* Exim - an Internet mail transport agent *
*************************************************/
+/* Copyright (c) The Exim Maintainers 2020 - 2024 */
/* Copyright (c) University of Cambridge 1995 - 2018 */
/* See the file NOTICE for conditions of use and distribution. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
/* Functions for finding hosts, either by gethostbyname(), gethostbyaddr(), or
directly via the DNS. When IPv6 is supported, getipnodebyname() and
if (limit < 1)
return 0;
if (random_seed == 0)
- {
- if (f.running_in_test_harness) random_seed = 42; else
+ if (f.running_in_test_harness)
+ random_seed = 42;
+ else
{
int p = (int)getpid();
random_seed = (int)time(NULL) ^ ((p << 16) | p);
}
- }
random_seed = 1103515245 * random_seed + 12345;
return (unsigned int)(random_seed >> 16) % limit;
}
dns_scan dnss;
DEBUG(D_host_lookup)
- debug_printf("using host_fake_gethostbyname for %s (%s)\n", name,
- (af == AF_INET)? "IPv4" : "IPv6");
+ debug_printf_indent("using host_fake_gethostbyname for %s (%s)\n", name,
+ af == AF_INET ? "IPv4" : "IPv6");
/* Handle unqualified "localhost" */
if (Ustrcmp(name, "localhost") == 0)
- lname = (af == AF_INET)? US"127.0.0.1" : US"::1";
+ lname = af == AF_INET ? US"127.0.0.1" : US"::1";
/* Handle a literal IP address */
if ((ipa = string_is_ip_address(lname, NULL)) != 0)
- {
- if ((ipa == 4 && af == AF_INET) ||
- (ipa == 6 && af == AF_INET6))
+ if ( ipa == 4 && af == AF_INET
+ || ipa == 6 && af == AF_INET6)
{
int x[4];
- yield = store_get(sizeof(struct hostent), FALSE);
- alist = store_get(2 * sizeof(char *), FALSE);
- adds = store_get(alen, FALSE);
+ yield = store_get(sizeof(struct hostent), GET_UNTAINTED);
+ alist = store_get(2 * sizeof(char *), GET_UNTAINTED);
+ adds = store_get(alen, GET_UNTAINTED);
yield->h_name = CS name;
yield->h_aliases = NULL;
yield->h_addrtype = af;
else
{
*error_num = HOST_NOT_FOUND;
- return NULL;
+ yield = NULL;
+ goto out;
}
- }
/* Handle a host name */
else
{
- int type = (af == AF_INET)? T_A:T_AAAA;
+ int type = af == AF_INET ? T_A:T_AAAA;
int rc = dns_lookup_timerwrap(dnsa, lname, type, NULL);
int count = 0;
switch(rc)
{
case DNS_SUCCEED: break;
- case DNS_NOMATCH: *error_num = HOST_NOT_FOUND; return NULL;
- case DNS_NODATA: *error_num = NO_DATA; return NULL;
- case DNS_AGAIN: *error_num = TRY_AGAIN; return NULL;
+ case DNS_NOMATCH: *error_num = HOST_NOT_FOUND; yield = NULL; goto out;
+ case DNS_NODATA: *error_num = NO_DATA; yield = NULL; goto out;
+ case DNS_AGAIN: *error_num = TRY_AGAIN; yield = NULL; goto out;
default:
- case DNS_FAIL: *error_num = NO_RECOVERY; return NULL;
+ case DNS_FAIL: *error_num = NO_RECOVERY; yield = NULL; goto out;
}
for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == type)
count++;
- yield = store_get(sizeof(struct hostent), FALSE);
- alist = store_get((count + 1) * sizeof(char *), FALSE);
- adds = store_get(count *alen, FALSE);
+ yield = store_get(sizeof(struct hostent), GET_UNTAINTED);
+ alist = store_get((count + 1) * sizeof(char *), GET_UNTAINTED);
+ adds = store_get(count *alen, GET_UNTAINTED);
yield->h_name = CS name;
yield->h_aliases = NULL;
*alist = NULL;
}
+out:
+
+store_free_dns_answer(dnsa);
return yield;
}
continue;
}
- h = store_get(sizeof(host_item), FALSE);
+ h = store_get(sizeof(host_item), GET_UNTAINTED);
h->name = name;
h->address = NULL;
h->port = PORT_NONE;
h->mx = fake_mx;
- h->sort_key = randomize? (-fake_mx)*1000 + random_number(1000) : 0;
+ h->sort_key = randomize ? (-fake_mx)*1000 + random_number(1000) : 0;
h->status = hstatus_unknown;
h->why = hwhy_unknown;
h->last_try = 0;
}
-
-
-
-/*************************************************
-* Extract port from address string *
-*************************************************/
-
-/* In the spool file, and in the -oMa and -oMi options, a host plus port is
-given as an IP address followed by a dot and a port number. This function
-decodes this.
-
-An alternative format for the -oMa and -oMi options is [ip address]:port which
-is what Exim 4 uses for output, because it seems to becoming commonly used,
-whereas the dot form confuses some programs/people. So we recognize that form
-too.
-
-Argument:
- address points to the string; if there is a port, the '.' in the string
- is overwritten with zero to terminate the address; if the string
- is in the [xxx]:ppp format, the address is shifted left and the
- brackets are removed
-
-Returns: 0 if there is no port, else the port number. If there's a syntax
- error, leave the incoming address alone, and return 0.
