tidying
[exim.git] / src / src / dns.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2017 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions for interfacing with the DNS. */
9
10 #include "exim.h"
11
12
13
14 /*************************************************
15 * Fake DNS resolver *
16 *************************************************/
17
18 /* This function is called instead of res_search() when Exim is running in its
19 test harness. It recognizes some special domain names, and uses them to force
20 failure and retry responses (optionally with a delay). Otherwise, it calls an
21 external utility that mocks-up a nameserver, if it can find the utility.
22 If not, it passes its arguments on to res_search(). The fake nameserver may
23 also return a code specifying that the name should be passed on.
24
25 Background: the original test suite required a real nameserver to carry the
26 test zones, whereas the new test suite has the fake server for portability. This
27 code supports both.
28
29 Arguments:
30 domain the domain name
31 type the DNS record type
32 answerptr where to put the answer
33 size size of the answer area
34
35 Returns: length of returned data, or -1 on error (h_errno set)
36 */
37
38 static int
39 fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
40 {
41 int len = Ustrlen(domain);
42 int asize = size; /* Locally modified */
43 uschar name[256];
44 uschar utilname[256];
45 uschar *aptr = answerptr; /* Locally modified */
46 struct stat statbuf;
47
48 /* Remove terminating dot. */
49
50 if (domain[len - 1] == '.') len--;
51 Ustrncpy(name, domain, len);
52 name[len] = 0;
53
54 /* Look for the fakens utility, and if it exists, call it. */
55
56 (void)string_format(utilname, sizeof(utilname), "%s/bin/fakens",
57 config_main_directory);
58
59 if (stat(CS utilname, &statbuf) >= 0)
60 {
61 pid_t pid;
62 int infd, outfd, rc;
63 uschar *argv[5];
64
65 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n", name, dns_text_type(type));
66
67 argv[0] = utilname;
68 argv[1] = config_main_directory;
69 argv[2] = name;
70 argv[3] = dns_text_type(type);
71 argv[4] = NULL;
72
73 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE);
74 if (pid < 0)
75 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
76 strerror(errno));
77
78 len = 0;
79 rc = -1;
80 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
81 {
82 len += rc;
83 aptr += rc; /* Don't modify the actual arguments, because they */
84 asize -= rc; /* may need to be passed on to res_search(). */
85 }
86
87 /* If we ran out of output buffer before exhausting the return,
88 carry on reading and counting it. */
89
90 if (asize == 0)
91 while ((rc = read(outfd, name, sizeof(name))) > 0)
92 len += rc;
93
94 if (rc < 0)
95 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
96 strerror(errno));
97
98 switch(child_close(pid, 0))
99 {
100 case 0: return len;
101 case 1: h_errno = HOST_NOT_FOUND; return -1;
102 case 2: h_errno = TRY_AGAIN; return -1;
103 default:
104 case 3: h_errno = NO_RECOVERY; return -1;
105 case 4: h_errno = NO_DATA; return -1;
106 case 5: /* Pass on to res_search() */
107 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
108 }
109 }
110 else
111 {
112 DEBUG(D_dns) debug_printf("fakens (%s) not found\n", utilname);
113 }
114
115 /* fakens utility not found, or it returned "pass on" */
116
117 DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
118
119 return res_search(CS domain, C_IN, type, answerptr, size);
120 }
121
122
123
124 /*************************************************
125 * Initialize and configure resolver *
126 *************************************************/
127
128 /* Initialize the resolver and the storage for holding DNS answers if this is
129 the first time we have been here, and set the resolver options.
