Rename substructure for ease of debugging

[exim.git] / src / src / lookups / dnsdb.c

diff --git a/src/src/lookups/dnsdb.c b/src/src/lookups/dnsdb.c
index a1eb2b6587813cb353347da76f746c89a69cf732..1e8df3b169e51d13dc610b15574dc625bc86dd1d 100644 (file)
--- a/src/src/lookups/dnsdb.c
+++ b/src/src/lookups/dnsdb.c
@@ -34,9 +34,6 @@ static const char *type_names[] = {
 #if HAVE_IPV6
   "a+",
   "aaaa",
 #if HAVE_IPV6
   "a+",
   "aaaa",

-  #ifdef SUPPORT_A6
-  "a6",
-  #endif

 #endif
   "cname",
   "csa",
 #endif
   "cname",
   "csa",


@@ -54,11 +51,8 @@ static const char *type_names[] = {
 static int type_values[] = {
   T_A,
 #if HAVE_IPV6
 static int type_values[] = {
   T_A,
 #if HAVE_IPV6

-  T_APL,     /* Private type for AAAA + A */
+  T_ADDRESSES,     /* Private type for AAAA + A */

   T_AAAA,
   T_AAAA,

-  #ifdef SUPPORT_A6
-  T_A6,
-  #endif

 #endif
   T_CNAME,
   T_CSA,     /* Private type for "Client SMTP Authorization". */
 #endif
   T_CNAME,
   T_CSA,     /* Private type for "Client SMTP Authorization". */


@@ -114,16 +108,20 @@ any defer causes the whole lookup to defer; 'lax', where a defer causes the
 whole lookup to defer only if none of the DNS queries succeeds; and 'never',
 where all defers are as if the lookup failed. The default is 'lax'.
 
 whole lookup to defer only if none of the DNS queries succeeds; and 'never',
 where all defers are as if the lookup failed. The default is 'lax'.
 

-(d) If the next sequence of characters is a sequence of letters and digits
+(d) Another optional comma-sep field: 'dnssec_FOO', with 'strict', 'lax'
+and 'never' (default); can appear before or after (c).  The meanings are
+require, try and don't-try dnssec respectively.
+
+(e) If the next sequence of characters is a sequence of letters and digits

 followed by '=', it is interpreted as the name of the DNS record type. The
 default is "TXT".
 
 followed by '=', it is interpreted as the name of the DNS record type. The
 default is "TXT".
 

-(e) Then there follows list of domain names. This is a generalized Exim list,
+(f) Then there follows list of domain names. This is a generalized Exim list,

 which may start with '<' in order to set a specific separator. The default
 separator, as always, is colon. */
 
 static int
 which may start with '<' in order to set a specific separator. The default
 separator, as always, is colon. */
 
 static int

-dnsdb_find(void *handle, uschar *filename, uschar *keystring, int length,
+dnsdb_find(void *handle, uschar *filename, const uschar *keystring, int length,

   uschar **result, uschar **errmsg, BOOL *do_cache)
 {
 int rc;
   uschar **result, uschar **errmsg, BOOL *do_cache)
 {
 int rc;


@@ -131,10 +129,11 @@ int size = 256;
 int ptr = 0;
 int sep = 0;
 int defer_mode = PASS;
 int ptr = 0;
 int sep = 0;
 int defer_mode = PASS;

+int dnssec_mode = OK;

 int type;
 int failrc = FAIL;
 int type;
 int failrc = FAIL;

-uschar *outsep = US"\n";
-uschar *outsep2 = NULL;
+const uschar *outsep = CUS"\n";
+const uschar *outsep2 = NULL;

 uschar *equals, *domain, *found;
 uschar buffer[256];
 
 uschar *equals, *domain, *found;
 uschar buffer[256];
 


@@ -173,35 +172,64 @@ if (*keystring == '>')
   while (isspace(*keystring)) keystring++;
   }
 
   while (isspace(*keystring)) keystring++;
   }
 

-/* Check for a defer behaviour keyword. */
+/* Check for a modifier keyword. */

 
 

-if (strncmpic(keystring, US"defer_", 6) == 0)
+while (  strncmpic(keystring, US"defer_", 6) == 0
+      || strncmpic(keystring, US"dnssec_", 7) == 0
+      )

