DKIM: enforce limit of 20 on received DKIM-Signature: headers. Bug 2269

[exim.git] / test / src / fakens.c

diff --git a/test/src/fakens.c b/test/src/fakens.c
index a03f94a07414615bacdde0e5e7c85b75aa80a1e5..583b0128270fb23ca49da0e8390dcb175c4741cd 100644 (file)
--- a/test/src/fakens.c
+++ b/test/src/fakens.c
@@ -25,7 +25,7 @@ The arguments to the program are:
   the DNS record type that is being sought
 
 The output from the program is written to stdout. It is supposed to be in
   the DNS record type that is being sought
 
 The output from the program is written to stdout. It is supposed to be in

-exactly the same format as a traditional namserver response (see RFC 1035) so
+exactly the same format as a traditional nameserver response (see RFC 1035) so

 that Exim can process it as normal. At present, no compression is used.
 Error messages are written to stderr.
 
 that Exim can process it as normal. At present, no compression is used.
 Error messages are written to stderr.
 


@@ -53,14 +53,21 @@ HOST_NOT_FOUND.
 Any DNS record line in a zone file can be prefixed with "DELAY=" and
 a number of milliseconds (followed by one space).
 
 Any DNS record line in a zone file can be prefixed with "DELAY=" and
 a number of milliseconds (followed by one space).
 

-Any DNS record line in a zone file can be prefixed with "DNSSEC ";
+Any DNS record line can be prefixed with "DNSSEC ";

 if all the records found by a lookup are marked
 as such then the response will have the "AD" bit set.
 
 if all the records found by a lookup are marked
 as such then the response will have the "AD" bit set.
 

-Any DNS record line in a zone file can be prefixed with "AA "
+Any DNS record line can be prefixed with "NXDOMAIN ";
+The record will be ignored (but the prefix set still applied);
+This lets us return a DNSSEC NXDOMAIN.
+
+Any DNS record line can be prefixed with "AA "

 if all the records found by a lookup are marked
 as such then the response will have the "AA" bit set.
 
 if all the records found by a lookup are marked
 as such then the response will have the "AA" bit set.
 

+Any DNS record line in a zone file can be prefixed with "TTL=" and
+a number of seconds (followed by one space).
+

 */
 
 #include <ctype.h>
 */
 
 #include <ctype.h>


@@ -72,9 +79,14 @@ as such then the response will have the "AA" bit set.
 #include <errno.h>
 #include <signal.h>
 #include <arpa/nameser.h>
 #include <errno.h>
 #include <signal.h>
 #include <arpa/nameser.h>

+#include <arpa/inet.h>

 #include <sys/types.h>
 #include <sys/time.h>
 #include <dirent.h>
 #include <sys/types.h>
 #include <sys/time.h>
 #include <dirent.h>

+#include <unistd.h>
+#ifdef HAVE_SYS_SOCKET_H
+#include <sys/socket.h>
+#endif

 
 #define FALSE         0
 #define TRUE          1
 
 #define FALSE         0
 #define TRUE          1


@@ -94,6 +106,7 @@ typedef unsigned char uschar;
 #define Ustrlen(s)         (int)strlen(CCS(s))
 #define Ustrncmp(s,t,n)    strncmp(CCS(s),CCS(t),n)
 #define Ustrncpy(s,t,n)    strncpy(CS(s),CCS(t),n)
 #define Ustrlen(s)         (int)strlen(CCS(s))
 #define Ustrncmp(s,t,n)    strncmp(CCS(s),CCS(t),n)
 #define Ustrncpy(s,t,n)    strncpy(CS(s),CCS(t),n)

+#define Ustrtok(s,t)       (uschar*)strtok(CS(s),CCS(t))

 
 typedef struct zoneitem {
   uschar *zone;
 
 typedef struct zoneitem {
   uschar *zone;


@@ -105,6 +118,8 @@ typedef struct tlist {
   int value;
 } tlist;
 
   int value;
 } tlist;
 

+#define DEFAULT_TTL 3600U
+

 /* On some (older?) operating systems, the standard ns_t_xxx definitions are
 not available, and only the older T_xxx ones exist in nameser.h. If ns_t_a is
 not defined, assume we are in this state. A really old system might not even
 /* On some (older?) operating systems, the standard ns_t_xxx definitions are
 not available, and only the older T_xxx ones exist in nameser.h. If ns_t_a is
 not defined, assume we are in this state. A really old system might not even


