X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/c38d6da94aa327f7c42a90b50508c62702412fef..184e88237dea64ce48076cdd0184612d057cbafd:/src/src/lookups/dnsdb.c diff --git a/src/src/lookups/dnsdb.c b/src/src/lookups/dnsdb.c index 3f9dc8e78..ab3bc430d 100644 --- a/src/src/lookups/dnsdb.c +++ b/src/src/lookups/dnsdb.c @@ -1,10 +1,10 @@ -/* $Cambridge: exim/src/src/lookups/dnsdb.c,v 1.5 2004/11/25 14:31:28 ph10 Exp $ */ +/* $Cambridge: exim/src/src/lookups/dnsdb.c,v 1.17 2007/01/08 10:50:19 ph10 Exp $ */ /************************************************* * Exim - an Internet mail transport agent * *************************************************/ -/* Copyright (c) University of Cambridge 1995 - 2004 */ +/* Copyright (c) University of Cambridge 1995 - 2007 */ /* See the file NOTICE for conditions of use and distribution. */ #include "../exim.h" @@ -31,13 +31,14 @@ static char *type_names[] = { #endif #endif "cname", + "csa", "mx", "mxh", "ns", "ptr", "srv", "txt", - "zns" + "zns" }; static int type_values[] = { @@ -49,6 +50,7 @@ static int type_values[] = { #endif #endif T_CNAME, + T_CSA, /* Private type for "Client SMTP Authorization". */ T_MX, T_MXH, /* Private type for "MX hostnames" */ T_NS, @@ -82,16 +84,22 @@ return (void *)(-1); /* Any non-0 value */ /* See local README for interface description. The query in the "keystring" may consist of a number of parts. -(a) If the first significant character is '>' then the next character is the -separator character that is used when multiple records are found. The default +(a) If the first significant character is '>' then the next character is the +separator character that is used when multiple records are found. The default separator is newline. -(b) If the next sequence of characters is a sequence of letters and digits -followed by '=', it is interpreted as the name of the DNS record type. The -default is "A". +(b) If the next sequence of characters is 'defer_FOO' followed by a comma, +the defer behaviour is set to FOO. The possible behaviours are: 'strict', where +any defer causes the whole lookup to defer; 'lax', where a defer causes the +whole lookup to defer only if none of the DNS queries succeeds; and 'never', +where all defers are as if the lookup failed. The default is 'lax'. -(c) Then there follows list of domain names. This is a generalized Exim list, -which may start with '<' in order to set a specific separator. The default +(c) If the next sequence of characters is a sequence of letters and digits +followed by '=', it is interpreted as the name of the DNS record type. The +default is "TXT". + +(d) Then there follows list of domain names. This is a generalized Exim list, +which may start with '<' in order to set a specific separator. The default separator, as always, is colon. */ int @@ -102,10 +110,11 @@ int rc; int size = 256; int ptr = 0; int sep = 0; +int defer_mode = PASS; int type = T_TXT; int failrc = FAIL; uschar *outsep = US"\n"; -uschar *equals, *domain; +uschar *equals, *domain, *found; uschar buffer[256]; /* Because we're the working in the search pool, we try to reclaim as much @@ -128,9 +137,43 @@ while (isspace(*keystring)) keystring++; if (*keystring == '>') { outsep = keystring + 1; - keystring += 2; + keystring += 2; + while (isspace(*keystring)) keystring++; + } + +/* Check for a defer behaviour keyword. */ + +if (strncmpic(keystring, US"defer_", 6) == 0) + { + keystring += 6; + if (strncmpic(keystring, US"strict", 6) == 0) + { + defer_mode = DEFER; + keystring += 6; + } + else if (strncmpic(keystring, US"lax", 3) == 0) + { + defer_mode = PASS; + keystring += 3; + } + else if (strncmpic(keystring, US"never", 5) == 0) + { + defer_mode = OK; + keystring += 5; + } + else + { + *errmsg = US"unsupported dnsdb defer behaviour"; + return DEFER; + } + while (isspace(*keystring)) keystring++; + if (*keystring++ != ',') + { + *errmsg = US"dnsdb defer behaviour syntax error"; + return DEFER; + } while (isspace(*keystring)) keystring++; - } + } /* If the keystring contains an = this must be preceded by a valid type name. */ @@ -138,10 +181,10 @@ if ((equals = Ustrchr(keystring, '=')) != NULL) { int i, len; uschar *tend = equals; - - while (tend > keystring && isspace(tend[-1])) tend--; - len = tend - keystring; - + + while (tend > keystring && isspace(tend[-1])) tend--; + len = tend - keystring; + for (i = 0; i < sizeof(type_names)/sizeof(uschar *); i++) { if (len == Ustrlen(type_names[i]) && @@ -151,73 +194,80 @@ if ((equals = Ustrchr(keystring, '=')) != NULL) break; } } - + if (i >= sizeof(type_names)/sizeof(uschar *)) { *errmsg = US"unsupported DNS record type"; return DEFER; } - + keystring = equals + 1; while (isspace(*keystring)) keystring++; } - + /* Initialize the resolver in case this is the first time it has been used. */ dns_init(FALSE, FALSE); -/* The remainder of the string must be a list of domains. As long as the lookup -for at least one of them succeeds, we return success. Failure means that none -of them were found. +/* The remainder of the string must be a list of domains. As long as the lookup +for at least one of them succeeds, we return success. Failure means that none +of them were found. -The original implementation did not support a list of domains. Adding the list -feature is compatible, except in one case: when PTR records are being looked up -for a single IPv6 address. Fortunately, we can hack in a compatibility feature -here: If the type is PTR and no list separator is specified, and the entire -remaining string is valid as an IP address, set an impossible separator so that +The original implementation did not support a list of domains. Adding the list +feature is compatible, except in one case: when PTR records are being looked up +for a single IPv6 address. Fortunately, we can hack in a compatibility feature +here: If the type is PTR and no list separator is specified, and the entire +remaining string is valid as an IP address, set an impossible separator so that it is treated as one item. */ if (type == T_PTR && keystring[0] != '<' && - string_is_ip_address(keystring, NULL) > 0) + string_is_ip_address(keystring, NULL) != 0) sep = -1; /* Now scan the list and do a lookup for each item */ -while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer))) +while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer))) != NULL) - { + { uschar rbuffer[256]; - int searchtype = (type == T_ZNS)? T_NS : /* record type we want */ - (type == T_MXH)? T_MX : type; - - /* If the type is PTR, we have to construct the relevant magic lookup - key. This code is now in a separate function. */ - - if (type == T_PTR) + int searchtype = (type == T_CSA)? T_SRV : /* record type we want */ + (type == T_MXH)? T_MX : + (type == T_ZNS)? T_NS : type; + + /* If the type is PTR or CSA, we have to construct the relevant magic lookup + key if the original is an IP address (some experimental protocols are using + PTR records for different purposes where the key string is a host name, and + Exim's extended CSA can be keyed by domains or IP addresses). This code for + doing the reversal is now in a separate function. */ + + if ((type == T_PTR || type == T_CSA) && + string_is_ip_address(domain, NULL) != 0) { dns_build_reverse(domain, rbuffer); domain = rbuffer; } - + DEBUG(D_lookup) debug_printf("dnsdb key: %s\n", domain); - - /* Do the lookup and sort out the result. There are two special types that - are handled specially: T_ZNS and T_MXH. The former is handled in a special - lookup function so that the facility could be used from other parts of the - Exim code. The latter affects only what happens later on in this function, - but for tidiness it is handled in a similar way. If the lookup fails, - continue with the next domain. In the case of DEFER, adjust the final - "nothing found" result, but carry on to the next domain. */ - - rc = dns_special_lookup(&dnsa, domain, type, NULL); - + + /* Do the lookup and sort out the result. There are three special types that + are handled specially: T_CSA, T_ZNS and T_MXH. The former two are handled in + a special lookup function so that the facility could be used from other + parts of the Exim code. The latter affects only what happens later on in + this function, but for tidiness it is handled in a similar way. If the + lookup fails, continue with the next domain. In the case of DEFER, adjust + the final "nothing found" result, but carry on to the next