/* SPF support.
Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004 - 2014
License: GPL
- Copyright (c) The Exim Maintainers 2015 - 2019
+ Copyright (c) The Exim Maintainers 2015 - 2020
*/
/* Code for calling spf checks via libspf-alt. Called from acl.c. */
SPF_dns_rr_t * spf_nxdomain = NULL;
+void
+spf_lib_version_report(FILE * fp)
+{
+int maj, min, patch;
+SPF_get_lib_version(&maj, &min, &patch);
+fprintf(fp, "Library version: spf2: Compile: %d.%d.%d\n",
+ SPF_LIB_VERSION_MAJOR, SPF_LIB_VERSION_MINOR, SPF_LIB_VERSION_PATCH);
+fprintf(fp, " Runtime: %d.%d.%d\n",
+ maj, min, patch);
+}
+
+
static SPF_dns_rr_t *
SPF_dns_exim_lookup(SPF_dns_server_t *spf_dns_server,
-const char *domain, ns_type rr_type, int should_cache)
+ const char *domain, ns_type rr_type, int should_cache)
{
dns_answer * dnsa = store_get_dns_answer();
dns_scan dnss;
.hook = NULL, /* misc information */
.source = spf_dns_server
};
+int dns_rc;
DEBUG(D_receive) debug_printf("SPF_dns_exim_lookup '%s'\n", domain);
-if (dns_lookup(dnsa, US domain, rr_type, NULL) == DNS_NOMATCH)
+/* Shortcircuit SPF RR lookups by returning NO_DATA. They were obsoleted by
+RFC 6686/7208 years ago. see bug #1294 */
+
+if (rr_type == T_SPF)
{
- SPF_dns_rr_dup(&spfrr, spf_nxdomain);
+ HDEBUG(D_host_lookup) debug_printf("faking NO_DATA for SPF RR(99) lookup\n");
+ srr.herrno = NO_DATA;
+ SPF_dns_rr_dup(&spfrr, &srr);
+ store_free_dns_answer(dnsa);
return spfrr;
-}
+ }
+
+switch (dns_rc = dns_lookup(dnsa, US domain, rr_type, NULL))
+ {
+ case DNS_SUCCEED: srr.herrno = NETDB_SUCCESS; break;
+ case DNS_AGAIN: srr.herrno = TRY_AGAIN; break;
+ case DNS_NOMATCH: srr.herrno = HOST_NOT_FOUND; break;
+ case DNS_NODATA: srr.herrno = NO_DATA; break;
+ case DNS_FAIL:
+ default: srr.herrno = NO_RECOVERY; break;
+ }
for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
if (rr->type == rr_type) found++;
-srr.num_rr = found;
+if (found == 0)
+ {
+ SPF_dns_rr_dup(&spfrr, &srr);
+ store_free_dns_answer(dnsa);
+ return spfrr;
+ }
+
srr.rr = store_malloc(sizeof(SPF_dns_rr_data_t) * found);
-srr.herrno = h_errno,
found = 0;
for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
switch(rr_type)
{
case T_MX:
- s += 2; /* skip the MX precedence field */
+ s += 2; /* skip the MX precedence field */
case T_PTR:
{
uschar * buf = store_malloc(256);
gstring * g = NULL;
uschar chunk_len;
- if (strncmpic(rr->data+1, US"v=spf1", 6) != 0)
+ if (strncmpic(rr->data+1, US SPF_VER_STR, 6) != 0)
{
- HDEBUG(D_host_lookup) debug_printf("not an spf record\n");
+ HDEBUG(D_host_lookup) debug_printf("not an spf record: %.*s\n",
+ (int) s[0], s+1);
continue;
}
continue;
gstring_release_unused(g);
s = string_copy_malloc(string_from_gstring(g));
+ DEBUG(D_receive) debug_printf("SPF_dns_exim_lookup '%s'\n", s);
break;
}
break;
}
}
- DEBUG(D_receive) debug_printf("SPF_dns_exim_lookup '%s'\n", s);
srr.rr[found++] = (void *) s;
}
+/* Did we filter out all TXT RRs? Return NO_DATA instead of SUCCESS with
+empty ANSWER section. */
+
+if (!(srr.num_rr = found))
+ srr.herrno = NO_DATA;
+
/* spfrr->rr must have been malloc()d for this */
SPF_dns_rr_dup(&spfrr, &srr);
+store_free_dns_answer(dnsa);
return spfrr;
}
{
SPF_dns_server_t * dc;
int debug = 0;
+const uschar *s;
DEBUG(D_receive) debug = 1;
DEBUG(D_receive) debug_printf("spf: SPF_server_new() failed.\n");
return FALSE;
}
- /* Quick hack to override the outdated explanation URL.
- See https://www.mail-archive.com/mailop@mailop.org/msg08019.html */
- SPF_server_set_explanation(spf_server, "Please%_see%_http://www.open-spf.org/Why?id=%{S}&ip=%{C}&receiver=%{R}", &spf_response);
- if (SPF_response_errcode(spf_response) != SPF_E_SUCCESS)
- log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", SPF_strerror(SPF_response_errcode(spf_response)));
+ /* Override the outdated explanation URL.
+ See https://www.mail-archive.com/mailop@mailop.org/msg08019.html
+ Used to work as "Please%_see%_http://www.open-spf.org/Why?id=%{S}&ip=%{C}&receiver=%{R}",
+ but is broken now (May 18th, 2020) */
+if (!(s = expand_string(spf_smtp_comment_template)))
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "expansion of spf_smtp_comment_template failed");
+
+SPF_server_set_explanation(spf_server, CCS s, &spf_response);
+if (SPF_response_errcode(spf_response) != SPF_E_SUCCESS)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", SPF_strerror(SPF_response_errcode(spf_response)));
return TRUE;
}
}
+void
+spf_response_debug(SPF_response_t * spf_response)
+{
+if (SPF_response_messages(spf_response) == 0)
+ debug_printf(" (no errors)\n");
+else for (int i = 0; i < SPF_response_messages(spf_response); i++)
+ {
+ SPF_error_t * err = SPF_response_message(spf_response, i);
+ debug_printf( "%s_msg = (%d) %s\n",
+ (SPF_error_errorp(err) ? "warn" : "err"),
+ SPF_error_code(err),
+ SPF_error_message(err));
+ }
+}
+
+
/* spf_process adds the envelope sender address to the existing
context (if any), retrieves the result, sets up expansion
strings and evaluates the condition outcome.
spf_smtp_comment = US SPF_response_get_smtp_comment(spf_response);
rc = SPF_response_result(spf_response);
+
+ DEBUG(D_acl) spf_response_debug(spf_response);
}
/* We got a result. Now see if we should return OK or FAIL for it */
g = string_cat(g, US" (best guess record for domain)");
s = expand_string(US"$sender_address_domain");
+if (s && *s)
+ return string_append(g, 2, US" smtp.mailfrom=", s);
+
+s = sender_helo_name;
return s && *s
- ? string_append(g, 2, US" smtp.mailfrom=", s)
+ ? string_append(g, 2, US" smtp.helo=", s)
: string_cat(g, US" smtp.mailfrom=<>");
}
git://git.exim.org / exim.git / blobdiff