rpms
/
postfix
7
0
Fork 0
Code Issues Pull Requests Releases Activity
postfix/SOURCES/postfix-3.5.8-SRV-resolve.p...

1587 lines
57 KiB
Diff
Raw Permalink Blame History

commit 4b486868473462f9b65cc3ad44c48c2e68ee45ee
Author: Tomas Korbar <tkorbar@redhat.com>
Date: Wed May 17 13:17:30 2023 +0200
Backport SRV record resolution feature
diff --git a/mantools/postlink b/mantools/postlink
index 46f187e..f738fd3 100755
--- a/mantools/postlink
+++ b/mantools/postlink
@@ -1128,6 +1128,10 @@ while (<>) {
s;\bpostlog_service_name\b;<a href="postconf.5.html#postlog_service_name">$&</a>;g;
s;\bpostlogd_watchdog_timeout\b;<a href="postconf.5.html#postlogd_watchdog_timeout">$&</a>;g;
+ s;\buse_srv_lookup\b;<a href="postconf.5.html#use_srv_lookup">$&</a>;g;
+ s;\ballow_srv_lookup_fallback\b;<a href="postconf.5.html#allow_srv_lookup_fallback">$&</a>;g;
+ s;\bignore_srv_lookup_error\b;<a href="postconf.5.html#ignore_srv_lookup_error">$&</a>;g;
+
# Service-defined parameters...
s;\bpolicy_time_limit\b;<a href="postconf.5.html#transport_time_limit">$&</a>;g;
diff --git a/proto/postconf.proto b/proto/postconf.proto
index 3d53657..29d0aa5 100644
--- a/proto/postconf.proto
+++ b/proto/postconf.proto
@@ -17698,3 +17698,111 @@ with quotes and backslashes. An attacker should not be able to use
such games to circumvent Postfix access policies. </p>
<p> This feature is available in Postfix 3.5 and later. </p>
+
+
+%PARAM use_srv_lookup
+
+<p> Enables discovery for the specified service(s) using DNS SRV
+records. For example, with "use_srv_lookup = submission" and
+"relayhost = example.com:submission", the Postfix SMTP client will
+look up DNS SRV records for _submission._tcp.example.com, and will
+relay email through the hosts and ports that are specified with
+those records. See RFC 2782 for details of the host selection
+process. </p>
+
+<p> Specify zero or more service names separated by comma and/or
+whitespace. Any name in the services(5) database may be specified,
+though in practice only submission, submissions, and smtp make
+sense. </p>
+
+<p> When SRV record lookup is enabled with use_srv_lookup, you can
+enclose a domain name in "[]" to force IP address lookup instead
+of SRV record lookup. </p>
+
+<p> Example 1: MUA-to-MTA submission using SRV record lookup for
+the "submission" service for domain "example.com". This uses the
+default SMTP delivery agent with STARTTLS, and looks up SRV records
+for "_submission._tcp.example.com". </p>
+
+<pre>
+/etc/postfix/main.cf:
+ use_srv_lookup = submission
+ relayhost = example.com:submission
+ smtp_tls_security_level = may
+ ...see SASL_README for sasl configuration...
+</pre>
+
+<p> Example 2: MUA-to-MTA submission using SRV record lookup for
+the "submissions" service for domain "example.org". This uses a
+dedicated SMTP delivery agent (smtp-wraptls) with tls_wrappermode
+turned on, and looks up SRV records for "_submissions._tcp.example.org".
+</p>
+
+<p> Note: specify the older name "smtps" instead of "submissions"
+when a provider has DNS SRV records like "_smtps._tcp.example.org"
+instead of "_submissions._tcp.example.org". </p>
+
+<pre>
+/etc/postfix/main.cf:
+ use_srv_lookup = submissions
+ default_transport = smtp-wraptls:example.org:submissions
+ ...see SASL_README for sasl configuration...
