mirror of
https://github.com/mjl-/mox.git
synced 2025-07-12 17:04:39 +03:00
implement dnssec-awareness throughout code, and dane for incoming/outgoing mail delivery
the vendored dns resolver code is a copy of the go stdlib dns resolver, with awareness of the "authentic data" (i.e. dnssec secure) added, as well as support for enhanced dns errors, and looking up tlsa records (for dane). ideally it would be upstreamed, but the chances seem slim. dnssec-awareness is added to all packages, e.g. spf, dkim, dmarc, iprev. their dnssec status is added to the Received message headers for incoming email. but the main reason to add dnssec was for implementing dane. with dane, the verification of tls certificates can be done through certificates/public keys published in dns (in the tlsa records). this only makes sense (is trustworthy) if those dns records can be verified to be authentic. mox now applies dane to delivering messages over smtp. mox already implemented mta-sts for webpki/pkix-verification of certificates against the (large) pool of CA's, and still enforces those policies when present. but it now also checks for dane records, and will verify those if present. if dane and mta-sts are both absent, the regular opportunistic tls with starttls is still done. and the fallback to plaintext is also still done. mox also makes it easy to setup dane for incoming deliveries, so other servers can deliver with dane tls certificate verification. the quickstart now generates private keys that are used when requesting certificates with acme. the private keys are pre-generated because they must be static and known during setup, because their public keys must be published in tlsa records in dns. autocert would generate private keys on its own, so had to be forked to add the option to provide the private key when requesting a new certificate. hopefully upstream will accept the change and we can drop the fork. with this change, using the quickstart to setup a new mox instance, the checks at internet.nl result in a 100% score, provided the domain is dnssec-signed and the network doesn't have any issues.
This commit is contained in:
Mechiel Lukkien
369
queue/direct.go
369
queue/direct.go
@ -11,6 +11,10 @@ import (
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/prometheus/client_golang/prometheus"
|
||||
"github.com/prometheus/client_golang/prometheus/promauto"
|
||||
|
||||
"github.com/mjl-/adns"
|
||||
"github.com/mjl-/bstore"
|
||||
|
||||
"github.com/mjl-/mox/dns"
|
||||
@ -23,6 +27,39 @@ import (
|
||||
"github.com/mjl-/mox/store"
|
||||
)
|
||||
|
||||
var (
|
||||
metricDestinations = promauto.NewCounter(
|
||||
prometheus.CounterOpts{
|
||||
Name: "mox_queue_destinations_total",
|
||||
Help: "Total destination (e.g. MX) lookups for delivery attempts, including those in mox_smtpclient_destinations_authentic_total.",
|
||||
},
|
||||
)
|
||||
metricDestinationsAuthentic = promauto.NewCounter(
|
||||
prometheus.CounterOpts{
|
||||
Name: "mox_queue_destinations_authentic_total",
|
||||
Help: "Destination (e.g. MX) lookups for delivery attempts authenticated with DNSSEC so they are candidates for DANE verification.",
|
||||
},
|
||||
)
|
||||
metricDestinationDANERequired = promauto.NewCounter(
|
||||
prometheus.CounterOpts{
|
||||
Name: "mox_queue_destination_dane_required_total",
|
||||
Help: "Total number of connections to hosts with valid TLSA records making DANE required.",
|
||||
},
|
||||
)
|
||||
metricDestinationDANESTARTTLSUnverified = promauto.NewCounter(
|
||||
prometheus.CounterOpts{
|
||||
Name: "mox_queue_destination_dane_starttlsunverified_total",
|
||||
Help: "Total number of connections with required DANE where all TLSA records were unusable.",
|
||||
},
|
||||
)
|
||||
metricDestinationDANEGatherTLSAErrors = promauto.NewCounter(
|
||||
prometheus.CounterOpts{
|
||||
Name: "mox_queue_destination_dane_gathertlsa_errors_total",
|
||||
Help: "Total number of connections where looking up TLSA records resulted in an error.",
|
||||
},
|
||||
)
|
||||
)
|
||||
|
||||
// todo: rename function, perhaps put some of the params in a delivery struct so we don't pass all the params all the time?
|
||||
func fail(qlog *mlog.Log, m Msg, backoff time.Duration, permanent bool, remoteMTA dsn.NameIP, secodeOpt, errmsg string) {
|
||||
if permanent || m.Attempts >= 8 {
|
||||
@ -53,9 +90,27 @@ func fail(qlog *mlog.Log, m Msg, backoff time.Duration, permanent bool, remoteMT
|
||||
}
|
||||
}
|
||||
|
||||
// Delivery by directly dialing MX hosts for destination domain.
