Haraka 2.8.28 → 3.0.0

package/spf.js

@@ -1,689 +0,0 @@
-'use strict';
-// spf
-
-const dns = require('dns');
-const ipaddr = require('ipaddr.js');
-const net_utils = require('haraka-net-utils')
-
-class SPF {
-    constructor (count, been_there) {
-        // For macro expansion
-        // This should be set before check_host() is called
-        this.helo = 'unknown';
-        this.spf_record = '';
-
-        // RFC 4408 Section 10.1
-        // Limit the number of mechanisms/modifiers that require DNS lookups to complete.
-        this.count = 0;
-
-        // If we have recursed we are supplied the count
-        if (count) this.count = count;
-
-        // Prevent circular references, this isn't covered in the RFC
-        this.been_there = {};
-        if (been_there) this.been_there = been_there;
-
-        // RFC 4408 Section 10.1
-        this.LIMIT = 10;
-
-        // Constants
-        this.SPF_NONE = 1;
-        this.SPF_PASS = 2;
-        this.SPF_FAIL = 3;
-        this.SPF_SOFTFAIL = 4;
-        this.SPF_NEUTRAL = 5;
-        this.SPF_TEMPERROR = 6;
-        this.SPF_PERMERROR = 7;
-
-        this.mech_ip4 = this.mech_ip;
-        this.mech_ip6 = this.mech_ip;
-    }
-
-    const_translate (value) {
-        const t = {};
-        for (const k in this) {
-            if (typeof this[k] === 'number') {
-                t[this[k]] = k.toUpperCase();
-            }
-        }
-        if (t[value]) return t[value];
-        return 'UNKNOWN';
-    }
-
-    result (value) {
-        switch (value) {
-            case this.SPF_NONE:      return 'None';
-            case this.SPF_PASS:      return 'Pass';
-            case this.SPF_FAIL:      return 'Fail';
-            case this.SPF_SOFTFAIL:  return 'SoftFail';
-            case this.SPF_NEUTRAL:   return 'Neutral';
-            case this.SPF_TEMPERROR: return 'TempError';
-            case this.SPF_PERMERROR: return 'PermError';
-            default:                 return `Unknown (${value})`;
-        }
-    }
-
-    return_const (qualifier) {
-        switch (qualifier) {
-            case '+':   return this.SPF_PASS;
-            case '-':   return this.SPF_FAIL;
-            case '~':   return this.SPF_SOFTFAIL;
-            case '?':   return this.SPF_NEUTRAL;
-            default:    return this.SPF_PERMERROR;
-        }
-    }
-
-    expand_macros (str) {
-        const macro = /%{([slodipvh])((?:(?:\d+)?r?)?)?([-.+,/_=])?}/ig;
-        let match;
-        while ((match = macro.exec(str))) {
-            // match[1] = macro-letter
-            // match[2] = transformers
-            // match[3] = delimiter
-            if (!match[3]) match[3] = '.';
-            let strip = /(\d+)/.exec(match[2]);
-            if (strip) strip = strip[1];
-
-            const reverse = (((`${match[2]}`).indexOf('r')) !== -1);
-            let replace;
-            let kind;
-            switch (match[1]) {
-                case 's':   // sender
-                    replace = this.mail_from;
-                    break;
-                case 'l':   // local-part of sender
-                    replace = (this.mail_from.split('@'))[0];
-                    break;
-                case 'o':   // domain of sender
-                    replace = (this.mail_from.split('@'))[1];
-                    break;
-                case 'd':   // domain
-                    replace = this.domain;
-                    break;
-                case 'i':   // IP
-                    replace = this.ip;
-                    break;
-                case 'p':   // validated domain name of IP
-                    // NOT IMPLEMENTED
-                    replace = 'unknown';
-                    break;
-                case 'v':   // IP version
-                    try {
