qpsmtpd/plugins/require_resolvable_fromhost

#!perl -w

=head1 NAME

resolvable_fromhost

=head1 SYNOPSIS

Determine if the from host resolves to a valid MX or host.

=head1 DESCRIPTION

The fromhost is the part of the email address after the @ symbol, provided by
the sending server during the SMTP conversation. This is usually, but not
always, the same as the hostname in the From: header.

B<resolvable_fromhost> tests to see if the fromhost resolves. It saves the 
results in the transaction note I<resolvable_fromhost> where other plugins can
use that information. Typical results are:

 a  - fromhost resolved as an A record
 mx - fromhost has valid MX record(s)
 ip - fromhost was an IP
 whitelist - skipped checks due to whitelisting
 null - null sender
 config - fromhost not resolvable, but I<reject 0> was set.

Any other result is an error message with details of the failure.

If B<resolvable_fromhost> is enabled, the from hostname is also stored in
I<resolvable_fromhost_host>, making it accessible when $sender is not.

=head1 CONFIGURATION

=head2 reject <bool>

If I<reject 1> is set, the old require_resolvable_fromhost plugin behavior of
temporary rejection is the default.

 resolvable_fromhost reject [ 0 | 1 ]

Default: 1

=head2 reject_type

 reject_type [ perm | temp ]

Set I<reject_type perm> to reject mail instead of deferring it.

Default: temp (temporary, aka soft, aka 4xx).

=head1 EXAMPLE LOG ENTRIES

 80072 (mail) resolvable_fromhost: googlegroups.com has valid MX at gmr-smtp-in.l.google.com
 80108 (mail) resolvable_fromhost: zerobarriers.net has valid MX at zerobarriers.net
 80148 (mail) resolvable_fromhost: uhin.com has valid MX at filter.itsafemail.com
 86627 (mail) resolvable_fromhost: no MX records for palmalar.com
 86627 (mail) resolvable_fromhost: fail: palmalar.com (SERVFAIL)

=head1 AUTHORS

2012 - Matt Simerson - refactored, added: POD, tests, reject, reject_type

2002 - Ask Bjørn Hansen - intial plugin

=cut


use strict;
use warnings;

use Qpsmtpd::Constants;
use Qpsmtpd::DSN;
use Qpsmtpd::TcpServer;

use Socket;
use Net::DNS qw(mx);
use Net::IP qw(:PROC);

my %invalid  = ();
my $has_ipv6 = Qpsmtpd::TcpServer::has_ipv6();

sub register {
    my ($self, $qp, %args) = @_;

    foreach (keys %args) {
        $self->{_args}->{$_} = $args{$_};
    }
    if ( ! defined $self->{_args}{reject} ) {
        $self->{_args}{reject} = 1;
    };
    $self->{_args}{reject_type} ||= 'soft';
}

sub hook_mail {
    my ($self, $transaction, $sender, %param) = @_;

    $self->populate_invalid_networks();

    # check first, so results are noted for other plugins
    my $resolved = $self->check_dns($sender->host, $transaction);

    return DECLINED if $resolved;  # success, no need to continue
    return DECLINED if $self->is_immune( $sender, $transaction );
    return DECLINED if ! $self->{_args}{reject};

    return DECLINED if $sender->host;  # reject later

    $self->log(LOGWARN, "FQDN required in envelope sender");
    return Qpsmtpd::DSN->addr_bad_from_system( $self->get_reject_type(),
                            "FQDN required in the envelope sender");
}

sub hook_rcpt {
    my ($self, $transaction, $recipient, %args) = @_;

    my $result = $transaction->notes('resolvable_fromhost');
    return DECLINED if ! $self->{_args}{reject};         # no reject policy
    return DECLINED if $result =~ /^(a|ip|mx)$/;         # success
    return DECLINED if $result =~ /^(whitelist|null|config)$/; # immunity

    $self->log(LOGINFO, $result ); # log error
    return Qpsmtpd::DSN->temp_resolver_failed( $self->get_reject_type(), $result );
}

sub check_dns {
    my ($self, $host, $transaction) = @_;

    # we can't even parse a hostname out of the address
    if ( ! $host ) {
        $transaction->notes('resolvable_fromhost', 'unparsable host');
        return;
    };

    $transaction->notes('resolvable_fromhost_host', $host);

    if ( $host =~ m/^\[(\d{1,3}\.){3}\d{1,3}\]$/ ) {
        $self->log(LOGINFO, "skip: $host is an IP");
        $transaction->notes('resolvable_fromhost', 'ip');
        return 1;
    };

    my $res = new Net::DNS::Resolver(dnsrch => 0);
    $res->tcp_timeout(30);
    $res->udp_timeout(30);

    my $has_mx = $self->get_and_validate_mx( $res, $host, $transaction );
    return 1 if $has_mx == 1;  # success!
    return if $has_mx == -1;   # has invalid MX records

