1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Functions for finding hosts, either by gethostbyname(), gethostbyaddr(), or
10 directly via the DNS. When IPv6 is supported, getipnodebyname() and
11 getipnodebyaddr() may be used instead of gethostbyname() and gethostbyaddr(),
12 if the newer functions are available. This module also contains various other
13 functions concerned with hosts and addresses, and a random number function,
14 used for randomizing hosts with equal MXs but available for use in other parts
21 /* Static variable for preserving the list of interface addresses in case it is
22 used more than once. */
24 static ip_address_item *local_interface_data = NULL;
27 #ifdef USE_INET_NTOA_FIX
28 /*************************************************
29 * Replacement for broken inet_ntoa() *
30 *************************************************/
32 /* On IRIX systems, gcc uses a different structure passing convention to the
33 native libraries. This causes inet_ntoa() to always yield 0.0.0.0 or
34 255.255.255.255. To get round this, we provide a private version of the
35 function here. It is used only if USE_INET_NTOA_FIX is set, which should happen
36 only when gcc is in use on an IRIX system. Code send to me by J.T. Breitner,
40 as seen in comp.sys.sgi.admin
42 August 2005: Apparently this is also needed for AIX systems; USE_INET_NTOA_FIX
43 should now be set for them as well.
45 Arguments: sa an in_addr structure
46 Returns: pointer to static text string
50 inet_ntoa(struct in_addr sa)
52 static uschar addr[20];
53 sprintf(addr, "%d.%d.%d.%d",
64 /*************************************************
65 * Random number generator *
66 *************************************************/
68 /* This is a simple pseudo-random number generator. It does not have to be
69 very good for the uses to which it is put. When running the regression tests,
70 start with a fixed seed.
72 If you need better, see vaguely_random_number() which is potentially stronger,
73 if a crypto library is available, but might end up just calling this instead.
76 limit: one more than the largest number required
78 Returns: a pseudo-random number in the range 0 to limit-1
82 random_number(int limit)
88 if (f.running_in_test_harness) random_seed = 42; else
90 int p = (int)getpid();
91 random_seed = (int)time(NULL) ^ ((p << 16) | p);
94 random_seed = 1103515245 * random_seed + 12345;
95 return (unsigned int)(random_seed >> 16) % limit;
98 /*************************************************
99 * Wrappers for logging lookup times *
100 *************************************************/
102 /* When the 'slow_lookup_log' variable is enabled, these wrappers will
103 write to the log file all (potential) dns lookups that take more than
104 slow_lookup_log milliseconds
108 log_long_lookup(const uschar * type, const uschar * data, unsigned long msec)
110 log_write(0, LOG_MAIN, "Long %s lookup for '%s': %lu msec",
115 /* returns the current system epoch time in milliseconds. */
119 struct timeval tmp_time;
120 unsigned long seconds, microseconds;
122 gettimeofday(&tmp_time, NULL);
123 seconds = (unsigned long) tmp_time.tv_sec;
124 microseconds = (unsigned long) tmp_time.tv_usec;
125 return seconds*1000 + microseconds/1000;
130 dns_lookup_timerwrap(dns_answer *dnsa, const uschar *name, int type,
131 const uschar **fully_qualified_name)
134 unsigned long time_msec;
136 if (!slow_lookup_log)
137 return dns_lookup(dnsa, name, type, fully_qualified_name);
139 time_msec = get_time_in_ms();
140 retval = dns_lookup(dnsa, name, type, fully_qualified_name);
141 if ((time_msec = get_time_in_ms() - time_msec) > slow_lookup_log)
142 log_long_lookup(dns_text_type(type), name, time_msec);
147 /*************************************************
148 * Replace gethostbyname() when testing *
149 *************************************************/
151 /* This function is called instead of gethostbyname(), gethostbyname2(), or
152 getipnodebyname() when running in the test harness. . It also
153 recognizes an unqualified "localhost" and forces it to the appropriate loopback
154 address. IP addresses are treated as literals. For other names, it uses the DNS
155 to find the host name. In the test harness, this means it will access only the
159 name the host name or a textual IP address
160 af AF_INET or AF_INET6
161 error_num where to put an error code:
162 HOST_NOT_FOUND/TRY_AGAIN/NO_RECOVERY/NO_DATA
164 Returns: a hostent structure or NULL for an error
167 static struct hostent *
168 host_fake_gethostbyname(const uschar *name, int af, int *error_num)
171 int alen = (af == AF_INET)? sizeof(struct in_addr):sizeof(struct in6_addr);
173 int alen = sizeof(struct in_addr);
177 const uschar *lname = name;
180 struct hostent *yield;
181 dns_answer * dnsa = store_get_dns_answer();
185 debug_printf("using host_fake_gethostbyname for %s (%s)\n", name,
186 af == AF_INET ? "IPv4" : "IPv6");
188 /* Handle unqualified "localhost" */
190 if (Ustrcmp(name, "localhost") == 0)
191 lname = af == AF_INET ? US"127.0.0.1" : US"::1";
193 /* Handle a literal IP address */
195 if ((ipa = string_is_ip_address(lname, NULL)) != 0)
196 if ( ipa == 4 && af == AF_INET
197 || ipa == 6 && af == AF_INET6)
200 yield = store_get(sizeof(struct hostent), GET_UNTAINTED);
201 alist = store_get(2 * sizeof(char *), GET_UNTAINTED);
202 adds = store_get(alen, GET_UNTAINTED);
203 yield->h_name = CS name;
204 yield->h_aliases = NULL;
205 yield->h_addrtype = af;
206 yield->h_length = alen;
207 yield->h_addr_list = CSS alist;
209 for (int n = host_aton(lname, x), i = 0; i < n; i++)
212 *adds++ = (y >> 24) & 255;
213 *adds++ = (y >> 16) & 255;
214 *adds++ = (y >> 8) & 255;
220 /* Wrong kind of literal address */
224 *error_num = HOST_NOT_FOUND;
229 /* Handle a host name */
233 int type = af == AF_INET ? T_A:T_AAAA;
234 int rc = dns_lookup_timerwrap(dnsa, lname, type, NULL);
237 lookup_dnssec_authenticated = NULL;
241 case DNS_SUCCEED: break;
242 case DNS_NOMATCH: *error_num = HOST_NOT_FOUND; yield = NULL; goto out;
243 case DNS_NODATA: *error_num = NO_DATA; yield = NULL; goto out;
244 case DNS_AGAIN: *error_num = TRY_AGAIN; yield = NULL; goto out;
246 case DNS_FAIL: *error_num = NO_RECOVERY; yield = NULL; goto out;
249 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
251 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == type)
254 yield = store_get(sizeof(struct hostent), GET_UNTAINTED);
255 alist = store_get((count + 1) * sizeof(char *), GET_UNTAINTED);
256 adds = store_get(count *alen, GET_UNTAINTED);
258 yield->h_name = CS name;
259 yield->h_aliases = NULL;
260 yield->h_addrtype = af;
261 yield->h_length = alen;
262 yield->h_addr_list = CSS alist;
264 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
266 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == type)
270 if (!(da = dns_address_from_rr(dnsa, rr))) break;
272 for (int n = host_aton(da->address, x), i = 0; i < n; i++)
275 *adds++ = (y >> 24) & 255;
276 *adds++ = (y >> 16) & 255;
277 *adds++ = (y >> 8) & 255;
286 store_free_dns_answer(dnsa);
292 /*************************************************
293 * Build chain of host items from list *
294 *************************************************/
296 /* This function builds a chain of host items from a textual list of host
297 names. It does not do any lookups. If randomize is true, the chain is build in
298 a randomized order. There may be multiple groups of independently randomized
299 hosts; they are delimited by a host name consisting of just "+".
302 anchor anchor for the chain
304 randomize TRUE for randomizing
310 host_build_hostlist(host_item **anchor, const uschar *list, BOOL randomize)
313 int fake_mx = MX_NONE; /* This value is actually -1 */
317 if (randomize) fake_mx--; /* Start at -2 for randomizing */
321 while ((name = string_nextinlist(&list, &sep, NULL, 0)))
325 if (name[0] == '+' && name[1] == 0) /* "+" delimits a randomized group */
326 { /* ignore if not randomizing */
327 if (randomize) fake_mx--;
331 h = store_get(sizeof(host_item), GET_UNTAINTED);
336 h->sort_key = randomize ? (-fake_mx)*1000 + random_number(1000) : 0;
337 h->status = hstatus_unknown;
338 h->why = hwhy_unknown;
348 host_item *hh = *anchor;
349 if (h->sort_key < hh->sort_key)
356 while (hh->next && h->sort_key >= hh->next->sort_key)
369 /*************************************************
370 * Extract port from address string *
371 *************************************************/
373 /* In the -oMa and -oMi options, a host plus port is given as an IP address
374 followed by a dot and a port number. This function decodes this.
376 An alternative format for the -oMa and -oMi options is [ip address]:port which
377 is what Exim uses for output, because it seems to becoming commonly used,
378 whereas the dot form confuses some programs/people. So we recognize that form
381 The spool file used to use the first form, but this breaks with a v4mapped ipv6
382 hybrid, because the parsing here is not clever. So for spool we now use the
386 address points to the string; if there is a port, the '.' in the string
387 is overwritten with zero to terminate the address; if the string
388 is in the [xxx]:ppp format, the address is shifted left and the
391 Returns: 0 if there is no port, else the port number. If there's a syntax
392 error, leave the incoming address alone, and return 0.
396 host_address_extract_port(uschar *address)
401 /* Handle the "bracketed with colon on the end" format */
405 uschar *rb = address + 1;
406 while (*rb != 0 && *rb != ']') rb++;
407 if (*rb++ == 0) return 0; /* Missing ]; leave invalid address */
410 port = Ustrtol(rb + 1, &endptr, 10);
411 if (*endptr != 0) return 0; /* Invalid port; leave invalid address */
413 else if (*rb != 0) return 0; /* Bad syntax; leave invalid address */
414 memmove(address, address + 1, rb - address - 2);
418 /* Handle the "dot on the end" format */
422 int skip = -3; /* Skip 3 dots in IPv4 addresses */
424 while (*(++address) != 0)
427 if (ch == ':') skip = 0; /* Skip 0 dots in IPv6 addresses */
428 else if (ch == '.' && skip++ >= 0) break;
430 if (*address == 0) return 0;
431 port = Ustrtol(address + 1, &endptr, 10);
432 if (*endptr != 0) return 0; /* Invalid port; leave invalid address */
440 /*************************************************
441 * Get port from a host item's name *
442 *************************************************/
444 /* This function is called when finding the IP address for a host that is in a
445 list of hosts explicitly configured, such as in the manualroute router, or in a
446 fallback hosts list. We see if there is a port specification at the end of the
447 host name, and if so, remove it. A minimum length of 3 is required for the
448 original name; nothing shorter is recognized as having a port.
450 We test for a name ending with a sequence of digits; if preceded by colon we
451 have a port if the character before the colon is ] and the name starts with [
452 or if there are no other colons in the name (i.e. it's not an IPv6 address).
454 Arguments: pointer to the host item
455 Returns: a port number or PORT_NONE
459 host_item_get_port(host_item *h)
463 int len = Ustrlen(h->name);
465 if (len < 3 || (p = h->name + len - 1, !isdigit(*p))) return PORT_NONE;
467 /* Extract potential port number */
472 while (p > h->name + 1 && isdigit(*p))
474 port += (*p-- - '0') * x;
478 /* The smallest value of p at this point is h->name + 1. */
480 if (*p != ':') return PORT_NONE;
482 if (p[-1] == ']' && h->name[0] == '[')
483 h->name = string_copyn(h->name + 1, p - h->name - 2);
484 else if (Ustrchr(h->name, ':') == p)
485 h->name = string_copyn(h->name, p - h->name);
486 else return PORT_NONE;
488 DEBUG(D_route|D_host_lookup) debug_printf("host=%s port=%d\n", h->name, port);
494 #ifndef STAND_ALONE /* Omit when standalone testing */
496 /*************************************************
497 * Build sender_fullhost and sender_rcvhost *
498 *************************************************/
500 /* This function is called when sender_host_name and/or sender_helo_name
501 have been set. Or might have been set - for a local message read off the spool
502 they won't be. In that case, do nothing. Otherwise, set up the fullhost string
505 (a) No sender_host_name or sender_helo_name: "[ip address]"
506 (b) Just sender_host_name: "host_name [ip address]"
507 (c) Just sender_helo_name: "(helo_name) [ip address]" unless helo is IP
508 in which case: "[ip address}"
509 (d) The two are identical: "host_name [ip address]" includes helo = IP
510 (e) The two are different: "host_name (helo_name) [ip address]"
512 If log_incoming_port is set, the sending host's port number is added to the IP
515 This function also builds sender_rcvhost for use in Received: lines, whose
516 syntax is a bit different. This value also includes the RFC 1413 identity.
