1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Functions for finding hosts, either by gethostbyname(), gethostbyaddr(), or
9 directly via the DNS. When IPv6 is supported, getipnodebyname() and
10 getipnodebyaddr() may be used instead of gethostbyname() and gethostbyaddr(),
11 if the newer functions are available. This module also contains various other
12 functions concerned with hosts and addresses, and a random number function,
13 used for randomizing hosts with equal MXs but available for use in other parts
20 /* Static variable for preserving the list of interface addresses in case it is
21 used more than once. */
23 static ip_address_item *local_interface_data = NULL;
26 #ifdef USE_INET_NTOA_FIX
27 /*************************************************
28 * Replacement for broken inet_ntoa() *
29 *************************************************/
31 /* On IRIX systems, gcc uses a different structure passing convention to the
32 native libraries. This causes inet_ntoa() to always yield 0.0.0.0 or
33 255.255.255.255. To get round this, we provide a private version of the
34 function here. It is used only if USE_INET_NTOA_FIX is set, which should happen
35 only when gcc is in use on an IRIX system. Code send to me by J.T. Breitner,
39 as seen in comp.sys.sgi.admin
41 August 2005: Apparently this is also needed for AIX systems; USE_INET_NTOA_FIX
42 should now be set for them as well.
44 Arguments: sa an in_addr structure
45 Returns: pointer to static text string
49 inet_ntoa(struct in_addr sa)
51 static uschar addr[20];
52 sprintf(addr, "%d.%d.%d.%d",
63 /*************************************************
64 * Random number generator *
65 *************************************************/
67 /* This is a simple pseudo-random number generator. It does not have to be
68 very good for the uses to which it is put. When running the regression tests,
69 start with a fixed seed.
71 If you need better, see vaguely_random_number() which is potentially stronger,
72 if a crypto library is available, but might end up just calling this instead.
75 limit: one more than the largest number required
77 Returns: a pseudo-random number in the range 0 to limit-1
81 random_number(int limit)
87 if (running_in_test_harness) random_seed = 42; else
89 int p = (int)getpid();
90 random_seed = (int)time(NULL) ^ ((p << 16) | p);
93 random_seed = 1103515245 * random_seed + 12345;
94 return (unsigned int)(random_seed >> 16) % limit;
99 /*************************************************
100 * Replace gethostbyname() when testing *
101 *************************************************/
103 /* This function is called instead of gethostbyname(), gethostbyname2(), or
104 getipnodebyname() when running in the test harness. It recognizes the name
105 "manyhome.test.ex" and generates a humungous number of IP addresses. It also
106 recognizes an unqualified "localhost" and forces it to the appropriate loopback
107 address. IP addresses are treated as literals. For other names, it uses the DNS
108 to find the host name. In the test harness, this means it will access only the
112 name the host name or a textual IP address
113 af AF_INET or AF_INET6
114 error_num where to put an error code:
115 HOST_NOT_FOUND/TRY_AGAIN/NO_RECOVERY/NO_DATA
117 Returns: a hostent structure or NULL for an error
120 static struct hostent *
121 host_fake_gethostbyname(uschar *name, int af, int *error_num)
124 int alen = (af == AF_INET)? sizeof(struct in_addr):sizeof(struct in6_addr);
126 int alen = sizeof(struct in_addr);
130 uschar *lname = name;
133 struct hostent *yield;
139 debug_printf("using host_fake_gethostbyname for %s (%s)\n", name,
140 (af == AF_INET)? "IPv4" : "IPv6");
142 /* Handle the name that needs a vast number of IP addresses */
144 if (Ustrcmp(name, "manyhome.test.ex") == 0 && af == AF_INET)
147 yield = store_get(sizeof(struct hostent));
148 alist = store_get(2049 * sizeof(char *));
149 adds = store_get(2048 * alen);
150 yield->h_name = CS name;
151 yield->h_aliases = NULL;
152 yield->h_addrtype = af;
153 yield->h_length = alen;
154 yield->h_addr_list = CSS alist;
155 for (i = 104; i <= 111; i++)
157 for (j = 0; j <= 255; j++)
170 /* Handle unqualified "localhost" */
172 if (Ustrcmp(name, "localhost") == 0)
173 lname = (af == AF_INET)? US"127.0.0.1" : US"::1";
175 /* Handle a literal IP address */
177 ipa = string_is_ip_address(lname, NULL);
180 if ((ipa == 4 && af == AF_INET) ||
181 (ipa == 6 && af == AF_INET6))
185 yield = store_get(sizeof(struct hostent));
186 alist = store_get(2 * sizeof(char *));
187 adds = store_get(alen);
188 yield->h_name = CS name;
189 yield->h_aliases = NULL;
190 yield->h_addrtype = af;
191 yield->h_length = alen;
192 yield->h_addr_list = CSS alist;
194 n = host_aton(lname, x);
195 for (i = 0; i < n; i++)
198 *adds++ = (y >> 24) & 255;
199 *adds++ = (y >> 16) & 255;
200 *adds++ = (y >> 8) & 255;
206 /* Wrong kind of literal address */
210 *error_num = HOST_NOT_FOUND;
215 /* Handle a host name */
219 int type = (af == AF_INET)? T_A:T_AAAA;
220 int rc = dns_lookup(&dnsa, lname, type, NULL);
223 lookup_dnssec_authenticated = NULL;
227 case DNS_SUCCEED: break;
228 case DNS_NOMATCH: *error_num = HOST_NOT_FOUND; return NULL;
229 case DNS_NODATA: *error_num = NO_DATA; return NULL;
230 case DNS_AGAIN: *error_num = TRY_AGAIN; return NULL;
232 case DNS_FAIL: *error_num = NO_RECOVERY; return NULL;
235 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
237 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
239 if (rr->type == type) count++;
242 yield = store_get(sizeof(struct hostent));
243 alist = store_get((count + 1) * sizeof(char **));
244 adds = store_get(count *alen);
246 yield->h_name = CS name;
247 yield->h_aliases = NULL;
248 yield->h_addrtype = af;
249 yield->h_length = alen;
250 yield->h_addr_list = CSS alist;
252 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
254 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
259 if (rr->type != type) continue;
260 da = dns_address_from_rr(&dnsa, rr);
262 n = host_aton(da->address, x);
263 for (i = 0; i < n; i++)
266 *adds++ = (y >> 24) & 255;
267 *adds++ = (y >> 16) & 255;
268 *adds++ = (y >> 8) & 255;
280 /*************************************************
281 * Build chain of host items from list *
282 *************************************************/
284 /* This function builds a chain of host items from a textual list of host
285 names. It does not do any lookups. If randomize is true, the chain is build in
286 a randomized order. There may be multiple groups of independently randomized
287 hosts; they are delimited by a host name consisting of just "+".
290 anchor anchor for the chain
292 randomize TRUE for randomizing
298 host_build_hostlist(host_item **anchor, uschar *list, BOOL randomize)
301 int fake_mx = MX_NONE; /* This value is actually -1 */
305 if (list == NULL) return;
306 if (randomize) fake_mx--; /* Start at -2 for randomizing */
310 while ((name = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
314 if (name[0] == '+' && name[1] == 0) /* "+" delimits a randomized group */
315 { /* ignore if not randomizing */
316 if (randomize) fake_mx--;
320 h = store_get(sizeof(host_item));
321 h->name = string_copy(name);
325 h->sort_key = randomize? (-fake_mx)*1000 + random_number(1000) : 0;
326 h->status = hstatus_unknown;
327 h->why = hwhy_unknown;
337 host_item *hh = *anchor;
338 if (h->sort_key < hh->sort_key)
345 while (hh->next != NULL && h->sort_key >= (hh->next)->sort_key)
358 /*************************************************
359 * Extract port from address string *
360 *************************************************/
362 /* In the spool file, and in the -oMa and -oMi options, a host plus port is
363 given as an IP address followed by a dot and a port number. This function
366 An alternative format for the -oMa and -oMi options is [ip address]:port which
367 is what Exim 4 uses for output, because it seems to becoming commonly used,
368 whereas the dot form confuses some programs/people. So we recognize that form
372 address points to the string; if there is a port, the '.' in the string
373 is overwritten with zero to terminate the address; if the string
374 is in the [xxx]:ppp format, the address is shifted left and the
377 Returns: 0 if there is no port, else the port number. If there's a syntax
378 error, leave the incoming address alone, and return 0.
382 host_address_extract_port(uschar *address)
387 /* Handle the "bracketed with colon on the end" format */
391 uschar *rb = address + 1;
392 while (*rb != 0 && *rb != ']') rb++;
393 if (*rb++ == 0) return 0; /* Missing ]; leave invalid address */
396 port = Ustrtol(rb + 1, &endptr, 10);
397 if (*endptr != 0) return 0; /* Invalid port; leave invalid address */
399 else if (*rb != 0) return 0; /* Bad syntax; leave invalid address */
400 memmove(address, address + 1, rb - address - 2);
404 /* Handle the "dot on the end" format */
408 int skip = -3; /* Skip 3 dots in IPv4 addresses */
410 while (*(++address) != 0)
413 if (ch == ':') skip = 0; /* Skip 0 dots in IPv6 addresses */
414 else if (ch == '.' && skip++ >= 0) break;
416 if (*address == 0) return 0;
417 port = Ustrtol(address + 1, &endptr, 10);
418 if (*endptr != 0) return 0; /* Invalid port; leave invalid address */
426 /*************************************************
427 * Get port from a host item's name *
428 *************************************************/
430 /* This function is called when finding the IP address for a host that is in a
431 list of hosts explicitly configured, such as in the manualroute router, or in a
432 fallback hosts list. We see if there is a port specification at the end of the
433 host name, and if so, remove it. A minimum length of 3 is required for the
434 original name; nothing shorter is recognized as having a port.
436 We test for a name ending with a sequence of digits; if preceded by colon we
437 have a port if the character before the colon is ] and the name starts with [
438 or if there are no other colons in the name (i.e. it's not an IPv6 address).
440 Arguments: pointer to the host item
441 Returns: a port number or PORT_NONE
445 host_item_get_port(host_item *h)
449 int len = Ustrlen(h->name);
451 if (len < 3 || (p = h->name + len - 1, !isdigit(*p))) return PORT_NONE;
453 /* Extract potential port number */
458 while (p > h->name + 1 && isdigit(*p))
460 port += (*p-- - '0') * x;
464 /* The smallest value of p at this point is h->name + 1. */
466 if (*p != ':') return PORT_NONE;
468 if (p[-1] == ']' && h->name[0] == '[')
469 h->name = string_copyn(h->name + 1, p - h->name - 2);
470 else if (Ustrchr(h->name, ':') == p)
471 h->name = string_copyn(h->name, p - h->name);
472 else return PORT_NONE;
474 DEBUG(D_route|D_host_lookup) debug_printf("host=%s port=%d\n", h->name, port);
480 #ifndef STAND_ALONE /* Omit when standalone testing */
482 /*************************************************
483 * Build sender_fullhost and sender_rcvhost *
484 *************************************************/
486 /* This function is called when sender_host_name and/or sender_helo_name
487 have been set. Or might have been set - for a local message read off the spool
488 they won't be. In that case, do nothing. Otherwise, set up the fullhost string
491 (a) No sender_host_name or sender_helo_name: "[ip address]"
492 (b) Just sender_host_name: "host_name [ip address]"
493 (c) Just sender_helo_name: "(helo_name) [ip address]" unless helo is IP
494 in which case: "[ip address}"
495 (d) The two are identical: "host_name [ip address]" includes helo = IP
496 (e) The two are different: "host_name (helo_name) [ip address]"
498 If log_incoming_port is set, the sending host's port number is added to the IP
501 This function also builds sender_rcvhost for use in Received: lines, whose
502 syntax is a bit different. This value also includes the RFC 1413 identity.
503 There wouldn't be two different variables if I had got all this right in the
506 Because this data may survive over more than one incoming SMTP message, it has
507 to be in permanent store.
