stop-gap: doc glibc 2.31 RES_TRUSTAD/trust-ad
[exim.git] / src / src / dns.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions for interfacing with the DNS. */
9
10#include "exim.h"
11
12
bef5a11f
PH
13/*************************************************
14* Fake DNS resolver *
15*************************************************/
16
17/* This function is called instead of res_search() when Exim is running in its
18test harness. It recognizes some special domain names, and uses them to force
433a2980
PH
19failure and retry responses (optionally with a delay). Otherwise, it calls an
20external utility that mocks-up a nameserver, if it can find the utility.
21If not, it passes its arguments on to res_search(). The fake nameserver may
22also return a code specifying that the name should be passed on.
bef5a11f
PH
23
24Background: the original test suite required a real nameserver to carry the
8e013028 25test zones, whereas the new test suite has the fake server for portability. This
e7726cbf 26code supports both.
bef5a11f
PH
27
28Arguments:
e7726cbf 29 domain the domain name
bef5a11f
PH
30 type the DNS record type
31 answerptr where to put the answer
32 size size of the answer area
33
34Returns: length of returned data, or -1 on error (h_errno set)
35*/
36
37static int
1dc92d5a 38fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
bef5a11f 39{
e7726cbf 40int len = Ustrlen(domain);
433a2980 41int asize = size; /* Locally modified */
f3ebb786 42uschar * name;
433a2980
PH
43uschar utilname[256];
44uschar *aptr = answerptr; /* Locally modified */
45struct stat statbuf;
46
47/* Remove terminating dot. */
e7726cbf
PH
48
49if (domain[len - 1] == '.') len--;
f3ebb786 50name = string_copyn(domain, len);
bef5a11f 51
433a2980
PH
52/* Look for the fakens utility, and if it exists, call it. */
53
5f3d0983
HSHR
54(void)string_format(utilname, sizeof(utilname), "%s/bin/fakens",
55 config_main_directory);
433a2980
PH
56
57if (stat(CS utilname, &statbuf) >= 0)
bef5a11f 58 {
433a2980
PH
59 pid_t pid;
60 int infd, outfd, rc;
61 uschar *argv[5];
62
eb24befc
JH
63 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n",
64 name, dns_text_type(type));
433a2980
PH
65
66 argv[0] = utilname;
5f3d0983 67 argv[1] = config_main_directory;
433a2980
PH
68 argv[2] = name;
69 argv[3] = dns_text_type(type);
70 argv[4] = NULL;
71
eb24befc 72 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE, US"fakens-search");
433a2980
PH
73 if (pid < 0)
74 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
75 strerror(errno));
76
77 len = 0;
78 rc = -1;
79 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
80 {
81 len += rc;
82 aptr += rc; /* Don't modify the actual arguments, because they */
83 asize -= rc; /* may need to be passed on to res_search(). */
84 }
bef5a11f 85
aa7751be 86 /* If we ran out of output buffer before exhausting the return,
1fb7660f
JH
87 carry on reading and counting it. */
88
89 if (asize == 0)
90 while ((rc = read(outfd, name, sizeof(name))) > 0)
91 len += rc;
92
433a2980
PH
93 if (rc < 0)
94 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
95 strerror(errno));
bef5a11f 96
433a2980 97 switch(child_close(pid, 0))
bef5a11f 98 {
433a2980
PH
99 case 0: return len;
100 case 1: h_errno = HOST_NOT_FOUND; return -1;
101 case 2: h_errno = TRY_AGAIN; return -1;
102 default:
103 case 3: h_errno = NO_RECOVERY; return -1;
104 case 4: h_errno = NO_DATA; return -1;
105 case 5: /* Pass on to res_search() */
106 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
bef5a11f
PH
107 }
108 }
8e013028
HSHR
109else
110 {
4cea764f 111 DEBUG(D_dns) debug_printf("fakens (%s) not found\n", utilname);
8e013028 112 }
bef5a11f 113
433a2980 114/* fakens utility not found, or it returned "pass on" */
bef5a11f 115
433a2980 116DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
e7726cbf
PH
117
118return res_search(CS domain, C_IN, type, answerptr, size);
bef5a11f
PH
119}
120
121
059ec3d9
PH
122
123/*************************************************
124* Initialize and configure resolver *
125*************************************************/
126
127/* Initialize the resolver and the storage for holding DNS answers if this is
128the first time we have been here, and set the resolver options.
129
130Arguments:
131 qualify_single TRUE to set the RES_DEFNAMES option
132 search_parents TRUE to set the RES_DNSRCH option
8c51eead 133 use_dnssec TRUE to set the RES_USE_DNSSEC option
059ec3d9
PH
134
135Returns: nothing
136*/
137
138void
8c51eead 139dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
059ec3d9 140{
5bfb4cdf
PP
141res_state resp = os_get_dns_resolver_res();
142
143if ((resp->options & RES_INIT) == 0)
059ec3d9 144 {
5bfb4cdf
PP
145 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
146 os_put_dns_resolver_res(resp);
059ec3d9 147 res_init();
5bfb4cdf
PP
148 DEBUG(D_resolver) resp->options |= RES_DEBUG;
149 os_put_dns_resolver_res(resp);
059ec3d9
PH
150 }
151
5bfb4cdf
PP
152resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
153resp->options |= (qualify_single? RES_DEFNAMES : 0) |
059ec3d9 154 (search_parents? RES_DNSRCH : 0);
5bfb4cdf
PP
155if (dns_retrans > 0) resp->retrans = dns_retrans;
156if (dns_retry > 0) resp->retry = dns_retry;
e97d1f08
PP
157
158#ifdef RES_USE_EDNS0
159if (dns_use_edns0 >= 0)
160 {
161 if (dns_use_edns0)
5bfb4cdf 162 resp->options |= RES_USE_EDNS0;
e97d1f08 163 else
5bfb4cdf 164 resp->options &= ~RES_USE_EDNS0;
e97d1f08
PP
165 DEBUG(D_resolver)
166 debug_printf("Coerced resolver EDNS0 support %s.\n",
167 dns_use_edns0 ? "on" : "off");
168 }
169#else
170if (dns_use_edns0 >= 0)
171 DEBUG(D_resolver)
172 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
173 dns_use_edns0 ? "" : "un");
174#endif
5bfb4cdf 175
1f4a55da
PP
176#ifndef DISABLE_DNSSEC
177# ifdef RES_USE_DNSSEC
178# ifndef RES_USE_EDNS0
179# error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
180# endif
8c51eead
JH
181if (use_dnssec)
182 resp->options |= RES_USE_DNSSEC;
0fbd9bff 183if (dns_dnssec_ok >= 0)
1f4a55da 184 {
0fbd9bff 185 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
1f4a55da
PP
186 {
187 DEBUG(D_resolver)
0fbd9bff 188 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
1f4a55da
PP
189 }
190 else
191 {
0fbd9bff 192 if (dns_dnssec_ok)
1f4a55da
PP
193 resp->options |= RES_USE_DNSSEC;
194 else
195 resp->options &= ~RES_USE_DNSSEC;
196 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
0fbd9bff 197 dns_dnssec_ok ? "on" : "off");
1f4a55da
PP
198 }
199 }
200# else
0fbd9bff 201if (dns_dnssec_ok >= 0)
1f4a55da
PP
202 DEBUG(D_resolver)
203 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
0fbd9bff 204 dns_dnssec_ok ? "" : "un");
8c51eead
JH
205if (use_dnssec)
206 DEBUG(D_resolver)
93d4b03a 207 debug_printf("Unable to set DNSSEC without resolver support.\n");
1f4a55da
PP
208# endif
209#endif /* DISABLE_DNSSEC */
210
5bfb4cdf 211os_put_dns_resolver_res(resp);
059ec3d9
PH
212}
213
214
215
216/*************************************************
217* Build key name for PTR records *
218*************************************************/
219
220/* This function inverts an IP address and adds the relevant domain, to produce
221a name that can be used to look up PTR records.
