tidying
[exim.git] / src / src / dns.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
d4e5e70b 5/* Copyright (c) University of Cambridge 1995 - 2017 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions for interfacing with the DNS. */
9
10#include "exim.h"
11
12
059ec3d9 13
bef5a11f
PH
14/*************************************************
15* Fake DNS resolver *
16*************************************************/
17
18/* This function is called instead of res_search() when Exim is running in its
19test harness. It recognizes some special domain names, and uses them to force
433a2980
PH
20failure and retry responses (optionally with a delay). Otherwise, it calls an
21external utility that mocks-up a nameserver, if it can find the utility.
22If not, it passes its arguments on to res_search(). The fake nameserver may
23also return a code specifying that the name should be passed on.
bef5a11f
PH
24
25Background: the original test suite required a real nameserver to carry the
8e013028 26test zones, whereas the new test suite has the fake server for portability. This
e7726cbf 27code supports both.
bef5a11f
PH
28
29Arguments:
e7726cbf 30 domain the domain name
bef5a11f
PH
31 type the DNS record type
32 answerptr where to put the answer
33 size size of the answer area
34
35Returns: length of returned data, or -1 on error (h_errno set)
36*/
37
38static int
1dc92d5a 39fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
bef5a11f 40{
e7726cbf 41int len = Ustrlen(domain);
433a2980 42int asize = size; /* Locally modified */
e7726cbf 43uschar name[256];
433a2980
PH
44uschar utilname[256];
45uschar *aptr = answerptr; /* Locally modified */
46struct stat statbuf;
47
48/* Remove terminating dot. */
e7726cbf
PH
49
50if (domain[len - 1] == '.') len--;
51Ustrncpy(name, domain, len);
52name[len] = 0;
bef5a11f 53
433a2980
PH
54/* Look for the fakens utility, and if it exists, call it. */
55
5f3d0983
HSHR
56(void)string_format(utilname, sizeof(utilname), "%s/bin/fakens",
57 config_main_directory);
433a2980
PH
58
59if (stat(CS utilname, &statbuf) >= 0)
bef5a11f 60 {
433a2980
PH
61 pid_t pid;
62 int infd, outfd, rc;
63 uschar *argv[5];
64
3735e326 65 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n", name, dns_text_type(type));
433a2980
PH
66
67 argv[0] = utilname;
5f3d0983 68 argv[1] = config_main_directory;
433a2980
PH
69 argv[2] = name;
70 argv[3] = dns_text_type(type);
71 argv[4] = NULL;
72
73 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE);
74 if (pid < 0)
75 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
76 strerror(errno));
77
78 len = 0;
79 rc = -1;
80 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
81 {
82 len += rc;
83 aptr += rc; /* Don't modify the actual arguments, because they */
84 asize -= rc; /* may need to be passed on to res_search(). */
85 }
bef5a11f 86
aa7751be 87 /* If we ran out of output buffer before exhausting the return,
1fb7660f
JH
88 carry on reading and counting it. */
89
90 if (asize == 0)
91 while ((rc = read(outfd, name, sizeof(name))) > 0)
92 len += rc;
93
433a2980
PH
94 if (rc < 0)
95 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
96 strerror(errno));
bef5a11f 97
433a2980 98 switch(child_close(pid, 0))
bef5a11f 99 {
433a2980
PH
100 case 0: return len;
101 case 1: h_errno = HOST_NOT_FOUND; return -1;
102 case 2: h_errno = TRY_AGAIN; return -1;
103 default:
104 case 3: h_errno = NO_RECOVERY; return -1;
105 case 4: h_errno = NO_DATA; return -1;
106 case 5: /* Pass on to res_search() */
107 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
bef5a11f
PH
108 }
109 }
8e013028
HSHR
110else
111 {
4cea764f 112 DEBUG(D_dns) debug_printf("fakens (%s) not found\n", utilname);
8e013028 113 }
bef5a11f 114
433a2980 115/* fakens utility not found, or it returned "pass on" */
bef5a11f 116
433a2980 117DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
e7726cbf
PH
118
119return res_search(CS domain, C_IN, type, answerptr, size);
bef5a11f
PH
120}
121
122
059ec3d9
PH
123
124/*************************************************
125* Initialize and configure resolver *
126*************************************************/
127
128/* Initialize the resolver and the storage for holding DNS answers if this is
129the first time we have been here, and set the resolver options.
