* Exim - an Internet mail transport agent *
*************************************************/
-/* Copyright (c) University of Cambridge 1995 - 2012 */
+/* Copyright (c) University of Cambridge 1995 - 2014 */
/* See the file NOTICE for conditions of use and distribution. */
#include "../exim.h"
#define T_SPF 99
#endif
+/* New TLSA record for DANE */
+#ifndef T_TLSA
+#define T_TLSA 52
+#endif
+
/* Table of recognized DNS record types and their integer values. */
static const char *type_names[] = {
"ptr",
"spf",
"srv",
+ "tlsa",
"txt",
"zns"
};
static int type_values[] = {
T_A,
#if HAVE_IPV6
- T_APL, /* Private type for AAAA + A */
+ T_ADDRESSES, /* Private type for AAAA + A */
T_AAAA,
#ifdef SUPPORT_A6
T_A6,
T_PTR,
T_SPF,
T_SRV,
+ T_TLSA,
T_TXT,
T_ZNS /* Private type for "zone nameservers" */
};
whole lookup to defer only if none of the DNS queries succeeds; and 'never',
where all defers are as if the lookup failed. The default is 'lax'.
-(d) If the next sequence of characters is a sequence of letters and digits
+(d) Another optional comma-sep field: 'dnssec_FOO', with 'strict', 'lax'
+and 'never' (default); can appear before or after (c). The meanings are
+require, try and don't-try dnssec respectively.
+
+(e) If the next sequence of characters is a sequence of letters and digits
followed by '=', it is interpreted as the name of the DNS record type. The
default is "TXT".
-(e) Then there follows list of domain names. This is a generalized Exim list,
+(f) Then there follows list of domain names. This is a generalized Exim list,
which may start with '<' in order to set a specific separator. The default
separator, as always, is colon. */
static int
-dnsdb_find(void *handle, uschar *filename, uschar *keystring, int length,
+dnsdb_find(void *handle, uschar *filename, const uschar *keystring, int length,
uschar **result, uschar **errmsg, BOOL *do_cache)
{
int rc;
int ptr = 0;
int sep = 0;
int defer_mode = PASS;
+int dnssec_mode = OK;
int type;
int failrc = FAIL;
-uschar *outsep = US"\n";
-uschar *outsep2 = NULL;
+const uschar *outsep = CUS"\n";
+const uschar *outsep2 = NULL;
uschar *equals, *domain, *found;
uschar buffer[256];
while (isspace(*keystring)) keystring++;
}
-/* Check for a defer behaviour keyword. */
+/* Check for a modifier keyword. */
-if (strncmpic(keystring, US"defer_", 6) == 0)
+while ( strncmpic(keystring, US"defer_", 6) == 0
+ || strncmpic(keystring, US"dnssec_", 7) == 0
+ )
{
- keystring += 6;
- if (strncmpic(keystring, US"strict", 6) == 0)
+ if (strncmpic(keystring, US"defer_", 6) == 0)
{
- defer_mode = DEFER;
keystring += 6;
- }
- else if (strncmpic(keystring, US"lax", 3) == 0)
- {
- defer_mode = PASS;
- keystring += 3;
- }
- else if (strncmpic(keystring, US"never", 5) == 0)
- {
- defer_mode = OK;
- keystring += 5;
+ if (strncmpic(keystring, US"strict", 6) == 0)
+ {
+ defer_mode = DEFER;
+ keystring += 6;
+ }
+ else if (strncmpic(keystring, US"lax", 3) == 0)
+ {
+ defer_mode = PASS;
+ keystring += 3;
+ }
+ else if (strncmpic(keystring, US"never", 5) == 0)
+ {
+ defer_mode = OK;
+ keystring += 5;
+ }
+ else
+ {
+ *errmsg = US"unsupported dnsdb defer behaviour";
+ return DEFER;
+ }
}
else
{
- *errmsg = US"unsupported dnsdb defer behaviour";
