1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2009 */
6 /* See the file NOTICE for conditions of use and distribution. */
9 #include "rf_functions.h"
10 #include "dnslookup.h"
14 /* Options specific to the dnslookup router. */
16 optionlist dnslookup_router_options[] = {
17 { "check_secondary_mx", opt_bool,
18 (void *)(offsetof(dnslookup_router_options_block, check_secondary_mx)) },
19 { "check_srv", opt_stringptr,
20 (void *)(offsetof(dnslookup_router_options_block, check_srv)) },
21 { "dnssec_request_domains", opt_stringptr,
22 (void *)(offsetof(dnslookup_router_options_block, dnssec_request_domains)) },
23 { "dnssec_require_domains", opt_stringptr,
24 (void *)(offsetof(dnslookup_router_options_block, dnssec_require_domains)) },
25 { "fail_defer_domains", opt_stringptr,
26 (void *)(offsetof(dnslookup_router_options_block, fail_defer_domains)) },
27 { "mx_domains", opt_stringptr,
28 (void *)(offsetof(dnslookup_router_options_block, mx_domains)) },
29 { "mx_fail_domains", opt_stringptr,
30 (void *)(offsetof(dnslookup_router_options_block, mx_fail_domains)) },
31 { "qualify_single", opt_bool,
32 (void *)(offsetof(dnslookup_router_options_block, qualify_single)) },
33 { "rewrite_headers", opt_bool,
34 (void *)(offsetof(dnslookup_router_options_block, rewrite_headers)) },
35 { "same_domain_copy_routing", opt_bool|opt_public,
36 (void *)(offsetof(router_instance, same_domain_copy_routing)) },
37 { "search_parents", opt_bool,
38 (void *)(offsetof(dnslookup_router_options_block, search_parents)) },
39 { "srv_fail_domains", opt_stringptr,
40 (void *)(offsetof(dnslookup_router_options_block, srv_fail_domains)) },
41 { "widen_domains", opt_stringptr,
42 (void *)(offsetof(dnslookup_router_options_block, widen_domains)) }
45 /* Size of the options list. An extern variable has to be used so that its
46 address can appear in the tables drtables.c. */
48 int dnslookup_router_options_count =
49 sizeof(dnslookup_router_options)/sizeof(optionlist);
51 /* Default private options block for the dnslookup router. */
53 dnslookup_router_options_block dnslookup_router_option_defaults = {
54 FALSE, /* check_secondary_mx */
55 TRUE, /* qualify_single */
56 FALSE, /* search_parents */
57 TRUE, /* rewrite_headers */
58 NULL, /* widen_domains */
59 NULL, /* mx_domains */
60 NULL, /* mx_fail_domains */
61 NULL, /* srv_fail_domains */
63 NULL, /* dnssec_request_domains */
64 NULL, /* dnssec_require_domains */
65 NULL /* fail_defer_domains */
70 /*************************************************
71 * Initialization entry point *
72 *************************************************/
74 /* Called for each instance, after its options have been read, to enable
75 consistency checks to be done, or anything else that needs to be set up. */
78 dnslookup_router_init(router_instance *rblock)
81 dnslookup_router_options_block *ob =
82 (dnslookup_router_options_block *)(rblock->options_block);
89 /*************************************************
91 *************************************************/
93 /* See local README for interface details. This router returns:
96 . the domain does not exist in the DNS
97 . MX records point to non-existent hosts (including RHS = IP address)
98 . a single SRV record has a host name of "." (=> no service)
99 . syntactically invalid mail domain
100 . check_secondary_mx set, and local host not in host list
103 . lookup defer for mx_domains
104 . timeout etc on DNS lookup
105 . verifying the errors address caused a deferment or a big disaster such
106 as an expansion failure (rf_get_errors_address)
107 . expanding a headers_{add,remove} string caused a deferment or another
108 expansion error (rf_get_munge_headers)
109 . a problem in rf_get_transport: no transport when one is needed;
110 failed to expand dynamic transport; failed to find dynamic transport
111 . failure to expand or find a uid/gid (rf_get_ugid via rf_queue_add)
112 . self = "freeze", self = "defer"
115 . timeout etc on DNS lookup and pass_on_timeout set
119 . routed to local host, but name was expanded by DNS lookup, so a
120 re-routing should take place
123 In both cases the new address will have been set up as a child
129 added address to addr_local or addr_remote, as appropriate for the
130 type of transport; this includes the self="send" case.
