Docs: clarify notes on .ifdef Bug 1155
[exim.git] / src / src / dns.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions for interfacing with the DNS. */
9
10#include "exim.h"
11
12
059ec3d9 13
bef5a11f
PH
14/*************************************************
15* Fake DNS resolver *
16*************************************************/
17
18/* This function is called instead of res_search() when Exim is running in its
19test harness. It recognizes some special domain names, and uses them to force
433a2980
PH
20failure and retry responses (optionally with a delay). Otherwise, it calls an
21external utility that mocks-up a nameserver, if it can find the utility.
22If not, it passes its arguments on to res_search(). The fake nameserver may
23also return a code specifying that the name should be passed on.
bef5a11f
PH
24
25Background: the original test suite required a real nameserver to carry the
8e013028 26test zones, whereas the new test suite has the fake server for portability. This
e7726cbf 27code supports both.
bef5a11f
PH
28
29Arguments:
e7726cbf 30 domain the domain name
bef5a11f
PH
31 type the DNS record type
32 answerptr where to put the answer
33 size size of the answer area
34
35Returns: length of returned data, or -1 on error (h_errno set)
36*/
37
38static int
1dc92d5a 39fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
bef5a11f 40{
e7726cbf 41int len = Ustrlen(domain);
433a2980 42int asize = size; /* Locally modified */
e7726cbf
PH
43uschar *endname;
44uschar name[256];
433a2980
PH
45uschar utilname[256];
46uschar *aptr = answerptr; /* Locally modified */
47struct stat statbuf;
48
49/* Remove terminating dot. */
e7726cbf
PH
50
51if (domain[len - 1] == '.') len--;
52Ustrncpy(name, domain, len);
53name[len] = 0;
54endname = name + len;
bef5a11f 55
433a2980
PH
56/* Look for the fakens utility, and if it exists, call it. */
57
5f3d0983
HSHR
58(void)string_format(utilname, sizeof(utilname), "%s/bin/fakens",
59 config_main_directory);
433a2980
PH
60
61if (stat(CS utilname, &statbuf) >= 0)
bef5a11f 62 {
433a2980
PH
63 pid_t pid;
64 int infd, outfd, rc;
65 uschar *argv[5];
66
3735e326 67 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n", name, dns_text_type(type));
433a2980
PH
68
69 argv[0] = utilname;
5f3d0983 70 argv[1] = config_main_directory;
433a2980
PH
71 argv[2] = name;
72 argv[3] = dns_text_type(type);
73 argv[4] = NULL;
74
75 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE);
76 if (pid < 0)
77 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
78 strerror(errno));
79
80 len = 0;
81 rc = -1;
82 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
83 {
84 len += rc;
85 aptr += rc; /* Don't modify the actual arguments, because they */
86 asize -= rc; /* may need to be passed on to res_search(). */
87 }
bef5a11f 88
1fb7660f
JH
89 /* If we ran out of output buffer before exhasting the return,
90 carry on reading and counting it. */
91
92 if (asize == 0)
93 while ((rc = read(outfd, name, sizeof(name))) > 0)
94 len += rc;
95
433a2980
PH
96 if (rc < 0)
97 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
98 strerror(errno));
bef5a11f 99
433a2980 100 switch(child_close(pid, 0))
bef5a11f 101 {
433a2980
PH
102 case 0: return len;
103 case 1: h_errno = HOST_NOT_FOUND; return -1;
104 case 2: h_errno = TRY_AGAIN; return -1;
105 default:
106 case 3: h_errno = NO_RECOVERY; return -1;
107 case 4: h_errno = NO_DATA; return -1;
108 case 5: /* Pass on to res_search() */
109 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
bef5a11f
PH
110 }
111 }
8e013028
HSHR
112else
113 {
4cea764f 114 DEBUG(D_dns) debug_printf("fakens (%s) not found\n", utilname);
8e013028 115 }
bef5a11f 116
433a2980 117/* fakens utility not found, or it returned "pass on" */
bef5a11f 118
433a2980 119DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
e7726cbf
PH
120
121return res_search(CS domain, C_IN, type, answerptr, size);
bef5a11f
PH
122}
123
124
059ec3d9
PH
125
126/*************************************************
127* Initialize and configure resolver *
128*************************************************/
129
130/* Initialize the resolver and the storage for holding DNS answers if this is
131the first time we have been here, and set the resolver options.