517 There wouldn't be two different variables if I had got all this right in the
520 Because this data may survive over more than one incoming SMTP message, it has
521 to be in permanent store. However, STARTTLS has to be forgotten and redone
522 on a multi-message conn, so this will be called once per message then. Hence
523 we use malloc, so we can free.
530 host_build_sender_fullhost(void)
532 BOOL show_helo = TRUE;
533 uschar * address, * fullhost, * rcvhost;
537 if (!sender_host_address) return;
539 reset_point = store_mark();
541 /* Set up address, with or without the port. After discussion, it seems that
542 the only format that doesn't cause trouble is [aaaa]:pppp. However, we can't
543 use this directly as the first item for Received: because it ain't an RFC 2822
546 address = string_sprintf("[%s]:%d", sender_host_address, sender_host_port);
547 if (!LOGGING(incoming_port) || sender_host_port <= 0)
548 *(Ustrrchr(address, ':')) = 0;
550 /* If there's no EHLO/HELO data, we can't show it. */
552 if (!sender_helo_name) show_helo = FALSE;
554 /* If HELO/EHLO was followed by an IP literal, it's messy because of two
555 features of IPv6. Firstly, there's the "IPv6:" prefix (Exim is liberal and
556 doesn't require this, for historical reasons). Secondly, IPv6 addresses may not
557 be given in canonical form, so we have to canonicalize them before comparing. As
558 it happens, the code works for both IPv4 and IPv6. */
560 else if (sender_helo_name[0] == '[' &&
561 sender_helo_name[(len=Ustrlen(sender_helo_name))-1] == ']')
566 if (strncmpic(sender_helo_name + 1, US"IPv6:", 5) == 0) offset += 5;
567 if (strncmpic(sender_helo_name + 1, US"IPv4:", 5) == 0) offset += 5;
569 helo_ip = string_copyn(sender_helo_name + offset, len - offset - 1);
571 if (string_is_ip_address(helo_ip, NULL) != 0)
575 uschar ipx[48], ipy[48]; /* large enough for full IPv6 */
577 sizex = host_aton(helo_ip, x);
578 sizey = host_aton(sender_host_address, y);
580 (void)host_nmtoa(sizex, x, -1, ipx, ':');
581 (void)host_nmtoa(sizey, y, -1, ipy, ':');
583 if (strcmpic(ipx, ipy) == 0) show_helo = FALSE;
587 /* Host name is not verified */
589 if (!sender_host_name)
591 uschar *portptr = Ustrstr(address, "]:");
593 int adlen; /* Sun compiler doesn't like ++ in initializers */
595 adlen = portptr ? (++portptr - address) : Ustrlen(address);
596 fullhost = sender_helo_name
597 ? string_sprintf("(%s) %s", sender_helo_name, address)
600 g = string_catn(NULL, address, adlen);
602 if (sender_ident || show_helo || portptr)
605 g = string_catn(g, US" (", 2);
609 g = string_append(g, 2, US"port=", portptr + 1);
612 g = string_append(g, 2,
613 firstptr == g->ptr ? US"helo=" : US" helo=", sender_helo_name);
616 g = string_append(g, 2,
617 firstptr == g->ptr ? US"ident=" : US" ident=", sender_ident);
619 g = string_catn(g, US")", 1);
622 rcvhost = string_from_gstring(g);
625 /* Host name is known and verified. Unless we've already found that the HELO
626 data matches the IP address, compare it with the name. */
630 if (show_helo && strcmpic(sender_host_name, sender_helo_name) == 0)
635 fullhost = string_sprintf("%s (%s) %s", sender_host_name,
636 sender_helo_name, address);
637 rcvhost = sender_ident
638 ? string_sprintf("%s\n\t(%s helo=%s ident=%s)", sender_host_name,
639 address, sender_helo_name, sender_ident)
640 : string_sprintf("%s (%s helo=%s)", sender_host_name,
641 address, sender_helo_name);
645 fullhost = string_sprintf("%s %s", sender_host_name, address);
646 rcvhost = sender_ident
647 ? string_sprintf("%s (%s ident=%s)", sender_host_name, address,
649 : string_sprintf("%s (%s)", sender_host_name, address);
653 sender_fullhost = string_copy_perm(fullhost, TRUE);
654 sender_rcvhost = string_copy_perm(rcvhost, TRUE);
656 store_reset(reset_point);
658 DEBUG(D_host_lookup) debug_printf("sender_fullhost = %s\n", sender_fullhost);
659 DEBUG(D_host_lookup) debug_printf("sender_rcvhost = %s\n", sender_rcvhost);
664 /*************************************************
665 * Build host+ident message *
666 *************************************************/
668 /* Used when logging rejections and various ACL and SMTP incidents. The text
669 return depends on whether sender_fullhost and sender_ident are set or not:
671 no ident, no host => U=unknown
672 no ident, host set => H=sender_fullhost
673 ident set, no host => U=ident
674 ident set, host set => H=sender_fullhost U=ident
676 Use taint-unchecked routines on the assumption we'll never expand the results.
679 useflag TRUE if first item to be flagged (H= or U=); if there are two
680 items, the second is always flagged
682 Returns: pointer to a string in big_buffer
686 host_and_ident(BOOL useflag)
688 if (!sender_fullhost)
689 string_format_nt(big_buffer, big_buffer_size, "%s%s", useflag ? "U=" : "",
690 sender_ident ? sender_ident : US"unknown");
693 uschar * flag = useflag ? US"H=" : US"";
694 uschar * iface = US"";
695 if (LOGGING(incoming_interface) && interface_address)
696 iface = string_sprintf(" I=[%s]:%d", interface_address, interface_port);
698 string_format_nt(big_buffer, big_buffer_size, "%s%s%s U=%s",
699 flag, sender_fullhost, iface, sender_ident);
701 string_format_nt(big_buffer, big_buffer_size, "%s%s%s",
702 flag, sender_fullhost, iface);
707 #endif /* STAND_ALONE */
712 /*************************************************
713 * Build list of local interfaces *
714 *************************************************/
716 /* This function interprets the contents of the local_interfaces or
717 extra_local_interfaces options, and creates an ip_address_item block for each
718 item on the list. There is no special interpretation of any IP addresses; in
719 particular, 0.0.0.0 and ::0 are returned without modification. If any address
720 includes a port, it is set in the block. Otherwise the port value is set to
725 name the name of the option being expanded
727 Returns: a chain of ip_address_items, each containing to a textual
728 version of an IP address, and a port number (host order) or
729 zero if no port was given with the address
733 host_build_ifacelist(const uschar *list, uschar *name)
737 ip_address_item * yield = NULL, * last = NULL, * next;
739 while ((s = string_nextinlist(&list, &sep, NULL, 0)))
742 int port = host_address_extract_port(s); /* Leaves just the IP address */
744 if (!(ipv = string_is_ip_address(s, NULL)))
745 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Malformed IP address \"%s\" in %s",
748 /* Skip IPv6 addresses if IPv6 is disabled. */
750 if (disable_ipv6 && ipv == 6) continue;
752 /* This use of strcpy() is OK because we have checked that s is a valid IP
753 address above. The field in the ip_address_item is large enough to hold an
756 next = store_get(sizeof(ip_address_item), list);
758 Ustrcpy(next->address, s);
760 next->v6_include_v4 = FALSE;
779 /*************************************************
780 * Find addresses on local interfaces *
781 *************************************************/
783 /* This function finds the addresses of local IP interfaces. These are used
784 when testing for routing to the local host. As the function may be called more
785 than once, the list is preserved in permanent store, pointed to by a static
786 variable, to save doing the work more than once per process.
788 The generic list of interfaces is obtained by calling host_build_ifacelist()
789 for local_interfaces and extra_local_interfaces. This list scanned to remove
790 duplicates (which may exist with different ports - not relevant here). If
791 either of the wildcard IP addresses (0.0.0.0 and ::0) are encountered, they are
792 replaced by the appropriate (IPv4 or IPv6) list of actual local interfaces,
793 obtained from os_find_running_interfaces().
796 Returns: a chain of ip_address_items, each containing to a textual
797 version of an IP address; the port numbers are not relevant
801 /* First, a local subfunction to add an interface to a list in permanent store,
802 but only if there isn't a previous copy of that address on the list. */
804 static ip_address_item *
805 add_unique_interface(ip_address_item *list, ip_address_item *ipa)
807 ip_address_item *ipa2;
808 for (ipa2 = list; ipa2; ipa2 = ipa2->next)
809 if (Ustrcmp(ipa2->address, ipa->address) == 0) return list;
810 ipa2 = store_get_perm(sizeof(ip_address_item), FALSE);
817 /* This is the globally visible function */
820 host_find_interfaces(void)
822 ip_address_item *running_interfaces = NULL;
824 if (!local_interface_data)
826 void *reset_item = store_mark();
827 ip_address_item *dlist = host_build_ifacelist(CUS local_interfaces,
828 US"local_interfaces");
829 ip_address_item *xlist = host_build_ifacelist(CUS extra_local_interfaces,
830 US"extra_local_interfaces");
831 ip_address_item *ipa;
833 if (!dlist) dlist = xlist;
836 for (ipa = dlist; ipa->next; ipa = ipa->next) ;
840 for (ipa = dlist; ipa; ipa = ipa->next)
842 if (Ustrcmp(ipa->address, "0.0.0.0") == 0 ||
843 Ustrcmp(ipa->address, "::0") == 0)
845 BOOL ipv6 = ipa->address[0] == ':';
846 if (!running_interfaces)
847 running_interfaces = os_find_running_interfaces();
848 for (ip_address_item * ipa2 = running_interfaces; ipa2; ipa2 = ipa2->next)
849 if ((Ustrchr(ipa2->address, ':') != NULL) == ipv6)
850 local_interface_data = add_unique_interface(local_interface_data,
855 local_interface_data = add_unique_interface(local_interface_data, ipa);
858 debug_printf("Configured local interface: address=%s", ipa->address);
859 if (ipa->port != 0) debug_printf(" port=%d", ipa->port);
864 store_reset(reset_item);
867 return local_interface_data;
874 /*************************************************
875 * Convert network IP address to text *
876 *************************************************/
878 /* Given an IPv4 or IPv6 address in binary, convert it to a text
879 string and return the result in a piece of new store. The address can
880 either be given directly, or passed over in a sockaddr structure. Note
881 that this isn't the converse of host_aton() because of byte ordering
882 differences. See host_nmtoa() below.
885 type if < 0 then arg points to a sockaddr, else
886 either AF_INET or AF_INET6
887 arg points to a sockaddr if type is < 0, or
888 points to an IPv4 address (32 bits), or
889 points to an IPv6 address (128 bits),
890 in both cases, in network byte order
891 buffer if NULL, the result is returned in gotten store;
892 else points to a buffer to hold the answer
893 portptr points to where to put the port number, if non NULL; only
896 Returns: pointer to character string
900 host_ntoa(int type, const void *arg, uschar *buffer, int *portptr)
904 /* The new world. It is annoying that we have to fish out the address from
905 different places in the block, depending on what kind of address it is. It
906 is also a pain that inet_ntop() returns a const uschar *, whereas the IPv4
907 function inet_ntoa() returns just uschar *, and some picky compilers insist
908 on warning if one assigns a const uschar * to a uschar *. Hence the casts. */
911 uschar addr_buffer[46];
914 int family = ((struct sockaddr *)arg)->sa_family;
915 if (family == AF_INET6)
917 struct sockaddr_in6 *sk = (struct sockaddr_in6 *)arg;
918 yield = US inet_ntop(family, &(sk->sin6_addr), CS addr_buffer,
919 sizeof(addr_buffer));
920 if (portptr) *portptr = ntohs(sk->sin6_port);
924 struct sockaddr_in *sk = (struct sockaddr_in *)arg;
925 yield = US inet_ntop(family, &(sk->sin_addr), CS addr_buffer,
926 sizeof(addr_buffer));
927 if (portptr) *portptr = ntohs(sk->sin_port);
932 yield = US inet_ntop(type, arg, CS addr_buffer, sizeof(addr_buffer));
935 /* If the result is a mapped IPv4 address, show it in V4 format. */
937 if (Ustrncmp(yield, "::ffff:", 7) == 0) yield += 7;
939 #else /* HAVE_IPV6 */
945 yield = US inet_ntoa(((struct sockaddr_in *)arg)->sin_addr);
946 if (portptr) *portptr = ntohs(((struct sockaddr_in *)arg)->sin_port);
949 yield = US inet_ntoa(*((struct in_addr *)arg));
952 /* If there is no buffer, put the string into some new store. */
954 if (!buffer) buffer = store_get(46, GET_UNTAINTED);
956 /* Callers of this function with a non-NULL buffer must ensure that it is
957 large enough to hold an IPv6 address, namely, at least 46 bytes. That's what
958 makes this use of strcpy() OK.
