tidying
[exim.git] / src / src / routers / dnslookup.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2015 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 #include "../exim.h"
9 #include "rf_functions.h"
10 #include "dnslookup.h"
11
12
13
14 /* Options specific to the dnslookup router. */
15
16 optionlist dnslookup_router_options[] = {
17 { "check_secondary_mx", opt_bool,
18 (void *)(offsetof(dnslookup_router_options_block, check_secondary_mx)) },
19 { "check_srv", opt_stringptr,
20 (void *)(offsetof(dnslookup_router_options_block, check_srv)) },
21 { "fail_defer_domains", opt_stringptr,
22 (void *)(offsetof(dnslookup_router_options_block, fail_defer_domains)) },
23 { "mx_domains", opt_stringptr,
24 (void *)(offsetof(dnslookup_router_options_block, mx_domains)) },
25 { "mx_fail_domains", opt_stringptr,
26 (void *)(offsetof(dnslookup_router_options_block, mx_fail_domains)) },
27 { "qualify_single", opt_bool,
28 (void *)(offsetof(dnslookup_router_options_block, qualify_single)) },
29 { "rewrite_headers", opt_bool,
30 (void *)(offsetof(dnslookup_router_options_block, rewrite_headers)) },
31 { "same_domain_copy_routing", opt_bool|opt_public,
32 (void *)(offsetof(router_instance, same_domain_copy_routing)) },
33 { "search_parents", opt_bool,
34 (void *)(offsetof(dnslookup_router_options_block, search_parents)) },
35 { "srv_fail_domains", opt_stringptr,
36 (void *)(offsetof(dnslookup_router_options_block, srv_fail_domains)) },
37 { "widen_domains", opt_stringptr,
38 (void *)(offsetof(dnslookup_router_options_block, widen_domains)) }
39 };
40
41 /* Size of the options list. An extern variable has to be used so that its
42 address can appear in the tables drtables.c. */
43
44 int dnslookup_router_options_count =
45 sizeof(dnslookup_router_options)/sizeof(optionlist);
46
47
48 #ifdef MACRO_PREDEF
49
50 /* Dummy entries */
51 dnslookup_router_options_block dnslookup_router_option_defaults = {0};
52 void dnslookup_router_init(router_instance *rblock) {}
53 int dnslookup_router_entry(router_instance *rblock, address_item *addr,
54 struct passwd *pw, int verify, address_item **addr_local,
55 address_item **addr_remote, address_item **addr_new,
56 address_item **addr_succeed) {return 0;}
57
58 #else /*!MACRO_PREDEF*/
59
60
61
62
63 /* Default private options block for the dnslookup router. */
64
65 dnslookup_router_options_block dnslookup_router_option_defaults = {
66 FALSE, /* check_secondary_mx */
67 TRUE, /* qualify_single */
68 FALSE, /* search_parents */
69 TRUE, /* rewrite_headers */
70 NULL, /* widen_domains */
71 NULL, /* mx_domains */
72 NULL, /* mx_fail_domains */
73 NULL, /* srv_fail_domains */
74 NULL, /* check_srv */
75 NULL /* fail_defer_domains */
76 };
77
78
79
80 /*************************************************
81 * Initialization entry point *
82 *************************************************/
83
84 /* Called for each instance, after its options have been read, to enable
85 consistency checks to be done, or anything else that needs to be set up. */
86
87 void
88 dnslookup_router_init(router_instance *rblock)
89 {
90 /*
91 dnslookup_router_options_block *ob =
92 (dnslookup_router_options_block *)(rblock->options_block);
93 */
94 rblock = rblock;
95 }
96
97
98
99 /*************************************************
100 * Main entry point *
101 *************************************************/
102
103 /* See local README for interface details. This router returns:
104
105 DECLINE
106 . the domain does not exist in the DNS
107 . MX records point to non-existent hosts (including RHS = IP address)
108 . a single SRV record has a host name of "." (=> no service)
109 . syntactically invalid mail domain
110 . check_secondary_mx set, and local host not in host list
111
112 DEFER
113 . lookup defer for mx_domains
114 . timeout etc on DNS lookup
115 . verifying the errors address caused a deferment or a big disaster such
116 as an expansion failure (rf_get_errors_address)
117 . expanding a headers_{add,remove} string caused a deferment or another
118 expansion error (rf_get_munge_headers)
119 . a problem in rf_get_transport: no transport when one is needed;
120 failed to expand dynamic transport; failed to find dynamic transport
121 . failure to expand or find a uid/gid (rf_get_ugid via rf_queue_add)
122 . self = "freeze", self = "defer"
123
124 PASS
125 . timeout etc on DNS lookup and pass_on_timeout set
126 . self = "pass"
127
128 REROUTED
129 . routed to local host, but name was expanded by DNS lookup, so a
130 re-routing should take place
131 . self = "reroute"
132
133 In both cases the new address will have been set up as a child
134
135 FAIL
136 . self = "fail"
137
138 OK
139 added address to addr_local or addr_remote, as appropriate for the
140 type of transport; this includes the self="send" case.
