src/src/routers/dnslookup.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2009 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 #include "../exim.h"
   9 #include "rf_functions.h"
  10 #include "dnslookup.h"
  11
  12
  13
  14 /* Options specific to the dnslookup router. */
  15
  16 optionlist dnslookup_router_options[] = {
  17   { "check_secondary_mx", opt_bool,
  18       (void *)(offsetof(dnslookup_router_options_block, check_secondary_mx)) },
  19   { "check_srv",          opt_stringptr,
  20       (void *)(offsetof(dnslookup_router_options_block, check_srv)) },
  21   { "mx_domains",         opt_stringptr,
  22       (void *)(offsetof(dnslookup_router_options_block, mx_domains)) },
  23   { "mx_fail_domains",    opt_stringptr,
  24       (void *)(offsetof(dnslookup_router_options_block, mx_fail_domains)) },
  25   { "qualify_single",     opt_bool,
  26       (void *)(offsetof(dnslookup_router_options_block, qualify_single)) },
  27   { "rewrite_headers",    opt_bool,
  28       (void *)(offsetof(dnslookup_router_options_block, rewrite_headers)) },
  29   { "same_domain_copy_routing", opt_bool|opt_public,
  30       (void *)(offsetof(router_instance, same_domain_copy_routing)) },
  31   { "search_parents",     opt_bool,
  32       (void *)(offsetof(dnslookup_router_options_block, search_parents)) },
  33   { "srv_fail_domains",   opt_stringptr,
  34       (void *)(offsetof(dnslookup_router_options_block, srv_fail_domains)) },
  35   { "widen_domains",      opt_stringptr,
  36       (void *)(offsetof(dnslookup_router_options_block, widen_domains)) }
  37 };
  38
  39 /* Size of the options list. An extern variable has to be used so that its
  40 address can appear in the tables drtables.c. */
  41
  42 int dnslookup_router_options_count =
  43   sizeof(dnslookup_router_options)/sizeof(optionlist);
  44
  45 /* Default private options block for the dnslookup router. */
  46
  47 dnslookup_router_options_block dnslookup_router_option_defaults = {
  48   FALSE,           /* check_secondary_mx */
  49   TRUE,            /* qualify_single */
  50   FALSE,           /* search_parents */
  51   TRUE,            /* rewrite_headers */
  52   NULL,            /* widen_domains */
  53   NULL,            /* mx_domains */
  54   NULL,            /* mx_fail_domains */
  55   NULL,            /* srv_fail_domains */
  56   NULL             /* check_srv */
  57 };
  58
  59
  60
  61 /*************************************************
  62 *          Initialization entry point            *
  63 *************************************************/
  64
  65 /* Called for each instance, after its options have been read, to enable
  66 consistency checks to be done, or anything else that needs to be set up. */
  67
  68 void
  69 dnslookup_router_init(router_instance *rblock)
  70 {
  71 /*
  72 dnslookup_router_options_block *ob =
  73   (dnslookup_router_options_block *)(rblock->options_block);
  74 */
  75 rblock = rblock;
  76 }
  77
  78
  79
  80 /*************************************************
  81 *              Main entry point                  *
  82 *************************************************/
  83
  84 /* See local README for interface details. This router returns:
  85
  86 DECLINE
  87   . the domain does not exist in the DNS
  88   . MX records point to non-existent hosts (including RHS = IP address)
  89   . a single SRV record has a host name of "." (=> no service)
  90   . syntactically invalid mail domain
  91   . check_secondary_mx set, and local host not in host list
  92
  93 DEFER
  94   . lookup defer for mx_domains
  95   . timeout etc on DNS lookup
  96   . verifying the errors address caused a deferment or a big disaster such
  97       as an expansion failure (rf_get_errors_address)
  98   . expanding a headers_{add,remove} string caused a deferment or another
  99       expansion error (rf_get_munge_headers)
 100   . a problem in rf_get_transport: no transport when one is needed;
 101       failed to expand dynamic transport; failed to find dynamic transport
 102   . failure to expand or find a uid/gid (rf_get_ugid via rf_queue_add)
 103   . self = "freeze", self = "defer"
 104
 105 PASS
 106   . timeout etc on DNS lookup and pass_on_timeout set
 107   . self = "pass"
 108
 109 REROUTED
 110   . routed to local host, but name was expanded by DNS lookup, so a
 111       re-routing should take place
 112   . self = "reroute"
 113
 114   In both cases the new address will have been set up as a child
 115
 116 FAIL
 117   . self = "fail"
 118
 119 OK
 120   added address to addr_local or addr_remote, as appropriate for the
 121   type of transport; this includes the self="send" case.
