1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Functions for interfacing with the DNS. */
13 /*************************************************
15 *************************************************/
17 /* This function is called instead of res_search() when Exim is running in its
18 test harness. It recognizes some special domain names, and uses them to force
19 failure and retry responses (optionally with a delay). Otherwise, it calls an
20 external utility that mocks-up a nameserver, if it can find the utility.
21 If not, it passes its arguments on to res_search(). The fake nameserver may
22 also return a code specifying that the name should be passed on.
24 Background: the original test suite required a real nameserver to carry the
25 test zones, whereas the new test suite has the fake server for portability. This
29 domain the domain name
30 type the DNS record type
31 answerptr where to put the answer
32 size size of the answer area
34 Returns: length of returned data, or -1 on error (h_errno set)
38 fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
40 int len = Ustrlen(domain);
41 int asize = size; /* Locally modified */
44 uschar *aptr = answerptr; /* Locally modified */
47 /* Remove terminating dot. */
49 if (domain[len - 1] == '.') len--;
50 name = string_copyn(domain, len);
52 /* Look for the fakens utility, and if it exists, call it. */
54 (void)string_format(utilname, sizeof(utilname), "%s/bin/fakens",
55 config_main_directory);
57 if (stat(CS utilname, &statbuf) >= 0)
63 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n",
64 name, dns_text_type(type));
67 argv[1] = config_main_directory;
69 argv[3] = dns_text_type(type);
72 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE, US"fakens-search");
74 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
79 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
82 aptr += rc; /* Don't modify the actual arguments, because they */
83 asize -= rc; /* may need to be passed on to res_search(). */
86 /* If we ran out of output buffer before exhausting the return,
87 carry on reading and counting it. */
90 while ((rc = read(outfd, name, sizeof(name))) > 0)
94 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
97 switch(child_close(pid, 0))
100 case 1: h_errno = HOST_NOT_FOUND; return -1;
101 case 2: h_errno = TRY_AGAIN; return -1;
103 case 3: h_errno = NO_RECOVERY; return -1;
104 case 4: h_errno = NO_DATA; return -1;
105 case 5: /* Pass on to res_search() */
106 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
111 DEBUG(D_dns) debug_printf("fakens (%s) not found\n", utilname);
114 /* fakens utility not found, or it returned "pass on" */
116 DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
118 return res_search(CS domain, C_IN, type, answerptr, size);
123 /*************************************************
124 * Initialize and configure resolver *
125 *************************************************/
127 /* Initialize the resolver and the storage for holding DNS answers if this is
128 the first time we have been here, and set the resolver options.
131 qualify_single TRUE to set the RES_DEFNAMES option
132 search_parents TRUE to set the RES_DNSRCH option
133 use_dnssec TRUE to set the RES_USE_DNSSEC option
139 dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
141 res_state resp = os_get_dns_resolver_res();
143 if ((resp->options & RES_INIT) == 0)
145 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
146 os_put_dns_resolver_res(resp);
148 DEBUG(D_resolver) resp->options |= RES_DEBUG;
149 os_put_dns_resolver_res(resp);
152 resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
153 resp->options |= (qualify_single? RES_DEFNAMES : 0) |
154 (search_parents? RES_DNSRCH : 0);
155 if (dns_retrans > 0) resp->retrans = dns_retrans;
156 if (dns_retry > 0) resp->retry = dns_retry;
159 if (dns_use_edns0 >= 0)
162 resp->options |= RES_USE_EDNS0;
164 resp->options &= ~RES_USE_EDNS0;
166 debug_printf("Coerced resolver EDNS0 support %s.\n",
167 dns_use_edns0 ? "on" : "off");
170 if (dns_use_edns0 >= 0)
172 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
173 dns_use_edns0 ? "" : "un");
176 #ifndef DISABLE_DNSSEC
177 # ifdef RES_USE_DNSSEC
178 # ifndef RES_USE_EDNS0
179 # error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
182 resp->options |= RES_USE_DNSSEC;
183 if (dns_dnssec_ok >= 0)
185 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
188 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
193 resp->options |= RES_USE_DNSSEC;
195 resp->options &= ~RES_USE_DNSSEC;
196 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
197 dns_dnssec_ok ? "on" : "off");
201 if (dns_dnssec_ok >= 0)
203 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
204 dns_dnssec_ok ? "" : "un");
207 debug_printf("Unable to set DNSSEC without resolver support.\n");
209 #endif /* DISABLE_DNSSEC */
211 os_put_dns_resolver_res(resp);
216 /*************************************************
217 * Build key name for PTR records *
218 *************************************************/
220 /* This function inverts an IP address and adds the relevant domain, to produce
221 a name that can be used to look up PTR records.
