Make dnssec_request_domains/dnssec_require_domains generic
[exim.git] / src / src / routers / dnslookup.c
CommitLineData
0756eb3c
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
0a49a7a4 5/* Copyright (c) University of Cambridge 1995 - 2009 */
0756eb3c
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8#include "../exim.h"
9#include "rf_functions.h"
10#include "dnslookup.h"
11
12
13
14/* Options specific to the dnslookup router. */
15
16optionlist dnslookup_router_options[] = {
17 { "check_secondary_mx", opt_bool,
18 (void *)(offsetof(dnslookup_router_options_block, check_secondary_mx)) },
19 { "check_srv", opt_stringptr,
20 (void *)(offsetof(dnslookup_router_options_block, check_srv)) },
bd4ece7d
JH
21 { "fail_defer_domains", opt_stringptr,
22 (void *)(offsetof(dnslookup_router_options_block, fail_defer_domains)) },
0756eb3c
PH
23 { "mx_domains", opt_stringptr,
24 (void *)(offsetof(dnslookup_router_options_block, mx_domains)) },
25 { "mx_fail_domains", opt_stringptr,
26 (void *)(offsetof(dnslookup_router_options_block, mx_fail_domains)) },
27 { "qualify_single", opt_bool,
28 (void *)(offsetof(dnslookup_router_options_block, qualify_single)) },
29 { "rewrite_headers", opt_bool,
30 (void *)(offsetof(dnslookup_router_options_block, rewrite_headers)) },
31 { "same_domain_copy_routing", opt_bool|opt_public,
32 (void *)(offsetof(router_instance, same_domain_copy_routing)) },
33 { "search_parents", opt_bool,
34 (void *)(offsetof(dnslookup_router_options_block, search_parents)) },
35 { "srv_fail_domains", opt_stringptr,
36 (void *)(offsetof(dnslookup_router_options_block, srv_fail_domains)) },
37 { "widen_domains", opt_stringptr,
38 (void *)(offsetof(dnslookup_router_options_block, widen_domains)) }
39};
40
41/* Size of the options list. An extern variable has to be used so that its
42address can appear in the tables drtables.c. */
43
44int dnslookup_router_options_count =
45 sizeof(dnslookup_router_options)/sizeof(optionlist);
46
47/* Default private options block for the dnslookup router. */
48
49dnslookup_router_options_block dnslookup_router_option_defaults = {
50 FALSE, /* check_secondary_mx */
51 TRUE, /* qualify_single */
52 FALSE, /* search_parents */
53 TRUE, /* rewrite_headers */
54 NULL, /* widen_domains */
55 NULL, /* mx_domains */
56 NULL, /* mx_fail_domains */
57 NULL, /* srv_fail_domains */
8c51eead 58 NULL, /* check_srv */
bd4ece7d 59 NULL /* fail_defer_domains */
0756eb3c
PH
60};
61
62
63
64/*************************************************
65* Initialization entry point *
66*************************************************/
67
68/* Called for each instance, after its options have been read, to enable
69consistency checks to be done, or anything else that needs to be set up. */
70
71void
72dnslookup_router_init(router_instance *rblock)
73{
74/*
75dnslookup_router_options_block *ob =
76 (dnslookup_router_options_block *)(rblock->options_block);
77*/
78rblock = rblock;
79}
80
81
82
83/*************************************************
84* Main entry point *
85*************************************************/
86
87/* See local README for interface details. This router returns:
88
89DECLINE
90 . the domain does not exist in the DNS
91 . MX records point to non-existent hosts (including RHS = IP address)
92 . a single SRV record has a host name of "." (=> no service)
93 . syntactically invalid mail domain
94 . check_secondary_mx set, and local host not in host list
95
96DEFER
97 . lookup defer for mx_domains
98 . timeout etc on DNS lookup
99 . verifying the errors address caused a deferment or a big disaster such
100 as an expansion failure (rf_get_errors_address)
101 . expanding a headers_{add,remove} string caused a deferment or another
102 expansion error (rf_get_munge_headers)
103 . a problem in rf_get_transport: no transport when one is needed;
104 failed to expand dynamic transport; failed to find dynamic transport
105 . failure to expand or find a uid/gid (rf_get_ugid via rf_queue_add)
106 . self = "freeze", self = "defer"
107
108PASS
109 . timeout etc on DNS lookup and pass_on_timeout set
110 . self = "pass"
111
112REROUTED
113 . routed to local host, but name was expanded by DNS lookup, so a
114 re-routing should take place
115 . self = "reroute"
116
117 In both cases the new address will have been set up as a child
118
119FAIL
120 . self = "fail"
121
122OK
123 added address to addr_local or addr_remote, as appropriate for the
124 type of transport; this includes the self="send" case.
