1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
8
9 #include "../exim.h"
10 #include "lf_functions.h"
11
12
13
14 /* Ancient systems (e.g. SunOS4) don't appear to have T_TXT defined in their
15 header files. */
16
17 #ifndef T_TXT
18 # define T_TXT 16
19 #endif
20
21 /* Many systems do not have T_SPF. */
22 #ifndef T_SPF
23 # define T_SPF 99
24 #endif
25
26 /* New TLSA record for DANE */
27 #ifndef T_TLSA
28 # define T_TLSA 52
29 #endif
30
31 /* Table of recognized DNS record types and their integer values. */
32
33 static const char *type_names[] = {
34 "a",
35 #if HAVE_IPV6
36 "a+",
37 "aaaa",
38 #endif
39 "cname",
40 "csa",
41 "mx",
42 "mxh",
43 "ns",
44 "ptr",
45 "soa",
46 "spf",
47 "srv",
48 "tlsa",
49 "txt",
50 "zns"
51 };
52
53 static int type_values[] = {
54 T_A,
55 #if HAVE_IPV6
56 T_ADDRESSES, /* Private type for AAAA + A */
57 T_AAAA,
58 #endif
59 T_CNAME,
60 T_CSA, /* Private type for "Client SMTP Authorization". */
61 T_MX,
62 T_MXH, /* Private type for "MX hostnames" */
63 T_NS,
64 T_PTR,
65 T_SOA,
66 T_SPF,
67 T_SRV,
68 T_TLSA,
69 T_TXT,
70 T_ZNS /* Private type for "zone nameservers" */
71 };
72
73
74 /*************************************************
75 * Open entry point *
76 *************************************************/
77
78 /* See local README for interface description. */
79
80 static void *
dnsdb_open(const uschar * filename,uschar ** errmsg)81 dnsdb_open(const uschar * filename, uschar **errmsg)
82 {
83 return (void *)(-1); /* Any non-0 value */
84 }
85
86
87
88 /*************************************************
89 * Find entry point for dnsdb *
90 *************************************************/
91
92 /* See local README for interface description. The query in the "keystring" may
93 consist of a number of parts.
94
95 (a) If the first significant character is '>' then the next character is the
96 separator character that is used when multiple records are found. The default
97 separator is newline.
98
99 (b) If the next character is ',' then the next character is the separator
100 character used for multiple items of text in "TXT" records. Alternatively,
101 if the next character is ';' then these multiple items are concatenated with
102 no separator. With neither of these options specified, only the first item
103 is output. Similarly for "SPF" records, but the default for joining multiple
104 items in one SPF record is the empty string, for direct concatenation.
105
106 (c) Options, all comma-terminated, in any order. Any unrecognised option
107 terminates option processing. Recognised options are:
108
109 - 'defer_FOO': set the defer behaviour to FOO. The possible behaviours are:
110 'strict', where any defer causes the whole lookup to defer; 'lax', where a defer
111 causes the whole lookup to defer only if none of the DNS queries succeeds; and
112 'never', where all defers are as if the lookup failed. The default is 'lax'.
113
114 - 'dnssec_FOO', with 'strict', 'lax' (default), and 'never'. The meanings are
115 require, try and don't-try dnssec respectively.
116
117 - 'retrans_VAL', set the timeout value. VAL is an Exim time specification
118 (eg "5s"). The default is set by the main configuration option 'dns_retrans'.
119
120 - 'retry_VAL', set the retry count on timeouts. VAL is an integer. The
121 default is set by the main configuration option "dns_retry".
122
123 (d) If the next sequence of characters is a sequence of letters and digits
124 followed by '=', it is interpreted as the name of the DNS record type. The
125 default is "TXT".