224 string the IP address as a string
226 Returns: an allocated string
230 dns_build_reverse(const uschar * string)
232 const uschar * p = string + Ustrlen(string);
235 /* Handle IPv4 address */
238 if (Ustrchr(string, ':') == NULL)
241 for (int i = 0; i < 4; i++)
243 const uschar * ppp = p;
244 while (ppp > string && ppp[-1] != '.') ppp--;
245 g = string_catn(g, ppp, p - ppp);
246 g = string_catn(g, US".", 1);
249 g = string_catn(g, US"in-addr.arpa", 12);
252 /* Handle IPv6 address; convert to binary so as to fill out any
253 abbreviation in the textual form. */
260 g = string_get_tainted(32, is_tainted(string));
261 (void)host_aton(string, v6);
263 /* The original specification for IPv6 reverse lookup was to invert each
264 nibble, and look in the ip6.int domain. The domain was subsequently
265 changed to ip6.arpa. */
267 for (int i = 3; i >= 0; i--)
268 for (int j = 0; j < 32; j += 4)
269 g = string_fmt_append(g, "%x.", (v6[i] >> j) & 15);
270 g = string_catn(g, US"ip6.arpa.", 9);
272 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
273 with A6 records. However, it fell out of favour when they did. The
274 alternative was to construct a binary key, and look in ip6.arpa. I tried
275 to make this code do that, but I could not make it work on Solaris 8. The
276 resolver seems to lose the initial backslash somehow. However, now that
277 this style of reverse lookup has been dropped, it doesn't matter. These
278 lines are left here purely for historical interest. */
280 /**************************************************
284 for (int i = 0; i < 4; i++)
286 sprintf(pp, "%08X", v6[i]);
289 Ustrcpy(pp, US"].ip6.arpa.");
290 **************************************************/
294 return string_from_gstring(g);
300 /* Increment the aptr in dnss, checking against dnsa length.
301 Return: TRUE for a bad result
304 dnss_inc_aptr(const dns_answer * dnsa, dns_scan * dnss, unsigned delta)
306 return (dnss->aptr += delta) >= dnsa->answer + dnsa->answerlen;
309 /*************************************************
310 * Get next DNS record from answer block *
311 *************************************************/
313 /* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
314 RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
315 scan the additional records, and reset == RESET_NEXT to get the next record.
316 The result is in static storage which must be copied if it is to be preserved.
319 dnsa pointer to dns answer block
320 dnss pointer to dns scan block
321 reset option specifying what portion to scan, as described above
323 Returns: next dns record, or NULL when no more
327 dns_next_rr(const dns_answer *dnsa, dns_scan *dnss, int reset)
329 const HEADER * h = (const HEADER *)dnsa->answer;
334 # define TRACE DEBUG(D_dns)
337 # define TRACE if (FALSE)
340 /* Reset the saved data when requested to, and skip to the first required RR */
342 if (reset != RESET_NEXT)
344 dnss->rrcount = ntohs(h->qdcount);
345 TRACE debug_printf("%s: reset (Q rrcount %d)\n", __FUNCTION__, dnss->rrcount);
346 dnss->aptr = dnsa->answer + sizeof(HEADER);
348 /* Skip over questions; failure to expand the name just gives up */
350 while (dnss->rrcount-- > 0)
352 TRACE trace = "Q-namelen";
353 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
354 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
355 if (namelen < 0) goto null_return;
356 /* skip name & type & class */
357 TRACE trace = "Q-skip";
358 if (dnss_inc_aptr(dnsa, dnss, namelen+4)) goto null_return;
361 /* Get the number of answer records. */
363 dnss->rrcount = ntohs(h->ancount);
364 TRACE debug_printf("%s: reset (A rrcount %d)\n", __FUNCTION__, dnss->rrcount);
366 /* Skip over answers if we want to look at the authority section. Also skip
367 the NS records (i.e. authority section) if wanting to look at the additional
370 if (reset == RESET_ADDITIONAL)
372 TRACE debug_printf("%s: additional\n", __FUNCTION__);
