1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Functions for interfacing with the DNS. */
14 /*************************************************
16 *************************************************/
18 /* This function is called instead of res_search() when Exim is running in its
19 test harness. It recognizes some special domain names, and uses them to force
20 failure and retry responses (optionally with a delay). Otherwise, it calls an
21 external utility that mocks-up a nameserver, if it can find the utility.
22 If not, it passes its arguments on to res_search(). The fake nameserver may
23 also return a code specifying that the name should be passed on.
25 Background: the original test suite required a real nameserver to carry the
26 test zones, whereas the new test suite has the fake server for portability. This
30 domain the domain name
31 type the DNS record type
32 answerptr where to put the answer
33 size size of the answer area
35 Returns: length of returned data, or -1 on error (h_errno set)
39 fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
41 int len = Ustrlen(domain);
42 int asize = size; /* Locally modified */
45 uschar *aptr = answerptr; /* Locally modified */
48 /* Remove terminating dot. */
50 if (domain[len - 1] == '.') len--;
51 name = string_copyn(domain, len);
53 /* Look for the fakens utility, and if it exists, call it. */
55 (void)string_format(utilname, sizeof(utilname), "%s/bin/fakens",
56 config_main_directory);
58 if (stat(CS utilname, &statbuf) >= 0)
64 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) using fakens\n", name, dns_text_type(type));
67 argv[1] = config_main_directory;
69 argv[3] = dns_text_type(type);
72 pid = child_open(argv, NULL, 0000, &infd, &outfd, FALSE);
74 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to run fakens: %s",
79 while (asize > 0 && (rc = read(outfd, aptr, asize)) > 0)
82 aptr += rc; /* Don't modify the actual arguments, because they */
83 asize -= rc; /* may need to be passed on to res_search(). */
86 /* If we ran out of output buffer before exhausting the return,
87 carry on reading and counting it. */
90 while ((rc = read(outfd, name, sizeof(name))) > 0)
94 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "read from fakens failed: %s",
97 switch(child_close(pid, 0))
100 case 1: h_errno = HOST_NOT_FOUND; return -1;
101 case 2: h_errno = TRY_AGAIN; return -1;
103 case 3: h_errno = NO_RECOVERY; return -1;
104 case 4: h_errno = NO_DATA; return -1;
105 case 5: /* Pass on to res_search() */
106 DEBUG(D_dns) debug_printf("fakens returned PASS_ON\n");
111 DEBUG(D_dns) debug_printf("fakens (%s) not found\n", utilname);
114 /* fakens utility not found, or it returned "pass on" */
116 DEBUG(D_dns) debug_printf("passing %s on to res_search()\n", domain);
118 return res_search(CS domain, C_IN, type, answerptr, size);
123 /*************************************************
124 * Initialize and configure resolver *
125 *************************************************/
127 /* Initialize the resolver and the storage for holding DNS answers if this is
128 the first time we have been here, and set the resolver options.
131 qualify_single TRUE to set the RES_DEFNAMES option
132 search_parents TRUE to set the RES_DNSRCH option
133 use_dnssec TRUE to set the RES_USE_DNSSEC option
139 dns_init(BOOL qualify_single, BOOL search_parents, BOOL use_dnssec)
141 res_state resp = os_get_dns_resolver_res();
143 if ((resp->options & RES_INIT) == 0)
145 DEBUG(D_resolver) resp->options |= RES_DEBUG; /* For Cygwin */
146 os_put_dns_resolver_res(resp);
148 DEBUG(D_resolver) resp->options |= RES_DEBUG;
149 os_put_dns_resolver_res(resp);
152 resp->options &= ~(RES_DNSRCH | RES_DEFNAMES);
153 resp->options |= (qualify_single? RES_DEFNAMES : 0) |
154 (search_parents? RES_DNSRCH : 0);
155 if (dns_retrans > 0) resp->retrans = dns_retrans;
156 if (dns_retry > 0) resp->retry = dns_retry;
159 if (dns_use_edns0 >= 0)
162 resp->options |= RES_USE_EDNS0;
164 resp->options &= ~RES_USE_EDNS0;
166 debug_printf("Coerced resolver EDNS0 support %s.\n",
167 dns_use_edns0 ? "on" : "off");
170 if (dns_use_edns0 >= 0)
172 debug_printf("Unable to %sset EDNS0 without resolver support.\n",
173 dns_use_edns0 ? "" : "un");
176 #ifndef DISABLE_DNSSEC
177 # ifdef RES_USE_DNSSEC
178 # ifndef RES_USE_EDNS0
179 # error Have RES_USE_DNSSEC but not RES_USE_EDNS0? Something hinky ...