959 If the library returned apparently an apparently tainted string, clean it;
960 we trust IP addresses. */
962 string_format_nt(buffer, 46, "%s", yield);
969 /*************************************************
970 * Convert address text to binary *
971 *************************************************/
973 /* Given the textual form of an IP address, convert it to binary in an
974 array of ints. IPv4 addresses occupy one int; IPv6 addresses occupy 4 ints.
975 The result has the first byte in the most significant byte of the first int. In
976 other words, the result is not in network byte order, but in host byte order.
977 As a result, this is not the converse of host_ntoa(), which expects network
978 byte order. See host_nmtoa() below.
981 address points to the textual address, checked for syntax
982 bin points to an array of 4 ints
984 Returns: the number of ints used
988 host_aton(const uschar *address, int *bin)
993 /* Handle IPv6 address, which may end with an IPv4 address. It may also end
994 with a "scope", introduced by a percent sign. This code is NOT enclosed in #if
995 HAVE_IPV6 in order that IPv6 addresses are recognized even if IPv6 is not
998 if (Ustrchr(address, ':') != NULL)
1000 const uschar *p = address;
1001 const uschar *component[8];
1002 BOOL ipv4_ends = FALSE;
1008 /* If the address starts with a colon, it will start with two colons.
1009 Just lose the first one, which will leave a null first component. */
1013 /* Split the address into components separated by colons. The input address
1014 is supposed to be checked for syntax. There was a case where this was
1015 overlooked; to guard against that happening again, check here and crash if
1016 there are too many components. */
1018 while (*p != 0 && *p != '%')
1020 int len = Ustrcspn(p, ":%");
1021 if (len == 0) nulloffset = ci;
1022 if (ci > 7) log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1023 "Internal error: invalid IPv6 address \"%s\" passed to host_aton()",
1025 component[ci++] = p;
1030 /* If the final component contains a dot, it is a trailing v4 address.
1031 As the syntax is known to be checked, just set up for a trailing
1032 v4 address and restrict the v6 part to 6 components. */
1034 if (Ustrchr(component[ci-1], '.') != NULL)
1036 address = component[--ci];
1042 /* If there are fewer than 6 or 8 components, we have to insert some
1043 more empty ones in the middle. */
1047 int insert_count = v6count - ci;
1048 for (i = v6count-1; i > nulloffset + insert_count; i--)
1049 component[i] = component[i - insert_count];
1050 while (i > nulloffset) component[i--] = US"";
1053 /* Now turn the components into binary in pairs and bung them
1054 into the vector of ints. */
1056 for (i = 0; i < v6count; i += 2)
1057 bin[i/2] = (Ustrtol(component[i], NULL, 16) << 16) +
1058 Ustrtol(component[i+1], NULL, 16);
1060 /* If there was no terminating v4 component, we are done. */
1062 if (!ipv4_ends) return 4;
1065 /* Handle IPv4 address */
1067 (void)sscanf(CS address, "%d.%d.%d.%d", x, x+1, x+2, x+3);
1068 bin[v4offset] = ((uint)x[0] << 24) + (x[1] << 16) + (x[2] << 8) + x[3];
1073 /*************************************************
1074 * Apply mask to an IP address *
1075 *************************************************/
1077 /* Mask an address held in 1 or 4 ints, with the ms bit in the ms bit of the
1081 count the number of ints
1082 binary points to the ints to be masked
1083 mask the count of ms bits to leave, or -1 if no masking
1089 host_mask(int count, int *binary, int mask)
1091 if (mask < 0) mask = 99999;
1092 for (int i = 0; i < count; i++)
1095 if (mask == 0) wordmask = 0;
1098 wordmask = (uint)(-1) << (32 - mask);
1106 binary[i] &= wordmask;
1113 /*************************************************
1114 * Convert masked IP address in ints to text *
1115 *************************************************/
1117 /* We can't use host_ntoa() because it assumes the binary values are in network
1118 byte order, and these are the result of host_aton(), which puts them in ints in
1119 host byte order. Also, we really want IPv6 addresses to be in a canonical
1120 format, so we output them with no abbreviation. In a number of cases we can't
1121 use the normal colon separator in them because it terminates keys in lsearch
1122 files, so we want to use dot instead. There's an argument that specifies what
1123 to use for IPv6 addresses.
1126 count 1 or 4 (number of ints)
1127 binary points to the ints
1128 mask mask value; if < 0 don't add to result
1129 buffer big enough to hold the result
1130 sep component separator character for IPv6 addresses
1132 Returns: the number of characters placed in buffer, not counting
1137 host_nmtoa(int count, int *binary, int mask, uschar *buffer, int sep)
1140 uschar *tt = buffer;
1145 for (int i = 24; i >= 0; i -= 8)
1146 tt += sprintf(CS tt, "%d.", (j >> i) & 255);
1149 for (int i = 0; i < 4; i++)
1152 tt += sprintf(CS tt, "%04x%c%04x%c", (j >> 16) & 0xffff, sep, j & 0xffff, sep);
1155 tt--; /* lose final separator */
1160 tt += sprintf(CS tt, "/%d", mask);
1166 /* Like host_nmtoa() but: ipv6-only, canonical output, no mask
1169 binary points to the ints
1170 buffer big enough to hold the result
1172 Returns: the number of characters placed in buffer, not counting
1177 ipv6_nmtoa(int * binary, uschar * buffer)
1180 uschar * c = buffer;
1181 uschar * d = NULL; /* shut insufficiently "clever" compiler up */
1183 for (i = 0; i < 4; i++)
1184 { /* expand to text */
1186 c += sprintf(CS c, "%x:%x:", (j >> 16) & 0xffff, j & 0xffff);
1189 for (c = buffer, k = -1, i = 0; i < 8; i++)
1190 { /* find longest 0-group sequence */
1191 if (*c == '0') /* must be "0:" */
1195 while (c[2] == '0') i++, c += 2;
1198 k = i-j; /* length of sequence */
1199 d = s; /* start of sequence */
1202 while (*++c != ':') ;
1206 *--c = '\0'; /* drop trailing colon */
1208 /* debug_printf("%s: D k %d <%s> <%s>\n", __FUNCTION__, k, buffer, buffer + 2*(k+1)); */
1212 if (d == buffer) c--; /* need extra colon */
1213 *d++ = ':'; /* 1st 0 */
1214 while ((*d++ = *c++)) ;
1224 /*************************************************
1225 * Check port for tls_on_connect *
1226 *************************************************/
1228 /* This function checks whether a given incoming port is configured for tls-
1229 on-connect. It is called from the daemon and from inetd handling. If the global
1230 option tls_on_connect is already set, all ports operate this way. Otherwise, we
1231 check the tls_on_connect_ports option for a list of ports.
1233 Argument: a port number
1234 Returns: TRUE or FALSE
1238 host_is_tls_on_connect_port(int port)
1241 const uschar * list = tls_in.on_connect_ports;
1243 if (tls_in.on_connect) return TRUE;
1245 for (uschar * s, * end; s = string_nextinlist(&list, &sep, NULL, 0); )
1246 if (Ustrtol(s, &end, 10) == port)
1254 /*************************************************
1255 * Check whether host is in a network *
1256 *************************************************/
1258 /* This function checks whether a given IP address matches a pattern that
1259 represents either a single host, or a network (using CIDR notation). The caller
1260 of this function must check the syntax of the arguments before calling it.
1263 host string representation of the ip-address to check
1264 net string representation of the network, with optional CIDR mask
1265 maskoffset offset to the / that introduces the mask in the key
1266 zero if there is no mask
1269 TRUE the host is inside the network
1270 FALSE the host is NOT inside the network
1274 host_is_in_net(const uschar *host, const uschar *net, int maskoffset)
1279 int size = host_aton(net, address);
1282 /* No mask => all bits to be checked */
1284 if (maskoffset == 0) mlen = 99999; /* Big number */
1285 else mlen = Uatoi(net + maskoffset + 1);
1287 /* Convert the incoming address to binary. */
1289 insize = host_aton(host, incoming);
1291 /* Convert IPv4 addresses given in IPv6 compatible mode, which represent
1292 connections from IPv4 hosts to IPv6 hosts, that is, addresses of the form
1293 ::ffff:<v4address>, to IPv4 format. */
1295 if (insize == 4 && incoming[0] == 0 && incoming[1] == 0 &&
1296 incoming[2] == 0xffff)
1299 incoming[0] = incoming[3];
1302 /* No match if the sizes don't agree. */
1304 if (insize != size) return FALSE;
1306 /* Else do the masked comparison. */
1308 for (int i = 0; i < size; i++)
1311 if (mlen == 0) mask = 0;
1314 mask = (uint)(-1) << (32 - mlen);
1322 if ((incoming[i] & mask) != (address[i] & mask)) return FALSE;
1330 /*************************************************
1331 * Scan host list for local hosts *
1332 *************************************************/
1334 /* Scan through a chain of addresses and check whether any of them is the
1335 address of an interface on the local machine. If so, remove that address and
1336 any previous ones with the same MX value, and all subsequent ones (which will
1337 have greater or equal MX values) from the chain. Note: marking them as unusable
1338 is NOT the right thing to do because it causes the hosts not to be used for
1339 other domains, for which they may well be correct.
1341 The hosts may be part of a longer chain; we only process those between the
1342 initial pointer and the "last" pointer.
1344 There is also a list of "pseudo-local" host names which are checked against the
1345 host names. Any match causes that host item to be treated the same as one which
1346 matches a local IP address.
1348 If the very first host is a local host, then all MX records had a precedence
1349 greater than or equal to that of the local host. Either there's a problem in
1350 the DNS, or an apparently remote name turned out to be an abbreviation for the
1351 local host. Give a specific return code, and let the caller decide what to do.
1352 Otherwise, give a success code if at least one host address has been found.
1355 host pointer to the first host in the chain
1356 lastptr pointer to pointer to the last host in the chain (may be updated)
1357 removed if not NULL, set TRUE if some local addresses were removed
1361 HOST_FOUND if there is at least one host with an IP address on the chain
1362 and an MX value less than any MX value associated with the
1364 HOST_FOUND_LOCAL if a local host is among the lowest-numbered MX hosts; when
1365 the host addresses were obtained from A records or
1366 gethostbyname(), the MX values are set to -1.
1367 HOST_FIND_FAILED if no valid hosts with set IP addresses were found
1371 host_scan_for_local_hosts(host_item *host, host_item **lastptr, BOOL *removed)
1373 int yield = HOST_FIND_FAILED;
1374 host_item *last = *lastptr;
1375 host_item *prev = NULL;
1378 if (removed != NULL) *removed = FALSE;
1380 if (local_interface_data == NULL) local_interface_data = host_find_interfaces();
1382 for (h = host; h != last->next; h = h->next)
1385 if (hosts_treat_as_local != NULL)
1388 const uschar *save = deliver_domain;
1389 deliver_domain = h->name; /* set $domain */
1390 rc = match_isinlist(string_copylc(h->name), CUSS &hosts_treat_as_local, 0,
1391 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL);
1392 deliver_domain = save;
1393 if (rc == OK) goto FOUND_LOCAL;
1397 /* It seems that on many operating systems, 0.0.0.0 is treated as a synonym
1398 for 127.0.0.1 and refers to the local host. We therefore force it always to
1399 be treated as local. */
1401 if (h->address != NULL)
1403 if (Ustrcmp(h->address, "0.0.0.0") == 0) goto FOUND_LOCAL;
1404 for (ip_address_item * ip = local_interface_data; ip; ip = ip->next)
1405 if (Ustrcmp(h->address, ip->address) == 0) goto FOUND_LOCAL;
1406 yield = HOST_FOUND; /* At least one remote address has been found */
1409 /* Update prev to point to the last host item before any that have
1410 the same MX value as the one we have just considered. */
1412 if (h->next == NULL || h->next->mx != h->mx) prev = h;
1415 return yield; /* No local hosts found: return HOST_FOUND or HOST_FIND_FAILED */
1417 /* A host whose IP address matches a local IP address, or whose name matches
1418 something in hosts_treat_as_local has been found. */
1424 HDEBUG(D_host_lookup) debug_printf((h->mx >= 0)?
1425 "local host has lowest MX\n" :
1426 "local host found for non-MX address\n");
1427 return HOST_FOUND_LOCAL;
1430 HDEBUG(D_host_lookup)
1432 debug_printf("local host in host list - removed hosts:\n");
1433 for (h = prev->next; h != last->next; h = h->next)
1434 debug_printf(" %s %s %d\n", h->name, h->address, h->mx);
1437 if (removed != NULL) *removed = TRUE;
1438 prev->next = last->next;
1446 /*************************************************
1447 * Remove duplicate IPs in host list *
1448 *************************************************/
1450 /* You would think that administrators could set up their DNS records so that
1451 one ended up with a list of unique IP addresses after looking up A or MX
1452 records, but apparently duplication is common. So we scan such lists and
1453 remove the later duplicates. Note that we may get lists in which some host
1454 addresses are not set.
