src/src/routers/dnslookup.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2009 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 #include "../exim.h"
   9 #include "rf_functions.h"
  10 #include "dnslookup.h"
  11
  12
  13
  14 /* Options specific to the dnslookup router. */
  15
  16 optionlist dnslookup_router_options[] = {
  17   { "check_secondary_mx", opt_bool,
  18       (void *)(offsetof(dnslookup_router_options_block, check_secondary_mx)) },
  19   { "check_srv",          opt_stringptr,
  20       (void *)(offsetof(dnslookup_router_options_block, check_srv)) },
  21   { "dnssec_request_domains",         opt_stringptr,
  22       (void *)(offsetof(dnslookup_router_options_block, dnssec_request_domains)) },
  23   { "dnssec_require_domains",         opt_stringptr,
  24       (void *)(offsetof(dnslookup_router_options_block, dnssec_require_domains)) },
  25   { "fail_defer_domains", opt_stringptr,
  26       (void *)(offsetof(dnslookup_router_options_block, fail_defer_domains)) },
  27   { "mx_domains",         opt_stringptr,
  28       (void *)(offsetof(dnslookup_router_options_block, mx_domains)) },
  29   { "mx_fail_domains",    opt_stringptr,
  30       (void *)(offsetof(dnslookup_router_options_block, mx_fail_domains)) },
  31   { "qualify_single",     opt_bool,
  32       (void *)(offsetof(dnslookup_router_options_block, qualify_single)) },
  33   { "rewrite_headers",    opt_bool,
  34       (void *)(offsetof(dnslookup_router_options_block, rewrite_headers)) },
  35   { "same_domain_copy_routing", opt_bool|opt_public,
  36       (void *)(offsetof(router_instance, same_domain_copy_routing)) },
  37   { "search_parents",     opt_bool,
  38       (void *)(offsetof(dnslookup_router_options_block, search_parents)) },
  39   { "srv_fail_domains",   opt_stringptr,
  40       (void *)(offsetof(dnslookup_router_options_block, srv_fail_domains)) },
  41   { "widen_domains",      opt_stringptr,
  42       (void *)(offsetof(dnslookup_router_options_block, widen_domains)) }
  43 };
  44
  45 /* Size of the options list. An extern variable has to be used so that its
  46 address can appear in the tables drtables.c. */
  47
  48 int dnslookup_router_options_count =
  49   sizeof(dnslookup_router_options)/sizeof(optionlist);
  50
  51 /* Default private options block for the dnslookup router. */
  52
  53 dnslookup_router_options_block dnslookup_router_option_defaults = {
  54   FALSE,           /* check_secondary_mx */
  55   TRUE,            /* qualify_single */
  56   FALSE,           /* search_parents */
  57   TRUE,            /* rewrite_headers */
  58   NULL,            /* widen_domains */
  59   NULL,            /* mx_domains */
  60   NULL,            /* mx_fail_domains */
  61   NULL,            /* srv_fail_domains */
  62   NULL,            /* check_srv */
  63   NULL,            /* dnssec_request_domains */
  64   NULL,            /* dnssec_require_domains */
  65   NULL             /* fail_defer_domains */
  66 };
  67
  68
  69
  70 /*************************************************
  71 *          Initialization entry point            *
  72 *************************************************/
  73
  74 /* Called for each instance, after its options have been read, to enable
  75 consistency checks to be done, or anything else that needs to be set up. */
  76
  77 void
  78 dnslookup_router_init(router_instance *rblock)
  79 {
  80 /*
  81 dnslookup_router_options_block *ob =
  82   (dnslookup_router_options_block *)(rblock->options_block);
  83 */
  84 rblock = rblock;
  85 }
  86
  87
  88
  89 /*************************************************
  90 *              Main entry point                  *
  91 *************************************************/
  92
  93 /* See local README for interface details. This router returns:
  94
  95 DECLINE
  96   . the domain does not exist in the DNS
  97   . MX records point to non-existent hosts (including RHS = IP address)
  98   . a single SRV record has a host name of "." (=> no service)
  99   . syntactically invalid mail domain
 100   . check_secondary_mx set, and local host not in host list
 101
 102 DEFER
 103   . lookup defer for mx_domains
 104   . timeout etc on DNS lookup
 105   . verifying the errors address caused a deferment or a big disaster such
 106       as an expansion failure (rf_get_errors_address)
 107   . expanding a headers_{add,remove} string caused a deferment or another
 108       expansion error (rf_get_munge_headers)
 109   . a problem in rf_get_transport: no transport when one is needed;
 110       failed to expand dynamic transport; failed to find dynamic transport
 111   . failure to expand or find a uid/gid (rf_get_ugid via rf_queue_add)
 112   . self = "freeze", self = "defer"
 113
 114 PASS
 115   . timeout etc on DNS lookup and pass_on_timeout set
 116   . self = "pass"
 117
 118 REROUTED
 119   . routed to local host, but name was expanded by DNS lookup, so a
 120       re-routing should take place
 121   . self = "reroute"
 122
 123   In both cases the new address will have been set up as a child
 124
 125 FAIL
 126   . self = "fail"
 127
 128 OK
 129   added address to addr_local or addr_remote, as appropriate for the
 130   type of transport; this includes the self="send" case.