132
133Arguments:
134 qualify_single TRUE to set the RES_DEFNAMES option
135 search_parents TRUE to set the RES_DNSRCH option
8c51eead 136 use_dnssec TRUE to set the RES_USE_DNSSEC option
059ec3d9
PH
137
138Returns: nothing
139*/
140
141void
8c51eead 142dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
059ec3d9 143{
5bfb4cdf
PP
144res_state resp = os_get_dns_resolver_res();
145
146if ((resp->options & RES_INIT) == 0)
059ec3d9 147 {
5bfb4cdf
PP
148 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
149 os_put_dns_resolver_res(resp);
059ec3d9 150 res_init();
5bfb4cdf
PP
151 DEBUG(D_resolver) resp->options |= RES_DEBUG;
152 os_put_dns_resolver_res(resp);
059ec3d9
PH
153 }
154
5bfb4cdf
PP
155resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
156resp->options |= (qualify_single? RES_DEFNAMES : 0) |
059ec3d9 157 (search_parents? RES_DNSRCH : 0);
5bfb4cdf
PP
158if (dns_retrans > 0) resp->retrans = dns_retrans;
159if (dns_retry > 0) resp->retry = dns_retry;
e97d1f08
PP
160
161#ifdef RES_USE_EDNS0
162if (dns_use_edns0 >= 0)
163 {
164 if (dns_use_edns0)
5bfb4cdf 165 resp->options |= RES_USE_EDNS0;
e97d1f08 166 else
5bfb4cdf 167 resp->options &= ~RES_USE_EDNS0;
e97d1f08
PP
168 DEBUG(D_resolver)
169 debug_printf("Coerced resolver EDNS0 support %s.\n",
170 dns_use_edns0 ? "on" : "off");
171 }
172#else
173if (dns_use_edns0 >= 0)
174 DEBUG(D_resolver)
175 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
176 dns_use_edns0 ? "" : "un");
177#endif
5bfb4cdf 178
1f4a55da
PP
179#ifndef DISABLE_DNSSEC
180# ifdef RES_USE_DNSSEC
181# ifndef RES_USE_EDNS0
182# error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
183# endif
8c51eead
JH
184if (use_dnssec)
185 resp->options |= RES_USE_DNSSEC;
0fbd9bff 186if (dns_dnssec_ok >= 0)
1f4a55da 187 {
0fbd9bff 188 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
1f4a55da
PP
189 {
190 DEBUG(D_resolver)
0fbd9bff 191 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
1f4a55da
PP
192 }
193 else
194 {
0fbd9bff 195 if (dns_dnssec_ok)
1f4a55da
PP
196 resp->options |= RES_USE_DNSSEC;
197 else
198 resp->options &= ~RES_USE_DNSSEC;
199 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
0fbd9bff 200 dns_dnssec_ok ? "on" : "off");
1f4a55da
PP
201 }
202 }
203# else
0fbd9bff 204if (dns_dnssec_ok >= 0)
1f4a55da
PP
205 DEBUG(D_resolver)
206 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
0fbd9bff 207 dns_dnssec_ok ? "" : "un");
8c51eead
JH
208if (use_dnssec)
209 DEBUG(D_resolver)
93d4b03a 210 debug_printf("Unable to set DNSSEC without resolver support.\n");
1f4a55da
PP
211# endif
212#endif /* DISABLE_DNSSEC */
213
5bfb4cdf 214os_put_dns_resolver_res(resp);
059ec3d9
PH
215}
216
217
218
219/*************************************************
220* Build key name for PTR records *
221*************************************************/
222
223/* This function inverts an IP address and adds the relevant domain, to produce
224a name that can be used to look up PTR records.
225
226Arguments:
227 string the IP address as a string
228 buffer a suitable buffer, long enough to hold the result
229
230Returns: nothing
231*/
232
233void
55414b25 234dns_build_reverse(const uschar *string, uschar *buffer)
059ec3d9 235{
55414b25 236const uschar *p = string + Ustrlen(string);
059ec3d9
PH
237uschar *pp = buffer;
238
239/* Handle IPv4 address */
240
241#if HAVE_IPV6
242if (Ustrchr(string, ':') == NULL)
243#endif
244 {
245 int i;
246 for (i = 0; i < 4; i++)
247 {
55414b25 248 const uschar *ppp = p;
059ec3d9
PH
249 while (ppp > string && ppp[-1] != '.') ppp--;
250 Ustrncpy(pp, ppp, p - ppp);
251 pp += p - ppp;
252 *pp++ = '.';
253 p = ppp - 1;
254 }
255 Ustrcpy(pp, "in-addr.arpa");
256 }
257
258/* Handle IPv6 address; convert to binary so as to fill out any
259abbreviation in the textual form. */
260
261#if HAVE_IPV6
262else
263 {
264 int i;
265 int v6[4];
266 (void)host_aton(string, v6);
267
268 /* The original specification for IPv6 reverse lookup was to invert each
269 nibble, and look in the ip6.int domain. The domain was subsequently
270 changed to ip6.arpa. */
271
272 for (i = 3; i >= 0; i--)
273 {
274 int j;
275 for (j = 0; j < 32; j += 4)
276 {
277 sprintf(CS pp, "%x.", (v6[i] >> j) & 15);
278 pp += 2;
279 }
280 }
281 Ustrcpy(pp, "ip6.arpa.");
282
283 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
284 with A6 records. However, it fell out of favour when they did. The
285 alternative was to construct a binary key, and look in ip6.arpa. I tried
286 to make this code do that, but I could not make it work on Solaris 8. The
287 resolver seems to lose the initial backslash somehow. However, now that
288 this style of reverse lookup has been dropped, it doesn't matter. These
289 lines are left here purely for historical interest. */
290
291 /**************************************************
292 Ustrcpy(pp, "\\[x");
293 pp += 3;
294
295 for (i = 0; i < 4; i++)
296 {
297 sprintf(pp, "%08X", v6[i]);
298 pp += 8;
299 }
300 Ustrcpy(pp, "].ip6.arpa.");
301 **************************************************/
302
303 }
304#endif
305}
306
307
308
309
310/*************************************************
311* Get next DNS record from answer block *
312*************************************************/
313
314/* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
e5a9dba6
PH
315RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
316scan the additional records, and reset == RESET_NEXT to get the next record.
