dnsbl: src/context.cpp comparison

comparison src/context.cpp @ 462:f3f1ece619ba stable-6-0-75

change dkim_from syntax to allow "signer1,signer2;spf data"

author	Carl Byington <carl@five-ten-sg.com>
date	Sat, 09 Mar 2019 18:46:25 -0800
parents	ad05c61d6372
children	428de28b34b7

comparison

equal deleted inserted replaced

-:c22fc705c597
+:f3f1ece619ba
 my_syslog(queueid, buf);
 }
 }
+const char *CONTEXT::extra_spf_data(const char *signers) {
+const char *e = strchr(signers, ';');
+if (e) e++;
+return e;
+}
 bool CONTEXT::in_signing_set(const char *s, const char *signers) {
 // s is an actual signer
 // signers is the set of acceptable signers, separated by commas
 size_t n = strlen(s);
 const char *p = signers;
+char *e = (char *)strchr(p, ';');       // only search up to ; which separates signers from extra spf data
+if (e) *e = '\0';
+bool rc = true;
 do {
 const char *c = strchr(p, ',');
 size_t m = (c) ? c-p : strlen(p);   // length of this element in the signing set
-if ((m == n) && (strncasecmp(p, s, n) == 0)) return true;   // exact match
+if ((m == n) && (strncasecmp(p, s, n) == 0)) break;     // exact match
 if ((*p == '*') && (n >= m)) {
-// try for wildcard match
+if (strncasecmp(p+1, s+n-(m-1), m-1) == 0) break;   // wildcard match
-if (strncasecmp(p+1, s+n-(m-1), m-1) == 0) return true;
+}
-}
+if (!c) {
-if (!c) return false;
+rc = false;
+break;
+}
 p = c + 1;
 } while (true);
+if (e) *e = ';';
+return rc;
 }
 void CONTEXT::replace(char *buf, char *p, const char *what)
 {
 strcpy(buf, repl);
 }
 }
-bool CONTEXT::resolve_spf(const char *from, uint32_t ip, mlfiPriv *priv)
+bool CONTEXT::resolve_spf(const char *from, uint32_t ip, mlfiPriv *priv, const char *signers)
 {
+const char *extraspf = extra_spf_data(signers);
 // ip is in host order
 if (priv->mailaddr) {
 const char *f = strchr(priv->mailaddr, '@');
 if (f) {
 f++;
 if (efl > hfl) {
 size_t off = efl - hfl;
 if ((f[off-1] == '.') && (strcmp(f+off,from) == 0)) {
 // envelope from is a strict child of header from
 // use envelope from rather than header from
-if (resolve_one_spf(f, ip, priv)) return true;
+if (resolve_one_spf(f, ip, priv, extraspf)) return true;
 }
 }
 }
 }
-return resolve_one_spf(from, ip, priv);
+return resolve_one_spf(from, ip, priv, extraspf);
 }
-bool CONTEXT::resolve_one_spf(const char *from, uint32_t ip, mlfiPriv *priv, int level)
+bool CONTEXT::resolve_one_spf(const char *from, uint32_t ip, mlfiPriv *priv, const char *extraspf, int level)
 {
 char buf[maxdnslength];
 log(priv->queueid, "looking for %s txt record", from);
 dns_interface(*priv, from, ns_t_txt, false, NULL, buf, maxdnslength);
+if ((level == 0) &&
+extraspf &&
+((strlen(buf) + strlen(extraspf) + 1) < sizeof(buf))) {
+strcat(buf, " ");
+strcat(buf, extraspf);
+}
 if (*buf) {
 log(priv->queueid, "found txt record %s", buf);
 // expand some macros here - a very restricted subset of all possible spf macros
 // only expand the first instance of each.
 char *p = strstr(buf, "%{i}");
 }
 }
 }
 else if ((level < 5) && (strncmp(p, "redirect=", 9) == 0)) {
 p += 9;
-if (resolve_one_spf(p, ip, priv, level+1)) return true;
+if (resolve_one_spf(p, ip, priv, NULL, level+1)) return true;
 }
 else if ((level < 5) && (strncmp(p, "include:", 8) == 0)) {
 p += 8;
-if (resolve_one_spf(p, ip, priv, level+1)) return true;
+if (resolve_one_spf(p, ip, priv, NULL, level+1)) return true;
 }
 }
 p = (b) ? b+1 : e;
 }
 }
 }
 }
 if (st == token_unsigned_black) {
 // enforce dmarc
 if (!dmarc) {
-dmarc = resolve_spf(from, ntohl(priv->ip), priv);
+dmarc = resolve_spf(from, ntohl(priv->ip), priv, dk->signer);
 }
 if (!dmarc) {
 // not signed and does not pass spf, reject it
 char buf[maxlen];
 snprintf(buf, sizeof(buf), "Mail rejected - not dkim signed by %s", dk->signer);
 return token_black;
 }
 }
 if (st == token_signed_white) {
 // not signed by a white listed signer, but maybe passes strong spf check
-if (resolve_spf(from, ntohl(priv->ip), priv)) {
+if (resolve_spf(from, ntohl(priv->ip), priv, dk->signer)) {
 log(queueid, "spf pass for %s rather than whitelisted dkim signer", from);
 return token_white;
 }
 }
 if (st == token_require_signed) {
 // not signed by a required signer, but maybe passes strong spf check
 // only check spf if the list of required signers is not a single dot.
-if (strcmp(dk->signer, ".") && resolve_spf(from, ntohl(priv->ip), priv)) {
+if (strcmp(dk->signer, ".") && resolve_spf(from, ntohl(priv->ip), priv, dk->signer)) {
 log(queueid, "spf pass for %s rather than required dkim signer", from);
 return token_white;
 }
 // todo - we could also check spf for the rfc5321 envelope from domain,
 // if it is dmarc aligned (relaxed) with the rfc5322 header from domain.

Mercurial > dnsbl

comparison src/context.cpp @ 462:f3f1ece619ba stable-6-0-75