d036162cb873b44a10f7a9927174411fd90a88da
[exim.git] / src / src / dns.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions for interfacing with the DNS. */
9
10 #include "exim.h"
11
12
13 /*************************************************
14 * Fake DNS resolver *
15 *************************************************/
16
17 /* This function is called instead of res_search() when Exim is running in its
18 test harness. It recognizes some special domain names, and uses them to force
19 failure and retry responses (optionally with a delay). Otherwise, it calls an
20 external utility that mocks-up a nameserver, if it can find the utility.
21 If not, it passes its arguments on to res_search(). The fake nameserver may
22 also return a code specifying that the name should be passed on.
23
24 Background: the original test suite required a real nameserver to carry the
25 test zones, whereas the new test suite has the fake server for portability. This
26 code supports both.
27
28 Arguments:
29 domain the domain name
30 type the DNS record type
31 answerptr where to put the answer
32 size size of the answer area
33
34 Returns: length of returned data, or -1 on error (h_errno set)
35 */
36
37 static int
38 fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
39 {
40 int len = Ustrlen(domain);
41 int asize = size; /* Locally modified */
42 uschar * name;
43 uschar utilname[256];
44 uschar *aptr = answerptr; /* Locally modified */
45 struct stat statbuf;
46
47 /* Remove terminating dot. */
48
49 if (domain[len - 1] == '.') len--;
50 name = string_copyn(domain, len);
51
52 /* Look for the fakens utility, and if it exists, call it. */
53
54 (void)string_format(utilname, sizeof(utilname), "%s/bin/fakens",
55 config_main_directory);
56
57 if (stat(CS utilname, &statbuf) >= 0)
58 {
59 pid_t pid;
60 int infd, outfd, rc;
61 uschar *argv[5];
62
63 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n",
64 name, dns_text_type(type));
65
66 argv[0] = utilname;
67 argv[1] = config_main_directory;
68 argv[2] = name;
69 argv[3] = dns_text_type(type);
70 argv[4] = NULL;
71
72 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE, US"fakens-search");
73 if (pid < 0)
74 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
75 strerror(errno));
76
77 len = 0;
78 rc = -1;
79 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
80 {
81 len += rc;
82 aptr += rc; /* Don't modify the actual arguments, because they */
83 asize -= rc; /* may need to be passed on to res_search(). */
84 }
85
86 /* If we ran out of output buffer before exhausting the return,
87 carry on reading and counting it. */
88
89 if (asize == 0)
90 while ((rc = read(outfd, name, sizeof(name))) > 0)
91 len += rc;
92
93 if (rc < 0)
94 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
95 strerror(errno));
96
97 switch(child_close(pid, 0))
98 {
99 case 0: return len;
100 case 1: h_errno = HOST_NOT_FOUND; return -1;
101 case 2: h_errno = TRY_AGAIN; return -1;
102 default:
103 case 3: h_errno = NO_RECOVERY; return -1;
104 case 4: h_errno = NO_DATA; return -1;
105 case 5: /* Pass on to res_search() */
106 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
107 }
108 }
109 else
110 {
111 DEBUG(D_dns) debug_printf("fakens (%s) not found\n", utilname);
112 }
113
114 /* fakens utility not found, or it returned "pass on" */
115
116 DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
117
118 return res_search(CS domain, C_IN, type, answerptr, size);
119 }
120
121
122
123 /*************************************************
124 * Initialize and configure resolver *
125 *************************************************/
126
127 /* Initialize the resolver and the storage for holding DNS answers if this is
128 the first time we have been here, and set the resolver options.
129
130 Arguments:
131 qualify_single TRUE to set the RES_DEFNAMES option
132 search_parents TRUE to set the RES_DNSRCH option
133 use_dnssec TRUE to set the RES_USE_DNSSEC option
134
135 Returns: nothing
136 */
137
138 void
139 dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
140 {
141 res_state resp = os_get_dns_resolver_res();
142
143 if ((resp->options & RES_INIT) == 0)
144 {
145 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
146 os_put_dns_resolver_res(resp);
147 res_init();
148 DEBUG(D_resolver) resp->options |= RES_DEBUG;
149 os_put_dns_resolver_res(resp);
150 }
151
152 resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
153 resp->options |= (qualify_single? RES_DEFNAMES : 0) |
154 (search_parents? RES_DNSRCH : 0);
155 if (dns_retrans > 0) resp->retrans = dns_retrans;
156 if (dns_retry > 0) resp->retry = dns_retry;
157
158 #ifdef RES_USE_EDNS0
159 if (dns_use_edns0 >= 0)
160 {
161 if (dns_use_edns0)
162 resp->options |= RES_USE_EDNS0;
163 else
164 resp->options &= ~RES_USE_EDNS0;
165 DEBUG(D_resolver)
166 debug_printf("Coerced resolver EDNS0 support %s.\n",
167 dns_use_edns0 ? "on" : "off");
168 }
169 #else
170 if (dns_use_edns0 >= 0)
171 DEBUG(D_resolver)
172 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
173 dns_use_edns0 ? "" : "un");
174 #endif
175
176 #ifndef DISABLE_DNSSEC
177 # ifdef RES_USE_DNSSEC
178 # ifndef RES_USE_EDNS0
179 # error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
180 # endif
181 if (use_dnssec)
182 resp->options |= RES_USE_DNSSEC;
183 if (dns_dnssec_ok >= 0)
184 {
185 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
186 {
187 DEBUG(D_resolver)
188 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
189 }
190 else
191 {
192 if (dns_dnssec_ok)
193 resp->options |= RES_USE_DNSSEC;
194 else
195 resp->options &= ~RES_USE_DNSSEC;
196 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
197 dns_dnssec_ok ? "on" : "off");
198 }
199 }
200 # else
201 if (dns_dnssec_ok >= 0)
202 DEBUG(D_resolver)
203 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
204 dns_dnssec_ok ? "" : "un");
205 if (use_dnssec)
206 DEBUG(D_resolver)
207 debug_printf("Unable to set DNSSEC without resolver support.\n");
208 # endif
209 #endif /* DISABLE_DNSSEC */
210
211 os_put_dns_resolver_res(resp);
212 }
213
214
215
216 /*************************************************
217 * Build key name for PTR records *
218 *************************************************/
219
220 /* This function inverts an IP address and adds the relevant domain, to produce
221 a name that can be used to look up PTR records.
