Add dns_trust_aa
[exim.git] / src / src / dns.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions for interfacing with the DNS. */
9
10#include "exim.h"
11
12
059ec3d9 13
bef5a11f
PH
14/*************************************************
15* Fake DNS resolver *
16*************************************************/
17
18/* This function is called instead of res_search() when Exim is running in its
19test harness. It recognizes some special domain names, and uses them to force
433a2980
PH
20failure and retry responses (optionally with a delay). Otherwise, it calls an
21external utility that mocks-up a nameserver, if it can find the utility.
22If not, it passes its arguments on to res_search(). The fake nameserver may
23also return a code specifying that the name should be passed on.
bef5a11f
PH
24
25Background: the original test suite required a real nameserver to carry the
8e013028 26test zones, whereas the new test suite has the fake server for portability. This
e7726cbf 27code supports both.
bef5a11f
PH
28
29Arguments:
e7726cbf 30 domain the domain name
bef5a11f
PH
31 type the DNS record type
32 answerptr where to put the answer
33 size size of the answer area
34
35Returns: length of returned data, or -1 on error (h_errno set)
36*/
37
38static int
1dc92d5a 39fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
bef5a11f 40{
e7726cbf 41int len = Ustrlen(domain);
433a2980 42int asize = size; /* Locally modified */
e7726cbf
PH
43uschar *endname;
44uschar name[256];
433a2980
PH
45uschar utilname[256];
46uschar *aptr = answerptr; /* Locally modified */
47struct stat statbuf;
48
49/* Remove terminating dot. */
e7726cbf
PH
50
51if (domain[len - 1] == '.') len--;
52Ustrncpy(name, domain, len);
53name[len] = 0;
54endname = name + len;
bef5a11f 55
433a2980
PH
56/* Look for the fakens utility, and if it exists, call it. */
57
5f3d0983
HSHR
58(void)string_format(utilname, sizeof(utilname), "%s/bin/fakens",
59 config_main_directory);
433a2980
PH
60
61if (stat(CS utilname, &statbuf) >= 0)
bef5a11f 62 {
433a2980
PH
63 pid_t pid;
64 int infd, outfd, rc;
65 uschar *argv[5];
66
3735e326 67 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n", name, dns_text_type(type));
433a2980
PH
68
69 argv[0] = utilname;
5f3d0983 70 argv[1] = config_main_directory;
433a2980
PH
71 argv[2] = name;
72 argv[3] = dns_text_type(type);
73 argv[4] = NULL;
74
75 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE);
76 if (pid < 0)
77 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
78 strerror(errno));
79
80 len = 0;
81 rc = -1;
82 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
83 {
84 len += rc;
85 aptr += rc; /* Don't modify the actual arguments, because they */
86 asize -= rc; /* may need to be passed on to res_search(). */
87 }
bef5a11f 88
1fb7660f
JH
89 /* If we ran out of output buffer before exhasting the return,
90 carry on reading and counting it. */
91
92 if (asize == 0)
93 while ((rc = read(outfd, name, sizeof(name))) > 0)
94 len += rc;
95
433a2980
PH
96 if (rc < 0)
97 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
98 strerror(errno));
bef5a11f 99
433a2980 100 switch(child_close(pid, 0))
bef5a11f 101 {
433a2980
PH
102 case 0: return len;
103 case 1: h_errno = HOST_NOT_FOUND; return -1;
104 case 2: h_errno = TRY_AGAIN; return -1;
105 default:
106 case 3: h_errno = NO_RECOVERY; return -1;
107 case 4: h_errno = NO_DATA; return -1;
108 case 5: /* Pass on to res_search() */
109 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
bef5a11f
PH
110 }
111 }
8e013028
HSHR
112else
113 {
4cea764f 114 DEBUG(D_dns) debug_printf("fakens (%s) not found\n", utilname);
8e013028 115 }
bef5a11f 116
433a2980 117/* fakens utility not found, or it returned "pass on" */
bef5a11f 118
433a2980 119DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
e7726cbf
PH
120
121return res_search(CS domain, C_IN, type, answerptr, size);
bef5a11f
PH
122}
123
124
059ec3d9
PH
125
126/*************************************************
127* Initialize and configure resolver *
128*************************************************/
129
130/* Initialize the resolver and the storage for holding DNS answers if this is
131the first time we have been here, and set the resolver options.
