#include <sys_defs.h>
#include <netdb.h>
#include <string.h>
#include <ctype.h>
#include <mymalloc.h>
#include <vstring.h>
#include <msg.h>
#include <valid_hostname.h>
#include <stringops.h>
#include <mail_params.h>
#define LIBDNS_INTERNAL
#include "dns.h"
#define DEF_DNS_REPLY_SIZE 4096
#define MAX_DNS_REPLY_SIZE 65536
#define MAX_DNS_QUERY_SIZE 2048
typedef struct DNS_REPLY {
unsigned char *buf;
size_t buf_len;
int rcode;
int dnssec_ad;
int query_count;
int answer_count;
int auth_count;
unsigned char *query_start;
unsigned char *answer_start;
unsigned char *end;
} DNS_REPLY;
#define TEST_HAVE_DNS_REPLY_PACKET(r) ((r)->end > (r)->buf)
#define SET_HAVE_DNS_REPLY_PACKET(r, l) ((r)->end = (r)->buf + (l))
#define SET_NO_DNS_REPLY_PACKET(r) ((r)->end = (r)->buf)
#define INET_ADDR_LEN 4
#define INET6_ADDR_LEN 16
static int dns_res_query(const char *name, int class, int type,
unsigned char *answer, int anslen)
{
unsigned char msg_buf[MAX_DNS_QUERY_SIZE];
HEADER *reply_header = (HEADER *) answer;
int len;
reply_header->rcode = NOERROR;
#define NO_MKQUERY_DATA_BUF ((unsigned char *) 0)
#define NO_MKQUERY_DATA_LEN ((int) 0)
#define NO_MKQUERY_NEWRR ((unsigned char *) 0)
if ((len = res_mkquery(QUERY, name, class, type, NO_MKQUERY_DATA_BUF,
NO_MKQUERY_DATA_LEN, NO_MKQUERY_NEWRR,
msg_buf, sizeof(msg_buf))) < 0) {
SET_H_ERRNO(NO_RECOVERY);
if (msg_verbose)
msg_info("res_mkquery() failed");
return (len);
} else if ((len = res_send(msg_buf, len, answer, anslen)) < 0) {
SET_H_ERRNO(TRY_AGAIN);
if (msg_verbose)
msg_info("res_send() failed");
return (len);
} else {
switch (reply_header->rcode) {
case NXDOMAIN:
SET_H_ERRNO(HOST_NOT_FOUND);
break;
case NOERROR:
if (reply_header->ancount != 0)
SET_H_ERRNO(0);
else
SET_H_ERRNO(NO_DATA);
break;
case SERVFAIL:
SET_H_ERRNO(TRY_AGAIN);
break;
default:
SET_H_ERRNO(NO_RECOVERY);
break;
}
return (len);
}
}
static int dns_res_search(const char *name, int class, int type,
unsigned char *answer, int anslen, int keep_notfound)
{
int len;
#define NOT_FOUND_H_ERRNO(he) ((he) == HOST_NOT_FOUND || (he) == NO_DATA)
if (keep_notfound)
memset(answer, 0, anslen);
len = res_query(name, class, type, answer, anslen);
if (len > 0) {
SET_H_ERRNO(0);
} else if (keep_notfound && NOT_FOUND_H_ERRNO(h_errno)) {
len = anslen;
}
return (len);
}
static int dns_query(const char *name, int type, unsigned flags,
DNS_REPLY *reply, VSTRING *why, unsigned lflags)
{
HEADER *reply_header;
int len;
unsigned long saved_options;
int keep_notfound = (lflags & DNS_REQ_FLAG_NCACHE_TTL);
if (reply->buf == 0) {
reply->buf = (unsigned char *) mymalloc(DEF_DNS_REPLY_SIZE);
reply->buf_len = DEF_DNS_REPLY_SIZE;
}
if ((_res.options & RES_INIT) == 0 && res_init() < 0) {
if (why)
vstring_strcpy(why, "Name service initialization failure");
return (DNS_FAIL);
}
#define USER_FLAGS (RES_DEBUG | RES_DNSRCH | RES_DEFNAMES | RES_USE_DNSSEC)
