DANE: ignore undersized TLSA records
[exim.git] / src / src / dns.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions for interfacing with the DNS. */
9
10#include "exim.h"
11
12
059ec3d9 13
bef5a11f
PH
14/*************************************************
15* Fake DNS resolver *
16*************************************************/
17
18/* This function is called instead of res_search() when Exim is running in its
19test harness. It recognizes some special domain names, and uses them to force
433a2980
PH
20failure and retry responses (optionally with a delay). Otherwise, it calls an
21external utility that mocks-up a nameserver, if it can find the utility.
22If not, it passes its arguments on to res_search(). The fake nameserver may
23also return a code specifying that the name should be passed on.
bef5a11f
PH
24
25Background: the original test suite required a real nameserver to carry the
8e013028 26test zones, whereas the new test suite has the fake server for portability. This
e7726cbf 27code supports both.
bef5a11f
PH
28
29Arguments:
e7726cbf 30 domain the domain name
bef5a11f
PH
31 type the DNS record type
32 answerptr where to put the answer
33 size size of the answer area
34
35Returns: length of returned data, or -1 on error (h_errno set)
36*/
37
38static int
1dc92d5a 39fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
bef5a11f 40{
e7726cbf 41int len = Ustrlen(domain);
433a2980 42int asize = size; /* Locally modified */
e7726cbf 43uschar name[256];
433a2980
PH
44uschar utilname[256];
45uschar *aptr = answerptr; /* Locally modified */
46struct stat statbuf;
47
48/* Remove terminating dot. */
e7726cbf
PH
49
50if (domain[len - 1] == '.') len--;
51Ustrncpy(name, domain, len);
52name[len] = 0;
bef5a11f 53
433a2980
PH
54/* Look for the fakens utility, and if it exists, call it. */
55
5f3d0983
HSHR
56(void)string_format(utilname, sizeof(utilname), "%s/bin/fakens",
57 config_main_directory);
433a2980
PH
58
59if (stat(CS utilname, &statbuf) >= 0)
bef5a11f 60 {
433a2980
PH
61 pid_t pid;
62 int infd, outfd, rc;
63 uschar *argv[5];
64
3735e326 65 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n", name, dns_text_type(type));
433a2980
PH
66
67 argv[0] = utilname;
5f3d0983 68 argv[1] = config_main_directory;
433a2980
PH
69 argv[2] = name;
70 argv[3] = dns_text_type(type);
71 argv[4] = NULL;
72
73 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE);
74 if (pid < 0)
75 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
76 strerror(errno));
77
78 len = 0;
79 rc = -1;
80 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
81 {
82 len += rc;
83 aptr += rc; /* Don't modify the actual arguments, because they */
84 asize -= rc; /* may need to be passed on to res_search(). */
85 }
bef5a11f 86
aa7751be 87 /* If we ran out of output buffer before exhausting the return,
1fb7660f
JH
88 carry on reading and counting it. */
89
90 if (asize == 0)
91 while ((rc = read(outfd, name, sizeof(name))) > 0)
92 len += rc;
93
433a2980
PH
94 if (rc < 0)
95 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
96 strerror(errno));
bef5a11f 97
433a2980 98 switch(child_close(pid, 0))
bef5a11f 99 {
433a2980
PH
100 case 0: return len;
101 case 1: h_errno = HOST_NOT_FOUND; return -1;
102 case 2: h_errno = TRY_AGAIN; return -1;
103 default:
104 case 3: h_errno = NO_RECOVERY; return -1;
105 case 4: h_errno = NO_DATA; return -1;
106 case 5: /* Pass on to res_search() */
107 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
bef5a11f
PH
108 }
109 }
8e013028
HSHR
110else
111 {
4cea764f 112 DEBUG(D_dns) debug_printf("fakens (%s) not found\n", utilname);
8e013028 113 }
bef5a11f 114
433a2980 115/* fakens utility not found, or it returned "pass on" */
bef5a11f 116
433a2980 117DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
e7726cbf
PH
118
119return res_search(CS domain, C_IN, type, answerptr, size);
bef5a11f
PH
120}
121
122
059ec3d9
PH
123
124/*************************************************
125* Initialize and configure resolver *
126*************************************************/
127
128/* Initialize the resolver and the storage for holding DNS answers if this is
129the first time we have been here, and set the resolver options.
