1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2012 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Functions for finding hosts, either by gethostbyname(), gethostbyaddr(), or
9 directly via the DNS. When IPv6 is supported, getipnodebyname() and
10 getipnodebyaddr() may be used instead of gethostbyname() and gethostbyaddr(),
11 if the newer functions are available. This module also contains various other
12 functions concerned with hosts and addresses, and a random number function,
13 used for randomizing hosts with equal MXs but available for use in other parts
20 /* Static variable for preserving the list of interface addresses in case it is
21 used more than once. */
23 static ip_address_item *local_interface_data = NULL;
26 #ifdef USE_INET_NTOA_FIX
27 /*************************************************
28 * Replacement for broken inet_ntoa() *
29 *************************************************/
31 /* On IRIX systems, gcc uses a different structure passing convention to the
32 native libraries. This causes inet_ntoa() to always yield 0.0.0.0 or
33 255.255.255.255. To get round this, we provide a private version of the
34 function here. It is used only if USE_INET_NTOA_FIX is set, which should happen
35 only when gcc is in use on an IRIX system. Code send to me by J.T. Breitner,
39 as seen in comp.sys.sgi.admin
41 August 2005: Apparently this is also needed for AIX systems; USE_INET_NTOA_FIX
42 should now be set for them as well.
44 Arguments: sa an in_addr structure
45 Returns: pointer to static text string
49 inet_ntoa(struct in_addr sa)
51 static uschar addr[20];
52 sprintf(addr, "%d.%d.%d.%d",
63 /*************************************************
64 * Random number generator *
65 *************************************************/
67 /* This is a simple pseudo-random number generator. It does not have to be
68 very good for the uses to which it is put. When running the regression tests,
69 start with a fixed seed.
71 If you need better, see vaguely_random_number() which is potentially stronger,
72 if a crypto library is available, but might end up just calling this instead.
75 limit: one more than the largest number required
77 Returns: a pseudo-random number in the range 0 to limit-1
81 random_number(int limit)
87 if (running_in_test_harness) random_seed = 42; else
89 int p = (int)getpid();
90 random_seed = (int)time(NULL) ^ ((p << 16) | p);
93 random_seed = 1103515245 * random_seed + 12345;
94 return (unsigned int)(random_seed >> 16) % limit;
99 /*************************************************
100 * Replace gethostbyname() when testing *
101 *************************************************/
103 /* This function is called instead of gethostbyname(), gethostbyname2(), or
104 getipnodebyname() when running in the test harness. It recognizes the name
105 "manyhome.test.ex" and generates a humungous number of IP addresses. It also
106 recognizes an unqualified "localhost" and forces it to the appropriate loopback
107 address. IP addresses are treated as literals. For other names, it uses the DNS
108 to find the host name. In the test harness, this means it will access only the
112 name the host name or a textual IP address
113 af AF_INET or AF_INET6
114 error_num where to put an error code:
115 HOST_NOT_FOUND/TRY_AGAIN/NO_RECOVERY/NO_DATA
117 Returns: a hostent structure or NULL for an error
120 static struct hostent *
121 host_fake_gethostbyname(uschar *name, int af, int *error_num)
124 int alen = (af == AF_INET)? sizeof(struct in_addr):sizeof(struct in6_addr);
126 int alen = sizeof(struct in_addr);
130 uschar *lname = name;
133 struct hostent *yield;
139 debug_printf("using host_fake_gethostbyname for %s (%s)\n", name,
140 (af == AF_INET)? "IPv4" : "IPv6");
142 /* Handle the name that needs a vast number of IP addresses */
144 if (Ustrcmp(name, "manyhome.test.ex") == 0 && af == AF_INET)
147 yield = store_get(sizeof(struct hostent));
148 alist = store_get(2049 * sizeof(char *));
149 adds = store_get(2048 * alen);
150 yield->h_name = CS name;
151 yield->h_aliases = NULL;
152 yield->h_addrtype = af;
153 yield->h_length = alen;
154 yield->h_addr_list = CSS alist;
155 for (i = 104; i <= 111; i++)
157 for (j = 0; j <= 255; j++)
170 /* Handle unqualified "localhost" */
172 if (Ustrcmp(name, "localhost") == 0)
173 lname = (af == AF_INET)? US"127.0.0.1" : US"::1";
175 /* Handle a literal IP address */
177 ipa = string_is_ip_address(lname, NULL);
180 if ((ipa == 4 && af == AF_INET) ||
181 (ipa == 6 && af == AF_INET6))
185 yield = store_get(sizeof(struct hostent));
186 alist = store_get(2 * sizeof(char *));
187 adds = store_get(alen);
188 yield->h_name = CS name;
189 yield->h_aliases = NULL;
190 yield->h_addrtype = af;
191 yield->h_length = alen;
192 yield->h_addr_list = CSS alist;
194 n = host_aton(lname, x);
195 for (i = 0; i < n; i++)
198 *adds++ = (y >> 24) & 255;
199 *adds++ = (y >> 16) & 255;
200 *adds++ = (y >> 8) & 255;
206 /* Wrong kind of literal address */
210 *error_num = HOST_NOT_FOUND;
215 /* Handle a host name */
219 int type = (af == AF_INET)? T_A:T_AAAA;
220 int rc = dns_lookup(&dnsa, lname, type, NULL);
223 lookup_dnssec_authenticated = NULL;
227 case DNS_SUCCEED: break;
228 case DNS_NOMATCH: *error_num = HOST_NOT_FOUND; return NULL;
229 case DNS_NODATA: *error_num = NO_DATA; return NULL;
230 case DNS_AGAIN: *error_num = TRY_AGAIN; return NULL;
232 case DNS_FAIL: *error_num = NO_RECOVERY; return NULL;
235 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
237 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
239 if (rr->type == type) count++;
242 yield = store_get(sizeof(struct hostent));
243 alist = store_get((count + 1) * sizeof(char **));
244 adds = store_get(count *alen);
246 yield->h_name = CS name;
247 yield->h_aliases = NULL;
248 yield->h_addrtype = af;
249 yield->h_length = alen;
250 yield->h_addr_list = CSS alist;
252 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
254 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
259 if (rr->type != type) continue;
260 da = dns_address_from_rr(&dnsa, rr);
262 n = host_aton(da->address, x);
263 for (i = 0; i < n; i++)
266 *adds++ = (y >> 24) & 255;
267 *adds++ = (y >> 16) & 255;
268 *adds++ = (y >> 8) & 255;
280 /*************************************************
281 * Build chain of host items from list *
282 *************************************************/
284 /* This function builds a chain of host items from a textual list of host
285 names. It does not do any lookups. If randomize is true, the chain is build in
286 a randomized order. There may be multiple groups of independently randomized
287 hosts; they are delimited by a host name consisting of just "+".
290 anchor anchor for the chain
292 randomize TRUE for randomizing
298 host_build_hostlist(host_item **anchor, uschar *list, BOOL randomize)
301 int fake_mx = MX_NONE; /* This value is actually -1 */
305 if (list == NULL) return;
306 if (randomize) fake_mx--; /* Start at -2 for randomizing */
310 while ((name = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
314 if (name[0] == '+' && name[1] == 0) /* "+" delimits a randomized group */
315 { /* ignore if not randomizing */
316 if (randomize) fake_mx--;
320 h = store_get(sizeof(host_item));
321 h->name = string_copy(name);
325 h->sort_key = randomize? (-fake_mx)*1000 + random_number(1000) : 0;
326 h->status = hstatus_unknown;
327 h->why = hwhy_unknown;
337 host_item *hh = *anchor;
338 if (h->sort_key < hh->sort_key)
345 while (hh->next != NULL && h->sort_key >= (hh->next)->sort_key)
358 /*************************************************
359 * Extract port from address string *
360 *************************************************/
362 /* In the spool file, and in the -oMa and -oMi options, a host plus port is
363 given as an IP address followed by a dot and a port number. This function
366 An alternative format for the -oMa and -oMi options is [ip address]:port which
367 is what Exim 4 uses for output, because it seems to becoming commonly used,
368 whereas the dot form confuses some programs/people. So we recognize that form
372 address points to the string; if there is a port, the '.' in the string
373 is overwritten with zero to terminate the address; if the string
374 is in the [xxx]:ppp format, the address is shifted left and the
377 Returns: 0 if there is no port, else the port number. If there's a syntax
378 error, leave the incoming address alone, and return 0.
382 host_address_extract_port(uschar *address)
387 /* Handle the "bracketed with colon on the end" format */
391 uschar *rb = address + 1;
392 while (*rb != 0 && *rb != ']') rb++;
393 if (*rb++ == 0) return 0; /* Missing ]; leave invalid address */
396 port = Ustrtol(rb + 1, &endptr, 10);
397 if (*endptr != 0) return 0; /* Invalid port; leave invalid address */
399 else if (*rb != 0) return 0; /* Bad syntax; leave invalid address */
400 memmove(address, address + 1, rb - address - 2);
404 /* Handle the "dot on the end" format */
408 int skip = -3; /* Skip 3 dots in IPv4 addresses */
410 while (*(++address) != 0)
413 if (ch == ':') skip = 0; /* Skip 0 dots in IPv6 addresses */
414 else if (ch == '.' && skip++ >= 0) break;
416 if (*address == 0) return 0;
417 port = Ustrtol(address + 1, &endptr, 10);
418 if (*endptr != 0) return 0; /* Invalid port; leave invalid address */
426 /*************************************************
427 * Get port from a host item's name *
428 *************************************************/
430 /* This function is called when finding the IP address for a host that is in a
431 list of hosts explicitly configured, such as in the manualroute router, or in a
432 fallback hosts list. We see if there is a port specification at the end of the
433 host name, and if so, remove it. A minimum length of 3 is required for the
434 original name; nothing shorter is recognized as having a port.
436 We test for a name ending with a sequence of digits; if preceded by colon we
437 have a port if the character before the colon is ] and the name starts with [
438 or if there are no other colons in the name (i.e. it's not an IPv6 address).
440 Arguments: pointer to the host item
441 Returns: a port number or PORT_NONE
445 host_item_get_port(host_item *h)
449 int len = Ustrlen(h->name);
451 if (len < 3 || (p = h->name + len - 1, !isdigit(*p))) return PORT_NONE;
453 /* Extract potential port number */
458 while (p > h->name + 1 && isdigit(*p))
460 port += (*p-- - '0') * x;
464 /* The smallest value of p at this point is h->name + 1. */
466 if (*p != ':') return PORT_NONE;
468 if (p[-1] == ']' && h->name[0] == '[')
469 h->name = string_copyn(h->name + 1, p - h->name - 2);
470 else if (Ustrchr(h->name, ':') == p)
471 h->name = string_copyn(h->name, p - h->name);
472 else return PORT_NONE;
474 DEBUG(D_route|D_host_lookup) debug_printf("host=%s port=%d\n", h->name, port);
480 #ifndef STAND_ALONE /* Omit when standalone testing */
482 /*************************************************
483 * Build sender_fullhost and sender_rcvhost *
484 *************************************************/
486 /* This function is called when sender_host_name and/or sender_helo_name
487 have been set. Or might have been set - for a local message read off the spool
488 they won't be. In that case, do nothing. Otherwise, set up the fullhost string
491 (a) No sender_host_name or sender_helo_name: "[ip address]"
492 (b) Just sender_host_name: "host_name [ip address]"
493 (c) Just sender_helo_name: "(helo_name) [ip address]" unless helo is IP
494 in which case: "[ip address}"
495 (d) The two are identical: "host_name [ip address]" includes helo = IP
496 (e) The two are different: "host_name (helo_name) [ip address]"
498 If log_incoming_port is set, the sending host's port number is added to the IP
501 This function also builds sender_rcvhost for use in Received: lines, whose
502 syntax is a bit different. This value also includes the RFC 1413 identity.
503 There wouldn't be two different variables if I had got all this right in the
506 Because this data may survive over more than one incoming SMTP message, it has
507 to be in permanent store.
