Support service names for tls_on_connect_ports. Bug 72
[exim.git] / src / src / host.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
c4ceed07 5/* Copyright (c) University of Cambridge 1995 - 2012 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions for finding hosts, either by gethostbyname(), gethostbyaddr(), or
9directly via the DNS. When IPv6 is supported, getipnodebyname() and
10getipnodebyaddr() may be used instead of gethostbyname() and gethostbyaddr(),
11if the newer functions are available. This module also contains various other
12functions concerned with hosts and addresses, and a random number function,
13used for randomizing hosts with equal MXs but available for use in other parts
14of Exim. */
15
16
17#include "exim.h"
18
19
20/* Static variable for preserving the list of interface addresses in case it is
21used more than once. */
22
23static ip_address_item *local_interface_data = NULL;
24
25
26#ifdef USE_INET_NTOA_FIX
27/*************************************************
28* Replacement for broken inet_ntoa() *
29*************************************************/
30
31/* On IRIX systems, gcc uses a different structure passing convention to the
32native libraries. This causes inet_ntoa() to always yield 0.0.0.0 or
33255.255.255.255. To get round this, we provide a private version of the
34function here. It is used only if USE_INET_NTOA_FIX is set, which should happen
35only when gcc is in use on an IRIX system. Code send to me by J.T. Breitner,
36with these comments:
37
38 code by Stuart Levy
39 as seen in comp.sys.sgi.admin
40
2548ba04
PH
41August 2005: Apparently this is also needed for AIX systems; USE_INET_NTOA_FIX
42should now be set for them as well.
43
059ec3d9
PH
44Arguments: sa an in_addr structure
45Returns: pointer to static text string
46*/
47
48char *
49inet_ntoa(struct in_addr sa)
50{
51static uschar addr[20];
52sprintf(addr, "%d.%d.%d.%d",
53 (US &sa.s_addr)[0],
54 (US &sa.s_addr)[1],
55 (US &sa.s_addr)[2],
56 (US &sa.s_addr)[3]);
57 return addr;
58}
59#endif
60
61
62
63/*************************************************
64* Random number generator *
65*************************************************/
66
67/* This is a simple pseudo-random number generator. It does not have to be
68very good for the uses to which it is put. When running the regression tests,
69start with a fixed seed.
70
17c76198 71If you need better, see vaguely_random_number() which is potentially stronger,
9e3331ea
TK
72if a crypto library is available, but might end up just calling this instead.
73
059ec3d9
PH
74Arguments:
75 limit: one more than the largest number required
76
77Returns: a pseudo-random number in the range 0 to limit-1
78*/
79
80int
81random_number(int limit)
82{
9e3331ea
TK
83if (limit < 1)
84 return 0;
059ec3d9
PH
85if (random_seed == 0)
86 {
87 if (running_in_test_harness) random_seed = 42; else
88 {
89 int p = (int)getpid();
90 random_seed = (int)time(NULL) ^ ((p << 16) | p);
91 }
92 }
93random_seed = 1103515245 * random_seed + 12345;
94return (unsigned int)(random_seed >> 16) % limit;
95}
96
97
98
99/*************************************************
e7726cbf
PH
100* Replace gethostbyname() when testing *
101*************************************************/
102
103/* This function is called instead of gethostbyname(), gethostbyname2(), or
7a546ad5
PH
104getipnodebyname() when running in the test harness. It recognizes the name
105"manyhome.test.ex" and generates a humungous number of IP addresses. It also
106recognizes an unqualified "localhost" and forces it to the appropriate loopback
107address. IP addresses are treated as literals. For other names, it uses the DNS
75e0e026
PH
108to find the host name. In the test harness, this means it will access only the
109fake DNS resolver.
e7726cbf
PH
110
111Arguments:
112 name the host name or a textual IP address
113 af AF_INET or AF_INET6
114 error_num where to put an error code:
115 HOST_NOT_FOUND/TRY_AGAIN/NO_RECOVERY/NO_DATA
116
117Returns: a hostent structure or NULL for an error
118*/
119
120static struct hostent *
121host_fake_gethostbyname(uschar *name, int af, int *error_num)
122{
70d67ad3 123#if HAVE_IPV6
e7726cbf 124int alen = (af == AF_INET)? sizeof(struct in_addr):sizeof(struct in6_addr);
70d67ad3
PH
125#else
126int alen = sizeof(struct in_addr);
127#endif
128
129int ipa;
e7726cbf
PH
130uschar *lname = name;
131uschar *adds;
132uschar **alist;
133struct hostent *yield;
134dns_answer dnsa;
135dns_scan dnss;
136dns_record *rr;
137
138DEBUG(D_host_lookup)
139 debug_printf("using host_fake_gethostbyname for %s (%s)\n", name,
140 (af == AF_INET)? "IPv4" : "IPv6");
141
7a546ad5
PH
142/* Handle the name that needs a vast number of IP addresses */
143
144if (Ustrcmp(name, "manyhome.test.ex") == 0 && af == AF_INET)
145 {
146 int i, j;
147 yield = store_get(sizeof(struct hostent));
148 alist = store_get(2049 * sizeof(char *));
149 adds = store_get(2048 * alen);
150 yield->h_name = CS name;
151 yield->h_aliases = NULL;
152 yield->h_addrtype = af;
153 yield->h_length = alen;
154 yield->h_addr_list = CSS alist;
155 for (i = 104; i <= 111; i++)
156 {
157 for (j = 0; j <= 255; j++)
158 {
159 *alist++ = adds;
160 *adds++ = 10;
161 *adds++ = 250;
162 *adds++ = i;
163 *adds++ = j;
164 }
165 }
166 *alist = NULL;
167 return yield;
168 }
169
170/* Handle unqualified "localhost" */
171
e7726cbf
PH
172if (Ustrcmp(name, "localhost") == 0)
173 lname = (af == AF_INET)? US"127.0.0.1" : US"::1";
174
175/* Handle a literal IP address */
176
177ipa = string_is_ip_address(lname, NULL);
178if (ipa != 0)
179 {
180 if ((ipa == 4 && af == AF_INET) ||
181 (ipa == 6 && af == AF_INET6))
182 {
183 int i, n;
184 int x[4];
185 yield = store_get(sizeof(struct hostent));
186 alist = store_get(2 * sizeof(char *));
187 adds = store_get(alen);
188 yield->h_name = CS name;
189 yield->h_aliases = NULL;
190 yield->h_addrtype = af;
191 yield->h_length = alen;
192 yield->h_addr_list = CSS alist;
193 *alist++ = adds;
194 n = host_aton(lname, x);
195 for (i = 0; i < n; i++)
196 {
197 int y = x[i];
198 *adds++ = (y >> 24) & 255;
199 *adds++ = (y >> 16) & 255;
200 *adds++ = (y >> 8) & 255;
201 *adds++ = y & 255;
202 }
203 *alist = NULL;
204 }
205
206 /* Wrong kind of literal address */
207
208 else
209 {
210 *error_num = HOST_NOT_FOUND;
211 return NULL;
212 }
213 }
214
215/* Handle a host name */
216
217else
218 {
219 int type = (af == AF_INET)? T_A:T_AAAA;
220 int rc = dns_lookup(&dnsa, lname, type, NULL);
221 int count = 0;
222
4e0983dc
JH
223 lookup_dnssec_authenticated = NULL;
224
e7726cbf
PH
225 switch(rc)
226 {
227 case DNS_SUCCEED: break;
228 case DNS_NOMATCH: *error_num = HOST_NOT_FOUND; return NULL;
229 case DNS_NODATA: *error_num = NO_DATA; return NULL;
230 case DNS_AGAIN: *error_num = TRY_AGAIN; return NULL;
231 default:
232 case DNS_FAIL: *error_num = NO_RECOVERY; return NULL;
233 }
234
235 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
236 rr != NULL;
237 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
238 {
239 if (rr->type == type) count++;
240 }
241
242 yield = store_get(sizeof(struct hostent));
243 alist = store_get((count + 1) * sizeof(char **));
244 adds = store_get(count *alen);
245
246 yield->h_name = CS name;
247 yield->h_aliases = NULL;
248 yield->h_addrtype = af;
249 yield->h_length = alen;
250 yield->h_addr_list = CSS alist;
251
252 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
253 rr != NULL;
254 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
255 {
256 int i, n;
257 int x[4];
258 dns_address *da;
259 if (rr->type != type) continue;
260 da = dns_address_from_rr(&dnsa, rr);
261 *alist++ = adds;
262 n = host_aton(da->address, x);
263 for (i = 0; i < n; i++)
264 {
265 int y = x[i];
266 *adds++ = (y >> 24) & 255;
267 *adds++ = (y >> 16) & 255;
268 *adds++ = (y >> 8) & 255;
269 *adds++ = y & 255;
270 }
271 }
272 *alist = NULL;
273 }
274
275return yield;
276}
277
278
279
280/*************************************************
059ec3d9
PH
281* Build chain of host items from list *
282*************************************************/
283
284/* This function builds a chain of host items from a textual list of host
285names. It does not do any lookups. If randomize is true, the chain is build in
286a randomized order. There may be multiple groups of independently randomized
287hosts; they are delimited by a host name consisting of just "+".
288
289Arguments:
290 anchor anchor for the chain
291 list text list
292 randomize TRUE for randomizing
293
294Returns: nothing
295*/
296
297void
298host_build_hostlist(host_item **anchor, uschar *list, BOOL randomize)
299{
300int sep = 0;
301int fake_mx = MX_NONE; /* This value is actually -1 */
302uschar *name;
303uschar buffer[1024];
304
305if (list == NULL) return;
306if (randomize) fake_mx--; /* Start at -2 for randomizing */
307
308*anchor = NULL;
309
310while ((name = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
311 {
312 host_item *h;
313
314 if (name[0] == '+' && name[1] == 0) /* "+" delimits a randomized group */
315 { /* ignore if not randomizing */
316 if (randomize) fake_mx--;
317 continue;
318 }
319
320 h = store_get(sizeof(host_item));
321 h->name = string_copy(name);
322 h->address = NULL;
323 h->port = PORT_NONE;
324 h->mx = fake_mx;
325 h->sort_key = randomize? (-fake_mx)*1000 + random_number(1000) : 0;
326 h->status = hstatus_unknown;
327 h->why = hwhy_unknown;
328 h->last_try = 0;
329
330 if (*anchor == NULL)
331 {
332 h->next = NULL;
333 *anchor = h;
334 }
335 else
336 {
337 host_item *hh = *anchor;
338 if (h->sort_key < hh->sort_key)
339 {
340 h->next = hh;
341 *anchor = h;
342 }
343 else
344 {
345 while (hh->next != NULL && h->sort_key >= (hh->next)->sort_key)
346 hh = hh->next;
347 h->next = hh->next;
348 hh->next = h;
349 }
350 }
351 }
352}
353
354
355
356
357
358/*************************************************
359* Extract port from address string *
360*************************************************/
361
362/* In the spool file, and in the -oMa and -oMi options, a host plus port is
363given as an IP address followed by a dot and a port number. This function
364decodes this.
365
366An alternative format for the -oMa and -oMi options is [ip address]:port which
367is what Exim 4 uses for output, because it seems to becoming commonly used,
368whereas the dot form confuses some programs/people. So we recognize that form
369too.
370
371Argument:
372 address points to the string; if there is a port, the '.' in the string
373 is overwritten with zero to terminate the address; if the string
374 is in the [xxx]:ppp format, the address is shifted left and the
375 brackets are removed
376
377Returns: 0 if there is no port, else the port number. If there's a syntax
378 error, leave the incoming address alone, and return 0.
379*/
380
381int
7cd1141b 382host_address_extract_port(uschar *address)
059ec3d9
PH
383{
384int port = 0;
385uschar *endptr;
386
387/* Handle the "bracketed with colon on the end" format */
388
389if (*address == '[')
390 {
391 uschar *rb = address + 1;
392 while (*rb != 0 && *rb != ']') rb++;
393 if (*rb++ == 0) return 0; /* Missing ]; leave invalid address */
394 if (*rb == ':')
395 {
396 port = Ustrtol(rb + 1, &endptr, 10);
397 if (*endptr != 0) return 0; /* Invalid port; leave invalid address */
398 }
399 else if (*rb != 0) return 0; /* Bad syntax; leave invalid address */
400 memmove(address, address + 1, rb - address - 2);
401 rb[-2] = 0;
402 }
403
404/* Handle the "dot on the end" format */
405
406else
407 {
408 int skip = -3; /* Skip 3 dots in IPv4 addresses */
409 address--;
410 while (*(++address) != 0)
411 {
412 int ch = *address;
413 if (ch == ':') skip = 0; /* Skip 0 dots in IPv6 addresses */
414 else if (ch == '.' && skip++ >= 0) break;
415 }
416 if (*address == 0) return 0;
417 port = Ustrtol(address + 1, &endptr, 10);
418 if (*endptr != 0) return 0; /* Invalid port; leave invalid address */
419 *address = 0;
420 }
421
422return port;
423}
424
425
7cd1141b
PH
426/*************************************************
427* Get port from a host item's name *
428*************************************************/
429
430/* This function is called when finding the IP address for a host that is in a
431list of hosts explicitly configured, such as in the manualroute router, or in a
432fallback hosts list. We see if there is a port specification at the end of the
433host name, and if so, remove it. A minimum length of 3 is required for the
434original name; nothing shorter is recognized as having a port.
435
436We test for a name ending with a sequence of digits; if preceded by colon we
437have a port if the character before the colon is ] and the name starts with [
438or if there are no other colons in the name (i.e. it's not an IPv6 address).
439
440Arguments: pointer to the host item
441Returns: a port number or PORT_NONE
442*/
443
444int
445host_item_get_port(host_item *h)
446{
447uschar *p;
448int port, x;
449int len = Ustrlen(h->name);
450
451if (len < 3 || (p = h->name + len - 1, !isdigit(*p))) return PORT_NONE;
452
453/* Extract potential port number */
454
455port = *p-- - '0';
456x = 10;
457
458while (p > h->name + 1 && isdigit(*p))
459 {
460 port += (*p-- - '0') * x;
461 x *= 10;
462 }
463
464/* The smallest value of p at this point is h->name + 1. */
465
466if (*p != ':') return PORT_NONE;
467
468if (p[-1] == ']' && h->name[0] == '[')
469 h->name = string_copyn(h->name + 1, p - h->name - 2);
470else if (Ustrchr(h->name, ':') == p)
471 h->name = string_copyn(h->name, p - h->name);
472else return PORT_NONE;
473
474DEBUG(D_route|D_host_lookup) debug_printf("host=%s port=%d\n", h->name, port);
475return port;
476}
477
478
059ec3d9
PH
479
480#ifndef STAND_ALONE /* Omit when standalone testing */
481
482/*************************************************
483* Build sender_fullhost and sender_rcvhost *
484*************************************************/
485
486/* This function is called when sender_host_name and/or sender_helo_name
487have been set. Or might have been set - for a local message read off the spool
488they won't be. In that case, do nothing. Otherwise, set up the fullhost string
489as follows:
490
491(a) No sender_host_name or sender_helo_name: "[ip address]"
492(b) Just sender_host_name: "host_name [ip address]"
82c19f95
PH
493(c) Just sender_helo_name: "(helo_name) [ip address]" unless helo is IP
494 in which case: "[ip address}"
495(d) The two are identical: "host_name [ip address]" includes helo = IP
059ec3d9
PH
496(e) The two are different: "host_name (helo_name) [ip address]"
497
498If log_incoming_port is set, the sending host's port number is added to the IP
499address.
