A-label expansion operators
[exim.git] / src / src / dns.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions for interfacing with the DNS. */
9
10#include "exim.h"
11
12
059ec3d9 13
bef5a11f
PH
14/*************************************************
15* Fake DNS resolver *
16*************************************************/
17
18/* This function is called instead of res_search() when Exim is running in its
19test harness. It recognizes some special domain names, and uses them to force
433a2980
PH
20failure and retry responses (optionally with a delay). Otherwise, it calls an
21external utility that mocks-up a nameserver, if it can find the utility.
22If not, it passes its arguments on to res_search(). The fake nameserver may
23also return a code specifying that the name should be passed on.
bef5a11f
PH
24
25Background: the original test suite required a real nameserver to carry the
e7726cbf
PH
26test zones, whereas the new test suit has the fake server for portability. This
27code supports both.
bef5a11f
PH
28
29Arguments:
e7726cbf 30 domain the domain name
bef5a11f
PH
31 type the DNS record type
32 answerptr where to put the answer
33 size size of the answer area
34
35Returns: length of returned data, or -1 on error (h_errno set)
36*/
37
38static int
1dc92d5a 39fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
bef5a11f 40{
e7726cbf 41int len = Ustrlen(domain);
433a2980 42int asize = size; /* Locally modified */
e7726cbf
PH
43uschar *endname;
44uschar name[256];
433a2980
PH
45uschar utilname[256];
46uschar *aptr = answerptr; /* Locally modified */
47struct stat statbuf;
48
49/* Remove terminating dot. */
e7726cbf
PH
50
51if (domain[len - 1] == '.') len--;
52Ustrncpy(name, domain, len);
53name[len] = 0;
54endname = name + len;
bef5a11f 55
433a2980
PH
56/* This code, for forcing TRY_AGAIN and NO_RECOVERY, is here so that it works
57for the old test suite that uses a real nameserver. When the old test suite is
58eventually abandoned, this code could be moved into the fakens utility. */
59
bef5a11f
PH
60if (len >= 14 && Ustrcmp(endname - 14, "test.again.dns") == 0)
61 {
62 int delay = Uatoi(name); /* digits at the start of the name */
63 DEBUG(D_dns) debug_printf("Return from DNS lookup of %s (%s) faked for testing\n",
64 name, dns_text_type(type));
65 if (delay > 0)
66 {
67 DEBUG(D_dns) debug_printf("delaying %d seconds\n", delay);
68 sleep(delay);
69 }
70 h_errno = TRY_AGAIN;
71 return -1;
72 }
73
74if (len >= 13 && Ustrcmp(endname - 13, "test.fail.dns") == 0)
75 {
76 DEBUG(D_dns) debug_printf("Return from DNS lookup of %s (%s) faked for testing\n",
77 name, dns_text_type(type));
78 h_errno = NO_RECOVERY;
79 return -1;
80 }
81
433a2980
PH
82/* Look for the fakens utility, and if it exists, call it. */
83
84(void)string_format(utilname, sizeof(utilname), "%s/../bin/fakens",
85 spool_directory);
86
87if (stat(CS utilname, &statbuf) >= 0)
bef5a11f 88 {
433a2980
PH
89 pid_t pid;
90 int infd, outfd, rc;
91 uschar *argv[5];
92
93 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n",
94 name, dns_text_type(type));
95
96 argv[0] = utilname;
97 argv[1] = spool_directory;
98 argv[2] = name;
99 argv[3] = dns_text_type(type);
100 argv[4] = NULL;
101
102 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE);
103 if (pid < 0)
104 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
105 strerror(errno));
106
107 len = 0;
108 rc = -1;
109 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
110 {
111 len += rc;
112 aptr += rc; /* Don't modify the actual arguments, because they */
113 asize -= rc; /* may need to be passed on to res_search(). */
114 }
bef5a11f 115
433a2980
PH
116 if (rc < 0)
117 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
118 strerror(errno));
bef5a11f 119
433a2980 120 switch(child_close(pid, 0))
bef5a11f 121 {
433a2980
PH
122 case 0: return len;
123 case 1: h_errno = HOST_NOT_FOUND; return -1;
124 case 2: h_errno = TRY_AGAIN; return -1;
125 default:
126 case 3: h_errno = NO_RECOVERY; return -1;
127 case 4: h_errno = NO_DATA; return -1;
128 case 5: /* Pass on to res_search() */
129 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
bef5a11f
PH
130 }
131 }
132
433a2980 133/* fakens utility not found, or it returned "pass on" */
bef5a11f 134
433a2980 135DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
e7726cbf
PH
136
137return res_search(CS domain, C_IN, type, answerptr, size);
bef5a11f
PH
138}
139
140
059ec3d9
PH
141
142/*************************************************
143* Initialize and configure resolver *
144*************************************************/
145
146/* Initialize the resolver and the storage for holding DNS answers if this is
147the first time we have been here, and set the resolver options.