130
131 Arguments:
132 qualify_single TRUE to set the RES_DEFNAMES option
133 search_parents TRUE to set the RES_DNSRCH option
134 use_dnssec TRUE to set the RES_USE_DNSSEC option
135
136 Returns: nothing
137 */
138
139 void
140 dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
141 {
142 res_state resp = os_get_dns_resolver_res();
143
144 if ((resp->options & RES_INIT) == 0)
145 {
146 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
147 os_put_dns_resolver_res(resp);
148 res_init();
149 DEBUG(D_resolver) resp->options |= RES_DEBUG;
150 os_put_dns_resolver_res(resp);
151 }
152
153 resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
154 resp->options |= (qualify_single? RES_DEFNAMES : 0) |
155 (search_parents? RES_DNSRCH : 0);
156 if (dns_retrans > 0) resp->retrans = dns_retrans;
157 if (dns_retry > 0) resp->retry = dns_retry;
158
159 #ifdef RES_USE_EDNS0
160 if (dns_use_edns0 >= 0)
161 {
162 if (dns_use_edns0)
163 resp->options |= RES_USE_EDNS0;
164 else
165 resp->options &= ~RES_USE_EDNS0;
166 DEBUG(D_resolver)
167 debug_printf("Coerced resolver EDNS0 support %s.\n",
168 dns_use_edns0 ? "on" : "off");
169 }
170 #else
171 if (dns_use_edns0 >= 0)
172 DEBUG(D_resolver)
173 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
174 dns_use_edns0 ? "" : "un");
175 #endif
176
177 #ifndef DISABLE_DNSSEC
178 # ifdef RES_USE_DNSSEC
179 # ifndef RES_USE_EDNS0
180 # error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
181 # endif
182 if (use_dnssec)
183 resp->options |= RES_USE_DNSSEC;
184 if (dns_dnssec_ok >= 0)
185 {
186 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
187 {
188 DEBUG(D_resolver)
189 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
190 }
191 else
192 {
193 if (dns_dnssec_ok)
194 resp->options |= RES_USE_DNSSEC;
195 else
196 resp->options &= ~RES_USE_DNSSEC;
197 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
198 dns_dnssec_ok ? "on" : "off");
199 }
200 }
201 # else
202 if (dns_dnssec_ok >= 0)
203 DEBUG(D_resolver)
204 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
205 dns_dnssec_ok ? "" : "un");
206 if (use_dnssec)
207 DEBUG(D_resolver)
208 debug_printf("Unable to set DNSSEC without resolver support.\n");
209 # endif
210 #endif /* DISABLE_DNSSEC */
211
212 os_put_dns_resolver_res(resp);
213 }
214
215
216
217 /*************************************************
218 * Build key name for PTR records *
219 *************************************************/
220
221 /* This function inverts an IP address and adds the relevant domain, to produce
222 a name that can be used to look up PTR records.
223
224 Arguments:
225 string the IP address as a string
226 buffer a suitable buffer, long enough to hold the result
227
228 Returns: nothing
229 */
230
231 void
232 dns_build_reverse(const uschar *string, uschar *buffer)
233 {
234 const uschar *p = string + Ustrlen(string);
235 uschar *pp = buffer;
236
237 /* Handle IPv4 address */
238
239 #if HAVE_IPV6
240 if (Ustrchr(string, ':') == NULL)
241 #endif
242 {
243 int i;
244 for (i = 0; i < 4; i++)
245 {
246 const uschar *ppp = p;
247 while (ppp > string && ppp[-1] != '.') ppp--;
248 Ustrncpy(pp, ppp, p - ppp);
249 pp += p - ppp;
250 *pp++ = '.';
251 p = ppp - 1;
252 }
253 Ustrcpy(pp, "in-addr.arpa");
254 }
255
256 /* Handle IPv6 address; convert to binary so as to fill out any
257 abbreviation in the textual form. */
258
259 #if HAVE_IPV6
260 else
261 {
262 int i;
263 int v6[4];
264 (void)host_aton(string, v6);
265
266 /* The original specification for IPv6 reverse lookup was to invert each
267 nibble, and look in the ip6.int domain. The domain was subsequently
268 changed to ip6.arpa. */
269
270 for (i = 3; i >= 0; i--)
271 {
272 int j;
273 for (j = 0; j < 32; j += 4)
274 pp += sprintf(CS pp, "%x.", (v6[i] >> j) & 15);
275 }
276 Ustrcpy(pp, "ip6.arpa.");
277
278 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
279 with A6 records. However, it fell out of favour when they did. The
280 alternative was to construct a binary key, and look in ip6.arpa. I tried
281 to make this code do that, but I could not make it work on Solaris 8. The
282 resolver seems to lose the initial backslash somehow. However, now that
283 this style of reverse lookup has been dropped, it doesn't matter. These
284 lines are left here purely for historical interest. */
285
286 /**************************************************
287 Ustrcpy(pp, "\\[x");
288 pp += 3;
289
290 for (i = 0; i < 4; i++)
291 {
292 sprintf(pp, "%08X", v6[i]);
293 pp += 8;
294 }
295 Ustrcpy(pp, "].ip6.arpa.");
296 **************************************************/
297
298 }
299 #endif
300 }
301
302
303
304
305 /* Increment the aptr in dnss, checking against dnsa length.
306 Return: TRUE for a bad result
307 */
308 static BOOL
309 dnss_inc_aptr(const dns_answer * dnsa, dns_scan * dnss, unsigned delta)
310 {
311 return (dnss->aptr += delta) >= dnsa->answer + dnsa->answerlen;
312 }
313
314 /*************************************************
315 * Get next DNS record from answer block *
316 *************************************************/
317
318 /* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
319 RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
320 scan the additional records, and reset == RESET_NEXT to get the next record.