-                        if (this.ip_ver === 'ipv4') kind = 'in-addr';
-                        if (this.ip_ver === 'ipv6') kind = 'ip6';
-                        replace = kind;
-                    }
-                    catch (e) {}
-                    break;
-                case 'h':   // EHLO/HELO domain
-                    replace = this.helo;
-                    break;
-            }
-            // Process any transformers
-            if (replace) {
-                if (reverse || strip) {
-                    replace = replace.split(match[3]);
-                    if (strip) {
-                        strip = ((strip > replace.length) ? replace.length : strip);
-                        replace = replace.slice(0,strip);
-                    }
-                    if (reverse) replace = replace.reverse();
-                    replace = replace.join('.');
-                }
-                str = str.replace(match[0], replace);
-            }
-        }
-        // Process any other expansions
-        str = str.replace(/%%/g, '%');
-        str = str.replace(/%_/g, ' ');
-        str = str.replace(/%-/g, '%20');
-        return str;
-    }
-
-    log_debug (str) {
-        console.error(str);
-    }
-
-    valid_ip (ip) {
-        const ip_split = /^:([^/ ]+)(?:\/([^ ]+))?$/.exec(ip);
-        if (!ip_split) {
-            this.log_debug(`invalid IP address: ${ip}`);
-            return false;
-        }
-        if (!ipaddr.isValid(ip_split[1])) {
-            this.log_debug(`invalid IP address: ${ip_split[1]}`);
-            return false;
-        }
-        return true;
-    }
-
-    check_host (ip, domain, mail_from, cb) {
-        const self = this;
-        domain = domain.toLowerCase();
-        if (mail_from) {
-            mail_from = mail_from.toLowerCase();
-        }
-        else {
-            mail_from = `postmaster@${domain}`;
-        }
-        this.ipaddr = ipaddr.parse(ip);
-        this.ip_ver = this.ipaddr.kind();
-        if (this.ip_ver === 'ipv6') {
-            this.ip = this.ipaddr.toString();
-        }
-        else {
-            this.ip = ip;
-        }
-        this.domain = domain;
-        this.mail_from = mail_from;
-
-        this.log_debug(`ip=${ip} domain=${domain} mail_from=${mail_from}`);
-
-        // Get the SPF record for domain
-        dns.resolveTxt(domain, (err, txt_rrs) => {
-            if (err) {
-                self.log_debug(`error looking up TXT record: ${err.message}`);
-                switch (err.code) {
-                    case dns.NOTFOUND:
-                    case dns.NODATA:
-                    case dns.NXDOMAIN:  return cb(null, self.SPF_NONE);
-                    default:            return cb(null, self.SPF_TEMPERROR);
-                }
-            }
-
-            let spf_record;
-            let match;
-            for (let txt_rr of txt_rrs) {
-                // Node 0.11.x compatibility
-                if (Array.isArray(txt_rr)) txt_rr = txt_rr.join('');
-
-                match = /^(v=spf1(?:$|\s.+$))/i.exec(txt_rr);
-                if (!match) {
-                    self.log_debug(`discarding TXT record: ${txt_rr}`);
-                    continue;
-                }
-
-                if (!spf_record) {
-                    self.log_debug(`found SPF record for domain ${domain}: ${match[1]}`);
-                    spf_record = match[1].replace(/\s+/, ' ').toLowerCase();
-                }
-                else {
-                    // already found an MX record
-                    self.log_debug(`found additional SPF record for domain ${domain}: ${match[1]}`);
-                    return cb(null, self.SPF_PERMERROR);
-                }
-            }
-
-            if (!spf_record) return cb(null, self.SPF_NONE);   // No SPF record?