-*/
-
-int
-host_address_extract_port(uschar *address)
-{
-int port = 0;
-uschar *endptr;
-
-/* Handle the "bracketed with colon on the end" format */
-
-if (*address == '[')
- {
- uschar *rb = address + 1;
- while (*rb != 0 && *rb != ']') rb++;
- if (*rb++ == 0) return 0; /* Missing ]; leave invalid address */
- if (*rb == ':')
- {
- port = Ustrtol(rb + 1, &endptr, 10);
- if (*endptr != 0) return 0; /* Invalid port; leave invalid address */
- }
- else if (*rb != 0) return 0; /* Bad syntax; leave invalid address */
- memmove(address, address + 1, rb - address - 2);
- rb[-2] = 0;
- }
-
-/* Handle the "dot on the end" format */
-
-else
- {
- int skip = -3; /* Skip 3 dots in IPv4 addresses */
- address--;
- while (*(++address) != 0)
- {
- int ch = *address;
- if (ch == ':') skip = 0; /* Skip 0 dots in IPv6 addresses */
- else if (ch == '.' && skip++ >= 0) break;
- }
- if (*address == 0) return 0;
- port = Ustrtol(address + 1, &endptr, 10);
- if (*endptr != 0) return 0; /* Invalid port; leave invalid address */
- *address = 0;
- }
-
-return port;
-}
-
-
/*************************************************
* Get port from a host item's name *
*************************************************/
store_reset(reset_point);
-DEBUG(D_host_lookup) debug_printf("sender_fullhost = %s\n", sender_fullhost);
-DEBUG(D_host_lookup) debug_printf("sender_rcvhost = %s\n", sender_rcvhost);
+DEBUG(D_host_lookup)
+ {
+ debug_printf_indent("sender_fullhost = %s\n", sender_fullhost);
+ debug_printf_indent("sender_rcvhost = %s\n", sender_rcvhost);
+ }
}
ident set, no host => U=ident
ident set, host set => H=sender_fullhost U=ident
-Use taint-unchecked routines on the assumption we'll never expand the results.
-
Arguments:
useflag TRUE if first item to be flagged (H= or U=); if there are two
items, the second is always flagged
-Returns: pointer to a string in big_buffer
+Returns: pointer to an allocated string
*/
uschar *
host_and_ident(BOOL useflag)
{
+gstring * g = NULL;
+
if (!sender_fullhost)
- string_format_nt(big_buffer, big_buffer_size, "%s%s", useflag ? "U=" : "",
- sender_ident ? sender_ident : US"unknown");
+ {
+ if (useflag)
+ g = string_catn(g, US"U=", 2);
+ g = string_cat(g, sender_ident ? sender_ident : US"unknown");
+ }
else
{
- uschar * flag = useflag ? US"H=" : US"";
- uschar * iface = US"";
+ if (useflag)
+ g = string_catn(g, US"H=", 2);
+ g = string_cat(g, sender_fullhost);
if (LOGGING(incoming_interface) && interface_address)
- iface = string_sprintf(" I=[%s]:%d", interface_address, interface_port);
+ g = string_fmt_append(g, " I=[%s]:%d", interface_address, interface_port);
if (sender_ident)
- string_format_nt(big_buffer, big_buffer_size, "%s%s%s U=%s",
- flag, sender_fullhost, iface, sender_ident);
- else
- string_format_nt(big_buffer, big_buffer_size, "%s%s%s",
- flag, sender_fullhost, iface);
+ g = string_fmt_append(g, " U=%s", sender_ident);
}
-return big_buffer;
+if (LOGGING(connection_id))
+ g = string_fmt_append(g, " Ci=%s", connection_id);
+gstring_release_unused(g);
+return string_from_gstring(g);
}
#endif /* STAND_ALONE */
address above. The field in the ip_address_item is large enough to hold an
IPv6 address. */
- next = store_get(sizeof(ip_address_item), FALSE);
+ next = store_get(sizeof(ip_address_item), list);
next->next = NULL;
Ustrcpy(next->address, s);
next->port = port;
ip_address_item *ipa2;
for (ipa2 = list; ipa2; ipa2 = ipa2->next)
if (Ustrcmp(ipa2->address, ipa->address) == 0) return list;
-ipa2 = store_get_perm(sizeof(ip_address_item), FALSE);
+ipa2 = store_get_perm(sizeof(ip_address_item), GET_UNTAINTED);
*ipa2 = *ipa;
ipa2->next = list;
return ipa2;
{
ip_address_item *running_interfaces = NULL;
-if (local_interface_data == NULL)
+if (!local_interface_data)
{
void *reset_item = store_mark();
ip_address_item *dlist = host_build_ifacelist(CUS local_interfaces,
*/
uschar *
-host_ntoa(int type, const void *arg, uschar *buffer, int *portptr)
+host_ntoa(int type, const void * arg, uschar * buffer, int * portptr)
{
-uschar *yield;
+uschar * yield;
/* The new world. It is annoying that we have to fish out the address from
different places in the block, depending on what kind of address it is. It
struct sockaddr_in6 *sk = (struct sockaddr_in6 *)arg;
yield = US inet_ntop(family, &(sk->sin6_addr), CS addr_buffer,
sizeof(addr_buffer));
- if (portptr != NULL) *portptr = ntohs(sk->sin6_port);
+ if (portptr) *portptr = ntohs(sk->sin6_port);
}
else
{
struct sockaddr_in *sk = (struct sockaddr_in *)arg;
yield = US inet_ntop(family, &(sk->sin_addr), CS addr_buffer,
sizeof(addr_buffer));
- if (portptr != NULL) *portptr = ntohs(sk->sin_port);
+ if (portptr) *portptr = ntohs(sk->sin_port);
}
}
else
if (type < 0)
{
yield = US inet_ntoa(((struct sockaddr_in *)arg)->sin_addr);
- if (portptr != NULL) *portptr = ntohs(((struct sockaddr_in *)arg)->sin_port);
+ if (portptr) *portptr = ntohs(((struct sockaddr_in *)arg)->sin_port);
}
else
yield = US inet_ntoa(*((struct in_addr *)arg));
/* If there is no buffer, put the string into some new store. */
-if (!buffer) buffer = store_get(46, FALSE);
+if (!buffer) buffer = store_get(46, GET_UNTAINTED);
/* Callers of this function with a non-NULL buffer must ensure that it is
large enough to hold an IPv6 address, namely, at least 46 bytes. That's what
*/
int
-host_aton(const uschar *address, int *bin)
+host_aton(const uschar * address, int * bin)
{
int x[4];
int v4offset = 0;
if (Ustrchr(address, ':') != NULL)
{
- const uschar *p = address;
- const uschar *component[8];
+ const uschar * p = address;
+ const uschar * component[8];
BOOL ipv4_ends = FALSE;
- int ci = 0;
- int nulloffset = 0;
- int v6count = 8;
- int i;
+ int ci = 0, nulloffset = 0, v6count = 8, i;
/* If the address starts with a colon, it will start with two colons.
