Fix more build dependencies
[exim.git] / src / src / dns.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions for interfacing with the DNS. */
9
10#include "exim.h"
11
12
059ec3d9 13
bef5a11f
PH
14/*************************************************
15* Fake DNS resolver *
16*************************************************/
17
18/* This function is called instead of res_search() when Exim is running in its
19test harness. It recognizes some special domain names, and uses them to force
433a2980
PH
20failure and retry responses (optionally with a delay). Otherwise, it calls an
21external utility that mocks-up a nameserver, if it can find the utility.
22If not, it passes its arguments on to res_search(). The fake nameserver may
23also return a code specifying that the name should be passed on.
bef5a11f
PH
24
25Background: the original test suite required a real nameserver to carry the
e7726cbf
PH
26test zones, whereas the new test suit has the fake server for portability. This
27code supports both.
bef5a11f
PH
28
29Arguments:
e7726cbf 30 domain the domain name
bef5a11f
PH
31 type the DNS record type
32 answerptr where to put the answer
33 size size of the answer area
34
35Returns: length of returned data, or -1 on error (h_errno set)
36*/
37
38static int
1dc92d5a 39fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
bef5a11f 40{
e7726cbf 41int len = Ustrlen(domain);
433a2980 42int asize = size; /* Locally modified */
e7726cbf
PH
43uschar *endname;
44uschar name[256];
433a2980
PH
45uschar utilname[256];
46uschar *aptr = answerptr; /* Locally modified */
47struct stat statbuf;
48
49/* Remove terminating dot. */
e7726cbf
PH
50
51if (domain[len - 1] == '.') len--;
52Ustrncpy(name, domain, len);
53name[len] = 0;
54endname = name + len;
bef5a11f 55
433a2980
PH
56/* This code, for forcing TRY_AGAIN and NO_RECOVERY, is here so that it works
57for the old test suite that uses a real nameserver. When the old test suite is
58eventually abandoned, this code could be moved into the fakens utility. */
59
bef5a11f
PH
60if (len >= 14 && Ustrcmp(endname - 14, "test.again.dns") == 0)
61 {
62 int delay = Uatoi(name); /* digits at the start of the name */
63 DEBUG(D_dns) debug_printf("Return from DNS lookup of %s (%s) faked for testing\n",
64 name, dns_text_type(type));
65 if (delay > 0)
66 {
67 DEBUG(D_dns) debug_printf("delaying %d seconds\n", delay);
68 sleep(delay);
69 }
70 h_errno = TRY_AGAIN;
71 return -1;
72 }
73
74if (len >= 13 && Ustrcmp(endname - 13, "test.fail.dns") == 0)
75 {
76 DEBUG(D_dns) debug_printf("Return from DNS lookup of %s (%s) faked for testing\n",
77 name, dns_text_type(type));
78 h_errno = NO_RECOVERY;
79 return -1;
80 }
81
433a2980
PH
82/* Look for the fakens utility, and if it exists, call it. */
83
84(void)string_format(utilname, sizeof(utilname), "%s/../bin/fakens",
85 spool_directory);
86
87if (stat(CS utilname, &statbuf) >= 0)
bef5a11f 88 {
433a2980
PH
89 pid_t pid;
90 int infd, outfd, rc;
91 uschar *argv[5];
92
93 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n",
94 name, dns_text_type(type));
95
96 argv[0] = utilname;
97 argv[1] = spool_directory;
98 argv[2] = name;
99 argv[3] = dns_text_type(type);
100 argv[4] = NULL;
101
102 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE);
103 if (pid < 0)
104 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
105 strerror(errno));
106
107 len = 0;
108 rc = -1;
109 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
110 {
111 len += rc;
112 aptr += rc; /* Don't modify the actual arguments, because they */
113 asize -= rc; /* may need to be passed on to res_search(). */
114 }
bef5a11f 115
433a2980
PH
116 if (rc < 0)
117 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
118 strerror(errno));
bef5a11f 119
433a2980 120 switch(child_close(pid, 0))
bef5a11f 121 {
433a2980
PH
122 case 0: return len;
123 case 1: h_errno = HOST_NOT_FOUND; return -1;
124 case 2: h_errno = TRY_AGAIN; return -1;
125 default:
126 case 3: h_errno = NO_RECOVERY; return -1;
127 case 4: h_errno = NO_DATA; return -1;
128 case 5: /* Pass on to res_search() */
129 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
bef5a11f
PH
130 }
131 }
132
433a2980 133/* fakens utility not found, or it returned "pass on" */
bef5a11f 134
433a2980 135DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
e7726cbf
PH
136
137return res_search(CS domain, C_IN, type, answerptr, size);
bef5a11f
PH
138}
139
140
059ec3d9
PH
141
142/*************************************************
143* Initialize and configure resolver *
144*************************************************/
145
146/* Initialize the resolver and the storage for holding DNS answers if this is
147the first time we have been here, and set the resolver options.