-
-            // Store the SPF record used in the object
-            self.spf_record = spf_record;
-
-            // Validate SPF record and build call chain
-            const mech_array = [];
-            const mod_array = [];
-            const mech_regexp1 = /^([-+~?])?(all|a|mx|ptr)$/;
-            const mech_regexp2 = /^([-+~?])?(a|mx|ptr|ip4|ip6|include|exists)((?::[^/ ]+(?:\/\d+(?:\/\/\d+)?)?)|\/\d+(?:\/\/\d+)?)$/;
-            const mod_regexp = /^([^ =]+)=([a-z0-9:/._-]+)$/;
-            const split = spf_record.split(' ');
-            for (let i=1; i<split.length; i++) {
-                // Skip blanks
-                let obj;
-                if (!split[i]) continue;
-                if ((match = (mech_regexp1.exec(split[i]) || mech_regexp2.exec(split[i])))) {
-                    // match[1] = qualifier
-                    // match[2] = mechanism
-                    // match[3] = optional args
-                    if (!match[1]) match[1] = '+';
-                    self.log_debug(`found mechanism: ${match}`);
-
-                    if (match[2] === 'ip4' || match[2] === 'ip6') {
-                        if (!this.valid_ip(match[3])) return cb(null, self.SPF_PERMERROR);
-                    }
-                    else {
-                        // Validate macro strings
-                        if (match[3] && /%[^{%+-]/.exec(match[3])) {
-                            self.log_debug('invalid macro string');
-                            return cb(null, self.SPF_PERMERROR);
-                        }
-                        if (match[3]) {
-                            // Expand macros
-                            match[3] = self.expand_macros(match[3]);
-                        }
-                    }
-
-                    obj = {};
-                    obj[match[2]] = [ match[1], match[3] ];
-                    mech_array.push(obj);
-                }
-                else if ((match = mod_regexp.exec(split[i]))) {
-                    self.log_debug(`found modifier: ${match}`);
-                    // match[1] = modifier
-                    // match[2] = name
-                    // Make sure we have a method
-                    if (!self[`mod_${match[1]}`]) {
-                        self.log_debug(`skipping unknown modifier: ${match[1]}`);
-                    }
-                    else {
-                        obj = {};
-                        obj[match[1]] = match[2];
-                        mod_array.push(obj);
-                    }
-                }
-                else {
-                    // Syntax error
-                    self.log_debug(`syntax error: ${split[i]}`);
-                    return cb(null, self.SPF_PERMERROR);
-                }
-            }
-
-            self.log_debug(`SPF record for '${self.domain}' validated OK`);
-
-            // Set-up modifier run chain
-            function mod_chain_caller (err2, result) {
-                // Throw any errors
-                if (err2) throw err2;
-                // Check limits
-                if (self.count > self.LIMIT) {
-                    self.log_debug('lookup limit reached');
-                    return cb(null, self.SPF_PERMERROR);
-                }
-                // Return any result that is not SPF_NONE
-                if (result && result !== self.SPF_NONE) {
-                    return cb(err2, result);
-                }
-                if (!mod_array.length) {
-                    return cb(null, self.SPF_NEUTRAL);
-                }
-                const next_in_chain = mod_array.shift();
-                const func = Object.keys(next_in_chain);
-                const args = next_in_chain[func];
-                self.log_debug(`running modifier: ${func} args=${args} domain=${self.domain}`);
-                self[`mod_${func}`](args, mod_chain_caller);
-            }
-
-            // Run all the mechanisms first
-            function mech_chain_caller (err3, result) {
-                // Throw any errors
-                if (err3) throw err3;
-                // Check limits
-                if (self.count > self.LIMIT) {
-                    self.log_debug('lookup limit reached');
-                    return cb(null, self.SPF_PERMERROR);
-                }
-                // If we have a result other than SPF_NONE
-                if (result && result !== self.SPF_NONE) {
-                    return cb(err3, result);
-                }
-                // Return default if no more mechanisms to run
-                if (!mech_array.length) {