222
223 Arguments:
224 string the IP address as a string
225
226 Returns: an allocated string
227 */
228
229 uschar *
230 dns_build_reverse(const uschar * string)
231 {
232 const uschar * p = string + Ustrlen(string);
233 gstring * g = NULL;
234
235 /* Handle IPv4 address */
236
237 #if HAVE_IPV6
238 if (Ustrchr(string, ':') == NULL)
239 #endif
240 {
241 for (int i = 0; i < 4; i++)
242 {
243 const uschar * ppp = p;
244 while (ppp > string && ppp[-1] != '.') ppp--;
245 g = string_catn(g, ppp, p - ppp);
246 g = string_catn(g, US".", 1);
247 p = ppp - 1;
248 }
249 g = string_catn(g, US"in-addr.arpa", 12);
250 }
251
252 /* Handle IPv6 address; convert to binary so as to fill out any
253 abbreviation in the textual form. */
254
255 #if HAVE_IPV6
256 else
257 {
258 int v6[4];
259
260 g = string_get_tainted(32, is_tainted(string));
261 (void)host_aton(string, v6);
262
263 /* The original specification for IPv6 reverse lookup was to invert each
264 nibble, and look in the ip6.int domain. The domain was subsequently
265 changed to ip6.arpa. */
266
267 for (int i = 3; i >= 0; i--)
268 for (int j = 0; j < 32; j += 4)
269 g = string_fmt_append(g, "%x.", (v6[i] >> j) & 15);
270 g = string_catn(g, US"ip6.arpa.", 9);
271
272 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
273 with A6 records. However, it fell out of favour when they did. The
274 alternative was to construct a binary key, and look in ip6.arpa. I tried
275 to make this code do that, but I could not make it work on Solaris 8. The
276 resolver seems to lose the initial backslash somehow. However, now that
277 this style of reverse lookup has been dropped, it doesn't matter. These
278 lines are left here purely for historical interest. */
279
280 /**************************************************
281 Ustrcpy(pp, "\\[x");
282 pp += 3;
283
284 for (int i = 0; i < 4; i++)
285 {
286 sprintf(pp, "%08X", v6[i]);
287 pp += 8;
288 }
289 Ustrcpy(pp, US"].ip6.arpa.");
290 **************************************************/
291
292 }
293 #endif
294 return string_from_gstring(g);
295 }
296
297
298
299
300 /* Increment the aptr in dnss, checking against dnsa length.
301 Return: TRUE for a bad result
302 */
303 static BOOL
304 dnss_inc_aptr(const dns_answer * dnsa, dns_scan * dnss, unsigned delta)
305 {
306 return (dnss->aptr += delta) >= dnsa->answer + dnsa->answerlen;
307 }
308
309 /*************************************************
310 * Get next DNS record from answer block *
311 *************************************************/
312
313 /* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
314 RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
315 scan the additional records, and reset == RESET_NEXT to get the next record.
