for untrusted clients, require at least one ASCII letter in
the helo/ehlo argument, unless it's an address-literal.
this rejects

	helo 192.168.1.1

among others.  It still accepts the legal form

	helo [192.168.1.1]

but that's not what spammers send.

I've been running with this change overnight with no problems.

Reference: /n/sources/patch/applied/smtpd-helo-letter
Date: Tue May 30 02:07:58 CES 2006
Signed-off-by: geoff@collyer.net

--- /sys/src/cmd/upas/smtp/smtpd.c	Tue May 30 02:05:46 2006
+++ /sys/src/cmd/upas/smtp/smtpd.c	Tue May 30 02:05:41 2006
@@ -293,6 +293,22 @@
 	    strcmp(him, "localhost.localdomain") == 0 ||
 	    strcmp(him, "localhost.example.com") == 0)
 		goto Liarliar;
+	/*
+	 * similarly, if the claimed domain is not an address-literal,
+	 * require at least one letter, which there will be in
+	 * at least the last component (e.g., .com, .net) if it's real.
+	 * this rejects non-address-literal IP addresses,
+	 * among other bogosities.
+	 */
+	if (!trusted && him[0] != '[') {
+		char *p;
+
+		for (p = him; *p != '\0'; p++)
+			if (isascii(*p) && isalpha(*p))
+				break;
+		if (*p == '\0')
+			goto Liarliar;
+	}
 	if(strchr(him, '.') == 0 && nci != nil && strchr(nci->rsys, '.') != nil)
 		him = nci->rsys;