-                    // Now run any modifiers
-                    if (mod_array.length) {
-                        return mod_chain_caller();
-                    }
-                    else {
-                        return cb(null, self.SPF_NEUTRAL);
-                    }
-                }
-                const next_in_chain = mech_array.shift();
-                const func = Object.keys(next_in_chain);
-                const args = next_in_chain[func];
-                self.log_debug(`running mechanism: ${func} args=${args} domain=${self.domain}`);
-                self[`mech_${func}`](((args && args.length) ? args[0] : null), ((args && args.length) ? args[1] : null), mech_chain_caller);
-            }
-            // Start the chain
-            mech_chain_caller();
-        });
-    }
-
-    mech_all (qualifier, args, cb) {
-        return cb(null, this.return_const(qualifier));
-    }
-
-    mech_include (qualifier, args, cb) {
-        const self = this;
-        const domain = args.substr(1);
-        // Avoid circular references
-        if (self.been_there[domain]) {
-            self.log_debug(`circular reference detected: ${domain}`);
-            return cb(null, self.SPF_NONE);
-        }
-        self.count++;
-        self.been_there[domain] = true;
-        // Recurse
-        const recurse = new SPF(self.count, self.been_there);
-        recurse.check_host(self.ip, domain, self.mail_from, (err, result) => {
-            if (!err) {
-                self.log_debug(`mech_include: domain=${domain} returned=${self.const_translate(result)}`);
-                switch (result) {
-                    case self.SPF_PASS:         return cb(null, self.SPF_PASS);
-                    case self.SPF_FAIL:
-                    case self.SPF_SOFTFAIL:
-                    case self.SPF_NEUTRAL:      return cb(null, self.SPF_NONE);
-                    case self.SPF_TEMPERROR:    return cb(null, self.SPF_TEMPERROR);
-                    default:                    return cb(null, self.SPF_PERMERROR);
-                }
-            }
-        });
-    }
-
-    mech_exists (qualifier, args, cb) {
-        const self = this;
-        self.count++;
-        const exists = args.substr(1);
-        dns.resolve(exists, (err, addrs) => {
-            if (err) {
-                self.log_debug(`mech_exists: ${err}`);
-                switch (err.code) {
-                    case dns.NOTFOUND:
-                    case dns.NODATA:
-                    case dns.NXDOMAIN:
-                        return cb(null, self.SPF_NONE);
-                    default:
-                        return cb(null, self.SPF_TEMPERROR);
-                }
-            }
-            self.log_debug(`mech_exists: ${exists} result=${addrs.join(',')}`);
-            return cb(null, self.return_const(qualifier));
-        });
-    }
-
-    mech_a (qualifier, args, cb) {
-        const self = this;
-        self.count++;
-        // Parse any arguments
-        let cm;
-        let cidr4;
-        let cidr6;
-        if (args && (cm = /\/(\d+)(?:\/\/(\d+))?$/.exec(args))) {
-            cidr4 = cm[1];
-            cidr6 = cm[2];
-        }
-        let dm;
-        let domain = self.domain;
-        if (args && (dm = /^:([^/ ]+)/.exec(args))) {
-            domain = dm[1];
-        }
-        // Calculate with IP method to use
-        let resolve_method;
-        let cidr;
-        if (self.ip_ver === 'ipv4') {
-            cidr = cidr4;
-            resolve_method = 'resolve4';
-        }
-        else if (self.ip_ver === 'ipv6') {
-            cidr = cidr6;
-            resolve_method = 'resolve6';
-        }
-        // Use current domain
-        dns[resolve_method](domain, (err, addrs) => {
-            if (err) {
-                self.log_debug(`mech_a: ${err}`);
-                switch (err.code) {
-                    case dns.NOTFOUND:
-                    case dns.NODATA:
-                    case dns.NXDOMAIN:  return cb(null, self.SPF_NONE);
-                    default:            return cb(null, self.SPF_TEMPERROR);
-                }
-            }
-            for (let a=0; a<addrs.length; a++) {
-                if (cidr) {
-                    // CIDR
-                    const range = ipaddr.parse(addrs[a]);
-                    if (self.ipaddr.match(range, cidr)) {
-                        self.log_debug(`mech_a: ${self.ip} => ${addrs[a]}/${cidr}: MATCH!`);
-                        return cb(null, self.return_const(qualifier));
-                    }
-                    else {