|
||||
func deliverDirect(cid int64, qlog *mlog.Log, resolver dns.Resolver, dialer contextDialer, ourHostname dns.Domain, transportName string, m Msg, backoff time.Duration) {
|
||||
hosts, effectiveDomain, permanent, err := gatherHosts(resolver, m, cid, qlog)
|
||||
// Delivery by directly dialing (MX) hosts for destination domain of message.
|
||||
func deliverDirect(cid int64, qlog *mlog.Log, resolver dns.Resolver, dialer smtpclient.Dialer, ourHostname dns.Domain, transportName string, m Msg, backoff time.Duration) {
|
||||
// High-level approach:
|
||||
// - Resolve domain to deliver to (CNAME), and determine hosts to try to deliver to (MX)
|
||||
// - Get MTA-STS policy for domain (optional). If present, only deliver to its
|
||||
// allowlisted hosts and verify TLS against CA pool.
|
||||
// - For each host, attempt delivery. If the attempt results in a permanent failure
|
||||
// (as claimed by remote with a 5xx SMTP response, or perhaps decided by us), the
|
||||
// attempt can be aborted. Other errors are often temporary and may result in later
|
||||
// successful delivery. But hopefully the delivery just succeeds. For each host:
|
||||
// - If there is an MTA-STS policy, we only connect to allow-listed hosts.
|
||||
// - We try to lookup DANE records (optional) and verify them if present.
|
||||
|
||||
// Resolve domain and hosts to attempt delivery to.
|
||||
// These next-hop names are often the name under which we find MX records. The
|
||||
// expanded name is different from the original if the original was a CNAME,
|
||||
// possibly a chain. If there are no MX records, it can be an IP or the host
|
||||
// directly.
|
||||
origNextHop := m.RecipientDomain.Domain
|
||||
ctx := context.WithValue(mox.Context, mlog.CidKey, cid)
|
||||
haveMX, origNextHopAuthentic, expandedNextHopAuthentic, expandedNextHop, hosts, permanent, err := smtpclient.GatherDestinations(ctx, qlog, resolver, m.RecipientDomain)
|
||||
if err != nil {
|
||||
fail(qlog, m, backoff, permanent, dsn.NameIP{}, "", err.Error())
|
||||
return
|
||||
@ -63,65 +118,87 @@ func deliverDirect(cid int64, qlog *mlog.Log, resolver dns.Resolver, dialer cont
|
||||
|
||||
// Check for MTA-STS policy and enforce it if needed. We have to check the
|
||||
// effective domain (found after following CNAME record(s)): there will certainly
|
||||
// not be an mtasts record for the original recipient domain, because that is not
|
||||
// not be an MTA-STS record for the original recipient domain, because that is not
|
||||
// allowed when a CNAME record is present.
|
||||
var policyFresh bool
|
||||
var policy *mtasts.Policy
|
||||
tlsModeDefault := smtpclient.TLSOpportunistic
|
||||
if !effectiveDomain.IsZero() {
|
||||
if !expandedNextHop.IsZero() {
|
||||
cidctx := context.WithValue(mox.Shutdown, mlog.CidKey, cid)
|
||||
policy, policyFresh, err = mtastsdb.Get(cidctx, resolver, effectiveDomain)
|
||||
policy, _, err = mtastsdb.Get(cidctx, resolver, expandedNextHop)
|
||||
if err != nil {
|
||||
// No need to refuse to deliver if we have some mtasts error.
|
||||
qlog.Infox("mtasts failed, continuing with strict tls requirement", err, mlog.Field("domain", effectiveDomain))
|
||||
qlog.Infox("mtasts failed, continuing with strict tls requirement", err, mlog.Field("domain", expandedNextHop))
|
||||
tlsModeDefault = smtpclient.TLSStrictStartTLS
|
||||
}
|
||||
// note: policy can be nil, if a domain does not implement MTA-STS or its the first
|
||||
// time we fetch the policy and if we encountered an error.
|
||||
// note: policy can be nil, if a domain does not implement MTA-STS or it's the
|
||||
// first time we fetch the policy and if we encountered an error.