222
223Arguments:
224 string the IP address as a string
059ec3d9 225
152481a0 226Returns: an allocated string
059ec3d9
PH
227*/
228
152481a0
JH
229uschar *
230dns_build_reverse(const uschar * string)
059ec3d9 231{
152481a0
JH
232const uschar * p = string + Ustrlen(string);
233gstring * g = NULL;
059ec3d9
PH
234
235/* Handle IPv4 address */
236
237#if HAVE_IPV6
238if (Ustrchr(string, ':') == NULL)
239#endif
240 {
d7978c0f 241 for (int i = 0; i < 4; i++)
059ec3d9 242 {
152481a0 243 const uschar * ppp = p;
059ec3d9 244 while (ppp > string && ppp[-1] != '.') ppp--;
152481a0
JH
245 g = string_catn(g, ppp, p - ppp);
246 g = string_catn(g, US".", 1);
059ec3d9
PH
247 p = ppp - 1;
248 }
152481a0 249 g = string_catn(g, US"in-addr.arpa", 12);
059ec3d9
PH
250 }
251
252/* Handle IPv6 address; convert to binary so as to fill out any
253abbreviation in the textual form. */
254
255#if HAVE_IPV6
256else
257 {
059ec3d9 258 int v6[4];
152481a0
JH
259
260 g = string_get_tainted(32, is_tainted(string));
059ec3d9
PH
261 (void)host_aton(string, v6);
262
263 /* The original specification for IPv6 reverse lookup was to invert each
264 nibble, and look in the ip6.int domain. The domain was subsequently
265 changed to ip6.arpa. */
266
d7978c0f
JH
267 for (int i = 3; i >= 0; i--)
268 for (int j = 0; j < 32; j += 4)
152481a0
JH
269 g = string_fmt_append(g, "%x.", (v6[i] >> j) & 15);
270 g = string_catn(g, US"ip6.arpa.", 9);
059ec3d9
PH
271
272 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
273 with A6 records. However, it fell out of favour when they did. The
274 alternative was to construct a binary key, and look in ip6.arpa. I tried
275 to make this code do that, but I could not make it work on Solaris 8. The
276 resolver seems to lose the initial backslash somehow. However, now that
277 this style of reverse lookup has been dropped, it doesn't matter. These
278 lines are left here purely for historical interest. */
279
280 /**************************************************
281 Ustrcpy(pp, "\\[x");
282 pp += 3;
283
d7978c0f 284 for (int i = 0; i < 4; i++)
059ec3d9
PH
285 {
286 sprintf(pp, "%08X", v6[i]);
287 pp += 8;
288 }
f3ebb786 289 Ustrcpy(pp, US"].ip6.arpa.");
059ec3d9
PH
290 **************************************************/
291
292 }
293#endif
152481a0 294return string_from_gstring(g);
059ec3d9
PH
295}
296
297
298
299
2a407b17
JH
300/* Increment the aptr in dnss, checking against dnsa length.
301Return: TRUE for a bad result
302*/
303static BOOL
dd708fd7 304dnss_inc_aptr(const dns_answer * dnsa, dns_scan * dnss, unsigned delta)
2a407b17
JH
305{
306return (dnss->aptr += delta) >= dnsa->answer + dnsa->answerlen;
307}
308
059ec3d9
PH
309/*************************************************
310* Get next DNS record from answer block *
311*************************************************/
312
313/* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
e5a9dba6
PH
314RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
315scan the additional records, and reset == RESET_NEXT to get the next record.
316The result is in static storage which must be copied if it is to be preserved.