514 host_build_sender_fullhost(void)
516 BOOL show_helo = TRUE;
519 int old_pool = store_pool;
521 if (sender_host_address == NULL) return;
523 store_pool = POOL_PERM;
525 /* Set up address, with or without the port. After discussion, it seems that
526 the only format that doesn't cause trouble is [aaaa]:pppp. However, we can't
527 use this directly as the first item for Received: because it ain't an RFC 2822
530 address = string_sprintf("[%s]:%d", sender_host_address, sender_host_port);
531 if ((log_extra_selector & LX_incoming_port) == 0 || sender_host_port <= 0)
532 *(Ustrrchr(address, ':')) = 0;
534 /* If there's no EHLO/HELO data, we can't show it. */
536 if (sender_helo_name == NULL) show_helo = FALSE;
538 /* If HELO/EHLO was followed by an IP literal, it's messy because of two
539 features of IPv6. Firstly, there's the "IPv6:" prefix (Exim is liberal and
540 doesn't require this, for historical reasons). Secondly, IPv6 addresses may not
541 be given in canonical form, so we have to canonicize them before comparing. As
542 it happens, the code works for both IPv4 and IPv6. */
544 else if (sender_helo_name[0] == '[' &&
545 sender_helo_name[(len=Ustrlen(sender_helo_name))-1] == ']')
550 if (strncmpic(sender_helo_name + 1, US"IPv6:", 5) == 0) offset += 5;
551 if (strncmpic(sender_helo_name + 1, US"IPv4:", 5) == 0) offset += 5;
553 helo_ip = string_copyn(sender_helo_name + offset, len - offset - 1);
555 if (string_is_ip_address(helo_ip, NULL) != 0)
559 uschar ipx[48], ipy[48]; /* large enough for full IPv6 */
561 sizex = host_aton(helo_ip, x);
562 sizey = host_aton(sender_host_address, y);
564 (void)host_nmtoa(sizex, x, -1, ipx, ':');
565 (void)host_nmtoa(sizey, y, -1, ipy, ':');
567 if (strcmpic(ipx, ipy) == 0) show_helo = FALSE;
571 /* Host name is not verified */
573 if (sender_host_name == NULL)
575 uschar *portptr = Ustrstr(address, "]:");
578 int adlen; /* Sun compiler doesn't like ++ in initializers */
580 adlen = (portptr == NULL)? Ustrlen(address) : (++portptr - address);
581 sender_fullhost = (sender_helo_name == NULL)? address :
582 string_sprintf("(%s) %s", sender_helo_name, address);
584 sender_rcvhost = string_cat(NULL, &size, &ptr, address, adlen);
586 if (sender_ident != NULL || show_helo || portptr != NULL)
589 sender_rcvhost = string_cat(sender_rcvhost, &size, &ptr, US" (", 2);
593 sender_rcvhost = string_append(sender_rcvhost, &size, &ptr, 2, US"port=",
597 sender_rcvhost = string_append(sender_rcvhost, &size, &ptr, 2,
598 (firstptr == ptr)? US"helo=" : US" helo=", sender_helo_name);
600 if (sender_ident != NULL)
601 sender_rcvhost = string_append(sender_rcvhost, &size, &ptr, 2,
602 (firstptr == ptr)? US"ident=" : US" ident=", sender_ident);
604 sender_rcvhost = string_cat(sender_rcvhost, &size, &ptr, US")", 1);
607 sender_rcvhost[ptr] = 0; /* string_cat() always leaves room */
609 /* Release store, because string_cat allocated a minimum of 100 bytes that
610 are rarely completely used. */
612 store_reset(sender_rcvhost + ptr + 1);
615 /* Host name is known and verified. Unless we've already found that the HELO
616 data matches the IP address, compare it with the name. */
620 if (show_helo && strcmpic(sender_host_name, sender_helo_name) == 0)
625 sender_fullhost = string_sprintf("%s (%s) %s", sender_host_name,
626 sender_helo_name, address);
627 sender_rcvhost = (sender_ident == NULL)?
628 string_sprintf("%s (%s helo=%s)", sender_host_name,
629 address, sender_helo_name) :
630 string_sprintf("%s\n\t(%s helo=%s ident=%s)", sender_host_name,
631 address, sender_helo_name, sender_ident);
635 sender_fullhost = string_sprintf("%s %s", sender_host_name, address);
636 sender_rcvhost = (sender_ident == NULL)?
637 string_sprintf("%s (%s)", sender_host_name, address) :
638 string_sprintf("%s (%s ident=%s)", sender_host_name, address,
643 store_pool = old_pool;
645 DEBUG(D_host_lookup) debug_printf("sender_fullhost = %s\n", sender_fullhost);
646 DEBUG(D_host_lookup) debug_printf("sender_rcvhost = %s\n", sender_rcvhost);
651 /*************************************************
652 * Build host+ident message *
653 *************************************************/
655 /* Used when logging rejections and various ACL and SMTP incidents. The text
656 return depends on whether sender_fullhost and sender_ident are set or not:
658 no ident, no host => U=unknown
659 no ident, host set => H=sender_fullhost
660 ident set, no host => U=ident
661 ident set, host set => H=sender_fullhost U=ident
664 useflag TRUE if first item to be flagged (H= or U=); if there are two
665 items, the second is always flagged
667 Returns: pointer to a string in big_buffer
671 host_and_ident(BOOL useflag)
673 if (sender_fullhost == NULL)
675 (void)string_format(big_buffer, big_buffer_size, "%s%s", useflag? "U=" : "",
676 (sender_ident == NULL)? US"unknown" : sender_ident);
680 uschar *flag = useflag? US"H=" : US"";
681 uschar *iface = US"";
682 if ((log_extra_selector & LX_incoming_interface) != 0 &&
683 interface_address != NULL)
684 iface = string_sprintf(" I=[%s]:%d", interface_address, interface_port);
685 if (sender_ident == NULL)
686 (void)string_format(big_buffer, big_buffer_size, "%s%s%s",
687 flag, sender_fullhost, iface);
689 (void)string_format(big_buffer, big_buffer_size, "%s%s%s U=%s",
690 flag, sender_fullhost, iface, sender_ident);
695 #endif /* STAND_ALONE */
700 /*************************************************
701 * Build list of local interfaces *
702 *************************************************/
704 /* This function interprets the contents of the local_interfaces or
705 extra_local_interfaces options, and creates an ip_address_item block for each
706 item on the list. There is no special interpretation of any IP addresses; in
707 particular, 0.0.0.0 and ::0 are returned without modification. If any address
708 includes a port, it is set in the block. Otherwise the port value is set to
713 name the name of the option being expanded
715 Returns: a chain of ip_address_items, each containing to a textual
716 version of an IP address, and a port number (host order) or
717 zero if no port was given with the address
721 host_build_ifacelist(uschar *list, uschar *name)
726 ip_address_item *yield = NULL;
727 ip_address_item *last = NULL;
728 ip_address_item *next;
730 while ((s = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
733 int port = host_address_extract_port(s); /* Leaves just the IP address */
734 if ((ipv = string_is_ip_address(s, NULL)) == 0)
735 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Malformed IP address \"%s\" in %s",
738 /* Skip IPv6 addresses if IPv6 is disabled. */
740 if (disable_ipv6 && ipv == 6) continue;
742 /* This use of strcpy() is OK because we have checked that s is a valid IP
743 address above. The field in the ip_address_item is large enough to hold an
746 next = store_get(sizeof(ip_address_item));
748 Ustrcpy(next->address, s);
750 next->v6_include_v4 = FALSE;
752 if (yield == NULL) yield = last = next; else
766 /*************************************************
767 * Find addresses on local interfaces *
768 *************************************************/
770 /* This function finds the addresses of local IP interfaces. These are used
771 when testing for routing to the local host. As the function may be called more
772 than once, the list is preserved in permanent store, pointed to by a static
773 variable, to save doing the work more than once per process.
775 The generic list of interfaces is obtained by calling host_build_ifacelist()
776 for local_interfaces and extra_local_interfaces. This list scanned to remove
777 duplicates (which may exist with different ports - not relevant here). If
778 either of the wildcard IP addresses (0.0.0.0 and ::0) are encountered, they are
779 replaced by the appropriate (IPv4 or IPv6) list of actual local interfaces,
780 obtained from os_find_running_interfaces().
783 Returns: a chain of ip_address_items, each containing to a textual
784 version of an IP address; the port numbers are not relevant
788 /* First, a local subfunction to add an interface to a list in permanent store,
789 but only if there isn't a previous copy of that address on the list. */
791 static ip_address_item *
792 add_unique_interface(ip_address_item *list, ip_address_item *ipa)
794 ip_address_item *ipa2;
795 for (ipa2 = list; ipa2 != NULL; ipa2 = ipa2->next)
796 if (Ustrcmp(ipa2->address, ipa->address) == 0) return list;
797 ipa2 = store_get_perm(sizeof(ip_address_item));
804 /* This is the globally visible function */
807 host_find_interfaces(void)
809 ip_address_item *running_interfaces = NULL;
811 if (local_interface_data == NULL)
813 void *reset_item = store_get(0);
814 ip_address_item *dlist = host_build_ifacelist(local_interfaces,
815 US"local_interfaces");
816 ip_address_item *xlist = host_build_ifacelist(extra_local_interfaces,
817 US"extra_local_interfaces");
818 ip_address_item *ipa;
820 if (dlist == NULL) dlist = xlist; else
822 for (ipa = dlist; ipa->next != NULL; ipa = ipa->next);
826 for (ipa = dlist; ipa != NULL; ipa = ipa->next)
828 if (Ustrcmp(ipa->address, "0.0.0.0") == 0 ||
829 Ustrcmp(ipa->address, "::0") == 0)
831 ip_address_item *ipa2;
832 BOOL ipv6 = ipa->address[0] == ':';
833 if (running_interfaces == NULL)
834 running_interfaces = os_find_running_interfaces();
835 for (ipa2 = running_interfaces; ipa2 != NULL; ipa2 = ipa2->next)
837 if ((Ustrchr(ipa2->address, ':') != NULL) == ipv6)
838 local_interface_data = add_unique_interface(local_interface_data,
844 local_interface_data = add_unique_interface(local_interface_data, ipa);
847 debug_printf("Configured local interface: address=%s", ipa->address);
848 if (ipa->port != 0) debug_printf(" port=%d", ipa->port);
853 store_reset(reset_item);
856 return local_interface_data;
863 /*************************************************
864 * Convert network IP address to text *
865 *************************************************/
867 /* Given an IPv4 or IPv6 address in binary, convert it to a text
868 string and return the result in a piece of new store. The address can
869 either be given directly, or passed over in a sockaddr structure. Note
870 that this isn't the converse of host_aton() because of byte ordering
871 differences. See host_nmtoa() below.
