Always check return from tls_export_cert()
[exim.git] / src / src / dns.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions for interfacing with the DNS. */
9
10#include "exim.h"
11
12
059ec3d9 13
bef5a11f
PH
14/*************************************************
15* Fake DNS resolver *
16*************************************************/
17
18/* This function is called instead of res_search() when Exim is running in its
19test harness. It recognizes some special domain names, and uses them to force
433a2980
PH
20failure and retry responses (optionally with a delay). Otherwise, it calls an
21external utility that mocks-up a nameserver, if it can find the utility.
22If not, it passes its arguments on to res_search(). The fake nameserver may
23also return a code specifying that the name should be passed on.
bef5a11f
PH
24
25Background: the original test suite required a real nameserver to carry the
8e013028 26test zones, whereas the new test suite has the fake server for portability. This
e7726cbf 27code supports both.
bef5a11f
PH
28
29Arguments:
e7726cbf 30 domain the domain name
bef5a11f
PH
31 type the DNS record type
32 answerptr where to put the answer
33 size size of the answer area
34
35Returns: length of returned data, or -1 on error (h_errno set)
36*/
37
38static int
1dc92d5a 39fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
bef5a11f 40{
e7726cbf 41int len = Ustrlen(domain);
433a2980 42int asize = size; /* Locally modified */
f3ebb786 43uschar * name;
433a2980
PH
44uschar utilname[256];
45uschar *aptr = answerptr; /* Locally modified */
46struct stat statbuf;
47
48/* Remove terminating dot. */
e7726cbf
PH
49
50if (domain[len - 1] == '.') len--;
f3ebb786 51name = string_copyn(domain, len);
bef5a11f 52
433a2980
PH
53/* Look for the fakens utility, and if it exists, call it. */
54
5f3d0983
HSHR
55(void)string_format(utilname, sizeof(utilname), "%s/bin/fakens",
56 config_main_directory);
433a2980
PH
57
58if (stat(CS utilname, &statbuf) >= 0)
bef5a11f 59 {
433a2980
PH
60 pid_t pid;
61 int infd, outfd, rc;
62 uschar *argv[5];
63
3735e326 64 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n", name, dns_text_type(type));
433a2980
PH
65
66 argv[0] = utilname;
5f3d0983 67 argv[1] = config_main_directory;
433a2980
PH
68 argv[2] = name;
69 argv[3] = dns_text_type(type);
70 argv[4] = NULL;
71
72 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE);
73 if (pid < 0)
74 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
75 strerror(errno));
76
77 len = 0;
78 rc = -1;
79 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
80 {
81 len += rc;
82 aptr += rc; /* Don't modify the actual arguments, because they */
83 asize -= rc; /* may need to be passed on to res_search(). */
84 }
bef5a11f 85
aa7751be 86 /* If we ran out of output buffer before exhausting the return,
1fb7660f
JH
87 carry on reading and counting it. */
88
89 if (asize == 0)
90 while ((rc = read(outfd, name, sizeof(name))) > 0)
91 len += rc;
92
433a2980
PH
93 if (rc < 0)
94 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
95 strerror(errno));
bef5a11f 96
433a2980 97 switch(child_close(pid, 0))
bef5a11f 98 {
433a2980
PH
99 case 0: return len;
100 case 1: h_errno = HOST_NOT_FOUND; return -1;
101 case 2: h_errno = TRY_AGAIN; return -1;
102 default:
103 case 3: h_errno = NO_RECOVERY; return -1;
104 case 4: h_errno = NO_DATA; return -1;
105 case 5: /* Pass on to res_search() */
106 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
bef5a11f
PH
107 }
108 }
8e013028
HSHR
109else
110 {
4cea764f 111 DEBUG(D_dns) debug_printf("fakens (%s) not found\n", utilname);
8e013028 112 }
bef5a11f 113
433a2980 114/* fakens utility not found, or it returned "pass on" */
bef5a11f 115
433a2980 116DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
e7726cbf
PH
117
118return res_search(CS domain, C_IN, type, answerptr, size);
bef5a11f
PH
119}
120
121
059ec3d9
PH
122
123/*************************************************
124* Initialize and configure resolver *
125*************************************************/
126
127/* Initialize the resolver and the storage for holding DNS answers if this is
128the first time we have been here, and set the resolver options.
