22

✏️ Editing: enable_spf_dkim_globally

#!/usr/local/cpanel/3rdparty/bin/perl

# cpanel - scripts/enable_spf_dkim_globally        Copyright 2022 cPanel, L.L.C.
#                                                           All rights reserved.
# copyright@cpanel.net                                         http://cpanel.net
# This code is subject to the cPanel license. Unauthorized copying is prohibited

package scripts::enable_spf_dkim_globally;

use strict;
use warnings;

use Cpanel::SPF                     ();
use Cpanel::DKIM::Transaction       ();
use Cpanel::Logger                  ();
use Cpanel::Config::Users           ();
use Cpanel::Config::CpUserGuard     ();
use Cpanel::Config::LoadCpUserFile  ();
use Cpanel::DnsUtils::AskDnsAdmin   ();
use Cpanel::DnsUtils::Fetch         ();
use Cpanel::PwCache::Build          ();
use Cpanel::ZoneFile                ();
use Cpanel::Config::LoadUserDomains ();
use Cpanel::ServerTasks             ();
use Getopt::Long                    ();

my $DOMAINS_TO_RELOAD_EACH_CALL    = 2048;
my $DKIM_RECORD_NAME_PREFIX        = 'default._domainkey.';
my $DKIM_RECORD_NAME_PREFIX_LENGTH = length $DKIM_RECORD_NAME_PREFIX;

our $logger;
our @USERS = ();

sub new {
    my $pkg = shift;
    return bless {
        domains_by_user => scalar Cpanel::Config::LoadUserDomains::loaduserdomains( undef, 0, 1 ),
        reload_zones    => [],
    }, $pkg;
}

sub as_script {
    my $self = shift;

$logger //= Cpanel::Logger->new();

my $execute;
    Getopt::Long::GetOptions(
        "user=s" => \@USERS,
        "x"      => \$execute,
    );

if ( not $execute ) {
        my $msg = qq{To execute, use the -x flag.};
        $logger->die($msg);
    }

$self->run();

return 1;
}

sub run {
    my $self         = shift;
    my $options_href = shift;    # { users => [qw/user1 user2/] }

$logger //= Cpanel::Logger->new();

my @users =
      ( exists $options_href->{user} and @{ $options_href->{user} } ) ?    #
      @{ $options_href->{user} }
      :                                                                    #
      scalar @USERS ?                                                      #
      @USERS
      :                                                                    #
      Cpanel::Config::Users::getcpusers();                                 #

Cpanel::PwCache::Build::init_passwdless_pwcache() if scalar @users > 5;

my $domains_by_user = $self->{domains_by_user};

USERS:
    foreach my $user (@users) {

unless ( exists $domains_by_user->{$user} ) {
            $logger->warn(qq{Invalid user "$user", skipping.});
            next USERS;
        }

my $users_domains_ref = $domains_by_user->{$user};

$self->_enable_spf_dkim_cpusers_file($user);

my $zone_ref = Cpanel::DnsUtils::Fetch::fetch_zones( 'zones' => $users_domains_ref );

$self->_setup_spf_for_all_users_domains( $user, $zone_ref );

$zone_ref = Cpanel::DnsUtils::Fetch::fetch_zones( 'zones' => $users_domains_ref );    # Need to fetch again in case setup_spf has modified them

$self->_setup_dkim_for_users_domains_without_it( $user, $zone_ref );

push @{ $self->{'reload_zones'} }, grep { exists $zone_ref->{$_} } @$users_domains_ref;
    }

$self->_reload_zones();

Cpanel::ServerTasks::queue_task( ['DKIMTasks'], 'refresh_entire_dkim_validity_cache' );

return 1;
}

sub _setup_spf_for_all_users_domains {
    my ( $self, $user, $zone_ref ) = @_;

my $users_domains_ref = $self->{domains_by_user}->{$user};

# set up SPF on all domains owned by $users
    my ( $status, $msg ) = Cpanel::SPF::setup_spf(
        'user'       => $user,
        'preserve'   => 1,
        'skipreload' => 1,
        'zone_ref'   => $zone_ref
    );
    $logger->warn(qq{Failed to set up SPF for $user: $msg}) unless $status;
    return $status;
}

sub _setup_dkim_for_users_domains_without_it {
    my ( $self, $user, $zone_ref ) = @_;

my $users_domains_ref       = $self->{domains_by_user}->{$user};
    my $seen_dkim_for_domain_hr = _find_domains_that_have_dkim_installed($zone_ref);

foreach my $domain (@$users_domains_ref) {
        if ( $seen_dkim_for_domain_hr->{$domain} ) {
            $logger->info(qq{"default._domainkey" DKIM TXT record detected for $domain, skipping.});
        }
    }

my @domains_to_setup_dkim_on = grep { !$seen_dkim_for_domain_hr->{$_} } @$users_domains_ref;
    if (@domains_to_setup_dkim_on) {

my $dkim = Cpanel::DKIM::Transaction->new();

my @w;

my $result = do {
            local $SIG{'__WARN__'} = sub { push @w, @_ };

