fix edge cases for previous commit

[infanticide.git] / infanticide.pm

diff --git a/infanticide.pm b/infanticide.pm
index caff4f89eeb829439e05b2e16252288ae92c4c23..3c077f196a7fc4bd9225e72b979e2f9b7be0fb36 100755 (executable)
--- a/infanticide.pm
+++ b/infanticide.pm
@@ -1,14 +1,17 @@
 #!/usr/bin/perl
 
 # This is a SpamAssassin module that kills mail from newly-born domains.
+# Copyright (c) 2022-2023 by Art Cancro
+# Use, duplication, or disclosure are subject to the terms of the GNU General Public License v3.
 
 
 package infanticide;
 use Mail::SpamAssassin::Plugin;
 use Sys::Syslog;
 use Sys::Syslog qw(:standard :macros);
-#use Time::Local;
 use HTTP::Date;
+use POSIX;
+
 
 our @ISA = qw(Mail::SpamAssassin::Plugin);
 my $counter = 100;
@@ -50,10 +53,38 @@ sub infanticide_get_creation_date {
                        # 2017-06-02T13:15:42Z
                }
        }
+       if ($cDate eq "") {
+               syslog('debug', "infanticide: no creation date for " . $domain_to_test);
+
+               # If the FQDN is made up of more than two components (for example, mail.spammers.com)
+               # try stripping components until it's down to two
+               $dots = ($domain_to_test =~ tr/.//);
+               if ($dots > 1) {
+                       return(infanticide_get_creation_date(substr $domain_to_test, index($domain_to_test, ".")+1));
+               }
+
+       }
        return($cDate);
 }
 
 
+sub infanticide_get_creation_date_recursive {
+       my $domain_to_test = $_[0];
+       my $cDate = infanticide_get_creation_date($domain_to_test);
+       if ($cDate ne "") {
+               return($cDate);
+       }
+
+       $dots = ($domain_to_test =~ tr/.//);
+       if ($dots < 2) {
+               return("");
+       }
+
+       return(infanticide_get_creation_date_recursive(substr $domain_to_test, index($domain_to_test, ".")+1));
+}
+
+
+
 sub check_for_disposable_domain() {
        $counter = $counter + 1;
 
@@ -61,13 +92,12 @@ sub check_for_disposable_domain() {
        my $fromaddr = $pms->get("From:addr", undef);
        my @fromarr = split('@', $fromaddr);
        my $domain = $fromarr[1];
-       my $creationDate = infanticide_get_creation_date($domain);
+       my $creationDate = infanticide_get_creation_date_recursive($domain);
        if ($creationDate eq "") {
-               syslog('debug', "infanticide: " . $counter . " no creation date for " . $domain);
                return(0);
        }
        my $dt = str2time($creationDate);
-       my $daysAgo = (time() - $dt) / 86400;
+       my $daysAgo = ceil((time() - $dt) / 86400);
        syslog("debug", "infanticide: " . $domain . " was created " . $daysAgo . " days ago");
        if ($daysAgo < 30) {
                return(1);