500
501This function also builds sender_rcvhost for use in Received: lines, whose
502syntax is a bit different. This value also includes the RFC 1413 identity.
503There wouldn't be two different variables if I had got all this right in the
504first place.
505
506Because this data may survive over more than one incoming SMTP message, it has
507to be in permanent store.
508
509Arguments: none
510Returns: nothing
511*/
512
513void
514host_build_sender_fullhost(void)
515{
82c19f95 516BOOL show_helo = TRUE;
059ec3d9 517uschar *address;
82c19f95 518int len;
059ec3d9
PH
519int old_pool = store_pool;
520
521if (sender_host_address == NULL) return;
522
523store_pool = POOL_PERM;
524
525/* Set up address, with or without the port. After discussion, it seems that
526the only format that doesn't cause trouble is [aaaa]:pppp. However, we can't
527use this directly as the first item for Received: because it ain't an RFC 2822
528domain. Sigh. */
529
530address = string_sprintf("[%s]:%d", sender_host_address, sender_host_port);
531if ((log_extra_selector & LX_incoming_port) == 0 || sender_host_port <= 0)
532 *(Ustrrchr(address, ':')) = 0;
533
82c19f95
PH
534/* If there's no EHLO/HELO data, we can't show it. */
535
536if (sender_helo_name == NULL) show_helo = FALSE;
537
538/* If HELO/EHLO was followed by an IP literal, it's messy because of two
539features of IPv6. Firstly, there's the "IPv6:" prefix (Exim is liberal and
540doesn't require this, for historical reasons). Secondly, IPv6 addresses may not
541be given in canonical form, so we have to canonicize them before comparing. As
542it happens, the code works for both IPv4 and IPv6. */
543
544else if (sender_helo_name[0] == '[' &&
545 sender_helo_name[(len=Ustrlen(sender_helo_name))-1] == ']')
546 {
547 int offset = 1;
548 uschar *helo_ip;
549
550 if (strncmpic(sender_helo_name + 1, US"IPv6:", 5) == 0) offset += 5;
551 if (strncmpic(sender_helo_name + 1, US"IPv4:", 5) == 0) offset += 5;
552
553 helo_ip = string_copyn(sender_helo_name + offset, len - offset - 1);
554
555 if (string_is_ip_address(helo_ip, NULL) != 0)
556 {
557 int x[4], y[4];
558 int sizex, sizey;
559 uschar ipx[48], ipy[48]; /* large enough for full IPv6 */
560
561 sizex = host_aton(helo_ip, x);
562 sizey = host_aton(sender_host_address, y);
563
564 (void)host_nmtoa(sizex, x, -1, ipx, ':');
565 (void)host_nmtoa(sizey, y, -1, ipy, ':');
566
567 if (strcmpic(ipx, ipy) == 0) show_helo = FALSE;
568 }
569 }
570
059ec3d9
PH
571/* Host name is not verified */
572
573if (sender_host_name == NULL)
574 {
575 uschar *portptr = Ustrstr(address, "]:");
576 int size = 0;
577 int ptr = 0;
578 int adlen; /* Sun compiler doesn't like ++ in initializers */
579
580 adlen = (portptr == NULL)? Ustrlen(address) : (++portptr - address);
581 sender_fullhost = (sender_helo_name == NULL)? address :
582 string_sprintf("(%s) %s", sender_helo_name, address);
583
584 sender_rcvhost = string_cat(NULL, &size, &ptr, address, adlen);
585
82c19f95 586 if (sender_ident != NULL || show_helo || portptr != NULL)
059ec3d9
PH
587 {
588 int firstptr;
589 sender_rcvhost = string_cat(sender_rcvhost, &size, &ptr, US" (", 2);
590 firstptr = ptr;
591
592 if (portptr != NULL)
593 sender_rcvhost = string_append(sender_rcvhost, &size, &ptr, 2, US"port=",
594 portptr + 1);
595
82c19f95 596 if (show_helo)
059ec3d9
PH
597 sender_rcvhost = string_append(sender_rcvhost, &size, &ptr, 2,
598 (firstptr == ptr)? US"helo=" : US" helo=", sender_helo_name);
599
600 if (sender_ident != NULL)
601 sender_rcvhost = string_append(sender_rcvhost, &size, &ptr, 2,
602 (firstptr == ptr)? US"ident=" : US" ident=", sender_ident);
603
604 sender_rcvhost = string_cat(sender_rcvhost, &size, &ptr, US")", 1);
605 }
606
607 sender_rcvhost[ptr] = 0; /* string_cat() always leaves room */
608
609 /* Release store, because string_cat allocated a minimum of 100 bytes that
610 are rarely completely used. */
611
612 store_reset(sender_rcvhost + ptr + 1);
613 }
614
82c19f95
PH
615/* Host name is known and verified. Unless we've already found that the HELO
616data matches the IP address, compare it with the name. */
059ec3d9
PH
617
618else
619 {
82c19f95
PH
620 if (show_helo && strcmpic(sender_host_name, sender_helo_name) == 0)
621 show_helo = FALSE;
5dd9625b 622
82c19f95 623 if (show_helo)
059ec3d9
PH
624 {
625 sender_fullhost = string_sprintf("%s (%s) %s", sender_host_name,
626 sender_helo_name, address);
627 sender_rcvhost = (sender_ident == NULL)?
628 string_sprintf("%s (%s helo=%s)", sender_host_name,
629 address, sender_helo_name) :
630 string_sprintf("%s\n\t(%s helo=%s ident=%s)", sender_host_name,
631 address, sender_helo_name, sender_ident);
632 }
82c19f95
PH
633 else
634 {
635 sender_fullhost = string_sprintf("%s %s", sender_host_name, address);
636 sender_rcvhost = (sender_ident == NULL)?
637 string_sprintf("%s (%s)", sender_host_name, address) :
638 string_sprintf("%s (%s ident=%s)", sender_host_name, address,
639 sender_ident);
640 }
059ec3d9
PH
641 }
642
643store_pool = old_pool;
644
645DEBUG(D_host_lookup) debug_printf("sender_fullhost = %s\n", sender_fullhost);
646DEBUG(D_host_lookup) debug_printf("sender_rcvhost = %s\n", sender_rcvhost);
647}
648
649
650
651/*************************************************
652* Build host+ident message *
653*************************************************/
654
655/* Used when logging rejections and various ACL and SMTP incidents. The text
656return depends on whether sender_fullhost and sender_ident are set or not:
657
658 no ident, no host => U=unknown
659 no ident, host set => H=sender_fullhost
660 ident set, no host => U=ident
661 ident set, host set => H=sender_fullhost U=ident
662
663Arguments:
664 useflag TRUE if first item to be flagged (H= or U=); if there are two
665 items, the second is always flagged
666
667Returns: pointer to a string in big_buffer
668*/
669
670uschar *
671host_and_ident(BOOL useflag)
672{
673if (sender_fullhost == NULL)
674 {
675 (void)string_format(big_buffer, big_buffer_size, "%s%s", useflag? "U=" : "",
676 (sender_ident == NULL)? US"unknown" : sender_ident);
677 }
678else
679 {
680 uschar *flag = useflag? US"H=" : US"";
681 uschar *iface = US"";
682 if ((log_extra_selector & LX_incoming_interface) != 0 &&
683 interface_address != NULL)
684 iface = string_sprintf(" I=[%s]:%d", interface_address, interface_port);
685 if (sender_ident == NULL)
686 (void)string_format(big_buffer, big_buffer_size, "%s%s%s",
687 flag, sender_fullhost, iface);
688 else
689 (void)string_format(big_buffer, big_buffer_size, "%s%s%s U=%s",
690 flag, sender_fullhost, iface, sender_ident);
691 }
692return big_buffer;
693}
694
695#endif /* STAND_ALONE */
696
697
698
699
700/*************************************************
701* Build list of local interfaces *
702*************************************************/
703
704/* This function interprets the contents of the local_interfaces or
705extra_local_interfaces options, and creates an ip_address_item block for each
706item on the list. There is no special interpretation of any IP addresses; in
707particular, 0.0.0.0 and ::0 are returned without modification. If any address
708includes a port, it is set in the block. Otherwise the port value is set to
709zero.
710
711Arguments:
712 list the list
713 name the name of the option being expanded
714
715Returns: a chain of ip_address_items, each containing to a textual
716 version of an IP address, and a port number (host order) or
717 zero if no port was given with the address
718*/
719
720ip_address_item *
721host_build_ifacelist(uschar *list, uschar *name)
722{
723int sep = 0;
724uschar *s;
725uschar buffer[64];
726ip_address_item *yield = NULL;
727ip_address_item *last = NULL;
728ip_address_item *next;
729
730while ((s = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
731 {
7e66e54d 732 int ipv;
7cd1141b 733 int port = host_address_extract_port(s); /* Leaves just the IP address */
7e66e54d 734 if ((ipv = string_is_ip_address(s, NULL)) == 0)
059ec3d9
PH
735 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Malformed IP address \"%s\" in %s",
736 s, name);
737
7e66e54d
PH
738 /* Skip IPv6 addresses if IPv6 is disabled. */
739
740 if (disable_ipv6 && ipv == 6) continue;
741
059ec3d9
PH
742 /* This use of strcpy() is OK because we have checked that s is a valid IP
743 address above. The field in the ip_address_item is large enough to hold an
744 IPv6 address. */
745
746 next = store_get(sizeof(ip_address_item));
747 next->next = NULL;
748 Ustrcpy(next->address, s);
749 next->port = port;
750 next->v6_include_v4 = FALSE;
751
752 if (yield == NULL) yield = last = next; else
753 {
754 last->next = next;
755 last = next;
756 }
757 }
758
759return yield;
760}
761
762
763
764
765
766/*************************************************
767* Find addresses on local interfaces *
768*************************************************/
769
770/* This function finds the addresses of local IP interfaces. These are used
771when testing for routing to the local host. As the function may be called more
772than once, the list is preserved in permanent store, pointed to by a static
773variable, to save doing the work more than once per process.
774
775The generic list of interfaces is obtained by calling host_build_ifacelist()
776for local_interfaces and extra_local_interfaces. This list scanned to remove
777duplicates (which may exist with different ports - not relevant here). If
778either of the wildcard IP addresses (0.0.0.0 and ::0) are encountered, they are
779replaced by the appropriate (IPv4 or IPv6) list of actual local interfaces,
780obtained from os_find_running_interfaces().
781
782Arguments: none
783Returns: a chain of ip_address_items, each containing to a textual
784 version of an IP address; the port numbers are not relevant
785*/
786
787
788/* First, a local subfunction to add an interface to a list in permanent store,
789but only if there isn't a previous copy of that address on the list. */
790
791static ip_address_item *
792add_unique_interface(ip_address_item *list, ip_address_item *ipa)
793{
794ip_address_item *ipa2;
795for (ipa2 = list; ipa2 != NULL; ipa2 = ipa2->next)
796 if (Ustrcmp(ipa2->address, ipa->address) == 0) return list;
797ipa2 = store_get_perm(sizeof(ip_address_item));
798*ipa2 = *ipa;
799ipa2->next = list;
800return ipa2;
801}
802
803
804/* This is the globally visible function */
805
806ip_address_item *
807host_find_interfaces(void)
808{
809ip_address_item *running_interfaces = NULL;
810
811if (local_interface_data == NULL)
812 {
813 void *reset_item = store_get(0);
814 ip_address_item *dlist = host_build_ifacelist(local_interfaces,
815 US"local_interfaces");
816 ip_address_item *xlist = host_build_ifacelist(extra_local_interfaces,
817 US"extra_local_interfaces");
818 ip_address_item *ipa;
819
820 if (dlist == NULL) dlist = xlist; else
821 {
822 for (ipa = dlist; ipa->next != NULL; ipa = ipa->next);
823 ipa->next = xlist;
824 }
825
826 for (ipa = dlist; ipa != NULL; ipa = ipa->next)
827 {
828 if (Ustrcmp(ipa->address, "0.0.0.0") == 0 ||
829 Ustrcmp(ipa->address, "::0") == 0)
830 {
831 ip_address_item *ipa2;
832 BOOL ipv6 = ipa->address[0] == ':';
833 if (running_interfaces == NULL)
834 running_interfaces = os_find_running_interfaces();
835 for (ipa2 = running_interfaces; ipa2 != NULL; ipa2 = ipa2->next)
836 {
837 if ((Ustrchr(ipa2->address, ':') != NULL) == ipv6)
838 local_interface_data = add_unique_interface(local_interface_data,
839 ipa2);
840 }
841 }
842 else
843 {
844 local_interface_data = add_unique_interface(local_interface_data, ipa);
845 DEBUG(D_interface)
846 {
847 debug_printf("Configured local interface: address=%s", ipa->address);
848 if (ipa->port != 0) debug_printf(" port=%d", ipa->port);
849 debug_printf("\n");
850 }
851 }
852 }
853 store_reset(reset_item);
854 }
855
856return local_interface_data;
857}
858
859
860
861
862
863/*************************************************
864* Convert network IP address to text *
865*************************************************/
866
867/* Given an IPv4 or IPv6 address in binary, convert it to a text
868string and return the result in a piece of new store. The address can
869either be given directly, or passed over in a sockaddr structure. Note
870that this isn't the converse of host_aton() because of byte ordering
871differences. See host_nmtoa() below.
872
873Arguments:
874 type if < 0 then arg points to a sockaddr, else
875 either AF_INET or AF_INET6
876 arg points to a sockaddr if type is < 0, or
877 points to an IPv4 address (32 bits), or
878 points to an IPv6 address (128 bits),
879 in both cases, in network byte order
880 buffer if NULL, the result is returned in gotten store;
881 else points to a buffer to hold the answer
882 portptr points to where to put the port number, if non NULL; only
883 used when type < 0
884
885Returns: pointer to character string
886*/
887
888uschar *
889host_ntoa(int type, const void *arg, uschar *buffer, int *portptr)
890{
891uschar *yield;
892
893/* The new world. It is annoying that we have to fish out the address from
894different places in the block, depending on what kind of address it is. It
895is also a pain that inet_ntop() returns a const uschar *, whereas the IPv4
896function inet_ntoa() returns just uschar *, and some picky compilers insist
897on warning if one assigns a const uschar * to a uschar *. Hence the casts. */
898
899#if HAVE_IPV6
900uschar addr_buffer[46];
901if (type < 0)
902 {
903 int family = ((struct sockaddr *)arg)->sa_family;
904 if (family == AF_INET6)
905 {
906 struct sockaddr_in6 *sk = (struct sockaddr_in6 *)arg;
907 yield = (uschar *)inet_ntop(family, &(sk->sin6_addr), CS addr_buffer,
908 sizeof(addr_buffer));
909 if (portptr != NULL) *portptr = ntohs(sk->sin6_port);
910 }
911 else
912 {
913 struct sockaddr_in *sk = (struct sockaddr_in *)arg;
914 yield = (uschar *)inet_ntop(family, &(sk->sin_addr), CS addr_buffer,
915 sizeof(addr_buffer));
916 if (portptr != NULL) *portptr = ntohs(sk->sin_port);
917 }
918 }
919else
920 {
921 yield = (uschar *)inet_ntop(type, arg, CS addr_buffer, sizeof(addr_buffer));
922 }
923
924/* If the result is a mapped IPv4 address, show it in V4 format. */
925
926if (Ustrncmp(yield, "::ffff:", 7) == 0) yield += 7;
927
928#else /* HAVE_IPV6 */
929
930/* The old world */
931
932if (type < 0)
933 {
934 yield = US inet_ntoa(((struct sockaddr_in *)arg)->sin_addr);
935 if (portptr != NULL) *portptr = ntohs(((struct sockaddr_in *)arg)->sin_port);
936 }
937else
938 yield = US inet_ntoa(*((struct in_addr *)arg));
939#endif
940
941/* If there is no buffer, put the string into some new store. */
942
943if (buffer == NULL) return string_copy(yield);
944
945/* Callers of this function with a non-NULL buffer must ensure that it is
946large enough to hold an IPv6 address, namely, at least 46 bytes. That's what
947makes this use of strcpy() OK. */
948
949Ustrcpy(buffer, yield);
950return buffer;
951}
952
953
954
955
956/*************************************************
957* Convert address text to binary *
958*************************************************/
959
960/* Given the textual form of an IP address, convert it to binary in an
961array of ints. IPv4 addresses occupy one int; IPv6 addresses occupy 4 ints.
