Edit: /opt/dedrads/update_spf (14972B)
#!/usr/lib/rads/venv/bin/python3
"""SPF record updater"""
# Vanessa Vasile, InMotion Hosting, Oct 2017
# ref: https://trac.imhtech.net/T3/ticket/18096
from argparse import ArgumentParser, Action, ArgumentTypeError as BadArg
import platform
import sys
from typing import Literal
from subprocess import CalledProcessError, check_output
from collections import OrderedDict
from cpapis import whmapi1, cpapi2, CpAPIError
from rads import cpuser_safe
from rads.color import red, yellow, green, magenta, blue
HOSTNAME = platform.node()
SPAMEXP_HOSTNAME = 'smtp.servconfig.com'
def get_args() -> (
tuple[Literal['create', 'update', 'delete'], bool, str, list[str]]
):
"""Arg Parser"""
parser = ArgumentParser(description='Configures SPF records')
actions_group = parser.add_mutually_exclusive_group(required=True)
targets_group = parser.add_mutually_exclusive_group(required=True)
# fmt: off
actions_group.add_argument(
'--create', '-c', action='store_const', const='create', dest='action',
help='Creates a new SPF record and applies it. '
'Will overwrite an existing one.',
)
actions_group.add_argument(
'--update', '-r', action='store_const', const='update', dest='action',
help='Updates the existing SPF record to be correct',
)
parser.add_argument(
'--show-only', '-s', action='store_true',
help='Do not apply the new record, just show it',
)
actions_group.add_argument(
'--delete', '-x', action='store_const', const='delete', dest='action',
help='Deletes an SPF TXT record',
)
targets_group.add_argument(
'--user', '-u', action=SetUserAction,
help='Update all domains (main, addon, parked) for this user',
)
targets_group.add_argument(
'--domain', '-d', action=SetDomainAction, dest='domains',
help='Domain to update',
)
# fmt: on
args = parser.parse_args()
return args.action, args.show_only, args.user, args.domains
class SetUserAction(Action):
def __call__(self, parser, namespace, values, option_string=None):
user: str = values
if not cpuser_safe(user):
raise BadArg(f"{user} is not a valid cPanel user or is restricted")
try:
api = cpapi2('DomainLookup::getbasedomains', user)
domains = [x['domain'] for x in api['cpanelresult']['data']]
except Exception as exc:
print(type(exc).__name__, exc, file=sys.stderr)
raise BadArg("Error getting domain list from cpapi2") from exc
setattr(namespace, 'domains', domains)
setattr(namespace, 'user', user)
class SetDomainAction(Action):
def __call__(self, parser, namespace, values, option_string=None):
domain: str = values
user = whoowns(domain)
if not user:
raise BadArg(f"{domain} is not owned by a user on the system")
if not cpuser_safe(user):
raise BadArg(f"{user} is a restricted user")
setattr(namespace, 'domains', [domain])
def err_msg(msg: str) -> None:
print(red(msg), file=sys.stderr)
def main():
action, show_only, user, domains = get_args()
spf_data: dict[str, tuple[int, str]] = {}
for domain in domains:
spf_data.update(get_spf(domain))
if user is None and not spf_data and action != 'create':
# if user is None, --domain / -d was used
err_msg(
f"{domains[0]} does not have an SPF record. "
"Use --create/-c instead"
)
sys.exit(1)
mail_ips, domain_mail_ips = get_mail_ips(list(spf_data.keys()))
if action == 'update':
for domain, (line_num, txtdata) in spf_data.items():
new_record = generate_spf(
existing_spf=txtdata,
mail_ips=mail_ips,
domain=domain,
domain_ip=domain_mail_ips.get(domain, None),
overwrite=False,
)
print(blue(f"{domain}:"))
print(magenta(f'\tExisting: "{txtdata}"'))
if show_only:
print(yellow(f'\tNew: "{new_record}"'))
continue
print(green(f'\tNew: "{new_record}"'))
update_zone(domain, domain, line_num, new_record)
elif action == 'create':
for domain in domains:
line_num, txtdata = spf_data.get(domain, (None, None))
new_record = generate_spf(
existing_spf=None,
mail_ips=mail_ips,
domain=domain,
domain_ip=domain_mail_ips.get(domain, None),
overwrite=True,
)