182 resp->options |= RES_USE_DNSSEC;
183 if (dns_dnssec_ok >= 0)
185 if (dns_use_edns0 == 0 && dns_dnssec_ok != 0)
188 debug_printf("CONFLICT: dns_use_edns0 forced false, dns_dnssec_ok forced true, ignoring latter!\n");
193 resp->options |= RES_USE_DNSSEC;
195 resp->options &= ~RES_USE_DNSSEC;
196 DEBUG(D_resolver) debug_printf("Coerced resolver DNSSEC support %s.\n",
197 dns_dnssec_ok ? "on" : "off");
201 if (dns_dnssec_ok >= 0)
203 debug_printf("Unable to %sset DNSSEC without resolver support.\n",
204 dns_dnssec_ok ? "" : "un");
207 debug_printf("Unable to set DNSSEC without resolver support.\n");
209 #endif /* DISABLE_DNSSEC */
211 os_put_dns_resolver_res(resp);
216 /*************************************************
217 * Build key name for PTR records *
218 *************************************************/
220 /* This function inverts an IP address and adds the relevant domain, to produce
221 a name that can be used to look up PTR records.
224 string the IP address as a string
225 buffer a suitable buffer, long enough to hold the result
231 dns_build_reverse(const uschar *string, uschar *buffer)
233 const uschar *p = string + Ustrlen(string);
236 /* Handle IPv4 address */
239 if (Ustrchr(string, ':') == NULL)
242 for (int i = 0; i < 4; i++)
244 const uschar *ppp = p;
245 while (ppp > string && ppp[-1] != '.') ppp--;
246 Ustrncpy(pp, ppp, p - ppp);
251 Ustrcpy(pp, US"in-addr.arpa");
254 /* Handle IPv6 address; convert to binary so as to fill out any
255 abbreviation in the textual form. */
261 (void)host_aton(string, v6);
263 /* The original specification for IPv6 reverse lookup was to invert each
264 nibble, and look in the ip6.int domain. The domain was subsequently
265 changed to ip6.arpa. */
267 for (int i = 3; i >= 0; i--)
268 for (int j = 0; j < 32; j += 4)
269 pp += sprintf(CS pp, "%x.", (v6[i] >> j) & 15);
270 Ustrcpy(pp, US"ip6.arpa.");
272 /* Another way of doing IPv6 reverse lookups was proposed in conjunction
273 with A6 records. However, it fell out of favour when they did. The
274 alternative was to construct a binary key, and look in ip6.arpa. I tried
275 to make this code do that, but I could not make it work on Solaris 8. The
276 resolver seems to lose the initial backslash somehow. However, now that
277 this style of reverse lookup has been dropped, it doesn't matter. These
278 lines are left here purely for historical interest. */
280 /**************************************************
284 for (int i = 0; i < 4; i++)
286 sprintf(pp, "%08X", v6[i]);
289 Ustrcpy(pp, US"].ip6.arpa.");
290 **************************************************/
299 /* Increment the aptr in dnss, checking against dnsa length.
300 Return: TRUE for a bad result
303 dnss_inc_aptr(const dns_answer * dnsa, dns_scan * dnss, unsigned delta)
305 return (dnss->aptr += delta) >= dnsa->answer + dnsa->answerlen;
308 /*************************************************
309 * Get next DNS record from answer block *
310 *************************************************/
312 /* Call this with reset == RESET_ANSWERS to scan the answer block, reset ==
313 RESET_AUTHORITY to scan the authority records, reset == RESET_ADDITIONAL to
314 scan the additional records, and reset == RESET_NEXT to get the next record.