130
131Arguments:
132 qualify_single TRUE to set the RES_DEFNAMES option
133 search_parents TRUE to set the RES_DNSRCH option
8c51eead 134 use_dnssec TRUE to set the RES_USE_DNSSEC option
059ec3d9
PH
135
136Returns: nothing
137*/
138
139void
8c51eead 140dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
059ec3d9 141{
5bfb4cdf
PP
142res_state resp = os_get_dns_resolver_res();
143
144if ((resp->options & RES_INIT) == 0)
059ec3d9 145 {
5bfb4cdf
PP
146 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
147 os_put_dns_resolver_res(resp);
059ec3d9 148 res_init();
5bfb4cdf
PP
149 DEBUG(D_resolver) resp->options |= RES_DEBUG;
150 os_put_dns_resolver_res(resp);
059ec3d9
PH
151 }
152
5bfb4cdf
PP
153resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
154resp->options |= (qualify_single? RES_DEFNAMES : 0) |
059ec3d9 155 (search_parents? RES_DNSRCH : 0);
5bfb4cdf
PP
156if (dns_retrans > 0) resp->retrans = dns_retrans;
157if (dns_retry > 0) resp->retry = dns_retry;
e97d1f08
PP
158
159#ifdef RES_USE_EDNS0
160if (dns_use_edns0 >= 0)
161 {
162 if (dns_use_edns0)
5bfb4cdf 163 resp->options |= RES_USE_EDNS0;
e97d1f08 164 else
5bfb4cdf 165 resp->options &= ~RES_USE_EDNS0;
e97d1f08
PP
166 DEBUG(D_resolver)
167 debug_printf("Coerced resolver EDNS0 support %s.\n",
168 dns_use_edns0 ? "on" : "off");
169 }
170#else
171if (dns_use_edns0 >= 0)
172 DEBUG(D_resolver)
173 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
174 dns_use_edns0 ? "" : "un");
175#endif
5bfb4cdf 176
1f4a55da
PP
177#ifndef DISABLE_DNSSEC
178# ifdef RES_USE_DNSSEC
179# ifndef RES_USE_EDNS0
180# error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
181# endif
8c51eead
JH
182if (use_dnssec)
183 resp->options |= RES_USE_DNSSEC;
0fbd9bff 184if (dns_dnssec_ok >= 0)
1f4a55da 185 {
0fbd9bff 186 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
1f4a55da
PP
187 {
188 DEBUG(D_resolver)
0fbd9bff 189 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
1f4a55da
PP
190 }
191 else
192 {
0fbd9bff 193 if (dns_dnssec_ok)
1f4a55da
PP
194 resp->options |= RES_USE_DNSSEC;
195 else
196 resp->options &= ~RES_USE_DNSSEC;
197 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
0fbd9bff 198 dns_dnssec_ok ? "on" : "off");
1f4a55da
PP
199 }
200 }
201# else
0fbd9bff 202if (dns_dnssec_ok >= 0)
1f4a55da
PP
203 DEBUG(D_resolver)
204 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
0fbd9bff 205 dns_dnssec_ok ? "" : "un");
8c51eead
JH
206if (use_dnssec)
207 DEBUG(D_resolver)
93d4b03a 208 debug_printf("Unable to set DNSSEC without resolver support.\n");
1f4a55da
PP
209# endif
210#endif /* DISABLE_DNSSEC */
211
5bfb4cdf 212os_put_dns_resolver_res(resp);
059ec3d9
PH
213}
214
215
216
217/*************************************************
218* Build key name for PTR records *
219*************************************************/
220
221/* This function inverts an IP address and adds the relevant domain, to produce
222a name that can be used to look up PTR records.
223
224Arguments:
225 string the IP address as a string
226 buffer a suitable buffer, long enough to hold the result
227
228Returns: nothing
229*/
230
231void
55414b25 232dns_build_reverse(const uschar *string, uschar *buffer)
059ec3d9 233{
55414b25 234const uschar *p = string + Ustrlen(string);
059ec3d9
PH
235uschar *pp = buffer;
236
237/* Handle IPv4 address */
238
239#if HAVE_IPV6
240if (Ustrchr(string, ':') == NULL)
241#endif
242 {
243 int i;
244 for (i = 0; i < 4; i++)
245 {
55414b25 246 const uschar *ppp = p;
059ec3d9
PH
247 while (ppp > string && ppp[-1] != '.') ppp--;
248 Ustrncpy(pp, ppp, p - ppp);
249 pp += p - ppp;
250 *pp++ = '.';
251 p = ppp - 1;
252 }
253 Ustrcpy(pp, "in-addr.arpa");
254 }
255
256/* Handle IPv6 address; convert to binary so as to fill out any
257abbreviation in the textual form. */
258
259#if HAVE_IPV6
260else
261 {
262 int i;
263 int v6[4];
264 (void)host_aton(string, v6);
265
266 /* The original specification for IPv6 reverse lookup was to invert each
267 nibble, and look in the ip6.int domain. The domain was subsequently
268 changed to ip6.arpa. */
269
270 for (i = 3; i >= 0; i--)
271 {
272 int j;
273 for (j = 0; j < 32; j += 4)
5976eb99 274 pp += sprintf(CS pp, "%x.", (v6[i] >> j) & 15);
059ec3d9
PH
275 }
276 Ustrcpy(pp, "ip6.arpa.");
277
278 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
279 with A6 records. However, it fell out of favour when they did. The
280 alternative was to construct a binary key, and look in ip6.arpa. I tried
281 to make this code do that, but I could not make it work on Solaris 8. The
282 resolver seems to lose the initial backslash somehow. However, now that
283 this style of reverse lookup has been dropped, it doesn't matter. These
284 lines are left here purely for historical interest. */
285
286 /**************************************************
287 Ustrcpy(pp, "\\[x");
288 pp += 3;
289
290 for (i = 0; i < 4; i++)
291 {
292 sprintf(pp, "%08X", v6[i]);
293 pp += 8;
294 }
295 Ustrcpy(pp, "].ip6.arpa.");
296 **************************************************/
297
298 }
299#endif
300}
301
302
303
304
2a407b17
JH
305/* Increment the aptr in dnss, checking against dnsa length.
306Return: TRUE for a bad result
307*/
308static BOOL
dd708fd7 309dnss_inc_aptr(const dns_answer * dnsa, dns_scan * dnss, unsigned delta)
2a407b17
JH
310{
311return (dnss->aptr += delta) >= dnsa->answer + dnsa->answerlen;
312}
313
059ec3d9
PH
314/*************************************************
315* Get next DNS record from answer block *
316*************************************************/
317
318/* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
e5a9dba6
PH
319RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
320scan the additional records, and reset == RESET_NEXT to get the next record.
321The result is in static storage which must be copied if it is to be preserved.
