jcoffey-dev
e0060c9e6e
Phase 2f of the DLP and mail flow rules spec: the rules now run on mail
an authenticated sender submits, after the DATA system script and
before headers and DKIM signing (§2.1).
- smtp/inbound/mailflow.rs: builds what the rules look at from the
message (subject, the text version of each body, one level of attached
messages, attachment text via the extractor, 10 MB of text at most)
and the envelope (sender's groups and tenant; each recipient local or
not, and its groups). Skipped entirely when no enabled rule applies to
outgoing mail. Rules that can't be loaded refuse with a 451: nothing
unchecked leaves.
- Block: 550 5.7.1 with the rule's notice. Warn: 550 5.7.1 with the
notice and how to override: "[override: reason]" at the start of the
subject, taken out before the message goes on (settled answer 1).
Until phase 3, a hold rule blocks rather than let mail through.
- JMAP: EmailSubmission takes inbuxa:dlpOverride {reason}; a refusal
comes back as inbuxa:dlpWarning or inbuxa:dlpBlocked with each rule's
name and notice (description too, for older clients).
- Audit: one record per DLP match, the sender as actor, action create,
target a message: the recipient domains, each rule with its detectors'
counts, the outcome, an override's reason. Never the matched text. No
new audit action: an older node that meets one fails its daily
clean-up, which would make rolling back unsafe (spec §2.7 updated).
Tests: mail_rules_tests gains the DLP flow over JMAP (no rules, warning
with rule and notice, local recipient not warned, override with a
reason, block that no reason passes, the subject tag stripped from the
delivered message, audit records with no card or key text). smtp
inbound tests pass; system_tests passed twice after one timeout in the
email delivery tests that didn't recur.
698 lines
23 KiB
Rust
698 lines
23 KiB
Rust
/*
|
|
* SPDX-FileCopyrightText: 2026 Coffey Labs
|
|
*
|
|
* SPDX-License-Identifier: AGPL-3.0-only
|
|
*/
|
|
|
|
//! Evaluating rules against a message (§2.1–§2.4). Rules are compiled once,
|
|
//! when they change: word lists become automata, patterns regexes. A message
|
|
//! is then checked against every enabled rule in order; each detector runs
|
|
//! at most once per message, and only when some rule asks for it.
|
|
//!
|
|
//! Pure: the caller parses the message, extracts attachment text
|
|
//! ([`super::extract`]) and knows the sender's groups and tenant. What comes
|
|
//! back is which rules matched, with each detector's count, and what DLP
|
|
//! decided; the matched text itself never leaves here (§2.7).
|
|
|
|
use super::{
|
|
detectors::{self, Findings},
|
|
extract::Extracted,
|
|
rules::{Action, Condition, Direction, Kind, Rule},
|
|
words::{Pattern, WordList},
|
|
};
|
|
use ahash::AHashMap;
|
|
use std::borrow::Cow;
|
|
|
|
/// Who sent a message, and to whom.
|
|
#[derive(Debug, Clone, Default)]
|
|
pub struct Envelope<'a> {
|
|
/// Outgoing (an authenticated sender) or incoming.
|
|
pub outgoing: bool,
|
|
pub sender: &'a str,
|
|
pub sender_groups: &'a [u32],
|
|
pub sender_tenant: Option<u32>,
|
|
pub recipients: Vec<Recipient<'a>>,
|
|
}
|
|
|
|
#[derive(Debug, Clone, Default)]
|
|
pub struct Recipient<'a> {
|
|
pub address: &'a str,
|
|
/// At a domain this server hosts.
|
|
pub local: bool,
|
|
pub groups: &'a [u32],
|
|
}
|
|
|
|
#[derive(Debug, Clone)]
|
|
pub struct Attachment<'a> {
|
|
pub name: Option<&'a str>,
|
|
/// Declared type, or detected where the caller knows better.
|
|
pub content_type: Cow<'a, str>,
|
|
pub size: u64,
|
|
pub extracted: Extracted,
|
|
}
|
|
|
|
/// What rules look at.