132
133Arguments:
134 qualify_single TRUE to set the RES_DEFNAMES option
135 search_parents TRUE to set the RES_DNSRCH option
8c51eead 136 use_dnssec TRUE to set the RES_USE_DNSSEC option
059ec3d9
PH
137
138Returns: nothing
139*/
140
141void
8c51eead 142dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
059ec3d9 143{
5bfb4cdf
PP
144res_state resp = os_get_dns_resolver_res();
145
146if ((resp->options & RES_INIT) == 0)
059ec3d9 147 {
5bfb4cdf
PP
148 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
149 os_put_dns_resolver_res(resp);
059ec3d9 150 res_init();
5bfb4cdf
PP
151 DEBUG(D_resolver) resp->options |= RES_DEBUG;
152 os_put_dns_resolver_res(resp);
059ec3d9
PH
153 }
154
5bfb4cdf
PP
155resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
156resp->options |= (qualify_single? RES_DEFNAMES : 0) |
059ec3d9 157 (search_parents? RES_DNSRCH : 0);
5bfb4cdf
PP
158if (dns_retrans > 0) resp->retrans = dns_retrans;
159if (dns_retry > 0) resp->retry = dns_retry;
e97d1f08
PP
160
161#ifdef RES_USE_EDNS0
162if (dns_use_edns0 >= 0)
163 {
164 if (dns_use_edns0)
5bfb4cdf 165 resp->options |= RES_USE_EDNS0;
e97d1f08 166 else
5bfb4cdf 167 resp->options &= ~RES_USE_EDNS0;
e97d1f08
PP
168 DEBUG(D_resolver)
169 debug_printf("Coerced resolver EDNS0 support %s.\n",
170 dns_use_edns0 ? "on" : "off");
171 }
172#else
173if (dns_use_edns0 >= 0)
174 DEBUG(D_resolver)
175 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
176 dns_use_edns0 ? "" : "un");
177#endif
5bfb4cdf 178
1f4a55da
PP
179#ifndef DISABLE_DNSSEC
180# ifdef RES_USE_DNSSEC
181# ifndef RES_USE_EDNS0
182# error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
183# endif
8c51eead
JH
184if (use_dnssec)
185 resp->options |= RES_USE_DNSSEC;
0fbd9bff 186if (dns_dnssec_ok >= 0)
1f4a55da 187 {
0fbd9bff 188 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
1f4a55da
PP
189 {
190 DEBUG(D_resolver)
0fbd9bff 191 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
1f4a55da
PP
192 }
193 else
194 {
0fbd9bff 195 if (dns_dnssec_ok)
1f4a55da
PP
196 resp->options |= RES_USE_DNSSEC;
197 else
198 resp->options &= ~RES_USE_DNSSEC;
199 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
0fbd9bff 200 dns_dnssec_ok ? "on" : "off");
1f4a55da
PP
201 }
202 }
203# else
0fbd9bff 204if (dns_dnssec_ok >= 0)
1f4a55da
PP
205 DEBUG(D_resolver)
206 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
0fbd9bff 207 dns_dnssec_ok ? "" : "un");
8c51eead
JH
208if (use_dnssec)
209 DEBUG(D_resolver)
93d4b03a 210 debug_printf("Unable to set DNSSEC without resolver support.\n");
1f4a55da
PP
211# endif
212#endif /* DISABLE_DNSSEC */
213
5bfb4cdf 214os_put_dns_resolver_res(resp);
059ec3d9
PH
215}
216
217
218
219/*************************************************
220* Build key name for PTR records *
221*************************************************/
222
223/* This function inverts an IP address and adds the relevant domain, to produce
224a name that can be used to look up PTR records.
225
226Arguments:
227 string the IP address as a string
228 buffer a suitable buffer, long enough to hold the result
229
230Returns: nothing
231*/
232
233void
55414b25 234dns_build_reverse(const uschar *string, uschar *buffer)
059ec3d9 235{
55414b25 236const uschar *p = string + Ustrlen(string);
059ec3d9
PH
237uschar *pp = buffer;
238
239/* Handle IPv4 address */
240
241#if HAVE_IPV6
242if (Ustrchr(string, ':') == NULL)
243#endif
244 {
245 int i;
246 for (i = 0; i < 4; i++)
247 {
55414b25 248 const uschar *ppp = p;
059ec3d9
PH
249 while (ppp > string && ppp[-1] != '.') ppp--;
250 Ustrncpy(pp, ppp, p - ppp);
251 pp += p - ppp;
252 *pp++ = '.';
253 p = ppp - 1;
254 }
255 Ustrcpy(pp, "in-addr.arpa");
256 }
257
258/* Handle IPv6 address; convert to binary so as to fill out any
259abbreviation in the textual form. */
260
261#if HAVE_IPV6
262else
263 {
264 int i;
265 int v6[4];
266 (void)host_aton(string, v6);
267
268 /* The original specification for IPv6 reverse lookup was to invert each
269 nibble, and look in the ip6.int domain. The domain was subsequently
270 changed to ip6.arpa. */
271
272 for (i = 3; i >= 0; i--)
273 {
274 int j;
275 for (j = 0; j < 32; j += 4)
276 {
277 sprintf(CS pp, "%x.", (v6[i] >> j) & 15);
278 pp += 2;
279 }
280 }
281 Ustrcpy(pp, "ip6.arpa.");
282
283 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
284 with A6 records. However, it fell out of favour when they did. The
285 alternative was to construct a binary key, and look in ip6.arpa. I tried
286 to make this code do that, but I could not make it work on Solaris 8. The
287 resolver seems to lose the initial backslash somehow. However, now that
288 this style of reverse lookup has been dropped, it doesn't matter. These
289 lines are left here purely for historical interest. */
290
291 /**************************************************
292 Ustrcpy(pp, "\\[x");
293 pp += 3;
294
295 for (i = 0; i < 4; i++)
296 {
297 sprintf(pp, "%08X", v6[i]);
298 pp += 8;
299 }
300 Ustrcpy(pp, "].ip6.arpa.");
301 **************************************************/
302
303 }
304#endif
305}
306
307
308
309
310/*************************************************
311* Get next DNS record from answer block *
312*************************************************/
313
314/* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
e5a9dba6
PH
315RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
316scan the additional records, and reset == RESET_NEXT to get the next record.
