/*- * Copyright 2016 Vsevolod Stakhov * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ /***MODULE:dkim * rspamd module that checks dkim records of incoming email * * Allowed options: * - symbol_allow (string): symbol to insert in case of allow (default: 'R_DKIM_ALLOW') * - symbol_reject (string): symbol to insert (default: 'R_DKIM_REJECT') * - symbol_tempfail (string): symbol to insert in case of temporary fail (default: 'R_DKIM_TEMPFAIL') * - symbol_permfail (string): symbol to insert in case of permanent failure (default: 'R_DKIM_PERMFAIL') * - symbol_na (string): symbol to insert in case of no signing (default: 'R_DKIM_NA') * - whitelist (map): map of whitelisted networks * - domains (map): map of domains to check * - strict_multiplier (number): multiplier for strict domains * - time_jitter (number): jitter in seconds to allow time diff while checking * - trusted_only (flag): check signatures only for domains in 'domains' map */ #include "config.h" #include "libmime/message.h" #include "libserver/dkim.h" #include "libutil/hash.h" #include "libserver/maps/map.h" #include "libserver/maps/map_helpers.h" #include "rspamd.h" #include "utlist.h" #include "unix-std.h" #include "lua/lua_common.h" #include "libserver/mempool_vars_internal.h" #define DEFAULT_SYMBOL_REJECT "R_DKIM_REJECT" #define DEFAULT_SYMBOL_TEMPFAIL "R_DKIM_TEMPFAIL" #define DEFAULT_SYMBOL_ALLOW "R_DKIM_ALLOW" #define DEFAULT_SYMBOL_NA "R_DKIM_NA" #define DEFAULT_SYMBOL_PERMFAIL "R_DKIM_PERMFAIL" #define DEFAULT_CACHE_SIZE 2048 #define DEFAULT_TIME_JITTER 60 #define DEFAULT_MAX_SIGS 5 static const gchar *M = "rspamd dkim plugin"; static const gchar default_sign_headers[] = "" "(o)from:(x)sender:(o)reply-to:(o)subject:(x)date:(x)message-id:" "(o)to:(o)cc:(x)mime-version:(x)content-type:(x)content-transfer-encoding:" "resent-to:resent-cc:resent-from:resent-sender:resent-message-id:" "(x)in-reply-to:(x)references:list-id:list-help:list-owner:list-unsubscribe:" "list-unsubscribe-post:list-subscribe:list-post:(x)openpgp:(x)autocrypt"; static const gchar default_arc_sign_headers[] = "" "(o)from:(x)sender:(o)reply-to:(o)subject:(x)date:(x)message-id:" "(o)to:(o)cc:(x)mime-version:(x)content-type:(x)content-transfer-encoding:" "resent-to:resent-cc:resent-from:resent-sender:resent-message-id:" "(x)in-reply-to:(x)references:list-id:list-help:list-owner:list-unsubscribe:" "list-unsubscribe-post:list-subscribe:list-post:dkim-signature:(x)openpgp:" "(x)autocrypt"; struct dkim_ctx { struct module_ctx ctx; const gchar *symbol_reject; const gchar *symbol_tempfail; const gchar *symbol_allow; const gchar *symbol_na; const gchar *symbol_permfail; struct rspamd_radix_map_helper *whitelist_ip; struct rspamd_hash_map_helper *dkim_domains; guint strict_multiplier; guint time_jitter; rspamd_lru_hash_t *dkim_hash; rspamd_lru_hash_t *dkim_sign_hash; const gchar *sign_headers; const gchar *arc_sign_headers; guint max_sigs; gboolean trusted_only; gboolean check_local; gboolean check_authed; }; struct dkim_check_result { rspamd_dkim_context_t *ctx; rspamd_dkim_key_t *key; struct rspamd_task *task; struct rspamd_dkim_check_result *res; gdouble mult_allow; gdouble mult_deny; struct rspamd_symcache_dynamic_item *item; struct dkim_check_result *next, *prev, *first; }; static void dkim_symbol_callback(struct rspamd_task *task, struct rspamd_symcache_dynamic_item *item, void *unused); static gint lua_dkim_sign_handler(lua_State *L); static gint lua_dkim_verify_handler(lua_State *L); static gint lua_dkim_canonicalize_handler(lua_State *L); /* Initialization */ gint dkim_module_init(struct rspamd_config *cfg, struct module_ctx **ctx); gint dkim_module_config(struct rspamd_config *cfg, bool validate); gint dkim_module_reconfig(struct rspamd_config *cfg); module_t dkim_module = { "dkim", dkim_module_init, dkim_module_config, dkim_module_reconfig, NULL, RSPAMD_MODULE_VER, (guint) -1, }; static inline struct dkim_ctx * dkim_get_context(struct rspamd_config *cfg) { return (struct dkim_ctx *) g_ptr_array_index(cfg->c_modules, dkim_module.ctx_offset); } static void dkim_module_key_dtor(gpointer k) { rspamd_dkim_key_t *key = k; rspamd_dkim_key_unref(key); } static void dkim_module_free_list(gpointer k) { g_list_free_full((GList *) k, rspamd_gstring_free_hard); } gint dkim_module_init(struct rspamd_config *cfg, struct module_ctx **ctx) { struct dkim_ctx *dkim_module_ctx; dkim_module_ctx = rspamd_mempool_alloc0(cfg->cfg_pool, sizeof(*dkim_module_ctx)); dkim_module_ctx->sign_headers = default_sign_headers; dkim_module_ctx->arc_sign_headers = default_arc_sign_headers; dkim_module_ctx->max_sigs = DEFAULT_MAX_SIGS; *ctx = (struct module_ctx *) dkim_module_ctx; rspamd_rcl_add_doc_by_path(cfg, NULL, "DKIM check plugin", "dkim", UCL_OBJECT, NULL, 0, NULL, 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Map of IP addresses that should be excluded from DKIM checks", "whitelist", UCL_STRING, NULL, 0, NULL, 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Symbol that is added if DKIM check is successful", "symbol_allow", UCL_STRING, NULL, 0, DEFAULT_SYMBOL_ALLOW, 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Symbol that is added if DKIM check is unsuccessful", "symbol_reject", UCL_STRING, NULL, 0, DEFAULT_SYMBOL_REJECT, 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Symbol that is added if DKIM check can't be completed (e.g. DNS failure)", "symbol_tempfail", UCL_STRING, NULL, 0, DEFAULT_SYMBOL_TEMPFAIL, 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Symbol that is added if mail is not signed", "symbol_na", UCL_STRING, NULL, 0, DEFAULT_SYMBOL_NA, 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Symbol that is added if permanent failure encountered", "symbol_permfail", UCL_STRING, NULL, 0, DEFAULT_SYMBOL_PERMFAIL, 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Size of DKIM keys cache", "dkim_cache_size", UCL_INT, NULL, 0, G_STRINGIFY(DEFAULT_CACHE_SIZE), 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Allow this time difference when checking DKIM signature time validity", "time_jitter", UCL_TIME, NULL, 0, G_STRINGIFY(DEFAULT_TIME_JITTER), 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Domains to check DKIM for (check all domains if this option is empty)", "domains", UCL_STRING, NULL, 0, "empty", 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Map of domains that are treated as 'trusted' meaning that DKIM policy failure has more significant score", "trusted_domains", UCL_STRING, NULL, 0, "empty", 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Multiply dkim score by this factor for trusted domains", "strict_multiplier", UCL_FLOAT, NULL, 0, NULL, 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Check DKIM policies merely for `trusted_domains`", "trusted_only", UCL_BOOLEAN, NULL, 0, "false", 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Lua script that tells if a message should be signed and with what params (obsoleted)", "sign_condition", UCL_STRING, NULL, 0, "empty", 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Obsoleted: maximum number of DKIM signatures to check", "max_sigs", UCL_INT, NULL, 0, "n/a", 0); rspamd_rcl_add_doc_by_path(cfg, "dkim", "Headers used in signing", "sign_headers", UCL_STRING, NULL, 0, default_sign_headers, 0); return 0; } gint dkim_module_config(struct rspamd_config *cfg, bool validate) { const ucl_object_t *value; gint res = TRUE, cb_id = -1; guint cache_size, sign_cache_size; gboolean got_trusted = FALSE; struct dkim_ctx *dkim_module_ctx = dkim_get_context(cfg); /* Register global methods */ lua_getglobal(cfg->lua_state, "rspamd_plugins"); if (lua_type(cfg->lua_state, -1) == LUA_TTABLE) { lua_pushstring(cfg->lua_state, "dkim"); lua_createtable(cfg->lua_state, 0, 1); /* Set methods */ lua_pushstring(cfg->lua_state, "sign"); lua_pushcfunction(cfg->lua_state, lua_dkim_sign_handler); lua_settable(cfg->lua_state, -3); lua_pushstring(cfg->lua_state, "verify"); lua_pushcfunction(cfg->lua_state, lua_dkim_verify_handler); lua_settable(cfg->lua_state, -3); lua_pushstring(cfg->lua_state, "canon_header_relaxed"); lua_pushcfunction(cfg->lua_state, lua_dkim_canonicalize_handler); lua_settable(cfg->lua_state, -3); /* Finish dkim key */ lua_settable(cfg->lua_state, -3); } lua_pop(cfg->lua_state, 1); /* Remove global function */ dkim_module_ctx->whitelist_ip = NULL; value = rspamd_config_get_module_opt(cfg, "dkim", "check_local"); if (value == NULL) { value = rspamd_config_get_module_opt(cfg, "options", "check_local"); } if (value != NULL) { dkim_module_ctx->check_local = ucl_object_toboolean(value); } else { dkim_module_ctx->check_local = FALSE; } value = rspamd_config_get_module_opt(cfg, "dkim", "check_authed"); if (value == NULL) { value = rspamd_config_get_module_opt(cfg, "options", "check_authed"); } if (value != NULL) { dkim_module_ctx->check_authed = ucl_object_toboolean(value); } else { dkim_module_ctx->check_authed = FALSE; } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "symbol_reject")) != NULL) { dkim_module_ctx->symbol_reject = ucl_object_tostring(value); } else { dkim_module_ctx->symbol_reject = DEFAULT_SYMBOL_REJECT; } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "symbol_tempfail")) != NULL) { dkim_module_ctx->symbol_tempfail = ucl_object_tostring(value); } else { dkim_module_ctx->symbol_tempfail = DEFAULT_SYMBOL_TEMPFAIL; } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "symbol_allow")) != NULL) { dkim_module_ctx->symbol_allow = ucl_object_tostring(value); } else { dkim_module_ctx->symbol_allow = DEFAULT_SYMBOL_ALLOW; } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "symbol_na")) != NULL) { dkim_module_ctx->symbol_na = ucl_object_tostring(value); } else { dkim_module_ctx->symbol_na = DEFAULT_SYMBOL_NA; } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "symbol_permfail")) != NULL) { dkim_module_ctx->symbol_permfail = ucl_object_tostring(value); } else { dkim_module_ctx->symbol_permfail = DEFAULT_SYMBOL_PERMFAIL; } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "dkim_cache_size")) != NULL) { cache_size = ucl_object_toint(value); } else { cache_size = DEFAULT_CACHE_SIZE; } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "sign_cache_size")) != NULL) { sign_cache_size = ucl_object_toint(value); } else { sign_cache_size = 128; } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "time_jitter")) != NULL) { dkim_module_ctx->time_jitter = ucl_object_todouble(value); } else { dkim_module_ctx->time_jitter = DEFAULT_TIME_JITTER; } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "max_sigs")) != NULL) { dkim_module_ctx->max_sigs = ucl_object_toint(value); } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "whitelist")) != NULL) { rspamd_config_radix_from_ucl(cfg, value, "DKIM whitelist", &dkim_module_ctx->whitelist_ip, NULL, NULL, "dkim whitelist"); } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "domains")) != NULL) { if (!rspamd_map_add_from_ucl(cfg, value, "DKIM domains", rspamd_kv_list_read, rspamd_kv_list_fin, rspamd_kv_list_dtor, (void **) &dkim_module_ctx->dkim_domains, NULL, RSPAMD_MAP_DEFAULT)) { msg_warn_config("cannot load dkim domains list from %s", ucl_object_tostring(value)); } else { got_trusted = TRUE; } } if (!got_trusted && (value = rspamd_config_get_module_opt(cfg, "dkim", "trusted_domains")) != NULL) { if (!rspamd_map_add_from_ucl(cfg, value, "DKIM domains", rspamd_kv_list_read, rspamd_kv_list_fin, rspamd_kv_list_dtor, (void **) &dkim_module_ctx->dkim_domains, NULL, RSPAMD_MAP_DEFAULT)) { msg_warn_config("cannot load dkim domains list from %s", ucl_object_tostring(value)); if (validate) { return FALSE; } } else { got_trusted = TRUE; } } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "strict_multiplier")) != NULL) { dkim_module_ctx->strict_multiplier = ucl_object_toint(value); } else { dkim_module_ctx->strict_multiplier = 1; } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "trusted_only")) != NULL) { dkim_module_ctx->trusted_only = ucl_object_toboolean(value); } else { dkim_module_ctx->trusted_only = FALSE; } if ((value = rspamd_config_get_module_opt(cfg, "dkim", "sign_headers")) != NULL) { dkim_module_ctx->sign_headers = ucl_object_tostring(value); } if ((value = rspamd_config_get_module_opt(cfg, "arc", "sign_headers")) != NULL) { dkim_module_ctx->arc_sign_headers = ucl_object_tostring(value); } if (cache_size > 0) { dkim_module_ctx->dkim_hash = rspamd_lru_hash_new( cache_size, g_free, dkim_module_key_dtor); rspamd_mempool_add_destructor(cfg->cfg_pool, (rspamd_mempool_destruct_t) rspamd_lru_hash_destroy, dkim_module_ctx->dkim_hash); } if (sign_cache_size > 0) { dkim_module_ctx->dkim_sign_hash = rspamd_lru_hash_new( sign_cache_size, g_free, (GDestroyNotify) rspamd_dkim_sign_key_unref); rspamd_mempool_add_destructor(cfg->cfg_pool, (rspamd_mempool_destruct_t) rspamd_lru_hash_destroy, dkim_module_ctx->dkim_sign_hash); } if (dkim_module_ctx->trusted_only && !got_trusted) { msg_err_config("trusted_only option is set and no trusted domains are defined"); if (validate) { return FALSE; } } else { if (!rspamd_config_is_module_enabled(cfg, "dkim")) { return TRUE; } cb_id = rspamd_symcache_add_symbol(cfg->cache, "DKIM_CHECK", 0, dkim_symbol_callback, NULL, SYMBOL_TYPE_CALLBACK, -1); rspamd_config_add_symbol(cfg, "DKIM_CHECK", 