Add dns_trust_aa

[exim.git] / src / src / dns.c

diff --git a/src/src/dns.c b/src/src/dns.c
index 4ca349cd118546cfb6177dc6e2b1967f8811bd3e..29078dacd8971ca04251abd9fa0c71614ebeddf6 100644 (file)
--- a/src/src/dns.c
+++ b/src/src/dns.c
@@ -2,7 +2,7 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
-/* Copyright (c) University of Cambridge 1995 - 2014 */
+/* Copyright (c) University of Cambridge 1995 - 2015 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for interfacing with the DNS. */
@@ -53,32 +53,6 @@ Ustrncpy(name, domain, len);
 name[len] = 0;
 endname = name + len;
 
-/* This code, for forcing TRY_AGAIN and NO_RECOVERY, is here so that it works
-for the old test suite that uses a real nameserver. When the old test suite is
-eventually abandoned, this code could be moved into the fakens utility. */
-
-if (len >= 14 && Ustrcmp(endname - 14, "test.again.dns") == 0)
-  {
-  int delay = Uatoi(name);  /* digits at the start of the name */
-  DEBUG(D_dns) debug_printf("Return from DNS lookup of %s (%s) faked for testing\n",
-    name, dns_text_type(type));
-  if (delay > 0)
-    {
-    DEBUG(D_dns) debug_printf("delaying %d seconds\n", delay);
-    sleep(delay);
-    }
-  h_errno = TRY_AGAIN;
-  return -1;
-  }
-
-if (len >= 13 && Ustrcmp(endname - 13, "test.fail.dns") == 0)
-  {
-  DEBUG(D_dns) debug_printf("Return from DNS lookup of %s (%s) faked for testing\n",
-    name, dns_text_type(type));
-  h_errno = NO_RECOVERY;
-  return -1;
-  }
-
 /* Look for the fakens utility, and if it exists, call it. */
 
 (void)string_format(utilname, sizeof(utilname), "%s/bin/fakens",
@@ -428,6 +402,26 @@ return &(dnss->srr);
 }
 
 
+/* Extract the AUTHORITY info from the answer. If the
+ * answer isn't authoritive (AA) we do not extract anything.
+ * We've to search for SOA or NS records, since there may be
+ * other records (e.g. NSEC3) too.
+ */
+static const uschar*
+dns_extract_auth_name(const dns_answer *dnsa)  /* FIXME: const dns_answer */
+{
+    dns_scan dnss;
+    dns_record *rr;
+    HEADER *h = (HEADER *) dnsa->answer;
+    if (!h->nscount || !h->aa) return NULL;
+    for (rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_AUTHORITY);
+        rr;
+        rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_NEXT))
+      if (rr->type == T_SOA || rr->type == T_NS) return rr->name;
+    return NULL;
+}
+
+
 
 
 /*************************************************
@@ -436,7 +430,7 @@ return &(dnss->srr);
 
 /* We do not perform DNSSEC work ourselves; if the administrator has installed
 a verifying resolver which sets AD as appropriate, though, we'll use that.
-(AD = Authentic Data)
+(AD = Authentic Data, AA = Authoritive Answer)
 
 Argument:   pointer to dns answer block
 Returns:    bool indicating presence of AD bit
@@ -450,8 +444,31 @@ DEBUG(D_dns)
   debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
 return FALSE;
 #else
-HEADER *h = (HEADER *)dnsa->answer;
-return h->ad ? TRUE : FALSE;
+HEADER *h = (HEADER *) dnsa->answer;
+
+if (h->ad) return TRUE;
+else
+  {
+  /* If the resolver we ask is authoritive for the domain in question, it
+  * may not set the AD but the AA bit. If we explicitly trust
+  * the resolver for that domain (via a domainlist in dns_trust_aa),
+  * we return TRUE to indicate a secure answer.
+  */
+  const uschar *auth_name;
+  const uschar *trusted;
+
+  if (!h->aa || !dns_trust_aa) return FALSE;
+
+  trusted = expand_string(dns_trust_aa);
+  auth_name = dns_extract_auth_name(dnsa);
+  if (OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL)) 
+    return FALSE;
+
+  DEBUG(D_dns)
+    debug_printf("DNS faked the AD bit (got AA and matched with dns_trust_aa (%s in %s))\n", auth_name, dns_trust_aa);
+
+  return TRUE;
+}
 #endif
 }
 
@@ -465,7 +482,7 @@ h->ad = 0;
 /************************************************
  *     Check whether the AA bit is set         *
  *     We need this to warn if we requested AD *
- *     from a authoritive server               *
+ *     from an authoritive server              *
  ************************************************/
 
 BOOL
@@ -539,8 +556,6 @@ node->data.val = rc;
 return rc;
 }
 
-
-
 /*************************************************
 *              Do basic DNS lookup               *
 *************************************************/
@@ -880,7 +895,7 @@ return DNS_FAIL;
 *    Do a DNS lookup and handle virtual types   *
 ************************************************/
 
-/* This function handles some invented "lookup types" that synthesize feature
+/* This function handles some invented "lookup types" that synthesize features
 not available in the basic types. The special types all have negative values.
 Positive type values are passed straight on to dns_lookup().