Just lose the first one, which will leave a null first component. */
overlooked; to guard against that happening again, check here and crash if
there are too many components. */
- while (*p != 0 && *p != '%')
+ while (*p && *p != '%')
{
int len = Ustrcspn(p, ":%");
if (len == 0) nulloffset = ci;
*/
int
-host_nmtoa(int count, int *binary, int mask, uschar *buffer, int sep)
+host_nmtoa(int count, const int * binary, int mask, uschar * buffer, int sep)
{
-int j;
-uschar *tt = buffer;
+uschar * tt = buffer;
if (count == 1)
- {
- j = binary[0];
- for (int i = 24; i >= 0; i -= 8)
+ for (int j = binary[0], i = 24; i >= 0; i -= 8)
tt += sprintf(CS tt, "%d.", (j >> i) & 255);
- }
else
- for (int i = 0; i < 4; i++)
+ for (int j, i = 0; i < 4; i++)
{
j = binary[i];
tt += sprintf(CS tt, "%04x%c%04x%c", (j >> 16) & 0xffff, sep, j & 0xffff, sep);
c++;
}
-c[-1] = '\0'; /* drop trailing colon */
+*--c = '\0'; /* drop trailing colon */
-/* debug_printf("%s: D k %d <%s> <%s>\n", __FUNCTION__, k, d, d + 2*(k+1)); */
+/* debug_printf("%s: D k %d <%s> <%s>\n", __FUNCTION__, k, buffer, buffer + 2*(k+1)); */
if (k >= 0)
{ /* collapse */
c = d + 2*(k+1);
host_is_tls_on_connect_port(int port)
{
int sep = 0;
-uschar buffer[32];
-const uschar *list = tls_in.on_connect_ports;
-uschar *s;
-uschar *end;
+const uschar * list = tls_in.on_connect_ports;
if (tls_in.on_connect) return TRUE;
-while ((s = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
+for (uschar * s, * end; s = string_nextinlist(&list, &sep, NULL, 0); )
if (Ustrtol(s, &end, 10) == port)
return TRUE;
host_item *prev = NULL;
host_item *h;
-if (removed != NULL) *removed = FALSE;
+if (removed) *removed = FALSE;
-if (local_interface_data == NULL) local_interface_data = host_find_interfaces();
+if (!local_interface_data) local_interface_data = host_find_interfaces();
for (h = host; h != last->next; h = h->next)
{
- #ifndef STAND_ALONE
- if (hosts_treat_as_local != NULL)
+#ifndef STAND_ALONE
+ if (hosts_treat_as_local)
{
int rc;
- const uschar *save = deliver_domain;
+ const uschar * save = deliver_domain;
deliver_domain = h->name; /* set $domain */
rc = match_isinlist(string_copylc(h->name), CUSS &hosts_treat_as_local, 0,
&domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL);
deliver_domain = save;
if (rc == OK) goto FOUND_LOCAL;
}
- #endif
+#endif
/* It seems that on many operating systems, 0.0.0.0 is treated as a synonym
for 127.0.0.1 and refers to the local host. We therefore force it always to
be treated as local. */
- if (h->address != NULL)
+ if (h->address)
{
if (Ustrcmp(h->address, "0.0.0.0") == 0) goto FOUND_LOCAL;
for (ip_address_item * ip = local_interface_data; ip; ip = ip->next)
/* Update prev to point to the last host item before any that have
the same MX value as the one we have just considered. */
- if (h->next == NULL || h->next->mx != h->mx) prev = h;
+ if (!h->next || h->next->mx != h->mx)
+ prev = h;
}
return yield; /* No local hosts found: return HOST_FOUND or HOST_FIND_FAILED */
FOUND_LOCAL:
-if (prev == NULL)
+if (!prev)
{
- HDEBUG(D_host_lookup) debug_printf((h->mx >= 0)?
- "local host has lowest MX\n" :
- "local host found for non-MX address\n");
+ HDEBUG(D_host_lookup) debug_printf_indent(h->mx >= 0
+ ? "local host has lowest MX\n"
+ : "local host found for non-MX address\n");
return HOST_FOUND_LOCAL;
}
HDEBUG(D_host_lookup)
{
- debug_printf("local host in host list - removed hosts:\n");
+ debug_printf_indent("local host in host list - removed hosts:\n");
for (h = prev->next; h != last->next; h = h->next)
- debug_printf(" %s %s %d\n", h->name, h->address, h->mx);
+ debug_printf_indent(" %s %s %d\n", h->name, h->address, h->mx);
}
-if (removed != NULL) *removed = TRUE;
+if (removed) *removed = TRUE;
prev->next = last->next;
*lastptr = prev;
return yield;
if (!hosts->h_name || !hosts->h_name[0] || hosts->h_name[0] == '.')