373 dnss->rrcount += ntohs(h->nscount);
374 TRACE debug_printf("%s: reset (NS rrcount %d)\n", __FUNCTION__, dnss->rrcount);
377 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
379 TRACE if (reset == RESET_AUTHORITY)
380 debug_printf("%s: authority\n", __FUNCTION__);
381 while (dnss->rrcount-- > 0)
383 TRACE trace = "A-namelen";
384 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
385 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
386 if (namelen < 0) goto null_return;
387 /* skip name, type, class & TTL */
388 TRACE trace = "A-hdr";
389 if (dnss_inc_aptr(dnsa, dnss, namelen+8)) goto null_return;
390 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
392 TRACE trace = "A-skip";
393 if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) goto null_return;
395 dnss->rrcount = reset == RESET_AUTHORITY
396 ? ntohs(h->nscount) : ntohs(h->arcount);
397 TRACE debug_printf("%s: reset (%s rrcount %d)\n", __FUNCTION__,
398 reset == RESET_AUTHORITY ? "NS" : "AR", dnss->rrcount);
400 TRACE debug_printf("%s: %d RRs to read\n", __FUNCTION__, dnss->rrcount);
403 TRACE debug_printf("%s: next (%d left)\n", __FUNCTION__, dnss->rrcount);
405 /* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
406 contains the number of RR records left. */
408 if (dnss->rrcount-- <= 0) return NULL;
410 /* If expanding the RR domain name fails, behave as if no more records
413 TRACE trace = "R-namelen";
414 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
415 (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
416 if (namelen < 0) goto null_return;
418 /* Move the pointer past the name and fill in the rest of the data structure
419 from the following bytes. */
421 TRACE trace = "R-name";
422 if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return;
424 GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
425 TRACE trace = "R-class";
426 if (dnss_inc_aptr(dnsa, dnss, 2)) goto null_return; /* Don't want class */
427 GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */
428 GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
429 dnss->srr.data = dnss->aptr; /* The record's data follows */
431 /* Unchecked increment ok here since no further access on this iteration;
432 will be checked on next at "R-name". */
434 dnss->aptr += dnss->srr.size; /* Advance to next RR */
436 /* Return a pointer to the dns_record structure within the dns_answer. This is
437 for convenience so that the scans can use nice-looking for loops. */
439 TRACE debug_printf("%s: return %s\n", __FUNCTION__, dns_text_type(dnss->srr.type));
443 TRACE debug_printf("%s: terminate (%d RRs left). Last op: %s; errno %d %s\n",
444 __FUNCTION__, dnss->rrcount, trace, errno, strerror(errno));
450 /* Extract the AUTHORITY information from the answer. If the answer isn't
451 authoritative (AA not set), we do not extract anything.
453 The AUTHORITY section contains NS records if the name in question was found,
454 it contains a SOA record otherwise. (This is just from experience and some
455 tests, is there some spec?)
457 Scan the whole AUTHORITY section, since it may contain other records
460 Return: name for the authority, in an allocated string, or NULL if none found */
462 static const uschar *
463 dns_extract_auth_name(const dns_answer * dnsa) /* FIXME: const dns_answer */
466 const HEADER * h = (const HEADER *) dnsa->answer;
468 if (h->nscount && h->aa)
469 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
470 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
471 if (rr->type == (h->ancount ? T_NS : T_SOA))
472 return string_copy(rr->name);
479 /*************************************************
480 * Return whether AD bit set in DNS result *
481 *************************************************/
483 /* We do not perform DNSSEC work ourselves; if the administrator has installed
484 a verifying resolver which sets AD as appropriate, though, we'll use that.
