mta_sts 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a086ee4ab9118b9e83ca143ba5c353410b2ff8700e5e322211678b7dfa9bbe4
-  data.tar.gz: ea8ff974a581d31003e7a535d896c76d8c440842ea07114f9481778d2116a3c1
+  metadata.gz: 9b46a83fc4dd32476a29b8c197095b65617a18a5936e90b6121767376154ee2d
+  data.tar.gz: e20185095d16cccb6f717760f82e49e6a01963268ff34312bcf21e4d48316d99
 SHA512:
-  metadata.gz: 0a0eae0d2cdc73838df1045457af6a3c27f7110aef3aed1375d78a1a05744a22df90438f95bc9c9de8be2a96a4e16a28409ca52bcb949ade8e04a2c799a3463e
-  data.tar.gz: 0de333d23526642595a595745048b94c9b525c8f89e19ad76b1fba4a00a07ddc435533c60d766088f882e9505f8962325abe4db36bef24dd78e5900924bed8bc
+  metadata.gz: 4d61ee904a79ac3e44dbb052f033cef8288b9417be6fc9fda21991c1591ef3f426284333ca6d44fed8226256c54f32e426890075bd89ead162af514c664583a6
+  data.tar.gz: e4912ee834c01be36fdae2fbada466899192dc3c42e97898c928d4a1c69a006de38bc311fce178c18a049061371c660be8938164c957c903c82cd6ba6c066e9e

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.2.0
+
+- The fetcher resolves the policy host and judges the address before dialling it
+
 ## 0.1.1
 
 Documentation

data/README.md

@@ -179,9 +179,21 @@ MtaSts.lookup("example.com", known: nil,
   fetcher:  MyPolicyFetcher.new)    # the HTTPS GET
 ```
 
-- **resolver** - needs one method, `txt`, over `dnsruby` by default. Covers discovery only (`_mta-sts` and `_smtp._tls`). Raise `NotFound` for no such record, `Timeout` or `ServerFailure` for no answer. The policy host itself is resolved by the HTTP stack inside the fetcher.
+- **resolver** - needs one method, `txt`, over `dnsruby` by default. Covers discovery only (`_mta-sts` and `_smtp._tls`). Raise `NotFound` for no such record, `Timeout` or `ServerFailure` for no answer.
 - **fetcher** - one `GET`, over stdlib `Net::HTTP` by default, certificate verification on. Body size and a total wall-clock budget are capped so a hostile host cannot hold the thread forever.
 
+The fetcher resolves the policy host itself, so that the address it dials is one it has judged:
+
+```ruby
+MtaSts::Fetcher.new(
+  resolver:  MyResolver.new,                       # needs `addresses` as well as `txt`
+  permitted: ->(address) { my_own_opinion(address) })
+```
+
+- **permitted** - asked about each resolved address; the first one admitted is dialled. Defaults to `MtaSts::Fetcher.public_address?`, which admits public unicast and refuses private, loopback, link-local, and other special-use addresses, including ones wrapped or reached through NAT64. A deployment serving policies from inside its own network passes something more permissive.
+
+The recipient domain names the policy host, so where it resolves is chosen by whoever is being sent mail — without this, that's a request to an address of a stranger's choosing.
+
 ### Publishing a Policy
 
 ```ruby

data/lib/mta_sts/fetcher.rb

@@ -1,6 +1,8 @@
+require "ipaddr"
 require "net/http"
 require "openssl"
 require "zlib"
+require "mta_sts/resolver"
 require "mta_sts/version"
 
 module MtaSts
@@ -9,6 +11,8 @@ module MtaSts
     class Error < StandardError; end
     class HttpError < Error; end
     class CertificateError < Error; end
+    # A temperror like any other failed fetch, so a policy already held stands.
+    class BlockedAddress < Error; end
     class Timeout < Error; end
 