321 The result is in static storage which must be copied if it is to be preserved.
322
323 Arguments:
324 dnsa pointer to dns answer block
325 dnss pointer to dns scan block
326 reset option specifying what portion to scan, as described above
327
328 Returns: next dns record, or NULL when no more
329 */
330
331 dns_record *
332 dns_next_rr(const dns_answer *dnsa, dns_scan *dnss, int reset)
333 {
334 const HEADER * h = (const HEADER *)dnsa->answer;
335 int namelen;
336
337 char * trace = NULL;
338 #ifdef rr_trace
339 # define TRACE DEBUG(D_dns)
340 #else
341 trace = trace;
342 # define TRACE if (FALSE)
343 #endif
344
345 /* Reset the saved data when requested to, and skip to the first required RR */
346
347 if (reset != RESET_NEXT)
348 {
349 dnss->rrcount = ntohs(h->qdcount);
350 TRACE debug_printf("%s: reset (Q rrcount %d)\n", __FUNCTION__, dnss->rrcount);
351 dnss->aptr = dnsa->answer + sizeof(HEADER);
352
353 /* Skip over questions; failure to expand the name just gives up */
354
355 while (dnss->rrcount-- > 0)
356 {
357 TRACE trace = "Q-namelen";
358 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
359 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
360 if (namelen < 0) goto null_return;
361 /* skip name & type & class */
362 TRACE trace = "Q-skip";
363 if (dnss_inc_aptr(dnsa, dnss, namelen+4)) goto null_return;
364 }
365
366 /* Get the number of answer records. */
367
368 dnss->rrcount = ntohs(h->ancount);
369 TRACE debug_printf("%s: reset (A rrcount %d)\n", __FUNCTION__, dnss->rrcount);
370
371 /* Skip over answers if we want to look at the authority section. Also skip
372 the NS records (i.e. authority section) if wanting to look at the additional
373 records. */
374
375 if (reset == RESET_ADDITIONAL)
376 {
377 TRACE debug_printf("%s: additional\n", __FUNCTION__);
378 dnss->rrcount += ntohs(h->nscount);
379 TRACE debug_printf("%s: reset (NS rrcount %d)\n", __FUNCTION__, dnss->rrcount);
380 }
381
382 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
383 {
384 TRACE if (reset == RESET_AUTHORITY)
385 debug_printf("%s: authority\n", __FUNCTION__);
386 while (dnss->rrcount-- > 0)
387 {
388 TRACE trace = "A-namelen";
389 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
390 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
391 if (namelen < 0) goto null_return;
392 /* skip name, type, class & TTL */
393 TRACE trace = "A-hdr";
394 if (dnss_inc_aptr(dnsa, dnss, namelen+8)) goto null_return;
395 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
396 /* skip over it */
397 TRACE trace = "A-skip";
398 if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) goto null_return;
399 }
400 dnss->rrcount = reset == RESET_AUTHORITY
401 ? ntohs(h->nscount) : ntohs(h->arcount);
402 TRACE debug_printf("%s: reset (%s rrcount %d)\n", __FUNCTION__,
403 reset == RESET_AUTHORITY ? "NS" : "AR", dnss->rrcount);
404 }
405 TRACE debug_printf("%s: %d RRs to read\n", __FUNCTION__, dnss->rrcount);
406 }
407 else
408 TRACE debug_printf("%s: next (%d left)\n", __FUNCTION__, dnss->rrcount);
409
410 /* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
411 contains the number of RR records left. */
412
413 if (dnss->rrcount-- <= 0) return NULL;
414
415 /* If expanding the RR domain name fails, behave as if no more records
416 (something safe). */
417
418 TRACE trace = "R-namelen";
419 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
420 (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
421 if (namelen < 0) goto null_return;
422
423 /* Move the pointer past the name and fill in the rest of the data structure
424 from the following bytes. */
425
426 TRACE trace = "R-name";
427 if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return;
428
429 GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
430 TRACE trace = "R-class";
431 if (dnss_inc_aptr(dnsa, dnss, 2)) goto null_return; /* Don't want class */
432 GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */
433 GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
434 dnss->srr.data = dnss->aptr; /* The record's data follows */
435
436 /* Unchecked increment ok here since no further access on this iteration;
437 will be checked on next at "R-name". */
438
439 dnss->aptr += dnss->srr.size; /* Advance to next RR */
440
441 /* Return a pointer to the dns_record structure within the dns_answer. This is
442 for convenience so that the scans can use nice-looking for loops. */
443
444 return &dnss->srr;
445
446 null_return:
447 TRACE debug_printf("%s: terminate (%d RRs left). Last op: %s; errno %d %s\n",
448 __FUNCTION__, dnss->rrcount, trace, errno, strerror(errno));
449 dnss->rrcount = 0;
450 return NULL;
451 }
452
453
454 /* Extract the AUTHORITY information from the answer. If the answer isn't
455 authoritative (AA not set), we do not extract anything.
456
457 The AUTHORITY section contains NS records if the name in question was found,
458 it contains a SOA record otherwise. (This is just from experience and some
459 tests, is there some spec?)
460
461 Scan the whole AUTHORITY section, since it may contain other records
462 (e.g. NSEC3) too.