|
|
#[derive(Debug, Clone, Default)]
|
|
pub struct Content<'a> {
|
|
pub subject: &'a str,
|
|
/// Each text and HTML part, as text.
|
|
pub bodies: Vec<Cow<'a, str>>,
|
|
pub headers: Vec<(&'a str, &'a str)>,
|
|
pub attachments: Vec<Attachment<'a>>,
|
|
pub size: u64,
|
|
/// Text past the inspection limit wasn't read.
|
|
pub truncated: bool,
|
|
}
|
|
|
|
impl Content<'_> {
|
|
fn texts(&self) -> impl Iterator<Item = &str> {
|
|
std::iter::once(self.subject)
|
|
.chain(self.bodies.iter().map(|b| b.as_ref()))
|
|
.chain(self.attachments.iter().filter_map(|a| match &a.extracted {
|
|
Extracted::Text(text) => Some(text.as_str()),
|
|
_ => None,
|
|
}))
|
|
}
|
|
|
|
fn cant_be_inspected(&self) -> bool {
|
|
self.truncated
|
|
|| self
|
|
.attachments
|
|
.iter()
|
|
.any(|a| matches!(a.extracted, Extracted::NotInspectable(_)))
|
|
}
|
|
}
|
|
|
|
enum Check {
|
|
Plain(Condition),
|
|
Words(WordList, u32),
|
|
Pattern(Pattern, u32),
|
|
Header {
|
|
name: String,
|
|
contains: Option<String>,
|
|
matches: Option<Pattern>,
|
|
},
|
|
AttachmentName(Pattern),
|
|
}
|
|
|
|
struct CompiledRule {
|
|
rule: Rule,
|
|
conditions: Vec<Check>,
|
|
exceptions: Vec<Check>,
|
|
}
|
|
|
|
/// The enabled rules, ready to run.
|
|
pub struct Compiled {
|
|
rules: Vec<CompiledRule>,
|
|
}
|
|
|
|
/// A rule reference, for notices and the audit record.
|
|
#[derive(Debug, Clone, PartialEq, Eq)]
|
|
pub struct RuleRef {
|
|
pub id: u32,
|
|
pub name: String,
|
|
pub notice: String,
|
|
}
|
|
|
|
#[derive(Debug, Clone, PartialEq, Eq)]
|
|
pub struct Match {
|
|
pub rule_id: u32,
|
|
pub name: String,
|
|
pub kind: Kind,
|
|
pub actions: Vec<Action>,
|
|
/// Each detector (or `words`, `pattern`) that counted, and its count.
|
|
pub counts: Vec<(String, usize)>,
|
|
}
|
|
|
|
#[derive(Debug, Default)]
|
|
pub struct Outcome {
|
|
pub matched: Vec<Match>,
|
|
pub blocks: Vec<RuleRef>,
|
|
pub holds: Vec<(RuleRef, bool)>,
|
|
pub warns: Vec<RuleRef>,
|
|
}
|
|
|
|
/// What DLP decided, strictest first (§2.4).
|
|
#[derive(Debug, Clone, PartialEq, Eq)]
|
|
pub enum Decision {
|
|
Pass,
|
|
Block(Vec<RuleRef>),
|
|
Hold {
|
|
rules: Vec<RuleRef>,
|
|
notify_sender: bool,
|
|
},
|
|
Warn(Vec<RuleRef>),
|
|
}
|
|
|
|
impl Outcome {
|
|
/// Block beats hold beats warn. An override (§2.5) answers the warnings
|
|
/// only: a block or hold still applies.