   {
   {

-  keystring += 6;
-  if (strncmpic(keystring, US"strict", 6) == 0)
+  if (strncmpic(keystring, US"defer_", 6) == 0)

     {
     {

-    defer_mode = DEFER;

     keystring += 6;
     keystring += 6;

-    }
-  else if (strncmpic(keystring, US"lax", 3) == 0)
-    {
-    defer_mode = PASS;
-    keystring += 3;
-    }
-  else if (strncmpic(keystring, US"never", 5) == 0)
-    {
-    defer_mode = OK;
-    keystring += 5;
+    if (strncmpic(keystring, US"strict", 6) == 0)
+      {
+      defer_mode = DEFER;
+      keystring += 6;
+      }
+    else if (strncmpic(keystring, US"lax", 3) == 0)
+      {
+      defer_mode = PASS;
+      keystring += 3;
+      }
+    else if (strncmpic(keystring, US"never", 5) == 0)
+      {
+      defer_mode = OK;
+      keystring += 5;
+      }
+    else
+      {
+      *errmsg = US"unsupported dnsdb defer behaviour";
+      return DEFER;
+      }

     }
   else
     {
     }
   else
     {

-    *errmsg = US"unsupported dnsdb defer behaviour";
-    return DEFER;
+    keystring += 7;
+    if (strncmpic(keystring, US"strict", 6) == 0)
+      {
+      dnssec_mode = DEFER;
+      keystring += 6;
+      }
+    else if (strncmpic(keystring, US"lax", 3) == 0)
+      {
+      dnssec_mode = PASS;
+      keystring += 3;
+      }
+    else if (strncmpic(keystring, US"never", 5) == 0)
+      {
+      dnssec_mode = OK;
+      keystring += 5;
+      }
+    else
+      {
+      *errmsg = US"unsupported dnsdb dnssec behaviour";
+      return DEFER;
+      }

     }
   while (isspace(*keystring)) keystring++;
   if (*keystring++ != ',')
     {
     }
   while (isspace(*keystring)) keystring++;
   if (*keystring++ != ',')
     {

-    *errmsg = US"dnsdb defer behaviour syntax error";
+    *errmsg = US"dnsdb modifier syntax error";

     return DEFER;
     }
   while (isspace(*keystring)) keystring++;
     return DEFER;
     }
   while (isspace(*keystring)) keystring++;


@@ -241,7 +269,7 @@ if ((equals = Ustrchr(keystring, '=')) != NULL)
 
 /* Initialize the resolver in case this is the first time it has been used. */
 
 
 /* Initialize the resolver in case this is the first time it has been used. */
 

-dns_init(FALSE, FALSE, FALSE); /*XXX dnssec? */
+dns_init(FALSE, FALSE, dnssec_mode != OK);

 
 /* The remainder of the string must be a list of domains. As long as the lookup
 for at least one of them succeeds, we return success. Failure means that none
 
 /* The remainder of the string must be a list of domains. As long as the lookup
 for at least one of them succeeds, we return success. Failure means that none


@@ -261,10 +289,15 @@ if (type == T_PTR && keystring[0] != '<' &&
 /* SPF strings should be concatenated without a separator, thus make
 it the default if not defined (see RFC 4408 section 3.1.3).
 Multiple SPF records are forbidden (section 3.1.2) but are currently
 /* SPF strings should be concatenated without a separator, thus make
 it the default if not defined (see RFC 4408 section 3.1.3).
 Multiple SPF records are forbidden (section 3.1.2) but are currently

-not handled specially, thus they are concatenated with \n by default. */
+not handled specially, thus they are concatenated with \n by default.
+MX priority and value are space-separated by default.
+SRV and TLSA record parts are space-separated by default. */

 
 

-if (type == T_SPF && outsep2 == NULL)
-  outsep2 = US"";
+if (!outsep2) switch(type)
+  {
+  case T_SPF:                         outsep2 = US"";  break;
+  case T_SRV: case T_MX: case T_TLSA: outsep2 = US" "; break;
+  }

 
 /* Now scan the list and do a lookup for each item */
 
 
 /* Now scan the list and do a lookup for each item */
 


@@ -294,9 +327,9 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer)))
     DEBUG(D_lookup) debug_printf("dnsdb key: %s\n", domain);
 
     /* Do the lookup and sort out the result. There are four special types that
     DEBUG(D_lookup) debug_printf("dnsdb key: %s\n", domain);
 
     /* Do the lookup and sort out the result. There are four special types that

-    are handled specially: T_CSA, T_ZNS, T_APL and T_MXH.
+    are handled specially: T_CSA, T_ZNS, T_ADDRESSES and T_MXH.

