src/src/routers/dnslookup.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2017 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 #include "../exim.h"
   9 #include "rf_functions.h"
  10 #include "dnslookup.h"
  11
  12
  13
  14 /* Options specific to the dnslookup router. */
  15
  16 optionlist dnslookup_router_options[] = {
  17   { "check_secondary_mx", opt_bool,
  18       (void *)(offsetof(dnslookup_router_options_block, check_secondary_mx)) },
  19   { "check_srv",          opt_stringptr,
  20       (void *)(offsetof(dnslookup_router_options_block, check_srv)) },
  21   { "fail_defer_domains", opt_stringptr,
  22       (void *)(offsetof(dnslookup_router_options_block, fail_defer_domains)) },
  23   { "mx_domains",         opt_stringptr,
  24       (void *)(offsetof(dnslookup_router_options_block, mx_domains)) },
  25   { "mx_fail_domains",    opt_stringptr,
  26       (void *)(offsetof(dnslookup_router_options_block, mx_fail_domains)) },
  27   { "qualify_single",     opt_bool,
  28       (void *)(offsetof(dnslookup_router_options_block, qualify_single)) },
  29   { "rewrite_headers",    opt_bool,
  30       (void *)(offsetof(dnslookup_router_options_block, rewrite_headers)) },
  31   { "same_domain_copy_routing", opt_bool|opt_public,
  32       (void *)(offsetof(router_instance, same_domain_copy_routing)) },
  33   { "search_parents",     opt_bool,
  34       (void *)(offsetof(dnslookup_router_options_block, search_parents)) },
  35   { "srv_fail_domains",   opt_stringptr,
  36       (void *)(offsetof(dnslookup_router_options_block, srv_fail_domains)) },
  37   { "widen_domains",      opt_stringptr,
  38       (void *)(offsetof(dnslookup_router_options_block, widen_domains)) }
  39 };
  40
  41 /* Size of the options list. An extern variable has to be used so that its
  42 address can appear in the tables drtables.c. */
  43
  44 int dnslookup_router_options_count =
  45   sizeof(dnslookup_router_options)/sizeof(optionlist);
  46
  47
  48 #ifdef MACRO_PREDEF
  49
  50 /* Dummy entries */
  51 dnslookup_router_options_block dnslookup_router_option_defaults = {0};
  52 void dnslookup_router_init(router_instance *rblock) {}
  53 int dnslookup_router_entry(router_instance *rblock, address_item *addr,
  54   struct passwd *pw, int verify, address_item **addr_local,
  55   address_item **addr_remote, address_item **addr_new,
  56   address_item **addr_succeed) {return 0;}
  57
  58 #else   /*!MACRO_PREDEF*/
  59
  60
  61
  62
  63 /* Default private options block for the dnslookup router. */
  64
  65 dnslookup_router_options_block dnslookup_router_option_defaults = {
  66   FALSE,           /* check_secondary_mx */
  67   TRUE,            /* qualify_single */
  68   FALSE,           /* search_parents */
  69   TRUE,            /* rewrite_headers */
  70   NULL,            /* widen_domains */
  71   NULL,            /* mx_domains */
  72   NULL,            /* mx_fail_domains */
  73   NULL,            /* srv_fail_domains */
  74   NULL,            /* check_srv */
  75   NULL             /* fail_defer_domains */
  76 };
  77
  78
  79
  80 /*************************************************
  81 *          Initialization entry point            *
  82 *************************************************/
  83
  84 /* Called for each instance, after its options have been read, to enable
  85 consistency checks to be done, or anything else that needs to be set up. */
  86
  87 void
  88 dnslookup_router_init(router_instance *rblock)
  89 {
  90 /*
  91 dnslookup_router_options_block *ob =
  92   (dnslookup_router_options_block *)(rblock->options_block);
  93 */
  94 rblock = rblock;
  95 }
  96
  97
  98
  99 /*************************************************
 100 *              Main entry point                  *
 101 *************************************************/
 102
 103 /* See local README for interface details. This router returns:
 104
 105 DECLINE
 106   . the domain does not exist in the DNS
 107   . MX records point to non-existent hosts (including RHS = IP address)
 108   . a single SRV record has a host name of "." (=> no service)
 109   . syntactically invalid mail domain
 110   . check_secondary_mx set, and local host not in host list
 111
 112 DEFER
 113   . lookup defer for mx_domains
 114   . timeout etc on DNS lookup
 115   . verifying the errors address caused a deferment or a big disaster such
 116       as an expansion failure (rf_get_errors_address)
 117   . expanding a headers_{add,remove} string caused a deferment or another
 118       expansion error (rf_get_munge_headers)
 119   . a problem in rf_get_transport: no transport when one is needed;
 120       failed to expand dynamic transport; failed to find dynamic transport
 121   . failure to expand or find a uid/gid (rf_get_ugid via rf_queue_add)
 122   . self = "freeze", self = "defer"
 123
 124 PASS
 125   . timeout etc on DNS lookup and pass_on_timeout set
 126   . self = "pass"
 127
 128 REROUTED
 129   . routed to local host, but name was expanded by DNS lookup, so a
 130       re-routing should take place
 131   . self = "reroute"
 132
 133   In both cases the new address will have been set up as a child
 134
 135 FAIL
 136   . self = "fail"
 137
 138 OK
 139   added address to addr_local or addr_remote, as appropriate for the
 140   type of transport; this includes the self="send" case.
