Fix client-only use of gsasl authenticator. Bug 2818

[exim.git] / src / src / spf.c

diff --git a/src/src/spf.c b/src/src/spf.c
index a8318dcda87590c2cdde44f7ada3f622a070e852..9f0805ada9d49ac93ad36356c4e08ad015282f4b 100644 (file)
--- a/src/src/spf.c
+++ b/src/src/spf.c
@@ -5,7 +5,7 @@
 /* SPF support.
    Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004 - 2014
    License: GPL
 /* SPF support.
    Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004 - 2014
    License: GPL

-   Copyright (c) The Exim Maintainers 2015 - 2019
+   Copyright (c) The Exim Maintainers 2015 - 2021

 */
 
 /* Code for calling spf checks via libspf-alt. Called from acl.c. */
 */
 
 /* Code for calling spf checks via libspf-alt. Called from acl.c. */


@@ -72,6 +72,18 @@ int dns_rc;
 
 DEBUG(D_receive) debug_printf("SPF_dns_exim_lookup '%s'\n", domain);
 
 
 DEBUG(D_receive) debug_printf("SPF_dns_exim_lookup '%s'\n", domain);
 

+/* Shortcircuit SPF RR lookups by returning NO_DATA.  They were obsoleted by
+RFC 6686/7208 years ago. see bug #1294 */
+
+if (rr_type == T_SPF)
+  {
+  HDEBUG(D_host_lookup) debug_printf("faking NO_DATA for SPF RR(99) lookup\n");
+  srr.herrno = NO_DATA;
+  SPF_dns_rr_dup(&spfrr, &srr);
+  store_free_dns_answer(dnsa);
+  return spfrr;
+  }
+

 switch (dns_rc = dns_lookup(dnsa, US domain, rr_type, NULL))
   {
   case DNS_SUCCEED:    srr.herrno = NETDB_SUCCESS;     break;
 switch (dns_rc = dns_lookup(dnsa, US domain, rr_type, NULL))
   {
   case DNS_SUCCEED:    srr.herrno = NETDB_SUCCESS;     break;


@@ -80,7 +92,7 @@ switch (dns_rc = dns_lookup(dnsa, US domain, rr_type, NULL))
   case DNS_NODATA:     srr.herrno = NO_DATA;           break;
   case DNS_FAIL:
   default:             srr.herrno = NO_RECOVERY;       break;
   case DNS_NODATA:     srr.herrno = NO_DATA;           break;
   case DNS_FAIL:
   default:             srr.herrno = NO_RECOVERY;       break;

-  } 
+  }

 
 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
 
 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
      rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))


@@ -89,6 +101,7 @@ for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
 if (found == 0)
   {
   SPF_dns_rr_dup(&spfrr, &srr);
 if (found == 0)
   {
   SPF_dns_rr_dup(&spfrr, &srr);

+  store_free_dns_answer(dnsa);

   return spfrr;
   }
 
   return spfrr;
   }
 


@@ -122,7 +135,8 @@ for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
 
        if (strncmpic(rr->data+1, US SPF_VER_STR, 6) != 0)
          {
 
        if (strncmpic(rr->data+1, US SPF_VER_STR, 6) != 0)
          {

-         HDEBUG(D_host_lookup) debug_printf("not an spf record\n");
+         HDEBUG(D_host_lookup) debug_printf("not an spf record: %.*s\n",
+           (int) s[0], s+1);

          continue;
          }
 
          continue;
          }
 


@@ -135,6 +149,7 @@ for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
          continue;
        gstring_release_unused(g);
        s = string_copy_malloc(string_from_gstring(g));
          continue;
        gstring_release_unused(g);
        s = string_copy_malloc(string_from_gstring(g));

+       DEBUG(D_receive) debug_printf("SPF_dns_exim_lookup '%s'\n", s);

        break;
        }
 
        break;
        }
 


@@ -147,13 +162,18 @@ for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
        break;
        }
       }
        break;
        }
       }

-    DEBUG(D_receive) debug_printf("SPF_dns_exim_lookup '%s'\n", s);

     srr.rr[found++] = (void *) s;
     }
 
     srr.rr[found++] = (void *) s;
     }
 

-srr.num_rr = found;
+/* Did we filter out all TXT RRs? Return NO_DATA instead of SUCCESS with
+empty ANSWER section. */
+
+if (!(srr.num_rr = found))
+  srr.herrno = NO_DATA;
+

