Method: SPF::Server#select_record

Defined in:

lib/spf/eval.rb

#select_record(request, loose_match = false) ⇒ Object

# File 'lib/spf/eval.rb', line 176

def select_record(request, loose_match = false)
  domain   = request.authority_domain
  versions = request.versions
  scope    = request.scope

  # Employ identical behavior for 'v=spf1' and 'spf2.0' records, both of
  # which support SPF (code 99) and TXT type records (this may be different
  # in future revisions of SPF):
  # Query for SPF type records first, then fall back to TXT type records.

  records       = []
  loose_records = []
  query_count   = 0
  dns_errors    = []

  # Query for SPF-type RRs first:
  if (@query_rr_types == QUERY_RR_TYPE_ALL or
      @query_rr_types & QUERY_RR_TYPE_SPF)
    begin
      query_count += 1
      packet = self.dns_lookup(domain, 'SPF')
      matches = self.get_acceptable_records_from_packet(
        packet, 'SPF', versions, scope, domain, loose_match)
      records << matches[0]
      loose_records << matches[1]
    rescue SPF::DNSError => e
      dns_errors << e
    #rescue SPF::DNSTimeout => e
    #  # FIXME: Ignore DNS timeouts on SPF type lookups?
    #  # Apparently some brain-dead DNS servers time out on SPF-type queries.
    end
  end

  if (not records.flatten.any? and
      @query_rr_types == QUERY_RR_TYPE_ALL or
      @query_rr_types & QUERY_RR_TYPE_TXT)
    # NOTE:
    #   This deliberately violates RFC 4406 (Sender ID), 4.4/3 (4.4.1):
    #   TXT-type RRs are still tried if there _are_ SPF-type RRs but all
    #   of them are inapplicable (e.g. "Hi!", or even "spf2/pra" for an
    #   'mfrom' scope request).  This conforms to the spirit of the more
    #   sensible algorithm in RFC 4408 (SPF), 4.5.
    #   Implication:  Sender ID processing may make use of existing TXT-
    #   type records where a result of "None" would normally be returned
    #   under a strict interpretation of RFC 4406.
   
    begin
      query_count += 1
      packet = self.dns_lookup(domain, 'TXT')
      matches = self.get_acceptable_records_from_packet(
        packet, 'TXT', versions, scope, domain, loose_match)
      records << matches[0]
      loose_records << matches[1]
    rescue SPF::DNSError => e
      dns_errors << e
    end

    # Unless at least one query succeeded, re-raise the first DNS error that occured.
    raise dns_errors[0] unless dns_errors.length < query_count

    records.flatten!
    loose_records.flatten!

    if records.empty?
      # RFC 4408, 4.5/7
      raise SPF::NoAcceptableRecordError.new('No applicable sender policy available',
                                             loose_records)
    end

    # Discard all records but the highest acceptable version:
    preferred_record_class = records[0].class

    records = records.select { |record| preferred_record_class === record }

    if records.length != 1
      # RFC 4408, 4.5/6
      raise SPF::RedundantAcceptableRecordsError.new(
        "Redundant applicable '#{preferred_record_class.version_tag}' sender policies found",
        records
      )
    end

    return records[0]
  end
end