059ec3d9
PH
322
323Arguments:
324 dnsa pointer to dns answer block
325 dnss pointer to dns scan block
4c04137d 326 reset option specifying what portion to scan, as described above
059ec3d9
PH
327
328Returns: next dns record, or NULL when no more
329*/
330
331dns_record *
dd708fd7 332dns_next_rr(const dns_answer *dnsa, dns_scan *dnss, int reset)
059ec3d9 333{
dd708fd7 334const HEADER * h = (const HEADER *)dnsa->answer;
059ec3d9
PH
335int namelen;
336
2a407b17
JH
337char * trace = NULL;
338#ifdef rr_trace
339# define TRACE DEBUG(D_dns)
340#else
341trace = trace;
342# define TRACE if (FALSE)
343#endif
344
059ec3d9
PH
345/* Reset the saved data when requested to, and skip to the first required RR */
346
347if (reset != RESET_NEXT)
348 {
349 dnss->rrcount = ntohs(h->qdcount);
d093f8e5 350 TRACE debug_printf("%s: reset (Q rrcount %d)\n", __FUNCTION__, dnss->rrcount);
059ec3d9
PH
351 dnss->aptr = dnsa->answer + sizeof(HEADER);
352
353 /* Skip over questions; failure to expand the name just gives up */
354
355 while (dnss->rrcount-- > 0)
356 {
2a407b17 357 TRACE trace = "Q-namelen";
059ec3d9 358 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
2a407b17
JH
359 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
360 if (namelen < 0) goto null_return;
361 /* skip name & type & class */
362 TRACE trace = "Q-skip";
dd708fd7 363 if (dnss_inc_aptr(dnsa, dnss, namelen+4)) goto null_return;
059ec3d9
PH
364 }
365
366 /* Get the number of answer records. */
367
368 dnss->rrcount = ntohs(h->ancount);
d093f8e5 369 TRACE debug_printf("%s: reset (A rrcount %d)\n", __FUNCTION__, dnss->rrcount);
059ec3d9 370
e5a9dba6
PH
371 /* Skip over answers if we want to look at the authority section. Also skip
372 the NS records (i.e. authority section) if wanting to look at the additional
059ec3d9
PH
373 records. */
374
2a407b17
JH
375 if (reset == RESET_ADDITIONAL)
376 {
377 TRACE debug_printf("%s: additional\n", __FUNCTION__);
378 dnss->rrcount += ntohs(h->nscount);
d093f8e5 379 TRACE debug_printf("%s: reset (NS rrcount %d)\n", __FUNCTION__, dnss->rrcount);
2a407b17 380 }
e5a9dba6
PH
381
382 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
059ec3d9 383 {
2a407b17
JH
384 TRACE if (reset == RESET_AUTHORITY)
385 debug_printf("%s: authority\n", __FUNCTION__);
059ec3d9
PH
386 while (dnss->rrcount-- > 0)
387 {
2a407b17 388 TRACE trace = "A-namelen";
059ec3d9 389 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
2a407b17
JH
390 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
391 if (namelen < 0) goto null_return;
392 /* skip name, type, class & TTL */
393 TRACE trace = "A-hdr";
dd708fd7 394 if (dnss_inc_aptr(dnsa, dnss, namelen+8)) goto null_return;
059ec3d9 395 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
2a407b17
JH
396 /* skip over it */
397 TRACE trace = "A-skip";
dd708fd7 398 if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) goto null_return;
059ec3d9 399 }
2a407b17 400 dnss->rrcount = reset == RESET_AUTHORITY
e5a9dba6 401 ? ntohs(h->nscount) : ntohs(h->arcount);
d093f8e5
JH
402 TRACE debug_printf("%s: reset (%s rrcount %d)\n", __FUNCTION__,
403 reset == RESET_AUTHORITY ? "NS" : "AR", dnss->rrcount);
059ec3d9 404 }
2a407b17 405 TRACE debug_printf("%s: %d RRs to read\n", __FUNCTION__, dnss->rrcount);
059ec3d9 406 }
2a407b17
JH
407else
408 TRACE debug_printf("%s: next (%d left)\n", __FUNCTION__, dnss->rrcount);
059ec3d9 409
059ec3d9
PH
410/* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
411contains the number of RR records left. */
412
413if (dnss->rrcount-- <= 0) return NULL;
414
415/* If expanding the RR domain name fails, behave as if no more records
416(something safe). */
417
2a407b17 418TRACE trace = "R-namelen";
059ec3d9 419namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
2a407b17
JH
420 (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
421if (namelen < 0) goto null_return;
059ec3d9
PH
422
423/* Move the pointer past the name and fill in the rest of the data structure
424from the following bytes. */
425
2a407b17 426TRACE trace = "R-name";
dd708fd7 427if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return;
2a407b17
JH
428
429GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
430TRACE trace = "R-class";
dd708fd7 431if (dnss_inc_aptr(dnsa, dnss, 2)) goto null_return; /* Don't want class */
2a407b17
JH
432GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */
433GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
434dnss->srr.data = dnss->aptr; /* The record's data follows */
435
436/* Unchecked increment ok here since no further access on this iteration;
437will be checked on next at "R-name". */
438
439dnss->aptr += dnss->srr.size; /* Advance to next RR */
059ec3d9
PH
440
441/* Return a pointer to the dns_record structure within the dns_answer. This is
442for convenience so that the scans can use nice-looking for loops. */
443
2a407b17
JH
444return &dnss->srr;
445
446null_return:
d093f8e5
JH
447 TRACE debug_printf("%s: terminate (%d RRs left). Last op: %s; errno %d %s\n",
448 __FUNCTION__, dnss->rrcount, trace, errno, strerror(errno));
2a407b17
JH
449 dnss->rrcount = 0;
450 return NULL;
059ec3d9
PH
451}
452
453
8688d177 454/* Extract the AUTHORITY information from the answer. If the answer isn't
4c04137d 455authoritative (AA not set), we do not extract anything.
8db90b31 456
4c04137d 457The AUTHORITY section contains NS records if the name in question was found,
8688d177
JH
458it contains a SOA record otherwise. (This is just from experience and some
459tests, is there some spec?)
8db90b31 460
8688d177
JH
461Scan the whole AUTHORITY section, since it may contain other records
462(e.g. NSEC3) too.