485 (AD = Authentic Data, AA = Authoritative Answer)
487 Argument: pointer to dns answer block
488 Returns: bool indicating presence of AD bit
492 dns_is_secure(const dns_answer * dnsa)
494 #ifdef DISABLE_DNSSEC
496 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
499 const HEADER * h = (const HEADER *) dnsa->answer;
500 const uschar * auth_name;
501 const uschar * trusted;
503 if (dnsa->answerlen < 0) return FALSE;
504 if (h->ad) return TRUE;
506 /* If the resolver we ask is authoritative for the domain in question, it may
507 not set the AD but the AA bit. If we explicitly trust the resolver for that
508 domain (via a domainlist in dns_trust_aa), we return TRUE to indicate a secure
513 || !(trusted = expand_string(dns_trust_aa))
515 || !(auth_name = dns_extract_auth_name(dnsa))
516 || OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL,
517 MCL_DOMAIN, TRUE, NULL)
521 DEBUG(D_dns) debug_printf("DNS faked the AD bit "
522 "(got AA and matched with dns_trust_aa (%s in %s))\n",
523 auth_name, dns_trust_aa);
530 dns_set_insecure(dns_answer * dnsa)
532 #ifndef DISABLE_DNSSEC
533 HEADER * h = (HEADER *)dnsa->answer;
538 /************************************************
539 * Check whether the AA bit is set *
540 * We need this to warn if we requested AD *
541 * from an authoritative server *
542 ************************************************/
545 dns_is_aa(const dns_answer * dnsa)
547 #ifdef DISABLE_DNSSEC
550 return dnsa->answerlen >= 0 && ((const HEADER *)dnsa->answer)->aa;
556 /*************************************************
557 * Turn DNS type into text *
558 *************************************************/
560 /* Turn the coded record type into a string for printing. All those that Exim
561 uses should be included here.
563 Argument: record type
564 Returns: pointer to string
572 case T_A: return US"A";
573 case T_MX: return US"MX";
574 case T_AAAA: return US"AAAA";
575 case T_A6: return US"A6";
576 case T_TXT: return US"TXT";
577 case T_SPF: return US"SPF";
578 case T_PTR: return US"PTR";
579 case T_SOA: return US"SOA";
580 case T_SRV: return US"SRV";
581 case T_NS: return US"NS";
582 case T_CNAME: return US"CNAME";
583 case T_TLSA: return US"TLSA";
584 default: return US"?";
590 /*************************************************
591 * Cache a failed DNS lookup result *
592 *************************************************/
595 dns_fail_tag(uschar * buf, const uschar * name, int dns_type)
597 res_state resp = os_get_dns_resolver_res();
599 /*XX buf needs to be 255 +1 + (max(typetext) == 5) +1 + max(chars_for_long-max) +1
600 We truncate the name here for safety... could use a dynamic string. */
602 sprintf(CS buf, "%.255s-%s-%lx", name, dns_text_type(dns_type),
603 (unsigned long) resp->options);
607 /* We cache failed lookup results so as not to experience timeouts many
608 times for the same domain. We need to retain the resolver options because they
609 may change. For successful lookups, we rely on resolver and/or name server
615 expiry time TTL expires, or zero for unlimited
618 Returns: the return code
621 /* we need: 255 +1 + (max(typetext) == 5) +1 + max(chars_for_long-max) +1 */
622 #define DNS_FAILTAG_MAX 290
623 #define DNS_FAILNODE_SIZE \
624 (sizeof(expiring_data) + sizeof(tree_node) + DNS_FAILTAG_MAX)
627 dns_fail_return(const uschar * name, int type, time_t expiry, int rc)
629 uschar node_name[DNS_FAILTAG_MAX];
630 tree_node * previous, * new;
633 dns_fail_tag(node_name, name, type);
634 if ((previous = tree_search(tree_dns_fails, node_name)))
635 e = previous->data.ptr;
638 e = store_get_perm(DNS_FAILNODE_SIZE, is_tainted(name));
640 dns_fail_tag(new->name, name, type);
642 (void)tree_insertnode(&tree_dns_fails, new);
645 DEBUG(D_dns) debug_printf(" %s neg-cache entry for %s, ttl %d\n",
646 previous ? "update" : "writing",
647 node_name, expiry ? (int)(expiry - time(NULL)) : -1);
654 /* Return the cached result of a known-bad lookup, or -1.