{
- HDEBUG(D_host_lookup) debug_printf("IP address lookup yielded an empty name: "
- "treated as non-existent host name\n");
+ HDEBUG(D_host_lookup)
+ debug_printf_indent("IP address lookup yielded an empty name: "
+ "treated as non-existent host name\n");
return FAIL;
}
if (hosts->h_aliases)
{
- int count = 1;
+ int count = 1; /* need 1 more for terminating NULL */
uschar **ptr;
for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++) count++;
store_pool = POOL_PERM;
- ptr = sender_host_aliases = store_get(count * sizeof(uschar *), FALSE);
+ ptr = sender_host_aliases = store_get(count * sizeof(uschar *), GET_UNTAINTED);
store_pool = POOL_TAINT_PERM;
for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++)
int
host_name_lookup(void)
{
-int old_pool, rc;
-int sep = 0;
+int sep = 0, old_pool, rc, yield;
uschar *save_hostname;
uschar **aliases;
-uschar buffer[256];
uschar *ordername;
const uschar *list = host_lookup_order;
dns_answer * dnsa = store_get_dns_answer();
sender_host_dnssec = host_lookup_deferred = host_lookup_failed = FALSE;
HDEBUG(D_host_lookup)
- debug_printf("looking up host name for %s\n", sender_host_address);
+ debug_printf_indent("looking up host name for %s\n", sender_host_address);
+expand_level++;
/* For testing the case when a lookup does not complete, we have a special
reserved IP address. */
HDEBUG(D_host_lookup)
debug_printf("Test harness: host name lookup returns DEFER\n");
host_lookup_deferred = TRUE;
- return DEFER;
+ yield = DEFER;
+ goto out;
}
/* Do lookups directly in the DNS or via gethostbyaddr() (or equivalent), in
the order specified by the host_lookup_order option. */
-while ((ordername = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
+while ((ordername = string_nextinlist(&list, &sep, NULL, 0)))
{
if (strcmpic(ordername, US"bydns") == 0)
{
+ uschar * name = dns_build_reverse(sender_host_address);
+
dns_init(FALSE, FALSE, FALSE); /* dnssec ctrl by dns_dnssec_ok glbl */
- dns_build_reverse(sender_host_address, buffer);
- rc = dns_lookup_timerwrap(dnsa, buffer, T_PTR, NULL);
+ rc = dns_lookup_timerwrap(dnsa, name, T_PTR, NULL);
/* The first record we come across is used for the name; others are
considered to be aliases. We have to scan twice, in order to find out the
{
uschar **aptr = NULL;
int ssize = 264;
- int count = 0;
+ int count = 1; /* need 1 more for terminating NULL */
int old_pool = store_pool;
sender_host_dnssec = dns_is_secure(dnsa);
DEBUG(D_dns)
- debug_printf("Reverse DNS security status: %s\n",
+ debug_printf_indent("Reverse DNS security status: %s\n",
sender_host_dnssec ? "DNSSEC verified (AD)" : "unverified");
store_pool = POOL_PERM; /* Save names in permanent storage */
/* Get store for the list of aliases. For compatibility with
gethostbyaddr, we make an empty list if there are none. */
- aptr = sender_host_aliases = store_get(count * sizeof(uschar *), FALSE);
+ aptr = sender_host_aliases = store_get(count * sizeof(uschar *), GET_UNTAINTED);
/* Re-scan and extract the names */
rr;
rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_PTR)
{
- uschar * s = store_get(ssize, TRUE); /* names are tainted */
+ uschar * s = store_get(ssize, GET_TAINTED); /* names are tainted */
+ unsigned slen;
/* If an overlong response was received, the data will have been
truncated and dn_expand may fail. */
if (dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen,
- US (rr->data), (DN_EXPAND_ARG4_TYPE)(s), ssize) < 0)
+ US rr->data, (DN_EXPAND_ARG4_TYPE)(s), ssize) < 0)
{
log_write(0, LOG_MAIN, "host name alias list truncated for %s",
sender_host_address);
break;
}
- store_release_above(s + Ustrlen(s) + 1);
- if (!s[0])
+ store_release_above(s + (slen = Ustrlen(s)) + 1);
+ if (!*s)
+ {
+ HDEBUG(D_host_lookup) debug_printf_indent("IP address lookup yielded "
+ "an empty name: treated as non-existent host name\n");
+ continue;
+ }
+ if (Ustrspn(s, letter_digit_hyphen_dot) != slen)
{
- HDEBUG(D_host_lookup) debug_printf("IP address lookup yielded an "
- "empty name: treated as non-existent host name\n");
+ HDEBUG(D_host_lookup) debug_printf_indent("IP address lookup yielded "
+ "an illegal name (bad char): treated as non-existent host name\n");
continue;
}
if (!sender_host_name) sender_host_name = s;
HDEBUG(D_host_lookup)
debug_printf("IP address PTR lookup gave temporary error\n");
host_lookup_deferred = TRUE;
- return DEFER;
+ yield = DEFER;
+ goto out;
}
}
if (rc == DEFER)
{
host_lookup_deferred = TRUE;
- return rc; /* Can't carry on */
+ yield = rc; /* Can't carry on */
+ goto out;
}
if (rc == OK) break; /* Found a name */
}
"address %s", sender_host_address);
host_lookup_msg = US" (failed to find host name from IP address)";
host_lookup_failed = TRUE;
- return FAIL;
+ yield = FAIL;
+ goto out;
}
HDEBUG(D_host_lookup)
{
- uschar **aliases = sender_host_aliases;
- debug_printf("IP address lookup yielded \"%s\"\n", sender_host_name);
- while (*aliases != NULL) debug_printf(" alias \"%s\"\n", *aliases++);
+ uschar ** aliases = sender_host_aliases;
+ debug_printf_indent("IP address lookup yielded \"%s\"\n", sender_host_name);
+ while (*aliases) debug_printf_indent(" alias \"%s\"\n", *aliases++);
}
/* We need to verify that a forward lookup on the name we found does indeed
|| rc == HOST_FOUND_LOCAL
)
{
- HDEBUG(D_host_lookup) debug_printf("checking addresses for %s\n", hname);
+ HDEBUG(D_host_lookup)
+ debug_printf_indent("checking addresses for %s\n", hname);
/* If the forward lookup was not secure we cancel the is-secure variable */
- DEBUG(D_dns) debug_printf("Forward DNS security status: %s\n",
+ DEBUG(D_dns) debug_printf_indent("Forward DNS security status: %s\n",
h.dnssec == DS_YES ? "DNSSEC verified (AD)" : "unverified");