141 */
142
143 int
144 dnslookup_router_entry(
145 router_instance *rblock, /* data for this instantiation */
146 address_item *addr, /* address we are working on */
147 struct passwd *pw, /* passwd entry after check_local_user */
148 int verify, /* v_none/v_recipient/v_sender/v_expn */
149 address_item **addr_local, /* add it to this if it's local */
150 address_item **addr_remote, /* add it to this if it's remote */
151 address_item **addr_new, /* put new addresses on here */
152 address_item **addr_succeed) /* put old address here on success */
153 {
154 host_item h;
155 int rc;
156 int widen_sep = 0;
157 int whichrrs = HOST_FIND_BY_MX | HOST_FIND_BY_A;
158 dnslookup_router_options_block *ob =
159 (dnslookup_router_options_block *)(rblock->options_block);
160 uschar *srv_service = NULL;
161 uschar *widen = NULL;
162 const uschar *pre_widen = addr->domain;
163 const uschar *post_widen = NULL;
164 const uschar *fully_qualified_name;
165 const uschar *listptr;
166 uschar widen_buffer[256];
167
168 addr_new = addr_new; /* Keep picky compilers happy */
169 addr_succeed = addr_succeed;
170
171 DEBUG(D_route)
172 debug_printf("%s router called for %s\n domain = %s\n",
173 rblock->name, addr->address, addr->domain);
174
175 /* If an SRV check is required, expand the service name */
176
177 if (ob->check_srv)
178 {
179 if ( !(srv_service = expand_string(ob->check_srv))
180 && !expand_string_forcedfail)
181 {
182 addr->message = string_sprintf("%s router: failed to expand \"%s\": %s",
183 rblock->name, ob->check_srv, expand_string_message);
184 return DEFER;
185 }
186 else whichrrs |= HOST_FIND_BY_SRV;
187 }
188
189 /* Set up the first of any widening domains. The code further down copes with
190 either pre- or post-widening, but at present there is no way to turn on
191 pre-widening, as actually doing so seems like a rather bad idea, and nobody has
192 requested it. Pre-widening would cause local abbreviated names to take
193 precedence over global names. For example, if the domain is "xxx.ch" it might
194 be something in the "ch" toplevel domain, but it also might be xxx.ch.xyz.com.
195 The choice of pre- or post-widening affects which takes precedence. If ever
196 somebody comes up with some kind of requirement for pre-widening, presumably
197 with some conditions under which it is done, it can be selected here.