962The result has the first byte in the most significant byte of the first int. In
963other words, the result is not in network byte order, but in host byte order.
964As a result, this is not the converse of host_ntoa(), which expects network
965byte order. See host_nmtoa() below.
966
967Arguments:
968 address points to the textual address, checked for syntax
969 bin points to an array of 4 ints
970
971Returns: the number of ints used
972*/
973
974int
975host_aton(uschar *address, int *bin)
976{
977int x[4];
978int v4offset = 0;
979
8e669ac1 980/* Handle IPv6 address, which may end with an IPv4 address. It may also end
7e634d24
PH
981with a "scope", introduced by a percent sign. This code is NOT enclosed in #if
982HAVE_IPV6 in order that IPv6 addresses are recognized even if IPv6 is not
983supported. */
059ec3d9
PH
984
985if (Ustrchr(address, ':') != NULL)
986 {
987 uschar *p = address;
988 uschar *component[8];
989 BOOL ipv4_ends = FALSE;
990 int ci = 0;
991 int nulloffset = 0;
992 int v6count = 8;
993 int i;
994
995 /* If the address starts with a colon, it will start with two colons.
996 Just lose the first one, which will leave a null first component. */
8e669ac1 997
059ec3d9
PH
998 if (*p == ':') p++;
999
8e669ac1
PH
1000 /* Split the address into components separated by colons. The input address
1001 is supposed to be checked for syntax. There was a case where this was
1002 overlooked; to guard against that happening again, check here and crash if
7e634d24 1003 there are too many components. */
059ec3d9 1004
7e634d24 1005 while (*p != 0 && *p != '%')
059ec3d9 1006 {
7e634d24 1007 int len = Ustrcspn(p, ":%");
059ec3d9 1008 if (len == 0) nulloffset = ci;
8e669ac1 1009 if (ci > 7) log_write(0, LOG_MAIN|LOG_PANIC_DIE,
b975ba52 1010 "Internal error: invalid IPv6 address \"%s\" passed to host_aton()",
8e669ac1 1011 address);
059ec3d9
PH
1012 component[ci++] = p;
1013 p += len;
1014 if (*p == ':') p++;
1015 }
1016
1017 /* If the final component contains a dot, it is a trailing v4 address.
1018 As the syntax is known to be checked, just set up for a trailing
1019 v4 address and restrict the v6 part to 6 components. */
1020
1021 if (Ustrchr(component[ci-1], '.') != NULL)
1022 {
1023 address = component[--ci];
1024 ipv4_ends = TRUE;
1025 v4offset = 3;
1026 v6count = 6;
1027 }
1028
1029 /* If there are fewer than 6 or 8 components, we have to insert some
1030 more empty ones in the middle. */
1031
1032 if (ci < v6count)
1033 {
1034 int insert_count = v6count - ci;
1035 for (i = v6count-1; i > nulloffset + insert_count; i--)
1036 component[i] = component[i - insert_count];
1037 while (i > nulloffset) component[i--] = US"";
1038 }
1039
1040 /* Now turn the components into binary in pairs and bung them
1041 into the vector of ints. */
1042
1043 for (i = 0; i < v6count; i += 2)
1044 bin[i/2] = (Ustrtol(component[i], NULL, 16) << 16) +
1045 Ustrtol(component[i+1], NULL, 16);
1046
1047 /* If there was no terminating v4 component, we are done. */
1048
1049 if (!ipv4_ends) return 4;
1050 }
1051
1052/* Handle IPv4 address */
1053
ff790e47 1054(void)sscanf(CS address, "%d.%d.%d.%d", x, x+1, x+2, x+3);
059ec3d9
PH
1055bin[v4offset] = (x[0] << 24) + (x[1] << 16) + (x[2] << 8) + x[3];
1056return v4offset+1;
1057}
1058
1059
1060/*************************************************
1061* Apply mask to an IP address *
1062*************************************************/
1063
1064/* Mask an address held in 1 or 4 ints, with the ms bit in the ms bit of the
1065first int, etc.
1066
1067Arguments:
1068 count the number of ints
1069 binary points to the ints to be masked
1070 mask the count of ms bits to leave, or -1 if no masking
1071
1072Returns: nothing
1073*/
1074
1075void
1076host_mask(int count, int *binary, int mask)
1077{
1078int i;
1079if (mask < 0) mask = 99999;
1080for (i = 0; i < count; i++)
1081 {
1082 int wordmask;
1083 if (mask == 0) wordmask = 0;
1084 else if (mask < 32)
1085 {
1086 wordmask = (-1) << (32 - mask);
1087 mask = 0;
1088 }
1089 else
1090 {
1091 wordmask = -1;
1092 mask -= 32;
1093 }
1094 binary[i] &= wordmask;
1095 }
1096}
1097
1098
1099
1100
1101/*************************************************
1102* Convert masked IP address in ints to text *
1103*************************************************/
1104
1105/* We can't use host_ntoa() because it assumes the binary values are in network
1106byte order, and these are the result of host_aton(), which puts them in ints in
1107host byte order. Also, we really want IPv6 addresses to be in a canonical
6f0c9a4f
PH
1108format, so we output them with no abbreviation. In a number of cases we can't
1109use the normal colon separator in them because it terminates keys in lsearch
8e669ac1 1110files, so we want to use dot instead. There's an argument that specifies what
6f0c9a4f 1111to use for IPv6 addresses.
059ec3d9
PH
1112
1113Arguments:
1114 count 1 or 4 (number of ints)
1115 binary points to the ints
1116 mask mask value; if < 0 don't add to result
1117 buffer big enough to hold the result
8e669ac1 1118 sep component separator character for IPv6 addresses
059ec3d9
PH
1119
1120Returns: the number of characters placed in buffer, not counting
1121 the final nul.
1122*/
1123
1124int
6f0c9a4f 1125host_nmtoa(int count, int *binary, int mask, uschar *buffer, int sep)
059ec3d9
PH
1126{
1127int i, j;
1128uschar *tt = buffer;
1129
1130if (count == 1)
1131 {
1132 j = binary[0];
1133 for (i = 24; i >= 0; i -= 8)
1134 {
1135 sprintf(CS tt, "%d.", (j >> i) & 255);
1136 while (*tt) tt++;
1137 }
1138 }
1139else
1140 {
1141 for (i = 0; i < 4; i++)
1142 {
1143 j = binary[i];
6f0c9a4f 1144 sprintf(CS tt, "%04x%c%04x%c", (j >> 16) & 0xffff, sep, j & 0xffff, sep);
059ec3d9
PH
1145 while (*tt) tt++;
1146 }
1147 }
1148
6f0c9a4f 1149tt--; /* lose final separator */
059ec3d9
PH
1150
1151if (mask < 0)
1152 *tt = 0;
1153else
1154 {
1155 sprintf(CS tt, "/%d", mask);
1156 while (*tt) tt++;
1157 }
1158
1159return tt - buffer;
1160}
1161
1162
1163
1164/*************************************************
1165* Check port for tls_on_connect *
1166*************************************************/
1167
1168/* This function checks whether a given incoming port is configured for tls-
1169on-connect. It is called from the daemon and from inetd handling. If the global
1170option tls_on_connect is already set, all ports operate this way. Otherwise, we
1171check the tls_on_connect_ports option for a list of ports.
1172
1173Argument: a port number
1174Returns: TRUE or FALSE
1175*/
1176
1177BOOL
1178host_is_tls_on_connect_port(int port)
1179{
1180int sep = 0;
1181uschar buffer[32];
817d9f57 1182uschar *list = tls_in.on_connect_ports;
059ec3d9 1183uschar *s;
071c51f7 1184uschar *end;
059ec3d9 1185
817d9f57 1186if (tls_in.on_connect) return TRUE;
059ec3d9 1187
071c51f7
JH
1188while ((s = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
1189 if (Ustrtol(s, &end, 10) == port)
1190 return TRUE;
059ec3d9
PH
1191
1192return FALSE;
1193}
1194
1195
1196
1197/*************************************************
1198* Check whether host is in a network *
1199*************************************************/
1200
1201/* This function checks whether a given IP address matches a pattern that
1202represents either a single host, or a network (using CIDR notation). The caller
1203of this function must check the syntax of the arguments before calling it.
1204
1205Arguments:
1206 host string representation of the ip-address to check
1207 net string representation of the network, with optional CIDR mask
1208 maskoffset offset to the / that introduces the mask in the key
1209 zero if there is no mask
1210
1211Returns:
1212 TRUE the host is inside the network
1213 FALSE the host is NOT inside the network
1214*/
1215
1216BOOL
1217host_is_in_net(uschar *host, uschar *net, int maskoffset)
1218{
1219int i;
1220int address[4];
1221int incoming[4];
1222int mlen;
1223int size = host_aton(net, address);
1224int insize;
1225
1226/* No mask => all bits to be checked */
1227
1228if (maskoffset == 0) mlen = 99999; /* Big number */
1229 else mlen = Uatoi(net + maskoffset + 1);
1230
1231/* Convert the incoming address to binary. */
1232
1233insize = host_aton(host, incoming);
1234
1235/* Convert IPv4 addresses given in IPv6 compatible mode, which represent
1236 connections from IPv4 hosts to IPv6 hosts, that is, addresses of the form
1237 ::ffff:<v4address>, to IPv4 format. */
1238
1239if (insize == 4 && incoming[0] == 0 && incoming[1] == 0 &&
1240 incoming[2] == 0xffff)
1241 {
1242 insize = 1;
1243 incoming[0] = incoming[3];
1244 }
1245
1246/* No match if the sizes don't agree. */
1247
1248if (insize != size) return FALSE;
1249
1250/* Else do the masked comparison. */
1251
1252for (i = 0; i < size; i++)
1253 {
1254 int mask;
1255 if (mlen == 0) mask = 0;
1256 else if (mlen < 32)
1257 {
1258 mask = (-1) << (32 - mlen);
1259 mlen = 0;
1260 }
1261 else
1262 {
1263 mask = -1;
1264 mlen -= 32;
1265 }
1266 if ((incoming[i] & mask) != (address[i] & mask)) return FALSE;
1267 }
1268
1269return TRUE;
1270}
1271
1272
1273
1274/*************************************************
1275* Scan host list for local hosts *
1276*************************************************/
1277
1278/* Scan through a chain of addresses and check whether any of them is the
1279address of an interface on the local machine. If so, remove that address and
1280any previous ones with the same MX value, and all subsequent ones (which will
1281have greater or equal MX values) from the chain. Note: marking them as unusable
1282is NOT the right thing to do because it causes the hosts not to be used for
1283other domains, for which they may well be correct.
1284
1285The hosts may be part of a longer chain; we only process those between the
1286initial pointer and the "last" pointer.
1287
1288There is also a list of "pseudo-local" host names which are checked against the
1289host names. Any match causes that host item to be treated the same as one which
1290matches a local IP address.
1291
1292If the very first host is a local host, then all MX records had a precedence
1293greater than or equal to that of the local host. Either there's a problem in
1294the DNS, or an apparently remote name turned out to be an abbreviation for the
1295local host. Give a specific return code, and let the caller decide what to do.
1296Otherwise, give a success code if at least one host address has been found.
1297
1298Arguments:
1299 host pointer to the first host in the chain
1300 lastptr pointer to pointer to the last host in the chain (may be updated)
1301 removed if not NULL, set TRUE if some local addresses were removed
1302 from the list
1303
1304Returns:
1305 HOST_FOUND if there is at least one host with an IP address on the chain
1306 and an MX value less than any MX value associated with the
1307 local host
1308 HOST_FOUND_LOCAL if a local host is among the lowest-numbered MX hosts; when
1309 the host addresses were obtained from A records or
1310 gethostbyname(), the MX values are set to -1.
1311 HOST_FIND_FAILED if no valid hosts with set IP addresses were found
1312*/
1313
1314int
1315host_scan_for_local_hosts(host_item *host, host_item **lastptr, BOOL *removed)
1316{
1317int yield = HOST_FIND_FAILED;
1318host_item *last = *lastptr;
1319host_item *prev = NULL;
1320host_item *h;
1321
1322if (removed != NULL) *removed = FALSE;
1323
1324if (local_interface_data == NULL) local_interface_data = host_find_interfaces();
1325
1326for (h = host; h != last->next; h = h->next)
1327 {
1328 #ifndef STAND_ALONE
1329 if (hosts_treat_as_local != NULL)
1330 {
1331 int rc;
1332 uschar *save = deliver_domain;
1333 deliver_domain = h->name; /* set $domain */
1334 rc = match_isinlist(string_copylc(h->name), &hosts_treat_as_local, 0,
1335 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL);
1336 deliver_domain = save;
1337 if (rc == OK) goto FOUND_LOCAL;
1338 }
1339 #endif
1340
1341 /* It seems that on many operating systems, 0.0.0.0 is treated as a synonym
1342 for 127.0.0.1 and refers to the local host. We therefore force it always to
1343 be treated as local. */
1344
1345 if (h->address != NULL)
1346 {
1347 ip_address_item *ip;
1348 if (Ustrcmp(h->address, "0.0.0.0") == 0) goto FOUND_LOCAL;
1349 for (ip = local_interface_data; ip != NULL; ip = ip->next)
1350 if (Ustrcmp(h->address, ip->address) == 0) goto FOUND_LOCAL;
1351 yield = HOST_FOUND; /* At least one remote address has been found */
1352 }
1353
1354 /* Update prev to point to the last host item before any that have
1355 the same MX value as the one we have just considered. */
1356
1357 if (h->next == NULL || h->next->mx != h->mx) prev = h;
1358 }
1359
1360return yield; /* No local hosts found: return HOST_FOUND or HOST_FIND_FAILED */
1361
1362/* A host whose IP address matches a local IP address, or whose name matches
1363something in hosts_treat_as_local has been found. */
1364
1365FOUND_LOCAL:
1366
1367if (prev == NULL)
1368 {
1369 HDEBUG(D_host_lookup) debug_printf((h->mx >= 0)?
1370 "local host has lowest MX\n" :
1371 "local host found for non-MX address\n");
1372 return HOST_FOUND_LOCAL;
1373 }
1374
1375HDEBUG(D_host_lookup)
1376 {
1377 debug_printf("local host in host list - removed hosts:\n");
1378 for (h = prev->next; h != last->next; h = h->next)
1379 debug_printf(" %s %s %d\n", h->name, h->address, h->mx);
1380 }
1381
1382if (removed != NULL) *removed = TRUE;
1383prev->next = last->next;
1384*lastptr = prev;
1385return yield;
1386}
1387
1388
1389
1390
1391/*************************************************
1392* Remove duplicate IPs in host list *
1393*************************************************/
1394
1395/* You would think that administrators could set up their DNS records so that
1396one ended up with a list of unique IP addresses after looking up A or MX
1397records, but apparently duplication is common. So we scan such lists and
1398remove the later duplicates. Note that we may get lists in which some host
1399addresses are not set.