514 host_build_sender_fullhost(void)
516 BOOL show_helo = TRUE;
519 int old_pool = store_pool;
521 if (sender_host_address == NULL) return;
523 store_pool = POOL_PERM;
525 /* Set up address, with or without the port. After discussion, it seems that
526 the only format that doesn't cause trouble is [aaaa]:pppp. However, we can't
527 use this directly as the first item for Received: because it ain't an RFC 2822
530 address = string_sprintf("[%s]:%d", sender_host_address, sender_host_port);
531 if ((log_extra_selector & LX_incoming_port) == 0 || sender_host_port <= 0)
532 *(Ustrrchr(address, ':')) = 0;
534 /* If there's no EHLO/HELO data, we can't show it. */
536 if (sender_helo_name == NULL) show_helo = FALSE;
538 /* If HELO/EHLO was followed by an IP literal, it's messy because of two
539 features of IPv6. Firstly, there's the "IPv6:" prefix (Exim is liberal and
540 doesn't require this, for historical reasons). Secondly, IPv6 addresses may not
541 be given in canonical form, so we have to canonicize them before comparing. As
542 it happens, the code works for both IPv4 and IPv6. */
544 else if (sender_helo_name[0] == '[' &&
545 sender_helo_name[(len=Ustrlen(sender_helo_name))-1] == ']')
550 if (strncmpic(sender_helo_name + 1, US"IPv6:", 5) == 0) offset += 5;
551 if (strncmpic(sender_helo_name + 1, US"IPv4:", 5) == 0) offset += 5;
553 helo_ip = string_copyn(sender_helo_name + offset, len - offset - 1);
555 if (string_is_ip_address(helo_ip, NULL) != 0)
559 uschar ipx[48], ipy[48]; /* large enough for full IPv6 */
561 sizex = host_aton(helo_ip, x);
562 sizey = host_aton(sender_host_address, y);
564 (void)host_nmtoa(sizex, x, -1, ipx, ':');
565 (void)host_nmtoa(sizey, y, -1, ipy, ':');
567 if (strcmpic(ipx, ipy) == 0) show_helo = FALSE;
571 /* Host name is not verified */
573 if (sender_host_name == NULL)
575 uschar *portptr = Ustrstr(address, "]:");
578 int adlen; /* Sun compiler doesn't like ++ in initializers */
580 adlen = (portptr == NULL)? Ustrlen(address) : (++portptr - address);
581 sender_fullhost = (sender_helo_name == NULL)? address :
582 string_sprintf("(%s) %s", sender_helo_name, address);
584 sender_rcvhost = string_cat(NULL, &size, &ptr, address, adlen);
586 if (sender_ident != NULL || show_helo || portptr != NULL)
589 sender_rcvhost = string_cat(sender_rcvhost, &size, &ptr, US" (", 2);
593 sender_rcvhost = string_append(sender_rcvhost, &size, &ptr, 2, US"port=",
597 sender_rcvhost = string_append(sender_rcvhost, &size, &ptr, 2,
598 (firstptr == ptr)? US"helo=" : US" helo=", sender_helo_name);
600 if (sender_ident != NULL)
601 sender_rcvhost = string_append(sender_rcvhost, &size, &ptr, 2,
602 (firstptr == ptr)? US"ident=" : US" ident=", sender_ident);
604 sender_rcvhost = string_cat(sender_rcvhost, &size, &ptr, US")", 1);
607 sender_rcvhost[ptr] = 0; /* string_cat() always leaves room */
609 /* Release store, because string_cat allocated a minimum of 100 bytes that
610 are rarely completely used. */
612 store_reset(sender_rcvhost + ptr + 1);
615 /* Host name is known and verified. Unless we've already found that the HELO
616 data matches the IP address, compare it with the name. */
620 if (show_helo && strcmpic(sender_host_name, sender_helo_name) == 0)
625 sender_fullhost = string_sprintf("%s (%s) %s", sender_host_name,
626 sender_helo_name, address);
627 sender_rcvhost = (sender_ident == NULL)?
628 string_sprintf("%s (%s helo=%s)", sender_host_name,
629 address, sender_helo_name) :
630 string_sprintf("%s\n\t(%s helo=%s ident=%s)", sender_host_name,
631 address, sender_helo_name, sender_ident);
635 sender_fullhost = string_sprintf("%s %s", sender_host_name, address);
636 sender_rcvhost = (sender_ident == NULL)?
637 string_sprintf("%s (%s)", sender_host_name, address) :
638 string_sprintf("%s (%s ident=%s)", sender_host_name, address,
643 store_pool = old_pool;
645 DEBUG(D_host_lookup) debug_printf("sender_fullhost = %s\n", sender_fullhost);
646 DEBUG(D_host_lookup) debug_printf("sender_rcvhost = %s\n", sender_rcvhost);
651 /*************************************************
652 * Build host+ident message *
653 *************************************************/
655 /* Used when logging rejections and various ACL and SMTP incidents. The text
656 return depends on whether sender_fullhost and sender_ident are set or not:
658 no ident, no host => U=unknown
659 no ident, host set => H=sender_fullhost
660 ident set, no host => U=ident
661 ident set, host set => H=sender_fullhost U=ident
664 useflag TRUE if first item to be flagged (H= or U=); if there are two
665 items, the second is always flagged
667 Returns: pointer to a string in big_buffer
671 host_and_ident(BOOL useflag)
673 if (sender_fullhost == NULL)
675 (void)string_format(big_buffer, big_buffer_size, "%s%s", useflag? "U=" : "",
676 (sender_ident == NULL)? US"unknown" : sender_ident);
680 uschar *flag = useflag? US"H=" : US"";
681 uschar *iface = US"";
682 if ((log_extra_selector & LX_incoming_interface) != 0 &&
683 interface_address != NULL)
684 iface = string_sprintf(" I=[%s]:%d", interface_address, interface_port);
685 if (sender_ident == NULL)
686 (void)string_format(big_buffer, big_buffer_size, "%s%s%s",
687 flag, sender_fullhost, iface);
689 (void)string_format(big_buffer, big_buffer_size, "%s%s%s U=%s",
690 flag, sender_fullhost, iface, sender_ident);
695 #endif /* STAND_ALONE */
700 /*************************************************
701 * Build list of local interfaces *
702 *************************************************/
704 /* This function interprets the contents of the local_interfaces or
705 extra_local_interfaces options, and creates an ip_address_item block for each
706 item on the list. There is no special interpretation of any IP addresses; in
707 particular, 0.0.0.0 and ::0 are returned without modification. If any address
708 includes a port, it is set in the block. Otherwise the port value is set to
713 name the name of the option being expanded
715 Returns: a chain of ip_address_items, each containing to a textual
716 version of an IP address, and a port number (host order) or
717 zero if no port was given with the address
721 host_build_ifacelist(uschar *list, uschar *name)
726 ip_address_item *yield = NULL;
727 ip_address_item *last = NULL;
728 ip_address_item *next;
730 while ((s = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
733 int port = host_address_extract_port(s); /* Leaves just the IP address */
734 if ((ipv = string_is_ip_address(s, NULL)) == 0)
735 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Malformed IP address \"%s\" in %s",
738 /* Skip IPv6 addresses if IPv6 is disabled. */
740 if (disable_ipv6 && ipv == 6) continue;
742 /* This use of strcpy() is OK because we have checked that s is a valid IP
743 address above. The field in the ip_address_item is large enough to hold an
746 next = store_get(sizeof(ip_address_item));
748 Ustrcpy(next->address, s);
750 next->v6_include_v4 = FALSE;
752 if (yield == NULL) yield = last = next; else
766 /*************************************************
767 * Find addresses on local interfaces *
768 *************************************************/
770 /* This function finds the addresses of local IP interfaces. These are used
771 when testing for routing to the local host. As the function may be called more
772 than once, the list is preserved in permanent store, pointed to by a static
773 variable, to save doing the work more than once per process.
775 The generic list of interfaces is obtained by calling host_build_ifacelist()
776 for local_interfaces and extra_local_interfaces. This list scanned to remove
777 duplicates (which may exist with different ports - not relevant here). If
778 either of the wildcard IP addresses (0.0.0.0 and ::0) are encountered, they are
779 replaced by the appropriate (IPv4 or IPv6) list of actual local interfaces,
780 obtained from os_find_running_interfaces().
783 Returns: a chain of ip_address_items, each containing to a textual
784 version of an IP address; the port numbers are not relevant
788 /* First, a local subfunction to add an interface to a list in permanent store,
789 but only if there isn't a previous copy of that address on the list. */
791 static ip_address_item *
792 add_unique_interface(ip_address_item *list, ip_address_item *ipa)
794 ip_address_item *ipa2;
795 for (ipa2 = list; ipa2 != NULL; ipa2 = ipa2->next)
796 if (Ustrcmp(ipa2->address, ipa->address) == 0) return list;
797 ipa2 = store_get_perm(sizeof(ip_address_item));
804 /* This is the globally visible function */
807 host_find_interfaces(void)
809 ip_address_item *running_interfaces = NULL;
811 if (local_interface_data == NULL)
813 void *reset_item = store_get(0);
814 ip_address_item *dlist = host_build_ifacelist(local_interfaces,
815 US"local_interfaces");
816 ip_address_item *xlist = host_build_ifacelist(extra_local_interfaces,
817 US"extra_local_interfaces");
818 ip_address_item *ipa;
820 if (dlist == NULL) dlist = xlist; else
822 for (ipa = dlist; ipa->next != NULL; ipa = ipa->next);
826 for (ipa = dlist; ipa != NULL; ipa = ipa->next)
828 if (Ustrcmp(ipa->address, "0.0.0.0") == 0 ||
829 Ustrcmp(ipa->address, "::0") == 0)
831 ip_address_item *ipa2;
832 BOOL ipv6 = ipa->address[0] == ':';
833 if (running_interfaces == NULL)
834 running_interfaces = os_find_running_interfaces();
835 for (ipa2 = running_interfaces; ipa2 != NULL; ipa2 = ipa2->next)
837 if ((Ustrchr(ipa2->address, ':') != NULL) == ipv6)
838 local_interface_data = add_unique_interface(local_interface_data,
844 local_interface_data = add_unique_interface(local_interface_data, ipa);
847 debug_printf("Configured local interface: address=%s", ipa->address);
848 if (ipa->port != 0) debug_printf(" port=%d", ipa->port);
853 store_reset(reset_item);
856 return local_interface_data;
863 /*************************************************
864 * Convert network IP address to text *
865 *************************************************/
867 /* Given an IPv4 or IPv6 address in binary, convert it to a text
868 string and return the result in a piece of new store. The address can
869 either be given directly, or passed over in a sockaddr structure. Note
870 that this isn't the converse of host_aton() because of byte ordering
871 differences. See host_nmtoa() below.
