{
int len = Ustrlen(domain);
int asize = size; /* Locally modified */
-uschar *endname;
uschar name[256];
uschar utilname[256];
uschar *aptr = answerptr; /* Locally modified */
if (domain[len - 1] == '.') len--;
Ustrncpy(name, domain, len);
name[len] = 0;
-endname = name + len;
/* Look for the fakens utility, and if it exists, call it. */
asize -= rc; /* may need to be passed on to res_search(). */
}
- /* If we ran out of output buffer before exhasting the return,
+ /* If we ran out of output buffer before exhausting the return,
carry on reading and counting it. */
if (asize == 0)
dnss->aptr += namelen;
GETSHORT(dnss->srr.type, dnss->aptr); /* Record type */
-dnss->aptr += 6; /* Don't want class or TTL */
+dnss->aptr += 2; /* Don't want class */
+GETLONG(dnss->srr.ttl, dnss->aptr); /* TTL */
GETSHORT(dnss->srr.size, dnss->aptr); /* Size of data portion */
dnss->srr.data = dnss->aptr; /* The record's data follows */
dnss->aptr += dnss->srr.size; /* Advance to next RR */
}
-/* Extract the AUTHORITY info from the answer. If the
- * answer isn't authoritive (AA) we do not extract anything.
- * We've to search for SOA or NS records, since there may be
- * other records (e.g. NSEC3) too.
- */
-static const uschar*
-dns_extract_auth_name(const dns_answer *dnsa) /* FIXME: const dns_answer */
+/* Extract the AUTHORITY information from the answer. If the
+answer isn't authoritive (AA not set), we do not extract anything.
+
+The AUTHORITIVE section contains NS records if
+the name in question was found, it contains a SOA record
+otherwise. (This is just from experience and some tests, is there
+some spec?)
+
+We've cycle through the AUTHORITY section, since it may contain
+other records (e.g. NSEC3) too. */
+
+static const uschar *
+dns_extract_auth_name(const dns_answer * dnsa) /* FIXME: const dns_answer */
{
- dns_scan dnss;
- dns_record *rr;
- HEADER *h = (HEADER *) dnsa->answer;
- if (!h->nscount || !h->aa) return NULL;
- for (rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_AUTHORITY);
- rr;
- rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_NEXT))
- if (rr->type == T_SOA || rr->type == T_NS) return rr->name;
- return NULL;
+dns_scan dnss;
+dns_record * rr;
+HEADER * h = (HEADER *) dnsa->answer;
+
+if (!h->nscount || !h->aa) return NULL;
+for (rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_AUTHORITY);
+ rr;
+ rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_NEXT))
+ if (rr->type == (h->ancount ? T_NS : T_SOA)) return rr->name;
+return NULL;
}
debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
return FALSE;
#else
-HEADER *h = (HEADER *) dnsa->answer;
+HEADER * h = (HEADER *) dnsa->answer;
+const uschar * auth_name;
+const uschar * trusted;
if (h->ad) return TRUE;
-else
- {
- /* If the resolver we ask is authoritive for the domain in question, it
- * may not set the AD but the AA bit. If we explicitly trust
- * the resolver for that domain (via a domainlist in dns_trust_aa),
- * we return TRUE to indicate a secure answer.
- */
- const uschar *auth_name;
- const uschar *trusted;
-
- if (!h->aa || !dns_trust_aa) return FALSE;
-
- trusted = expand_string(dns_trust_aa);
- auth_name = dns_extract_auth_name(dnsa);
- if (OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL))
- return FALSE;
- DEBUG(D_dns)
- debug_printf("DNS faked the AD bit (got AA and matched with dns_trust_aa (%s in %s))\n", auth_name, dns_trust_aa);
+/* If the resolver we ask is authoritive for the domain in question, it
+* may not set the AD but the AA bit. If we explicitly trust
+* the resolver for that domain (via a domainlist in dns_trust_aa),
+* we return TRUE to indicate a secure answer.
+*/
- return TRUE;
-}
+if ( !h->aa
+ || !dns_trust_aa
+ || !(trusted = expand_string(dns_trust_aa))
+ || !*trusted
+ || !(auth_name = dns_extract_auth_name(dnsa))
+ || OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL,
+ MCL_DOMAIN, TRUE, NULL)
+ )
+ return FALSE;
+
+DEBUG(D_dns) debug_printf("DNS faked the AD bit "
+ "(got AA and matched with dns_trust_aa (%s in %s))\n",
+ auth_name, dns_trust_aa);
+
+return TRUE;
#endif
}
return previous->data.val;
}
-#ifdef EXPERIMENTAL_INTERNATIONAL
+#ifdef SUPPORT_I18N
/* Convert all names to a-label form before doing lookup */
{
uschar * alabel;
if ( rr_name
&& Ustrcmp(rr_name, *fully_qualified_name) != 0
&& rr_name[0] != '*'
-#ifdef EXPERIMENTAL_INTERNATIONAL
+#ifdef SUPPORT_I18N
&& ( !string_is_utf8(*fully_qualified_name)
|| Ustrcmp(rr_name,
string_domain_utf8_to_alabel(*fully_qualified_name, NULL)) != 0
* Get address(es) from DNS record *
*************************************************/
-/* The record type is either T_A for an IPv4 address or T_AAAA (or T_A6 when
-supported) for an IPv6 address.
+/* The record type is either T_A for an IPv4 address or T_AAAA for an IPv6 address.
Argument:
dnsa the DNS answer block
{
if (rr->data + 16 <= dnsa_lim)
{
+ struct in6_addr in6;
+ int i;
+ for (i = 0; i < 16; i++) in6.__in6_u.__u6_addr8[i] = rr->data[i];
yield = store_get(sizeof(dns_address) + 50);
- inet_ntop(AF_INET6, US rr->data, CS yield->address, 50);
+ inet_ntop(AF_INET6, &in6, CS yield->address, 50);
yield->next = NULL;
}
}