463
464Return: name for the authority, in an allocated string, or NULL if none found */
09b80b4e
JH
465
466static const uschar *
467dns_extract_auth_name(const dns_answer * dnsa) /* FIXME: const dns_answer */
9820a77f 468{
09b80b4e
JH
469dns_scan dnss;
470dns_record * rr;
dd708fd7 471const HEADER * h = (const HEADER *) dnsa->answer;
09b80b4e 472
8688d177
JH
473if (h->nscount && h->aa)
474 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
475 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
476 if (rr->type == (h->ancount ? T_NS : T_SOA))
477 return string_copy(rr->name);
09b80b4e 478return NULL;
9820a77f
HSHR
479}
480
481
059ec3d9
PH
482
483
484/*************************************************
1f4a55da
PP
485* Return whether AD bit set in DNS result *
486*************************************************/
487
488/* We do not perform DNSSEC work ourselves; if the administrator has installed
489a verifying resolver which sets AD as appropriate, though, we'll use that.
4c04137d 490(AD = Authentic Data, AA = Authoritative Answer)
1f4a55da
PP
491
492Argument: pointer to dns answer block
493Returns: bool indicating presence of AD bit
494*/
495
496BOOL
4a142059 497dns_is_secure(const dns_answer * dnsa)
1f4a55da
PP
498{
499#ifdef DISABLE_DNSSEC
500DEBUG(D_dns)
501 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
502return FALSE;
503#else
dd708fd7 504const HEADER * h = (const HEADER *) dnsa->answer;
09b80b4e
JH
505const uschar * auth_name;
506const uschar * trusted;
9820a77f
HSHR
507
508if (h->ad) return TRUE;
9820a77f 509
4c04137d 510/* If the resolver we ask is authoritative for the domain in question, it
09b80b4e
JH
511* may not set the AD but the AA bit. If we explicitly trust
512* the resolver for that domain (via a domainlist in dns_trust_aa),
513* we return TRUE to indicate a secure answer.
514*/
9820a77f 515
09b80b4e
JH
516if ( !h->aa
517 || !dns_trust_aa
25bf2076
HSHR
518 || !(trusted = expand_string(dns_trust_aa))
519 || !*trusted
09b80b4e
JH
520 || !(auth_name = dns_extract_auth_name(dnsa))
521 || OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL,
94431adb 522 MCL_DOMAIN, TRUE, NULL)
09b80b4e
JH
523 )
524 return FALSE;
9820a77f 525
09b80b4e
JH
526DEBUG(D_dns) debug_printf("DNS faked the AD bit "
527 "(got AA and matched with dns_trust_aa (%s in %s))\n",
528 auth_name, dns_trust_aa);
9820a77f 529
09b80b4e 530return TRUE;
1f4a55da
PP
531#endif
532}
533
4a142059
JH
534static void
535dns_set_insecure(dns_answer * dnsa)
536{
e87c01c7 537#ifndef DISABLE_DNSSEC
4a142059 538HEADER * h = (HEADER *)dnsa->answer;
8688d177 539h->aa = h->ad = 0;
e87c01c7 540#endif
4a142059
JH
541}
542
221dff13
HSHR
543/************************************************
544 * Check whether the AA bit is set *
545 * We need this to warn if we requested AD *
4c04137d 546 * from an authoritative server *
221dff13
HSHR
547 ************************************************/
548
549BOOL
550dns_is_aa(const dns_answer *dnsa)
551{
e87c01c7
MH
552#ifdef DISABLE_DNSSEC
553return FALSE;
554#else
dd708fd7 555return ((const HEADER*)dnsa->answer)->aa;
e87c01c7 556#endif
221dff13 557}
1f4a55da
PP
558
559
560
561/*************************************************
059ec3d9
PH
562* Turn DNS type into text *
563*************************************************/
564
885ccd3e
PH
565/* Turn the coded record type into a string for printing. All those that Exim
566uses should be included here.
059ec3d9
PH
567
568Argument: record type
569Returns: pointer to string
570*/
571
572uschar *
573dns_text_type(int t)
574{
575switch(t)
576 {
33397d19
PH
577 case T_A: return US"A";
578 case T_MX: return US"MX";
579 case T_AAAA: return US"AAAA";
580 case T_A6: return US"A6";
581 case T_TXT: return US"TXT";
eae0036b 582 case T_SPF: return US"SPF";
33397d19 583 case T_PTR: return US"PTR";
885ccd3e 584 case T_SOA: return US"SOA";
33397d19
PH
585 case T_SRV: return US"SRV";
586 case T_NS: return US"NS";
8e669ac1 587 case T_CNAME: return US"CNAME";
1e06383a 588 case T_TLSA: return US"TLSA";
33397d19 589 default: return US"?";
059ec3d9
PH
590 }
591}
592
593
594
595/*************************************************
596* Cache a failed DNS lookup result *
597*************************************************/
598
cabf3e99
JH
599static void
600dns_fail_tag(uschar * buf, const uschar * name, int dns_type)
601{
602res_state resp = os_get_dns_resolver_res();
603sprintf(CS buf, "%.255s-%s-%lx", name, dns_text_type(dns_type),
604 (unsigned long) resp->options);
605}
606
607
059ec3d9
PH
608/* We cache failed lookup results so as not to experience timeouts many
609times for the same domain. We need to retain the resolver options because they
610may change. For successful lookups, we rely on resolver and/or name server
611caching.
612
613Arguments:
614 name the domain name
615 type the lookup type
616 rc the return code
617
618Returns: the return code
619*/
620
621static int
1dc92d5a 622dns_return(const uschar * name, int type, int rc)
059ec3d9
PH
623{
624tree_node *node = store_get_perm(sizeof(tree_node) + 290);
cabf3e99 625dns_fail_tag(node->name, name, type);
059ec3d9
PH
626node->data.val = rc;
627(void)tree_insertnode(&tree_dns_fails, node);
628return rc;
629}
630
059ec3d9
PH
631/*************************************************
632* Do basic DNS lookup *
633*************************************************/
634
635/* Call the resolver to look up the given domain name, using the given type,
636and check the result. The error code TRY_AGAIN is documented as meaning "non-
4c04137d 637Authoritative Host not found, or SERVERFAIL". Sometimes there are badly set
059ec3d9
PH
638up nameservers that produce this error continually, so there is the option of
639providing a list of domains for which this is treated as a non-existent
640host.