874 type if < 0 then arg points to a sockaddr, else
875 either AF_INET or AF_INET6
876 arg points to a sockaddr if type is < 0, or
877 points to an IPv4 address (32 bits), or
878 points to an IPv6 address (128 bits),
879 in both cases, in network byte order
880 buffer if NULL, the result is returned in gotten store;
881 else points to a buffer to hold the answer
882 portptr points to where to put the port number, if non NULL; only
885 Returns: pointer to character string
889 host_ntoa(int type, const void *arg, uschar *buffer, int *portptr)
893 /* The new world. It is annoying that we have to fish out the address from
894 different places in the block, depending on what kind of address it is. It
895 is also a pain that inet_ntop() returns a const uschar *, whereas the IPv4
896 function inet_ntoa() returns just uschar *, and some picky compilers insist
897 on warning if one assigns a const uschar * to a uschar *. Hence the casts. */
900 uschar addr_buffer[46];
903 int family = ((struct sockaddr *)arg)->sa_family;
904 if (family == AF_INET6)
906 struct sockaddr_in6 *sk = (struct sockaddr_in6 *)arg;
907 yield = (uschar *)inet_ntop(family, &(sk->sin6_addr), CS addr_buffer,
908 sizeof(addr_buffer));
909 if (portptr != NULL) *portptr = ntohs(sk->sin6_port);
913 struct sockaddr_in *sk = (struct sockaddr_in *)arg;
914 yield = (uschar *)inet_ntop(family, &(sk->sin_addr), CS addr_buffer,
915 sizeof(addr_buffer));
916 if (portptr != NULL) *portptr = ntohs(sk->sin_port);
921 yield = (uschar *)inet_ntop(type, arg, CS addr_buffer, sizeof(addr_buffer));
924 /* If the result is a mapped IPv4 address, show it in V4 format. */
926 if (Ustrncmp(yield, "::ffff:", 7) == 0) yield += 7;
928 #else /* HAVE_IPV6 */
934 yield = US inet_ntoa(((struct sockaddr_in *)arg)->sin_addr);
935 if (portptr != NULL) *portptr = ntohs(((struct sockaddr_in *)arg)->sin_port);
938 yield = US inet_ntoa(*((struct in_addr *)arg));
941 /* If there is no buffer, put the string into some new store. */
943 if (buffer == NULL) return string_copy(yield);
945 /* Callers of this function with a non-NULL buffer must ensure that it is
946 large enough to hold an IPv6 address, namely, at least 46 bytes. That's what
947 makes this use of strcpy() OK. */
949 Ustrcpy(buffer, yield);
956 /*************************************************
957 * Convert address text to binary *
958 *************************************************/
960 /* Given the textual form of an IP address, convert it to binary in an
961 array of ints. IPv4 addresses occupy one int; IPv6 addresses occupy 4 ints.
962 The result has the first byte in the most significant byte of the first int. In
963 other words, the result is not in network byte order, but in host byte order.
964 As a result, this is not the converse of host_ntoa(), which expects network
965 byte order. See host_nmtoa() below.
968 address points to the textual address, checked for syntax
969 bin points to an array of 4 ints
971 Returns: the number of ints used
975 host_aton(uschar *address, int *bin)
980 /* Handle IPv6 address, which may end with an IPv4 address. It may also end
981 with a "scope", introduced by a percent sign. This code is NOT enclosed in #if
982 HAVE_IPV6 in order that IPv6 addresses are recognized even if IPv6 is not
985 if (Ustrchr(address, ':') != NULL)
988 uschar *component[8];
989 BOOL ipv4_ends = FALSE;
995 /* If the address starts with a colon, it will start with two colons.
996 Just lose the first one, which will leave a null first component. */
1000 /* Split the address into components separated by colons. The input address
1001 is supposed to be checked for syntax. There was a case where this was
1002 overlooked; to guard against that happening again, check here and crash if
1003 there are too many components. */
1005 while (*p != 0 && *p != '%')
1007 int len = Ustrcspn(p, ":%");
1008 if (len == 0) nulloffset = ci;
1009 if (ci > 7) log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1010 "Internal error: invalid IPv6 address \"%s\" passed to host_aton()",
1012 component[ci++] = p;
1017 /* If the final component contains a dot, it is a trailing v4 address.
1018 As the syntax is known to be checked, just set up for a trailing
1019 v4 address and restrict the v6 part to 6 components. */
1021 if (Ustrchr(component[ci-1], '.') != NULL)
1023 address = component[--ci];
1029 /* If there are fewer than 6 or 8 components, we have to insert some
1030 more empty ones in the middle. */
1034 int insert_count = v6count - ci;
1035 for (i = v6count-1; i > nulloffset + insert_count; i--)
1036 component[i] = component[i - insert_count];
1037 while (i > nulloffset) component[i--] = US"";
1040 /* Now turn the components into binary in pairs and bung them
1041 into the vector of ints. */
1043 for (i = 0; i < v6count; i += 2)
1044 bin[i/2] = (Ustrtol(component[i], NULL, 16) << 16) +
1045 Ustrtol(component[i+1], NULL, 16);
1047 /* If there was no terminating v4 component, we are done. */
1049 if (!ipv4_ends) return 4;
1052 /* Handle IPv4 address */
1054 (void)sscanf(CS address, "%d.%d.%d.%d", x, x+1, x+2, x+3);
1055 bin[v4offset] = (x[0] << 24) + (x[1] << 16) + (x[2] << 8) + x[3];
1060 /*************************************************
1061 * Apply mask to an IP address *
1062 *************************************************/
1064 /* Mask an address held in 1 or 4 ints, with the ms bit in the ms bit of the
1068 count the number of ints
1069 binary points to the ints to be masked
1070 mask the count of ms bits to leave, or -1 if no masking
1076 host_mask(int count, int *binary, int mask)
1079 if (mask < 0) mask = 99999;
1080 for (i = 0; i < count; i++)
1083 if (mask == 0) wordmask = 0;
1086 wordmask = (-1) << (32 - mask);
1094 binary[i] &= wordmask;
1101 /*************************************************
1102 * Convert masked IP address in ints to text *
1103 *************************************************/
1105 /* We can't use host_ntoa() because it assumes the binary values are in network
1106 byte order, and these are the result of host_aton(), which puts them in ints in
1107 host byte order. Also, we really want IPv6 addresses to be in a canonical
1108 format, so we output them with no abbreviation. In a number of cases we can't
1109 use the normal colon separator in them because it terminates keys in lsearch
1110 files, so we want to use dot instead. There's an argument that specifies what
1111 to use for IPv6 addresses.
1114 count 1 or 4 (number of ints)
1115 binary points to the ints
1116 mask mask value; if < 0 don't add to result
1117 buffer big enough to hold the result
1118 sep component separator character for IPv6 addresses
1120 Returns: the number of characters placed in buffer, not counting
1125 host_nmtoa(int count, int *binary, int mask, uschar *buffer, int sep)
1128 uschar *tt = buffer;
1133 for (i = 24; i >= 0; i -= 8)
1135 sprintf(CS tt, "%d.", (j >> i) & 255);
1141 for (i = 0; i < 4; i++)
1144 sprintf(CS tt, "%04x%c%04x%c", (j >> 16) & 0xffff, sep, j & 0xffff, sep);
1149 tt--; /* lose final separator */
1155 sprintf(CS tt, "/%d", mask);
1164 /*************************************************
1165 * Check port for tls_on_connect *
1166 *************************************************/
1168 /* This function checks whether a given incoming port is configured for tls-
1169 on-connect. It is called from the daemon and from inetd handling. If the global
1170 option tls_on_connect is already set, all ports operate this way. Otherwise, we
1171 check the tls_on_connect_ports option for a list of ports.
1173 Argument: a port number
1174 Returns: TRUE or FALSE
1178 host_is_tls_on_connect_port(int port)
1182 uschar *list = tls_in.on_connect_ports;
1185 if (tls_in.on_connect) return TRUE;
1187 while ((s = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
1190 int lport = Ustrtol(s, &end, 10);
1191 if (*end != 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "tls_on_connect_ports "
1192 "contains \"%s\", which is not a port number: exim abandoned", s);
1193 if (lport == port) return TRUE;
1201 /*************************************************
1202 * Check whether host is in a network *
1203 *************************************************/
1205 /* This function checks whether a given IP address matches a pattern that
1206 represents either a single host, or a network (using CIDR notation). The caller
1207 of this function must check the syntax of the arguments before calling it.
1210 host string representation of the ip-address to check
1211 net string representation of the network, with optional CIDR mask
1212 maskoffset offset to the / that introduces the mask in the key
1213 zero if there is no mask
1216 TRUE the host is inside the network
1217 FALSE the host is NOT inside the network
1221 host_is_in_net(uschar *host, uschar *net, int maskoffset)
1227 int size = host_aton(net, address);
1230 /* No mask => all bits to be checked */
1232 if (maskoffset == 0) mlen = 99999; /* Big number */
1233 else mlen = Uatoi(net + maskoffset + 1);
1235 /* Convert the incoming address to binary. */
1237 insize = host_aton(host, incoming);
1239 /* Convert IPv4 addresses given in IPv6 compatible mode, which represent
1240 connections from IPv4 hosts to IPv6 hosts, that is, addresses of the form
1241 ::ffff:<v4address>, to IPv4 format. */
1243 if (insize == 4 && incoming[0] == 0 && incoming[1] == 0 &&
1244 incoming[2] == 0xffff)
1247 incoming[0] = incoming[3];
1250 /* No match if the sizes don't agree. */
1252 if (insize != size) return FALSE;
1254 /* Else do the masked comparison. */
1256 for (i = 0; i < size; i++)
1259 if (mlen == 0) mask = 0;
1262 mask = (-1) << (32 - mlen);
1270 if ((incoming[i] & mask) != (address[i] & mask)) return FALSE;
1278 /*************************************************
1279 * Scan host list for local hosts *
1280 *************************************************/
1282 /* Scan through a chain of addresses and check whether any of them is the
1283 address of an interface on the local machine. If so, remove that address and
1284 any previous ones with the same MX value, and all subsequent ones (which will
1285 have greater or equal MX values) from the chain. Note: marking them as unusable
1286 is NOT the right thing to do because it causes the hosts not to be used for
1287 other domains, for which they may well be correct.
1289 The hosts may be part of a longer chain; we only process those between the
1290 initial pointer and the "last" pointer.
1292 There is also a list of "pseudo-local" host names which are checked against the
1293 host names. Any match causes that host item to be treated the same as one which
1294 matches a local IP address.
1296 If the very first host is a local host, then all MX records had a precedence
1297 greater than or equal to that of the local host. Either there's a problem in
1298 the DNS, or an apparently remote name turned out to be an abbreviation for the
1299 local host. Give a specific return code, and let the caller decide what to do.
1300 Otherwise, give a success code if at least one host address has been found.
1303 host pointer to the first host in the chain
1304 lastptr pointer to pointer to the last host in the chain (may be updated)
1305 removed if not NULL, set TRUE if some local addresses were removed
1309 HOST_FOUND if there is at least one host with an IP address on the chain
1310 and an MX value less than any MX value associated with the
1312 HOST_FOUND_LOCAL if a local host is among the lowest-numbered MX hosts; when
1313 the host addresses were obtained from A records or
1314 gethostbyname(), the MX values are set to -1.
1315 HOST_FIND_FAILED if no valid hosts with set IP addresses were found
1319 host_scan_for_local_hosts(host_item *host, host_item **lastptr, BOOL *removed)
1321 int yield = HOST_FIND_FAILED;
1322 host_item *last = *lastptr;
1323 host_item *prev = NULL;
1326 if (removed != NULL) *removed = FALSE;
1328 if (local_interface_data == NULL) local_interface_data = host_find_interfaces();
1330 for (h = host; h != last->next; h = h->next)
1333 if (hosts_treat_as_local != NULL)
1336 uschar *save = deliver_domain;
1337 deliver_domain = h->name; /* set $domain */
1338 rc = match_isinlist(string_copylc(h->name), &hosts_treat_as_local, 0,
1339 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL);
1340 deliver_domain = save;
1341 if (rc == OK) goto FOUND_LOCAL;
1345 /* It seems that on many operating systems, 0.0.0.0 is treated as a synonym
1346 for 127.0.0.1 and refers to the local host. We therefore force it always to
1347 be treated as local. */
1349 if (h->address != NULL)
1351 ip_address_item *ip;
1352 if (Ustrcmp(h->address, "0.0.0.0") == 0) goto FOUND_LOCAL;
1353 for (ip = local_interface_data; ip != NULL; ip = ip->next)
1354 if (Ustrcmp(h->address, ip->address) == 0) goto FOUND_LOCAL;
1355 yield = HOST_FOUND; /* At least one remote address has been found */
1358 /* Update prev to point to the last host item before any that have
1359 the same MX value as the one we have just considered. */
1361 if (h->next == NULL || h->next->mx != h->mx) prev = h;
1364 return yield; /* No local hosts found: return HOST_FOUND or HOST_FIND_FAILED */
1366 /* A host whose IP address matches a local IP address, or whose name matches
1367 something in hosts_treat_as_local has been found. */
1373 HDEBUG(D_host_lookup) debug_printf((h->mx >= 0)?
1374 "local host has lowest MX\n" :
1375 "local host found for non-MX address\n");
1376 return HOST_FOUND_LOCAL;
1379 HDEBUG(D_host_lookup)
1381 debug_printf("local host in host list - removed hosts:\n");
1382 for (h = prev->next; h != last->next; h = h->next)
1383 debug_printf(" %s %s %d\n", h->name, h->address, h->mx);
1386 if (removed != NULL) *removed = TRUE;
1387 prev->next = last->next;
1395 /*************************************************
1396 * Remove duplicate IPs in host list *
1397 *************************************************/
1399 /* You would think that administrators could set up their DNS records so that
1400 one ended up with a list of unique IP addresses after looking up A or MX
1401 records, but apparently duplication is common. So we scan such lists and
1402 remove the later duplicates. Note that we may get lists in which some host
1403 addresses are not set.