129
130Arguments:
131 qualify_single TRUE to set the RES_DEFNAMES option
132 search_parents TRUE to set the RES_DNSRCH option
8c51eead 133 use_dnssec TRUE to set the RES_USE_DNSSEC option
059ec3d9
PH
134
135Returns: nothing
136*/
137
138void
8c51eead 139dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
059ec3d9 140{
5bfb4cdf
PP
141res_state resp = os_get_dns_resolver_res();
142
143if ((resp->options & RES_INIT) == 0)
059ec3d9 144 {
5bfb4cdf
PP
145 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
146 os_put_dns_resolver_res(resp);
059ec3d9 147 res_init();
5bfb4cdf
PP
148 DEBUG(D_resolver) resp->options |= RES_DEBUG;
149 os_put_dns_resolver_res(resp);
059ec3d9
PH
150 }
151
5bfb4cdf
PP
152resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
153resp->options |= (qualify_single? RES_DEFNAMES : 0) |
059ec3d9 154 (search_parents? RES_DNSRCH : 0);
5bfb4cdf
PP
155if (dns_retrans > 0) resp->retrans = dns_retrans;
156if (dns_retry > 0) resp->retry = dns_retry;
e97d1f08
PP
157
158#ifdef RES_USE_EDNS0
159if (dns_use_edns0 >= 0)
160 {
161 if (dns_use_edns0)
5bfb4cdf 162 resp->options |= RES_USE_EDNS0;
e97d1f08 163 else
5bfb4cdf 164 resp->options &= ~RES_USE_EDNS0;
e97d1f08
PP
165 DEBUG(D_resolver)
166 debug_printf("Coerced resolver EDNS0 support %s.\n",
167 dns_use_edns0 ? "on" : "off");
168 }
169#else
170if (dns_use_edns0 >= 0)
171 DEBUG(D_resolver)
172 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
173 dns_use_edns0 ? "" : "un");
174#endif
5bfb4cdf 175
1f4a55da
PP
176#ifndef DISABLE_DNSSEC
177# ifdef RES_USE_DNSSEC
178# ifndef RES_USE_EDNS0
179# error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
180# endif
8c51eead
JH
181if (use_dnssec)
182 resp->options |= RES_USE_DNSSEC;
0fbd9bff 183if (dns_dnssec_ok >= 0)
1f4a55da 184 {
0fbd9bff 185 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
1f4a55da
PP
186 {
187 DEBUG(D_resolver)
0fbd9bff 188 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
1f4a55da
PP
189 }
190 else
191 {
0fbd9bff 192 if (dns_dnssec_ok)
1f4a55da
PP
193 resp->options |= RES_USE_DNSSEC;
194 else
195 resp->options &= ~RES_USE_DNSSEC;
196 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
0fbd9bff 197 dns_dnssec_ok ? "on" : "off");
1f4a55da
PP
198 }
199 }
200# else
0fbd9bff 201if (dns_dnssec_ok >= 0)
1f4a55da
PP
202 DEBUG(D_resolver)
203 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
0fbd9bff 204 dns_dnssec_ok ? "" : "un");
8c51eead
JH
205if (use_dnssec)
206 DEBUG(D_resolver)
93d4b03a 207 debug_printf("Unable to set DNSSEC without resolver support.\n");
1f4a55da
PP
208# endif
209#endif /* DISABLE_DNSSEC */
210
5bfb4cdf 211os_put_dns_resolver_res(resp);
059ec3d9
PH
212}
213
214
215
216/*************************************************
217* Build key name for PTR records *
218*************************************************/
219
220/* This function inverts an IP address and adds the relevant domain, to produce
221a name that can be used to look up PTR records.
222
223Arguments:
224 string the IP address as a string
225 buffer a suitable buffer, long enough to hold the result
226
227Returns: nothing
228*/
229
230void
55414b25 231dns_build_reverse(const uschar *string, uschar *buffer)
059ec3d9 232{
55414b25 233const uschar *p = string + Ustrlen(string);
059ec3d9
PH
234uschar *pp = buffer;
235
236/* Handle IPv4 address */
237
238#if HAVE_IPV6
239if (Ustrchr(string, ':') == NULL)
240#endif
241 {
d7978c0f 242 for (int i = 0; i < 4; i++)
059ec3d9 243 {
55414b25 244 const uschar *ppp = p;
059ec3d9
PH
245 while (ppp > string && ppp[-1] != '.') ppp--;
246 Ustrncpy(pp, ppp, p - ppp);
247 pp += p - ppp;
248 *pp++ = '.';
249 p = ppp - 1;
250 }
f3ebb786 251 Ustrcpy(pp, US"in-addr.arpa");
059ec3d9
PH
252 }
253
254/* Handle IPv6 address; convert to binary so as to fill out any
255abbreviation in the textual form. */
256
257#if HAVE_IPV6
258else
259 {
059ec3d9
PH
260 int v6[4];
261 (void)host_aton(string, v6);
262
263 /* The original specification for IPv6 reverse lookup was to invert each
264 nibble, and look in the ip6.int domain. The domain was subsequently
265 changed to ip6.arpa. */
266
d7978c0f
JH
267 for (int i = 3; i >= 0; i--)
268 for (int j = 0; j < 32; j += 4)
5976eb99 269 pp += sprintf(CS pp, "%x.", (v6[i] >> j) & 15);
f3ebb786 270 Ustrcpy(pp, US"ip6.arpa.");
059ec3d9
PH
271
272 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
273 with A6 records. However, it fell out of favour when they did. The
274 alternative was to construct a binary key, and look in ip6.arpa. I tried
275 to make this code do that, but I could not make it work on Solaris 8. The
276 resolver seems to lose the initial backslash somehow. However, now that
277 this style of reverse lookup has been dropped, it doesn't matter. These
278 lines are left here purely for historical interest. */
279
280 /**************************************************
281 Ustrcpy(pp, "\\[x");
282 pp += 3;
283
d7978c0f 284 for (int i = 0; i < 4; i++)
059ec3d9
PH
285 {
286 sprintf(pp, "%08X", v6[i]);
287 pp += 8;
288 }
f3ebb786 289 Ustrcpy(pp, US"].ip6.arpa.");
059ec3d9
PH
290 **************************************************/
291
292 }
293#endif
294}
295
296
297
298
2a407b17
JH
299/* Increment the aptr in dnss, checking against dnsa length.
300Return: TRUE for a bad result
301*/
302static BOOL
dd708fd7 303dnss_inc_aptr(const dns_answer * dnsa, dns_scan * dnss, unsigned delta)
2a407b17
JH
304{
305return (dnss->aptr += delta) >= dnsa->answer + dnsa->answerlen;
306}
307
059ec3d9
PH
308/*************************************************
309* Get next DNS record from answer block *
310*************************************************/
311
312/* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
e5a9dba6
PH
313RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
314scan the additional records, and reset == RESET_NEXT to get the next record.
315The result is in static storage which must be copied if it is to be preserved.