641
642Arguments:
643 dnsa pointer to dns_answer structure
644 name name to look up
645 type type of DNS record required (T_A, T_MX, etc)
646
647Returns: DNS_SUCCEED successful lookup
648 DNS_NOMATCH name not found (NXDOMAIN)
649 or name contains illegal characters (if checking)
30e18802 650 or name is an IP address (for IP address lookup)
059ec3d9
PH
651 DNS_NODATA domain exists, but no data for this type (NODATA)
652 DNS_AGAIN soft failure, try again later
653 DNS_FAIL DNS failure
654*/
655
656int
1dc92d5a 657dns_basic_lookup(dns_answer *dnsa, const uschar *name, int type)
059ec3d9
PH
658{
659#ifndef STAND_ALONE
7156b1ef 660int rc = -1;
55414b25 661const uschar *save_domain;
059ec3d9
PH
662#endif
663
664tree_node *previous;
665uschar node_name[290];
666
667/* DNS lookup failures of any kind are cached in a tree. This is mainly so that
668a timeout on one domain doesn't happen time and time again for messages that
669have many addresses in the same domain. We rely on the resolver and name server
670caching for successful lookups. */
671
cabf3e99 672dns_fail_tag(node_name, name, type);
4b0fe319 673if ((previous = tree_search(tree_dns_fails, node_name)))
059ec3d9
PH
674 {
675 DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: using cached value %s\n",
676 name, dns_text_type(type),
d8d9f930
JH
677 previous->data.val == DNS_NOMATCH ? "DNS_NOMATCH" :
678 previous->data.val == DNS_NODATA ? "DNS_NODATA" :
679 previous->data.val == DNS_AGAIN ? "DNS_AGAIN" :
680 previous->data.val == DNS_FAIL ? "DNS_FAIL" : "??");
059ec3d9
PH
681 return previous->data.val;
682 }
683
8c5d388a 684#ifdef SUPPORT_I18N
9d4319df
JH
685/* Convert all names to a-label form before doing lookup */
686 {
687 uschar * alabel;
688 uschar * errstr = NULL;
766e7a65
JH
689 DEBUG(D_dns) if (string_is_utf8(name))
690 debug_printf("convert utf8 '%s' to alabel for for lookup\n", name);
9d4319df
JH
691 if ((alabel = string_domain_utf8_to_alabel(name, &errstr)), errstr)
692 {
693 DEBUG(D_dns)
37bf366e 694 debug_printf("DNS name '%s' utf8 conversion to alabel failed: %s\n", name,
9d4319df 695 errstr);
8768d548 696 f.host_find_failed_syntax = TRUE;
9d4319df
JH
697 return DNS_NOMATCH;
698 }
699 name = alabel;
700 }
701#endif
702
4c04137d 703/* If configured, check the hygiene of the name passed to lookup. Otherwise,
059ec3d9
PH
704although DNS lookups may give REFUSED at the lower level, some resolvers
705turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
706domains cannot be in the DNS. The check is now done by a regular expression;
707give it space for substring storage to save it having to get its own if the
708regex has substrings that are used - the default uses a conditional.
709
710This test is omitted for PTR records. These occur only in calls from the dnsdb
711lookup, which constructs the names itself, so they should be OK. Besides,
712bitstring labels don't conform to normal name syntax. (But the aren't used any
713more.)
714
715For SRV records, we omit the initial _smtp._tcp. components at the start. */
716
717#ifndef STAND_ALONE /* Omit this for stand-alone tests */
718
482d1455 719if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
059ec3d9 720 {
1dc92d5a 721 const uschar *checkname = name;
059ec3d9
PH
722 int ovector[3*(EXPAND_MAXN+1)];
723
476be7e2 724 dns_pattern_init();
059ec3d9
PH
725
726 /* For an SRV lookup, skip over the first two components (the service and
727 protocol names, which both start with an underscore). */
728
b4161d10 729 if (type == T_SRV || type == T_TLSA)
059ec3d9
PH
730 {
731 while (*checkname++ != '.');
732 while (*checkname++ != '.');
733 }
734
1dc92d5a 735 if (pcre_exec(regex_check_dns_names, NULL, CCS checkname, Ustrlen(checkname),
d093f8e5 736 0, PCRE_EOPT, ovector, nelem(ovector)) < 0)
059ec3d9
PH
737 {
738 DEBUG(D_dns)
739 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
740 dns_text_type(type));
8768d548 741 f.host_find_failed_syntax = TRUE;
059ec3d9
PH
742 return DNS_NOMATCH;
743 }
744 }
745
746#endif /* STAND_ALONE */
747
748/* Call the resolver; for an overlong response, res_search() will return the
bef5a11f
PH
749number of bytes the message would need, so we need to check for this case. The
750effect is to truncate overlong data.