130
131Arguments:
132 qualify_single TRUE to set the RES_DEFNAMES option
133 search_parents TRUE to set the RES_DNSRCH option
8c51eead 134 use_dnssec TRUE to set the RES_USE_DNSSEC option
059ec3d9
PH
135
136Returns: nothing
137*/
138
139void
8c51eead 140dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
059ec3d9 141{
5bfb4cdf
PP
142res_state resp = os_get_dns_resolver_res();
143
144if ((resp->options & RES_INIT) == 0)
059ec3d9 145 {
5bfb4cdf
PP
146 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
147 os_put_dns_resolver_res(resp);
059ec3d9 148 res_init();
5bfb4cdf
PP
149 DEBUG(D_resolver) resp->options |= RES_DEBUG;
150 os_put_dns_resolver_res(resp);
059ec3d9
PH
151 }
152
5bfb4cdf
PP
153resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
154resp->options |= (qualify_single? RES_DEFNAMES : 0) |
059ec3d9 155 (search_parents? RES_DNSRCH : 0);
5bfb4cdf
PP
156if (dns_retrans > 0) resp->retrans = dns_retrans;
157if (dns_retry > 0) resp->retry = dns_retry;
e97d1f08
PP
158
159#ifdef RES_USE_EDNS0
160if (dns_use_edns0 >= 0)
161 {
162 if (dns_use_edns0)
5bfb4cdf 163 resp->options |= RES_USE_EDNS0;
e97d1f08 164 else
5bfb4cdf 165 resp->options &= ~RES_USE_EDNS0;
e97d1f08
PP
166 DEBUG(D_resolver)
167 debug_printf("Coerced resolver EDNS0 support %s.\n",
168 dns_use_edns0 ? "on" : "off");
169 }
170#else
171if (dns_use_edns0 >= 0)
172 DEBUG(D_resolver)
173 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
174 dns_use_edns0 ? "" : "un");
175#endif
5bfb4cdf 176
1f4a55da
PP
177#ifndef DISABLE_DNSSEC
178# ifdef RES_USE_DNSSEC
179# ifndef RES_USE_EDNS0
180# error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
181# endif
8c51eead
JH
182if (use_dnssec)
183 resp->options |= RES_USE_DNSSEC;
0fbd9bff 184if (dns_dnssec_ok >= 0)
1f4a55da 185 {
0fbd9bff 186 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
1f4a55da
PP
187 {
188 DEBUG(D_resolver)
0fbd9bff 189 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
1f4a55da
PP
190 }
191 else
192 {
0fbd9bff 193 if (dns_dnssec_ok)
1f4a55da
PP
194 resp->options |= RES_USE_DNSSEC;
195 else
196 resp->options &= ~RES_USE_DNSSEC;
197 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
0fbd9bff 198 dns_dnssec_ok ? "on" : "off");
1f4a55da
PP
199 }
200 }
201# else
0fbd9bff 202if (dns_dnssec_ok >= 0)
1f4a55da
PP
203 DEBUG(D_resolver)
204 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
0fbd9bff 205 dns_dnssec_ok ? "" : "un");
8c51eead
JH
206if (use_dnssec)
207 DEBUG(D_resolver)
93d4b03a 208 debug_printf("Unable to set DNSSEC without resolver support.\n");
1f4a55da
PP
209# endif
210#endif /* DISABLE_DNSSEC */
211
5bfb4cdf 212os_put_dns_resolver_res(resp);
059ec3d9
PH
213}
214
215
216
217/*************************************************
218* Build key name for PTR records *
219*************************************************/
220
221/* This function inverts an IP address and adds the relevant domain, to produce
222a name that can be used to look up PTR records.
223
224Arguments:
225 string the IP address as a string
226 buffer a suitable buffer, long enough to hold the result
227
228Returns: nothing
229*/
230
231void
55414b25 232dns_build_reverse(const uschar *string, uschar *buffer)
059ec3d9 233{
55414b25 234const uschar *p = string + Ustrlen(string);
059ec3d9
PH
235uschar *pp = buffer;
236
237/* Handle IPv4 address */
238
239#if HAVE_IPV6
240if (Ustrchr(string, ':') == NULL)
241#endif
242 {
243 int i;
244 for (i = 0; i < 4; i++)
245 {
55414b25 246 const uschar *ppp = p;
059ec3d9
PH
247 while (ppp > string && ppp[-1] != '.') ppp--;
248 Ustrncpy(pp, ppp, p - ppp);
249 pp += p - ppp;
250 *pp++ = '.';
251 p = ppp - 1;
252 }
253 Ustrcpy(pp, "in-addr.arpa");
254 }
255
256/* Handle IPv6 address; convert to binary so as to fill out any
257abbreviation in the textual form. */
258
259#if HAVE_IPV6
260else
261 {
262 int i;
263 int v6[4];
264 (void)host_aton(string, v6);
265
266 /* The original specification for IPv6 reverse lookup was to invert each
267 nibble, and look in the ip6.int domain. The domain was subsequently
268 changed to ip6.arpa. */
269
270 for (i = 3; i >= 0; i--)
271 {
272 int j;
273 for (j = 0; j < 32; j += 4)
5976eb99 274 pp += sprintf(CS pp, "%x.", (v6[i] >> j) & 15);
059ec3d9
PH
275 }
276 Ustrcpy(pp, "ip6.arpa.");
277
278 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
279 with A6 records. However, it fell out of favour when they did. The
280 alternative was to construct a binary key, and look in ip6.arpa. I tried
281 to make this code do that, but I could not make it work on Solaris 8. The
282 resolver seems to lose the initial backslash somehow. However, now that
283 this style of reverse lookup has been dropped, it doesn't matter. These
284 lines are left here purely for historical interest. */
285
286 /**************************************************
287 Ustrcpy(pp, "\\[x");
288 pp += 3;
289
290 for (i = 0; i < 4; i++)
291 {
292 sprintf(pp, "%08X", v6[i]);
293 pp += 8;
294 }
295 Ustrcpy(pp, "].ip6.arpa.");
296 **************************************************/
297
298 }
299#endif
300}
301
302
303
304
2a407b17
JH
305/* Increment the aptr in dnss, checking against dnsa length.
306Return: TRUE for a bad result
307*/
308static BOOL
dd708fd7 309dnss_inc_aptr(const dns_answer * dnsa, dns_scan * dnss, unsigned delta)
2a407b17
JH
310{
311return (dnss->aptr += delta) >= dnsa->answer + dnsa->answerlen;
312}
313
059ec3d9
PH
314/*************************************************
315* Get next DNS record from answer block *
316*************************************************/
317
318/* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
e5a9dba6
PH
319RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
320scan the additional records, and reset == RESET_NEXT to get the next record.
321The result is in static storage which must be copied if it is to be preserved.