125*/
126
127int
128dnslookup_router_entry(
129 router_instance *rblock, /* data for this instantiation */
130 address_item *addr, /* address we are working on */
131 struct passwd *pw, /* passwd entry after check_local_user */
fd6de02e 132 int verify, /* v_none/v_recipient/v_sender/v_expn */
0756eb3c
PH
133 address_item **addr_local, /* add it to this if it's local */
134 address_item **addr_remote, /* add it to this if it's remote */
135 address_item **addr_new, /* put new addresses on here */
136 address_item **addr_succeed) /* put old address here on success */
137{
138host_item h;
139int rc;
140int widen_sep = 0;
141int whichrrs = HOST_FIND_BY_MX | HOST_FIND_BY_A;
142dnslookup_router_options_block *ob =
143 (dnslookup_router_options_block *)(rblock->options_block);
144uschar *srv_service = NULL;
145uschar *widen = NULL;
55414b25
JH
146const uschar *pre_widen = addr->domain;
147const uschar *post_widen = NULL;
148const uschar *fully_qualified_name;
149const uschar *listptr;
0756eb3c
PH
150uschar widen_buffer[256];
151
152addr_new = addr_new; /* Keep picky compilers happy */
153addr_succeed = addr_succeed;
154
155DEBUG(D_route)
156 debug_printf("%s router called for %s\n domain = %s\n",
157 rblock->name, addr->address, addr->domain);
158
159/* If an SRV check is required, expand the service name */
160
bd4ece7d 161if (ob->check_srv)
0756eb3c 162 {
bd4ece7d
JH
163 if ( !(srv_service = expand_string(ob->check_srv))
164 && !expand_string_forcedfail)
0756eb3c
PH
165 {
166 addr->message = string_sprintf("%s router: failed to expand \"%s\": %s",
167 rblock->name, ob->check_srv, expand_string_message);
168 return DEFER;
169 }
170 else whichrrs |= HOST_FIND_BY_SRV;
171 }
172
173/* Set up the first of any widening domains. The code further down copes with
174either pre- or post-widening, but at present there is no way to turn on
175pre-widening, as actually doing so seems like a rather bad idea, and nobody has
176requested it. Pre-widening would cause local abbreviated names to take
177precedence over global names. For example, if the domain is "xxx.ch" it might
178be something in the "ch" toplevel domain, but it also might be xxx.ch.xyz.com.
179The choice of pre- or post-widening affects which takes precedence. If ever
180somebody comes up with some kind of requirement for pre-widening, presumably
fd6de02e
PH
181with some conditions under which it is done, it can be selected here.
182
183The rewrite_headers option works only when routing an address at transport
184time, because the alterations to the headers are not persistent so must be
185worked out immediately before they are used. Sender addresses are routed for
186verification purposes, but never at transport time, so any header changes that
187you might expect as a result of sender domain widening do not occur. Therefore
188we do not perform widening when verifying sender addresses; however, widening
a5f65aa4
TF
189sender addresses is OK if we do not have to rewrite the headers. A corollary
190of this is that if the current address is not the original address, then it
191does not appear in the message header so it is also OK to widen. The
192suppression of widening for sender addresses is silent because it is the
193normal desirable behaviour. */
194
bd4ece7d
JH
195if ( ob->widen_domains
196 && (verify != v_sender || !ob->rewrite_headers || addr->parent))
0756eb3c
PH
197 {
198 listptr = ob->widen_domains;
199 widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
200 sizeof(widen_buffer));
201
202/****
203 if (some condition requiring pre-widening)
204 {
205 post_widen = pre_widen;
206 pre_widen = NULL;
207 }
208****/
209 }
210
211/* Loop to cope with explicit widening of domains as configured. This code
212copes with widening that may happen before or after the original name. The