134 dnslookup_router_entry(
135 router_instance *rblock, /* data for this instantiation */
136 address_item *addr, /* address we are working on */
137 struct passwd *pw, /* passwd entry after check_local_user */
138 int verify, /* v_none/v_recipient/v_sender/v_expn */
139 address_item **addr_local, /* add it to this if it's local */
140 address_item **addr_remote, /* add it to this if it's remote */
141 address_item **addr_new, /* put new addresses on here */
142 address_item **addr_succeed) /* put old address here on success */
147 int whichrrs = HOST_FIND_BY_MX | HOST_FIND_BY_A;
148 dnslookup_router_options_block *ob =
149 (dnslookup_router_options_block *)(rblock->options_block);
150 uschar *srv_service = NULL;
151 uschar *widen = NULL;
152 const uschar *pre_widen = addr->domain;
153 const uschar *post_widen = NULL;
154 const uschar *fully_qualified_name;
155 const uschar *listptr;
156 uschar widen_buffer[256];
158 addr_new = addr_new; /* Keep picky compilers happy */
159 addr_succeed = addr_succeed;
162 debug_printf("%s router called for %s\n domain = %s\n",
163 rblock->name, addr->address, addr->domain);
165 /* If an SRV check is required, expand the service name */
169 if ( !(srv_service = expand_string(ob->check_srv))
170 && !expand_string_forcedfail)
172 addr->message = string_sprintf("%s router: failed to expand \"%s\": %s",
173 rblock->name, ob->check_srv, expand_string_message);
176 else whichrrs |= HOST_FIND_BY_SRV;
179 /* Set up the first of any widening domains. The code further down copes with
180 either pre- or post-widening, but at present there is no way to turn on
181 pre-widening, as actually doing so seems like a rather bad idea, and nobody has
182 requested it. Pre-widening would cause local abbreviated names to take
183 precedence over global names. For example, if the domain is "xxx.ch" it might
184 be something in the "ch" toplevel domain, but it also might be xxx.ch.xyz.com.
185 The choice of pre- or post-widening affects which takes precedence. If ever
186 somebody comes up with some kind of requirement for pre-widening, presumably
187 with some conditions under which it is done, it can be selected here.
189 The rewrite_headers option works only when routing an address at transport
190 time, because the alterations to the headers are not persistent so must be
191 worked out immediately before they are used. Sender addresses are routed for
192 verification purposes, but never at transport time, so any header changes that
193 you might expect as a result of sender domain widening do not occur. Therefore
194 we do not perform widening when verifying sender addresses; however, widening
195 sender addresses is OK if we do not have to rewrite the headers. A corollary
196 of this is that if the current address is not the original address, then it
197 does not appear in the message header so it is also OK to widen. The
198 suppression of widening for sender addresses is silent because it is the
199 normal desirable behaviour. */
201 if ( ob->widen_domains
202 && (verify != v_sender || !ob->rewrite_headers || addr->parent))
204 listptr = ob->widen_domains;
205 widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
206 sizeof(widen_buffer));
209 if (some condition requiring pre-widening)
211 post_widen = pre_widen;
217 /* Loop to cope with explicit widening of domains as configured. This code
218 copes with widening that may happen before or after the original name. The
219 decision as to which is taken above. */
223 int flags = whichrrs;
224 BOOL removed = FALSE;
233 h.name = string_sprintf("%s.%s", addr->domain, widen);
234 widen = string_nextinlist(&listptr, &widen_sep, widen_buffer,
235 sizeof(widen_buffer));
236 DEBUG(D_route) debug_printf("%s router widened %s to %s\n", rblock->name,
237 addr->domain, h.name);
243 DEBUG(D_route) debug_printf("%s router trying %s after widening failed\n",
244 rblock->name, h.name);
248 /* Set up the rest of the initial host item. Others may get chained on if
249 there is more than one IP address. We set it up here instead of outside the
250 loop so as to re-initialize if a previous try succeeded but was rejected
251 because of not having an MX record. */
257 h.status = hstatus_unknown;
258 h.why = hwhy_unknown;
261 /* Unfortunately, we cannot set the mx_only option in advance, because the
262 DNS lookup may extend an unqualified name. Therefore, we must do the test
263 subsequently. We use the same logic as that for widen_domains above to avoid
264 requesting a header rewrite that cannot work. */
266 if (verify != v_sender || !ob->rewrite_headers || addr->parent)
268 if (ob->qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
269 if (ob->search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
272 rc = host_find_bydns(&h, CUS rblock->ignore_target_hosts, flags, srv_service,
273 ob->srv_fail_domains, ob->mx_fail_domains,
274 ob->dnssec_request_domains, ob->dnssec_require_domains,
275 &fully_qualified_name, &removed);
276 if (removed) setflag(addr, af_local_host_removed);
278 /* If host found with only address records, test for the domain's being in
279 the mx_domains list. Note that this applies also to SRV records; the name of
280 the option is historical. */
282 if ((rc == HOST_FOUND || rc == HOST_FOUND_LOCAL) && h.mx < 0 &&
284 switch(match_isinlist(fully_qualified_name,
285 CUSS &(ob->mx_domains), 0,
286 &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
289 addr->message = US"lookup defer for mx_domains";
293 DEBUG(D_route) debug_printf("%s router rejected %s: no MX record(s)\n",
294 rblock->name, fully_qualified_name);
298 /* Deferral returns forthwith, and anything other than failure breaks the
301 if (rc == HOST_FIND_AGAIN)
303 if (rblock->pass_on_timeout)
305 DEBUG(D_route) debug_printf("%s router timed out, and pass_on_timeout is set\n",
309 addr->message = US"host lookup did not complete";
313 if (rc != HOST_FIND_FAILED) break;
315 /* Check to see if the failure is the result of MX records pointing to
316 non-existent domains, and if so, set an appropriate error message; the case
317 of an MX or SRV record pointing to "." is another special case that we can
318 detect. Otherwise "unknown mail domain" is used, which is confusing. Also, in
319 this case don't do the widening. We need check only the first host to see if
320 its MX has been filled in, but there is no address, because if there were any
321 usable addresses returned, we would not have had HOST_FIND_FAILED.