463
464 Return: name for the authority, in an allocated string, or NULL if none found */
465
466 static const uschar *
467 dns_extract_auth_name(const dns_answer * dnsa) /* FIXME: const dns_answer */
468 {
469 dns_scan dnss;
470 dns_record * rr;
471 const HEADER * h = (const HEADER *) dnsa->answer;
472
473 if (h->nscount && h->aa)
474 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
475 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
476 if (rr->type == (h->ancount ? T_NS : T_SOA))
477 return string_copy(rr->name);
478 return NULL;
479 }
480
481
482
483
484 /*************************************************
485 * Return whether AD bit set in DNS result *
486 *************************************************/
487
488 /* We do not perform DNSSEC work ourselves; if the administrator has installed
489 a verifying resolver which sets AD as appropriate, though, we'll use that.
490 (AD = Authentic Data, AA = Authoritative Answer)
491
492 Argument: pointer to dns answer block
493 Returns: bool indicating presence of AD bit
494 */
495
496 BOOL
497 dns_is_secure(const dns_answer * dnsa)
498 {
499 #ifdef DISABLE_DNSSEC
500 DEBUG(D_dns)
501 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
502 return FALSE;
503 #else
504 const HEADER * h = (const HEADER *) dnsa->answer;
505 const uschar * auth_name;
506 const uschar * trusted;
507
508 if (h->ad) return TRUE;
509
510 /* If the resolver we ask is authoritative for the domain in question, it
511 * may not set the AD but the AA bit. If we explicitly trust
512 * the resolver for that domain (via a domainlist in dns_trust_aa),
513 * we return TRUE to indicate a secure answer.
514 */
515
516 if ( !h->aa
517 || !dns_trust_aa
518 || !(trusted = expand_string(dns_trust_aa))
519 || !*trusted
520 || !(auth_name = dns_extract_auth_name(dnsa))
521 || OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL,
522 MCL_DOMAIN, TRUE, NULL)
523 )
524 return FALSE;
525
526 DEBUG(D_dns) debug_printf("DNS faked the AD bit "
527 "(got AA and matched with dns_trust_aa (%s in %s))\n",
528 auth_name, dns_trust_aa);
529
530 return TRUE;
531 #endif
532 }
533
534 static void
535 dns_set_insecure(dns_answer * dnsa)
536 {
537 #ifndef DISABLE_DNSSEC
538 HEADER * h = (HEADER *)dnsa->answer;
539 h->aa = h->ad = 0;
540 #endif
541 }
542
543 /************************************************
544 * Check whether the AA bit is set *
545 * We need this to warn if we requested AD *
546 * from an authoritative server *
547 ************************************************/
548
549 BOOL
550 dns_is_aa(const dns_answer *dnsa)
551 {
552 #ifdef DISABLE_DNSSEC
553 return FALSE;
554 #else
555 return ((const HEADER*)dnsa->answer)->aa;
556 #endif
557 }
558
559
560
561 /*************************************************
562 * Turn DNS type into text *
563 *************************************************/
564
565 /* Turn the coded record type into a string for printing. All those that Exim
566 uses should be included here.
567
568 Argument: record type
569 Returns: pointer to string
570 */
571
572 uschar *
573 dns_text_type(int t)
574 {
575 switch(t)
576 {
577 case T_A: return US"A";
578 case T_MX: return US"MX";
579 case T_AAAA: return US"AAAA";
580 case T_A6: return US"A6";
581 case T_TXT: return US"TXT";
582 case T_SPF: return US"SPF";
583 case T_PTR: return US"PTR";
584 case T_SOA: return US"SOA";
585 case T_SRV: return US"SRV";
586 case T_NS: return US"NS";
587 case T_CNAME: return US"CNAME";
588 case T_TLSA: return US"TLSA";
589 default: return US"?";
590 }
591 }
592
593
594
595 /*************************************************
596 * Cache a failed DNS lookup result *
597 *************************************************/
598
599 /* We cache failed lookup results so as not to experience timeouts many
600 times for the same domain. We need to retain the resolver options because they
601 may change. For successful lookups, we rely on resolver and/or name server
602 caching.
603
604 Arguments:
605 name the domain name
606 type the lookup type
607 rc the return code
608
609 Returns: the return code
610 */
611
612 static int
613 dns_return(const uschar * name, int type, int rc)
614 {
615 res_state resp = os_get_dns_resolver_res();
616 tree_node *node = store_get_perm(sizeof(tree_node) + 290);
617 sprintf(CS node->name, "%.255s-%s-%lx", name, dns_text_type(type),
618 (unsigned long) resp->options);
619 node->data.val = rc;
620 (void)tree_insertnode(&tree_dns_fails, node);
621 return rc;
622 }
623
624 /*************************************************
625 * Do basic DNS lookup *
626 *************************************************/
627
628 /* Call the resolver to look up the given domain name, using the given type,
629 and check the result. The error code TRY_AGAIN is documented as meaning "non-
630 Authoritative Host not found, or SERVERFAIL". Sometimes there are badly set
631 up nameservers that produce this error continually, so there is the option of
632 providing a list of domains for which this is treated as a non-existent
633 host.