148
149Arguments:
150 qualify_single TRUE to set the RES_DEFNAMES option
151 search_parents TRUE to set the RES_DNSRCH option
8c51eead 152 use_dnssec TRUE to set the RES_USE_DNSSEC option
059ec3d9
PH
153
154Returns: nothing
155*/
156
157void
8c51eead 158dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
059ec3d9 159{
5bfb4cdf
PP
160res_state resp = os_get_dns_resolver_res();
161
162if ((resp->options & RES_INIT) == 0)
059ec3d9 163 {
5bfb4cdf
PP
164 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
165 os_put_dns_resolver_res(resp);
059ec3d9 166 res_init();
5bfb4cdf
PP
167 DEBUG(D_resolver) resp->options |= RES_DEBUG;
168 os_put_dns_resolver_res(resp);
059ec3d9
PH
169 }
170
5bfb4cdf
PP
171resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
172resp->options |= (qualify_single? RES_DEFNAMES : 0) |
059ec3d9 173 (search_parents? RES_DNSRCH : 0);
5bfb4cdf
PP
174if (dns_retrans > 0) resp->retrans = dns_retrans;
175if (dns_retry > 0) resp->retry = dns_retry;
e97d1f08
PP
176
177#ifdef RES_USE_EDNS0
178if (dns_use_edns0 >= 0)
179 {
180 if (dns_use_edns0)
5bfb4cdf 181 resp->options |= RES_USE_EDNS0;
e97d1f08 182 else
5bfb4cdf 183 resp->options &= ~RES_USE_EDNS0;
e97d1f08
PP
184 DEBUG(D_resolver)
185 debug_printf("Coerced resolver EDNS0 support %s.\n",
186 dns_use_edns0 ? "on" : "off");
187 }
188#else
189if (dns_use_edns0 >= 0)
190 DEBUG(D_resolver)
191 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
192 dns_use_edns0 ? "" : "un");
193#endif
5bfb4cdf 194
1f4a55da
PP
195#ifndef DISABLE_DNSSEC
196# ifdef RES_USE_DNSSEC
197# ifndef RES_USE_EDNS0
198# error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
199# endif
8c51eead
JH
200if (use_dnssec)
201 resp->options |= RES_USE_DNSSEC;
0fbd9bff 202if (dns_dnssec_ok >= 0)
1f4a55da 203 {
0fbd9bff 204 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
1f4a55da
PP
205 {
206 DEBUG(D_resolver)
0fbd9bff 207 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
1f4a55da
PP
208 }
209 else
210 {
0fbd9bff 211 if (dns_dnssec_ok)
1f4a55da
PP
212 resp->options |= RES_USE_DNSSEC;
213 else
214 resp->options &= ~RES_USE_DNSSEC;
215 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
0fbd9bff 216 dns_dnssec_ok ? "on" : "off");
1f4a55da
PP
217 }
218 }
219# else
0fbd9bff 220if (dns_dnssec_ok >= 0)
1f4a55da
PP
221 DEBUG(D_resolver)
222 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
0fbd9bff 223 dns_dnssec_ok ? "" : "un");
8c51eead
JH
224if (use_dnssec)
225 DEBUG(D_resolver)
93d4b03a 226 debug_printf("Unable to set DNSSEC without resolver support.\n");
1f4a55da
PP
227# endif
228#endif /* DISABLE_DNSSEC */
229
5bfb4cdf 230os_put_dns_resolver_res(resp);
059ec3d9
PH
231}
232
233
234
235/*************************************************
236* Build key name for PTR records *
237*************************************************/
238
239/* This function inverts an IP address and adds the relevant domain, to produce
240a name that can be used to look up PTR records.