1400
1401Arguments:
1402 host pointer to the first host in the chain
1403 lastptr pointer to pointer to the last host in the chain (may be updated)
1404
1405Returns: nothing
1406*/
1407
1408static void
1409host_remove_duplicates(host_item *host, host_item **lastptr)
1410{
1411while (host != *lastptr)
1412 {
1413 if (host->address != NULL)
1414 {
1415 host_item *h = host;
1416 while (h != *lastptr)
1417 {
1418 if (h->next->address != NULL &&
1419 Ustrcmp(h->next->address, host->address) == 0)
1420 {
1421 DEBUG(D_host_lookup) debug_printf("duplicate IP address %s (MX=%d) "
1422 "removed\n", host->address, h->next->mx);
1423 if (h->next == *lastptr) *lastptr = h;
1424 h->next = h->next->next;
1425 }
1426 else h = h->next;
1427 }
1428 }
1429 /* If the last item was removed, host may have become == *lastptr */
1430 if (host != *lastptr) host = host->next;
1431 }
1432}
1433
1434
1435
1436
1437/*************************************************
1438* Find sender host name by gethostbyaddr() *
1439*************************************************/
1440
1441/* This used to be the only way it was done, but it turns out that not all
1442systems give aliases for calls to gethostbyaddr() - or one of the modern
1443equivalents like getipnodebyaddr(). Fortunately, multiple PTR records are rare,
1444but they can still exist. This function is now used only when a DNS lookup of
1445the IP address fails, in order to give access to /etc/hosts.
1446
1447Arguments: none
1448Returns: OK, DEFER, FAIL
1449*/
1450
1451static int
1452host_name_lookup_byaddr(void)
1453{
1454int len;
1455uschar *s, *t;
1456struct hostent *hosts;
1457struct in_addr addr;
1458
1459/* Lookup on IPv6 system */
1460
1461#if HAVE_IPV6
1462if (Ustrchr(sender_host_address, ':') != NULL)
1463 {
1464 struct in6_addr addr6;
1465 if (inet_pton(AF_INET6, CS sender_host_address, &addr6) != 1)
1466 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
1467 "IPv6 address", sender_host_address);
1468 #if HAVE_GETIPNODEBYADDR
1469 hosts = getipnodebyaddr(CS &addr6, sizeof(addr6), AF_INET6, &h_errno);
1470 #else
1471 hosts = gethostbyaddr(CS &addr6, sizeof(addr6), AF_INET6);
1472 #endif
1473 }
1474else
1475 {
1476 if (inet_pton(AF_INET, CS sender_host_address, &addr) != 1)
1477 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
1478 "IPv4 address", sender_host_address);
1479 #if HAVE_GETIPNODEBYADDR
1480 hosts = getipnodebyaddr(CS &addr, sizeof(addr), AF_INET, &h_errno);
1481 #else
1482 hosts = gethostbyaddr(CS &addr, sizeof(addr), AF_INET);
1483 #endif
1484 }
1485
1486/* Do lookup on IPv4 system */
1487
1488#else
1489addr.s_addr = (S_ADDR_TYPE)inet_addr(CS sender_host_address);
1490hosts = gethostbyaddr(CS(&addr), sizeof(addr), AF_INET);
1491#endif
1492
1493/* Failed to look up the host. */
1494
1495if (hosts == NULL)
1496 {
1497 HDEBUG(D_host_lookup) debug_printf("IP address lookup failed: h_errno=%d\n",
1498 h_errno);
1499 return (h_errno == TRY_AGAIN || h_errno == NO_RECOVERY) ? DEFER : FAIL;
1500 }
1501
1502/* It seems there are some records in the DNS that yield an empty name. We
1503treat this as non-existent. In some operating systems, this is returned as an
1504empty string; in others as a single dot. */
1505
8ad076b2 1506if (hosts->h_name == NULL || hosts->h_name[0] == 0 || hosts->h_name[0] == '.')
059ec3d9
PH
1507 {
1508 HDEBUG(D_host_lookup) debug_printf("IP address lookup yielded an empty name: "
1509 "treated as non-existent host name\n");
1510 return FAIL;
1511 }
1512
1513/* Copy and lowercase the name, which is in static storage in many systems.
1514Put it in permanent memory. */
1515
1516s = (uschar *)hosts->h_name;
1517len = Ustrlen(s) + 1;
1518t = sender_host_name = store_get_perm(len);
1519while (*s != 0) *t++ = tolower(*s++);
1520*t = 0;
1521
1522/* If the host has aliases, build a copy of the alias list */
1523
1524if (hosts->h_aliases != NULL)
1525 {
1526 int count = 1;
1527 uschar **aliases, **ptr;
1528 for (aliases = USS hosts->h_aliases; *aliases != NULL; aliases++) count++;
1529 ptr = sender_host_aliases = store_get_perm(count * sizeof(uschar *));
1530 for (aliases = USS hosts->h_aliases; *aliases != NULL; aliases++)
1531 {
1532 uschar *s = *aliases;
1533 int len = Ustrlen(s) + 1;
1534 uschar *t = *ptr++ = store_get_perm(len);
1535 while (*s != 0) *t++ = tolower(*s++);
1536 *t = 0;
1537 }
1538 *ptr = NULL;
1539 }
1540
1541return OK;
1542}
1543
1544
1545
1546/*************************************************
1547* Find host name for incoming call *
1548*************************************************/
1549
1550/* Put the name in permanent store, pointed to by sender_host_name. We also set
1551up a list of alias names, pointed to by sender_host_alias. The list is
1552NULL-terminated. The incoming address is in sender_host_address, either in
1553dotted-quad form for IPv4 or in colon-separated form for IPv6.
1554
1555This function does a thorough check that the names it finds point back to the
1556incoming IP address. Any that do not are discarded. Note that this is relied on
1557by the ACL reverse_host_lookup check.
1558
1559On some systems, get{host,ipnode}byaddr() appears to do this internally, but
1560this it not universally true. Also, for release 4.30, this function was changed
1561to do a direct DNS lookup first, by default[1], because it turns out that that
1562is the only guaranteed way to find all the aliases on some systems. My
1563experiments indicate that Solaris gethostbyaddr() gives the aliases for but
1564Linux does not.
1565
1566[1] The actual order is controlled by the host_lookup_order option.
1567
1568Arguments: none
1569Returns: OK on success, the answer being placed in the global variable
1570 sender_host_name, with any aliases in a list hung off
1571 sender_host_aliases
1572 FAIL if no host name can be found
1573 DEFER if a temporary error was encountered
1574
1575The variable host_lookup_msg is set to an empty string on sucess, or to a
1576reason for the failure otherwise, in a form suitable for tagging onto an error
8e669ac1 1577message, and also host_lookup_failed is set TRUE if the lookup failed. If there
b08b24c8
PH
1578was a defer, host_lookup_deferred is set TRUE.
1579
1580Any dynamically constructed string for host_lookup_msg must be in permanent
1581store, because it might be used for several incoming messages on the same SMTP
059ec3d9
PH
1582connection. */
1583
1584int
1585host_name_lookup(void)
1586{
1587int old_pool, rc;
1588int sep = 0;
1589uschar *hname, *save_hostname;
1590uschar **aliases;
1591uschar buffer[256];
1592uschar *ordername;
1593uschar *list = host_lookup_order;
1594dns_record *rr;
1595dns_answer dnsa;
1596dns_scan dnss;
1597
1f4a55da 1598sender_host_dnssec = host_lookup_deferred = host_lookup_failed = FALSE;
b08b24c8 1599
059ec3d9
PH
1600HDEBUG(D_host_lookup)
1601 debug_printf("looking up host name for %s\n", sender_host_address);
1602
1603/* For testing the case when a lookup does not complete, we have a special
1604reserved IP address. */
1605
1606if (running_in_test_harness &&
1607 Ustrcmp(sender_host_address, "99.99.99.99") == 0)
1608 {
1609 HDEBUG(D_host_lookup)
1610 debug_printf("Test harness: host name lookup returns DEFER\n");
8e669ac1 1611 host_lookup_deferred = TRUE;
059ec3d9
PH
1612 return DEFER;
1613 }
1614
1615/* Do lookups directly in the DNS or via gethostbyaddr() (or equivalent), in
1616the order specified by the host_lookup_order option. */
1617
1618while ((ordername = string_nextinlist(&list, &sep, buffer, sizeof(buffer)))
1619 != NULL)
1620 {
1621 if (strcmpic(ordername, US"bydns") == 0)
1622 {
9d9c3746 1623 dns_init(FALSE, FALSE, FALSE); /* dnssec ctrl by dns_dnssec_ok glbl */
059ec3d9
PH
1624 dns_build_reverse(sender_host_address, buffer);
1625 rc = dns_lookup(&dnsa, buffer, T_PTR, NULL);
1626
1627 /* The first record we come across is used for the name; others are
1628 considered to be aliases. We have to scan twice, in order to find out the
1629 number of aliases. However, if all the names are empty, we will behave as
1630 if failure. (PTR records that yield empty names have been encountered in
1631 the DNS.) */
1632
1633 if (rc == DNS_SUCCEED)
1634 {
1635 uschar **aptr = NULL;
1636 int ssize = 264;
1637 int count = 0;
1638 int old_pool = store_pool;
1639
1f4a55da
PP
1640 /* Ideally we'd check DNSSEC both forward and reverse, but we use the
1641 gethost* routines for forward, so can't do that unless/until we rewrite. */
1642 sender_host_dnssec = dns_is_secure(&dnsa);
1643 DEBUG(D_dns)
1644 debug_printf("Reverse DNS security status: %s\n",
1645 sender_host_dnssec ? "DNSSEC verified (AD)" : "unverified");
1646
059ec3d9
PH
1647 store_pool = POOL_PERM; /* Save names in permanent storage */
1648
1649 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1650 rr != NULL;
1651 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1652 {
1653 if (rr->type == T_PTR) count++;
1654 }
1655
1656 /* Get store for the list of aliases. For compatibility with
1657 gethostbyaddr, we make an empty list if there are none. */
1658
1659 aptr = sender_host_aliases = store_get(count * sizeof(uschar *));
1660
1661 /* Re-scan and extract the names */
1662
1663 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1664 rr != NULL;
1665 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1666 {
1667 uschar *s = NULL;
1668 if (rr->type != T_PTR) continue;
1669 s = store_get(ssize);
1670
1671 /* If an overlong response was received, the data will have been
1672 truncated and dn_expand may fail. */
1673
1674 if (dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen,
1675 (uschar *)(rr->data), (DN_EXPAND_ARG4_TYPE)(s), ssize) < 0)
1676 {
1677 log_write(0, LOG_MAIN, "host name alias list truncated for %s",
1678 sender_host_address);
1679 break;
1680 }
1681
1682 store_reset(s + Ustrlen(s) + 1);
1683 if (s[0] == 0)
1684 {
1685 HDEBUG(D_host_lookup) debug_printf("IP address lookup yielded an "
1686 "empty name: treated as non-existent host name\n");
1687 continue;
1688 }
1689 if (sender_host_name == NULL) sender_host_name = s;
1690 else *aptr++ = s;
1691 while (*s != 0) { *s = tolower(*s); s++; }
1692 }
1693
1694 *aptr = NULL; /* End of alias list */
1695 store_pool = old_pool; /* Reset store pool */
1696
1697 /* If we've found a names, break out of the "order" loop */
1698
1699 if (sender_host_name != NULL) break;
1700 }
1701
1702 /* If the DNS lookup deferred, we must also defer. */
1703
1704 if (rc == DNS_AGAIN)
1705 {
1706 HDEBUG(D_host_lookup)
1707 debug_printf("IP address PTR lookup gave temporary error\n");
8e669ac1 1708 host_lookup_deferred = TRUE;
059ec3d9
PH
1709 return DEFER;
1710 }
1711 }
1712
1713 /* Do a lookup using gethostbyaddr() - or equivalent */
1714
1715 else if (strcmpic(ordername, US"byaddr") == 0)
1716 {
1717 HDEBUG(D_host_lookup)
1718 debug_printf("IP address lookup using gethostbyaddr()\n");
059ec3d9 1719 rc = host_name_lookup_byaddr();
8e669ac1 1720 if (rc == DEFER)
b08b24c8 1721 {
8e669ac1 1722 host_lookup_deferred = TRUE;
b08b24c8 1723 return rc; /* Can't carry on */
8e669ac1 1724 }
059ec3d9
PH
1725 if (rc == OK) break; /* Found a name */
1726 }
1727 } /* Loop for bydns/byaddr scanning */
1728
1729/* If we have failed to find a name, return FAIL and log when required.
1730NB host_lookup_msg must be in permanent store. */
1731
1732if (sender_host_name == NULL)
1733 {
1734 if (host_checking || !log_testing_mode)
1735 log_write(L_host_lookup_failed, LOG_MAIN, "no host name found for IP "
1736 "address %s", sender_host_address);
1737 host_lookup_msg = US" (failed to find host name from IP address)";
b08b24c8 1738 host_lookup_failed = TRUE;
059ec3d9
PH
1739 return FAIL;
1740 }
1741
059ec3d9
PH
1742HDEBUG(D_host_lookup)
1743 {
1744 uschar **aliases = sender_host_aliases;
1745 debug_printf("IP address lookup yielded %s\n", sender_host_name);
1746 while (*aliases != NULL) debug_printf(" alias %s\n", *aliases++);
1747 }
1748
1749/* We need to verify that a forward lookup on the name we found does indeed
1750correspond to the address. This is for security: in principle a malefactor who
1751happened to own a reverse zone could set it to point to any names at all.
1752
1753This code was present in versions of Exim before 3.20. At that point I took it
1754out because I thought that gethostbyaddr() did the check anyway. It turns out
1755that this isn't always the case, so it's coming back in at 4.01. This version
1756is actually better, because it also checks aliases.
