/* SPF support.
Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004 - 2014
License: GPL
- Copyright (c) The Exim Maintainers 2015 - 2019
+ Copyright (c) The Exim Maintainers 2015 - 2020
*/
/* Code for calling spf checks via libspf-alt. Called from acl.c. */
SPF_dns_rr_t * spf_nxdomain = NULL;
+void
+spf_lib_version_report(FILE * fp)
+{
+int maj, min, patch;
+SPF_get_lib_version(&maj, &min, &patch);
+fprintf(fp, "Library version: spf2: Compile: %d.%d.%d\n",
+ SPF_LIB_VERSION_MAJOR, SPF_LIB_VERSION_MINOR, SPF_LIB_VERSION_PATCH);
+fprintf(fp, " Runtime: %d.%d.%d\n",
+ maj, min, patch);
+}
+
+
static SPF_dns_rr_t *
SPF_dns_exim_lookup(SPF_dns_server_t *spf_dns_server,
-const char *domain, ns_type rr_type, int should_cache)
+ const char *domain, ns_type rr_type, int should_cache)
{
dns_answer * dnsa = store_get_dns_answer();
dns_scan dnss;
SPF_dns_rr_t * spfrr;
+unsigned found = 0;
+
+SPF_dns_rr_t srr = {
+ .domain = CS domain, /* query information */
+ .domain_buf_len = 0,
+ .rr_type = rr_type,
+
+ .rr_buf_len = 0, /* answer information */
+ .rr_buf_num = 0, /* no free of s */
+ .utc_ttl = 0,
+
+ .hook = NULL, /* misc information */
+ .source = spf_dns_server
+};
+int dns_rc;
DEBUG(D_receive) debug_printf("SPF_dns_exim_lookup '%s'\n", domain);
-if (dns_lookup(dnsa, US domain, rr_type, NULL) == DNS_SUCCEED)
- for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
- rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
- if ( rr->type == rr_type
- && (rr_type != T_TXT || Ustrncmp(rr->data+1, "v=spf1", 6) == 0))
+/* Shortcircuit SPF RR lookups by returning NO_DATA. They were obsoleted by
+RFC 6686/7208 years ago. see bug #1294 */
+
+if (rr_type == T_SPF)
+ {
+ HDEBUG(D_host_lookup) debug_printf("faking NO_DATA for SPF RR(99) lookup\n");
+ srr.herrno = NO_DATA;
+ SPF_dns_rr_dup(&spfrr, &srr);
+ store_free_dns_answer(dnsa);
+ return spfrr;
+ }
+
+switch (dns_rc = dns_lookup(dnsa, US domain, rr_type, NULL))
+ {
+ case DNS_SUCCEED: srr.herrno = NETDB_SUCCESS; break;
+ case DNS_AGAIN: srr.herrno = TRY_AGAIN; break;
+ case DNS_NOMATCH: srr.herrno = HOST_NOT_FOUND; break;
+ case DNS_NODATA: srr.herrno = NO_DATA; break;
+ case DNS_FAIL:
+ default: srr.herrno = NO_RECOVERY; break;
+ }
+
+for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
+ rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
+ if (rr->type == rr_type) found++;
+
+if (found == 0)
+ {
+ SPF_dns_rr_dup(&spfrr, &srr);
+ store_free_dns_answer(dnsa);
+ return spfrr;
+ }
+
+srr.rr = store_malloc(sizeof(SPF_dns_rr_data_t) * found);
+
+found = 0;
+for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
+ rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
+ if (rr->type == rr_type)
+ {
+ const uschar * s = rr->data;
+
+ srr.ttl = rr->ttl;
+ switch(rr_type)
{
- const uschar * s = rr->data;
- SPF_dns_rr_t srr = {
- .domain = CS rr->name, /* query information */
- .domain_buf_len = DNS_MAXNAME,
- .rr_type = rr->type,
-
- .num_rr = 1, /* answer information */
- .rr = NULL,
- .rr_buf_len = 0,
- .rr_buf_num = 0,
- .ttl = rr->ttl,
- .utc_ttl = 0,
- .herrno = NETDB_SUCCESS,
-
- .hook = NULL, /* misc information */
- .source = spf_dns_server
- };
-
- switch(rr_type)
+ case T_MX:
+ s += 2; /* skip the MX precedence field */
+ case T_PTR:
{
- case T_MX:
- s += 2; /* skip the MX precedence field */
- case T_PTR:
- {
- uschar * buf = store_malloc(256);
- (void)dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, s,
- (DN_EXPAND_ARG4_TYPE)buf, 256);
- s = buf;
- break;
- }
+ uschar * buf = store_malloc(256);
+ (void)dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, s,
+ (DN_EXPAND_ARG4_TYPE)buf, 256);
+ s = buf;
+ break;
+ }
- case T_TXT:
+ case T_TXT:
+ {
+ gstring * g = NULL;
+ uschar chunk_len;
+
+ if (strncmpic(rr->data+1, US SPF_VER_STR, 6) != 0)
{
- gstring * g = NULL;
- uschar chunk_len;
- for (int off = 0; off < rr->size; off += chunk_len)
- {
- if (!(chunk_len = s[off++])) break;
- g = string_catn(g, s+off, chunk_len);
- }
- if (!g)
- {
- HDEBUG(D_host_lookup) debug_printf("IP address lookup yielded an "
- "empty name: treated as non-existent host name\n");
- continue;
- }
- gstring_release_unused(g);
- s = string_copy_malloc(string_from_gstring(g));
