LoginSignup
0
0

More than 3 years have passed since last update.

@idani(井谷 茂寛)

メールフォームでメールアドレスのドメインをDNS-over-HTTPS (DoH)でチェックするカスタムバリデーションを作成する

Last updated at Posted at 2020-01-31

目的

メールフォームから登録されるメールアドレスが、入力間違いがないかチェックをしたい。
メールアドレスのドメインをDNSに問い合わせを行って、間違ったドメインでないか確認をする。

Symfonyのバリデーションでデフォルトであるのでは？

Symfonyのバリデーションを見ていると、Emailでのバリデーションが用意されています。

Ver 4.2で非推奨になりましたが、以前は、EmailバリデーションのオプションでcheckHostやcheckMXを渡すことで、HostやMXのチェックしてくれたようです。

image.png

しかし、ネットワーク状況によって安定しないので非推奨になったということです。

実装を見てみると、PHPの標準関数のcheckdnsrrでシンプルに作られています。

symfony/src/Symfony/Component/Validator/Constraints/EmailValidator.php
    /**
     * Check DNS Records for MX type.
     */
    private function checkMX(string $host): bool
    {
        return '' !== $host && checkdnsrr($host, 'MX');
    }

    /**
     * Check if one of MX, A or AAAA DNS RR exists.
     */
    private function checkHost(string $host): bool
    {
        return '' !== $host && ($this->checkMX($host) || (checkdnsrr($host, 'A') || checkdnsrr($host, 'AAAA')));
    }

DNS-over-HTTPS (DoH) について

DNSをHTTPSで検索できるそうです。

参考にさせていただいたのは以下の記事。

@usullaさんのスライドに実装まで書いてあるので参考にさせてもらいました。

curlで試してみる。

GoogleのJsonでのサンプルがありますので、レスポンス情報など実感を掴むため操作してみます。


% curl -i 'https://dns.google/resolve?name=example.com&type=a&do=1'
HTTP/2 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
date: Fri, 31 Jan 2020 09:18:02 GMT
expires: Fri, 31 Jan 2020 09:18:02 GMT
cache-control: private, max-age=7189
content-type: application/x-javascript; charset=UTF-8
server: HTTP server (unknown)
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
accept-ranges: none
vary: Accept-Encoding

{"Status": 0,"TC": false,"RD": true,"RA": true,"AD": true,"CD": false,"Question":[ {"name": "example.com.","type": 1}],"Answer":[ {"name": "example.com.","type": 1,"TTL": 7189,"data": "93.184.216.34"},{"name": "example.com.","type": 46,"TTL": 7189,"data": "a 8 2 86400 1582004640 1580178069 5418 example.com. Y0/Mb+trXbRNs2YCCVBhwkGNQmYmcmgxahO4aAe70OMX4Z/AyWjHLZuxFyEIZSpWhfbiJXaNFn3ZCt6nUoHhbATrsNsIMhass8y3lJB1/Ka4MvsK2iISctdVZ8oQ77S+fTB5lZXZEV5K94hazNavmt3oBb4MIX7sKS1iE/MPRxs="}],"Additional":[]}%

レスポンスが見づらいので整形します。

{
    "Status": 0,
    "TC": false,
    "RD": true,
    "RA": true,
    "AD": true,
    "CD": false,
    "Question": [
        {
            "name": "example.com.",
            "type": 1
        }
    ],
    "Answer": [
        {
            "name": "example.com.",
            "type": 1,
            "TTL": 7189,
            "data": "93.184.216.34"
        },
        {
            "name": "example.com.",
            "type": 46,
            "TTL": 7189,
            "data": "a 8 2 86400 1582004640 1580178069 5418 example.com. Y0/Mb+trXbRNs2YCCVBhwkGNQmYmcmgxahO4aAe70OMX4Z/AyWjHLZuxFyEIZSpWhfbiJXaNFn3ZCt6nUoHhbATrsNsIMhass8y3lJB1/Ka4MvsK2iISctdVZ8oQ77S+fTB5lZXZEV5K94hazNavmt3oBb4MIX7sKS1iE/MPRxs="
        }
    ],
    "Additional": []
}