317The result is in static storage which must be copied if it is to be preserved.
059ec3d9
PH
318
319Arguments:
320 dnsa pointer to dns answer block
321 dnss pointer to dns scan block
322 reset option specifing what portion to scan, as described above
323
324Returns: next dns record, or NULL when no more
325*/
326
327dns_record *
328dns_next_rr(dns_answer *dnsa, dns_scan *dnss, int reset)
329{
330HEADER *h = (HEADER *)dnsa->answer;
331int namelen;
332
333/* Reset the saved data when requested to, and skip to the first required RR */
334
335if (reset != RESET_NEXT)
336 {
337 dnss->rrcount = ntohs(h->qdcount);
338 dnss->aptr = dnsa->answer + sizeof(HEADER);
339
340 /* Skip over questions; failure to expand the name just gives up */
341
342 while (dnss->rrcount-- > 0)
343 {
344 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
345 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
346 if (namelen < 0) { dnss->rrcount = 0; return NULL; }
347 dnss->aptr += namelen + 4; /* skip name & type & class */
348 }
349
350 /* Get the number of answer records. */
351
352 dnss->rrcount = ntohs(h->ancount);
353
e5a9dba6
PH
354 /* Skip over answers if we want to look at the authority section. Also skip
355 the NS records (i.e. authority section) if wanting to look at the additional
059ec3d9
PH
356 records. */
357
e5a9dba6
PH
358 if (reset == RESET_ADDITIONAL) dnss->rrcount += ntohs(h->nscount);
359
360 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
059ec3d9 361 {
059ec3d9
PH
362 while (dnss->rrcount-- > 0)
363 {
364 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
365 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
366 if (namelen < 0) { dnss->rrcount = 0; return NULL; }
367 dnss->aptr += namelen + 8; /* skip name, type, class & TTL */
368 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
369 dnss->aptr += dnss->srr.size; /* skip over it */
370 }
e5a9dba6
PH
371 dnss->rrcount = (reset == RESET_AUTHORITY)
372 ? ntohs(h->nscount) : ntohs(h->arcount);
059ec3d9
PH
373 }
374 }
375
059ec3d9
PH
376/* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
377contains the number of RR records left. */
378
379if (dnss->rrcount-- <= 0) return NULL;
380
381/* If expanding the RR domain name fails, behave as if no more records
382(something safe). */
383
384namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
385 (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
386if (namelen < 0) { dnss->rrcount = 0; return NULL; }
387
388/* Move the pointer past the name and fill in the rest of the data structure
389from the following bytes. */
390
391dnss->aptr += namelen;
392GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
393dnss->aptr += 6; /* Don't want class or TTL */
394GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
395dnss->srr.data = dnss->aptr; /* The record's data follows */
396dnss->aptr += dnss->srr.size; /* Advance to next RR */
397
398/* Return a pointer to the dns_record structure within the dns_answer. This is
399for convenience so that the scans can use nice-looking for loops. */
400
401return &(dnss->srr);
402}
403
404
405
406
407/*************************************************
1f4a55da
PP
408* Return whether AD bit set in DNS result *
409*************************************************/
410
411/* We do not perform DNSSEC work ourselves; if the administrator has installed
412a verifying resolver which sets AD as appropriate, though, we'll use that.
413(AD = Authentic Data)
414
415Argument: pointer to dns answer block
416Returns: bool indicating presence of AD bit
417*/
418
419BOOL
4a142059 420dns_is_secure(const dns_answer * dnsa)
1f4a55da
PP
421{
422#ifdef DISABLE_DNSSEC
423DEBUG(D_dns)
424 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
425return FALSE;
426#else
427HEADER *h = (HEADER *)dnsa->answer;
428return h->ad ? TRUE : FALSE;
429#endif
430}
431
4a142059
JH
432static void
433dns_set_insecure(dns_answer * dnsa)
434{
435HEADER * h = (HEADER *)dnsa->answer;
436h->ad = 0;
437}
438
221dff13
HSHR
439/************************************************
440 * Check whether the AA bit is set *
441 * We need this to warn if we requested AD *
442 * from a authoritive server *
443 ************************************************/
444
445BOOL
446dns_is_aa(const dns_answer *dnsa)
447{
448return ((HEADER*)dnsa->answer)->aa;
449}
1f4a55da
PP
450
451
452
453/*************************************************
059ec3d9
PH
454* Turn DNS type into text *
455*************************************************/
456
885ccd3e
PH
457/* Turn the coded record type into a string for printing. All those that Exim
458uses should be included here.