if ((flags & USER_FLAGS) != flags)
msg_panic("dns_query: bad flags: %d", flags);
#define XTRA_FLAGS (RES_USE_EDNS0)
if (flags & RES_USE_DNSSEC)
flags |= RES_USE_EDNS0;
#define SAVE_FLAGS (USER_FLAGS | XTRA_FLAGS)
saved_options = (_res.options & SAVE_FLAGS);
for (;;) {
_res.options &= ~saved_options;
_res.options |= flags;
if (keep_notfound && var_dns_ncache_ttl_fix) {
len = dns_res_query((char *) name, C_IN, type, reply->buf,
reply->buf_len);
} else {
len = dns_res_search((char *) name, C_IN, type, reply->buf,
reply->buf_len, keep_notfound);
}
_res.options &= ~flags;
_res.options |= saved_options;
reply_header = (HEADER *) reply->buf;
reply->rcode = reply_header->rcode;
if (h_errno != 0) {
if (why)
vstring_sprintf(why, "Host or domain name not found. "
"Name service error for name=%s type=%s: %s",
name, dns_strtype(type), dns_strerror(h_errno));
if (msg_verbose)
msg_info("dns_query: %s (%s): %s",
name, dns_strtype(type), dns_strerror(h_errno));
switch (h_errno) {
case NO_RECOVERY:
return (DNS_FAIL);
case HOST_NOT_FOUND:
case NO_DATA:
if (keep_notfound)
break;
SET_NO_DNS_REPLY_PACKET(reply);
return (DNS_NOTFOUND);
default:
return (DNS_RETRY);
}
} else {
if (msg_verbose)
msg_info("dns_query: %s (%s): OK", name, dns_strtype(type));
}
if (reply_header->tc == 0 || reply->buf_len >= MAX_DNS_REPLY_SIZE)
break;
reply->buf = (unsigned char *)
myrealloc((void *) reply->buf, 2 * reply->buf_len);
reply->buf_len *= 2;
}
if (len < 0)
msg_panic("dns_query: bad length %d (h_errno=%s)",
len, dns_strerror(h_errno));
if (len > reply->buf_len) {
msg_warn("reply length %d > buffer length %d for name=%s type=%s",
len, (int) reply->buf_len, name, dns_strtype(type));
len = reply->buf_len;
}
#if RES_USE_DNSSEC != 0
reply->dnssec_ad = (flags & RES_USE_DNSSEC) ? !!reply_header->ad : 0;
#else
reply->dnssec_ad = 0;
#endif
SET_HAVE_DNS_REPLY_PACKET(reply, len);
reply->query_start = reply->buf + sizeof(HEADER);
reply->answer_start = 0;
reply->query_count = ntohs(reply_header->qdcount);
reply->answer_count = ntohs(reply_header->ancount);
reply->auth_count = ntohs(reply_header->nscount);
if (msg_verbose > 1)
msg_info("dns_query: reply len=%d ancount=%d nscount=%d",
len, reply->answer_count, reply->auth_count);
if (h_errno == 0) {
return (DNS_OK);
} else if (keep_notfound) {
return (DNS_NOTFOUND);
} else {
msg_panic("dns_query: unexpected reply status: %s",
dns_strerror(h_errno));
}
}
static int dns_skip_query(DNS_REPLY *reply)
{
int query_count = reply->query_count;
unsigned char *pos = reply->query_start;
int len;
while (query_count-- > 0) {
if (pos >= reply->end)
return DNS_RETRY;
len = dn_skipname(pos, reply->end);
if (len < 0)
return (DNS_RETRY);
pos += len + QFIXEDSZ;
}
reply->answer_start = pos;
return (DNS_OK);
}
static int dns_get_fixed(unsigned char *pos, DNS_FIXED *fixed)