 122 */
 123
 124 int
 125 dnslookup_router_entry(
 126   router_instance *rblock,        /* data for this instantiation */
 127   address_item *addr,             /* address we are working on */
 128   struct passwd *pw,              /* passwd entry after check_local_user */
 129   int verify,                     /* v_none/v_recipient/v_sender/v_expn */
 130   address_item **addr_local,      /* add it to this if it's local */
 131   address_item **addr_remote,     /* add it to this if it's remote */
 132   address_item **addr_new,        /* put new addresses on here */
 133   address_item **addr_succeed)    /* put old address here on success */
 134 {
 135 host_item h;
 136 int rc;
 137 int widen_sep = 0;
 138 int whichrrs = HOST_FIND_BY_MX | HOST_FIND_BY_A;
 139 dnslookup_router_options_block *ob =
 140   (dnslookup_router_options_block *)(rblock->options_block);
 141 uschar *srv_service = NULL;
 142 uschar *widen = NULL;
 143 uschar *pre_widen = addr->domain;
 144 uschar *post_widen = NULL;
 145 uschar *fully_qualified_name;
 146 uschar *listptr;
 147 uschar widen_buffer[256];
 148
 149 addr_new = addr_new;          /* Keep picky compilers happy */
 150 addr_succeed = addr_succeed;
 151
 152 DEBUG(D_route)
 153   debug_printf("%s router called for %s\n  domain = %s\n",
 154     rblock->name, addr->address, addr->domain);
 155
 156 /* If an SRV check is required, expand the service name */
 157
 158 if (ob->check_srv != NULL)
 159   {
 160   srv_service = expand_string(ob->check_srv);
 161   if (srv_service == NULL && !expand_string_forcedfail)
 162     {
 163     addr->message = string_sprintf("%s router: failed to expand \"%s\": %s",
 164       rblock->name, ob->check_srv, expand_string_message);
 165     return DEFER;
 166     }
 167   else whichrrs |= HOST_FIND_BY_SRV;
 168   }
 169
 170 /* Set up the first of any widening domains. The code further down copes with
 171 either pre- or post-widening, but at present there is no way to turn on
 172 pre-widening, as actually doing so seems like a rather bad idea, and nobody has
 173 requested it. Pre-widening would cause local abbreviated names to take
 174 precedence over global names. For example, if the domain is "xxx.ch" it might
 175 be something in the "ch" toplevel domain, but it also might be xxx.ch.xyz.com.
 176 The choice of pre- or post-widening affects which takes precedence. If ever
 177 somebody comes up with some kind of requirement for pre-widening, presumably
 178 with some conditions under which it is done, it can be selected here.