317The result is in static storage which must be copied if it is to be preserved.
059ec3d9
PH
318
319Arguments:
320 dnsa pointer to dns answer block
321 dnss pointer to dns scan block
322 reset option specifing what portion to scan, as described above
323
324Returns: next dns record, or NULL when no more
325*/
326
327dns_record *
328dns_next_rr(dns_answer *dnsa, dns_scan *dnss, int reset)
329{
330HEADER *h = (HEADER *)dnsa->answer;
331int namelen;
332
333/* Reset the saved data when requested to, and skip to the first required RR */
334
335if (reset != RESET_NEXT)
336 {
337 dnss->rrcount = ntohs(h->qdcount);
338 dnss->aptr = dnsa->answer + sizeof(HEADER);
339
340 /* Skip over questions; failure to expand the name just gives up */
341
342 while (dnss->rrcount-- > 0)
343 {
344 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
345 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
346 if (namelen < 0) { dnss->rrcount = 0; return NULL; }
347 dnss->aptr += namelen + 4; /* skip name & type & class */
348 }
349
350 /* Get the number of answer records. */
351
352 dnss->rrcount = ntohs(h->ancount);
353
e5a9dba6
PH
354 /* Skip over answers if we want to look at the authority section. Also skip
355 the NS records (i.e. authority section) if wanting to look at the additional
059ec3d9
PH
356 records. */
357
e5a9dba6
PH
358 if (reset == RESET_ADDITIONAL) dnss->rrcount += ntohs(h->nscount);
359
360 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
059ec3d9 361 {
059ec3d9
PH
362 while (dnss->rrcount-- > 0)
363 {
364 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
365 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
366 if (namelen < 0) { dnss->rrcount = 0; return NULL; }
367 dnss->aptr += namelen + 8; /* skip name, type, class & TTL */
368 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
369 dnss->aptr += dnss->srr.size; /* skip over it */
370 }
e5a9dba6
PH
371 dnss->rrcount = (reset == RESET_AUTHORITY)
372 ? ntohs(h->nscount) : ntohs(h->arcount);
059ec3d9
PH
373 }
374 }
375
059ec3d9
PH
376/* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
377contains the number of RR records left. */
378
379if (dnss->rrcount-- <= 0) return NULL;
380
381/* If expanding the RR domain name fails, behave as if no more records
382(something safe). */
383
384namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
385 (DN_EXPAND_ARG4_TYPE) &(dnss->srr.name), DNS_MAXNAME);
386if (namelen < 0) { dnss->rrcount = 0; return NULL; }
387
388/* Move the pointer past the name and fill in the rest of the data structure
389from the following bytes. */
390
391dnss->aptr += namelen;
392GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
393dnss->aptr += 6; /* Don't want class or TTL */
394GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
395dnss->srr.data = dnss->aptr; /* The record's data follows */
396dnss->aptr += dnss->srr.size; /* Advance to next RR */
397
398/* Return a pointer to the dns_record structure within the dns_answer. This is
399for convenience so that the scans can use nice-looking for loops. */
400
401return &(dnss->srr);
402}
403
404
9820a77f
HSHR
405/* Extract the AUTHORITY info from the answer. If the
406 * answer isn't authoritive (AA) we do not extract anything.
407 * We've to search for SOA or NS records, since there may be
408 * other records (e.g. NSEC3) too.
409 */
410static const uschar*
411dns_extract_auth_name(const dns_answer *dnsa) /* FIXME: const dns_answer */
412{
413 dns_scan dnss;
414 dns_record *rr;
415 HEADER *h = (HEADER *) dnsa->answer;
416 if (!h->nscount || !h->aa) return NULL;
417 for (rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_AUTHORITY);
418 rr;
419 rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_NEXT))
420 if (rr->type == T_SOA || rr->type == T_NS) return rr->name;
421 return NULL;
422}
423
424
059ec3d9
PH
425
426
427/*************************************************
1f4a55da
PP
428* Return whether AD bit set in DNS result *
429*************************************************/
430
431/* We do not perform DNSSEC work ourselves; if the administrator has installed
432a verifying resolver which sets AD as appropriate, though, we'll use that.
9820a77f 433(AD = Authentic Data, AA = Authoritive Answer)
1f4a55da
PP
434
435Argument: pointer to dns answer block
436Returns: bool indicating presence of AD bit
437*/
438
439BOOL
4a142059 440dns_is_secure(const dns_answer * dnsa)
1f4a55da
PP
441{
442#ifdef DISABLE_DNSSEC
443DEBUG(D_dns)
444 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
445return FALSE;
446#else
9820a77f
HSHR
447HEADER *h = (HEADER *) dnsa->answer;
448
449if (h->ad) return TRUE;
450else
451 {
452 /* If the resolver we ask is authoritive for the domain in question, it
453 * may not set the AD but the AA bit. If we explicitly trust
454 * the resolver for that domain (via a domainlist in dns_trust_aa),
455 * we return TRUE to indicate a secure answer.