@@ -331,9 +346,6 @@ if (typeptr->name == NULL)
 rrdomain[0] = 0;                 /* No previous domain */
 (void)fseek(f, 0, SEEK_SET);     /* Start again at the beginning */
 
 rrdomain[0] = 0;                 /* No previous domain */
 (void)fseek(f, 0, SEEK_SET);     /* Start again at the beginning */
 

-if (dnssec) *dnssec = TRUE;     /* cancelled by first nonsecure rec found */
-if (aa) *aa = TRUE;             /* cancelled by first non-aa rec found */
-

 /* Scan for RRs */
 
 while (fgets(CS buffer, sizeof(buffer), f) != NULL)
 /* Scan for RRs */
 
 while (fgets(CS buffer, sizeof(buffer), f) != NULL)


@@ -346,7 +358,9 @@ while (fgets(CS buffer, sizeof(buffer), f) != NULL)
   int qtlen = qtypelen;
   BOOL rr_sec = FALSE;
   BOOL rr_aa = FALSE;
   int qtlen = qtypelen;
   BOOL rr_sec = FALSE;
   BOOL rr_aa = FALSE;

+  BOOL rr_ignore = FALSE;

   int delay = 0;
   int delay = 0;

+  uint ttl = DEFAULT_TTL;

 
   p = buffer;
   while (isspace(*p)) p++;
 
   p = buffer;
   while (isspace(*p)) p++;


@@ -370,7 +384,12 @@ while (fgets(CS buffer, sizeof(buffer), f) != NULL)
       rr_sec = TRUE;
       p += 7;
       }
       rr_sec = TRUE;
       p += 7;
       }

-    else if (Ustrncmp(p, US"AA ", 3) == 0)      /* tagged as authoritive */
+    if (Ustrncmp(p, US"NXDOMAIN ", 9) == 0)     /* ignore record content */
+      {
+      rr_ignore = TRUE;
+      p += 9;
+      }
+    else if (Ustrncmp(p, US"AA ", 3) == 0)      /* tagged as authoritative */

       {
       rr_aa = TRUE;
       p += 3;
       {
       rr_aa = TRUE;
       p += 3;


@@ -380,6 +399,12 @@ while (fgets(CS buffer, sizeof(buffer), f) != NULL)
       for (p += 6; *p >= '0' && *p <= '9'; p++) delay = delay*10 + *p - '0';
       if (isspace(*p)) p++;
       }
       for (p += 6; *p >= '0' && *p <= '9'; p++) delay = delay*10 + *p - '0';
       if (isspace(*p)) p++;
       }

+    else if (Ustrncmp(p, US"TTL=", 4) == 0)     /* TTL for record */
+      {
+      ttl = 0;
+      for (p += 4; *p >= '0' && *p <= '9'; p++) ttl = ttl*10 + *p - '0';
+      if (isspace(*p)) p++;
+      }

     else
       break;
     }
     else
       break;
     }


@@ -420,7 +445,12 @@ while (fgets(CS buffer, sizeof(buffer), f) != NULL)
 
   /* The domain matches */
 
 
   /* The domain matches */
 

-  if (yield == HOST_NOT_FOUND) yield = NO_DATA;
+  if (yield == HOST_NOT_FOUND)
+    {
+    yield = NO_DATA;
+    if (dnssec) *dnssec = TRUE;     /* cancelled by first nonsecure rec found */
+    if (aa) *aa = TRUE;             /* cancelled by first non-aa rec found */
+    }

 
   /* Compare RR types; a CNAME record is always returned */
 
 
   /* Compare RR types; a CNAME record is always returned */
 


@@ -444,6 +474,8 @@ while (fgets(CS buffer, sizeof(buffer), f) != NULL)
   if (aa && !rr_aa)
     *aa = FALSE;                        /* cancel AA return */
 
   if (aa && !rr_aa)
     *aa = FALSE;                        /* cancel AA return */
 

+  if (rr_ignore) continue;
+

   yield = 0;
   *countptr = *countptr + 1;
 
   yield = 0;
   *countptr = *countptr + 1;
 


