+
+ /* Search the returned records */
+
+ for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
+ rr != NULL;
+ rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
+ {
+ if (rr->type != searchtype) continue;
+
+ if (*do_cache > rr->ttl)
+ *do_cache = rr->ttl;
+
+ if (type == T_A || type == T_AAAA || type == T_ADDRESSES)
+ {
+ dns_address *da;
+ for (da = dns_address_from_rr(&dnsa, rr); da; da = da->next)
+ {
+ if (ptr != 0) yield = string_catn(yield, &size, &ptr, outsep, 1);
+ yield = string_cat(yield, &size, &ptr, da->address);
+ }
+ continue;
+ }
+
+ /* Other kinds of record just have one piece of data each, but there may be
+ several of them, of course. */
+
+ if (ptr != 0) yield = string_catn(yield, &size, &ptr, outsep, 1);
+
+ if (type == T_TXT || type == T_SPF)
+ {
+ if (outsep2 == NULL)
+ {
+ /* output only the first item of data */
+ yield = string_catn(yield, &size, &ptr, US (rr->data+1),
+ (rr->data)[0]);
+ }
+ else
+ {
+ /* output all items */
+ int data_offset = 0;
+ while (data_offset < rr->size)
+ {
+ uschar chunk_len = (rr->data)[data_offset++];
+ if (outsep2[0] != '\0' && data_offset != 1)
+ yield = string_catn(yield, &size, &ptr, outsep2, 1);
+ yield = string_catn(yield, &size, &ptr,
+ US ((rr->data)+data_offset), chunk_len);
+ data_offset += chunk_len;
+ }
+ }
+ }
+ else if (type == T_TLSA)
+ {
+ uint8_t usage, selector, matching_type;
+ uint16_t i, payload_length;
+ uschar s[MAX_TLSA_EXPANDED_SIZE];
+ uschar * sp = s;
+ uschar * p = US rr->data;
+
+ usage = *p++;
+ selector = *p++;
+ matching_type = *p++;
+ /* What's left after removing the first 3 bytes above */
+ payload_length = rr->size - 3;
+ sp += sprintf(CS s, "%d%c%d%c%d%c", usage, *outsep2,
+ selector, *outsep2, matching_type, *outsep2);
+ /* Now append the cert/identifier, one hex char at a time */
+ for (i=0;
+ i < payload_length && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4);
+ i++)
+ sp += sprintf(CS sp, "%02x", (unsigned char)p[i]);
+
+ yield = string_cat(yield, &size, &ptr, s);
+ }
+ else /* T_CNAME, T_CSA, T_MX, T_MXH, T_NS, T_PTR, T_SOA, T_SRV */
+ {
+ int priority, weight, port;
+ uschar s[264];
+ uschar * p = US rr->data;
+
+ switch (type)
+ {
+ case T_MXH:
+ /* mxh ignores the priority number and includes only the hostnames */
+ GETSHORT(priority, p);
+ break;
+
+ case T_MX:
+ GETSHORT(priority, p);
+ sprintf(CS s, "%d%c", priority, *outsep2);
+ yield = string_cat(yield, &size, &ptr, s);
+ break;
+
+ case T_SRV:
+ GETSHORT(priority, p);
+ GETSHORT(weight, p);
+ GETSHORT(port, p);
+ sprintf(CS s, "%d%c%d%c%d%c", priority, *outsep2,
+ weight, *outsep2, port, *outsep2);
+ yield = string_cat(yield, &size, &ptr, s);
+ break;
+
+ case T_CSA:
+ /* See acl_verify_csa() for more comments about CSA. */
+ GETSHORT(priority, p);
+ GETSHORT(weight, p);
+ GETSHORT(port, p);
+
+ if (priority != 1) continue; /* CSA version must be 1 */
+
+ /* If the CSA record we found is not the one we asked for, analyse
+ the subdomain assertions in the port field, else analyse the direct
+ authorization status in the weight field. */
+
+ if (Ustrcmp(found, domain) != 0)
+ {
+ if (port & 1) *s = 'X'; /* explicit authorization required */
+ else *s = '?'; /* no subdomain assertions here */
+ }
+ else
+ {
+ if (weight < 2) *s = 'N'; /* not authorized */
+ else if (weight == 2) *s = 'Y'; /* authorized */
+ else if (weight == 3) *s = '?'; /* unauthorizable */
+ else continue; /* invalid */
+ }
+
+ s[1] = ' ';
+ yield = string_catn(yield, &size, &ptr, s, 2);
+ break;
+
+ default:
+ break;
+ }
+
+ /* GETSHORT() has advanced the pointer to the target domain. */
+
+ rc = dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
+ (DN_EXPAND_ARG4_TYPE)s, sizeof(s));
+
+ /* If an overlong response was received, the data will have been
+ truncated and dn_expand may fail. */
+
+ if (rc < 0)
+ {
+ log_write(0, LOG_MAIN, "host name alias list truncated: type=%s "
+ "domain=%s", dns_text_type(type), domain);
+ break;
+ }
+ else yield = string_cat(yield, &size, &ptr, s);
+
+ if (type == T_SOA && outsep2 != NULL)
+ {
+ unsigned long serial, refresh, retry, expire, minimum;
+
+ p += rc;
+ yield = string_catn(yield, &size, &ptr, outsep2, 1);
+
+ rc = dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
+ (DN_EXPAND_ARG4_TYPE)s, sizeof(s));
+ if (rc < 0)
+ {
+ log_write(0, LOG_MAIN, "responsible-mailbox truncated: type=%s "
+ "domain=%s", dns_text_type(type), domain);
+ break;
+ }
+ else yield = string_cat(yield, &size, &ptr, s);
+
+ p += rc;
+ GETLONG(serial, p); GETLONG(refresh, p);
+ GETLONG(retry, p); GETLONG(expire, p); GETLONG(minimum, p);
+ sprintf(CS s, "%c%lu%c%lu%c%lu%c%lu%c%lu",
+ *outsep2, serial, *outsep2, refresh,
+ *outsep2, retry, *outsep2, expire, *outsep2, minimum);
+ yield = string_cat(yield, &size, &ptr, s);
+ }
+ }
+ } /* Loop for list of returned records */
+
+ /* Loop for set of A-lookup types */
+ } while (type == T_ADDRESSES && searchtype != T_A);
+
+ } /* Loop for list of domains */
+
+/* Reclaim unused memory */
+
+store_reset(yield + ptr + 1);
+
+/* If ptr == 0 we have not found anything. Otherwise, insert the terminating
+zero and return the result. */
+
+dns_retrans = save_retrans;
+dns_retry = save_retry;
+dns_init(FALSE, FALSE, FALSE); /* clear the dnssec bit for getaddrbyname */
+
+if (ptr == 0) return failrc;