aboutsummaryrefslogtreecommitdiffstats
path: root/src/plugins/lua/dmarc.lua
blob: d162b11640650306a0b8108d20a5f1b955369ee0 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
--[[
Copyright (c) 2011-2016, Vsevolod Stakhov <vsevolod@highsecure.ru>
Copyright (c) 2015-2016, Andrew Lewis <nerf@judo.za.org>

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
]]--

-- Dmarc policy filter

local rspamd_regexp = require "rspamd_regexp"
local rspamd_logger = require "rspamd_logger"
local rspamd_redis = require "rspamd_redis"
local upstream_list = require "rspamd_upstream_list"
local rspamd_util = require "rspamd_util"

local symbols = {
  spf_allow_symbol = 'R_SPF_ALLOW',
  spf_deny_symbol = 'R_SPF_FAIL',
  spf_softfail_symbol = 'R_SPF_SOFTFAIL',
  spf_neutral_symbol = 'R_SPF_NEUTRAL',

  dkim_allow_symbol = 'R_DKIM_ALLOW',
  dkim_deny_symbol = 'R_DKIM_REJECT',
}
-- Default port for redis upstreams
local redis_params = nil
local dmarc_redis_key_prefix = "dmarc_"
local dmarc_domain = nil
local elts_re = rspamd_regexp.create_cached("\\\\{0,1};\\s+")
local dmarc_reporting = false

local function dmarc_report(task, spf_ok, dkim_ok, disposition)
  local ip = task:get_from_ip()
  if not ip:is_valid() then
    return nil
  end
  local res = string.format('%d,%s,%s,%s,%s', task:get_date(0),
    ip:to_string(), tostring(spf_ok), tostring(dkim_ok),
    disposition)

  return res
end

local function dmarc_callback(task)
  local from = task:get_from(2)
  local dmarc_domain

  if from and from[1] and from[1]['domain'] and not from[2] then
    dmarc_domain = rspamd_util.get_tld(from[1]['domain'])
  else
    return
  end

  local function dmarc_report_cb(task, err, data)
    if not err then
      rspamd_logger.infox(task, '<%1> dmarc report saved for %2',
        task:get_message_id(), from[1]['domain'])
    else
      rspamd_logger.errx(task, '<%1> dmarc report is not saved for %2: %3',
        task:get_message_id(), from[1]['domain'], err)
    end
  end

  local function dmarc_dns_cb(resolver, to_resolve, results, err, key)

    local lookup_domain = string.sub(to_resolve, 8)
    if not results then
      if lookup_domain ~= dmarc_domain then
        local resolve_name = '_dmarc.' .. dmarc_domain
        task:get_resolver():resolve_txt({
          task=task,
          name = resolve_name,
          callback = dmarc_dns_cb,
          forced = true})
        return
      end

      return
    end

    local strict_spf = false
    local strict_dkim = false
    local strict_policy = false
    local quarantine_policy = false
    local found_policy = false
    local failed_policy = false
    local rua

    for _,r in ipairs(results) do
      if failed_policy then break end
      (function()
        if not string.match(r, '^v=DMARC1[;\\][; ]') then
          return
        else
          if found_policy then
            failed_policy = true
            return
          else
            found_policy = true
          end
        end
        local elts = elts_re:split(r)

        if elts then
          for _,e in ipairs(elts) do
            dkim_pol = string.match(e, '^adkim=(.)$')
            if dkim_pol then
              if dkim_pol == 's' then
                strict_dkim = true
              elseif dkim_pol ~= 'r' then
                failed_policy = true
                return
              end
            end
            spf_pol = string.match(e, '^aspf=(.)$')
            if spf_pol then
              if spf_pol == 's' then
                strict_spf = true
              elseif spf_pol ~= 'r' then
                failed_policy = true
                return
              end
            end
            policy = string.match(e, '^p=(.+)$')
            if policy then
              if (policy == 'reject') then
                strict_policy = true
              elseif (policy == 'quarantine') then
                strict_policy = true
                quarantine_policy = true
              elseif (policy ~= 'none') then
                failed_policy = true
                return
              end
            end
            subdomain_policy = string.match(e, '^sp=(.+)$')
            if subdomain_policy and lookup_domain == dmarc_domain then
              if (subdomain_policy == 'reject') then
                if dmarc_domain ~= from[1]['domain'] then
                  strict_policy = true
                end
              elseif (subdomain_policy == 'quarantine') then
                if dmarc_domain ~= from[1]['domain'] then
                  strict_policy = true
                  quarantine_policy = true
                end
              elseif (subdomain_policy == 'none') then
                if dmarc_domain ~= from[1]['domain'] then
                  strict_policy = false
                  quarantine_policy = false
                end
              else
                failed_policy = true
                return
              end
            end
            pct = string.match(e, '^pct=(%d+)$')
            if pct then
              pct = tonumber(pct)
            end

            if not rua then
              rua = string.match(e, '^rua=([^%s]+)$')
            end
          end
        end
      end)()
    end

    if not found_policy then
      if lookup_domain ~= dmarc_domain then
        local resolve_name = '_dmarc.' .. dmarc_domain
        task:get_resolver():resolve_txt({
          task=task,
          name = resolve_name,
          callback = dmarc_dns_cb,
          forced = true})