1457 host pointer to the first host in the chain
1458 lastptr pointer to pointer to the last host in the chain (may be updated)
1464 host_remove_duplicates(host_item *host, host_item **lastptr)
1466 while (host != *lastptr)
1468 if (host->address != NULL)
1470 host_item *h = host;
1471 while (h != *lastptr)
1473 if (h->next->address != NULL &&
1474 Ustrcmp(h->next->address, host->address) == 0)
1476 DEBUG(D_host_lookup) debug_printf("duplicate IP address %s (MX=%d) "
1477 "removed\n", host->address, h->next->mx);
1478 if (h->next == *lastptr) *lastptr = h;
1479 h->next = h->next->next;
1484 /* If the last item was removed, host may have become == *lastptr */
1485 if (host != *lastptr) host = host->next;
1492 /*************************************************
1493 * Find sender host name by gethostbyaddr() *
1494 *************************************************/
1496 /* This used to be the only way it was done, but it turns out that not all
1497 systems give aliases for calls to gethostbyaddr() - or one of the modern
1498 equivalents like getipnodebyaddr(). Fortunately, multiple PTR records are rare,
1499 but they can still exist. This function is now used only when a DNS lookup of
1500 the IP address fails, in order to give access to /etc/hosts.
1503 Returns: OK, DEFER, FAIL
1507 host_name_lookup_byaddr(void)
1509 struct hostent * hosts;
1510 struct in_addr addr;
1511 unsigned long time_msec = 0; /* init to quieten dumb static analysis */
1513 if (slow_lookup_log) time_msec = get_time_in_ms();
1515 /* Lookup on IPv6 system */
1518 if (Ustrchr(sender_host_address, ':') != NULL)
1520 struct in6_addr addr6;
1521 if (inet_pton(AF_INET6, CS sender_host_address, &addr6) != 1)
1522 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
1523 "IPv6 address", sender_host_address);
1524 #if HAVE_GETIPNODEBYADDR
1525 hosts = getipnodebyaddr(CS &addr6, sizeof(addr6), AF_INET6, &h_errno);
1527 hosts = gethostbyaddr(CS &addr6, sizeof(addr6), AF_INET6);
1532 if (inet_pton(AF_INET, CS sender_host_address, &addr) != 1)
1533 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
1534 "IPv4 address", sender_host_address);
1535 #if HAVE_GETIPNODEBYADDR
1536 hosts = getipnodebyaddr(CS &addr, sizeof(addr), AF_INET, &h_errno);
1538 hosts = gethostbyaddr(CS &addr, sizeof(addr), AF_INET);
1542 /* Do lookup on IPv4 system */
1545 addr.s_addr = (S_ADDR_TYPE)inet_addr(CS sender_host_address);
1546 hosts = gethostbyaddr(CS(&addr), sizeof(addr), AF_INET);
1549 if ( slow_lookup_log
1550 && (time_msec = get_time_in_ms() - time_msec) > slow_lookup_log
1552 log_long_lookup(US"gethostbyaddr", sender_host_address, time_msec);
1554 /* Failed to look up the host. */
1558 HDEBUG(D_host_lookup) debug_printf("IP address lookup failed: h_errno=%d\n",
1560 return (h_errno == TRY_AGAIN || h_errno == NO_RECOVERY) ? DEFER : FAIL;
1563 /* It seems there are some records in the DNS that yield an empty name. We
1564 treat this as non-existent. In some operating systems, this is returned as an
1565 empty string; in others as a single dot. */
1567 if (!hosts->h_name || !hosts->h_name[0] || hosts->h_name[0] == '.')
1569 HDEBUG(D_host_lookup) debug_printf("IP address lookup yielded an empty name: "
1570 "treated as non-existent host name\n");
1574 /* Copy and lowercase the name, which is in static storage in many systems.
1575 Put it in permanent memory. */
1578 int old_pool = store_pool;
1579 store_pool = POOL_TAINT_PERM; /* names are tainted */
1581 sender_host_name = string_copylc(US hosts->h_name);
1583 /* If the host has aliases, build a copy of the alias list */
1585 if (hosts->h_aliases)
1587 int count = 1; /* need 1 more for terminating NULL */
1590 for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++) count++;
1591 store_pool = POOL_PERM;
1592 ptr = sender_host_aliases = store_get(count * sizeof(uschar *), GET_UNTAINTED);
1593 store_pool = POOL_TAINT_PERM;
1595 for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++)
1596 *ptr++ = string_copylc(*aliases);
1599 store_pool = old_pool;
1607 /*************************************************
1608 * Find host name for incoming call *
1609 *************************************************/
1611 /* Put the name in permanent store, pointed to by sender_host_name. We also set
1612 up a list of alias names, pointed to by sender_host_alias. The list is
1613 NULL-terminated. The incoming address is in sender_host_address, either in
1614 dotted-quad form for IPv4 or in colon-separated form for IPv6.
1616 This function does a thorough check that the names it finds point back to the
1617 incoming IP address. Any that do not are discarded. Note that this is relied on
1618 by the ACL reverse_host_lookup check.
1620 On some systems, get{host,ipnode}byaddr() appears to do this internally, but
1621 this it not universally true. Also, for release 4.30, this function was changed
1622 to do a direct DNS lookup first, by default[1], because it turns out that that
1623 is the only guaranteed way to find all the aliases on some systems. My
1624 experiments indicate that Solaris gethostbyaddr() gives the aliases for but
1627 [1] The actual order is controlled by the host_lookup_order option.
1630 Returns: OK on success, the answer being placed in the global variable
1631 sender_host_name, with any aliases in a list hung off
1633 FAIL if no host name can be found
1634 DEFER if a temporary error was encountered
1636 The variable host_lookup_msg is set to an empty string on success, or to a
1637 reason for the failure otherwise, in a form suitable for tagging onto an error
1638 message, and also host_lookup_failed is set TRUE if the lookup failed. If there
1639 was a defer, host_lookup_deferred is set TRUE.
1641 Any dynamically constructed string for host_lookup_msg must be in permanent
1642 store, because it might be used for several incoming messages on the same SMTP
1646 host_name_lookup(void)
1650 uschar *save_hostname;
1653 const uschar *list = host_lookup_order;
1654 dns_answer * dnsa = store_get_dns_answer();
1657 sender_host_dnssec = host_lookup_deferred = host_lookup_failed = FALSE;
1659 HDEBUG(D_host_lookup)
1660 debug_printf("looking up host name for %s\n", sender_host_address);
1662 /* For testing the case when a lookup does not complete, we have a special
1663 reserved IP address. */
1665 if (f.running_in_test_harness &&
1666 Ustrcmp(sender_host_address, "99.99.99.99") == 0)
1668 HDEBUG(D_host_lookup)
1669 debug_printf("Test harness: host name lookup returns DEFER\n");
1670 host_lookup_deferred = TRUE;
1674 /* Do lookups directly in the DNS or via gethostbyaddr() (or equivalent), in
1675 the order specified by the host_lookup_order option. */
1677 while ((ordername = string_nextinlist(&list, &sep, NULL, 0)))
1679 if (strcmpic(ordername, US"bydns") == 0)
1681 uschar * name = dns_build_reverse(sender_host_address);
1683 dns_init(FALSE, FALSE, FALSE); /* dnssec ctrl by dns_dnssec_ok glbl */
1684 rc = dns_lookup_timerwrap(dnsa, name, T_PTR, NULL);
1686 /* The first record we come across is used for the name; others are
1687 considered to be aliases. We have to scan twice, in order to find out the
1688 number of aliases. However, if all the names are empty, we will behave as
1689 if failure. (PTR records that yield empty names have been encountered in
1692 if (rc == DNS_SUCCEED)
1694 uschar **aptr = NULL;
1696 int count = 1; /* need 1 more for terminating NULL */
1697 int old_pool = store_pool;
1699 sender_host_dnssec = dns_is_secure(dnsa);
1701 debug_printf("Reverse DNS security status: %s\n",
1702 sender_host_dnssec ? "DNSSEC verified (AD)" : "unverified");
1704 store_pool = POOL_PERM; /* Save names in permanent storage */
1706 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1708 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_PTR)
1711 /* Get store for the list of aliases. For compatibility with
1712 gethostbyaddr, we make an empty list if there are none. */
1714 aptr = sender_host_aliases = store_get(count * sizeof(uschar *), GET_UNTAINTED);
1716 /* Re-scan and extract the names */
1718 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1720 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_PTR)
1722 uschar * s = store_get(ssize, GET_TAINTED); /* names are tainted */
1724 /* If an overlong response was received, the data will have been
1725 truncated and dn_expand may fail. */
1727 if (dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
1728 US (rr->data), (DN_EXPAND_ARG4_TYPE)(s), ssize) < 0)
1730 log_write(0, LOG_MAIN, "host name alias list truncated for %s",
1731 sender_host_address);
1735 store_release_above(s + Ustrlen(s) + 1);
1738 HDEBUG(D_host_lookup) debug_printf("IP address lookup yielded an "
1739 "empty name: treated as non-existent host name\n");
1742 if (!sender_host_name) sender_host_name = s;
1744 while (*s) { *s = tolower(*s); s++; }
1747 *aptr = NULL; /* End of alias list */
1748 store_pool = old_pool; /* Reset store pool */
1750 /* If we've found a name, break out of the "order" loop */
1752 if (sender_host_name) break;
1755 /* If the DNS lookup deferred, we must also defer. */
1757 if (rc == DNS_AGAIN)
1759 HDEBUG(D_host_lookup)
1760 debug_printf("IP address PTR lookup gave temporary error\n");
1761 host_lookup_deferred = TRUE;
1766 /* Do a lookup using gethostbyaddr() - or equivalent */
1768 else if (strcmpic(ordername, US"byaddr") == 0)
1770 HDEBUG(D_host_lookup)
1771 debug_printf("IP address lookup using gethostbyaddr()\n");
1772 rc = host_name_lookup_byaddr();
1775 host_lookup_deferred = TRUE;
1776 return rc; /* Can't carry on */
1778 if (rc == OK) break; /* Found a name */
1780 } /* Loop for bydns/byaddr scanning */
1782 /* If we have failed to find a name, return FAIL and log when required.
1783 NB host_lookup_msg must be in permanent store. */
1785 if (!sender_host_name)
1787 if (host_checking || !f.log_testing_mode)
1788 log_write(L_host_lookup_failed, LOG_MAIN, "no host name found for IP "
1789 "address %s", sender_host_address);
1790 host_lookup_msg = US" (failed to find host name from IP address)";
1791 host_lookup_failed = TRUE;
1795 HDEBUG(D_host_lookup)
1797 uschar **aliases = sender_host_aliases;
1798 debug_printf("IP address lookup yielded \"%s\"\n", sender_host_name);
1799 while (*aliases) debug_printf(" alias \"%s\"\n", *aliases++);
1802 /* We need to verify that a forward lookup on the name we found does indeed
1803 correspond to the address. This is for security: in principle a malefactor who
1804 happened to own a reverse zone could set it to point to any names at all.
1806 This code was present in versions of Exim before 3.20. At that point I took it
1807 out because I thought that gethostbyaddr() did the check anyway. It turns out
1808 that this isn't always the case, so it's coming back in at 4.01. This version
1809 is actually better, because it also checks aliases.