    my @host_answers = $self->get_host_records( $res, $host, $transaction );
    foreach my $rr (@host_answers) {
        if ( $rr->type eq 'A' || $rr->type eq 'AAAA' ) {
            $self->log(LOGINFO, "pass: found valid A for $host");
            $transaction->notes('resolvable_fromhost', 'a');
            return $self->ip_is_valid($rr->address);
        };
        if ( $rr->type eq 'MX' ) {
            $self->log(LOGINFO, "pass: found valid MX for $host");
            $transaction->notes('resolvable_fromhost', 'mx');
            return $self->mx_address_resolves($rr->exchange, $host);
        };
    }
    return;
}

sub ip_is_valid {
    my ($self, $ip) = @_;
    my ($net, $mask);
    ### while (($net,$mask) = each %invalid) {
    ###      ... does NOT reset to beginning, will start on
    ###      2nd invocation after where it denied the first time..., so
    ###      2nd time the same "MAIL FROM" would be accepted!
    foreach $net (keys %invalid) {
        $mask = $invalid{$net};
        $mask = pack "B32", "1" x ($mask) . "0" x (32 - $mask);
        return if $net eq join('.', unpack("C4", inet_aton($ip) & $mask));
    }
    return 1;
}

sub get_and_validate_mx {
    my ($self, $res, $host, $transaction ) = @_;

    my @mx = mx($res, $host);
    if ( ! scalar @mx ) {    # no mx records
        $self->log(LOGINFO, "no MX records for $host");
        return 0;
    };

    foreach my $mx (@mx) {
        # if any MX is valid, then we consider the domain resolvable
        if ( $self->mx_address_resolves($mx->exchange, $host) ) {
            $self->log(LOGINFO, "pass: $host has valid MX at " . $mx->exchange);
            $transaction->notes('resolvable_fromhost', 'mx');
            return 1;
        };
    }

    # if there are MX records, and we got here, none are valid
    $self->log(LOGINFO, "fail: invalid MX for $host");
    $transaction->notes('resolvable_fromhost', "invalid MX for $host");
    return -1;
};

sub get_host_records {
    my ($self, $res, $host, $transaction ) = @_;

    my @answers;
    my $query = $res->search($host);

    if ($query) {
        foreach my $rrA ($query->answer) {
            push(@answers, $rrA);
        }
    }

    if ($has_ipv6) {
        $query = $res->search($host, 'AAAA');
        if ($query) {
            foreach my $rrAAAA ($query->answer) {
                push(@answers, $rrAAAA);
            }
        }
    }

    if ( ! scalar @answers) {
        if ( $res->errorstring ne 'NXDOMAIN' ) {
            $self->log(LOGWARN, "$$ query for $host failed: ", $res->errorstring);
        };
        return;
    };

    return @answers;
};

sub mx_address_resolves {
    my ($self, $name, $fromhost) = @_;

    # IP in MX
    return $self->ip_is_valid($name) if ip_is_ipv4($name) || ip_is_ipv6($name);

    my $res = new Net::DNS::Resolver(dnsrch => 0);
    my @mx_answers;
    my $query = $res->search($name, 'A');
    if ($query) {
        foreach my $rrA ($query->answer) {
            push(@mx_answers, $rrA);
        }
    }
    if ($has_ipv6) {
        my $query = $res->search($name, 'AAAA');
        if ($query) {
            foreach my $rrAAAA ($query->answer) {
                push(@mx_answers, $rrAAAA);
            }
        }
    }
    if (! @mx_answers) {
        $self->log(LOGWARN, "query for $fromhost failed: ", $res->errorstring)
            unless $res->errorstring eq "NXDOMAIN";
        return;
    }

    foreach my $rr (@mx_answers) {
        next if ( $rr->type ne 'A' && $rr->type ne 'AAAA' );
        return $self->ip_is_valid($rr->address);
    }

    return;
}

sub populate_invalid_networks {
    my $self = shift;

    foreach my $i ($self->qp->config("invalid_resolvable_fromhost")) {
        $i =~ s/^\s*//;  # trim leading spaces
        $i =~ s/\s*$//;  # trim trailing spaces
        if ($i =~ m#^((\d{1,3}\.){3}\d{1,3})/(\d\d?)#) {
            $invalid{$1} = $3;
        }
    }
};

sub is_immune {
    my ($self, $sender, $transaction) = @_;

    if ( $self->qp->connection->notes('whitelisthost') ) {
        $transaction->notes('resolvable_fromhost', 'whitelist');
        $self->log(LOGINFO, "pass: whitelisted");
        return 1;
    };

    if ( $sender eq '<>' ) {
        $transaction->notes('resolvable_fromhost', 'null');
        $self->log(LOGINFO, "pass: null sender");
        return 1;
    };

    if ( ! $self->{_args}{reject} ) {
        $transaction->notes('resolvable_fromhost', 'config');
        $self->log(LOGINFO, "skip: reject not enabled in config.");
        return;
    };

    return;
};

sub get_reject_type {
    my $self = shift;
    my $default = shift || DENYSOFT;
    my $deny = $self->{_args}{reject_type} or return $default;

    return $deny =~ /^(temp|soft)$/i ? DENYSOFT
         : $deny =~ /^(perm|hard)$/i ? DENY
         : $deny eq 'disconnect' ? DENY_DISCONNECT
         : $default;
};