sara\@mail-abuse.org>"	  ],
  [ "<sara>",			"<sara\@mail-abuse.org>"	  ],
  [ "<>",			"<sara\@mail-abuse.org>"	  ],
  [ "<sara\@$target>",		"<sara\@mail-abuse.org>"	  ],
  [ "<sara\@$target>",		"<sara%mail-abuse.org\@$target>"  ],
  [ "<sara\@$target>",		"<\"sara\@mail-abuse.org\">"	  ],
  [ "<sara\@$target>",		"<\"sara%mail-abuse.org\">"	  ],
  [ "<sara\@$target>",		"<sara\@mail-abuse.org\@$target>" ],
  [ "<sara\@$target>",		"<\"sara\@mail-abuse.org\"\@$target>" ],
  [ "<sara\@$target>",		"<sara\@mail-abuse.org\@$target>" ],
  [ "<sara\@$target>",		"<\@$target:sara\@mail-abuse.org>"],
  [ "<sara\@>",			"<relaytest\@mail-abuse.org\@>"	  ],
  [ "<sara\@$target>",		"<mail-abuse.org!sara>"		  ],
  [ "<sara\@$target>",		"<mail-abuse.org!sara\@$target>"  ],
  [ "<sara\@$target>",	"<IMCEASMTP-test+40test+2Esara\@mail-abuse.org>"],
);

foreach $test (@tests) {

  $mail_from = @{$test}[0];
  $rcpt_to = @{$test}[1];

  if ( $debug ) {
    print ">>> MAIL FROM: $mail_from\n";
    print ">>> RCPT TO: $rcpt_to\n";
  }

  $msg = "HELO sara\r\nMAIL FROM: $mail_from\r\nRCPT TO: $rcpt_to\r\nquit\r\n";
  $args = "-s \"$msg\" -w $ttw -b";

  open(TCP, "$TCP_SCAN $args $target $port 2>&1|") or
    die "Can't open $TCPSCAN: $!\n";
  $_ = <TCP>;
  close(TCP);
  $ms_flag = "TRUE" if /Microsoft/;
  @responses = split(/\\r\\n/,$_);
  
  if ( $debug ) {
    $_ =~ s/\\r\\n/\n/g;
   print "$_\n";
  }
}
#
#  SARA checks for three 250 codes (OK).  1 for HELO, 2 for MAIL from
#  and 3 for RCPT to.  If we don't get all 3, we assume that the operation
#  was not relayable.
#
$cnt = grep(/^250/, @responses);
$maxcnt = $cnt if $cnt >= $maxcnt;
if ( $cnt >= 3 ) {
    $status  = "a";
    $severity = "ycio";
    $severity = "zcio" if $ms_flag;;
    $trustee = "ANY\@$target";
    $trusted = "ANY\@$target";
    $sid     = "SMTP-008";
    $sid     = "SMTP-009" if $ms_flag;
    $sid     = "SMTP-010" if($rcpt_to =~ /IMCEASMTP/);
    $text = "Probable smtp relay";
    $text = "Possible smtp relay; MS may give a false positive" if $ms_flag;
    ($severity,$service_output,$text) = &get_sid($sid);
    $trustee = "ANY\@$target";
    $trusted = "ANY\@$target";
 }
if ( $maxcnt <= 1 ) {
    $status  = "a";
    $sid     = "SMTP-011";
    ($severity,$service_output,$text) = &get_sid($sid);
    $trustee = "ANY\@$target";
    $trusted = "ANY\@$target";
}
&sara_print();
 
