X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/45d58479b6cdbacce6cb823355f91d953d5aef9a..2b68e140a846db4f24f4e29dfa16db73dc35c37f:/src/src/host.c diff --git a/src/src/host.c b/src/src/host.c index 4e1cb8a45..e43b507e5 100644 --- a/src/src/host.c +++ b/src/src/host.c @@ -2,8 +2,8 @@ * Exim - an Internet mail transport agent * *************************************************/ +/* Copyright (c) The Exim Maintainers 2020 - 2022 */ /* Copyright (c) University of Cambridge 1995 - 2018 */ -/* Copyright (c) The Exim Maintainers 2020 */ /* See the file NOTICE for conditions of use and distribution. */ /* Functions for finding hosts, either by gethostbyname(), gethostbyaddr(), or @@ -197,9 +197,9 @@ if ((ipa = string_is_ip_address(lname, NULL)) != 0) || ipa == 6 && af == AF_INET6) { int x[4]; - yield = store_get(sizeof(struct hostent), FALSE); - alist = store_get(2 * sizeof(char *), FALSE); - adds = store_get(alen, FALSE); + yield = store_get(sizeof(struct hostent), GET_UNTAINTED); + alist = store_get(2 * sizeof(char *), GET_UNTAINTED); + adds = store_get(alen, GET_UNTAINTED); yield->h_name = CS name; yield->h_aliases = NULL; yield->h_addrtype = af; @@ -222,7 +222,8 @@ if ((ipa = string_is_ip_address(lname, NULL)) != 0) else { *error_num = HOST_NOT_FOUND; - return NULL; + yield = NULL; + goto out; } /* Handle a host name */ @@ -238,11 +239,11 @@ else switch(rc) { case DNS_SUCCEED: break; - case DNS_NOMATCH: *error_num = HOST_NOT_FOUND; return NULL; - case DNS_NODATA: *error_num = NO_DATA; return NULL; - case DNS_AGAIN: *error_num = TRY_AGAIN; return NULL; + case DNS_NOMATCH: *error_num = HOST_NOT_FOUND; yield = NULL; goto out; + case DNS_NODATA: *error_num = NO_DATA; yield = NULL; goto out; + case DNS_AGAIN: *error_num = TRY_AGAIN; yield = NULL; goto out; default: - case DNS_FAIL: *error_num = NO_RECOVERY; return NULL; + case DNS_FAIL: *error_num = NO_RECOVERY; yield = NULL; goto out; } for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); @@ -250,9 +251,9 @@ else rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == type) count++; - yield = store_get(sizeof(struct hostent), FALSE); - alist = store_get((count + 1) * sizeof(char *), FALSE); - adds = store_get(count *alen, FALSE); + yield = store_get(sizeof(struct hostent), GET_UNTAINTED); + alist = store_get((count + 1) * sizeof(char *), GET_UNTAINTED); + adds = store_get(count *alen, GET_UNTAINTED); yield->h_name = CS name; yield->h_aliases = NULL; @@ -280,6 +281,9 @@ else *alist = NULL; } +out: + +store_free_dns_answer(dnsa); return yield; } @@ -324,12 +328,12 @@ while ((name = string_nextinlist(&list, &sep, NULL, 0))) continue; } - h = store_get(sizeof(host_item), FALSE); + h = store_get(sizeof(host_item), GET_UNTAINTED); h->name = name; h->address = NULL; h->port = PORT_NONE; h->mx = fake_mx; - h->sort_key = randomize? (-fake_mx)*1000 + random_number(1000) : 0; + h->sort_key = randomize ? (-fake_mx)*1000 + random_number(1000) : 0; h->status = hstatus_unknown; h->why = hwhy_unknown; h->last_try = 0; @@ -366,15 +370,18 @@ while ((name = string_nextinlist(&list, &sep, NULL, 0))) * Extract port from address string * *************************************************/ -/* In the spool file, and in the -oMa and -oMi options, a host plus port is -given as an IP address followed by a dot and a port number. This function -decodes this. +/* In the -oMa and -oMi options, a host plus port is given as an IP address +followed by a dot and a port number. This function decodes this. An alternative format for the -oMa and -oMi options is [ip address]:port which -is what Exim 4 uses for output, because it seems to becoming commonly used, +is what Exim uses for output, because it seems to becoming commonly used, whereas the dot form confuses some programs/people. So we recognize that form too. +The spool file used to use the first form, but this breaks with a v4mapped ipv6 +hybrid, because the parsing here is not clever. So for spool we now use the +second form. + Argument: address points to the string; if