241
242Arguments:
243 string the IP address as a string
244 buffer a suitable buffer, long enough to hold the result
245
246Returns: nothing
247*/
248
249void
55414b25 250dns_build_reverse(const uschar *string, uschar *buffer)
059ec3d9 251{
55414b25 252const uschar *p = string + Ustrlen(string);
059ec3d9
PH
253uschar *pp = buffer;
254
255/* Handle IPv4 address */
256
257#if HAVE_IPV6
258if (Ustrchr(string, ':') == NULL)
259#endif
260 {
261 int i;
262 for (i = 0; i < 4; i++)
263 {
55414b25 264 const uschar *ppp = p;
059ec3d9
PH
265 while (ppp > string && ppp[-1] != '.') ppp--;
266 Ustrncpy(pp, ppp, p - ppp);
267 pp += p - ppp;
268 *pp++ = '.';
269 p = ppp - 1;
270 }
271 Ustrcpy(pp, "in-addr.arpa");
272 }
273
274/* Handle IPv6 address; convert to binary so as to fill out any
275abbreviation in the textual form. */
276
277#if HAVE_IPV6
278else
279 {
280 int i;
281 int v6[4];
282 (void)host_aton(string, v6);
283
284 /* The original specification for IPv6 reverse lookup was to invert each
285 nibble, and look in the ip6.int domain. The domain was subsequently
286 changed to ip6.arpa. */
287
288 for (i = 3; i >= 0; i--)
289 {
290 int j;
291 for (j = 0; j < 32; j += 4)
292 {
293 sprintf(CS pp, "%x.", (v6[i] >> j) & 15);
294 pp += 2;
295 }
296 }
297 Ustrcpy(pp, "ip6.arpa.");
298
299 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
300 with A6 records. However, it fell out of favour when they did. The
301 alternative was to construct a binary key, and look in ip6.arpa. I tried
302 to make this code do that, but I could not make it work on Solaris 8. The
303 resolver seems to lose the initial backslash somehow. However, now that
304 this style of reverse lookup has been dropped, it doesn't matter. These
305 lines are left here purely for historical interest. */
306
307 /**************************************************
308 Ustrcpy(pp, "\\[x");
309 pp += 3;
310
311 for (i = 0; i < 4; i++)
312 {
313 sprintf(pp, "%08X", v6[i]);
314 pp += 8;
315 }
316 Ustrcpy(pp, "].ip6.arpa.");
317 **************************************************/
318
319 }
320#endif
321}
322
323
324
325
326/*************************************************
327* Get next DNS record from answer block *
328*************************************************/
329
330/* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
e5a9dba6
PH
331RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
332scan the additional records, and reset == RESET_NEXT to get the next record.
333The result is in static storage which must be copied if it is to be preserved.
059ec3d9
PH
334
335Arguments:
336 dnsa pointer to dns answer block
337 dnss pointer to dns scan block
338 reset option specifing what portion to scan, as described above
339
340Returns: next dns record, or NULL when no more
341*/
342
343dns_record *
344dns_next_rr(dns_answer *dnsa, dns_scan *dnss, int reset)
345{
346HEADER *h = (HEADER *)dnsa->answer;
347int namelen;
348
349/* Reset the saved data when requested to, and skip to the first required RR */
350
351if (reset != RESET_NEXT)
352 {
353 dnss->rrcount = ntohs(h->qdcount);
354 dnss->aptr = dnsa->answer + sizeof(HEADER);
355
356 /* Skip over questions; failure to expand the name just gives up */
357
358 while (dnss->rrcount-- > 0)
359 {
360 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
361 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
362 if (namelen < 0) { dnss->rrcount = 0; return NULL; }
363 dnss->aptr += namelen + 4; /* skip name & type & class */
364 }
365
366 /* Get the number of answer records. */
367
368 dnss->rrcount = ntohs(h->ancount);
369
e5a9dba6
PH
370 /* Skip over answers if we want to look at the authority section. Also skip
371 the NS records (i.e. authority section) if wanting to look at the additional
059ec3d9
PH
372 records. */
373
e5a9dba6
PH
374 if (reset == RESET_ADDITIONAL) dnss->rrcount += ntohs(h->nscount);
375
376 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
059ec3d9 377 {
059ec3d9
PH
378 while (dnss->rrcount-- > 0)
379 {
380 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
381 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
382 if (namelen < 0) { dnss->rrcount = 0; return NULL; }
383 dnss->aptr += namelen + 8; /* skip name, type, class & TTL */
384 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
385 dnss->aptr += dnss->srr.size; /* skip over it */
386 }
e5a9dba6
PH
387 dnss->rrcount = (reset == RESET_AUTHORITY)
388 ? ntohs(h->nscount) : ntohs(h->arcount);
059ec3d9
PH
389 }
390 }
391
059ec3d9
PH
392/* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
393contains the number of RR records left. */
394
395if (dnss->rrcount-- <= 0) return NULL;
396
397/* If expanding the RR domain name fails, behave as if no more records
398(something safe). */
399
400namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
401 (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
402if (namelen < 0) { dnss->rrcount = 0; return NULL; }
403
404/* Move the pointer past the name and fill in the rest of the data structure
405from the following bytes. */
406
407dnss->aptr += namelen;
408GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
409dnss->aptr += 6; /* Don't want class or TTL */
410GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
411dnss->srr.data = dnss->aptr; /* The record's data follows */
412dnss->aptr += dnss->srr.size; /* Advance to next RR */
413
414/* Return a pointer to the dns_record structure within the dns_answer. This is
415for convenience so that the scans can use nice-looking for loops. */
416
417return &(dnss->srr);
418}
419
420
421
422
423/*************************************************
1f4a55da
PP
424* Return whether AD bit set in DNS result *
425*************************************************/
426
427/* We do not perform DNSSEC work ourselves; if the administrator has installed
428a verifying resolver which sets AD as appropriate, though, we'll use that.