059ec3d9
PH
316
317Arguments:
318 dnsa pointer to dns answer block
319 dnss pointer to dns scan block
4c04137d 320 reset option specifying what portion to scan, as described above
059ec3d9
PH
321
322Returns: next dns record, or NULL when no more
323*/
324
325dns_record *
dd708fd7 326dns_next_rr(const dns_answer *dnsa, dns_scan *dnss, int reset)
059ec3d9 327{
dd708fd7 328const HEADER * h = (const HEADER *)dnsa->answer;
059ec3d9
PH
329int namelen;
330
2a407b17
JH
331char * trace = NULL;
332#ifdef rr_trace
333# define TRACE DEBUG(D_dns)
334#else
335trace = trace;
336# define TRACE if (FALSE)
337#endif
338
059ec3d9
PH
339/* Reset the saved data when requested to, and skip to the first required RR */
340
341if (reset != RESET_NEXT)
342 {
343 dnss->rrcount = ntohs(h->qdcount);
d093f8e5 344 TRACE debug_printf("%s: reset (Q rrcount %d)\n", __FUNCTION__, dnss->rrcount);
059ec3d9
PH
345 dnss->aptr = dnsa->answer + sizeof(HEADER);
346
347 /* Skip over questions; failure to expand the name just gives up */
348
349 while (dnss->rrcount-- > 0)
350 {
2a407b17 351 TRACE trace = "Q-namelen";
059ec3d9 352 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
2a407b17
JH
353 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
354 if (namelen < 0) goto null_return;
355 /* skip name & type & class */
356 TRACE trace = "Q-skip";
dd708fd7 357 if (dnss_inc_aptr(dnsa, dnss, namelen+4)) goto null_return;
059ec3d9
PH
358 }
359
360 /* Get the number of answer records. */
361
362 dnss->rrcount = ntohs(h->ancount);
d093f8e5 363 TRACE debug_printf("%s: reset (A rrcount %d)\n", __FUNCTION__, dnss->rrcount);
059ec3d9 364
e5a9dba6
PH
365 /* Skip over answers if we want to look at the authority section. Also skip
366 the NS records (i.e. authority section) if wanting to look at the additional
059ec3d9
PH
367 records. */
368
2a407b17
JH
369 if (reset == RESET_ADDITIONAL)
370 {
371 TRACE debug_printf("%s: additional\n", __FUNCTION__);
372 dnss->rrcount += ntohs(h->nscount);
d093f8e5 373 TRACE debug_printf("%s: reset (NS rrcount %d)\n", __FUNCTION__, dnss->rrcount);
2a407b17 374 }
e5a9dba6
PH
375
376 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
059ec3d9 377 {
2a407b17
JH
378 TRACE if (reset == RESET_AUTHORITY)
379 debug_printf("%s: authority\n", __FUNCTION__);
059ec3d9
PH
380 while (dnss->rrcount-- > 0)
381 {
2a407b17 382 TRACE trace = "A-namelen";
059ec3d9 383 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
2a407b17
JH
384 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
385 if (namelen < 0) goto null_return;
386 /* skip name, type, class & TTL */
387 TRACE trace = "A-hdr";
dd708fd7 388 if (dnss_inc_aptr(dnsa, dnss, namelen+8)) goto null_return;
059ec3d9 389 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
2a407b17
JH
390 /* skip over it */
391 TRACE trace = "A-skip";
dd708fd7 392 if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) goto null_return;
059ec3d9 393 }
2a407b17 394 dnss->rrcount = reset == RESET_AUTHORITY
e5a9dba6 395 ? ntohs(h->nscount) : ntohs(h->arcount);
d093f8e5
JH
396 TRACE debug_printf("%s: reset (%s rrcount %d)\n", __FUNCTION__,
397 reset == RESET_AUTHORITY ? "NS" : "AR", dnss->rrcount);
059ec3d9 398 }
2a407b17 399 TRACE debug_printf("%s: %d RRs to read\n", __FUNCTION__, dnss->rrcount);
059ec3d9 400 }
2a407b17
JH
401else
402 TRACE debug_printf("%s: next (%d left)\n", __FUNCTION__, dnss->rrcount);
059ec3d9 403
059ec3d9
PH
404/* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
405contains the number of RR records left. */
406
407if (dnss->rrcount-- <= 0) return NULL;
408
409/* If expanding the RR domain name fails, behave as if no more records
410(something safe). */
411
2a407b17 412TRACE trace = "R-namelen";
059ec3d9 413namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
2a407b17
JH
414 (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
415if (namelen < 0) goto null_return;
059ec3d9
PH
416
417/* Move the pointer past the name and fill in the rest of the data structure
418from the following bytes. */
419
2a407b17 420TRACE trace = "R-name";
dd708fd7 421if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return;
2a407b17
JH
422
423GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
424TRACE trace = "R-class";
dd708fd7 425if (dnss_inc_aptr(dnsa, dnss, 2)) goto null_return; /* Don't want class */
2a407b17
JH
426GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */
427GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
428dnss->srr.data = dnss->aptr; /* The record's data follows */
429
430/* Unchecked increment ok here since no further access on this iteration;
431will be checked on next at "R-name". */
432
433dnss->aptr += dnss->srr.size; /* Advance to next RR */
059ec3d9
PH
434
435/* Return a pointer to the dns_record structure within the dns_answer. This is
436for convenience so that the scans can use nice-looking for loops. */
437
2a407b17
JH
438return &dnss->srr;
439
440null_return:
d093f8e5
JH
441 TRACE debug_printf("%s: terminate (%d RRs left). Last op: %s; errno %d %s\n",
442 __FUNCTION__, dnss->rrcount, trace, errno, strerror(errno));
2a407b17
JH
443 dnss->rrcount = 0;
444 return NULL;
059ec3d9
PH
445}
446
447
8688d177 448/* Extract the AUTHORITY information from the answer. If the answer isn't
4c04137d 449authoritative (AA not set), we do not extract anything.
8db90b31 450
4c04137d 451The AUTHORITY section contains NS records if the name in question was found,
8688d177
JH
452it contains a SOA record otherwise. (This is just from experience and some
453tests, is there some spec?)
8db90b31 454
8688d177
JH
455Scan the whole AUTHORITY section, since it may contain other records
456(e.g. NSEC3) too.
457
458Return: name for the authority, in an allocated string, or NULL if none found */
09b80b4e
JH
459
460static const uschar *
461dns_extract_auth_name(const dns_answer * dnsa) /* FIXME: const dns_answer */
9820a77f 462{
09b80b4e 463dns_scan dnss;
dd708fd7 464const HEADER * h = (const HEADER *) dnsa->answer;
09b80b4e 465
8688d177 466if (h->nscount && h->aa)
d7978c0f 467 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
8688d177
JH
468 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
469 if (rr->type == (h->ancount ? T_NS : T_SOA))
470 return string_copy(rr->name);
09b80b4e 471return NULL;
9820a77f
HSHR
472}
473
474
059ec3d9
PH
475
476
477/*************************************************
1f4a55da
PP
478* Return whether AD bit set in DNS result *
479*************************************************/
480
481/* We do not perform DNSSEC work ourselves; if the administrator has installed
482a verifying resolver which sets AD as appropriate, though, we'll use that.