1757
1758The code was made more robust at release 4.21. Prior to that, it accepted all
1759the names if any of them had the correct IP address. Now the code checks all
1760the names, and accepts only those that have the correct IP address. */
1761
1762save_hostname = sender_host_name; /* Save for error messages */
1763aliases = sender_host_aliases;
1764for (hname = sender_host_name; hname != NULL; hname = *aliases++)
1765 {
1766 int rc;
1767 BOOL ok = FALSE;
1768 host_item h;
1769 h.next = NULL;
1770 h.name = hname;
1771 h.mx = MX_NONE;
1772 h.address = NULL;
1773
322050c2 1774 /* When called with the last argument FALSE, host_find_byname() won't return
059ec3d9
PH
1775 HOST_FOUND_LOCAL. If the incoming address is an IPv4 address expressed in
1776 IPv6 format, we must compare the IPv4 part to any IPv4 addresses. */
1777
322050c2 1778 if ((rc = host_find_byname(&h, NULL, 0, NULL, FALSE)) == HOST_FOUND)
059ec3d9
PH
1779 {
1780 host_item *hh;
059ec3d9
PH
1781 HDEBUG(D_host_lookup) debug_printf("checking addresses for %s\n", hname);
1782 for (hh = &h; hh != NULL; hh = hh->next)
1783 {
d27f1df3 1784 if (host_is_in_net(hh->address, sender_host_address, 0))
059ec3d9
PH
1785 {
1786 HDEBUG(D_host_lookup) debug_printf(" %s OK\n", hh->address);
1787 ok = TRUE;
1788 break;
1789 }
1790 else
1791 {
1792 HDEBUG(D_host_lookup) debug_printf(" %s\n", hh->address);
1793 }
1794 }
1795 if (!ok) HDEBUG(D_host_lookup)
1796 debug_printf("no IP address for %s matched %s\n", hname,
1797 sender_host_address);
1798 }
1799 else if (rc == HOST_FIND_AGAIN)
1800 {
1801 HDEBUG(D_host_lookup) debug_printf("temporary error for host name lookup\n");
8e669ac1 1802 host_lookup_deferred = TRUE;
55728a4f 1803 sender_host_name = NULL;
059ec3d9
PH
1804 return DEFER;
1805 }
1806 else
1807 {
1808 HDEBUG(D_host_lookup) debug_printf("no IP addresses found for %s\n", hname);
1809 }
1810
1811 /* If this name is no good, and it's the sender name, set it null pro tem;
1812 if it's an alias, just remove it from the list. */
1813
1814 if (!ok)
1815 {
1816 if (hname == sender_host_name) sender_host_name = NULL; else
1817 {
1818 uschar **a; /* Don't amalgamate - some */
1819 a = --aliases; /* compilers grumble */
1820 while (*a != NULL) { *a = a[1]; a++; }
1821 }
1822 }
1823 }
1824
1825/* If sender_host_name == NULL, it means we didn't like the name. Replace
1826it with the first alias, if there is one. */
1827
1828if (sender_host_name == NULL && *sender_host_aliases != NULL)
1829 sender_host_name = *sender_host_aliases++;
1830
1831/* If we now have a main name, all is well. */
1832
1833if (sender_host_name != NULL) return OK;
1834
1835/* We have failed to find an address that matches. */
1836
1837HDEBUG(D_host_lookup)
1838 debug_printf("%s does not match any IP address for %s\n",
1839 sender_host_address, save_hostname);
1840
1841/* This message must be in permanent store */
1842
1843old_pool = store_pool;
1844store_pool = POOL_PERM;
1845host_lookup_msg = string_sprintf(" (%s does not match any IP address for %s)",
1846 sender_host_address, save_hostname);
1847store_pool = old_pool;
059ec3d9
PH
1848host_lookup_failed = TRUE;
1849return FAIL;
1850}
1851
1852
1853
1854
1855/*************************************************
1856* Find IP address(es) for host by name *
1857*************************************************/
1858
1859/* The input is a host_item structure with the name filled in and the address
322050c2
PH
1860field set to NULL. We use gethostbyname() or getipnodebyname() or
1861gethostbyname2(), as appropriate. Of course, these functions may use the DNS,
1862but they do not do MX processing. It appears, however, that in some systems the
1863current setting of resolver options is used when one of these functions calls
1864the resolver. For this reason, we call dns_init() at the start, with arguments
1865influenced by bits in "flags", just as we do for host_find_bydns().
059ec3d9
PH
1866
1867The second argument provides a host list (usually an IP list) of hosts to
1868ignore. This makes it possible to ignore IPv6 link-local addresses or loopback
1869addresses in unreasonable places.
1870
1871The lookup may result in a change of name. For compatibility with the dns
1872lookup, return this via fully_qualified_name as well as updating the host item.
1873The lookup may also yield more than one IP address, in which case chain on
1874subsequent host_item structures.
1875
1876Arguments:
1877 host a host item with the name and MX filled in;
1878 the address is to be filled in;
1879 multiple IP addresses cause other host items to be
1880 chained on.
1881 ignore_target_hosts a list of hosts to ignore
322050c2
PH
1882 flags HOST_FIND_QUALIFY_SINGLE ) passed to
1883 HOST_FIND_SEARCH_PARENTS ) dns_init()
059ec3d9
PH
1884 fully_qualified_name if not NULL, set to point to host name for
1885 compatibility with host_find_bydns
1886 local_host_check TRUE if a check for the local host is wanted
1887
1888Returns: HOST_FIND_FAILED Failed to find the host or domain
1889 HOST_FIND_AGAIN Try again later
1890 HOST_FOUND Host found - data filled in
1891 HOST_FOUND_LOCAL Host found and is the local host
1892*/
1893
1894int
322050c2 1895host_find_byname(host_item *host, uschar *ignore_target_hosts, int flags,
059ec3d9
PH
1896 uschar **fully_qualified_name, BOOL local_host_check)
1897{
1898int i, yield, times;
1899uschar **addrlist;
1900host_item *last = NULL;
1901BOOL temp_error = FALSE;
b08b24c8
PH
1902#if HAVE_IPV6
1903int af;
1904#endif
1905
1906/* If we are in the test harness, a name ending in .test.again.dns always
9b8fadde
PH
1907forces a temporary error response, unless the name is in
1908dns_again_means_nonexist. */
b08b24c8
PH
1909
1910if (running_in_test_harness)
1911 {
1912 uschar *endname = host->name + Ustrlen(host->name);
9b8fadde 1913 if (Ustrcmp(endname - 14, "test.again.dns") == 0) goto RETURN_AGAIN;
8e669ac1 1914 }
059ec3d9 1915
322050c2
PH
1916/* Make sure DNS options are set as required. This appears to be necessary in
1917some circumstances when the get..byname() function actually calls the DNS. */
1918
1919dns_init((flags & HOST_FIND_QUALIFY_SINGLE) != 0,
8c51eead
JH
1920 (flags & HOST_FIND_SEARCH_PARENTS) != 0,
1921 FALSE); /*XXX dnssec? */
322050c2 1922
7e66e54d
PH
1923/* In an IPv6 world, unless IPv6 has been disabled, we need to scan for both
1924kinds of address, so go round the loop twice. Note that we have ensured that
1925AF_INET6 is defined even in an IPv4 world, which makes for slightly tidier
1926code. However, if dns_ipv4_lookup matches the domain, we also just do IPv4
1927lookups here (except when testing standalone). */
059ec3d9
PH
1928
1929#if HAVE_IPV6
322050c2
PH
1930 #ifdef STAND_ALONE
1931 if (disable_ipv6)
1932 #else
1933 if (disable_ipv6 ||
1934 (dns_ipv4_lookup != NULL &&
059ec3d9 1935 match_isinlist(host->name, &dns_ipv4_lookup, 0, NULL, NULL, MCL_DOMAIN,
7e66e54d 1936 TRUE, NULL) == OK))
322050c2
PH
1937 #endif
1938
059ec3d9
PH
1939 { af = AF_INET; times = 1; }
1940 else
059ec3d9
PH
1941 { af = AF_INET6; times = 2; }
1942
1943/* No IPv6 support */
1944
1945#else /* HAVE_IPV6 */
1946 times = 1;
1947#endif /* HAVE_IPV6 */
1948
1949/* Initialize the flag that gets set for DNS syntax check errors, so that the
1950interface to this function can be similar to host_find_bydns. */
1951
1952host_find_failed_syntax = FALSE;
1953
1954/* Loop to look up both kinds of address in an IPv6 world */
1955
1956for (i = 1; i <= times;
1957 #if HAVE_IPV6
1958 af = AF_INET, /* If 2 passes, IPv4 on the second */
1959 #endif
1960 i++)
1961 {
1962 BOOL ipv4_addr;
91ecef39 1963 int error_num = 0;
059ec3d9
PH
1964 struct hostent *hostdata;
1965
322050c2
PH
1966 #ifdef STAND_ALONE
1967 printf("Looking up: %s\n", host->name);
1968 #endif
1969
059ec3d9 1970 #if HAVE_IPV6
e7726cbf
PH
1971 if (running_in_test_harness)
1972 hostdata = host_fake_gethostbyname(host->name, af, &error_num);
1973 else
1974 {
059ec3d9
PH
1975 #if HAVE_GETIPNODEBYNAME
1976 hostdata = getipnodebyname(CS host->name, af, 0, &error_num);
1977 #else
1978 hostdata = gethostbyname2(CS host->name, af);
1979 error_num = h_errno;
1980 #endif
e7726cbf
PH
1981 }
1982
1983 #else /* not HAVE_IPV6 */
1984 if (running_in_test_harness)
1985 hostdata = host_fake_gethostbyname(host->name, AF_INET, &error_num);
1986 else
1987 {
1988 hostdata = gethostbyname(CS host->name);
1989 error_num = h_errno;
1990 }
1991 #endif /* HAVE_IPV6 */
059ec3d9
PH
1992
1993 if (hostdata == NULL)
1994 {
1995 uschar *error;
1996 switch (error_num)
1997 {
1998 case HOST_NOT_FOUND: error = US"HOST_NOT_FOUND"; break;
1999 case TRY_AGAIN: error = US"TRY_AGAIN"; break;
2000 case NO_RECOVERY: error = US"NO_RECOVERY"; break;
2001 case NO_DATA: error = US"NO_DATA"; break;
2002 #if NO_DATA != NO_ADDRESS
2003 case NO_ADDRESS: error = US"NO_ADDRESS"; break;
2004 #endif
2005 default: error = US"?"; break;
2006 }
2007
2008 DEBUG(D_host_lookup) debug_printf("%s returned %d (%s)\n",
2009 #if HAVE_IPV6
2010 #if HAVE_GETIPNODEBYNAME
2011 (af == AF_INET6)? "getipnodebyname(af=inet6)" : "getipnodebyname(af=inet)",
2012 #else
2013 (af == AF_INET6)? "gethostbyname2(af=inet6)" : "gethostbyname2(af=inet)",
2014 #endif
2015 #else
2016 "gethostbyname",
2017 #endif
2018 error_num, error);
2019
2020 if (error_num == TRY_AGAIN || error_num == NO_RECOVERY) temp_error = TRUE;
2021 continue;
2022 }
2023 if ((hostdata->h_addr_list)[0] == NULL) continue;
2024
2025 /* Replace the name with the fully qualified one if necessary, and fill in
2026 the fully_qualified_name pointer. */
2027
2028 if (hostdata->h_name[0] != 0 &&
2029 Ustrcmp(host->name, hostdata->h_name) != 0)
2030 host->name = string_copy_dnsdomain((uschar *)hostdata->h_name);
2031 if (fully_qualified_name != NULL) *fully_qualified_name = host->name;
2032
2033 /* Get the list of addresses. IPv4 and IPv6 addresses can be distinguished
2034 by their different lengths. Scan the list, ignoring any that are to be
2035 ignored, and build a chain from the rest. */
2036
2037 ipv4_addr = hostdata->h_length == sizeof(struct in_addr);
2038
2039 for (addrlist = USS hostdata->h_addr_list; *addrlist != NULL; addrlist++)
2040 {
2041 uschar *text_address =
2042 host_ntoa(ipv4_addr? AF_INET:AF_INET6, *addrlist, NULL, NULL);
2043
2044 #ifndef STAND_ALONE
2045 if (ignore_target_hosts != NULL &&
2046 verify_check_this_host(&ignore_target_hosts, NULL, host->name,
2047 text_address, NULL) == OK)
2048 {
2049 DEBUG(D_host_lookup)
2050 debug_printf("ignored host %s [%s]\n", host->name, text_address);
2051 continue;
2052 }
2053 #endif
2054
2055 /* If this is the first address, last == NULL and we put the data in the
2056 original block. */
2057
2058 if (last == NULL)
2059 {
2060 host->address = text_address;
2061 host->port = PORT_NONE;
2062 host->status = hstatus_unknown;
2063 host->why = hwhy_unknown;
783b385f 2064 host->dnssec = DS_UNK;
059ec3d9
PH
2065 last = host;
2066 }
2067
2068 /* Else add further host item blocks for any other addresses, keeping
2069 the order. */
2070
2071 else
2072 {
2073 host_item *next = store_get(sizeof(host_item));
2074 next->name = host->name;
2075 next->mx = host->mx;
2076 next->address = text_address;
2077 next->port = PORT_NONE;
2078 next->status = hstatus_unknown;
2079 next->why = hwhy_unknown;
783b385f 2080 next->dnssec = DS_UNK;
059ec3d9
PH
2081 next->last_try = 0;
2082 next->next = last->next;
2083 last->next = next;
2084 last = next;
2085 }
2086 }
2087 }
2088
2089/* If no hosts were found, the address field in the original host block will be
2090NULL. If temp_error is set, at least one of the lookups gave a temporary error,
2091so we pass that back. */
2092
2093if (host->address == NULL)
2094 {
2095 uschar *msg =
2096 #ifndef STAND_ALONE
2097 (message_id[0] == 0 && smtp_in != NULL)?
2098 string_sprintf("no IP address found for host %s (during %s)", host->name,
2099 smtp_get_connection_info()) :
2100 #endif
2101 string_sprintf("no IP address found for host %s", host->name);
2102
2103 HDEBUG(D_host_lookup) debug_printf("%s\n", msg);
9b8fadde 2104 if (temp_error) goto RETURN_AGAIN;
059ec3d9
PH
2105 if (host_checking || !log_testing_mode)
2106 log_write(L_host_lookup_failed, LOG_MAIN, "%s", msg);
2107 return HOST_FIND_FAILED;
2108 }
2109
2110/* Remove any duplicate IP addresses, then check to see if this is the local
2111host if required. */
2112
2113host_remove_duplicates(host, &last);
2114yield = local_host_check?