751
30e18802
PH
752On some systems, res_search() will recognize "A-for-A" queries and return
753the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
754nameservers are also believed to do this. It is, of course, contrary to the
755specification of the DNS, so we lock it out. */
756
cc00f4af 757if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
30e18802
PH
758 return DNS_NOMATCH;
759
760/* If we are running in the test harness, instead of calling the normal resolver
bef5a11f
PH
761(res_search), we call fakens_search(), which recognizes certain special
762domains, and interfaces to a fake nameserver for certain special zones. */
763
8768d548 764dnsa->answerlen = f.running_in_test_harness
d093f8e5
JH
765 ? fakens_search(name, type, dnsa->answer, sizeof(dnsa->answer))
766 : res_search(CCS name, C_IN, type, dnsa->answer, sizeof(dnsa->answer));
059ec3d9 767
d093f8e5 768if (dnsa->answerlen > (int) sizeof(dnsa->answer))
80a47a2c 769 {
9e7e0f6a
JH
770 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet"
771 " (size %d), truncating to %u.\n",
772 name, dns_text_type(type), dnsa->answerlen, (unsigned int) sizeof(dnsa->answer));
d093f8e5 773 dnsa->answerlen = sizeof(dnsa->answer);
80a47a2c 774 }
059ec3d9
PH
775
776if (dnsa->answerlen < 0) switch (h_errno)
777 {
778 case HOST_NOT_FOUND:
4b0fe319
JH
779 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
780 "returning DNS_NOMATCH\n", name, dns_text_type(type));
781 return dns_return(name, type, DNS_NOMATCH);
059ec3d9
PH
782
783 case TRY_AGAIN:
4b0fe319
JH
784 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
785 name, dns_text_type(type));
059ec3d9 786
4b0fe319 787 /* Cut this out for various test programs */
1dc92d5a 788#ifndef STAND_ALONE
4b0fe319
JH
789 save_domain = deliver_domain;
790 deliver_domain = string_copy(name); /* set $domain */
791 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
792 MCL_DOMAIN, TRUE, NULL);
793 deliver_domain = save_domain;
794 if (rc != OK)
795 {
796 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
797 return dns_return(name, type, DNS_AGAIN);
798 }
799 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
800 "DNS_NOMATCH\n", name);
801 return dns_return(name, type, DNS_NOMATCH);
059ec3d9 802
1dc92d5a 803#else /* For stand-alone tests */
4b0fe319 804 return dns_return(name, type, DNS_AGAIN);
1dc92d5a 805#endif
059ec3d9
PH
806
807 case NO_RECOVERY:
4b0fe319
JH
808 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
809 "returning DNS_FAIL\n", name, dns_text_type(type));
810 return dns_return(name, type, DNS_FAIL);
059ec3d9
PH
811
812 case NO_DATA:
4b0fe319
JH
813 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
814 "returning DNS_NODATA\n", name, dns_text_type(type));
815 return dns_return(name, type, DNS_NODATA);
059ec3d9
PH
816
817 default:
4b0fe319
JH
818 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
819 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
820 return dns_return(name, type, DNS_FAIL);
059ec3d9
PH
821 }
822
823DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
824 name, dns_text_type(type));
825
826return DNS_SUCCEED;
827}
828
829
830
831
832/************************************************
833* Do a DNS lookup and handle CNAMES *
834************************************************/
835
836/* Look up the given domain name, using the given type. Follow CNAMEs if
837necessary, but only so many times. There aren't supposed to be CNAME chains in
838the DNS, but you are supposed to cope with them if you find them.
d8d9f930
JH
839By default, follow one CNAME since a resolver has been seen, faced with
840an MX request and a CNAME (to an A) but no MX present, returning the CNAME.
059ec3d9
PH
841
842The assumption is made that if the resolver gives back records of the
843requested type *and* a CNAME, we don't need to make another call to look up
844the CNAME. I can't see how it could return only some of the right records. If
845it's done a CNAME lookup in the past, it will have all of them; if not, it
846won't return any.
847
848If fully_qualified_name is not NULL, set it to point to the full name
849returned by the resolver, if this is different to what it is given, unless
850the returned name starts with "*" as some nameservers seem to be returning
766e7a65
JH
851wildcards in this form. In international mode "different" means "alabel
852forms are different".
059ec3d9
PH
853
854Arguments:
855 dnsa pointer to dns_answer structure
856 name domain name to look up
857 type DNS record type (T_A, T_MX, etc)
858 fully_qualified_name if not NULL, return the returned name here if its
859 contents are different (i.e. it must be preset)
860
861Returns: DNS_SUCCEED successful lookup
862 DNS_NOMATCH name not found
863 DNS_NODATA no data found
864 DNS_AGAIN soft failure, try again later
865 DNS_FAIL DNS failure
866*/
867
868int
1dc92d5a 869dns_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 870 const uschar **fully_qualified_name)
059ec3d9
PH
871{
872int i;
1dc92d5a 873const uschar *orig_name = name;
c85b3043 874BOOL secure_so_far = TRUE;
059ec3d9 875
d8d9f930
JH
876/* By default, assume the resolver follows CNAME chains (and returns NODATA for
877an unterminated one). If it also does that for a CNAME loop, fine; if it returns
878a CNAME (maybe the last?) whine about it. However, retain the coding for dumb
879resolvers hiding behind a config variable. Loop to follow CNAME chains so far,
880but no further... The testsuite tests the latter case, mostly assuming that the
881former will work. */
059ec3d9 882
d8d9f930 883for (i = 0; i <= dns_cname_loops; i++)
059ec3d9 884 {
806c3df9 885 uschar * data;
059ec3d9
PH
886 dns_record *rr, cname_rr, type_rr;
887 dns_scan dnss;
1b76ad22 888 int rc;
059ec3d9
PH
889
890 /* DNS lookup failures get passed straight back. */
