/*************************************************
* Exim - an Internet mail transport agent *
*************************************************/
-/* Experimental DMARC support.
+/* DMARC support.
Copyright (c) Todd Lyons <tlyons@exim.org> 2012 - 2014
+ Copyright (c) The Exim Maintainers 2019
License: GPL */
/* Portions Copyright (c) 2012, 2013, The Trusted Domain Project;
/* Code for calling dmarc checks via libopendmarc. Called from acl.c. */
#include "exim.h"
-#ifdef EXPERIMENTAL_DMARC
+#ifdef SUPPORT_DMARC
# if !defined SUPPORT_SPF
# error SPF must also be enabled for DMARC
# elif defined DISABLE_DKIM
dmarc_abort = FALSE;
dmarc_pass_fail = US"skipped";
dmarc_used_domain = US"";
-dmarc_has_been_checked = FALSE;
+f.dmarc_has_been_checked = FALSE;
header_from_sender = NULL;
spf_sender_domain = NULL;
spf_human_readable = NULL;
/* ACLs have "control=dmarc_disable_verify" */
-if (dmarc_disable_verify == TRUE)
+if (f.dmarc_disable_verify == TRUE)
return OK;
(void) memset(&dmarc_ctx, '\0', sizeof dmarc_ctx);
opendmarc_policy_status_to_str(libdm_status));
dmarc_abort = TRUE;
}
-if (!dmarc_tld_file)
+if (!dmarc_tld_file || !*dmarc_tld_file)
{
DEBUG(D_receive) debug_printf("DMARC: no dmarc_tld_file\n");
dmarc_abort = TRUE;
}
-else if (opendmarc_tld_read_file(dmarc_tld_file, NULL, NULL, NULL))
+else if (opendmarc_tld_read_file(CS dmarc_tld_file, NULL, NULL, NULL))
{
- log_write(0, LOG_MAIN|LOG_PANIC, "DMARC failure to load tld list %s: %d",
- dmarc_tld_file, errno);
+ log_write(0, LOG_MAIN|LOG_PANIC, "DMARC failure to load tld list '%s': %s",
+ dmarc_tld_file, strerror(errno));
dmarc_abort = TRUE;
}
if (!sender_host_address)
dmarc_store_data(header_line *hdr)
{
/* No debug output because would change every test debug output */
-if (!dmarc_disable_verify)
+if (!f.dmarc_disable_verify)
from_header = hdr;
return OK;
}
static void
dmarc_send_forensic_report(u_char **ruf)
{
-int c;
uschar *recipient, *save_sender;
BOOL send_status = FALSE;
error_block *eblock = NULL;
FILE *message_file = NULL;
/* Earlier ACL does not have *required* control=dmarc_enable_forensic */
-if (!dmarc_enable_forensic)
+if (!f.dmarc_enable_forensic)
return;
if ( dmarc_policy == DMARC_POLICY_REJECT && action == DMARC_RESULT_REJECT
eblock = add_to_eblock(eblock, US"Sender IP Address", sender_host_address);
eblock = add_to_eblock(eblock, US"Received Date", tod_stamp(tod_full));
eblock = add_to_eblock(eblock, US"SPF Alignment",
- (sa==DMARC_POLICY_SPF_ALIGNMENT_PASS) ?US"yes":US"no");
+ sa == DMARC_POLICY_SPF_ALIGNMENT_PASS ? US"yes" : US"no");
eblock = add_to_eblock(eblock, US"DKIM Alignment",
- (da==DMARC_POLICY_DKIM_ALIGNMENT_PASS)?US"yes":US"no");
+ da == DMARC_POLICY_DKIM_ALIGNMENT_PASS ? US"yes" : US"no");
eblock = add_to_eblock(eblock, US"DMARC Results", dmarc_status_text);
- /* Set a sane default envelope sender */
- dsn_from = dmarc_forensic_sender ? dmarc_forensic_sender :
- dsn_from ? dsn_from :
- string_sprintf("do-not-reply@%s",primary_hostname);
- for (c = 0; ruf[c]; c++)
+
+ for (int c = 0; ruf[c]; c++)
{
recipient = string_copylc(ruf[c]);
if (Ustrncmp(recipient, "mailto:",7))
recipient += 7;
DEBUG(D_receive)
debug_printf("DMARC forensic report to %s%s\n", recipient,
- (host_checking || running_in_test_harness) ? " (not really)" : "");
- if (host_checking || running_in_test_harness)
+ (host_checking || f.running_in_test_harness) ? " (not really)" : "");
+ if (host_checking || f.running_in_test_harness)
continue;
- save_sender = sender_address;
- sender_address = recipient;
- send_status = moan_to_sender(ERRMESS_DMARC_FORENSIC, eblock,
- header_list, message_file, FALSE);
- sender_address = save_sender;
- if (!send_status)
+ if (!moan_send_message(recipient, ERRMESS_DMARC_FORENSIC, eblock,
+ header_list, message_file, NULL))
log_write(0, LOG_MAIN|LOG_PANIC,
"failure to send DMARC forensic report to %s", recipient);
}
}
}
+
+/* Look up a DNS dmarc record for the given domain. Return it or NULL */
+
+static uschar *
+dmarc_dns_lookup(uschar * dom)
+{
+dns_answer * dnsa = store_get_dns_answer();
+dns_scan dnss;
+int rc = dns_lookup(dnsa, string_sprintf("_dmarc.%s", dom), T_TXT, NULL);
+
+if (rc == DNS_SUCCEED)
+ for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
+ rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
+ if (rr->type == T_TXT && rr->size > 3)
+ return string_copyn(US rr->data, rr->size);
+return NULL;
+}
+
+
/* dmarc_process adds the envelope sender address to the existing
context (if any), retrieves the result, sets up expansion
strings and evaluates the condition outcome. */
int dmarc_spf_result = 0; /* stores spf into dmarc conn ctx */
int tmp_ans, c;
pdkim_signature * sig = dkim_signatures;
+uschar * rr;
BOOL has_dmarc_record = TRUE;
u_char **ruf; /* forensic report addressees, if called for */
/* ACLs have "control=dmarc_disable_verify" */
-if (dmarc_disable_verify)
+if (f.dmarc_disable_verify)
return OK;
/* Store the header From: sender domain for this part of DMARC.