        return
      else
        return
      end
    end

    if failed_policy then return end

    -- Check dkim and spf symbols
    local spf_ok = false
    local dkim_ok = false
    if task:has_symbol(symbols['spf_allow_symbol']) then
      efrom = task:get_from(1)
      if efrom and efrom[1] and efrom[1]['domain'] then
        if rspamd_util.strequal_caseless(efrom[1]['domain'], from[1]['domain']) then
          spf_ok = true
        elseif not strict_spf then
          if rspamd_util.strequal_caseless(
              string.sub(efrom[1]['domain'], -string.len('.' .. lookup_domain)),
              '.' .. lookup_domain) then
            spf_ok = true
          end
        end
      end
    end
    local das = task:get_symbol(symbols['dkim_allow_symbol'])
    if das and das[1] and das[1]['options'] then
      for i,dkim_domain in ipairs(das[1]['options']) do
        if rspamd_util.strequal_caseless(from[1]['domain'], dkim_domain) then
          dkim_ok = true
        elseif not strict_dkim then
          if rspamd_util.strequal_caseless(
              string.sub(dkim_domain, -string.len('.' .. lookup_domain)),
              '.' .. lookup_domain) then
            dkim_ok = true
          end
        end
      end
    end

    disposition = "none"
    local res = 0.5
    if not (spf_ok or dkim_ok) then
      res = 1.0
      if quarantine_policy then
        if not pct or pct == 100 or (math.random(100) <= pct) then
          task:insert_result('DMARC_POLICY_QUARANTINE', res, lookup_domain)
          disposition = "quarantine"
        end
      elseif strict_policy then
        if not pct or pct == 100 or (math.random(100) <= pct) then
          task:insert_result('DMARC_POLICY_REJECT', res, lookup_domain)
          disposition = "reject"
        end
      else
        task:insert_result('DMARC_POLICY_SOFTFAIL', res, lookup_domain)
      end
    else
      task:insert_result('DMARC_POLICY_ALLOW', res, lookup_domain)
    end

    if rua and redis_params and dmarc_reporting then
      -- Prepare and send redis report element
      local redis_key = dmarc_redis_key_prefix .. from[1]['domain']
      local report_data = dmarc_report(task, spf_ok, dkim_ok, disposition)

      if report_data then
        rspamd_redis_make_request(task,
          redis_params, -- connect params
          from[1]['domain'], -- hash key
          true, -- is write
          dmarc_report_cb, --callback
          'LPUSH', -- command
          {redis_key, report_data} -- arguments
        )
      end
    end

    -- XXX: handle rua and push data to redis
  end

  -- Do initial request
  local resolve_name = '_dmarc.' .. from[1]['domain']
  task:get_resolver():resolve_txt({
    task=task,
    name = resolve_name,
    callback = dmarc_dns_cb,
    forced = true})
end

local opts = rspamd_config:get_all_opt('dmarc')
if not opts or type(opts) ~= 'table' then
  return
end

if opts['reporting'] == true then
  dmarc_reporting = true
end

redis_params = rspamd_parse_redis_server('dmarc')
if not redis_params then
  rspamd_logger.infox(rspamd_config, 'cannot parse servers parameter')
end

if opts['key_prefix'] then
  dmarc_redis_key_prefix = opts['key_prefix']
end

-- Check spf and dkim sections for changed symbols
local function check_mopt(var, opts, name)
  if opts[name] then
    symbols['var'] = tostring(opts[name])
  end
end

local spf_opts = rspamd_config:get_all_opt('spf')
if spf_opts then
  check_mopt('spf_deny_symbol', spf_opts, 'symbol_fail')
  check_mopt('spf_allow_symbol', spf_opts, 'symbol_allow')
  check_mopt('spf_softfail_symbol', spf_opts, 'symbol_softfail')
  check_mopt('spf_neutral_symbol', spf_opts, 'symbol_neutral')
end

local dkim_opts = rspamd_config:get_all_opt('dkim')
if dkim_opts then
  check_mopt('dkim_deny_symbol', 'symbol_reject')
  check_mopt('dkim_allow_symbol', 'symbol_allow')
end

local id = rspamd_config:register_symbol({
  name = 'DMARC_CALLBACK',
  type = 'callback',
  callback = dmarc_callback
})
rspamd_config:register_symbol({
  name = 'DMARC_POLICY_ALLOW',
  flags = 'nice',
  parent = id,
  type = 'virtual'
})
rspamd_config:register_symbol({
  name = 'DMARC_POLICY_REJECT',
  parent = id,
  type = 'virtual'
})
rspamd_config:register_symbol({
  name = 'DMARC_POLICY_QUARANTINE',
  parent = id,
  type = 'virtual'
})
rspamd_config:register_symbol({
  name = 'DMARC_POLICY_SOFTFAIL',
  parent = id,
  type = 'virtual'
})

rspamd_config:register_dependency(id, symbols['spf_allow_symbol'])
rspamd_config:register_dependency(id, symbols['dkim_allow_symbol'])