874 type if < 0 then arg points to a sockaddr, else
875 either AF_INET or AF_INET6
876 arg points to a sockaddr if type is < 0, or
877 points to an IPv4 address (32 bits), or
878 points to an IPv6 address (128 bits),
879 in both cases, in network byte order
880 buffer if NULL, the result is returned in gotten store;
881 else points to a buffer to hold the answer
882 portptr points to where to put the port number, if non NULL; only
885 Returns: pointer to character string
889 host_ntoa(int type, const void *arg, uschar *buffer, int *portptr)
893 /* The new world. It is annoying that we have to fish out the address from
894 different places in the block, depending on what kind of address it is. It
895 is also a pain that inet_ntop() returns a const uschar *, whereas the IPv4
896 function inet_ntoa() returns just uschar *, and some picky compilers insist
897 on warning if one assigns a const uschar * to a uschar *. Hence the casts. */
900 uschar addr_buffer[46];
903 int family = ((struct sockaddr *)arg)->sa_family;
904 if (family == AF_INET6)
906 struct sockaddr_in6 *sk = (struct sockaddr_in6 *)arg;
907 yield = (uschar *)inet_ntop(family, &(sk->sin6_addr), CS addr_buffer,
908 sizeof(addr_buffer));
909 if (portptr != NULL) *portptr = ntohs(sk->sin6_port);
913 struct sockaddr_in *sk = (struct sockaddr_in *)arg;
914 yield = (uschar *)inet_ntop(family, &(sk->sin_addr), CS addr_buffer,
915 sizeof(addr_buffer));
916 if (portptr != NULL) *portptr = ntohs(sk->sin_port);
921 yield = (uschar *)inet_ntop(type, arg, CS addr_buffer, sizeof(addr_buffer));
924 /* If the result is a mapped IPv4 address, show it in V4 format. */
926 if (Ustrncmp(yield, "::ffff:", 7) == 0) yield += 7;
928 #else /* HAVE_IPV6 */
934 yield = US inet_ntoa(((struct sockaddr_in *)arg)->sin_addr);
935 if (portptr != NULL) *portptr = ntohs(((struct sockaddr_in *)arg)->sin_port);
938 yield = US inet_ntoa(*((struct in_addr *)arg));
941 /* If there is no buffer, put the string into some new store. */
943 if (buffer == NULL) return string_copy(yield);
945 /* Callers of this function with a non-NULL buffer must ensure that it is
946 large enough to hold an IPv6 address, namely, at least 46 bytes. That's what
947 makes this use of strcpy() OK. */
949 Ustrcpy(buffer, yield);
956 /*************************************************
957 * Convert address text to binary *
958 *************************************************/
960 /* Given the textual form of an IP address, convert it to binary in an
961 array of ints. IPv4 addresses occupy one int; IPv6 addresses occupy 4 ints.
962 The result has the first byte in the most significant byte of the first int. In
963 other words, the result is not in network byte order, but in host byte order.
964 As a result, this is not the converse of host_ntoa(), which expects network
965 byte order. See host_nmtoa() below.
968 address points to the textual address, checked for syntax
969 bin points to an array of 4 ints
971 Returns: the number of ints used
975 host_aton(uschar *address, int *bin)
980 /* Handle IPv6 address, which may end with an IPv4 address. It may also end
981 with a "scope", introduced by a percent sign. This code is NOT enclosed in #if
982 HAVE_IPV6 in order that IPv6 addresses are recognized even if IPv6 is not
985 if (Ustrchr(address, ':') != NULL)
988 uschar *component[8];
989 BOOL ipv4_ends = FALSE;
995 /* If the address starts with a colon, it will start with two colons.
996 Just lose the first one, which will leave a null first component. */
1000 /* Split the address into components separated by colons. The input address
1001 is supposed to be checked for syntax. There was a case where this was
1002 overlooked; to guard against that happening again, check here and crash if
1003 there are too many components. */
1005 while (*p != 0 && *p != '%')
1007 int len = Ustrcspn(p, ":%");
1008 if (len == 0) nulloffset = ci;
1009 if (ci > 7) log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1010 "Internal error: invalid IPv6 address \"%s\" passed to host_aton()",
1012 component[ci++] = p;
1017 /* If the final component contains a dot, it is a trailing v4 address.
1018 As the syntax is known to be checked, just set up for a trailing
1019 v4 address and restrict the v6 part to 6 components. */
1021 if (Ustrchr(component[ci-1], '.') != NULL)
1023 address = component[--ci];
1029 /* If there are fewer than 6 or 8 components, we have to insert some
1030 more empty ones in the middle. */
1034 int insert_count = v6count - ci;
1035 for (i = v6count-1; i > nulloffset + insert_count; i--)
1036 component[i] = component[i - insert_count];
1037 while (i > nulloffset) component[i--] = US"";
1040 /* Now turn the components into binary in pairs and bung them
1041 into the vector of ints. */
1043 for (i = 0; i < v6count; i += 2)
1044 bin[i/2] = (Ustrtol(component[i], NULL, 16) << 16) +
1045 Ustrtol(component[i+1], NULL, 16);
1047 /* If there was no terminating v4 component, we are done. */
1049 if (!ipv4_ends) return 4;
1052 /* Handle IPv4 address */
1054 (void)sscanf(CS address, "%d.%d.%d.%d", x, x+1, x+2, x+3);
1055 bin[v4offset] = (x[0] << 24) + (x[1] << 16) + (x[2] << 8) + x[3];
1060 /*************************************************
1061 * Apply mask to an IP address *
1062 *************************************************/
1064 /* Mask an address held in 1 or 4 ints, with the ms bit in the ms bit of the
1068 count the number of ints
1069 binary points to the ints to be masked
1070 mask the count of ms bits to leave, or -1 if no masking
1076 host_mask(int count, int *binary, int mask)
1079 if (mask < 0) mask = 99999;
1080 for (i = 0; i < count; i++)
1083 if (mask == 0) wordmask = 0;
1086 wordmask = (-1) << (32 - mask);
1094 binary[i] &= wordmask;
1101 /*************************************************
1102 * Convert masked IP address in ints to text *
1103 *************************************************/
1105 /* We can't use host_ntoa() because it assumes the binary values are in network
1106 byte order, and these are the result of host_aton(), which puts them in ints in
1107 host byte order. Also, we really want IPv6 addresses to be in a canonical
1108 format, so we output them with no abbreviation. In a number of cases we can't
1109 use the normal colon separator in them because it terminates keys in lsearch
1110 files, so we want to use dot instead. There's an argument that specifies what
1111 to use for IPv6 addresses.
1114 count 1 or 4 (number of ints)
1115 binary points to the ints
1116 mask mask value; if < 0 don't add to result
1117 buffer big enough to hold the result
1118 sep component separator character for IPv6 addresses
1120 Returns: the number of characters placed in buffer, not counting
1125 host_nmtoa(int count, int *binary, int mask, uschar *buffer, int sep)
1128 uschar *tt = buffer;
1133 for (i = 24; i >= 0; i -= 8)
1135 sprintf(CS tt, "%d.", (j >> i) & 255);
1141 for (i = 0; i < 4; i++)
1144 sprintf(CS tt, "%04x%c%04x%c", (j >> 16) & 0xffff, sep, j & 0xffff, sep);
1149 tt--; /* lose final separator */
1155 sprintf(CS tt, "/%d", mask);
1164 /*************************************************
1165 * Check port for tls_on_connect *
1166 *************************************************/
1168 /* This function checks whether a given incoming port is configured for tls-
1169 on-connect. It is called from the daemon and from inetd handling. If the global
1170 option tls_on_connect is already set, all ports operate this way. Otherwise, we
1171 check the tls_on_connect_ports option for a list of ports.
1173 Argument: a port number
1174 Returns: TRUE or FALSE
1178 host_is_tls_on_connect_port(int port)
1182 uschar *list = tls_in.on_connect_ports;
1185 if (tls_in.on_connect) return TRUE;
1187 while ((s = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
1190 int lport = Ustrtol(s, &end, 10);
1191 if (*end != 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "tls_on_connect_ports "
1192 "contains \"%s\", which is not a port number: exim abandoned", s);
1193 if (lport == port) return TRUE;
1201 /*************************************************
1202 * Check whether host is in a network *
1203 *************************************************/
1205 /* This function checks whether a given IP address matches a pattern that
1206 represents either a single host, or a network (using CIDR notation). The caller
1207 of this function must check the syntax of the arguments before calling it.
1210 host string representation of the ip-address to check
1211 net string representation of the network, with optional CIDR mask
1212 maskoffset offset to the / that introduces the mask in the key
1213 zero if there is no mask
1216 TRUE the host is inside the network
1217 FALSE the host is NOT inside the network
1221 host_is_in_net(uschar *host, uschar *net, int maskoffset)
1227 int size = host_aton(net, address);
1230 /* No mask => all bits to be checked */
1232 if (maskoffset == 0) mlen = 99999; /* Big number */
1233 else mlen = Uatoi(net + maskoffset + 1);
1235 /* Convert the incoming address to binary. */
1237 insize = host_aton(host, incoming);
1239 /* Convert IPv4 addresses given in IPv6 compatible mode, which represent
1240 connections from IPv4 hosts to IPv6 hosts, that is, addresses of the form
1241 ::ffff:<v4address>, to IPv4 format. */
1243 if (insize == 4 && incoming[0] == 0 && incoming[1] == 0 &&
1244 incoming[2] == 0xffff)
1247 incoming[0] = incoming[3];
1250 /* No match if the sizes don't agree. */
1252 if (insize != size) return FALSE;
1254 /* Else do the masked comparison. */
1256 for (i = 0; i < size; i++)
1259 if (mlen == 0) mask = 0;
1262 mask = (-1) << (32 - mlen);
1270 if ((incoming[i] & mask) != (address[i] & mask)) return FALSE;
1278 /*************************************************
1279 * Scan host list for local hosts *
1280 *************************************************/
1282 /* Scan through a chain of addresses and check whether any of them is the
1283 address of an interface on the local machine. If so, remove that address and
1284 any previous ones with the same MX value, and all subsequent ones (which will
1285 have greater or equal MX values) from the chain. Note: marking them as unusable
1286 is NOT the right thing to do because it causes the hosts not to be used for
1287 other domains, for which they may well be correct.
1289 The hosts may be part of a longer chain; we only process those between the
1290 initial pointer and the "last" pointer.
1292 There is also a list of "pseudo-local" host names which are checked against the
1293 host names. Any match causes that host item to be treated the same as one which
1294 matches a local IP address.
1296 If the very first host is a local host, then all MX records had a precedence
1297 greater than or equal to that of the local host. Either there's a problem in
1298 the DNS, or an apparently remote name turned out to be an abbreviation for the
1299 local host. Give a specific return code, and let the caller decide what to do.
1300 Otherwise, give a success code if at least one host address has been found.
1303 host pointer to the first host in the chain
1304 lastptr pointer to pointer to the last host in the chain (may be updated)
1305 removed if not NULL, set TRUE if some local addresses were removed
1309 HOST_FOUND if there is at least one host with an IP address on the chain
1310 and an MX value less than any MX value associated with the
1312 HOST_FOUND_LOCAL if a local host is among the lowest-numbered MX hosts; when
1313 the host addresses were obtained from A records or
1314 gethostbyname(), the MX values are set to -1.
1315 HOST_FIND_FAILED if no valid hosts with set IP addresses were found
1319 host_scan_for_local_hosts(host_item *host, host_item **lastptr, BOOL *removed)
1321 int yield = HOST_FIND_FAILED;
1322 host_item *last = *lastptr;
1323 host_item *prev = NULL;
1326 if (removed != NULL) *removed = FALSE;
1328 if (local_interface_data == NULL) local_interface_data = host_find_interfaces();
1330 for (h = host; h != last->next; h = h->next)
1333 if (hosts_treat_as_local != NULL)
1336 uschar *save = deliver_domain;
1337 deliver_domain = h->name; /* set $domain */
1338 rc = match_isinlist(string_copylc(h->name), &hosts_treat_as_local, 0,
1339 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL);
1340 deliver_domain = save;
1341 if (rc == OK) goto FOUND_LOCAL;
1345 /* It seems that on many operating systems, 0.0.0.0 is treated as a synonym
1346 for 127.0.0.1 and refers to the local host. We therefore force it always to
1347 be treated as local. */
1349 if (h->address != NULL)
1351 ip_address_item *ip;
1352 if (Ustrcmp(h->address, "0.0.0.0") == 0) goto FOUND_LOCAL;
1353 for (ip = local_interface_data; ip != NULL; ip = ip->next)
1354 if (Ustrcmp(h->address, ip->address) == 0) goto FOUND_LOCAL;
1355 yield = HOST_FOUND; /* At least one remote address has been found */
1358 /* Update prev to point to the last host item before any that have
1359 the same MX value as the one we have just considered. */
1361 if (h->next == NULL || h->next->mx != h->mx) prev = h;
1364 return yield; /* No local hosts found: return HOST_FOUND or HOST_FIND_FAILED */
1366 /* A host whose IP address matches a local IP address, or whose name matches
1367 something in hosts_treat_as_local has been found. */
1373 HDEBUG(D_host_lookup) debug_printf((h->mx >= 0)?
1374 "local host has lowest MX\n" :
1375 "local host found for non-MX address\n");
1376 return HOST_FOUND_LOCAL;
1379 HDEBUG(D_host_lookup)
1381 debug_printf("local host in host list - removed hosts:\n");
1382 for (h = prev->next; h != last->next; h = h->next)
1383 debug_printf(" %s %s %d\n", h->name, h->address, h->mx);
1386 if (removed != NULL) *removed = TRUE;
1387 prev->next = last->next;
1395 /*************************************************
1396 * Remove duplicate IPs in host list *
1397 *************************************************/
1399 /* You would think that administrators could set up their DNS records so that
1400 one ended up with a list of unique IP addresses after looking up A or MX
1401 records, but apparently duplication is common. So we scan such lists and
1402 remove the later duplicates. Note that we may get lists in which some host
1403 addresses are not set.