148
149Arguments:
150 qualify_single TRUE to set the RES_DEFNAMES option
151 search_parents TRUE to set the RES_DNSRCH option
8c51eead 152 use_dnssec TRUE to set the RES_USE_DNSSEC option
059ec3d9
PH
153
154Returns: nothing
155*/
156
157void
8c51eead 158dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
059ec3d9 159{
5bfb4cdf
PP
160res_state resp = os_get_dns_resolver_res();
161
162if ((resp->options & RES_INIT) == 0)
059ec3d9 163 {
5bfb4cdf
PP
164 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
165 os_put_dns_resolver_res(resp);
059ec3d9 166 res_init();
5bfb4cdf
PP
167 DEBUG(D_resolver) resp->options |= RES_DEBUG;
168 os_put_dns_resolver_res(resp);
059ec3d9
PH
169 }
170
5bfb4cdf
PP
171resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
172resp->options |= (qualify_single? RES_DEFNAMES : 0) |
059ec3d9 173 (search_parents? RES_DNSRCH : 0);
5bfb4cdf
PP
174if (dns_retrans > 0) resp->retrans = dns_retrans;
175if (dns_retry > 0) resp->retry = dns_retry;
e97d1f08
PP
176
177#ifdef RES_USE_EDNS0
178if (dns_use_edns0 >= 0)
179 {
180 if (dns_use_edns0)
5bfb4cdf 181 resp->options |= RES_USE_EDNS0;
e97d1f08 182 else
5bfb4cdf 183 resp->options &= ~RES_USE_EDNS0;
e97d1f08
PP
184 DEBUG(D_resolver)
185 debug_printf("Coerced resolver EDNS0 support %s.\n",
186 dns_use_edns0 ? "on" : "off");
187 }
188#else
189if (dns_use_edns0 >= 0)
190 DEBUG(D_resolver)
191 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
192 dns_use_edns0 ? "" : "un");
193#endif
5bfb4cdf 194
1f4a55da
PP
195#ifndef DISABLE_DNSSEC
196# ifdef RES_USE_DNSSEC
197# ifndef RES_USE_EDNS0
198# error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
199# endif
8c51eead
JH
200if (use_dnssec)
201 resp->options |= RES_USE_DNSSEC;
0fbd9bff 202if (dns_dnssec_ok >= 0)
1f4a55da 203 {
0fbd9bff 204 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
1f4a55da
PP
205 {
206 DEBUG(D_resolver)
0fbd9bff 207 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
1f4a55da
PP
208 }
209 else
210 {
0fbd9bff 211 if (dns_dnssec_ok)
1f4a55da
PP
212 resp->options |= RES_USE_DNSSEC;
213 else
214 resp->options &= ~RES_USE_DNSSEC;
215 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
0fbd9bff 216 dns_dnssec_ok ? "on" : "off");
1f4a55da
PP
217 }
218 }
219# else
0fbd9bff 220if (dns_dnssec_ok >= 0)
1f4a55da
PP
221 DEBUG(D_resolver)
222 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
0fbd9bff 223 dns_dnssec_ok ? "" : "un");
8c51eead
JH
224if (use_dnssec)
225 DEBUG(D_resolver)
93d4b03a 226 debug_printf("Unable to set DNSSEC without resolver support.\n");
1f4a55da
PP
227# endif
228#endif /* DISABLE_DNSSEC */
229
5bfb4cdf 230os_put_dns_resolver_res(resp);
059ec3d9
PH
231}
232
233
234
235/*************************************************
236* Build key name for PTR records *
237*************************************************/
238
239/* This function inverts an IP address and adds the relevant domain, to produce
240a name that can be used to look up PTR records.