print(blue(f"{domain}:"))
print(magenta(f'\tExisting: "{txtdata}"'))
if show_only:
print(yellow(f'\tNew: "{new_record}"'))
continue
print(green(f'\tNew: "{new_record}"'))
if txtdata is None: # add new record
update_zone(domain, domain, None, new_record)
else: # update existing
update_zone(domain, domain, line_num, new_record)
elif action == 'delete':
for domain, (line_num, txtdata) in spf_data.items():
print(blue(f"{domain}:"))
print(magenta(f'\tExisting: "{txtdata}"'))
if show_only:
continue
delete_spf(domain, txtdata)
else:
raise RuntimeError(f"{action=}")
def get_mail_ips(domains: list[str]) -> tuple[list[str], dict[str, str]]:
"""Pulls relevant data"""
mail_ips = []
for path in ('/var/cpanel/mainip', '/var/cpanel/mainips/root'):
try:
with open(path, encoding='utf-8') as file:
for line in file:
mail_ips.append(line.strip())
except OSError:
pass
domain_mail_ips = {}
try:
with open('/etc/mailips', encoding='utf-8') as file:
for line in file:
dom, ipaddr = line.strip().split(':')
if dom in domains:
domain_mail_ips[dom] = ipaddr.strip()
except ValueError:
err_msg('/etc/mailips is incorrectly formatted')
sys.exit(1)
except OSError:
pass
return mail_ips, domain_mail_ips
def whoowns(domain: str) -> str:
"""Obtain the cPanel user owning a domain"""
try:
user = check_output(
['/usr/local/cpanel/scripts/whoowns', domain], encoding='utf-8'
)
except CalledProcessError:
return ''
return user.strip()
def get_spf(domain: str) -> dict[str, tuple[int, str]]:
"""Gets the SPF record for a domain"""
try:
api = whmapi1('dumpzone', {"domain": domain}, check=True)
except CpAPIError as exc:
err_msg(str(exc))
return {}
spf_records = {}
for data in api['data']['zone'][0]['record']:
data: dict
record_type: str = data.get('type', '')
txtdata: str = data.get('txtdata', '')
if 'TXT' not in record_type or 'v=spf1' not in txtdata:
continue
line: int = data['Line']
name: str = data['name'].rstrip('.')
# If we have a duplicate key, error out. This is invalid.
if name in spf_records:
err_msg(
f"Duplicate SPF record for {name} Resolve this manually, "
"then re-run the utility"
)
sys.exit(1)
spf_records[name] = (line, txtdata)
return spf_records
def update_zone(domain: str, name: str, line: int, content: str) -> None:
"""Updates the DNS zone"""
if not name.endswith('.'):
name = name + '.'
args = {
'domain': domain,
'name': name,
'class': 'IN',
'ttl': 900,
'type': 'TXT',
'txtdata': content,
}
try:
if line is not None: # We're updating an existing record
whmapi1('editzonerecord', args | {'line': line}, check=True)
else: # We're creating a new zone record
whmapi1('addzonerecord', args, check=True)
except CpAPIError as exc:
print(red(f'\tError updating zone: {exc}'))
def delete_spf(domain: str, line: str) -> None:
"""Deletes an SPF record"""
try:
whmapi1('removezonerecord', {'zone': domain, 'line': line}, check=True)
except CpAPIError as exc:
print(red(f'\tError updating zone: {exc}'))
else:
print(green('\tSPF TXT record removed'))
def generate_spf(
*,
mail_ips: list[str],
existing_spf: str,
domain: str,
domain_ip: str | None,
overwrite: bool,
):
"""Generates the SPF record"""
# The only difference between 'creating' and 'updating' a record is
# 'updating' will ignore stuff that's already in the record,
# unless it's wrong
if overwrite or existing_spf is None:
# If we're overwriting the record, we don't really care what's in it
# This is the default record to include SE and server hostname
# (all mail ips on this server)
if domain_ip:
new_record = 'v=spf1 +a +mx +a:{} +a:{} +ip4:{} ~all'.format(
HOSTNAME,
SPAMEXP_HOSTNAME,
domain_ip,
)
else:
new_record = 'v=spf1 +a +mx +a:{} +a:{} ~all'.format(
HOSTNAME,
SPAMEXP_HOSTNAME,
)
return new_record
# If we have a record already, split it up so it's easier to parse
parts = existing_spf.split()
# Now we have to further split each part into sections
# See: http://www.openspf.org/SPF_Record_Syntax
mechanisms = ['+', '-', '~', '?']