315 The result is in static storage which must be copied if it is to be preserved.
318 dnsa pointer to dns answer block
319 dnss pointer to dns scan block
320 reset option specifying what portion to scan, as described above
322 Returns: next dns record, or NULL when no more
326 dns_next_rr(const dns_answer *dnsa, dns_scan *dnss, int reset)
328 const HEADER * h = (const HEADER *)dnsa->answer;
333 # define TRACE DEBUG(D_dns)
336 # define TRACE if (FALSE)
339 /* Reset the saved data when requested to, and skip to the first required RR */
341 if (reset != RESET_NEXT)
343 dnss->rrcount = ntohs(h->qdcount);
344 TRACE debug_printf("%s: reset (Q rrcount %d)\n", __FUNCTION__, dnss->rrcount);
345 dnss->aptr = dnsa->answer + sizeof(HEADER);
347 /* Skip over questions; failure to expand the name just gives up */
349 while (dnss->rrcount-- > 0)
351 TRACE trace = "Q-namelen";
352 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
353 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
354 if (namelen < 0) goto null_return;
355 /* skip name & type & class */
356 TRACE trace = "Q-skip";
357 if (dnss_inc_aptr(dnsa, dnss, namelen+4)) goto null_return;
360 /* Get the number of answer records. */
362 dnss->rrcount = ntohs(h->ancount);
363 TRACE debug_printf("%s: reset (A rrcount %d)\n", __FUNCTION__, dnss->rrcount);
365 /* Skip over answers if we want to look at the authority section. Also skip
366 the NS records (i.e. authority section) if wanting to look at the additional
369 if (reset == RESET_ADDITIONAL)
371 TRACE debug_printf("%s: additional\n", __FUNCTION__);
372 dnss->rrcount += ntohs(h->nscount);
373 TRACE debug_printf("%s: reset (NS rrcount %d)\n", __FUNCTION__, dnss->rrcount);
376 if (reset == RESET_AUTHORITY || reset == RESET_ADDITIONAL)
378 TRACE if (reset == RESET_AUTHORITY)
379 debug_printf("%s: authority\n", __FUNCTION__);
380 while (dnss->rrcount-- > 0)
382 TRACE trace = "A-namelen";
383 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
384 dnss->aptr, (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
385 if (namelen < 0) goto null_return;
386 /* skip name, type, class & TTL */
387 TRACE trace = "A-hdr";
388 if (dnss_inc_aptr(dnsa, dnss, namelen+8)) goto null_return;
389 GETSHORT(dnss->srr.size, dnss->aptr); /* size of data portion */
391 TRACE trace = "A-skip";
392 if (dnss_inc_aptr(dnsa, dnss, dnss->srr.size)) goto null_return;
394 dnss->rrcount = reset == RESET_AUTHORITY
395 ? ntohs(h->nscount) : ntohs(h->arcount);
396 TRACE debug_printf("%s: reset (%s rrcount %d)\n", __FUNCTION__,
397 reset == RESET_AUTHORITY ? "NS" : "AR", dnss->rrcount);
399 TRACE debug_printf("%s: %d RRs to read\n", __FUNCTION__, dnss->rrcount);
402 TRACE debug_printf("%s: next (%d left)\n", __FUNCTION__, dnss->rrcount);
404 /* The variable dnss->aptr is now pointing at the next RR, and dnss->rrcount
405 contains the number of RR records left. */
407 if (dnss->rrcount-- <= 0) return NULL;
409 /* If expanding the RR domain name fails, behave as if no more records
412 TRACE trace = "R-namelen";
413 namelen = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, dnss->aptr,
414 (DN_EXPAND_ARG4_TYPE) &dnss->srr.name, DNS_MAXNAME);
415 if (namelen < 0) goto null_return;
417 /* Move the pointer past the name and fill in the rest of the data structure
418 from the following bytes. */
420 TRACE trace = "R-name";
421 if (dnss_inc_aptr(dnsa, dnss, namelen)) goto null_return;
423 GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
424 TRACE trace = "R-class";
425 if (dnss_inc_aptr(dnsa, dnss, 2)) goto null_return; /* Don't want class */
426 GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */
427 GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
428 dnss->srr.data = dnss->aptr; /* The record's data follows */
430 /* Unchecked increment ok here since no further access on this iteration;
431 will be checked on next at "R-name". */
433 dnss->aptr += dnss->srr.size; /* Advance to next RR */
435 /* Return a pointer to the dns_record structure within the dns_answer. This is
436 for convenience so that the scans can use nice-looking for loops. */
441 TRACE debug_printf("%s: terminate (%d RRs left). Last op: %s; errno %d %s\n",
442 __FUNCTION__, dnss->rrcount, trace, errno, strerror(errno));
448 /* Extract the AUTHORITY information from the answer. If the answer isn't
449 authoritative (AA not set), we do not extract anything.
451 The AUTHORITY section contains NS records if the name in question was found,
452 it contains a SOA record otherwise. (This is just from experience and some
453 tests, is there some spec?)
455 Scan the whole AUTHORITY section, since it may contain other records
458 Return: name for the authority, in an allocated string, or NULL if none found */
460 static const uschar *
461 dns_extract_auth_name(const dns_answer * dnsa) /* FIXME: const dns_answer */
464 const HEADER * h = (const HEADER *) dnsa->answer;
466 if (h->nscount && h->aa)
467 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
468 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
469 if (rr->type == (h->ancount ? T_NS : T_SOA))
470 return string_copy(rr->name);
477 /*************************************************
478 * Return whether AD bit set in DNS result *
479 *************************************************/
481 /* We do not perform DNSSEC work ourselves; if the administrator has installed
482 a verifying resolver which sets AD as appropriate, though, we'll use that.