domain. */ + + found = domain; + rc = dns_special_lookup(&dnsa, domain, type, &found); + if (rc == DNS_NOMATCH || rc == DNS_NODATA) continue; if (rc != DNS_SUCCEED) { - failrc = DEFER; - continue; + if (defer_mode == DEFER) return DEFER; /* always defer */ + else if (defer_mode == PASS) failrc = DEFER; /* defer only if all do */ + continue; /* treat defer as fail */ } - + /* Search the returned records */ for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS); @@ -225,11 +275,11 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer))) rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) { if (rr->type != searchtype) continue; - - /* There may be several addresses from an A6 record. Put the configured - separator between them, just as for between several records. However, A6 + + /* There may be several addresses from an A6 record. Put the configured + separator between them, just as for between several records. However, A6 support is not normally configured these days. */ - + if (type == T_A || #ifdef SUPPORT_A6 type == T_A6 || @@ -240,55 +290,86 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer))) for (da = dns_address_from_rr(&dnsa, rr); da != NULL; da = da->next) { if (ptr != 0) yield = string_cat(yield, &size, &ptr, outsep, 1); - yield = string_cat(yield, &size, &ptr, da->address, + yield = string_cat(yield, &size, &ptr, da->address, Ustrlen(da->address)); } continue; } - - /* Other kinds of record just have one piece of data each, but there may be + + /* Other kinds of record just have one piece of data each, but there may be several of them, of course. */ - + if (ptr != 0) yield = string_cat(yield, &size, &ptr, outsep, 1); - + if (type == T_TXT) { yield = string_cat(yield, &size, &ptr, (uschar *)(rr->data+1), (rr->data)[0]); } - else /* T_CNAME, T_MX, T_MXH, T_NS, T_SRV, T_PTR */ + else /* T_CNAME, T_CSA, T_MX, T_MXH, T_NS, T_PTR, T_SRV */ { - int num; + int priority, weight, port; uschar s[264]; uschar *p = (uschar *)(rr->data); - + if (type == T_MXH) { /* mxh ignores the priority number and includes only the hostnames */ - GETSHORT(num, p); /* pointer is advanced */ + GETSHORT(priority, p); } else if (type == T_MX) { - GETSHORT(num, p); /* pointer is advanced */ - sprintf(CS s, "%d ", num); + GETSHORT(priority, p); + sprintf(CS s, "%d ", priority); yield = string_cat(yield, &size, &ptr, s, Ustrlen(s)); } else if (type == T_SRV) { - int weight, port; - GETSHORT(num, p); /* pointer is advanced */ + GETSHORT(priority, p); GETSHORT(weight, p); GETSHORT(port, p); - sprintf(CS s, "%d %d %d ", num, weight, port); + sprintf(CS s, "%d %d %d ", priority, weight, port); yield = string_cat(yield, &size, &ptr, s, Ustrlen(s)); } - + else if (type == T_CSA) + { + /* See acl_verify_csa() for more comments about CSA. */ + + GETSHORT(priority, p); + GETSHORT(weight, p); + GETSHORT(port, p); + + if (priority != 1) continue; /* CSA version must be 1 */ + + /* If the CSA record we found is not the one we asked for, analyse + the subdomain assertions in the port field, else analyse the direct + authorization status in the weight field. */ + + if (found != domain) + { + if (port & 1) *s = 'X'; /* explicit authorization required */ + else *s = '?'; /* no subdomain assertions here */ + } + else + { + if (weight < 2) *s = 'N'; /* not authorized */ + else if (weight == 2) *s = 'Y'; /* authorized */ + else if (weight == 3) *s = '?'; /* unauthorizable */ + else continue; /* invalid */ + } + + s[1] = ' '; + yield = string_cat(yield, &size, &ptr, s, 2); + } + + /* GETSHORT() has advanced the pointer to the target domain. */ + rc = dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p, (DN_EXPAND_ARG4_TYPE)(s), sizeof(s)); - + /* If an overlong response was received, the data will have been truncated and dn_expand may fail. */ - + if (rc < 0) { log_write(0, LOG_MAIN, "host name alias list truncated: type=%s " @@ -304,7 +385,7 @@ while ((domain = string_nextinlist(&keystring, &sep, buffer, sizeof(buffer))) store_reset(yield + ptr + 1); -/* If ptr == 0 we have not found anything. Otherwise, insert the terminating +/* If ptr == 0 we have not found anything. Otherwise, insert the terminating zero and return the result. */ if (ptr == 0) return failrc;