241
242Arguments:
243 string the IP address as a string
244 buffer a suitable buffer, long enough to hold the result
245
246Returns: nothing
247*/
248
249void
55414b25 250dns_build_reverse(const uschar *string, uschar *buffer)
059ec3d9 251{
55414b25 252const uschar *p = string + Ustrlen(string);
059ec3d9
PH
253uschar *pp = buffer;
254
255/* Handle IPv4 address */
256
257#if HAVE_IPV6
258if (Ustrchr(string, ':') == NULL)
259#endif
260 {
261 int i;
262 for (i = 0; i < 4; i++)
263 {
55414b25 264 const uschar *ppp = p;
059ec3d9
PH
265 while (ppp > string && ppp[-1] != '.') ppp--;
266 Ustrncpy(pp, ppp, p - ppp);
267 pp += p - ppp;
268 *pp++ = '.';
269 p = ppp - 1;
270 }
271 Ustrcpy(pp, "in-addr.arpa");
272 }
273
274/* Handle IPv6 address; convert to binary so as to fill out any
275abbreviation in the textual form. */
276
277#if HAVE_IPV6
278else
279 {
280 int i;
281 int v6[4];
282 (void)host_aton(string, v6);
283
284 /* The original specification for IPv6 reverse lookup was to invert each
285 nibble, and look in the ip6.int domain. The domain was subsequently
286 changed to ip6.arpa. */
287
288 for (i = 3; i >= 0; i--)
289 {
290 int j;
291 for (j = 0; j < 32; j += 4)
292 {
293 sprintf(CS pp, "%x.", (v6[i] >> j) & 15);
294 pp += 2;
295 }
296 }
297 Ustrcpy(pp, "ip6.arpa.");
298
299 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
300 with A6 records. However, it fell out of favour when they did. The
301 alternative was to construct a binary key, and look in ip6.arpa. I tried
302 to make this code do that, but I could not make it work on Solaris 8. The
303 resolver seems to lose the initial backslash somehow. However, now that
304 this style of reverse lookup has been dropped, it doesn't matter. These
305 lines are left here purely for historical interest. */
306
307 /**************************************************
308 Ustrcpy(pp, "\\[x");
309 pp += 3;
310
311 for (i = 0; i < 4; i++)
312 {
313 sprintf(pp, "%08X", v6[i]);
314 pp += 8;
315 }
316 Ustrcpy(pp, "].ip6.arpa.");
317 **************************************************/
318
319 }
320#endif
321}
322
323
324
325
326/*************************************************
327* Get next DNS record from answer block *
328*************************************************/
329
330/* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
e5a9dba6
PH
331RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
332scan the additional records, and reset == RESET_NEXT to get the next record.
333The result is in static storage which must be copied if it is to be preserved.
059ec3d9
PH
334
335Arguments:
336 dnsa pointer to dns answer block
337 dnss pointer to dns scan block
338 reset option specifing what portion to scan, as described above
339
340Returns: next dns record, or NULL when no more
341*/
342
343dns_record *
344dns_next_rr(dns_answer *dnsa, dns_scan *dnss, int reset)
345{
346HEADER *h = (HEADER *)dnsa->answer;
347int namelen;
348
349/* Reset the saved data when requested to, and skip to the first required RR */
350
351if (reset != RESET_NEXT)
352 {
353 dnss->rrcount = ntohs(h->qdcount);
354 dnss->aptr = dnsa->answer + sizeof(HEADER);
355
356 /* Skip over questions; failure to expand the name just gives up */
357
358 while (dnss->rrcount-- > 0)
359 {
360 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
361 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
362 if (namelen < 0) { dnss->rrcount = 0; return NULL; }
363 dnss->aptr += namelen + 4; /* skip name & type & class */
364 }
365
366 /* Get the number of answer records. */
367
368 dnss->rrcount = ntohs(h->ancount);
369
e5a9dba6
PH
370 /* Skip over answers if we want to look at the authority section. Also skip
371 the NS records (i.e. authority section) if wanting to look at the additional
059ec3d9
PH
372 records. */
373
e5a9dba6
PH
374 if (reset == RESET_ADDITIONAL) dnss->rrcount += ntohs(h->nscount);
375
376 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
059ec3d9 377 {
059ec3d9
PH
378 while (dnss->rrcount-- > 0)
379 {
380 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
381 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
382 if (namelen < 0) { dnss->rrcount = 0; return NULL; }
383 dnss->aptr += namelen + 8; /* skip name, type, class & TTL */
384 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
385 dnss->aptr += dnss->srr.size; /* skip over it */
386 }
e5a9dba6
PH
387 dnss->rrcount = (reset == RESET_AUTHORITY)
388 ? ntohs(h->nscount) : ntohs(h->arcount);
059ec3d9
PH
389 }
390 }
391
059ec3d9
PH
392/* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
393contains the number of RR records left. */
394
395if (dnss->rrcount-- <= 0) return NULL;
396
397/* If expanding the RR domain name fails, behave as if no more records
398(something safe). */
399
400namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
401 (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
402if (namelen < 0) { dnss->rrcount = 0; return NULL; }
403
404/* Move the pointer past the name and fill in the rest of the data structure
405from the following bytes. */
406
407dnss->aptr += namelen;
408GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
409dnss->aptr += 6; /* Don't want class or TTL */
410GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
411dnss->srr.data = dnss->aptr; /* The record's data follows */
412dnss->aptr += dnss->srr.size; /* Advance to next RR */
413
414/* Return a pointer to the dns_record structure within the dns_answer. This is
415for convenience so that the scans can use nice-looking for loops. */
416
417return &(dnss->srr);
418}
419
420
421
422
423/*************************************************
1f4a55da
PP
424* Return whether AD bit set in DNS result *
425*************************************************/
426
427/* We do not perform DNSSEC work ourselves; if the administrator has installed
428a verifying resolver which sets AD as appropriate, though, we'll use that.