213decision as to which is taken above. */
214
215for (;;)
216 {
217 int flags = whichrrs;
218 BOOL removed = FALSE;
219
bd4ece7d 220 if (pre_widen)
0756eb3c
PH
221 {
222 h.name = pre_widen;
223 pre_widen = NULL;
224 }
bd4ece7d 225 else if (widen)
0756eb3c
PH
226 {
227 h.name = string_sprintf("%s.%s", addr->domain, widen);
228 widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
229 sizeof(widen_buffer));
230 DEBUG(D_route) debug_printf("%s router widened %s to %s\n", rblock->name,
231 addr->domain, h.name);
232 }
bd4ece7d 233 else if (post_widen)
0756eb3c
PH
234 {
235 h.name = post_widen;
236 post_widen = NULL;
237 DEBUG(D_route) debug_printf("%s router trying %s after widening failed\n",
238 rblock->name, h.name);
239 }
240 else return DECLINE;
241
242 /* Set up the rest of the initial host item. Others may get chained on if
243 there is more than one IP address. We set it up here instead of outside the
244 loop so as to re-initialize if a previous try succeeded but was rejected
245 because of not having an MX record. */
246
247 h.next = NULL;
248 h.address = NULL;
249 h.port = PORT_NONE;
250 h.mx = MX_NONE;
251 h.status = hstatus_unknown;
252 h.why = hwhy_unknown;
253 h.last_try = 0;
254
255 /* Unfortunately, we cannot set the mx_only option in advance, because the
256 DNS lookup may extend an unqualified name. Therefore, we must do the test
a7fdad5b
TF
257 subsequently. We use the same logic as that for widen_domains above to avoid
258 requesting a header rewrite that cannot work. */
0756eb3c 259
bd4ece7d 260 if (verify != v_sender || !ob->rewrite_headers || addr->parent)
a7fdad5b
TF
261 {
262 if (ob->qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
263 if (ob->search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
264 }
0756eb3c 265
55414b25 266 rc = host_find_bydns(&h, CUS rblock->ignore_target_hosts, flags, srv_service,
8c51eead 267 ob->srv_fail_domains, ob->mx_fail_domains,
99c1bb4e 268 rblock->dnssec_request_domains, rblock->dnssec_require_domains,
8c51eead 269 &fully_qualified_name, &removed);
0756eb3c
PH
270 if (removed) setflag(addr, af_local_host_removed);
271
272 /* If host found with only address records, test for the domain's being in
273 the mx_domains list. Note that this applies also to SRV records; the name of
274 the option is historical. */
275
276 if ((rc == HOST_FOUND || rc == HOST_FOUND_LOCAL) && h.mx < 0 &&
bd4ece7d 277 ob->mx_domains)
55414b25 278 switch(match_isinlist(fully_qualified_name,
bd4ece7d 279 CUSS &(ob->mx_domains), 0,
0756eb3c
PH
280 &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
281 {
282 case DEFER:
283 addr->message = US"lookup defer for mx_domains";
284 return DEFER;
285
286 case OK:
287 DEBUG(D_route) debug_printf("%s router rejected %s: no MX record(s)\n",
288 rblock->name, fully_qualified_name);
289 continue;
290 }
0756eb3c
PH
291
292 /* Deferral returns forthwith, and anything other than failure breaks the
293 loop. */
294
295 if (rc == HOST_FIND_AGAIN)
296 {
297 if (rblock->pass_on_timeout)
298 {
299 DEBUG(D_route) debug_printf("%s router timed out, and pass_on_timeout is set\n",
300 rblock->name);
301 return PASS;
302 }
303 addr->message = US"host lookup did not complete";
304 return DEFER;
305 }
306
307 if (rc != HOST_FIND_FAILED) break;
308
66afa403
TF
309 /* Check to see if the failure is the result of MX records pointing to
310 non-existent domains, and if so, set an appropriate error message; the case
311 of an MX or SRV record pointing to "." is another special case that we can
0756eb3c
PH
312 detect. Otherwise "unknown mail domain" is used, which is confusing. Also, in
313 this case don't do the widening. We need check only the first host to see if
314 its MX has been filled in, but there is no address, because if there were any
315 usable addresses returned, we would not have had HOST_FIND_FAILED.