1406 host pointer to the first host in the chain
1407 lastptr pointer to pointer to the last host in the chain (may be updated)
1413 host_remove_duplicates(host_item *host, host_item **lastptr)
1415 while (host != *lastptr)
1417 if (host->address != NULL)
1419 host_item *h = host;
1420 while (h != *lastptr)
1422 if (h->next->address != NULL &&
1423 Ustrcmp(h->next->address, host->address) == 0)
1425 DEBUG(D_host_lookup) debug_printf("duplicate IP address %s (MX=%d) "
1426 "removed\n", host->address, h->next->mx);
1427 if (h->next == *lastptr) *lastptr = h;
1428 h->next = h->next->next;
1433 /* If the last item was removed, host may have become == *lastptr */
1434 if (host != *lastptr) host = host->next;
1441 /*************************************************
1442 * Find sender host name by gethostbyaddr() *
1443 *************************************************/
1445 /* This used to be the only way it was done, but it turns out that not all
1446 systems give aliases for calls to gethostbyaddr() - or one of the modern
1447 equivalents like getipnodebyaddr(). Fortunately, multiple PTR records are rare,
1448 but they can still exist. This function is now used only when a DNS lookup of
1449 the IP address fails, in order to give access to /etc/hosts.
1452 Returns: OK, DEFER, FAIL
1456 host_name_lookup_byaddr(void)
1460 struct hostent *hosts;
1461 struct in_addr addr;
1463 /* Lookup on IPv6 system */
1466 if (Ustrchr(sender_host_address, ':') != NULL)
1468 struct in6_addr addr6;
1469 if (inet_pton(AF_INET6, CS sender_host_address, &addr6) != 1)
1470 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
1471 "IPv6 address", sender_host_address);
1472 #if HAVE_GETIPNODEBYADDR
1473 hosts = getipnodebyaddr(CS &addr6, sizeof(addr6), AF_INET6, &h_errno);
1475 hosts = gethostbyaddr(CS &addr6, sizeof(addr6), AF_INET6);
1480 if (inet_pton(AF_INET, CS sender_host_address, &addr) != 1)
1481 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
1482 "IPv4 address", sender_host_address);
1483 #if HAVE_GETIPNODEBYADDR
1484 hosts = getipnodebyaddr(CS &addr, sizeof(addr), AF_INET, &h_errno);
1486 hosts = gethostbyaddr(CS &addr, sizeof(addr), AF_INET);
1490 /* Do lookup on IPv4 system */
1493 addr.s_addr = (S_ADDR_TYPE)inet_addr(CS sender_host_address);
1494 hosts = gethostbyaddr(CS(&addr), sizeof(addr), AF_INET);
1497 /* Failed to look up the host. */
1501 HDEBUG(D_host_lookup) debug_printf("IP address lookup failed: h_errno=%d\n",
1503 return (h_errno == TRY_AGAIN || h_errno == NO_RECOVERY) ? DEFER : FAIL;
1506 /* It seems there are some records in the DNS that yield an empty name. We
1507 treat this as non-existent. In some operating systems, this is returned as an
1508 empty string; in others as a single dot. */
1510 if (hosts->h_name == NULL || hosts->h_name[0] == 0 || hosts->h_name[0] == '.')
1512 HDEBUG(D_host_lookup) debug_printf("IP address lookup yielded an empty name: "
1513 "treated as non-existent host name\n");
1517 /* Copy and lowercase the name, which is in static storage in many systems.
1518 Put it in permanent memory. */
1520 s = (uschar *)hosts->h_name;
1521 len = Ustrlen(s) + 1;
1522 t = sender_host_name = store_get_perm(len);
1523 while (*s != 0) *t++ = tolower(*s++);
1526 /* If the host has aliases, build a copy of the alias list */
1528 if (hosts->h_aliases != NULL)
1531 uschar **aliases, **ptr;
1532 for (aliases = USS hosts->h_aliases; *aliases != NULL; aliases++) count++;
1533 ptr = sender_host_aliases = store_get_perm(count * sizeof(uschar *));
1534 for (aliases = USS hosts->h_aliases; *aliases != NULL; aliases++)
1536 uschar *s = *aliases;
1537 int len = Ustrlen(s) + 1;
1538 uschar *t = *ptr++ = store_get_perm(len);
1539 while (*s != 0) *t++ = tolower(*s++);
1550 /*************************************************
1551 * Find host name for incoming call *
1552 *************************************************/
1554 /* Put the name in permanent store, pointed to by sender_host_name. We also set
1555 up a list of alias names, pointed to by sender_host_alias. The list is
1556 NULL-terminated. The incoming address is in sender_host_address, either in
1557 dotted-quad form for IPv4 or in colon-separated form for IPv6.
1559 This function does a thorough check that the names it finds point back to the
1560 incoming IP address. Any that do not are discarded. Note that this is relied on
1561 by the ACL reverse_host_lookup check.
1563 On some systems, get{host,ipnode}byaddr() appears to do this internally, but
1564 this it not universally true. Also, for release 4.30, this function was changed
1565 to do a direct DNS lookup first, by default[1], because it turns out that that
1566 is the only guaranteed way to find all the aliases on some systems. My
1567 experiments indicate that Solaris gethostbyaddr() gives the aliases for but
1570 [1] The actual order is controlled by the host_lookup_order option.
1573 Returns: OK on success, the answer being placed in the global variable
1574 sender_host_name, with any aliases in a list hung off
1576 FAIL if no host name can be found
1577 DEFER if a temporary error was encountered
1579 The variable host_lookup_msg is set to an empty string on sucess, or to a
1580 reason for the failure otherwise, in a form suitable for tagging onto an error
1581 message, and also host_lookup_failed is set TRUE if the lookup failed. If there
1582 was a defer, host_lookup_deferred is set TRUE.
1584 Any dynamically constructed string for host_lookup_msg must be in permanent
1585 store, because it might be used for several incoming messages on the same SMTP
1589 host_name_lookup(void)
1593 uschar *hname, *save_hostname;
1597 uschar *list = host_lookup_order;
1602 sender_host_dnssec = host_lookup_deferred = host_lookup_failed = FALSE;
1604 HDEBUG(D_host_lookup)
1605 debug_printf("looking up host name for %s\n", sender_host_address);
1607 /* For testing the case when a lookup does not complete, we have a special
1608 reserved IP address. */
1610 if (running_in_test_harness &&
1611 Ustrcmp(sender_host_address, "99.99.99.99") == 0)
1613 HDEBUG(D_host_lookup)
1614 debug_printf("Test harness: host name lookup returns DEFER\n");
1615 host_lookup_deferred = TRUE;
1619 /* Do lookups directly in the DNS or via gethostbyaddr() (or equivalent), in
1620 the order specified by the host_lookup_order option. */
1622 while ((ordername = string_nextinlist(&list, &sep, buffer, sizeof(buffer)))
1625 if (strcmpic(ordername, US"bydns") == 0)
1627 dns_init(FALSE, FALSE, FALSE); /*XXX dnssec? */
1628 dns_build_reverse(sender_host_address, buffer);
1629 rc = dns_lookup(&dnsa, buffer, T_PTR, NULL);
1631 /* The first record we come across is used for the name; others are
1632 considered to be aliases. We have to scan twice, in order to find out the
1633 number of aliases. However, if all the names are empty, we will behave as
1634 if failure. (PTR records that yield empty names have been encountered in
1637 if (rc == DNS_SUCCEED)
1639 uschar **aptr = NULL;
1642 int old_pool = store_pool;
1644 /* Ideally we'd check DNSSEC both forward and reverse, but we use the
1645 gethost* routines for forward, so can't do that unless/until we rewrite. */
1646 sender_host_dnssec = dns_is_secure(&dnsa);
1648 debug_printf("Reverse DNS security status: %s\n",
1649 sender_host_dnssec ? "DNSSEC verified (AD)" : "unverified");
1651 store_pool = POOL_PERM; /* Save names in permanent storage */
1653 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1655 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1657 if (rr->type == T_PTR) count++;
1660 /* Get store for the list of aliases. For compatibility with
1661 gethostbyaddr, we make an empty list if there are none. */
1663 aptr = sender_host_aliases = store_get(count * sizeof(uschar *));
1665 /* Re-scan and extract the names */
1667 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1669 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1672 if (rr->type != T_PTR) continue;
1673 s = store_get(ssize);
1675 /* If an overlong response was received, the data will have been
1676 truncated and dn_expand may fail. */
1678 if (dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen,
1679 (uschar *)(rr->data), (DN_EXPAND_ARG4_TYPE)(s), ssize) < 0)
1681 log_write(0, LOG_MAIN, "host name alias list truncated for %s",
1682 sender_host_address);
1686 store_reset(s + Ustrlen(s) + 1);
1689 HDEBUG(D_host_lookup) debug_printf("IP address lookup yielded an "
1690 "empty name: treated as non-existent host name\n");
1693 if (sender_host_name == NULL) sender_host_name = s;
1695 while (*s != 0) { *s = tolower(*s); s++; }
1698 *aptr = NULL; /* End of alias list */
1699 store_pool = old_pool; /* Reset store pool */
1701 /* If we've found a names, break out of the "order" loop */
1703 if (sender_host_name != NULL) break;
1706 /* If the DNS lookup deferred, we must also defer. */
1708 if (rc == DNS_AGAIN)
1710 HDEBUG(D_host_lookup)
1711 debug_printf("IP address PTR lookup gave temporary error\n");
1712 host_lookup_deferred = TRUE;
1717 /* Do a lookup using gethostbyaddr() - or equivalent */
1719 else if (strcmpic(ordername, US"byaddr") == 0)
1721 HDEBUG(D_host_lookup)
1722 debug_printf("IP address lookup using gethostbyaddr()\n");
1723 rc = host_name_lookup_byaddr();
1726 host_lookup_deferred = TRUE;
1727 return rc; /* Can't carry on */
1729 if (rc == OK) break; /* Found a name */
1731 } /* Loop for bydns/byaddr scanning */
1733 /* If we have failed to find a name, return FAIL and log when required.
1734 NB host_lookup_msg must be in permanent store. */
1736 if (sender_host_name == NULL)
1738 if (host_checking || !log_testing_mode)
1739 log_write(L_host_lookup_failed, LOG_MAIN, "no host name found for IP "
1740 "address %s", sender_host_address);
1741 host_lookup_msg = US" (failed to find host name from IP address)";
1742 host_lookup_failed = TRUE;
1746 HDEBUG(D_host_lookup)
1748 uschar **aliases = sender_host_aliases;
1749 debug_printf("IP address lookup yielded %s\n", sender_host_name);
1750 while (*aliases != NULL) debug_printf(" alias %s\n", *aliases++);
1753 /* We need to verify that a forward lookup on the name we found does indeed
1754 correspond to the address. This is for security: in principle a malefactor who
1755 happened to own a reverse zone could set it to point to any names at all.