483 (AD = Authentic Data, AA = Authoritative Answer)
485 Argument: pointer to dns answer block
486 Returns: bool indicating presence of AD bit
490 dns_is_secure(const dns_answer * dnsa)
492 #ifdef DISABLE_DNSSEC
494 debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
497 const HEADER * h = (const HEADER *) dnsa->answer;
498 const uschar * auth_name;
499 const uschar * trusted;
501 if (h->ad) return TRUE;
503 /* If the resolver we ask is authoritative for the domain in question, it
504 * may not set the AD but the AA bit. If we explicitly trust
505 * the resolver for that domain (via a domainlist in dns_trust_aa),
506 * we return TRUE to indicate a secure answer.
511 || !(trusted = expand_string(dns_trust_aa))
513 || !(auth_name = dns_extract_auth_name(dnsa))
514 || OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL,
515 MCL_DOMAIN, TRUE, NULL)
519 DEBUG(D_dns) debug_printf("DNS faked the AD bit "
520 "(got AA and matched with dns_trust_aa (%s in %s))\n",
521 auth_name, dns_trust_aa);
528 dns_set_insecure(dns_answer * dnsa)
530 #ifndef DISABLE_DNSSEC
531 HEADER * h = (HEADER *)dnsa->answer;
536 /************************************************
537 * Check whether the AA bit is set *
538 * We need this to warn if we requested AD *
539 * from an authoritative server *
540 ************************************************/
543 dns_is_aa(const dns_answer *dnsa)
545 #ifdef DISABLE_DNSSEC
548 return ((const HEADER*)dnsa->answer)->aa;
554 /*************************************************
555 * Turn DNS type into text *
556 *************************************************/
558 /* Turn the coded record type into a string for printing. All those that Exim
559 uses should be included here.
561 Argument: record type
562 Returns: pointer to string
570 case T_A: return US"A";
571 case T_MX: return US"MX";
572 case T_AAAA: return US"AAAA";
573 case T_A6: return US"A6";
574 case T_TXT: return US"TXT";
575 case T_SPF: return US"SPF";
576 case T_PTR: return US"PTR";
577 case T_SOA: return US"SOA";
578 case T_SRV: return US"SRV";
579 case T_NS: return US"NS";
580 case T_CNAME: return US"CNAME";
581 case T_TLSA: return US"TLSA";
582 default: return US"?";
588 /*************************************************
589 * Cache a failed DNS lookup result *
590 *************************************************/
593 dns_fail_tag(uschar * buf, const uschar * name, int dns_type)
595 res_state resp = os_get_dns_resolver_res();
596 sprintf(CS buf, "%.255s-%s-%lx", name, dns_text_type(dns_type),
597 (unsigned long) resp->options);
601 /* We cache failed lookup results so as not to experience timeouts many
602 times for the same domain. We need to retain the resolver options because they
603 may change. For successful lookups, we rely on resolver and/or name server
611 Returns: the return code
615 dns_return(const uschar * name, int type, int rc)
617 tree_node *node = store_get_perm(sizeof(tree_node) + 290, TRUE);
618 dns_fail_tag(node->name, name, type);
620 (void)tree_insertnode(&tree_dns_fails, node);
624 /*************************************************
625 * Do basic DNS lookup *
626 *************************************************/
628 /* Call the resolver to look up the given domain name, using the given type,
629 and check the result. The error code TRY_AGAIN is documented as meaning "non-
630 Authoritative Host not found, or SERVERFAIL". Sometimes there are badly set
631 up nameservers that produce this error continually, so there is the option of
632 providing a list of domains for which this is treated as a non-existent
635 The dns_answer structure is pretty big; enough to hold a max-sized DNS message
636 - so best allocated from fast-release memory. As of writing, all our callers
637 use a stack-auto variable.