+</pre>
+
+<pre>
+/etc/postfix/master.cf:
+ smtp-wraptls unix ... ... ... ... ... smtp
+ -o { smtp_tls_wrappermode = yes }
+ -o { smtp_tls_security_level = encrypt }
+</pre>
+
+<p> Example 3: Sender-dependent selection for a combination of
+MUA-to-MTA submission services. This combines examples 1 and 2 with
+examples of how to disable SRV and look up IP address records for
+"smtp-relay.example.net" and "smtp-relay.other.example". Again,
+specify the older name "smtps" instead of "submissions" when a
+provider has DNS SRV records like "_smtps._tcp.example.org" instead
+of "_submissions._tcp.example.org". </p>
+
+<pre>
+/etc/postfix/main.cf:
+ use_srv_lookup = submission, submissions
+ sender_dependent_default_transport_maps = inline:{
+ # Destinations that support SRV record lookup.
+ { user1@example.com = smtp:example.com:submission }
+ { user2@example.org = smtp-wraptls:example.org:submissions }
+ # Use [destination] to force IP address lookups.
+ { user3@example.net = smtp:[smtp-relay.example.net]:submission }
+ { user4@other.example =
+ smtp-wraptls:[smtp-relay.other.example]:submissions } }
+ ...see SASL_README for sasl configuration...
+</pre>
+
+<p> Example 4: MTA-to-MTA traffic, using SRV record lookup for the
+SMTP service. This is useful for Postfix tests, and may be useful
+in environments where ports are dynamically assigned to servers.
+</p>
+
+<pre>
+/etc/postfix/main.cf:
+ use_srv_lookup = smtp
+ # Fall back to MX record lookup when SRV records are unavailable.
+ #allow_srv_lookup_fallback = yes
+ #ignore_srv_lookup_error = yes
+</pre>
+
+<p> This feature was backported from Postfix 3.8. </p>
+
+%PARAM ignore_srv_lookup_error no
+
+<p> When SRV record lookup fails, fall back to MX or IP address
+lookup as if SRV record lookup was not enabled. </p>
+
+<p> This feature was backported from Postfix 3.8. </p>
+
+%PARAM allow_srv_lookup_fallback no
+
+<p> When SRV record lookup fails or no SRV record exists, fall back
+to MX or IP address lookup as if SRV record lookup was not enabled. <p>
+
+<p> This feature was backported from Postfix 3.8. </p>
diff --git a/src/dns/dns.h b/src/dns/dns.h
index b8c4c4a..aac3ca9 100644
--- a/src/dns/dns.h
+++ b/src/dns/dns.h
@@ -147,10 +147,12 @@ typedef struct DNS_RR {
unsigned short class; /* C_IN, etc. */
unsigned int ttl; /* always */
unsigned int dnssec_valid; /* DNSSEC validated */
- unsigned short pref; /* T_MX only */
+ unsigned short pref; /* T_MX and T_SRV record related */
+ unsigned short weight; /* T_SRV related, defined in rfc2782 */
+ unsigned short port; /* T_SRV related, defined in rfc2782 */
struct DNS_RR *next; /* linkage */
size_t data_len; /* actual data size */
- char data[1]; /* actually a bunch of data */
+ char *data; /* a bunch of data */
} DNS_RR;
/*
@@ -172,14 +174,29 @@ extern char *dns_strrecord(VSTRING *, DNS_RR *);
/*
* dns_rr.c
*/
+#define DNS_RR_NOPREF (0)
+#define DNS_RR_NOWEIGHT (0)
+#define DNS_RR_NOPORT (0)
+
+#define dns_rr_create_noport(qname, rname, type, class, ttl, pref, data, \