1757 This code was present in versions of Exim before 3.20. At that point I took it
1758 out because I thought that gethostbyaddr() did the check anyway. It turns out
1759 that this isn't always the case, so it's coming back in at 4.01. This version
1760 is actually better, because it also checks aliases.
1762 The code was made more robust at release 4.21. Prior to that, it accepted all
1763 the names if any of them had the correct IP address. Now the code checks all
1764 the names, and accepts only those that have the correct IP address. */
1766 save_hostname = sender_host_name; /* Save for error messages */
1767 aliases = sender_host_aliases;
1768 for (hname = sender_host_name; hname != NULL; hname = *aliases++)
1778 /* When called with the last argument FALSE, host_find_byname() won't return
1779 HOST_FOUND_LOCAL. If the incoming address is an IPv4 address expressed in
1780 IPv6 format, we must compare the IPv4 part to any IPv4 addresses. */
1782 if ((rc = host_find_byname(&h, NULL, 0, NULL, FALSE)) == HOST_FOUND)
1785 HDEBUG(D_host_lookup) debug_printf("checking addresses for %s\n", hname);
1786 for (hh = &h; hh != NULL; hh = hh->next)
1788 if (host_is_in_net(hh->address, sender_host_address, 0))
1790 HDEBUG(D_host_lookup) debug_printf(" %s OK\n", hh->address);
1796 HDEBUG(D_host_lookup) debug_printf(" %s\n", hh->address);
1799 if (!ok) HDEBUG(D_host_lookup)
1800 debug_printf("no IP address for %s matched %s\n", hname,
1801 sender_host_address);
1803 else if (rc == HOST_FIND_AGAIN)
1805 HDEBUG(D_host_lookup) debug_printf("temporary error for host name lookup\n");
1806 host_lookup_deferred = TRUE;
1807 sender_host_name = NULL;
1812 HDEBUG(D_host_lookup) debug_printf("no IP addresses found for %s\n", hname);
1815 /* If this name is no good, and it's the sender name, set it null pro tem;
1816 if it's an alias, just remove it from the list. */
1820 if (hname == sender_host_name) sender_host_name = NULL; else
1822 uschar **a; /* Don't amalgamate - some */
1823 a = --aliases; /* compilers grumble */
1824 while (*a != NULL) { *a = a[1]; a++; }
1829 /* If sender_host_name == NULL, it means we didn't like the name. Replace
1830 it with the first alias, if there is one. */
1832 if (sender_host_name == NULL && *sender_host_aliases != NULL)
1833 sender_host_name = *sender_host_aliases++;
1835 /* If we now have a main name, all is well. */
1837 if (sender_host_name != NULL) return OK;
1839 /* We have failed to find an address that matches. */
1841 HDEBUG(D_host_lookup)
1842 debug_printf("%s does not match any IP address for %s\n",
1843 sender_host_address, save_hostname);
1845 /* This message must be in permanent store */
1847 old_pool = store_pool;
1848 store_pool = POOL_PERM;
1849 host_lookup_msg = string_sprintf(" (%s does not match any IP address for %s)",
1850 sender_host_address, save_hostname);
1851 store_pool = old_pool;
1852 host_lookup_failed = TRUE;
1859 /*************************************************
1860 * Find IP address(es) for host by name *
1861 *************************************************/
1863 /* The input is a host_item structure with the name filled in and the address
1864 field set to NULL. We use gethostbyname() or getipnodebyname() or
1865 gethostbyname2(), as appropriate. Of course, these functions may use the DNS,
1866 but they do not do MX processing. It appears, however, that in some systems the
1867 current setting of resolver options is used when one of these functions calls
1868 the resolver. For this reason, we call dns_init() at the start, with arguments
1869 influenced by bits in "flags", just as we do for host_find_bydns().
1871 The second argument provides a host list (usually an IP list) of hosts to
1872 ignore. This makes it possible to ignore IPv6 link-local addresses or loopback
1873 addresses in unreasonable places.
1875 The lookup may result in a change of name. For compatibility with the dns
1876 lookup, return this via fully_qualified_name as well as updating the host item.
1877 The lookup may also yield more than one IP address, in which case chain on
1878 subsequent host_item structures.
1881 host a host item with the name and MX filled in;
1882 the address is to be filled in;
1883 multiple IP addresses cause other host items to be
1885 ignore_target_hosts a list of hosts to ignore
1886 flags HOST_FIND_QUALIFY_SINGLE ) passed to
1887 HOST_FIND_SEARCH_PARENTS ) dns_init()
1888 fully_qualified_name if not NULL, set to point to host name for
1889 compatibility with host_find_bydns
1890 local_host_check TRUE if a check for the local host is wanted
1892 Returns: HOST_FIND_FAILED Failed to find the host or domain
1893 HOST_FIND_AGAIN Try again later
1894 HOST_FOUND Host found - data filled in
1895 HOST_FOUND_LOCAL Host found and is the local host
1899 host_find_byname(host_item *host, uschar *ignore_target_hosts, int flags,
1900 uschar **fully_qualified_name, BOOL local_host_check)
1902 int i, yield, times;
1904 host_item *last = NULL;
1905 BOOL temp_error = FALSE;
1910 /* If we are in the test harness, a name ending in .test.again.dns always
1911 forces a temporary error response, unless the name is in
1912 dns_again_means_nonexist. */
1914 if (running_in_test_harness)
1916 uschar *endname = host->name + Ustrlen(host->name);
1917 if (Ustrcmp(endname - 14, "test.again.dns") == 0) goto RETURN_AGAIN;
1920 /* Make sure DNS options are set as required. This appears to be necessary in
1921 some circumstances when the get..byname() function actually calls the DNS. */
1923 dns_init((flags & HOST_FIND_QUALIFY_SINGLE) != 0,
1924 (flags & HOST_FIND_SEARCH_PARENTS) != 0,
1925 FALSE); /*XXX dnssec? */
1927 /* In an IPv6 world, unless IPv6 has been disabled, we need to scan for both
1928 kinds of address, so go round the loop twice. Note that we have ensured that
1929 AF_INET6 is defined even in an IPv4 world, which makes for slightly tidier
1930 code. However, if dns_ipv4_lookup matches the domain, we also just do IPv4
1931 lookups here (except when testing standalone). */
1938 (dns_ipv4_lookup != NULL &&
1939 match_isinlist(host->name, &dns_ipv4_lookup, 0, NULL, NULL, MCL_DOMAIN,
1943 { af = AF_INET; times = 1; }
1945 { af = AF_INET6; times = 2; }
1947 /* No IPv6 support */
1949 #else /* HAVE_IPV6 */
1951 #endif /* HAVE_IPV6 */
1953 /* Initialize the flag that gets set for DNS syntax check errors, so that the
1954 interface to this function can be similar to host_find_bydns. */
1956 host_find_failed_syntax = FALSE;
1958 /* Loop to look up both kinds of address in an IPv6 world */
1960 for (i = 1; i <= times;
1962 af = AF_INET, /* If 2 passes, IPv4 on the second */
1968 struct hostent *hostdata;
1971 printf("Looking up: %s\n", host->name);
1975 if (running_in_test_harness)
1976 hostdata = host_fake_gethostbyname(host->name, af, &error_num);
1979 #if HAVE_GETIPNODEBYNAME
1980 hostdata = getipnodebyname(CS host->name, af, 0, &error_num);
1982 hostdata = gethostbyname2(CS host->name, af);
1983 error_num = h_errno;
1987 #else /* not HAVE_IPV6 */
1988 if (running_in_test_harness)
1989 hostdata = host_fake_gethostbyname(host->name, AF_INET, &error_num);
1992 hostdata = gethostbyname(CS host->name);
1993 error_num = h_errno;
1995 #endif /* HAVE_IPV6 */
1997 if (hostdata == NULL)
2002 case HOST_NOT_FOUND: error = US"HOST_NOT_FOUND"; break;
2003 case TRY_AGAIN: error = US"TRY_AGAIN"; break;
2004 case NO_RECOVERY: error = US"NO_RECOVERY"; break;
2005 case NO_DATA: error = US"NO_DATA"; break;
2006 #if NO_DATA != NO_ADDRESS
2007 case NO_ADDRESS: error = US"NO_ADDRESS"; break;
2009 default: error = US"?"; break;
2012 DEBUG(D_host_lookup) debug_printf("%s returned %d (%s)\n",
2014 #if HAVE_GETIPNODEBYNAME
2015 (af == AF_INET6)? "getipnodebyname(af=inet6)" : "getipnodebyname(af=inet)",
2017 (af == AF_INET6)? "gethostbyname2(af=inet6)" : "gethostbyname2(af=inet)",
2024 if (error_num == TRY_AGAIN || error_num == NO_RECOVERY) temp_error = TRUE;
2027 if ((hostdata->h_addr_list)[0] == NULL) continue;
2029 /* Replace the name with the fully qualified one if necessary, and fill in
2030 the fully_qualified_name pointer. */
2032 if (hostdata->h_name[0] != 0 &&
2033 Ustrcmp(host->name, hostdata->h_name) != 0)
2034 host->name = string_copy_dnsdomain((uschar *)hostdata->h_name);
2035 if (fully_qualified_name != NULL) *fully_qualified_name = host->name;
2037 /* Get the list of addresses. IPv4 and IPv6 addresses can be distinguished
2038 by their different lengths. Scan the list, ignoring any that are to be
2039 ignored, and build a chain from the rest. */
2041 ipv4_addr = hostdata->h_length == sizeof(struct in_addr);
2043 for (addrlist = USS hostdata->h_addr_list; *addrlist != NULL; addrlist++)
2045 uschar *text_address =
2046 host_ntoa(ipv4_addr? AF_INET:AF_INET6, *addrlist, NULL, NULL);
2049 if (ignore_target_hosts != NULL &&
2050 verify_check_this_host(&ignore_target_hosts, NULL, host->name,
2051 text_address, NULL) == OK)
2053 DEBUG(D_host_lookup)
2054 debug_printf("ignored host %s [%s]\n", host->name, text_address);
2059 /* If this is the first address, last == NULL and we put the data in the
2064 host->address = text_address;
2065 host->port = PORT_NONE;
2066 host->status = hstatus_unknown;
2067 host->why = hwhy_unknown;
2071 /* Else add further host item blocks for any other addresses, keeping
2076 host_item *next = store_get(sizeof(host_item));
2077 next->name = host->name;
2078 next->mx = host->mx;
2079 next->address = text_address;
2080 next->port = PORT_NONE;
2081 next->status = hstatus_unknown;
2082 next->why = hwhy_unknown;
2084 next->next = last->next;
2091 /* If no hosts were found, the address field in the original host block will be
2092 NULL. If temp_error is set, at least one of the lookups gave a temporary error,
2093 so we pass that back. */
2095 if (host->address == NULL)
2099 (message_id[0] == 0 && smtp_in != NULL)?
2100 string_sprintf("no IP address found for host %s (during %s)", host->name,
2101 smtp_get_connection_info()) :
2103 string_sprintf("no IP address found for host %s", host->name);
2105 HDEBUG(D_host_lookup) debug_printf("%s\n", msg);
2106 if (temp_error) goto RETURN_AGAIN;
2107 if (host_checking || !log_testing_mode)
2108 log_write(L_host_lookup_failed, LOG_MAIN, "%s", msg);
2109 return HOST_FIND_FAILED;
2112 /* Remove any duplicate IP addresses, then check to see if this is the local
2113 host if required. */
2115 host_remove_duplicates(host, &last);
2116 yield = local_host_check?