|
||||
}
|
||||
|
||||
// We try delivery to each record until we have success or a permanent failure. So
|
||||
// for transient errors, we'll try the next MX record. For MX records pointing to a
|
||||
// We try delivery to each host until we have success or a permanent failure. So
|
||||
// for transient errors, we'll try the next host. For MX records pointing to a
|
||||
// dual stack host, we turn a permanent failure due to policy on the first delivery
|
||||
// attempt into a temporary failure and make sure to try the other address family
|
||||
// the next attempt. This should reduce issues due to one of our IPs being on a
|
||||
// block list. We won't try multiple IPs of the same address family. Surprisingly,
|
||||
// RFC 5321 does not specify a clear algorithm, but common practicie is probably
|
||||
// RFC 5321 does not specify a clear algorithm, but common practice is probably
|
||||
// ../rfc/3974:268.
|
||||
var remoteMTA dsn.NameIP
|
||||
var secodeOpt, errmsg string
|
||||
permanent = false
|
||||
mtastsFailure := true
|
||||
// todo: should make distinction between host permanently not accepting the message, and the message not being deliverable permanently. e.g. a mx host may have a size limit, or not accept 8bitmime, while another host in the list does accept the message. same for smtputf8, ../rfc/6531:555
|
||||
for _, h := range hosts {
|
||||
var badTLS, ok bool
|
||||
|
||||
// ../rfc/8461:913
|
||||
if policy != nil && policy.Mode == mtasts.ModeEnforce && !policy.Matches(h.Domain) {
|
||||
if policy != nil && !policy.Matches(h.Domain) {
|
||||
var policyHosts []string
|
||||
for _, mx := range policy.MX {
|
||||
policyHosts = append(policyHosts, mx.LogString())
|
||||
}
|
||||
errmsg = fmt.Sprintf("mx host %s does not match enforced mta-sts policy with hosts %s", h.Domain, strings.Join(policyHosts, ","))
|
||||
qlog.Error("mx host does not match enforce mta-sts policy, skipping", mlog.Field("host", h.Domain), mlog.Field("policyhosts", policyHosts))
|
||||
continue
|
||||
if policy.Mode == mtasts.ModeEnforce {
|
||||
errmsg = fmt.Sprintf("mx host %s does not match enforced mta-sts policy with hosts %s", h.Domain, strings.Join(policyHosts, ","))
|
||||
qlog.Error("mx host does not match mta-sts policy in mode enforce, skipping", mlog.Field("host", h.Domain), mlog.Field("policyhosts", policyHosts))
|
||||
continue
|
||||
}
|
||||
qlog.Error("mx host does not match mta-sts policy, but it is not enforced, continuing", mlog.Field("host", h.Domain), mlog.Field("policyhosts", policyHosts))
|
||||
}
|
||||
|
||||
qlog.Info("delivering to remote", mlog.Field("remote", h), mlog.Field("queuecid", cid))
|
||||
cid := mox.Cid()
|
||||
nqlog := qlog.WithCid(cid)
|
||||
var remoteIP net.IP
|
||||
|
||||
tlsMode := tlsModeDefault
|
||||
if policy != nil && policy.Mode == mtasts.ModeEnforce {
|
||||
tlsMode = smtpclient.TLSStrictStartTLS
|
||||
}
|
||||
permanent, badTLS, secodeOpt, remoteIP, errmsg, ok = deliverHost(nqlog, resolver, dialer, cid, ourHostname, transportName, h, &m, tlsMode)
|
||||
if !ok && badTLS && tlsMode == smtpclient.TLSOpportunistic {
|
||||
|
||||
// Try to deliver to host. We can get various errors back. Like permanent failure
|
||||
// response codes, TCP, DNSSEC, TLS (opportunistic, i.e. optional with fallback to
|
||||
// without), etc. It's a balancing act to handle these situations correctly. We
|
||||
// don't want to bounce unnecessarily. But also not keep trying if there is no
|
||||
// chance of success.
|
||||
|
||||
// Set if there TLSA records were found. Means TLS is required for this host,
|
||||
// usually with verification of the certificate.
|
||||
var daneRequired bool
|
||||
|
||||
enforceMTASTS := policy != nil && policy.Mode == mtasts.ModeEnforce
|
||||
permanent, daneRequired, badTLS, secodeOpt, remoteIP, errmsg, ok = deliverHost(nqlog, resolver, dialer, cid, ourHostname, transportName, h, enforceMTASTS, haveMX, origNextHopAuthentic, origNextHop, expandedNextHopAuthentic, expandedNextHop, &m, tlsMode)
|
||||
|
||||
// If we had a TLS-related failure when doing opportunistic (optional) TLS, and no
|
||||
// DANE records were not found, we should try again without TLS. This could be an
|
||||
// old server that only does ancient TLS versions, or has a misconfiguration. Note
|
||||
// that opportunistic TLS does not do regular certificate verification, so that can't
|
||||
// be the problem.