429(AD = Authentic Data)
430
431Argument: pointer to dns answer block
432Returns: bool indicating presence of AD bit
433*/
434
435BOOL
4a142059 436dns_is_secure(const dns_answer * dnsa)
1f4a55da
PP
437{
438#ifdef DISABLE_DNSSEC
439DEBUG(D_dns)
440 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
441return FALSE;
442#else
443HEADER *h = (HEADER *)dnsa->answer;
444return h->ad ? TRUE : FALSE;
445#endif
446}
447
4a142059
JH
448static void
449dns_set_insecure(dns_answer * dnsa)
450{
451HEADER * h = (HEADER *)dnsa->answer;
452h->ad = 0;
453}
454
1f4a55da
PP
455
456
457
458/*************************************************
059ec3d9
PH
459* Turn DNS type into text *
460*************************************************/
461
885ccd3e
PH
462/* Turn the coded record type into a string for printing. All those that Exim
463uses should be included here.
059ec3d9
PH
464
465Argument: record type
466Returns: pointer to string
467*/
468
469uschar *
470dns_text_type(int t)
471{
472switch(t)
473 {
33397d19
PH
474 case T_A: return US"A";
475 case T_MX: return US"MX";
476 case T_AAAA: return US"AAAA";
477 case T_A6: return US"A6";
478 case T_TXT: return US"TXT";
eae0036b 479 case T_SPF: return US"SPF";
33397d19 480 case T_PTR: return US"PTR";
885ccd3e 481 case T_SOA: return US"SOA";
33397d19
PH
482 case T_SRV: return US"SRV";
483 case T_NS: return US"NS";
8e669ac1 484 case T_CNAME: return US"CNAME";
1e06383a 485 case T_TLSA: return US"TLSA";
33397d19 486 default: return US"?";
059ec3d9
PH
487 }
488}
489
490
491
492/*************************************************
493* Cache a failed DNS lookup result *
494*************************************************/
495
496/* We cache failed lookup results so as not to experience timeouts many
497times for the same domain. We need to retain the resolver options because they
498may change. For successful lookups, we rely on resolver and/or name server
499caching.
500
501Arguments:
502 name the domain name
503 type the lookup type
504 rc the return code
505
506Returns: the return code
507*/
508
509static int
1dc92d5a 510dns_return(const uschar * name, int type, int rc)
059ec3d9 511{
5bfb4cdf 512res_state resp = os_get_dns_resolver_res();
059ec3d9
PH
513tree_node *node = store_get_perm(sizeof(tree_node) + 290);
514sprintf(CS node->name, "%.255s-%s-%lx", name, dns_text_type(type),
5bfb4cdf 515 resp->options);
059ec3d9
PH
516node->data.val = rc;
517(void)tree_insertnode(&tree_dns_fails, node);
518return rc;
519}
520
521
522
523/*************************************************
524* Do basic DNS lookup *
525*************************************************/
526
527/* Call the resolver to look up the given domain name, using the given type,
528and check the result. The error code TRY_AGAIN is documented as meaning "non-
529Authoritive Host not found, or SERVERFAIL". Sometimes there are badly set
530up nameservers that produce this error continually, so there is the option of
531providing a list of domains for which this is treated as a non-existent
532host.