059ec3d9
PH
317
318Arguments:
319 dnsa pointer to dns answer block
320 dnss pointer to dns scan block
4c04137d 321 reset option specifying what portion to scan, as described above
059ec3d9
PH
322
323Returns: next dns record, or NULL when no more
324*/
325
326dns_record *
dd708fd7 327dns_next_rr(const dns_answer *dnsa, dns_scan *dnss, int reset)
059ec3d9 328{
dd708fd7 329const HEADER * h = (const HEADER *)dnsa->answer;
059ec3d9
PH
330int namelen;
331
2a407b17
JH
332char * trace = NULL;
333#ifdef rr_trace
334# define TRACE DEBUG(D_dns)
335#else
336trace = trace;
337# define TRACE if (FALSE)
338#endif
339
059ec3d9
PH
340/* Reset the saved data when requested to, and skip to the first required RR */
341
342if (reset != RESET_NEXT)
343 {
344 dnss->rrcount = ntohs(h->qdcount);
d093f8e5 345 TRACE debug_printf("%s: reset (Q rrcount %d)\n", __FUNCTION__, dnss->rrcount);
059ec3d9
PH
346 dnss->aptr = dnsa->answer + sizeof(HEADER);
347
348 /* Skip over questions; failure to expand the name just gives up */
349
350 while (dnss->rrcount-- > 0)
351 {
2a407b17 352 TRACE trace = "Q-namelen";
059ec3d9 353 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
2a407b17
JH
354 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
355 if (namelen < 0) goto null_return;
356 /* skip name & type & class */
357 TRACE trace = "Q-skip";
dd708fd7 358 if (dnss_inc_aptr(dnsa, dnss, namelen+4)) goto null_return;
059ec3d9
PH
359 }
360
361 /* Get the number of answer records. */
362
363 dnss->rrcount = ntohs(h->ancount);
d093f8e5 364 TRACE debug_printf("%s: reset (A rrcount %d)\n", __FUNCTION__, dnss->rrcount);
059ec3d9 365
e5a9dba6
PH
366 /* Skip over answers if we want to look at the authority section. Also skip
367 the NS records (i.e. authority section) if wanting to look at the additional
059ec3d9
PH
368 records. */
369
2a407b17
JH
370 if (reset == RESET_ADDITIONAL)
371 {
372 TRACE debug_printf("%s: additional\n", __FUNCTION__);
373 dnss->rrcount += ntohs(h->nscount);
d093f8e5 374 TRACE debug_printf("%s: reset (NS rrcount %d)\n", __FUNCTION__, dnss->rrcount);
2a407b17 375 }
e5a9dba6
PH
376
377 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
059ec3d9 378 {
2a407b17
JH
379 TRACE if (reset == RESET_AUTHORITY)
380 debug_printf("%s: authority\n", __FUNCTION__);
059ec3d9
PH
381 while (dnss->rrcount-- > 0)
382 {
2a407b17 383 TRACE trace = "A-namelen";
059ec3d9 384 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
2a407b17
JH
385 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
386 if (namelen < 0) goto null_return;
387 /* skip name, type, class & TTL */
388 TRACE trace = "A-hdr";
dd708fd7 389 if (dnss_inc_aptr(dnsa, dnss, namelen+8)) goto null_return;
059ec3d9 390 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
2a407b17
JH
391 /* skip over it */
392 TRACE trace = "A-skip";
dd708fd7 393 if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) goto null_return;
059ec3d9 394 }
2a407b17 395 dnss->rrcount = reset == RESET_AUTHORITY
e5a9dba6 396 ? ntohs(h->nscount) : ntohs(h->arcount);
d093f8e5
JH
397 TRACE debug_printf("%s: reset (%s rrcount %d)\n", __FUNCTION__,
398 reset == RESET_AUTHORITY ? "NS" : "AR", dnss->rrcount);
059ec3d9 399 }
2a407b17 400 TRACE debug_printf("%s: %d RRs to read\n", __FUNCTION__, dnss->rrcount);
059ec3d9 401 }
2a407b17
JH
402else
403 TRACE debug_printf("%s: next (%d left)\n", __FUNCTION__, dnss->rrcount);
059ec3d9 404
059ec3d9
PH
405/* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
406contains the number of RR records left. */
407
408if (dnss->rrcount-- <= 0) return NULL;
409
410/* If expanding the RR domain name fails, behave as if no more records
411(something safe). */
412
2a407b17 413TRACE trace = "R-namelen";
059ec3d9 414namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
2a407b17
JH
415 (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
416if (namelen < 0) goto null_return;
059ec3d9
PH
417
418/* Move the pointer past the name and fill in the rest of the data structure
419from the following bytes. */
420
2a407b17 421TRACE trace = "R-name";
dd708fd7 422if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return;
2a407b17
JH
423
424GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
425TRACE trace = "R-class";
dd708fd7 426if (dnss_inc_aptr(dnsa, dnss, 2)) goto null_return; /* Don't want class */
2a407b17
JH
427GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */
428GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
429dnss->srr.data = dnss->aptr; /* The record's data follows */
430
431/* Unchecked increment ok here since no further access on this iteration;
432will be checked on next at "R-name". */
433
434dnss->aptr += dnss->srr.size; /* Advance to next RR */
059ec3d9
PH
435
436/* Return a pointer to the dns_record structure within the dns_answer. This is
437for convenience so that the scans can use nice-looking for loops. */
438
7d8d08c4 439TRACE debug_printf("%s: return %s\n", __FUNCTION__, dns_text_type(dnss->srr.type));
2a407b17
JH
440return &dnss->srr;
441
442null_return:
d093f8e5
JH
443 TRACE debug_printf("%s: terminate (%d RRs left). Last op: %s; errno %d %s\n",
444 __FUNCTION__, dnss->rrcount, trace, errno, strerror(errno));
2a407b17
JH
445 dnss->rrcount = 0;
446 return NULL;
059ec3d9
PH
447}
448
449
8688d177 450/* Extract the AUTHORITY information from the answer. If the answer isn't
4c04137d 451authoritative (AA not set), we do not extract anything.
8db90b31 452
4c04137d 453The AUTHORITY section contains NS records if the name in question was found,
8688d177
JH
454it contains a SOA record otherwise. (This is just from experience and some
455tests, is there some spec?)
8db90b31 456
8688d177
JH
457Scan the whole AUTHORITY section, since it may contain other records
458(e.g. NSEC3) too.
459
460Return: name for the authority, in an allocated string, or NULL if none found */
09b80b4e
JH
461
462static const uschar *
463dns_extract_auth_name(const dns_answer * dnsa) /* FIXME: const dns_answer */
9820a77f 464{
09b80b4e 465dns_scan dnss;
dd708fd7 466const HEADER * h = (const HEADER *) dnsa->answer;
09b80b4e 467
8688d177 468if (h->nscount && h->aa)
d7978c0f 469 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
8688d177
JH
470 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
471 if (rr->type == (h->ancount ? T_NS : T_SOA))
472 return string_copy(rr->name);
09b80b4e 473return NULL;
9820a77f
HSHR
474}
475
476
059ec3d9
PH
477
478
479/*************************************************
1f4a55da
PP
480* Return whether AD bit set in DNS result *
481*************************************************/
482
483/* We do not perform DNSSEC work ourselves; if the administrator has installed
484a verifying resolver which sets AD as appropriate, though, we'll use that.