059ec3d9
PH
322
323Arguments:
324 dnsa pointer to dns answer block
325 dnss pointer to dns scan block
4c04137d 326 reset option specifying what portion to scan, as described above
059ec3d9
PH
327
328Returns: next dns record, or NULL when no more
329*/
330
331dns_record *
dd708fd7 332dns_next_rr(const dns_answer *dnsa, dns_scan *dnss, int reset)
059ec3d9 333{
dd708fd7 334const HEADER * h = (const HEADER *)dnsa->answer;
059ec3d9
PH
335int namelen;
336
2a407b17
JH
337char * trace = NULL;
338#ifdef rr_trace
339# define TRACE DEBUG(D_dns)
340#else
341trace = trace;
342# define TRACE if (FALSE)
343#endif
344
059ec3d9
PH
345/* Reset the saved data when requested to, and skip to the first required RR */
346
347if (reset != RESET_NEXT)
348 {
349 dnss->rrcount = ntohs(h->qdcount);
d093f8e5 350 TRACE debug_printf("%s: reset (Q rrcount %d)\n", __FUNCTION__, dnss->rrcount);
059ec3d9
PH
351 dnss->aptr = dnsa->answer + sizeof(HEADER);
352
353 /* Skip over questions; failure to expand the name just gives up */
354
355 while (dnss->rrcount-- > 0)
356 {
2a407b17 357 TRACE trace = "Q-namelen";
059ec3d9 358 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
2a407b17
JH
359 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
360 if (namelen < 0) goto null_return;
361 /* skip name & type & class */
362 TRACE trace = "Q-skip";
dd708fd7 363 if (dnss_inc_aptr(dnsa, dnss, namelen+4)) goto null_return;
059ec3d9
PH
364 }
365
366 /* Get the number of answer records. */
367
368 dnss->rrcount = ntohs(h->ancount);
d093f8e5 369 TRACE debug_printf("%s: reset (A rrcount %d)\n", __FUNCTION__, dnss->rrcount);
059ec3d9 370
e5a9dba6
PH
371 /* Skip over answers if we want to look at the authority section. Also skip
372 the NS records (i.e. authority section) if wanting to look at the additional
059ec3d9
PH
373 records. */
374
2a407b17
JH
375 if (reset == RESET_ADDITIONAL)
376 {
377 TRACE debug_printf("%s: additional\n", __FUNCTION__);
378 dnss->rrcount += ntohs(h->nscount);
d093f8e5 379 TRACE debug_printf("%s: reset (NS rrcount %d)\n", __FUNCTION__, dnss->rrcount);
2a407b17 380 }
e5a9dba6
PH
381
382 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
059ec3d9 383 {
2a407b17
JH
384 TRACE if (reset == RESET_AUTHORITY)
385 debug_printf("%s: authority\n", __FUNCTION__);
059ec3d9
PH
386 while (dnss->rrcount-- > 0)
387 {
2a407b17 388 TRACE trace = "A-namelen";
059ec3d9 389 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
2a407b17
JH
390 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
391 if (namelen < 0) goto null_return;
392 /* skip name, type, class & TTL */
393 TRACE trace = "A-hdr";
dd708fd7 394 if (dnss_inc_aptr(dnsa, dnss, namelen+8)) goto null_return;
059ec3d9 395 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
2a407b17
JH
396 /* skip over it */
397 TRACE trace = "A-skip";
dd708fd7 398 if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) goto null_return;
059ec3d9 399 }
2a407b17 400 dnss->rrcount = reset == RESET_AUTHORITY
e5a9dba6 401 ? ntohs(h->nscount) : ntohs(h->arcount);
d093f8e5
JH
402 TRACE debug_printf("%s: reset (%s rrcount %d)\n", __FUNCTION__,
403 reset == RESET_AUTHORITY ? "NS" : "AR", dnss->rrcount);
059ec3d9 404 }
2a407b17 405 TRACE debug_printf("%s: %d RRs to read\n", __FUNCTION__, dnss->rrcount);
059ec3d9 406 }
2a407b17
JH
407else
408 TRACE debug_printf("%s: next (%d left)\n", __FUNCTION__, dnss->rrcount);
059ec3d9 409
059ec3d9
PH
410/* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
411contains the number of RR records left. */
412
413if (dnss->rrcount-- <= 0) return NULL;
414
415/* If expanding the RR domain name fails, behave as if no more records
416(something safe). */
417
2a407b17 418TRACE trace = "R-namelen";
059ec3d9 419namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
2a407b17
JH
420 (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
421if (namelen < 0) goto null_return;
059ec3d9
PH
422
423/* Move the pointer past the name and fill in the rest of the data structure
424from the following bytes. */
425
2a407b17 426TRACE trace = "R-name";
dd708fd7 427if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return;
2a407b17
JH
428
429GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
430TRACE trace = "R-class";
dd708fd7 431if (dnss_inc_aptr(dnsa, dnss, 2)) goto null_return; /* Don't want class */
2a407b17
JH
432GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */
433GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
434dnss->srr.data = dnss->aptr; /* The record's data follows */
435
436/* Unchecked increment ok here since no further access on this iteration;
437will be checked on next at "R-name". */
438
439dnss->aptr += dnss->srr.size; /* Advance to next RR */
059ec3d9
PH
440
441/* Return a pointer to the dns_record structure within the dns_answer. This is
442for convenience so that the scans can use nice-looking for loops. */
443
2a407b17
JH
444return &dnss->srr;
445
446null_return:
d093f8e5
JH
447 TRACE debug_printf("%s: terminate (%d RRs left). Last op: %s; errno %d %s\n",
448 __FUNCTION__, dnss->rrcount, trace, errno, strerror(errno));
2a407b17
JH
449 dnss->rrcount = 0;
450 return NULL;
059ec3d9
PH
451}
452
453
8688d177 454/* Extract the AUTHORITY information from the answer. If the answer isn't
4c04137d 455authoritative (AA not set), we do not extract anything.
8db90b31 456
4c04137d 457The AUTHORITY section contains NS records if the name in question was found,
8688d177
JH
458it contains a SOA record otherwise. (This is just from experience and some
459tests, is there some spec?)
8db90b31 460
8688d177
JH
461Scan the whole AUTHORITY section, since it may contain other records
462(e.g. NSEC3) too.