198
199 The rewrite_headers option works only when routing an address at transport
200 time, because the alterations to the headers are not persistent so must be
201 worked out immediately before they are used. Sender addresses are routed for
202 verification purposes, but never at transport time, so any header changes that
203 you might expect as a result of sender domain widening do not occur. Therefore
204 we do not perform widening when verifying sender addresses; however, widening
205 sender addresses is OK if we do not have to rewrite the headers. A corollary
206 of this is that if the current address is not the original address, then it
207 does not appear in the message header so it is also OK to widen. The
208 suppression of widening for sender addresses is silent because it is the
209 normal desirable behaviour. */
210
211 if ( ob->widen_domains
212 && (verify != v_sender || !ob->rewrite_headers || addr->parent))
213 {
214 listptr = ob->widen_domains;
215 widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
216 sizeof(widen_buffer));
217
218 /****
219 if (some condition requiring pre-widening)
220 {
221 post_widen = pre_widen;
222 pre_widen = NULL;
223 }
224 ****/
225 }
226
227 /* Loop to cope with explicit widening of domains as configured. This code
228 copes with widening that may happen before or after the original name. The
229 decision as to which is taken above. */
230
231 for (;;)
232 {
233 int flags = whichrrs;
234 BOOL removed = FALSE;
235
236 if (pre_widen)
237 {
238 h.name = pre_widen;
239 pre_widen = NULL;
240 }
241 else if (widen)
242 {
243 h.name = string_sprintf("%s.%s", addr->domain, widen);
244 widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
245 sizeof(widen_buffer));
246 DEBUG(D_route) debug_printf("%s router widened %s to %s\n", rblock->name,
247 addr->domain, h.name);
248 }
249 else if (post_widen)
250 {
251 h.name = post_widen;
252 post_widen = NULL;
253 DEBUG(D_route) debug_printf("%s router trying %s after widening failed\n",
254 rblock->name, h.name);
255 }
256 else return DECLINE;
257
258 /* Set up the rest of the initial host item. Others may get chained on if
259 there is more than one IP address. We set it up here instead of outside the
260 loop so as to re-initialize if a previous try succeeded but was rejected
261 because of not having an MX record. */
262
263 h.next = NULL;
264 h.address = NULL;
265 h.port = PORT_NONE;
266 h.mx = MX_NONE;
267 h.status = hstatus_unknown;
268 h.why = hwhy_unknown;
269 h.last_try = 0;
270
271 /* Unfortunately, we cannot set the mx_only option in advance, because the
272 DNS lookup may extend an unqualified name. Therefore, we must do the test
273 subsequently. We use the same logic as that for widen_domains above to avoid
274 requesting a header rewrite that cannot work. */
275
276 if (verify != v_sender || !ob->rewrite_headers || addr->parent)
277 {
278 if (ob->qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
279 if (ob->search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
280 }
281
282 rc = host_find_bydns(&h, CUS rblock->ignore_target_hosts, flags, srv_service,
283 ob->srv_fail_domains, ob->mx_fail_domains,
284 &rblock->dnssec, &fully_qualified_name, &removed);
285 if (removed) setflag(addr, af_local_host_removed);
286
287 /* If host found with only address records, test for the domain's being in
288 the mx_domains list. Note that this applies also to SRV records; the name of
289 the option is historical. */
290
291 if ((rc == HOST_FOUND || rc == HOST_FOUND_LOCAL) && h.mx < 0 &&
292 ob->mx_domains)
293 switch(match_isinlist(fully_qualified_name,
294 CUSS &(ob->mx_domains), 0,
295 &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
296 {
297 case DEFER:
298 addr->message = US"lookup defer for mx_domains";
299 return DEFER;
300
301 case OK:
302 DEBUG(D_route) debug_printf("%s router rejected %s: no MX record(s)\n",
303 rblock->name, fully_qualified_name);
304 continue;
305 }
306
307 /* Deferral returns forthwith, and anything other than failure breaks the
308 loop. */
309
310 if (rc == HOST_FIND_SECURITY)
311 {
312 addr->message = US"host lookup done insecurely";
313 return DEFER;
314 }
315 if (rc == HOST_FIND_AGAIN)
316 {
317 if (rblock->pass_on_timeout)
318 {
319 DEBUG(D_route) debug_printf("%s router timed out, and pass_on_timeout is set\n",
320 rblock->name);
321 return PASS;
322 }
323 addr->message = US"host lookup did not complete";
324 return DEFER;
325 }
326
327 if (rc != HOST_FIND_FAILED) break;
328
329 if (ob->fail_defer_domains)
330 switch(match_isinlist(fully_qualified_name,
331 CUSS &ob->fail_defer_domains, 0,
332 &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
333 {
334 case DEFER:
335 addr->message = US"lookup defer for fail_defer_domains option";
336 return DEFER;
337
338 case OK:
339 DEBUG(D_route) debug_printf("%s router: matched fail_defer_domains\n",
340 rblock->name);
341 addr->message = US"missing MX, or all MXs point to missing A records,"
342 " and defer requested";
343 return DEFER;
344 }
345 /* Check to see if the failure is the result of MX records pointing to
346 non-existent domains, and if so, set an appropriate error message; the case
347 of an MX or SRV record pointing to "." is another special case that we can
348 detect. Otherwise "unknown mail domain" is used, which is confusing. Also, in
349 this case don't do the widening. We need check only the first host to see if
350 its MX has been filled in, but there is no address, because if there were any
351 usable addresses returned, we would not have had HOST_FIND_FAILED.