4c04137d 483(AD = Authentic Data, AA = Authoritative Answer)
1f4a55da
PP
484
485Argument: pointer to dns answer block
486Returns: bool indicating presence of AD bit
487*/
488
489BOOL
4a142059 490dns_is_secure(const dns_answer * dnsa)
1f4a55da
PP
491{
492#ifdef DISABLE_DNSSEC
493DEBUG(D_dns)
494 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
495return FALSE;
496#else
dd708fd7 497const HEADER * h = (const HEADER *) dnsa->answer;
09b80b4e
JH
498const uschar * auth_name;
499const uschar * trusted;
9820a77f
HSHR
500
501if (h->ad) return TRUE;
9820a77f 502
4c04137d 503/* If the resolver we ask is authoritative for the domain in question, it
09b80b4e
JH
504* may not set the AD but the AA bit. If we explicitly trust
505* the resolver for that domain (via a domainlist in dns_trust_aa),
506* we return TRUE to indicate a secure answer.
507*/
9820a77f 508
09b80b4e
JH
509if ( !h->aa
510 || !dns_trust_aa
25bf2076
HSHR
511 || !(trusted = expand_string(dns_trust_aa))
512 || !*trusted
09b80b4e
JH
513 || !(auth_name = dns_extract_auth_name(dnsa))
514 || OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL,
94431adb 515 MCL_DOMAIN, TRUE, NULL)
09b80b4e
JH
516 )
517 return FALSE;
9820a77f 518
09b80b4e
JH
519DEBUG(D_dns) debug_printf("DNS faked the AD bit "
520 "(got AA and matched with dns_trust_aa (%s in %s))\n",
521 auth_name, dns_trust_aa);
9820a77f 522
09b80b4e 523return TRUE;
1f4a55da
PP
524#endif
525}
526
4a142059
JH
527static void
528dns_set_insecure(dns_answer * dnsa)
529{
e87c01c7 530#ifndef DISABLE_DNSSEC
4a142059 531HEADER * h = (HEADER *)dnsa->answer;
8688d177 532h->aa = h->ad = 0;
e87c01c7 533#endif
4a142059
JH
534}
535
221dff13
HSHR
536/************************************************
537 * Check whether the AA bit is set *
538 * We need this to warn if we requested AD *
4c04137d 539 * from an authoritative server *
221dff13
HSHR
540 ************************************************/
541
542BOOL
543dns_is_aa(const dns_answer *dnsa)
544{
e87c01c7
MH
545#ifdef DISABLE_DNSSEC
546return FALSE;
547#else
dd708fd7 548return ((const HEADER*)dnsa->answer)->aa;
e87c01c7 549#endif
221dff13 550}
1f4a55da
PP
551
552
553
554/*************************************************
059ec3d9
PH
555* Turn DNS type into text *
556*************************************************/
557
885ccd3e
PH
558/* Turn the coded record type into a string for printing. All those that Exim
559uses should be included here.
059ec3d9
PH
560
561Argument: record type
562Returns: pointer to string
563*/
564
565uschar *
566dns_text_type(int t)
567{
568switch(t)
569 {
33397d19
PH
570 case T_A: return US"A";
571 case T_MX: return US"MX";
572 case T_AAAA: return US"AAAA";
573 case T_A6: return US"A6";
574 case T_TXT: return US"TXT";
eae0036b 575 case T_SPF: return US"SPF";
33397d19 576 case T_PTR: return US"PTR";
885ccd3e 577 case T_SOA: return US"SOA";
33397d19
PH
578 case T_SRV: return US"SRV";
579 case T_NS: return US"NS";
8e669ac1 580 case T_CNAME: return US"CNAME";
1e06383a 581 case T_TLSA: return US"TLSA";
33397d19 582 default: return US"?";
059ec3d9
PH
583 }
584}
585
586
587
588/*************************************************
589* Cache a failed DNS lookup result *
590*************************************************/
591
cabf3e99
JH
592static void
593dns_fail_tag(uschar * buf, const uschar * name, int dns_type)
594{
595res_state resp = os_get_dns_resolver_res();
596sprintf(CS buf, "%.255s-%s-%lx", name, dns_text_type(dns_type),
597 (unsigned long) resp->options);
598}
599
600
059ec3d9
PH
601/* We cache failed lookup results so as not to experience timeouts many
602times for the same domain. We need to retain the resolver options because they
603may change. For successful lookups, we rely on resolver and/or name server
604caching.
605
606Arguments:
607 name the domain name
608 type the lookup type
609 rc the return code
610
611Returns: the return code
612*/
613
614static int
1dc92d5a 615dns_return(const uschar * name, int type, int rc)
059ec3d9 616{
f3ebb786 617tree_node *node = store_get_perm(sizeof(tree_node) + 290, TRUE);
cabf3e99 618dns_fail_tag(node->name, name, type);
059ec3d9
PH
619node->data.val = rc;
620(void)tree_insertnode(&tree_dns_fails, node);
621return rc;
622}
623
059ec3d9
PH
624/*************************************************
625* Do basic DNS lookup *
626*************************************************/
627
628/* Call the resolver to look up the given domain name, using the given type,
629and check the result. The error code TRY_AGAIN is documented as meaning "non-
4c04137d 630Authoritative Host not found, or SERVERFAIL". Sometimes there are badly set
059ec3d9
PH
631up nameservers that produce this error continually, so there is the option of
632providing a list of domains for which this is treated as a non-existent
633host.
634
75c121f0
JH
635The dns_answer structure is pretty big; enough to hold a max-sized DNS message
636- so best allocated from fast-release memory. As of writing, all our callers
637use a stack-auto variable.