1811 The code was made more robust at release 4.21. Prior to that, it accepted all
1812 the names if any of them had the correct IP address. Now the code checks all
1813 the names, and accepts only those that have the correct IP address. */
1815 save_hostname = sender_host_name; /* Save for error messages */
1816 aliases = sender_host_aliases;
1817 for (uschar * hname = sender_host_name; hname; hname = *aliases++)
1821 host_item h = { .next = NULL, .name = hname, .mx = MX_NONE, .address = NULL };
1823 { .request = sender_host_dnssec ? US"*" : NULL, .require = NULL };
1825 if ( (rc = host_find_bydns(&h, NULL, HOST_FIND_BY_A | HOST_FIND_BY_AAAA,
1826 NULL, NULL, NULL, &d, NULL, NULL)) == HOST_FOUND
1827 || rc == HOST_FOUND_LOCAL
1830 HDEBUG(D_host_lookup) debug_printf("checking addresses for %s\n", hname);
1832 /* If the forward lookup was not secure we cancel the is-secure variable */
1834 DEBUG(D_dns) debug_printf("Forward DNS security status: %s\n",
1835 h.dnssec == DS_YES ? "DNSSEC verified (AD)" : "unverified");
1836 if (h.dnssec != DS_YES) sender_host_dnssec = FALSE;
1838 for (host_item * hh = &h; hh; hh = hh->next)
1839 if (host_is_in_net(hh->address, sender_host_address, 0))
1841 HDEBUG(D_host_lookup) debug_printf(" %s OK\n", hh->address);
1846 HDEBUG(D_host_lookup) debug_printf(" %s\n", hh->address);
1848 if (!ok) HDEBUG(D_host_lookup)
1849 debug_printf("no IP address for %s matched %s\n", hname,
1850 sender_host_address);
1852 else if (rc == HOST_FIND_AGAIN)
1854 HDEBUG(D_host_lookup) debug_printf("temporary error for host name lookup\n");
1855 host_lookup_deferred = TRUE;
1856 sender_host_name = NULL;
1860 HDEBUG(D_host_lookup) debug_printf("no IP addresses found for %s\n", hname);
1862 /* If this name is no good, and it's the sender name, set it null pro tem;
1863 if it's an alias, just remove it from the list. */
1867 if (hname == sender_host_name) sender_host_name = NULL; else
1869 uschar **a; /* Don't amalgamate - some */
1870 a = --aliases; /* compilers grumble */
1871 while (*a != NULL) { *a = a[1]; a++; }
1876 /* If sender_host_name == NULL, it means we didn't like the name. Replace
1877 it with the first alias, if there is one. */
1879 if (sender_host_name == NULL && *sender_host_aliases != NULL)
1880 sender_host_name = *sender_host_aliases++;
1882 /* If we now have a main name, all is well. */
1884 if (sender_host_name != NULL) return OK;
1886 /* We have failed to find an address that matches. */
1888 HDEBUG(D_host_lookup)
1889 debug_printf("%s does not match any IP address for %s\n",
1890 sender_host_address, save_hostname);
1892 /* This message must be in permanent store */
1894 old_pool = store_pool;
1895 store_pool = POOL_PERM;
1896 host_lookup_msg = string_sprintf(" (%s does not match any IP address for %s)",
1897 sender_host_address, save_hostname);
1898 store_pool = old_pool;
1899 host_lookup_failed = TRUE;
1906 /*************************************************
1907 * Find IP address(es) for host by name *
1908 *************************************************/
1910 /* The input is a host_item structure with the name filled in and the address
1911 field set to NULL. We use gethostbyname() or getipnodebyname() or
1912 gethostbyname2(), as appropriate. Of course, these functions may use the DNS,
1913 but they do not do MX processing. It appears, however, that in some systems the
1914 current setting of resolver options is used when one of these functions calls
1915 the resolver. For this reason, we call dns_init() at the start, with arguments
1916 influenced by bits in "flags", just as we do for host_find_bydns().
1918 The second argument provides a host list (usually an IP list) of hosts to
1919 ignore. This makes it possible to ignore IPv6 link-local addresses or loopback
1920 addresses in unreasonable places.
1922 The lookup may result in a change of name. For compatibility with the dns
1923 lookup, return this via fully_qualified_name as well as updating the host item.
1924 The lookup may also yield more than one IP address, in which case chain on
1925 subsequent host_item structures.
1928 host a host item with the name and MX filled in;
1929 the address is to be filled in;
1930 multiple IP addresses cause other host items to be
1932 ignore_target_hosts a list of hosts to ignore
1933 flags HOST_FIND_QUALIFY_SINGLE ) passed to
1934 HOST_FIND_SEARCH_PARENTS ) dns_init()
1935 fully_qualified_name if not NULL, set to point to host name for
1936 compatibility with host_find_bydns
1937 local_host_check TRUE if a check for the local host is wanted
1939 Returns: HOST_FIND_FAILED Failed to find the host or domain
1940 HOST_FIND_AGAIN Try again later
1941 HOST_FOUND Host found - data filled in
1942 HOST_FOUND_LOCAL Host found and is the local host
1946 host_find_byname(host_item *host, const uschar *ignore_target_hosts, int flags,
1947 const uschar **fully_qualified_name, BOOL local_host_check)
1950 host_item *last = NULL;
1951 BOOL temp_error = FALSE;
1955 /* Copy the host name at this point to the value which is used for
1956 TLS certificate name checking, before anything modifies it. */
1958 host->certname = host->name;
1961 /* Make sure DNS options are set as required. This appears to be necessary in
1962 some circumstances when the get..byname() function actually calls the DNS. */
1964 dns_init((flags & HOST_FIND_QUALIFY_SINGLE) != 0,
1965 (flags & HOST_FIND_SEARCH_PARENTS) != 0,
1966 FALSE); /* Cannot retrieve dnssec status so do not request */
1968 /* In an IPv6 world, unless IPv6 has been disabled, we need to scan for both
1969 kinds of address, so go round the loop twice. Note that we have ensured that
1970 AF_INET6 is defined even in an IPv4 world, which makes for slightly tidier
1971 code. However, if dns_ipv4_lookup matches the domain, we also just do IPv4
1972 lookups here (except when testing standalone). */
1980 && match_isinlist(host->name, CUSS &dns_ipv4_lookup, 0,
1981 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK)
1984 { af = AF_INET; times = 1; }
1986 { af = AF_INET6; times = 2; }
1988 /* No IPv6 support */
1990 #else /* HAVE_IPV6 */
1991 af = AF_INET; times = 1;
1992 #endif /* HAVE_IPV6 */
1994 /* Initialize the flag that gets set for DNS syntax check errors, so that the
1995 interface to this function can be similar to host_find_bydns. */
1997 f.host_find_failed_syntax = FALSE;
1999 /* Loop to look up both kinds of address in an IPv6 world */
2001 for (int i = 1; i <= times;
2003 af = AF_INET, /* If 2 passes, IPv4 on the second */
2009 struct hostent *hostdata;
2010 unsigned long time_msec = 0; /* compiler quietening */
2013 printf("Looking up: %s\n", host->name);
2016 if (slow_lookup_log) time_msec = get_time_in_ms();
2019 if (f.running_in_test_harness)
2020 hostdata = host_fake_gethostbyname(host->name, af, &error_num);
2023 #if HAVE_GETIPNODEBYNAME
2024 hostdata = getipnodebyname(CS host->name, af, 0, &error_num);
2026 hostdata = gethostbyname2(CS host->name, af);
2027 error_num = h_errno;
2031 #else /* not HAVE_IPV6 */
2032 if (f.running_in_test_harness)
2033 hostdata = host_fake_gethostbyname(host->name, af, &error_num);
2036 hostdata = gethostbyname(CS host->name);
2037 error_num = h_errno;
2039 #endif /* HAVE_IPV6 */
2041 if ( slow_lookup_log
2042 && (time_msec = get_time_in_ms() - time_msec) > slow_lookup_log)
2043 log_long_lookup(US"gethostbyname", host->name, time_msec);
2050 case HOST_NOT_FOUND: error = US"HOST_NOT_FOUND"; break;
2051 case TRY_AGAIN: error = US"TRY_AGAIN"; temp_error = TRUE; break;
2052 case NO_RECOVERY: error = US"NO_RECOVERY"; temp_error = TRUE; break;
2053 case NO_DATA: error = US"NO_DATA"; break;
2054 #if NO_DATA != NO_ADDRESS
2055 case NO_ADDRESS: error = US"NO_ADDRESS"; break;
2057 default: error = US"?"; break;
2060 DEBUG(D_host_lookup) debug_printf("%s(af=%s) returned %d (%s)\n",
2061 f.running_in_test_harness ? "host_fake_gethostbyname" :
2063 # if HAVE_GETIPNODEBYNAME
2071 af == AF_INET ? "inet" : "inet6", error_num, error);
2075 if (!(hostdata->h_addr_list)[0]) continue;
2077 /* Replace the name with the fully qualified one if necessary, and fill in
2078 the fully_qualified_name pointer. */
2080 if (hostdata->h_name[0] && Ustrcmp(host->name, hostdata->h_name) != 0)
2081 host->name = string_copy_dnsdomain(US hostdata->h_name);
2082 if (fully_qualified_name) *fully_qualified_name = host->name;
2084 /* Get the list of addresses. IPv4 and IPv6 addresses can be distinguished
2085 by their different lengths. Scan the list, ignoring any that are to be
2086 ignored, and build a chain from the rest. */
2088 ipv4_addr = hostdata->h_length == sizeof(struct in_addr);
2090 for (uschar ** addrlist = USS hostdata->h_addr_list; *addrlist; addrlist++)
2092 uschar *text_address =
2093 host_ntoa(ipv4_addr? AF_INET:AF_INET6, *addrlist, NULL, NULL);
2096 if ( ignore_target_hosts
2097 && verify_check_this_host(&ignore_target_hosts, NULL, host->name,
2098 text_address, NULL) == OK)
2100 DEBUG(D_host_lookup)
2101 debug_printf("ignored host %s [%s]\n", host->name, text_address);
2106 /* If this is the first address, last is NULL and we put the data in the
2111 host->address = text_address;
2112 host->port = PORT_NONE;
2113 host->status = hstatus_unknown;
2114 host->why = hwhy_unknown;
2115 host->dnssec = DS_UNK;
2119 /* Else add further host item blocks for any other addresses, keeping
2124 host_item *next = store_get(sizeof(host_item), GET_UNTAINTED);
2125 next->name = host->name;
2127 next->certname = host->certname;
2129 next->mx = host->mx;
2130 next->address = text_address;
2131 next->port = PORT_NONE;
2132 next->status = hstatus_unknown;
2133 next->why = hwhy_unknown;
2134 next->dnssec = DS_UNK;
2136 next->next = last->next;
2143 /* If no hosts were found, the address field in the original host block will be
2144 NULL. If temp_error is set, at least one of the lookups gave a temporary error,
2145 so we pass that back. */
2151 !message_id[0] && smtp_in
2152 ? string_sprintf("no IP address found for host %s (during %s)", host->name,
2153 smtp_get_connection_info()) :
2155 string_sprintf("no IP address found for host %s", host->name);
2157 HDEBUG(D_host_lookup) debug_printf("%s\n", msg);
2158 if (temp_error) goto RETURN_AGAIN;
2159 if (host_checking || !f.log_testing_mode)
2160 log_write(L_host_lookup_failed, LOG_MAIN, "%s", msg);
2161 return HOST_FIND_FAILED;
2164 /* Remove any duplicate IP addresses, then check to see if this is the local
2165 host if required. */
2167 host_remove_duplicates(host, &last);
2168 yield = local_host_check?
2169 host_scan_for_local_hosts(host, &last, NULL) : HOST_FOUND;
2171 HDEBUG(D_host_lookup)
2173 if (fully_qualified_name)
2174 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
2175 debug_printf("%s looked up these IP addresses:\n",
2177 #if HAVE_GETIPNODEBYNAME
2186 for (const host_item * h = host; h != last->next; h = h->next)
2187 debug_printf(" name=%s address=%s\n", h->name,
2188 h->address ? h->address : US"<null>");
2191 /* Return the found status. */
2195 /* Handle the case when there is a temporary error. If the name matches
2196 dns_again_means_nonexist, return permanent rather than temporary failure. */
2202 const uschar *save = deliver_domain;
2203 deliver_domain = host->name; /* set $domain */
2204 rc = match_isinlist(host->name, CUSS &dns_again_means_nonexist, 0,
2205 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL);
2206 deliver_domain = save;
2209 DEBUG(D_host_lookup) debug_printf("%s is in dns_again_means_nonexist: "
2210 "returning HOST_FIND_FAILED\n", host->name);
2211 return HOST_FIND_FAILED;
2214 return HOST_FIND_AGAIN;
2220 /*************************************************
2221 * Fill in a host address from the DNS *
2222 *************************************************/
2224 /* Given a host item, with its name, port and mx fields set, and its address
2225 field set to NULL, fill in its IP address from the DNS. If it is multi-homed,
2226 create additional host items for the additional addresses, copying all the
2227 other fields, and randomizing the order.