$dkim->set_up_user_domains(
                $user,
                \@domains_to_setup_dkim_on,
                $zone_ref,
            );
        };

$dkim->commit();

if ( !$result || !$result->was_any_success() ) {
            $logger->warn(qq{Failed to set up DKIM for $user: @w});
        }

return $result->was_any_success();
    }
    return;
}

sub _enable_spf_dkim_cpusers_file {
    my ( $self, $user ) = @_;
    my $cpuser_data = Cpanel::Config::LoadCpUserFile::loadcpuserfile($user);
    if ( !$cpuser_data->{'HASSPF'} || !$cpuser_data->{'HASDKIM'} ) {

# check each domain to make sure that we don't overwrite SPF
        my $lock = Cpanel::Config::CpUserGuard->new($user);
        $lock->{data}{HASSPF}  = 1;
        $lock->{data}{HASDKIM} = 1;
        $lock->save;
    }
    return 1;
}

sub _reload_zones {
    my ($self) = @_;

while ( @{ $self->{'reload_zones'} } ) {
        Cpanel::DnsUtils::AskDnsAdmin::askdnsadmin( 'RELOADZONES', 0, join( ',', splice( @{ $self->{'reload_zones'} }, 0, $DOMAINS_TO_RELOAD_EACH_CALL ) ) );
    }
    return 1;
}

sub _find_domains_that_have_dkim_installed {
    my ($zone_ref) = @_;

my %seen_dkim_for_domain;

foreach my $zone ( keys %$zone_ref ) {
        my $dkim_records_ar = _get_dkim_records_from_zone_ref( $zone, $zone_ref->{$zone} );
        foreach my $record (@$dkim_records_ar) {
            my $record_name_without_prefix = substr( $record->{'name'}, $DKIM_RECORD_NAME_PREFIX_LENGTH );
            my $domain                     = _convert_zone_name_to_domain( $record_name_without_prefix, $zone );
            $seen_dkim_for_domain{$domain} = 1;
        }
    }

return \%seen_dkim_for_domain;
}

sub _get_dkim_records_from_zone_ref {
    my ( $zone, $zone_contents_ar ) = @_;
    my $zone_obj = Cpanel::ZoneFile->new( 'domain' => $zone, 'text' => $zone_contents_ar );
    return [ grep { index( $_->{'name'}, $DKIM_RECORD_NAME_PREFIX ) == 0 } $zone_obj->find_records( { 'type' => 'TXT' } ) ];

}

sub _convert_zone_name_to_domain {
    my ( $zone_name_record, $zone ) = @_;

# If the name does not end with a . we must append .$zone
    if ( substr( $zone_name_record, -1 ) eq '.' ) {
        return substr( $zone_name_record, 0, -1 );    # strip tailing .
    }
    return $zone_name_record . '.' . $zone;
}

if ( not caller() ) {
    my $enable = scripts::enable_spf_dkim_globally->new();
    $enable->as_script;
    exit 0;
}

__END__

=head1 NAME

/scripts/enable_spf_dkim_globally

=head1 USAGE AS A SCRIPT

/scripts/enable_spf_dkim_globally -x [--user=<user1>] [--user=<user2>] ... [--user=<userN>]

=head2 AS A LIBRARY

This script is internally written as a modulino, which means it can be C<require>'d:

use strict;
  require q{/scripts/enable_spf_dkim_globally};
  my $enable = scripts::enable_spf_dkim_globally->new();
  $enable->run();                                       # globally enable, iterate over domains from all users
  $enable->run( { user => [qw/username1 username2/] }); # globally enable, iterate over domains from list of specified users

=head1 DESCRIPTION

This script enables C<SPF> and C<DKIM> system-wide, and it adds respective C<DNS> entries for all domains
if none exist. If a C<DKIM DNS> record is detected for a domain, it remains untouched. If a C<SPF>
record exists, it is updated.

The scope of the domains that are affected with new C<DKIM>/C<SPF> or updated C<SPF> records may be limited
by using the C<--user> flag to specify one or more users from whom the list of domains to affect is generated.

=head1 REQUIRED COMMAND LINE ARGUMENTS

=over 4

=item -x

Use this option to actually run the script, otherwise it will warn and return
without doing anything.

=back

=head1 COMMAND LINE OPTIONS

=over 4

=item --user C<username>

Specify a user or list of users for whom all domains are enabled rather than all user
accounts on the system. Specify more than one user by using one C<--user> per username.

For example,

/scripts/enable_spf_dkim_globally -x --user="username1" --user="username2"

If no users are specified, all domains for all user accounts on the system are enabled.

=back

=head1 DIAGNOSTICS

None

=head1 EXIT STATUS

Exit status is 0 (success) unless an unexpected error occurs.

=head1 DEPENDENCIES

None

=head1 INCOMPATIBILITIES

None

=head1 BUGS AND LIMITATIONS

None

MR SKB