316
317 As a common cause of this problem is MX records with IP addresses on the
318 RHS, give a special message in this case. */
319
320 if (h.mx >= 0 && h.address == NULL)
321 {
ca02eafb 322 setflag(addr, af_pass_message); /* This is not a security risk */
0756eb3c 323 if (h.name[0] == 0)
66afa403 324 addr->message = US"an MX or SRV record indicated no SMTP service";
0756eb3c
PH
325 else
326 {
bd4ece7d 327 addr->basic_errno = ERRNO_UNKNOWNHOST;
0756eb3c 328 addr->message = US"all relevant MX records point to non-existent hosts";
7e66e54d 329 if (!allow_mx_to_ip && string_is_ip_address(h.name, NULL) != 0)
0756eb3c
PH
330 {
331 addr->user_message =
332 string_sprintf("It appears that the DNS operator for %s\n"
333 "has installed an invalid MX record with an IP address\n"
334 "instead of a domain name on the right hand side.", addr->domain);
335 addr->message = string_sprintf("%s or (invalidly) to IP addresses",
336 addr->message);
337 }
338 }
bd4ece7d
JH
339 if (ob->fail_defer_domains)
340 {
341 switch(match_isinlist(fully_qualified_name,
342 CUSS &ob->fail_defer_domains, 0,
343 &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
344 {
345 case DEFER:
346 addr->message = US"lookup defer for fail_defer_domains";
347 return DEFER;
348
349 case OK:
350 DEBUG(D_route) debug_printf("%s router: matched fail_defer_domains\n",
351 rblock->name);
352 return DEFER;
353 }
354 }
0756eb3c
PH
355 return DECLINE;
356 }
357
358 /* If there's a syntax error, do not continue with any widening, and note
359 the error. */
360
361 if (host_find_failed_syntax)
362 {
363 addr->message = string_sprintf("mail domain \"%s\" is syntactically "
364 "invalid", h.name);
365 return DECLINE;
366 }
367 }
368
369/* If the original domain name has been changed as a result of the host lookup,
370set up a child address for rerouting and request header rewrites if so
371configured. Then yield REROUTED. However, if the only change is a change of
372case in the domain name, which some resolvers yield (others don't), just change
373the domain name in the original address so that the official version is used in
374RCPT commands. */
375
376if (Ustrcmp(addr->domain, fully_qualified_name) != 0)
377 {
378 if (strcmpic(addr->domain, fully_qualified_name) == 0)
379 {
380 uschar *at = Ustrrchr(addr->address, '@');
381 memcpy(at+1, fully_qualified_name, Ustrlen(at+1));
382 }
383 else
384 {
385 rf_change_domain(addr, fully_qualified_name, ob->rewrite_headers, addr_new);
386 return REROUTED;
387 }
388 }
389
390/* If the yield is HOST_FOUND_LOCAL, the remote domain name either found MX
391records with the lowest numbered one pointing to a host with an IP address that
392is set on one of the interfaces of this machine, or found A records or got
393addresses from gethostbyname() that contain one for this machine. This can
394happen quite legitimately if the original name was a shortened form of a
395domain, but we will have picked that up already via the name change test above.
396
397Otherwise, the action to be taken can be configured by the self option, the
398handling of which is in a separate function, as it is also required for other
399routers. */
400
401if (rc == HOST_FOUND_LOCAL)
402 {
403 rc = rf_self_action(addr, &h, rblock->self_code, rblock->self_rewrite,
404 rblock->self, addr_new);
405 if (rc != OK) return rc;
406 }
407
408/* Otherwise, insist on being a secondary MX if so configured */
409
410else if (ob->check_secondary_mx && !testflag(addr, af_local_host_removed))
411 {
412 DEBUG(D_route) debug_printf("check_secondary_mx set and local host not secondary\n");
413 return DECLINE;
414 }
415
416/* Set up the errors address, if any. */
417
d43cbe25 418rc = rf_get_errors_address(addr, rblock, verify, &addr->prop.errors_address);
0756eb3c
PH
419if (rc != OK) return rc;
420
421/* Set up the additional and removeable headers for this address. */
422
d43cbe25
JH
423rc = rf_get_munge_headers(addr, rblock, &addr->prop.extra_headers,
424 &addr->prop.remove_headers);
0756eb3c
PH
425if (rc != OK) return rc;
426
427/* Get store in which to preserve the original host item, chained on
428to the address. */
429
430addr->host_list = store_get(sizeof(host_item));
431addr->host_list[0] = h;
432
433/* Fill in the transport and queue the address for delivery. */
434
435if (!rf_get_transport(rblock->transport_name, &(rblock->transport),
436 addr, rblock->name, NULL))
437 return DEFER;
438
439addr->transport = rblock->transport;
440
441return rf_queue_add(addr, addr_local, addr_remote, rblock, pw)?
442 OK : DEFER;
443}
444
445/* End of routers/dnslookup.c */
bd4ece7d
JH
446/* vi: aw ai sw=2
447*/