{
GETSHORT(fixed->type, pos);
GETSHORT(fixed->class, pos);
GETLONG(fixed->ttl, pos);
GETSHORT(fixed->length, pos);
if (fixed->class != C_IN) {
msg_warn("dns_get_fixed: bad class: %u", fixed->class);
return (DNS_RETRY);
}
return (DNS_OK);
}
static int valid_rr_name(const char *name, const char *location,
unsigned type, DNS_REPLY *reply)
{
char temp[DNS_NAME_LEN];
char *query_name;
int len;
char *gripe;
int result;
#define PASS_NAME 1
#define REJECT_NAME 0
if (valid_hostaddr(name, DONT_GRIPE)) {
result = PASS_NAME;
gripe = "numeric domain name";
} else if (!valid_hostname(name, DO_GRIPE)) {
result = REJECT_NAME;
gripe = "malformed domain name";
} else {
result = PASS_NAME;
gripe = 0;
}
if (gripe) {
len = dn_expand(reply->buf, reply->end, reply->query_start,
temp, DNS_NAME_LEN);
query_name = (len < 0 ? "*unparsable*" : temp);
msg_warn("%s in %s of %s record for %s: %.100s",
gripe, location, dns_strtype(type), query_name, name);
}
return (result);
}
static int dns_get_rr(DNS_RR **list, const char *orig_name, DNS_REPLY *reply,
unsigned char *pos, char *rr_name,
DNS_FIXED *fixed)
{
char temp[DNS_NAME_LEN];
char *tempbuf = temp;
UINT32_TYPE soa_buf[5];
int comp_len;
ssize_t data_len;
unsigned pref = 0;
unsigned char *src;
unsigned char *dst;
int ch;
#define MIN2(a, b) ((unsigned)(a) < (unsigned)(b) ? (a) : (b))
*list = 0;
switch (fixed->type) {
default:
msg_panic("dns_get_rr: don't know how to extract resource type %s",
dns_strtype(fixed->type));
case T_CNAME:
case T_DNAME:
case T_MB:
case T_MG:
case T_MR:
case T_NS:
case T_PTR:
if (dn_expand(reply->buf, reply->end, pos, temp, sizeof(temp)) < 0)
return (DNS_RETRY);
if (!valid_rr_name(temp, "resource data", fixed->type, reply))
return (DNS_INVAL);
data_len = strlen(temp) + 1;
break;
case T_MX:
GETSHORT(pref, pos);
if (dn_expand(reply->buf, reply->end, pos, temp, sizeof(temp)) < 0)
return (DNS_RETRY);
if (*temp == 0)
return (DNS_NULLMX);
if (!valid_rr_name(temp, "resource data", fixed->type, reply))
return (DNS_INVAL);
data_len = strlen(temp) + 1;
break;
case T_A:
if (fixed->length != INET_ADDR_LEN) {
msg_warn("extract_answer: bad address length: %d", fixed->length);
return (DNS_RETRY);
}
if (fixed->length > sizeof(temp))
msg_panic("dns_get_rr: length %d > DNS_NAME_LEN",
fixed->length);
memcpy(temp, pos, fixed->length);
data_len = fixed->length;
break;
#ifdef T_AAAA
case T_AAAA:
if (fixed->length != INET6_ADDR_LEN) {
msg_warn("extract_answer: bad address length: %d", fixed->length);
return (DNS_RETRY);
}
if (fixed->length > sizeof(temp))
msg_panic("dns_get_rr: length %d > DNS_NAME_LEN",
fixed->length);
memcpy(temp, pos, fixed->length);
data_len = fixed->length;
break;
#endif
case T_TXT:
data_len = MIN2(pos[0] + 1, MIN2(fixed->length + 1, sizeof(temp)));
for (src = pos + 1, dst = (unsigned char *) (temp);
dst < (unsigned char *) (temp) + data_len - 1; ) {