data = OrderedDict()
index = 0
for part in parts:
if part.startswith('v='):
data['version'] = {'mech': '', 'qual': '', 'val': part}
index += 1
continue
# Check for modifiers
if part.startswith('redirect='):
_, val = part.split('=')
if val != '':
# If we have a modifier, we can basically just generate a
# new record
new_record = 'v=spf1 redirect=%s' % (val)
return new_record
# If we're missing a value though, remove this entirely
continue
if part.startswith('exp='):
_, val = part.split('=')
if val != '':
data['exp'] = {'mech': '', 'qual': '', 'val': 'exp=%s' % val}
continue
# If the part starts with a mechanism...
if any(part.startswith(m) for m in mechanisms):
mech = part[0]
part = part.lstrip(part[0])
else:
mech = ''
# If the part contains a ":", add a value. Otherwise replace with a ''
if ':' in part:
qual, val = part.split(':')
else:
qual = part
val = ''
data[index] = {'mech': mech, 'qual': qual, 'val': val}
index += 1
# This is where we actually generate the record
present = {
'version': False,
'server_host': False,
'domain_mx': False,
'domain_a': False,
'domain_mailip': False,
'se_host': False,
'pass_fail': False,
}
delete = []
for key, value in data.items():
# ipv4 that matches mailips or domain ip
if value['qual'] == 'ip4':
if value['val'] in mail_ips:
delete.append(key)
if domain_ip is None:
# we don't need this value if the domain uses a shared IP
present['domain_mailip'] = True
else:
if value['val'] == domain_ip:
present['domain_mailip'] = True
# Other servers' hostnames of ours
if value['val'] not in (HOSTNAME, SPAMEXP_HOSTNAME):
if (
'inmotionhosting.com' in value['val']
or 'webhostinghub.com' in value['val']
or 'servconfig.com' in value['val']
):
delete.append(key)
# version
if value['qual'] == '' and "v=" in value['val']:
present['version'] = True
# domain, server, & SE hostnames
if value['qual'] == 'a':
if value['val'] == HOSTNAME:
present['server_host'] = True
if value['val'] == SPAMEXP_HOSTNAME:
present['se_host'] = True
if value['val'] == domain or value['val'] == '':
present['domain_a'] = True
# The domain's MX
if value['qual'] == 'mx':
if value['val'] == domain or value['val'] == '':
present['domain_mx'] = True
# action
if value['qual'] == "all":
present['pass_fail'] = True
data['pass'] = value
if isinstance(key, int): # delete the numerical key
delete.append(key)
for item in delete:
data.pop(item)
# Add anything that's missing
if not present['domain_mailip'] and domain_ip is not None:
data[index] = {'mech': '+', 'qual': 'a', 'val': domain_ip}
index += 1
if not present['version']:
data['version'] = {'mech': '', 'qual': '', 'val': 'v=spf1'}
index += 1
if not present['server_host']:
data[index] = {'mech': '+', 'qual': 'a', 'val': HOSTNAME}
index += 1
if not present['se_host']:
data[index] = {'mech': '+', 'qual': 'a', 'val': SPAMEXP_HOSTNAME}
index += 1
if not present['domain_a']:
data[index] = {'mech': '+', 'qual': 'a', 'val': ''}
index += 1
if not present['domain_mx']:
data[index] = {'mech': '+', 'qual': 'mx', 'val': ''}
index += 1
if not present['pass_fail']:
data['pass'] = {'mech': '~', 'qual': 'all', 'val': ''}
index += 1
# Now put all the parts together to make a new SPF record
new_map = []
new_map.append(data['version']) # version first
for key, val in sorted(data.items()):
if isinstance(key, int):
new_map.append(val)
# The pass/fail and exp modifier should be last
try:
new_map.append(data['pass'])
except KeyError:
pass
try:
new_map.append(data['exp'])
except KeyError:
pass
# Now put all the SPF elements together
data = [] # reuse this one
for item in new_map:
if item['mech'] != '':
if item['qual'] != '':
line = '{}{}'.format(item['mech'], item['qual'])
else:
line = item['mech']
else:
line = '%s' % item['qual']
if item['val'] != '' and item['qual'] != '':
line = '{}:{}'.format(line, item['val'])
else:
line = '{}{}'.format(line, item['val'])
data.append(line.strip())
new_record = ' '.join(data)
return new_record
if __name__ == "__main__":
main()