429(AD = Authentic Data)
430
431Argument: pointer to dns answer block
432Returns: bool indicating presence of AD bit
433*/
434
435BOOL
4a142059 436dns_is_secure(const dns_answer * dnsa)
1f4a55da
PP
437{
438#ifdef DISABLE_DNSSEC
439DEBUG(D_dns)
440 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
441return FALSE;
442#else
443HEADER *h = (HEADER *)dnsa->answer;
444return h->ad ? TRUE : FALSE;
445#endif
446}
447
4a142059
JH
448static void
449dns_set_insecure(dns_answer * dnsa)
450{
451HEADER * h = (HEADER *)dnsa->answer;
452h->ad = 0;
453}
454
1f4a55da
PP
455
456
457
458/*************************************************
059ec3d9
PH
459* Turn DNS type into text *
460*************************************************/
461
885ccd3e
PH
462/* Turn the coded record type into a string for printing. All those that Exim
463uses should be included here.
059ec3d9
PH
464
465Argument: record type
466Returns: pointer to string
467*/
468
469uschar *
470dns_text_type(int t)
471{
472switch(t)
473 {
33397d19
PH
474 case T_A: return US"A";
475 case T_MX: return US"MX";
476 case T_AAAA: return US"AAAA";
477 case T_A6: return US"A6";
478 case T_TXT: return US"TXT";
eae0036b 479 case T_SPF: return US"SPF";
33397d19 480 case T_PTR: return US"PTR";
885ccd3e 481 case T_SOA: return US"SOA";
33397d19
PH
482 case T_SRV: return US"SRV";
483 case T_NS: return US"NS";
8e669ac1 484 case T_CNAME: return US"CNAME";
1e06383a 485 case T_TLSA: return US"TLSA";
33397d19 486 default: return US"?";
059ec3d9
PH
487 }
488}
489
490
491
492/*************************************************
493* Cache a failed DNS lookup result *
494*************************************************/
495
496/* We cache failed lookup results so as not to experience timeouts many
497times for the same domain. We need to retain the resolver options because they
498may change. For successful lookups, we rely on resolver and/or name server
499caching.
500
501Arguments:
502 name the domain name
503 type the lookup type
504 rc the return code
505
506Returns: the return code
507*/
508
509static int
1dc92d5a 510dns_return(const uschar * name, int type, int rc)
059ec3d9 511{
5bfb4cdf 512res_state resp = os_get_dns_resolver_res();
059ec3d9
PH
513tree_node *node = store_get_perm(sizeof(tree_node) + 290);
514sprintf(CS node->name, "%.255s-%s-%lx", name, dns_text_type(type),
5bfb4cdf 515 resp->options);
059ec3d9
PH
516node->data.val = rc;
517(void)tree_insertnode(&tree_dns_fails, node);
518return rc;
519}
520
521
522
523/*************************************************
524* Do basic DNS lookup *
525*************************************************/
526
527/* Call the resolver to look up the given domain name, using the given type,
528and check the result. The error code TRY_AGAIN is documented as meaning "non-
529Authoritive Host not found, or SERVERFAIL". Sometimes there are badly set
530up nameservers that produce this error continually, so there is the option of
531providing a list of domains for which this is treated as a non-existent
532host.