 131 */
 132
 133 int
 134 dnslookup_router_entry(
 135   router_instance *rblock,        /* data for this instantiation */
 136   address_item *addr,             /* address we are working on */
 137   struct passwd *pw,              /* passwd entry after check_local_user */
 138   int verify,                     /* v_none/v_recipient/v_sender/v_expn */
 139   address_item **addr_local,      /* add it to this if it's local */
 140   address_item **addr_remote,     /* add it to this if it's remote */
 141   address_item **addr_new,        /* put new addresses on here */
 142   address_item **addr_succeed)    /* put old address here on success */
 143 {
 144 host_item h;
 145 int rc;
 146 int widen_sep = 0;
 147 int whichrrs = HOST_FIND_BY_MX | HOST_FIND_BY_A;
 148 dnslookup_router_options_block *ob =
 149   (dnslookup_router_options_block *)(rblock->options_block);
 150 uschar *srv_service = NULL;
 151 uschar *widen = NULL;
 152 const uschar *pre_widen = addr->domain;
 153 const uschar *post_widen = NULL;
 154 const uschar *fully_qualified_name;
 155 const uschar *listptr;
 156 uschar widen_buffer[256];
 157
 158 addr_new = addr_new;          /* Keep picky compilers happy */
 159 addr_succeed = addr_succeed;
 160
 161 DEBUG(D_route)
 162   debug_printf("%s router called for %s\n  domain = %s\n",
 163     rblock->name, addr->address, addr->domain);
 164
 165 /* If an SRV check is required, expand the service name */
 166
 167 if (ob->check_srv)
 168   {
 169   if (  !(srv_service = expand_string(ob->check_srv))
 170      && !expand_string_forcedfail)
 171     {
 172     addr->message = string_sprintf("%s router: failed to expand \"%s\": %s",
 173       rblock->name, ob->check_srv, expand_string_message);
 174     return DEFER;
 175     }
 176   else whichrrs |= HOST_FIND_BY_SRV;
 177   }
 178
 179 /* Set up the first of any widening domains. The code further down copes with
 180 either pre- or post-widening, but at present there is no way to turn on
 181 pre-widening, as actually doing so seems like a rather bad idea, and nobody has
 182 requested it. Pre-widening would cause local abbreviated names to take
 183 precedence over global names. For example, if the domain is "xxx.ch" it might
 184 be something in the "ch" toplevel domain, but it also might be xxx.ch.xyz.com.
 185 The choice of pre- or post-widening affects which takes precedence. If ever
 186 somebody comes up with some kind of requirement for pre-widening, presumably
 187 with some conditions under which it is done, it can be selected here.