533
534Arguments:
535 dnsa pointer to dns_answer structure
536 name name to look up
537 type type of DNS record required (T_A, T_MX, etc)
538
539Returns: DNS_SUCCEED successful lookup
540 DNS_NOMATCH name not found (NXDOMAIN)
541 or name contains illegal characters (if checking)
30e18802 542 or name is an IP address (for IP address lookup)
059ec3d9
PH
543 DNS_NODATA domain exists, but no data for this type (NODATA)
544 DNS_AGAIN soft failure, try again later
545 DNS_FAIL DNS failure
546*/
547
548int
1dc92d5a 549dns_basic_lookup(dns_answer *dnsa, const uschar *name, int type)
059ec3d9
PH
550{
551#ifndef STAND_ALONE
7156b1ef 552int rc = -1;
55414b25 553const uschar *save_domain;
059ec3d9 554#endif
5bfb4cdf 555res_state resp = os_get_dns_resolver_res();
059ec3d9
PH
556
557tree_node *previous;
558uschar node_name[290];
559
560/* DNS lookup failures of any kind are cached in a tree. This is mainly so that
561a timeout on one domain doesn't happen time and time again for messages that
562have many addresses in the same domain. We rely on the resolver and name server
563caching for successful lookups. */
564
565sprintf(CS node_name, "%.255s-%s-%lx", name, dns_text_type(type),
5bfb4cdf 566 resp->options);
059ec3d9
PH
567previous = tree_search(tree_dns_fails, node_name);
568if (previous != NULL)
569 {
570 DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: using cached value %s\n",
571 name, dns_text_type(type),
572 (previous->data.val == DNS_NOMATCH)? "DNS_NOMATCH" :
573 (previous->data.val == DNS_NODATA)? "DNS_NODATA" :
574 (previous->data.val == DNS_AGAIN)? "DNS_AGAIN" :
575 (previous->data.val == DNS_FAIL)? "DNS_FAIL" : "??");
576 return previous->data.val;
577 }
578
059ec3d9
PH
579/* If configured, check the hygene of the name passed to lookup. Otherwise,
580although DNS lookups may give REFUSED at the lower level, some resolvers
581turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
582domains cannot be in the DNS. The check is now done by a regular expression;
583give it space for substring storage to save it having to get its own if the
584regex has substrings that are used - the default uses a conditional.
585
586This test is omitted for PTR records. These occur only in calls from the dnsdb
587lookup, which constructs the names itself, so they should be OK. Besides,
588bitstring labels don't conform to normal name syntax. (But the aren't used any
589more.)
590
591For SRV records, we omit the initial _smtp._tcp. components at the start. */
592
593#ifndef STAND_ALONE /* Omit this for stand-alone tests */
594
482d1455 595if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
059ec3d9 596 {
1dc92d5a 597 const uschar *checkname = name;
059ec3d9
PH
598 int ovector[3*(EXPAND_MAXN+1)];
599
476be7e2 600 dns_pattern_init();
059ec3d9
PH
601
602 /* For an SRV lookup, skip over the first two components (the service and
603 protocol names, which both start with an underscore). */
604
b4161d10 605 if (type == T_SRV || type == T_TLSA)
059ec3d9
PH
606 {
607 while (*checkname++ != '.');
608 while (*checkname++ != '.');
609 }
610
1dc92d5a 611 if (pcre_exec(regex_check_dns_names, NULL, CCS checkname, Ustrlen(checkname),
059ec3d9
PH
612 0, PCRE_EOPT, ovector, sizeof(ovector)/sizeof(int)) < 0)
613 {
614 DEBUG(D_dns)
615 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
616 dns_text_type(type));
617 host_find_failed_syntax = TRUE;
618 return DNS_NOMATCH;
619 }
620 }
621
622#endif /* STAND_ALONE */
623
624/* Call the resolver; for an overlong response, res_search() will return the
bef5a11f
PH
625number of bytes the message would need, so we need to check for this case. The
626effect is to truncate overlong data.
627
30e18802
PH
628On some systems, res_search() will recognize "A-for-A" queries and return
629the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
630nameservers are also believed to do this. It is, of course, contrary to the
631specification of the DNS, so we lock it out. */
632
cc00f4af 633if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
30e18802
PH
634 return DNS_NOMATCH;
635
636/* If we are running in the test harness, instead of calling the normal resolver
bef5a11f
PH
637(res_search), we call fakens_search(), which recognizes certain special
638domains, and interfaces to a fake nameserver for certain special zones. */
639
cc00f4af
JH
640dnsa->answerlen = running_in_test_harness
641 ? fakens_search(name, type, dnsa->answer, MAXPACKET)
642 : res_search(CCS name, C_IN, type, dnsa->answer, MAXPACKET);
059ec3d9 643
80a47a2c
TK
644if (dnsa->answerlen > MAXPACKET)
645 {
646 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet (size %d), truncating to %d.\n",
647 name, dns_text_type(type), dnsa->answerlen, MAXPACKET);
648 dnsa->answerlen = MAXPACKET;
649 }
059ec3d9
PH
650
651if (dnsa->answerlen < 0) switch (h_errno)
652 {
653 case HOST_NOT_FOUND:
654 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
655 "returning DNS_NOMATCH\n", name, dns_text_type(type));
656 return dns_return(name, type, DNS_NOMATCH);
657
658 case TRY_AGAIN:
659 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
660 name, dns_text_type(type));
661
662 /* Cut this out for various test programs */
1dc92d5a 663#ifndef STAND_ALONE
55414b25 664 save_domain = deliver_domain;
1dc92d5a 665 deliver_domain = string_copy(name); /* set $domain */
55414b25 666 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
059ec3d9 667 MCL_DOMAIN, TRUE, NULL);
55414b25 668 deliver_domain = save_domain;
059ec3d9
PH
669 if (rc != OK)
670 {
671 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
672 return dns_return(name, type, DNS_AGAIN);
673 }
674 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
675 "DNS_NOMATCH\n", name);
676 return dns_return(name, type, DNS_NOMATCH);
677
1dc92d5a 678#else /* For stand-alone tests */