059ec3d9
PH
459
460Argument: record type
461Returns: pointer to string
462*/
463
464uschar *
465dns_text_type(int t)
466{
467switch(t)
468 {
33397d19
PH
469 case T_A: return US"A";
470 case T_MX: return US"MX";
471 case T_AAAA: return US"AAAA";
472 case T_A6: return US"A6";
473 case T_TXT: return US"TXT";
eae0036b 474 case T_SPF: return US"SPF";
33397d19 475 case T_PTR: return US"PTR";
885ccd3e 476 case T_SOA: return US"SOA";
33397d19
PH
477 case T_SRV: return US"SRV";
478 case T_NS: return US"NS";
8e669ac1 479 case T_CNAME: return US"CNAME";
1e06383a 480 case T_TLSA: return US"TLSA";
33397d19 481 default: return US"?";
059ec3d9
PH
482 }
483}
484
485
486
487/*************************************************
488* Cache a failed DNS lookup result *
489*************************************************/
490
491/* We cache failed lookup results so as not to experience timeouts many
492times for the same domain. We need to retain the resolver options because they
493may change. For successful lookups, we rely on resolver and/or name server
494caching.
495
496Arguments:
497 name the domain name
498 type the lookup type
499 rc the return code
500
501Returns: the return code
502*/
503
504static int
1dc92d5a 505dns_return(const uschar * name, int type, int rc)
059ec3d9 506{
5bfb4cdf 507res_state resp = os_get_dns_resolver_res();
059ec3d9
PH
508tree_node *node = store_get_perm(sizeof(tree_node) + 290);
509sprintf(CS node->name, "%.255s-%s-%lx", name, dns_text_type(type),
5bfb4cdf 510 resp->options);
059ec3d9
PH
511node->data.val = rc;
512(void)tree_insertnode(&tree_dns_fails, node);
513return rc;
514}
515
516
517
518/*************************************************
519* Do basic DNS lookup *
520*************************************************/
521
522/* Call the resolver to look up the given domain name, using the given type,
523and check the result. The error code TRY_AGAIN is documented as meaning "non-
524Authoritive Host not found, or SERVERFAIL". Sometimes there are badly set
525up nameservers that produce this error continually, so there is the option of
526providing a list of domains for which this is treated as a non-existent
527host.
528
529Arguments:
530 dnsa pointer to dns_answer structure
531 name name to look up
532 type type of DNS record required (T_A, T_MX, etc)
533
534Returns: DNS_SUCCEED successful lookup
535 DNS_NOMATCH name not found (NXDOMAIN)
536 or name contains illegal characters (if checking)
30e18802 537 or name is an IP address (for IP address lookup)
059ec3d9
PH
538 DNS_NODATA domain exists, but no data for this type (NODATA)
539 DNS_AGAIN soft failure, try again later
540 DNS_FAIL DNS failure
541*/
542
543int
1dc92d5a 544dns_basic_lookup(dns_answer *dnsa, const uschar *name, int type)
059ec3d9
PH
545{
546#ifndef STAND_ALONE
7156b1ef 547int rc = -1;
55414b25 548const uschar *save_domain;
059ec3d9 549#endif
5bfb4cdf 550res_state resp = os_get_dns_resolver_res();
059ec3d9
PH
551
552tree_node *previous;
553uschar node_name[290];
554
555/* DNS lookup failures of any kind are cached in a tree. This is mainly so that
556a timeout on one domain doesn't happen time and time again for messages that
557have many addresses in the same domain. We rely on the resolver and name server
558caching for successful lookups. */
559
560sprintf(CS node_name, "%.255s-%s-%lx", name, dns_text_type(type),
5bfb4cdf 561 resp->options);
059ec3d9
PH
562previous = tree_search(tree_dns_fails, node_name);
563if (previous != NULL)
564 {
565 DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: using cached value %s\n",
566 name, dns_text_type(type),
567 (previous->data.val == DNS_NOMATCH)? "DNS_NOMATCH" :
568 (previous->data.val == DNS_NODATA)? "DNS_NODATA" :
569 (previous->data.val == DNS_AGAIN)? "DNS_AGAIN" :
570 (previous->data.val == DNS_FAIL)? "DNS_FAIL" : "??");
571 return previous->data.val;
572 }
573
9d4319df
JH
574#ifdef EXPERIMENTAL_INTERNATIONAL
575/* Convert all names to a-label form before doing lookup */
576 {
577 uschar * alabel;
578 uschar * errstr = NULL;
766e7a65
JH
579 DEBUG(D_dns) if (string_is_utf8(name))
580 debug_printf("convert utf8 '%s' to alabel for for lookup\n", name);
9d4319df
JH
581 if ((alabel = string_domain_utf8_to_alabel(name, &errstr)), errstr)
582 {
583 DEBUG(D_dns)
37bf366e 584 debug_printf("DNS name '%s' utf8 conversion to alabel failed: %s\n", name,
9d4319df
JH
585 errstr);
586 host_find_failed_syntax = TRUE;
587 return DNS_NOMATCH;
588 }
589 name = alabel;
590 }
591#endif
592
059ec3d9
PH
593/* If configured, check the hygene of the name passed to lookup. Otherwise,
594although DNS lookups may give REFUSED at the lower level, some resolvers
595turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
596domains cannot be in the DNS. The check is now done by a regular expression;
597give it space for substring storage to save it having to get its own if the
598regex has substrings that are used - the default uses a conditional.
