Add dns_trust_aa

This new global option allows to trust the AA bit for
specific domains the same way we'd trust the AD bit.

diff --git a/src/src/dns.c b/src/src/dns.c
index f1c038834ee03e216c85788b17bb4e3638b8fe21..29078dacd8971ca04251abd9fa0c71614ebeddf6 100644 (file)
--- a/src/src/dns.c
+++ b/src/src/dns.c
@@ -402,6 +402,26 @@ return &(dnss->srr);
 }
 
 
+/* Extract the AUTHORITY info from the answer. If the
+ * answer isn't authoritive (AA) we do not extract anything.
+ * We've to search for SOA or NS records, since there may be
+ * other records (e.g. NSEC3) too.
+ */
+static const uschar*
+dns_extract_auth_name(const dns_answer *dnsa)  /* FIXME: const dns_answer */
+{
+    dns_scan dnss;
+    dns_record *rr;
+    HEADER *h = (HEADER *) dnsa->answer;
+    if (!h->nscount || !h->aa) return NULL;
+    for (rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_AUTHORITY);
+        rr;
+        rr = dns_next_rr((dns_answer*) dnsa, &dnss, RESET_NEXT))
+      if (rr->type == T_SOA || rr->type == T_NS) return rr->name;
+    return NULL;
+}
+
+
 
 
 /*************************************************
@@ -410,7 +430,7 @@ return &(dnss->srr);
 
 /* We do not perform DNSSEC work ourselves; if the administrator has installed
 a verifying resolver which sets AD as appropriate, though, we'll use that.
-(AD = Authentic Data)
+(AD = Authentic Data, AA = Authoritive Answer)
 
 Argument:   pointer to dns answer block
 Returns:    bool indicating presence of AD bit
@@ -424,8 +444,31 @@ DEBUG(D_dns)
   debug_printf("DNSSEC support disabled at build-time; dns_is_secure() false\n");
 return FALSE;
 #else
-HEADER *h = (HEADER *)dnsa->answer;
-return h->ad ? TRUE : FALSE;
+HEADER *h = (HEADER *) dnsa->answer;
+
+if (h->ad) return TRUE;
+else
+  {
+  /* If the resolver we ask is authoritive for the domain in question, it
+  * may not set the AD but the AA bit. If we explicitly trust
+  * the resolver for that domain (via a domainlist in dns_trust_aa),
+  * we return TRUE to indicate a secure answer.
+  */
+  const uschar *auth_name;
+  const uschar *trusted;
+
+  if (!h->aa || !dns_trust_aa) return FALSE;
+
+  trusted = expand_string(dns_trust_aa);
+  auth_name = dns_extract_auth_name(dnsa);
+  if (OK != match_isinlist(auth_name, &trusted, 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL)) 
+    return FALSE;
+
+  DEBUG(D_dns)
+    debug_printf("DNS faked the AD bit (got AA and matched with dns_trust_aa (%s in %s))\n", auth_name, dns_trust_aa);
+
+  return TRUE;
+}
 #endif
 }
 
@@ -439,7 +482,7 @@ h->ad = 0;
 /************************************************
  *     Check whether the AA bit is set         *
  *     We need this to warn if we requested AD *
- *     from a authoritive server               *
+ *     from an authoritive server              *
  ************************************************/
 
 BOOL
@@ -513,8 +556,6 @@ node->data.val = rc;
 return rc;
 }
 
-
-
 /*************************************************
 *              Do basic DNS lookup               *
 *************************************************/
@@ -854,7 +895,7 @@ return DNS_FAIL;
 *    Do a DNS lookup and handle virtual types   *
 ************************************************/
 
-/* This function handles some invented "lookup types" that synthesize feature
+/* This function handles some invented "lookup types" that synthesize features
 not available in the basic types. The special types all have negative values.
 Positive type values are passed straight on to dns_lookup().
 

diff --git a/src/src/globals.c b/src/src/globals.c
index 63674e51c8620116969b82836774f7392cf9ba25..66baffe450257af3a53b693042eca1ac0c4062ce 100644 (file)
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -657,6 +657,7 @@ uschar *dns_ipv4_lookup        = NULL;
 int     dns_retrans            = 0;
 int     dns_retry              = 0;
 int     dns_dnssec_ok          = -1; /* <0 = not coerced */
+uschar *dns_trust_aa           = NULL;
 int     dns_use_edns0          = -1; /* <0 = not coerced */
 uschar *dnslist_domain         = NULL;
 uschar *dnslist_matched        = NULL;

diff --git a/src/src/globals.h b/src/src/globals.h
index 36c25906e8985cce25b0273a10ef5aa53efcaaaa..ab03302bbfba57a77eb968913b5458e1347bea27 100644 (file)
--- a/src/src/globals.h
+++ b/src/src/globals.h
@@ -404,6 +404,7 @@ extern int     dns_dane_ok;            /* Ok to use DANE when checking TLS authe
 extern int     dns_retrans;            /* Retransmission time setting */
 extern int     dns_retry;              /* Number of retries */
 extern int     dns_dnssec_ok;          /* When constructing DNS query, set DO flag */
+extern uschar *dns_trust_aa;           /* DNSSEC trust AA as AD */
 extern int     dns_use_edns0;          /* Coerce EDNS0 support on/off in resolver. */
 extern uschar *dnslist_domain;         /* DNS (black) list domain */
 extern uschar *dnslist_matched;        /* DNS (black) list matched key */

diff --git a/src/src/readconf.c b/src/src/readconf.c
index 8b43c7a9fb183789962e9c6c3c9de84a83984211..8a62d0245799b89c9b38c3bf93e2d838987d8884 100644 (file)
--- a/src/src/readconf.c
+++ b/src/src/readconf.c
@@ -228,6 +228,7 @@ static optionlist optionlist_config[] = {
   { "dns_ipv4_lookup",          opt_stringptr,   &dns_ipv4_lookup },
   { "dns_retrans",              opt_time,        &dns_retrans },
   { "dns_retry",                opt_int,         &dns_retry },
+  { "dns_trust_aa",             opt_stringptr,   &dns_trust_aa },
   { "dns_use_edns0",            opt_int,         &dns_use_edns0 },
  /* This option is now a no-op, retained for compability */
   { "drop_cr",                  opt_bool,        &drop_cr },