|
|
pub fn decision(&self, overridden: bool) -> Decision {
|
|
if !self.blocks.is_empty() {
|
|
Decision::Block(self.blocks.clone())
|
|
} else if !self.holds.is_empty() {
|
|
Decision::Hold {
|
|
rules: self.holds.iter().map(|(r, _)| r.clone()).collect(),
|
|
notify_sender: self.holds.iter().any(|(_, notify)| *notify),
|
|
}
|
|
} else if !self.warns.is_empty() && !overridden {
|
|
Decision::Warn(self.warns.clone())
|
|
} else {
|
|
Decision::Pass
|
|
}
|
|
}
|
|
}
|
|
|
|
fn compile_check(condition: &Condition) -> Result<Check, String> {
|
|
Ok(match condition {
|
|
Condition::Words { words, at_least } => Check::Words(WordList::new(words)?, *at_least),
|
|
Condition::Pattern { pattern, at_least } => {
|
|
Check::Pattern(Pattern::new(pattern)?, *at_least)
|
|
}
|
|
Condition::Header {
|
|
name,
|
|
contains,
|
|
matches,
|
|
} => Check::Header {
|
|
name: name.to_ascii_lowercase(),
|
|
contains: contains.as_ref().map(|c| c.to_lowercase()),
|
|
matches: matches.as_deref().map(Pattern::new).transpose()?,
|
|
},
|
|
Condition::AttachmentName { pattern } => Check::AttachmentName(Pattern::new(pattern)?),
|
|
other => Check::Plain(other.clone()),
|
|
})
|
|
}
|
|
|
|
impl Compiled {
|
|
/// Compiles the enabled rules; one that no longer compiles (a detector
|
|
/// renamed since it was saved) is skipped and named in the second list.
|
|
pub fn new(rules: &[Rule]) -> (Self, Vec<(u32, String)>) {
|
|
let mut compiled = Vec::new();
|
|
let mut skipped = Vec::new();
|
|
for rule in rules.iter().filter(|r| r.enabled) {
|
|
let result = rule.validate().map_err(|e| e.reason).and_then(|_| {
|
|
Ok(CompiledRule {
|
|
rule: rule.clone(),
|
|
conditions: rule
|
|
.conditions
|
|
.iter()
|
|
.map(compile_check)
|
|
.collect::<Result<_, _>>()?,
|
|
exceptions: rule
|
|
.exceptions
|
|
.iter()
|
|
.map(compile_check)
|
|
.collect::<Result<_, _>>()?,
|
|
})
|
|
});
|
|
match result {
|
|
Ok(c) => compiled.push(c),
|
|
Err(reason) => skipped.push((rule.id, reason)),
|
|
}
|
|
}
|
|
compiled.sort_by_key(|c| (c.rule.priority, c.rule.id));
|
|
(Self { rules: compiled }, skipped)
|
|
}
|
|
|
|
pub fn is_empty(&self) -> bool {
|
|
self.rules.is_empty()
|
|
}
|
|
|
|
/// Whether any rule could apply to mail going this way, so a caller can
|
|
/// skip parsing when none can.
|
|
pub fn applies_to(&self, outgoing: bool) -> bool {
|
|
self.rules
|
|
.iter()
|
|
.any(|c| direction_matches(c.rule.direction, outgoing))
|
|
}
|
|
|
|
pub fn evaluate(&self, envelope: &Envelope<'_>, content: &Content<'_>) -> Outcome {
|
|
let mut state = State {
|
|
content,
|
|
detected: AHashMap::new(),
|
|
};
|
|
let mut outcome = Outcome::default();
|
|
for compiled in &self.rules {
|
|
let rule = &compiled.rule;
|
|
if !direction_matches(rule.direction, envelope.outgoing) {
|
|
continue;
|
|
}
|
|
let mut counts = Vec::new();
|
|
let all_match = compiled
|
|
.conditions
|
|
.iter()
|
|
.all(|check| state.check(check, envelope, &mut counts));
|
|
if !all_match {
|
|