- return DEFER;
+ keystring += 7;
+ if (strncmpic(keystring, US"strict", 6) == 0)
+ {
+ dnssec_mode = DEFER;
+ keystring += 6;
+ }
+ else if (strncmpic(keystring, US"lax", 3) == 0)
+ {
+ dnssec_mode = PASS;
+ keystring += 3;
+ }
+ else if (strncmpic(keystring, US"never", 5) == 0)
+ {
+ dnssec_mode = OK;
+ keystring += 5;
+ }
+ else
+ {
+ *errmsg = US"unsupported dnsdb dnssec behaviour";
+ return DEFER;
+ }
}
while (isspace(*keystring)) keystring++;
if (*keystring++ != ',')
{
- *errmsg = US"dnsdb defer behaviour syntax error";
+ *errmsg = US"dnsdb modifier syntax error";
return DEFER;
}
while (isspace(*keystring)) keystring++;
/* Initialize the resolver in case this is the first time it has been used. */
-dns_init(FALSE, FALSE);
+dns_init(FALSE, FALSE, dnssec_mode != OK);
/* The remainder of the string must be a list of domains. As long as the lookup
for at least one of them succeeds, we return success. Failure means that none
/* SPF strings should be concatenated without a separator, thus make
it the default if not defined (see RFC 4408 section 3.1.3).
Multiple SPF records are forbidden (section 3.1.2) but are currently
-not handled specially, thus they are concatenated with \n by default. */
+not handled specially, thus they are concatenated with \n by default.
+MX priority and value are space-separated by default.
+SRV and TLSA record parts are space-separated by default. */
-if (type == T_SPF && outsep2 == NULL)
- outsep2 = US"";
+if (!outsep2) switch(type)
+ {
+ case T_SPF: outsep2 = US""; break;
+ case T_SRV: case T_MX: case T_TLSA: outsep2 = US" "; break;
+ }
/* Now scan the list and do a lookup for each item */
DEBUG(D_lookup) debug_printf("dnsdb key: %s\n", domain);
/* Do the lookup and sort out the result. There are four special types that
- are handled specially: T_CSA, T_ZNS, T_APL and T_MXH.
+ are handled specially: T_CSA, T_ZNS, T_ADDRESSES and T_MXH.
The first two are handled in a special lookup function so that the facility
- could be used from other parts of the Exim code. T_APL is handled by looping
+ could be used from other parts of the Exim code. T_ADDRESSES is handled by looping
over the types of A lookup. T_MXH affects only what happens later on in
this function, but for tidiness it is handled by the "special". If the
lookup fails, continue with the next domain. In the case of DEFER, adjust
the final "nothing found" result, but carry on to the next domain. */
found = domain;
- if (type == T_APL) /* NB cannot happen unless HAVE_IPV6 */
+#if HAVE_IPV6
+ if (type == T_ADDRESSES) /* NB cannot happen unless HAVE_IPV6 */
{
-#if HAVE_IPV6 && defined(SUPPORT_A6)
- if (searchtype == T_APL) searchtype = T_A6;
-#endif
-#if HAVE_IPV6 && !defined(SUPPORT_A6)
- if (searchtype == T_APL) searchtype = T_AAAA;
-#endif
+ if (searchtype == T_ADDRESSES)
+# if defined(SUPPORT_A6)
+ searchtype = T_A6;
+# else
+ searchtype = T_AAAA;
+# endif
else if (searchtype == T_A6) searchtype = T_AAAA;
else if (searchtype == T_AAAA) searchtype = T_A;
- rc = dns_special_lookup(&dnsa, domain, searchtype, &found);
+ rc = dns_special_lookup(&dnsa, domain, searchtype, CUSS &found);
}
else
- rc = dns_special_lookup(&dnsa, domain, type, &found);