 141 */
 142
 143 int
 144 dnslookup_router_entry(
 145   router_instance *rblock,        /* data for this instantiation */
 146   address_item *addr,             /* address we are working on */
 147   struct passwd *pw,              /* passwd entry after check_local_user */
 148   int verify,                     /* v_none/v_recipient/v_sender/v_expn */
 149   address_item **addr_local,      /* add it to this if it's local */
 150   address_item **addr_remote,     /* add it to this if it's remote */
 151   address_item **addr_new,        /* put new addresses on here */
 152   address_item **addr_succeed)    /* put old address here on success */
 153 {
 154 host_item h;
 155 int rc;
 156 int widen_sep = 0;
 157 int whichrrs = HOST_FIND_BY_MX | HOST_FIND_BY_A;
 158 dnslookup_router_options_block *ob =
 159   (dnslookup_router_options_block *)(rblock->options_block);
 160 uschar *srv_service = NULL;
 161 uschar *widen = NULL;
 162 const uschar *pre_widen = addr->domain;
 163 const uschar *post_widen = NULL;
 164 const uschar *fully_qualified_name;
 165 const uschar *listptr;
 166 uschar widen_buffer[256];
 167
 168 addr_new = addr_new;          /* Keep picky compilers happy */
 169 addr_succeed = addr_succeed;
 170
 171 DEBUG(D_route)
 172   debug_printf("%s router called for %s\n  domain = %s\n",
 173     rblock->name, addr->address, addr->domain);
 174
 175 /* If an SRV check is required, expand the service name */
 176
 177 if (ob->check_srv)
 178   {
 179   if (  !(srv_service = expand_string(ob->check_srv))
 180      && !expand_string_forcedfail)
 181     {
 182     addr->message = string_sprintf("%s router: failed to expand \"%s\": %s",
 183       rblock->name, ob->check_srv, expand_string_message);
 184     return DEFER;
 185     }
 186   else whichrrs |= HOST_FIND_BY_SRV;
 187   }
 188
 189 /* Set up the first of any widening domains. The code further down copes with
 190 either pre- or post-widening, but at present there is no way to turn on
 191 pre-widening, as actually doing so seems like a rather bad idea, and nobody has
 192 requested it. Pre-widening would cause local abbreviated names to take
 193 precedence over global names. For example, if the domain is "xxx.ch" it might
 194 be something in the "ch" toplevel domain, but it also might be xxx.ch.xyz.com.
 195 The choice of pre- or post-widening affects which takes precedence. If ever
 196 somebody comes up with some kind of requirement for pre-widening, presumably
 197 with some conditions under which it is done, it can be selected here.
