# SPF record validator script
import dns.resolver
import re
import requests

class SPFValidator:
    def __init__(self):
        self.max_dns_lookups = 10
        self.max_void_lookups = 2
        self.max_record_length = 255
        
    def validate_spf_record(self, domain):
        """Validate SPF record syntax and DNS lookup limits"""
        
        try:
            # Get SPF record
            spf_record = self.get_spf_record(domain)
            if not spf_record:
                return {"valid": False, "error": "No SPF record found"}
            
            # Validate syntax
            syntax_result = self.validate_syntax(spf_record)
            if not syntax_result["valid"]:
                return syntax_result
            
            # Check DNS lookup count
            lookup_result = self.validate_dns_lookups(spf_record, domain)
            if not lookup_result["valid"]:
                return lookup_result
            
            # Validate included domains
            include_result = self.validate_includes(spf_record)
            
            return {
                "valid": True,
                "record": spf_record,
                "dns_lookups": lookup_result["count"],
                "includes": include_result["includes"],
                "warnings": self.generate_warnings(spf_record)
            }
            
        except Exception as e:
            return {"valid": False, "error": f"Validation failed: {str(e)}"}
    
    def get_spf_record(self, domain):
        """Retrieve SPF record from DNS"""
        try:
            answers = dns.resolver.resolve(domain, 'TXT')
            for answer in answers:
                txt_record = str(answer).strip('"')
                if txt_record.startswith('v=spf1'):
                    return txt_record
            return None
        except Exception:
            return None
    
    def validate_syntax(self, record):
        """Validate SPF record syntax"""
        if len(record) > self.max_record_length:
            return {
                "valid": False, 
                "error": f"SPF record exceeds {self.max_record_length} characters"
            }
        
        if not record.startswith('v=spf1'):
            return {"valid": False, "error": "SPF record must start with 'v=spf1'"}
        
        # Check for valid mechanisms
        valid_mechanisms = r'(include:|a:|mx:|ptr:|ip4:|ip6:|exists:|redirect=|exp=|\+|\-|\~|\?)'
        invalid_parts = []
        
        parts = record.split()
        for part in parts[1:]:  # Skip 'v=spf1'
            if part in ['all', '+all', '-all', '~all', '?all']:
                continue
            if not re.match(valid_mechanisms, part):
                invalid_parts.append(part)
        
        if invalid_parts:
            return {
                "valid": False, 
                "error": f"Invalid mechanisms found: {', '.join(invalid_parts)}"
            }
        
        return {"valid": True}
    
    def validate_dns_lookups(self, record, domain, visited=None):
        """Count DNS lookups to ensure under RFC limit"""
        if visited is None:
            visited = set()
        
        if domain in visited:
            return {"valid": False, "error": "Circular SPF reference detected"}
        
        visited.add(domain)
        lookup_count = 0
        
        # Count include, a, mx, exists, and redirect mechanisms
        include_pattern = r'include:([^\s]+)'
        a_pattern = r'\ba:([^\s]+)'
        mx_pattern = r'\bmx:([^\s]+)'
        exists_pattern = r'exists:([^\s]+)'
        
        includes = re.findall(include_pattern, record)
        a_records = re.findall(a_pattern, record)
        mx_records = re.findall(mx_pattern, record)
        exists_records = re.findall(exists_pattern, record)
        
        # Count mx records without domain specification
        if re.search(r'\bmx\b', record):
            lookup_count += 1
        
        total_lookups = len(includes) + len(a_records) + len(mx_records) + len(exists_records)
        lookup_count += total_lookups
        