- break;
+ HDEBUG(D_host_lookup) debug_printf("not an spf record: %.*s\n",
+ (int) s[0], s+1);
+ continue;
}
- case T_A:
- case T_AAAA:
- default:
+ for (int off = 0; off < rr->size; off += chunk_len)
{
- uschar * buf = store_malloc(dnsa->answerlen + 1);
- s = memcpy(buf, s, dnsa->answerlen + 1);
- break;
+ if (!(chunk_len = s[off++])) break;
+ g = string_catn(g, s+off, chunk_len);
}
+ if (!g)
+ continue;
+ gstring_release_unused(g);
+ s = string_copy_malloc(string_from_gstring(g));
+ DEBUG(D_receive) debug_printf("SPF_dns_exim_lookup '%s'\n", s);
+ break;
}
- DEBUG(D_receive) debug_printf("SPF_dns_exim_lookup '%s'\n", s);
- srr.rr = (void *) &s;
-
- /* spfrr->rr must have been malloc()d for this */
- SPF_dns_rr_dup(&spfrr, &srr);
- return spfrr;
+ case T_A:
+ case T_AAAA:
+ default:
+ {
+ uschar * buf = store_malloc(dnsa->answerlen + 1);
+ s = memcpy(buf, s, dnsa->answerlen + 1);
+ break;
+ }
}
+ srr.rr[found++] = (void *) s;
+ }
+
+/* Did we filter out all TXT RRs? Return NO_DATA instead of SUCCESS with
+empty ANSWER section. */
+
+if (!(srr.num_rr = found))
+ srr.herrno = NO_DATA;
-SPF_dns_rr_dup(&spfrr, spf_nxdomain);
+/* spfrr->rr must have been malloc()d for this */
+SPF_dns_rr_dup(&spfrr, &srr);
+store_free_dns_answer(dnsa);
return spfrr;
}
SPF_dns_server_t *
SPF_dns_exim_new(int debug)
{
-SPF_dns_server_t *spf_dns_server;
+SPF_dns_server_t * spf_dns_server = store_malloc(sizeof(SPF_dns_server_t));
DEBUG(D_receive) debug_printf("SPF_dns_exim_new\n");
-if (!(spf_dns_server = malloc(sizeof(SPF_dns_server_t))))
- return NULL;
memset(spf_dns_server, 0, sizeof(SPF_dns_server_t));
-
spf_dns_server->destroy = NULL;
spf_dns_server->lookup = SPF_dns_exim_lookup;
spf_dns_server->get_spf = NULL;
{
SPF_dns_server_t * dc;
int debug = 0;
+const uschar *s;
DEBUG(D_receive) debug = 1;
DEBUG(D_receive) debug_printf("spf: SPF_server_new() failed.\n");
return FALSE;
}
- /* Quick hack to override the outdated explanation URL.
- See https://www.mail-archive.com/mailop@mailop.org/msg08019.html */
- SPF_server_set_explanation(spf_server, "Please%_see%_http://www.open-spf.org/Why?id=%{S}&ip=%{C}&receiver=%{R}", &spf_response);
- if (SPF_response_errcode(spf_response) != SPF_E_SUCCESS)
- log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", SPF_strerror(SPF_response_errcode(spf_response)));
+ /* Override the outdated explanation URL.
+ See https://www.mail-archive.com/mailop@mailop.org/msg08019.html
+ Used to work as "Please%_see%_http://www.open-spf.org/Why?id=%{S}&ip=%{C}&receiver=%{R}",
+ but is broken now (May 18th, 2020) */
+if (!(s = expand_string(spf_smtp_comment_template)))
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "expansion of spf_smtp_comment_template failed");
+
+SPF_server_set_explanation(spf_server, CCS s, &spf_response);
+if (SPF_response_errcode(spf_response) != SPF_E_SUCCESS)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", SPF_strerror(SPF_response_errcode(spf_response)));
return TRUE;
}
}
+void
+spf_response_debug(SPF_response_t * spf_response)
+{
+if (SPF_response_messages(spf_response) == 0)
+ debug_printf(" (no errors)\n");
+else for (int i = 0; i < SPF_response_messages(spf_response); i++)
+ {
+ SPF_error_t * err = SPF_response_message(spf_response, i);
+ debug_printf( "%s_msg = (%d) %s\n",
+ (SPF_error_errorp(err) ? "warn" : "err"),
+ SPF_error_code(err),
+ SPF_error_message(err));
+ }
+}
+
+
/* spf_process adds the envelope sender address to the existing
context (if any), retrieves the result, sets up expansion
strings and evaluates the condition outcome.
spf_smtp_comment = US SPF_response_get_smtp_comment(spf_response);
rc = SPF_response_result(spf_response);
+
+ DEBUG(D_acl) spf_response_debug(spf_response);
}
/* We got a result. Now see if we should return OK or FAIL for it */
g = string_cat(g, US" (best guess record for domain)");
s = expand_string(US"$sender_address_domain");
+if (s && *s)
+ return string_append(g, 2, US" smtp.mailfrom=", s);
+
+s = sender_helo_name;
return s && *s
- ? string_append(g, 2, US" smtp.mailfrom=", s)
+ ? string_append(g, 2, US" smtp.helo=", s)
: string_cat(g, US" smtp.mailfrom=<>");
}
git://git.exim.org / exim.git / blobdiff