uschar * p;
uschar saveend;
- parse_allow_group = TRUE;
+ f.parse_allow_group = TRUE;
p = parse_find_address_end(from_header->text, FALSE);
saveend = *p; *p = '\0';
if ((header_from_sender = parse_extract_address(from_header->text, &errormsg,
sig->domain, dkim_ares_result);
sig = sig->next;
}
- libdm_status = opendmarc_policy_query_dmarc(dmarc_pctx, US"");
+
+ /* Look up DMARC policy record in DNS. We do this explicitly, rather than
+ letting the dmarc library do it with opendmarc_policy_query_dmarc(), so that
+ our dns access path is used for debug tracing and for the testsuite
+ diversion. */
+
+ libdm_status = (rr = dmarc_dns_lookup(header_from_sender))
+ ? opendmarc_policy_store_dmarc(dmarc_pctx, rr, header_from_sender, NULL)
+ : DMARC_DNS_ERROR_NO_RECORD;
switch (libdm_status)
{
case DMARC_DNS_ERROR_NXDOMAIN:
/* Can't use exim's string manipulation functions so allocate memory
for libopendmarc using its max hostname length definition. */
- dmarc_domain = US calloc(DMARC_MAXHOSTNAMELEN, sizeof(uschar));
+ dmarc_domain = store_get(DMARC_MAXHOSTNAMELEN, TRUE);
libdm_status = opendmarc_policy_fetch_utilized_domain(dmarc_pctx,
dmarc_domain, DMARC_MAXHOSTNAMELEN-1);
- dmarc_used_domain = string_copy(dmarc_domain);
- free(dmarc_domain);
+ store_release_above(dmarc_domain + Ustrlen(dmarc_domain)+1);
+ dmarc_used_domain = dmarc_domain;
if (libdm_status != DMARC_PARSE_OKAY)
log_write(0, LOG_MAIN|LOG_PANIC,
/* shut down libopendmarc */
if (dmarc_pctx)
(void) opendmarc_policy_connect_shutdown(dmarc_pctx);
-if (!dmarc_disable_verify)
+if (!f.dmarc_disable_verify)
(void) opendmarc_policy_library_shutdown(&dmarc_ctx);
return OK;
/* Write the contents to the history file */
DEBUG(D_receive)
debug_printf("DMARC logging history data for opendmarc reporting%s\n",
- (host_checking || running_in_test_harness) ? " (not really)" : "");
-if (host_checking || running_in_test_harness)
+ (host_checking || f.running_in_test_harness) ? " (not really)" : "");
+if (host_checking || f.running_in_test_harness)
{
DEBUG(D_receive)
debug_printf("DMARC history data for debugging:\n%s", history_buffer);
uschar *
dmarc_exim_expand_query(int what)
{
-if (dmarc_disable_verify || !dmarc_pctx)
+if (f.dmarc_disable_verify || !dmarc_pctx)
return dmarc_exim_expand_defaults(what);
if (what == DMARC_VERIFY_STATUS)
dmarc_exim_expand_defaults(int what)
{
if (what == DMARC_VERIFY_STATUS)
- return dmarc_disable_verify ? US"off" : US"none";
+ return f.dmarc_disable_verify ? US"off" : US"none";
return US"";
}
gstring *
authres_dmarc(gstring * g)
{
-if (dmarc_has_been_checked)
+if (f.dmarc_has_been_checked)
{
g = string_append(g, 2, US";\n\tdmarc=", dmarc_pass_fail);
if (header_from_sender)
}
# endif /* SUPPORT_SPF */
-#endif /* EXPERIMENTAL_DMARC */
+#endif /* SUPPORT_DMARC */
/* vi: aw ai sw=2
*/
git://git.exim.org / users / jgh / exim.git / blobdiff