1406 host pointer to the first host in the chain
1407 lastptr pointer to pointer to the last host in the chain (may be updated)
1413 host_remove_duplicates(host_item *host, host_item **lastptr)
1415 while (host != *lastptr)
1417 if (host->address != NULL)
1419 host_item *h = host;
1420 while (h != *lastptr)
1422 if (h->next->address != NULL &&
1423 Ustrcmp(h->next->address, host->address) == 0)
1425 DEBUG(D_host_lookup) debug_printf("duplicate IP address %s (MX=%d) "
1426 "removed\n", host->address, h->next->mx);
1427 if (h->next == *lastptr) *lastptr = h;
1428 h->next = h->next->next;
1433 /* If the last item was removed, host may have become == *lastptr */
1434 if (host != *lastptr) host = host->next;
1441 /*************************************************
1442 * Find sender host name by gethostbyaddr() *
1443 *************************************************/
1445 /* This used to be the only way it was done, but it turns out that not all
1446 systems give aliases for calls to gethostbyaddr() - or one of the modern
1447 equivalents like getipnodebyaddr(). Fortunately, multiple PTR records are rare,
1448 but they can still exist. This function is now used only when a DNS lookup of
1449 the IP address fails, in order to give access to /etc/hosts.
1452 Returns: OK, DEFER, FAIL
1456 host_name_lookup_byaddr(void)
1460 struct hostent *hosts;
1461 struct in_addr addr;
1463 /* Lookup on IPv6 system */
1466 if (Ustrchr(sender_host_address, ':') != NULL)
1468 struct in6_addr addr6;
1469 if (inet_pton(AF_INET6, CS sender_host_address, &addr6) != 1)
1470 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
1471 "IPv6 address", sender_host_address);
1472 #if HAVE_GETIPNODEBYADDR
1473 hosts = getipnodebyaddr(CS &addr6, sizeof(addr6), AF_INET6, &h_errno);
1475 hosts = gethostbyaddr(CS &addr6, sizeof(addr6), AF_INET6);
1480 if (inet_pton(AF_INET, CS sender_host_address, &addr) != 1)
1481 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unable to parse \"%s\" as an "
1482 "IPv4 address", sender_host_address);
1483 #if HAVE_GETIPNODEBYADDR
1484 hosts = getipnodebyaddr(CS &addr, sizeof(addr), AF_INET, &h_errno);
1486 hosts = gethostbyaddr(CS &addr, sizeof(addr), AF_INET);
1490 /* Do lookup on IPv4 system */
1493 addr.s_addr = (S_ADDR_TYPE)inet_addr(CS sender_host_address);
1494 hosts = gethostbyaddr(CS(&addr), sizeof(addr), AF_INET);
1497 /* Failed to look up the host. */
1501 HDEBUG(D_host_lookup) debug_printf("IP address lookup failed: h_errno=%d\n",
1503 return (h_errno == TRY_AGAIN || h_errno == NO_RECOVERY) ? DEFER : FAIL;
1506 /* It seems there are some records in the DNS that yield an empty name. We
1507 treat this as non-existent. In some operating systems, this is returned as an
1508 empty string; in others as a single dot. */
1510 if (hosts->h_name == NULL || hosts->h_name[0] == 0 || hosts->h_name[0] == '.')
1512 HDEBUG(D_host_lookup) debug_printf("IP address lookup yielded an empty name: "
1513 "treated as non-existent host name\n");
1517 /* Copy and lowercase the name, which is in static storage in many systems.
1518 Put it in permanent memory. */
1520 s = (uschar *)hosts->h_name;
1521 len = Ustrlen(s) + 1;
1522 t = sender_host_name = store_get_perm(len);
1523 while (*s != 0) *t++ = tolower(*s++);
1526 /* If the host has aliases, build a copy of the alias list */
1528 if (hosts->h_aliases != NULL)
1531 uschar **aliases, **ptr;
1532 for (aliases = USS hosts->h_aliases; *aliases != NULL; aliases++) count++;
1533 ptr = sender_host_aliases = store_get_perm(count * sizeof(uschar *));
1534 for (aliases = USS hosts->h_aliases; *aliases != NULL; aliases++)
1536 uschar *s = *aliases;
1537 int len = Ustrlen(s) + 1;
1538 uschar *t = *ptr++ = store_get_perm(len);
1539 while (*s != 0) *t++ = tolower(*s++);
1550 /*************************************************
1551 * Find host name for incoming call *
1552 *************************************************/
1554 /* Put the name in permanent store, pointed to by sender_host_name. We also set
1555 up a list of alias names, pointed to by sender_host_alias. The list is
1556 NULL-terminated. The incoming address is in sender_host_address, either in
1557 dotted-quad form for IPv4 or in colon-separated form for IPv6.
1559 This function does a thorough check that the names it finds point back to the
1560 incoming IP address. Any that do not are discarded. Note that this is relied on
1561 by the ACL reverse_host_lookup check.
1563 On some systems, get{host,ipnode}byaddr() appears to do this internally, but
1564 this it not universally true. Also, for release 4.30, this function was changed
1565 to do a direct DNS lookup first, by default[1], because it turns out that that
1566 is the only guaranteed way to find all the aliases on some systems. My
1567 experiments indicate that Solaris gethostbyaddr() gives the aliases for but
1570 [1] The actual order is controlled by the host_lookup_order option.
1573 Returns: OK on success, the answer being placed in the global variable
1574 sender_host_name, with any aliases in a list hung off
1576 FAIL if no host name can be found
1577 DEFER if a temporary error was encountered
1579 The variable host_lookup_msg is set to an empty string on sucess, or to a
1580 reason for the failure otherwise, in a form suitable for tagging onto an error
1581 message, and also host_lookup_failed is set TRUE if the lookup failed. If there
1582 was a defer, host_lookup_deferred is set TRUE.
1584 Any dynamically constructed string for host_lookup_msg must be in permanent
1585 store, because it might be used for several incoming messages on the same SMTP
1589 host_name_lookup(void)
1593 uschar *hname, *save_hostname;
1597 uschar *list = host_lookup_order;
1602 sender_host_dnssec = host_lookup_deferred = host_lookup_failed = FALSE;
1604 HDEBUG(D_host_lookup)
1605 debug_printf("looking up host name for %s\n", sender_host_address);
1607 /* For testing the case when a lookup does not complete, we have a special
1608 reserved IP address. */
1610 if (running_in_test_harness &&
1611 Ustrcmp(sender_host_address, "99.99.99.99") == 0)
1613 HDEBUG(D_host_lookup)
1614 debug_printf("Test harness: host name lookup returns DEFER\n");
1615 host_lookup_deferred = TRUE;
1619 /* Do lookups directly in the DNS or via gethostbyaddr() (or equivalent), in
1620 the order specified by the host_lookup_order option. */
1622 while ((ordername = string_nextinlist(&list, &sep, buffer, sizeof(buffer)))
1625 if (strcmpic(ordername, US"bydns") == 0)
1627 dns_init(FALSE, FALSE, FALSE); /* dnssec ctrl by dns_dnssec_ok glbl */
1628 dns_build_reverse(sender_host_address, buffer);
1629 rc = dns_lookup(&dnsa, buffer, T_PTR, NULL);
1631 /* The first record we come across is used for the name; others are
1632 considered to be aliases. We have to scan twice, in order to find out the
1633 number of aliases. However, if all the names are empty, we will behave as
1634 if failure. (PTR records that yield empty names have been encountered in
1637 if (rc == DNS_SUCCEED)
1639 uschar **aptr = NULL;
1642 int old_pool = store_pool;
1644 /* Ideally we'd check DNSSEC both forward and reverse, but we use the
1645 gethost* routines for forward, so can't do that unless/until we rewrite. */
1646 sender_host_dnssec = dns_is_secure(&dnsa);
1648 debug_printf("Reverse DNS security status: %s\n",
1649 sender_host_dnssec ? "DNSSEC verified (AD)" : "unverified");
1651 store_pool = POOL_PERM; /* Save names in permanent storage */
1653 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1655 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1657 if (rr->type == T_PTR) count++;
1660 /* Get store for the list of aliases. For compatibility with
1661 gethostbyaddr, we make an empty list if there are none. */
1663 aptr = sender_host_aliases = store_get(count * sizeof(uschar *));
1665 /* Re-scan and extract the names */
1667 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1669 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1672 if (rr->type != T_PTR) continue;
1673 s = store_get(ssize);
1675 /* If an overlong response was received, the data will have been
1676 truncated and dn_expand may fail. */
1678 if (dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen,
1679 (uschar *)(rr->data), (DN_EXPAND_ARG4_TYPE)(s), ssize) < 0)
1681 log_write(0, LOG_MAIN, "host name alias list truncated for %s",
1682 sender_host_address);
1686 store_reset(s + Ustrlen(s) + 1);
1689 HDEBUG(D_host_lookup) debug_printf("IP address lookup yielded an "
1690 "empty name: treated as non-existent host name\n");
1693 if (sender_host_name == NULL) sender_host_name = s;
1695 while (*s != 0) { *s = tolower(*s); s++; }
1698 *aptr = NULL; /* End of alias list */
1699 store_pool = old_pool; /* Reset store pool */
1701 /* If we've found a names, break out of the "order" loop */
1703 if (sender_host_name != NULL) break;
1706 /* If the DNS lookup deferred, we must also defer. */
1708 if (rc == DNS_AGAIN)
1710 HDEBUG(D_host_lookup)
1711 debug_printf("IP address PTR lookup gave temporary error\n");
1712 host_lookup_deferred = TRUE;
1717 /* Do a lookup using gethostbyaddr() - or equivalent */
1719 else if (strcmpic(ordername, US"byaddr") == 0)
1721 HDEBUG(D_host_lookup)
1722 debug_printf("IP address lookup using gethostbyaddr()\n");
1723 rc = host_name_lookup_byaddr();
1726 host_lookup_deferred = TRUE;
1727 return rc; /* Can't carry on */
1729 if (rc == OK) break; /* Found a name */
1731 } /* Loop for bydns/byaddr scanning */
1733 /* If we have failed to find a name, return FAIL and log when required.
1734 NB host_lookup_msg must be in permanent store. */
1736 if (sender_host_name == NULL)
1738 if (host_checking || !log_testing_mode)
1739 log_write(L_host_lookup_failed, LOG_MAIN, "no host name found for IP "
1740 "address %s", sender_host_address);
1741 host_lookup_msg = US" (failed to find host name from IP address)";
1742 host_lookup_failed = TRUE;
1746 HDEBUG(D_host_lookup)
1748 uschar **aliases = sender_host_aliases;
1749 debug_printf("IP address lookup yielded %s\n", sender_host_name);
1750 while (*aliases != NULL) debug_printf(" alias %s\n", *aliases++);
1753 /* We need to verify that a forward lookup on the name we found does indeed
1754 correspond to the address. This is for security: in principle a malefactor who
1755 happened to own a reverse zone could set it to point to any names at all.
1757 This code was present in versions of Exim before 3.20. At that point I took it
1758 out because I thought that gethostbyaddr() did the check anyway. It turns out
1759 that this isn't always the case, so it's coming back in at 4.01. This version
1760 is actually better, because it also checks aliases.