JSON API for DNS over HTTPS (DoH)のドキュメントをみると、Typeで問い合わせを変更できるようです。

TypeにMXを指定してみます。ドメインもexampleだとつまらないので、自分のドメインにしてみます。

% curl -i 'https://dns.google/resolve?name=hirotae.com&type=mx&do=1'
HTTP/2 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
date: Fri, 31 Jan 2020 09:22:43 GMT
expires: Fri, 31 Jan 2020 09:22:43 GMT
cache-control: private, max-age=1199
content-type: application/x-javascript; charset=UTF-8
server: HTTP server (unknown)
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
accept-ranges: none
vary: Accept-Encoding

{"Status": 0,"TC": false,"RD": true,"RA": true,"AD": false,"CD": false,"Question":[ {"name": "hirotae.com.","type": 15}],"Answer":[ {"name": "hirotae.com.","type": 15,"TTL": 1199,"data": "10 hirotae.com."}],"Additional":[],"Comment": "Response from 13.113.251.9."}

きちんとAnswerに回答が入っています。

{
    "Status": 0,
    "TC": false,
    "RD": true,
    "RA": true,
    "AD": false,
    "CD": false,
    "Question": [
        {
            "name": "hirotae.com.",
            "type": 15
        }
    ],
    "Answer": [
        {
            "name": "hirotae.com.",
            "type": 15,
            "TTL": 1199,
            "data": "10 hirotae.com."
        }
    ],
    "Additional": [],
    "Comment": "Response from 13.113.251.9."
}

typeに255を設定すると全て問い合わせをしてくれるようなので試してみます。

% curl -i 'https://dns.google/resolve?name=hirotae.com&type=255&do=1'
HTTP/2 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
date: Fri, 31 Jan 2020 09:24:55 GMT
expires: Fri, 31 Jan 2020 09:24:55 GMT
cache-control: private, max-age=1199
content-type: application/x-javascript; charset=UTF-8
server: HTTP server (unknown)
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
accept-ranges: none
vary: Accept-Encoding

{"Status": 0,"TC": false,"RD": true,"RA": true,"AD": false,"CD": false,"Question":[ {"name": "hirotae.com.","type": 255}],"Answer":[ {"name": "hirotae.com.","type": 1,"TTL": 1199,"data": "150.95.8.211"},{"name": "hirotae.com.","type": 2,"TTL": 1199,"data": "ns11.value-domain.com."},{"name": "hirotae.com.","type": 2,"TTL": 1199,"data": "ns12.value-domain.com."},{"name": "hirotae.com.","type": 2,"TTL": 1199,"data": "ns13.value-domain.com."},{"name": "hirotae.com.","type": 6,"TTL": 2559,"data": "ns13.value-domain.com. hostmaster.hirotae.com. 1580462514 16384 2048 1048576 2560"},{"name": "hirotae.com.","type": 15,"TTL": 1199,"data": "10 hirotae.com."},{"name": "hirotae.com.","type": 16,"TTL": 1199,"data": "\"v=spf1 ip4:150.95.8.211 +ipv4:59.106.27.210 ~all\""}],"Additional":[],"Comment": "Response from 54.199.222.7."}%

こんな感じでAnswerにズラズラと返ってきます。


{
    "Status": 0,
    "TC": false,
    "RD": true,
    "RA": true,
    "AD": false,
    "CD": false,
    "Question": [
        {
            "name": "hirotae.com.",
            "type": 255
        }
    ],
    "Answer": [
        {
            "name": "hirotae.com.",
            "type": 1,
            "TTL": 1199,
            "data": "150.95.8.211"
        },
        {
            "name": "hirotae.com.",
            "type": 2,
            "TTL": 1199,
            "data": "ns11.value-domain.com."
        },
        {
            "name": "hirotae.com.",
            "type": 2,
            "TTL": 1199,
            "data": "ns12.value-domain.com."
        },
        {
            "name": "hirotae.com.",
            "type": 2,
            "TTL": 1199,
            "data": "ns13.value-domain.com."
        },
        {
            "name": "hirotae.com.",
            "type": 6,
            "TTL": 2559,
            "data": "ns13.value-domain.com. hostmaster.hirotae.com. 1580462514 16384 2048 1048576 2560"
        },
        {
            "name": "hirotae.com.",
            "type": 15,
            "TTL": 1199,
            "data": "10 hirotae.com."
        },
        {
            "name": "hirotae.com.",
            "type": 16,
            "TTL": 1199,
            "data": "\"v=spf1 ip4:150.95.8.211 +ipv4:59.106.27.210 ~all\""
        }
    ],
    "Additional": [],
    "Comment": "Response from 54.199.222.7."
}