059ec3d9 679 return dns_return(name, type, DNS_AGAIN);
1dc92d5a 680#endif
059ec3d9
PH
681
682 case NO_RECOVERY:
683 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
684 "returning DNS_FAIL\n", name, dns_text_type(type));
685 return dns_return(name, type, DNS_FAIL);
686
687 case NO_DATA:
688 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
689 "returning DNS_NODATA\n", name, dns_text_type(type));
690 return dns_return(name, type, DNS_NODATA);
691
692 default:
693 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
694 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
695 return dns_return(name, type, DNS_FAIL);
696 }
697
698DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
699 name, dns_text_type(type));
700
701return DNS_SUCCEED;
702}
703
704
705
706
707/************************************************
708* Do a DNS lookup and handle CNAMES *
709************************************************/
710
711/* Look up the given domain name, using the given type. Follow CNAMEs if
712necessary, but only so many times. There aren't supposed to be CNAME chains in
713the DNS, but you are supposed to cope with them if you find them.
714
715The assumption is made that if the resolver gives back records of the
716requested type *and* a CNAME, we don't need to make another call to look up
717the CNAME. I can't see how it could return only some of the right records. If
718it's done a CNAME lookup in the past, it will have all of them; if not, it
719won't return any.
720
721If fully_qualified_name is not NULL, set it to point to the full name
722returned by the resolver, if this is different to what it is given, unless
723the returned name starts with "*" as some nameservers seem to be returning
724wildcards in this form.
725
726Arguments:
727 dnsa pointer to dns_answer structure
728 name domain name to look up
729 type DNS record type (T_A, T_MX, etc)
730 fully_qualified_name if not NULL, return the returned name here if its
731 contents are different (i.e. it must be preset)
732
733Returns: DNS_SUCCEED successful lookup
734 DNS_NOMATCH name not found
735 DNS_NODATA no data found
736 DNS_AGAIN soft failure, try again later
737 DNS_FAIL DNS failure
738*/
739
740int
1dc92d5a 741dns_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 742 const uschar **fully_qualified_name)
059ec3d9
PH
743{
744int i;
1dc92d5a 745const uschar *orig_name = name;
c85b3043 746BOOL secure_so_far = TRUE;
059ec3d9
PH
747
748/* Loop to follow CNAME chains so far, but no further... */
749
750for (i = 0; i < 10; i++)
751 {
752 uschar data[256];
753 dns_record *rr, cname_rr, type_rr;
754 dns_scan dnss;
755 int datalen, rc;
756
757 /* DNS lookup failures get passed straight back. */
758
759 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED) return rc;
760
761 /* We should have either records of the required type, or a CNAME record,
762 or both. We need to know whether both exist for getting the fully qualified
763 name, but avoid scanning more than necessary. Note that we must copy the
764 contents of any rr blocks returned by dns_next_rr() as they use the same
765 area in the dnsa block. */
766
767 cname_rr.data = type_rr.data = NULL;
768 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
769 rr != NULL;
770 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
771 {
772 if (rr->type == type)
773 {
774 if (type_rr.data == NULL) type_rr = *rr;
775 if (cname_rr.data != NULL) break;
776 }
777 else if (rr->type == T_CNAME) cname_rr = *rr;
778 }
779
a2042e78
PH
780 /* For the first time round this loop, if a CNAME was found, take the fully
781 qualified name from it; otherwise from the first data record, if present. */
059ec3d9 782
a2042e78 783 if (i == 0 && fully_qualified_name != NULL)
059ec3d9
PH
784 {
785 if (cname_rr.data != NULL)
786 {
787 if (Ustrcmp(cname_rr.name, *fully_qualified_name) != 0 &&
788 cname_rr.name[0] != '*')
789 *fully_qualified_name = string_copy_dnsdomain(cname_rr.name);
790 }
791 else if (type_rr.data != NULL)
792 {
75e0e026
PH
793 if (Ustrcmp(type_rr.name, *fully_qualified_name) != 0 &&
794 type_rr.name[0] != '*')
795 *fully_qualified_name = string_copy_dnsdomain(type_rr.name);
059ec3d9
PH
796 }
797 }
798
799 /* If any data records of the correct type were found, we are done. */
800
c85b3043
JH
801 if (type_rr.data != NULL)
802 {
803 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
4a142059 804 dns_set_insecure(dnsa);
c85b3043
JH
805 return DNS_SUCCEED;
806 }
059ec3d9
PH
807
808 /* If there are no data records, we need to re-scan the DNS using the
809 domain given in the CNAME record, which should exist (otherwise we should
810 have had a failure from dns_lookup). However code against the possibility of
811 its not existing. */
812
813 if (cname_rr.data == NULL) return DNS_FAIL;
814 datalen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
1dc92d5a 815 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, sizeof(data));
059ec3d9
PH
816 if (datalen < 0) return DNS_FAIL;
817 name = data;
a2042e78 818
c85b3043
JH
819 if (!dns_is_secure(dnsa))
820 secure_so_far = FALSE;
821
a2042e78 822 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
059ec3d9
PH
823 } /* Loop back to do another lookup */
824
825/*Control reaches here after 10 times round the CNAME loop. Something isn't
826right... */
827
828log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
829return DNS_FAIL;
830}
831
832
833
33397d19
PH
834
835
836
837/************************************************
838* Do a DNS lookup and handle virtual types *
839************************************************/
840
8e669ac1
PH
841/* This function handles some invented "lookup types" that synthesize feature
842not available in the basic types. The special types all have negative values.
