svn/view/checkdane.bash

#!/bin/bash
set -e

debug=0

ehlo=pro5s2.nethence.com
#ehlo=`curl -s ip.nethence.com | sed -n 1p | awk '{print $NF}' | sed 's/\.$//'`
echo using $ehlo as EHLO

function checkdane {
        #no need for backspace as we are going to pass $rrdata without double-quotes
        #also the carriage-return becomes a space when ever there are multiple lines
        #
        #note: grabbing all the lines here, not only the first one
        rrdataraw=`host -4 -t TLSA _25._tcp.$mx`

        #single line output if it's an alias
        #_25._tcp.lsmhosting.com is an alias for lsmhosting.com.
        #_25._tcp.mx1.sleepingamongstdragons.com is an alias for link.sleepingamongstdragons.com.
        tmp=`echo "$rrdataraw" | grep ' is an alias for '`
        if [[ -n $tmp ]]; then
                thatalias=`echo $tmp | awk '{print $NF}'`
                echo -en "$mx\talias $thatalias\t"
                #some are truly doing TLSA on aliases.  therefore we need to re-process those
                rrdataraw=`host -4 -t TLSA $thatalias`
        fi
        unset tmp
        rrdata=`echo "$rrdataraw" | cut -d' ' -f5- | tr -dc '[\n\r 0-9A-Fa-f]'`

        #Host _25._tcp.mxhost1.obacks.com not found: 3(NXDOMAIN)
        if [[ $rrdata = 3DA ]]; then
                #most of the hosts will respond that
                (( debug == 1 )) && echo -e "$mx\tnxdomain"
        #Host _25._tcp.tamucc-edu.mail.protection.outlook.com not found: 2(SERVFAIL)
        elif [[ $rrdata = 2EFA ]]; then
                (( debug == 1 )) && echo -e "$mx\tservfail"
        #;; connection timed out; no servers could be reached
        elif [[ "$rrdata" = " ee cd be eaced" ]]; then
                echo -e "$mx\ttimeout"
        #_25._tcp.ip-104-238-92-85.ip.secureserver.net has no TLSA record
        elif [[ $rrdata = ecd ]]; then
                echo -e "$mx\tnotlsa"
        elif (( `echo "$rrdata" | head -1 | cut -f4 -d' ' | wc -c` == 57 )); then
                echo -e "$mx\tTHIS-LOOKS-LIKE-DANE"
                echo -e "$mx\tTHIS-LOOKS-LIKE-DANE" >> $piece.dane.results
                rraddon=`echo "$rrdata" | sed 's/^/-dane_tlsa_rrdata "/; s/$/"/'`
                result=`echo Q | eval /usr/local/bin/openssl s_client -verify_depth 5 \
                -starttls smtp -name $ehlo -connect $mx:25 \
                -crlf -dane_tlsa_domain $mx $rraddon -dane_ee_no_namechecks 2>/dev/null | grep -E 'Verif|^DANE'`
                echo "$result" | grep 'Verify return code' >> $piece.dane.results
                echo -e "$result\n$rrdata\n" >> $piece.dane.results
                unset rraddon
        else
                echo -e "$mx\tSOME-WEIRD-SHIT"
                echo -e "$mx\tSOME-WEIRD-SHIT" >> $piece.dane.weird
                echo "$rrdata" >> $piece.dane.weird
        fi

        unset rrdata
        [[ -n $thatalias ]] && unset thatalias
}

function processpiece {
        echo writing to $piece.dane
        for mx in `cat $piece`; do
                checkdane
        done > $piece.dane; unset mx
}

#echo -n entering domains/mx/dane/ ...
#mkdir -p domains/mx/dane/
#cd domains/mx/dane/

#echo -n splitting mx.unique into 50 pieces...
#split -a2 -d -nl/50 ../mx.unique mx.unique && echo done

#real    206m52.516s
#user    81m7.876s
#sys     31m9.614s
echo -n starting 50 processes to process those...
#for piece in test; do
for piece in mx.unique[0-9][0-9]; do
        processpiece &
done && echo done; unset piece
ps auxfww | grep checkdane | grep -v grep
cat <<EOF

watch live with

        ps auxfww | grep checkdane | grep -v grep
        cd mass/splitted/domains/mx/dane/
        tail -F *.dane

EOF
time wait