 179
 180 The rewrite_headers option works only when routing an address at transport
 181 time, because the alterations to the headers are not persistent so must be
 182 worked out immediately before they are used. Sender addresses are routed for
 183 verification purposes, but never at transport time, so any header changes that
 184 you might expect as a result of sender domain widening do not occur. Therefore
 185 we do not perform widening when verifying sender addresses; however, widening
 186 sender addresses is OK if we do not have to rewrite the headers. A corollary
 187 of this is that if the current address is not the original address, then it
 188 does not appear in the message header so it is also OK to widen. The
 189 suppression of widening for sender addresses is silent because it is the
 190 normal desirable behaviour. */
 191
 192 if (ob->widen_domains != NULL &&
 193     (verify != v_sender || !ob->rewrite_headers || addr->parent != NULL))
 194   {
 195   listptr = ob->widen_domains;
 196   widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
 197     sizeof(widen_buffer));
 198
 199 /****
 200   if (some condition requiring pre-widening)
 201     {
 202     post_widen = pre_widen;
 203     pre_widen = NULL;
 204     }
 205 ****/
 206   }
 207
 208 /* Loop to cope with explicit widening of domains as configured. This code
 209 copes with widening that may happen before or after the original name. The
 210 decision as to which is taken above. */
 211
 212 for (;;)
 213   {
 214   int flags = whichrrs;
 215   BOOL removed = FALSE;
 216
 217   if (pre_widen != NULL)
 218     {
 219     h.name = pre_widen;
 220     pre_widen = NULL;
 221     }
 222   else if (widen != NULL)
 223     {
 224     h.name = string_sprintf("%s.%s", addr->domain, widen);
 225     widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
 226       sizeof(widen_buffer));
 227     DEBUG(D_route) debug_printf("%s router widened %s to %s\n", rblock->name,
 228       addr->domain, h.name);
 229     }
 230   else if (post_widen != NULL)
 231     {
 232     h.name = post_widen;
 233     post_widen = NULL;
 234     DEBUG(D_route) debug_printf("%s router trying %s after widening failed\n",
 235       rblock->name, h.name);
 236     }
 237   else return DECLINE;
 238
 239   /* Set up the rest of the initial host item. Others may get chained on if
 240   there is more than one IP address. We set it up here instead of outside the
 241   loop so as to re-initialize if a previous try succeeded but was rejected
 242   because of not having an MX record. */
 243
 244   h.next = NULL;
 245   h.address = NULL;
 246   h.port = PORT_NONE;
 247   h.mx = MX_NONE;
 248   h.status = hstatus_unknown;
 249   h.why = hwhy_unknown;
 250   h.last_try = 0;
 251
 252   /* Unfortunately, we cannot set the mx_only option in advance, because the
 253   DNS lookup may extend an unqualified name. Therefore, we must do the test
 254   subsequently. We use the same logic as that for widen_domains above to avoid
 255   requesting a header rewrite that cannot work. */
 256
 257   if (verify != v_sender || !ob->rewrite_headers || addr->parent != NULL)
 258     {
 259     if (ob->qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
 260     if (ob->search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
 261     }
 262
 263   rc = host_find_bydns(&h, rblock->ignore_target_hosts, flags, srv_service,
 264     ob->srv_fail_domains, ob->mx_fail_domains, &fully_qualified_name, &removed);
 265   if (removed) setflag(addr, af_local_host_removed);
 266
 267   /* If host found with only address records, test for the domain's being in
 268   the mx_domains list. Note that this applies also to SRV records; the name of
 269   the option is historical. */
 270
 271   if ((rc == HOST_FOUND || rc == HOST_FOUND_LOCAL) && h.mx < 0 &&
 272        ob->mx_domains != NULL)
 273     {
 274     switch(match_isinlist(fully_qualified_name, &(ob->mx_domains), 0,
 275           &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
 276       {
 277       case DEFER:
 278       addr->message = US"lookup defer for mx_domains";
 279       return DEFER;
 280
 281       case OK:
 282       DEBUG(D_route) debug_printf("%s router rejected %s: no MX record(s)\n",
 283         rblock->name, fully_qualified_name);
 284       continue;
 285       }
 286     }
 287
 288   /* Deferral returns forthwith, and anything other than failure breaks the
 289   loop. */
 290
 291   if (rc == HOST_FIND_AGAIN)
 292     {
 293     if (rblock->pass_on_timeout)
 294       {
 295       DEBUG(D_route) debug_printf("%s router timed out, and pass_on_timeout is set\n",
 296         rblock->name);
 297       return PASS;
 298       }
 299     addr->message = US"host lookup did not complete";
 300     return DEFER;
 301     }
 302
 303   if (rc != HOST_FIND_FAILED) break;
 304
 305   /* Check to see if the failure is the result of MX records pointing to
 306   non-existent domains, and if so, set an appropriate error message; the case
 307   of an MX or SRV record pointing to "." is another special case that we can
 308   detect. Otherwise "unknown mail domain" is used, which is confusing. Also, in
 309   this case don't do the widening. We need check only the first host to see if
 310   its MX has been filled in, but there is no address, because if there were any
 311   usable addresses returned, we would not have had HOST_FIND_FAILED.