640 dnsa pointer to dns_answer structure
642 type type of DNS record required (T_A, T_MX, etc)
644 Returns: DNS_SUCCEED successful lookup
645 DNS_NOMATCH name not found (NXDOMAIN)
646 or name contains illegal characters (if checking)
647 or name is an IP address (for IP address lookup)
648 DNS_NODATA domain exists, but no data for this type (NODATA)
649 DNS_AGAIN soft failure, try again later
654 dns_basic_lookup(dns_answer *dnsa, const uschar *name, int type)
658 const uschar *save_domain;
662 uschar node_name[290];
664 /* DNS lookup failures of any kind are cached in a tree. This is mainly so that
665 a timeout on one domain doesn't happen time and time again for messages that
666 have many addresses in the same domain. We rely on the resolver and name server
667 caching for successful lookups. */
669 dns_fail_tag(node_name, name, type);
670 if ((previous = tree_search(tree_dns_fails, node_name)))
672 DEBUG(D_dns) debug_printf("DNS lookup of %.255s-%s: using cached value %s\n",
673 name, dns_text_type(type),
674 previous->data.val == DNS_NOMATCH ? "DNS_NOMATCH" :
675 previous->data.val == DNS_NODATA ? "DNS_NODATA" :
676 previous->data.val == DNS_AGAIN ? "DNS_AGAIN" :
677 previous->data.val == DNS_FAIL ? "DNS_FAIL" : "??");
678 return previous->data.val;
682 /* Convert all names to a-label form before doing lookup */
685 uschar * errstr = NULL;
686 DEBUG(D_dns) if (string_is_utf8(name))
687 debug_printf("convert utf8 '%s' to alabel for for lookup\n", name);
688 if ((alabel = string_domain_utf8_to_alabel(name, &errstr)), errstr)
691 debug_printf("DNS name '%s' utf8 conversion to alabel failed: %s\n", name,
693 f.host_find_failed_syntax = TRUE;
700 /* If configured, check the hygiene of the name passed to lookup. Otherwise,
701 although DNS lookups may give REFUSED at the lower level, some resolvers
702 turn this into TRY_AGAIN, which is silly. Give a NOMATCH return, since such
703 domains cannot be in the DNS. The check is now done by a regular expression;
704 give it space for substring storage to save it having to get its own if the
705 regex has substrings that are used - the default uses a conditional.
707 This test is omitted for PTR records. These occur only in calls from the dnsdb
708 lookup, which constructs the names itself, so they should be OK. Besides,
709 bitstring labels don't conform to normal name syntax. (But the aren't used any
712 For SRV records, we omit the initial _smtp._tcp. components at the start.
713 The check has been seen to bite on the destination of a SRV lookup that
714 initiall hit a CNAME, for which the next name had only two components.
715 RFC2782 makes no mention of the possibiility of CNAMES, but the Wikipedia
716 article on SRV says they are not a valid configuration. */
718 #ifndef STAND_ALONE /* Omit this for stand-alone tests */
720 if (check_dns_names_pattern[0] != 0 && type != T_PTR && type != T_TXT)
722 const uschar *checkname = name;
723 int ovector[3*(EXPAND_MAXN+1)];
727 /* For an SRV lookup, skip over the first two components (the service and
728 protocol names, which both start with an underscore). */
730 if (type == T_SRV || type == T_TLSA)
732 while (*checkname && *checkname++ != '.') ;
733 while (*checkname && *checkname++ != '.') ;
736 if (pcre_exec(regex_check_dns_names, NULL, CCS checkname, Ustrlen(checkname),
737 0, PCRE_EOPT, ovector, nelem(ovector)) < 0)
740 debug_printf("DNS name syntax check failed: %s (%s)\n", name,
741 dns_text_type(type));
742 f.host_find_failed_syntax = TRUE;
747 #endif /* STAND_ALONE */
749 /* Call the resolver; for an overlong response, res_search() will return the
750 number of bytes the message would need, so we need to check for this case. The
751 effect is to truncate overlong data.
753 On some systems, res_search() will recognize "A-for-A" queries and return
754 the IP address instead of returning -1 with h_error=HOST_NOT_FOUND. Some
755 nameservers are also believed to do this. It is, of course, contrary to the
756 specification of the DNS, so we lock it out. */
758 if ((type == T_A || type == T_AAAA) && string_is_ip_address(name, NULL) != 0)
761 /* If we are running in the test harness, instead of calling the normal resolver
762 (res_search), we call fakens_search(), which recognizes certain special
763 domains, and interfaces to a fake nameserver for certain special zones. */
765 dnsa->answerlen = f.running_in_test_harness
766 ? fakens_search(name, type, dnsa->answer, sizeof(dnsa->answer))
767 : res_search(CCS name, C_IN, type, dnsa->answer, sizeof(dnsa->answer));
769 if (dnsa->answerlen > (int) sizeof(dnsa->answer))
771 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) resulted in overlong packet"
772 " (size %d), truncating to %u.\n",