ch = *src++;
*dst++ = (ISPRINT(ch) ? ch : ' ');
}
*dst = 0;
break;
case T_TLSA:
data_len = fixed->length;
tempbuf = (char *) pos;
break;
case T_SOA:
comp_len = dn_skipname(pos, reply->end);
if (comp_len < 0)
return (DNS_RETRY);
pos += comp_len;
comp_len = dn_skipname(pos, reply->end);
if (comp_len < 0)
return (DNS_RETRY);
pos += comp_len;
if (reply->end - pos < sizeof(soa_buf)) {
msg_warn("extract_answer: bad SOA length: %d", fixed->length);
return (DNS_RETRY);
}
GETLONG(soa_buf[0], pos);
GETLONG(soa_buf[1], pos);
GETLONG(soa_buf[2], pos);
GETLONG(soa_buf[3], pos);
GETLONG(soa_buf[4], pos);
tempbuf = (char *) soa_buf;
data_len = sizeof(soa_buf);
break;
}
*list = dns_rr_create(orig_name, rr_name, fixed->type, fixed->class,
fixed->ttl, pref, tempbuf, data_len);
return (DNS_OK);
}
static int dns_get_alias(DNS_REPLY *reply, unsigned char *pos,
DNS_FIXED *fixed, char *cname, int c_len)
{
if (fixed->type != T_CNAME)
msg_panic("dns_get_alias: bad type %s", dns_strtype(fixed->type));
if (dn_expand(reply->buf, reply->end, pos, cname, c_len) < 0)
return (DNS_RETRY);
if (!valid_rr_name(cname, "resource data", fixed->type, reply))
return (DNS_INVAL);
return (DNS_OK);
}
static int dns_get_answer(const char *orig_name, DNS_REPLY *reply, int type,
DNS_RR **rrlist, VSTRING *fqdn, char *cname, int c_len,
int *maybe_secure)
{
char rr_name[DNS_NAME_LEN];
unsigned char *pos;
int answer_count = reply->answer_count;
int len;
DNS_FIXED fixed;
DNS_RR *rr;
int resource_found = 0;
int cname_found = 0;
int not_found_status = DNS_NOTFOUND;
int status;
if (reply->answer_start == 0)
if ((status = dns_skip_query(reply)) < 0)
return (status);
pos = reply->answer_start;
#define CORRUPT(status) { \
if (rrlist && *rrlist) { \
dns_rr_free(*rrlist); \
*rrlist = 0; \
} \
return (status); \
}
while (answer_count-- > 0) {
if (pos >= reply->end)
CORRUPT(DNS_RETRY);
len = dn_expand(reply->buf, reply->end, pos, rr_name, DNS_NAME_LEN);
if (len < 0)
CORRUPT(DNS_RETRY);
pos += len;
if (pos + RRFIXEDSZ > reply->end)
CORRUPT(DNS_RETRY);
if ((status = dns_get_fixed(pos, &fixed)) != DNS_OK)
CORRUPT(status);
if (!valid_rr_name(rr_name, "resource name", fixed.type, reply))
CORRUPT(DNS_INVAL);
if (fqdn)
vstring_strcpy(fqdn, rr_name);
if (msg_verbose)
msg_info("dns_get_answer: type %s for %s",
dns_strtype(fixed.type), rr_name);
pos += RRFIXEDSZ;
if (pos + fixed.length > reply->end)
CORRUPT(DNS_RETRY);
if (type == fixed.type || type == T_ANY) {
if (rrlist) {
if ((status = dns_get_rr(&rr, orig_name, reply, pos, rr_name,
&fixed)) == DNS_OK) {
resource_found++;
rr->dnssec_valid = *maybe_secure ? reply->dnssec_ad : 0;
*rrlist = dns_rr_append(*rrlist, rr);
} else if (status == DNS_NULLMX) {
CORRUPT(status);
} else if (not_found_status != DNS_RETRY)
not_found_status = status;
} else
resource_found++;