if (h.dnssec != DS_YES) sender_host_dnssec = FALSE;
HDEBUG(D_host_lookup) debug_printf("temporary error for host name lookup\n");
host_lookup_deferred = TRUE;
sender_host_name = NULL;
- return DEFER;
+ yield = DEFER;
+ goto out;
}
else
HDEBUG(D_host_lookup) debug_printf("no IP addresses found for %s\n", hname);
/* If sender_host_name == NULL, it means we didn't like the name. Replace
it with the first alias, if there is one. */
-if (sender_host_name == NULL && *sender_host_aliases != NULL)
+if (!sender_host_name && *sender_host_aliases)
sender_host_name = *sender_host_aliases++;
/* If we now have a main name, all is well. */
-if (sender_host_name != NULL) return OK;
+if (sender_host_name) { yield = OK; goto out; }
/* We have failed to find an address that matches. */
sender_host_address, save_hostname);
store_pool = old_pool;
host_lookup_failed = TRUE;
-return FAIL;
+yield = FAIL;
+
+out:
+ expand_level--;
+ return yield;
}
int yield, times;
host_item *last = NULL;
BOOL temp_error = FALSE;
-#if HAVE_IPV6
int af;
+
+#ifndef DISABLE_TLS
+/* Copy the host name at this point to the value which is used for
+TLS certificate name checking, before anything modifies it. */
+
+host->certname = host->name;
#endif
/* Make sure DNS options are set as required. This appears to be necessary in
#ifdef STAND_ALONE
if (disable_ipv6)
#else
- if (disable_ipv6 ||
- (dns_ipv4_lookup != NULL &&
- match_isinlist(host->name, CUSS &dns_ipv4_lookup, 0, NULL, NULL,
- MCL_DOMAIN, TRUE, NULL) == OK))
+ if ( disable_ipv6
+ || dns_ipv4_lookup
+ && match_isinlist(host->name, CUSS &dns_ipv4_lookup, 0,
+ &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK)
#endif
{ af = AF_INET; times = 1; }
/* No IPv6 support */
#else /* HAVE_IPV6 */
- times = 1;
+ af = AF_INET; times = 1;
#endif /* HAVE_IPV6 */
/* Initialize the flag that gets set for DNS syntax check errors, so that the
#else /* not HAVE_IPV6 */
if (f.running_in_test_harness)
- hostdata = host_fake_gethostbyname(host->name, AF_INET, &error_num);
+ hostdata = host_fake_gethostbyname(host->name, af, &error_num);
else
{
hostdata = gethostbyname(CS host->name);
&& (time_msec = get_time_in_ms() - time_msec) > slow_lookup_log)
log_long_lookup(US"gethostbyname", host->name, time_msec);
- if (hostdata == NULL)
+ if (!hostdata)
{
- uschar *error;
+ uschar * error;
switch (error_num)
{
- case HOST_NOT_FOUND: error = US"HOST_NOT_FOUND"; break;
- case TRY_AGAIN: error = US"TRY_AGAIN"; break;
- case NO_RECOVERY: error = US"NO_RECOVERY"; break;
- case NO_DATA: error = US"NO_DATA"; break;
- #if NO_DATA != NO_ADDRESS
- case NO_ADDRESS: error = US"NO_ADDRESS"; break;
- #endif
+ case HOST_NOT_FOUND: error = US"HOST_NOT_FOUND"; break;
+ case TRY_AGAIN: error = US"TRY_AGAIN"; temp_error = TRUE; break;
+ case NO_RECOVERY: error = US"NO_RECOVERY"; temp_error = TRUE; break;
+ case NO_DATA: error = US"NO_DATA"; break;
+ #if NO_DATA != NO_ADDRESS
+ case NO_ADDRESS: error = US"NO_ADDRESS"; break;
+ #endif
default: error = US"?"; break;
}
- DEBUG(D_host_lookup) debug_printf("%s returned %d (%s)\n",
- #if HAVE_IPV6
- #if HAVE_GETIPNODEBYNAME
- (af == AF_INET6)? "getipnodebyname(af=inet6)" : "getipnodebyname(af=inet)",
- #else
- (af == AF_INET6)? "gethostbyname2(af=inet6)" : "gethostbyname2(af=inet)",
- #endif
- #else
- "gethostbyname",
- #endif
- error_num, error);
+ DEBUG(D_host_lookup) debug_printf_indent("%s(af=%s) returned %d (%s)\n",
+ f.running_in_test_harness ? "host_fake_gethostbyname" :
+#if HAVE_IPV6
+# if HAVE_GETIPNODEBYNAME
+ "getipnodebyname",
+# else
+ "gethostbyname2",
+# endif
+#else
+ "gethostbyname",
+#endif
+ af == AF_INET ? "inet" : "inet6", error_num, error);
- if (error_num == TRY_AGAIN || error_num == NO_RECOVERY) temp_error = TRUE;
continue;
}
- if ((hostdata->h_addr_list)[0] == NULL) continue;
+ if (!(hostdata->h_addr_list)[0]) continue;
/* Replace the name with the fully qualified one if necessary, and fill in
the fully_qualified_name pointer. */
- if (hostdata->h_name[0] != 0 &&
- Ustrcmp(host->name, hostdata->h_name) != 0)
+ if (hostdata->h_name[0] && Ustrcmp(host->name, hostdata->h_name) != 0)
host->name = string_copy_dnsdomain(US hostdata->h_name);
- if (fully_qualified_name != NULL) *fully_qualified_name = host->name;
+ if (fully_qualified_name) *fully_qualified_name = host->name;
/* Get the list of addresses. IPv4 and IPv6 addresses can be distinguished
by their different lengths. Scan the list, ignoring any that are to be
host_ntoa(ipv4_addr? AF_INET:AF_INET6, *addrlist, NULL, NULL);
#ifndef STAND_ALONE
- if (ignore_target_hosts != NULL &&
- verify_check_this_host(&ignore_target_hosts, NULL, host->name,
- text_address, NULL) == OK)
+ if ( ignore_target_hosts
+ && verify_check_this_host(&ignore_target_hosts, NULL, host->name,
+ text_address, NULL) == OK)
{
DEBUG(D_host_lookup)
debug_printf("ignored host %s [%s]\n", host->name, text_address);
}
#endif
- /* If this is the first address, last == NULL and we put the data in the
+ /* If this is the first address, last is NULL and we put the data in the
original block. */
- if (last == NULL)
+ if (!last)
{
host->address = text_address;
host->port = PORT_NONE;
else
{
- host_item *next = store_get(sizeof(host_item), FALSE);
+ host_item *next = store_get(sizeof(host_item), GET_UNTAINTED);
next->name = host->name;
+#ifndef DISABLE_TLS
+ next->certname = host->certname;
+#endif
next->mx = host->mx;
next->address = text_address;
next->port = PORT_NONE;
NULL. If temp_error is set, at least one of the lookups gave a temporary error,
so we pass that back. */
-if (host->address == NULL)
+if (!host->address)
{
uschar *msg =
- #ifndef STAND_ALONE
- (message_id[0] == 0 && smtp_in != NULL)?