773 name, dns_text_type(type), dnsa->answerlen, (unsigned int) sizeof(dnsa->answer));
774 dnsa->answerlen = sizeof(dnsa->answer);
777 if (dnsa->answerlen < 0) switch (h_errno)
780 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave HOST_NOT_FOUND\n"
781 "returning DNS_NOMATCH\n", name, dns_text_type(type));
782 return dns_return(name, type, DNS_NOMATCH);
785 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave TRY_AGAIN\n",
786 name, dns_text_type(type));
788 /* Cut this out for various test programs */
790 save_domain = deliver_domain;
791 deliver_domain = string_copy(name); /* set $domain */
792 rc = match_isinlist(name, (const uschar **)&dns_again_means_nonexist, 0, NULL, NULL,
793 MCL_DOMAIN, TRUE, NULL);
794 deliver_domain = save_domain;
797 DEBUG(D_dns) debug_printf("returning DNS_AGAIN\n");
798 return dns_return(name, type, DNS_AGAIN);
800 DEBUG(D_dns) debug_printf("%s is in dns_again_means_nonexist: returning "
801 "DNS_NOMATCH\n", name);
802 return dns_return(name, type, DNS_NOMATCH);
804 #else /* For stand-alone tests */
805 return dns_return(name, type, DNS_AGAIN);
809 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_RECOVERY\n"
810 "returning DNS_FAIL\n", name, dns_text_type(type));
811 return dns_return(name, type, DNS_FAIL);
814 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave NO_DATA\n"
815 "returning DNS_NODATA\n", name, dns_text_type(type));
816 return dns_return(name, type, DNS_NODATA);
819 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) gave unknown DNS error %d\n"
820 "returning DNS_FAIL\n", name, dns_text_type(type), h_errno);
821 return dns_return(name, type, DNS_FAIL);
824 DEBUG(D_dns) debug_printf("DNS lookup of %s (%s) succeeded\n",
825 name, dns_text_type(type));
833 /************************************************
834 * Do a DNS lookup and handle CNAMES *
835 ************************************************/
837 /* Look up the given domain name, using the given type. Follow CNAMEs if
838 necessary, but only so many times. There aren't supposed to be CNAME chains in
839 the DNS, but you are supposed to cope with them if you find them.
840 By default, follow one CNAME since a resolver has been seen, faced with
841 an MX request and a CNAME (to an A) but no MX present, returning the CNAME.
843 The assumption is made that if the resolver gives back records of the
844 requested type *and* a CNAME, we don't need to make another call to look up
845 the CNAME. I can't see how it could return only some of the right records. If
846 it's done a CNAME lookup in the past, it will have all of them; if not, it
849 If fully_qualified_name is not NULL, set it to point to the full name
850 returned by the resolver, if this is different to what it is given, unless
851 the returned name starts with "*" as some nameservers seem to be returning
852 wildcards in this form. In international mode "different" means "alabel
853 forms are different".
856 dnsa pointer to dns_answer structure
857 name domain name to look up
858 type DNS record type (T_A, T_MX, etc)
859 fully_qualified_name if not NULL, return the returned name here if its
860 contents are different (i.e. it must be preset)
862 Returns: DNS_SUCCEED successful lookup
863 DNS_NOMATCH name not found
864 DNS_NODATA no data found
865 DNS_AGAIN soft failure, try again later
870 dns_lookup(dns_answer *dnsa, const uschar *name, int type,
871 const uschar **fully_qualified_name)
873 const uschar *orig_name = name;
874 BOOL secure_so_far = TRUE;
876 /* By default, assume the resolver follows CNAME chains (and returns NODATA for
877 an unterminated one). If it also does that for a CNAME loop, fine; if it returns
878 a CNAME (maybe the last?) whine about it. However, retain the coding for dumb
879 resolvers hiding behind a config variable. Loop to follow CNAME chains so far,
880 but no further... The testsuite tests the latter case, mostly assuming that the
883 for (int i = 0; i <= dns_cname_loops; i++)
886 dns_record cname_rr, type_rr;
890 /* DNS lookup failures get passed straight back. */
892 if ((rc = dns_basic_lookup(dnsa, name, type)) != DNS_SUCCEED)
895 /* We should have either records of the required type, or a CNAME record,
896 or both. We need to know whether both exist for getting the fully qualified
897 name, but avoid scanning more than necessary. Note that we must copy the
898 contents of any rr blocks returned by dns_next_rr() as they use the same
899 area in the dnsa block. */
901 cname_rr.data = type_rr.data = NULL;
902 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
903 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
904 if (rr->type == type)
906 if (type_rr.data == NULL) type_rr = *rr;
907 if (cname_rr.data != NULL) break;
909 else if (rr->type == T_CNAME)