316 The result is in static storage which must be copied if it is to be preserved.
317
318 Arguments:
319 dnsa pointer to dns answer block
320 dnss pointer to dns scan block
321 reset option specifying what portion to scan, as described above
322
323 Returns: next dns record, or NULL when no more
324 */
325
326 dns_record *
327 dns_next_rr(const dns_answer *dnsa, dns_scan *dnss, int reset)
328 {
329 const HEADER * h = (const HEADER *)dnsa->answer;
330 int namelen;
331
332 char * trace = NULL;
333 #ifdef rr_trace
334 # define TRACE DEBUG(D_dns)
335 #else
336 trace = trace;
337 # define TRACE if (FALSE)
338 #endif
339
340 /* Reset the saved data when requested to, and skip to the first required RR */
341
342 if (reset != RESET_NEXT)
343 {
344 dnss->rrcount = ntohs(h->qdcount);
345 TRACE debug_printf("%s: reset (Q rrcount %d)\n", __FUNCTION__, dnss->rrcount);
346 dnss->aptr = dnsa->answer + sizeof(HEADER);
347
348 /* Skip over questions; failure to expand the name just gives up */
349
350 while (dnss->rrcount-- > 0)
351 {
352 TRACE trace = "Q-namelen";
353 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
354 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
355 if (namelen < 0) goto null_return;
356 /* skip name & type & class */
357 TRACE trace = "Q-skip";
358 if (dnss_inc_aptr(dnsa, dnss, namelen+4)) goto null_return;
359 }
360
361 /* Get the number of answer records. */
362
363 dnss->rrcount = ntohs(h->ancount);
364 TRACE debug_printf("%s: reset (A rrcount %d)\n", __FUNCTION__, dnss->rrcount);
365
366 /* Skip over answers if we want to look at the authority section. Also skip
367 the NS records (i.e. authority section) if wanting to look at the additional
368 records. */
369
370 if (reset == RESET_ADDITIONAL)
371 {
372 TRACE debug_printf("%s: additional\n", __FUNCTION__);
373 dnss->rrcount += ntohs(h->nscount);
374 TRACE debug_printf("%s: reset (NS rrcount %d)\n", __FUNCTION__, dnss->rrcount);
375 }
376
377 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
378 {
379 TRACE if (reset == RESET_AUTHORITY)
380 debug_printf("%s: authority\n", __FUNCTION__);
381 while (dnss->rrcount-- > 0)
382 {
383 TRACE trace = "A-namelen";
384 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
385 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
386 if (namelen < 0) goto null_return;
387 /* skip name, type, class & TTL */
388 TRACE trace = "A-hdr";
389 if (dnss_inc_aptr(dnsa, dnss, namelen+8)) goto null_return;
390 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
391 /* skip over it */
392 TRACE trace = "A-skip";
393 if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) goto null_return;
394 }
395 dnss->rrcount = reset == RESET_AUTHORITY
396 ? ntohs(h->nscount) : ntohs(h->arcount);
397 TRACE debug_printf("%s: reset (%s rrcount %d)\n", __FUNCTION__,
398 reset == RESET_AUTHORITY ? "NS" : "AR", dnss->rrcount);
399 }
400 TRACE debug_printf("%s: %d RRs to read\n", __FUNCTION__, dnss->rrcount);
401 }
402 else
403 TRACE debug_printf("%s: next (%d left)\n", __FUNCTION__, dnss->rrcount);
404
405 /* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
406 contains the number of RR records left. */
407
408 if (dnss->rrcount-- <= 0) return NULL;
409
410 /* If expanding the RR domain name fails, behave as if no more records
411 (something safe). */
412
413 TRACE trace = "R-namelen";
414 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
415 (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
416 if (namelen < 0) goto null_return;
417
418 /* Move the pointer past the name and fill in the rest of the data structure
419 from the following bytes. */
420
421 TRACE trace = "R-name";
422 if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return;
423
424 GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
425 TRACE trace = "R-class";
426 if (dnss_inc_aptr(dnsa, dnss, 2)) goto null_return; /* Don't want class */
427 GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */
428 GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
429 dnss->srr.data = dnss->aptr; /* The record's data follows */
430
431 /* Unchecked increment ok here since no further access on this iteration;
432 will be checked on next at "R-name". */
433
434 dnss->aptr += dnss->srr.size; /* Advance to next RR */
435
436 /* Return a pointer to the dns_record structure within the dns_answer. This is
437 for convenience so that the scans can use nice-looking for loops. */
438
439 TRACE debug_printf("%s: return %s\n", __FUNCTION__, dns_text_type(dnss->srr.type));
440 return &dnss->srr;
441
442 null_return:
443 TRACE debug_printf("%s: terminate (%d RRs left). Last op: %s; errno %d %s\n",
444 __FUNCTION__, dnss->rrcount, trace, errno, strerror(errno));
445 dnss->rrcount = 0;
446 return NULL;
447 }
448
449
450 /* Extract the AUTHORITY information from the answer. If the answer isn't
451 authoritative (AA not set), we do not extract anything.
452
453 The AUTHORITY section contains NS records if the name in question was found,
454 it contains a SOA record otherwise. (This is just from experience and some
455 tests, is there some spec?)
456
457 Scan the whole AUTHORITY section, since it may contain other records
458 (e.g. NSEC3) too.
459
460 Return: name for the authority, in an allocated string, or NULL if none found */
461
462 static const uschar *
463 dns_extract_auth_name(const dns_answer * dnsa) /* FIXME: const dns_answer */
464 {
465 dns_scan dnss;
466 const HEADER * h = (const HEADER *) dnsa->answer;
467
468 if (h->nscount && h->aa)
469 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
470 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
471 if (rr->type == (h->ancount ? T_NS : T_SOA))
472 return string_copy(rr->name);
473 return NULL;
474 }
475
476
477
478
479 /*************************************************
480 * Return whether AD bit set in DNS result *
481 *************************************************/
482
483 /* We do not perform DNSSEC work ourselves; if the administrator has installed
484 a verifying resolver which sets AD as appropriate, though, we'll use that.