533
534Arguments:
535 dnsa pointer to dns_answer structure
536 name name to look up
537 type type of DNS record required (T_A, T_MX, etc)
538
539Returns: DNS_SUCCEED successful lookup
540 DNS_NOMATCH name not found (NXDOMAIN)
541 or name contains illegal characters (if checking)
30e18802 542 or name is an IP address (for IP address lookup)
059ec3d9
PH
543 DNS_NODATA domain exists, but no data for this type (NODATA)
544 DNS_AGAIN soft failure, try again later
545 DNS_FAIL DNS failure
546*/
547
548int
1dc92d5a 549dns_basic_lookup(dns_answer *dnsa, const uschar *name, int type)
059ec3d9
PH
550{
551#ifndef STAND_ALONE
7156b1ef 552int rc = -1;
55414b25 553const uschar *save_domain;
059ec3d9 554#endif
5bfb4cdf 555res_state resp = os_get_dns_resolver_res();
059ec3d9
PH
556
557tree_node *previous;
558uschar node_name[290];
559
560/* DNS lookup failures of any kind are cached in a tree. This is mainly so that
561a timeout on one domain doesn't happen time and time again for messages that
562have many addresses in the same domain. We rely on the resolver and name server
563caching for successful lookups. */
564
565sprintf(CS node_name, "%.255s-%s-%lx", name, dns_text_type(type),
5bfb4cdf 566 resp->options);
059ec3d9
PH
567previous = tree_search(tree_dns_fails, node_name);
568if (previous != NULL)
569 {
570 DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: using cached value %s\n",
571 name, dns_text_type(type),
572 (previous->data.val == DNS_NOMATCH)? "DNS_NOMATCH" :
573 (previous->data.val == DNS_NODATA)? "DNS_NODATA" :
574 (previous->data.val == DNS_AGAIN)? "DNS_AGAIN" :
575 (previous->data.val == DNS_FAIL)? "DNS_FAIL" : "??");
576 return previous->data.val;
577 }
578
9d4319df
JH
579#ifdef EXPERIMENTAL_INTERNATIONAL
580/* Convert all names to a-label form before doing lookup */
581 {
582 uschar * alabel;
583 uschar * errstr = NULL;
584 if ((alabel = string_domain_utf8_to_alabel(name, &errstr)), errstr)
585 {
586 DEBUG(D_dns)
37bf366e 587 debug_printf("DNS name '%s' utf8 conversion to alabel failed: %s\n", name,
9d4319df
JH
588 errstr);
589 host_find_failed_syntax = TRUE;
590 return DNS_NOMATCH;
591 }
592 name = alabel;
593 }
594#endif
595
059ec3d9
PH
596/* If configured, check the hygene of the name passed to lookup. Otherwise,
597although DNS lookups may give REFUSED at the lower level, some resolvers
598turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
599domains cannot be in the DNS. The check is now done by a regular expression;
600give it space for substring storage to save it having to get its own if the
601regex has substrings that are used - the default uses a conditional.
602
603This test is omitted for PTR records. These occur only in calls from the dnsdb
604lookup, which constructs the names itself, so they should be OK. Besides,
605bitstring labels don't conform to normal name syntax. (But the aren't used any
606more.)
607
608For SRV records, we omit the initial _smtp._tcp. components at the start. */
609
610#ifndef STAND_ALONE /* Omit this for stand-alone tests */
611
482d1455 612if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
059ec3d9 613 {
1dc92d5a 614 const uschar *checkname = name;
059ec3d9
PH
615 int ovector[3*(EXPAND_MAXN+1)];
616
476be7e2 617 dns_pattern_init();
059ec3d9
PH
618
619 /* For an SRV lookup, skip over the first two components (the service and
620 protocol names, which both start with an underscore). */
621
b4161d10 622 if (type == T_SRV || type == T_TLSA)
059ec3d9
PH
623 {
624 while (*checkname++ != '.');
625 while (*checkname++ != '.');
626 }
627
1dc92d5a 628 if (pcre_exec(regex_check_dns_names, NULL, CCS checkname, Ustrlen(checkname),
059ec3d9
PH
629 0, PCRE_EOPT, ovector, sizeof(ovector)/sizeof(int)) < 0)
630 {
631 DEBUG(D_dns)
632 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
633 dns_text_type(type));
634 host_find_failed_syntax = TRUE;
635 return DNS_NOMATCH;
636 }
637 }
638
639#endif /* STAND_ALONE */
640
641/* Call the resolver; for an overlong response, res_search() will return the
bef5a11f
PH
642number of bytes the message would need, so we need to check for this case. The
643effect is to truncate overlong data.
644
30e18802
PH
645On some systems, res_search() will recognize "A-for-A" queries and return
646the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
647nameservers are also believed to do this. It is, of course, contrary to the
648specification of the DNS, so we lock it out. */
649
cc00f4af 650if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
30e18802
PH
651 return DNS_NOMATCH;
652
653/* If we are running in the test harness, instead of calling the normal resolver
bef5a11f
PH
654(res_search), we call fakens_search(), which recognizes certain special
655domains, and interfaces to a fake nameserver for certain special zones. */
656
cc00f4af
JH
657dnsa->answerlen = running_in_test_harness