 /* spfrr->rr must have been malloc()d for this */
 SPF_dns_rr_dup(&spfrr, &srr);
 /* spfrr->rr must have been malloc()d for this */
 SPF_dns_rr_dup(&spfrr, &srr);

+store_free_dns_answer(dnsa);

 return spfrr;
 }
 
 return spfrr;
 }
 


@@ -201,6 +221,7 @@ spf_init(void)
 {
 SPF_dns_server_t * dc;
 int debug = 0;
 {
 SPF_dns_server_t * dc;
 int debug = 0;

+const uschar *s;

 
 DEBUG(D_receive) debug = 1;
 
 
 DEBUG(D_receive) debug = 1;
 


@@ -223,11 +244,16 @@ if (!(spf_server = SPF_server_new_dns(dc, debug)))
   DEBUG(D_receive) debug_printf("spf: SPF_server_new() failed.\n");
   return FALSE;
   }
   DEBUG(D_receive) debug_printf("spf: SPF_server_new() failed.\n");
   return FALSE;
   }

-  /* Quick hack to override the outdated explanation URL.
-  See https://www.mail-archive.com/mailop@mailop.org/msg08019.html */
-  SPF_server_set_explanation(spf_server, "Please%_see%_http://www.open-spf.org/Why?id=%{S}&ip=%{C}&receiver=%{R}", &spf_response);
-  if (SPF_response_errcode(spf_response) != SPF_E_SUCCESS)
-    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", SPF_strerror(SPF_response_errcode(spf_response)));
+  /* Override the outdated explanation URL.
+  See https://www.mail-archive.com/mailop@mailop.org/msg08019.html
+  Used to work as "Please%_see%_http://www.open-spf.org/Why?id=%{S}&ip=%{C}&receiver=%{R}",
+  but is broken now (May 18th, 2020) */
+if (!(s = expand_string(spf_smtp_comment_template)))
+  log_write(0, LOG_MAIN|LOG_PANIC_DIE, "expansion of spf_smtp_comment_template failed");
+
+SPF_server_set_explanation(spf_server, CCS s, &spf_response);
+if (SPF_response_errcode(spf_response) != SPF_E_SUCCESS)
+  log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", SPF_strerror(SPF_response_errcode(spf_response)));

 
 return TRUE;
 }
 
 return TRUE;
 }


@@ -283,6 +309,22 @@ return TRUE;
 }
 
 
 }
 
 

+void
+spf_response_debug(SPF_response_t * spf_response)
+{
+if (SPF_response_messages(spf_response) == 0)
+  debug_printf(" (no errors)\n");
+else for (int i = 0; i < SPF_response_messages(spf_response); i++)
+  {
+  SPF_error_t * err = SPF_response_message(spf_response, i);
+  debug_printf( "%s_msg = (%d) %s\n",
+                 (SPF_error_errorp(err) ? "warn" : "err"),
+                 SPF_error_code(err),
+                 SPF_error_message(err));
+  }
+}
+
+

 /* spf_process adds the envelope sender address to the existing
    context (if any), retrieves the result, sets up expansion
    strings and evaluates the condition outcome.
 /* spf_process adds the envelope sender address to the existing
    context (if any), retrieves the result, sets up expansion
    strings and evaluates the condition outcome.


@@ -325,6 +367,8 @@ else
   spf_smtp_comment       = US SPF_response_get_smtp_comment(spf_response);
 
   rc = SPF_response_result(spf_response);
   spf_smtp_comment       = US SPF_response_get_smtp_comment(spf_response);
 
   rc = SPF_response_result(spf_response);

+
+  DEBUG(D_acl) spf_response_debug(spf_response);

   }
 
 /* We got a result. Now see if we should return OK or FAIL for it */
   }
 
 /* We got a result. Now see if we should return OK or FAIL for it */


@@ -361,8 +405,12 @@ if (spf_result_guessed)
   g = string_cat(g, US" (best guess record for domain)");
 
 s = expand_string(US"$sender_address_domain");
   g = string_cat(g, US" (best guess record for domain)");
 
 s = expand_string(US"$sender_address_domain");

+if (s && *s)
+  return string_append(g, 2, US" smtp.mailfrom=", s);
+
+s = sender_helo_name;

 return s && *s
 return s && *s

-  ? string_append(g, 2, US" smtp.mailfrom=", s)
+  ? string_append(g, 2, US" smtp.helo=", s)

   : string_cat(g, US" smtp.mailfrom=<>");
 }
 
   : string_cat(g, US" smtp.mailfrom=<>");
 }