599
600This test is omitted for PTR records. These occur only in calls from the dnsdb
601lookup, which constructs the names itself, so they should be OK. Besides,
602bitstring labels don't conform to normal name syntax. (But the aren't used any
603more.)
604
605For SRV records, we omit the initial _smtp._tcp. components at the start. */
606
607#ifndef STAND_ALONE /* Omit this for stand-alone tests */
608
482d1455 609if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
059ec3d9 610 {
1dc92d5a 611 const uschar *checkname = name;
059ec3d9
PH
612 int ovector[3*(EXPAND_MAXN+1)];
613
476be7e2 614 dns_pattern_init();
059ec3d9
PH
615
616 /* For an SRV lookup, skip over the first two components (the service and
617 protocol names, which both start with an underscore). */
618
b4161d10 619 if (type == T_SRV || type == T_TLSA)
059ec3d9
PH
620 {
621 while (*checkname++ != '.');
622 while (*checkname++ != '.');
623 }
624
1dc92d5a 625 if (pcre_exec(regex_check_dns_names, NULL, CCS checkname, Ustrlen(checkname),
059ec3d9
PH
626 0, PCRE_EOPT, ovector, sizeof(ovector)/sizeof(int)) < 0)
627 {
628 DEBUG(D_dns)
629 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
630 dns_text_type(type));
631 host_find_failed_syntax = TRUE;
632 return DNS_NOMATCH;
633 }
634 }
635
636#endif /* STAND_ALONE */
637
638/* Call the resolver; for an overlong response, res_search() will return the
bef5a11f
PH
639number of bytes the message would need, so we need to check for this case. The
640effect is to truncate overlong data.
641
30e18802
PH
642On some systems, res_search() will recognize "A-for-A" queries and return
643the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
644nameservers are also believed to do this. It is, of course, contrary to the
645specification of the DNS, so we lock it out. */
646
cc00f4af 647if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
30e18802
PH
648 return DNS_NOMATCH;
649
650/* If we are running in the test harness, instead of calling the normal resolver
bef5a11f
PH
651(res_search), we call fakens_search(), which recognizes certain special
652domains, and interfaces to a fake nameserver for certain special zones. */
653
cc00f4af
JH
654dnsa->answerlen = running_in_test_harness
655 ? fakens_search(name, type, dnsa->answer, MAXPACKET)
656 : res_search(CCS name, C_IN, type, dnsa->answer, MAXPACKET);
059ec3d9 657
80a47a2c
TK
658if (dnsa->answerlen > MAXPACKET)
659 {
660 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet (size %d), truncating to %d.\n",
661 name, dns_text_type(type), dnsa->answerlen, MAXPACKET);
662 dnsa->answerlen = MAXPACKET;
663 }
059ec3d9
PH
664
665if (dnsa->answerlen < 0) switch (h_errno)
666 {
667 case HOST_NOT_FOUND:
668 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
669 "returning DNS_NOMATCH\n", name, dns_text_type(type));
670 return dns_return(name, type, DNS_NOMATCH);
671
672 case TRY_AGAIN:
673 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
674 name, dns_text_type(type));
675
676 /* Cut this out for various test programs */
1dc92d5a 677#ifndef STAND_ALONE
55414b25 678 save_domain = deliver_domain;
1dc92d5a 679 deliver_domain = string_copy(name); /* set $domain */
55414b25 680 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
059ec3d9 681 MCL_DOMAIN, TRUE, NULL);
55414b25 682 deliver_domain = save_domain;
059ec3d9
PH
683 if (rc != OK)
684 {
685 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
686 return dns_return(name, type, DNS_AGAIN);
687 }
688 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
689 "DNS_NOMATCH\n", name);
690 return dns_return(name, type, DNS_NOMATCH);
691
1dc92d5a 692#else /* For stand-alone tests */
059ec3d9 693 return dns_return(name, type, DNS_AGAIN);
1dc92d5a 694#endif
059ec3d9
PH
695
696 case NO_RECOVERY:
697 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
698 "returning DNS_FAIL\n", name, dns_text_type(type));
699 return dns_return(name, type, DNS_FAIL);
700
701 case NO_DATA:
702 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
703 "returning DNS_NODATA\n", name, dns_text_type(type));
704 return dns_return(name, type, DNS_NODATA);
705
706 default:
707 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
708 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
709 return dns_return(name, type, DNS_FAIL);
710 }
711
712DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
713 name, dns_text_type(type));
714
715return DNS_SUCCEED;
716}
717
718
719
720
721/************************************************
722* Do a DNS lookup and handle CNAMES *
723************************************************/
724
725/* Look up the given domain name, using the given type. Follow CNAMEs if
726necessary, but only so many times. There aren't supposed to be CNAME chains in
727the DNS, but you are supposed to cope with them if you find them.