657 dns_fail_cache_hit(const uschar * name, int type)
659 uschar node_name[DNS_FAILTAG_MAX];
660 tree_node * previous;
664 dns_fail_tag(node_name, name, type);
665 if (!(previous = tree_search(tree_dns_fails, node_name)))
668 e = previous->data.ptr;
670 rc = e->expiry && e->expiry <= time(NULL) ? -1 : val;
672 DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: %scached value %s%s\n",
673 name, dns_text_type(type),
674 rc == -1 ? "" : "using ",
675 val == DNS_NOMATCH ? "DNS_NOMATCH" :
676 val == DNS_NODATA ? "DNS_NODATA" :
677 val == DNS_AGAIN ? "DNS_AGAIN" :
678 val == DNS_FAIL ? "DNS_FAIL" : "??",
679 rc == -1 ? " past valid time" : "");
686 /* This is really gross. The successful return value from res_search() is
687 the packet length, which is stored in dnsa->answerlen. If we get a
688 negative DNS reply then res_search() returns -1, which causes the bounds
689 checks for name decompression to fail when it is treated as a packet
690 length, which in turn causes the authority search to fail. The correct
691 packet length has been lost inside libresolv, so we have to guess a
692 replacement value. (The only way to fix this properly would be to
693 re-implement res_search() and res_query() so that they don't muddle their
694 success and packet length return values.) For added safety we only reset
695 the packet length if the packet header looks plausible. */
698 fake_dnsa_len_for_fail(dns_answer * dnsa, int type)
700 const HEADER * h = (const HEADER *)dnsa->answer;
702 if ( h->qr == 1 /* a response */
703 && h->opcode == QUERY
704 && h->tc == 0 /* nmessage not truncated */
705 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
706 && ( ntohs(h->qdcount) == 1 /* one question record */
707 || f.running_in_test_harness)
708 && ntohs(h->ancount) == 0 /* no answer records */
709 && ntohs(h->nscount) >= 1) /* authority records */
711 DEBUG(D_dns) debug_printf("faking res_search(%s) response length as %d\n",
712 dns_text_type(type), (int)sizeof(dnsa->answer));
713 dnsa->answerlen = sizeof(dnsa->answer);
718 /* Return the TTL suitable for an NXDOMAIN result, which is given
719 in the SOA. We hope that one was returned in the lookup, and do not
720 bother doing a separate lookup; if not found return a forever TTL.
724 dns_expire_from_soa(dns_answer * dnsa, int type)
728 fake_dnsa_len_for_fail(dnsa, type);
730 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
731 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
732 ) if (rr->type == T_SOA)
734 const uschar * p = rr->data;
735 uschar discard_buf[256];
739 /* Skip the mname & rname strings */
741 if ((len = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
742 p, (DN_EXPAND_ARG4_TYPE)discard_buf, 256)) < 0)
745 if ((len = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
746 p, (DN_EXPAND_ARG4_TYPE)discard_buf, 256)) < 0)
750 /* Skip the SOA serial, refresh, retry & expire. Grab the TTL */
752 if (p > dnsa->answer + dnsa->answerlen - 5 * INT32SZ)
757 return time(NULL) + ttl;
759 DEBUG(D_dns) debug_printf("DNS: no SOA record found for neg-TTL\n");
764 /*************************************************
765 * Do basic DNS lookup *
766 *************************************************/
768 /* Call the resolver to look up the given domain name, using the given type,
769 and check the result. The error code TRY_AGAIN is documented as meaning "non-
770 Authoritative Host not found, or SERVERFAIL". Sometimes there are badly set
771 up nameservers that produce this error continually, so there is the option of
772 providing a list of domains for which this is treated as a non-existent
775 The dns_answer structure is pretty big; enough to hold a max-sized DNS message
776 - so best allocated from fast-release memory. As of writing, all our callers
777 use a stack-auto variable.
780 dnsa pointer to dns_answer structure
782 type type of DNS record required (T_A, T_MX, etc)
784 Returns: DNS_SUCCEED successful lookup
785 DNS_NOMATCH name not found (NXDOMAIN)
786 or name contains illegal characters (if checking)
787 or name is an IP address (for IP address lookup)
788 DNS_NODATA domain exists, but no data for this type (NODATA)
789 DNS_AGAIN soft failure, try again later
794 dns_basic_lookup(dns_answer * dnsa, const uschar * name, int type)
798 const uschar * save_domain;
801 /* DNS lookup failures of any kind are cached in a tree. This is mainly so that
802 a timeout on one domain doesn't happen time and time again for messages that
803 have many addresses in the same domain. We rely on the resolver and name server
804 caching for successful lookups.