634
635 Arguments:
636 dnsa pointer to dns_answer structure
637 name name to look up
638 type type of DNS record required (T_A, T_MX, etc)
639
640 Returns: DNS_SUCCEED successful lookup
641 DNS_NOMATCH name not found (NXDOMAIN)
642 or name contains illegal characters (if checking)
643 or name is an IP address (for IP address lookup)
644 DNS_NODATA domain exists, but no data for this type (NODATA)
645 DNS_AGAIN soft failure, try again later
646 DNS_FAIL DNS failure
647 */
648
649 int
650 dns_basic_lookup(dns_answer *dnsa, const uschar *name, int type)
651 {
652 #ifndef STAND_ALONE
653 int rc = -1;
654 const uschar *save_domain;
655 #endif
656 res_state resp = os_get_dns_resolver_res();
657
658 tree_node *previous;
659 uschar node_name[290];
660
661 /* DNS lookup failures of any kind are cached in a tree. This is mainly so that
662 a timeout on one domain doesn't happen time and time again for messages that
663 have many addresses in the same domain. We rely on the resolver and name server
664 caching for successful lookups. */
665
666 sprintf(CS node_name, "%.255s-%s-%lx", name, dns_text_type(type),
667 (unsigned long) resp->options);
668 if ((previous = tree_search(tree_dns_fails, node_name)))
669 {
670 DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: using cached value %s\n",
671 name, dns_text_type(type),
672 (previous->data.val == DNS_NOMATCH)? "DNS_NOMATCH" :
673 (previous->data.val == DNS_NODATA)? "DNS_NODATA" :
674 (previous->data.val == DNS_AGAIN)? "DNS_AGAIN" :
675 (previous->data.val == DNS_FAIL)? "DNS_FAIL" : "??");
676 return previous->data.val;
677 }
678
679 #ifdef SUPPORT_I18N
680 /* Convert all names to a-label form before doing lookup */
681 {
682 uschar * alabel;
683 uschar * errstr = NULL;
684 DEBUG(D_dns) if (string_is_utf8(name))
685 debug_printf("convert utf8 '%s' to alabel for for lookup\n", name);
686 if ((alabel = string_domain_utf8_to_alabel(name, &errstr)), errstr)
687 {
688 DEBUG(D_dns)
689 debug_printf("DNS name '%s' utf8 conversion to alabel failed: %s\n", name,
690 errstr);
691 host_find_failed_syntax = TRUE;
692 return DNS_NOMATCH;
693 }
694 name = alabel;
695 }
696 #endif
697
698 /* If configured, check the hygiene of the name passed to lookup. Otherwise,
699 although DNS lookups may give REFUSED at the lower level, some resolvers
700 turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
701 domains cannot be in the DNS. The check is now done by a regular expression;
702 give it space for substring storage to save it having to get its own if the
703 regex has substrings that are used - the default uses a conditional.
704
705 This test is omitted for PTR records. These occur only in calls from the dnsdb
706 lookup, which constructs the names itself, so they should be OK. Besides,
707 bitstring labels don't conform to normal name syntax. (But the aren't used any
708 more.)
709
710 For SRV records, we omit the initial _smtp._tcp. components at the start. */
711
712 #ifndef STAND_ALONE /* Omit this for stand-alone tests */
713
714 if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
715 {
716 const uschar *checkname = name;
717 int ovector[3*(EXPAND_MAXN+1)];
718
719 dns_pattern_init();
720
721 /* For an SRV lookup, skip over the first two components (the service and
722 protocol names, which both start with an underscore). */
723
724 if (type == T_SRV || type == T_TLSA)
725 {
726 while (*checkname++ != '.');
727 while (*checkname++ != '.');
728 }
729
730 if (pcre_exec(regex_check_dns_names, NULL, CCS checkname, Ustrlen(checkname),
731 0, PCRE_EOPT, ovector, nelem(ovector)) < 0)
732 {
733 DEBUG(D_dns)
734 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
735 dns_text_type(type));
736 host_find_failed_syntax = TRUE;
737 return DNS_NOMATCH;
738 }
739 }
740
741 #endif /* STAND_ALONE */
742
743 /* Call the resolver; for an overlong response, res_search() will return the
744 number of bytes the message would need, so we need to check for this case. The
745 effect is to truncate overlong data.