there is a port, the '.' in the string is overwritten with zero to terminate the address; if the string @@ -728,7 +735,6 @@ host_build_ifacelist(const uschar *list, uschar *name) int sep = 0; uschar *s; ip_address_item * yield = NULL, * last = NULL, * next; -BOOL taint = is_tainted(list); while ((s = string_nextinlist(&list, &sep, NULL, 0))) { @@ -747,7 +753,7 @@ while ((s = string_nextinlist(&list, &sep, NULL, 0))) address above. The field in the ip_address_item is large enough to hold an IPv6 address. */ - next = store_get(sizeof(ip_address_item), taint); + next = store_get(sizeof(ip_address_item), list); next->next = NULL; Ustrcpy(next->address, s); next->port = port; @@ -815,7 +821,7 @@ host_find_interfaces(void) { ip_address_item *running_interfaces = NULL; -if (local_interface_data == NULL) +if (!local_interface_data) { void *reset_item = store_mark(); ip_address_item *dlist = host_build_ifacelist(CUS local_interfaces, @@ -911,14 +917,14 @@ if (type < 0) struct sockaddr_in6 *sk = (struct sockaddr_in6 *)arg; yield = US inet_ntop(family, &(sk->sin6_addr), CS addr_buffer, sizeof(addr_buffer)); - if (portptr != NULL) *portptr = ntohs(sk->sin6_port); + if (portptr) *portptr = ntohs(sk->sin6_port); } else { struct sockaddr_in *sk = (struct sockaddr_in *)arg; yield = US inet_ntop(family, &(sk->sin_addr), CS addr_buffer, sizeof(addr_buffer)); - if (portptr != NULL) *portptr = ntohs(sk->sin_port); + if (portptr) *portptr = ntohs(sk->sin_port); } } else @@ -937,7 +943,7 @@ if (Ustrncmp(yield, "::ffff:", 7) == 0) yield += 7; if (type < 0) { yield = US inet_ntoa(((struct sockaddr_in *)arg)->sin_addr); - if (portptr != NULL) *portptr = ntohs(((struct sockaddr_in *)arg)->sin_port); + if (portptr) *portptr = ntohs(((struct sockaddr_in *)arg)->sin_port); } else yield = US inet_ntoa(*((struct in_addr *)arg)); @@ -945,7 +951,7 @@ else /* If there is no buffer, put the string into some new store. */ -if (!buffer) buffer = store_get(46, FALSE); +if (!buffer) buffer = store_get(46, GET_UNTAINTED); /* Callers of this function with a non-NULL buffer must ensure that it is large enough to hold an IPv6 address, namely, at least 46 bytes. That's what @@ -1197,9 +1203,9 @@ for (c = buffer, k = -1, i = 0; i < 8; i++) c++; } -c[-1] = '\0'; /* drop trailing colon */ +*--c = '\0'; /* drop trailing colon */ -/* debug_printf("%s: D k %d <%s> <%s>\n", __FUNCTION__, k, d, d + 2*(k+1)); */ +/* debug_printf("%s: D k %d <%s> <%s>\n", __FUNCTION__, k, buffer, buffer + 2*(k+1)); */ if (k >= 0) { /* collapse */ c = d + 2*(k+1); @@ -1232,14 +1238,11 @@ BOOL host_is_tls_on_connect_port(int port) { int sep = 0; -uschar buffer[32]; -const uschar *list = tls_in.on_connect_ports; -uschar *s; -uschar *end; +const uschar * list = tls_in.on_connect_ports; if (tls_in.on_connect) return TRUE; -while ((s = string_nextinlist(&list, &sep, buffer, sizeof(buffer)))) +for (uschar * s, * end; s = string_nextinlist(&list, &sep, NULL, 0); ) if (Ustrtol(s, &end, 10) == port) return TRUE; @@ -1581,12 +1584,12 @@ Put it in permanent memory. */ if (hosts->h_aliases) { - int count = 1; + int count = 1; /* need 1 more for terminating NULL */ uschar **ptr; for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++) count++; store_pool = POOL_PERM; - ptr = sender_host_aliases = store_get(count * sizeof(uschar *), FALSE); + ptr = sender_host_aliases = store_get(count * sizeof(uschar *), GET_UNTAINTED); store_pool = POOL_TAINT_PERM; for (uschar ** aliases = USS hosts->h_aliases; *aliases; aliases++) @@ -1690,7 +1693,7 @@ while ((ordername = string_nextinlist(&list, &sep, NULL, 0))) { uschar **aptr = NULL; int ssize = 264; - int count = 0; + int count = 1; /* need 1 more for terminating NULL */ int old_pool = store_pool; sender_host_dnssec = dns_is_secure(dnsa); @@ -1708,7 +1711,7 @@ while ((ordername = string_nextinlist(&list, &sep, NULL, 0))) /* Get store for the list of aliases. For compatibility with gethostbyaddr, we make an empty list if there are none. */ - aptr = sender_host_aliases = store_get(count * sizeof(uschar *), FALSE); + aptr = sender_host_aliases = store_get(count * sizeof(uschar *), GET_UNTAINTED); /* Re-scan and extract the names */ @@ -1716,7 +1719,7 @@ while ((ordername = string_nextinlist(&list, &sep, NULL, 0))) rr; rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_PTR) { - uschar * s = store_get(ssize, TRUE); /* names are tainted */ + uschar * s = store_get(ssize, GET_TAINTED); /* names are tainted */ /* If an overlong response was received, the data will have been truncated and dn_expand may fail. */ @@ -1793,7 +1796,7 @@ HDEBUG(D_host_lookup) { uschar **aliases = sender_host_aliases; debug_printf("IP address lookup yielded \"%s\"\n", sender_host_name); - while (*aliases != NULL) debug_printf(" alias \"%s\"\n", *aliases++); + while (*aliases) debug_printf(" alias \"%s\"\n", *aliases++); } /* We need to verify that a forward lookup on the name we found does indeed @@ -1974,8 +1977,8 @@ lookups here (except when testing standalone). */ #else if ( disable_ipv6 || dns_ipv4_lookup - && match_isinlist(host->name, CUSS &dns_ipv4_lookup, 0, NULL, NULL, - MCL_DOMAIN, TRUE, NULL) == OK) + && match_isinlist(host->name, CUSS &dns_ipv4_lookup, 0, + &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK) #endif { af = AF_INET; times = 1; } @@ -2118,7 +2121,7 @@ for (int i = 1; i <= times; else { - host_item *next = store_get(sizeof(host_item), FALSE); + host_item *next = store_get(sizeof(host_item), GET_UNTAINTED); next->name = host->name; #ifndef DISABLE_TLS next->certname = host->certname; @@ -2194,12 +2197,12 @@ dns_again_means_nonexist, return permanent rather than temporary failure. */ RETURN_AGAIN: { - #ifndef STAND_ALONE +#ifndef STAND_ALONE int rc; const uschar *save = deliver_domain; deliver_domain = host->name; /* set $domain */ - rc = match_isinlist(host->name, CUSS &dns_again_means_nonexist, 0, NULL, NULL, - MCL_DOMAIN, TRUE, NULL); + rc = match_isinlist(host->name, CUSS &dns_again_means_nonexist, 0, + &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL); deliver_domain = save; if (rc == OK) { @@ -2207,7 +2210,7 @@ RETURN_AGAIN: "returning HOST_FIND_FAILED\n", host->name); return HOST_FIND_FAILED; } - #endif +#endif return HOST_FIND_AGAIN; } } @@ -2265,6 +2268,7 @@ host_item *thishostlast = NULL; /* Indicates not yet filled in anything */ BOOL v6_find_again = FALSE; BOOL dnssec_fail = FALSE; int i; +dns_answer * dnsa; #ifndef DISABLE_TLS /* Copy the host name at this point to the value which is used for @@ -2290,6 +2294,8 @@ if (allow_ip && string_is_ip_address(host->name, NULL) != 0) return HOST_FOUND; } +dnsa = store_get_dns_answer(); + /* On an IPv6 system, unless IPv6 is disabled, go round the loop up to twice, looking for AAAA records the first time. However, unless doing standalone testing, we force an IPv4 lookup if the domain matches dns_ipv4_lookup global. @@ -2299,9 +2305,9 @@ On an IPv4 system, go round the loop once only, looking only for A records. */ #ifndef STAND_ALONE if ( disable_ipv6 || !(whichrrs & HOST_FIND_BY_AAAA) - || (dns_ipv4_lookup - && match_isinlist(host->name, CUSS &dns_ipv4_lookup, 0, NULL, NULL, - MCL_DOMAIN, TRUE, NULL) == OK) + || dns_ipv4_lookup + && match_isinlist(host->name, CUSS &dns_ipv4_lookup, 0, + &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK ) i = 0; /* look up A records only */ else @@ -2321,7 +2327,6 @@ for (; i >= 0; i--) int type = types[i]; int randoffset = i == (whichrrs & HOST_FIND_IPV4_FIRST ? 1 : 0) ? 