 198
 199 The rewrite_headers option works only when routing an address at transport
 200 time, because the alterations to the headers are not persistent so must be
 201 worked out immediately before they are used. Sender addresses are routed for
 202 verification purposes, but never at transport time, so any header changes that
 203 you might expect as a result of sender domain widening do not occur. Therefore
 204 we do not perform widening when verifying sender addresses; however, widening
 205 sender addresses is OK if we do not have to rewrite the headers. A corollary
 206 of this is that if the current address is not the original address, then it
 207 does not appear in the message header so it is also OK to widen. The
 208 suppression of widening for sender addresses is silent because it is the
 209 normal desirable behaviour. */
 210
 211 if (  ob->widen_domains
 212    && (verify != v_sender || !ob->rewrite_headers || addr->parent))
 213   {
 214   listptr = ob->widen_domains;
 215   widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
 216     sizeof(widen_buffer));
 217
 218 /****
 219   if (some condition requiring pre-widening)
 220     {
 221     post_widen = pre_widen;
 222     pre_widen = NULL;
 223     }
 224 ****/
 225   }
 226
 227 /* Loop to cope with explicit widening of domains as configured. This code
 228 copes with widening that may happen before or after the original name. The
 229 decision as to which is taken above. */
 230
 231 for (;;)
 232   {
 233   int flags = whichrrs;
 234   BOOL removed = FALSE;
 235
 236   if (pre_widen)
 237     {
 238     h.name = pre_widen;
 239     pre_widen = NULL;
 240     }
 241   else if (widen)
 242     {
 243     h.name = string_sprintf("%s.%s", addr->domain, widen);
 244     widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
 245       sizeof(widen_buffer));
 246     DEBUG(D_route) debug_printf("%s router widened %s to %s\n", rblock->name,
 247       addr->domain, h.name);
 248     }
 249   else if (post_widen)
 250     {
 251     h.name = post_widen;
 252     post_widen = NULL;
 253     DEBUG(D_route) debug_printf("%s router trying %s after widening failed\n",
 254       rblock->name, h.name);
 255     }
 256   else return DECLINE;
 257
 258   /* Set up the rest of the initial host item. Others may get chained on if
 259   there is more than one IP address. We set it up here instead of outside the
 260   loop so as to re-initialize if a previous try succeeded but was rejected
 261   because of not having an MX record. */
 262
 263   h.next = NULL;
 264   h.address = NULL;
 265   h.port = PORT_NONE;
 266   h.mx = MX_NONE;
 267   h.status = hstatus_unknown;
 268   h.why = hwhy_unknown;
 269   h.last_try = 0;
 270
 271   /* Unfortunately, we cannot set the mx_only option in advance, because the
 272   DNS lookup may extend an unqualified name. Therefore, we must do the test
 273   subsequently. We use the same logic as that for widen_domains above to avoid
 274   requesting a header rewrite that cannot work. */
 275
 276   if (verify != v_sender || !ob->rewrite_headers || addr->parent)
 277     {
 278     if (ob->qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
 279     if (ob->search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
 280     }
 281
 282   rc = host_find_bydns(&h, CUS rblock->ignore_target_hosts, flags, srv_service,
 283     ob->srv_fail_domains, ob->mx_fail_domains,
 284     &rblock->dnssec, &fully_qualified_name, &removed);
 285   if (removed) setflag(addr, af_local_host_removed);
 286
 287   /* If host found with only address records, test for the domain's being in
 288   the mx_domains list. Note that this applies also to SRV records; the name of
 289   the option is historical. */
 290
 291   if ((rc == HOST_FOUND || rc == HOST_FOUND_LOCAL) && h.mx < 0 &&
 292        ob->mx_domains)
 293     switch(match_isinlist(fully_qualified_name,
 294           CUSS &(ob->mx_domains), 0,
 295           &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
 296       {
 297       case DEFER:
 298       addr->message = US"lookup defer for mx_domains";
 299       return DEFER;
 300
 301       case OK:
 302       DEBUG(D_route) debug_printf("%s router rejected %s: no MX record(s)\n",
 303         rblock->name, fully_qualified_name);
 304       continue;
 305       }
 306
 307   /* Deferral returns forthwith, and anything other than failure breaks the
 308   loop. */
 309
 310   if (rc == HOST_FIND_SECURITY)
 311     {
 312     addr->message = US"host lookup done insecurely";
 313     return DEFER;
 314     }
 315   if (rc == HOST_FIND_AGAIN)
 316     {
 317     if (rblock->pass_on_timeout)
 318       {
 319       DEBUG(D_route) debug_printf("%s router timed out, and pass_on_timeout is set\n",
 320         rblock->name);
 321       return PASS;
 322       }
 323     addr->message = US"host lookup did not complete";
 324     return DEFER;
 325     }
 326
 327   if (rc != HOST_FIND_FAILED) break;
 328
 329   if (ob->fail_defer_domains)
 330     switch(match_isinlist(fully_qualified_name,
 331           CUSS &ob->fail_defer_domains, 0,
 332           &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
 333       {
 334       case DEFER:
 335         addr->message = US"lookup defer for fail_defer_domains option";
 336         return DEFER;
 337
 338       case OK:
 339         DEBUG(D_route) debug_printf("%s router: matched fail_defer_domains\n",
 340           rblock->name);
 341         addr->message = US"missing MX, or all MXs point to missing A records,"
 342           " and defer requested";
 343         return DEFER;
 344       }
 345   /* Check to see if the failure is the result of MX records pointing to
 346   non-existent domains, and if so, set an appropriate error message; the case
 347   of an MX or SRV record pointing to "." is another special case that we can
 348   detect. Otherwise "unknown mail domain" is used, which is confusing. Also, in
 349   this case don't do the widening. We need check only the first host to see if
 350   its MX has been filled in, but there is no address, because if there were any
 351   usable addresses returned, we would not have had HOST_FIND_FAILED.