33397d19
PH
843Positive type values are passed straight on to dns_lookup().
844
845Arguments:
846 dnsa pointer to dns_answer structure
847 name domain name to look up
848 type DNS record type (T_A, T_MX, etc or a "special")
849 fully_qualified_name if not NULL, return the returned name here if its
850 contents are different (i.e. it must be preset)
851
852Returns: DNS_SUCCEED successful lookup
853 DNS_NOMATCH name not found
854 DNS_NODATA no data found
855 DNS_AGAIN soft failure, try again later
856 DNS_FAIL DNS failure
857*/
858
859int
1dc92d5a 860dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 861 const uschar **fully_qualified_name)
33397d19
PH
862{
863if (type >= 0) return dns_lookup(dnsa, name, type, fully_qualified_name);
864
ea3bc19b
PH
865/* The "mx hosts only" type doesn't require any special action here */
866
867if (type == T_MXH) return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
868
8e669ac1 869/* Find nameservers for the domain or the nearest enclosing zone, excluding the
33397d19
PH
870root servers. */
871
872if (type == T_ZNS)
873 {
1dc92d5a 874 const uschar *d = name;
33397d19
PH
875 while (d != 0)
876 {
877 int rc = dns_lookup(dnsa, d, T_NS, fully_qualified_name);
878 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
879 while (*d != 0 && *d != '.') d++;
8e669ac1 880 if (*d++ == 0) break;
33397d19 881 }
8e669ac1
PH
882 return DNS_NOMATCH;
883 }
33397d19 884
e5a9dba6
PH
885/* Try to look up the Client SMTP Authorization SRV record for the name. If
886there isn't one, search from the top downwards for a CSA record in a parent
887domain, which might be making assertions about subdomains. If we find a record
888we set fully_qualified_name to whichever lookup succeeded, so that the caller
889can tell whether to look at the explicit authorization field or the subdomain
890assertion field. */
891
892if (type == T_CSA)
893 {
894 uschar *srvname, *namesuff, *tld, *p;
895 int priority, weight, port;
896 int limit, rc, i;
897 BOOL ipv6;
898 dns_record *rr;
899 dns_scan dnss;
900
901 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
902
903 srvname = string_sprintf("_client._smtp.%s", name);
904 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
905 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
906 {
1dc92d5a 907 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
e5a9dba6
PH
908 return rc;
909 }
910
911 /* Search for CSA subdomain assertion SRV records from the top downwards,
912 starting with the 2nd level domain. This order maximizes cache-friendliness.