2229 On IPv6 systems, AAAA records are sought first, then A records.
2231 The host name may be changed if the DNS returns a different name - e.g. fully
2232 qualified or changed via CNAME. If fully_qualified_name is not NULL, dns_lookup
2233 ensures that it points to the fully qualified name. However, this is the fully
2234 qualified version of the original name; if a CNAME is involved, the actual
2235 canonical host name may be different again, and so we get it directly from the
2236 relevant RR. Note that we do NOT change the mx field of the host item in this
2237 function as it may be called to set the addresses of hosts taken from MX
2241 host points to the host item we're filling in
2242 lastptr points to pointer to last host item in a chain of
2243 host items (may be updated if host is last and gets
2244 extended because multihomed)
2245 ignore_target_hosts list of hosts to ignore
2246 allow_ip if TRUE, recognize an IP address and return it
2247 fully_qualified_name if not NULL, return fully qualified name here if
2248 the contents are different (i.e. it must be preset
2250 dnssec_request if TRUE request the AD bit
2251 dnssec_require if TRUE require the AD bit
2252 whichrrs select ipv4, ipv6 results
2254 Returns: HOST_FIND_FAILED couldn't find A record
2255 HOST_FIND_AGAIN try again later
2256 HOST_FIND_SECURITY dnssec required but not acheived
2257 HOST_FOUND found AAAA and/or A record(s)
2258 HOST_IGNORED found, but all IPs ignored
2262 set_address_from_dns(host_item *host, host_item **lastptr,
2263 const uschar *ignore_target_hosts, BOOL allow_ip,
2264 const uschar **fully_qualified_name,
2265 BOOL dnssec_request, BOOL dnssec_require, int whichrrs)
2267 host_item *thishostlast = NULL; /* Indicates not yet filled in anything */
2268 BOOL v6_find_again = FALSE;
2269 BOOL dnssec_fail = FALSE;
2274 /* Copy the host name at this point to the value which is used for
2275 TLS certificate name checking, before any CNAME-following modifies it. */
2277 host->certname = host->name;
2280 /* If allow_ip is set, a name which is an IP address returns that value
2281 as its address. This is used for MX records when allow_mx_to_ip is set, for
2282 those sites that feel they have to flaunt the RFC rules. */
2284 if (allow_ip && string_is_ip_address(host->name, NULL) != 0)
2287 if ( ignore_target_hosts
2288 && verify_check_this_host(&ignore_target_hosts, NULL, host->name,
2289 host->name, NULL) == OK)
2290 return HOST_IGNORED;
2293 host->address = host->name;
2297 dnsa = store_get_dns_answer();
2299 /* On an IPv6 system, unless IPv6 is disabled, go round the loop up to twice,
2300 looking for AAAA records the first time. However, unless doing standalone
2301 testing, we force an IPv4 lookup if the domain matches dns_ipv4_lookup global.
2302 On an IPv4 system, go round the loop once only, looking only for A records. */
2307 || !(whichrrs & HOST_FIND_BY_AAAA)
2309 && match_isinlist(host->name, CUSS &dns_ipv4_lookup, 0,
2310 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK
2312 i = 0; /* look up A records only */
2314 #endif /* STAND_ALONE */
2316 i = 1; /* look up AAAA and A records */
2318 /* The IPv4 world */
2320 #else /* HAVE_IPV6 */
2321 i = 0; /* look up A records only */
2322 #endif /* HAVE_IPV6 */
2326 static int types[] = { T_A, T_AAAA };
2327 int type = types[i];
2328 int randoffset = i == (whichrrs & HOST_FIND_IPV4_FIRST ? 1 : 0)
2329 ? 500 : 0; /* Ensures v6/4 sort order */
2332 int rc = dns_lookup_timerwrap(dnsa, host->name, type, fully_qualified_name);
2333 lookup_dnssec_authenticated = !dnssec_request ? NULL
2334 : dns_is_secure(dnsa) ? US"yes" : US"no";
2337 if ( (dnssec_request || dnssec_require)
2338 && !dns_is_secure(dnsa)
2341 debug_printf("DNS lookup of %.256s (A/AAAA) requested AD, but got AA\n", host->name);
2343 /* We want to return HOST_FIND_AGAIN if one of the A or AAAA lookups
2344 fails or times out, but not if another one succeeds. (In the early
2345 IPv6 days there are name servers that always fail on AAAA, but are happy
2346 to give out an A record. We want to proceed with that A record.) */
2348 if (rc != DNS_SUCCEED)
2350 if (i == 0) /* Just tried for an A record, i.e. end of loop */
2352 if (host->address != NULL)
2353 i = HOST_FOUND; /* AAAA was found */
2354 else if (rc == DNS_AGAIN || rc == DNS_FAIL || v6_find_again)
2355 i = HOST_FIND_AGAIN;
2357 i = HOST_FIND_FAILED; /* DNS_NOMATCH or DNS_NODATA */
2361 /* Tried for an AAAA record: remember if this was a temporary
2362 error, and look for the next record type. */
2364 if (rc != DNS_NOMATCH && rc != DNS_NODATA) v6_find_again = TRUE;
2370 if (dns_is_secure(dnsa))
2372 DEBUG(D_host_lookup) debug_printf("%s A DNSSEC\n", host->name);
2373 if (host->dnssec == DS_UNK) /* set in host_find_bydns() */
2374 host->dnssec = DS_YES;
2381 DEBUG(D_host_lookup) debug_printf("dnssec fail on %s for %.256s",
2382 i>0 ? "AAAA" : "A", host->name);
2385 if (host->dnssec == DS_YES) /* set in host_find_bydns() */
2387 DEBUG(D_host_lookup) debug_printf("%s A cancel DNSSEC\n", host->name);
2388 host->dnssec = DS_NO;
2389 lookup_dnssec_authenticated = US"no";
2394 /* Lookup succeeded: fill in the given host item with the first non-ignored
2395 address found; create additional items for any others. A single A6 record
2396 may generate more than one address. The lookup had a chance to update the
2397 fqdn; we do not want any later times round the loop to do so. */
2399 fully_qualified_name = NULL;
2401 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
2403 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == type)
2405 dns_address * da = dns_address_from_rr(dnsa, rr);
2407 DEBUG(D_host_lookup)
2408 if (!da) debug_printf("no addresses extracted from A6 RR for %s\n",
2411 /* This loop runs only once for A and AAAA records, but may run
2412 several times for an A6 record that generated multiple addresses. */
2414 for (; da; da = da->next)
2417 if (ignore_target_hosts != NULL &&
2418 verify_check_this_host(&ignore_target_hosts, NULL,
2419 host->name, da->address, NULL) == OK)
2421 DEBUG(D_host_lookup)
2422 debug_printf("ignored host %s [%s]\n", host->name, da->address);
2427 /* If this is the first address, stick it in the given host block,
2428 and change the name if the returned RR has a different name. */
2430 if (thishostlast == NULL)
2432 if (strcmpic(host->name, rr->name) != 0)
2433 host->name = string_copy_dnsdomain(rr->name);
2434 host->address = da->address;
2435 host->sort_key = host->mx * 1000 + random_number(500) + randoffset;
2436 host->status = hstatus_unknown;
2437 host->why = hwhy_unknown;
2438 thishostlast = host;
2441 /* Not the first address. Check for, and ignore, duplicates. Then
2442 insert in the chain at a random point. */
2449 /* End of our local chain is specified by "thishostlast". */
2451 for (next = host;; next = next->next)
2453 if (Ustrcmp(CS da->address, next->address) == 0) break;
2454 if (next == thishostlast) { next = NULL; break; }
2456 if (next != NULL) continue; /* With loop for next address */
2458 /* Not a duplicate */
2460 new_sort_key = host->mx * 1000 + random_number(500) + randoffset;
2461 next = store_get(sizeof(host_item), GET_UNTAINTED);
2463 /* New address goes first: insert the new block after the first one
2464 (so as not to disturb the original pointer) but put the new address
2465 in the original block. */
2467 if (new_sort_key < host->sort_key)
2469 *next = *host; /* Copies port */
2471 host->address = da->address;
2472 host->sort_key = new_sort_key;
2473 if (thishostlast == host) thishostlast = next; /* Local last */
2474 if (*lastptr == host) *lastptr = next; /* Global last */
2477 /* Otherwise scan down the addresses for this host to find the
2478 one to insert after. */
2482 host_item *h = host;
2483 while (h != thishostlast)
2485 if (new_sort_key < h->next->sort_key) break;
2488 *next = *h; /* Copies port */
2490 next->address = da->address;
2491 next->sort_key = new_sort_key;
2492 if (h == thishostlast) thishostlast = next; /* Local last */
2493 if (h == *lastptr) *lastptr = next; /* Global last */
2500 /* Control gets here only if the second lookup (the A record) succeeded.
2501 However, the address may not be filled in if it was ignored. */
2506 ? HOST_FIND_SECURITY
2510 store_free_dns_answer(dnsa);
2517 /*************************************************
2518 * Find IP addresses and host names via DNS *
2519 *************************************************/
2521 /* The input is a host_item structure with the name field filled in and the
2522 address field set to NULL. This may be in a chain of other host items. The
2523 lookup may result in more than one IP address, in which case we must created
2524 new host blocks for the additional addresses, and insert them into the chain.
2525 The original name may not be fully qualified. Use the fully_qualified_name
2526 argument to return the official name, as returned by the resolver.
2529 host point to initial host item
2530 ignore_target_hosts a list of hosts to ignore
2531 whichrrs flags indicating which RRs to look for:
2532 HOST_FIND_BY_SRV => look for SRV
2533 HOST_FIND_BY_MX => look for MX
2534 HOST_FIND_BY_A => look for A
2535 HOST_FIND_BY_AAAA => look for AAAA
2536 also flags indicating how the lookup is done
2537 HOST_FIND_QUALIFY_SINGLE ) passed to the
2538 HOST_FIND_SEARCH_PARENTS ) resolver
2539 HOST_FIND_IPV4_FIRST => reverse usual result ordering
2540 HOST_FIND_IPV4_ONLY => MX results elide ipv6
2541 srv_service when SRV used, the service name
2542 srv_fail_domains DNS errors for these domains => assume nonexist
2543 mx_fail_domains DNS errors for these domains => assume nonexist
2544 dnssec_d.request => make dnssec request: domainlist
2545 dnssec_d.require => ditto and nonexist failures
2546 fully_qualified_name if not NULL, return fully-qualified name
2547 removed set TRUE if local host was removed from the list
2549 Returns: HOST_FIND_FAILED Failed to find the host or domain;
2550 if there was a syntax error,
2551 host_find_failed_syntax is set.