456 */
457 const uschar *auth_name;
458 const uschar *trusted;
459
460 if (!h->aa || !dns_trust_aa) return FALSE;
461
462 trusted = expand_string(dns_trust_aa);
463 auth_name = dns_extract_auth_name(dnsa);
464 if (OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL))
465 return FALSE;
466
467 DEBUG(D_dns)
468 debug_printf("DNS faked the AD bit (got AA and matched with dns_trust_aa (%s in %s))\n", auth_name, dns_trust_aa);
469
470 return TRUE;
471}
1f4a55da
PP
472#endif
473}
474
4a142059
JH
475static void
476dns_set_insecure(dns_answer * dnsa)
477{
478HEADER * h = (HEADER *)dnsa->answer;
479h->ad = 0;
480}
481
221dff13
HSHR
482/************************************************
483 * Check whether the AA bit is set *
484 * We need this to warn if we requested AD *
9820a77f 485 * from an authoritive server *
221dff13
HSHR
486 ************************************************/
487
488BOOL
489dns_is_aa(const dns_answer *dnsa)
490{
491return ((HEADER*)dnsa->answer)->aa;
492}
1f4a55da
PP
493
494
495
496/*************************************************
059ec3d9
PH
497* Turn DNS type into text *
498*************************************************/
499
885ccd3e
PH
500/* Turn the coded record type into a string for printing. All those that Exim
501uses should be included here.
059ec3d9
PH
502
503Argument: record type
504Returns: pointer to string
505*/
506
507uschar *
508dns_text_type(int t)
509{
510switch(t)
511 {
33397d19
PH
512 case T_A: return US"A";
513 case T_MX: return US"MX";
514 case T_AAAA: return US"AAAA";
515 case T_A6: return US"A6";
516 case T_TXT: return US"TXT";
eae0036b 517 case T_SPF: return US"SPF";
33397d19 518 case T_PTR: return US"PTR";
885ccd3e 519 case T_SOA: return US"SOA";
33397d19
PH
520 case T_SRV: return US"SRV";
521 case T_NS: return US"NS";
8e669ac1 522 case T_CNAME: return US"CNAME";
1e06383a 523 case T_TLSA: return US"TLSA";
33397d19 524 default: return US"?";
059ec3d9
PH
525 }
526}
527
528
529
530/*************************************************
531* Cache a failed DNS lookup result *
532*************************************************/
533
534/* We cache failed lookup results so as not to experience timeouts many
535times for the same domain. We need to retain the resolver options because they
536may change. For successful lookups, we rely on resolver and/or name server
537caching.
538
539Arguments:
540 name the domain name
541 type the lookup type
542 rc the return code
543
544Returns: the return code
545*/
546
547static int
1dc92d5a 548dns_return(const uschar * name, int type, int rc)
059ec3d9 549{
5bfb4cdf 550res_state resp = os_get_dns_resolver_res();
059ec3d9
PH
551tree_node *node = store_get_perm(sizeof(tree_node) + 290);
552sprintf(CS node->name, "%.255s-%s-%lx", name, dns_text_type(type),
5bfb4cdf 553 resp->options);
059ec3d9
PH
554node->data.val = rc;
555(void)tree_insertnode(&tree_dns_fails, node);
556return rc;
557}
558
059ec3d9
PH
559/*************************************************
560* Do basic DNS lookup *
561*************************************************/
562
563/* Call the resolver to look up the given domain name, using the given type,
564and check the result. The error code TRY_AGAIN is documented as meaning "non-
565Authoritive Host not found, or SERVERFAIL". Sometimes there are badly set
566up nameservers that produce this error continually, so there is the option of
567providing a list of domains for which this is treated as a non-existent
568host.