1762 The code was made more robust at release 4.21. Prior to that, it accepted all
1763 the names if any of them had the correct IP address. Now the code checks all
1764 the names, and accepts only those that have the correct IP address. */
1766 save_hostname = sender_host_name; /* Save for error messages */
1767 aliases = sender_host_aliases;
1768 for (hname = sender_host_name; hname != NULL; hname = *aliases++)
1778 /* When called with the last argument FALSE, host_find_byname() won't return
1779 HOST_FOUND_LOCAL. If the incoming address is an IPv4 address expressed in
1780 IPv6 format, we must compare the IPv4 part to any IPv4 addresses. */
1782 if ((rc = host_find_byname(&h, NULL, 0, NULL, FALSE)) == HOST_FOUND)
1785 HDEBUG(D_host_lookup) debug_printf("checking addresses for %s\n", hname);
1786 for (hh = &h; hh != NULL; hh = hh->next)
1788 if (host_is_in_net(hh->address, sender_host_address, 0))
1790 HDEBUG(D_host_lookup) debug_printf(" %s OK\n", hh->address);
1796 HDEBUG(D_host_lookup) debug_printf(" %s\n", hh->address);
1799 if (!ok) HDEBUG(D_host_lookup)
1800 debug_printf("no IP address for %s matched %s\n", hname,
1801 sender_host_address);
1803 else if (rc == HOST_FIND_AGAIN)
1805 HDEBUG(D_host_lookup) debug_printf("temporary error for host name lookup\n");
1806 host_lookup_deferred = TRUE;
1807 sender_host_name = NULL;
1812 HDEBUG(D_host_lookup) debug_printf("no IP addresses found for %s\n", hname);
1815 /* If this name is no good, and it's the sender name, set it null pro tem;
1816 if it's an alias, just remove it from the list. */
1820 if (hname == sender_host_name) sender_host_name = NULL; else
1822 uschar **a; /* Don't amalgamate - some */
1823 a = --aliases; /* compilers grumble */
1824 while (*a != NULL) { *a = a[1]; a++; }
1829 /* If sender_host_name == NULL, it means we didn't like the name. Replace
1830 it with the first alias, if there is one. */
1832 if (sender_host_name == NULL && *sender_host_aliases != NULL)
1833 sender_host_name = *sender_host_aliases++;
1835 /* If we now have a main name, all is well. */
1837 if (sender_host_name != NULL) return OK;
1839 /* We have failed to find an address that matches. */
1841 HDEBUG(D_host_lookup)
1842 debug_printf("%s does not match any IP address for %s\n",
1843 sender_host_address, save_hostname);
1845 /* This message must be in permanent store */
1847 old_pool = store_pool;
1848 store_pool = POOL_PERM;
1849 host_lookup_msg = string_sprintf(" (%s does not match any IP address for %s)",
1850 sender_host_address, save_hostname);
1851 store_pool = old_pool;
1852 host_lookup_failed = TRUE;
1859 /*************************************************
1860 * Find IP address(es) for host by name *
1861 *************************************************/
1863 /* The input is a host_item structure with the name filled in and the address
1864 field set to NULL. We use gethostbyname() or getipnodebyname() or
1865 gethostbyname2(), as appropriate. Of course, these functions may use the DNS,
1866 but they do not do MX processing. It appears, however, that in some systems the
1867 current setting of resolver options is used when one of these functions calls
1868 the resolver. For this reason, we call dns_init() at the start, with arguments
1869 influenced by bits in "flags", just as we do for host_find_bydns().
1871 The second argument provides a host list (usually an IP list) of hosts to
1872 ignore. This makes it possible to ignore IPv6 link-local addresses or loopback
1873 addresses in unreasonable places.
1875 The lookup may result in a change of name. For compatibility with the dns
1876 lookup, return this via fully_qualified_name as well as updating the host item.
1877 The lookup may also yield more than one IP address, in which case chain on
1878 subsequent host_item structures.
1881 host a host item with the name and MX filled in;
1882 the address is to be filled in;
1883 multiple IP addresses cause other host items to be
1885 ignore_target_hosts a list of hosts to ignore
1886 flags HOST_FIND_QUALIFY_SINGLE ) passed to
1887 HOST_FIND_SEARCH_PARENTS ) dns_init()
1888 fully_qualified_name if not NULL, set to point to host name for
1889 compatibility with host_find_bydns
1890 local_host_check TRUE if a check for the local host is wanted
1892 Returns: HOST_FIND_FAILED Failed to find the host or domain
1893 HOST_FIND_AGAIN Try again later
1894 HOST_FOUND Host found - data filled in
1895 HOST_FOUND_LOCAL Host found and is the local host
1899 host_find_byname(host_item *host, uschar *ignore_target_hosts, int flags,
1900 uschar **fully_qualified_name, BOOL local_host_check)
1902 int i, yield, times;
1904 host_item *last = NULL;
1905 BOOL temp_error = FALSE;
1910 /* If we are in the test harness, a name ending in .test.again.dns always
1911 forces a temporary error response, unless the name is in
1912 dns_again_means_nonexist. */
1914 if (running_in_test_harness)
1916 uschar *endname = host->name + Ustrlen(host->name);
1917 if (Ustrcmp(endname - 14, "test.again.dns") == 0) goto RETURN_AGAIN;
1920 /* Make sure DNS options are set as required. This appears to be necessary in
1921 some circumstances when the get..byname() function actually calls the DNS. */
1923 dns_init((flags & HOST_FIND_QUALIFY_SINGLE) != 0,
1924 (flags & HOST_FIND_SEARCH_PARENTS) != 0,
1925 FALSE); /*XXX dnssec? */
1927 /* In an IPv6 world, unless IPv6 has been disabled, we need to scan for both
1928 kinds of address, so go round the loop twice. Note that we have ensured that
1929 AF_INET6 is defined even in an IPv4 world, which makes for slightly tidier
1930 code. However, if dns_ipv4_lookup matches the domain, we also just do IPv4
1931 lookups here (except when testing standalone). */
1938 (dns_ipv4_lookup != NULL &&
1939 match_isinlist(host->name, &dns_ipv4_lookup, 0, NULL, NULL, MCL_DOMAIN,
1943 { af = AF_INET; times = 1; }
1945 { af = AF_INET6; times = 2; }
1947 /* No IPv6 support */
1949 #else /* HAVE_IPV6 */
1951 #endif /* HAVE_IPV6 */
1953 /* Initialize the flag that gets set for DNS syntax check errors, so that the
1954 interface to this function can be similar to host_find_bydns. */
1956 host_find_failed_syntax = FALSE;
1958 /* Loop to look up both kinds of address in an IPv6 world */
1960 for (i = 1; i <= times;
1962 af = AF_INET, /* If 2 passes, IPv4 on the second */
1968 struct hostent *hostdata;
1971 printf("Looking up: %s\n", host->name);
1975 if (running_in_test_harness)
1976 hostdata = host_fake_gethostbyname(host->name, af, &error_num);
1979 #if HAVE_GETIPNODEBYNAME
1980 hostdata = getipnodebyname(CS host->name, af, 0, &error_num);
1982 hostdata = gethostbyname2(CS host->name, af);
1983 error_num = h_errno;
1987 #else /* not HAVE_IPV6 */
1988 if (running_in_test_harness)
1989 hostdata = host_fake_gethostbyname(host->name, AF_INET, &error_num);
1992 hostdata = gethostbyname(CS host->name);
1993 error_num = h_errno;
1995 #endif /* HAVE_IPV6 */
1997 if (hostdata == NULL)
2002 case HOST_NOT_FOUND: error = US"HOST_NOT_FOUND"; break;
2003 case TRY_AGAIN: error = US"TRY_AGAIN"; break;
2004 case NO_RECOVERY: error = US"NO_RECOVERY"; break;
2005 case NO_DATA: error = US"NO_DATA"; break;
2006 #if NO_DATA != NO_ADDRESS
2007 case NO_ADDRESS: error = US"NO_ADDRESS"; break;
2009 default: error = US"?"; break;
2012 DEBUG(D_host_lookup) debug_printf("%s returned %d (%s)\n",
2014 #if HAVE_GETIPNODEBYNAME
2015 (af == AF_INET6)? "getipnodebyname(af=inet6)" : "getipnodebyname(af=inet)",
2017 (af == AF_INET6)? "gethostbyname2(af=inet6)" : "gethostbyname2(af=inet)",
2024 if (error_num == TRY_AGAIN || error_num == NO_RECOVERY) temp_error = TRUE;
2027 if ((hostdata->h_addr_list)[0] == NULL) continue;
2029 /* Replace the name with the fully qualified one if necessary, and fill in
2030 the fully_qualified_name pointer. */
2032 if (hostdata->h_name[0] != 0 &&
2033 Ustrcmp(host->name, hostdata->h_name) != 0)
2034 host->name = string_copy_dnsdomain((uschar *)hostdata->h_name);
2035 if (fully_qualified_name != NULL) *fully_qualified_name = host->name;
2037 /* Get the list of addresses. IPv4 and IPv6 addresses can be distinguished
2038 by their different lengths. Scan the list, ignoring any that are to be
2039 ignored, and build a chain from the rest. */
2041 ipv4_addr = hostdata->h_length == sizeof(struct in_addr);
2043 for (addrlist = USS hostdata->h_addr_list; *addrlist != NULL; addrlist++)
2045 uschar *text_address =
2046 host_ntoa(ipv4_addr? AF_INET:AF_INET6, *addrlist, NULL, NULL);
2049 if (ignore_target_hosts != NULL &&
2050 verify_check_this_host(&ignore_target_hosts, NULL, host->name,
2051 text_address, NULL) == OK)
2053 DEBUG(D_host_lookup)
2054 debug_printf("ignored host %s [%s]\n", host->name, text_address);
2059 /* If this is the first address, last == NULL and we put the data in the
2064 host->address = text_address;
2065 host->port = PORT_NONE;
2066 host->status = hstatus_unknown;
2067 host->why = hwhy_unknown;
2068 host->dnssec = DS_UNK;
2072 /* Else add further host item blocks for any other addresses, keeping
2077 host_item *next = store_get(sizeof(host_item));
2078 next->name = host->name;
2079 next->mx = host->mx;
2080 next->address = text_address;
2081 next->port = PORT_NONE;
2082 next->status = hstatus_unknown;
2083 next->why = hwhy_unknown;
2084 next->dnssec = DS_UNK;
2086 next->next = last->next;
2093 /* If no hosts were found, the address field in the original host block will be
2094 NULL. If temp_error is set, at least one of the lookups gave a temporary error,
2095 so we pass that back. */
2097 if (host->address == NULL)
2101 (message_id[0] == 0 && smtp_in != NULL)?
2102 string_sprintf("no IP address found for host %s (during %s)", host->name,
2103 smtp_get_connection_info()) :
2105 string_sprintf("no IP address found for host %s", host->name);
2107 HDEBUG(D_host_lookup) debug_printf("%s\n", msg);
2108 if (temp_error) goto RETURN_AGAIN;
2109 if (host_checking || !log_testing_mode)
2110 log_write(L_host_lookup_failed, LOG_MAIN, "%s", msg);
2111 return HOST_FIND_FAILED;
2114 /* Remove any duplicate IP addresses, then check to see if this is the local
2115 host if required. */
2117 host_remove_duplicates(host, &last);
2118 yield = local_host_check?