        # Recursively check included SPF records
        for include_domain in includes:
            try:
                include_spf = self.get_spf_record(include_domain)
                if include_spf:
                    nested_result = self.validate_dns_lookups(include_spf, include_domain, visited.copy())
                    if not nested_result["valid"]:
                        return nested_result
                    lookup_count += nested_result["count"]
            except Exception:
                pass  # Skip invalid includes
        
        if lookup_count > self.max_dns_lookups:
            return {
                "valid": False, 
                "error": f"DNS lookup count ({lookup_count}) exceeds RFC limit ({self.max_dns_lookups})"
            }
        
        return {"valid": True, "count": lookup_count}
    
    def validate_includes(self, record):
        """Validate included domains"""
        include_pattern = r'include:([^\s]+)'
        includes = re.findall(include_pattern, record)
        
        valid_includes = []
        invalid_includes = []
        
        for include_domain in includes:
            try:
                # Check if included domain has SPF record
                include_spf = self.get_spf_record(include_domain)
                if include_spf:
                    valid_includes.append(include_domain)
                else:
                    invalid_includes.append(include_domain)
            except Exception:
                invalid_includes.append(include_domain)
        
        return {
            "includes": valid_includes,
            "invalid_includes": invalid_includes
        }
    
    def generate_warnings(self, record):
        """Generate optimization warnings"""
        warnings = []
        
        if '~all' not in record and '-all' not in record:
            warnings.append("Consider adding explicit 'all' mechanism for better security")
        
        if '+all' in record:
            warnings.append("'+all' allows any server to send email - security risk")
        
        if 'ptr:' in record:
            warnings.append("PTR mechanism is deprecated and not recommended")
        
        return warnings

# Usage example
validator = SPFValidator()

domains_to_check = [
    "example.com",
    "marketing.example.com", 
    "support.example.com"
]

for domain in domains_to_check:
    print(f"\n=== SPF Validation for {domain} ===")
    result = validator.validate_spf_record(domain)
    
    if result["valid"]:
        print(f"✓ Valid SPF record found")
        print(f"  Record: {result['record']}")
        print(f"  DNS Lookups: {result['dns_lookups']}/{validator.max_dns_lookups}")
        print(f"  Includes: {', '.join(result['includes'])}")
        
        if result["warnings"]:
            print(f"  Warnings:")
            for warning in result["warnings"]:
                print(f"    - {warning}")
    else:
        print(f"✗ SPF validation failed: {result['error']}")

# Python example using dkimpy library
import dkim
import email.mime.text
import email.utils
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText

class DKIMSigner:
    def __init__(self, private_key_path, selector, domain):
        with open(private_key_path, 'rb') as f:
            self.private_key = f.read()
        self.selector = selector.encode()
        self.domain = domain.encode()
    
    def sign_email(self, message):
        """Sign an email message with DKIM"""
        
        # Convert message to bytes if it's a string
        if isinstance(message, str):
            message = message.encode()
        elif hasattr(message, 'as_bytes'):
            message = message.as_bytes()
        
        # Sign the message
        signature = dkim.sign(
            message,
            self.selector,
            self.domain,
            self.private_key,
            include_headers=[
                b'from', b'to', b'subject', b'date', 
                b'message-id', b'mime-version', b'content-type'
            ],
            canonicalize=(b'relaxed', b'simple'),
            signature_algorithm=b'rsa-sha256'
        )
        
        return signature.decode() + message.decode()
    
    def create_signed_email(self, sender, recipient, subject, body):
        """Create and sign a complete email"""
        
        # Create email message
        msg = MIMEMultipart()
        msg['From'] = sender
        msg['To'] = recipient
        msg['Subject'] = subject
        msg['Date'] = email.utils.formatdate(localtime=True)
        msg['Message-ID'] = email.utils.make_msgid()
        
        # Add body
        msg.attach(MIMEText(body, 'plain'))
        
        # Sign the message
        signed_message = self.sign_email(msg.as_bytes())
        
        return signed_message

# Usage example
signer = DKIMSigner(
    private_key_path='/etc/dkim/private.pem',
    selector='selector1',
    domain='example.com'
)

# Create signed email
signed_email = signer.create_signed_email(
    sender='noreply@example.com',
    recipient='user@customer.com',
    subject='Welcome to Our Service',
    body='Thank you for signing up!'
)

print(signed_email)