569
570Arguments:
571 dnsa pointer to dns_answer structure
572 name name to look up
573 type type of DNS record required (T_A, T_MX, etc)
574
575Returns: DNS_SUCCEED successful lookup
576 DNS_NOMATCH name not found (NXDOMAIN)
577 or name contains illegal characters (if checking)
30e18802 578 or name is an IP address (for IP address lookup)
059ec3d9
PH
579 DNS_NODATA domain exists, but no data for this type (NODATA)
580 DNS_AGAIN soft failure, try again later
581 DNS_FAIL DNS failure
582*/
583
584int
1dc92d5a 585dns_basic_lookup(dns_answer *dnsa, const uschar *name, int type)
059ec3d9
PH
586{
587#ifndef STAND_ALONE
7156b1ef 588int rc = -1;
55414b25 589const uschar *save_domain;
059ec3d9 590#endif
5bfb4cdf 591res_state resp = os_get_dns_resolver_res();
059ec3d9
PH
592
593tree_node *previous;
594uschar node_name[290];
595
596/* DNS lookup failures of any kind are cached in a tree. This is mainly so that
597a timeout on one domain doesn't happen time and time again for messages that
598have many addresses in the same domain. We rely on the resolver and name server
599caching for successful lookups. */
600
601sprintf(CS node_name, "%.255s-%s-%lx", name, dns_text_type(type),
5bfb4cdf 602 resp->options);
059ec3d9
PH
603previous = tree_search(tree_dns_fails, node_name);
604if (previous != NULL)
605 {
606 DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: using cached value %s\n",
607 name, dns_text_type(type),
608 (previous->data.val == DNS_NOMATCH)? "DNS_NOMATCH" :
609 (previous->data.val == DNS_NODATA)? "DNS_NODATA" :
610 (previous->data.val == DNS_AGAIN)? "DNS_AGAIN" :
611 (previous->data.val == DNS_FAIL)? "DNS_FAIL" : "??");
612 return previous->data.val;
613 }
614
9d4319df
JH
615#ifdef EXPERIMENTAL_INTERNATIONAL
616/* Convert all names to a-label form before doing lookup */
617 {
618 uschar * alabel;
619 uschar * errstr = NULL;
766e7a65
JH
620 DEBUG(D_dns) if (string_is_utf8(name))
621 debug_printf("convert utf8 '%s' to alabel for for lookup\n", name);
9d4319df
JH
622 if ((alabel = string_domain_utf8_to_alabel(name, &errstr)), errstr)
623 {
624 DEBUG(D_dns)
37bf366e 625 debug_printf("DNS name '%s' utf8 conversion to alabel failed: %s\n", name,
9d4319df
JH
626 errstr);
627 host_find_failed_syntax = TRUE;
628 return DNS_NOMATCH;
629 }
630 name = alabel;
631 }
632#endif
633
059ec3d9
PH
634/* If configured, check the hygene of the name passed to lookup. Otherwise,
635although DNS lookups may give REFUSED at the lower level, some resolvers
636turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
637domains cannot be in the DNS. The check is now done by a regular expression;
638give it space for substring storage to save it having to get its own if the
639regex has substrings that are used - the default uses a conditional.
640
641This test is omitted for PTR records. These occur only in calls from the dnsdb
642lookup, which constructs the names itself, so they should be OK. Besides,
643bitstring labels don't conform to normal name syntax. (But the aren't used any
644more.)
645
646For SRV records, we omit the initial _smtp._tcp. components at the start. */
647
648#ifndef STAND_ALONE /* Omit this for stand-alone tests */
649
482d1455 650if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
059ec3d9 651 {
1dc92d5a 652 const uschar *checkname = name;
059ec3d9
PH
653 int ovector[3*(EXPAND_MAXN+1)];
654
476be7e2 655 dns_pattern_init();
059ec3d9
PH
656
657 /* For an SRV lookup, skip over the first two components (the service and
658 protocol names, which both start with an underscore). */
659
b4161d10 660 if (type == T_SRV || type == T_TLSA)
059ec3d9
PH
661 {
662 while (*checkname++ != '.');
663 while (*checkname++ != '.');
664 }
665
1dc92d5a 666 if (pcre_exec(regex_check_dns_names, NULL, CCS checkname, Ustrlen(checkname),
059ec3d9
PH
667 0, PCRE_EOPT, ovector, sizeof(ovector)/sizeof(int)) < 0)
668 {
669 DEBUG(D_dns)
670 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
671 dns_text_type(type));
672 host_find_failed_syntax = TRUE;
673 return DNS_NOMATCH;
674 }
675 }
676
677#endif /* STAND_ALONE */
678
679/* Call the resolver; for an overlong response, res_search() will return the
bef5a11f
PH
680number of bytes the message would need, so we need to check for this case. The
681effect is to truncate overlong data.