|
||||
if !ok && badTLS && !enforceMTASTS && tlsMode == smtpclient.TLSOpportunistic && !daneRequired {
|
||||
// In case of failure with opportunistic TLS, try again without TLS. ../rfc/7435:459
|
||||
// todo future: revisit this decision. perhaps it should be a configuration option that defaults to not doing this?
|
||||
// todo future: add a configuration option to not fall back?
|
||||
nqlog.Info("connecting again for delivery attempt without tls")
|
||||
permanent, badTLS, secodeOpt, remoteIP, errmsg, ok = deliverHost(nqlog, resolver, dialer, cid, ourHostname, transportName, h, &m, smtpclient.TLSSkip)
|
||||
tlsMode = smtpclient.TLSSkip
|
||||
permanent, _, _, secodeOpt, remoteIP, errmsg, ok = deliverHost(nqlog, resolver, dialer, cid, ourHostname, transportName, h, enforceMTASTS, haveMX, origNextHopAuthentic, origNextHop, expandedNextHopAuthentic, expandedNextHop, &m, tlsMode)
|
||||
}
|
||||
|
||||
if ok {
|
||||
nqlog.Info("delivered from queue")
|
||||
if err := queueDelete(context.Background(), m.ID); err != nil {
|
||||
@ -130,141 +207,54 @@ func deliverDirect(cid int64, qlog *mlog.Log, resolver dns.Resolver, dialer cont
|
||||
return
|
||||
}
|
||||
remoteMTA = dsn.NameIP{Name: h.XString(false), IP: remoteIP}
|
||||
if !badTLS {
|
||||
mtastsFailure = false
|
||||
}
|
||||
if permanent {
|
||||
break
|
||||
}
|
||||
}
|
||||
if mtastsFailure && policyFresh {
|
||||
permanent = true
|
||||
}
|
||||
|
||||
// In theory, we could make a failure permanent if we didn't find any mx host
|
||||
// matching the mta-sts policy AND the policy is fresh AND all DNS records leading
|
||||
// to the MX targets (including CNAME) have a TTL that is beyond the latest
|
||||
// possible delivery attempt. Until that time, configuration problems can be
|
||||
// corrected through DNS or policy update. Not sure if worth it in practice, there
|
||||
// is a good chance the MX records can still change, at least on initial delivery
|
||||
// failures.
|
||||
// todo: possibly detect that future deliveries will fail due to long ttl's of cached records that are preventing delivery.
|
||||
|
||||
fail(qlog, m, backoff, permanent, remoteMTA, secodeOpt, errmsg)
|
||||
}
|
||||
|
||||
var (
|
||||
errCNAMELoop = errors.New("cname loop")
|
||||
errCNAMELimit = errors.New("too many cname records")
|
||||
errNoRecord = errors.New("no dns record")
|
||||
errDNS = errors.New("dns lookup error")
|
||||
errNoMail = errors.New("domain does not accept email as indicated with single dot for mx record")
|
||||
)
|
||||
|
||||
// Gather hosts to try to deliver to. We start with the straight-forward MX record.
|
||||
// If that does not exist, we'll look for CNAME of the entire domain (following
|
||||
// chains if needed). If a CNAME does not exist, but the domain name has an A or
|
||||
// AAAA record, we'll try delivery directly to that host.
|
||||
// ../rfc/5321:3824
|
||||
func gatherHosts(resolver dns.Resolver, m Msg, cid int64, qlog *mlog.Log) (hosts []dns.IPDomain, effectiveDomain dns.Domain, permanent bool, err error) {
|
||||
if len(m.RecipientDomain.IP) > 0 {
|
||||
return []dns.IPDomain{m.RecipientDomain}, effectiveDomain, false, nil
|
||||
}
|
||||
|
||||
// We start out delivering to the recipient domain. We follow CNAMEs a few times.
|
||||
rcptDomain := m.RecipientDomain.Domain
|
||||
// Domain we are actually delivering to, after following CNAME record(s).