 352
 353   As a common cause of this problem is MX records with IP addresses on the
 354   RHS, give a special message in this case. */
 355
 356   if (h.mx >= 0 && h.address == NULL)
 357     {
 358     setflag(addr, af_pass_message);   /* This is not a security risk */
 359     if (h.name[0] == 0)
 360       addr->message = US"an MX or SRV record indicated no SMTP service";
 361     else
 362       {
 363       addr->basic_errno = ERRNO_UNKNOWNHOST;
 364       addr->message = US"all relevant MX records point to non-existent hosts";
 365       if (!allow_mx_to_ip && string_is_ip_address(h.name, NULL) != 0)
 366         {
 367         addr->user_message =
 368           string_sprintf("It appears that the DNS operator for %s\n"
 369             "has installed an invalid MX record with an IP address\n"
 370             "instead of a domain name on the right hand side.", addr->domain);
 371         addr->message = string_sprintf("%s or (invalidly) to IP addresses",
 372           addr->message);
 373         }
 374       }
 375     return DECLINE;
 376     }
 377
 378   /* If there's a syntax error, do not continue with any widening, and note
 379   the error. */
 380
 381   if (host_find_failed_syntax)
 382     {
 383     addr->message = string_sprintf("mail domain \"%s\" is syntactically "
 384       "invalid", h.name);
 385     return DECLINE;
 386     }
 387   }
 388
 389 /* If the original domain name has been changed as a result of the host lookup,
 390 set up a child address for rerouting and request header rewrites if so
 391 configured. Then yield REROUTED. However, if the only change is a change of
 392 case in the domain name, which some resolvers yield (others don't), just change
 393 the domain name in the original address so that the official version is used in
 394 RCPT commands. */
 395
 396 if (Ustrcmp(addr->domain, fully_qualified_name) != 0)
 397   {
 398   if (strcmpic(addr->domain, fully_qualified_name) == 0)
 399     {
 400     uschar *at = Ustrrchr(addr->address, '@');
 401     memcpy(at+1, fully_qualified_name, Ustrlen(at+1));
 402     }
 403   else
 404     {
 405     rf_change_domain(addr, fully_qualified_name, ob->rewrite_headers, addr_new);
 406     return REROUTED;
 407     }
 408   }
 409
 410 /* If the yield is HOST_FOUND_LOCAL, the remote domain name either found MX
 411 records with the lowest numbered one pointing to a host with an IP address that
 412 is set on one of the interfaces of this machine, or found A records or got
 413 addresses from gethostbyname() that contain one for this machine. This can
 414 happen quite legitimately if the original name was a shortened form of a
 415 domain, but we will have picked that up already via the name change test above.
 416
 417 Otherwise, the action to be taken can be configured by the self option, the
 418 handling of which is in a separate function, as it is also required for other
 419 routers. */
 420
 421 if (rc == HOST_FOUND_LOCAL)
 422   {
 423   rc = rf_self_action(addr, &h, rblock->self_code, rblock->self_rewrite,
 424     rblock->self, addr_new);
 425   if (rc != OK) return rc;
 426   }
 427
 428 /* Otherwise, insist on being a secondary MX if so configured */
 429
 430 else if (ob->check_secondary_mx && !testflag(addr, af_local_host_removed))
 431   {
 432   DEBUG(D_route) debug_printf("check_secondary_mx set and local host not secondary\n");
 433   return DECLINE;
 434   }
 435
 436 /* Set up the errors address, if any. */
 437
 438 rc = rf_get_errors_address(addr, rblock, verify, &addr->prop.errors_address);
 439 if (rc != OK) return rc;
 440
 441 /* Set up the additional and removeable headers for this address. */
 442
 443 rc = rf_get_munge_headers(addr, rblock, &addr->prop.extra_headers,
 444   &addr->prop.remove_headers);
 445 if (rc != OK) return rc;
 446
 447 /* Get store in which to preserve the original host item, chained on
 448 to the address. */
 449
 450 addr->host_list = store_get(sizeof(host_item));
 451 addr->host_list[0] = h;
 452
 453 /* Fill in the transport and queue the address for delivery. */
 454
 455 if (!rf_get_transport(rblock->transport_name, &(rblock->transport),
 456       addr, rblock->name, NULL))
 457   return DEFER;
 458
 459 addr->transport = rblock->transport;
 460
 461 return rf_queue_add(addr, addr_local, addr_remote, rblock, pw)?
 462   OK : DEFER;
 463 }
 464
 465 #endif   /*!MACRO_PREDEF*/
 466 /* End of routers/dnslookup.c */
 467 /* vi: aw ai sw=2
 468 */