2119 host_scan_for_local_hosts(host, &last, NULL) : HOST_FOUND;
2121 HDEBUG(D_host_lookup)
2124 if (fully_qualified_name != NULL)
2125 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
2126 debug_printf("%s looked up these IP addresses:\n",
2128 #if HAVE_GETIPNODEBYNAME
2137 for (h = host; h != last->next; h = h->next)
2138 debug_printf(" name=%s address=%s\n", h->name,
2139 (h->address == NULL)? US"<null>" : h->address);
2142 /* Return the found status. */
2146 /* Handle the case when there is a temporary error. If the name matches
2147 dns_again_means_nonexist, return permanent rather than temporary failure. */
2153 uschar *save = deliver_domain;
2154 deliver_domain = host->name; /* set $domain */
2155 rc = match_isinlist(host->name, &dns_again_means_nonexist, 0, NULL, NULL,
2156 MCL_DOMAIN, TRUE, NULL);
2157 deliver_domain = save;
2160 DEBUG(D_host_lookup) debug_printf("%s is in dns_again_means_nonexist: "
2161 "returning HOST_FIND_FAILED\n", host->name);
2162 return HOST_FIND_FAILED;
2165 return HOST_FIND_AGAIN;
2171 /*************************************************
2172 * Fill in a host address from the DNS *
2173 *************************************************/
2175 /* Given a host item, with its name, port and mx fields set, and its address
2176 field set to NULL, fill in its IP address from the DNS. If it is multi-homed,
2177 create additional host items for the additional addresses, copying all the
2178 other fields, and randomizing the order.
2180 On IPv6 systems, A6 records are sought first (but only if support for A6 is
2181 configured - they may never become mainstream), then AAAA records are sought,
2182 and finally A records are sought as well.
2184 The host name may be changed if the DNS returns a different name - e.g. fully
2185 qualified or changed via CNAME. If fully_qualified_name is not NULL, dns_lookup
2186 ensures that it points to the fully qualified name. However, this is the fully
2187 qualified version of the original name; if a CNAME is involved, the actual
2188 canonical host name may be different again, and so we get it directly from the
2189 relevant RR. Note that we do NOT change the mx field of the host item in this
2190 function as it may be called to set the addresses of hosts taken from MX
2194 host points to the host item we're filling in
2195 lastptr points to pointer to last host item in a chain of
2196 host items (may be updated if host is last and gets
2197 extended because multihomed)
2198 ignore_target_hosts list of hosts to ignore
2199 allow_ip if TRUE, recognize an IP address and return it
2200 fully_qualified_name if not NULL, return fully qualified name here if
2201 the contents are different (i.e. it must be preset
2203 dnnssec_require if TRUE check the DNS result AD bit
2205 Returns: HOST_FIND_FAILED couldn't find A record
2206 HOST_FIND_AGAIN try again later
2207 HOST_FOUND found AAAA and/or A record(s)
2208 HOST_IGNORED found, but all IPs ignored
2212 set_address_from_dns(host_item *host, host_item **lastptr,
2213 uschar *ignore_target_hosts, BOOL allow_ip, uschar **fully_qualified_name,
2214 BOOL dnssec_requested, BOOL dnssec_require)
2217 host_item *thishostlast = NULL; /* Indicates not yet filled in anything */
2218 BOOL v6_find_again = FALSE;
2221 /* If allow_ip is set, a name which is an IP address returns that value
2222 as its address. This is used for MX records when allow_mx_to_ip is set, for
2223 those sites that feel they have to flaunt the RFC rules. */
2225 if (allow_ip && string_is_ip_address(host->name, NULL) != 0)
2228 if (ignore_target_hosts != NULL &&
2229 verify_check_this_host(&ignore_target_hosts, NULL, host->name,
2230 host->name, NULL) == OK)
2231 return HOST_IGNORED;
2234 host->address = host->name;
2238 /* On an IPv6 system, unless IPv6 is disabled, go round the loop up to three
2239 times, looking for A6 and AAAA records the first two times. However, unless
2240 doing standalone testing, we force an IPv4 lookup if the domain matches
2241 dns_ipv4_lookup is set. Since A6 records look like being abandoned, support
2242 them only if explicitly configured to do so. On an IPv4 system, go round the
2243 loop once only, looking only for A records. */
2247 if (disable_ipv6 || (dns_ipv4_lookup != NULL &&
2248 match_isinlist(host->name, &dns_ipv4_lookup, 0, NULL, NULL, MCL_DOMAIN,
2250 i = 0; /* look up A records only */
2252 #endif /* STAND_ALONE */
2255 i = 2; /* look up A6 and AAAA and A records */
2257 i = 1; /* look up AAAA and A records */
2258 #endif /* SUPPORT_A6 */
2260 /* The IPv4 world */
2262 #else /* HAVE_IPV6 */
2263 i = 0; /* look up A records only */
2264 #endif /* HAVE_IPV6 */
2268 static int types[] = { T_A, T_AAAA, T_A6 };
2269 int type = types[i];
2270 int randoffset = (i == 0)? 500 : 0; /* Ensures v6 sorts before v4 */
2274 int rc = dns_lookup(&dnsa, host->name, type, fully_qualified_name);
2275 lookup_dnssec_authenticated = !dnssec_requested ? NULL
2276 : dns_is_secure(&dnsa) ? US"yes" : US"no";
2278 /* We want to return HOST_FIND_AGAIN if one of the A, A6, or AAAA lookups
2279 fails or times out, but not if another one succeeds. (In the early
2280 IPv6 days there are name servers that always fail on AAAA, but are happy
2281 to give out an A record. We want to proceed with that A record.) */
2283 if (rc != DNS_SUCCEED)
2285 if (i == 0) /* Just tried for an A record, i.e. end of loop */
2287 if (host->address != NULL) return HOST_FOUND; /* A6 or AAAA was found */
2288 if (rc == DNS_AGAIN || rc == DNS_FAIL || v6_find_again)
2289 return HOST_FIND_AGAIN;
2290 return HOST_FIND_FAILED; /* DNS_NOMATCH or DNS_NODATA */
2293 /* Tried for an A6 or AAAA record: remember if this was a temporary
2294 error, and look for the next record type. */
2296 if (rc != DNS_NOMATCH && rc != DNS_NODATA) v6_find_again = TRUE;
2299 if (dnssec_require && !dns_is_secure(&dnsa))
2301 log_write(L_host_lookup_failed, LOG_MAIN, "dnssec fail on %s for %.256s",
2302 i>1 ? "A6" : i>0 ? "AAAA" : "A", host->name);
2306 /* Lookup succeeded: fill in the given host item with the first non-ignored
2307 address found; create additional items for any others. A single A6 record
2308 may generate more than one address. */
2310 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2312 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2314 if (rr->type == type)
2316 /* dns_address *da = dns_address_from_rr(&dnsa, rr); */
2319 da = dns_address_from_rr(&dnsa, rr);
2321 DEBUG(D_host_lookup)
2324 debug_printf("no addresses extracted from A6 RR for %s\n",
2328 /* This loop runs only once for A and AAAA records, but may run
2329 several times for an A6 record that generated multiple addresses. */
2331 for (; da != NULL; da = da->next)
2334 if (ignore_target_hosts != NULL &&
2335 verify_check_this_host(&ignore_target_hosts, NULL,
2336 host->name, da->address, NULL) == OK)
2338 DEBUG(D_host_lookup)
2339 debug_printf("ignored host %s [%s]\n", host->name, da->address);
2344 /* If this is the first address, stick it in the given host block,
2345 and change the name if the returned RR has a different name. */
2347 if (thishostlast == NULL)
2349 if (strcmpic(host->name, rr->name) != 0)
2350 host->name = string_copy_dnsdomain(rr->name);
2351 host->address = da->address;
2352 host->sort_key = host->mx * 1000 + random_number(500) + randoffset;
2353 host->status = hstatus_unknown;
2354 host->why = hwhy_unknown;
2355 thishostlast = host;
2358 /* Not the first address. Check for, and ignore, duplicates. Then
2359 insert in the chain at a random point. */
2366 /* End of our local chain is specified by "thishostlast". */
2368 for (next = host;; next = next->next)
2370 if (Ustrcmp(CS da->address, next->address) == 0) break;
2371 if (next == thishostlast) { next = NULL; break; }
2373 if (next != NULL) continue; /* With loop for next address */
2375 /* Not a duplicate */
2377 new_sort_key = host->mx * 1000 + random_number(500) + randoffset;
2378 next = store_get(sizeof(host_item));
2380 /* New address goes first: insert the new block after the first one
2381 (so as not to disturb the original pointer) but put the new address
2382 in the original block. */
2384 if (new_sort_key < host->sort_key)
2386 *next = *host; /* Copies port */
2388 host->address = da->address;
2389 host->sort_key = new_sort_key;
2390 if (thishostlast == host) thishostlast = next; /* Local last */
2391 if (*lastptr == host) *lastptr = next; /* Global last */
2394 /* Otherwise scan down the addresses for this host to find the
2395 one to insert after. */
2399 host_item *h = host;
2400 while (h != thishostlast)
2402 if (new_sort_key < h->next->sort_key) break;
2405 *next = *h; /* Copies port */
2407 next->address = da->address;
2408 next->sort_key = new_sort_key;
2409 if (h == thishostlast) thishostlast = next; /* Local last */
2410 if (h == *lastptr) *lastptr = next; /* Global last */
2418 /* Control gets here only if the third lookup (the A record) succeeded.
2419 However, the address may not be filled in if it was ignored. */
2421 return (host->address == NULL)? HOST_IGNORED : HOST_FOUND;
2427 /*************************************************
2428 * Find IP addresses and host names via DNS *
2429 *************************************************/
2431 /* The input is a host_item structure with the name field filled in and the
2432 address field set to NULL. This may be in a chain of other host items. The
2433 lookup may result in more than one IP address, in which case we must created
2434 new host blocks for the additional addresses, and insert them into the chain.
2435 The original name may not be fully qualified. Use the fully_qualified_name
2436 argument to return the official name, as returned by the resolver.
2439 host point to initial host item
2440 ignore_target_hosts a list of hosts to ignore
2441 whichrrs flags indicating which RRs to look for:
2442 HOST_FIND_BY_SRV => look for SRV
2443 HOST_FIND_BY_MX => look for MX
2444 HOST_FIND_BY_A => look for A or AAAA
2445 also flags indicating how the lookup is done
2446 HOST_FIND_QUALIFY_SINGLE ) passed to the
2447 HOST_FIND_SEARCH_PARENTS ) resolver
2448 srv_service when SRV used, the service name
2449 srv_fail_domains DNS errors for these domains => assume nonexist
2450 mx_fail_domains DNS errors for these domains => assume nonexist
2451 dnssec_request_domains => make dnssec request
2452 dnssec_require_domains => ditto and nonexist failures
2453 fully_qualified_name if not NULL, return fully-qualified name
2454 removed set TRUE if local host was removed from the list
2456 Returns: HOST_FIND_FAILED Failed to find the host or domain;
2457 if there was a syntax error,
2458 host_find_failed_syntax is set.