126
127 (e) Then there follows list of domain names. This is a generalized Exim list,
128 which may start with '<' in order to set a specific separator. The default
129 separator, as always, is colon. */
130
131 static int
dnsdb_find(void * handle,const uschar * filename,const uschar * keystring,int length,uschar ** result,uschar ** errmsg,uint * do_cache,const uschar * opts)132 dnsdb_find(void * handle, const uschar * filename, const uschar * keystring,
133 int length, uschar ** result, uschar ** errmsg, uint * do_cache,
134 const uschar * opts)
135 {
136 int rc;
137 int sep = 0;
138 int defer_mode = PASS;
139 int dnssec_mode = PASS;
140 int save_retrans = dns_retrans;
141 int save_retry = dns_retry;
142 int type;
143 int failrc = FAIL;
144 const uschar *outsep = CUS"\n";
145 const uschar *outsep2 = NULL;
146 uschar *equals, *domain, *found;
147
148 dns_answer * dnsa = store_get_dns_answer();
149 dns_scan dnss;
150
151 /* Because we're working in the search pool, we try to reclaim as much
152 store as possible later, so we preallocate the result here */
153
154 gstring * yield = string_get(256);
155
156 /* If the string starts with '>' we change the output separator.
157 If it's followed by ';' or ',' we set the TXT output separator. */
158
159 while (isspace(*keystring)) keystring++;
160 if (*keystring == '>')
161 {
162 outsep = keystring + 1;
163 keystring += 2;
164 if (*keystring == ',')
165 {
166 outsep2 = keystring + 1;
167 keystring += 2;
168 }
169 else if (*keystring == ';')
170 {
171 outsep2 = US"";
172 keystring++;
173 }
174 while (isspace(*keystring)) keystring++;
175 }
176
177 /* Check for a modifier keyword. */
178
179 for (;;)
180 {
181 if (strncmpic(keystring, US"defer_", 6) == 0)
182 {
183 keystring += 6;
184 if (strncmpic(keystring, US"strict", 6) == 0)
185 { defer_mode = DEFER; keystring += 6; }
186 else if (strncmpic(keystring, US"lax", 3) == 0)
187 { defer_mode = PASS; keystring += 3; }
188 else if (strncmpic(keystring, US"never", 5) == 0)
189 { defer_mode = OK; keystring += 5; }
190 else
191 {
192 *errmsg = US"unsupported dnsdb defer behaviour";
193 rc = DEFER;
194 goto out;
195 }
196 }
197 else if (strncmpic(keystring, US"dnssec_", 7) == 0)
198 {
199 keystring += 7;
200 if (strncmpic(keystring, US"strict", 6) == 0)
201 { dnssec_mode = DEFER; keystring += 6; }
202 else if (strncmpic(keystring, US"lax", 3) == 0)
203 { dnssec_mode = PASS; keystring += 3; }
204 else if (strncmpic(keystring, US"never", 5) == 0)
205 { dnssec_mode = OK; keystring += 5; }
206 else
207 {
208 *errmsg = US"unsupported dnsdb dnssec behaviour";
209 rc = DEFER;
210 goto out;
211 }
212 }
213 else if (strncmpic(keystring, US"retrans_", 8) == 0)
214 {
215 int timeout_sec;
216 if ((timeout_sec = readconf_readtime(keystring += 8, ',', FALSE)) <= 0)
217 {
218 *errmsg = US"unsupported dnsdb timeout value";
219 rc = DEFER;
220 goto out;
221 }
222 dns_retrans = timeout_sec;
223 while (*keystring != ',') keystring++;
224 }
225 else if (strncmpic(keystring, US"retry_", 6) == 0)
226 {
227 int retries;
228 if ((retries = (int)strtol(CCS keystring + 6, CSS &keystring, 0)) < 0)
229 {
230 *errmsg = US"unsupported dnsdb retry count";
231 rc = DEFER;
232 goto out;
233 }
234 dns_retry = retries;
235 }
236 else
237 break;
238
239 while (isspace(*keystring)) keystring++;
240 if (*keystring++ != ',')
241 {
242 *errmsg = US"dnsdb modifier syntax error";
243 rc = DEFER;
244 goto out;
245 }
246 while (isspace(*keystring)) keystring++;
247 }
248
249 /* Figure out the "type" value if it is not T_TXT.