+ data_len) \
+ dns_rr_create((qname), (rname), (type), (class), (ttl), \
+ (pref), DNS_RR_NOWEIGHT, DNS_RR_NOPORT, (data), (data_len))
+
+#define dns_rr_create_nopref(qname, rname, type, class, ttl, data, data_len) \
+ dns_rr_create_noport((qname), (rname), (type), (class), (ttl), \
+ DNS_RR_NOPREF, (data), (data_len))
+
extern DNS_RR *dns_rr_create(const char *, const char *,
ushort, ushort,
unsigned, unsigned,
+ unsigned, unsigned,
const char *, size_t);
extern void dns_rr_free(DNS_RR *);
extern DNS_RR *dns_rr_copy(DNS_RR *);
extern DNS_RR *dns_rr_append(DNS_RR *, DNS_RR *);
extern DNS_RR *dns_rr_sort(DNS_RR *, int (*) (DNS_RR *, DNS_RR *));
+extern DNS_RR *dns_srv_rr_sort(DNS_RR *);
extern int dns_rr_compare_pref_ipv6(DNS_RR *, DNS_RR *);
extern int dns_rr_compare_pref_ipv4(DNS_RR *, DNS_RR *);
extern int dns_rr_compare_pref_any(DNS_RR *, DNS_RR *);
@@ -278,8 +295,9 @@ extern int dns_lookup_rv(const char *, unsigned, DNS_RR **, VSTRING *,
* Below is the precedence order. The order between DNS_RETRY and DNS_NOTFOUND
* is arbitrary.
*/
-#define DNS_RECURSE (-7) /* internal only: recursion needed */
-#define DNS_NOTFOUND (-6) /* query ok, data not found */
+#define DNS_RECURSE (-8) /* internal only: recursion needed */
+#define DNS_NOTFOUND (-7) /* query ok, data not found */
+#define DNS_NULLSRV (-6) /* query ok, service unavailable */
#define DNS_NULLMX (-5) /* query ok, service unavailable */
#define DNS_FAIL (-4) /* query failed, don't retry */
#define DNS_INVAL (-3) /* query ok, malformed reply */
diff --git a/src/dns/dns_lookup.c b/src/dns/dns_lookup.c
index 11c9281..1aa97a4 100644
--- a/src/dns/dns_lookup.c
+++ b/src/dns/dns_lookup.c
@@ -688,6 +688,8 @@ static int dns_get_rr(DNS_RR **list, const char *orig_name, DNS_REPLY *reply,
int comp_len;
ssize_t data_len;
unsigned pref = 0;
+ unsigned weight = 0;
+ unsigned port = 0;
unsigned char *src;
unsigned char *dst;
int ch;
@@ -713,6 +715,18 @@ static int dns_get_rr(DNS_RR **list, const char *orig_name, DNS_REPLY *reply,
return (DNS_INVAL);
data_len = strlen(temp) + 1;
break;
+ case T_SRV:
+ GETSHORT(pref, pos);
+ GETSHORT(weight, pos);
+ GETSHORT(port, pos);
+ if (dn_expand(reply->buf, reply->end, pos, temp, sizeof(temp)) < 0)
+ return (DNS_RETRY);
+ if (*temp == 0)
+ return (DNS_NULLSRV);
+ if (!valid_rr_name(temp, "resource data", fixed->type, reply))
+ return (DNS_INVAL);
+ data_len = strlen(temp) + 1;
+ break;
case T_MX:
GETSHORT(pref, pos);
if (dn_expand(reply->buf, reply->end, pos, temp, sizeof(temp)) < 0)
@@ -808,7 +822,7 @@ static int dns_get_rr(DNS_RR **list, const char *orig_name, DNS_REPLY *reply,
break;
}
*list = dns_rr_create(orig_name, rr_name, fixed->type, fixed->class,
- fixed->ttl, pref, tempbuf, data_len);
+ fixed->ttl, pref, weight, port, tempbuf, data_len);
return (DNS_OK);
}
@@ -906,7 +920,7 @@ static int dns_get_answer(const char *orig_name, DNS_REPLY *reply, int type,
resource_found++;
rr->dnssec_valid = *maybe_secure ? reply->dnssec_ad : 0;