     The first two are handled in a special lookup function so that the facility
     The first two are handled in a special lookup function so that the facility

-    could be used from other parts of the Exim code. T_APL is handled by looping
+    could be used from other parts of the Exim code. T_ADDRESSES is handled by looping

     over the types of A lookup.  T_MXH affects only what happens later on in
     this function, but for tidiness it is handled by the "special". If the
     lookup fails, continue with the next domain. In the case of DEFER, adjust
     over the types of A lookup.  T_MXH affects only what happens later on in
     this function, but for tidiness it is handled by the "special". If the
     lookup fails, continue with the next domain. In the case of DEFER, adjust


@@ -304,30 +337,34 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer)))
 
     found = domain;
 #if HAVE_IPV6
 
     found = domain;
 #if HAVE_IPV6

-    if (type == T_APL)         /* NB cannot happen unless HAVE_IPV6 */
+    if (type == T_ADDRESSES)           /* NB cannot happen unless HAVE_IPV6 */

       {
       {

-      if (searchtype == T_APL)
-# if defined(SUPPORT_A6)
-                                     searchtype = T_A6;
-# else
-                                     searchtype = T_AAAA;
-# endif
-      else if (searchtype == T_A6)   searchtype = T_AAAA;
+      if (searchtype == T_ADDRESSES) searchtype = T_AAAA;

       else if (searchtype == T_AAAA) searchtype = T_A;
       else if (searchtype == T_AAAA) searchtype = T_A;

-      rc = dns_special_lookup(&dnsa, domain, searchtype, &found);
+      rc = dns_special_lookup(&dnsa, domain, searchtype, CUSS &found);

       }
     else
 #endif
       }
     else
 #endif

-      rc = dns_special_lookup(&dnsa, domain, type, &found);
+      rc = dns_special_lookup(&dnsa, domain, type, CUSS &found);
+
+    lookup_dnssec_authenticated = dnssec_mode==OK ? NULL
+      : dns_is_secure(&dnsa) ? US"yes" : US"no";

 
     if (rc == DNS_NOMATCH || rc == DNS_NODATA) continue;
 
     if (rc == DNS_NOMATCH || rc == DNS_NODATA) continue;

-    if (rc != DNS_SUCCEED)
+    if (  rc != DNS_SUCCEED
+       || (dnssec_mode == DEFER && !dns_is_secure(&dnsa))
+       )

       {
       {

-      if (defer_mode == DEFER) return DEFER;          /* always defer */
+      if (defer_mode == DEFER)
+       {
+       dns_init(FALSE, FALSE, FALSE);                  /* clr dnssec bit */
+       return DEFER;                                   /* always defer */
+       }

       if (defer_mode == PASS) failrc = DEFER;         /* defer only if all do */
       continue;                                       /* treat defer as fail */
       }
 
       if (defer_mode == PASS) failrc = DEFER;         /* defer only if all do */
       continue;                                       /* treat defer as fail */
       }
 

+

     /* Search the returned records */
 
     for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
     /* Search the returned records */
 
     for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);


@@ -340,12 +377,7 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer)))
       separator between them, just as for between several records. However, A6
       support is not normally configured these days. */
 
       separator between them, just as for between several records. However, A6
       support is not normally configured these days. */
 

-      if (type == T_A ||
-          #ifdef SUPPORT_A6
-          type == T_A6 ||
-          #endif
-          type == T_AAAA ||
-         type == T_APL)
+      if (type == T_A || type == T_AAAA || type == T_ADDRESSES)