463
464Return: name for the authority, in an allocated string, or NULL if none found */
09b80b4e
JH
465
466static const uschar *
467dns_extract_auth_name(const dns_answer * dnsa) /* FIXME: const dns_answer */
9820a77f 468{
09b80b4e
JH
469dns_scan dnss;
470dns_record * rr;
dd708fd7 471const HEADER * h = (const HEADER *) dnsa->answer;
09b80b4e 472
8688d177
JH
473if (h->nscount && h->aa)
474 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
475 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
476 if (rr->type == (h->ancount ? T_NS : T_SOA))
477 return string_copy(rr->name);
09b80b4e 478return NULL;
9820a77f
HSHR
479}
480
481
059ec3d9
PH
482
483
484/*************************************************
1f4a55da
PP
485* Return whether AD bit set in DNS result *
486*************************************************/
487
488/* We do not perform DNSSEC work ourselves; if the administrator has installed
489a verifying resolver which sets AD as appropriate, though, we'll use that.
4c04137d 490(AD = Authentic Data, AA = Authoritative Answer)
1f4a55da
PP
491
492Argument: pointer to dns answer block
493Returns: bool indicating presence of AD bit
494*/
495
496BOOL
4a142059 497dns_is_secure(const dns_answer * dnsa)
1f4a55da
PP
498{
499#ifdef DISABLE_DNSSEC
500DEBUG(D_dns)
501 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
502return FALSE;
503#else
dd708fd7 504const HEADER * h = (const HEADER *) dnsa->answer;
09b80b4e
JH
505const uschar * auth_name;
506const uschar * trusted;
9820a77f
HSHR
507
508if (h->ad) return TRUE;
9820a77f 509
4c04137d 510/* If the resolver we ask is authoritative for the domain in question, it
09b80b4e
JH
511* may not set the AD but the AA bit. If we explicitly trust
512* the resolver for that domain (via a domainlist in dns_trust_aa),
513* we return TRUE to indicate a secure answer.
514*/
9820a77f 515
09b80b4e
JH
516if ( !h->aa
517 || !dns_trust_aa
25bf2076
HSHR
518 || !(trusted = expand_string(dns_trust_aa))
519 || !*trusted
09b80b4e
JH
520 || !(auth_name = dns_extract_auth_name(dnsa))
521 || OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL,
94431adb 522 MCL_DOMAIN, TRUE, NULL)
09b80b4e
JH
523 )
524 return FALSE;
9820a77f 525
09b80b4e
JH
526DEBUG(D_dns) debug_printf("DNS faked the AD bit "
527 "(got AA and matched with dns_trust_aa (%s in %s))\n",
528 auth_name, dns_trust_aa);
9820a77f 529
09b80b4e 530return TRUE;
1f4a55da
PP
531#endif
532}
533
4a142059
JH
534static void
535dns_set_insecure(dns_answer * dnsa)
536{
e87c01c7 537#ifndef DISABLE_DNSSEC
4a142059 538HEADER * h = (HEADER *)dnsa->answer;
8688d177 539h->aa = h->ad = 0;
e87c01c7 540#endif
4a142059
JH
541}
542
221dff13
HSHR
543/************************************************
544 * Check whether the AA bit is set *
545 * We need this to warn if we requested AD *
4c04137d 546 * from an authoritative server *
221dff13
HSHR
547 ************************************************/
548
549BOOL
550dns_is_aa(const dns_answer *dnsa)
551{
e87c01c7
MH
552#ifdef DISABLE_DNSSEC
553return FALSE;
554#else
dd708fd7 555return ((const HEADER*)dnsa->answer)->aa;
e87c01c7 556#endif
221dff13 557}
1f4a55da
PP
558
559
560
561/*************************************************
059ec3d9
PH
562* Turn DNS type into text *
563*************************************************/
564
885ccd3e
PH
565/* Turn the coded record type into a string for printing. All those that Exim
566uses should be included here.
059ec3d9
PH
567
568Argument: record type
569Returns: pointer to string
570*/
571
572uschar *
573dns_text_type(int t)
574{
575switch(t)
576 {
33397d19
PH
577 case T_A: return US"A";
578 case T_MX: return US"MX";
579 case T_AAAA: return US"AAAA";
580 case T_A6: return US"A6";
581 case T_TXT: return US"TXT";
eae0036b 582 case T_SPF: return US"SPF";
33397d19 583 case T_PTR: return US"PTR";
885ccd3e 584 case T_SOA: return US"SOA";
33397d19
PH
585 case T_SRV: return US"SRV";
586 case T_NS: return US"NS";
8e669ac1 587 case T_CNAME: return US"CNAME";
1e06383a 588 case T_TLSA: return US"TLSA";
33397d19 589 default: return US"?";
059ec3d9
PH
590 }
591}
592
593
594
595/*************************************************
596* Cache a failed DNS lookup result *
597*************************************************/
598
599/* We cache failed lookup results so as not to experience timeouts many
600times for the same domain. We need to retain the resolver options because they
601may change. For successful lookups, we rely on resolver and/or name server
602caching.
603
604Arguments:
605 name the domain name
606 type the lookup type
607 rc the return code
608
609Returns: the return code
610*/
611
612static int
1dc92d5a 613dns_return(const uschar * name, int type, int rc)
059ec3d9 614{
5bfb4cdf 615res_state resp = os_get_dns_resolver_res();
059ec3d9
PH
616tree_node *node = store_get_perm(sizeof(tree_node) + 290);
617sprintf(CS node->name, "%.255s-%s-%lx", name, dns_text_type(type),
f794c12b 618 (unsigned long) resp->options);
059ec3d9
PH
619node->data.val = rc;
620(void)tree_insertnode(&tree_dns_fails, node);
621return rc;
622}
623
059ec3d9
PH
624/*************************************************
625* Do basic DNS lookup *
626*************************************************/
627
628/* Call the resolver to look up the given domain name, using the given type,
629and check the result. The error code TRY_AGAIN is documented as meaning "non-
4c04137d 630Authoritative Host not found, or SERVERFAIL". Sometimes there are badly set
059ec3d9
PH
631up nameservers that produce this error continually, so there is the option of
632providing a list of domains for which this is treated as a non-existent
633host.