# DKIM verification script
import dkim
import dns.resolver
import re
from email import message_from_string

class DKIMVerifier:
    def __init__(self):
        self.debug = False
    
    def verify_dkim_signature(self, email_content):
        """Verify DKIM signature in email"""
        
        try:
            # Parse email
            msg = message_from_string(email_content)
            
            # Check for DKIM signature
            dkim_signature = msg.get('DKIM-Signature')
            if not dkim_signature:
                return {"valid": False, "error": "No DKIM signature found"}
            
            # Extract signature parameters
            sig_params = self.parse_dkim_signature(dkim_signature)
            
            # Verify signature
            is_valid = dkim.verify(email_content.encode())
            
            return {
                "valid": is_valid,
                "signature_params": sig_params,
                "selector": sig_params.get('s'),
                "domain": sig_params.get('d'),
                "algorithm": sig_params.get('a')
            }
            
        except Exception as e:
            return {"valid": False, "error": f"Verification failed: {str(e)}"}
    
    def parse_dkim_signature(self, signature):
        """Parse DKIM signature header"""
        params = {}
        
        # Remove header name and clean up
        sig_content = signature.replace('DKIM-Signature:', '').strip()
        
        # Parse key-value pairs
        pairs = re.findall(r'([a-z]+)=([^;]+)', sig_content, re.IGNORECASE)
        for key, value in pairs:
            params[key.strip()] = value.strip()
        
        return params
    
    def check_dkim_dns_record(self, selector, domain):
        """Verify DKIM DNS record exists and is valid"""
        
        try:
            dkim_domain = f"{selector}._domainkey.{domain}"
            answers = dns.resolver.resolve(dkim_domain, 'TXT')
            
            for answer in answers:
                txt_record = str(answer).strip('"')
                if 'v=DKIM1' in txt_record:
                    return {
                        "exists": True,
                        "record": txt_record,
                        "params": self.parse_dkim_dns_record(txt_record)
                    }
            
            return {"exists": False, "error": "No DKIM record found"}
            
        except Exception as e:
            return {"exists": False, "error": f"DNS lookup failed: {str(e)}"}
    
    def parse_dkim_dns_record(self, record):
        """Parse DKIM DNS TXT record"""
        params = {}
        
        # Remove spaces and split by semicolon
        clean_record = record.replace(' ', '').replace('\t', '').replace('\n', '')
        pairs = clean_record.split(';')
        
        for pair in pairs:
            if '=' in pair:
                key, value = pair.split('=', 1)
                params[key] = value
        
        return params
    
    def validate_dkim_setup(self, domain, selector):
        """Comprehensive DKIM setup validation"""
        
        # Check DNS record
        dns_result = self.check_dkim_dns_record(selector, domain)
        
        if not dns_result["exists"]:
            return {
                "valid": False, 
                "error": "DKIM DNS record not found",
                "dns_result": dns_result
            }
        
        # Validate DNS record content
        params = dns_result["params"]
        validation_issues = []
        
        if 'v' not in params or params['v'] != 'DKIM1':
            validation_issues.append("Missing or invalid version tag")
        
        if 'k' not in params or params['k'] != 'rsa':
            validation_issues.append("Missing or unsupported key type")
        
        if 'p' not in params or len(params['p']) < 100:
            validation_issues.append("Missing or invalid public key")
        
        return {
            "valid": len(validation_issues) == 0,
            "dns_record": dns_result["record"],
            "parameters": params,
            "issues": validation_issues
        }

# Usage example
verifier = DKIMVerifier()

# Test DKIM DNS setup
result = verifier.validate_dkim_setup('example.com', 'selector1')
print(f"DKIM Setup Valid: {result['valid']}")
if not result['valid']:
    print(f"Issues: {', '.join(result['issues'])}")