2117 host_scan_for_local_hosts(host, &last, NULL) : HOST_FOUND;
2119 HDEBUG(D_host_lookup)
2122 if (fully_qualified_name != NULL)
2123 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
2124 debug_printf("%s looked up these IP addresses:\n",
2126 #if HAVE_GETIPNODEBYNAME
2135 for (h = host; h != last->next; h = h->next)
2136 debug_printf(" name=%s address=%s\n", h->name,
2137 (h->address == NULL)? US"<null>" : h->address);
2140 /* Return the found status. */
2144 /* Handle the case when there is a temporary error. If the name matches
2145 dns_again_means_nonexist, return permanent rather than temporary failure. */
2151 uschar *save = deliver_domain;
2152 deliver_domain = host->name; /* set $domain */
2153 rc = match_isinlist(host->name, &dns_again_means_nonexist, 0, NULL, NULL,
2154 MCL_DOMAIN, TRUE, NULL);
2155 deliver_domain = save;
2158 DEBUG(D_host_lookup) debug_printf("%s is in dns_again_means_nonexist: "
2159 "returning HOST_FIND_FAILED\n", host->name);
2160 return HOST_FIND_FAILED;
2163 return HOST_FIND_AGAIN;
2169 /*************************************************
2170 * Fill in a host address from the DNS *
2171 *************************************************/
2173 /* Given a host item, with its name, port and mx fields set, and its address
2174 field set to NULL, fill in its IP address from the DNS. If it is multi-homed,
2175 create additional host items for the additional addresses, copying all the
2176 other fields, and randomizing the order.
2178 On IPv6 systems, A6 records are sought first (but only if support for A6 is
2179 configured - they may never become mainstream), then AAAA records are sought,
2180 and finally A records are sought as well.
2182 The host name may be changed if the DNS returns a different name - e.g. fully
2183 qualified or changed via CNAME. If fully_qualified_name is not NULL, dns_lookup
2184 ensures that it points to the fully qualified name. However, this is the fully
2185 qualified version of the original name; if a CNAME is involved, the actual
2186 canonical host name may be different again, and so we get it directly from the
2187 relevant RR. Note that we do NOT change the mx field of the host item in this
2188 function as it may be called to set the addresses of hosts taken from MX
2192 host points to the host item we're filling in
2193 lastptr points to pointer to last host item in a chain of
2194 host items (may be updated if host is last and gets
2195 extended because multihomed)
2196 ignore_target_hosts list of hosts to ignore
2197 allow_ip if TRUE, recognize an IP address and return it
2198 fully_qualified_name if not NULL, return fully qualified name here if
2199 the contents are different (i.e. it must be preset
2201 dnnssec_require if TRUE check the DNS result AD bit
2203 Returns: HOST_FIND_FAILED couldn't find A record
2204 HOST_FIND_AGAIN try again later
2205 HOST_FOUND found AAAA and/or A record(s)
2206 HOST_IGNORED found, but all IPs ignored
2210 set_address_from_dns(host_item *host, host_item **lastptr,
2211 uschar *ignore_target_hosts, BOOL allow_ip, uschar **fully_qualified_name,
2212 BOOL dnssec_requested, BOOL dnssec_require)
2215 host_item *thishostlast = NULL; /* Indicates not yet filled in anything */
2216 BOOL v6_find_again = FALSE;
2219 /* If allow_ip is set, a name which is an IP address returns that value
2220 as its address. This is used for MX records when allow_mx_to_ip is set, for
2221 those sites that feel they have to flaunt the RFC rules. */
2223 if (allow_ip && string_is_ip_address(host->name, NULL) != 0)
2226 if (ignore_target_hosts != NULL &&
2227 verify_check_this_host(&ignore_target_hosts, NULL, host->name,
2228 host->name, NULL) == OK)
2229 return HOST_IGNORED;
2232 host->address = host->name;
2236 /* On an IPv6 system, unless IPv6 is disabled, go round the loop up to three
2237 times, looking for A6 and AAAA records the first two times. However, unless
2238 doing standalone testing, we force an IPv4 lookup if the domain matches
2239 dns_ipv4_lookup is set. Since A6 records look like being abandoned, support
2240 them only if explicitly configured to do so. On an IPv4 system, go round the
2241 loop once only, looking only for A records. */
2245 if (disable_ipv6 || (dns_ipv4_lookup != NULL &&
2246 match_isinlist(host->name, &dns_ipv4_lookup, 0, NULL, NULL, MCL_DOMAIN,
2248 i = 0; /* look up A records only */
2250 #endif /* STAND_ALONE */
2253 i = 2; /* look up A6 and AAAA and A records */
2255 i = 1; /* look up AAAA and A records */
2256 #endif /* SUPPORT_A6 */
2258 /* The IPv4 world */
2260 #else /* HAVE_IPV6 */
2261 i = 0; /* look up A records only */
2262 #endif /* HAVE_IPV6 */
2266 static int types[] = { T_A, T_AAAA, T_A6 };
2267 int type = types[i];
2268 int randoffset = (i == 0)? 500 : 0; /* Ensures v6 sorts before v4 */
2272 int rc = dns_lookup(&dnsa, host->name, type, fully_qualified_name);
2273 lookup_dnssec_authenticated = !dnssec_requested ? NULL
2274 : dns_is_secure(&dnsa) ? US"yes" : US"no";
2276 /* We want to return HOST_FIND_AGAIN if one of the A, A6, or AAAA lookups
2277 fails or times out, but not if another one succeeds. (In the early
2278 IPv6 days there are name servers that always fail on AAAA, but are happy
2279 to give out an A record. We want to proceed with that A record.) */
2281 if (rc != DNS_SUCCEED)
2283 if (i == 0) /* Just tried for an A record, i.e. end of loop */
2285 if (host->address != NULL) return HOST_FOUND; /* A6 or AAAA was found */
2286 if (rc == DNS_AGAIN || rc == DNS_FAIL || v6_find_again)
2287 return HOST_FIND_AGAIN;
2288 return HOST_FIND_FAILED; /* DNS_NOMATCH or DNS_NODATA */
2291 /* Tried for an A6 or AAAA record: remember if this was a temporary
2292 error, and look for the next record type. */
2294 if (rc != DNS_NOMATCH && rc != DNS_NODATA) v6_find_again = TRUE;
2297 if (dnssec_require && !dns_is_secure(&dnsa))
2299 log_write(L_host_lookup_failed, LOG_MAIN, "dnssec fail on %s for %.256s",
2300 i>1 ? "A6" : i>0 ? "AAAA" : "A", host->name);
2304 /* Lookup succeeded: fill in the given host item with the first non-ignored
2305 address found; create additional items for any others. A single A6 record
2306 may generate more than one address. */
2308 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2310 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2312 if (rr->type == type)
2314 /* dns_address *da = dns_address_from_rr(&dnsa, rr); */
2317 da = dns_address_from_rr(&dnsa, rr);
2319 DEBUG(D_host_lookup)
2322 debug_printf("no addresses extracted from A6 RR for %s\n",
2326 /* This loop runs only once for A and AAAA records, but may run
2327 several times for an A6 record that generated multiple addresses. */
2329 for (; da != NULL; da = da->next)
2332 if (ignore_target_hosts != NULL &&
2333 verify_check_this_host(&ignore_target_hosts, NULL,
2334 host->name, da->address, NULL) == OK)
2336 DEBUG(D_host_lookup)
2337 debug_printf("ignored host %s [%s]\n", host->name, da->address);
2342 /* If this is the first address, stick it in the given host block,
2343 and change the name if the returned RR has a different name. */
2345 if (thishostlast == NULL)
2347 if (strcmpic(host->name, rr->name) != 0)
2348 host->name = string_copy_dnsdomain(rr->name);
2349 host->address = da->address;
2350 host->sort_key = host->mx * 1000 + random_number(500) + randoffset;
2351 host->status = hstatus_unknown;
2352 host->why = hwhy_unknown;
2353 thishostlast = host;
2356 /* Not the first address. Check for, and ignore, duplicates. Then
2357 insert in the chain at a random point. */
2364 /* End of our local chain is specified by "thishostlast". */
2366 for (next = host;; next = next->next)
2368 if (Ustrcmp(CS da->address, next->address) == 0) break;
2369 if (next == thishostlast) { next = NULL; break; }
2371 if (next != NULL) continue; /* With loop for next address */
2373 /* Not a duplicate */
2375 new_sort_key = host->mx * 1000 + random_number(500) + randoffset;
2376 next = store_get(sizeof(host_item));
2378 /* New address goes first: insert the new block after the first one
2379 (so as not to disturb the original pointer) but put the new address
2380 in the original block. */
2382 if (new_sort_key < host->sort_key)
2384 *next = *host; /* Copies port */
2386 host->address = da->address;
2387 host->sort_key = new_sort_key;
2388 if (thishostlast == host) thishostlast = next; /* Local last */
2389 if (*lastptr == host) *lastptr = next; /* Global last */
2392 /* Otherwise scan down the addresses for this host to find the
2393 one to insert after. */
2397 host_item *h = host;
2398 while (h != thishostlast)
2400 if (new_sort_key < h->next->sort_key) break;
2403 *next = *h; /* Copies port */
2405 next->address = da->address;
2406 next->sort_key = new_sort_key;
2407 if (h == thishostlast) thishostlast = next; /* Local last */
2408 if (h == *lastptr) *lastptr = next; /* Global last */
2416 /* Control gets here only if the third lookup (the A record) succeeded.
2417 However, the address may not be filled in if it was ignored. */
2419 return (host->address == NULL)? HOST_IGNORED : HOST_FOUND;
2425 /*************************************************
2426 * Find IP addresses and host names via DNS *
2427 *************************************************/
2429 /* The input is a host_item structure with the name field filled in and the
2430 address field set to NULL. This may be in a chain of other host items. The
2431 lookup may result in more than one IP address, in which case we must created
2432 new host blocks for the additional addresses, and insert them into the chain.
2433 The original name may not be fully qualified. Use the fully_qualified_name
2434 argument to return the official name, as returned by the resolver.
2437 host point to initial host item
2438 ignore_target_hosts a list of hosts to ignore
2439 whichrrs flags indicating which RRs to look for:
2440 HOST_FIND_BY_SRV => look for SRV
2441 HOST_FIND_BY_MX => look for MX
2442 HOST_FIND_BY_A => look for A or AAAA
2443 also flags indicating how the lookup is done
2444 HOST_FIND_QUALIFY_SINGLE ) passed to the
2445 HOST_FIND_SEARCH_PARENTS ) resolver
2446 srv_service when SRV used, the service name
2447 srv_fail_domains DNS errors for these domains => assume nonexist
2448 mx_fail_domains DNS errors for these domains => assume nonexist
2449 dnssec_request_domains => make dnssec request
2450 dnssec_require_domains => ditto and nonexist failures
2451 fully_qualified_name if not NULL, return fully-qualified name
2452 removed set TRUE if local host was removed from the list
2454 Returns: HOST_FIND_FAILED Failed to find the host or domain;
2455 if there was a syntax error,
2456 host_find_failed_syntax is set.