485 (AD = Authentic Data, AA = Authoritative Answer)
486
487 Argument: pointer to dns answer block
488 Returns: bool indicating presence of AD bit
489 */
490
491 BOOL
492 dns_is_secure(const dns_answer * dnsa)
493 {
494 #ifdef DISABLE_DNSSEC
495 DEBUG(D_dns)
496 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
497 return FALSE;
498 #else
499 const HEADER * h = (const HEADER *) dnsa->answer;
500 const uschar * auth_name;
501 const uschar * trusted;
502
503 if (dnsa->answerlen < 0) return FALSE;
504 if (h->ad) return TRUE;
505
506 /* If the resolver we ask is authoritative for the domain in question, it may
507 not set the AD but the AA bit. If we explicitly trust the resolver for that
508 domain (via a domainlist in dns_trust_aa), we return TRUE to indicate a secure
509 answer. */
510
511 if ( !h->aa
512 || !dns_trust_aa
513 || !(trusted = expand_string(dns_trust_aa))
514 || !*trusted
515 || !(auth_name = dns_extract_auth_name(dnsa))
516 || OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL,
517 MCL_DOMAIN, TRUE, NULL)
518 )
519 return FALSE;
520
521 DEBUG(D_dns) debug_printf("DNS faked the AD bit "
522 "(got AA and matched with dns_trust_aa (%s in %s))\n",
523 auth_name, dns_trust_aa);
524
525 return TRUE;
526 #endif
527 }
528
529 static void
530 dns_set_insecure(dns_answer * dnsa)
531 {
532 #ifndef DISABLE_DNSSEC
533 HEADER * h = (HEADER *)dnsa->answer;
534 h->aa = h->ad = 0;
535 #endif
536 }
537
538 /************************************************
539 * Check whether the AA bit is set *
540 * We need this to warn if we requested AD *
541 * from an authoritative server *
542 ************************************************/
543
544 BOOL
545 dns_is_aa(const dns_answer * dnsa)
546 {
547 #ifdef DISABLE_DNSSEC
548 return FALSE;
549 #else
550 return dnsa->answerlen >= 0 && ((const HEADER *)dnsa->answer)->aa;
551 #endif
552 }
553
554
555
556 /*************************************************
557 * Turn DNS type into text *
558 *************************************************/
559
560 /* Turn the coded record type into a string for printing. All those that Exim
561 uses should be included here.
562
563 Argument: record type
564 Returns: pointer to string
565 */
566
567 uschar *
568 dns_text_type(int t)
569 {
570 switch(t)
571 {
572 case T_A: return US"A";
573 case T_MX: return US"MX";
574 case T_AAAA: return US"AAAA";
575 case T_A6: return US"A6";
576 case T_TXT: return US"TXT";
577 case T_SPF: return US"SPF";
578 case T_PTR: return US"PTR";
579 case T_SOA: return US"SOA";
580 case T_SRV: return US"SRV";
581 case T_NS: return US"NS";
582 case T_CNAME: return US"CNAME";
583 case T_TLSA: return US"TLSA";
584 default: return US"?";
585 }
586 }
587
588
589
590 /*************************************************
591 * Cache a failed DNS lookup result *
592 *************************************************/
593
594 static void
595 dns_fail_tag(uschar * buf, const uschar * name, int dns_type)
596 {
597 res_state resp = os_get_dns_resolver_res();
598
599 /*XX buf needs to be 255 +1 + (max(typetext) == 5) +1 + max(chars_for_long-max) +1
600 We truncate the name here for safety... could use a dynamic string. */
601
602 sprintf(CS buf, "%.255s-%s-%lx", name, dns_text_type(dns_type),
603 (unsigned long) resp->options);
604 }
605
606
607 /* We cache failed lookup results so as not to experience timeouts many
608 times for the same domain. We need to retain the resolver options because they
609 may change. For successful lookups, we rely on resolver and/or name server
610 caching.
611
612 Arguments:
613 name the domain name
614 type the lookup type
615 expiry time TTL expires, or zero for unlimited
616 rc the return code
617
618 Returns: the return code
619 */
620
621 /* we need: 255 +1 + (max(typetext) == 5) +1 + max(chars_for_long-max) +1 */
622 #define DNS_FAILTAG_MAX 290
623 #define DNS_FAILNODE_SIZE \
624 (sizeof(expiring_data) + sizeof(tree_node) + DNS_FAILTAG_MAX)
625
626 static int
627 dns_fail_return(const uschar * name, int type, time_t expiry, int rc)
628 {
629 uschar node_name[DNS_FAILTAG_MAX];
630 tree_node * previous, * new;
631 expiring_data * e;
632
633 dns_fail_tag(node_name, name, type);
634 if ((previous = tree_search(tree_dns_fails, node_name)))
635 e = previous->data.ptr;
636 else
637 {
638 e = store_get_perm(DNS_FAILNODE_SIZE, is_tainted(name));
639 new = (void *)(e+1);
640 dns_fail_tag(new->name, name, type);
641 new->data.ptr = e;
642 (void)tree_insertnode(&tree_dns_fails, new);
643 }
644
645 DEBUG(D_dns) debug_printf(" %s neg-cache entry for %s, ttl %d\n",
646 previous ? "update" : "writing",
647 node_name, expiry ? (int)(expiry - time(NULL)) : -1);
648 e->expiry = expiry;
649 e->data.val = rc;
650 return rc;
651 }
652
653
654 /* Return the cached result of a known-bad lookup, or -1.