} else if (fixed.type == T_CNAME) {
cname_found++;
if (cname && c_len > 0)
if ((status = dns_get_alias(reply, pos, &fixed, cname, c_len)) != DNS_OK)
CORRUPT(status);
if (!reply->dnssec_ad)
*maybe_secure = 0;
}
pos += fixed.length;
}
if (resource_found)
return (DNS_OK);
if (cname_found)
return (DNS_RECURSE);
return (not_found_status);
}
int dns_lookup_x(const char *name, unsigned type, unsigned flags,
DNS_RR **rrlist, VSTRING *fqdn, VSTRING *why,
int *rcode, unsigned lflags)
{
char cname[DNS_NAME_LEN];
int c_len = sizeof(cname);
static DNS_REPLY reply;
int count;
int status;
int maybe_secure = 1;
const char *orig_name = name;
if (rrlist)
*rrlist = 0;
if (valid_hostaddr(name, DONT_GRIPE)) {
if (why)
vstring_sprintf(why,
"Name service error for %s: invalid host or domain name",
name);
if (rcode)
*rcode = NXDOMAIN;
SET_H_ERRNO(HOST_NOT_FOUND);
return (DNS_NOTFOUND);
}
if (!valid_hostname(name, DONT_GRIPE)) {
if (why)
vstring_sprintf(why,
"Name service error for %s: invalid host or domain name",
name);
if (rcode)
*rcode = NXDOMAIN;
SET_H_ERRNO(HOST_NOT_FOUND);
return (DNS_NOTFOUND);
}
for (count = 0; count < 10; count++) {
status = dns_query(name, type, flags, &reply, why, lflags);
if (rcode)
*rcode = reply.rcode;
if (status != DNS_OK) {
if (status == DNS_NOTFOUND && TEST_HAVE_DNS_REPLY_PACKET(&reply)
&& reply.auth_count > 0) {
reply.answer_count = reply.auth_count;
(void) dns_get_answer(orig_name, &reply, T_SOA, rrlist, fqdn,
cname, c_len, &maybe_secure);
}
return (status);
}
status = dns_get_answer(orig_name, &reply, type, rrlist, fqdn,
cname, c_len, &maybe_secure);
switch (status) {
default:
if (why)
vstring_sprintf(why, "Name service error for name=%s type=%s: "
"Malformed or unexpected name server reply",
name, dns_strtype(type));
return (status);
case DNS_NULLMX:
if (why)
vstring_sprintf(why, "Domain %s does not accept mail (nullMX)",
name);
SET_H_ERRNO(NO_DATA);
return (status);
case DNS_OK:
if (rrlist && dns_rr_filter_maps) {
if (dns_rr_filter_execute(rrlist) < 0) {
if (why)
vstring_sprintf(why,
"Error looking up name=%s type=%s: "
"Invalid DNS reply filter syntax",
name, dns_strtype(type));
dns_rr_free(*rrlist);
*rrlist = 0;
status = DNS_RETRY;
} else if (*rrlist == 0) {
if (why)
vstring_sprintf(why,
"Error looking up name=%s type=%s: "
"DNS reply filter drops all results",
name, dns_strtype(type));
status = DNS_POLICY;
}
}
return (status);
case DNS_RECURSE:
if (msg_verbose)
msg_info("dns_lookup: %s aliased to %s", name, cname);
#if RES_USE_DNSSEC
if (maybe_secure == 0)
flags &= ~RES_USE_DNSSEC;
#endif
name = cname;
}
}
if (why)
vstring_sprintf(why, "Name server loop for %s", name);
msg_warn("dns_lookup: Name server loop for %s", name);
return (DNS_NOTFOUND);
}
int dns_lookup_rl(const char *name, unsigned flags, DNS_RR **rrlist,
VSTRING *fqdn, VSTRING *why, int *rcode,
int lflags,...)