658 ? fakens_search(name, type, dnsa->answer, MAXPACKET)
659 : res_search(CCS name, C_IN, type, dnsa->answer, MAXPACKET);
059ec3d9 660
80a47a2c
TK
661if (dnsa->answerlen > MAXPACKET)
662 {
663 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet (size %d), truncating to %d.\n",
664 name, dns_text_type(type), dnsa->answerlen, MAXPACKET);
665 dnsa->answerlen = MAXPACKET;
666 }
059ec3d9
PH
667
668if (dnsa->answerlen < 0) switch (h_errno)
669 {
670 case HOST_NOT_FOUND:
671 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
672 "returning DNS_NOMATCH\n", name, dns_text_type(type));
673 return dns_return(name, type, DNS_NOMATCH);
674
675 case TRY_AGAIN:
676 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
677 name, dns_text_type(type));
678
679 /* Cut this out for various test programs */
1dc92d5a 680#ifndef STAND_ALONE
55414b25 681 save_domain = deliver_domain;
1dc92d5a 682 deliver_domain = string_copy(name); /* set $domain */
55414b25 683 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
059ec3d9 684 MCL_DOMAIN, TRUE, NULL);
55414b25 685 deliver_domain = save_domain;
059ec3d9
PH
686 if (rc != OK)
687 {
688 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
689 return dns_return(name, type, DNS_AGAIN);
690 }
691 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
692 "DNS_NOMATCH\n", name);
693 return dns_return(name, type, DNS_NOMATCH);
694
1dc92d5a 695#else /* For stand-alone tests */
059ec3d9 696 return dns_return(name, type, DNS_AGAIN);
1dc92d5a 697#endif
059ec3d9
PH
698
699 case NO_RECOVERY:
700 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
701 "returning DNS_FAIL\n", name, dns_text_type(type));
702 return dns_return(name, type, DNS_FAIL);
703
704 case NO_DATA:
705 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
706 "returning DNS_NODATA\n", name, dns_text_type(type));
707 return dns_return(name, type, DNS_NODATA);
708
709 default:
710 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
711 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
712 return dns_return(name, type, DNS_FAIL);
713 }
714
715DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
716 name, dns_text_type(type));
717
718return DNS_SUCCEED;
719}
720
721
722
723
724/************************************************
725* Do a DNS lookup and handle CNAMES *
726************************************************/
727
728/* Look up the given domain name, using the given type. Follow CNAMEs if
729necessary, but only so many times. There aren't supposed to be CNAME chains in
730the DNS, but you are supposed to cope with them if you find them.
731
732The assumption is made that if the resolver gives back records of the
733requested type *and* a CNAME, we don't need to make another call to look up
734the CNAME. I can't see how it could return only some of the right records. If
735it's done a CNAME lookup in the past, it will have all of them; if not, it
736won't return any.
737
738If fully_qualified_name is not NULL, set it to point to the full name
739returned by the resolver, if this is different to what it is given, unless
740the returned name starts with "*" as some nameservers seem to be returning
741wildcards in this form.
742
743Arguments:
744 dnsa pointer to dns_answer structure
745 name domain name to look up
746 type DNS record type (T_A, T_MX, etc)
747 fully_qualified_name if not NULL, return the returned name here if its
748 contents are different (i.e. it must be preset)
749
750Returns: DNS_SUCCEED successful lookup
751 DNS_NOMATCH name not found
752 DNS_NODATA no data found
753 DNS_AGAIN soft failure, try again later
754 DNS_FAIL DNS failure
755*/
756
757int
1dc92d5a 758dns_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 759 const uschar **fully_qualified_name)
059ec3d9
PH
760{
761int i;
1dc92d5a 762const uschar *orig_name = name;
c85b3043 763BOOL secure_so_far = TRUE;
059ec3d9
PH
764
765/* Loop to follow CNAME chains so far, but no further... */
766
767for (i = 0; i < 10; i++)
768 {
769 uschar data[256];
770 dns_record *rr, cname_rr, type_rr;
771 dns_scan dnss;
772 int datalen, rc;
773
774 /* DNS lookup failures get passed straight back. */
775
776 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED) return rc;
777
778 /* We should have either records of the required type, or a CNAME record,
779 or both. We need to know whether both exist for getting the fully qualified
780 name, but avoid scanning more than necessary. Note that we must copy the
781 contents of any rr blocks returned by dns_next_rr() as they use the same
782 area in the dnsa block. */
783
784 cname_rr.data = type_rr.data = NULL;
785 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
786 rr != NULL;
787 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
788 {
789 if (rr->type == type)
790 {
791 if (type_rr.data == NULL) type_rr = *rr;
792 if (cname_rr.data != NULL) break;
793 }