728
729The assumption is made that if the resolver gives back records of the
730requested type *and* a CNAME, we don't need to make another call to look up
731the CNAME. I can't see how it could return only some of the right records. If
732it's done a CNAME lookup in the past, it will have all of them; if not, it
733won't return any.
734
735If fully_qualified_name is not NULL, set it to point to the full name
736returned by the resolver, if this is different to what it is given, unless
737the returned name starts with "*" as some nameservers seem to be returning
766e7a65
JH
738wildcards in this form. In international mode "different" means "alabel
739forms are different".
059ec3d9
PH
740
741Arguments:
742 dnsa pointer to dns_answer structure
743 name domain name to look up
744 type DNS record type (T_A, T_MX, etc)
745 fully_qualified_name if not NULL, return the returned name here if its
746 contents are different (i.e. it must be preset)
747
748Returns: DNS_SUCCEED successful lookup
749 DNS_NOMATCH name not found
750 DNS_NODATA no data found
751 DNS_AGAIN soft failure, try again later
752 DNS_FAIL DNS failure
753*/
754
755int
1dc92d5a 756dns_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 757 const uschar **fully_qualified_name)
059ec3d9
PH
758{
759int i;
1dc92d5a 760const uschar *orig_name = name;
c85b3043 761BOOL secure_so_far = TRUE;
059ec3d9
PH
762
763/* Loop to follow CNAME chains so far, but no further... */
764
765for (i = 0; i < 10; i++)
766 {
767 uschar data[256];
768 dns_record *rr, cname_rr, type_rr;
769 dns_scan dnss;
770 int datalen, rc;
771
772 /* DNS lookup failures get passed straight back. */
773
774 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED) return rc;
775
776 /* We should have either records of the required type, or a CNAME record,
777 or both. We need to know whether both exist for getting the fully qualified
778 name, but avoid scanning more than necessary. Note that we must copy the
779 contents of any rr blocks returned by dns_next_rr() as they use the same
780 area in the dnsa block. */
781
782 cname_rr.data = type_rr.data = NULL;
783 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1705dd20 784 rr;
059ec3d9
PH
785 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
786 {
787 if (rr->type == type)
788 {
789 if (type_rr.data == NULL) type_rr = *rr;
790 if (cname_rr.data != NULL) break;
791 }
792 else if (rr->type == T_CNAME) cname_rr = *rr;
793 }
794
a2042e78
PH
795 /* For the first time round this loop, if a CNAME was found, take the fully
796 qualified name from it; otherwise from the first data record, if present. */
059ec3d9 797
a2042e78 798 if (i == 0 && fully_qualified_name != NULL)
059ec3d9 799 {
766e7a65
JH
800 uschar * rr_name = cname_rr.data ? cname_rr.name
801 : type_rr.data ? type_rr.name : NULL;
802 if ( rr_name
803 && Ustrcmp(rr_name, *fully_qualified_name) != 0
804 && rr_name[0] != '*'
805#ifdef EXPERIMENTAL_INTERNATIONAL
806 && ( !string_is_utf8(*fully_qualified_name)
807 || Ustrcmp(rr_name,
808 string_domain_utf8_to_alabel(*fully_qualified_name, NULL)) != 0
809 )
810#endif
811 )
812 *fully_qualified_name = string_copy_dnsdomain(rr_name);
059ec3d9
PH
813 }
814
815 /* If any data records of the correct type were found, we are done. */
816
c85b3043
JH
817 if (type_rr.data != NULL)
818 {
819 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
4a142059 820 dns_set_insecure(dnsa);
c85b3043
JH
821 return DNS_SUCCEED;
822 }
059ec3d9
PH
823
824 /* If there are no data records, we need to re-scan the DNS using the
825 domain given in the CNAME record, which should exist (otherwise we should
826 have had a failure from dns_lookup). However code against the possibility of
827 its not existing. */
828
829 if (cname_rr.data == NULL) return DNS_FAIL;
830 datalen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
1dc92d5a 831 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, sizeof(data));
059ec3d9
PH
832 if (datalen < 0) return DNS_FAIL;
833 name = data;
a2042e78 834
c85b3043
JH
835 if (!dns_is_secure(dnsa))
836 secure_so_far = FALSE;
837
a2042e78 838 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
059ec3d9
PH
839 } /* Loop back to do another lookup */
840
841/*Control reaches here after 10 times round the CNAME loop. Something isn't
842right... */
843
844log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
845return DNS_FAIL;
846}
847
848
849
33397d19
PH
850
851
852
853/************************************************
854* Do a DNS lookup and handle virtual types *
855************************************************/
856
8e669ac1
PH
857/* This function handles some invented "lookup types" that synthesize feature
858not available in the basic types. The special types all have negative values.