807 if ((rc = dns_fail_cache_hit(name, type)) > 0)
809 dnsa->answerlen = -1;
814 /* Convert all names to a-label form before doing lookup */
817 uschar * errstr = NULL;
818 DEBUG(D_dns) if (string_is_utf8(name))
819 debug_printf("convert utf8 '%s' to alabel for for lookup\n", name);
820 if ((alabel = string_domain_utf8_to_alabel(name, &errstr)), errstr)
823 debug_printf("DNS name '%s' utf8 conversion to alabel failed: %s\n", name,
825 f.host_find_failed_syntax = TRUE;
832 /* If configured, check the hygiene of the name passed to lookup. Otherwise,
833 although DNS lookups may give REFUSED at the lower level, some resolvers
834 turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
835 domains cannot be in the DNS. The check is now done by a regular expression;
836 give it space for substring storage to save it having to get its own if the
837 regex has substrings that are used - the default uses a conditional.
839 This test is omitted for PTR records. These occur only in calls from the dnsdb
840 lookup, which constructs the names itself, so they should be OK. Besides,
841 bitstring labels don't conform to normal name syntax. (But they aren't used any
844 #ifndef STAND_ALONE /* Omit this for stand-alone tests */
846 if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
848 int ovector[3*(EXPAND_MAXN+1)];
851 if (pcre_exec(regex_check_dns_names, NULL, CCS name, Ustrlen(name),
852 0, PCRE_EOPT, ovector, nelem(ovector)) < 0)
855 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
856 dns_text_type(type));
857 f.host_find_failed_syntax = TRUE;
862 #endif /* STAND_ALONE */
864 /* Call the resolver; for an overlong response, res_search() will return the
865 number of bytes the message would need, so we need to check for this case. The
866 effect is to truncate overlong data.
868 On some systems, res_search() will recognize "A-for-A" queries and return
869 the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
870 nameservers are also believed to do this. It is, of course, contrary to the
871 specification of the DNS, so we lock it out. */
873 if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
876 /* If we are running in the test harness, instead of calling the normal resolver
877 (res_search), we call fakens_search(), which recognizes certain special
878 domains, and interfaces to a fake nameserver for certain special zones. */
881 dnsa->answerlen = f.running_in_test_harness
882 ? fakens_search(name, type, dnsa->answer, sizeof(dnsa->answer))
883 : res_search(CCS name, C_IN, type, dnsa->answer, sizeof(dnsa->answer));
885 if (dnsa->answerlen > (int) sizeof(dnsa->answer))
887 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet"
888 " (size %d), truncating to %u.\n",
889 name, dns_text_type(type), dnsa->answerlen, (unsigned int) sizeof(dnsa->answer));
890 dnsa->answerlen = sizeof(dnsa->answer);
893 if (dnsa->answerlen < 0) switch (h_errno)
896 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
897 "returning DNS_NOMATCH\n", name, dns_text_type(type));
898 return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), DNS_NOMATCH);
901 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
902 name, dns_text_type(type));
904 /* Cut this out for various test programs */
906 save_domain = deliver_domain;
907 deliver_domain = string_copy(name); /* set $domain */
908 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
909 MCL_DOMAIN, TRUE, NULL);
910 deliver_domain = save_domain;
913 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
914 return dns_fail_return(name, type, 0, DNS_AGAIN);
916 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
917 "DNS_NOMATCH\n", name);
918 return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), DNS_NOMATCH);
920 #else /* For stand-alone tests */
921 return dns_fail_return(name, type, 0, DNS_AGAIN);
925 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
926 "returning DNS_FAIL\n", name, dns_text_type(type));
927 return dns_fail_return(name, type, 0, DNS_FAIL);
930 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
931 "returning DNS_NODATA\n", name, dns_text_type(type));
932 return dns_fail_return(name, type, dns_expire_from_soa(dnsa, type), DNS_NODATA);
935 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
936 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
937 return dns_fail_return(name, type, 0, DNS_FAIL);
940 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
941 name, dns_text_type(type));
949 /************************************************
950 * Do a DNS lookup and handle CNAMES *
951 ************************************************/
953 /* Look up the given domain name, using the given type. Follow CNAMEs if
954 necessary, but only so many times. There aren't supposed to be CNAME chains in
955 the DNS, but you are supposed to cope with them if you find them.
956 By default, follow one CNAME since a resolver has been seen, faced with
957 an MX request and a CNAME (to an A) but no MX present, returning the CNAME.
959 The assumption is made that if the resolver gives back records of the
960 requested type *and* a CNAME, we don't need to make another call to look up
961 the CNAME. I can't see how it could return only some of the right records. If
962 it's done a CNAME lookup in the past, it will have all of them; if not, it
965 If fully_qualified_name is not NULL, set it to point to the full name
966 returned by the resolver, if this is different to what it is given, unless
967 the returned name starts with "*" as some nameservers seem to be returning
968 wildcards in this form. In international mode "different" means "alabel
969 forms are different".