323 As a common cause of this problem is MX records with IP addresses on the
324 RHS, give a special message in this case. */
326 if (h.mx >= 0 && h.address == NULL)
328 setflag(addr, af_pass_message); /* This is not a security risk */
330 addr->message = US"an MX or SRV record indicated no SMTP service";
333 addr->basic_errno = ERRNO_UNKNOWNHOST;
334 addr->message = US"all relevant MX records point to non-existent hosts";
335 if (!allow_mx_to_ip && string_is_ip_address(h.name, NULL) != 0)
338 string_sprintf("It appears that the DNS operator for %s\n"
339 "has installed an invalid MX record with an IP address\n"
340 "instead of a domain name on the right hand side.", addr->domain);
341 addr->message = string_sprintf("%s or (invalidly) to IP addresses",
345 if (ob->fail_defer_domains)
347 switch(match_isinlist(fully_qualified_name,
348 CUSS &ob->fail_defer_domains, 0,
349 &domainlist_anchor, addr->domain_cache, MCL_DOMAIN, TRUE, NULL))
352 addr->message = US"lookup defer for fail_defer_domains";
356 DEBUG(D_route) debug_printf("%s router: matched fail_defer_domains\n",
364 /* If there's a syntax error, do not continue with any widening, and note
367 if (host_find_failed_syntax)
369 addr->message = string_sprintf("mail domain \"%s\" is syntactically "
375 /* If the original domain name has been changed as a result of the host lookup,
376 set up a child address for rerouting and request header rewrites if so
377 configured. Then yield REROUTED. However, if the only change is a change of
378 case in the domain name, which some resolvers yield (others don't), just change
379 the domain name in the original address so that the official version is used in
382 if (Ustrcmp(addr->domain, fully_qualified_name) != 0)
384 if (strcmpic(addr->domain, fully_qualified_name) == 0)
386 uschar *at = Ustrrchr(addr->address, '@');
387 memcpy(at+1, fully_qualified_name, Ustrlen(at+1));
391 rf_change_domain(addr, fully_qualified_name, ob->rewrite_headers, addr_new);
396 /* If the yield is HOST_FOUND_LOCAL, the remote domain name either found MX
397 records with the lowest numbered one pointing to a host with an IP address that
398 is set on one of the interfaces of this machine, or found A records or got
399 addresses from gethostbyname() that contain one for this machine. This can
400 happen quite legitimately if the original name was a shortened form of a
401 domain, but we will have picked that up already via the name change test above.
403 Otherwise, the action to be taken can be configured by the self option, the
404 handling of which is in a separate function, as it is also required for other
407 if (rc == HOST_FOUND_LOCAL)
409 rc = rf_self_action(addr, &h, rblock->self_code, rblock->self_rewrite,
410 rblock->self, addr_new);
411 if (rc != OK) return rc;
414 /* Otherwise, insist on being a secondary MX if so configured */
416 else if (ob->check_secondary_mx && !testflag(addr, af_local_host_removed))
418 DEBUG(D_route) debug_printf("check_secondary_mx set and local host not secondary\n");
422 /* Set up the errors address, if any. */
424 rc = rf_get_errors_address(addr, rblock, verify, &addr->prop.errors_address);
425 if (rc != OK) return rc;
427 /* Set up the additional and removeable headers for this address. */
429 rc = rf_get_munge_headers(addr, rblock, &addr->prop.extra_headers,
430 &addr->prop.remove_headers);
431 if (rc != OK) return rc;
433 /* Get store in which to preserve the original host item, chained on
436 addr->host_list = store_get(sizeof(host_item));
437 addr->host_list[0] = h;
439 /* Fill in the transport and queue the address for delivery. */
441 if (!rf_get_transport(rblock->transport_name, &(rblock->transport),
442 addr, rblock->name, NULL))
445 addr->transport = rblock->transport;
447 return rf_queue_add(addr, addr_local, addr_remote, rblock, pw)?
451 /* End of routers/dnslookup.c */