|
||||
effectiveDomain = rcptDomain
|
||||
domainsSeen := map[string]bool{}
|
||||
for i := 0; ; i++ {
|
||||
if domainsSeen[effectiveDomain.ASCII] {
|
||||
return nil, effectiveDomain, true, fmt.Errorf("%w: recipient domain %s: already saw %s", errCNAMELoop, rcptDomain, effectiveDomain)
|
||||
}
|
||||
domainsSeen[effectiveDomain.ASCII] = true
|
||||
|
||||
// note: The Go resolver returns the requested name if the domain has no CNAME record but has a host record.
|
||||
if i == 16 {
|
||||
// We have a maximum number of CNAME records we follow. There is no hard limit for
|
||||
// DNS, and you might think folks wouldn't configure CNAME chains at all, but for
|
||||
// (non-mail) domains, CNAME chains of 10 records have been encountered according
|
||||
// to the internet.
|
||||
return nil, effectiveDomain, true, fmt.Errorf("%w: recipient domain %s, last resolved domain %s", errCNAMELimit, rcptDomain, effectiveDomain)
|
||||
}
|
||||
|
||||
cidctx := context.WithValue(mox.Context, mlog.CidKey, cid)
|
||||
ctx, cancel := context.WithTimeout(cidctx, 30*time.Second)
|
||||
defer cancel()
|
||||
// Note: LookupMX can return an error and still return records: Invalid records are
|
||||
// filtered out and an error returned. We must process any records that are valid.
|
||||
// Only if all are unusable will we return an error. ../rfc/5321:3851
|
||||
mxl, err := resolver.LookupMX(ctx, effectiveDomain.ASCII+".")
|
||||
cancel()
|
||||
if err != nil && len(mxl) == 0 {
|
||||
if !dns.IsNotFound(err) {
|
||||
return nil, effectiveDomain, false, fmt.Errorf("%w: mx lookup for %s: %v", errDNS, effectiveDomain, err)
|
||||
}
|
||||
|
||||
// No MX record. First attempt CNAME lookup. ../rfc/5321:3838 ../rfc/3974:197
|
||||
ctx, cancel = context.WithTimeout(cidctx, 30*time.Second)
|
||||
defer cancel()
|
||||
cname, err := resolver.LookupCNAME(ctx, effectiveDomain.ASCII+".")
|
||||
cancel()
|
||||
if err != nil && !dns.IsNotFound(err) {
|
||||
return nil, effectiveDomain, false, fmt.Errorf("%w: cname lookup for %s: %v", errDNS, effectiveDomain, err)
|
||||
}
|
||||
if err == nil && cname != effectiveDomain.ASCII+"." {
|
||||
d, err := dns.ParseDomain(strings.TrimSuffix(cname, "."))
|
||||
if err != nil {
|
||||
return nil, effectiveDomain, true, fmt.Errorf("%w: parsing cname domain %s: %v", errDNS, effectiveDomain, err)
|
||||
}
|
||||
effectiveDomain = d
|
||||
// Start again with new domain.
|
||||
continue
|
||||
}
|
||||
|
||||
// See if the host exists. If so, attempt delivery directly to host. ../rfc/5321:3842
|
||||
ctx, cancel = context.WithTimeout(cidctx, 30*time.Second)
|
||||
defer cancel()
|
||||
_, err = resolver.LookupHost(ctx, effectiveDomain.ASCII+".")
|
||||
cancel()
|
||||
if dns.IsNotFound(err) {
|
||||
return nil, effectiveDomain, true, fmt.Errorf("%w: recipient domain/host %s", errNoRecord, effectiveDomain)
|
||||
} else if err != nil {
|
||||
return nil, effectiveDomain, false, fmt.Errorf("%w: looking up host %s because of no mx record: %v", errDNS, effectiveDomain, err)
|
||||
}
|
||||
hosts = []dns.IPDomain{{Domain: effectiveDomain}}
|
||||
} else if err != nil {
|
||||
qlog.Infox("partial mx failure, attempting delivery to valid mx records", err)
|
||||
}
|
||||
|
||||
// ../rfc/7505:122
|
||||
if err == nil && len(mxl) == 1 && mxl[0].Host == "." {
|
||||
return nil, effectiveDomain, true, errNoMail
|
||||
}
|
||||
|
||||
// The Go resolver already sorts by preference, randomizing records of same
|
||||
// preference. ../rfc/5321:3885
|
||||
for _, mx := range mxl {
|
||||
host, err := dns.ParseDomain(strings.TrimSuffix(mx.Host, "."))