912 /* For the first time round this loop, if a CNAME was found, take the fully
913 qualified name from it; otherwise from the first data record, if present. */
915 if (i == 0 && fully_qualified_name)
917 uschar * rr_name = cname_rr.data
918 ? cname_rr.name : type_rr.data ? type_rr.name : NULL;
920 && Ustrcmp(rr_name, *fully_qualified_name) != 0
923 && ( !string_is_utf8(*fully_qualified_name)
925 string_domain_utf8_to_alabel(*fully_qualified_name, NULL)) != 0
929 *fully_qualified_name = string_copy_dnsdomain(rr_name);
932 /* If any data records of the correct type were found, we are done. */
936 if (!secure_so_far) /* mark insecure if any element of CNAME chain was */
937 dns_set_insecure(dnsa);
941 /* If there are no data records, we need to re-scan the DNS using the
942 domain given in the CNAME record, which should exist (otherwise we should
943 have had a failure from dns_lookup). However code against the possibility of
949 /* DNS data comes from the outside, hence tainted */
950 data = store_get(256, TRUE);
951 if (dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
952 cname_rr.data, (DN_EXPAND_ARG4_TYPE)data, 256) < 0)
956 if (!dns_is_secure(dnsa))
957 secure_so_far = FALSE;
959 DEBUG(D_dns) debug_printf("CNAME found: change to %s\n", name);
960 } /* Loop back to do another lookup */
962 /*Control reaches here after 10 times round the CNAME loop. Something isn't
965 log_write(0, LOG_MAIN, "CNAME loop for %s encountered", orig_name);
974 /************************************************
975 * Do a DNS lookup and handle virtual types *
976 ************************************************/
978 /* This function handles some invented "lookup types" that synthesize features
979 not available in the basic types. The special types all have negative values.
980 Positive type values are passed straight on to dns_lookup().
983 dnsa pointer to dns_answer structure
984 name domain name to look up
985 type DNS record type (T_A, T_MX, etc or a "special")
986 fully_qualified_name if not NULL, return the returned name here if its
987 contents are different (i.e. it must be preset)
989 Returns: DNS_SUCCEED successful lookup
990 DNS_NOMATCH name not found
991 DNS_NODATA no data found
992 DNS_AGAIN soft failure, try again later
997 dns_special_lookup(dns_answer *dnsa, const uschar *name, int type,
998 const uschar **fully_qualified_name)
1002 /* The "mx hosts only" type doesn't require any special action here */
1004 return dns_lookup(dnsa, name, T_MX, fully_qualified_name);
1006 /* Find nameservers for the domain or the nearest enclosing zone, excluding
1007 the root servers. */
1013 const uschar *d = name;
1016 int rc = dns_lookup(dnsa, d, type, fully_qualified_name);
1017 if (rc != DNS_NOMATCH && rc != DNS_NODATA) return rc;
1018 while (*d != 0 && *d != '.') d++;
1019 if (*d++ == 0) break;
1024 /* Try to look up the Client SMTP Authorization SRV record for the name. If
1025 there isn't one, search from the top downwards for a CSA record in a parent
1026 domain, which might be making assertions about subdomains. If we find a record
1027 we set fully_qualified_name to whichever lookup succeeded, so that the caller
1028 can tell whether to look at the explicit authorization field or the subdomain
1032 uschar *srvname, *namesuff, *tld;
1033 int priority, weight, port;
1039 DEBUG(D_dns) debug_printf("CSA lookup of %s\n", name);
1041 srvname = string_sprintf("_client._smtp.%s", name);
1042 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1043 if (rc == DNS_SUCCEED || rc == DNS_AGAIN)
1045 if (rc == DNS_SUCCEED) *fully_qualified_name = string_copy(name);
1049 /* Search for CSA subdomain assertion SRV records from the top downwards,
1050 starting with the 2nd level domain. This order maximizes cache-friendliness.
1051 We skip the top level domains to avoid loading their nameservers and because
1052 we know they'll never have CSA SRV records. */
1054 namesuff = Ustrrchr(name, '.');
1055 if (namesuff == NULL) return DNS_NOMATCH;
1058 limit = dns_csa_search_limit;
1060 /* Use more appropriate search parameters if we are in the reverse DNS. */
1062 if (strcmpic(namesuff, US".arpa") == 0)
1063 if (namesuff - 8 > name && strcmpic(namesuff - 8, US".in-addr.arpa") == 0)
1069 else if (namesuff - 4 > name && strcmpic(namesuff - 4, US".ip6.arpa") == 0)
1077 DEBUG(D_dns) debug_printf("CSA TLD %s\n", tld);
1079 /* Do not perform the search if the top level or 2nd level domains do not
1080 exist. This is quite common, and when it occurs all the search queries would
1081 go to the root or TLD name servers, which is not friendly. So we check the
1082 AUTHORITY section; if it contains the root's SOA record or the TLD's SOA then
1083 the TLD or the 2LD (respectively) doesn't exist and we can skip the search.