634
635Arguments:
636 dnsa pointer to dns_answer structure
637 name name to look up
638 type type of DNS record required (T_A, T_MX, etc)
639
640Returns: DNS_SUCCEED successful lookup
641 DNS_NOMATCH name not found (NXDOMAIN)
642 or name contains illegal characters (if checking)
30e18802 643 or name is an IP address (for IP address lookup)
059ec3d9
PH
644 DNS_NODATA domain exists, but no data for this type (NODATA)
645 DNS_AGAIN soft failure, try again later
646 DNS_FAIL DNS failure
647*/
648
649int
1dc92d5a 650dns_basic_lookup(dns_answer *dnsa, const uschar *name, int type)
059ec3d9
PH
651{
652#ifndef STAND_ALONE
7156b1ef 653int rc = -1;
55414b25 654const uschar *save_domain;
059ec3d9 655#endif
5bfb4cdf 656res_state resp = os_get_dns_resolver_res();
059ec3d9
PH
657
658tree_node *previous;
659uschar node_name[290];
660
661/* DNS lookup failures of any kind are cached in a tree. This is mainly so that
662a timeout on one domain doesn't happen time and time again for messages that
663have many addresses in the same domain. We rely on the resolver and name server
664caching for successful lookups. */
665
666sprintf(CS node_name, "%.255s-%s-%lx", name, dns_text_type(type),
f794c12b 667 (unsigned long) resp->options);
4b0fe319 668if ((previous = tree_search(tree_dns_fails, node_name)))
059ec3d9
PH
669 {
670 DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: using cached value %s\n",
671 name, dns_text_type(type),
672 (previous->data.val == DNS_NOMATCH)? "DNS_NOMATCH" :
673 (previous->data.val == DNS_NODATA)? "DNS_NODATA" :
674 (previous->data.val == DNS_AGAIN)? "DNS_AGAIN" :
675 (previous->data.val == DNS_FAIL)? "DNS_FAIL" : "??");
676 return previous->data.val;
677 }
678
8c5d388a 679#ifdef SUPPORT_I18N
9d4319df
JH
680/* Convert all names to a-label form before doing lookup */
681 {
682 uschar * alabel;
683 uschar * errstr = NULL;
766e7a65
JH
684 DEBUG(D_dns) if (string_is_utf8(name))
685 debug_printf("convert utf8 '%s' to alabel for for lookup\n", name);
9d4319df
JH
686 if ((alabel = string_domain_utf8_to_alabel(name, &errstr)), errstr)
687 {
688 DEBUG(D_dns)
37bf366e 689 debug_printf("DNS name '%s' utf8 conversion to alabel failed: %s\n", name,
9d4319df
JH
690 errstr);
691 host_find_failed_syntax = TRUE;
692 return DNS_NOMATCH;
693 }
694 name = alabel;
695 }
696#endif
697
4c04137d 698/* If configured, check the hygiene of the name passed to lookup. Otherwise,
059ec3d9
PH
699although DNS lookups may give REFUSED at the lower level, some resolvers
700turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
701domains cannot be in the DNS. The check is now done by a regular expression;
702give it space for substring storage to save it having to get its own if the
703regex has substrings that are used - the default uses a conditional.
704
705This test is omitted for PTR records. These occur only in calls from the dnsdb
706lookup, which constructs the names itself, so they should be OK. Besides,
707bitstring labels don't conform to normal name syntax. (But the aren't used any
708more.)
709
710For SRV records, we omit the initial _smtp._tcp. components at the start. */
711
712#ifndef STAND_ALONE /* Omit this for stand-alone tests */
713
482d1455 714if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
059ec3d9 715 {
1dc92d5a 716 const uschar *checkname = name;
059ec3d9
PH
717 int ovector[3*(EXPAND_MAXN+1)];
718
476be7e2 719 dns_pattern_init();
059ec3d9
PH
720
721 /* For an SRV lookup, skip over the first two components (the service and
722 protocol names, which both start with an underscore). */
723
b4161d10 724 if (type == T_SRV || type == T_TLSA)
059ec3d9
PH
725 {
726 while (*checkname++ != '.');
727 while (*checkname++ != '.');
728 }
729
1dc92d5a 730 if (pcre_exec(regex_check_dns_names, NULL, CCS checkname, Ustrlen(checkname),
d093f8e5 731 0, PCRE_EOPT, ovector, nelem(ovector)) < 0)
059ec3d9
PH
732 {
733 DEBUG(D_dns)
734 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
735 dns_text_type(type));
736 host_find_failed_syntax = TRUE;
737 return DNS_NOMATCH;
738 }
739 }
740
741#endif /* STAND_ALONE */
742
743/* Call the resolver; for an overlong response, res_search() will return the
bef5a11f
PH
744number of bytes the message would need, so we need to check for this case. The
745effect is to truncate overlong data.