250 If the keystring contains an = this must be preceded by a valid type name. */
251
252 type = T_TXT;
253 if ((equals = Ustrchr(keystring, '=')) != NULL)
254 {
255 int i, len;
256 uschar *tend = equals;
257
258 while (tend > keystring && isspace(tend[-1])) tend--;
259 len = tend - keystring;
260
261 for (i = 0; i < nelem(type_names); i++)
262 if (len == Ustrlen(type_names[i]) &&
263 strncmpic(keystring, US type_names[i], len) == 0)
264 {
265 type = type_values[i];
266 break;
267 }
268
269 if (i >= nelem(type_names))
270 {
271 *errmsg = US"unsupported DNS record type";
272 rc = DEFER;
273 goto out;
274 }
275
276 keystring = equals + 1;
277 while (isspace(*keystring)) keystring++;
278 }
279
280 /* Initialize the resolver in case this is the first time it has been used. */
281
282 dns_init(FALSE, FALSE, dnssec_mode != OK);
283
284 /* The remainder of the string must be a list of domains. As long as the lookup
285 for at least one of them succeeds, we return success. Failure means that none
286 of them were found.
287
288 The original implementation did not support a list of domains. Adding the list
289 feature is compatible, except in one case: when PTR records are being looked up
290 for a single IPv6 address. Fortunately, we can hack in a compatibility feature
291 here: If the type is PTR and no list separator is specified, and the entire
292 remaining string is valid as an IP address, set an impossible separator so that
293 it is treated as one item. */
294
295 if (type == T_PTR && keystring[0] != '<' &&
296 string_is_ip_address(keystring, NULL) != 0)
297 sep = -1;
298
299 /* SPF strings should be concatenated without a separator, thus make
300 it the default if not defined (see RFC 4408 section 3.1.3).
301 Multiple SPF records are forbidden (section 3.1.2) but are currently
302 not handled specially, thus they are concatenated with \n by default.
303 MX priority and value are space-separated by default.
304 SRV and TLSA record parts are space-separated by default. */
305
306 if (!outsep2) switch(type)
307 {
308 case T_SPF: outsep2 = US""; break;
309 case T_SRV: case T_MX: case T_TLSA: outsep2 = US" "; break;
310 }
311
312 /* Now scan the list and do a lookup for each item */
313
314 while ((domain = string_nextinlist(&keystring, &sep, NULL, 0)))
315 {
316 int searchtype = type == T_CSA ? T_SRV : /* record type we want */
317 type == T_MXH ? T_MX :
318 type == T_ZNS ? T_NS : type;
319
320 /* If the type is PTR or CSA, we have to construct the relevant magic lookup
321 key if the original is an IP address (some experimental protocols are using
322 PTR records for different purposes where the key string is a host name, and
323 Exim's extended CSA can be keyed by domains or IP addresses). This code for
324 doing the reversal is now in a separate function. */
325
326 if ((type == T_PTR || type == T_CSA) &&
327 string_is_ip_address(domain, NULL) != 0)
328 domain = dns_build_reverse(domain);
329
330 do
331 {
332 DEBUG(D_lookup) debug_printf_indent("dnsdb key: %s\n", domain);
333
334 /* Do the lookup and sort out the result. There are four special types that
335 are handled specially: T_CSA, T_ZNS, T_ADDRESSES and T_MXH.
336 The first two are handled in a special lookup function so that the facility
337 could be used from other parts of the Exim code. T_ADDRESSES is handled by looping
338 over the types of A lookup. T_MXH affects only what happens later on in
339 this function, but for tidiness it is handled by the "special". If the
340 lookup fails, continue with the next domain. In the case of DEFER, adjust
341 the final "nothing found" result, but carry on to the next domain. */
342
343 found = domain;
344 #if HAVE_IPV6
345 if (type == T_ADDRESSES) /* NB cannot happen unless HAVE_IPV6 */
346 {
347 if (searchtype == T_ADDRESSES) searchtype = T_AAAA;