+#endif
+ rc = dns_special_lookup(&dnsa, domain, type, CUSS &found);
+
+ lookup_dnssec_authenticated = dnssec_mode==OK ? NULL
+ : dns_is_secure(&dnsa) ? US"yes" : US"no";
if (rc == DNS_NOMATCH || rc == DNS_NODATA) continue;
- if (rc != DNS_SUCCEED)
+ if ( rc != DNS_SUCCEED
+ || (dnssec_mode == DEFER && !dns_is_secure(&dnsa))
+ )
{
- if (defer_mode == DEFER) return DEFER; /* always defer */
+ if (defer_mode == DEFER)
+ {
+ dns_init(FALSE, FALSE, FALSE); /* clr dnssec bit */
+ return DEFER; /* always defer */
+ }
if (defer_mode == PASS) failrc = DEFER; /* defer only if all do */
continue; /* treat defer as fail */
}
+
/* Search the returned records */
for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
type == T_A6 ||
#endif
type == T_AAAA ||
- type == T_APL)
+ type == T_ADDRESSES)
{
dns_address *da;
for (da = dns_address_from_rr(&dnsa, rr); da != NULL; da = da->next)
}
}
}
+ else if (type == T_TLSA)
+ {
+ uint8_t usage, selector, matching_type;
+ uint16_t i, payload_length;
+ uschar s[MAX_TLSA_EXPANDED_SIZE];
+ uschar * sp = s;
+ uschar *p = (uschar *)(rr->data);
+
+ usage = *p++;
+ selector = *p++;
+ matching_type = *p++;
+ /* What's left after removing the first 3 bytes above */
+ payload_length = rr->size - 3;
+ sp += sprintf(CS s, "%d%c%d%c%d%c", usage, *outsep2,
+ selector, *outsep2, matching_type, *outsep2);
+ /* Now append the cert/identifier, one hex char at a time */
+ for (i=0;
+ i < payload_length && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4);
+ i++)
+ {
+ sp += sprintf(CS sp, "%02x", (unsigned char)p[i]);
+ }
+ yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
+ }
else /* T_CNAME, T_CSA, T_MX, T_MXH, T_NS, T_PTR, T_SRV */
{
int priority, weight, port;
else if (type == T_MX)
{
GETSHORT(priority, p);
- sprintf(CS s, "%d ", priority);
+ sprintf(CS s, "%d%c", priority, *outsep2);
yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
}
else if (type == T_SRV)
GETSHORT(priority, p);
GETSHORT(weight, p);
GETSHORT(port, p);
- sprintf(CS s, "%d %d %d ", priority, weight, port);
+ sprintf(CS s, "%d%c%d%c%d%c", priority, *outsep2,
+ weight, *outsep2, port, *outsep2);
yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
}
else if (type == T_CSA)
the subdomain assertions in the port field, else analyse the direct
authorization status in the weight field. */
- if (found != domain)
+ if (Ustrcmp(found, domain) != 0)
{
if (port & 1) *s = 'X'; /* explicit authorization required */
else *s = '?'; /* no subdomain assertions here */
} /* Loop for list of returned records */
/* Loop for set of A-lookupu types */
- } while (type == T_APL && searchtype != T_A);
+ } while (type == T_ADDRESSES && searchtype != T_A);
} /* Loop for list of domains */
/* If ptr == 0 we have not found anything. Otherwise, insert the terminating
zero and return the result. */
+dns_init(FALSE, FALSE, FALSE); /* clear the dnssec bit for getaddrbyname */
+
if (ptr == 0) return failrc;
yield[ptr] = 0;
*result = yield;
static lookup_info *_lookup_list[] = { &_lookup_info };
lookup_module_info dnsdb_lookup_module_info = { LOOKUP_MODULE_INFO_MAGIC, _lookup_list, 1 };
+/* vi: aw ai sw=2
+*/
/* End of lookups/dnsdb.c */
git://git.exim.org / exim.git / blobdiff