         {
         dns_address *da;
         for (da = dns_address_from_rr(&dnsa, rr); da != NULL; da = da->next)
         {
         dns_address *da;
         for (da = dns_address_from_rr(&dnsa, rr); da != NULL; da = da->next)


@@ -398,7 +430,8 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer)))
         matching_type = *p++;
         /* What's left after removing the first 3 bytes above */
         payload_length = rr->size - 3;
         matching_type = *p++;
         /* What's left after removing the first 3 bytes above */
         payload_length = rr->size - 3;

-        sp += sprintf(CS s, "%d %d %d ", usage, selector, matching_type);
+        sp += sprintf(CS s, "%d%c%d%c%d%c", usage, *outsep2,
+               selector, *outsep2, matching_type, *outsep2);

         /* Now append the cert/identifier, one hex char at a time */
         for (i=0;
              i < payload_length && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4);
         /* Now append the cert/identifier, one hex char at a time */
         for (i=0;
              i < payload_length && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4);


@@ -422,7 +455,7 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer)))
         else if (type == T_MX)
           {
           GETSHORT(priority, p);
         else if (type == T_MX)
           {
           GETSHORT(priority, p);

-          sprintf(CS s, "%d ", priority);
+          sprintf(CS s, "%d%c", priority, *outsep2);

           yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
           }
         else if (type == T_SRV)
           yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
           }
         else if (type == T_SRV)


@@ -430,7 +463,8 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer)))
           GETSHORT(priority, p);
           GETSHORT(weight, p);
           GETSHORT(port, p);
           GETSHORT(priority, p);
           GETSHORT(weight, p);
           GETSHORT(port, p);

-          sprintf(CS s, "%d %d %d ", priority, weight, port);
+          sprintf(CS s, "%d%c%d%c%d%c", priority, *outsep2,
+                                       weight, *outsep2, port, *outsep2);

           yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
           }
         else if (type == T_CSA)
           yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
           }
         else if (type == T_CSA)


@@ -447,7 +481,7 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer)))
           the subdomain assertions in the port field, else analyse the direct
           authorization status in the weight field. */
 
           the subdomain assertions in the port field, else analyse the direct
           authorization status in the weight field. */
 

-          if (found != domain)
+          if (Ustrcmp(found, domain) != 0)

             {
             if (port & 1) *s = 'X';         /* explicit authorization required */
             else *s = '?';                  /* no subdomain assertions here */
             {
             if (port & 1) *s = 'X';         /* explicit authorization required */
             else *s = '?';                  /* no subdomain assertions here */


@@ -483,7 +517,7 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer)))
       }    /* Loop for list of returned records */
 
            /* Loop for set of A-lookupu types */
       }    /* Loop for list of returned records */
 
            /* Loop for set of A-lookupu types */

-    } while (type == T_APL && searchtype != T_A);
+    } while (type == T_ADDRESSES && searchtype != T_A);

 
   }        /* Loop for list of domains */
 
 
   }        /* Loop for list of domains */
 


@@ -494,6 +528,8 @@ store_reset(yield + ptr + 1);
 /* If ptr == 0 we have not found anything. Otherwise, insert the terminating
 zero and return the result. */
 
 /* If ptr == 0 we have not found anything. Otherwise, insert the terminating
 zero and return the result. */
 

+dns_init(FALSE, FALSE, FALSE); /* clear the dnssec bit for getaddrbyname */
+

 if (ptr == 0) return failrc;
 yield[ptr] = 0;
 *result = yield;
 if (ptr == 0) return failrc;
 yield[ptr] = 0;
 *result = yield;


@@ -538,4 +574,6 @@ static lookup_info _lookup_info = {
 static lookup_info *_lookup_list[] = { &_lookup_info };
 lookup_module_info dnsdb_lookup_module_info = { LOOKUP_MODULE_INFO_MAGIC, _lookup_list, 1 };
 
 static lookup_info *_lookup_list[] = { &_lookup_info };
 lookup_module_info dnsdb_lookup_module_info = { LOOKUP_MODULE_INFO_MAGIC, _lookup_list, 1 };
 

+/* vi: aw ai sw=2
+*/

 /* End of lookups/dnsdb.c */
 /* End of lookups/dnsdb.c */