746
747 On some systems, res_search() will recognize "A-for-A" queries and return
748 the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
749 nameservers are also believed to do this. It is, of course, contrary to the
750 specification of the DNS, so we lock it out. */
751
752 if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
753 return DNS_NOMATCH;
754
755 /* If we are running in the test harness, instead of calling the normal resolver
756 (res_search), we call fakens_search(), which recognizes certain special
757 domains, and interfaces to a fake nameserver for certain special zones. */
758
759 dnsa->answerlen = running_in_test_harness
760 ? fakens_search(name, type, dnsa->answer, sizeof(dnsa->answer))
761 : res_search(CCS name, C_IN, type, dnsa->answer, sizeof(dnsa->answer));
762
763 if (dnsa->answerlen > (int) sizeof(dnsa->answer))
764 {
765 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet"
766 " (size %d), truncating to %u.\n",
767 name, dns_text_type(type), dnsa->answerlen, (unsigned int) sizeof(dnsa->answer));
768 dnsa->answerlen = sizeof(dnsa->answer);
769 }
770
771 if (dnsa->answerlen < 0) switch (h_errno)
772 {
773 case HOST_NOT_FOUND:
774 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
775 "returning DNS_NOMATCH\n", name, dns_text_type(type));
776 return dns_return(name, type, DNS_NOMATCH);
777
778 case TRY_AGAIN:
779 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
780 name, dns_text_type(type));
781
782 /* Cut this out for various test programs */
783 #ifndef STAND_ALONE
784 save_domain = deliver_domain;
785 deliver_domain = string_copy(name); /* set $domain */
786 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
787 MCL_DOMAIN, TRUE, NULL);
788 deliver_domain = save_domain;
789 if (rc != OK)
790 {
791 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
792 return dns_return(name, type, DNS_AGAIN);
793 }
794 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
795 "DNS_NOMATCH\n", name);
796 return dns_return(name, type, DNS_NOMATCH);
797
798 #else /* For stand-alone tests */
799 return dns_return(name, type, DNS_AGAIN);
800 #endif
801
802 case NO_RECOVERY:
803 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
804 "returning DNS_FAIL\n", name, dns_text_type(type));
805 return dns_return(name, type, DNS_FAIL);
806
807 case NO_DATA:
808 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
809 "returning DNS_NODATA\n", name, dns_text_type(type));
810 return dns_return(name, type, DNS_NODATA);
811
812 default:
813 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
814 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
815 return dns_return(name, type, DNS_FAIL);
816 }
817
818 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
819 name, dns_text_type(type));
820
821 return DNS_SUCCEED;
822 }
823
824
825
826
827 /************************************************
828 * Do a DNS lookup and handle CNAMES *
829 ************************************************/
830
831 /* Look up the given domain name, using the given type. Follow CNAMEs if
832 necessary, but only so many times. There aren't supposed to be CNAME chains in
833 the DNS, but you are supposed to cope with them if you find them.
834
835 The assumption is made that if the resolver gives back records of the
836 requested type *and* a CNAME, we don't need to make another call to look up
837 the CNAME. I can't see how it could return only some of the right records. If
838 it's done a CNAME lookup in the past, it will have all of them; if not, it
839 won't return any.
840
841 If fully_qualified_name is not NULL, set it to point to the full name
842 returned by the resolver, if this is different to what it is given, unless
843 the returned name starts with "*" as some nameservers seem to be returning
844 wildcards in this form. In international mode "different" means "alabel
845 forms are different".
846
847 Arguments:
848 dnsa pointer to dns_answer structure
849 name domain name to look up
850 type DNS record type (T_A, T_MX, etc)
851 fully_qualified_name if not NULL, return the returned name here if its
852 contents are different (i.e. it must be preset)
853
854 Returns: DNS_SUCCEED successful lookup
855 DNS_NOMATCH name not found
856 DNS_NODATA no data found
857 DNS_AGAIN soft failure, try again later
858 DNS_FAIL DNS failure
859 */
860
861 int
862 dns_lookup(dns_answer *dnsa, const uschar *name, int type,
863 const uschar **fully_qualified_name)
864 {
865 int i;
866 const uschar *orig_name = name;
867 BOOL secure_so_far = TRUE;
868
869 /* Loop to follow CNAME chains so far, but no further... */
870
871 for (i = 0; i < 10; i++)
872 {
873 uschar * data;
874 dns_record *rr, cname_rr, type_rr;
875 dns_scan dnss;
876 int datalen, rc;
877
878 /* DNS lookup failures get passed straight back. */
879
880 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED)
881 return rc;
882
883 /* We should have either records of the required type, or a CNAME record,
884 or both. We need to know whether both exist for getting the fully qualified