0.0, "DKIM check callback", "policies", RSPAMD_SYMBOL_FLAG_IGNORE_METRIC, 1, 1); rspamd_config_add_symbol_group(cfg, "DKIM_CHECK", "dkim"); rspamd_symcache_add_symbol(cfg->cache, dkim_module_ctx->symbol_reject, 0, NULL, NULL, SYMBOL_TYPE_VIRTUAL | SYMBOL_TYPE_FINE, cb_id); rspamd_symcache_add_symbol(cfg->cache, dkim_module_ctx->symbol_na, 0, NULL, NULL, SYMBOL_TYPE_VIRTUAL | SYMBOL_TYPE_FINE, cb_id); rspamd_symcache_add_symbol(cfg->cache, dkim_module_ctx->symbol_permfail, 0, NULL, NULL, SYMBOL_TYPE_VIRTUAL | SYMBOL_TYPE_FINE, cb_id); rspamd_symcache_add_symbol(cfg->cache, dkim_module_ctx->symbol_tempfail, 0, NULL, NULL, SYMBOL_TYPE_VIRTUAL | SYMBOL_TYPE_FINE, cb_id); rspamd_symcache_add_symbol(cfg->cache, dkim_module_ctx->symbol_allow, 0, NULL, NULL, SYMBOL_TYPE_VIRTUAL | SYMBOL_TYPE_FINE, cb_id); rspamd_symcache_add_symbol(cfg->cache, "DKIM_TRACE", 0, NULL, NULL, SYMBOL_TYPE_VIRTUAL | SYMBOL_TYPE_NOSTAT, cb_id); rspamd_config_add_symbol(cfg, "DKIM_TRACE", 0.0, "DKIM trace symbol", "policies", RSPAMD_SYMBOL_FLAG_IGNORE_METRIC, 1, 1); rspamd_config_add_symbol_group(cfg, "DKIM_TRACE", "dkim"); msg_info_config("init internal dkim module"); #ifndef HAVE_OPENSSL msg_warn_config( "openssl is not found so dkim rsa check is disabled, only check body hash, it is NOT safe to trust these results"); #endif } return res; } /** * Grab a private key from the cache * or from the key content provided */ rspamd_dkim_sign_key_t * dkim_module_load_key_format(struct rspamd_task *task, struct dkim_ctx *dkim_module_ctx, const gchar *key, gsize keylen, enum rspamd_dkim_key_format key_format) { guchar h[rspamd_cryptobox_HASHBYTES], hex_hash[rspamd_cryptobox_HASHBYTES * 2 + 1]; rspamd_dkim_sign_key_t *ret = NULL; GError *err = NULL; struct stat st; memset(hex_hash, 0, sizeof(hex_hash)); rspamd_cryptobox_hash(h, key, keylen, NULL, 0); rspamd_encode_hex_buf(h, sizeof(h), hex_hash, sizeof(hex_hash)); if (dkim_module_ctx->dkim_sign_hash) { ret = rspamd_lru_hash_lookup(dkim_module_ctx->dkim_sign_hash, hex_hash, time(NULL)); } /* * This fails for paths that are also valid base64. * Maybe the caller should have specified a format. */ if (key_format == RSPAMD_DKIM_KEY_UNKNOWN) { if (key[0] == '.' || key[0] == '/') { if (!rspamd_cryptobox_base64_is_valid(key, keylen)) { key_format = RSPAMD_DKIM_KEY_FILE; } } else if (rspamd_cryptobox_base64_is_valid(key, keylen)) { key_format = RSPAMD_DKIM_KEY_BASE64; } } if (ret != NULL && key_format == RSPAMD_DKIM_KEY_FILE) { msg_debug_task("checking for stale file key"); if (stat(key, &st) != 0) { msg_err_task("cannot stat key file: %s", strerror(errno)); return NULL; } if (rspamd_dkim_sign_key_maybe_invalidate(ret, st.st_mtime)) { msg_debug_task("removing stale file key"); /* * Invalidate DKIM key * removal from lru cache also cleanup the key and value */ if (dkim_module_ctx->dkim_sign_hash) { rspamd_lru_hash_remove(dkim_module_ctx->dkim_sign_hash, hex_hash); } ret = NULL; } } /* found key; done */ if (ret != NULL) { return ret; } ret = rspamd_dkim_sign_key_load(key, keylen, key_format, &err); if (ret == NULL) { msg_err_task("cannot load dkim key %s: %e", key, err); g_error_free(err); } else if (dkim_module_ctx->dkim_sign_hash) { rspamd_lru_hash_insert(dkim_module_ctx->dkim_sign_hash, g_strdup(hex_hash), ret, time(NULL), 0); } return ret; } static gint lua_dkim_sign_handler(lua_State *L) { struct rspamd_task *task = lua_check_task(L, 1); gint64 arc_idx = 0, expire = 0; enum rspamd_dkim_type sign_type = RSPAMD_DKIM_NORMAL; GError *err = NULL; GString *hdr; GList *sigs = NULL; const gchar *selector = NULL, *domain = NULL, *key = NULL, *rawkey = NULL, *headers = NULL, *sign_type_str = NULL, *arc_cv = NULL, *pubkey = NULL; rspamd_dkim_sign_context_t *ctx; rspamd_dkim_sign_key_t *dkim_key; gsize rawlen = 0, keylen = 0; gboolean no_cache = FALSE, strict_pubkey_check = FALSE; struct dkim_ctx *dkim_module_ctx; luaL_argcheck(L, lua_type(L, 2) == LUA_TTABLE, 2, "'table' expected"); /* * Get the following elements: * - selector * - domain * - key */ if (!rspamd_lua_parse_table_arguments(L, 2, &err, RSPAMD_LUA_PARSE_ARGUMENTS_DEFAULT, "key=V;rawkey=V;*domain=S;*selector=S;no_cache=B;headers=S;" "sign_type=S;arc_idx=I;arc_cv=S;expire=I;pubkey=S;" "strict_pubkey_check=B", &keylen, &key, &rawlen, &rawkey, &domain, &selector, &no_cache, &headers, &sign_type_str, &arc_idx, &arc_cv, &expire, &pubkey, &strict_pubkey_check)) { msg_err_task("cannot