655 */
656 static int
657 dns_fail_cache_hit(const uschar * name, int type)
658 {
659 uschar node_name[DNS_FAILTAG_MAX];
660 tree_node * previous;
661 expiring_data * e;
662 int val, rc;
663
664 dns_fail_tag(node_name, name, type);
665 if (!(previous = tree_search(tree_dns_fails, node_name)))
666 return -1;
667
668 e = previous->data.ptr;
669 val = e->data.val;
670 rc = e->expiry && e->expiry <= time(NULL) ? -1 : val;
671
672 DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: %scached value %s%s\n",
673 name, dns_text_type(type),
674 rc == -1 ? "" : "using ",
675 val == DNS_NOMATCH ? "DNS_NOMATCH" :
676 val == DNS_NODATA ? "DNS_NODATA" :
677 val == DNS_AGAIN ? "DNS_AGAIN" :
678 val == DNS_FAIL ? "DNS_FAIL" : "??",
679 rc == -1 ? " past valid time" : "");
680
681 return rc;
682 }
683
684
685
686 /* This is really gross. The successful return value from res_search() is
687 the packet length, which is stored in dnsa->answerlen. If we get a
688 negative DNS reply then res_search() returns -1, which causes the bounds
689 checks for name decompression to fail when it is treated as a packet
690 length, which in turn causes the authority search to fail. The correct
691 packet length has been lost inside libresolv, so we have to guess a
692 replacement value. (The only way to fix this properly would be to
693 re-implement res_search() and res_query() so that they don't muddle their
694 success and packet length return values.) For added safety we only reset
695 the packet length if the packet header looks plausible. */
696
697 static void
698 fake_dnsa_len_for_fail(dns_answer * dnsa, int type)
699 {
700 const HEADER * h = (const HEADER *)dnsa->answer;
701
702 if ( h->qr == 1 /* a response */
703 && h->opcode == QUERY
704 && h->tc == 0 /* nmessage not truncated */
705 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
706 && ( ntohs(h->qdcount) == 1 /* one question record */
707 || f.running_in_test_harness)
708 && ntohs(h->ancount) == 0 /* no answer records */
709 && ntohs(h->nscount) >= 1) /* authority records */
710 {
711 DEBUG(D_dns) debug_printf("faking res_search(%s) response length as %d\n",
712 dns_text_type(type), (int)sizeof(dnsa->answer));
713 dnsa->answerlen = sizeof(dnsa->answer);
714 }
715 }
716
717
718 /* Return the TTL suitable for an NXDOMAIN result, which is given
719 in the SOA. We hope that one was returned in the lookup, and do not
720 bother doing a separate lookup; if not found return a forever TTL.
721 */
722
723 time_t
724 dns_expire_from_soa(dns_answer * dnsa, int type)
725 {
726 dns_scan dnss;
727
728 fake_dnsa_len_for_fail(dnsa, type);
729
730 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
731 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
732 ) if (rr->type == T_SOA)
733 {
734 const uschar * p = rr->data;
735 uschar discard_buf[256];
736 int len;
737 unsigned long ttl;
738
739 /* Skip the mname & rname strings */
740
741 if ((len = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
742 p, (DN_EXPAND_ARG4_TYPE)discard_buf, 256)) < 0)
743 break;
744 p += len;
745 if ((len = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
746 p, (DN_EXPAND_ARG4_TYPE)discard_buf, 256)) < 0)
747 break;
748 p += len;
749
750 /* Skip the SOA serial, refresh, retry & expire. Grab the TTL */
751
752 if (p > dnsa->answer + dnsa->answerlen - 5 * INT32SZ)
753 break;
754 p += 4 * INT32SZ;
755 GETLONG(ttl, p);
756
757 return time(NULL) + ttl;
758 }
759 DEBUG(D_dns) debug_printf("DNS: no SOA record found for neg-TTL\n");
760 return 0;
761 }
762
763
764 /*************************************************
765 * Do basic DNS lookup *
766 *************************************************/
767
768 /* Call the resolver to look up the given domain name, using the given type,
769 and check the result. The error code TRY_AGAIN is documented as meaning "non-
770 Authoritative Host not found, or SERVERFAIL". Sometimes there are badly set
771 up nameservers that produce this error continually, so there is the option of
772 providing a list of domains for which this is treated as a non-existent
773 host.
774
775 The dns_answer structure is pretty big; enough to hold a max-sized DNS message
776 - so best allocated from fast-release memory. As of writing, all our callers
777 use a stack-auto variable.
778
779 Arguments:
780 dnsa pointer to dns_answer structure
781 name name to look up
782 type type of DNS record required (T_A, T_MX, etc)
783
784 Returns: DNS_SUCCEED successful lookup
785 DNS_NOMATCH name not found (NXDOMAIN)
786 or name contains illegal characters (if checking)
787 or name is an IP address (for IP address lookup)
788 DNS_NODATA domain exists, but no data for this type (NODATA)
789 DNS_AGAIN soft failure, try again later
790 DNS_FAIL DNS failure
791 */
792
793 int
794 dns_basic_lookup(dns_answer * dnsa, const uschar * name, int type)
795 {
796 int rc;
797 #ifndef STAND_ALONE
798 const uschar * save_domain;
799 #endif
800
801 /* DNS lookup failures of any kind are cached in a tree. This is mainly so that
802 a timeout on one domain doesn't happen time and time again for messages that
803 have many addresses in the same domain. We rely on the resolver and name server
804 caching for successful lookups.
805 */
806
807 if ((rc = dns_fail_cache_hit(name, type)) > 0)
808 {
809 dnsa->answerlen = -1;
810 return rc;
811 }
812
813 #ifdef SUPPORT_I18N
814 /* Convert all names to a-label form before doing lookup */
815 {
816 uschar * alabel;
817 uschar * errstr = NULL;
818 DEBUG(D_dns) if (string_is_utf8(name))
819 debug_printf("convert utf8 '%s' to alabel for for lookup\n", name);
820 if ((alabel = string_domain_utf8_to_alabel(name, &errstr)), errstr)
821 {
822 DEBUG(D_dns)
823 debug_printf("DNS name '%s' utf8 conversion to alabel failed: %s\n", name,
824 errstr);
825 f.host_find_failed_syntax = TRUE;
826 return DNS_NOMATCH;
827 }
828 name = alabel;
829 }
830 #endif
831
832 /* If configured, check the hygiene of the name passed to lookup. Otherwise,
833 although DNS lookups may give REFUSED at the lower level, some resolvers
834 turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
835 domains cannot be in the DNS. The check is now done by a regular expression;
836 give it space for substring storage to save it having to get its own if the
837 regex has substrings that are used - the default uses a conditional.