continue;
|
|
}
|
|
let mut ignored = Vec::new();
|
|
if compiled
|
|
.exceptions
|
|
.iter()
|
|
.any(|check| state.check(check, envelope, &mut ignored))
|
|
{
|
|
continue;
|
|
}
|
|
for action in &rule.actions {
|
|
let reference = |notice: &str| RuleRef {
|
|
id: rule.id,
|
|
name: rule.name.clone(),
|
|
notice: notice.to_string(),
|
|
};
|
|
match action {
|
|
Action::Block { notice } => outcome.blocks.push(reference(notice)),
|
|
Action::Hold {
|
|
notice,
|
|
notify_sender,
|
|
} => outcome.holds.push((reference(notice), *notify_sender)),
|
|
Action::Warn { notice } => outcome.warns.push(reference(notice)),
|
|
_ => {}
|
|
}
|
|
}
|
|
outcome.matched.push(Match {
|
|
rule_id: rule.id,
|
|
name: rule.name.clone(),
|
|
kind: rule.kind,
|
|
actions: rule.actions.clone(),
|
|
counts,
|
|
});
|
|
if rule.stop_processing {
|
|
break;
|
|
}
|
|
}
|
|
outcome
|
|
}
|
|
}
|
|
|
|
fn direction_matches(direction: Direction, outgoing: bool) -> bool {
|
|
match direction {
|
|
Direction::Any => true,
|
|
Direction::Outgoing => outgoing,
|
|
Direction::Incoming => !outgoing,
|
|
}
|
|
}
|
|
|
|
fn domain_of(address: &str) -> &str {
|
|
address.rsplit_once('@').map_or("", |(_, d)| d)
|
|
}
|
|
|
|
fn in_list(value: &str, list: &[String]) -> bool {
|
|
list.iter().any(|v| v.eq_ignore_ascii_case(value))
|
|
}
|
|
|
|
struct State<'c, 'a> {
|
|
content: &'c Content<'a>,
|
|
/// Each detector's count, run once per message.
|
|
detected: AHashMap<&'static str, usize>,
|
|
}
|
|
|
|
impl State<'_, '_> {
|
|
fn detector_count(&mut self, id: &str) -> usize {
|
|
let Some(detector) = detectors::by_id(id) else {
|
|
return 0;
|
|
};
|
|
if let Some(count) = self.detected.get(detector.id) {
|
|
return *count;
|
|
}
|
|
let mut findings = Findings::default();
|
|
for text in self.content.texts() {
|
|
detector.find(text, &mut findings);
|
|
}
|
|
self.detected.insert(detector.id, findings.len());
|
|
findings.len()
|
|
}
|
|
|
|
fn check(
|
|
&mut self,
|
|
check: &Check,
|
|
envelope: &Envelope<'_>,
|
|
counts: &mut Vec<(String, usize)>,
|
|
) -> bool {
|
|
let content = self.content;
|
|
match check {
|
|
Check::Words(list, at_least) => {
|
|
let n: usize = content.texts().map(|t| list.count(t)).sum();
|
|
counts.push(("words".into(), n));
|
|
n >= *at_least as usize
|
|
}
|
|
Check::Pattern(pattern, at_least) => {
|
|
let n: usize = content.texts().map(|t| pattern.count(t)).sum();
|
|
counts.push(("pattern".into(), n));
|
|
n >= *at_least as usize
|
|
}
|
|
Check::Header {
|
|
name,
|
|
contains,
|
|
matches,
|
|
} => content
|
|
.headers
|
|
.iter()
|
|
.filter(|(n, _)| n.eq_ignore_ascii_case(name))
|
|
.any(|(_, value)| match (contains, matches) {
|
|
(Some(needle), _) => value.to_lowercase().contains(needle.as_str()),
|
|
(_, Some(pattern)) => pattern.count(value) > 0,
|
|
_ => true,
|
|
}),
|
|
Check::AttachmentName(pattern) => content
|
|
.attachments
|
|
.iter()
|
|
.any(|a| a.name.is_some_and(|n| pattern.count(n) > 0)),
|
|
