#!perl -w

use strict;
use warnings;

use Qpsmtpd::Constants;
use Qpsmtpd::DSN;
use Qpsmtpd::TcpServer;

#use ParaDNS;  # moved into register
use Socket;

my %invalid  = ();
my $has_ipv6 = Qpsmtpd::TcpServer::has_ipv6();

sub register {
    my ($self, $qp) = @_;

    foreach my $i ($self->qp->config("invalid_resolvable_fromhost")) {
        $i =~ s/^\s*//;
        $i =~ s/\s*$//;
        if ($i =~ m#^((\d{1,3}\.){3}\d{1,3})/(\d\d?)#) {
            $invalid{$1} = $3;
        }
    }

    eval 'use ParaDNS';
    if ($@) {
        warn "could not load ParaDNS, plugin disabled";
        return DECLINED;
    }
    $self->register_hook(mail => 'hook_mail_start');
    $self->register_hook(mail => 'hook_mail_done');
}

sub hook_mail_start {
    my ($self, $transaction, $sender) = @_;

    return DECLINED
      if ($self->connection->notes('whitelisthost'));

    if ($sender ne '<>') {

        unless ($sender->host) {

            # default of addr_bad_from_system is DENY, we use DENYSOFT here to
            # get the same behaviour as without Qpsmtpd::DSN...
            return
              Qpsmtpd::DSN->addr_bad_from_system(DENYSOFT,
                                        "FQDN required in the envelope sender");
        }

        return DECLINED if $sender->host =~ m/^\[(\d{1,3}\.){3}\d{1,3}\]$/;

        unless ($self->check_dns($sender->host)) {
            return Qpsmtpd::DSN->temp_resolver_failed(
                                          "Could not resolve " . $sender->host);
        }

        return YIELD;
    }

    return DECLINED;
}

sub hook_mail_done {
    my ($self, $transaction, $sender) = @_;

    return DECLINED
      if ($self->connection->notes('whitelisthost'));

    if ($sender ne "<>" && !$transaction->notes('resolvable_fromhost')) {

        # default of temp_resolver_failed is DENYSOFT
        return Qpsmtpd::DSN->temp_resolver_failed(
                                          "Could not resolve " . $sender->host);
    }
    return DECLINED;
}

sub check_dns {
    my ($self, $host) = @_;
    my @host_answers;

    my $qp = $self->qp;
    $qp->input_sock->pause_read;

    my $a_records   = [];
    my $num_queries = 1;    # queries in progress
    my $mx_found    = 0;

    ParaDNS->new(
        callback => sub {
            my $mx = shift;
            return if $mx =~ /^[A-Z]+$/;    # error

            my $addr = $mx->[0];
            $mx_found = 1;

            $num_queries++;
            ParaDNS->new(
                callback => sub {
                    push @$a_records, $_[0] if $_[0] !~ /^[A-Z]+$/;
                },
                finished => sub {
                    $num_queries--;
                    $self->finish_up($qp, $a_records, $num_queries);
                },
                host => $addr,
                type => 'A',
                        );

            if ($has_ipv6) {
                $num_queries++;
                ParaDNS->new(
                    callback => sub {
                        push @$a_records, $_[0] if $_[0] !~ /^[A-Z]+$/;
                    },
                    finished => sub {
                        $num_queries--;
                        $self->finish_up($qp, $a_records, $num_queries);
                    },
                    host => $addr,
                    type => 'AAAA',
                            );
            }
        },
        finished => sub {

            unless ($mx_found) {

                $num_queries++;
                ParaDNS->new(
                    callback => sub {
                        push @$a_records, $_[0] if $_[0] !~ /^[A-Z]+$/;
                    },
                    finished => sub {
                        $num_queries--;
                        $self->finish_up($qp, $a_records, $num_queries);
                    },
                    host => $host,
                    type => 'A',
                            );

                if ($has_ipv6) {
                    $num_queries++;
                    ParaDNS->new(
                        callback => sub {
                            push @$a_records, $_[0] if $_[0] !~ /^[A-Z]+$/;
                        },
                        finished => sub {
                            $num_queries--;
                            $self->finish_up($qp, $a_records, $num_queries);
                        },
                        host => $host,
                        type => 'AAAA',
                                );
                }

            }

            $num_queries--;
            $self->finish_up($qp, $a_records, $num_queries);
        },
        host => $host,
        type => 'MX',
                )
      or $qp->input_sock->continue_read, return;

    return 1;
}

sub finish_up {
    my ($self, $qp, $a_records, $num_queries) = @_;

    return if defined $qp->transaction->notes('resolvable_fromhost');

    foreach my $addr (@$a_records) {
        if (is_valid($addr)) {
            $qp->transaction->notes('resolvable_fromhost', 1);
            $qp->input_sock->continue_read;
            $qp->run_continuation;
            return;
        }
    }

    unless ($num_queries) {

        # all queries returned no valid response
        $qp->transaction->notes('resolvable_fromhost', 0);
        $qp->input_sock->continue_read;
        $qp->run_continuation;
    }
}

sub is_valid {
    my $ip = shift;
    my ($net, $mask);
    foreach $net (keys %invalid) {
        $mask = $invalid{$net};
        $mask = pack "B32", "1" x ($mask) . "0" x (32 - $mask);
        return 0
          if join(".", unpack("C4", inet_aton($ip) & $mask)) eq $net;
    }
    return 1;
}