972 dnsa pointer to dns_answer structure
973 name domain name to look up
974 type DNS record type (T_A, T_MX, etc)
975 fully_qualified_name if not NULL, return the returned name here if its
976 contents are different (i.e. it must be preset)
978 Returns: DNS_SUCCEED successful lookup
979 DNS_NOMATCH name not found
980 DNS_NODATA no data found
981 DNS_AGAIN soft failure, try again later
986 dns_lookup(dns_answer *dnsa, const uschar *name, int type,
987 const uschar **fully_qualified_name)
989 const uschar *orig_name = name;
990 BOOL secure_so_far = TRUE;
992 /* By default, assume the resolver follows CNAME chains (and returns NODATA for
993 an unterminated one). If it also does that for a CNAME loop, fine; if it returns
994 a CNAME (maybe the last?) whine about it. However, retain the coding for dumb
995 resolvers hiding behind a config variable. Loop to follow CNAME chains so far,
996 but no further... The testsuite tests the latter case, mostly assuming that the
999 for (int i = 0; i <= dns_cname_loops; i++)
1002 dns_record cname_rr, type_rr;
1006 /* DNS lookup failures get passed straight back. */
1008 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED)
1011 /* We should have either records of the required type, or a CNAME record,
1012 or both. We need to know whether both exist for getting the fully qualified
1013 name, but avoid scanning more than necessary. Note that we must copy the
1014 contents of any rr blocks returned by dns_next_rr() as they use the same
1015 area in the dnsa block. */
1017 cname_rr.data = type_rr.data = NULL;
1018 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1019 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
1020 if (rr->type == type)
1022 if (type_rr.data == NULL) type_rr = *rr;
1023 if (cname_rr.data != NULL) break;
1025 else if (rr->type == T_CNAME)
1028 /* For the first time round this loop, if a CNAME was found, take the fully
1029 qualified name from it; otherwise from the first data record, if present. */
1031 if (i == 0 && fully_qualified_name)
1033 uschar * rr_name = cname_rr.data
1034 ? cname_rr.name : type_rr.data ? type_rr.name : NULL;
1036 && Ustrcmp(rr_name, *fully_qualified_name) != 0
1037 && rr_name[0] != '*'
1039 && ( !string_is_utf8(*fully_qualified_name)
1041 string_domain_utf8_to_alabel(*fully_qualified_name, NULL)) != 0
1045 *fully_qualified_name = string_copy_dnsdomain(rr_name);
1048 /* If any data records of the correct type were found, we are done. */
1052 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
1053 dns_set_insecure(dnsa);
1057 /* If there are no data records, we need to re-scan the DNS using the
1058 domain given in the CNAME record, which should exist (otherwise we should
1059 have had a failure from dns_lookup). However code against the possibility of
1060 its not existing. */
1065 /* DNS data comes from the outside, hence tainted */
1066 data = store_get(256, TRUE);
1067 if (dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
1068 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, 256) < 0)
1072 if (!dns_is_secure(dnsa))
1073 secure_so_far = FALSE;
1075 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
1076 } /* Loop back to do another lookup */
1078 /*Control reaches here after 10 times round the CNAME loop. Something isn't
1081 log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
1090 /************************************************
1091 * Do a DNS lookup and handle virtual types *
1092 ************************************************/
1094 /* This function handles some invented "lookup types" that synthesize features
1095 not available in the basic types. The special types all have negative values.