 188
 189 The rewrite_headers option works only when routing an address at transport
 190 time, because the alterations to the headers are not persistent so must be
 191 worked out immediately before they are used. Sender addresses are routed for
 192 verification purposes, but never at transport time, so any header changes that
 193 you might expect as a result of sender domain widening do not occur. Therefore
 194 we do not perform widening when verifying sender addresses; however, widening
 195 sender addresses is OK if we do not have to rewrite the headers. A corollary
 196 of this is that if the current address is not the original address, then it
 197 does not appear in the message header so it is also OK to widen. The
 198 suppression of widening for sender addresses is silent because it is the
 199 normal desirable behaviour. */
 200
 201 if (  ob->widen_domains
 202    && (verify != v_sender || !ob->rewrite_headers || addr->parent))
 203   {
 204   listptr = ob->widen_domains;
 205   widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
 206     sizeof(widen_buffer));
 207
 208 /****
 209   if (some condition requiring pre-widening)
 210     {
 211     post_widen = pre_widen;
 212     pre_widen = NULL;
 213     }
 214 ****/
 215   }
 216
 217 /* Loop to cope with explicit widening of domains as configured. This code
 218 copes with widening that may happen before or after the original name. The
 219 decision as to which is taken above. */
 220
 221 for (;;)
 222   {
 223   int flags = whichrrs;
 224   BOOL removed = FALSE;
 225
 226   if (pre_widen)
 227     {
 228     h.name = pre_widen;
 229     pre_widen = NULL;
 230     }
 231   else if (widen)
 232     {
 233     h.name = string_sprintf("%s.%s", addr->domain, widen);
 234     widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
 235       sizeof(widen_buffer));
 236     DEBUG(D_route) debug_printf("%s router widened %s to %s\n", rblock->name,
 237       addr->domain, h.name);
 238     }
 239   else if (post_widen)
 240     {
 241     h.name = post_widen;
 242     post_widen = NULL;
 243     DEBUG(D_route) debug_printf("%s router trying %s after widening failed\n",
 244       rblock->name, h.name);
 245     }
 246   else return DECLINE;
 247
 248   /* Set up the rest of the initial host item. Others may get chained on if
 249   there is more than one IP address. We set it up here instead of outside the
 250   loop so as to re-initialize if a previous try succeeded but was rejected
 251   because of not having an MX record. */
 252
 253   h.next = NULL;
 254   h.address = NULL;
 255   h.port = PORT_NONE;
 256   h.mx = MX_NONE;
 257   h.status = hstatus_unknown;
 258   h.why = hwhy_unknown;
 259   h.last_try = 0;
 260
 261   /* Unfortunately, we cannot set the mx_only option in advance, because the
 262   DNS lookup may extend an unqualified name. Therefore, we must do the test
 263   subsequently. We use the same logic as that for widen_domains above to avoid
 264   requesting a header rewrite that cannot work. */
 265
 266   if (verify != v_sender || !ob->rewrite_headers || addr->parent)
 267     {
 268     if (ob->qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
 269     if (ob->search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
 270     }
 271
 272   rc = host_find_bydns(&h, CUS rblock->ignore_target_hosts, flags, srv_service,
 273     ob->srv_fail_domains, ob->mx_fail_domains,
 274     ob->dnssec_request_domains, ob->dnssec_require_domains,
 275     &fully_qualified_name, &removed);
 276   if (removed) setflag(addr, af_local_host_removed);
 277
 278   /* If host found with only address records, test for the domain's being in
 279   the mx_domains list. Note that this applies also to SRV records; the name of
 280   the option is historical. */
 281
 282   if ((rc == HOST_FOUND || rc == HOST_FOUND_LOCAL) && h.mx < 0 &&
 283        ob->mx_domains)
 284     switch(match_isinlist(fully_qualified_name,
 285           CUSS &(ob->mx_domains), 0,
 286           &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
 287       {
 288       case DEFER:
 289       addr->message = US"lookup defer for mx_domains";
 290       return DEFER;
 291
 292       case OK:
 293       DEBUG(D_route) debug_printf("%s router rejected %s: no MX record(s)\n",
 294         rblock->name, fully_qualified_name);
 295       continue;
 296       }
 297
 298   /* Deferral returns forthwith, and anything other than failure breaks the
 299   loop. */
 300
 301   if (rc == HOST_FIND_AGAIN)
 302     {
 303     if (rblock->pass_on_timeout)
 304       {
 305       DEBUG(D_route) debug_printf("%s router timed out, and pass_on_timeout is set\n",
 306         rblock->name);
 307       return PASS;
 308       }
 309     addr->message = US"host lookup did not complete";
 310     return DEFER;
 311     }
 312
 313   if (rc != HOST_FIND_FAILED) break;
 314
 315   /* Check to see if the failure is the result of MX records pointing to
 316   non-existent domains, and if so, set an appropriate error message; the case
 317   of an MX or SRV record pointing to "." is another special case that we can
 318   detect. Otherwise "unknown mail domain" is used, which is confusing. Also, in
 319   this case don't do the widening. We need check only the first host to see if
 320   its MX has been filled in, but there is no address, because if there were any
 321   usable addresses returned, we would not have had HOST_FIND_FAILED.