500 : 0; /* Ensures v6/4 sort order */ - dns_answer * dnsa = store_get_dns_answer(); dns_scan dnss; int rc = dns_lookup_timerwrap(dnsa, host->name, type, fully_qualified_name); @@ -2344,10 +2349,13 @@ for (; i >= 0; i--) { if (i == 0) /* Just tried for an A record, i.e. end of loop */ { - if (host->address != NULL) return HOST_FOUND; /* AAAA was found */ - if (rc == DNS_AGAIN || rc == DNS_FAIL || v6_find_again) - return HOST_FIND_AGAIN; - return HOST_FIND_FAILED; /* DNS_NOMATCH or DNS_NODATA */ + if (host->address != NULL) + i = HOST_FOUND; /* AAAA was found */ + else if (rc == DNS_AGAIN || rc == DNS_FAIL || v6_find_again) + i = HOST_FIND_AGAIN; + else + i = HOST_FIND_FAILED; /* DNS_NOMATCH or DNS_NODATA */ + goto out; } /* Tried for an AAAA record: remember if this was a temporary @@ -2450,7 +2458,7 @@ for (; i >= 0; i--) /* Not a duplicate */ new_sort_key = host->mx * 1000 + random_number(500) + randoffset; - next = store_get(sizeof(host_item), FALSE); + next = store_get(sizeof(host_item), GET_UNTAINTED); /* New address goes first: insert the new block after the first one (so as not to disturb the original pointer) but put the new address @@ -2492,11 +2500,15 @@ for (; i >= 0; i--) /* Control gets here only if the second lookup (the A record) succeeded. However, the address may not be filled in if it was ignored. */ -return host->address +i = host->address ? HOST_FOUND : dnssec_fail ? HOST_FIND_SECURITY : HOST_IGNORED; + +out: + store_free_dns_answer(dnsa); + return i; } @@ -2559,12 +2571,12 @@ int yield; dns_answer * dnsa = store_get_dns_answer(); dns_scan dnss; BOOL dnssec_require = dnssec_d - && match_isinlist(host->name, CUSS &dnssec_d->require, - 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL) == OK; + && match_isinlist(host->name, CUSS &dnssec_d->require, + 0, &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK; BOOL dnssec_request = dnssec_require - || ( dnssec_d - && match_isinlist(host->name, CUSS &dnssec_d->request, - 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL) == OK); + || ( dnssec_d + && match_isinlist(host->name, CUSS &dnssec_d->request, + 0, &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK); dnssec_status_t dnssec; /* Set the default fully qualified name to the incoming name, initialize the @@ -2629,13 +2641,13 @@ if (whichrrs & HOST_FIND_BY_SRV) } if (rc == DNS_FAIL || rc == DNS_AGAIN) { - #ifndef STAND_ALONE - if (match_isinlist(host->name, CUSS &srv_fail_domains, 0, NULL, NULL, - MCL_DOMAIN, TRUE, NULL) != OK) - #endif +#ifndef STAND_ALONE + if (match_isinlist(host->name, CUSS &srv_fail_domains, 0, + &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) != OK) +#endif { yield = HOST_FIND_AGAIN; goto out; } DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA " - "(domain in srv_fail_domains)\n", (rc == DNS_FAIL)? "FAIL":"AGAIN"); + "(domain in srv_fail_domains)\n", rc == DNS_FAIL ? "FAIL":"AGAIN"); } } @@ -2681,8 +2693,8 @@ if (rc != DNS_SUCCEED && whichrrs & HOST_FIND_BY_MX) DEBUG(D_host_lookup) debug_printf("dnssec fail on MX for %.256s", host->name); #ifndef STAND_ALONE - if (match_isinlist(host->name, CUSS &mx_fail_domains, 0, NULL, NULL, - MCL_DOMAIN, TRUE, NULL) != OK) + if (match_isinlist(host->name, CUSS &mx_fail_domains, 0, + &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) != OK) { yield = HOST_FIND_SECURITY; goto out; } #endif rc = DNS_FAIL; @@ -2691,8 +2703,8 @@ if (rc != DNS_SUCCEED && whichrrs & HOST_FIND_BY_MX) case DNS_FAIL: case DNS_AGAIN: #ifndef STAND_ALONE - if (match_isinlist(host->name, CUSS &mx_fail_domains, 0, NULL, NULL, - MCL_DOMAIN, TRUE, NULL) != OK) + if (match_isinlist(host->name, CUSS &mx_fail_domains, 0, + &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) != OK) #endif { yield = HOST_FIND_AGAIN; goto out; } DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA " @@ -2853,7 +2865,7 @@ for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); /* Make a new host item and seek the correct insertion place */ { int sort_key = precedence * 1000 + weight; - host_item *next = store_get(sizeof(host_item), FALSE); + host_item * next = store_get(sizeof(host_item), GET_UNTAINTED); next->name = string_copy_dnsdomain(data); next->address = NULL; next->port = port; @@ -3165,6 +3177,7 @@ DEBUG(D_host_lookup) out: dns_init(FALSE, FALSE, FALSE); /* clear the dnssec bit for getaddrbyname */ +store_free_dns_answer(dnsa); return yield; } @@ -3263,6 +3276,7 @@ uschar buffer[256]; disable_ipv6 = FALSE; primary_hostname = US""; +store_init(); store_pool = POOL_MAIN; debug_selector = D_host_lookup|D_interface; debug_file = stdout;