794 else if (rr->type == T_CNAME) cname_rr = *rr;
795 }
796
a2042e78
PH
797 /* For the first time round this loop, if a CNAME was found, take the fully
798 qualified name from it; otherwise from the first data record, if present. */
059ec3d9 799
a2042e78 800 if (i == 0 && fully_qualified_name != NULL)
059ec3d9
PH
801 {
802 if (cname_rr.data != NULL)
803 {
804 if (Ustrcmp(cname_rr.name, *fully_qualified_name) != 0 &&
805 cname_rr.name[0] != '*')
806 *fully_qualified_name = string_copy_dnsdomain(cname_rr.name);
807 }
808 else if (type_rr.data != NULL)
809 {
75e0e026
PH
810 if (Ustrcmp(type_rr.name, *fully_qualified_name) != 0 &&
811 type_rr.name[0] != '*')
812 *fully_qualified_name = string_copy_dnsdomain(type_rr.name);
059ec3d9
PH
813 }
814 }
815
816 /* If any data records of the correct type were found, we are done. */
817
c85b3043
JH
818 if (type_rr.data != NULL)
819 {
820 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
4a142059 821 dns_set_insecure(dnsa);
c85b3043
JH
822 return DNS_SUCCEED;
823 }
059ec3d9
PH
824
825 /* If there are no data records, we need to re-scan the DNS using the
826 domain given in the CNAME record, which should exist (otherwise we should
827 have had a failure from dns_lookup). However code against the possibility of
828 its not existing. */
829
830 if (cname_rr.data == NULL) return DNS_FAIL;
831 datalen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
1dc92d5a 832 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, sizeof(data));
059ec3d9
PH
833 if (datalen < 0) return DNS_FAIL;
834 name = data;
a2042e78 835
c85b3043
JH
836 if (!dns_is_secure(dnsa))
837 secure_so_far = FALSE;
838
a2042e78 839 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
059ec3d9
PH
840 } /* Loop back to do another lookup */
841
842/*Control reaches here after 10 times round the CNAME loop. Something isn't
843right... */
844
845log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
846return DNS_FAIL;
847}
848
849
850
33397d19
PH
851
852
853
854/************************************************
855* Do a DNS lookup and handle virtual types *
856************************************************/
857
8e669ac1
PH
858/* This function handles some invented "lookup types" that synthesize feature
859not available in the basic types. The special types all have negative values.
33397d19
PH
860Positive type values are passed straight on to dns_lookup().
861
862Arguments:
863 dnsa pointer to dns_answer structure
864 name domain name to look up
865 type DNS record type (T_A, T_MX, etc or a "special")
866 fully_qualified_name if not NULL, return the returned name here if its
867 contents are different (i.e. it must be preset)
868
869Returns: DNS_SUCCEED successful lookup
870 DNS_NOMATCH name not found
871 DNS_NODATA no data found
872 DNS_AGAIN soft failure, try again later
873 DNS_FAIL DNS failure
874*/
875
876int
1dc92d5a 877dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 878 const uschar **fully_qualified_name)
33397d19
PH
879{
880if (type >= 0) return dns_lookup(dnsa, name, type, fully_qualified_name);
881
ea3bc19b
PH
882/* The "mx hosts only" type doesn't require any special action here */
883
884if (type == T_MXH) return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
885
8e669ac1 886/* Find nameservers for the domain or the nearest enclosing zone, excluding the
33397d19
PH
887root servers. */
888
889if (type == T_ZNS)
890 {
1dc92d5a 891 const uschar *d = name;
33397d19
PH
892 while (d != 0)
893 {
894 int rc = dns_lookup(dnsa, d, T_NS, fully_qualified_name);
895 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
896 while (*d != 0 && *d != '.') d++;
8e669ac1 897 if (*d++ == 0) break;
33397d19 898 }
8e669ac1
PH
899 return DNS_NOMATCH;
900 }
33397d19 901
e5a9dba6
PH
902/* Try to look up the Client SMTP Authorization SRV record for the name. If
903there isn't one, search from the top downwards for a CSA record in a parent
904domain, which might be making assertions about subdomains. If we find a record
905we set fully_qualified_name to whichever lookup succeeded, so that the caller
906can tell whether to look at the explicit authorization field or the subdomain
907assertion field. */
908
909if (type == T_CSA)
910 {
911 uschar *srvname, *namesuff, *tld, *p;
912 int priority, weight, port;
913 int limit, rc, i;
914 BOOL ipv6;
915 dns_record *rr;
916 dns_scan dnss;
917
918 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
919
920 srvname = string_sprintf("_client._smtp.%s", name);
921 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
922 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
923 {
1dc92d5a 924 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
e5a9dba6
PH
925 return rc;
926 }
927
928 /* Search for CSA subdomain assertion SRV records from the top downwards,
929 starting with the 2nd level domain. This order maximizes cache-friendliness.