4c04137d 485(AD = Authentic Data, AA = Authoritative Answer)
1f4a55da
PP
486
487Argument: pointer to dns answer block
488Returns: bool indicating presence of AD bit
489*/
490
491BOOL
4a142059 492dns_is_secure(const dns_answer * dnsa)
1f4a55da
PP
493{
494#ifdef DISABLE_DNSSEC
495DEBUG(D_dns)
496 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
497return FALSE;
498#else
dd708fd7 499const HEADER * h = (const HEADER *) dnsa->answer;
09b80b4e
JH
500const uschar * auth_name;
501const uschar * trusted;
9820a77f 502
979c462e 503if (dnsa->answerlen < 0) return FALSE;
dce58c04
PP
504/* Beware that newer versions of glibc on Linux will filter out the ad bit
505unless their shiny new RES_TRUSTAD bit is set for the resolver. */
9820a77f 506if (h->ad) return TRUE;
9820a77f 507
979c462e
JH
508/* If the resolver we ask is authoritative for the domain in question, it may
509not set the AD but the AA bit. If we explicitly trust the resolver for that
510domain (via a domainlist in dns_trust_aa), we return TRUE to indicate a secure
511answer. */
9820a77f 512
09b80b4e
JH
513if ( !h->aa
514 || !dns_trust_aa
25bf2076
HSHR
515 || !(trusted = expand_string(dns_trust_aa))
516 || !*trusted
09b80b4e
JH
517 || !(auth_name = dns_extract_auth_name(dnsa))
518 || OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL,
94431adb 519 MCL_DOMAIN, TRUE, NULL)
09b80b4e
JH
520 )
521 return FALSE;
9820a77f 522
09b80b4e
JH
523DEBUG(D_dns) debug_printf("DNS faked the AD bit "
524 "(got AA and matched with dns_trust_aa (%s in %s))\n",
525 auth_name, dns_trust_aa);
9820a77f 526
09b80b4e 527return TRUE;
1f4a55da
PP
528#endif
529}
530
4a142059
JH
531static void
532dns_set_insecure(dns_answer * dnsa)
533{
e87c01c7 534#ifndef DISABLE_DNSSEC
4a142059 535HEADER * h = (HEADER *)dnsa->answer;
8688d177 536h->aa = h->ad = 0;
e87c01c7 537#endif
4a142059
JH
538}
539
221dff13
HSHR
540/************************************************
541 * Check whether the AA bit is set *
542 * We need this to warn if we requested AD *
4c04137d 543 * from an authoritative server *
221dff13
HSHR
544 ************************************************/
545
546BOOL
979c462e 547dns_is_aa(const dns_answer * dnsa)
221dff13 548{
e87c01c7
MH
549#ifdef DISABLE_DNSSEC
550return FALSE;
551#else
979c462e 552return dnsa->answerlen >= 0 && ((const HEADER *)dnsa->answer)->aa;
e87c01c7 553#endif
221dff13 554}
1f4a55da
PP
555
556
557
558/*************************************************
059ec3d9
PH
559* Turn DNS type into text *
560*************************************************/
561
885ccd3e
PH
562/* Turn the coded record type into a string for printing. All those that Exim
563uses should be included here.
059ec3d9
PH
564
565Argument: record type
566Returns: pointer to string
567*/
568
569uschar *
570dns_text_type(int t)
571{
572switch(t)
573 {
33397d19
PH
574 case T_A: return US"A";
575 case T_MX: return US"MX";
576 case T_AAAA: return US"AAAA";
577 case T_A6: return US"A6";
578 case T_TXT: return US"TXT";
eae0036b 579 case T_SPF: return US"SPF";
33397d19 580 case T_PTR: return US"PTR";
885ccd3e 581 case T_SOA: return US"SOA";
33397d19
PH
582 case T_SRV: return US"SRV";
583 case T_NS: return US"NS";
8e669ac1 584 case T_CNAME: return US"CNAME";
1e06383a 585 case T_TLSA: return US"TLSA";
33397d19 586 default: return US"?";
059ec3d9
PH
587 }
588}
589
590
591
592/*************************************************
593* Cache a failed DNS lookup result *
594*************************************************/
595
cabf3e99
JH
596static void
597dns_fail_tag(uschar * buf, const uschar * name, int dns_type)
598{
599res_state resp = os_get_dns_resolver_res();
7d8d08c4
JH
600
601/*XX buf needs to be 255 +1 + (max(typetext) == 5) +1 + max(chars_for_long-max) +1
602We truncate the name here for safety... could use a dynamic string. */
603
cabf3e99
JH
604sprintf(CS buf, "%.255s-%s-%lx", name, dns_text_type(dns_type),
605 (unsigned long) resp->options);
606}
607
608
059ec3d9
PH
609/* We cache failed lookup results so as not to experience timeouts many
610times for the same domain. We need to retain the resolver options because they
611may change. For successful lookups, we rely on resolver and/or name server
612caching.
613
614Arguments:
615 name the domain name
616 type the lookup type
7d8d08c4 617 expiry time TTL expires, or zero for unlimited
059ec3d9
PH
618 rc the return code
619
620Returns: the return code
621*/
622
3a2feed8 623/* we need: 255 +1 + (max(typetext) == 5) +1 + max(chars_for_long-max) +1 */
7d8d08c4 624#define DNS_FAILTAG_MAX 290
927e32d4 625#define DNS_FAILNODE_SIZE \
3a2feed8 626 (sizeof(expiring_data) + sizeof(tree_node) + DNS_FAILTAG_MAX)
7d8d08c4
JH
627
628static int
629dns_fail_return(const uschar * name, int type, time_t expiry, int rc)
630{
631uschar node_name[DNS_FAILTAG_MAX];
632tree_node * previous, * new;
633expiring_data * e;
634
635dns_fail_tag(node_name, name, type);
636if ((previous = tree_search(tree_dns_fails, node_name)))
637 e = previous->data.ptr;
638else
639 {
3a2feed8
JH
640 e = store_get_perm(DNS_FAILNODE_SIZE, is_tainted(name));
641 new = (void *)(e+1);
7d8d08c4 642 dns_fail_tag(new->name, name, type);
7d8d08c4
JH
643 new->data.ptr = e;
644 (void)tree_insertnode(&tree_dns_fails, new);
645 }
646
647DEBUG(D_dns) debug_printf(" %s neg-cache entry for %s, ttl %d\n",
648 previous ? "update" : "writing",
649 node_name, expiry ? (int)(expiry - time(NULL)) : -1);
650e->expiry = expiry;
651e->data.val = rc;
652return rc;
653}
654
655
656/* Return the cached result of a known-bad lookup, or -1.