1084 If the TLD and the 2LD exist but the explicit CSA record lookup failed, then
1085 the AUTHORITY SOA will be the 2LD's or a subdomain thereof. */
1087 if (rc == DNS_NOMATCH)
1089 /* This is really gross. The successful return value from res_search() is
1090 the packet length, which is stored in dnsa->answerlen. If we get a
1091 negative DNS reply then res_search() returns -1, which causes the bounds
1092 checks for name decompression to fail when it is treated as a packet
1093 length, which in turn causes the authority search to fail. The correct
1094 packet length has been lost inside libresolv, so we have to guess a
1095 replacement value. (The only way to fix this properly would be to
1096 re-implement res_search() and res_query() so that they don't muddle their
1097 success and packet length return values.) For added safety we only reset
1098 the packet length if the packet header looks plausible. */
1100 const HEADER * h = (const HEADER *)dnsa->answer;
1101 if (h->qr == 1 && h->opcode == QUERY && h->tc == 0
1102 && (h->rcode == NOERROR || h->rcode == NXDOMAIN)
1103 && ntohs(h->qdcount) == 1 && ntohs(h->ancount) == 0
1104 && ntohs(h->nscount) >= 1)
1105 dnsa->answerlen = sizeof(dnsa->answer);
1107 for (rr = dns_next_rr(dnsa, &dnss, RESET_AUTHORITY);
1108 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)
1110 if (rr->type != T_SOA) continue;
1111 else if (strcmpic(rr->name, US"") == 0 ||
1112 strcmpic(rr->name, tld) == 0) return DNS_NOMATCH;
1116 for (i = 0; i < limit; i++)
1120 /* Scan through the IPv6 reverse DNS in chunks of 16 bits worth of IP
1121 address, i.e. 4 hex chars and 4 dots, i.e. 8 chars. */
1123 if (namesuff <= name) return DNS_NOMATCH;
1126 /* Find the start of the preceding domain name label. */
1128 if (--namesuff <= name) return DNS_NOMATCH;
1129 while (*namesuff != '.');
1131 DEBUG(D_dns) debug_printf("CSA parent search at %s\n", namesuff + 1);
1133 srvname = string_sprintf("_client._smtp.%s", namesuff + 1);
1134 rc = dns_lookup(dnsa, srvname, T_SRV, NULL);
1135 if (rc == DNS_AGAIN) return rc;
1136 if (rc != DNS_SUCCEED) continue;
1138 /* Check that the SRV record we have found is worth returning. We don't
1139 just return the first one we find, because some lower level SRV record
1140 might make stricter assertions than its parent domain. */
1142 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1143 rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1145 const uschar * p = rr->data;
1147 /* Extract the numerical SRV fields (p is incremented) */
1148 GETSHORT(priority, p);
1149 GETSHORT(weight, p); weight = weight; /* compiler quietening */
1152 /* Check the CSA version number */
1153 if (priority != 1) continue;
1155 /* If it's making an interesting assertion, return this response. */
1158 *fully_qualified_name = namesuff + 1;
1168 return dns_lookup(dnsa, name, type, fully_qualified_name);
1171 /* Control should never reach here */
1180 /*************************************************
1181 * Get address(es) from DNS record *
1182 *************************************************/
1184 /* The record type is either T_A for an IPv4 address or T_AAAA for an IPv6 address.
1187 dnsa the DNS answer block
1190 Returns: pointer to a chain of dns_address items; NULL when the dnsa was overrun
1194 dns_address_from_rr(dns_answer *dnsa, dns_record *rr)
1196 dns_address * yield = NULL;
1197 uschar * dnsa_lim = dnsa->answer + dnsa->answerlen;
1199 if (rr->type == T_A)
1201 uschar *p = US rr->data;
1202 if (p + 4 <= dnsa_lim)
1204 /* the IP is not regarded as tainted */
1205 yield = store_get(sizeof(dns_address) + 20, FALSE);
1206 (void)sprintf(CS yield->address, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
1215 if (rr->data + 16 <= dnsa_lim)
1217 struct in6_addr in6;
1218 for (int i = 0; i < 16; i++) in6.s6_addr[i] = rr->data[i];
1219 yield = store_get(sizeof(dns_address) + 50, FALSE);
1220 inet_ntop(AF_INET6, &in6, CS yield->address, 50);
1224 #endif /* HAVE_IPV6 */
1232 dns_pattern_init(void)
1234 if (check_dns_names_pattern[0] != 0 && !regex_check_dns_names)
1235 regex_check_dns_names =
1236 regex_must_compile(check_dns_names_pattern, FALSE, TRUE);