2457 HOST_FIND_AGAIN Could not resolve at this time
2458 HOST_FOUND Host found
2459 HOST_FOUND_LOCAL The lowest MX record points to this
2460 machine, if MX records were found, or
2461 an A record that was found contains
2462 an address of the local host
2466 host_find_bydns(host_item *host, uschar *ignore_target_hosts, int whichrrs,
2467 uschar *srv_service, uschar *srv_fail_domains, uschar *mx_fail_domains,
2468 uschar *dnssec_request_domains, uschar *dnssec_require_domains,
2469 uschar **fully_qualified_name, BOOL *removed)
2471 host_item *h, *last;
2478 BOOL dnssec_request = match_isinlist(host->name, &dnssec_request_domains,
2479 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL) == OK;
2480 BOOL dnssec_require = match_isinlist(host->name, &dnssec_require_domains,
2481 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL) == OK;
2483 /* Set the default fully qualified name to the incoming name, initialize the
2484 resolver if necessary, set up the relevant options, and initialize the flag
2485 that gets set for DNS syntax check errors. */
2487 if (fully_qualified_name != NULL) *fully_qualified_name = host->name;
2488 dns_init((whichrrs & HOST_FIND_QUALIFY_SINGLE) != 0,
2489 (whichrrs & HOST_FIND_SEARCH_PARENTS) != 0,
2490 dnssec_request || dnssec_require
2492 host_find_failed_syntax = FALSE;
2494 /* First, if requested, look for SRV records. The service name is given; we
2495 assume TCP progocol. DNS domain names are constrained to a maximum of 256
2496 characters, so the code below should be safe. */
2498 if ((whichrrs & HOST_FIND_BY_SRV) != 0)
2501 uschar *temp_fully_qualified_name = buffer;
2504 (void)sprintf(CS buffer, "_%s._tcp.%n%.256s", srv_service, &prefix_length,
2508 /* Search for SRV records. If the fully qualified name is different to
2509 the input name, pass back the new original domain, without the prepended
2512 rc = dns_lookup(&dnsa, buffer, ind_type, &temp_fully_qualified_name);
2513 lookup_dnssec_authenticated = !dnssec_request ? NULL
2514 : dns_is_secure(&dnsa) ? US"yes" : US"no";
2516 if (temp_fully_qualified_name != buffer && fully_qualified_name != NULL)
2517 *fully_qualified_name = temp_fully_qualified_name + prefix_length;
2519 /* On DNS failures, we give the "try again" error unless the domain is
2520 listed as one for which we continue. */
2522 if (rc == DNS_SUCCEED && dnssec_require && !dns_is_secure(&dnsa))
2524 log_write(L_host_lookup_failed, LOG_MAIN,
2525 "dnssec fail on SRV for %.256s", host->name);
2528 if (rc == DNS_FAIL || rc == DNS_AGAIN)
2531 if (match_isinlist(host->name, &srv_fail_domains, 0, NULL, NULL, MCL_DOMAIN,
2534 { yield = HOST_FIND_AGAIN; goto out; }
2535 DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA "
2536 "(domain in srv_fail_domains)\n", (rc == DNS_FAIL)? "FAIL":"AGAIN");
2540 /* If we did not find any SRV records, search the DNS for MX records, if
2541 requested to do so. If the result is DNS_NOMATCH, it means there is no such
2542 domain, and there's no point in going on to look for address records with the
2543 same domain. The result will be DNS_NODATA if the domain exists but has no MX
2544 records. On DNS failures, we give the "try again" error unless the domain is
2545 listed as one for which we continue. */
2547 if (rc != DNS_SUCCEED && (whichrrs & HOST_FIND_BY_MX) != 0)
2550 rc = dns_lookup(&dnsa, host->name, ind_type, fully_qualified_name);
2551 lookup_dnssec_authenticated = !dnssec_request ? NULL
2552 : dns_is_secure(&dnsa) ? US"yes" : US"no";
2557 yield = HOST_FIND_FAILED; goto out;
2560 if (!dnssec_require || dns_is_secure(&dnsa))
2562 log_write(L_host_lookup_failed, LOG_MAIN,
2563 "dnssec fail on MX for %.256s", host->name);
2570 if (match_isinlist(host->name, &mx_fail_domains, 0, NULL, NULL, MCL_DOMAIN,
2573 { yield = HOST_FIND_AGAIN; goto out; }
2574 DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA "
2575 "(domain in mx_fail_domains)\n", (rc == DNS_FAIL)? "FAIL":"AGAIN");
2580 /* If we haven't found anything yet, and we are requested to do so, try for an
2581 A or AAAA record. If we find it (or them) check to see that it isn't the local
2584 if (rc != DNS_SUCCEED)
2586 if ((whichrrs & HOST_FIND_BY_A) == 0)
2588 DEBUG(D_host_lookup) debug_printf("Address records are not being sought\n");
2589 yield = HOST_FIND_FAILED;
2593 last = host; /* End of local chainlet */
2595 host->port = PORT_NONE;
2596 rc = set_address_from_dns(host, &last, ignore_target_hosts, FALSE,
2597 fully_qualified_name, dnssec_request, dnssec_require);
2599 /* If one or more address records have been found, check that none of them
2600 are local. Since we know the host items all have their IP addresses
2601 inserted, host_scan_for_local_hosts() can only return HOST_FOUND or
2602 HOST_FOUND_LOCAL. We do not need to scan for duplicate IP addresses here,
2603 because set_address_from_dns() removes them. */
2605 if (rc == HOST_FOUND)
2606 rc = host_scan_for_local_hosts(host, &last, removed);
2608 if (rc == HOST_IGNORED) rc = HOST_FIND_FAILED; /* No special action */
2610 DEBUG(D_host_lookup)
2613 if (host->address != NULL)
2615 if (fully_qualified_name != NULL)
2616 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
2617 for (h = host; h != last->next; h = h->next)
2618 debug_printf("%s %s mx=%d sort=%d %s\n", h->name,
2619 (h->address == NULL)? US"<null>" : h->address, h->mx, h->sort_key,
2620 (h->status >= hstatus_unusable)? US"*" : US"");
2628 /* We have found one or more MX or SRV records. Sort them according to
2629 precedence. Put the data for the first one into the existing host block, and
2630 insert new host_item blocks into the chain for the remainder. For equal
2631 precedences one is supposed to randomize the order. To make this happen, the
2632 sorting is actually done on the MX value * 1000 + a random number. This is put
2633 into a host field called sort_key.
2635 In the case of hosts with both IPv6 and IPv4 addresses, we want to choose the
2636 IPv6 address in preference. At this stage, we don't know what kind of address
2637 the host has. We choose a random number < 500; if later we find an A record
2638 first, we add 500 to the random number. Then for any other address records, we
2639 use random numbers in the range 0-499 for AAAA records and 500-999 for A
2642 At this point we remove any duplicates that point to the same host, retaining
2643 only the one with the lowest precedence. We cannot yet check for precedence
2644 greater than that of the local host, because that test cannot be properly done
2645 until the addresses have been found - an MX record may point to a name for this
2646 host which is not the primary hostname. */
2648 last = NULL; /* Indicates that not even the first item is filled yet */
2650 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2652 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2655 int weight = 0; /* For SRV records */
2656 int port = PORT_NONE;
2657 uschar *s; /* MUST be unsigned for GETSHORT */
2660 if (rr->type != ind_type) continue;
2662 GETSHORT(precedence, s); /* Pointer s is advanced */
2664 /* For MX records, we use a random "weight" which causes multiple records of
2665 the same precedence to sort randomly. */
2667 if (ind_type == T_MX)
2669 weight = random_number(500);
2672 /* SRV records are specified with a port and a weight. The weight is used
2673 in a special algorithm. However, to start with, we just use it to order the
2674 records of equal priority (precedence). */
2678 GETSHORT(weight, s);
2682 /* Get the name of the host pointed to. */
2684 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, s,
2685 (DN_EXPAND_ARG4_TYPE)data, sizeof(data));
2687 /* Check that we haven't already got this host on the chain; if we have,
2688 keep only the lower precedence. This situation shouldn't occur, but you
2689 never know what junk might get into the DNS (and this case has been seen on
2690 more than one occasion). */
2692 if (last != NULL) /* This is not the first record */
2694 host_item *prev = NULL;
2696 for (h = host; h != last->next; prev = h, h = h->next)
2698 if (strcmpic(h->name, data) == 0)
2700 DEBUG(D_host_lookup)
2701 debug_printf("discarded duplicate host %s (MX=%d)\n", data,
2702 (precedence > h->mx)? precedence : h->mx);
2703 if (precedence >= h->mx) goto NEXT_MX_RR; /* Skip greater precedence */
2704 if (h == host) /* Override first item */
2707 host->sort_key = precedence * 1000 + weight;
2711 /* Unwanted host item is not the first in the chain, so we can get
2712 get rid of it by cutting it out. */
2714 prev->next = h->next;
2715 if (h == last) last = prev;
2721 /* If this is the first MX or SRV record, put the data into the existing host
2722 block. Otherwise, add a new block in the correct place; if it has to be
2723 before the first block, copy the first block's data to a new second block. */
2727 host->name = string_copy_dnsdomain(data);
2728 host->address = NULL;
2730 host->mx = precedence;
2731 host->sort_key = precedence * 1000 + weight;
2732 host->status = hstatus_unknown;
2733 host->why = hwhy_unknown;
2737 /* Make a new host item and seek the correct insertion place */
2741 int sort_key = precedence * 1000 + weight;
2742 host_item *next = store_get(sizeof(host_item));
2743 next->name = string_copy_dnsdomain(data);
2744 next->address = NULL;
2746 next->mx = precedence;
2747 next->sort_key = sort_key;
2748 next->status = hstatus_unknown;
2749 next->why = hwhy_unknown;
2752 /* Handle the case when we have to insert before the first item. */
2754 if (sort_key < host->sort_key)
2761 if (last == host) last = next;
2764 /* Else scan down the items we have inserted as part of this exercise;
2765 don't go further. */
2769 for (h = host; h != last; h = h->next)
2771 if (sort_key < h->next->sort_key)
2773 next->next = h->next;
2779 /* Join on after the last host item that's part of this
2780 processing if we haven't stopped sooner. */
2784 next->next = last->next;
2791 NEXT_MX_RR: continue;
2794 /* If the list of hosts was obtained from SRV records, there are two things to
2795 do. First, if there is only one host, and it's name is ".", it means there is
2796 no SMTP service at this domain. Otherwise, we have to sort the hosts of equal
2797 priority according to their weights, using an algorithm that is defined in RFC
2798 2782. The hosts are currently sorted by priority and weight. For each priority
2799 group we have to pick off one host and put it first, and then repeat for any
2800 remaining in the same priority group. */
2802 if (ind_type == T_SRV)
2806 if (host == last && host->name[0] == 0)
2808 DEBUG(D_host_lookup) debug_printf("the single SRV record is \".\"\n");
2809 yield = HOST_FIND_FAILED;
2813 DEBUG(D_host_lookup)
2815 debug_printf("original ordering of hosts from SRV records:\n");
2816 for (h = host; h != last->next; h = h->next)
2817 debug_printf(" %s P=%d W=%d\n", h->name, h->mx, h->sort_key % 1000);
2820 for (pptr = &host, h = host; h != last; pptr = &(h->next), h = h->next)
2825 /* Find the last following host that has the same precedence. At the same
2826 time, compute the sum of the weights and the running totals. These can be
2827 stored in the sort_key field. */
2829 for (hh = h; hh != last; hh = hh->next)
2831 int weight = hh->sort_key % 1000; /* was precedence * 1000 + weight */
2834 if (hh->mx != hh->next->mx) break;
2837 /* If there's more than one host at this precedence (priority), we need to
2838 pick one to go first. */
2844 int randomizer = random_number(sum + 1);
2846 for (ppptr = pptr, hhh = h;
2848 ppptr = &(hhh->next), hhh = hhh->next)
2850 if (hhh->sort_key >= randomizer) break;
2853 /* hhh now points to the host that should go first; ppptr points to the
2854 place that points to it. Unfortunately, if the start of the minilist is
2855 the start of the entire list, we can't just swap the items over, because
2856 we must not change the value of host, since it is passed in from outside.