657*/
059ec3d9 658static int
7d8d08c4 659dns_fail_cache_hit(const uschar * name, int type)
059ec3d9 660{
7d8d08c4
JH
661uschar node_name[DNS_FAILTAG_MAX];
662tree_node * previous;
663expiring_data * e;
664int val, rc;
665
666dns_fail_tag(node_name, name, type);
667if (!(previous = tree_search(tree_dns_fails, node_name)))
668 return -1;
669
670e = previous->data.ptr;
671val = e->data.val;
672rc = e->expiry && e->expiry <= time(NULL) ? -1 : val;
673
674DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: %scached value %s%s\n",
675 name, dns_text_type(type),
676 rc == -1 ? "" : "using ",
677 val == DNS_NOMATCH ? "DNS_NOMATCH" :
678 val == DNS_NODATA ? "DNS_NODATA" :
679 val == DNS_AGAIN ? "DNS_AGAIN" :
680 val == DNS_FAIL ? "DNS_FAIL" : "??",
681 rc == -1 ? " past valid time" : "");
682
059ec3d9
PH
683return rc;
684}
685
7d8d08c4
JH
686
687
7d8d08c4
JH
688/* This is really gross. The successful return value from res_search() is
689the packet length, which is stored in dnsa->answerlen. If we get a
690negative DNS reply then res_search() returns -1, which causes the bounds
691checks for name decompression to fail when it is treated as a packet
692length, which in turn causes the authority search to fail. The correct
693packet length has been lost inside libresolv, so we have to guess a
694replacement value. (The only way to fix this properly would be to
695re-implement res_search() and res_query() so that they don't muddle their
696success and packet length return values.) For added safety we only reset
697the packet length if the packet header looks plausible. */
698
b574c5ba 699static void
a713f766 700fake_dnsa_len_for_fail(dns_answer * dnsa, int type)
b574c5ba
JH
701{
702const HEADER * h = (const HEADER *)dnsa->answer;
703
704if ( h->qr == 1 /* a response */
705 && h->opcode == QUERY
706 && h->tc == 0 /* nmessage not truncated */
7d8d08c4 707 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
b574c5ba
JH
708 && ( ntohs(h->qdcount) == 1 /* one question record */
709 || f.running_in_test_harness)
710 && ntohs(h->ancount) == 0 /* no answer records */
711 && ntohs(h->nscount) >= 1) /* authority records */
712 {
a713f766
JH
713 DEBUG(D_dns) debug_printf("faking res_search(%s) response length as %d\n",
714 dns_text_type(type), (int)sizeof(dnsa->answer));
b574c5ba
JH
715 dnsa->answerlen = sizeof(dnsa->answer);
716 }
717}
718
719
720/* Return the TTL suitable for an NXDOMAIN result, which is given
721in the SOA. We hope that one was returned in the lookup, and do not
722bother doing a separate lookup; if not found return a forever TTL.
723*/
724
725time_t
a713f766 726dns_expire_from_soa(dns_answer * dnsa, int type)
b574c5ba
JH
727{
728dns_scan dnss;
729
a713f766 730fake_dnsa_len_for_fail(dnsa, type);
7d8d08c4
JH
731
732for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
733 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
734 ) if (rr->type == T_SOA)
735 {
736 const uschar * p = rr->data;
737 uschar discard_buf[256];
738 int len;
739 unsigned long ttl;
740
741 /* Skip the mname & rname strings */
742
743 if ((len = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
744 p, (DN_EXPAND_ARG4_TYPE)discard_buf, 256)) < 0)
745 break;
746 p += len;
747 if ((len = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
748 p, (DN_EXPAND_ARG4_TYPE)discard_buf, 256)) < 0)
749 break;
750 p += len;
751
752 /* Skip the SOA serial, refresh, retry & expire. Grab the TTL */
753
d70fc283 754 if (p > dnsa->answer + dnsa->answerlen - 5 * INT32SZ)
7d8d08c4 755 break;
d70fc283 756 p += 4 * INT32SZ;
7d8d08c4
JH
757 GETLONG(ttl, p);
758
759 return time(NULL) + ttl;
760 }
761DEBUG(D_dns) debug_printf("DNS: no SOA record found for neg-TTL\n");
762return 0;
763}
764
765
059ec3d9
PH
766/*************************************************
767* Do basic DNS lookup *
768*************************************************/
769
770/* Call the resolver to look up the given domain name, using the given type,
771and check the result. The error code TRY_AGAIN is documented as meaning "non-
4c04137d 772Authoritative Host not found, or SERVERFAIL". Sometimes there are badly set
059ec3d9
PH
773up nameservers that produce this error continually, so there is the option of
774providing a list of domains for which this is treated as a non-existent
775host.
776
75c121f0
JH
777The dns_answer structure is pretty big; enough to hold a max-sized DNS message
778- so best allocated from fast-release memory. As of writing, all our callers
779use a stack-auto variable.
780
059ec3d9
PH
781Arguments:
782 dnsa pointer to dns_answer structure
783 name name to look up
784 type type of DNS record required (T_A, T_MX, etc)
785
786Returns: DNS_SUCCEED successful lookup
787 DNS_NOMATCH name not found (NXDOMAIN)
788 or name contains illegal characters (if checking)
30e18802 789 or name is an IP address (for IP address lookup)
059ec3d9
PH
790 DNS_NODATA domain exists, but no data for this type (NODATA)
791 DNS_AGAIN soft failure, try again later
792 DNS_FAIL DNS failure
793*/
794
795int
7d8d08c4 796dns_basic_lookup(dns_answer * dnsa, const uschar * name, int type)
059ec3d9 797{
7d8d08c4 798int rc;
059ec3d9 799#ifndef STAND_ALONE
7d8d08c4 800const uschar * save_domain;
059ec3d9
PH
801#endif
802
059ec3d9
PH
803/* DNS lookup failures of any kind are cached in a tree. This is mainly so that
804a timeout on one domain doesn't happen time and time again for messages that
805have many addresses in the same domain. We rely on the resolver and name server
7d8d08c4
JH
806caching for successful lookups.
807*/
059ec3d9 808
7d8d08c4 809if ((rc = dns_fail_cache_hit(name, type)) > 0)
979c462e
JH
810 {
811 dnsa->answerlen = -1;
7d8d08c4 812 return rc;
979c462e 813 }
059ec3d9 814
8c5d388a 815#ifdef SUPPORT_I18N
9d4319df
JH
816/* Convert all names to a-label form before doing lookup */
817 {
818 uschar * alabel;
819 uschar * errstr = NULL;
766e7a65
JH
820 DEBUG(D_dns) if (string_is_utf8(name))
821 debug_printf("convert utf8 '%s' to alabel for for lookup\n", name);
9d4319df
JH
822 if ((alabel = string_domain_utf8_to_alabel(name, &errstr)), errstr)
823 {
824 DEBUG(D_dns)
37bf366e 825 debug_printf("DNS name '%s' utf8 conversion to alabel failed: %s\n", name,
9d4319df 826 errstr);
8768d548 827 f.host_find_failed_syntax = TRUE;
9d4319df
JH
828 return DNS_NOMATCH;
829 }
830 name = alabel;
831 }
832#endif
833
4c04137d 834/* If configured, check the hygiene of the name passed to lookup. Otherwise,
059ec3d9
PH
835although DNS lookups may give REFUSED at the lower level, some resolvers
836turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
837domains cannot be in the DNS. The check is now done by a regular expression;
838give it space for substring storage to save it having to get its own if the
839regex has substrings that are used - the default uses a conditional.