33397d19
PH
859Positive type values are passed straight on to dns_lookup().
860
861Arguments:
862 dnsa pointer to dns_answer structure
863 name domain name to look up
864 type DNS record type (T_A, T_MX, etc or a "special")
865 fully_qualified_name if not NULL, return the returned name here if its
866 contents are different (i.e. it must be preset)
867
868Returns: DNS_SUCCEED successful lookup
869 DNS_NOMATCH name not found
870 DNS_NODATA no data found
871 DNS_AGAIN soft failure, try again later
872 DNS_FAIL DNS failure
873*/
874
875int
1dc92d5a 876dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 877 const uschar **fully_qualified_name)
33397d19 878{
d2a2c69b 879switch (type)
e5a9dba6 880 {
d2a2c69b
JH
881 /* The "mx hosts only" type doesn't require any special action here */
882 case T_MXH:
1705dd20 883 return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
d2a2c69b
JH
884
885 /* Find nameservers for the domain or the nearest enclosing zone, excluding
886 the root servers. */
887 case T_ZNS:
1705dd20
JH
888 type = T_NS;
889 /* FALLTHROUGH */
d2a2c69b 890 case T_SOA:
1705dd20
JH
891 {
892 const uschar *d = name;
893 while (d != 0)
894 {
895 int rc = dns_lookup(dnsa, d, type, fully_qualified_name);
896 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
897 while (*d != 0 && *d != '.') d++;
898 if (*d++ == 0) break;
899 }
900 return DNS_NOMATCH;
901 }
d2a2c69b
JH
902
903 /* Try to look up the Client SMTP Authorization SRV record for the name. If
904 there isn't one, search from the top downwards for a CSA record in a parent
905 domain, which might be making assertions about subdomains. If we find a record
906 we set fully_qualified_name to whichever lookup succeeded, so that the caller
907 can tell whether to look at the explicit authorization field or the subdomain
908 assertion field. */
909 case T_CSA:
1705dd20
JH
910 {
911 uschar *srvname, *namesuff, *tld, *p;
912 int priority, weight, port;
913 int limit, rc, i;
914 BOOL ipv6;
915 dns_record *rr;
916 dns_scan dnss;
917
918 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
919
920 srvname = string_sprintf("_client._smtp.%s", name);
921 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
922 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
923 {
924 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
925 return rc;
926 }
d2a2c69b 927
1705dd20
JH
928 /* Search for CSA subdomain assertion SRV records from the top downwards,
929 starting with the 2nd level domain. This order maximizes cache-friendliness.
930 We skip the top level domains to avoid loading their nameservers and because
931 we know they'll never have CSA SRV records. */
d2a2c69b 932
1705dd20
JH
933 namesuff = Ustrrchr(name, '.');
934 if (namesuff == NULL) return DNS_NOMATCH;
935 tld = namesuff + 1;
936 ipv6 = FALSE;
937 limit = dns_csa_search_limit;
938
939 /* Use more appropriate search parameters if we are in the reverse DNS. */
940
941 if (strcmpic(namesuff, US".arpa") == 0)
942 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
943 {
944 namesuff -= 8;
d2a2c69b 945 tld = namesuff + 1;
1705dd20
JH
946 limit = 3;
947 }
948 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
949 {
950 namesuff -= 4;
951 tld = namesuff + 1;
952 ipv6 = TRUE;
953 limit = 3;
954 }
d2a2c69b 955
1705dd20 956 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
d2a2c69b 957
1705dd20
JH
958 /* Do not perform the search if the top level or 2nd level domains do not
959 exist. This is quite common, and when it occurs all the search queries would
960 go to the root or TLD name servers, which is not friendly. So we check the
961 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
962 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
963 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
964 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
965
966 if (rc == DNS_NOMATCH)
967 {
968 /* This is really gross. The successful return value from res_search() is
969 the packet length, which is stored in dnsa->answerlen. If we get a
970 negative DNS reply then res_search() returns -1, which causes the bounds
971 checks for name decompression to fail when it is treated as a packet
972 length, which in turn causes the authority search to fail. The correct
973 packet length has been lost inside libresolv, so we have to guess a
974 replacement value. (The only way to fix this properly would be to