638
059ec3d9
PH
639Arguments:
640 dnsa pointer to dns_answer structure
641 name name to look up
642 type type of DNS record required (T_A, T_MX, etc)
643
644Returns: DNS_SUCCEED successful lookup
645 DNS_NOMATCH name not found (NXDOMAIN)
646 or name contains illegal characters (if checking)
30e18802 647 or name is an IP address (for IP address lookup)
059ec3d9
PH
648 DNS_NODATA domain exists, but no data for this type (NODATA)
649 DNS_AGAIN soft failure, try again later
650 DNS_FAIL DNS failure
651*/
652
653int
1dc92d5a 654dns_basic_lookup(dns_answer *dnsa, const uschar *name, int type)
059ec3d9
PH
655{
656#ifndef STAND_ALONE
7156b1ef 657int rc = -1;
55414b25 658const uschar *save_domain;
059ec3d9
PH
659#endif
660
661tree_node *previous;
662uschar node_name[290];
663
664/* DNS lookup failures of any kind are cached in a tree. This is mainly so that
665a timeout on one domain doesn't happen time and time again for messages that
666have many addresses in the same domain. We rely on the resolver and name server
667caching for successful lookups. */
668
cabf3e99 669dns_fail_tag(node_name, name, type);
4b0fe319 670if ((previous = tree_search(tree_dns_fails, node_name)))
059ec3d9
PH
671 {
672 DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: using cached value %s\n",
673 name, dns_text_type(type),
d8d9f930
JH
674 previous->data.val == DNS_NOMATCH ? "DNS_NOMATCH" :
675 previous->data.val == DNS_NODATA ? "DNS_NODATA" :
676 previous->data.val == DNS_AGAIN ? "DNS_AGAIN" :
677 previous->data.val == DNS_FAIL ? "DNS_FAIL" : "??");
059ec3d9
PH
678 return previous->data.val;
679 }
680
8c5d388a 681#ifdef SUPPORT_I18N
9d4319df
JH
682/* Convert all names to a-label form before doing lookup */
683 {
684 uschar * alabel;
685 uschar * errstr = NULL;
766e7a65
JH
686 DEBUG(D_dns) if (string_is_utf8(name))
687 debug_printf("convert utf8 '%s' to alabel for for lookup\n", name);
9d4319df
JH
688 if ((alabel = string_domain_utf8_to_alabel(name, &errstr)), errstr)
689 {
690 DEBUG(D_dns)
37bf366e 691 debug_printf("DNS name '%s' utf8 conversion to alabel failed: %s\n", name,
9d4319df 692 errstr);
8768d548 693 f.host_find_failed_syntax = TRUE;
9d4319df
JH
694 return DNS_NOMATCH;
695 }
696 name = alabel;
697 }
698#endif
699
4c04137d 700/* If configured, check the hygiene of the name passed to lookup. Otherwise,
059ec3d9
PH
701although DNS lookups may give REFUSED at the lower level, some resolvers
702turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
703domains cannot be in the DNS. The check is now done by a regular expression;
704give it space for substring storage to save it having to get its own if the
705regex has substrings that are used - the default uses a conditional.
706
707This test is omitted for PTR records. These occur only in calls from the dnsdb
708lookup, which constructs the names itself, so they should be OK. Besides,
709bitstring labels don't conform to normal name syntax. (But the aren't used any
710more.)
711
14bc9cf0
JH
712For SRV records, we omit the initial _smtp._tcp. components at the start.
713The check has been seen to bite on the destination of a SRV lookup that
714initiall hit a CNAME, for which the next name had only two components.
715RFC2782 makes no mention of the possibiility of CNAMES, but the Wikipedia
716article on SRV says they are not a valid configuration. */
059ec3d9
PH
717
718#ifndef STAND_ALONE /* Omit this for stand-alone tests */
719
482d1455 720if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
059ec3d9 721 {
1dc92d5a 722 const uschar *checkname = name;
059ec3d9
PH
723 int ovector[3*(EXPAND_MAXN+1)];
724
476be7e2 725 dns_pattern_init();
059ec3d9
PH
726
727 /* For an SRV lookup, skip over the first two components (the service and
728 protocol names, which both start with an underscore). */
729
b4161d10 730 if (type == T_SRV || type == T_TLSA)
059ec3d9 731 {
14bc9cf0
JH
732 while (*checkname && *checkname++ != '.') ;
733 while (*checkname && *checkname++ != '.') ;
059ec3d9
PH
734 }
735
1dc92d5a 736 if (pcre_exec(regex_check_dns_names, NULL, CCS checkname, Ustrlen(checkname),
d093f8e5 737 0, PCRE_EOPT, ovector, nelem(ovector)) < 0)
059ec3d9
PH
738 {
739 DEBUG(D_dns)
740 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
741 dns_text_type(type));
8768d548 742 f.host_find_failed_syntax = TRUE;
059ec3d9
PH
743 return DNS_NOMATCH;
744 }
745 }
746
747#endif /* STAND_ALONE */
748
749/* Call the resolver; for an overlong response, res_search() will return the
bef5a11f
PH
750number of bytes the message would need, so we need to check for this case. The
751effect is to truncate overlong data.