AnswerのTypeを見ていくと、以下のような感じのようです。

  • 1: A
  • 2: ns
  • 6: soa
  • 15: mx
  • 16: txt

Symfonyのバリデーションとして実装してみる。

https://github.com/idani/EmailDoHValidator
で公開しています。

以下を参考にしてカスタムバリデーションを作成していきます。

/src/Validator/Constraints/EmailByDoH.php
<?php

namespace App\Validator\Constraints;

use Symfony\Component\Validator\Constraint;

class EmailByDoH extends Constraint
{
    public $message = 'This value is not a valid email address.';
    public $checkMX = true;
    public $checkHost = true;
}

AレコードとMXで2回もHTTPリクエストはしたくないので、1回にまとめて、結果を再利用できるようにしてみました。間違ってたりして。


<?php


namespace App\Validator\Constraints;


use Symfony\Component\HttpClient\HttpClient;
use Symfony\Component\Validator\Constraint;
use Symfony\Component\Validator\ConstraintValidator;
use Symfony\Component\Validator\Exception\UnexpectedValueException;
use Symfony\Contracts\HttpClient\Exception\ExceptionInterface;

class EmailByDoHValidator extends ConstraintValidator
{

    const DNS_A = 1;
    const DNS_NS = 3;
    const DNS_SOA = 6;
    const DNS_MX = 15;
    const DNS_TXT = 16;

    /**
     * @inheritDoc
     */
    public function validate($value, Constraint $constraint)
    {
        if (!$constraint instanceof EmailByDoH) {
            throw new UnexpectedTypeException($constraint, EmailByDoH::class);
        }

        // custom constraints should ignore null and empty values to allow
        // other constraints (NotBlank, NotNull, etc.) take care of that
        if (null === $value || '' === $value) {
            return;
        }

        if (!is_scalar($value) && !(\is_object($value) && method_exists($value, '__toString'))) {
            throw new UnexpectedValueException($value, 'string');
        }

        $value = (string)$value;
        $host = (string)substr($value, strrpos($value, '@') + 1);

        // Check for host DNS resource records
        if ($constraint->checkMX) {
            if (!$this->checkMXByDoH($host)) {
                $this->context->buildViolation($constraint->message)
                    ->setParameter('{{ value }}', $this->formatValue($value))
                    ->addViolation();
            }

            return;
        }

        if ($constraint->checkHost && !$this->checkHostByDoH($host)) {
            $this->context->buildViolation($constraint->message)
                ->setParameter('{{ value }}', $this->formatValue($value))
                ->addViolation();
        }

    }


    /**
     * @param string $host
     * @return bool
     */
    public function checkMXByDoH(string $host): bool
    {
        return $this->checkDoH($host, self::DNS_MX);
    }

    /**
     * @param string $host
     * @return bool
     */
    public function checkHostByDoH(string $host): bool
    {
        return $this->checkDoH($host, self::DNS_A);
    }

    /**
     * @param string $host
     * @param int $type
     * @return bool
     */
    public function checkDoH(string $host, int $type): bool
    {
        static $result = [];

        if (empty(trim($host))) {
            return false;
        }

        if (!in_array($type, [
            self::DNS_A,
            self::DNS_MX,
            self::DNS_NS,
            self::DNS_SOA,
            self::DNS_TXT
        ], true)) {
            return false;
        }

        if (isset($result[$host])) {
            return isset($result[$host][$type]);
        }

        try {
            $client = HttpClient::create();
            $response = $client->request('GET', 'https://dns.google/resolve', [
                'query' => [
                    'name' => urlencode($host),
                    'type' => 255,
                    'do' => true
                ]
            ]);

            if ($response->getStatusCode() !== 200) {
                return false;
            }

            $contents = $response->getContent();
        } catch (ExceptionInterface $e) {
            return false;
        }

        $dnsRecode = json_decode($contents, true);

        if ($dnsRecode['Status'] != 0) {
            return false;
        }

        if (!isset($dnsRecode['Answer']) || !is_array($dnsRecode['Answer'])) {
            return false;
        }

        $hAnswers = $dnsRecode['Answer'];
        foreach ($hAnswers as $hAnswer) {
            $qtype = $hAnswer['type'];
            $result[$host][$qtype] = $hAnswer;
        }

        return isset($result[$host][$type]);
    }
}

サンプル

以下のようにチェックできるようになりました。

2020-01-31_18h54_57.gif

0
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
0
0