838
839 This test is omitted for PTR records. These occur only in calls from the dnsdb
840 lookup, which constructs the names itself, so they should be OK. Besides,
841 bitstring labels don't conform to normal name syntax. (But they aren't used any
842 more.) */
843
844 #ifndef STAND_ALONE /* Omit this for stand-alone tests */
845
846 if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
847 {
848 int ovector[3*(EXPAND_MAXN+1)];
849
850 dns_pattern_init();
851 if (pcre_exec(regex_check_dns_names, NULL, CCS name, Ustrlen(name),
852 0, PCRE_EOPT, ovector, nelem(ovector)) < 0)
853 {
854 DEBUG(D_dns)
855 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
856 dns_text_type(type));
857 f.host_find_failed_syntax = TRUE;
858 return DNS_NOMATCH;
859 }
860 }
861
862 #endif /* STAND_ALONE */
863
864 /* Call the resolver; for an overlong response, res_search() will return the
865 number of bytes the message would need, so we need to check for this case. The
866 effect is to truncate overlong data.
867
868 On some systems, res_search() will recognize "A-for-A" queries and return
869 the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
870 nameservers are also believed to do this. It is, of course, contrary to the
871 specification of the DNS, so we lock it out. */
872
873 if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
874 return DNS_NOMATCH;
875
876 /* If we are running in the test harness, instead of calling the normal resolver
877 (res_search), we call fakens_search(), which recognizes certain special
878 domains, and interfaces to a fake nameserver for certain special zones. */
879
880 h_errno = 0;
881 dnsa->answerlen = f.running_in_test_harness
882 ? fakens_search(name, type, dnsa->answer, sizeof(dnsa->answer))
883 : res_search(CCS name, C_IN, type, dnsa->answer, sizeof(dnsa->answer));
884
885 if (dnsa->answerlen > (int) sizeof(dnsa->answer))
886 {
887 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet"
888 " (size %d), truncating to %u.\n",
889 name, dns_text_type(type), dnsa->answerlen, (unsigned int) sizeof(dnsa->answer));
890 dnsa->answerlen = sizeof(dnsa->answer);
891 }
892
893 if (dnsa->answerlen < 0) switch (h_errno)
894 {
895 case HOST_NOT_FOUND:
896 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
897 "returning DNS_NOMATCH\n", name, dns_text_type(type));
898 return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), DNS_NOMATCH);
899
900 case TRY_AGAIN:
901 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
902 name, dns_text_type(type));
903
904 /* Cut this out for various test programs */
905 #ifndef STAND_ALONE
906 save_domain = deliver_domain;
907 deliver_domain = string_copy(name); /* set $domain */
908 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
909 MCL_DOMAIN, TRUE, NULL);
910 deliver_domain = save_domain;
911 if (rc != OK)
912 {
913 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
914 return dns_fail_return(name, type, 0, DNS_AGAIN);
915 }
916 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
917 "DNS_NOMATCH\n", name);
918 return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), DNS_NOMATCH);
919
920 #else /* For stand-alone tests */
921 return dns_fail_return(name, type, 0, DNS_AGAIN);
922 #endif
923
924 case NO_RECOVERY:
925 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
926 "returning DNS_FAIL\n", name, dns_text_type(type));
927 return dns_fail_return(name, type, 0, DNS_FAIL);
928
929 case NO_DATA:
930 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
931 "returning DNS_NODATA\n", name, dns_text_type(type));
932 return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), DNS_NODATA);
933
934 default:
935 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
936 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
937 return dns_fail_return(name, type, 0, DNS_FAIL);
938 }
939
940 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
941 name, dns_text_type(type));
942
943 return DNS_SUCCEED;
944 }
945
946
947
948
949 /************************************************
950 * Do a DNS lookup and handle CNAMES *
951 ************************************************/
952
953 /* Look up the given domain name, using the given type. Follow CNAMEs if
954 necessary, but only so many times. There aren't supposed to be CNAME chains in
955 the DNS, but you are supposed to cope with them if you find them.
956 By default, follow one CNAME since a resolver has been seen, faced with
957 an MX request and a CNAME (to an A) but no MX present, returning the CNAME.
958
959 The assumption is made that if the resolver gives back records of the
960 requested type *and* a CNAME, we don't need to make another call to look up
961 the CNAME. I can't see how it could return only some of the right records. If
962 it's done a CNAME lookup in the past, it will have all of them; if not, it
963 won't return any.
964
965 If fully_qualified_name is not NULL, set it to point to the full name
966 returned by the resolver, if this is different to what it is given, unless
967 the returned name starts with "*" as some nameservers seem to be returning
968 wildcards in this form. In international mode "different" means "alabel
969 forms are different".