*rrlist = dns_rr_append(*rrlist, rr);
- } else if (status == DNS_NULLMX) {
+ } else if (status == DNS_NULLMX || status == DNS_NULLSRV) {
CORRUPT(status); /* TODO: use better name */
} else if (not_found_status != DNS_RETRY)
not_found_status = status;
@@ -1032,6 +1046,12 @@ int dns_lookup_x(const char *name, unsigned type, unsigned flags,
name);
SET_H_ERRNO(NO_DATA);
return (status);
+ case DNS_NULLSRV:
+ if (why)
+ vstring_sprintf(why, "Domain %s does not support SRV requests",
+ name);
+ SET_H_ERRNO(NO_DATA);
+ return (status);
case DNS_OK:
if (rrlist && dns_rr_filter_maps) {
if (dns_rr_filter_execute(rrlist) < 0) {
diff --git a/src/dns/dns_rr.c b/src/dns/dns_rr.c
index b550788..15b5dee 100644
--- a/src/dns/dns_rr.c
+++ b/src/dns/dns_rr.c
@@ -7,13 +7,15 @@
/* #include <dns.h>
/*
/* DNS_RR *dns_rr_create(qname, rname, type, class, ttl, preference,
-/* data, data_len)
+/* weight, port, data, data_len)
/* const char *qname;
/* const char *rname;
/* unsigned short type;
/* unsigned short class;
/* unsigned int ttl;
/* unsigned preference;
+/* unsigned weight;
+/* unsigned port;
/* const char *data;
/* size_t data_len;
/*
@@ -49,6 +51,30 @@
/* DNS_RR *dns_rr_remove(list, record)
/* DNS_RR *list;
/* DNS_RR *record;
+/*
+/* DNS_RR *dns_srv_rr_sort(list)
+/* DNS_RR *list;
+/* AUXILIARY FUNCTIONS
+/* DNS_RR *dns_rr_create_nopref(qname, rname, type, class, ttl,
+/* data, data_len)
+/* const char *qname;
+/* const char *rname;
+/* unsigned short type;
+/* unsigned short class;
+/* unsigned int ttl;
+/* const char *data;
+/* size_t data_len;
+/*
+/* DNS_RR *dns_rr_create_noport(qname, rname, type, class, ttl,
+/* preference, data, data_len)
+/* const char *qname;
+/* const char *rname;
+/* unsigned short type;
+/* unsigned short class;
+/* unsigned int ttl;
+/* unsigned preference;
+/* const char *data;
+/* size_t data_len;
/* DESCRIPTION
/* The routines in this module maintain memory for DNS resource record
/* information, and maintain lists of DNS resource records.
@@ -56,10 +82,14 @@
/* dns_rr_create() creates and initializes one resource record.
/* The \fIqname\fR field specifies the query name.
/* The \fIrname\fR field specifies the reply name.
-/* \fIpreference\fR is used for MX records; \fIdata\fR is a null
+/* \fIpreference\fR is used for MX and SRV records; \fIweight\fR
+/* and \fIport\fR are used for SRV records; \fIdata\fR is a null
/* pointer or specifies optional resource-specific data;
/* \fIdata_len\fR is the amount of resource-specific data.
/*
+/* dns_rr_create_nopref() and dns_rr_create_noport() are convenience
+/* wrappers around dns_rr_create() that take fewer arguments.
+/*
/* dns_rr_free() releases the resource used by of zero or more
/* resource records.
/*
@@ -81,6 +111,9 @@
/* dns_rr_remove() removes the specified record from the specified list.
/* The updated list is the result value.
/* The record MUST be a list member.
+/*
+/* dns_srv_rr_sort() sorts a list of SRV records according to
+/* their priority and weight as described in RFC 2782.