682
30e18802
PH
683On some systems, res_search() will recognize "A-for-A" queries and return
684the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
685nameservers are also believed to do this. It is, of course, contrary to the
686specification of the DNS, so we lock it out. */
687
cc00f4af 688if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
30e18802
PH
689 return DNS_NOMATCH;
690
691/* If we are running in the test harness, instead of calling the normal resolver
bef5a11f
PH
692(res_search), we call fakens_search(), which recognizes certain special
693domains, and interfaces to a fake nameserver for certain special zones. */
694
cc00f4af
JH
695dnsa->answerlen = running_in_test_harness
696 ? fakens_search(name, type, dnsa->answer, MAXPACKET)
697 : res_search(CCS name, C_IN, type, dnsa->answer, MAXPACKET);
059ec3d9 698
80a47a2c
TK
699if (dnsa->answerlen > MAXPACKET)
700 {
701 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet (size %d), truncating to %d.\n",
702 name, dns_text_type(type), dnsa->answerlen, MAXPACKET);
703 dnsa->answerlen = MAXPACKET;
704 }
059ec3d9
PH
705
706if (dnsa->answerlen < 0) switch (h_errno)
707 {
708 case HOST_NOT_FOUND:
709 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
710 "returning DNS_NOMATCH\n", name, dns_text_type(type));
711 return dns_return(name, type, DNS_NOMATCH);
712
713 case TRY_AGAIN:
714 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
715 name, dns_text_type(type));
716
717 /* Cut this out for various test programs */
1dc92d5a 718#ifndef STAND_ALONE
55414b25 719 save_domain = deliver_domain;
1dc92d5a 720 deliver_domain = string_copy(name); /* set $domain */
55414b25 721 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
059ec3d9 722 MCL_DOMAIN, TRUE, NULL);
55414b25 723 deliver_domain = save_domain;
059ec3d9
PH
724 if (rc != OK)
725 {
726 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
727 return dns_return(name, type, DNS_AGAIN);
728 }
729 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
730 "DNS_NOMATCH\n", name);
731 return dns_return(name, type, DNS_NOMATCH);
732
1dc92d5a 733#else /* For stand-alone tests */
059ec3d9 734 return dns_return(name, type, DNS_AGAIN);
1dc92d5a 735#endif
059ec3d9
PH
736
737 case NO_RECOVERY:
738 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
739 "returning DNS_FAIL\n", name, dns_text_type(type));
740 return dns_return(name, type, DNS_FAIL);
741
742 case NO_DATA:
743 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
744 "returning DNS_NODATA\n", name, dns_text_type(type));
745 return dns_return(name, type, DNS_NODATA);
746
747 default:
748 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
749 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
750 return dns_return(name, type, DNS_FAIL);
751 }
752
753DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
754 name, dns_text_type(type));
755
756return DNS_SUCCEED;
757}
758
759
760
761
762/************************************************
763* Do a DNS lookup and handle CNAMES *
764************************************************/
765
766/* Look up the given domain name, using the given type. Follow CNAMEs if
767necessary, but only so many times. There aren't supposed to be CNAME chains in
768the DNS, but you are supposed to cope with them if you find them.
769
770The assumption is made that if the resolver gives back records of the
771requested type *and* a CNAME, we don't need to make another call to look up
772the CNAME. I can't see how it could return only some of the right records. If
773it's done a CNAME lookup in the past, it will have all of them; if not, it
774won't return any.
775
776If fully_qualified_name is not NULL, set it to point to the full name
777returned by the resolver, if this is different to what it is given, unless
778the returned name starts with "*" as some nameservers seem to be returning
766e7a65
JH
779wildcards in this form. In international mode "different" means "alabel
780forms are different".
059ec3d9
PH
781
782Arguments:
783 dnsa pointer to dns_answer structure
784 name domain name to look up
785 type DNS record type (T_A, T_MX, etc)
786 fully_qualified_name if not NULL, return the returned name here if its
787 contents are different (i.e. it must be preset)
788
789Returns: DNS_SUCCEED successful lookup
790 DNS_NOMATCH name not found
791 DNS_NODATA no data found
792 DNS_AGAIN soft failure, try again later
793 DNS_FAIL DNS failure
794*/
795
796int
1dc92d5a 797dns_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 798 const uschar **fully_qualified_name)
059ec3d9
PH
799{
800int i;
1dc92d5a 801const uschar *orig_name = name;
c85b3043 802BOOL secure_so_far = TRUE;
059ec3d9
PH
803
804/* Loop to follow CNAME chains so far, but no further... */
805
806for (i = 0; i < 10; i++)
807 {
808 uschar data[256];
809 dns_record *rr, cname_rr, type_rr;
810 dns_scan dnss;
811 int datalen, rc;
812
813 /* DNS lookup failures get passed straight back. */
814
815 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED) return rc;
816
817 /* We should have either records of the required type, or a CNAME record,
818 or both. We need to know whether both exist for getting the fully qualified
819 name, but avoid scanning more than necessary. Note that we must copy the
820 contents of any rr blocks returned by dns_next_rr() as they use the same
821 area in the dnsa block. */
822
823 cname_rr.data = type_rr.data = NULL;
824 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1705dd20 825 rr;
059ec3d9
PH
826 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
827 {
828 if (rr->type == type)
829 {
830 if (type_rr.data == NULL) type_rr = *rr;
831 if (cname_rr.data != NULL) break;
832 }
833 else if (rr->type == T_CNAME) cname_rr = *rr;
834 }
835
a2042e78
PH
836 /* For the first time round this loop, if a CNAME was found, take the fully
837 qualified name from it; otherwise from the first data record, if present. */
059ec3d9 838
a2042e78 839 if (i == 0 && fully_qualified_name != NULL)
059ec3d9 840 {
766e7a65
JH
841 uschar * rr_name = cname_rr.data ? cname_rr.name
842 : type_rr.data ? type_rr.name : NULL;
843 if ( rr_name
844 && Ustrcmp(rr_name, *fully_qualified_name) != 0
845 && rr_name[0] != '*'
846#ifdef EXPERIMENTAL_INTERNATIONAL
847 && ( !string_is_utf8(*fully_qualified_name)
848 || Ustrcmp(rr_name,
849 string_domain_utf8_to_alabel(*fully_qualified_name, NULL)) != 0
850 )
851#endif
852 )
853 *fully_qualified_name = string_copy_dnsdomain(rr_name);
059ec3d9
PH
854 }
855
856 /* If any data records of the correct type were found, we are done. */
857
c85b3043
JH
858 if (type_rr.data != NULL)
859 {
860 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
4a142059 861 dns_set_insecure(dnsa);
c85b3043
JH
862 return DNS_SUCCEED;
863 }
059ec3d9
PH
864
865 /* If there are no data records, we need to re-scan the DNS using the
866 domain given in the CNAME record, which should exist (otherwise we should
867 have had a failure from dns_lookup). However code against the possibility of
868 its not existing. */
869
870 if (cname_rr.data == NULL) return DNS_FAIL;
871 datalen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
1dc92d5a 872 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, sizeof(data));
059ec3d9
PH
873 if (datalen < 0) return DNS_FAIL;
874 name = data;
a2042e78 875
c85b3043
JH
876 if (!dns_is_secure(dnsa))
877 secure_so_far = FALSE;
878
a2042e78 879 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
059ec3d9
PH
880 } /* Loop back to do another lookup */
881
882/*Control reaches here after 10 times round the CNAME loop. Something isn't
883right... */
884
885log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
886return DNS_FAIL;
887}
888
889
890
33397d19
PH
891
892
893
894/************************************************
895* Do a DNS lookup and handle virtual types *
896************************************************/
897
9820a77f 898/* This function handles some invented "lookup types" that synthesize features
8e669ac1 899not available in the basic types. The special types all have negative values.