2115 host_scan_for_local_hosts(host, &last, NULL) : HOST_FOUND;
2116
059ec3d9
PH
2117HDEBUG(D_host_lookup)
2118 {
2119 host_item *h;
2120 if (fully_qualified_name != NULL)
2121 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
2122 debug_printf("%s looked up these IP addresses:\n",
2123 #if HAVE_IPV6
2124 #if HAVE_GETIPNODEBYNAME
2125 "getipnodebyname"
2126 #else
2127 "gethostbyname2"
2128 #endif
2129 #else
2130 "gethostbyname"
2131 #endif
2132 );
2133 for (h = host; h != last->next; h = h->next)
2134 debug_printf(" name=%s address=%s\n", h->name,
2135 (h->address == NULL)? US"<null>" : h->address);
2136 }
2137
2138/* Return the found status. */
2139
2140return yield;
9b8fadde
PH
2141
2142/* Handle the case when there is a temporary error. If the name matches
2143dns_again_means_nonexist, return permanent rather than temporary failure. */
2144
2145RETURN_AGAIN:
2146 {
2147 #ifndef STAND_ALONE
2148 int rc;
2149 uschar *save = deliver_domain;
2150 deliver_domain = host->name; /* set $domain */
2151 rc = match_isinlist(host->name, &dns_again_means_nonexist, 0, NULL, NULL,
2152 MCL_DOMAIN, TRUE, NULL);
2153 deliver_domain = save;
2154 if (rc == OK)
2155 {
2156 DEBUG(D_host_lookup) debug_printf("%s is in dns_again_means_nonexist: "
2157 "returning HOST_FIND_FAILED\n", host->name);
2158 return HOST_FIND_FAILED;
2159 }
2160 #endif
2161 return HOST_FIND_AGAIN;
2162 }
059ec3d9
PH
2163}
2164
2165
2166
2167/*************************************************
2168* Fill in a host address from the DNS *
2169*************************************************/
2170
1349e1e5
PH
2171/* Given a host item, with its name, port and mx fields set, and its address
2172field set to NULL, fill in its IP address from the DNS. If it is multi-homed,
2173create additional host items for the additional addresses, copying all the
2174other fields, and randomizing the order.
059ec3d9
PH
2175
2176On IPv6 systems, A6 records are sought first (but only if support for A6 is
2177configured - they may never become mainstream), then AAAA records are sought,
2178and finally A records are sought as well.
2179
2180The host name may be changed if the DNS returns a different name - e.g. fully
2181qualified or changed via CNAME. If fully_qualified_name is not NULL, dns_lookup
2182ensures that it points to the fully qualified name. However, this is the fully
2183qualified version of the original name; if a CNAME is involved, the actual
2184canonical host name may be different again, and so we get it directly from the
2185relevant RR. Note that we do NOT change the mx field of the host item in this
2186function as it may be called to set the addresses of hosts taken from MX
2187records.
2188
2189Arguments:
2190 host points to the host item we're filling in
2191 lastptr points to pointer to last host item in a chain of
2192 host items (may be updated if host is last and gets
2193 extended because multihomed)
2194 ignore_target_hosts list of hosts to ignore
2195 allow_ip if TRUE, recognize an IP address and return it
2196 fully_qualified_name if not NULL, return fully qualified name here if
2197 the contents are different (i.e. it must be preset
2198 to something)
8c51eead 2199 dnnssec_require if TRUE check the DNS result AD bit
059ec3d9
PH
2200
2201Returns: HOST_FIND_FAILED couldn't find A record
2202 HOST_FIND_AGAIN try again later
2203 HOST_FOUND found AAAA and/or A record(s)
2204 HOST_IGNORED found, but all IPs ignored
2205*/
2206
2207static int
2208set_address_from_dns(host_item *host, host_item **lastptr,
8c51eead 2209 uschar *ignore_target_hosts, BOOL allow_ip, uschar **fully_qualified_name,
4e0983dc 2210 BOOL dnssec_requested, BOOL dnssec_require)
059ec3d9
PH
2211{
2212dns_record *rr;
2213host_item *thishostlast = NULL; /* Indicates not yet filled in anything */
2214BOOL v6_find_again = FALSE;
2215int i;
2216
2217/* If allow_ip is set, a name which is an IP address returns that value
2218as its address. This is used for MX records when allow_mx_to_ip is set, for
2219those sites that feel they have to flaunt the RFC rules. */
2220
2221if (allow_ip && string_is_ip_address(host->name, NULL) != 0)
2222 {
2223 #ifndef STAND_ALONE
2224 if (ignore_target_hosts != NULL &&
2225 verify_check_this_host(&ignore_target_hosts, NULL, host->name,
2226 host->name, NULL) == OK)
2227 return HOST_IGNORED;
2228 #endif
2229
2230 host->address = host->name;
059ec3d9
PH
2231 return HOST_FOUND;
2232 }
2233
7e66e54d
PH
2234/* On an IPv6 system, unless IPv6 is disabled, go round the loop up to three
2235times, looking for A6 and AAAA records the first two times. However, unless
2236doing standalone testing, we force an IPv4 lookup if the domain matches
2237dns_ipv4_lookup is set. Since A6 records look like being abandoned, support
2238them only if explicitly configured to do so. On an IPv4 system, go round the
2239loop once only, looking only for A records. */
059ec3d9
PH
2240
2241#if HAVE_IPV6
059ec3d9 2242 #ifndef STAND_ALONE
7e66e54d 2243 if (disable_ipv6 || (dns_ipv4_lookup != NULL &&
059ec3d9 2244 match_isinlist(host->name, &dns_ipv4_lookup, 0, NULL, NULL, MCL_DOMAIN,
7e66e54d 2245 TRUE, NULL) == OK))
059ec3d9
PH
2246 i = 0; /* look up A records only */
2247 else
2248 #endif /* STAND_ALONE */
2249
2250 #ifdef SUPPORT_A6
2251 i = 2; /* look up A6 and AAAA and A records */
2252 #else
2253 i = 1; /* look up AAAA and A records */
2254 #endif /* SUPPORT_A6 */
2255
2256/* The IPv4 world */
2257
2258#else /* HAVE_IPV6 */
2259 i = 0; /* look up A records only */
2260#endif /* HAVE_IPV6 */
2261
2262for (; i >= 0; i--)
2263 {
2264 static int types[] = { T_A, T_AAAA, T_A6 };
2265 int type = types[i];
2266 int randoffset = (i == 0)? 500 : 0; /* Ensures v6 sorts before v4 */
2267 dns_answer dnsa;
2268 dns_scan dnss;
2269
2270 int rc = dns_lookup(&dnsa, host->name, type, fully_qualified_name);
4e0983dc
JH
2271 lookup_dnssec_authenticated = !dnssec_requested ? NULL
2272 : dns_is_secure(&dnsa) ? US"yes" : US"no";
059ec3d9
PH
2273
2274 /* We want to return HOST_FIND_AGAIN if one of the A, A6, or AAAA lookups
2275 fails or times out, but not if another one succeeds. (In the early
2276 IPv6 days there are name servers that always fail on AAAA, but are happy
2277 to give out an A record. We want to proceed with that A record.) */
8e669ac1 2278
059ec3d9
PH
2279 if (rc != DNS_SUCCEED)
2280 {
2281 if (i == 0) /* Just tried for an A record, i.e. end of loop */
2282 {
2283 if (host->address != NULL) return HOST_FOUND; /* A6 or AAAA was found */
2284 if (rc == DNS_AGAIN || rc == DNS_FAIL || v6_find_again)
2285 return HOST_FIND_AGAIN;
2286 return HOST_FIND_FAILED; /* DNS_NOMATCH or DNS_NODATA */
2287 }
2288
2289 /* Tried for an A6 or AAAA record: remember if this was a temporary
2290 error, and look for the next record type. */
2291
2292 if (rc != DNS_NOMATCH && rc != DNS_NODATA) v6_find_again = TRUE;
2293 continue;
2294 }
8c51eead
JH
2295 if (dnssec_require && !dns_is_secure(&dnsa))
2296 {
2297 log_write(L_host_lookup_failed, LOG_MAIN, "dnssec fail on %s for %.256s",
2298 i>1 ? "A6" : i>0 ? "AAAA" : "A", host->name);
2299 continue;
2300 }
059ec3d9
PH
2301
2302 /* Lookup succeeded: fill in the given host item with the first non-ignored
2303 address found; create additional items for any others. A single A6 record
2304 may generate more than one address. */
2305
2306 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2307 rr != NULL;
2308 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2309 {
2310 if (rr->type == type)
2311 {
2312 /* dns_address *da = dns_address_from_rr(&dnsa, rr); */
2313
2314 dns_address *da;
2315 da = dns_address_from_rr(&dnsa, rr);
2316
2317 DEBUG(D_host_lookup)
2318 {
2319 if (da == NULL)
2320 debug_printf("no addresses extracted from A6 RR for %s\n",
2321 host->name);
2322 }
2323
2324 /* This loop runs only once for A and AAAA records, but may run
2325 several times for an A6 record that generated multiple addresses. */
2326
2327 for (; da != NULL; da = da->next)
2328 {
2329 #ifndef STAND_ALONE
2330 if (ignore_target_hosts != NULL &&
2331 verify_check_this_host(&ignore_target_hosts, NULL,
2332 host->name, da->address, NULL) == OK)
2333 {
2334 DEBUG(D_host_lookup)
2335 debug_printf("ignored host %s [%s]\n", host->name, da->address);
2336 continue;
2337 }
2338 #endif
2339
2340 /* If this is the first address, stick it in the given host block,
2341 and change the name if the returned RR has a different name. */
2342
2343 if (thishostlast == NULL)
2344 {
2345 if (strcmpic(host->name, rr->name) != 0)
2346 host->name = string_copy_dnsdomain(rr->name);
2347 host->address = da->address;
059ec3d9
PH
2348 host->sort_key = host->mx * 1000 + random_number(500) + randoffset;
2349 host->status = hstatus_unknown;
2350 host->why = hwhy_unknown;
2351 thishostlast = host;
2352 }
2353
2354 /* Not the first address. Check for, and ignore, duplicates. Then
2355 insert in the chain at a random point. */
2356
2357 else
2358 {
2359 int new_sort_key;
2360 host_item *next;
2361
2362 /* End of our local chain is specified by "thishostlast". */
2363
2364 for (next = host;; next = next->next)
2365 {
2366 if (Ustrcmp(CS da->address, next->address) == 0) break;
2367 if (next == thishostlast) { next = NULL; break; }
2368 }
2369 if (next != NULL) continue; /* With loop for next address */
2370
2371 /* Not a duplicate */
2372
2373 new_sort_key = host->mx * 1000 + random_number(500) + randoffset;
2374 next = store_get(sizeof(host_item));
2375
2376 /* New address goes first: insert the new block after the first one
2377 (so as not to disturb the original pointer) but put the new address
2378 in the original block. */
2379
2380 if (new_sort_key < host->sort_key)
2381 {
1349e1e5 2382 *next = *host; /* Copies port */
059ec3d9
PH
2383 host->next = next;
2384 host->address = da->address;
059ec3d9
PH
2385 host->sort_key = new_sort_key;
2386 if (thishostlast == host) thishostlast = next; /* Local last */
2387 if (*lastptr == host) *lastptr = next; /* Global last */
2388 }
2389
2390 /* Otherwise scan down the addresses for this host to find the
2391 one to insert after. */
2392
2393 else
2394 {
2395 host_item *h = host;
2396 while (h != thishostlast)
2397 {
2398 if (new_sort_key < h->next->sort_key) break;
2399 h = h->next;
2400 }
1349e1e5 2401 *next = *h; /* Copies port */
059ec3d9
PH
2402 h->next = next;
2403 next->address = da->address;
059ec3d9
PH
2404 next->sort_key = new_sort_key;
2405 if (h == thishostlast) thishostlast = next; /* Local last */
2406 if (h == *lastptr) *lastptr = next; /* Global last */
2407 }
2408 }
2409 }
2410 }
2411 }
2412 }
2413
2414/* Control gets here only if the third lookup (the A record) succeeded.
2415However, the address may not be filled in if it was ignored. */
2416
2417return (host->address == NULL)? HOST_IGNORED : HOST_FOUND;
2418}
2419
2420
2421
2422
2423/*************************************************
1349e1e5 2424* Find IP addresses and host names via DNS *
059ec3d9
PH
2425*************************************************/
2426
1349e1e5
PH
2427/* The input is a host_item structure with the name field filled in and the
2428address field set to NULL. This may be in a chain of other host items. The
2429lookup may result in more than one IP address, in which case we must created
2430new host blocks for the additional addresses, and insert them into the chain.
2431The original name may not be fully qualified. Use the fully_qualified_name
2432argument to return the official name, as returned by the resolver.
059ec3d9
PH
2433
2434Arguments:
2435 host point to initial host item
2436 ignore_target_hosts a list of hosts to ignore
2437 whichrrs flags indicating which RRs to look for:
2438 HOST_FIND_BY_SRV => look for SRV
2439 HOST_FIND_BY_MX => look for MX
2440 HOST_FIND_BY_A => look for A or AAAA
2441 also flags indicating how the lookup is done
2442 HOST_FIND_QUALIFY_SINGLE ) passed to the
2443 HOST_FIND_SEARCH_PARENTS ) resolver
2444 srv_service when SRV used, the service name
2445 srv_fail_domains DNS errors for these domains => assume nonexist
2446 mx_fail_domains DNS errors for these domains => assume nonexist
8c51eead
JH
2447 dnssec_request_domains => make dnssec request
2448 dnssec_require_domains => ditto and nonexist failures
059ec3d9
PH
2449 fully_qualified_name if not NULL, return fully-qualified name
2450 removed set TRUE if local host was removed from the list
2451
2452Returns: HOST_FIND_FAILED Failed to find the host or domain;
2453 if there was a syntax error,
2454 host_find_failed_syntax is set.