970
971 Arguments:
972 dnsa pointer to dns_answer structure
973 name domain name to look up
974 type DNS record type (T_A, T_MX, etc)
975 fully_qualified_name if not NULL, return the returned name here if its
976 contents are different (i.e. it must be preset)
977
978 Returns: DNS_SUCCEED successful lookup
979 DNS_NOMATCH name not found
980 DNS_NODATA no data found
981 DNS_AGAIN soft failure, try again later
982 DNS_FAIL DNS failure
983 */
984
985 int
986 dns_lookup(dns_answer *dnsa, const uschar *name, int type,
987 const uschar **fully_qualified_name)
988 {
989 const uschar *orig_name = name;
990 BOOL secure_so_far = TRUE;
991
992 /* By default, assume the resolver follows CNAME chains (and returns NODATA for
993 an unterminated one). If it also does that for a CNAME loop, fine; if it returns
994 a CNAME (maybe the last?) whine about it. However, retain the coding for dumb
995 resolvers hiding behind a config variable. Loop to follow CNAME chains so far,
996 but no further... The testsuite tests the latter case, mostly assuming that the
997 former will work. */
998
999 for (int i = 0; i <= dns_cname_loops; i++)
1000 {
1001 uschar * data;
1002 dns_record cname_rr, type_rr;
1003 dns_scan dnss;
1004 int rc;
1005
1006 /* DNS lookup failures get passed straight back. */
1007
1008 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED)
1009 return rc;
1010
1011 /* We should have either records of the required type, or a CNAME record,
1012 or both. We need to know whether both exist for getting the fully qualified
1013 name, but avoid scanning more than necessary. Note that we must copy the
1014 contents of any rr blocks returned by dns_next_rr() as they use the same
1015 area in the dnsa block. */
1016
1017 cname_rr.data = type_rr.data = NULL;
1018 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1019 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
1020 if (rr->type == type)
1021 {
1022 if (type_rr.data == NULL) type_rr = *rr;
1023 if (cname_rr.data != NULL) break;
1024 }
1025 else if (rr->type == T_CNAME)
1026 cname_rr = *rr;
1027
1028 /* For the first time round this loop, if a CNAME was found, take the fully
1029 qualified name from it; otherwise from the first data record, if present. */
1030
1031 if (i == 0 && fully_qualified_name)
1032 {
1033 uschar * rr_name = cname_rr.data
1034 ? cname_rr.name : type_rr.data ? type_rr.name : NULL;
1035 if ( rr_name
1036 && Ustrcmp(rr_name, *fully_qualified_name) != 0
1037 && rr_name[0] != '*'
1038 #ifdef SUPPORT_I18N
1039 && ( !string_is_utf8(*fully_qualified_name)
1040 || Ustrcmp(rr_name,
1041 string_domain_utf8_to_alabel(*fully_qualified_name, NULL)) != 0
1042 )
1043 #endif
1044 )
1045 *fully_qualified_name = string_copy_dnsdomain(rr_name);
1046 }
1047
1048 /* If any data records of the correct type were found, we are done. */
1049
1050 if (type_rr.data)
1051 {
1052 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
1053 dns_set_insecure(dnsa);
1054 return DNS_SUCCEED;
1055 }
1056
1057 /* If there are no data records, we need to re-scan the DNS using the
1058 domain given in the CNAME record, which should exist (otherwise we should
1059 have had a failure from dns_lookup). However code against the possibility of
1060 its not existing. */
1061
1062 if (!cname_rr.data)
1063 return DNS_FAIL;
1064
1065 /* DNS data comes from the outside, hence tainted */
1066 data = store_get(256, TRUE);
1067 if (dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
1068 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, 256) < 0)
1069 return DNS_FAIL;
1070 name = data;
1071
1072 if (!dns_is_secure(dnsa))
1073 secure_so_far = FALSE;
1074
1075 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
1076 } /* Loop back to do another lookup */
1077
1078 /*Control reaches here after 10 times round the CNAME loop. Something isn't
1079 right... */
1080
1081 log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
1082 return DNS_FAIL;
1083 }
1084
1085
1086
1087
1088
1089
1090 /************************************************
1091 * Do a DNS lookup and handle virtual types *
1092 ************************************************/
1093
1094 /* This function handles some invented "lookup types" that synthesize features
1095 not available in the basic types. The special types all have negative values.
1096 Positive type values are passed straight on to dns_lookup().
1097
1098 Arguments:
1099 dnsa pointer to dns_answer structure
1100 name domain name to look up
1101 type DNS record type (T_A, T_MX, etc or a "special")
1102 fully_qualified_name if not NULL, return the returned name here if its
1103 contents are different (i.e. it must be preset)
1104
1105 Returns: DNS_SUCCEED successful lookup
1106 DNS_NOMATCH name not found
1107 DNS_NODATA no data found
1108 DNS_AGAIN soft failure, try again later
1109 DNS_FAIL DNS failure
1110 */
1111
1112 int
1113 dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
1114 const uschar **fully_qualified_name)
1115 {
1116 switch (type)
1117 {
1118 /* The "mx hosts only" type doesn't require any special action here */
1119 case T_MXH:
1120 return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
1121
1122 /* Find nameservers for the domain or the nearest enclosing zone, excluding
1123 the root servers. */
1124 case T_ZNS:
1125 type = T_NS;
1126 /* FALLTHROUGH */
1127 case T_SOA:
1128 {
1129 const uschar *d = name;
1130 while (d != 0)
1131 {
1132 int rc = dns_lookup(dnsa, d, type, fully_qualified_name);
1133 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
1134 while (*d != 0 && *d != '.') d++;
1135 if (*d++ == 0) break;
1136 }
1137 return DNS_NOMATCH;
1138 }
1139
1140 /* Try to look up the Client SMTP Authorization SRV record for the name. If
1141 there isn't one, search from the top downwards for a CSA record in a parent
1142 domain, which might be making assertions about subdomains. If we find a record
1143 we set fully_qualified_name to whichever lookup succeeded, so that the caller
1144 can tell whether to look at the explicit authorization field or the subdomain
1145 assertion field. */
1146 case T_CSA:
1147 {
1148 uschar *srvname, *namesuff, *tld;
1149 int priority, weight, port;
1150 int limit, rc, i;
1151 BOOL ipv6;
1152 dns_record *rr;
1153 dns_scan dnss;
1154
1155 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
1156
1157 srvname = string_sprintf("_client._smtp.%s", name);
1158 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1159 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
1160 {
1161 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
1162 return rc;
1163 }
1164
1165 /* Search for CSA subdomain assertion SRV records from the top downwards,
1166 starting with the 2nd level domain. This order maximizes cache-friendliness.