33397d19
PH
900Positive type values are passed straight on to dns_lookup().
901
902Arguments:
903 dnsa pointer to dns_answer structure
904 name domain name to look up
905 type DNS record type (T_A, T_MX, etc or a "special")
906 fully_qualified_name if not NULL, return the returned name here if its
907 contents are different (i.e. it must be preset)
908
909Returns: DNS_SUCCEED successful lookup
910 DNS_NOMATCH name not found
911 DNS_NODATA no data found
912 DNS_AGAIN soft failure, try again later
913 DNS_FAIL DNS failure
914*/
915
916int
1dc92d5a 917dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 918 const uschar **fully_qualified_name)
33397d19 919{
d2a2c69b 920switch (type)
e5a9dba6 921 {
d2a2c69b
JH
922 /* The "mx hosts only" type doesn't require any special action here */
923 case T_MXH:
1705dd20 924 return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
d2a2c69b
JH
925
926 /* Find nameservers for the domain or the nearest enclosing zone, excluding
927 the root servers. */
928 case T_ZNS:
1705dd20
JH
929 type = T_NS;
930 /* FALLTHROUGH */
d2a2c69b 931 case T_SOA:
1705dd20
JH
932 {
933 const uschar *d = name;
934 while (d != 0)
935 {
936 int rc = dns_lookup(dnsa, d, type, fully_qualified_name);
937 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
938 while (*d != 0 && *d != '.') d++;
939 if (*d++ == 0) break;
940 }
941 return DNS_NOMATCH;
942 }
d2a2c69b
JH
943
944 /* Try to look up the Client SMTP Authorization SRV record for the name. If
945 there isn't one, search from the top downwards for a CSA record in a parent
946 domain, which might be making assertions about subdomains. If we find a record
947 we set fully_qualified_name to whichever lookup succeeded, so that the caller
948 can tell whether to look at the explicit authorization field or the subdomain
949 assertion field. */
950 case T_CSA:
1705dd20
JH
951 {
952 uschar *srvname, *namesuff, *tld, *p;
953 int priority, weight, port;
954 int limit, rc, i;
955 BOOL ipv6;
956 dns_record *rr;
957 dns_scan dnss;
958
959 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
960
961 srvname = string_sprintf("_client._smtp.%s", name);
962 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
963 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
964 {
965 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
966 return rc;
967 }
d2a2c69b 968
1705dd20
JH
969 /* Search for CSA subdomain assertion SRV records from the top downwards,
970 starting with the 2nd level domain. This order maximizes cache-friendliness.