2552 HOST_FIND_AGAIN Could not resolve at this time
2553 HOST_FIND_SECURITY dnsssec required but not acheived
2554 HOST_FOUND Host found
2555 HOST_FOUND_LOCAL The lowest MX record points to this
2556 machine, if MX records were found, or
2557 an A record that was found contains
2558 an address of the local host
2562 host_find_bydns(host_item *host, const uschar *ignore_target_hosts, int whichrrs,
2563 uschar *srv_service, uschar *srv_fail_domains, uschar *mx_fail_domains,
2564 const dnssec_domains *dnssec_d,
2565 const uschar **fully_qualified_name, BOOL *removed)
2567 host_item *h, *last;
2571 dns_answer * dnsa = store_get_dns_answer();
2573 BOOL dnssec_require = dnssec_d
2574 && match_isinlist(host->name, CUSS &dnssec_d->require,
2575 0, &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK;
2576 BOOL dnssec_request = dnssec_require
2578 && match_isinlist(host->name, CUSS &dnssec_d->request,
2579 0, &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK);
2580 dnssec_status_t dnssec;
2582 /* Set the default fully qualified name to the incoming name, initialize the
2583 resolver if necessary, set up the relevant options, and initialize the flag
2584 that gets set for DNS syntax check errors. */
2586 if (fully_qualified_name != NULL) *fully_qualified_name = host->name;
2587 dns_init((whichrrs & HOST_FIND_QUALIFY_SINGLE) != 0,
2588 (whichrrs & HOST_FIND_SEARCH_PARENTS) != 0,
2590 f.host_find_failed_syntax = FALSE;
2592 /* First, if requested, look for SRV records. The service name is given; we
2593 assume TCP protocol. DNS domain names are constrained to a maximum of 256
2594 characters, so the code below should be safe. */
2596 if (whichrrs & HOST_FIND_BY_SRV)
2599 uschar * temp_fully_qualified_name;
2602 g = string_fmt_append(NULL, "_%s._tcp.%n%.256s",
2603 srv_service, &prefix_length, host->name);
2604 temp_fully_qualified_name = string_from_gstring(g);
2607 /* Search for SRV records. If the fully qualified name is different to
2608 the input name, pass back the new original domain, without the prepended
2612 lookup_dnssec_authenticated = NULL;
2613 rc = dns_lookup_timerwrap(dnsa, temp_fully_qualified_name, ind_type,
2614 CUSS &temp_fully_qualified_name);
2617 if ((dnssec_request || dnssec_require)
2618 && !dns_is_secure(dnsa)
2620 debug_printf("DNS lookup of %.256s (SRV) requested AD, but got AA\n", host->name);
2624 if (dns_is_secure(dnsa))
2625 { dnssec = DS_YES; lookup_dnssec_authenticated = US"yes"; }
2627 { dnssec = DS_NO; lookup_dnssec_authenticated = US"no"; }
2630 if (temp_fully_qualified_name != g->s && fully_qualified_name != NULL)
2631 *fully_qualified_name = temp_fully_qualified_name + prefix_length;
2633 /* On DNS failures, we give the "try again" error unless the domain is
2634 listed as one for which we continue. */
2636 if (rc == DNS_SUCCEED && dnssec_require && !dns_is_secure(dnsa))
2638 log_write(L_host_lookup_failed, LOG_MAIN,
2639 "dnssec fail on SRV for %.256s", host->name);
2642 if (rc == DNS_FAIL || rc == DNS_AGAIN)
2645 if (match_isinlist(host->name, CUSS &srv_fail_domains, 0,
2646 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) != OK)
2648 { yield = HOST_FIND_AGAIN; goto out; }
2649 DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA "
2650 "(domain in srv_fail_domains)\n", rc == DNS_FAIL ? "FAIL":"AGAIN");
2654 /* If we did not find any SRV records, search the DNS for MX records, if
2655 requested to do so. If the result is DNS_NOMATCH, it means there is no such
2656 domain, and there's no point in going on to look for address records with the
2657 same domain. The result will be DNS_NODATA if the domain exists but has no MX
2658 records. On DNS failures, we give the "try again" error unless the domain is
2659 listed as one for which we continue. */
2661 if (rc != DNS_SUCCEED && whichrrs & HOST_FIND_BY_MX)
2665 lookup_dnssec_authenticated = NULL;
2666 rc = dns_lookup_timerwrap(dnsa, host->name, ind_type, fully_qualified_name);
2669 if ( (dnssec_request || dnssec_require)
2670 && !dns_is_secure(dnsa)
2672 debug_printf("DNS lookup of %.256s (MX) requested AD, but got AA\n", host->name);
2675 if (dns_is_secure(dnsa))
2677 DEBUG(D_host_lookup) debug_printf("%s (MX resp) DNSSEC\n", host->name);
2678 dnssec = DS_YES; lookup_dnssec_authenticated = US"yes";
2682 dnssec = DS_NO; lookup_dnssec_authenticated = US"no";
2688 yield = HOST_FIND_FAILED; goto out;
2691 if (!dnssec_require || dns_is_secure(dnsa))
2693 DEBUG(D_host_lookup)
2694 debug_printf("dnssec fail on MX for %.256s", host->name);
2696 if (match_isinlist(host->name, CUSS &mx_fail_domains, 0,
2697 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) != OK)
2698 { yield = HOST_FIND_SECURITY; goto out; }
2706 if (match_isinlist(host->name, CUSS &mx_fail_domains, 0,
2707 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) != OK)
2709 { yield = HOST_FIND_AGAIN; goto out; }
2710 DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA "
2711 "(domain in mx_fail_domains)\n", (rc == DNS_FAIL)? "FAIL":"AGAIN");
2716 /* If we haven't found anything yet, and we are requested to do so, try for an
2717 A or AAAA record. If we find it (or them) check to see that it isn't the local
2720 if (rc != DNS_SUCCEED)
2722 if (!(whichrrs & (HOST_FIND_BY_A | HOST_FIND_BY_AAAA)))
2724 DEBUG(D_host_lookup) debug_printf("Address records are not being sought\n");
2725 yield = HOST_FIND_FAILED;
2729 last = host; /* End of local chainlet */
2731 host->port = PORT_NONE;
2732 host->dnssec = DS_UNK;
2733 lookup_dnssec_authenticated = NULL;
2734 rc = set_address_from_dns(host, &last, ignore_target_hosts, FALSE,
2735 fully_qualified_name, dnssec_request, dnssec_require, whichrrs);
2737 /* If one or more address records have been found, check that none of them
2738 are local. Since we know the host items all have their IP addresses
2739 inserted, host_scan_for_local_hosts() can only return HOST_FOUND or
2740 HOST_FOUND_LOCAL. We do not need to scan for duplicate IP addresses here,
2741 because set_address_from_dns() removes them. */
2743 if (rc == HOST_FOUND)
2744 rc = host_scan_for_local_hosts(host, &last, removed);
2746 if (rc == HOST_IGNORED) rc = HOST_FIND_FAILED; /* No special action */
2748 DEBUG(D_host_lookup)
2751 if (fully_qualified_name)
2752 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
2753 for (host_item * h = host; h != last->next; h = h->next)
2754 debug_printf("%s %s mx=%d sort=%d %s\n", h->name,
2755 h->address ? h->address : US"<null>", h->mx, h->sort_key,
2756 h->status >= hstatus_unusable ? US"*" : US"");
2763 /* We have found one or more MX or SRV records. Sort them according to
2764 precedence. Put the data for the first one into the existing host block, and
2765 insert new host_item blocks into the chain for the remainder. For equal
2766 precedences one is supposed to randomize the order. To make this happen, the
2767 sorting is actually done on the MX value * 1000 + a random number. This is put
2768 into a host field called sort_key.
2770 In the case of hosts with both IPv6 and IPv4 addresses, we want to choose the
2771 IPv6 address in preference. At this stage, we don't know what kind of address
2772 the host has. We choose a random number < 500; if later we find an A record
2773 first, we add 500 to the random number. Then for any other address records, we
2774 use random numbers in the range 0-499 for AAAA records and 500-999 for A
2777 At this point we remove any duplicates that point to the same host, retaining
2778 only the one with the lowest precedence. We cannot yet check for precedence
2779 greater than that of the local host, because that test cannot be properly done
2780 until the addresses have been found - an MX record may point to a name for this
2781 host which is not the primary hostname. */
2783 last = NULL; /* Indicates that not even the first item is filled yet */
2785 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
2787 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == ind_type)
2789 int precedence, weight;
2790 int port = PORT_NONE;
2791 const uschar * s = rr->data; /* MUST be unsigned for GETSHORT */
2794 GETSHORT(precedence, s); /* Pointer s is advanced */
2796 /* For MX records, we use a random "weight" which causes multiple records of
2797 the same precedence to sort randomly. */
2799 if (ind_type == T_MX)
2800 weight = random_number(500);
2803 /* SRV records are specified with a port and a weight. The weight is used
2804 in a special algorithm. However, to start with, we just use it to order the
2805 records of equal priority (precedence). */
2806 GETSHORT(weight, s);
2810 /* Get the name of the host pointed to. */
2812 (void)dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, s,
2813 (DN_EXPAND_ARG4_TYPE)data, sizeof(data));
2815 /* Check that we haven't already got this host on the chain; if we have,
2816 keep only the lower precedence. This situation shouldn't occur, but you
2817 never know what junk might get into the DNS (and this case has been seen on
2818 more than one occasion). */
2820 if (last) /* This is not the first record */
2822 host_item *prev = NULL;
2824 for (h = host; h != last->next; prev = h, h = h->next)
2825 if (strcmpic(h->name, data) == 0)
2827 DEBUG(D_host_lookup)
2828 debug_printf("discarded duplicate host %s (MX=%d)\n", data,
2829 precedence > h->mx ? precedence : h->mx);
2830 if (precedence >= h->mx) goto NEXT_MX_RR; /* Skip greater precedence */
2831 if (h == host) /* Override first item */
2834 host->sort_key = precedence * 1000 + weight;
2838 /* Unwanted host item is not the first in the chain, so we can get
2839 get rid of it by cutting it out. */
2841 prev->next = h->next;
2842 if (h == last) last = prev;
2847 /* If this is the first MX or SRV record, put the data into the existing host
2848 block. Otherwise, add a new block in the correct place; if it has to be
2849 before the first block, copy the first block's data to a new second block. */
2853 host->name = string_copy_dnsdomain(data);
2854 host->address = NULL;
2856 host->mx = precedence;
2857 host->sort_key = precedence * 1000 + weight;
2858 host->status = hstatus_unknown;
2859 host->why = hwhy_unknown;
2860 host->dnssec = dnssec;
2865 /* Make a new host item and seek the correct insertion place */
2867 int sort_key = precedence * 1000 + weight;
2868 host_item * next = store_get(sizeof(host_item), GET_UNTAINTED);
2869 next->name = string_copy_dnsdomain(data);
2870 next->address = NULL;
2872 next->mx = precedence;
2873 next->sort_key = sort_key;
2874 next->status = hstatus_unknown;
2875 next->why = hwhy_unknown;
2876 next->dnssec = dnssec;
2879 /* Handle the case when we have to insert before the first item. */
2881 if (sort_key < host->sort_key)
2888 if (last == host) last = next;
2892 /* Else scan down the items we have inserted as part of this exercise;
2893 don't go further. */
2895 for (h = host; h != last; h = h->next)
2896 if (sort_key < h->next->sort_key)
2898 next->next = h->next;
2903 /* Join on after the last host item that's part of this
2904 processing if we haven't stopped sooner. */
2908 next->next = last->next;
2915 NEXT_MX_RR: continue;
2918 if (!last) /* No rr of correct type; give up */
2920 yield = HOST_FIND_FAILED;
2924 /* If the list of hosts was obtained from SRV records, there are two things to
2925 do. First, if there is only one host, and it's name is ".", it means there is
2926 no SMTP service at this domain. Otherwise, we have to sort the hosts of equal
2927 priority according to their weights, using an algorithm that is defined in RFC
2928 2782. The hosts are currently sorted by priority and weight. For each priority
2929 group we have to pick off one host and put it first, and then repeat for any
2930 remaining in the same priority group. */
2932 if (ind_type == T_SRV)
2936 if (host == last && host->name[0] == 0)
2938 DEBUG(D_host_lookup) debug_printf("the single SRV record is \".\"\n");
2939 yield = HOST_FIND_FAILED;
2943 DEBUG(D_host_lookup)
2945 debug_printf("original ordering of hosts from SRV records:\n");
2946 for (h = host; h != last->next; h = h->next)
2947 debug_printf(" %s P=%d W=%d\n", h->name, h->mx, h->sort_key % 1000);
2950 for (pptr = &host, h = host; h != last; pptr = &h->next, h = h->next)
2955 /* Find the last following host that has the same precedence. At the same
2956 time, compute the sum of the weights and the running totals. These can be
2957 stored in the sort_key field. */
2959 for (hh = h; hh != last; hh = hh->next)
2961 int weight = hh->sort_key % 1000; /* was precedence * 1000 + weight */
2964 if (hh->mx != hh->next->mx) break;
2967 /* If there's more than one host at this precedence (priority), we need to
2968 pick one to go first. */
2974 int randomizer = random_number(sum + 1);
2976 for (ppptr = pptr, hhh = h;
2978 ppptr = &hhh->next, hhh = hhh->next)
2979 if (hhh->sort_key >= randomizer)
2982 /* hhh now points to the host that should go first; ppptr points to the
2983 place that points to it. Unfortunately, if the start of the minilist is
2984 the start of the entire list, we can't just swap the items over, because
2985 we must not change the value of host, since it is passed in from outside.
2986 One day, this could perhaps be changed.
2988 The special case is fudged by putting the new item *second* in the chain,
2989 and then transferring the data between the first and second items. We
2990 can't just swap the first and the chosen item, because that would mean
2991 that an item with zero weight might no longer be first. */
2995 *ppptr = hhh->next; /* Cuts it out of the chain */
2999 host_item temp = *h;
3002 hhh->next = temp.next;
3007 hhh->next = h; /* The rest of the chain follows it */
3008 *pptr = hhh; /* It takes the place of h */
3009 h = hhh; /* It's now the start of this minilist */
3014 /* A host has been chosen to be first at this priority and h now points
3015 to this host. There may be others at the same priority, or others at a
3016 different priority. Before we leave this host, we need to put back a sort
3017 key of the traditional MX kind, in case this host is multihomed, because
3018 the sort key is used for ordering the multiple IP addresses. We do not need
3019 to ensure that these new sort keys actually reflect the order of the hosts,
3022 h->sort_key = h->mx * 1000 + random_number(500);
3023 } /* Move on to the next host */
3026 /* Now we have to find IP addresses for all the hosts. We have ensured above
3027 that the names in all the host items are unique. Before release 4.61 we used to
3028 process records from the additional section in the DNS packet that returned the
3029 MX or SRV records. However, a DNS name server is free to drop any resource
3030 records from the additional section. In theory, this has always been a
3031 potential problem, but it is exacerbated by the advent of IPv6. If a host had
3032 several IPv4 addresses and some were not in the additional section, at least
3033 Exim would try the others. However, if a host had both IPv4 and IPv6 addresses
3034 and all the IPv4 (say) addresses were absent, Exim would try only for a IPv6
3035 connection, and never try an IPv4 address. When there was only IPv4
3036 connectivity, this was a disaster that did in practice occur.
3038 So, from release 4.61 onwards, we always search for A and AAAA records
3039 explicitly. The names shouldn't point to CNAMES, but we use the general lookup
3040 function that handles them, just in case. If any lookup gives a soft error,
3041 change the default yield.