2455 HOST_FIND_AGAIN Could not resolve at this time
2456 HOST_FOUND Host found
2457 HOST_FOUND_LOCAL The lowest MX record points to this
2458 machine, if MX records were found, or
2459 an A record that was found contains
2460 an address of the local host
2461*/
2462
2463int
2464host_find_bydns(host_item *host, uschar *ignore_target_hosts, int whichrrs,
2465 uschar *srv_service, uschar *srv_fail_domains, uschar *mx_fail_domains,
8c51eead 2466 uschar *dnssec_request_domains, uschar *dnssec_require_domains,
059ec3d9
PH
2467 uschar **fully_qualified_name, BOOL *removed)
2468{
2469host_item *h, *last;
2470dns_record *rr;
2471int rc = DNS_FAIL;
2472int ind_type = 0;
2473int yield;
2474dns_answer dnsa;
2475dns_scan dnss;
8c51eead
JH
2476BOOL dnssec_require = match_isinlist(host->name, &dnssec_require_domains,
2477 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL) == OK;
783b385f
JH
2478BOOL dnssec_request = dnssec_require
2479 || match_isinlist(host->name, &dnssec_request_domains,
2480 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL) == OK;
2481dnssec_status_t dnssec;
059ec3d9
PH
2482
2483/* Set the default fully qualified name to the incoming name, initialize the
2484resolver if necessary, set up the relevant options, and initialize the flag
2485that gets set for DNS syntax check errors. */
2486
2487if (fully_qualified_name != NULL) *fully_qualified_name = host->name;
2488dns_init((whichrrs & HOST_FIND_QUALIFY_SINGLE) != 0,
8c51eead 2489 (whichrrs & HOST_FIND_SEARCH_PARENTS) != 0,
783b385f 2490 dnssec_request
8c51eead 2491 );
059ec3d9
PH
2492host_find_failed_syntax = FALSE;
2493
2494/* First, if requested, look for SRV records. The service name is given; we
2495assume TCP progocol. DNS domain names are constrained to a maximum of 256
2496characters, so the code below should be safe. */
2497
2498if ((whichrrs & HOST_FIND_BY_SRV) != 0)
2499 {
2500 uschar buffer[300];
2501 uschar *temp_fully_qualified_name = buffer;
2502 int prefix_length;
2503
2504 (void)sprintf(CS buffer, "_%s._tcp.%n%.256s", srv_service, &prefix_length,
2505 host->name);
2506 ind_type = T_SRV;
2507
2508 /* Search for SRV records. If the fully qualified name is different to
2509 the input name, pass back the new original domain, without the prepended
2510 magic. */
2511
783b385f
JH
2512 dnssec = DS_UNK;
2513 lookup_dnssec_authenticated = NULL;
059ec3d9 2514 rc = dns_lookup(&dnsa, buffer, ind_type, &temp_fully_qualified_name);
783b385f
JH
2515
2516 if (dnssec_request)
2517 {
2518 if (dns_is_secure(&dnsa))
2519 { dnssec = DS_YES; lookup_dnssec_authenticated = US"yes"; }
2520 else
2521 { dnssec = DS_NO; lookup_dnssec_authenticated = US"no"; }
2522 }
4e0983dc 2523
059ec3d9
PH
2524 if (temp_fully_qualified_name != buffer && fully_qualified_name != NULL)
2525 *fully_qualified_name = temp_fully_qualified_name + prefix_length;
2526
2527 /* On DNS failures, we give the "try again" error unless the domain is
2528 listed as one for which we continue. */
2529
8c51eead
JH
2530 if (rc == DNS_SUCCEED && dnssec_require && !dns_is_secure(&dnsa))
2531 {
2532 log_write(L_host_lookup_failed, LOG_MAIN,
2533 "dnssec fail on SRV for %.256s", host->name);
2534 rc = DNS_FAIL;
2535 }
059ec3d9
PH
2536 if (rc == DNS_FAIL || rc == DNS_AGAIN)
2537 {
e7726cbf 2538 #ifndef STAND_ALONE
059ec3d9
PH
2539 if (match_isinlist(host->name, &srv_fail_domains, 0, NULL, NULL, MCL_DOMAIN,
2540 TRUE, NULL) != OK)
e7726cbf 2541 #endif
8c51eead 2542 { yield = HOST_FIND_AGAIN; goto out; }
059ec3d9
PH
2543 DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA "
2544 "(domain in srv_fail_domains)\n", (rc == DNS_FAIL)? "FAIL":"AGAIN");
2545 }
2546 }
2547
2548/* If we did not find any SRV records, search the DNS for MX records, if
2549requested to do so. If the result is DNS_NOMATCH, it means there is no such
2550domain, and there's no point in going on to look for address records with the
2551same domain. The result will be DNS_NODATA if the domain exists but has no MX
2552records. On DNS failures, we give the "try again" error unless the domain is
2553listed as one for which we continue. */
2554
2555if (rc != DNS_SUCCEED && (whichrrs & HOST_FIND_BY_MX) != 0)
2556 {
2557 ind_type = T_MX;
783b385f
JH
2558 dnssec = DS_UNK;
2559 lookup_dnssec_authenticated = NULL;
059ec3d9 2560 rc = dns_lookup(&dnsa, host->name, ind_type, fully_qualified_name);
783b385f
JH
2561
2562 if (dnssec_request)
2563 {
2564 if (dns_is_secure(&dnsa))
2565 { dnssec = DS_YES; lookup_dnssec_authenticated = US"yes"; }
2566 else
2567 { dnssec = DS_NO; lookup_dnssec_authenticated = US"no"; }
2568 }
4e0983dc 2569
8c51eead
JH
2570 switch (rc)
2571 {
2572 case DNS_NOMATCH:
2573 yield = HOST_FIND_FAILED; goto out;
2574
2575 case DNS_SUCCEED:
2576 if (!dnssec_require || dns_is_secure(&dnsa))
2577 break;
2578 log_write(L_host_lookup_failed, LOG_MAIN,
2579 "dnssec fail on MX for %.256s", host->name);
2580 rc = DNS_FAIL;
2581 /*FALLTRHOUGH*/
2582
2583 case DNS_FAIL:
2584 case DNS_AGAIN:
2585 #ifndef STAND_ALONE
2586 if (match_isinlist(host->name, &mx_fail_domains, 0, NULL, NULL, MCL_DOMAIN,
2587 TRUE, NULL) != OK)
2588 #endif
2589 { yield = HOST_FIND_AGAIN; goto out; }
2590 DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA "
2591 "(domain in mx_fail_domains)\n", (rc == DNS_FAIL)? "FAIL":"AGAIN");
2592 break;
059ec3d9
PH
2593 }
2594 }
2595
2596/* If we haven't found anything yet, and we are requested to do so, try for an
2597A or AAAA record. If we find it (or them) check to see that it isn't the local
2598host. */
2599
2600if (rc != DNS_SUCCEED)
2601 {
2602 if ((whichrrs & HOST_FIND_BY_A) == 0)
2603 {
2604 DEBUG(D_host_lookup) debug_printf("Address records are not being sought\n");
8c51eead
JH
2605 yield = HOST_FIND_FAILED;
2606 goto out;
059ec3d9
PH
2607 }
2608
2609 last = host; /* End of local chainlet */
2610 host->mx = MX_NONE;
2611 host->port = PORT_NONE;
783b385f
JH
2612 dnssec = DS_UNK;
2613 lookup_dnssec_authenticated = NULL;
059ec3d9 2614 rc = set_address_from_dns(host, &last, ignore_target_hosts, FALSE,
4e0983dc 2615 fully_qualified_name, dnssec_request, dnssec_require);
059ec3d9 2616
783b385f
JH
2617 if (dnssec_request)
2618 {
2619 if (dns_is_secure(&dnsa))
2620 { dnssec = DS_YES; lookup_dnssec_authenticated = US"yes"; }
2621 else
2622 { dnssec = DS_NO; lookup_dnssec_authenticated = US"no"; }
2623 }
2624
059ec3d9
PH
2625 /* If one or more address records have been found, check that none of them
2626 are local. Since we know the host items all have their IP addresses
2627 inserted, host_scan_for_local_hosts() can only return HOST_FOUND or
2628 HOST_FOUND_LOCAL. We do not need to scan for duplicate IP addresses here,
2629 because set_address_from_dns() removes them. */
2630
2631 if (rc == HOST_FOUND)
2632 rc = host_scan_for_local_hosts(host, &last, removed);
2633 else
2634 if (rc == HOST_IGNORED) rc = HOST_FIND_FAILED; /* No special action */
2635
2636 DEBUG(D_host_lookup)
2637 {
2638 host_item *h;
2639 if (host->address != NULL)
2640 {
2641 if (fully_qualified_name != NULL)
2642 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
2643 for (h = host; h != last->next; h = h->next)
2644 debug_printf("%s %s mx=%d sort=%d %s\n", h->name,
2645 (h->address == NULL)? US"<null>" : h->address, h->mx, h->sort_key,
2646 (h->status >= hstatus_unusable)? US"*" : US"");
2647 }
2648 }
2649
8c51eead
JH
2650 yield = rc;
2651 goto out;
059ec3d9
PH
2652 }
2653
2654/* We have found one or more MX or SRV records. Sort them according to
2655precedence. Put the data for the first one into the existing host block, and
2656insert new host_item blocks into the chain for the remainder. For equal
2657precedences one is supposed to randomize the order. To make this happen, the
2658sorting is actually done on the MX value * 1000 + a random number. This is put
2659into a host field called sort_key.
2660
2661In the case of hosts with both IPv6 and IPv4 addresses, we want to choose the
2662IPv6 address in preference. At this stage, we don't know what kind of address
2663the host has. We choose a random number < 500; if later we find an A record
2664first, we add 500 to the random number. Then for any other address records, we
2665use random numbers in the range 0-499 for AAAA records and 500-999 for A
2666records.
2667
2668At this point we remove any duplicates that point to the same host, retaining
2669only the one with the lowest precedence. We cannot yet check for precedence
2670greater than that of the local host, because that test cannot be properly done
2671until the addresses have been found - an MX record may point to a name for this
2672host which is not the primary hostname. */
2673
2674last = NULL; /* Indicates that not even the first item is filled yet */
2675
2676for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2677 rr != NULL;
2678 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2679 {
2680 int precedence;
2681 int weight = 0; /* For SRV records */
1349e1e5 2682 int port = PORT_NONE;
059ec3d9
PH
2683 uschar *s; /* MUST be unsigned for GETSHORT */
2684 uschar data[256];
2685
2686 if (rr->type != ind_type) continue;
2687 s = rr->data;
2688 GETSHORT(precedence, s); /* Pointer s is advanced */
2689
2690 /* For MX records, we use a random "weight" which causes multiple records of
2691 the same precedence to sort randomly. */
2692
2693 if (ind_type == T_MX)
059ec3d9 2694 weight = random_number(500);
059ec3d9
PH
2695
2696 /* SRV records are specified with a port and a weight. The weight is used
2697 in a special algorithm. However, to start with, we just use it to order the
2698 records of equal priority (precedence). */
2699
2700 else
2701 {
2702 GETSHORT(weight, s);
2703 GETSHORT(port, s);
2704 }
2705
2706 /* Get the name of the host pointed to. */
2707
2708 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, s,
2709 (DN_EXPAND_ARG4_TYPE)data, sizeof(data));
2710
2711 /* Check that we haven't already got this host on the chain; if we have,
2712 keep only the lower precedence. This situation shouldn't occur, but you
2713 never know what junk might get into the DNS (and this case has been seen on
2714 more than one occasion). */
2715
2716 if (last != NULL) /* This is not the first record */
2717 {
2718 host_item *prev = NULL;
2719
2720 for (h = host; h != last->next; prev = h, h = h->next)
2721 {
2722 if (strcmpic(h->name, data) == 0)
2723 {
2724 DEBUG(D_host_lookup)
2725 debug_printf("discarded duplicate host %s (MX=%d)\n", data,
2726 (precedence > h->mx)? precedence : h->mx);
2727 if (precedence >= h->mx) goto NEXT_MX_RR; /* Skip greater precedence */
2728 if (h == host) /* Override first item */
2729 {
2730 h->mx = precedence;
2731 host->sort_key = precedence * 1000 + weight;
2732 goto NEXT_MX_RR;
2733 }
2734
2735 /* Unwanted host item is not the first in the chain, so we can get
2736 get rid of it by cutting it out. */
2737
2738 prev->next = h->next;
2739 if (h == last) last = prev;
2740 break;
2741 }
2742 }
2743 }
2744
2745 /* If this is the first MX or SRV record, put the data into the existing host
2746 block. Otherwise, add a new block in the correct place; if it has to be
2747 before the first block, copy the first block's data to a new second block. */
2748
2749 if (last == NULL)
2750 {
2751 host->name = string_copy_dnsdomain(data);
2752 host->address = NULL;
2753 host->port = port;
2754 host->mx = precedence;
2755 host->sort_key = precedence * 1000 + weight;
2756 host->status = hstatus_unknown;
2757 host->why = hwhy_unknown;
783b385f 2758 host->dnssec = dnssec;
059ec3d9
PH
2759 last = host;
2760 }
2761
2762 /* Make a new host item and seek the correct insertion place */
2763
2764 else
2765 {
2766 int sort_key = precedence * 1000 + weight;
2767 host_item *next = store_get(sizeof(host_item));
2768 next->name = string_copy_dnsdomain(data);
2769 next->address = NULL;
2770 next->port = port;
2771 next->mx = precedence;
2772 next->sort_key = sort_key;
2773 next->status = hstatus_unknown;
2774 next->why = hwhy_unknown;
783b385f 2775 next->dnssec = dnssec;
059ec3d9
PH
2776 next->last_try = 0;
2777
2778 /* Handle the case when we have to insert before the first item. */
2779
2780 if (sort_key < host->sort_key)
2781 {
2782 host_item htemp;
2783 htemp = *host;
2784 *host = *next;
2785 *next = htemp;
2786 host->next = next;
2787 if (last == host) last = next;
2788 }
2789
2790 /* Else scan down the items we have inserted as part of this exercise;
2791 don't go further. */
2792
2793 else
2794 {
2795 for (h = host; h != last; h = h->next)
2796 {
2797 if (sort_key < h->next->sort_key)
2798 {
2799 next->next = h->next;
2800 h->next = next;
2801 break;
2802 }
2803 }
2804
2805 /* Join on after the last host item that's part of this
2806 processing if we haven't stopped sooner. */
2807
2808 if (h == last)
2809 {
2810 next->next = last->next;
2811 last->next = next;
2812 last = next;
2813 }
2814 }
2815 }
2816
2817 NEXT_MX_RR: continue;
2818 }
2819
2820/* If the list of hosts was obtained from SRV records, there are two things to
2821do. First, if there is only one host, and it's name is ".", it means there is
2822no SMTP service at this domain. Otherwise, we have to sort the hosts of equal
2823priority according to their weights, using an algorithm that is defined in RFC
28242782. The hosts are currently sorted by priority and weight. For each priority
2825group we have to pick off one host and put it first, and then repeat for any
2826remaining in the same priority group. */
2827
2828if (ind_type == T_SRV)
2829 {
2830 host_item **pptr;
2831
2832 if (host == last && host->name[0] == 0)
2833 {
2834 DEBUG(D_host_lookup) debug_printf("the single SRV record is \".\"\n");
8c51eead
JH
2835 yield = HOST_FIND_FAILED;
2836 goto out;
059ec3d9
PH
2837 }
2838
2839 DEBUG(D_host_lookup)
2840 {
2841 debug_printf("original ordering of hosts from SRV records:\n");
2842 for (h = host; h != last->next; h = h->next)
2843 debug_printf(" %s P=%d W=%d\n", h->name, h->mx, h->sort_key % 1000);
2844 }
2845
2846 for (pptr = &host, h = host; h != last; pptr = &(h->next), h = h->next)
2847 {
2848 int sum = 0;
2849 host_item *hh;
2850
2851 /* Find the last following host that has the same precedence. At the same
2852 time, compute the sum of the weights and the running totals. These can be
2853 stored in the sort_key field. */
2854
2855 for (hh = h; hh != last; hh = hh->next)
2856 {
2857 int weight = hh->sort_key % 1000; /* was precedence * 1000 + weight */
2858 sum += weight;
2859 hh->sort_key = sum;
2860 if (hh->mx != hh->next->mx) break;
2861 }
2862
2863 /* If there's more than one host at this precedence (priority), we need to
2864 pick one to go first. */
2865
2866 if (hh != h)
2867 {
2868 host_item *hhh;
2869 host_item **ppptr;
2870 int randomizer = random_number(sum + 1);
2871
2872 for (ppptr = pptr, hhh = h;
2873 hhh != hh;
2874 ppptr = &(hhh->next), hhh = hhh->next)
2875 {
2876 if (hhh->sort_key >= randomizer) break;
2877 }
2878
2879 /* hhh now points to the host that should go first; ppptr points to the
2880 place that points to it. Unfortunately, if the start of the minilist is
2881 the start of the entire list, we can't just swap the items over, because
2882 we must not change the value of host, since it is passed in from outside.