352
353 As a common cause of this problem is MX records with IP addresses on the
354 RHS, give a special message in this case. */
355
356 if (h.mx >= 0 && h.address == NULL)
357 {
358 setflag(addr, af_pass_message); /* This is not a security risk */
359 if (h.name[0] == 0)
360 addr->message = US"an MX or SRV record indicated no SMTP service";
361 else
362 {
363 addr->basic_errno = ERRNO_UNKNOWNHOST;
364 addr->message = US"all relevant MX records point to non-existent hosts";
365 if (!allow_mx_to_ip && string_is_ip_address(h.name, NULL) != 0)
366 {
367 addr->user_message =
368 string_sprintf("It appears that the DNS operator for %s\n"
369 "has installed an invalid MX record with an IP address\n"
370 "instead of a domain name on the right hand side.", addr->domain);
371 addr->message = string_sprintf("%s or (invalidly) to IP addresses",
372 addr->message);
373 }
374 }
375 return DECLINE;
376 }
377
378 /* If there's a syntax error, do not continue with any widening, and note
379 the error. */
380
381 if (host_find_failed_syntax)
382 {
383 addr->message = string_sprintf("mail domain \"%s\" is syntactically "
384 "invalid", h.name);
385 return DECLINE;
386 }
387 }
388
389 /* If the original domain name has been changed as a result of the host lookup,
390 set up a child address for rerouting and request header rewrites if so
391 configured. Then yield REROUTED. However, if the only change is a change of
392 case in the domain name, which some resolvers yield (others don't), just change
393 the domain name in the original address so that the official version is used in
394 RCPT commands. */
395
396 if (Ustrcmp(addr->domain, fully_qualified_name) != 0)
397 {
398 if (strcmpic(addr->domain, fully_qualified_name) == 0)
399 {
400 uschar *at = Ustrrchr(addr->address, '@');
401 memcpy(at+1, fully_qualified_name, Ustrlen(at+1));
402 }
403 else
404 {
405 rf_change_domain(addr, fully_qualified_name, ob->rewrite_headers, addr_new);
406 return REROUTED;
407 }
408 }
409
410 /* If the yield is HOST_FOUND_LOCAL, the remote domain name either found MX
411 records with the lowest numbered one pointing to a host with an IP address that
412 is set on one of the interfaces of this machine, or found A records or got
413 addresses from gethostbyname() that contain one for this machine. This can
414 happen quite legitimately if the original name was a shortened form of a
415 domain, but we will have picked that up already via the name change test above.
416
417 Otherwise, the action to be taken can be configured by the self option, the
418 handling of which is in a separate function, as it is also required for other
419 routers. */
420
421 if (rc == HOST_FOUND_LOCAL)
422 {
423 rc = rf_self_action(addr, &h, rblock->self_code, rblock->self_rewrite,
424 rblock->self, addr_new);
425 if (rc != OK) return rc;
426 }
427
428 /* Otherwise, insist on being a secondary MX if so configured */
429
430 else if (ob->check_secondary_mx && !testflag(addr, af_local_host_removed))
431 {
432 DEBUG(D_route) debug_printf("check_secondary_mx set and local host not secondary\n");
433 return DECLINE;
434 }
435
436 /* Set up the errors address, if any. */
437
438 rc = rf_get_errors_address(addr, rblock, verify, &addr->prop.errors_address);
439 if (rc != OK) return rc;
440
441 /* Set up the additional and removeable headers for this address. */
442
443 rc = rf_get_munge_headers(addr, rblock, &addr->prop.extra_headers,
444 &addr->prop.remove_headers);
445 if (rc != OK) return rc;
446
447 /* Get store in which to preserve the original host item, chained on
448 to the address. */
449
450 addr->host_list = store_get(sizeof(host_item));
451 addr->host_list[0] = h;
452
453 /* Fill in the transport and queue the address for delivery. */
454
455 if (!rf_get_transport(rblock->transport_name, &(rblock->transport),
456 addr, rblock->name, NULL))
457 return DEFER;
458
459 addr->transport = rblock->transport;
460
461 return rf_queue_add(addr, addr_local, addr_remote, rblock, pw)?
462 OK : DEFER;
463 }
464
465 #endif /*!MACRO_PREDEF*/
466 /* End of routers/dnslookup.c */
467 /* vi: aw ai sw=2
468 */