     WELL_KNOWN_PATH = "/.well-known/mta-sts.txt"
@@ -34,12 +38,75 @@ module MtaSts
       end
     end
 
+    # Special-use IPv4 no policy is published in. RFC 1918, loopback and
+    # link-local are left to the IPAddr predicates.
+    RESERVED_V4 = %w[
+      0.0.0.0/8 100.64.0.0/10 192.0.0.0/24 192.0.2.0/24 192.88.99.0/24
+      198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4
+    ].map { |range| IPAddr.new(range) }.freeze
+
+    RESERVED_V6 = %w[
+      ::/128 64:ff9b:1::/48 100::/64 2001::/32 2001:2::/48 2001:db8::/32
+      2002::/16 fec0::/10 ff00::/8
+    ].map { |range| IPAddr.new(range) }.freeze
+
+    # RFC 6052 §2.2 with a /96 prefix
+    NAT64 = IPAddr.new("64:ff9b::/96")
+
+    class << self
+      # The policy host is named by the domain being delivered to, so where it
+      # resolves is a stranger's to choose.
+      def public_address?(address)
+        ip = address.is_a?(IPAddr) ? address : IPAddr.new(address.to_s)
+
+        case
+        # No resolver legitimately answers with an address wrapped in another,
+        # whatever it wraps.
+        when ip.ipv4_mapped? || ipv4_compat?(ip) then false
+        when ip.ipv4?                           then public_v4?(ip)
+        when NAT64.include?(ip)                 then public_v4?(embedded_v4(ip))
+        else                                         public_v6?(ip)
+        end
+      rescue IPAddr::Error
+        false
+      end
+
+      private
+        def public_v4?(ip)
+          !(ip.private? || ip.loopback? || ip.link_local? || covered_by?(RESERVED_V4, ip))
+        end
+
+        def public_v6?(ip)
+          !(ip.private? || ip.loopback? || ip.link_local? || covered_by?(RESERVED_V6, ip))
+        end
+
+        def embedded_v4(ip)
+          IPAddr.new(ip.to_i & 0xffffffff, Socket::AF_INET)
+        end
+
+        def covered_by?(ranges, ip)
+          ranges.any? { |range| range.include?(ip) }
+        end
+
+        # IPAddr#ipv4_compat? is obsolete; reimplemented since the check itself
+        # (the deprecated ::a.b.c.d form) is still one we need to catch.
+        def ipv4_compat?(ip)
+          return false unless ip.ipv6?
+
+          low = ip.to_i & 0xffffffff
+          (ip.to_i >> 32).zero? && low != 0 && low != 1
+        end
+    end
+
     def initialize(open_timeout: OPEN_TIMEOUT, read_timeout: READ_TIMEOUT,
-                   total_timeout: TOTAL_TIMEOUT, max_body_bytes: MAX_BODY_BYTES)
+                   total_timeout: TOTAL_TIMEOUT, max_body_bytes: MAX_BODY_BYTES,
+                   resolver: Resolver.new, permitted: Fetcher.method(:public_address?))
       @open_timeout = open_timeout
       @read_timeout = read_timeout
       @total_timeout = total_timeout
       @max_body_bytes = max_body_bytes
+      @resolver = resolver
+      @permitted = permitted
     end
 
     def fetch(host)
@@ -53,8 +120,9 @@ module MtaSts
 
       def get(host)
         deadline = monotonic_now + @total_timeout
+        address = permitted_address(host)
 
-        with_response(host) do |response|
+        with_response(host, address) do |response|
           if response.is_a?(Net::HTTPOK)
             body_from(response, host, deadline)
           else
@@ -64,10 +132,26 @@ module MtaSts
         end
       end
 