1096 Positive type values are passed straight on to dns_lookup().
1099 dnsa pointer to dns_answer structure
1100 name domain name to look up
1101 type DNS record type (T_A, T_MX, etc or a "special")
1102 fully_qualified_name if not NULL, return the returned name here if its
1103 contents are different (i.e. it must be preset)
1105 Returns: DNS_SUCCEED successful lookup
1106 DNS_NOMATCH name not found
1107 DNS_NODATA no data found
1108 DNS_AGAIN soft failure, try again later
1109 DNS_FAIL DNS failure
1113 dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
1114 const uschar **fully_qualified_name)
1118 /* The "mx hosts only" type doesn't require any special action here */
1120 return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
1122 /* Find nameservers for the domain or the nearest enclosing zone, excluding
1123 the root servers. */
1129 const uschar *d = name;
1132 int rc = dns_lookup(dnsa, d, type, fully_qualified_name);
1133 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
1134 while (*d != 0 && *d != '.') d++;
1135 if (*d++ == 0) break;
1140 /* Try to look up the Client SMTP Authorization SRV record for the name. If
1141 there isn't one, search from the top downwards for a CSA record in a parent
1142 domain, which might be making assertions about subdomains. If we find a record
1143 we set fully_qualified_name to whichever lookup succeeded, so that the caller
1144 can tell whether to look at the explicit authorization field or the subdomain
1148 uschar *srvname, *namesuff, *tld;
1149 int priority, weight, port;
1155 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
1157 srvname = string_sprintf("_client._smtp.%s", name);
1158 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1159 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
1161 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
1165 /* Search for CSA subdomain assertion SRV records from the top downwards,
1166 starting with the 2nd level domain. This order maximizes cache-friendliness.
1167 We skip the top level domains to avoid loading their nameservers and because
1168 we know they'll never have CSA SRV records. */
1170 namesuff = Ustrrchr(name, '.');
1171 if (namesuff == NULL) return DNS_NOMATCH;
1174 limit = dns_csa_search_limit;
1176 /* Use more appropriate search parameters if we are in the reverse DNS. */
1178 if (strcmpic(namesuff, US".arpa") == 0)
1179 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
1185 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
1193 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
1195 /* Do not perform the search if the top level or 2nd level domains do not
1196 exist. This is quite common, and when it occurs all the search queries would
1197 go to the root or TLD name servers, which is not friendly. So we check the
1198 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
1199 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
1200 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
1201 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
1203 if (rc == DNS_NOMATCH)
1205 fake_dnsa_len_for_fail(dnsa, T_CSA);
1207 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
1208 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1210 if (rr->type != T_SOA) continue;
1211 else if (strcmpic(rr->name, US"") == 0 ||
1212 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
1216 for (i = 0; i < limit; i++)
1220 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
1221 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
1223 if (namesuff <= name) return DNS_NOMATCH;
1226 /* Find the start of the preceding domain name label. */
1228 if (--namesuff <= name) return DNS_NOMATCH;
1229 while (*namesuff != '.');
1231 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
1233 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
1234 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1235 if (rc == DNS_AGAIN) return rc;
1236 if (rc != DNS_SUCCEED) continue;
1238 /* Check that the SRV record we have found is worth returning. We don't
1239 just return the first one we find, because some lower level SRV record
1240 might make stricter assertions than its parent domain. */
1242 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1243 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1245 const uschar * p = rr->data;
1247 /* Extract the numerical SRV fields (p is incremented) */
1248 GETSHORT(priority, p);
1249 GETSHORT(weight, p); weight = weight; /* compiler quietening */
1252 /* Check the CSA version number */
1253 if (priority != 1) continue;
1255 /* If it's making an interesting assertion, return this response. */
1258 *fully_qualified_name = namesuff + 1;
1268 return dns_lookup(dnsa, name, type, fully_qualified_name);
1271 /* Control should never reach here */
1280 /*************************************************
1281 * Get address(es) from DNS record *
1282 *************************************************/
1284 /* The record type is either T_A for an IPv4 address or T_AAAA for an IPv6 address.
1287 dnsa the DNS answer block
1290 Returns: pointer to a chain of dns_address items; NULL when the dnsa was overrun
1294 dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1296 dns_address * yield = NULL;
1297 uschar * dnsa_lim = dnsa->answer + dnsa->answerlen;
1299 if (rr->type == T_A)
1301 uschar *p = US rr->data;
1302 if (p + 4 <= dnsa_lim)
1304 /* the IP is not regarded as tainted */
1305 yield = store_get(sizeof(dns_address) + 20, FALSE);
1306 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1315 if (rr->data + 16 <= dnsa_lim)
1317 struct in6_addr in6;
1318 for (int i = 0; i < 16; i++) in6.s6_addr[i] = rr->data[i];
1319 yield = store_get(sizeof(dns_address) + 50, FALSE);
1320 inet_ntop(AF_INET6, &in6, CS yield->address, 50);
1324 #endif /* HAVE_IPV6 */
1332 dns_pattern_init(void)
1334 if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1335 regex_check_dns_names =
1336 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);