840
841This test is omitted for PTR records. These occur only in calls from the dnsdb
842lookup, which constructs the names itself, so they should be OK. Besides,
6219e0ec
SA
843bitstring labels don't conform to normal name syntax. (But they aren't used any
844more.) */
059ec3d9
PH
845
846#ifndef STAND_ALONE /* Omit this for stand-alone tests */
847
482d1455 848if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
059ec3d9 849 {
059ec3d9
PH
850 int ovector[3*(EXPAND_MAXN+1)];
851
476be7e2 852 dns_pattern_init();
6219e0ec 853 if (pcre_exec(regex_check_dns_names, NULL, CCS name, Ustrlen(name),
d093f8e5 854 0, PCRE_EOPT, ovector, nelem(ovector)) < 0)
059ec3d9
PH
855 {
856 DEBUG(D_dns)
857 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
858 dns_text_type(type));
8768d548 859 f.host_find_failed_syntax = TRUE;
059ec3d9
PH
860 return DNS_NOMATCH;
861 }
862 }
863
864#endif /* STAND_ALONE */
865
866/* Call the resolver; for an overlong response, res_search() will return the
bef5a11f
PH
867number of bytes the message would need, so we need to check for this case. The
868effect is to truncate overlong data.
869
30e18802
PH
870On some systems, res_search() will recognize "A-for-A" queries and return
871the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
872nameservers are also believed to do this. It is, of course, contrary to the
873specification of the DNS, so we lock it out. */
874
cc00f4af 875if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
30e18802
PH
876 return DNS_NOMATCH;
877
878/* If we are running in the test harness, instead of calling the normal resolver
bef5a11f
PH
879(res_search), we call fakens_search(), which recognizes certain special
880domains, and interfaces to a fake nameserver for certain special zones. */
881
979c462e 882h_errno = 0;
8768d548 883dnsa->answerlen = f.running_in_test_harness
d093f8e5
JH
884 ? fakens_search(name, type, dnsa->answer, sizeof(dnsa->answer))
885 : res_search(CCS name, C_IN, type, dnsa->answer, sizeof(dnsa->answer));
059ec3d9 886
d093f8e5 887if (dnsa->answerlen > (int) sizeof(dnsa->answer))
80a47a2c 888 {
9e7e0f6a
JH
889 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet"
890 " (size %d), truncating to %u.\n",
891 name, dns_text_type(type), dnsa->answerlen, (unsigned int) sizeof(dnsa->answer));
d093f8e5 892 dnsa->answerlen = sizeof(dnsa->answer);
80a47a2c 893 }
059ec3d9
PH
894
895if (dnsa->answerlen < 0) switch (h_errno)
896 {
897 case HOST_NOT_FOUND:
4b0fe319
JH
898 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
899 "returning DNS_NOMATCH\n", name, dns_text_type(type));
a713f766 900 return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), DNS_NOMATCH);
059ec3d9
PH
901
902 case TRY_AGAIN:
4b0fe319
JH
903 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
904 name, dns_text_type(type));
059ec3d9 905
4b0fe319 906 /* Cut this out for various test programs */
1dc92d5a 907#ifndef STAND_ALONE
4b0fe319
JH
908 save_domain = deliver_domain;
909 deliver_domain = string_copy(name); /* set $domain */
910 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
911 MCL_DOMAIN, TRUE, NULL);
912 deliver_domain = save_domain;
913 if (rc != OK)
914 {
915 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
7d8d08c4 916 return dns_fail_return(name, type, 0, DNS_AGAIN);
4b0fe319
JH
917 }
918 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
919 "DNS_NOMATCH\n", name);
a713f766 920 return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), DNS_NOMATCH);
059ec3d9 921
1dc92d5a 922#else /* For stand-alone tests */
7d8d08c4 923 return dns_fail_return(name, type, 0, DNS_AGAIN);
1dc92d5a 924#endif
059ec3d9
PH
925
926 case NO_RECOVERY:
4b0fe319
JH
927 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
928 "returning DNS_FAIL\n", name, dns_text_type(type));
7d8d08c4 929 return dns_fail_return(name, type, 0, DNS_FAIL);
059ec3d9
PH
930
931 case NO_DATA:
4b0fe319
JH
932 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
933 "returning DNS_NODATA\n", name, dns_text_type(type));
a713f766 934 return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), DNS_NODATA);
059ec3d9
PH
935
936 default:
4b0fe319
JH
937 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
938 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
7d8d08c4 939 return dns_fail_return(name, type, 0, DNS_FAIL);
059ec3d9
PH
940 }
941
942DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
943 name, dns_text_type(type));
944
945return DNS_SUCCEED;
946}
947
948
949
950
951/************************************************
952* Do a DNS lookup and handle CNAMES *
953************************************************/
954
955/* Look up the given domain name, using the given type. Follow CNAMEs if
956necessary, but only so many times. There aren't supposed to be CNAME chains in
957the DNS, but you are supposed to cope with them if you find them.
d8d9f930
JH
958By default, follow one CNAME since a resolver has been seen, faced with
959an MX request and a CNAME (to an A) but no MX present, returning the CNAME.
059ec3d9
PH
960
961The assumption is made that if the resolver gives back records of the
962requested type *and* a CNAME, we don't need to make another call to look up
963the CNAME. I can't see how it could return only some of the right records. If
964it's done a CNAME lookup in the past, it will have all of them; if not, it
965won't return any.
966
967If fully_qualified_name is not NULL, set it to point to the full name
968returned by the resolver, if this is different to what it is given, unless
969the returned name starts with "*" as some nameservers seem to be returning
766e7a65
JH
970wildcards in this form. In international mode "different" means "alabel
971forms are different".