885 name, but avoid scanning more than necessary. Note that we must copy the
886 contents of any rr blocks returned by dns_next_rr() as they use the same
887 area in the dnsa block. */
888
889 cname_rr.data = type_rr.data = NULL;
890 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
891 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
892 if (rr->type == type)
893 {
894 if (type_rr.data == NULL) type_rr = *rr;
895 if (cname_rr.data != NULL) break;
896 }
897 else if (rr->type == T_CNAME)
898 cname_rr = *rr;
899
900 /* For the first time round this loop, if a CNAME was found, take the fully
901 qualified name from it; otherwise from the first data record, if present. */
902
903 if (i == 0 && fully_qualified_name)
904 {
905 uschar * rr_name = cname_rr.data
906 ? cname_rr.name : type_rr.data ? type_rr.name : NULL;
907 if ( rr_name
908 && Ustrcmp(rr_name, *fully_qualified_name) != 0
909 && rr_name[0] != '*'
910 #ifdef SUPPORT_I18N
911 && ( !string_is_utf8(*fully_qualified_name)
912 || Ustrcmp(rr_name,
913 string_domain_utf8_to_alabel(*fully_qualified_name, NULL)) != 0
914 )
915 #endif
916 )
917 *fully_qualified_name = string_copy_dnsdomain(rr_name);
918 }
919
920 /* If any data records of the correct type were found, we are done. */
921
922 if (type_rr.data)
923 {
924 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
925 dns_set_insecure(dnsa);
926 return DNS_SUCCEED;
927 }
928
929 /* If there are no data records, we need to re-scan the DNS using the
930 domain given in the CNAME record, which should exist (otherwise we should
931 have had a failure from dns_lookup). However code against the possibility of
932 its not existing. */
933
934 if (!cname_rr.data)
935 return DNS_FAIL;
936
937 data = store_get(256);
938 if ((datalen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
939 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, 256)) < 0)
940 return DNS_FAIL;
941 name = data;
942
943 if (!dns_is_secure(dnsa))
944 secure_so_far = FALSE;
945
946 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
947 } /* Loop back to do another lookup */
948
949 /*Control reaches here after 10 times round the CNAME loop. Something isn't
950 right... */
951
952 log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
953 return DNS_FAIL;
954 }
955
956
957
958
959
960
961 /************************************************
962 * Do a DNS lookup and handle virtual types *
963 ************************************************/
964
965 /* This function handles some invented "lookup types" that synthesize features
966 not available in the basic types. The special types all have negative values.
967 Positive type values are passed straight on to dns_lookup().
968
969 Arguments:
970 dnsa pointer to dns_answer structure
971 name domain name to look up
972 type DNS record type (T_A, T_MX, etc or a "special")
973 fully_qualified_name if not NULL, return the returned name here if its
974 contents are different (i.e. it must be preset)
975
976 Returns: DNS_SUCCEED successful lookup
977 DNS_NOMATCH name not found
978 DNS_NODATA no data found
979 DNS_AGAIN soft failure, try again later
980 DNS_FAIL DNS failure
981 */
982
983 int
984 dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
985 const uschar **fully_qualified_name)
986 {
987 switch (type)
988 {
989 /* The "mx hosts only" type doesn't require any special action here */
990 case T_MXH:
991 return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
992
993 /* Find nameservers for the domain or the nearest enclosing zone, excluding
994 the root servers. */
995 case T_ZNS:
996 type = T_NS;
997 /* FALLTHROUGH */
998 case T_SOA:
999 {
1000 const uschar *d = name;
1001 while (d != 0)
1002 {
1003 int rc = dns_lookup(dnsa, d, type, fully_qualified_name);
1004 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
1005 while (*d != 0 && *d != '.') d++;
1006 if (*d++ == 0) break;
1007 }
1008 return DNS_NOMATCH;
1009 }
1010
1011 /* Try to look up the Client SMTP Authorization SRV record for the name. If
1012 there isn't one, search from the top downwards for a CSA record in a parent
1013 domain, which might be making assertions about subdomains. If we find a record
1014 we set fully_qualified_name to whichever lookup succeeded, so that the caller
1015 can tell whether to look at the explicit authorization field or the subdomain
1016 assertion field. */
1017 case T_CSA:
1018 {
1019 uschar *srvname, *namesuff, *tld;
1020 int priority, weight, port;
1021 int limit, rc, i;
1022 BOOL ipv6;
1023 dns_record *rr;
1024 dns_scan dnss;
1025
1026 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
1027
1028 srvname = string_sprintf("_client._smtp.%s", name);
1029 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1030 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
1031 {
1032 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
1033 return rc;
1034 }
1035
1036 /* Search for CSA subdomain assertion SRV records from the top downwards,
1037 starting with the 2nd level domain. This order maximizes cache-friendliness.