2883 One day, this could perhaps be changed.
2884
2885 The special case is fudged by putting the new item *second* in the chain,
2886 and then transferring the data between the first and second items. We
2887 can't just swap the first and the chosen item, because that would mean
2888 that an item with zero weight might no longer be first. */
2889
2890 if (hhh != h)
2891 {
2892 *ppptr = hhh->next; /* Cuts it out of the chain */
2893
2894 if (h == host)
2895 {
2896 host_item temp = *h;
2897 *h = *hhh;
2898 *hhh = temp;
2899 hhh->next = temp.next;
2900 h->next = hhh;
2901 }
2902
2903 else
2904 {
2905 hhh->next = h; /* The rest of the chain follows it */
2906 *pptr = hhh; /* It takes the place of h */
2907 h = hhh; /* It's now the start of this minilist */
2908 }
2909 }
2910 }
2911
2912 /* A host has been chosen to be first at this priority and h now points
2913 to this host. There may be others at the same priority, or others at a
2914 different priority. Before we leave this host, we need to put back a sort
2915 key of the traditional MX kind, in case this host is multihomed, because
2916 the sort key is used for ordering the multiple IP addresses. We do not need
2917 to ensure that these new sort keys actually reflect the order of the hosts,
2918 however. */
2919
2920 h->sort_key = h->mx * 1000 + random_number(500);
2921 } /* Move on to the next host */
2922 }
2923
1349e1e5
PH
2924/* Now we have to find IP addresses for all the hosts. We have ensured above
2925that the names in all the host items are unique. Before release 4.61 we used to
2926process records from the additional section in the DNS packet that returned the
2927MX or SRV records. However, a DNS name server is free to drop any resource
2928records from the additional section. In theory, this has always been a
2929potential problem, but it is exacerbated by the advent of IPv6. If a host had
2930several IPv4 addresses and some were not in the additional section, at least
2931Exim would try the others. However, if a host had both IPv4 and IPv6 addresses
2932and all the IPv4 (say) addresses were absent, Exim would try only for a IPv6
2933connection, and never try an IPv4 address. When there was only IPv4
2934connectivity, this was a disaster that did in practice occur.
2935
2936So, from release 4.61 onwards, we always search for A and AAAA records
2937explicitly. The names shouldn't point to CNAMES, but we use the general lookup
2938function that handles them, just in case. If any lookup gives a soft error,
2939change the default yield.
059ec3d9
PH
2940
2941For these DNS lookups, we must disable qualify_single and search_parents;
2942otherwise invalid host names obtained from MX or SRV records can cause trouble
2943if they happen to match something local. */
2944
1349e1e5 2945yield = HOST_FIND_FAILED; /* Default yield */
8c51eead
JH
2946dns_init(FALSE, FALSE, /* Disable qualify_single and search_parents */
2947 dnssec_request || dnssec_require);
059ec3d9
PH
2948
2949for (h = host; h != last->next; h = h->next)
2950 {
1349e1e5 2951 if (h->address != NULL) continue; /* Inserted by a multihomed host */
8c51eead 2952 rc = set_address_from_dns(h, &last, ignore_target_hosts, allow_mx_to_ip,
4e0983dc 2953 NULL, dnssec_request, dnssec_require);
059ec3d9
PH
2954 if (rc != HOST_FOUND)
2955 {
2956 h->status = hstatus_unusable;
2957 if (rc == HOST_FIND_AGAIN)
2958 {
2959 yield = rc;
2960 h->why = hwhy_deferred;
2961 }
2962 else
2963 h->why = (rc == HOST_IGNORED)? hwhy_ignored : hwhy_failed;
2964 }
2965 }
2966
2967/* Scan the list for any hosts that are marked unusable because they have
2968been explicitly ignored, and remove them from the list, as if they did not
2969exist. If we end up with just a single, ignored host, flatten its fields as if
2970nothing was found. */
2971
2972if (ignore_target_hosts != NULL)
2973 {
2974 host_item *prev = NULL;
2975 for (h = host; h != last->next; h = h->next)
2976 {
2977 REDO:
2978 if (h->why != hwhy_ignored) /* Non ignored host, just continue */
2979 prev = h;
2980 else if (prev == NULL) /* First host is ignored */
2981 {
2982 if (h != last) /* First is not last */
2983 {
2984 if (h->next == last) last = h; /* Overwrite it with next */
2985 *h = *(h->next); /* and reprocess it. */
2986 goto REDO; /* C should have redo, like Perl */
2987 }
2988 }
2989 else /* Ignored host is not first - */
2990 { /* cut it out */
2991 prev->next = h->next;
2992 if (h == last) last = prev;
2993 }
2994 }
2995
2996 if (host->why == hwhy_ignored) host->address = NULL;
2997 }
2998
2999/* There is still one complication in the case of IPv6. Although the code above
3000arranges that IPv6 addresses take precedence over IPv4 addresses for multihomed
3001hosts, it doesn't do this for addresses that apply to different hosts with the
3002same MX precedence, because the sorting on MX precedence happens first. So we
3003have to make another pass to check for this case. We ensure that, within a
3004single MX preference value, IPv6 addresses come first. This can separate the
3005addresses of a multihomed host, but that should not matter. */
3006
3007#if HAVE_IPV6
f3d7df6c 3008if (h != last && !disable_ipv6)
059ec3d9
PH
3009 {
3010 for (h = host; h != last; h = h->next)
3011 {
3012 host_item temp;
3013 host_item *next = h->next;
f3d7df6c
PH
3014 if (h->mx != next->mx || /* If next is different MX */
3015 h->address == NULL || /* OR this one is unset */
3016 Ustrchr(h->address, ':') != NULL || /* OR this one is IPv6 */
3017 (next->address != NULL &&
3018 Ustrchr(next->address, ':') == NULL)) /* OR next is IPv4 */
3019 continue; /* move on to next */
3020 temp = *h; /* otherwise, swap */
059ec3d9
PH
3021 temp.next = next->next;
3022 *h = *next;
3023 h->next = next;
3024 *next = temp;
3025 }
3026 }
3027#endif
3028
059ec3d9
PH
3029/* Remove any duplicate IP addresses and then scan the list of hosts for any
3030whose IP addresses are on the local host. If any are found, all hosts with the
3031same or higher MX values are removed. However, if the local host has the lowest
3032numbered MX, then HOST_FOUND_LOCAL is returned. Otherwise, if at least one host
3033with an IP address is on the list, HOST_FOUND is returned. Otherwise,
3034HOST_FIND_FAILED is returned, but in this case do not update the yield, as it
3035might have been set to HOST_FIND_AGAIN just above here. If not, it will already
3036be HOST_FIND_FAILED. */
3037
3038host_remove_duplicates(host, &last);
3039rc = host_scan_for_local_hosts(host, &last, removed);
3040if (rc != HOST_FIND_FAILED) yield = rc;
3041
3042DEBUG(D_host_lookup)
3043 {
3044 if (fully_qualified_name != NULL)
3045 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
3046 debug_printf("host_find_bydns yield = %s (%d); returned hosts:\n",
3047 (yield == HOST_FOUND)? "HOST_FOUND" :
3048 (yield == HOST_FOUND_LOCAL)? "HOST_FOUND_LOCAL" :
3049 (yield == HOST_FIND_AGAIN)? "HOST_FIND_AGAIN" :
3050 (yield == HOST_FIND_FAILED)? "HOST_FIND_FAILED" : "?",
3051 yield);
3052 for (h = host; h != last->next; h = h->next)
3053 {
3054 debug_printf(" %s %s MX=%d ", h->name,
3055 (h->address == NULL)? US"<null>" : h->address, h->mx);
3056 if (h->port != PORT_NONE) debug_printf("port=%d ", h->port);
3057 if (h->status >= hstatus_unusable) debug_printf("*");
3058 debug_printf("\n");
3059 }
3060 }
3061
8c51eead
JH
3062out:
3063
3064dns_init(FALSE, FALSE, FALSE); /* clear the dnssec bit for getaddrbyname */
059ec3d9
PH
3065return yield;
3066}
3067
3068
3069
3070
3071/*************************************************
3072**************************************************
3073* Stand-alone test program *
3074**************************************************
3075*************************************************/
3076
3077#ifdef STAND_ALONE
3078
059ec3d9
PH
3079int main(int argc, char **cargv)
3080{
3081host_item h;
3082int whichrrs = HOST_FIND_BY_MX | HOST_FIND_BY_A;
3083BOOL byname = FALSE;
3084BOOL qualify_single = TRUE;
3085BOOL search_parents = FALSE;
8c51eead
JH
3086BOOL request_dnssec = FALSE;
3087BOOL require_dnssec = FALSE;
059ec3d9
PH
3088uschar **argv = USS cargv;
3089uschar buffer[256];
3090
322050c2 3091disable_ipv6 = FALSE;
059ec3d9
PH
3092primary_hostname = US"";
3093store_pool = POOL_MAIN;
3094debug_selector = D_host_lookup|D_interface;
3095debug_file = stdout;
3096debug_fd = fileno(debug_file);
3097
3098printf("Exim stand-alone host functions test\n");
3099
3100host_find_interfaces();
3101debug_selector = D_host_lookup | D_dns;
3102
3103if (argc > 1) primary_hostname = argv[1];
3104
3105/* So that debug level changes can be done first */
3106
8c51eead 3107dns_init(qualify_single, search_parents, FALSE);
059ec3d9
PH
3108
3109printf("Testing host lookup\n");
3110printf("> ");
3111while (Ufgets(buffer, 256, stdin) != NULL)
3112 {
3113 int rc;
3114 int len = Ustrlen(buffer);
3115 uschar *fully_qualified_name;
3116
3117 while (len > 0 && isspace(buffer[len-1])) len--;
3118 buffer[len] = 0;
3119
3120 if (Ustrcmp(buffer, "q") == 0) break;
3121
3122 if (Ustrcmp(buffer, "byname") == 0) byname = TRUE;
3123 else if (Ustrcmp(buffer, "no_byname") == 0) byname = FALSE;
3124 else if (Ustrcmp(buffer, "a_only") == 0) whichrrs = HOST_FIND_BY_A;
3125 else if (Ustrcmp(buffer, "mx_only") == 0) whichrrs = HOST_FIND_BY_MX;
3126 else if (Ustrcmp(buffer, "srv_only") == 0) whichrrs = HOST_FIND_BY_SRV;
3127 else if (Ustrcmp(buffer, "srv+a") == 0)
3128 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_A;
3129 else if (Ustrcmp(buffer, "srv+mx") == 0)
3130 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_MX;
3131 else if (Ustrcmp(buffer, "srv+mx+a") == 0)
3132 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_MX | HOST_FIND_BY_A;
8c51eead 3133 else if (Ustrcmp(buffer, "qualify_single") == 0) qualify_single = TRUE;
059ec3d9 3134 else if (Ustrcmp(buffer, "no_qualify_single") == 0) qualify_single = FALSE;
8c51eead 3135 else if (Ustrcmp(buffer, "search_parents") == 0) search_parents = TRUE;
059ec3d9 3136 else if (Ustrcmp(buffer, "no_search_parents") == 0) search_parents = FALSE;
8c51eead
JH
3137 else if (Ustrcmp(buffer, "request_dnssec") == 0) request_dnssec = TRUE;
3138 else if (Ustrcmp(buffer, "no_request_dnssec") == 0) request_dnssec = FALSE;
3139 else if (Ustrcmp(buffer, "require_dnssec") == 0) require_dnssec = TRUE;
3140 else if (Ustrcmp(buffer, "no_reqiret_dnssec") == 0) require_dnssec = FALSE;
e7726cbf
PH
3141 else if (Ustrcmp(buffer, "test_harness") == 0)
3142 running_in_test_harness = !running_in_test_harness;
322050c2 3143 else if (Ustrcmp(buffer, "ipv6") == 0) disable_ipv6 = !disable_ipv6;
e7726cbf
PH
3144 else if (Ustrcmp(buffer, "res_debug") == 0)
3145 {
3146 _res.options ^= RES_DEBUG;
3147 }
059ec3d9
PH
3148 else if (Ustrncmp(buffer, "retrans", 7) == 0)
3149 {
ff790e47 3150 (void)sscanf(CS(buffer+8), "%d", &dns_retrans);
059ec3d9
PH
3151 _res.retrans = dns_retrans;
3152 }
3153 else if (Ustrncmp(buffer, "retry", 5) == 0)
3154 {
ff790e47 3155 (void)sscanf(CS(buffer+6), "%d", &dns_retry);
059ec3d9
PH
3156 _res.retry = dns_retry;
3157 }
059ec3d9
PH
3158 else
3159 {
3160 int flags = whichrrs;
3161
3162 h.name = buffer;
3163 h.next = NULL;
3164 h.mx = MX_NONE;
3165 h.port = PORT_NONE;
3166 h.status = hstatus_unknown;
3167 h.why = hwhy_unknown;
3168 h.address = NULL;
3169
3170 if (qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
3171 if (search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
3172
8c51eead
JH
3173 rc = byname
3174 ? host_find_byname(&h, NULL, flags, &fully_qualified_name, TRUE)
3175 : host_find_bydns(&h, NULL, flags, US"smtp", NULL, NULL,
3176 request_dnssec ? &h.name : NULL,
3177 require_dnssec ? &h.name : NULL,
3178 &fully_qualified_name, NULL);
059ec3d9
PH
3179
3180 if (rc == HOST_FIND_FAILED) printf("Failed\n");
3181 else if (rc == HOST_FIND_AGAIN) printf("Again\n");
3182 else if (rc == HOST_FOUND_LOCAL) printf("Local\n");
3183 }
3184
3185 printf("\n> ");
3186 }
3187
3188printf("Testing host_aton\n");
3189printf("> ");
3190while (Ufgets(buffer, 256, stdin) != NULL)
3191 {
3192 int i;
3193 int x[4];
3194 int len = Ustrlen(buffer);
3195
3196 while (len > 0 && isspace(buffer[len-1])) len--;
3197 buffer[len] = 0;
3198
3199 if (Ustrcmp(buffer, "q") == 0) break;
3200
3201 len = host_aton(buffer, x);
3202 printf("length = %d ", len);
3203 for (i = 0; i < len; i++)
3204 {
3205 printf("%04x ", (x[i] >> 16) & 0xffff);
3206 printf("%04x ", x[i] & 0xffff);
3207 }
3208 printf("\n> ");
3209 }
3210
3211printf("\n");
3212
3213printf("Testing host_name_lookup\n");
3214printf("> ");
3215while (Ufgets(buffer, 256, stdin) != NULL)
3216 {
3217 int len = Ustrlen(buffer);
3218 while (len > 0 && isspace(buffer[len-1])) len--;
3219 buffer[len] = 0;
3220 if (Ustrcmp(buffer, "q") == 0) break;
3221 sender_host_address = buffer;
3222 sender_host_name = NULL;
3223 sender_host_aliases = NULL;
3224 host_lookup_msg = US"";
3225 host_lookup_failed = FALSE;
3226 if (host_name_lookup() == FAIL) /* Debug causes printing */
3227 printf("Lookup failed:%s\n", host_lookup_msg);
3228 printf("\n> ");
3229 }
3230
3231printf("\n");
3232
3233return 0;
3234}
3235#endif /* STAND_ALONE */
3236
8c51eead
JH
3237/* vi: aw ai sw=2
3238*/
059ec3d9 3239/* End of host.c */