913 We skip the top level domains to avoid loading their nameservers and because
914 we know they'll never have CSA SRV records. */
915
916 namesuff = Ustrrchr(name, '.');
917 if (namesuff == NULL) return DNS_NOMATCH;
918 tld = namesuff + 1;
919 ipv6 = FALSE;
920 limit = dns_csa_search_limit;
921
922 /* Use more appropriate search parameters if we are in the reverse DNS. */
923
924 if (strcmpic(namesuff, US".arpa") == 0)
925 {
926 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
927 {
928 namesuff -= 8;
929 tld = namesuff + 1;
930 limit = 3;
931 }
932 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
933 {
934 namesuff -= 4;
935 tld = namesuff + 1;
936 ipv6 = TRUE;
937 limit = 3;
938 }
939 }
940
941 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
942
943 /* Do not perform the search if the top level or 2nd level domains do not
944 exist. This is quite common, and when it occurs all the search queries would
945 go to the root or TLD name servers, which is not friendly. So we check the
946 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
947 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
948 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
949 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
950
951 if (rc == DNS_NOMATCH)
952 {
953 /* This is really gross. The successful return value from res_search() is
954 the packet length, which is stored in dnsa->answerlen. If we get a
955 negative DNS reply then res_search() returns -1, which causes the bounds
956 checks for name decompression to fail when it is treated as a packet
957 length, which in turn causes the authority search to fail. The correct
958 packet length has been lost inside libresolv, so we have to guess a
959 replacement value. (The only way to fix this properly would be to
960 re-implement res_search() and res_query() so that they don't muddle their
961 success and packet length return values.) For added safety we only reset
962 the packet length if the packet header looks plausible. */
963
964 HEADER *h = (HEADER *)dnsa->answer;
965 if (h->qr == 1 && h->opcode == QUERY && h->tc == 0
966 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
967 && ntohs(h->qdcount) == 1 && ntohs(h->ancount) == 0
968 && ntohs(h->nscount) >= 1)
969 dnsa->answerlen = MAXPACKET;
970
971 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
972 rr != NULL;
973 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
974 if (rr->type != T_SOA) continue;
975 else if (strcmpic(rr->name, US"") == 0 ||
976 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
977 else break;
978 }
979
980 for (i = 0; i < limit; i++)
981 {
982 if (ipv6)
983 {
984 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
985 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
986 namesuff -= 8;
987 if (namesuff <= name) return DNS_NOMATCH;
988 }
989 else
990 /* Find the start of the preceding domain name label. */
991 do
992 if (--namesuff <= name) return DNS_NOMATCH;
993 while (*namesuff != '.');
994
995 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
996
997 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
998 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
999 if (rc == DNS_AGAIN) return rc;
1000 if (rc != DNS_SUCCEED) continue;
1001
1002 /* Check that the SRV record we have found is worth returning. We don't
1003 just return the first one we find, because some lower level SRV record
1004 might make stricter assertions than its parent domain. */
1005
1006 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1007 rr != NULL;
1008 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
1009 {
1010 if (rr->type != T_SRV) continue;
1011
1012 /* Extract the numerical SRV fields (p is incremented) */
1013 p = rr->data;
1014 GETSHORT(priority, p);
4a142059 1015 GETSHORT(weight, p); weight = weight; /* compiler quietening */
e5a9dba6
PH
1016 GETSHORT(port, p);
1017
1018 /* Check the CSA version number */
1019 if (priority != 1) continue;
1020
1021 /* If it's making an interesting assertion, return this response. */
1022 if (port & 1)
1023 {
1024 *fully_qualified_name = namesuff + 1;
1025 return DNS_SUCCEED;
1026 }
1027 }
1028 }
1029 return DNS_NOMATCH;
1030 }
1031
33397d19
PH
1032/* Control should never reach here */
1033
1034return DNS_FAIL;
1035}
1036
1037
1038
059ec3d9
PH
1039
1040
1041/*************************************************
1042* Get address(es) from DNS record *
1043*************************************************/
1044
1045/* The record type is either T_A for an IPv4 address or T_AAAA (or T_A6 when
1046supported) for an IPv6 address. In the A6 case, there may be several addresses,
1047generated by following chains. A recursive function does all the hard work. A6
1048records now look like passing into history, so the code is only included when
1049explicitly asked for.
1050
1051Argument:
1052 dnsa the DNS answer block
1053 rr the RR
1054
1055Returns: pointer a chain of dns_address items
1056*/
1057
1058dns_address *
1059dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1060{
1061dns_address *yield = NULL;
1062
059ec3d9 1063dnsa = dnsa; /* Stop picky compilers warning */
059ec3d9
PH
1064
1065if (rr->type == T_A)
1066 {
1067 uschar *p = (uschar *)(rr->data);
1068 yield = store_get(sizeof(dns_address) + 20);
1069 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1070 yield->next = NULL;
1071 }
1072
1073#if HAVE_IPV6
1074
059ec3d9
PH
1075else
1076 {
1077 yield = store_get(sizeof(dns_address) + 50);
1078 inet_ntop(AF_INET6, (uschar *)(rr->data), CS yield->address, 50);
1079 yield->next = NULL;
1080 }
1081#endif /* HAVE_IPV6 */
1082
1083return yield;
1084}
1085
476be7e2
JH
1086
1087
1088void
1089dns_pattern_init(void)
1090{
1091if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1092 regex_check_dns_names =
1093 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);
1094}
1095
8c51eead
JH
1096/* vi: aw ai sw=2
1097*/
059ec3d9 1098/* End of dns.c */