-                        self.log_debug(`mech_a: ${self.ip} => ${addrs[a]}/${cidr}: NO MATCH`);
-                    }
-                }
-                else {
-                    if (addrs[a] === self.ip) {
-                        return cb(null, self.return_const(qualifier));
-                    }
-                    else {
-                        self.log_debug(`mech_a: ${self.ip} => ${addrs[a]}: NO MATCH`);
-                    }
-                }
-            }
-            return cb(null, self.SPF_NONE);
-        });
-    }
-
-    mech_mx (qualifier, args, cb) {
-        const self = this;
-        this.count++;
-        // Parse any arguments
-        let cm;
-        let cidr4;
-        let cidr6;
-        if (args && (cm = /\/(\d+)((?:\/\/(\d+))?)$/.exec(args))) {
-            cidr4 = cm[1];
-            cidr6 = cm[2];
-        }
-        let dm;
-        let domain = this.domain;
-        if (args && (dm = /^:([^/ ]+)/.exec(args))) {
-            domain = dm[1];
-        }
-        // Fetch the MX records for the specified domain
-        net_utils.get_mx(domain, (err, mxes) => {
-            if (err) {
-                switch (err.code) {
-                    case dns.NOTFOUND:
-                    case dns.NODATA:
-                    case dns.NXDOMAIN:  return cb(null, self.SPF_NONE);
-                    default:            return cb(null, self.SPF_TEMPERROR);
-                }
-            }
-            let pending = 0;
-            let addresses = [];
-            // RFC 4408 Section 10.1
-            if (mxes.length > self.LIMIT) {
-                return cb(null, self.SPF_PERMERROR);
-            }
-            for (let a=0; a<mxes.length; a++) {
-                pending++;
-                const mx = mxes[a].exchange;
-                // Calculate which IP method to use
-                let resolve_method;
-                let cidr;
-                if (self.ip_ver === 'ipv4') {
-                    cidr = cidr4;
-                    resolve_method = 'resolve4';
-                }
-                else if (self.ip_ver === 'ipv6') {
-                    cidr = cidr6;
-                    resolve_method = 'resolve6';
-                }
-                dns[resolve_method](mx, (err4, addrs) => {
-                    pending--;
-                    if (err4) {
-                        switch (err4.code) {
-                            case dns.NOTFOUND:
-                            case dns.NODATA:
-                            case dns.NXDOMAIN:  break;
-                            default:            return cb(null, self.SPF_TEMPERROR);
-                        }
-                    }
-                    else {
-                        self.log_debug(`mech_mx: mx=${mx} addresses=${addrs.join(',')}`);
-                        addresses = addrs.concat(addresses);
-                    }
-                    if (pending === 0) {
-                        if (!addresses.length) return cb(null, self.SPF_NONE);
-                        // All queries run; see if our IP matches
-                        if (cidr) {
-                            // CIDR match type
-                            for (let i=0; i<addresses.length; i++) {
-                                const range = ipaddr.parse(addresses[i]);
-                                if (self.ipaddr.match(range, cidr)) {
-                                    self.log_debug(`mech_mx: ${self.ip} => ${addresses[i]}/${cidr}: MATCH!`);
-                                    return cb(null, self.return_const(qualifier));
-                                }
-                                else {
-                                    self.log_debug(`mech_mx: ${self.ip} => ${addresses[i]}/${cidr}: NO MATCH`);
-                                }
-                            }
-                            // No matches
-                            return cb(null, self.SPF_NONE);
-                        }
-                        else {
-                            if (addresses.includes(self.ip)) {
-                                self.log_debug(`mech_mx: ${self.ip} => ${addresses.join(',')}: MATCH!`);
-                                return cb(null, self.return_const(qualifier));
-                            }
-                            else {
-                                self.log_debug(`mech_mx: ${self.ip} => ${addresses.join(',')}: NO MATCH`);
-                                return cb(null, self.SPF_NONE);
-                            }
-                        }
-                    }
-                });
-                // In case we didn't run any queries...