746
30e18802
PH
747On some systems, res_search() will recognize "A-for-A" queries and return
748the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
749nameservers are also believed to do this. It is, of course, contrary to the
750specification of the DNS, so we lock it out. */
751
cc00f4af 752if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
30e18802
PH
753 return DNS_NOMATCH;
754
755/* If we are running in the test harness, instead of calling the normal resolver
bef5a11f
PH
756(res_search), we call fakens_search(), which recognizes certain special
757domains, and interfaces to a fake nameserver for certain special zones. */
758
cc00f4af 759dnsa->answerlen = running_in_test_harness
d093f8e5
JH
760 ? fakens_search(name, type, dnsa->answer, sizeof(dnsa->answer))
761 : res_search(CCS name, C_IN, type, dnsa->answer, sizeof(dnsa->answer));
059ec3d9 762
d093f8e5 763if (dnsa->answerlen > (int) sizeof(dnsa->answer))
80a47a2c 764 {
9e7e0f6a
JH
765 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet"
766 " (size %d), truncating to %u.\n",
767 name, dns_text_type(type), dnsa->answerlen, (unsigned int) sizeof(dnsa->answer));
d093f8e5 768 dnsa->answerlen = sizeof(dnsa->answer);
80a47a2c 769 }
059ec3d9
PH
770
771if (dnsa->answerlen < 0) switch (h_errno)
772 {
773 case HOST_NOT_FOUND:
4b0fe319
JH
774 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
775 "returning DNS_NOMATCH\n", name, dns_text_type(type));
776 return dns_return(name, type, DNS_NOMATCH);
059ec3d9
PH
777
778 case TRY_AGAIN:
4b0fe319
JH
779 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
780 name, dns_text_type(type));
059ec3d9 781
4b0fe319 782 /* Cut this out for various test programs */
1dc92d5a 783#ifndef STAND_ALONE
4b0fe319
JH
784 save_domain = deliver_domain;
785 deliver_domain = string_copy(name); /* set $domain */
786 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
787 MCL_DOMAIN, TRUE, NULL);
788 deliver_domain = save_domain;
789 if (rc != OK)
790 {
791 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
792 return dns_return(name, type, DNS_AGAIN);
793 }
794 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
795 "DNS_NOMATCH\n", name);
796 return dns_return(name, type, DNS_NOMATCH);
059ec3d9 797
1dc92d5a 798#else /* For stand-alone tests */
4b0fe319 799 return dns_return(name, type, DNS_AGAIN);
1dc92d5a 800#endif
059ec3d9
PH
801
802 case NO_RECOVERY:
4b0fe319
JH
803 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
804 "returning DNS_FAIL\n", name, dns_text_type(type));
805 return dns_return(name, type, DNS_FAIL);
059ec3d9
PH
806
807 case NO_DATA:
4b0fe319
JH
808 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
809 "returning DNS_NODATA\n", name, dns_text_type(type));
810 return dns_return(name, type, DNS_NODATA);
059ec3d9
PH
811
812 default:
4b0fe319
JH
813 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
814 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
815 return dns_return(name, type, DNS_FAIL);
059ec3d9
PH
816 }
817
818DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
819 name, dns_text_type(type));
820
821return DNS_SUCCEED;
822}
823
824
825
826
827/************************************************
828* Do a DNS lookup and handle CNAMES *
829************************************************/
830
831/* Look up the given domain name, using the given type. Follow CNAMEs if
832necessary, but only so many times. There aren't supposed to be CNAME chains in
833the DNS, but you are supposed to cope with them if you find them.
834
835The assumption is made that if the resolver gives back records of the
836requested type *and* a CNAME, we don't need to make another call to look up
837the CNAME. I can't see how it could return only some of the right records. If
838it's done a CNAME lookup in the past, it will have all of them; if not, it
839won't return any.
840
841If fully_qualified_name is not NULL, set it to point to the full name
842returned by the resolver, if this is different to what it is given, unless
843the returned name starts with "*" as some nameservers seem to be returning
766e7a65
JH
844wildcards in this form. In international mode "different" means "alabel
845forms are different".
059ec3d9
PH
846
847Arguments:
848 dnsa pointer to dns_answer structure
849 name domain name to look up
850 type DNS record type (T_A, T_MX, etc)
851 fully_qualified_name if not NULL, return the returned name here if its
852 contents are different (i.e. it must be preset)
853
854Returns: DNS_SUCCEED successful lookup
855 DNS_NOMATCH name not found
856 DNS_NODATA no data found
857 DNS_AGAIN soft failure, try again later
858 DNS_FAIL DNS failure
859*/
860
861int
1dc92d5a 862dns_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 863 const uschar **fully_qualified_name)
059ec3d9
PH
864{
865int i;
1dc92d5a 866const uschar *orig_name = name;
c85b3043 867BOOL secure_so_far = TRUE;
059ec3d9
PH
868
869/* Loop to follow CNAME chains so far, but no further... */
870
871for (i = 0; i < 10; i++)
872 {
806c3df9 873 uschar * data;
059ec3d9
PH
874 dns_record *rr, cname_rr, type_rr;
875 dns_scan dnss;
876 int datalen, rc;
877
878 /* DNS lookup failures get passed straight back. */
879
dd708fd7
JH
880 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED)
881 return rc;
059ec3d9
PH
882
883 /* We should have either records of the required type, or a CNAME record,
884 or both. We need to know whether both exist for getting the fully qualified