@@ -459,7 +491,10 @@ while (fgets(CS buffer, sizeof(buffer), f) != NULL)
   *pk++ = 0;
   *pk++ = 1;     /* class = IN */
 
   *pk++ = 0;
   *pk++ = 1;     /* class = IN */
 

-  pk += 4;       /* TTL field; don't care */
+  *pk++ = (ttl >>24) & 255;
+  *pk++ = (ttl >>16) & 255;
+  *pk++ = (ttl >> 8) & 255;
+  *pk++ = ttl & 255;

 
   rdlptr = pk;   /* remember rdlength field */
   pk += 2;
 
   rdlptr = pk;   /* remember rdlength field */
   pk += 2;


@@ -469,13 +504,13 @@ while (fgets(CS buffer, sizeof(buffer), f) != NULL)
   switch (tvalue)
     {
     case ns_t_soa:
   switch (tvalue)
     {
     case ns_t_soa:

-      p = strtok(p, " ");
-      ep = p + strlen(p);
+      p = Ustrtok(p, " ");
+      ep = p + Ustrlen(p);

       if (ep[-1] != '.') sprintf(CS ep, "%s.", zone);
       pk = packname(p, pk);                     /* primary ns */
       if (ep[-1] != '.') sprintf(CS ep, "%s.", zone);
       pk = packname(p, pk);                     /* primary ns */

-      p = strtok(NULL, " ");
+      p = Ustrtok(NULL, " ");

       pk = packname(p , pk);                    /* responsible mailbox */
       pk = packname(p , pk);                    /* responsible mailbox */

-      *(p += strlen(p)) = ' ';
+      *(p += Ustrlen(p)) = ' ';

       while (isspace(*p)) p++;
       pk = longfield(&p, pk);                   /* serial */
       pk = longfield(&p, pk);                   /* refresh */
       while (isspace(*p)) p++;
       pk = longfield(&p, pk);                   /* serial */
       pk = longfield(&p, pk);                   /* refresh */


@@ -485,35 +520,13 @@ while (fgets(CS buffer, sizeof(buffer), f) != NULL)
       break;
 
     case ns_t_a:
       break;
 
     case ns_t_a:

-      for (i = 0; i < 4; i++)
-        {
-        value = 0;
-        while (isdigit(*p)) value = value*10 + *p++ - '0';
-        *pk++ = value;
-        p++;
-        }
+      inet_pton(AF_INET, CCS p, pk);                /* FIXME: error checking */
+      pk += 4;

       break;
 
       break;
 

-    /* The only occurrence of a double colon is for ::1 */

     case ns_t_aaaa:
     case ns_t_aaaa:

-      if (Ustrcmp(p, "::1") == 0)
-        {
-        memset(pk, 0, 15);
-        pk += 15;
-        *pk++ = 1;
-        }
-      else for (i = 0; i < 8; i++)
-        {
-        value = 0;
-        while (isxdigit(*p))
-          {
-          value = value * 16 + toupper(*p) - (isdigit(*p)? '0' : '7');
-          p++;
-          }
-        *pk++ = (value >> 8) & 255;
-        *pk++ = value & 255;
-        p++;
-        }
+      inet_pton(AF_INET6, CCS p, pk);               /* FIXME: error checking */
+      pk += 16;

       break;
 
     case ns_t_mx:
       break;
 
     case ns_t_mx:


@@ -774,8 +787,8 @@ if (yield == NO_RECOVERY) goto END_OFF;
 header->ancount = htons(count);
 
 /* If the AA bit should be set (as indicated by the AA prefix in the zone file),
 header->ancount = htons(count);
 
 /* If the AA bit should be set (as indicated by the AA prefix in the zone file),

-we are expected to return some records in the authortive section. Bind9: If
-there is data in the answer section, the authoritive section contains the NS
+we are expected to return some records in the authoritative section. Bind9: If
+there is data in the answer section, the authoritative section contains the NS

 records, otherwise it contains the SOA record.  Currently we mimic this
 behaviour for the first case (there is some answer record).
 */
 records, otherwise it contains the SOA record.  Currently we mimic this
 behaviour for the first case (there is some answer record).
 */