Check::Plain(condition) => match condition {
|
|
Condition::SenderAddress { addresses } => in_list(envelope.sender, addresses),
|
|
Condition::SenderDomain { domains } => in_list(domain_of(envelope.sender), domains),
|
|
Condition::SenderGroup { groups } => {
|
|
envelope.sender_groups.iter().any(|g| groups.contains(g))
|
|
}
|
|
Condition::SenderTenant { tenants } => {
|
|
envelope.sender_tenant.is_some_and(|t| tenants.contains(&t))
|
|
}
|
|
Condition::RecipientAddress { addresses } => envelope
|
|
.recipients
|
|
.iter()
|
|
.any(|r| in_list(r.address, addresses)),
|
|
Condition::RecipientDomain { domains } => envelope
|
|
.recipients
|
|
.iter()
|
|
.any(|r| in_list(domain_of(r.address), domains)),
|
|
Condition::RecipientGroup { groups } => envelope
|
|
.recipients
|
|
.iter()
|
|
.any(|r| r.groups.iter().any(|g| groups.contains(g))),
|
|
Condition::RecipientOutside => envelope.recipients.iter().any(|r| !r.local),
|
|
Condition::AttachmentType { types } => content.attachments.iter().any(|a| {
|
|
let ct = a.content_type.to_ascii_lowercase();
|
|
types
|
|
.iter()
|
|
.any(|t| ct.starts_with(&t.to_ascii_lowercase()))
|
|
}),
|
|
Condition::AttachmentExtension { extensions } => {
|
|
content.attachments.iter().any(|a| {
|
|
a.name
|
|
.and_then(|n| n.rsplit_once('.'))
|
|
.is_some_and(|(_, ext)| {
|
|
extensions
|
|
.iter()
|
|
.any(|e| e.trim_start_matches('.').eq_ignore_ascii_case(ext))
|
|
})
|
|
})
|
|
}
|
|
Condition::AttachmentSizeOver { bytes } => {
|
|
content.attachments.iter().any(|a| a.size > *bytes)
|
|
}
|
|
Condition::AttachmentCountOver { count } => {
|
|
content.attachments.len() > *count as usize
|
|
}
|
|
Condition::CantBeInspected => content.cant_be_inspected(),
|
|
Condition::MessageSizeOver { bytes } => content.size > *bytes,
|
|
Condition::Detected { detectors } => {
|
|
let mut any = false;
|
|
for d in detectors {
|
|
let n = self.detector_count(&d.id);
|
|
counts.push((d.id.clone(), n));
|
|
any |= n >= d.at_least as usize;
|
|
}
|
|
any
|
|
}
|
|
// Compiled into their own checks
|
|
Condition::Words { .. }
|
|
| Condition::Pattern { .. }
|
|
| Condition::Header { .. }
|
|
| Condition::AttachmentName { .. } => false,
|
|
},
|
|
}
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use crate::mailflow::{
|
|
extract::Why,
|
|
rules::{DetectorMin, Position},
|
|
};
|
|
|
|
fn rule(id: u32, kind: Kind, conditions: Vec<Condition>, action: Action) -> Rule {
|
|
Rule {
|
|
id,
|
|
name: format!("rule {id}"),
|
|
description: String::new(),
|
|
kind,
|
|
enabled: true,
|
|
priority: id as i32,
|
|
direction: if kind == Kind::Dlp {
|
|
Direction::Outgoing
|
|
} else {
|
|
Direction::Any
|
|
},
|
|
conditions,
|
|
exceptions: vec![],
|
|
actions: vec![action],
|
|
stop_processing: false,
|
|
created_by: String::new(),
|
|
created_at: 0,
|
|
updated_at: 0,
|
|
}
|
|
}
|
|
|
|
fn envelope(outside: bool) -> Envelope<'static> {
|
|
Envelope {
|
|
outgoing: true,
|
|
sender: "[email protected]",
|
|
sender_groups: &[7],