885 name, but avoid scanning more than necessary. Note that we must copy the
886 contents of any rr blocks returned by dns_next_rr() as they use the same
887 area in the dnsa block. */
888
889 cname_rr.data = type_rr.data = NULL;
890 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
8688d177 891 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
059ec3d9
PH
892 if (rr->type == type)
893 {
894 if (type_rr.data == NULL) type_rr = *rr;
895 if (cname_rr.data != NULL) break;
896 }
dd708fd7
JH
897 else if (rr->type == T_CNAME)
898 cname_rr = *rr;
059ec3d9 899
a2042e78
PH
900 /* For the first time round this loop, if a CNAME was found, take the fully
901 qualified name from it; otherwise from the first data record, if present. */
059ec3d9 902
dd708fd7 903 if (i == 0 && fully_qualified_name)
059ec3d9 904 {
dd708fd7
JH
905 uschar * rr_name = cname_rr.data
906 ? cname_rr.name : type_rr.data ? type_rr.name : NULL;
766e7a65
JH
907 if ( rr_name
908 && Ustrcmp(rr_name, *fully_qualified_name) != 0
909 && rr_name[0] != '*'
8c5d388a 910#ifdef SUPPORT_I18N
766e7a65
JH
911 && ( !string_is_utf8(*fully_qualified_name)
912 || Ustrcmp(rr_name,
913 string_domain_utf8_to_alabel(*fully_qualified_name, NULL)) != 0
914 )
915#endif
916 )
917 *fully_qualified_name = string_copy_dnsdomain(rr_name);
059ec3d9
PH
918 }
919
920 /* If any data records of the correct type were found, we are done. */
921
806c3df9 922 if (type_rr.data)
c85b3043
JH
923 {
924 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
4a142059 925 dns_set_insecure(dnsa);
c85b3043
JH
926 return DNS_SUCCEED;
927 }
059ec3d9
PH
928
929 /* If there are no data records, we need to re-scan the DNS using the
930 domain given in the CNAME record, which should exist (otherwise we should
931 have had a failure from dns_lookup). However code against the possibility of
932 its not existing. */
933
806c3df9
JH
934 if (!cname_rr.data)
935 return DNS_FAIL;
936
937 data = store_get(256);
dd708fd7
JH
938 if ((datalen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
939 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, 256)) < 0)
806c3df9 940 return DNS_FAIL;
059ec3d9 941 name = data;
a2042e78 942
c85b3043
JH
943 if (!dns_is_secure(dnsa))
944 secure_so_far = FALSE;
945
a2042e78 946 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
059ec3d9
PH
947 } /* Loop back to do another lookup */
948
949/*Control reaches here after 10 times round the CNAME loop. Something isn't
950right... */
951
952log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
953return DNS_FAIL;
954}
955
956
957
33397d19
PH
958
959
960
961/************************************************
962* Do a DNS lookup and handle virtual types *
963************************************************/
964
9820a77f 965/* This function handles some invented "lookup types" that synthesize features
8e669ac1 966not available in the basic types. The special types all have negative values.
33397d19
PH
967Positive type values are passed straight on to dns_lookup().
968
969Arguments:
970 dnsa pointer to dns_answer structure
971 name domain name to look up
972 type DNS record type (T_A, T_MX, etc or a "special")
973 fully_qualified_name if not NULL, return the returned name here if its
974 contents are different (i.e. it must be preset)
975
976Returns: DNS_SUCCEED successful lookup
977 DNS_NOMATCH name not found
978 DNS_NODATA no data found
979 DNS_AGAIN soft failure, try again later
980 DNS_FAIL DNS failure
981*/
982
983int
1dc92d5a 984dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 985 const uschar **fully_qualified_name)
33397d19 986{
d2a2c69b 987switch (type)
e5a9dba6 988 {
d2a2c69b
JH
989 /* The "mx hosts only" type doesn't require any special action here */
990 case T_MXH:
1705dd20 991 return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
d2a2c69b
JH
992
993 /* Find nameservers for the domain or the nearest enclosing zone, excluding
994 the root servers. */
995 case T_ZNS:
1705dd20
JH
996 type = T_NS;
997 /* FALLTHROUGH */
d2a2c69b 998 case T_SOA:
1705dd20
JH
999 {
1000 const uschar *d = name;
1001 while (d != 0)
1002 {
1003 int rc = dns_lookup(dnsa, d, type, fully_qualified_name);
1004 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
1005 while (*d != 0 && *d != '.') d++;
1006 if (*d++ == 0) break;
1007 }
1008 return DNS_NOMATCH;
1009 }
d2a2c69b
JH
1010
1011 /* Try to look up the Client SMTP Authorization SRV record for the name. If
1012 there isn't one, search from the top downwards for a CSA record in a parent
1013 domain, which might be making assertions about subdomains. If we find a record
1014 we set fully_qualified_name to whichever lookup succeeded, so that the caller
1015 can tell whether to look at the explicit authorization field or the subdomain
1016 assertion field. */
1017 case T_CSA:
1705dd20 1018 {
cab0c277 1019 uschar *srvname, *namesuff, *tld;
1705dd20
JH
1020 int priority, weight, port;
1021 int limit, rc, i;
1022 BOOL ipv6;
1023 dns_record *rr;
1024 dns_scan dnss;
1025
1026 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
1027
1028 srvname = string_sprintf("_client._smtp.%s", name);
1029 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1030 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
1031 {
1032 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
1033 return rc;
1034 }
d2a2c69b 1035
1705dd20
JH
1036 /* Search for CSA subdomain assertion SRV records from the top downwards,
1037 starting with the 2nd level domain. This order maximizes cache-friendliness.