 312
 313   As a common cause of this problem is MX records with IP addresses on the
 314   RHS, give a special message in this case. */
 315
 316   if (h.mx >= 0 && h.address == NULL)
 317     {
 318     setflag(addr, af_pass_message);   /* This is not a security risk */
 319     if (h.name[0] == 0)
 320       addr->message = US"an MX or SRV record indicated no SMTP service";
 321     else
 322       {
 323       addr->message = US"all relevant MX records point to non-existent hosts";
 324       if (!allow_mx_to_ip && string_is_ip_address(h.name, NULL) != 0)
 325         {
 326         addr->user_message =
 327           string_sprintf("It appears that the DNS operator for %s\n"
 328             "has installed an invalid MX record with an IP address\n"
 329             "instead of a domain name on the right hand side.", addr->domain);
 330         addr->message = string_sprintf("%s or (invalidly) to IP addresses",
 331           addr->message);
 332         }
 333       }
 334     return DECLINE;
 335     }
 336
 337   /* If there's a syntax error, do not continue with any widening, and note
 338   the error. */
 339
 340   if (host_find_failed_syntax)
 341     {
 342     addr->message = string_sprintf("mail domain \"%s\" is syntactically "
 343       "invalid", h.name);
 344     return DECLINE;
 345     }
 346   }
 347
 348 /* If the original domain name has been changed as a result of the host lookup,
 349 set up a child address for rerouting and request header rewrites if so
 350 configured. Then yield REROUTED. However, if the only change is a change of
 351 case in the domain name, which some resolvers yield (others don't), just change
 352 the domain name in the original address so that the official version is used in
 353 RCPT commands. */
 354
 355 if (Ustrcmp(addr->domain, fully_qualified_name) != 0)
 356   {
 357   if (strcmpic(addr->domain, fully_qualified_name) == 0)
 358     {
 359     uschar *at = Ustrrchr(addr->address, '@');
 360     memcpy(at+1, fully_qualified_name, Ustrlen(at+1));
 361     }
 362   else
 363     {
 364     rf_change_domain(addr, fully_qualified_name, ob->rewrite_headers, addr_new);
 365     return REROUTED;
 366     }
 367   }
 368
 369 /* If the yield is HOST_FOUND_LOCAL, the remote domain name either found MX
 370 records with the lowest numbered one pointing to a host with an IP address that
 371 is set on one of the interfaces of this machine, or found A records or got
 372 addresses from gethostbyname() that contain one for this machine. This can
 373 happen quite legitimately if the original name was a shortened form of a
 374 domain, but we will have picked that up already via the name change test above.
 375
 376 Otherwise, the action to be taken can be configured by the self option, the
 377 handling of which is in a separate function, as it is also required for other
 378 routers. */
 379
 380 if (rc == HOST_FOUND_LOCAL)
 381   {
 382   rc = rf_self_action(addr, &h, rblock->self_code, rblock->self_rewrite,
 383     rblock->self, addr_new);
 384   if (rc != OK) return rc;
 385   }
 386
 387 /* Otherwise, insist on being a secondary MX if so configured */
 388
 389 else if (ob->check_secondary_mx && !testflag(addr, af_local_host_removed))
 390   {
 391   DEBUG(D_route) debug_printf("check_secondary_mx set and local host not secondary\n");
 392   return DECLINE;
 393   }
 394
 395 /* Set up the errors address, if any. */
 396
 397 rc = rf_get_errors_address(addr, rblock, verify, &(addr->p.errors_address));
 398 if (rc != OK) return rc;
 399
 400 /* Set up the additional and removeable headers for this address. */
 401
 402 rc = rf_get_munge_headers(addr, rblock, &(addr->p.extra_headers),
 403   &(addr->p.remove_headers));
 404 if (rc != OK) return rc;
 405
 406 /* Get store in which to preserve the original host item, chained on
 407 to the address. */
 408
 409 addr->host_list = store_get(sizeof(host_item));
 410 addr->host_list[0] = h;
 411
 412 /* Fill in the transport and queue the address for delivery. */
 413
 414 if (!rf_get_transport(rblock->transport_name, &(rblock->transport),
 415       addr, rblock->name, NULL))
 416   return DEFER;
 417
 418 addr->transport = rblock->transport;
 419
 420 return rf_queue_add(addr, addr_local, addr_remote, rblock, pw)?
 421   OK : DEFER;
 422 }
 423
 424 /* End of routers/dnslookup.c */