-                if (pending === 0) {
-                    return cb(null, self.SPF_NONE);
-                }
-            }
-            if (pending === 0) {
-                return cb(null, self.SPF_NONE);
-            }
-        });
-    }
-
-    mech_ptr (qualifier, args, cb) {
-        const self = this;
-        this.count++;
-        let dm;
-        let domain = this.domain;
-        if (args && (dm = /^:([^/ ]+)/.exec(args))) {
-            domain = dm[1];
-        }
-        // First do a PTR lookup for the connecting IP
-        dns.reverse(this.ip, (err, ptrs) => {
-            if (err) {
-                self.log_debug(`mech_ptr: lookup=${self.ip} => ${err}`);
-                return cb(null, self.SPF_NONE);
-            }
-            else {
-                let resolve_method;
-                if (self.ip_ver === 'ipv4') resolve_method = 'resolve4';
-                if (self.ip_ver === 'ipv6') resolve_method = 'resolve6';
-                let pending = 0;
-                const names = [];
-                // RFC 4408 Section 10.1
-                if (ptrs.length > self.LIMIT) {
-                    return cb(null, self.SPF_PERMERROR);
-                }
-                for (let i=0; i<ptrs.length; i++) {
-                    const ptr = ptrs[i];
-                    pending++;
-                    dns[resolve_method](ptr, (err3, addrs) => {
-                        pending--;
-                        if (err3) {
-                            // Skip on error
-                            self.log_debug(`mech_ptr: lookup=${ptr} => ${err3}`);
-                        }
-                        else {
-                            for (let a=0; a<addrs.length; a++) {
-                                if (addrs[a] === self.ip) {
-                                    self.log_debug(`mech_ptr: ${self.ip} => ${ptr} => ${addrs[a]}: MATCH!`);
-                                    names.push(ptr.toLowerCase());
-                                }
-                                else {
-                                    self.log_debug(`mech_ptr: ${self.ip} => ${ptr} => ${addrs[a]}: NO MATCH`);
-                                }
-                            }
-                        }
-                        // Finished
-                        if (pending === 0) {
-                            let re;
-                            // Catch bogus PTR matches e.g. ptr:*.bahnhof.se (should be ptr:bahnhof.se)
-                            // These will cause a regexp error, so we can catch them.
-                            try {
-                                re = new RegExp(`${domain.replace('.','\\.')}$`, 'i');
-                            }
-                            catch (e) {
-                                self.log_debug(
-                                    'mech_ptr',
-                                    {
-                                        domain: self.domain,
-                                        err: e.message
-                                    }
-                                );
-                                return cb(null, self.SPF_PERMERROR);
-                            }
-                            for (let t=0; t<names.length; t++) {
-                                if (re.test(names[t])) {
-                                    self.log_debug(`mech_ptr: ${names[t]} => ${domain}: MATCH!`);
-                                    return cb(null, self.return_const(qualifier));
-                                }
-                                else {
-                                    self.log_debug(`mech_ptr: ${names[t]} => ${domain}: NO MATCH`);
-                                }
-                            }
-                            return cb(null, self.SPF_NONE);
-                        }
-                    });
-                }
-                if (pending === 0) {
-                    // No queries run
-                    return cb(null, self.SPF_NONE);
-                }
-            }
-        });
-    }
-
-    mech_ip (qualifier, args, cb) {
-        const cidr = args.substr(1);
-        const match = /^([^/ ]+)(?:\/(\d+))?$/.exec(cidr);
-        if (!match) { return cb(null, this.SPF_NONE); }
-
-        // match[1] == ip
-        // match[2] == mask
-        try {
-            if (!match[2]) {
-                // Default masks for each IP version
-                if (this.ip_ver === 'ipv4') match[2] = '32';
-                if (this.ip_ver === 'ipv6') match[2] = '128';
-            }
-            const range = ipaddr.parse(match[1]);
-            const rtype = range.kind();
-            if (this.ip_ver !== rtype) {
-                this.log_debug(`mech_ip: ${this.ip} => ${cidr}: SKIP`);
-                return cb(null, this.SPF_NONE);
-            }
-            if (this.ipaddr.match(range, match[2])) {
-                this.log_debug(`mech_ip: ${this.ip} => ${cidr}: MATCH!`);
-                return cb(null, this.return_const(qualifier));
-            }
-            else {
-                this.log_debug(`mech_ip: ${this.ip} => ${cidr}: NO MATCH`);
-            }
-        }
-        catch (e) {
-            this.log_debug(e.message);
-            return cb(null, this.SPF_PERMERROR);
-        }
-        return cb(null, this.SPF_NONE);
-    }
-
-    mod_redirect (domain, cb) {
-        // Avoid circular references
-        if (this.been_there[domain]) {
-            this.log_debug(`circular reference detected: ${domain}`);
-            return cb(null, this.SPF_NONE);
-        }
-        this.count++;
-        this.been_there[domain] = 1;
-        return this.check_host(this.ip, domain, this.mail_from, cb);
-    }
-
-    mod_exp (str, cb) {
-        // NOT IMPLEMENTED
-        return cb(null, this.SPF_NONE);
-    }
-}
-
-exports.SPF = SPF;