891
dd708fd7
JH
892 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED)
893 return rc;
059ec3d9
PH
894
895 /* We should have either records of the required type, or a CNAME record,
896 or both. We need to know whether both exist for getting the fully qualified
897 name, but avoid scanning more than necessary. Note that we must copy the
898 contents of any rr blocks returned by dns_next_rr() as they use the same
899 area in the dnsa block. */
900
901 cname_rr.data = type_rr.data = NULL;
902 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
8688d177 903 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
059ec3d9
PH
904 if (rr->type == type)
905 {
906 if (type_rr.data == NULL) type_rr = *rr;
907 if (cname_rr.data != NULL) break;
908 }
dd708fd7
JH
909 else if (rr->type == T_CNAME)
910 cname_rr = *rr;
059ec3d9 911
a2042e78
PH
912 /* For the first time round this loop, if a CNAME was found, take the fully
913 qualified name from it; otherwise from the first data record, if present. */
059ec3d9 914
dd708fd7 915 if (i == 0 && fully_qualified_name)
059ec3d9 916 {
dd708fd7
JH
917 uschar * rr_name = cname_rr.data
918 ? cname_rr.name : type_rr.data ? type_rr.name : NULL;
766e7a65
JH
919 if ( rr_name
920 && Ustrcmp(rr_name, *fully_qualified_name) != 0
921 && rr_name[0] != '*'
8c5d388a 922#ifdef SUPPORT_I18N
766e7a65
JH
923 && ( !string_is_utf8(*fully_qualified_name)
924 || Ustrcmp(rr_name,
925 string_domain_utf8_to_alabel(*fully_qualified_name, NULL)) != 0
926 )
927#endif
928 )
929 *fully_qualified_name = string_copy_dnsdomain(rr_name);
059ec3d9
PH
930 }
931
932 /* If any data records of the correct type were found, we are done. */
933
806c3df9 934 if (type_rr.data)
c85b3043
JH
935 {
936 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
4a142059 937 dns_set_insecure(dnsa);
c85b3043
JH
938 return DNS_SUCCEED;
939 }
059ec3d9
PH
940
941 /* If there are no data records, we need to re-scan the DNS using the
942 domain given in the CNAME record, which should exist (otherwise we should
943 have had a failure from dns_lookup). However code against the possibility of
944 its not existing. */
945
806c3df9
JH
946 if (!cname_rr.data)
947 return DNS_FAIL;
948
949 data = store_get(256);
1b76ad22
JH
950 if (dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
951 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, 256) < 0)
806c3df9 952 return DNS_FAIL;
059ec3d9 953 name = data;
a2042e78 954
c85b3043
JH
955 if (!dns_is_secure(dnsa))
956 secure_so_far = FALSE;
957
a2042e78 958 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
059ec3d9
PH
959 } /* Loop back to do another lookup */
960
961/*Control reaches here after 10 times round the CNAME loop. Something isn't
962right... */
963
964log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
965return DNS_FAIL;
966}
967
968
969
33397d19
PH
970
971
972
973/************************************************
974* Do a DNS lookup and handle virtual types *
975************************************************/
976
9820a77f 977/* This function handles some invented "lookup types" that synthesize features
8e669ac1 978not available in the basic types. The special types all have negative values.
33397d19
PH
979Positive type values are passed straight on to dns_lookup().
980
981Arguments:
982 dnsa pointer to dns_answer structure
983 name domain name to look up
984 type DNS record type (T_A, T_MX, etc or a "special")
985 fully_qualified_name if not NULL, return the returned name here if its
986 contents are different (i.e. it must be preset)
987
988Returns: DNS_SUCCEED successful lookup
989 DNS_NOMATCH name not found
990 DNS_NODATA no data found
991 DNS_AGAIN soft failure, try again later
992 DNS_FAIL DNS failure
993*/
994
995int
1dc92d5a 996dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 997 const uschar **fully_qualified_name)
33397d19 998{
d2a2c69b 999switch (type)
e5a9dba6 1000 {
d2a2c69b
JH
1001 /* The "mx hosts only" type doesn't require any special action here */
1002 case T_MXH:
1705dd20 1003 return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
d2a2c69b
JH
1004
1005 /* Find nameservers for the domain or the nearest enclosing zone, excluding
1006 the root servers. */
1007 case T_ZNS:
1705dd20
JH
1008 type = T_NS;
1009 /* FALLTHROUGH */
d2a2c69b 1010 case T_SOA:
1705dd20
JH
1011 {
1012 const uschar *d = name;
1013 while (d != 0)
1014 {
1015 int rc = dns_lookup(dnsa, d, type, fully_qualified_name);
1016 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
1017 while (*d != 0 && *d != '.') d++;
1018 if (*d++ == 0) break;
1019 }
1020 return DNS_NOMATCH;
1021 }
d2a2c69b
JH
1022
1023 /* Try to look up the Client SMTP Authorization SRV record for the name. If
1024 there isn't one, search from the top downwards for a CSA record in a parent
1025 domain, which might be making assertions about subdomains. If we find a record
1026 we set fully_qualified_name to whichever lookup succeeded, so that the caller
1027 can tell whether to look at the explicit authorization field or the subdomain
1028 assertion field. */
1029 case T_CSA:
1705dd20 1030 {
cab0c277 1031 uschar *srvname, *namesuff, *tld;
1705dd20
JH
1032 int priority, weight, port;
1033 int limit, rc, i;
1034 BOOL ipv6;
1035 dns_record *rr;
1036 dns_scan dnss;
1037
1038 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
1039
1040 srvname = string_sprintf("_client._smtp.%s", name);
1041 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1042 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
1043 {
1044 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
1045 return rc;
1046 }
d2a2c69b 1047
1705dd20
JH
1048 /* Search for CSA subdomain assertion SRV records from the top downwards,
1049 starting with the 2nd level domain. This order maximizes cache-friendliness.
