Build: Make test_{os,parse,dbfn,string} work

[exim.git] / src / src / dns.c

diff --git a/src/src/dns.c b/src/src/dns.c
index f1c038834ee03e216c85788b17bb4e3638b8fe21..a239bec3063a46a2f29c5d13507467e3a8d1faee 100644 (file)
--- a/src/src/dns.c
+++ b/src/src/dns.c
@@ -40,7 +40,6 @@ fakens_search(const uschar *domain, int type, uschar *answerptr, int size)
 {
 int len = Ustrlen(domain);
 int asize = size;                  /* Locally modified */
-uschar *endname;
 uschar name[256];
 uschar utilname[256];
 uschar *aptr = answerptr;          /* Locally modified */
@@ -51,7 +50,6 @@ struct stat statbuf;
 if (domain[len - 1] == '.') len--;
 Ustrncpy(name, domain, len);
 name[len] = 0;
-endname = name + len;
 
 /* Look for the fakens utility, and if it exists, call it. */
 
@@ -86,7 +84,7 @@ if (stat(CS utilname, &statbuf) >= 0)
     asize -= rc;      /* may need to be passed on to res_search(). */
     }
 
-  /* If we ran out of output buffer before exhasting the return,
+  /* If we ran out of output buffer before exhausting the return,
   carry on reading and counting it. */
 
   if (asize == 0)
@@ -402,6 +400,33 @@ return &(dnss->srr);
 }
 
 
+/* Extract the AUTHORITY information from the answer. If the
+answer isn't authoritive (AA not set), we do not extract anything.
+
+The AUTHORITIVE section contains NS records if
+the name in question was found, it contains a SOA record
+otherwise. (This is just from experience and some tests, is there
+some spec?)
+
+We've cycle through the AUTHORITY section, since it may contain
+other records (e.g. NSEC3) too.  */
+
+static const uschar *
+dns_extract_auth_name(const dns_answer * dnsa) /* FIXME: const dns_answer */
+{
+dns_scan dnss;
+dns_record * rr;
+HEADER * h = (HEADER *) dnsa->answer;
+
+if (!h->nscount || !h->aa) return NULL;
+for (rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_AUTHORITY);
+     rr;
+     rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_NEXT))
+  if (rr->type == (h->ancount ? T_NS : T_SOA)) return rr->name;
+return NULL;
+}
+
+
 
 
 /*************************************************
@@ -410,7 +435,7 @@ return &(dnss->srr);
 
 /* We do not perform DNSSEC work ourselves; if the administrator has installed
 a verifying resolver which sets AD as appropriate, though, we'll use that.
-(AD = Authentic Data)
+(AD = Authentic Data, AA = Authoritive Answer)
 
 Argument:   pointer to dns answer block
 Returns:    bool indicating presence of AD bit
@@ -424,8 +449,33 @@ DEBUG(D_dns)
   debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
 return FALSE;
 #else
-HEADER *h = (HEADER *)dnsa->answer;
-return h->ad ? TRUE : FALSE;
+HEADER * h = (HEADER *) dnsa->answer;
+const uschar * auth_name;
+const uschar * trusted;
+
+if (h->ad) return TRUE;
+
+/* If the resolver we ask is authoritive for the domain in question, it
+* may not set the AD but the AA bit. If we explicitly trust
+* the resolver for that domain (via a domainlist in dns_trust_aa),
+* we return TRUE to indicate a secure answer.
+*/
+
+if (  !h->aa
+   || !dns_trust_aa
+   || !(trusted = expand_string(dns_trust_aa))
+   || !*trusted
+   || !(auth_name = dns_extract_auth_name(dnsa))
+   || OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL,
+                           MCL_DOMAIN, TRUE, NULL) 
+   )
+  return FALSE;
+
+DEBUG(D_dns) debug_printf("DNS faked the AD bit "
+  "(got AA and matched with dns_trust_aa (%s in %s))\n",
+  auth_name, dns_trust_aa);
+
+return TRUE;
 #endif
 }
 
@@ -439,7 +489,7 @@ h->ad = 0;
 /************************************************
  *     Check whether the AA bit is set         *
  *     We need this to warn if we requested AD *
- *     from a authoritive server               *
+ *     from an authoritive server              *
  ************************************************/
 
 BOOL
@@ -513,8 +563,6 @@ node->data.val = rc;
 return rc;
 }
 
-
-
 /*************************************************
 *              Do basic DNS lookup               *
 *************************************************/
@@ -854,7 +902,7 @@ return DNS_FAIL;
 *    Do a DNS lookup and handle virtual types   *
 ************************************************/
 
-/* This function handles some invented "lookup types" that synthesize feature
+/* This function handles some invented "lookup types" that synthesize features
 not available in the basic types. The special types all have negative values.
 Positive type values are passed straight on to dns_lookup().