752
30e18802
PH
753On some systems, res_search() will recognize "A-for-A" queries and return
754the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
755nameservers are also believed to do this. It is, of course, contrary to the
756specification of the DNS, so we lock it out. */
757
cc00f4af 758if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
30e18802
PH
759 return DNS_NOMATCH;
760
761/* If we are running in the test harness, instead of calling the normal resolver
bef5a11f
PH
762(res_search), we call fakens_search(), which recognizes certain special
763domains, and interfaces to a fake nameserver for certain special zones. */
764
8768d548 765dnsa->answerlen = f.running_in_test_harness
d093f8e5
JH
766 ? fakens_search(name, type, dnsa->answer, sizeof(dnsa->answer))
767 : res_search(CCS name, C_IN, type, dnsa->answer, sizeof(dnsa->answer));
059ec3d9 768
d093f8e5 769if (dnsa->answerlen > (int) sizeof(dnsa->answer))
80a47a2c 770 {
9e7e0f6a
JH
771 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet"
772 " (size %d), truncating to %u.\n",
773 name, dns_text_type(type), dnsa->answerlen, (unsigned int) sizeof(dnsa->answer));
d093f8e5 774 dnsa->answerlen = sizeof(dnsa->answer);
80a47a2c 775 }
059ec3d9
PH
776
777if (dnsa->answerlen < 0) switch (h_errno)
778 {
779 case HOST_NOT_FOUND:
4b0fe319
JH
780 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
781 "returning DNS_NOMATCH\n", name, dns_text_type(type));
782 return dns_return(name, type, DNS_NOMATCH);
059ec3d9
PH
783
784 case TRY_AGAIN:
4b0fe319
JH
785 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
786 name, dns_text_type(type));
059ec3d9 787
4b0fe319 788 /* Cut this out for various test programs */
1dc92d5a 789#ifndef STAND_ALONE
4b0fe319
JH
790 save_domain = deliver_domain;
791 deliver_domain = string_copy(name); /* set $domain */
792 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
793 MCL_DOMAIN, TRUE, NULL);
794 deliver_domain = save_domain;
795 if (rc != OK)
796 {
797 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
798 return dns_return(name, type, DNS_AGAIN);
799 }
800 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
801 "DNS_NOMATCH\n", name);
802 return dns_return(name, type, DNS_NOMATCH);
059ec3d9 803
1dc92d5a 804#else /* For stand-alone tests */
4b0fe319 805 return dns_return(name, type, DNS_AGAIN);
1dc92d5a 806#endif
059ec3d9
PH
807
808 case NO_RECOVERY:
4b0fe319
JH
809 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
810 "returning DNS_FAIL\n", name, dns_text_type(type));
811 return dns_return(name, type, DNS_FAIL);
059ec3d9
PH
812
813 case NO_DATA:
4b0fe319
JH
814 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
815 "returning DNS_NODATA\n", name, dns_text_type(type));
816 return dns_return(name, type, DNS_NODATA);
059ec3d9
PH
817
818 default:
4b0fe319
JH
819 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
820 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
821 return dns_return(name, type, DNS_FAIL);
059ec3d9
PH
822 }
823
824DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
825 name, dns_text_type(type));
826
827return DNS_SUCCEED;
828}
829
830
831
832
833/************************************************
834* Do a DNS lookup and handle CNAMES *
835************************************************/
836
837/* Look up the given domain name, using the given type. Follow CNAMEs if
838necessary, but only so many times. There aren't supposed to be CNAME chains in
839the DNS, but you are supposed to cope with them if you find them.
d8d9f930
JH
840By default, follow one CNAME since a resolver has been seen, faced with
841an MX request and a CNAME (to an A) but no MX present, returning the CNAME.
059ec3d9
PH
842
843The assumption is made that if the resolver gives back records of the
844requested type *and* a CNAME, we don't need to make another call to look up
845the CNAME. I can't see how it could return only some of the right records. If
846it's done a CNAME lookup in the past, it will have all of them; if not, it
847won't return any.
848
849If fully_qualified_name is not NULL, set it to point to the full name
850returned by the resolver, if this is different to what it is given, unless
851the returned name starts with "*" as some nameservers seem to be returning
766e7a65
JH
852wildcards in this form. In international mode "different" means "alabel
853forms are different".
059ec3d9
PH
854
855Arguments:
856 dnsa pointer to dns_answer structure
857 name domain name to look up
858 type DNS record type (T_A, T_MX, etc)
859 fully_qualified_name if not NULL, return the returned name here if its
860 contents are different (i.e. it must be preset)
861
862Returns: DNS_SUCCEED successful lookup
863 DNS_NOMATCH name not found
864 DNS_NODATA no data found
865 DNS_AGAIN soft failure, try again later
866 DNS_FAIL DNS failure
867*/
868
869int
1dc92d5a 870dns_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 871 const uschar **fully_qualified_name)
059ec3d9 872{
1dc92d5a 873const uschar *orig_name = name;
c85b3043 874BOOL secure_so_far = TRUE;
059ec3d9 875
d8d9f930
JH
876/* By default, assume the resolver follows CNAME chains (and returns NODATA for
877an unterminated one). If it also does that for a CNAME loop, fine; if it returns
878a CNAME (maybe the last?) whine about it. However, retain the coding for dumb
879resolvers hiding behind a config variable. Loop to follow CNAME chains so far,
880but no further... The testsuite tests the latter case, mostly assuming that the
881former will work. */
059ec3d9 882
d7978c0f 883for (int i = 0; i <= dns_cname_loops; i++)
059ec3d9 884 {
806c3df9 885 uschar * data;
d7978c0f 886 dns_record cname_rr, type_rr;
059ec3d9 887 dns_scan dnss;
1b76ad22 888 int rc;
059ec3d9
PH
889
890 /* DNS lookup failures get passed straight back. */
891
dd708fd7
JH