1050 We skip the top level domains to avoid loading their nameservers and because
1051 we know they'll never have CSA SRV records. */
d2a2c69b 1052
1705dd20
JH
1053 namesuff = Ustrrchr(name, '.');
1054 if (namesuff == NULL) return DNS_NOMATCH;
1055 tld = namesuff + 1;
1056 ipv6 = FALSE;
1057 limit = dns_csa_search_limit;
1058
1059 /* Use more appropriate search parameters if we are in the reverse DNS. */
1060
1061 if (strcmpic(namesuff, US".arpa") == 0)
1062 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
1063 {
1064 namesuff -= 8;
d2a2c69b 1065 tld = namesuff + 1;
1705dd20
JH
1066 limit = 3;
1067 }
1068 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
1069 {
1070 namesuff -= 4;
1071 tld = namesuff + 1;
1072 ipv6 = TRUE;
1073 limit = 3;
1074 }
d2a2c69b 1075
1705dd20 1076 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
d2a2c69b 1077
1705dd20
JH
1078 /* Do not perform the search if the top level or 2nd level domains do not
1079 exist. This is quite common, and when it occurs all the search queries would
1080 go to the root or TLD name servers, which is not friendly. So we check the
1081 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
1082 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
1083 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
1084 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
1085
1086 if (rc == DNS_NOMATCH)
1087 {
1088 /* This is really gross. The successful return value from res_search() is
1089 the packet length, which is stored in dnsa->answerlen. If we get a
1090 negative DNS reply then res_search() returns -1, which causes the bounds
1091 checks for name decompression to fail when it is treated as a packet
1092 length, which in turn causes the authority search to fail. The correct
1093 packet length has been lost inside libresolv, so we have to guess a
1094 replacement value. (The only way to fix this properly would be to
1095 re-implement res_search() and res_query() so that they don't muddle their
1096 success and packet length return values.) For added safety we only reset
1097 the packet length if the packet header looks plausible. */
1098
dd708fd7 1099 const HEADER * h = (const HEADER *)dnsa->answer;
1705dd20
JH
1100 if (h->qr == 1 && h->opcode == QUERY && h->tc == 0
1101 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
1102 && ntohs(h->qdcount) == 1 && ntohs(h->ancount) == 0
1103 && ntohs(h->nscount) >= 1)
1104 dnsa->answerlen = MAXPACKET;
1105
1106 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
8688d177 1107 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1705dd20
JH
1108 )
1109 if (rr->type != T_SOA) continue;
1110 else if (strcmpic(rr->name, US"") == 0 ||
1111 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
1112 else break;
1113 }
d2a2c69b 1114
1705dd20
JH
1115 for (i = 0; i < limit; i++)
1116 {
1117 if (ipv6)
1118 {
1119 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
1120 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
1121 namesuff -= 8;
1122 if (namesuff <= name) return DNS_NOMATCH;
1123 }
1124 else
1125 /* Find the start of the preceding domain name label. */
1126 do
1127 if (--namesuff <= name) return DNS_NOMATCH;
1128 while (*namesuff != '.');
1129
1130 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
1131
1132 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
1133 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1134 if (rc == DNS_AGAIN) return rc;
1135 if (rc != DNS_SUCCEED) continue;
1136
1137 /* Check that the SRV record we have found is worth returning. We don't
1138 just return the first one we find, because some lower level SRV record
1139 might make stricter assertions than its parent domain. */
1140
1141 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
8688d177 1142 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1705dd20 1143 {
dd708fd7 1144 const uschar * p = rr->data;
d2a2c69b 1145
1705dd20 1146 /* Extract the numerical SRV fields (p is incremented) */
1705dd20
JH
1147 GETSHORT(priority, p);
1148 GETSHORT(weight, p); weight = weight; /* compiler quietening */
1149 GETSHORT(port, p);
d2a2c69b 1150
1705dd20
JH
1151 /* Check the CSA version number */
1152 if (priority != 1) continue;
d2a2c69b 1153
1705dd20
JH
1154 /* If it's making an interesting assertion, return this response. */
1155 if (port & 1)
d2a2c69b 1156 {
1705dd20
JH
1157 *fully_qualified_name = namesuff + 1;
1158 return DNS_SUCCEED;
d2a2c69b 1159 }
d2a2c69b 1160 }
1705dd20
JH
1161 }
1162 return DNS_NOMATCH;
1163 }
e5a9dba6 1164
d2a2c69b 1165 default:
1705dd20
JH
1166 if (type >= 0)
1167 return dns_lookup(dnsa, name, type, fully_qualified_name);
e5a9dba6
PH
1168 }
1169
33397d19
PH
1170/* Control should never reach here */
1171
1172return DNS_FAIL;
1173}
1174
1175
1176
059ec3d9
PH
1177
1178
1179/*************************************************
1180* Get address(es) from DNS record *
1181*************************************************/
1182
d57d474f 1183/* The record type is either T_A for an IPv4 address or T_AAAA for an IPv6 address.
059ec3d9
PH
1184
1185Argument:
1186 dnsa the DNS answer block
1187 rr the RR
1188
e1a3f32f 1189Returns: pointer to a chain of dns_address items; NULL when the dnsa was overrun
059ec3d9
PH
1190*/
1191
1192dns_address *
1193dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1194{
e1a3f32f
JH
1195dns_address * yield = NULL;
1196uschar * dnsa_lim = dnsa->answer + dnsa->answerlen;
059ec3d9
PH
1197
1198if (rr->type == T_A)
1199 {
d2a2c69b 1200 uschar *p = US rr->data;
e1a3f32f
JH
1201 if (p + 4 <= dnsa_lim)
1202 {
1203 yield = store_get(sizeof(dns_address) + 20);
1204 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1205 yield->next = NULL;
1206 }
059ec3d9
PH
1207 }
1208
1209#if HAVE_IPV6
1210
059ec3d9
PH
1211else
1212 {
e1a3f32f
JH
1213 if (rr->data + 16 <= dnsa_lim)
1214 {
d57d474f
JH
1215 struct in6_addr in6;
1216 int i;
f794c12b 1217 for (i = 0; i < 16; i++) in6.s6_addr[i] = rr->data[i];
e1a3f32f 1218 yield = store_get(sizeof(dns_address) + 50);
d57d474f 1219 inet_ntop(AF_INET6, &in6, CS yield->address, 50);
e1a3f32f
JH
1220 yield->next = NULL;
1221 }
059ec3d9
PH
1222 }
1223#endif /* HAVE_IPV6 */
1224
1225return yield;
1226}
1227
476be7e2
JH
1228
1229
1230void
1231dns_pattern_init(void)
1232{
1233if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1234 regex_check_dns_names =
1235 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);
1236}
1237
8c51eead
JH
1238/* vi: aw ai sw=2
1239*/
059ec3d9 1240/* End of dns.c */