-      def with_response(host)
+      # Resolved once here and carried into the connection: resolving again to
+      # dial would leave the second answer free to differ from the one judged.
+      def permitted_address(host)
+        resolve(host).find { |address| @permitted.call(address) } or
+          raise BlockedAddress, "#{host} resolves to no address a policy may be published at"
+      end
+
+      def resolve(host)
+        addresses = @resolver.addresses(host)
+        raise Error, "couldn't resolve #{host}" if addresses.empty?
+
+        addresses
+      rescue Resolver::Error => error
+        raise Error, "couldn't resolve #{host}: #{error.message}"
+      end
+
+      def with_response(host, address)
         result = nil
 
-        connection(host).start do |http|
+        connection(host, address).start do |http|
           http.request(policy_request) { |response| result = yield response }
         end
 
@@ -82,8 +166,11 @@ module MtaSts
         raise Error, "couldn't reach #{host}: #{error.message}"
       end
 
-      def connection(host)
+      def connection(host, address)
         Net::HTTP.new(host, PORT).tap do |http|
+          # Dial the address already judged; the name stays behind for SNI, the
+          # Host header, and the certificate the whole fetch rests on.
+          http.ipaddr = address
           http.use_ssl = true
           http.verify_mode = OpenSSL::SSL::VERIFY_PEER
           http.verify_hostname = true

data/lib/mta_sts/resolver.rb

@@ -14,25 +14,37 @@ module MtaSts
     end
 
     def txt(name)
-      records(name).map { |record| record.strings.join }
+      records(name, "TXT").map { |record| record.strings.join }
+    end
+
+    def addresses(name)
+      %w[ A AAAA ].flat_map { |type| family(name, type) }
     end
 
     private
-      def records(name)
-        answer = resolver.query(name.to_s, "TXT").answer.grep(Dnsruby::RR::IN::TXT)
+      def family(name, type)
+        records(name, type).map { |record| record.address.to_s.downcase }
+      rescue NotFound
+        []
+      end
+
+      # Filter by type: a CNAME answer carries the alias beside the records it
+      # leads to.
+      def records(name, type)
+        answer = resolver.query(name.to_s, type).answer.select { |record| record.type == type }
 
         if answer.any?
           answer
         else
-          raise NotFound, "no TXT records for #{name}"
+          raise NotFound, "no #{type} records for #{name}"
         end
       rescue Dnsruby::NXDomain
         raise NotFound, "no such name #{name}"
       rescue Dnsruby::ResolvTimeout
-        raise Timeout, "timed out resolving TXT #{name}"
+        raise Timeout, "timed out resolving #{type} #{name}"
       # Fall through to ServerFailure, never NotFound — "couldn't ask" must not become "no policy"
       rescue Dnsruby::ResolvError, IOError, SocketError, SystemCallError => error
-        raise ServerFailure, "couldn't resolve TXT #{name}: #{reason(error)}"
+        raise ServerFailure, "couldn't resolve #{type} #{name}: #{reason(error)}"
       end
 
       def reason(error)

data/lib/mta_sts/version.rb

@@ -1,3 +1,3 @@
 module MtaSts
-  VERSION = "0.1.1"
+  VERSION = "0.2.0"
 end

data/mta_sts.gemspec

@@ -9,7 +9,7 @@ Gem::Specification.new do |spec|
   spec.authors = [ "Simon Lev" ]
 
   spec.summary = "SMTP MTA Strict Transport Security for Ruby."
-  spec.description = "Answers one question before delivering a message: must this connection be encrypted, and to which servers?"
+  spec.description = "Answers one question before delivering a message: must this connection be encrypted, and to which servers? Implements MTA-STS policy discovery and TLSRPT record discovery."
 
   spec.homepage = "https://github.com/mailpiece/mta_sts"
   spec.license = "MIT"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mta_sts
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Simon Lev
@@ -38,7 +38,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0.2'
 description: 'Answers one question before delivering a message: must this connection
-  be encrypted, and to which servers?'
+  be encrypted, and to which servers? Implements MTA-STS policy discovery and TLSRPT
+  record discovery.'
 executables:
 - mta-sts
 extensions: []