 322
 323   As a common cause of this problem is MX records with IP addresses on the
 324   RHS, give a special message in this case. */
 325
 326   if (h.mx >= 0 && h.address == NULL)
 327     {
 328     setflag(addr, af_pass_message);   /* This is not a security risk */
 329     if (h.name[0] == 0)
 330       addr->message = US"an MX or SRV record indicated no SMTP service";
 331     else
 332       {
 333       addr->basic_errno = ERRNO_UNKNOWNHOST;
 334       addr->message = US"all relevant MX records point to non-existent hosts";
 335       if (!allow_mx_to_ip && string_is_ip_address(h.name, NULL) != 0)
 336         {
 337         addr->user_message =
 338           string_sprintf("It appears that the DNS operator for %s\n"
 339             "has installed an invalid MX record with an IP address\n"
 340             "instead of a domain name on the right hand side.", addr->domain);
 341         addr->message = string_sprintf("%s or (invalidly) to IP addresses",
 342           addr->message);
 343         }
 344       }
 345     if (ob->fail_defer_domains)
 346       {
 347       switch(match_isinlist(fully_qualified_name,
 348             CUSS &ob->fail_defer_domains, 0,
 349             &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
 350         {
 351         case DEFER:
 352           addr->message = US"lookup defer for fail_defer_domains";
 353           return DEFER;
 354
 355         case OK:
 356           DEBUG(D_route) debug_printf("%s router: matched fail_defer_domains\n",
 357             rblock->name);
 358           return DEFER;
 359         }
 360       }
 361     return DECLINE;
 362     }
 363
 364   /* If there's a syntax error, do not continue with any widening, and note
 365   the error. */
 366
 367   if (host_find_failed_syntax)
 368     {
 369     addr->message = string_sprintf("mail domain \"%s\" is syntactically "
 370       "invalid", h.name);
 371     return DECLINE;
 372     }
 373   }
 374
 375 /* If the original domain name has been changed as a result of the host lookup,
 376 set up a child address for rerouting and request header rewrites if so
 377 configured. Then yield REROUTED. However, if the only change is a change of
 378 case in the domain name, which some resolvers yield (others don't), just change
 379 the domain name in the original address so that the official version is used in
 380 RCPT commands. */
 381
 382 if (Ustrcmp(addr->domain, fully_qualified_name) != 0)
 383   {
 384   if (strcmpic(addr->domain, fully_qualified_name) == 0)
 385     {
 386     uschar *at = Ustrrchr(addr->address, '@');
 387     memcpy(at+1, fully_qualified_name, Ustrlen(at+1));
 388     }
 389   else
 390     {
 391     rf_change_domain(addr, fully_qualified_name, ob->rewrite_headers, addr_new);
 392     return REROUTED;
 393     }
 394   }
 395
 396 /* If the yield is HOST_FOUND_LOCAL, the remote domain name either found MX
 397 records with the lowest numbered one pointing to a host with an IP address that
 398 is set on one of the interfaces of this machine, or found A records or got
 399 addresses from gethostbyname() that contain one for this machine. This can
 400 happen quite legitimately if the original name was a shortened form of a
 401 domain, but we will have picked that up already via the name change test above.
 402
 403 Otherwise, the action to be taken can be configured by the self option, the
 404 handling of which is in a separate function, as it is also required for other
 405 routers. */
 406
 407 if (rc == HOST_FOUND_LOCAL)
 408   {
 409   rc = rf_self_action(addr, &h, rblock->self_code, rblock->self_rewrite,
 410     rblock->self, addr_new);
 411   if (rc != OK) return rc;
 412   }
 413
 414 /* Otherwise, insist on being a secondary MX if so configured */
 415
 416 else if (ob->check_secondary_mx && !testflag(addr, af_local_host_removed))
 417   {
 418   DEBUG(D_route) debug_printf("check_secondary_mx set and local host not secondary\n");
 419   return DECLINE;
 420   }
 421
 422 /* Set up the errors address, if any. */
 423
 424 rc = rf_get_errors_address(addr, rblock, verify, &(addr->p.errors_address));
 425 if (rc != OK) return rc;
 426
 427 /* Set up the additional and removeable headers for this address. */
 428
 429 rc = rf_get_munge_headers(addr, rblock, &(addr->p.extra_headers),
 430   &(addr->p.remove_headers));
 431 if (rc != OK) return rc;
 432
 433 /* Get store in which to preserve the original host item, chained on
 434 to the address. */
 435
 436 addr->host_list = store_get(sizeof(host_item));
 437 addr->host_list[0] = h;
 438
 439 /* Fill in the transport and queue the address for delivery. */
 440
 441 if (!rf_get_transport(rblock->transport_name, &(rblock->transport),
 442       addr, rblock->name, NULL))
 443   return DEFER;
 444
 445 addr->transport = rblock->transport;
 446
 447 return rf_queue_add(addr, addr_local, addr_remote, rblock, pw)?
 448   OK : DEFER;
 449 }
 450
 451 /* End of routers/dnslookup.c */
 452 /* vi: aw ai sw=2
 453 */