2857 One day, this could perhaps be changed.
2859 The special case is fudged by putting the new item *second* in the chain,
2860 and then transferring the data between the first and second items. We
2861 can't just swap the first and the chosen item, because that would mean
2862 that an item with zero weight might no longer be first. */
2866 *ppptr = hhh->next; /* Cuts it out of the chain */
2870 host_item temp = *h;
2873 hhh->next = temp.next;
2879 hhh->next = h; /* The rest of the chain follows it */
2880 *pptr = hhh; /* It takes the place of h */
2881 h = hhh; /* It's now the start of this minilist */
2886 /* A host has been chosen to be first at this priority and h now points
2887 to this host. There may be others at the same priority, or others at a
2888 different priority. Before we leave this host, we need to put back a sort
2889 key of the traditional MX kind, in case this host is multihomed, because
2890 the sort key is used for ordering the multiple IP addresses. We do not need
2891 to ensure that these new sort keys actually reflect the order of the hosts,
2894 h->sort_key = h->mx * 1000 + random_number(500);
2895 } /* Move on to the next host */
2898 /* Now we have to find IP addresses for all the hosts. We have ensured above
2899 that the names in all the host items are unique. Before release 4.61 we used to
2900 process records from the additional section in the DNS packet that returned the
2901 MX or SRV records. However, a DNS name server is free to drop any resource
2902 records from the additional section. In theory, this has always been a
2903 potential problem, but it is exacerbated by the advent of IPv6. If a host had
2904 several IPv4 addresses and some were not in the additional section, at least
2905 Exim would try the others. However, if a host had both IPv4 and IPv6 addresses
2906 and all the IPv4 (say) addresses were absent, Exim would try only for a IPv6
2907 connection, and never try an IPv4 address. When there was only IPv4
2908 connectivity, this was a disaster that did in practice occur.
2910 So, from release 4.61 onwards, we always search for A and AAAA records
2911 explicitly. The names shouldn't point to CNAMES, but we use the general lookup
2912 function that handles them, just in case. If any lookup gives a soft error,
2913 change the default yield.
2915 For these DNS lookups, we must disable qualify_single and search_parents;
2916 otherwise invalid host names obtained from MX or SRV records can cause trouble
2917 if they happen to match something local. */
2919 yield = HOST_FIND_FAILED; /* Default yield */
2920 dns_init(FALSE, FALSE, /* Disable qualify_single and search_parents */
2921 dnssec_request || dnssec_require);
2923 for (h = host; h != last->next; h = h->next)
2925 if (h->address != NULL) continue; /* Inserted by a multihomed host */
2926 rc = set_address_from_dns(h, &last, ignore_target_hosts, allow_mx_to_ip,
2927 NULL, dnssec_request, dnssec_require);
2928 if (rc != HOST_FOUND)
2930 h->status = hstatus_unusable;
2931 if (rc == HOST_FIND_AGAIN)
2934 h->why = hwhy_deferred;
2937 h->why = (rc == HOST_IGNORED)? hwhy_ignored : hwhy_failed;
2941 /* Scan the list for any hosts that are marked unusable because they have
2942 been explicitly ignored, and remove them from the list, as if they did not
2943 exist. If we end up with just a single, ignored host, flatten its fields as if
2944 nothing was found. */
2946 if (ignore_target_hosts != NULL)
2948 host_item *prev = NULL;
2949 for (h = host; h != last->next; h = h->next)
2952 if (h->why != hwhy_ignored) /* Non ignored host, just continue */
2954 else if (prev == NULL) /* First host is ignored */
2956 if (h != last) /* First is not last */
2958 if (h->next == last) last = h; /* Overwrite it with next */
2959 *h = *(h->next); /* and reprocess it. */
2960 goto REDO; /* C should have redo, like Perl */
2963 else /* Ignored host is not first - */
2965 prev->next = h->next;
2966 if (h == last) last = prev;
2970 if (host->why == hwhy_ignored) host->address = NULL;
2973 /* There is still one complication in the case of IPv6. Although the code above
2974 arranges that IPv6 addresses take precedence over IPv4 addresses for multihomed
2975 hosts, it doesn't do this for addresses that apply to different hosts with the
2976 same MX precedence, because the sorting on MX precedence happens first. So we
2977 have to make another pass to check for this case. We ensure that, within a
2978 single MX preference value, IPv6 addresses come first. This can separate the
2979 addresses of a multihomed host, but that should not matter. */
2982 if (h != last && !disable_ipv6)
2984 for (h = host; h != last; h = h->next)
2987 host_item *next = h->next;
2988 if (h->mx != next->mx || /* If next is different MX */
2989 h->address == NULL || /* OR this one is unset */
2990 Ustrchr(h->address, ':') != NULL || /* OR this one is IPv6 */
2991 (next->address != NULL &&
2992 Ustrchr(next->address, ':') == NULL)) /* OR next is IPv4 */
2993 continue; /* move on to next */
2994 temp = *h; /* otherwise, swap */
2995 temp.next = next->next;
3003 /* Remove any duplicate IP addresses and then scan the list of hosts for any
3004 whose IP addresses are on the local host. If any are found, all hosts with the
3005 same or higher MX values are removed. However, if the local host has the lowest
3006 numbered MX, then HOST_FOUND_LOCAL is returned. Otherwise, if at least one host
3007 with an IP address is on the list, HOST_FOUND is returned. Otherwise,
3008 HOST_FIND_FAILED is returned, but in this case do not update the yield, as it
3009 might have been set to HOST_FIND_AGAIN just above here. If not, it will already
3010 be HOST_FIND_FAILED. */
3012 host_remove_duplicates(host, &last);
3013 rc = host_scan_for_local_hosts(host, &last, removed);
3014 if (rc != HOST_FIND_FAILED) yield = rc;
3016 DEBUG(D_host_lookup)
3018 if (fully_qualified_name != NULL)
3019 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
3020 debug_printf("host_find_bydns yield = %s (%d); returned hosts:\n",
3021 (yield == HOST_FOUND)? "HOST_FOUND" :
3022 (yield == HOST_FOUND_LOCAL)? "HOST_FOUND_LOCAL" :
3023 (yield == HOST_FIND_AGAIN)? "HOST_FIND_AGAIN" :
3024 (yield == HOST_FIND_FAILED)? "HOST_FIND_FAILED" : "?",
3026 for (h = host; h != last->next; h = h->next)
3028 debug_printf(" %s %s MX=%d ", h->name,
3029 (h->address == NULL)? US"<null>" : h->address, h->mx);
3030 if (h->port != PORT_NONE) debug_printf("port=%d ", h->port);
3031 if (h->status >= hstatus_unusable) debug_printf("*");
3038 dns_init(FALSE, FALSE, FALSE); /* clear the dnssec bit for getaddrbyname */
3045 /*************************************************
3046 **************************************************
3047 * Stand-alone test program *
3048 **************************************************
3049 *************************************************/
3053 int main(int argc, char **cargv)
3056 int whichrrs = HOST_FIND_BY_MX | HOST_FIND_BY_A;
3057 BOOL byname = FALSE;
3058 BOOL qualify_single = TRUE;
3059 BOOL search_parents = FALSE;
3060 BOOL request_dnssec = FALSE;
3061 BOOL require_dnssec = FALSE;
3062 uschar **argv = USS cargv;
3065 disable_ipv6 = FALSE;
3066 primary_hostname = US"";
3067 store_pool = POOL_MAIN;
3068 debug_selector = D_host_lookup|D_interface;
3069 debug_file = stdout;
3070 debug_fd = fileno(debug_file);
3072 printf("Exim stand-alone host functions test\n");
3074 host_find_interfaces();
3075 debug_selector = D_host_lookup | D_dns;
3077 if (argc > 1) primary_hostname = argv[1];
3079 /* So that debug level changes can be done first */
3081 dns_init(qualify_single, search_parents, FALSE);
3083 printf("Testing host lookup\n");
3085 while (Ufgets(buffer, 256, stdin) != NULL)
3088 int len = Ustrlen(buffer);
3089 uschar *fully_qualified_name;
3091 while (len > 0 && isspace(buffer[len-1])) len--;
3094 if (Ustrcmp(buffer, "q") == 0) break;
3096 if (Ustrcmp(buffer, "byname") == 0) byname = TRUE;
3097 else if (Ustrcmp(buffer, "no_byname") == 0) byname = FALSE;
3098 else if (Ustrcmp(buffer, "a_only") == 0) whichrrs = HOST_FIND_BY_A;
3099 else if (Ustrcmp(buffer, "mx_only") == 0) whichrrs = HOST_FIND_BY_MX;
3100 else if (Ustrcmp(buffer, "srv_only") == 0) whichrrs = HOST_FIND_BY_SRV;
3101 else if (Ustrcmp(buffer, "srv+a") == 0)
3102 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_A;
3103 else if (Ustrcmp(buffer, "srv+mx") == 0)
3104 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_MX;
3105 else if (Ustrcmp(buffer, "srv+mx+a") == 0)
3106 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_MX | HOST_FIND_BY_A;
3107 else if (Ustrcmp(buffer, "qualify_single") == 0) qualify_single = TRUE;
3108 else if (Ustrcmp(buffer, "no_qualify_single") == 0) qualify_single = FALSE;
3109 else if (Ustrcmp(buffer, "search_parents") == 0) search_parents = TRUE;
3110 else if (Ustrcmp(buffer, "no_search_parents") == 0) search_parents = FALSE;
3111 else if (Ustrcmp(buffer, "request_dnssec") == 0) request_dnssec = TRUE;
3112 else if (Ustrcmp(buffer, "no_request_dnssec") == 0) request_dnssec = FALSE;
3113 else if (Ustrcmp(buffer, "require_dnssec") == 0) require_dnssec = TRUE;
3114 else if (Ustrcmp(buffer, "no_reqiret_dnssec") == 0) require_dnssec = FALSE;
3115 else if (Ustrcmp(buffer, "test_harness") == 0)
3116 running_in_test_harness = !running_in_test_harness;
3117 else if (Ustrcmp(buffer, "ipv6") == 0) disable_ipv6 = !disable_ipv6;
3118 else if (Ustrcmp(buffer, "res_debug") == 0)
3120 _res.options ^= RES_DEBUG;
3122 else if (Ustrncmp(buffer, "retrans", 7) == 0)
3124 (void)sscanf(CS(buffer+8), "%d", &dns_retrans);
3125 _res.retrans = dns_retrans;
3127 else if (Ustrncmp(buffer, "retry", 5) == 0)
3129 (void)sscanf(CS(buffer+6), "%d", &dns_retry);
3130 _res.retry = dns_retry;
3134 int flags = whichrrs;
3140 h.status = hstatus_unknown;
3141 h.why = hwhy_unknown;
3144 if (qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
3145 if (search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
3148 ? host_find_byname(&h, NULL, flags, &fully_qualified_name, TRUE)
3149 : host_find_bydns(&h, NULL, flags, US"smtp", NULL, NULL,
3150 request_dnssec ? &h.name : NULL,
3151 require_dnssec ? &h.name : NULL,
3152 &fully_qualified_name, NULL);
3154 if (rc == HOST_FIND_FAILED) printf("Failed\n");
3155 else if (rc == HOST_FIND_AGAIN) printf("Again\n");
3156 else if (rc == HOST_FOUND_LOCAL) printf("Local\n");
3162 printf("Testing host_aton\n");
3164 while (Ufgets(buffer, 256, stdin) != NULL)
3168 int len = Ustrlen(buffer);
3170 while (len > 0 && isspace(buffer[len-1])) len--;
3173 if (Ustrcmp(buffer, "q") == 0) break;
3175 len = host_aton(buffer, x);
3176 printf("length = %d ", len);
3177 for (i = 0; i < len; i++)
3179 printf("%04x ", (x[i] >> 16) & 0xffff);
3180 printf("%04x ", x[i] & 0xffff);
3187 printf("Testing host_name_lookup\n");
3189 while (Ufgets(buffer, 256, stdin) != NULL)
3191 int len = Ustrlen(buffer);
3192 while (len > 0 && isspace(buffer[len-1])) len--;
3194 if (Ustrcmp(buffer, "q") == 0) break;
3195 sender_host_address = buffer;
3196 sender_host_name = NULL;
3197 sender_host_aliases = NULL;
3198 host_lookup_msg = US"";
3199 host_lookup_failed = FALSE;
3200 if (host_name_lookup() == FAIL) /* Debug causes printing */
3201 printf("Lookup failed:%s\n", host_lookup_msg);
3209 #endif /* STAND_ALONE */