3043 For these DNS lookups, we must disable qualify_single and search_parents;
3044 otherwise invalid host names obtained from MX or SRV records can cause trouble
3045 if they happen to match something local. */
3047 yield = HOST_FIND_FAILED; /* Default yield */
3048 dns_init(FALSE, FALSE, /* Disable qualify_single and search_parents */
3049 dnssec_request || dnssec_require);
3051 for (h = host; h != last->next; h = h->next)
3053 if (h->address) continue; /* Inserted by a multihomed host */
3055 rc = set_address_from_dns(h, &last, ignore_target_hosts, allow_mx_to_ip,
3056 NULL, dnssec_request, dnssec_require,
3057 whichrrs & HOST_FIND_IPV4_ONLY
3058 ? HOST_FIND_BY_A : HOST_FIND_BY_A | HOST_FIND_BY_AAAA);
3059 if (rc != HOST_FOUND)
3061 h->status = hstatus_unusable;
3064 case HOST_FIND_AGAIN: yield = rc; h->why = hwhy_deferred; break;
3065 case HOST_FIND_SECURITY: yield = rc; h->why = hwhy_insecure; break;
3066 case HOST_IGNORED: h->why = hwhy_ignored; break;
3067 default: h->why = hwhy_failed; break;
3072 /* Scan the list for any hosts that are marked unusable because they have
3073 been explicitly ignored, and remove them from the list, as if they did not
3074 exist. If we end up with just a single, ignored host, flatten its fields as if
3075 nothing was found. */
3077 if (ignore_target_hosts)
3079 host_item *prev = NULL;
3080 for (h = host; h != last->next; h = h->next)
3083 if (h->why != hwhy_ignored) /* Non ignored host, just continue */
3085 else if (prev == NULL) /* First host is ignored */
3087 if (h != last) /* First is not last */
3089 if (h->next == last) last = h; /* Overwrite it with next */
3090 *h = *(h->next); /* and reprocess it. */
3091 goto REDO; /* C should have redo, like Perl */
3094 else /* Ignored host is not first - */
3096 prev->next = h->next;
3097 if (h == last) last = prev;
3101 if (host->why == hwhy_ignored) host->address = NULL;
3104 /* There is still one complication in the case of IPv6. Although the code above
3105 arranges that IPv6 addresses take precedence over IPv4 addresses for multihomed
3106 hosts, it doesn't do this for addresses that apply to different hosts with the
3107 same MX precedence, because the sorting on MX precedence happens first. So we
3108 have to make another pass to check for this case. We ensure that, within a
3109 single MX preference value, IPv6 addresses come first. This can separate the
3110 addresses of a multihomed host, but that should not matter. */
3113 if (h != last && !disable_ipv6) for (h = host; h != last; h = h->next)
3116 host_item *next = h->next;
3118 if ( h->mx != next->mx /* If next is different MX */
3119 || !h->address /* OR this one is unset */
3121 continue; /* move on to next */
3123 if ( whichrrs & HOST_FIND_IPV4_FIRST
3124 ? !Ustrchr(h->address, ':') /* OR this one is IPv4 */
3126 && Ustrchr(next->address, ':') /* OR next is IPv6 */
3128 : Ustrchr(h->address, ':') /* OR this one is IPv6 */
3130 && !Ustrchr(next->address, ':') /* OR next is IPv4 */
3132 continue; /* move on to next */
3134 temp = *h; /* otherwise, swap */
3135 temp.next = next->next;
3142 /* Remove any duplicate IP addresses and then scan the list of hosts for any
3143 whose IP addresses are on the local host. If any are found, all hosts with the
3144 same or higher MX values are removed. However, if the local host has the lowest
3145 numbered MX, then HOST_FOUND_LOCAL is returned. Otherwise, if at least one host
3146 with an IP address is on the list, HOST_FOUND is returned. Otherwise,
3147 HOST_FIND_FAILED is returned, but in this case do not update the yield, as it
3148 might have been set to HOST_FIND_AGAIN just above here. If not, it will already
3149 be HOST_FIND_FAILED. */
3151 host_remove_duplicates(host, &last);
3152 rc = host_scan_for_local_hosts(host, &last, removed);
3153 if (rc != HOST_FIND_FAILED) yield = rc;
3155 DEBUG(D_host_lookup)
3157 if (fully_qualified_name)
3158 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
3159 debug_printf("host_find_bydns yield = %s (%d); returned hosts:\n",
3160 yield == HOST_FOUND ? "HOST_FOUND" :
3161 yield == HOST_FOUND_LOCAL ? "HOST_FOUND_LOCAL" :
3162 yield == HOST_FIND_SECURITY ? "HOST_FIND_SECURITY" :
3163 yield == HOST_FIND_AGAIN ? "HOST_FIND_AGAIN" :
3164 yield == HOST_FIND_FAILED ? "HOST_FIND_FAILED" : "?",
3166 for (h = host; h != last->next; h = h->next)
3168 debug_printf(" %s %s MX=%d %s", h->name,
3169 !h->address ? US"<null>" : h->address, h->mx,
3170 h->dnssec == DS_YES ? US"DNSSEC " : US"");
3171 if (h->port != PORT_NONE) debug_printf("port=%d ", h->port);
3172 if (h->status >= hstatus_unusable) debug_printf("*");
3179 dns_init(FALSE, FALSE, FALSE); /* clear the dnssec bit for getaddrbyname */
3180 store_free_dns_answer(dnsa);
3188 /* Lookup TLSA record for host/port.
3189 Return: OK success with dnssec; DANE mode
3190 DEFER Do not use this host now, may retry later
3191 FAIL_FORCED No TLSA record; DANE not usable
3192 FAIL Do not use this connection
3196 tlsa_lookup(const host_item * host, dns_answer * dnsa, BOOL dane_required)
3199 const uschar * fullname = buffer;
3203 /* TLSA lookup string */
3204 (void)sprintf(CS buffer, "_%d._tcp.%.256s", host->port, host->name);
3206 rc = dns_lookup_timerwrap(dnsa, buffer, T_TLSA, &fullname);
3207 sec = dns_is_secure(dnsa);
3209 debug_printf("TLSA lookup ret %s %sDNSSEC\n", dns_rc_names[rc], sec ? "" : "not ");
3214 return DEFER; /* just defer this TLS'd conn */
3222 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
3223 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT))
3224 if (rr->type == T_TLSA && rr->size > 3)
3226 uint16_t payload_length = rr->size - 3;
3227 uschar s[MAX_TLSA_EXPANDED_SIZE], * sp = s, * p = US rr->data;
3229 sp += sprintf(CS sp, "%d ", *p++); /* usage */
3230 sp += sprintf(CS sp, "%d ", *p++); /* selector */
3231 sp += sprintf(CS sp, "%d ", *p++); /* matchtype */
3232 while (payload_length-- > 0 && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4))
3233 sp += sprintf(CS sp, "%02x", *p++);
3235 debug_printf(" %s\n", s);
3240 log_write(0, LOG_MAIN,
3241 "DANE error: TLSA lookup for %s not DNSSEC", host->name);
3244 case DNS_NODATA: /* no TLSA RR for this lookup */
3245 case DNS_NOMATCH: /* no records at all for this lookup */
3246 return dane_required ? FAIL : FAIL_FORCED;
3250 return dane_required ? FAIL : DEFER;
3253 #endif /*SUPPORT_DANE*/
3257 /*************************************************
3258 **************************************************
3259 * Stand-alone test program *
3260 **************************************************
3261 *************************************************/
3265 int main(int argc, char **cargv)
3268 int whichrrs = HOST_FIND_BY_MX | HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
3269 BOOL byname = FALSE;
3270 BOOL qualify_single = TRUE;
3271 BOOL search_parents = FALSE;
3272 BOOL request_dnssec = FALSE;
3273 BOOL require_dnssec = FALSE;
3274 uschar **argv = USS cargv;
3277 disable_ipv6 = FALSE;
3278 primary_hostname = US"";
3280 store_pool = POOL_MAIN;
3281 debug_selector = D_host_lookup|D_interface;
3282 debug_file = stdout;
3283 debug_fd = fileno(debug_file);
3285 printf("Exim stand-alone host functions test\n");
3287 host_find_interfaces();
3288 debug_selector = D_host_lookup | D_dns;
3290 if (argc > 1) primary_hostname = argv[1];
3292 /* So that debug level changes can be done first */
3294 dns_init(qualify_single, search_parents, FALSE);
3296 printf("Testing host lookup\n");
3298 while (Ufgets(buffer, 256, stdin) != NULL)
3301 int len = Ustrlen(buffer);
3302 uschar *fully_qualified_name;
3304 while (len > 0 && isspace(buffer[len-1])) len--;
3307 if (Ustrcmp(buffer, "q") == 0) break;
3309 if (Ustrcmp(buffer, "byname") == 0) byname = TRUE;
3310 else if (Ustrcmp(buffer, "no_byname") == 0) byname = FALSE;
3311 else if (Ustrcmp(buffer, "a_only") == 0) whichrrs = HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
3312 else if (Ustrcmp(buffer, "mx_only") == 0) whichrrs = HOST_FIND_BY_MX;
3313 else if (Ustrcmp(buffer, "srv_only") == 0) whichrrs = HOST_FIND_BY_SRV;
3314 else if (Ustrcmp(buffer, "srv+a") == 0)
3315 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
3316 else if (Ustrcmp(buffer, "srv+mx") == 0)
3317 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_MX;
3318 else if (Ustrcmp(buffer, "srv+mx+a") == 0)
3319 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_MX | HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
3320 else if (Ustrcmp(buffer, "qualify_single") == 0) qualify_single = TRUE;
3321 else if (Ustrcmp(buffer, "no_qualify_single") == 0) qualify_single = FALSE;
3322 else if (Ustrcmp(buffer, "search_parents") == 0) search_parents = TRUE;
3323 else if (Ustrcmp(buffer, "no_search_parents") == 0) search_parents = FALSE;
3324 else if (Ustrcmp(buffer, "request_dnssec") == 0) request_dnssec = TRUE;
3325 else if (Ustrcmp(buffer, "no_request_dnssec") == 0) request_dnssec = FALSE;
3326 else if (Ustrcmp(buffer, "require_dnssec") == 0) require_dnssec = TRUE;
3327 else if (Ustrcmp(buffer, "no_require_dnssec") == 0) require_dnssec = FALSE;
3328 else if (Ustrcmp(buffer, "test_harness") == 0)
3329 f.running_in_test_harness = !f.running_in_test_harness;
3330 else if (Ustrcmp(buffer, "ipv6") == 0) disable_ipv6 = !disable_ipv6;
3331 else if (Ustrcmp(buffer, "res_debug") == 0)
3333 _res.options ^= RES_DEBUG;
3335 else if (Ustrncmp(buffer, "retrans", 7) == 0)
3337 (void)sscanf(CS(buffer+8), "%d", &dns_retrans);
3338 _res.retrans = dns_retrans;
3340 else if (Ustrncmp(buffer, "retry", 5) == 0)
3342 (void)sscanf(CS(buffer+6), "%d", &dns_retry);
3343 _res.retry = dns_retry;
3347 int flags = whichrrs;
3354 h.status = hstatus_unknown;
3355 h.why = hwhy_unknown;
3358 if (qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
3359 if (search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
3361 d.request = request_dnssec ? &h.name : NULL;
3362 d.require = require_dnssec ? &h.name : NULL;
3365 ? host_find_byname(&h, NULL, flags, &fully_qualified_name, TRUE)
3366 : host_find_bydns(&h, NULL, flags, US"smtp", NULL, NULL,
3367 &d, &fully_qualified_name, NULL);
3371 case HOST_FIND_FAILED: printf("Failed\n"); break;
3372 case HOST_FIND_AGAIN: printf("Again\n"); break;
3373 case HOST_FIND_SECURITY: printf("Security\n"); break;
3374 case HOST_FOUND_LOCAL: printf("Local\n"); break;
3381 printf("Testing host_aton\n");
3383 while (Ufgets(buffer, 256, stdin) != NULL)
3386 int len = Ustrlen(buffer);
3388 while (len > 0 && isspace(buffer[len-1])) len--;
3391 if (Ustrcmp(buffer, "q") == 0) break;
3393 len = host_aton(buffer, x);
3394 printf("length = %d ", len);
3395 for (int i = 0; i < len; i++)
3397 printf("%04x ", (x[i] >> 16) & 0xffff);
3398 printf("%04x ", x[i] & 0xffff);
3405 printf("Testing host_name_lookup\n");
3407 while (Ufgets(buffer, 256, stdin) != NULL)
3409 int len = Ustrlen(buffer);
3410 while (len > 0 && isspace(buffer[len-1])) len--;
3412 if (Ustrcmp(buffer, "q") == 0) break;
3413 sender_host_address = buffer;
3414 sender_host_name = NULL;
3415 sender_host_aliases = NULL;
3416 host_lookup_msg = US"";
3417 host_lookup_failed = FALSE;
3418 if (host_name_lookup() == FAIL) /* Debug causes printing */
3419 printf("Lookup failed:%s\n", host_lookup_msg);
3427 #endif /* STAND_ALONE */