|
||||
if err != nil {
|
||||
// note: should not happen because Go resolver already filters these out.
|
||||
return nil, effectiveDomain, true, fmt.Errorf("%w: invalid host name in mx record %q: %v", errDNS, mx.Host, err)
|
||||
}
|
||||
hosts = append(hosts, dns.IPDomain{Domain: host})
|
||||
}
|
||||
if len(hosts) > 0 {
|
||||
err = nil
|
||||
}
|
||||
return hosts, effectiveDomain, false, err
|
||||
}
|
||||
}
|
||||
|
||||
// deliverHost attempts to deliver m to host.
|
||||
// deliverHost updated m.DialedIPs, which must be saved in case of failure to deliver.
|
||||
func deliverHost(log *mlog.Log, resolver dns.Resolver, dialer contextDialer, cid int64, ourHostname dns.Domain, transportName string, host dns.IPDomain, m *Msg, tlsMode smtpclient.TLSMode) (permanent, badTLS bool, secodeOpt string, remoteIP net.IP, errmsg string, ok bool) {
|
||||
// deliverHost attempts to deliver m to host. Depending on tlsMode, we'll do
|
||||
// required TLS with WebPKI verification (with MTA-STS), opportunistic DANE TLS
|
||||
// (opportunistic TLS) or non-verifying TLS (opportunistic TLS) deliverHost updates
|
||||
// m.DialedIPs, which must be saved in case of failure to deliver.
|
||||
//
|
||||
// The haveMX and next-hop-authentic fields are used to determine if DANE is
|
||||
// applicable. The next-hop fields themselves are used to determine valid names
|
||||
// during DANE TLS certificate verification.
|
||||
func deliverHost(log *mlog.Log, resolver dns.Resolver, dialer smtpclient.Dialer, cid int64, ourHostname dns.Domain, transportName string, host dns.IPDomain, enforceMTASTS, haveMX, origNextHopAuthentic bool, origNextHop dns.Domain, expandedNextHopAuthentic bool, expandedNextHop dns.Domain, m *Msg, tlsMode smtpclient.TLSMode) (permanent, daneRequired, badTLS bool, secodeOpt string, remoteIP net.IP, errmsg string, ok bool) {
|
||||
// About attempting delivery to multiple addresses of a host: ../rfc/5321:3898
|
||||
|
||||
start := time.Now()
|
||||
var deliveryResult string
|
||||
defer func() {
|
||||
metricDelivery.WithLabelValues(fmt.Sprintf("%d", m.Attempts), transportName, string(tlsMode), deliveryResult).Observe(float64(time.Since(start)) / float64(time.Second))
|
||||
log.Debug("queue deliverhost result", mlog.Field("host", host), mlog.Field("attempt", m.Attempts), mlog.Field("tlsmode", tlsMode), mlog.Field("permanent", permanent), mlog.Field("badtls", badTLS), mlog.Field("secodeopt", secodeOpt), mlog.Field("errmsg", errmsg), mlog.Field("ok", ok), mlog.Field("duration", time.Since(start)))
|
||||
log.Debug("queue deliverhost result",
|
||||
mlog.Field("host", host),
|
||||
mlog.Field("attempt", m.Attempts),
|
||||
mlog.Field("tlsmode", tlsMode),
|
||||
mlog.Field("permanent", permanent),
|
||||
mlog.Field("badtls", badTLS),
|
||||
mlog.Field("secodeopt", secodeOpt),
|
||||
mlog.Field("errmsg", errmsg),
|
||||
mlog.Field("ok", ok),
|
||||
mlog.Field("duration", time.Since(start)))
|
||||
}()
|
||||
|
||||
// Open message to deliver.