348 else if (searchtype == T_AAAA) searchtype = T_A;
349 rc = dns_special_lookup(dnsa, domain, searchtype, CUSS &found);
350 }
351 else
352 #endif
353 rc = dns_special_lookup(dnsa, domain, type, CUSS &found);
354
355 lookup_dnssec_authenticated = dnssec_mode==OK ? NULL
356 : dns_is_secure(dnsa) ? US"yes" : US"no";
357
358 if (rc == DNS_NOMATCH || rc == DNS_NODATA) continue;
359 if ( rc != DNS_SUCCEED
360 || (dnssec_mode == DEFER && !dns_is_secure(dnsa))
361 )
362 {
363 if (defer_mode == DEFER)
364 {
365 dns_retrans = save_retrans;
366 dns_retry = save_retry;
367 dns_init(FALSE, FALSE, FALSE); /* clr dnssec bit */
368 rc = DEFER; /* always defer */
369 goto out;
370 }
371 if (defer_mode == PASS) failrc = DEFER; /* defer only if all do */
372 continue; /* treat defer as fail */
373 }
374
375
376 /* Search the returned records */
377
378 for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr;
379 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == searchtype)
380 {
381 if (*do_cache > rr->ttl)
382 *do_cache = rr->ttl;
383
384 if (type == T_A || type == T_AAAA || type == T_ADDRESSES)
385 {
386 for (dns_address * da = dns_address_from_rr(dnsa, rr); da; da = da->next)
387 {
388 if (yield->ptr) yield = string_catn(yield, outsep, 1);
389 yield = string_cat(yield, da->address);
390 }
391 continue;
392 }
393
394 /* Other kinds of record just have one piece of data each, but there may be
395 several of them, of course. */
396
397 if (yield->ptr) yield = string_catn(yield, outsep, 1);
398
399 if (type == T_TXT || type == T_SPF)
400 {
401 if (outsep2 == NULL) /* output only the first item of data */
402 yield = string_catn(yield, US (rr->data+1), (rr->data)[0]);
403 else
404 {
405 /* output all items */
406 int data_offset = 0;
407 while (data_offset < rr->size)
408 {
409 uschar chunk_len = (rr->data)[data_offset++];
410 if (outsep2[0] != '\0' && data_offset != 1)
411 yield = string_catn(yield, outsep2, 1);
412 yield = string_catn(yield, US ((rr->data)+data_offset), chunk_len);
413 data_offset += chunk_len;
414 }
415 }
416 }
417 else if (type == T_TLSA)
418 {
419 uint8_t usage, selector, matching_type;
420 uint16_t payload_length;
421 uschar s[MAX_TLSA_EXPANDED_SIZE];
422 uschar * sp = s;
423 uschar * p = US rr->data;
424
425 usage = *p++;
426 selector = *p++;
427 matching_type = *p++;
428 /* What's left after removing the first 3 bytes above */
429 payload_length = rr->size - 3;
430 sp += sprintf(CS s, "%d%c%d%c%d%c", usage, *outsep2,
431 selector, *outsep2, matching_type, *outsep2);
432 /* Now append the cert/identifier, one hex char at a time */
433 while (payload_length-- > 0 && sp-s < (MAX_TLSA_EXPANDED_SIZE - 4))
434 sp += sprintf(CS sp, "%02x", *p++);
435
436 yield = string_cat(yield, s);
437 }
438 else /* T_CNAME, T_CSA, T_MX, T_MXH, T_NS, T_PTR, T_SOA, T_SRV */
439 {
440 int priority, weight, port;
441 uschar s[264];
442 uschar * p = US rr->data;
443
444 switch (type)
445 {
446 case T_MXH:
447 /* mxh ignores the priority number and includes only the hostnames */
448 GETSHORT(priority, p);
449 break;
450
451 case T_MX:
452 GETSHORT(priority, p);
453 sprintf(CS s, "%d%c", priority, *outsep2);
454 yield = string_cat(yield, s);
455 break;
456
457 case T_SRV:
458 GETSHORT(priority, p);
459 GETSHORT(weight, p);
460 GETSHORT(port, p);
461 sprintf(CS s, "%d%c%d%c%d%c", priority, *outsep2,
462 weight, *outsep2, port, *outsep2);
463 yield = string_cat(yield, s);
464 break;
465
466 case T_CSA:
467 /* See acl_verify_csa() for more comments about CSA. */
468 GETSHORT(priority, p);
469 GETSHORT(weight, p);
470 GETSHORT(port, p);
471
472 if (priority != 1) continue; /* CSA version must be 1 */
473
474 /* If the CSA record we found is not the one we asked for, analyse
475 the subdomain assertions in the port field, else analyse the direct