# DMARC report processor
import xml.etree.ElementTree as ET
import zipfile
import gzip
import email
import base64
import json
from datetime import datetime
from collections import defaultdict

class DMARCReportProcessor:
    def __init__(self):
        self.reports = []
        self.summary_stats = defaultdict(int)
        
    def process_email_report(self, email_content):
        """Process DMARC report from email"""
        
        msg = email.message_from_string(email_content)
        
        # Find attachment
        for part in msg.walk():
            if part.get_content_disposition() == 'attachment':
                filename = part.get_filename()
                content = part.get_payload(decode=True)
                
                # Handle different compression formats
                if filename.endswith('.xml.gz'):
                    content = gzip.decompress(content)
                elif filename.endswith('.zip'):
                    with zipfile.ZipFile(io.BytesIO(content)) as zf:
                        for name in zf.namelist():
                            if name.endswith('.xml'):
                                content = zf.read(name)
                                break
                
                # Process XML report
                return self.process_xml_report(content.decode('utf-8'))
        
        return None
    
    def process_xml_report(self, xml_content):
        """Process DMARC XML report"""
        
        try:
            root = ET.fromstring(xml_content)
            
            # Extract report metadata
            report_metadata = {
                'org_name': root.find('.//org_name').text if root.find('.//org_name') is not None else 'Unknown',
                'email': root.find('.//email').text if root.find('.//email') is not None else 'Unknown',
                'begin': int(root.find('.//date_range/begin').text),
                'end': int(root.find('.//date_range/end').text),
                'domain': root.find('.//policy_published/domain').text
            }
            
            # Extract policy
            policy = {
                'domain': root.find('.//policy_published/domain').text,
                'adkim': root.find('.//policy_published/adkim').text if root.find('.//policy_published/adkim') is not None else 'r',
                'aspf': root.find('.//policy_published/aspf').text if root.find('.//policy_published/aspf') is not None else 'r',
                'p': root.find('.//policy_published/p').text,
                'sp': root.find('.//policy_published/sp').text if root.find('.//policy_published/sp') is not None else 'none',
                'pct': int(root.find('.//policy_published/pct').text) if root.find('.//policy_published/pct') is not None else 100
            }
            
            # Process records
            records = []
            for record in root.findall('.//record'):
                record_data = self.parse_record(record)
                records.append(record_data)
                self.update_summary_stats(record_data)
            
            report = {
                'metadata': report_metadata,
                'policy': policy,
                'records': records
            }
            
            self.reports.append(report)
            return report
            
        except ET.ParseError as e:
            print(f"XML parsing error: {e}")
            return None
    
    def parse_record(self, record_element):
        """Parse individual DMARC record"""
        
        # Source IP and count
        source_ip = record_element.find('.//source_ip').text
        count = int(record_element.find('.//count').text)
        
        # Policy evaluation
        disposition = record_element.find('.//disposition').text
        dkim_result = record_element.find('.//dkim').text
        spf_result = record_element.find('.//spf').text
        
        # Header From domain
        header_from = record_element.find('.//identifiers/header_from').text
        
        # Authentication results
        auth_results = {
            'dkim': [],
            'spf': []
        }
        
        # DKIM results
        for dkim in record_element.findall('.//auth_results/dkim'):
            auth_results['dkim'].append({
                'domain': dkim.find('domain').text,
                'selector': dkim.find('selector').text if dkim.find('selector') is not None else '',
                'result': dkim.find('result').text
            })
        
        # SPF results
        for spf in record_element.findall('.//auth_results/spf'):
            auth_results['spf'].append({
                'domain': spf.find('domain').text,
                'scope': spf.find('scope').text if spf.find('scope') is not None else '',
                'result': spf.find('result').text
            })
        
        return {
            'source_ip': source_ip,
            'count': count,
            'disposition': disposition,
            'dkim_result': dkim_result,
            'spf_result': spf_result,
            'header_from': header_from,
            'auth_results': auth_results
        }
    
    def update_summary_stats(self, record):
        """Update summary statistics"""
        
        self.summary_stats['total_messages'] += record['count']
        self.summary_stats[f"disposition_{record['disposition']}"] += record['count']
        self.summary_stats[f"dkim_{record['dkim_result']}"] += record['count']
        self.summary_stats[f"spf_{record['spf_result']}"] += record['count']
        