1038 We skip the top level domains to avoid loading their nameservers and because
1039 we know they'll never have CSA SRV records. */
1040
1041 namesuff = Ustrrchr(name, '.');
1042 if (namesuff == NULL) return DNS_NOMATCH;
1043 tld = namesuff + 1;
1044 ipv6 = FALSE;
1045 limit = dns_csa_search_limit;
1046
1047 /* Use more appropriate search parameters if we are in the reverse DNS. */
1048
1049 if (strcmpic(namesuff, US".arpa") == 0)
1050 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
1051 {
1052 namesuff -= 8;
1053 tld = namesuff + 1;
1054 limit = 3;
1055 }
1056 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
1057 {
1058 namesuff -= 4;
1059 tld = namesuff + 1;
1060 ipv6 = TRUE;
1061 limit = 3;
1062 }
1063
1064 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
1065
1066 /* Do not perform the search if the top level or 2nd level domains do not
1067 exist. This is quite common, and when it occurs all the search queries would
1068 go to the root or TLD name servers, which is not friendly. So we check the
1069 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
1070 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
1071 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
1072 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
1073
1074 if (rc == DNS_NOMATCH)
1075 {
1076 /* This is really gross. The successful return value from res_search() is
1077 the packet length, which is stored in dnsa->answerlen. If we get a
1078 negative DNS reply then res_search() returns -1, which causes the bounds
1079 checks for name decompression to fail when it is treated as a packet
1080 length, which in turn causes the authority search to fail. The correct
1081 packet length has been lost inside libresolv, so we have to guess a
1082 replacement value. (The only way to fix this properly would be to
1083 re-implement res_search() and res_query() so that they don't muddle their
1084 success and packet length return values.) For added safety we only reset
1085 the packet length if the packet header looks plausible. */
1086
1087 const HEADER * h = (const HEADER *)dnsa->answer;
1088 if (h->qr == 1 && h->opcode == QUERY && h->tc == 0
1089 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
1090 && ntohs(h->qdcount) == 1 && ntohs(h->ancount) == 0
1091 && ntohs(h->nscount) >= 1)
1092 dnsa->answerlen = MAXPACKET;
1093
1094 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
1095 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1096 )
1097 if (rr->type != T_SOA) continue;
1098 else if (strcmpic(rr->name, US"") == 0 ||
1099 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
1100 else break;
1101 }
1102
1103 for (i = 0; i < limit; i++)
1104 {
1105 if (ipv6)
1106 {
1107 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
1108 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
1109 namesuff -= 8;
1110 if (namesuff <= name) return DNS_NOMATCH;
1111 }
1112 else
1113 /* Find the start of the preceding domain name label. */
1114 do
1115 if (--namesuff <= name) return DNS_NOMATCH;
1116 while (*namesuff != '.');
1117
1118 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
1119
1120 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
1121 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1122 if (rc == DNS_AGAIN) return rc;
1123 if (rc != DNS_SUCCEED) continue;
1124
1125 /* Check that the SRV record we have found is worth returning. We don't
1126 just return the first one we find, because some lower level SRV record
1127 might make stricter assertions than its parent domain. */
1128
1129 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1130 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1131 {
1132 const uschar * p = rr->data;
1133
1134 /* Extract the numerical SRV fields (p is incremented) */
1135 GETSHORT(priority, p);
1136 GETSHORT(weight, p); weight = weight; /* compiler quietening */
1137 GETSHORT(port, p);
1138
1139 /* Check the CSA version number */
1140 if (priority != 1) continue;
1141
1142 /* If it's making an interesting assertion, return this response. */
1143 if (port & 1)
1144 {
1145 *fully_qualified_name = namesuff + 1;
1146 return DNS_SUCCEED;
1147 }
1148 }
1149 }
1150 return DNS_NOMATCH;
1151 }
1152
1153 default:
1154 if (type >= 0)
1155 return dns_lookup(dnsa, name, type, fully_qualified_name);
1156 }
1157
1158 /* Control should never reach here */
1159
1160 return DNS_FAIL;
1161 }
1162
1163
1164
1165
1166
1167 /*************************************************
1168 * Get address(es) from DNS record *
1169 *************************************************/
1170
1171 /* The record type is either T_A for an IPv4 address or T_AAAA for an IPv6 address.
1172
1173 Argument:
1174 dnsa the DNS answer block
1175 rr the RR
1176
1177 Returns: pointer to a chain of dns_address items; NULL when the dnsa was overrun
1178 */
1179
1180 dns_address *
1181 dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1182 {
1183 dns_address * yield = NULL;
1184 uschar * dnsa_lim = dnsa->answer + dnsa->answerlen;
1185
1186 if (rr->type == T_A)
1187 {
1188 uschar *p = US rr->data;
1189 if (p + 4 <= dnsa_lim)
1190 {
1191 yield = store_get(sizeof(dns_address) + 20);
1192 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1193 yield->next = NULL;
1194 }
1195 }
1196
1197 #if HAVE_IPV6
1198
1199 else
1200 {
1201 if (rr->data + 16 <= dnsa_lim)
1202 {
1203 struct in6_addr in6;
1204 int i;
1205 for (i = 0; i < 16; i++) in6.s6_addr[i] = rr->data[i];
1206 yield = store_get(sizeof(dns_address) + 50);
1207 inet_ntop(AF_INET6, &in6, CS yield->address, 50);
1208 yield->next = NULL;
1209 }
1210 }
1211 #endif /* HAVE_IPV6 */
1212
1213 return yield;
1214 }
1215
1216
1217
1218 void
1219 dns_pattern_init(void)
1220 {
1221 if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1222 regex_check_dns_names =
1223 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);
1224 }
1225
1226 /* vi: aw ai sw=2
1227 */
1228 /* End of dns.c */