892 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED)
893 return rc;
059ec3d9
PH
894
895 /* We should have either records of the required type, or a CNAME record,
896 or both. We need to know whether both exist for getting the fully qualified
897 name, but avoid scanning more than necessary. Note that we must copy the
898 contents of any rr blocks returned by dns_next_rr() as they use the same
899 area in the dnsa block. */
900
901 cname_rr.data = type_rr.data = NULL;
d7978c0f 902 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
8688d177 903 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
059ec3d9
PH
904 if (rr->type == type)
905 {
906 if (type_rr.data == NULL) type_rr = *rr;
907 if (cname_rr.data != NULL) break;
908 }
dd708fd7
JH
909 else if (rr->type == T_CNAME)
910 cname_rr = *rr;
059ec3d9 911
a2042e78
PH
912 /* For the first time round this loop, if a CNAME was found, take the fully
913 qualified name from it; otherwise from the first data record, if present. */
059ec3d9 914
dd708fd7 915 if (i == 0 && fully_qualified_name)
059ec3d9 916 {
dd708fd7
JH
917 uschar * rr_name = cname_rr.data
918 ? cname_rr.name : type_rr.data ? type_rr.name : NULL;
766e7a65
JH
919 if ( rr_name
920 && Ustrcmp(rr_name, *fully_qualified_name) != 0
921 && rr_name[0] != '*'
8c5d388a 922#ifdef SUPPORT_I18N
766e7a65
JH
923 && ( !string_is_utf8(*fully_qualified_name)
924 || Ustrcmp(rr_name,
925 string_domain_utf8_to_alabel(*fully_qualified_name, NULL)) != 0
926 )
927#endif
928 )
929 *fully_qualified_name = string_copy_dnsdomain(rr_name);
059ec3d9
PH
930 }
931
932 /* If any data records of the correct type were found, we are done. */
933
806c3df9 934 if (type_rr.data)
c85b3043
JH
935 {
936 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
4a142059 937 dns_set_insecure(dnsa);
c85b3043
JH
938 return DNS_SUCCEED;
939 }
059ec3d9
PH
940
941 /* If there are no data records, we need to re-scan the DNS using the
942 domain given in the CNAME record, which should exist (otherwise we should
943 have had a failure from dns_lookup). However code against the possibility of
944 its not existing. */
945
806c3df9
JH
946 if (!cname_rr.data)
947 return DNS_FAIL;
948
f3ebb786
JH
949 /* DNS data comes from the outside, hence tainted */
950 data = store_get(256, TRUE);
1b76ad22
JH
951 if (dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
952 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, 256) < 0)
806c3df9 953 return DNS_FAIL;
059ec3d9 954 name = data;
a2042e78 955
c85b3043
JH
956 if (!dns_is_secure(dnsa))
957 secure_so_far = FALSE;
958
a2042e78 959 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
059ec3d9
PH
960 } /* Loop back to do another lookup */
961
962/*Control reaches here after 10 times round the CNAME loop. Something isn't
963right... */
964
965log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
966return DNS_FAIL;
967}
968
969
970
33397d19
PH
971
972
973
974/************************************************
975* Do a DNS lookup and handle virtual types *
976************************************************/
977
9820a77f 978/* This function handles some invented "lookup types" that synthesize features
8e669ac1 979not available in the basic types. The special types all have negative values.
33397d19
PH
980Positive type values are passed straight on to dns_lookup().
981
982Arguments:
983 dnsa pointer to dns_answer structure
984 name domain name to look up
985 type DNS record type (T_A, T_MX, etc or a "special")
986 fully_qualified_name if not NULL, return the returned name here if its
987 contents are different (i.e. it must be preset)
988
989Returns: DNS_SUCCEED successful lookup
990 DNS_NOMATCH name not found
991 DNS_NODATA no data found
992 DNS_AGAIN soft failure, try again later
993 DNS_FAIL DNS failure
994*/
995
996int
1dc92d5a 997dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 998 const uschar **fully_qualified_name)
33397d19 999{
d2a2c69b 1000switch (type)
e5a9dba6 1001 {
d2a2c69b
JH
1002 /* The "mx hosts only" type doesn't require any special action here */
1003 case T_MXH:
1705dd20 1004 return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
d2a2c69b
JH
1005
1006 /* Find nameservers for the domain or the nearest enclosing zone, excluding
1007 the root servers. */
1008 case T_ZNS:
1705dd20
JH
1009 type = T_NS;
1010 /* FALLTHROUGH */
d2a2c69b 1011 case T_SOA:
1705dd20
JH
1012 {
1013 const uschar *d = name;
1014 while (d != 0)
1015 {
1016 int rc = dns_lookup(dnsa, d, type, fully_qualified_name);
1017 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
1018 while (*d != 0 && *d != '.') d++;
1019 if (*d++ == 0) break;
1020 }
1021 return DNS_NOMATCH;
1022 }
d2a2c69b
JH
1023
1024 /* Try to look up the Client SMTP Authorization SRV record for the name. If
1025 there isn't one, search from the top downwards for a CSA record in a parent
1026 domain, which might be making assertions about subdomains. If we find a record
1027 we set fully_qualified_name to whichever lookup succeeded, so that the caller
1028 can tell whether to look at the explicit authorization field or the subdomain
1029 assertion field. */
1030 case T_CSA:
1705dd20 1031 {
cab0c277 1032 uschar *srvname, *namesuff, *tld;
1705dd20
JH
1033 int priority, weight, port;
1034 int limit, rc, i;
1035 BOOL ipv6;
1036 dns_record *rr;
1037 dns_scan dnss;
1038
1039 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
1040
1041 srvname = string_sprintf("_client._smtp.%s", name);
1042 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1043 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
1044 {
1045 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
1046 return rc;
1047 }
d2a2c69b 1048
1705dd20
JH
1049 /* Search for CSA subdomain assertion SRV records from the top downwards,
1050 starting with the 2nd level domain. This order maximizes cache-friendliness.