059ec3d9
PH
972
973Arguments:
974 dnsa pointer to dns_answer structure
975 name domain name to look up
976 type DNS record type (T_A, T_MX, etc)
977 fully_qualified_name if not NULL, return the returned name here if its
978 contents are different (i.e. it must be preset)
979
980Returns: DNS_SUCCEED successful lookup
981 DNS_NOMATCH name not found
982 DNS_NODATA no data found
983 DNS_AGAIN soft failure, try again later
984 DNS_FAIL DNS failure
985*/
986
987int
1dc92d5a 988dns_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 989 const uschar **fully_qualified_name)
059ec3d9 990{
1dc92d5a 991const uschar *orig_name = name;
c85b3043 992BOOL secure_so_far = TRUE;
059ec3d9 993
d8d9f930
JH
994/* By default, assume the resolver follows CNAME chains (and returns NODATA for
995an unterminated one). If it also does that for a CNAME loop, fine; if it returns
996a CNAME (maybe the last?) whine about it. However, retain the coding for dumb
997resolvers hiding behind a config variable. Loop to follow CNAME chains so far,
998but no further... The testsuite tests the latter case, mostly assuming that the
999former will work. */
059ec3d9 1000
d7978c0f 1001for (int i = 0; i <= dns_cname_loops; i++)
059ec3d9 1002 {
806c3df9 1003 uschar * data;
d7978c0f 1004 dns_record cname_rr, type_rr;
059ec3d9 1005 dns_scan dnss;
1b76ad22 1006 int rc;
059ec3d9
PH
1007
1008 /* DNS lookup failures get passed straight back. */
1009
dd708fd7
JH
1010 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED)
1011 return rc;
059ec3d9
PH
1012
1013 /* We should have either records of the required type, or a CNAME record,
1014 or both. We need to know whether both exist for getting the fully qualified
1015 name, but avoid scanning more than necessary. Note that we must copy the
1016 contents of any rr blocks returned by dns_next_rr() as they use the same
1017 area in the dnsa block. */
1018
1019 cname_rr.data = type_rr.data = NULL;
d7978c0f 1020 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
8688d177 1021 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
059ec3d9
PH
1022 if (rr->type == type)
1023 {
1024 if (type_rr.data == NULL) type_rr = *rr;
1025 if (cname_rr.data != NULL) break;
1026 }
dd708fd7
JH
1027 else if (rr->type == T_CNAME)
1028 cname_rr = *rr;
059ec3d9 1029
a2042e78
PH
1030 /* For the first time round this loop, if a CNAME was found, take the fully
1031 qualified name from it; otherwise from the first data record, if present. */
059ec3d9 1032
dd708fd7 1033 if (i == 0 && fully_qualified_name)
059ec3d9 1034 {
dd708fd7
JH
1035 uschar * rr_name = cname_rr.data
1036 ? cname_rr.name : type_rr.data ? type_rr.name : NULL;
766e7a65
JH
1037 if ( rr_name
1038 && Ustrcmp(rr_name, *fully_qualified_name) != 0
1039 && rr_name[0] != '*'
8c5d388a 1040#ifdef SUPPORT_I18N
766e7a65
JH
1041 && ( !string_is_utf8(*fully_qualified_name)
1042 || Ustrcmp(rr_name,
1043 string_domain_utf8_to_alabel(*fully_qualified_name, NULL)) != 0
1044 )
1045#endif
1046 )
1047 *fully_qualified_name = string_copy_dnsdomain(rr_name);
059ec3d9
PH
1048 }
1049
1050 /* If any data records of the correct type were found, we are done. */
1051
806c3df9 1052 if (type_rr.data)
c85b3043
JH
1053 {
1054 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
4a142059 1055 dns_set_insecure(dnsa);
c85b3043
JH
1056 return DNS_SUCCEED;
1057 }
059ec3d9
PH
1058
1059 /* If there are no data records, we need to re-scan the DNS using the
1060 domain given in the CNAME record, which should exist (otherwise we should
1061 have had a failure from dns_lookup). However code against the possibility of
1062 its not existing. */
1063
806c3df9
JH
1064 if (!cname_rr.data)
1065 return DNS_FAIL;
1066
f3ebb786
JH
1067 /* DNS data comes from the outside, hence tainted */
1068 data = store_get(256, TRUE);
1b76ad22
JH
1069 if (dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
1070 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, 256) < 0)
806c3df9 1071 return DNS_FAIL;
059ec3d9 1072 name = data;
a2042e78 1073
c85b3043
JH
1074 if (!dns_is_secure(dnsa))
1075 secure_so_far = FALSE;
1076
a2042e78 1077 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
059ec3d9
PH
1078 } /* Loop back to do another lookup */
1079
1080/*Control reaches here after 10 times round the CNAME loop. Something isn't
1081right... */
1082
1083log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
1084return DNS_FAIL;
1085}
1086
1087
1088
33397d19
PH
1089
1090
1091
1092/************************************************
1093* Do a DNS lookup and handle virtual types *
1094************************************************/
1095
9820a77f 1096/* This function handles some invented "lookup types" that synthesize features
8e669ac1 1097not available in the basic types. The special types all have negative values.
33397d19
PH
1098Positive type values are passed straight on to dns_lookup().
1099
1100Arguments:
1101 dnsa pointer to dns_answer structure
1102 name domain name to look up
1103 type DNS record type (T_A, T_MX, etc or a "special")
1104 fully_qualified_name if not NULL, return the returned name here if its
1105 contents are different (i.e. it must be preset)
1106
1107Returns: DNS_SUCCEED successful lookup
1108 DNS_NOMATCH name not found
1109 DNS_NODATA no data found
1110 DNS_AGAIN soft failure, try again later
1111 DNS_FAIL DNS failure
1112*/
1113
1114int
1dc92d5a 1115dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
55414b25 1116 const uschar **fully_qualified_name)
33397d19 1117{
d2a2c69b 1118switch (type)
e5a9dba6 1119 {
d2a2c69b
JH
1120 /* The "mx hosts only" type doesn't require any special action here */
1121 case T_MXH:
1705dd20 1122 return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
d2a2c69b
JH
1123
1124 /* Find nameservers for the domain or the nearest enclosing zone, excluding
1125 the root servers. */
1126 case T_ZNS:
1705dd20
JH
1127 type = T_NS;
1128 /* FALLTHROUGH */
d2a2c69b 1129 case T_SOA:
1705dd20
JH
1130 {
1131 const uschar *d = name;
1132 while (d != 0)
1133 {
1134 int rc = dns_lookup(dnsa, d, type, fully_qualified_name);
1135 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
1136 while (*d != 0 && *d != '.') d++;
1137 if (*d++ == 0) break;
1138 }
1139 return DNS_NOMATCH;
1140 }
d2a2c69b
JH
1141
1142 /* Try to look up the Client SMTP Authorization SRV record for the name. If
1143 there isn't one, search from the top downwards for a CSA record in a parent
1144 domain, which might be making assertions about subdomains. If we find a record
1145 we set fully_qualified_name to whichever lookup succeeded, so that the caller
1146 can tell whether to look at the explicit authorization field or the subdomain
1147 assertion field. */
1148 case T_CSA:
1705dd20 1149 {
cab0c277 1150 uschar *srvname, *namesuff, *tld;
1705dd20
JH
1151 int priority, weight, port;
1152 int limit, rc, i;
1153 BOOL ipv6;
1154 dns_record *rr;
1155 dns_scan dnss;
1156
1157 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
1158
1159 srvname = string_sprintf("_client._smtp.%s", name);
1160 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1161 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
1162 {
1163 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
1164 return rc;
1165 }
d2a2c69b 1166
1705dd20
JH
1167 /* Search for CSA subdomain assertion SRV records from the top downwards,
1168 starting with the 2nd level domain. This order maximizes cache-friendliness.