|
|
sender_tenant: None,
|
|
recipients: vec![Recipient {
|
|
address: if outside {
|
|
"[email protected]"
|
|
} else {
|
|
"[email protected]"
|
|
},
|
|
local: !outside,
|
|
groups: &[],
|
|
}],
|
|
}
|
|
}
|
|
|
|
fn cards(n: usize) -> Content<'static> {
|
|
let body: String = [
|
|
"4242 4242 4242 4242",
|
|
"5555-5555-5555-4444",
|
|
"378282246310005",
|
|
"6011111111111117",
|
|
"3566002020360505",
|
|
]
|
|
.iter()
|
|
.take(n)
|
|
.map(|c| format!("card {c}\n"))
|
|
.collect();
|
|
Content {
|
|
subject: "Numbers",
|
|
bodies: vec![body.into()],
|
|
..Default::default()
|
|
}
|
|
}
|
|
|
|
fn five_cards_outside(action: Action) -> Rule {
|
|
rule(
|
|
1,
|
|
Kind::Dlp,
|
|
vec![
|
|
Condition::RecipientOutside,
|
|
Condition::Detected {
|
|
detectors: vec![DetectorMin {
|
|
id: "payment-card".into(),
|
|
at_least: 5,
|
|
}],
|
|
},
|
|
],
|
|
action,
|
|
)
|
|
}
|
|
|
|
#[test]
|
|
fn detector_threshold_and_recipients() {
|
|
let (rules, skipped) = Compiled::new(&[five_cards_outside(Action::Hold {
|
|
notice: "Held".into(),
|
|
notify_sender: true,
|
|
})]);
|
|
assert!(skipped.is_empty());
|
|
let outcome = rules.evaluate(&envelope(true), &cards(5));
|
|
assert_eq!(
|
|
outcome.matched[0].counts,
|
|
vec![("payment-card".to_string(), 5)]
|
|
);
|
|
assert!(matches!(
|
|
outcome.decision(false),
|
|
Decision::Hold {
|
|
notify_sender: true,
|
|
..
|
|
}
|
|
));
|
|
// Four cards, or everyone inside: nothing
|
|
assert_eq!(
|
|
rules.evaluate(&envelope(true), &cards(4)).decision(false),
|
|
Decision::Pass
|
|
);
|
|
assert_eq!(
|
|
rules.evaluate(&envelope(false), &cards(5)).decision(false),
|
|
Decision::Pass
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn strictest_wins_and_override_answers_warnings_only() {
|
|
let warn = five_cards_outside(Action::Warn {
|
|
notice: "Sure?".into(),
|
|
});
|
|
let mut block = five_cards_outside(Action::Block {
|
|
notice: "No".into(),
|
|
});
|
|
block.id = 2;
|
|
let (rules, _) = Compiled::new(&[warn.clone(), block]);
|
|
let outcome = rules.evaluate(&envelope(true), &cards(5));
|
|
assert!(matches!(outcome.decision(true), Decision::Block(_)));
|
|
let (rules, _) = Compiled::new(&[warn]);
|
|
let outcome = rules.evaluate(&envelope(true), &cards(5));
|
|
assert!(matches!(outcome.decision(false), Decision::Warn(ref w) if w[0].notice == "Sure?"));
|
|
assert_eq!(outcome.decision(true), Decision::Pass);
|
|
}
|
|
|
|
#[test]
|
|
fn exceptions_order_and_stop_processing() {
|
|
let disclaimer = |id| {
|
|
rule(
|
|
id,
|
|
Kind::Transport,
|
|
vec![Condition::RecipientOutside],
|
|
Action::AddDisclaimer {
|
|
text: "t".into(),
|
|
html: None,
|
|
position: Position::Bottom,
|
|
},
|
|
)
|
|
};
|
|
let mut first = disclaimer(1);
|
|
first.stop_processing = true;
|
|
let (rules, _) = Compiled::new(&[disclaimer(2), first.clone()]);
|
|
let outcome = rules.evaluate(&envelope(true), &cards(0));
|
|
assert_eq!(
|
|
outcome
|
|
.matched
|
|
.iter()
|
|
.map(|m| m.rule_id)
|
|