1051 We skip the top level domains to avoid loading their nameservers and because
1052 we know they'll never have CSA SRV records. */
d2a2c69b 1053
1705dd20
JH
1054 namesuff = Ustrrchr(name, '.');
1055 if (namesuff == NULL) return DNS_NOMATCH;
1056 tld = namesuff + 1;
1057 ipv6 = FALSE;
1058 limit = dns_csa_search_limit;
1059
1060 /* Use more appropriate search parameters if we are in the reverse DNS. */
1061
1062 if (strcmpic(namesuff, US".arpa") == 0)
1063 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
1064 {
1065 namesuff -= 8;
d2a2c69b 1066 tld = namesuff + 1;
1705dd20
JH
1067 limit = 3;
1068 }
1069 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
1070 {
1071 namesuff -= 4;
1072 tld = namesuff + 1;
1073 ipv6 = TRUE;
1074 limit = 3;
1075 }
d2a2c69b 1076
1705dd20 1077 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
d2a2c69b 1078
1705dd20
JH
1079 /* Do not perform the search if the top level or 2nd level domains do not
1080 exist. This is quite common, and when it occurs all the search queries would
1081 go to the root or TLD name servers, which is not friendly. So we check the
1082 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
1083 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
1084 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
1085 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
1086
1087 if (rc == DNS_NOMATCH)
1088 {
1089 /* This is really gross. The successful return value from res_search() is
1090 the packet length, which is stored in dnsa->answerlen. If we get a
1091 negative DNS reply then res_search() returns -1, which causes the bounds
1092 checks for name decompression to fail when it is treated as a packet
1093 length, which in turn causes the authority search to fail. The correct
1094 packet length has been lost inside libresolv, so we have to guess a
1095 replacement value. (The only way to fix this properly would be to
1096 re-implement res_search() and res_query() so that they don't muddle their
1097 success and packet length return values.) For added safety we only reset
1098 the packet length if the packet header looks plausible. */
1099
dd708fd7 1100 const HEADER * h = (const HEADER *)dnsa->answer;
1705dd20
JH
1101 if (h->qr == 1 && h->opcode == QUERY && h->tc == 0
1102 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
1103 && ntohs(h->qdcount) == 1 && ntohs(h->ancount) == 0
1104 && ntohs(h->nscount) >= 1)
75c121f0 1105 dnsa->answerlen = sizeof(dnsa->answer);
1705dd20
JH
1106
1107 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
8688d177 1108 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1705dd20
JH
1109 )
1110 if (rr->type != T_SOA) continue;
1111 else if (strcmpic(rr->name, US"") == 0 ||
1112 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
1113 else break;
1114 }
d2a2c69b 1115
1705dd20
JH
1116 for (i = 0; i < limit; i++)
1117 {
1118 if (ipv6)
1119 {
1120 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
1121 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
1122 namesuff -= 8;
1123 if (namesuff <= name) return DNS_NOMATCH;
1124 }
1125 else
1126 /* Find the start of the preceding domain name label. */
1127 do
1128 if (--namesuff <= name) return DNS_NOMATCH;
1129 while (*namesuff != '.');
1130
1131 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
1132
1133 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
1134 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1135 if (rc == DNS_AGAIN) return rc;
1136 if (rc != DNS_SUCCEED) continue;
1137
1138 /* Check that the SRV record we have found is worth returning. We don't
1139 just return the first one we find, because some lower level SRV record
1140 might make stricter assertions than its parent domain. */
1141
1142 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
8688d177 1143 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1705dd20 1144 {
dd708fd7 1145 const uschar * p = rr->data;
d2a2c69b 1146
1705dd20 1147 /* Extract the numerical SRV fields (p is incremented) */
1705dd20
JH
1148 GETSHORT(priority, p);
1149 GETSHORT(weight, p); weight = weight; /* compiler quietening */
1150 GETSHORT(port, p);
d2a2c69b 1151
1705dd20
JH
1152 /* Check the CSA version number */
1153 if (priority != 1) continue;
d2a2c69b 1154
1705dd20
JH
1155 /* If it's making an interesting assertion, return this response. */
1156 if (port & 1)
d2a2c69b 1157 {
1705dd20
JH
1158 *fully_qualified_name = namesuff + 1;
1159 return DNS_SUCCEED;
d2a2c69b 1160 }
d2a2c69b 1161 }
1705dd20
JH
1162 }
1163 return DNS_NOMATCH;
1164 }
e5a9dba6 1165
d2a2c69b 1166 default:
1705dd20
JH
1167 if (type >= 0)
1168 return dns_lookup(dnsa, name, type, fully_qualified_name);
e5a9dba6
PH
1169 }
1170
33397d19
PH
1171/* Control should never reach here */
1172
1173return DNS_FAIL;
1174}
1175
1176
1177
059ec3d9
PH
1178
1179
1180/*************************************************
1181* Get address(es) from DNS record *
1182*************************************************/
1183
d57d474f 1184/* The record type is either T_A for an IPv4 address or T_AAAA for an IPv6 address.
059ec3d9
PH
1185
1186Argument:
1187 dnsa the DNS answer block
1188 rr the RR
1189
e1a3f32f 1190Returns: pointer to a chain of dns_address items; NULL when the dnsa was overrun
059ec3d9
PH
1191*/
1192
1193dns_address *
1194dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1195{
e1a3f32f
JH
1196dns_address * yield = NULL;
1197uschar * dnsa_lim = dnsa->answer + dnsa->answerlen;
059ec3d9
PH
1198
1199if (rr->type == T_A)
1200 {
d2a2c69b 1201 uschar *p = US rr->data;
e1a3f32f
JH
1202 if (p + 4 <= dnsa_lim)
1203 {
f3ebb786
JH
1204 /* the IP is not regarded as tainted */
1205 yield = store_get(sizeof(dns_address) + 20, FALSE);
e1a3f32f
JH
1206 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1207 yield->next = NULL;
1208 }
059ec3d9
PH
1209 }
1210
1211#if HAVE_IPV6
1212
059ec3d9
PH
1213else
1214 {
e1a3f32f
JH
1215 if (rr->data + 16 <= dnsa_lim)
1216 {
d57d474f 1217 struct in6_addr in6;
d7978c0f 1218 for (int i = 0; i < 16; i++) in6.s6_addr[i] = rr->data[i];
f3ebb786 1219 yield = store_get(sizeof(dns_address) + 50, FALSE);
d57d474f 1220 inet_ntop(AF_INET6, &in6, CS yield->address, 50);
e1a3f32f
JH
1221 yield->next = NULL;
1222 }
059ec3d9
PH
1223 }
1224#endif /* HAVE_IPV6 */
1225
1226return yield;
1227}
1228
476be7e2
JH
1229
1230
1231void
1232dns_pattern_init(void)
1233{
1234if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1235 regex_check_dns_names =
1236 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);
1237}
1238
8c51eead
JH
1239/* vi: aw ai sw=2
1240*/
059ec3d9 1241/* End of dns.c */