{
va_list ap;
unsigned type, next;
int status = DNS_NOTFOUND;
int hpref_status = INT_MIN;
VSTRING *hpref_rtext = 0;
int hpref_rcode;
int hpref_h_errno;
DNS_RR *rr;
#define SAVE_HPREF_STATUS() do { \
hpref_status = status; \
if (rcode) \
hpref_rcode = *rcode; \
if (why && status != DNS_OK) \
vstring_strcpy(hpref_rtext ? hpref_rtext : \
(hpref_rtext = vstring_alloc(VSTRING_LEN(why))), \
vstring_str(why)); \
hpref_h_errno = h_errno; \
} while (0)
#define RESTORE_HPREF_STATUS() do { \
status = hpref_status; \
if (rcode) \
*rcode = hpref_rcode; \
if (why && status != DNS_OK) \
vstring_strcpy(why, vstring_str(hpref_rtext)); \
SET_H_ERRNO(hpref_h_errno); \
} while (0)
if (rrlist)
*rrlist = 0;
va_start(ap, lflags);
for (type = va_arg(ap, unsigned); type != 0; type = next) {
next = va_arg(ap, unsigned);
if (msg_verbose)
msg_info("lookup %s type %s flags %s",
name, dns_strtype(type), dns_str_resflags(flags));
status = dns_lookup_x(name, type, flags, rrlist ? &rr : (DNS_RR **) 0,
fqdn, why, rcode, lflags);
if (rrlist && rr)
*rrlist = dns_rr_append(*rrlist, rr);
if (status == DNS_OK) {
if (lflags & DNS_REQ_FLAG_STOP_OK)
break;
} else if (status == DNS_INVAL) {
if (lflags & DNS_REQ_FLAG_STOP_INVAL)
break;
} else if (status == DNS_POLICY) {
if (type == T_MX && (lflags & DNS_REQ_FLAG_STOP_MX_POLICY))
break;
} else if (status == DNS_NULLMX) {
if (lflags & DNS_REQ_FLAG_STOP_NULLMX)
break;
}
if (next == 0)
break;
if (status >= hpref_status)
SAVE_HPREF_STATUS();
}
va_end(ap);
if (status < hpref_status)
RESTORE_HPREF_STATUS();
if (hpref_rtext)
vstring_free(hpref_rtext);
return (status);
}
int dns_lookup_rv(const char *name, unsigned flags, DNS_RR **rrlist,
VSTRING *fqdn, VSTRING *why, int *rcode,
int lflags, unsigned *types)
{
unsigned type, next;
int status = DNS_NOTFOUND;
int hpref_status = INT_MIN;
VSTRING *hpref_rtext = 0;
int hpref_rcode;
int hpref_h_errno;
DNS_RR *rr;
if (rrlist)
*rrlist = 0;
for (type = *types++; type != 0; type = next) {
next = *types++;
if (msg_verbose)
msg_info("lookup %s type %s flags %s",
name, dns_strtype(type), dns_str_resflags(flags));
status = dns_lookup_x(name, type, flags, rrlist ? &rr : (DNS_RR **) 0,
fqdn, why, rcode, lflags);
if (rrlist && rr)
*rrlist = dns_rr_append(*rrlist, rr);
if (status == DNS_OK) {
if (lflags & DNS_REQ_FLAG_STOP_OK)
break;
} else if (status == DNS_INVAL) {
if (lflags & DNS_REQ_FLAG_STOP_INVAL)
break;
} else if (status == DNS_POLICY) {
if (type == T_MX && (lflags & DNS_REQ_FLAG_STOP_MX_POLICY))
break;
} else if (status == DNS_NULLMX) {
if (lflags & DNS_REQ_FLAG_STOP_NULLMX)
break;
}
if (next == 0)
break;
if (status >= hpref_status)
SAVE_HPREF_STATUS();
}
if (status < hpref_status)
RESTORE_HPREF_STATUS();
if (hpref_rtext)
vstring_free(hpref_rtext);
return (status);
}