930 We skip the top level domains to avoid loading their nameservers and because
931 we know they'll never have CSA SRV records. */
932
933 namesuff = Ustrrchr(name, '.');
934 if (namesuff == NULL) return DNS_NOMATCH;
935 tld = namesuff + 1;
936 ipv6 = FALSE;
937 limit = dns_csa_search_limit;
938
939 /* Use more appropriate search parameters if we are in the reverse DNS. */
940
941 if (strcmpic(namesuff, US".arpa") == 0)
942 {
943 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
944 {
945 namesuff -= 8;
946 tld = namesuff + 1;
947 limit = 3;
948 }
949 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
950 {
951 namesuff -= 4;
952 tld = namesuff + 1;
953 ipv6 = TRUE;
954 limit = 3;
955 }
956 }
957
958 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
959
960 /* Do not perform the search if the top level or 2nd level domains do not
961 exist. This is quite common, and when it occurs all the search queries would
962 go to the root or TLD name servers, which is not friendly. So we check the
963 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
964 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
965 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
966 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
967
968 if (rc == DNS_NOMATCH)
969 {
970 /* This is really gross. The successful return value from res_search() is
971 the packet length, which is stored in dnsa->answerlen. If we get a
972 negative DNS reply then res_search() returns -1, which causes the bounds
973 checks for name decompression to fail when it is treated as a packet
974 length, which in turn causes the authority search to fail. The correct
975 packet length has been lost inside libresolv, so we have to guess a
976 replacement value. (The only way to fix this properly would be to
977 re-implement res_search() and res_query() so that they don't muddle their
978 success and packet length return values.) For added safety we only reset
979 the packet length if the packet header looks plausible. */
980
981 HEADER *h = (HEADER *)dnsa->answer;
982 if (h->qr == 1 && h->opcode == QUERY && h->tc == 0
983 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
984 && ntohs(h->qdcount) == 1 && ntohs(h->ancount) == 0
985 && ntohs(h->nscount) >= 1)
986 dnsa->answerlen = MAXPACKET;
987
988 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
989 rr != NULL;
990 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
991 if (rr->type != T_SOA) continue;
992 else if (strcmpic(rr->name, US"") == 0 ||
993 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
994 else break;
995 }
996
997 for (i = 0; i < limit; i++)
998 {
999 if (ipv6)
1000 {
1001 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
1002 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
1003 namesuff -= 8;
1004 if (namesuff <= name) return DNS_NOMATCH;
1005 }
1006 else
1007 /* Find the start of the preceding domain name label. */
1008 do
1009 if (--namesuff <= name) return DNS_NOMATCH;
1010 while (*namesuff != '.');
1011
1012 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
1013
1014 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
1015 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1016 if (rc == DNS_AGAIN) return rc;
1017 if (rc != DNS_SUCCEED) continue;
1018
1019 /* Check that the SRV record we have found is worth returning. We don't
1020 just return the first one we find, because some lower level SRV record
1021 might make stricter assertions than its parent domain. */
1022
1023 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1024 rr != NULL;
1025 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
1026 {
1027 if (rr->type != T_SRV) continue;
1028
1029 /* Extract the numerical SRV fields (p is incremented) */
1030 p = rr->data;
1031 GETSHORT(priority, p);
4a142059 1032 GETSHORT(weight, p); weight = weight; /* compiler quietening */
e5a9dba6
PH
1033 GETSHORT(port, p);
1034
1035 /* Check the CSA version number */
1036 if (priority != 1) continue;
1037
1038 /* If it's making an interesting assertion, return this response. */
1039 if (port & 1)
1040 {
1041 *fully_qualified_name = namesuff + 1;
1042 return DNS_SUCCEED;
1043 }
1044 }
1045 }
1046 return DNS_NOMATCH;
1047 }
1048
33397d19
PH
1049/* Control should never reach here */
1050
1051return DNS_FAIL;
1052}
1053
1054
1055
059ec3d9
PH
1056
1057
1058/*************************************************
1059* Get address(es) from DNS record *
1060*************************************************/
1061
1062/* The record type is either T_A for an IPv4 address or T_AAAA (or T_A6 when
1063supported) for an IPv6 address. In the A6 case, there may be several addresses,
1064generated by following chains. A recursive function does all the hard work. A6
1065records now look like passing into history, so the code is only included when
1066explicitly asked for.
1067
1068Argument:
1069 dnsa the DNS answer block
1070 rr the RR
1071
1072Returns: pointer a chain of dns_address items
1073*/
1074
1075dns_address *
1076dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1077{
1078dns_address *yield = NULL;
1079
059ec3d9 1080dnsa = dnsa; /* Stop picky compilers warning */
059ec3d9
PH
1081
1082if (rr->type == T_A)
1083 {
1084 uschar *p = (uschar *)(rr->data);
1085 yield = store_get(sizeof(dns_address) + 20);
1086 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1087 yield->next = NULL;
1088 }
1089
1090#if HAVE_IPV6
1091
059ec3d9
PH
1092else
1093 {
1094 yield = store_get(sizeof(dns_address) + 50);
1095 inet_ntop(AF_INET6, (uschar *)(rr->data), CS yield->address, 50);
1096 yield->next = NULL;
1097 }
1098#endif /* HAVE_IPV6 */
1099
1100return yield;
1101}
1102
476be7e2
JH
1103
1104
1105void
1106dns_pattern_init(void)
1107{
1108if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1109 regex_check_dns_names =
1110 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);
1111}
1112
8c51eead
JH
1113/* vi: aw ai sw=2
1114*/
059ec3d9 1115/* End of dns.c */