1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
|
--[[
Copyright (c) 2016, Andrew Lewis <nerf@judo.za.org>
Copyright (c) 2017, Vsevolod Stakhov <vsevolod@highsecure.ru>
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
]]--
local exports = {}
local E = {}
local rspamd_logger = require "rspamd_logger"
local rspamd_util = require "rspamd_util"
local function prepare_dkim_signing(N, task, settings)
local is_local, is_sign_networks
local auser = task:get_user()
local ip = task:get_from_ip()
if ip and ip:is_local() then
is_local = true
end
if settings.auth_only and auser then
rspamd_logger.debugm(N, task, 'user is authenticated')
elseif (settings.sign_networks and settings.sign_networks:get_key(ip)) then
is_sign_networks = true
rspamd_logger.debugm(N, task, 'mail is from address in sign_networks')
elseif settings.sign_local and is_local then
rspamd_logger.debugm(N, task, 'mail is from local address')
elseif settings.sign_inbound and not is_local and not auser then
rspamd_logger.debugm(N, task, 'mail was sent to us')
else
rspamd_logger.debugm(N, task, 'ignoring unauthenticated mail')
return false,{}
end
local efrom = task:get_from('smtp')
if not settings.allow_envfrom_empty and
#(((efrom or E)[1] or E).addr or '') == 0 then
rspamd_logger.debugm(N, task, 'empty envelope from not allowed')
return false,{}
end
local hfrom = task:get_from('mime')
if not settings.allow_hdrfrom_multiple and (hfrom or E)[2] then
rspamd_logger.debugm(N, task, 'multiple header from not allowed')
return false,{}
end
local eto = task:get_recipients(0)
local dkim_domain
local hdom = ((hfrom or E)[1] or E).domain
local edom = ((efrom or E)[1] or E).domain
local tdom = ((eto or E)[1] or E).domain
local udom = string.match(auser or '', '.*@(.*)')
local function get_dkim_domain(dtype)
if settings[dtype] == 'header' then
return hdom
elseif settings[dtype] == 'envelope' then
return edom
elseif settings[dtype] == 'auth' then
return udom
elseif settings[dtype] == 'recipient' then
return tdom
end
end
if hdom then
hdom = hdom:lower()
end
if edom then
edom = edom:lower()
end
if udom then
udom = udom:lower()
end
if tdom then
tdom = tdom:lower()
end
if settings.use_domain_sign_networks and is_sign_networks then
dkim_domain = get_dkim_domain('use_domain_sign_networks')
rspamd_logger.debugm(N, task, 'sign_networks: use domain(%s) for signature: %s',
settings.use_domain_sign_networks, dkim_domain)
elseif settings.use_domain_local and is_local then
dkim_domain = get_dkim_domain('use_domain_local')
rspamd_logger.debugm(N, task, 'local: use domain(%s) for signature: %s',
settings.use_domain_local, dkim_domain)
else
dkim_domain = get_dkim_domain('use_domain')
rspamd_logger.debugm(N, task, 'use domain(%s) for signature: %s',
settings.use_domain, dkim_domain)
end
if not dkim_domain then
rspamd_logger.debugm(N, task, 'could not extract dkim domain')
return false,{}
end
if settings.use_esld then
dkim_domain = rspamd_util.get_tld(dkim_domain)
if hdom then
hdom = rspamd_util.get_tld(hdom)
end
if edom then
edom = rspamd_util.get_tld(edom)
end
end
rspamd_logger.debugm(N, task, 'final DKIM domain: %s', dkim_domain)
if edom and hdom and not settings.allow_hdrfrom_mismatch and hdom ~= edom then
if settings.allow_hdrfrom_mismatch_local and is_local then
rspamd_logger.debugm(N, task, 'domain mismatch allowed for local IP: %1 != %2', hdom, edom)
elseif settings.allow_hdrfrom_mismatch_sign_networks and is_sign_networks then
rspamd_logger.debugm(N, task, 'domain mismatch allowed for sign_networks: %1 != %2', hdom, edom)
else
rspamd_logger.debugm(N, task, 'domain mismatch not allowed: %1 != %2', hdom, edom)
return false,{}
end
end
if auser and not settings.allow_username_mismatch then
if not udom then
rspamd_logger.debugm(N, task, 'couldnt find domain in username')
return false,{}
end
if settings.use_esld then
udom = rspamd_util.get_tld(udom)
end
if udom ~= dkim_domain then
rspamd_logger.debugm(N, task, 'user domain mismatch')
return false,{}
end
end
local p = {}
if settings.domain[dkim_domain] then
p.selector = settings.domain[dkim_domain].selector
p.key = settings.domain[dkim_domain].path
end
if not p.key and p.selector then
local key_var = "dkim_key"
local selector_var = "dkim_selector"
if N == "arc" then
key_var = "arc_key"
selector_var = "arc_selector"
end
p.key = task:get_mempool():get_variable(key_var)
p.selector = task:get_mempool():get_variable(selector_var)
if (not p.key or not p.selector) and (not (settings.try_fallback or
settings.use_redis or settings.selector_map
or settings.path_map)) then
rspamd_logger.debugm(N, task, 'dkim unconfigured and fallback disabled')
return false,{}
end
end
if not p.selector and settings.selector_map then
local data = settings.selector_map:get_key(dkim_domain)
if data then
p.selector = data
elseif not settings.try_fallback then
rspamd_logger.debugm(N, task, 'no selector for %s', dkim_domain)
return false,{}
end
end
if not p.key and settings.path_map then
local data = settings.path_map:get_key(dkim_domain)
if data then
p.key = data
elseif not settings.try_fallback then
rspamd_logger.debugm(N, task, 'no key for %s', dkim_domain)
return false,{}
end
end
if not p.key then
if not settings.use_redis then
p.key = settings.path
end
end
if not p.selector then
p.selector = settings.selector
end
p.domain = dkim_domain
return true,p
end
exports.prepare_dkim_signing = prepare_dkim_signing
return exports
|