|
||||
f, err := os.Open(m.MessagePath())
|
||||
if err != nil {
|
||||
return false, false, "", nil, fmt.Sprintf("open message file: %s", err), false
|
||||
return false, false, false, "", nil, fmt.Sprintf("open message file: %s", err), false
|
||||
}
|
||||
msgr := store.FileMsgReader(m.MsgPrefix, f)
|
||||
defer func() {
|
||||
@ -276,9 +266,83 @@ func deliverHost(log *mlog.Log, resolver dns.Resolver, dialer contextDialer, cid
|
||||
ctx, cancel := context.WithTimeout(cidctx, 30*time.Second)
|
||||
defer cancel()
|
||||
|
||||
conn, ip, dualstack, err := dialHost(ctx, log, resolver, dialer, host, 25, m)
|
||||
remoteIP = ip
|
||||
// We must lookup the IPs for the host name before checking DANE TLSA records. And
|
||||
// only check TLSA records for secure responses. This prevents problems with old
|
||||
// name servers returning an error for TLSA requests or letting it timeout (not
|
||||
// sending a response). ../rfc/7672:879
|
||||
var daneRecords []adns.TLSA
|
||||
var tlsRemoteHostnames []dns.Domain
|
||||
if host.IsDomain() {
|
||||
tlsRemoteHostnames = []dns.Domain{host.Domain}
|
||||
}
|
||||
if m.DialedIPs == nil {
|
||||
m.DialedIPs = map[string][]net.IP{}
|
||||
}
|
||||
metricDestinations.Inc()
|
||||
authentic, expandedAuthentic, expandedHost, ips, dualstack, err := smtpclient.GatherIPs(ctx, log, resolver, host, m.DialedIPs)
|
||||
if err == nil && authentic && origNextHopAuthentic && (!haveMX || expandedNextHopAuthentic) && host.IsDomain() {
|
||||
metricDestinationsAuthentic.Inc()
|
||||
|
||||
// Modes to skip and not verify aren't normally set when we get here. But in the
|
||||
// future may perhaps be set on a message manually after delivery failures. We can
|
||||
// handle them here.
|
||||
switch tlsMode {
|
||||
case smtpclient.TLSSkip:
|
||||
// No TLS, so clearly no DANE.
|
||||
case smtpclient.TLSUnverifiedStartTLS:
|
||||
// Fallback mode for DANE without usable records, so skip DANE.
|
||||
default:
|
||||
// Look for TLSA records in either the expandedHost, or otherwise the original
|
||||
// host. ../rfc/7672:912
|
||||
var tlsaBaseDomain dns.Domain
|
||||
daneRequired, daneRecords, tlsaBaseDomain, err = smtpclient.GatherTLSA(ctx, log, resolver, host.Domain, expandedNextHopAuthentic && expandedAuthentic, expandedHost)
|
||||
if daneRequired {
|
||||
metricDestinationDANERequired.Inc()
|
||||
}
|
||||
if err != nil {
|
||||
metricDestinationDANEGatherTLSAErrors.Inc()
|
||||
}
|
||||
if err == nil && daneRequired {
|
||||
tlsMode = smtpclient.TLSStrictStartTLS
|
||||
if len(daneRecords) == 0 {
|
||||
// If there are no usable DANE records, we still have to use TLS, but without
|
||||
// verifying its certificate. At least when there is no MTA-STS. Why? Perhaps to
|
||||
// prevent ossification? The SMTP TLSA specification has different behaviour than
|
||||
// the generic TLSA. "Usable" means different things in different places.
|
||||
// ../rfc/7672:718 ../rfc/6698:1845 ../rfc/6698:660
|
||||
if !enforceMTASTS {
|
||||
tlsMode = smtpclient.TLSUnverifiedStartTLS
|
||||
log.Debug("no usable dane records, not verifying dane records, but doing required non-verifying opportunistic tls")
|
||||
metricDestinationDANESTARTTLSUnverified.Inc()
|
||||
}
|
||||
daneRecords = nil
|
||||
} else {
|
||||
// Based on CNAMEs followed and DNSSEC-secure status, we must allow up to 4 host
|
||||
// names.
|
||||
tlsRemoteHostnames = smtpclient.GatherTLSANames(haveMX, expandedNextHopAuthentic, expandedAuthentic, origNextHop, expandedNextHop, host.Domain, tlsaBaseDomain)
|
||||
log.Debug("delivery with required starttls with dane verification", mlog.Field("allowedtlshostnames", tlsRemoteHostnames))
|
||||
}
|
||||
} else if !daneRequired {
|
||||
log.Debugx("not doing opportunistic dane after gathering tlsa records", err)
|
||||
err = nil
|
||||
}
|
||||
// else, err is propagated below.
|
||||
}
|
||||
} else {
|
||||
log.Debugx("not attempting verification with dane", err, mlog.Field("authentic", authentic), mlog.Field("expandedauthentic", expandedAuthentic))
|
||||
}
|
||||
|
||||
// Dial the remote host given the IPs if no error yet.