parse table arguments: %e", err); g_error_free(err); lua_pushboolean(L, FALSE); return 1; } dkim_module_ctx = dkim_get_context(task->cfg); if (key) { dkim_key = dkim_module_load_key_format(task, dkim_module_ctx, key, keylen, RSPAMD_DKIM_KEY_UNKNOWN); } else if (rawkey) { dkim_key = dkim_module_load_key_format(task, dkim_module_ctx, rawkey, rawlen, RSPAMD_DKIM_KEY_UNKNOWN); } else { msg_err_task("neither key nor rawkey are specified"); lua_pushboolean(L, FALSE); return 1; } if (dkim_key == NULL) { lua_pushboolean(L, FALSE); return 1; } if (sign_type_str) { if (strcmp(sign_type_str, "dkim") == 0) { sign_type = RSPAMD_DKIM_NORMAL; if (headers == NULL) { headers = dkim_module_ctx->sign_headers; } } else if (strcmp(sign_type_str, "arc-sign") == 0) { sign_type = RSPAMD_DKIM_ARC_SIG; if (headers == NULL) { headers = dkim_module_ctx->arc_sign_headers; } if (arc_idx == 0) { lua_settop(L, 0); return luaL_error(L, "no arc idx specified"); } } else if (strcmp(sign_type_str, "arc-seal") == 0) { sign_type = RSPAMD_DKIM_ARC_SEAL; if (arc_cv == NULL) { lua_settop(L, 0); return luaL_error(L, "no arc cv specified"); } if (arc_idx == 0) { lua_settop(L, 0); return luaL_error(L, "no arc idx specified"); } } else { lua_settop(L, 0); return luaL_error(L, "unknown sign type: %s", sign_type_str); } } else { /* Unspecified sign type, assume plain dkim */ if (headers == NULL) { headers = dkim_module_ctx->sign_headers; } } if (pubkey != NULL) { /* Also check if private and public keys match */ rspamd_dkim_key_t *pk; keylen = strlen(pubkey); pk = rspamd_dkim_parse_key(pubkey, &keylen, NULL); if (pk == NULL) { if (strict_pubkey_check) { msg_err_task("cannot parse pubkey from string: %s, skip signing", pubkey); lua_pushboolean(L, FALSE); return 1; } else { msg_warn_task("cannot parse pubkey from string: %s", pubkey); } } else { GError *te = NULL; /* We have parsed the key, so try to check keys */ if (!rspamd_dkim_match_keys(pk, dkim_key, &te)) { if (strict_pubkey_check) { msg_err_task("public key for %s/%s does not match private " "key: %e, skip signing", domain, selector, te); g_error_free(te); lua_pushboolean(L, FALSE); rspamd_dkim_key_unref(pk); return 1; } else { msg_warn_task("public key for %s/%s does not match private " "key: %e", domain, selector, te); g_error_free(te); } } rspamd_dkim_key_unref(pk); } } ctx = rspamd_create_dkim_sign_context(task, dkim_key, DKIM_CANON_RELAXED, DKIM_CANON_RELAXED, headers, sign_type, &err); if (ctx == NULL) { msg_err_task("cannot create sign context: %e", err); g_error_free(err); lua_pushboolean(L, FALSE); return 1; } hdr = rspamd_dkim_sign(task, selector, domain, 0, expire, arc_idx, arc_cv, ctx); if (hdr) { if (!no_cache) { sigs = rspamd_mempool_get_variable(task->task_pool, "dkim-signature"); if (sigs == NULL) { sigs = g_list_append(sigs, hdr); rspamd_mempool_set_variable(task->task_pool, "dkim-signature", sigs, dkim_module_free_list); } else { sigs = g_list_append(sigs, hdr); (void) sigs; } } lua_pushboolean(L, TRUE); lua_pushlstring(L, hdr->str, hdr->len); if (no_cache) { g_string_free(hdr, TRUE); } return 2; } lua_pushboolean(L, FALSE); lua_pushnil(L); return 2; } gint dkim_module_reconfig(struct rspamd_config *cfg) { return dkim_module_config(cfg, false); } /* * Parse strict value for domain in format: 'reject_multiplier:deny_multiplier' */ static gboolean dkim_module_parse_strict(const gchar *value, gdouble *allow, gdouble *deny) { const gchar *colon; gchar *err = NULL; gdouble val; gchar numbuf[64]; colon = strchr(value, ':'); if (colon) { rspamd_strlcpy(numbuf, value, MIN(sizeof(numbuf), (colon - value) + 1)); val = strtod(numbuf, &err); if (err == NULL || *err == '\0') { *deny = val; colon++; rspamd_strlcpy(numbuf, colon, sizeof(numbuf)); err = NULL; val = strtod(numbuf, &err); if (err == NULL || *err == '\0') { *allow = val; return TRUE; } } } return FALSE; } static void dkim_module_check(struct dkim_check_result *res) { gboolean all_done = TRUE; const gchar *strict_value; struct dkim_check_result *first, *cur = NULL; struct dkim_ctx *dkim_module_ctx = dkim_get_context(res->task->cfg); struct rspamd_task *task = res->task; first = res->first; DL_FOREACH(first, cur) { if (cur->ctx == NULL) { continue; } if (cur->key != NULL && cur->res == NULL) { cur->res = rspamd_dkim_check(cur->ctx, cur->key, task); if (dkim_module_ctx->dkim_domains != NULL) { /* Perform strict check */ const gchar *domain = rspamd_dkim_get_domain(cur->ctx); if ((strict_value = rspamd_match_hash_map(dkim_module_ctx->dkim_domains, domain, strlen(domain))) != NULL) { if (!dkim_module_parse_strict(strict_value, &cur->mult_allow, &cur->mult_deny)) { cur->mult_allow = dkim_module_ctx->strict_multiplier; cur->mult_deny = dkim_module_ctx->strict_multiplier; } } } } } DL_FOREACH(first, cur) { if (cur->ctx == NULL) { continue; } if (cur->res == NULL) { /* Still need a key */ all_done = FALSE; } } if (all_done) { /* Create zero terminated array of results */ struct rspamd_dkim_check_result **pres; guint nres = 0, i = 0; DL_FOREACH(first, cur) { if (cur->ctx == NULL || cur->res == NULL) { continue; } nres++; } pres = rspamd_mempool_alloc(task->task_pool, sizeof(*pres) * (nres + 1)); pres[nres] = NULL; DL_FOREACH(first, cur) { const gchar *symbol = NULL, *trace = NULL; gdouble symbol_weight = 1.0; if (cur->ctx == NULL || cur->res == NULL) { continue; } pres[i++] = cur->res; if (cur->res->rcode == DKIM_REJECT) { symbol = dkim_module_ctx->symbol_reject; trace = "-"; symbol_weight = cur->mult_deny * 1.0; } else if (cur->res->rcode == DKIM_CONTINUE) { symbol = dkim_module_ctx->symbol_allow; trace = "+"; symbol_weight = cur->mult_allow * 1.0; } else if (cur->res->rcode == DKIM_PERM_ERROR) { trace = "~"; symbol = dkim_module_ctx->symbol_permfail; } else if (cur->res->rcode == DKIM_TRYAGAIN) { trace = "?"; symbol = dkim_module_ctx->symbol_tempfail; } if (symbol != NULL) { const gchar *domain = rspamd_dkim_get_domain(cur->ctx); const gchar *selector = rspamd_dkim_get_selector(cur->ctx); gsize tracelen; gchar *tracebuf; tracelen = strlen(domain) + strlen(selector) + 4; tracebuf = rspamd_mempool_alloc(task->task_pool, tracelen); rspamd_snprintf(tracebuf, tracelen, "%s:%s", domain, trace); rspamd_task_insert_result(cur->task, "DKIM_TRACE", 0.0, tracebuf); rspamd_snprintf(tracebuf, tracelen, "%s:s=%s", domain, selector); rspamd_task_insert_result(task, symbol, symbol_weight, tracebuf); } } rspamd_mempool_set_variable(task->task_pool, RSPAMD_MEMPOOL_DKIM_CHECK_RESULTS, pres, NULL); } } static void dkim_module_key_handler(rspamd_dkim_key_t *key, gsize keylen, rspamd_dkim_context_t *ctx, gpointer ud, GError *err) { struct dkim_check_result *res = ud; struct rspamd_task *task; struct dkim_ctx *dkim_module_ctx; task = res->task; dkim_module_ctx = dkim_get_context(task->cfg); if (key != NULL) { /* Another ref belongs to the check context */ res->key = rspamd_dkim_key_ref(key); /* * We actually receive key with refcount = 1, so we just assume that * lru hash owns this object now */ /* Release key when task is processed */ rspamd_mempool_add_destructor(res->task->task_pool, dkim_module_key_dtor, res->key); if (dkim_module_ctx->dkim_hash) { rspamd_lru_hash_insert(dkim_module_ctx->dkim_hash, g_strdup(rspamd_dkim_get_dns_key(ctx)), key, res->task->task_timestamp, rspamd_dkim_key_get_ttl(key)); msg_info_task("stored DKIM key for %s in LRU cache for %d seconds, " "%d/%d elements in the cache", rspamd_dkim_get_dns_key(ctx), rspamd_dkim_key_get_ttl(key), rspamd_lru_hash_size(dkim_module_ctx->dkim_hash), rspamd_lru_hash_capacity(dkim_module_ctx->dkim_hash)); } } else { /* Insert tempfail symbol */ msg_info_task("cannot get key for domain %s: %e", rspamd_dkim_get_dns_key(ctx), err); if (err != NULL) { if (err->code == DKIM_SIGERROR_NOKEY) { res->res = rspamd_dkim_create_result(ctx, DKIM_TRYAGAIN, task); res->res->fail_reason = "DNS error when getting key"; } else { res->res = rspamd_dkim_create_result(ctx, DKIM_PERM_ERROR, task); res->res->fail_reason = "invalid DKIM record"; } } } if (err) { g_error_free(err); } dkim_module_check(res); } static void dkim_symbol_callback(struct rspamd_task *task, struct rspamd_symcache_dynamic_item *item, void *unused) { rspamd_dkim_context_t *ctx; rspamd_dkim_key_t *key; GError *err = NULL; struct rspamd_mime_header *rh, *rh_cur; struct dkim_check_result *res = NULL, *cur; guint checked = 0; gdouble *dmarc_checks; struct dkim_ctx *dkim_module_ctx = dkim_get_context(task->cfg); /* Allow dmarc */ dmarc_checks = rspamd_mempool_get_variable(task->task_pool, RSPAMD_MEMPOOL_DMARC_CHECKS); if (dmarc_checks) { (*dmarc_checks)++; } else { dmarc_checks = rspamd_mempool_alloc(task->task_pool, sizeof(*dmarc_checks)); *dmarc_checks = 1; rspamd_mempool_set_variable(task->task_pool, RSPAMD_MEMPOOL_DMARC_CHECKS, dmarc_checks, NULL); } /* First check if plugin should be enabled */ if ((!dkim_module_ctx->check_authed && task->auth_user != NULL) || (!dkim_module_ctx->check_local && rspamd_ip_is_local_cfg(task->cfg, task->from_addr))) { msg_info_task("skip DKIM checks for local networks and authorized users"); rspamd_symcache_finalize_item(task, item); return; } /* Check whitelist */ if (rspamd_match_radix_map_addr(dkim_module_ctx->whitelist_ip, task->from_addr) != NULL) { msg_info_task("skip DKIM checks for whitelisted address"); rspamd_symcache_finalize_item(task, item); return; } rspamd_symcache_item_async_inc(task, item, M); /* Now check if a message has its signature */ rh = rspamd_message_get_header_array(task, RSPAMD_DKIM_SIGNHEADER, FALSE); if (rh) { msg_debug_task("dkim signature found"); DL_FOREACH(rh, rh_cur) { if (rh_cur->decoded == NULL || rh_cur->decoded[0] == '\0') { msg_info_task("cannot load empty DKIM signature"); continue; } cur = rspamd_mempool_alloc0(task->task_pool, sizeof(*cur)); cur->first = res; cur->res = NULL; cur->task = task; cur->mult_allow = 1.0; cur->mult_deny = 1.0; cur->item = item; ctx = rspamd_create_dkim_context(rh_cur->decoded, task->task_pool, task->resolver, dkim_module_ctx->time_jitter, RSPAMD_DKIM_NORMAL, &err); if (res == NULL) { res = cur; res->first = res; res->prev = res; } else { DL_APPEND(res, cur); } if (ctx == NULL) { if (err != NULL) { msg_info_task("cannot parse DKIM signature: %e", err); g_error_free(err); err = NULL; } else { msg_info_task("cannot parse DKIM signature: " "unknown error"); } continue; } else { /* Get key */ cur->ctx = ctx; const gchar *domain = rspamd_dkim_get_domain(cur->ctx); if (dkim_module_ctx->trusted_only && (dkim_module_ctx->dkim_domains == NULL || rspamd_match_hash_map(dkim_module_ctx->dkim_domains, domain, strlen(domain)) == NULL)) { msg_debug_task("skip dkim check for %s domain", rspamd_dkim_get_domain(ctx)); continue; } if (dkim_module_ctx->dkim_hash) { key = rspamd_lru_hash_lookup(dkim_module_ctx->dkim_hash, rspamd_dkim_get_dns_key(ctx), task->task_timestamp); } else { key = NULL; } if (key != NULL) { cur->key = rspamd_dkim_key_ref(key); /* Release key when task is processed */ rspamd_mempool_add_destructor(task->task_pool, dkim_module_key_dtor, cur->key); } else { if (!rspamd_get_dkim_key(ctx, task, dkim_module_key_handler, cur)) { continue; } } } checked++; if (checked > dkim_module_ctx->max_sigs) { msg_info_task("message has multiple signatures but we" " stopped after %d checked signatures as limit" " is reached", checked); break; } } } else { rspamd_task_insert_result(task, dkim_module_ctx->symbol_na, 1.0, NULL); } if (res != NULL) { dkim_module_check(res); } rspamd_symcache_item_async_dec_check(task, item, M); } struct rspamd_dkim_lua_verify_cbdata { rspamd_dkim_context_t *ctx; struct rspamd_task *task; lua_State *L; rspamd_dkim_key_t *key; gint cbref; }; static void dkim_module_lua_push_verify_result(struct rspamd_dkim_lua_verify_cbdata *cbd, struct rspamd_dkim_check_result *res, GError *err) { struct rspamd_task **ptask, *task; const gchar *error_str = "unknown error"; gboolean success = FALSE; task = cbd->task; switch (res->rcode) { case DKIM_CONTINUE: error_str = NULL; success = TRUE; break; case DKIM_REJECT: if (err) { error_str = err->message; } else { error_str = "reject"; } break; case DKIM_TRYAGAIN: if (err) { error_str = err->message; } else { error_str = "tempfail"; } break; case DKIM_NOTFOUND: if (err) { error_str = err->message; } else { error_str = "not found"; } break; case DKIM_RECORD_ERROR: if (err) { error_str = err->message; } else { error_str = "bad record"; } break; case DKIM_PERM_ERROR: if (err) { error_str = err->message; } else { error_str = "permanent error"; } break; default: break; } lua_rawgeti(cbd->L, LUA_REGISTRYINDEX, cbd->cbref); ptask = lua_newuserdata(cbd->L, sizeof(*ptask)); *ptask = task; lua_pushboolean(cbd->L, success); if (error_str) { lua_pushstring(cbd->L, error_str); } else { lua_pushnil(cbd->L); } if (cbd->ctx) { if (res->domain) { lua_pushstring(cbd->L, res->domain); } else { lua_pushnil(cbd->L); } if (res->selector) { lua_pushstring(cbd->L, res->selector); } else { lua_pushnil(cbd->L); } if (res->short_b) { lua_pushstring(cbd->L, res->short_b); } else { lua_pushnil(cbd->L); } if (res->fail_reason) { lua_pushstring(cbd->L, res->fail_reason); } else { lua_pushnil(cbd->L); } } else { lua_pushnil(cbd->L); lua_pushnil(cbd->L); lua_pushnil(cbd->L); lua_pushnil(cbd->L); } if (lua_pcall(cbd->L, 7, 0, 0) != 