2459 HOST_FIND_AGAIN Could not resolve at this time
2460 HOST_FOUND Host found
2461 HOST_FOUND_LOCAL The lowest MX record points to this
2462 machine, if MX records were found, or
2463 an A record that was found contains
2464 an address of the local host
2468 host_find_bydns(host_item *host, uschar *ignore_target_hosts, int whichrrs,
2469 uschar *srv_service, uschar *srv_fail_domains, uschar *mx_fail_domains,
2470 uschar *dnssec_request_domains, uschar *dnssec_require_domains,
2471 uschar **fully_qualified_name, BOOL *removed)
2473 host_item *h, *last;
2480 BOOL dnssec_require = match_isinlist(host->name, &dnssec_require_domains,
2481 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL) == OK;
2482 BOOL dnssec_request = dnssec_require
2483 || match_isinlist(host->name, &dnssec_request_domains,
2484 0, NULL, NULL, MCL_DOMAIN, TRUE, NULL) == OK;
2485 dnssec_status_t dnssec;
2487 /* Set the default fully qualified name to the incoming name, initialize the
2488 resolver if necessary, set up the relevant options, and initialize the flag
2489 that gets set for DNS syntax check errors. */
2491 if (fully_qualified_name != NULL) *fully_qualified_name = host->name;
2492 dns_init((whichrrs & HOST_FIND_QUALIFY_SINGLE) != 0,
2493 (whichrrs & HOST_FIND_SEARCH_PARENTS) != 0,
2496 host_find_failed_syntax = FALSE;
2498 /* First, if requested, look for SRV records. The service name is given; we
2499 assume TCP progocol. DNS domain names are constrained to a maximum of 256
2500 characters, so the code below should be safe. */
2502 if ((whichrrs & HOST_FIND_BY_SRV) != 0)
2505 uschar *temp_fully_qualified_name = buffer;
2508 (void)sprintf(CS buffer, "_%s._tcp.%n%.256s", srv_service, &prefix_length,
2512 /* Search for SRV records. If the fully qualified name is different to
2513 the input name, pass back the new original domain, without the prepended
2517 lookup_dnssec_authenticated = NULL;
2518 rc = dns_lookup(&dnsa, buffer, ind_type, &temp_fully_qualified_name);
2522 if (dns_is_secure(&dnsa))
2523 { dnssec = DS_YES; lookup_dnssec_authenticated = US"yes"; }
2525 { dnssec = DS_NO; lookup_dnssec_authenticated = US"no"; }
2528 if (temp_fully_qualified_name != buffer && fully_qualified_name != NULL)
2529 *fully_qualified_name = temp_fully_qualified_name + prefix_length;
2531 /* On DNS failures, we give the "try again" error unless the domain is
2532 listed as one for which we continue. */
2534 if (rc == DNS_SUCCEED && dnssec_require && !dns_is_secure(&dnsa))
2536 log_write(L_host_lookup_failed, LOG_MAIN,
2537 "dnssec fail on SRV for %.256s", host->name);
2540 if (rc == DNS_FAIL || rc == DNS_AGAIN)
2543 if (match_isinlist(host->name, &srv_fail_domains, 0, NULL, NULL, MCL_DOMAIN,
2546 { yield = HOST_FIND_AGAIN; goto out; }
2547 DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA "
2548 "(domain in srv_fail_domains)\n", (rc == DNS_FAIL)? "FAIL":"AGAIN");
2552 /* If we did not find any SRV records, search the DNS for MX records, if
2553 requested to do so. If the result is DNS_NOMATCH, it means there is no such
2554 domain, and there's no point in going on to look for address records with the
2555 same domain. The result will be DNS_NODATA if the domain exists but has no MX
2556 records. On DNS failures, we give the "try again" error unless the domain is
2557 listed as one for which we continue. */
2559 if (rc != DNS_SUCCEED && (whichrrs & HOST_FIND_BY_MX) != 0)
2563 lookup_dnssec_authenticated = NULL;
2564 rc = dns_lookup(&dnsa, host->name, ind_type, fully_qualified_name);
2568 if (dns_is_secure(&dnsa))
2569 { dnssec = DS_YES; lookup_dnssec_authenticated = US"yes"; }
2571 { dnssec = DS_NO; lookup_dnssec_authenticated = US"no"; }
2577 yield = HOST_FIND_FAILED; goto out;
2580 if (!dnssec_require || dns_is_secure(&dnsa))
2582 log_write(L_host_lookup_failed, LOG_MAIN,
2583 "dnssec fail on MX for %.256s", host->name);
2590 if (match_isinlist(host->name, &mx_fail_domains, 0, NULL, NULL, MCL_DOMAIN,
2593 { yield = HOST_FIND_AGAIN; goto out; }
2594 DEBUG(D_host_lookup) debug_printf("DNS_%s treated as DNS_NODATA "
2595 "(domain in mx_fail_domains)\n", (rc == DNS_FAIL)? "FAIL":"AGAIN");
2600 /* If we haven't found anything yet, and we are requested to do so, try for an
2601 A or AAAA record. If we find it (or them) check to see that it isn't the local
2604 if (rc != DNS_SUCCEED)
2606 if ((whichrrs & HOST_FIND_BY_A) == 0)
2608 DEBUG(D_host_lookup) debug_printf("Address records are not being sought\n");
2609 yield = HOST_FIND_FAILED;
2613 last = host; /* End of local chainlet */
2615 host->port = PORT_NONE;
2617 lookup_dnssec_authenticated = NULL;
2618 rc = set_address_from_dns(host, &last, ignore_target_hosts, FALSE,
2619 fully_qualified_name, dnssec_request, dnssec_require);
2623 if (dns_is_secure(&dnsa))
2624 { dnssec = DS_YES; lookup_dnssec_authenticated = US"yes"; }
2626 { dnssec = DS_NO; lookup_dnssec_authenticated = US"no"; }
2629 /* If one or more address records have been found, check that none of them
2630 are local. Since we know the host items all have their IP addresses
2631 inserted, host_scan_for_local_hosts() can only return HOST_FOUND or
2632 HOST_FOUND_LOCAL. We do not need to scan for duplicate IP addresses here,
2633 because set_address_from_dns() removes them. */
2635 if (rc == HOST_FOUND)
2636 rc = host_scan_for_local_hosts(host, &last, removed);
2638 if (rc == HOST_IGNORED) rc = HOST_FIND_FAILED; /* No special action */
2640 DEBUG(D_host_lookup)
2643 if (host->address != NULL)
2645 if (fully_qualified_name != NULL)
2646 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
2647 for (h = host; h != last->next; h = h->next)
2648 debug_printf("%s %s mx=%d sort=%d %s\n", h->name,
2649 (h->address == NULL)? US"<null>" : h->address, h->mx, h->sort_key,
2650 (h->status >= hstatus_unusable)? US"*" : US"");
2658 /* We have found one or more MX or SRV records. Sort them according to
2659 precedence. Put the data for the first one into the existing host block, and
2660 insert new host_item blocks into the chain for the remainder. For equal
2661 precedences one is supposed to randomize the order. To make this happen, the
2662 sorting is actually done on the MX value * 1000 + a random number. This is put
2663 into a host field called sort_key.
2665 In the case of hosts with both IPv6 and IPv4 addresses, we want to choose the
2666 IPv6 address in preference. At this stage, we don't know what kind of address
2667 the host has. We choose a random number < 500; if later we find an A record
2668 first, we add 500 to the random number. Then for any other address records, we
2669 use random numbers in the range 0-499 for AAAA records and 500-999 for A
2672 At this point we remove any duplicates that point to the same host, retaining
2673 only the one with the lowest precedence. We cannot yet check for precedence
2674 greater than that of the local host, because that test cannot be properly done
2675 until the addresses have been found - an MX record may point to a name for this
2676 host which is not the primary hostname. */
2678 last = NULL; /* Indicates that not even the first item is filled yet */
2680 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2682 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2685 int weight = 0; /* For SRV records */
2686 int port = PORT_NONE;
2687 uschar *s; /* MUST be unsigned for GETSHORT */
2690 if (rr->type != ind_type) continue;
2692 GETSHORT(precedence, s); /* Pointer s is advanced */
2694 /* For MX records, we use a random "weight" which causes multiple records of
2695 the same precedence to sort randomly. */
2697 if (ind_type == T_MX)
2698 weight = random_number(500);
2700 /* SRV records are specified with a port and a weight. The weight is used
2701 in a special algorithm. However, to start with, we just use it to order the
2702 records of equal priority (precedence). */
2706 GETSHORT(weight, s);
2710 /* Get the name of the host pointed to. */
2712 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, s,
2713 (DN_EXPAND_ARG4_TYPE)data, sizeof(data));
2715 /* Check that we haven't already got this host on the chain; if we have,
2716 keep only the lower precedence. This situation shouldn't occur, but you
2717 never know what junk might get into the DNS (and this case has been seen on
2718 more than one occasion). */
2720 if (last != NULL) /* This is not the first record */
2722 host_item *prev = NULL;
2724 for (h = host; h != last->next; prev = h, h = h->next)
2726 if (strcmpic(h->name, data) == 0)
2728 DEBUG(D_host_lookup)
2729 debug_printf("discarded duplicate host %s (MX=%d)\n", data,
2730 (precedence > h->mx)? precedence : h->mx);
2731 if (precedence >= h->mx) goto NEXT_MX_RR; /* Skip greater precedence */
2732 if (h == host) /* Override first item */
2735 host->sort_key = precedence * 1000 + weight;
2739 /* Unwanted host item is not the first in the chain, so we can get
2740 get rid of it by cutting it out. */
2742 prev->next = h->next;
2743 if (h == last) last = prev;
2749 /* If this is the first MX or SRV record, put the data into the existing host
2750 block. Otherwise, add a new block in the correct place; if it has to be
2751 before the first block, copy the first block's data to a new second block. */
2755 host->name = string_copy_dnsdomain(data);
2756 host->address = NULL;
2758 host->mx = precedence;
2759 host->sort_key = precedence * 1000 + weight;
2760 host->status = hstatus_unknown;
2761 host->why = hwhy_unknown;
2762 host->dnssec = dnssec;
2766 /* Make a new host item and seek the correct insertion place */
2770 int sort_key = precedence * 1000 + weight;
2771 host_item *next = store_get(sizeof(host_item));
2772 next->name = string_copy_dnsdomain(data);
2773 next->address = NULL;
2775 next->mx = precedence;
2776 next->sort_key = sort_key;
2777 next->status = hstatus_unknown;
2778 next->why = hwhy_unknown;
2779 next->dnssec = dnssec;
2782 /* Handle the case when we have to insert before the first item. */
2784 if (sort_key < host->sort_key)
2791 if (last == host) last = next;
2794 /* Else scan down the items we have inserted as part of this exercise;
2795 don't go further. */
2799 for (h = host; h != last; h = h->next)
2801 if (sort_key < h->next->sort_key)
2803 next->next = h->next;
2809 /* Join on after the last host item that's part of this
2810 processing if we haven't stopped sooner. */
2814 next->next = last->next;
2821 NEXT_MX_RR: continue;
2824 /* If the list of hosts was obtained from SRV records, there are two things to
2825 do. First, if there is only one host, and it's name is ".", it means there is
2826 no SMTP service at this domain. Otherwise, we have to sort the hosts of equal
2827 priority according to their weights, using an algorithm that is defined in RFC
2828 2782. The hosts are currently sorted by priority and weight. For each priority
2829 group we have to pick off one host and put it first, and then repeat for any
2830 remaining in the same priority group. */
2832 if (ind_type == T_SRV)
2836 if (host == last && host->name[0] == 0)
2838 DEBUG(D_host_lookup) debug_printf("the single SRV record is \".\"\n");
2839 yield = HOST_FIND_FAILED;
2843 DEBUG(D_host_lookup)
2845 debug_printf("original ordering of hosts from SRV records:\n");
2846 for (h = host; h != last->next; h = h->next)
2847 debug_printf(" %s P=%d W=%d\n", h->name, h->mx, h->sort_key % 1000);
2850 for (pptr = &host, h = host; h != last; pptr = &(h->next), h = h->next)
2855 /* Find the last following host that has the same precedence. At the same
2856 time, compute the sum of the weights and the running totals. These can be
2857 stored in the sort_key field. */
2859 for (hh = h; hh != last; hh = hh->next)
2861 int weight = hh->sort_key % 1000; /* was precedence * 1000 + weight */
2864 if (hh->mx != hh->next->mx) break;
2867 /* If there's more than one host at this precedence (priority), we need to
2868 pick one to go first. */
2874 int randomizer = random_number(sum + 1);
2876 for (ppptr = pptr, hhh = h;
2878 ppptr = &(hhh->next), hhh = hhh->next)
2880 if (hhh->sort_key >= randomizer) break;
2883 /* hhh now points to the host that should go first; ppptr points to the
2884 place that points to it. Unfortunately, if the start of the minilist is
2885 the start of the entire list, we can't just swap the items over, because
2886 we must not change the value of host, since it is passed in from outside.