- string_sprintf("no IP address found for host %s (during %s)", host->name,
+#ifndef STAND_ALONE
+ !message_id[0] && smtp_in
+ ? string_sprintf("no IP address found for host %s (during %s)", host->name,
smtp_get_connection_info()) :
- #endif
+#endif
string_sprintf("no IP address found for host %s", host->name);
- HDEBUG(D_host_lookup) debug_printf("%s\n", msg);
+ HDEBUG(D_host_lookup) debug_printf_indent("%s\n", msg);
if (temp_error) goto RETURN_AGAIN;
if (host_checking || !f.log_testing_mode)
log_write(L_host_lookup_failed, LOG_MAIN, "%s", msg);
RETURN_AGAIN:
{
- #ifndef STAND_ALONE
+#ifndef STAND_ALONE
int rc;
const uschar *save = deliver_domain;
deliver_domain = host->name; /* set $domain */
- rc = match_isinlist(host->name, CUSS &dns_again_means_nonexist, 0, NULL, NULL,
- MCL_DOMAIN, TRUE, NULL);
+ rc = match_isinlist(host->name, CUSS &dns_again_means_nonexist, 0,
+ &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL);
deliver_domain = save;
if (rc == OK)
{
"returning HOST_FIND_FAILED\n", host->name);
return HOST_FIND_FAILED;
}
- #endif
+#endif
return HOST_FIND_AGAIN;
}
}
const uschar **fully_qualified_name,
BOOL dnssec_request, BOOL dnssec_require, int whichrrs)
{
-host_item *thishostlast = NULL; /* Indicates not yet filled in anything */
+host_item * thishostlast = NULL; /* Indicates not yet filled in anything */
BOOL v6_find_again = FALSE;
BOOL dnssec_fail = FALSE;
int i;
+dns_answer * dnsa;
+
+#ifndef DISABLE_TLS
+/* Copy the host name at this point to the value which is used for
+TLS certificate name checking, before any CNAME-following modifies it. */
+
+host->certname = host->name;
+#endif
/* If allow_ip is set, a name which is an IP address returns that value
as its address. This is used for MX records when allow_mx_to_ip is set, for
if (allow_ip && string_is_ip_address(host->name, NULL) != 0)
{
- #ifndef STAND_ALONE
+#ifndef STAND_ALONE
if ( ignore_target_hosts
&& verify_check_this_host(&ignore_target_hosts, NULL, host->name,
host->name, NULL) == OK)
return HOST_IGNORED;
- #endif
+#endif
host->address = host->name;
return HOST_FOUND;
}
+dnsa = store_get_dns_answer();
+
/* On an IPv6 system, unless IPv6 is disabled, go round the loop up to twice,
looking for AAAA records the first time. However, unless doing standalone
testing, we force an IPv4 lookup if the domain matches dns_ipv4_lookup global.
On an IPv4 system, go round the loop once only, looking only for A records. */
#if HAVE_IPV6
- #ifndef STAND_ALONE
+# ifndef STAND_ALONE
if ( disable_ipv6
|| !(whichrrs & HOST_FIND_BY_AAAA)
- || (dns_ipv4_lookup
- && match_isinlist(host->name, CUSS &dns_ipv4_lookup, 0, NULL, NULL,
- MCL_DOMAIN, TRUE, NULL) == OK)
+ || dns_ipv4_lookup
+ && match_isinlist(host->name, CUSS &dns_ipv4_lookup, 0,
+ &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK
)
i = 0; /* look up A records only */
else
- #endif /* STAND_ALONE */
+# endif /* STAND_ALONE */
i = 1; /* look up AAAA and A records */
int type = types[i];
int randoffset = i == (whichrrs & HOST_FIND_IPV4_FIRST ? 1 : 0)
? 500 : 0; /* Ensures v6/4 sort order */
- dns_answer * dnsa = store_get_dns_answer();
dns_scan dnss;
int rc = dns_lookup_timerwrap(dnsa, host->name, type, fully_qualified_name);
{
if (i == 0) /* Just tried for an A record, i.e. end of loop */
{
- if (host->address != NULL) return HOST_FOUND; /* AAAA was found */
- if (rc == DNS_AGAIN || rc == DNS_FAIL || v6_find_again)
- return HOST_FIND_AGAIN;
- return HOST_FIND_FAILED; /* DNS_NOMATCH or DNS_NODATA */
+ if (host->address != NULL)
+ i = HOST_FOUND; /* AAAA was found */
+ else if (rc == DNS_AGAIN || rc == DNS_FAIL || v6_find_again)
+ i = HOST_FIND_AGAIN;
+ else
+ i = HOST_FIND_FAILED; /* DNS_NOMATCH or DNS_NODATA */
+ goto out;
}
/* Tried for an AAAA record: remember if this was a temporary
/* Not a duplicate */
new_sort_key = host->mx * 1000 + random_number(500) + randoffset;
- next = store_get(sizeof(host_item), FALSE);
+ next = store_get(sizeof(host_item), GET_UNTAINTED);
/* New address goes first: insert the new block after the first one
(so as not to disturb the original pointer) but put the new address
/* Control gets here only if the second lookup (the A record) succeeded.