1167 We skip the top level domains to avoid loading their nameservers and because
1168 we know they'll never have CSA SRV records. */
1169
1170 namesuff = Ustrrchr(name, '.');
1171 if (namesuff == NULL) return DNS_NOMATCH;
1172 tld = namesuff + 1;
1173 ipv6 = FALSE;
1174 limit = dns_csa_search_limit;
1175
1176 /* Use more appropriate search parameters if we are in the reverse DNS. */
1177
1178 if (strcmpic(namesuff, US".arpa") == 0)
1179 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
1180 {
1181 namesuff -= 8;
1182 tld = namesuff + 1;
1183 limit = 3;
1184 }
1185 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
1186 {
1187 namesuff -= 4;
1188 tld = namesuff + 1;
1189 ipv6 = TRUE;
1190 limit = 3;
1191 }
1192
1193 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
1194
1195 /* Do not perform the search if the top level or 2nd level domains do not
1196 exist. This is quite common, and when it occurs all the search queries would
1197 go to the root or TLD name servers, which is not friendly. So we check the
1198 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
1199 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
1200 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
1201 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
1202
1203 if (rc == DNS_NOMATCH)
1204 {
1205 fake_dnsa_len_for_fail(dnsa, T_CSA);
1206
1207 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
1208 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1209 )
1210 if (rr->type != T_SOA) continue;
1211 else if (strcmpic(rr->name, US"") == 0 ||
1212 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
1213 else break;
1214 }
1215
1216 for (i = 0; i < limit; i++)
1217 {
1218 if (ipv6)
1219 {
1220 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
1221 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
1222 namesuff -= 8;
1223 if (namesuff <= name) return DNS_NOMATCH;
1224 }
1225 else
1226 /* Find the start of the preceding domain name label. */
1227 do
1228 if (--namesuff <= name) return DNS_NOMATCH;
1229 while (*namesuff != '.');
1230
1231 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
1232
1233 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
1234 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1235 if (rc == DNS_AGAIN) return rc;
1236 if (rc != DNS_SUCCEED) continue;
1237
1238 /* Check that the SRV record we have found is worth returning. We don't
1239 just return the first one we find, because some lower level SRV record
1240 might make stricter assertions than its parent domain. */
1241
1242 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1243 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1244 {
1245 const uschar * p = rr->data;
1246
1247 /* Extract the numerical SRV fields (p is incremented) */
1248 GETSHORT(priority, p);
1249 GETSHORT(weight, p); weight = weight; /* compiler quietening */
1250 GETSHORT(port, p);
1251
1252 /* Check the CSA version number */
1253 if (priority != 1) continue;
1254
1255 /* If it's making an interesting assertion, return this response. */
1256 if (port & 1)
1257 {
1258 *fully_qualified_name = namesuff + 1;
1259 return DNS_SUCCEED;
1260 }
1261 }
1262 }
1263 return DNS_NOMATCH;
1264 }
1265
1266 default:
1267 if (type >= 0)
1268 return dns_lookup(dnsa, name, type, fully_qualified_name);
1269 }
1270
1271 /* Control should never reach here */
1272
1273 return DNS_FAIL;
1274 }
1275
1276
1277
1278
1279
1280 /*************************************************
1281 * Get address(es) from DNS record *
1282 *************************************************/
1283
1284 /* The record type is either T_A for an IPv4 address or T_AAAA for an IPv6 address.
1285
1286 Argument:
1287 dnsa the DNS answer block
1288 rr the RR
1289
1290 Returns: pointer to a chain of dns_address items; NULL when the dnsa was overrun
1291 */
1292
1293 dns_address *
1294 dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1295 {
1296 dns_address * yield = NULL;
1297 uschar * dnsa_lim = dnsa->answer + dnsa->answerlen;
1298
1299 if (rr->type == T_A)
1300 {
1301 uschar *p = US rr->data;
1302 if (p + 4 <= dnsa_lim)
1303 {
1304 /* the IP is not regarded as tainted */
1305 yield = store_get(sizeof(dns_address) + 20, FALSE);
1306 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1307 yield->next = NULL;
1308 }
1309 }
1310
1311 #if HAVE_IPV6
1312
1313 else
1314 {
1315 if (rr->data + 16 <= dnsa_lim)
1316 {
1317 struct in6_addr in6;
1318 for (int i = 0; i < 16; i++) in6.s6_addr[i] = rr->data[i];
1319 yield = store_get(sizeof(dns_address) + 50, FALSE);
1320 inet_ntop(AF_INET6, &in6, CS yield->address, 50);
1321 yield->next = NULL;
1322 }
1323 }
1324 #endif /* HAVE_IPV6 */
1325
1326 return yield;
1327 }
1328
1329
1330
1331 void
1332 dns_pattern_init(void)
1333 {
1334 if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1335 regex_check_dns_names =
1336 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);
1337 }
1338
1339 /* vi: aw ai sw=2
1340 */
1341 /* End of dns.c */