0) { msg_err_task("call to verify callback failed: %s", lua_tostring(cbd->L, -1)); lua_pop(cbd->L, 1); } luaL_unref(cbd->L, LUA_REGISTRYINDEX, cbd->cbref); } static void dkim_module_lua_on_key(rspamd_dkim_key_t *key, gsize keylen, rspamd_dkim_context_t *ctx, gpointer ud, GError *err) { struct rspamd_dkim_lua_verify_cbdata *cbd = ud; struct rspamd_task *task; struct rspamd_dkim_check_result *res; struct dkim_ctx *dkim_module_ctx; task = cbd->task; dkim_module_ctx = dkim_get_context(task->cfg); if (key != NULL) { /* Another ref belongs to the check context */ cbd->key = rspamd_dkim_key_ref(key); /* * We actually receive key with refcount = 1, so we just assume that * lru hash owns this object now */ if (dkim_module_ctx->dkim_hash) { rspamd_lru_hash_insert(dkim_module_ctx->dkim_hash, g_strdup(rspamd_dkim_get_dns_key(ctx)), key, cbd->task->task_timestamp, rspamd_dkim_key_get_ttl(key)); } /* Release key when task is processed */ rspamd_mempool_add_destructor(cbd->task->task_pool, dkim_module_key_dtor, cbd->key); } else { /* Insert tempfail symbol */ msg_info_task("cannot get key for domain %s: %e", rspamd_dkim_get_dns_key(ctx), err); if (err != NULL) { if (err->code == DKIM_SIGERROR_NOKEY) { res = rspamd_dkim_create_result(ctx, DKIM_TRYAGAIN, task); res->fail_reason = "DNS error when getting key"; } else { res = rspamd_dkim_create_result(ctx, DKIM_PERM_ERROR, task); res->fail_reason = "invalid DKIM record"; } } else { res = rspamd_dkim_create_result(ctx, DKIM_TRYAGAIN, task); res->fail_reason = "DNS error when getting key"; } dkim_module_lua_push_verify_result(cbd, res, err); if (err) { g_error_free(err); } return; } res = rspamd_dkim_check(cbd->ctx, cbd->key, cbd->task); dkim_module_lua_push_verify_result(cbd, res, NULL); } static gint lua_dkim_verify_handler(lua_State *L) { struct rspamd_task *task = lua_check_task(L, 1); const gchar *sig = luaL_checkstring(L, 2); rspamd_dkim_context_t *ctx; struct rspamd_dkim_lua_verify_cbdata *cbd; rspamd_dkim_key_t *key; struct rspamd_dkim_check_result *ret; GError *err = NULL; const gchar *type_str = NULL; enum rspamd_dkim_type type = RSPAMD_DKIM_NORMAL; struct dkim_ctx *dkim_module_ctx; if (task && sig && lua_isfunction(L, 3)) { if (lua_isstring(L, 4)) { type_str = lua_tostring(L, 4); if (type_str) { if (strcmp(type_str, "dkim") == 0) { type = RSPAMD_DKIM_NORMAL; } else if (strcmp(type_str, "arc-sign") == 0) { type = RSPAMD_DKIM_ARC_SIG; } else if (strcmp(type_str, "arc-seal") == 0) { type = RSPAMD_DKIM_ARC_SEAL; } else { lua_settop(L, 0); return luaL_error(L, "unknown sign type: %s", type_str); } } } dkim_module_ctx = dkim_get_context(task->cfg); ctx = rspamd_create_dkim_context(sig, task->task_pool, task->resolver, dkim_module_ctx->time_jitter, type, &err); if (ctx == NULL) { lua_pushboolean(L, false); if (err) { lua_pushstring(L, err->message); g_error_free(err); } else { lua_pushstring(L, "unknown error"); } return 2; } cbd = rspamd_mempool_alloc(task->task_pool, sizeof(*cbd)); cbd->L = L; cbd->task = task; lua_pushvalue(L, 3); cbd->cbref = luaL_ref(L, LUA_REGISTRYINDEX); cbd->ctx = ctx; cbd->key = NULL; if (dkim_module_ctx->dkim_hash) { key = rspamd_lru_hash_lookup(dkim_module_ctx->dkim_hash, rspamd_dkim_get_dns_key(ctx), task->task_timestamp); } else { key = NULL; } if (key != NULL) { cbd->key = rspamd_dkim_key_ref(key); /* Release key when task is processed */ rspamd_mempool_add_destructor(task->task_pool, dkim_module_key_dtor, cbd->key); ret = rspamd_dkim_check(cbd->ctx, cbd->key, cbd->task); dkim_module_lua_push_verify_result(cbd, ret, NULL); } else { rspamd_get_dkim_key(ctx, task, dkim_module_lua_on_key, cbd); } } else { return luaL_error(L, "invalid arguments"); } lua_pushboolean(L, TRUE); lua_pushnil(L); return 2; } static gint lua_dkim_canonicalize_handler(lua_State *L) { gsize nlen, vlen; const gchar *hname = luaL_checklstring(L, 1, &nlen), *hvalue = luaL_checklstring(L, 2, &vlen); static gchar st_buf[8192]; gchar *buf; guint inlen; gboolean allocated = FALSE; goffset r; if (hname && hvalue && nlen > 0) { inlen = nlen + vlen + sizeof(":" CRLF); if (inlen > sizeof(st_buf)) { buf = g_malloc(inlen); allocated = TRUE; } else { /* Faster */ buf = st_buf; } r = rspamd_dkim_canonize_header_relaxed_str(hname, hvalue, buf, inlen); if (r == -1) { lua_pushnil(L); } else { lua_pushlstring(L, buf, r); } if (allocated) { g_free(buf); } } else { return luaL_error(L, "invalid arguments"); } return 1; }