However, the address may not be filled in if it was ignored. */
-return host->address
+i = host->address
? HOST_FOUND
: dnssec_fail
? HOST_FIND_SECURITY
: HOST_IGNORED;
+
+out:
+ store_free_dns_answer(dnsa);
+ return i;
}
*/
int
-host_find_bydns(host_item *host, const uschar *ignore_target_hosts, int whichrrs,
- uschar *srv_service, uschar *srv_fail_domains, uschar *mx_fail_domains,
- const dnssec_domains *dnssec_d,
- const uschar **fully_qualified_name, BOOL *removed)
+host_find_bydns(host_item * host, const uschar * ignore_target_hosts,
+ int whichrrs,
+ uschar * srv_service, uschar * srv_fail_domains, uschar * mx_fail_domains,
+ const dnssec_domains * dnssec_d,
+ const uschar ** fully_qualified_name, BOOL * removed)
{
-host_item *h, *last;
-int rc = DNS_FAIL;
-int ind_type = 0;
-int yield;
+host_item * h, * last;
+int rc = DNS_FAIL, ind_type = 0, yield;
dns_answer * dnsa = store_get_dns_answer();
dns_scan dnss;
-BOOL dnssec_require = dnssec_d
- && match_isinlist(host->name, CUSS &dnssec_d->require,
- 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL) == OK;
-BOOL dnssec_request = dnssec_require
- || ( dnssec_d
- && match_isinlist(host->name, CUSS &dnssec_d->request,
- 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL) == OK);
+BOOL dnssec_require, dnssec_request;
dnssec_status_t dnssec;
+HDEBUG(D_host_lookup)
+ {
+ debug_printf_indent("check dnssec require list\n");
+ expand_level++;
+ }
+dnssec_require = dnssec_d
+ && match_isinlist(host->name, CUSS &dnssec_d->require,
+ 0, &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK;
+
+HDEBUG(D_host_lookup)
+ {
+ expand_level--;
+ debug_printf_indent("check dnssec request list\n");
+ expand_level++;
+ }
+dnssec_request = dnssec_require
+ || ( dnssec_d
+ && match_isinlist(host->name, CUSS &dnssec_d->request,
+ 0, &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK);
+HDEBUG(D_host_lookup)
+ expand_level--;
+
/* Set the default fully qualified name to the incoming name, initialize the
resolver if necessary, set up the relevant options, and initialize the flag
that gets set for DNS syntax check errors. */
-if (fully_qualified_name != NULL) *fully_qualified_name = host->name;
+if (fully_qualified_name) *fully_qualified_name = host->name;
dns_init((whichrrs & HOST_FIND_QUALIFY_SINGLE) != 0,
(whichrrs & HOST_FIND_SEARCH_PARENTS) != 0,
dnssec_request);
if (whichrrs & HOST_FIND_BY_SRV)
{
- gstring * g;
- uschar * temp_fully_qualified_name;
+ uschar * s, * temp_fully_qualified_name;
int prefix_length;
- g = string_fmt_append(NULL, "_%s._tcp.%n%.256s",
+ s = string_sprintf("_%s._tcp.%n%.256s",
srv_service, &prefix_length, host->name);
- temp_fully_qualified_name = string_from_gstring(g);
+ temp_fully_qualified_name = s;
ind_type = T_SRV;
/* Search for SRV records. If the fully qualified name is different to
if ((dnssec_request || dnssec_require)
&& !dns_is_secure(dnsa)
&& dns_is_aa(dnsa))
- debug_printf("DNS lookup of %.256s (SRV) requested AD, but got AA\n", host->name);
+ debug_printf_indent("DNS lookup of %.256s (SRV) requested AD, but got AA\n", host->name);
if (dnssec_request)
{
{ dnssec = DS_NO; lookup_dnssec_authenticated = US"no"; }
}
- if (temp_fully_qualified_name != g->s && fully_qualified_name != NULL)
+ if (temp_fully_qualified_name != s && fully_qualified_name)
*fully_qualified_name = temp_fully_qualified_name + prefix_length;
/* On DNS failures, we give the "try again" error unless the domain is
}
if (rc == DNS_FAIL || rc == DNS_AGAIN)
{
- #ifndef STAND_ALONE
- if (match_isinlist(host->name, CUSS &srv_fail_domains, 0, NULL, NULL,
- MCL_DOMAIN, TRUE, NULL) != OK)
- #endif
+#ifndef STAND_ALONE
+ if (match_isinlist(host->name, CUSS &srv_fail_domains, 0,
+ &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) != OK)
+#endif
{ yield = HOST_FIND_AGAIN; goto out; }
- DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA "
- "(domain in srv_fail_domains)\n", (rc == DNS_FAIL)? "FAIL":"AGAIN");
+ DEBUG(D_host_lookup) debug_printf_indent("DNS_%s treated as DNS_NODATA "
+ "(domain in srv_fail_domains)\n", rc == DNS_FAIL ? "FAIL":"AGAIN");
}
}
if ( (dnssec_request || dnssec_require)
&& !dns_is_secure(dnsa)
&& dns_is_aa(dnsa))
- debug_printf("DNS lookup of %.256s (MX) requested AD, but got AA\n", host->name);
+ debug_printf_indent("DNS lookup of %.256s (MX) requested AD, but got AA\n", host->name);
if (dnssec_request)
if (dns_is_secure(dnsa))
{
- DEBUG(D_host_lookup) debug_printf("%s (MX resp) DNSSEC\n", host->name);
+ DEBUG(D_host_lookup)
+ debug_printf_indent("%s (MX resp) DNSSEC\n", host->name);
dnssec = DS_YES; lookup_dnssec_authenticated = US"yes";
}
else
switch (rc)
{
case DNS_NOMATCH:
- yield = HOST_FIND_FAILED; goto out;
+ yield = HOST_FIND_FAILED;
+ goto out;
case DNS_SUCCEED:
if (!dnssec_require || dns_is_secure(dnsa))
break;
DEBUG(D_host_lookup)
- debug_printf("dnssec fail on MX for %.256s", host->name);
+ debug_printf_indent("dnssec fail on MX for %.256s\n", host->name);
#ifndef STAND_ALONE
- if (match_isinlist(host->name, CUSS &mx_fail_domains, 0, NULL, NULL,
- MCL_DOMAIN, TRUE, NULL) != OK)
+ if (match_isinlist(host->name, CUSS &mx_fail_domains, 0,