.collect::<Vec<_>>(),
|
|
vec![1]
|
|
);
|
|
|
|
first.stop_processing = false;
|
|
first.exceptions = vec![Condition::SenderGroup { groups: vec![7] }];
|
|
let (rules, _) = Compiled::new(&[disclaimer(2), first]);
|
|
let outcome = rules.evaluate(&envelope(true), &cards(0));
|
|
assert_eq!(
|
|
outcome
|
|
.matched
|
|
.iter()
|
|
.map(|m| m.rule_id)
|
|
.collect::<Vec<_>>(),
|
|
vec![2]
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn content_conditions() {
|
|
let content = Content {
|
|
subject: "Project Falcon",
|
|
bodies: vec!["see attached".into()],
|
|
headers: vec![("X-Class", "Internal only")],
|
|
attachments: vec![
|
|
Attachment {
|
|
name: Some("plan.docx"),
|
|
content_type:
|
|
"application/vnd.openxmlformats-officedocument.wordprocessingml.document"
|
|
.into(),
|
|
size: 40_000,
|
|
extracted: Extracted::Text("IBAN GB29 NWBK 6016 1331 9268 19".into()),
|
|
},
|
|
Attachment {
|
|
name: Some("scan.pdf"),
|
|
content_type: "application/pdf".into(),
|
|
size: 900_000,
|
|
extracted: Extracted::NotInspectable(Why::Pdf),
|
|
},
|
|
],
|
|
size: 1_000_000,
|
|
truncated: false,
|
|
};
|
|
let block = || Action::Block { notice: "n".into() };
|
|
let checks = [
|
|
(
|
|
Condition::Words {
|
|
words: vec!["project falcon".into()],
|
|
at_least: 1,
|
|
},
|
|
true,
|
|
),
|
|
(
|
|
Condition::Header {
|
|
name: "x-class".into(),
|
|
contains: Some("internal".into()),
|
|
matches: None,
|
|
},
|
|
true,
|
|
),
|
|
(
|
|
Condition::AttachmentExtension {
|
|
extensions: vec![".PDF".into()],
|
|
},
|
|
true,
|
|
),
|
|
(
|
|
Condition::AttachmentType {
|
|
types: vec!["image/".into()],
|
|
},
|
|
false,
|
|
),
|
|
(Condition::AttachmentSizeOver { bytes: 500_000 }, true),
|
|
(Condition::AttachmentCountOver { count: 2 }, false),
|
|
(Condition::CantBeInspected, true),
|
|
(Condition::MessageSizeOver { bytes: 2_000_000 }, false),
|
|
(
|
|
Condition::Detected {
|
|
detectors: vec![DetectorMin {
|
|
id: "iban".into(),
|
|
at_least: 1,
|
|
}],
|
|
},
|
|
true,
|
|
),
|
|
(
|
|
Condition::SenderDomain {
|
|
domains: vec!["EXAMPLE.com".into()],
|
|
},
|
|
true,
|
|
),
|
|
];
|
|
for (condition, expected) in checks {
|
|
let (rules, skipped) =
|
|
Compiled::new(&[rule(1, Kind::Dlp, vec![condition.clone()], block())]);
|
|
assert!(skipped.is_empty(), "{condition:?}");
|
|
let matched = !rules.evaluate(&envelope(true), &content).matched.is_empty();
|
|
assert_eq!(matched, expected, "{condition:?}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn direction_and_disabled_rules() {
|
|
let mut r = five_cards_outside(Action::Block { notice: "n".into() });
|
|
let (rules, _) = Compiled::new(std::slice::from_ref(&r));
|
|
assert!(rules.applies_to(true) && !rules.applies_to(false));
|
|
let mut incoming = envelope(true);
|
|
incoming.outgoing = false;
|
|
assert_eq!(
|
|
rules.evaluate(&incoming, &cards(5)).decision(false),
|
|
Decision::Pass
|
|
);
|
|
r.enabled = false;
|
|
assert!(Compiled::new(&[r]).0.is_empty());
|
|
}
|
|
}
|