1038 We skip the top level domains to avoid loading their nameservers and because
1039 we know they'll never have CSA SRV records. */
d2a2c69b 1040
1705dd20
JH
1041 namesuff = Ustrrchr(name, '.');
1042 if (namesuff == NULL) return DNS_NOMATCH;
1043 tld = namesuff + 1;
1044 ipv6 = FALSE;
1045 limit = dns_csa_search_limit;
1046
1047 /* Use more appropriate search parameters if we are in the reverse DNS. */
1048
1049 if (strcmpic(namesuff, US".arpa") == 0)
1050 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
1051 {
1052 namesuff -= 8;
d2a2c69b 1053 tld = namesuff + 1;
1705dd20
JH
1054 limit = 3;
1055 }
1056 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
1057 {
1058 namesuff -= 4;
1059 tld = namesuff + 1;
1060 ipv6 = TRUE;
1061 limit = 3;
1062 }
d2a2c69b 1063
1705dd20 1064 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
d2a2c69b 1065
1705dd20
JH
1066 /* Do not perform the search if the top level or 2nd level domains do not
1067 exist. This is quite common, and when it occurs all the search queries would
1068 go to the root or TLD name servers, which is not friendly. So we check the
1069 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
1070 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
1071 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
1072 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
1073
1074 if (rc == DNS_NOMATCH)
1075 {
1076 /* This is really gross. The successful return value from res_search() is
1077 the packet length, which is stored in dnsa->answerlen. If we get a
1078 negative DNS reply then res_search() returns -1, which causes the bounds
1079 checks for name decompression to fail when it is treated as a packet
1080 length, which in turn causes the authority search to fail. The correct
1081 packet length has been lost inside libresolv, so we have to guess a
1082 replacement value. (The only way to fix this properly would be to
1083 re-implement res_search() and res_query() so that they don't muddle their
1084 success and packet length return values.) For added safety we only reset
1085 the packet length if the packet header looks plausible. */
1086
dd708fd7 1087 const HEADER * h = (const HEADER *)dnsa->answer;
1705dd20
JH
1088 if (h->qr == 1 && h->opcode == QUERY && h->tc == 0
1089 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
1090 && ntohs(h->qdcount) == 1 && ntohs(h->ancount) == 0
1091 && ntohs(h->nscount) >= 1)
1092 dnsa->answerlen = MAXPACKET;
1093
1094 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
8688d177 1095 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1705dd20
JH
1096 )
1097 if (rr->type != T_SOA) continue;
1098 else if (strcmpic(rr->name, US"") == 0 ||
1099 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
1100 else break;
1101 }
d2a2c69b 1102
1705dd20
JH
1103 for (i = 0; i < limit; i++)
1104 {
1105 if (ipv6)
1106 {
1107 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
1108 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
1109 namesuff -= 8;
1110 if (namesuff <= name) return DNS_NOMATCH;
1111 }
1112 else
1113 /* Find the start of the preceding domain name label. */
1114 do
1115 if (--namesuff <= name) return DNS_NOMATCH;
1116 while (*namesuff != '.');
1117
1118 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
1119
1120 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
1121 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1122 if (rc == DNS_AGAIN) return rc;
1123 if (rc != DNS_SUCCEED) continue;
1124
1125 /* Check that the SRV record we have found is worth returning. We don't
1126 just return the first one we find, because some lower level SRV record
1127 might make stricter assertions than its parent domain. */
1128
1129 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
8688d177 1130 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1705dd20 1131 {
dd708fd7 1132 const uschar * p = rr->data;
d2a2c69b 1133
1705dd20 1134 /* Extract the numerical SRV fields (p is incremented) */
1705dd20
JH
1135 GETSHORT(priority, p);
1136 GETSHORT(weight, p); weight = weight; /* compiler quietening */
1137 GETSHORT(port, p);
d2a2c69b 1138
1705dd20
JH
1139 /* Check the CSA version number */
1140 if (priority != 1) continue;
d2a2c69b 1141
1705dd20
JH
1142 /* If it's making an interesting assertion, return this response. */
1143 if (port & 1)
d2a2c69b 1144 {
1705dd20
JH
1145 *fully_qualified_name = namesuff + 1;
1146 return DNS_SUCCEED;
d2a2c69b 1147 }
d2a2c69b 1148 }
1705dd20
JH
1149 }
1150 return DNS_NOMATCH;
1151 }
e5a9dba6 1152
d2a2c69b 1153 default:
1705dd20
JH
1154 if (type >= 0)
1155 return dns_lookup(dnsa, name, type, fully_qualified_name);
e5a9dba6
PH
1156 }
1157
33397d19
PH
1158/* Control should never reach here */
1159
1160return DNS_FAIL;
1161}
1162
1163
1164
059ec3d9
PH
1165
1166
1167/*************************************************
1168* Get address(es) from DNS record *
1169*************************************************/
1170
d57d474f 1171/* The record type is either T_A for an IPv4 address or T_AAAA for an IPv6 address.
059ec3d9
PH
1172
1173Argument:
1174 dnsa the DNS answer block
1175 rr the RR
1176
e1a3f32f 1177Returns: pointer to a chain of dns_address items; NULL when the dnsa was overrun
059ec3d9
PH
1178*/
1179
1180dns_address *
1181dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1182{
e1a3f32f
JH
1183dns_address * yield = NULL;
1184uschar * dnsa_lim = dnsa->answer + dnsa->answerlen;
059ec3d9
PH
1185
1186if (rr->type == T_A)
1187 {
d2a2c69b 1188 uschar *p = US rr->data;
e1a3f32f
JH
1189 if (p + 4 <= dnsa_lim)
1190 {
1191 yield = store_get(sizeof(dns_address) + 20);
1192 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1193 yield->next = NULL;
1194 }
059ec3d9
PH
1195 }
1196
1197#if HAVE_IPV6
1198
059ec3d9
PH
1199else
1200 {
e1a3f32f
JH
1201 if (rr->data + 16 <= dnsa_lim)
1202 {
d57d474f
JH
1203 struct in6_addr in6;
1204 int i;
f794c12b 1205 for (i = 0; i < 16; i++) in6.s6_addr[i] = rr->data[i];
e1a3f32f 1206 yield = store_get(sizeof(dns_address) + 50);
d57d474f 1207 inet_ntop(AF_INET6, &in6, CS yield->address, 50);
e1a3f32f
JH
1208 yield->next = NULL;
1209 }
059ec3d9
PH
1210 }
1211#endif /* HAVE_IPV6 */
1212
1213return yield;
1214}
1215
476be7e2
JH
1216
1217
1218void
1219dns_pattern_init(void)
1220{
1221if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1222 regex_check_dns_names =
1223 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);
1224}
1225
8c51eead
JH
1226/* vi: aw ai sw=2
1227*/
059ec3d9 1228/* End of dns.c */