        # Track by source IP
        ip_key = f"ip_{record['source_ip']}"
        self.summary_stats[ip_key] += record['count']
    
    def generate_summary_report(self):
        """Generate summary report from processed data"""
        
        total = self.summary_stats['total_messages']
        if total == 0:
            return {"error": "No messages processed"}
        
        # Calculate percentages
        summary = {
            'total_messages': total,
            'policy_results': {
                'none': self.summary_stats.get('disposition_none', 0),
                'quarantine': self.summary_stats.get('disposition_quarantine', 0),
                'reject': self.summary_stats.get('disposition_reject', 0)
            },
            'authentication_results': {
                'dkim_pass': self.summary_stats.get('dkim_pass', 0),
                'dkim_fail': self.summary_stats.get('dkim_fail', 0),
                'spf_pass': self.summary_stats.get('spf_pass', 0),
                'spf_fail': self.summary_stats.get('spf_fail', 0)
            },
            'compliance_rate': 0,
            'top_source_ips': self.get_top_source_ips()
        }
        
        # Calculate compliance rate
        compliant = (summary['authentication_results']['dkim_pass'] + 
                    summary['authentication_results']['spf_pass'])
        summary['compliance_rate'] = (compliant / total) * 100 if total > 0 else 0
        
        return summary
    
    def get_top_source_ips(self, limit=10):
        """Get top source IPs by message count"""
        
        ip_stats = {}
        for key, count in self.summary_stats.items():
            if key.startswith('ip_'):
                ip = key[3:]  # Remove 'ip_' prefix
                ip_stats[ip] = count
        
        # Sort by count and return top IPs
        sorted_ips = sorted(ip_stats.items(), key=lambda x: x[1], reverse=True)
        return sorted_ips[:limit]
    
    def identify_threats(self, threshold_percentage=5):
        """Identify potential security threats from reports"""
        
        threats = []
        total = self.summary_stats['total_messages']
        
        for report in self.reports:
            for record in report['records']:
                # High volume failures from single IP
                failure_rate = record['count'] / total * 100
                
                if (failure_rate > threshold_percentage and 
                    (record['dkim_result'] == 'fail' or record['spf_result'] == 'fail')):
                    
                    threats.append({
                        'type': 'suspicious_source',
                        'source_ip': record['source_ip'],
                        'message_count': record['count'],
                        'failure_rate': failure_rate,
                        'auth_failures': {
                            'dkim': record['dkim_result'],
                            'spf': record['spf_result']
                        }
                    })
        
        return threats

# Usage example
processor = DMARCReportProcessor()

# Process reports from email files
import glob
for email_file in glob.glob('/path/to/dmarc/emails/*.eml'):
    with open(email_file, 'r') as f:
        email_content = f.read()
    
    report = processor.process_email_report(email_content)
    if report:
        print(f"Processed report from {report['metadata']['org_name']}")

# Generate summary
summary = processor.generate_summary_report()
print(f"\n=== DMARC Summary Report ===")
print(f"Total Messages: {summary['total_messages']:,}")
print(f"Compliance Rate: {summary['compliance_rate']:.1f}%")
print(f"Policy Actions:")
print(f"  None: {summary['policy_results']['none']:,}")
print(f"  Quarantine: {summary['policy_results']['quarantine']:,}")
print(f"  Reject: {summary['policy_results']['reject']:,}")

# Identify threats
threats = processor.identify_threats()
if threats:
    print(f"\n=== Security Threats Identified ===")
    for threat in threats[:5]:  # Show top 5 threats
        print(f"Suspicious IP: {threat['source_ip']} ({threat['message_count']:,} messages, {threat['failure_rate']:.1f}% of total)")