1169 We skip the top level domains to avoid loading their nameservers and because
1170 we know they'll never have CSA SRV records. */
d2a2c69b 1171
1705dd20
JH
1172 namesuff = Ustrrchr(name, '.');
1173 if (namesuff == NULL) return DNS_NOMATCH;
1174 tld = namesuff + 1;
1175 ipv6 = FALSE;
1176 limit = dns_csa_search_limit;
1177
1178 /* Use more appropriate search parameters if we are in the reverse DNS. */
1179
1180 if (strcmpic(namesuff, US".arpa") == 0)
1181 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
1182 {
1183 namesuff -= 8;
d2a2c69b 1184 tld = namesuff + 1;
1705dd20
JH
1185 limit = 3;
1186 }
1187 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
1188 {
1189 namesuff -= 4;
1190 tld = namesuff + 1;
1191 ipv6 = TRUE;
1192 limit = 3;
1193 }
d2a2c69b 1194
1705dd20 1195 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
d2a2c69b 1196
1705dd20
JH
1197 /* Do not perform the search if the top level or 2nd level domains do not
1198 exist. This is quite common, and when it occurs all the search queries would
1199 go to the root or TLD name servers, which is not friendly. So we check the
1200 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
1201 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
1202 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
1203 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
1204
1205 if (rc == DNS_NOMATCH)
1206 {
a713f766 1207 fake_dnsa_len_for_fail(dnsa, T_CSA);
1705dd20
JH
1208
1209 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
8688d177 1210 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1705dd20
JH
1211 )
1212 if (rr->type != T_SOA) continue;
1213 else if (strcmpic(rr->name, US"") == 0 ||
1214 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
1215 else break;
1216 }
d2a2c69b 1217
1705dd20
JH
1218 for (i = 0; i < limit; i++)
1219 {
1220 if (ipv6)
1221 {
1222 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
1223 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
1224 namesuff -= 8;
1225 if (namesuff <= name) return DNS_NOMATCH;
1226 }
1227 else
1228 /* Find the start of the preceding domain name label. */
1229 do
1230 if (--namesuff <= name) return DNS_NOMATCH;
1231 while (*namesuff != '.');
1232
1233 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
1234
1235 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
1236 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1237 if (rc == DNS_AGAIN) return rc;
1238 if (rc != DNS_SUCCEED) continue;
1239
1240 /* Check that the SRV record we have found is worth returning. We don't
1241 just return the first one we find, because some lower level SRV record
1242 might make stricter assertions than its parent domain. */
1243
1244 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
8688d177 1245 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1705dd20 1246 {
dd708fd7 1247 const uschar * p = rr->data;
d2a2c69b 1248
1705dd20 1249 /* Extract the numerical SRV fields (p is incremented) */
1705dd20
JH
1250 GETSHORT(priority, p);
1251 GETSHORT(weight, p); weight = weight; /* compiler quietening */
1252 GETSHORT(port, p);
d2a2c69b 1253
1705dd20
JH
1254 /* Check the CSA version number */
1255 if (priority != 1) continue;
d2a2c69b 1256
1705dd20
JH
1257 /* If it's making an interesting assertion, return this response. */
1258 if (port & 1)
d2a2c69b 1259 {
1705dd20
JH
1260 *fully_qualified_name = namesuff + 1;
1261 return DNS_SUCCEED;
d2a2c69b 1262 }
d2a2c69b 1263 }
1705dd20
JH
1264 }
1265 return DNS_NOMATCH;
1266 }
e5a9dba6 1267
d2a2c69b 1268 default:
1705dd20
JH
1269 if (type >= 0)
1270 return dns_lookup(dnsa, name, type, fully_qualified_name);
e5a9dba6
PH
1271 }
1272
33397d19
PH
1273/* Control should never reach here */
1274
1275return DNS_FAIL;
1276}
1277
1278
1279
059ec3d9
PH
1280
1281
1282/*************************************************
1283* Get address(es) from DNS record *
1284*************************************************/
1285
d57d474f 1286/* The record type is either T_A for an IPv4 address or T_AAAA for an IPv6 address.
059ec3d9
PH
1287
1288Argument:
1289 dnsa the DNS answer block
1290 rr the RR
1291
e1a3f32f 1292Returns: pointer to a chain of dns_address items; NULL when the dnsa was overrun
059ec3d9
PH
1293*/
1294
1295dns_address *
1296dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1297{
e1a3f32f
JH
1298dns_address * yield = NULL;
1299uschar * dnsa_lim = dnsa->answer + dnsa->answerlen;
059ec3d9
PH
1300
1301if (rr->type == T_A)
1302 {
d2a2c69b 1303 uschar *p = US rr->data;
e1a3f32f
JH
1304 if (p + 4 <= dnsa_lim)
1305 {
f3ebb786
JH
1306 /* the IP is not regarded as tainted */
1307 yield = store_get(sizeof(dns_address) + 20, FALSE);
e1a3f32f
JH
1308 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1309 yield->next = NULL;
1310 }
059ec3d9
PH
1311 }
1312
1313#if HAVE_IPV6
1314
059ec3d9
PH
1315else
1316 {
e1a3f32f
JH
1317 if (rr->data + 16 <= dnsa_lim)
1318 {
d57d474f 1319 struct in6_addr in6;
d7978c0f 1320 for (int i = 0; i < 16; i++) in6.s6_addr[i] = rr->data[i];
f3ebb786 1321 yield = store_get(sizeof(dns_address) + 50, FALSE);
d57d474f 1322 inet_ntop(AF_INET6, &in6, CS yield->address, 50);
e1a3f32f
JH
1323 yield->next = NULL;
1324 }
059ec3d9
PH
1325 }
1326#endif /* HAVE_IPV6 */
1327
1328return yield;
1329}
1330
476be7e2
JH
1331
1332
1333void
1334dns_pattern_init(void)
1335{
1336if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1337 regex_check_dns_names =
1338 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);
1339}
1340
8c51eead
JH
1341/* vi: aw ai sw=2
1342*/
059ec3d9 1343/* End of dns.c */