971 We skip the top level domains to avoid loading their nameservers and because
972 we know they'll never have CSA SRV records. */
d2a2c69b 973
1705dd20
JH
974 namesuff = Ustrrchr(name, '.');
975 if (namesuff == NULL) return DNS_NOMATCH;
976 tld = namesuff + 1;
977 ipv6 = FALSE;
978 limit = dns_csa_search_limit;
979
980 /* Use more appropriate search parameters if we are in the reverse DNS. */
981
982 if (strcmpic(namesuff, US".arpa") == 0)
983 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
984 {
985 namesuff -= 8;
d2a2c69b 986 tld = namesuff + 1;
1705dd20
JH
987 limit = 3;
988 }
989 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
990 {
991 namesuff -= 4;
992 tld = namesuff + 1;
993 ipv6 = TRUE;
994 limit = 3;
995 }
d2a2c69b 996
1705dd20 997 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
d2a2c69b 998
1705dd20
JH
999 /* Do not perform the search if the top level or 2nd level domains do not
1000 exist. This is quite common, and when it occurs all the search queries would
1001 go to the root or TLD name servers, which is not friendly. So we check the
1002 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
1003 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
1004 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
1005 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
1006
1007 if (rc == DNS_NOMATCH)
1008 {
1009 /* This is really gross. The successful return value from res_search() is
1010 the packet length, which is stored in dnsa->answerlen. If we get a
1011 negative DNS reply then res_search() returns -1, which causes the bounds
1012 checks for name decompression to fail when it is treated as a packet
1013 length, which in turn causes the authority search to fail. The correct
1014 packet length has been lost inside libresolv, so we have to guess a
1015 replacement value. (The only way to fix this properly would be to
1016 re-implement res_search() and res_query() so that they don't muddle their
1017 success and packet length return values.) For added safety we only reset
1018 the packet length if the packet header looks plausible. */
1019
1020 HEADER *h = (HEADER *)dnsa->answer;
1021 if (h->qr == 1 && h->opcode == QUERY && h->tc == 0
1022 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
1023 && ntohs(h->qdcount) == 1 && ntohs(h->ancount) == 0
1024 && ntohs(h->nscount) >= 1)
1025 dnsa->answerlen = MAXPACKET;
1026
1027 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
1028 rr;
1029 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1030 )
1031 if (rr->type != T_SOA) continue;
1032 else if (strcmpic(rr->name, US"") == 0 ||
1033 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
1034 else break;
1035 }
d2a2c69b 1036
1705dd20
JH
1037 for (i = 0; i < limit; i++)
1038 {
1039 if (ipv6)
1040 {
1041 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
1042 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
1043 namesuff -= 8;
1044 if (namesuff <= name) return DNS_NOMATCH;
1045 }
1046 else
1047 /* Find the start of the preceding domain name label. */
1048 do
1049 if (--namesuff <= name) return DNS_NOMATCH;
1050 while (*namesuff != '.');
1051
1052 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
1053
1054 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
1055 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1056 if (rc == DNS_AGAIN) return rc;
1057 if (rc != DNS_SUCCEED) continue;
1058
1059 /* Check that the SRV record we have found is worth returning. We don't
1060 just return the first one we find, because some lower level SRV record
1061 might make stricter assertions than its parent domain. */
1062
1063 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1064 rr;
1065 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
1066 {
1067 if (rr->type != T_SRV) continue;
d2a2c69b 1068
1705dd20
JH
1069 /* Extract the numerical SRV fields (p is incremented) */
1070 p = rr->data;
1071 GETSHORT(priority, p);
1072 GETSHORT(weight, p); weight = weight; /* compiler quietening */
1073 GETSHORT(port, p);
d2a2c69b 1074
1705dd20
JH
1075 /* Check the CSA version number */
1076 if (priority != 1) continue;
d2a2c69b 1077
1705dd20
JH
1078 /* If it's making an interesting assertion, return this response. */
1079 if (port & 1)
d2a2c69b 1080 {
1705dd20
JH
1081 *fully_qualified_name = namesuff + 1;
1082 return DNS_SUCCEED;
d2a2c69b 1083 }
d2a2c69b 1084 }
1705dd20
JH
1085 }
1086 return DNS_NOMATCH;
1087 }
e5a9dba6 1088
d2a2c69b 1089 default:
1705dd20
JH
1090 if (type >= 0)
1091 return dns_lookup(dnsa, name, type, fully_qualified_name);
e5a9dba6
PH
1092 }
1093
33397d19
PH
1094/* Control should never reach here */
1095
1096return DNS_FAIL;
1097}
1098
1099
1100
059ec3d9
PH
1101
1102
1103/*************************************************
1104* Get address(es) from DNS record *
1105*************************************************/
1106
1107/* The record type is either T_A for an IPv4 address or T_AAAA (or T_A6 when
d2a2c69b 1108supported) for an IPv6 address.
059ec3d9
PH
1109
1110Argument:
1111 dnsa the DNS answer block
1112 rr the RR
1113
e1a3f32f 1114Returns: pointer to a chain of dns_address items; NULL when the dnsa was overrun
059ec3d9
PH
1115*/
1116
1117dns_address *
1118dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1119{
e1a3f32f
JH
1120dns_address * yield = NULL;
1121uschar * dnsa_lim = dnsa->answer + dnsa->answerlen;
059ec3d9
PH
1122
1123if (rr->type == T_A)
1124 {
d2a2c69b 1125 uschar *p = US rr->data;
e1a3f32f
JH
1126 if (p + 4 <= dnsa_lim)
1127 {
1128 yield = store_get(sizeof(dns_address) + 20);
1129 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1130 yield->next = NULL;
1131 }
059ec3d9
PH
1132 }
1133
1134#if HAVE_IPV6
1135
059ec3d9
PH
1136else
1137 {
e1a3f32f
JH
1138 if (rr->data + 16 <= dnsa_lim)
1139 {
1140 yield = store_get(sizeof(dns_address) + 50);
1141 inet_ntop(AF_INET6, US rr->data, CS yield->address, 50);
1142 yield->next = NULL;
1143 }
059ec3d9
PH
1144 }
1145#endif /* HAVE_IPV6 */
1146
1147return yield;
1148}
1149
476be7e2
JH
1150
1151
1152void
1153dns_pattern_init(void)
1154{
1155if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1156 regex_check_dns_names =
1157 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);
1158}
1159
8c51eead
JH
1160/* vi: aw ai sw=2
1161*/
059ec3d9 1162/* End of dns.c */