+ &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) != OK)
{ yield = HOST_FIND_SECURITY; goto out; }
#endif
rc = DNS_FAIL;
case DNS_FAIL:
case DNS_AGAIN:
#ifndef STAND_ALONE
- if (match_isinlist(host->name, CUSS &mx_fail_domains, 0, NULL, NULL,
- MCL_DOMAIN, TRUE, NULL) != OK)
+ if (match_isinlist(host->name, CUSS &mx_fail_domains, 0,
+ &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) != OK)
#endif
{ yield = HOST_FIND_AGAIN; goto out; }
- DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA "
+ DEBUG(D_host_lookup) debug_printf_indent("DNS_%s treated as DNS_NODATA "
"(domain in mx_fail_domains)\n", (rc == DNS_FAIL)? "FAIL":"AGAIN");
break;
}
{
if (!(whichrrs & (HOST_FIND_BY_A | HOST_FIND_BY_AAAA)))
{
- DEBUG(D_host_lookup) debug_printf("Address records are not being sought\n");
+ DEBUG(D_host_lookup) debug_printf_indent("Address records are not being sought\n");
yield = HOST_FIND_FAILED;
goto out;
}
if (rc == HOST_FOUND)
rc = host_scan_for_local_hosts(host, &last, removed);
- else
- if (rc == HOST_IGNORED) rc = HOST_FIND_FAILED; /* No special action */
+ else if (rc == HOST_IGNORED)
+ rc = HOST_FIND_FAILED; /* No special action */
DEBUG(D_host_lookup)
if (host->address)
{
if (fully_qualified_name)
- debug_printf("fully qualified name = %s\n", *fully_qualified_name);
+ debug_printf_indent("fully qualified name = %s\n", *fully_qualified_name);
for (host_item * h = host; h != last->next; h = h->next)
- debug_printf("%s %s mx=%d sort=%d %s\n", h->name,
+ debug_printf_indent("%s %s mx=%d sort=%d %s\n", h->name,
h->address ? h->address : US"<null>", h->mx, h->sort_key,
h->status >= hstatus_unusable ? US"*" : US"");
}
const uschar * s = rr->data; /* MUST be unsigned for GETSHORT */
uschar data[256];
+ if (rr_bad_size(rr, sizeof(uint16_t))) continue;
GETSHORT(precedence, s); /* Pointer s is advanced */
/* For MX records, we use a random "weight" which causes multiple records of
/* SRV records are specified with a port and a weight. The weight is used
in a special algorithm. However, to start with, we just use it to order the
records of equal priority (precedence). */
+
+ if (rr_bad_increment(rr, s, 2 * sizeof(uint16_t))) continue;
GETSHORT(weight, s);
GETSHORT(port, s);
}
if (strcmpic(h->name, data) == 0)
{
DEBUG(D_host_lookup)
- debug_printf("discarded duplicate host %s (MX=%d)\n", data,
+ debug_printf_indent("discarded duplicate host %s (MX=%d)\n", data,
precedence > h->mx ? precedence : h->mx);
if (precedence >= h->mx) goto NEXT_MX_RR; /* Skip greater precedence */
if (h == host) /* Override first item */
/* Make a new host item and seek the correct insertion place */
{
int sort_key = precedence * 1000 + weight;
- host_item *next = store_get(sizeof(host_item), FALSE);
+ host_item * next = store_get(sizeof(host_item), GET_UNTAINTED);
next->name = string_copy_dnsdomain(data);
next->address = NULL;
next->port = port;
if (host == last && host->name[0] == 0)
{
- DEBUG(D_host_lookup) debug_printf("the single SRV record is \".\"\n");
+ DEBUG(D_host_lookup) debug_printf_indent("the single SRV record is \".\"\n");
yield = HOST_FIND_FAILED;
goto out;
}
DEBUG(D_host_lookup)
{
- debug_printf("original ordering of hosts from SRV records:\n");
+ debug_printf_indent("original ordering of hosts from SRV records:\n");
for (h = host; h != last->next; h = h->next)
- debug_printf(" %s P=%d W=%d\n", h->name, h->mx, h->sort_key % 1000);
+ debug_printf_indent(" %s P=%d W=%d\n", h->name, h->mx, h->sort_key % 1000);
}
for (pptr = &host, h = host; h != last; pptr = &h->next, h = h->next)
h->next = next;
*next = temp;
}
-#endif
+#endif /*HAVE_IPV6*/
/* Remove any duplicate IP addresses and then scan the list of hosts for any
whose IP addresses are on the local host. If any are found, all hosts with the
DEBUG(D_host_lookup)
{
if (fully_qualified_name)
- debug_printf("fully qualified name = %s\n", *fully_qualified_name);
- debug_printf("host_find_bydns yield = %s (%d); returned hosts:\n",
+ debug_printf_indent("fully qualified name = %s\n", *fully_qualified_name);
+ debug_printf_indent("host_find_bydns yield = %s (%d); returned hosts:\n",
yield == HOST_FOUND ? "HOST_FOUND" :
yield == HOST_FOUND_LOCAL ? "HOST_FOUND_LOCAL" :
yield == HOST_FIND_SECURITY ? "HOST_FIND_SECURITY" :
yield);
for (h = host; h != last->next; h = h->next)
{
- debug_printf(" %s %s MX=%d %s", h->name,
+ debug_printf_indent(" %s %s MX=%d %s", h->name,
!h->address ? US"<null>" : h->address, h->mx,
h->dnssec == DS_YES ? US"DNSSEC " : US"");
if (h->port != PORT_NONE) debug_printf("port=%d ", h->port);
out:
dns_init(FALSE, FALSE, FALSE); /* clear the dnssec bit for getaddrbyname */
+store_free_dns_answer(dnsa);
return yield;
}
rc = dns_lookup_timerwrap(dnsa, buffer, T_TLSA, &fullname);
sec = dns_is_secure(dnsa);
DEBUG(D_transport)
- debug_printf("TLSA lookup ret %d %sDNSSEC\n", rc, sec ? "" : "not ");
+ debug_printf("TLSA lookup ret %s %sDNSSEC\n", dns_rc_names[rc], sec ? "" : "not ");
switch (rc)
{
disable_ipv6 = FALSE;
primary_hostname = US"";
+store_init();
store_pool = POOL_MAIN;
debug_selector = D_host_lookup|D_interface;
debug_file = stdout;
git://git.exim.org / exim.git / blobdiff