|
||||
var conn net.Conn
|
||||
if err == nil {
|
||||
if m.DialedIPs == nil {
|
||||
m.DialedIPs = map[string][]net.IP{}
|
||||
}
|
||||
conn, remoteIP, err = smtpclient.Dial(ctx, log, dialer, host, ips, 25, m.DialedIPs)
|
||||
}
|
||||
cancel()
|
||||
|
||||
// Set error for metrics.
|
||||
var result string
|
||||
switch {
|
||||
case err == nil:
|
||||
@ -293,7 +357,7 @@ func deliverHost(log *mlog.Log, resolver dns.Resolver, dialer contextDialer, cid
|
||||
metricConnection.WithLabelValues(result).Inc()
|
||||
if err != nil {
|
||||
log.Debugx("connecting to remote smtp", err, mlog.Field("host", host))
|
||||
return false, false, "", ip, fmt.Sprintf("dialing smtp server: %v", err), false
|
||||
return false, daneRequired, false, "", remoteIP, fmt.Sprintf("dialing smtp server: %v", err), false
|
||||
}
|
||||
|
||||
var mailFrom string
|
||||
@ -303,11 +367,21 @@ func deliverHost(log *mlog.Log, resolver dns.Resolver, dialer contextDialer, cid
|
||||
rcptTo := m.Recipient().XString(m.SMTPUTF8)
|
||||
|
||||
// todo future: get closer to timeouts specified in rfc? ../rfc/5321:3610
|
||||
log = log.Fields(mlog.Field("remoteip", ip))
|
||||
log = log.Fields(mlog.Field("remoteip", remoteIP))
|
||||
ctx, cancel = context.WithTimeout(cidctx, 30*time.Minute)
|
||||
defer cancel()
|
||||
mox.Connections.Register(conn, "smtpclient", "queue")
|
||||
sc, err := smtpclient.New(ctx, log, conn, tlsMode, ourHostname, host.Domain, nil)
|
||||
|
||||
// Initialize SMTP session, sending EHLO/HELO and STARTTLS with specified tls mode.
|
||||
var firstHost dns.Domain
|
||||
var moreHosts []dns.Domain
|
||||
if len(tlsRemoteHostnames) > 0 {
|
||||
// For use with DANE-TA.
|
||||
firstHost = tlsRemoteHostnames[0]
|
||||
moreHosts = tlsRemoteHostnames[1:]
|
||||
}
|
||||
var verifiedRecord adns.TLSA
|
||||
sc, err := smtpclient.New(ctx, log, conn, tlsMode, ourHostname, firstHost, nil, daneRecords, moreHosts, &verifiedRecord)
|
||||
defer func() {
|
||||
if sc == nil {
|
||||
conn.Close()
|
||||
@ -317,6 +391,7 @@ func deliverHost(log *mlog.Log, resolver dns.Resolver, dialer contextDialer, cid
|
||||
mox.Connections.Unregister(conn)
|
||||
}()
|
||||
if err == nil {
|
||||
// SMTP session is ready. Finally try to actually deliver.
|
||||
has8bit := m.Has8bit
|
||||
smtputf8 := m.SMTPUTF8
|
||||
var msg io.Reader = msgr
|
||||
@ -349,7 +424,7 @@ func deliverHost(log *mlog.Log, resolver dns.Resolver, dialer contextDialer, cid
|
||||
deliveryResult = "error"
|
||||
}
|
||||
if err == nil {
|
||||
return false, false, "", ip, "", true
|
||||
return false, daneRequired, false, "", remoteIP, "", true
|
||||
} else if cerr, ok := err.(smtpclient.Error); ok {
|
||||
// If we are being rejected due to policy reasons on the first
|
||||
// attempt and remote has both IPv4 and IPv6, we'll give it
|
||||
@ -359,8 +434,8 @@ func deliverHost(log *mlog.Log, resolver dns.Resolver, dialer contextDialer, cid
|
||||
if permanent && m.Attempts == 1 && dualstack && strings.HasPrefix(cerr.Secode, "7.") {
|
||||
permanent = false
|
||||
}
|
||||
return permanent, errors.Is(cerr, smtpclient.ErrTLS), cerr.Secode, ip, cerr.Error(), false
|
||||
return permanent, daneRequired, errors.Is(cerr, smtpclient.ErrTLS), cerr.Secode, remoteIP, cerr.Error(), false
|
||||
} else {
|
||||
return false, errors.Is(cerr, smtpclient.ErrTLS), "", ip, err.Error(), false
|
||||
return false, daneRequired, errors.Is(cerr, smtpclient.ErrTLS), "", remoteIP, err.Error(), false
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user