2887 One day, this could perhaps be changed.
2889 The special case is fudged by putting the new item *second* in the chain,
2890 and then transferring the data between the first and second items. We
2891 can't just swap the first and the chosen item, because that would mean
2892 that an item with zero weight might no longer be first. */
2896 *ppptr = hhh->next; /* Cuts it out of the chain */
2900 host_item temp = *h;
2903 hhh->next = temp.next;
2909 hhh->next = h; /* The rest of the chain follows it */
2910 *pptr = hhh; /* It takes the place of h */
2911 h = hhh; /* It's now the start of this minilist */
2916 /* A host has been chosen to be first at this priority and h now points
2917 to this host. There may be others at the same priority, or others at a
2918 different priority. Before we leave this host, we need to put back a sort
2919 key of the traditional MX kind, in case this host is multihomed, because
2920 the sort key is used for ordering the multiple IP addresses. We do not need
2921 to ensure that these new sort keys actually reflect the order of the hosts,
2924 h->sort_key = h->mx * 1000 + random_number(500);
2925 } /* Move on to the next host */
2928 /* Now we have to find IP addresses for all the hosts. We have ensured above
2929 that the names in all the host items are unique. Before release 4.61 we used to
2930 process records from the additional section in the DNS packet that returned the
2931 MX or SRV records. However, a DNS name server is free to drop any resource
2932 records from the additional section. In theory, this has always been a
2933 potential problem, but it is exacerbated by the advent of IPv6. If a host had
2934 several IPv4 addresses and some were not in the additional section, at least
2935 Exim would try the others. However, if a host had both IPv4 and IPv6 addresses
2936 and all the IPv4 (say) addresses were absent, Exim would try only for a IPv6
2937 connection, and never try an IPv4 address. When there was only IPv4
2938 connectivity, this was a disaster that did in practice occur.
2940 So, from release 4.61 onwards, we always search for A and AAAA records
2941 explicitly. The names shouldn't point to CNAMES, but we use the general lookup
2942 function that handles them, just in case. If any lookup gives a soft error,
2943 change the default yield.
2945 For these DNS lookups, we must disable qualify_single and search_parents;
2946 otherwise invalid host names obtained from MX or SRV records can cause trouble
2947 if they happen to match something local. */
2949 yield = HOST_FIND_FAILED; /* Default yield */
2950 dns_init(FALSE, FALSE, /* Disable qualify_single and search_parents */
2951 dnssec_request || dnssec_require);
2953 for (h = host; h != last->next; h = h->next)
2955 if (h->address != NULL) continue; /* Inserted by a multihomed host */
2956 rc = set_address_from_dns(h, &last, ignore_target_hosts, allow_mx_to_ip,
2957 NULL, dnssec_request, dnssec_require);
2958 if (rc != HOST_FOUND)
2960 h->status = hstatus_unusable;
2961 if (rc == HOST_FIND_AGAIN)
2964 h->why = hwhy_deferred;
2967 h->why = (rc == HOST_IGNORED)? hwhy_ignored : hwhy_failed;
2971 /* Scan the list for any hosts that are marked unusable because they have
2972 been explicitly ignored, and remove them from the list, as if they did not
2973 exist. If we end up with just a single, ignored host, flatten its fields as if
2974 nothing was found. */
2976 if (ignore_target_hosts != NULL)
2978 host_item *prev = NULL;
2979 for (h = host; h != last->next; h = h->next)
2982 if (h->why != hwhy_ignored) /* Non ignored host, just continue */
2984 else if (prev == NULL) /* First host is ignored */
2986 if (h != last) /* First is not last */
2988 if (h->next == last) last = h; /* Overwrite it with next */
2989 *h = *(h->next); /* and reprocess it. */
2990 goto REDO; /* C should have redo, like Perl */
2993 else /* Ignored host is not first - */
2995 prev->next = h->next;
2996 if (h == last) last = prev;
3000 if (host->why == hwhy_ignored) host->address = NULL;
3003 /* There is still one complication in the case of IPv6. Although the code above
3004 arranges that IPv6 addresses take precedence over IPv4 addresses for multihomed
3005 hosts, it doesn't do this for addresses that apply to different hosts with the
3006 same MX precedence, because the sorting on MX precedence happens first. So we
3007 have to make another pass to check for this case. We ensure that, within a
3008 single MX preference value, IPv6 addresses come first. This can separate the
3009 addresses of a multihomed host, but that should not matter. */
3012 if (h != last && !disable_ipv6)
3014 for (h = host; h != last; h = h->next)
3017 host_item *next = h->next;
3018 if (h->mx != next->mx || /* If next is different MX */
3019 h->address == NULL || /* OR this one is unset */
3020 Ustrchr(h->address, ':') != NULL || /* OR this one is IPv6 */
3021 (next->address != NULL &&
3022 Ustrchr(next->address, ':') == NULL)) /* OR next is IPv4 */
3023 continue; /* move on to next */
3024 temp = *h; /* otherwise, swap */
3025 temp.next = next->next;
3033 /* Remove any duplicate IP addresses and then scan the list of hosts for any
3034 whose IP addresses are on the local host. If any are found, all hosts with the
3035 same or higher MX values are removed. However, if the local host has the lowest
3036 numbered MX, then HOST_FOUND_LOCAL is returned. Otherwise, if at least one host
3037 with an IP address is on the list, HOST_FOUND is returned. Otherwise,
3038 HOST_FIND_FAILED is returned, but in this case do not update the yield, as it
3039 might have been set to HOST_FIND_AGAIN just above here. If not, it will already
3040 be HOST_FIND_FAILED. */
3042 host_remove_duplicates(host, &last);
3043 rc = host_scan_for_local_hosts(host, &last, removed);
3044 if (rc != HOST_FIND_FAILED) yield = rc;
3046 DEBUG(D_host_lookup)
3048 if (fully_qualified_name != NULL)
3049 debug_printf("fully qualified name = %s\n", *fully_qualified_name);
3050 debug_printf("host_find_bydns yield = %s (%d); returned hosts:\n",
3051 (yield == HOST_FOUND)? "HOST_FOUND" :
3052 (yield == HOST_FOUND_LOCAL)? "HOST_FOUND_LOCAL" :
3053 (yield == HOST_FIND_AGAIN)? "HOST_FIND_AGAIN" :
3054 (yield == HOST_FIND_FAILED)? "HOST_FIND_FAILED" : "?",
3056 for (h = host; h != last->next; h = h->next)
3058 debug_printf(" %s %s MX=%d ", h->name,
3059 (h->address == NULL)? US"<null>" : h->address, h->mx);
3060 if (h->port != PORT_NONE) debug_printf("port=%d ", h->port);
3061 if (h->status >= hstatus_unusable) debug_printf("*");
3068 dns_init(FALSE, FALSE, FALSE); /* clear the dnssec bit for getaddrbyname */
3075 /*************************************************
3076 **************************************************
3077 * Stand-alone test program *
3078 **************************************************
3079 *************************************************/
3083 int main(int argc, char **cargv)
3086 int whichrrs = HOST_FIND_BY_MX | HOST_FIND_BY_A;
3087 BOOL byname = FALSE;
3088 BOOL qualify_single = TRUE;
3089 BOOL search_parents = FALSE;
3090 BOOL request_dnssec = FALSE;
3091 BOOL require_dnssec = FALSE;
3092 uschar **argv = USS cargv;
3095 disable_ipv6 = FALSE;
3096 primary_hostname = US"";
3097 store_pool = POOL_MAIN;
3098 debug_selector = D_host_lookup|D_interface;
3099 debug_file = stdout;
3100 debug_fd = fileno(debug_file);
3102 printf("Exim stand-alone host functions test\n");
3104 host_find_interfaces();
3105 debug_selector = D_host_lookup | D_dns;
3107 if (argc > 1) primary_hostname = argv[1];
3109 /* So that debug level changes can be done first */
3111 dns_init(qualify_single, search_parents, FALSE);
3113 printf("Testing host lookup\n");
3115 while (Ufgets(buffer, 256, stdin) != NULL)
3118 int len = Ustrlen(buffer);
3119 uschar *fully_qualified_name;
3121 while (len > 0 && isspace(buffer[len-1])) len--;
3124 if (Ustrcmp(buffer, "q") == 0) break;
3126 if (Ustrcmp(buffer, "byname") == 0) byname = TRUE;
3127 else if (Ustrcmp(buffer, "no_byname") == 0) byname = FALSE;
3128 else if (Ustrcmp(buffer, "a_only") == 0) whichrrs = HOST_FIND_BY_A;
3129 else if (Ustrcmp(buffer, "mx_only") == 0) whichrrs = HOST_FIND_BY_MX;
3130 else if (Ustrcmp(buffer, "srv_only") == 0) whichrrs = HOST_FIND_BY_SRV;
3131 else if (Ustrcmp(buffer, "srv+a") == 0)
3132 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_A;
3133 else if (Ustrcmp(buffer, "srv+mx") == 0)
3134 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_MX;
3135 else if (Ustrcmp(buffer, "srv+mx+a") == 0)
3136 whichrrs = HOST_FIND_BY_SRV | HOST_FIND_BY_MX | HOST_FIND_BY_A;
3137 else if (Ustrcmp(buffer, "qualify_single") == 0) qualify_single = TRUE;
3138 else if (Ustrcmp(buffer, "no_qualify_single") == 0) qualify_single = FALSE;
3139 else if (Ustrcmp(buffer, "search_parents") == 0) search_parents = TRUE;
3140 else if (Ustrcmp(buffer, "no_search_parents") == 0) search_parents = FALSE;
3141 else if (Ustrcmp(buffer, "request_dnssec") == 0) request_dnssec = TRUE;
3142 else if (Ustrcmp(buffer, "no_request_dnssec") == 0) request_dnssec = FALSE;
3143 else if (Ustrcmp(buffer, "require_dnssec") == 0) require_dnssec = TRUE;
3144 else if (Ustrcmp(buffer, "no_reqiret_dnssec") == 0) require_dnssec = FALSE;
3145 else if (Ustrcmp(buffer, "test_harness") == 0)
3146 running_in_test_harness = !running_in_test_harness;
3147 else if (Ustrcmp(buffer, "ipv6") == 0) disable_ipv6 = !disable_ipv6;
3148 else if (Ustrcmp(buffer, "res_debug") == 0)
3150 _res.options ^= RES_DEBUG;
3152 else if (Ustrncmp(buffer, "retrans", 7) == 0)
3154 (void)sscanf(CS(buffer+8), "%d", &dns_retrans);
3155 _res.retrans = dns_retrans;
3157 else if (Ustrncmp(buffer, "retry", 5) == 0)
3159 (void)sscanf(CS(buffer+6), "%d", &dns_retry);
3160 _res.retry = dns_retry;
3164 int flags = whichrrs;
3170 h.status = hstatus_unknown;
3171 h.why = hwhy_unknown;
3174 if (qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
3175 if (search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
3178 ? host_find_byname(&h, NULL, flags, &fully_qualified_name, TRUE)
3179 : host_find_bydns(&h, NULL, flags, US"smtp", NULL, NULL,
3180 request_dnssec ? &h.name : NULL,
3181 require_dnssec ? &h.name : NULL,
3182 &fully_qualified_name, NULL);
3184 if (rc == HOST_FIND_FAILED) printf("Failed\n");
3185 else if (rc == HOST_FIND_AGAIN) printf("Again\n");
3186 else if (rc == HOST_FOUND_LOCAL) printf("Local\n");
3192 printf("Testing host_aton\n");
3194 while (Ufgets(buffer, 256, stdin) != NULL)
3198 int len = Ustrlen(buffer);
3200 while (len > 0 && isspace(buffer[len-1])) len--;
3203 if (Ustrcmp(buffer, "q") == 0) break;
3205 len = host_aton(buffer, x);
3206 printf("length = %d ", len);
3207 for (i = 0; i < len; i++)
3209 printf("%04x ", (x[i] >> 16) & 0xffff);
3210 printf("%04x ", x[i] & 0xffff);
3217 printf("Testing host_name_lookup\n");
3219 while (Ufgets(buffer, 256, stdin) != NULL)
3221 int len = Ustrlen(buffer);
3222 while (len > 0 && isspace(buffer[len-1])) len--;
3224 if (Ustrcmp(buffer, "q") == 0) break;
3225 sender_host_address = buffer;
3226 sender_host_name = NULL;
3227 sender_host_aliases = NULL;
3228 host_lookup_msg = US"";
3229 host_lookup_failed = FALSE;
3230 if (host_name_lookup() == FAIL) /* Debug causes printing */
3231 printf("Lookup failed:%s\n", host_lookup_msg);
3239 #endif /* STAND_ALONE */