476 authorization status in the weight field. */
477
478 if (Ustrcmp(found, domain) != 0)
479 {
480 if (port & 1) *s = 'X'; /* explicit authorization required */
481 else *s = '?'; /* no subdomain assertions here */
482 }
483 else
484 {
485 if (weight < 2) *s = 'N'; /* not authorized */
486 else if (weight == 2) *s = 'Y'; /* authorized */
487 else if (weight == 3) *s = '?'; /* unauthorizable */
488 else continue; /* invalid */
489 }
490
491 s[1] = ' ';
492 yield = string_catn(yield, s, 2);
493 break;
494
495 default:
496 break;
497 }
498
499 /* GETSHORT() has advanced the pointer to the target domain. */
500
501 rc = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, p,
502 (DN_EXPAND_ARG4_TYPE)s, sizeof(s));
503
504 /* If an overlong response was received, the data will have been
505 truncated and dn_expand may fail. */
506
507 if (rc < 0)
508 {
509 log_write(0, LOG_MAIN, "host name alias list truncated: type=%s "
510 "domain=%s", dns_text_type(type), domain);
511 break;
512 }
513 else yield = string_cat(yield, s);
514
515 if (type == T_SOA && outsep2 != NULL)
516 {
517 unsigned long serial, refresh, retry, expire, minimum;
518
519 p += rc;
520 yield = string_catn(yield, outsep2, 1);
521
522 rc = dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, p,
523 (DN_EXPAND_ARG4_TYPE)s, sizeof(s));
524 if (rc < 0)
525 {
526 log_write(0, LOG_MAIN, "responsible-mailbox truncated: type=%s "
527 "domain=%s", dns_text_type(type), domain);
528 break;
529 }
530 else yield = string_cat(yield, s);
531
532 p += rc;
533 GETLONG(serial, p); GETLONG(refresh, p);
534 GETLONG(retry, p); GETLONG(expire, p); GETLONG(minimum, p);
535 sprintf(CS s, "%c%lu%c%lu%c%lu%c%lu%c%lu",
536 *outsep2, serial, *outsep2, refresh,
537 *outsep2, retry, *outsep2, expire, *outsep2, minimum);
538 yield = string_cat(yield, s);
539 }
540 }
541 } /* Loop for list of returned records */
542
543 /* Loop for set of A-lookup types */
544 } while (type == T_ADDRESSES && searchtype != T_A);
545
546 } /* Loop for list of domains */
547
548 /* Reclaim unused memory */
549
550 gstring_release_unused(yield);
551
552 /* If yield NULL we have not found anything. Otherwise, insert the terminating
553 zero and return the result. */
554
555 dns_retrans = save_retrans;
556 dns_retry = save_retry;
557 dns_init(FALSE, FALSE, FALSE); /* clear the dnssec bit for getaddrbyname */
558
559 if (!yield || !yield->ptr)
560 rc = failrc;
561 else
562 {
563 *result = string_from_gstring(yield);
564 rc = OK;
565 }
566
567 out:
568
569 store_free_dns_answer(dnsa);
570 return rc;
571 }
572
573
574
575 /*************************************************
576 * Version reporting entry point *
577 *************************************************/
578
579 /* See local README for interface description. */
580
581 #include "../version.h"
582
583 void
dnsdb_version_report(FILE * f)584 dnsdb_version_report(FILE *f)
585 {
586 #ifdef DYNLOOKUP
587 fprintf(f, "Library version: DNSDB: Exim version %s\n", EXIM_VERSION_STR);
588 #endif
589 }
590
591
592 static lookup_info _lookup_info = {
593 .name = US"dnsdb", /* lookup name */
594 .type = lookup_querystyle, /* query style */
595 .open = dnsdb_open, /* open function */
596 .check = NULL, /* check function */
597 .find = dnsdb_find, /* find function */
598 .close = NULL, /* no close function */
599 .tidy = NULL, /* no tidy function */
600 .quote = NULL, /* no quoting function */
601 .version_report = dnsdb_version_report /* version reporting */
602 };
603
604 #ifdef DYNLOOKUP
605 #define dnsdb_lookup_module_info _lookup_module_info
606 #endif
607
608 static lookup_info *_lookup_list[] = { &_lookup_info };
609 lookup_module_info dnsdb_lookup_module_info = { LOOKUP_MODULE_INFO_MAGIC, _lookup_list, 1 };
610
611 /* vi: aw ai sw=2
612 */
613 /* End of lookups/dnsdb.c */
614