975 re-implement res_search() and res_query() so that they don't muddle their
976 success and packet length return values.) For added safety we only reset
977 the packet length if the packet header looks plausible. */
978
979 HEADER *h = (HEADER *)dnsa->answer;
980 if (h->qr == 1 && h->opcode == QUERY && h->tc == 0
981 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
982 && ntohs(h->qdcount) == 1 && ntohs(h->ancount) == 0
983 && ntohs(h->nscount) >= 1)
984 dnsa->answerlen = MAXPACKET;
985
986 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
987 rr;
988 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
989 )
990 if (rr->type != T_SOA) continue;
991 else if (strcmpic(rr->name, US"") == 0 ||
992 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
993 else break;
994 }
d2a2c69b 995
1705dd20
JH
996 for (i = 0; i < limit; i++)
997 {
998 if (ipv6)
999 {
1000 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
1001 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
1002 namesuff -= 8;
1003 if (namesuff <= name) return DNS_NOMATCH;
1004 }
1005 else
1006 /* Find the start of the preceding domain name label. */
1007 do
1008 if (--namesuff <= name) return DNS_NOMATCH;
1009 while (*namesuff != '.');
1010
1011 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
1012
1013 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
1014 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1015 if (rc == DNS_AGAIN) return rc;
1016 if (rc != DNS_SUCCEED) continue;
1017
1018 /* Check that the SRV record we have found is worth returning. We don't
1019 just return the first one we find, because some lower level SRV record
1020 might make stricter assertions than its parent domain. */
1021
1022 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1023 rr;
1024 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
1025 {
1026 if (rr->type != T_SRV) continue;
d2a2c69b 1027
1705dd20
JH
1028 /* Extract the numerical SRV fields (p is incremented) */
1029 p = rr->data;
1030 GETSHORT(priority, p);
1031 GETSHORT(weight, p); weight = weight; /* compiler quietening */
1032 GETSHORT(port, p);
d2a2c69b 1033
1705dd20
JH
1034 /* Check the CSA version number */
1035 if (priority != 1) continue;
d2a2c69b 1036
1705dd20
JH
1037 /* If it's making an interesting assertion, return this response. */
1038 if (port & 1)
d2a2c69b 1039 {
1705dd20
JH
1040 *fully_qualified_name = namesuff + 1;
1041 return DNS_SUCCEED;
d2a2c69b 1042 }
d2a2c69b 1043 }
1705dd20
JH
1044 }
1045 return DNS_NOMATCH;
1046 }
e5a9dba6 1047
d2a2c69b 1048 default:
1705dd20
JH
1049 if (type >= 0)
1050 return dns_lookup(dnsa, name, type, fully_qualified_name);
e5a9dba6
PH
1051 }
1052
33397d19
PH
1053/* Control should never reach here */
1054
1055return DNS_FAIL;
1056}
1057
1058
1059
059ec3d9
PH
1060
1061
1062/*************************************************
1063* Get address(es) from DNS record *
1064*************************************************/
1065
1066/* The record type is either T_A for an IPv4 address or T_AAAA (or T_A6 when
d2a2c69b 1067supported) for an IPv6 address.
059ec3d9
PH
1068
1069Argument:
1070 dnsa the DNS answer block
1071 rr the RR
1072
e1a3f32f 1073Returns: pointer to a chain of dns_address items; NULL when the dnsa was overrun
059ec3d9
PH
1074*/
1075
1076dns_address *
1077dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1078{
e1a3f32f
JH
1079dns_address * yield = NULL;
1080uschar * dnsa_lim = dnsa->answer + dnsa->answerlen;
059ec3d9
PH
1081
1082if (rr->type == T_A)
1083 {
d2a2c69b 1084 uschar *p = US rr->data;
e1a3f32f
JH
1085 if (p + 4 <= dnsa_lim)
1086 {
1087 yield = store_get(sizeof(dns_address) + 20);
1088 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1089 yield->next = NULL;
1090 }
059ec3d9
PH
1091 }
1092
1093#if HAVE_IPV6
1094
059ec3d9
PH
1095else
1096 {
e1a3f32f
JH
1097 if (rr->data + 16 <= dnsa_lim)
1098 {
1099 yield = store_get(sizeof(dns_address) + 50);
1100 inet_ntop(AF_INET6, US rr->data, CS yield->address, 50);
1101 yield->next = NULL;
1102 }
059ec3d9
PH
1103 }
1104#endif /* HAVE_IPV6 */
1105
1106return yield;
1107}
1108
476be7e2
JH
1109
1110
1111void
1112dns_pattern_init(void)
1113{
1114if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1115 regex_check_dns_names =
1116 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);
1117}
1118
8c51eead
JH
1119/* vi: aw ai sw=2
1120*/
059ec3d9 1121/* End of dns.c */