/* LICENSE
/* .ad
/* .fi
@@ -113,11 +146,15 @@
DNS_RR *dns_rr_create(const char *qname, const char *rname,
ushort type, ushort class,
unsigned int ttl, unsigned pref,
+ unsigned weight, unsigned port,
const char *data, size_t data_len)
{
DNS_RR *rr;
- rr = (DNS_RR *) mymalloc(sizeof(*rr) + data_len - 1);
+ /*
+ * Note: if this function is changed, update dns_rr_copy().
+ */
+ rr = (DNS_RR *) mymalloc(sizeof(*rr));
rr->qname = mystrdup(qname);
rr->rname = mystrdup(rname);
rr->type = type;
@@ -125,8 +162,14 @@ DNS_RR *dns_rr_create(const char *qname, const char *rname,
rr->ttl = ttl;
rr->dnssec_valid = 0;
rr->pref = pref;
- if (data && data_len > 0)
+ rr->weight = weight;
+ rr->port = port;
+ if (data_len != 0) {
+ rr->data = mymalloc(data_len);
memcpy(rr->data, data, data_len);
+ } else {
+ rr->data = 0;
+ }
rr->data_len = data_len;
rr->next = 0;
return (rr);
@@ -141,6 +184,8 @@ void dns_rr_free(DNS_RR *rr)
dns_rr_free(rr->next);
myfree(rr->qname);
myfree(rr->rname);
+ if (rr->data)
+ myfree(rr->data);
myfree((void *) rr);
}
}
@@ -149,16 +194,17 @@ void dns_rr_free(DNS_RR *rr)
DNS_RR *dns_rr_copy(DNS_RR *src)
{
- ssize_t len = sizeof(*src) + src->data_len - 1;
DNS_RR *dst;
/*
- * Combine struct assignment and data copy in one block copy operation.
+ * Note: struct copy, because dns_rr_create() would not copy all fields.
*/
- dst = (DNS_RR *) mymalloc(len);
- memcpy((void *) dst, (void *) src, len);
+ dst = (DNS_RR *) mymalloc(sizeof(*dst));
+ *dst = *src;
dst->qname = mystrdup(src->qname);
dst->rname = mystrdup(src->rname);
+ if (dst->data)
+ dst->data = mymemdup(src->data, src->data_len);
dst->next = 0;
return (dst);
}
@@ -247,6 +293,12 @@ DNS_RR *dns_rr_sort(DNS_RR *list, int (*compar) (DNS_RR *, DNS_RR *))
int len;
int i;
+ /*
+ * Avoid mymalloc() panic.
+ */
+ if (list == 0)
+ return (list);
+
/*
* Save state and initialize.
*/
@@ -293,6 +345,12 @@ DNS_RR *dns_rr_shuffle(DNS_RR *list)
int i;
int r;
+ /*
+ * Avoid mymalloc() panic.
+ */
+ if (list == 0)
+ return (list);
+
/*
* Build linear array with pointers to each list element.
*/
@@ -345,3 +403,141 @@ DNS_RR *dns_rr_remove(DNS_RR *list, DNS_RR *record)
}
return (list);
}
+
+/* weight_order - sort equal-priority records by weight */
+
+static void weight_order(DNS_RR **array, int count)
+{
+ int unordered_weights;
+ int i;
+
+ /*
+ * Compute the sum of record weights. If weights are not supplied then
+ * this function would be a noop. In fact this would be a noop when all
+ * weights have the same value, whether that weight is zero or not. There
+ * is no need to give special treatment to zero weights.
+ */
+ for (unordered_weights = 0, i = 0; i < count; i++)
+ unordered_weights += array[i]->weight;
+ if (unordered_weights == 0)
+ return;
+
+ /*
+ * The record ordering code below differs from RFC 2782 when the input
+ * contains a mix of zero and non-zero weights: the code below does not
+ * give special treatment to zero weights. Instead, it treats a zero
+ * weight just like any other small weight. Fewer special cases make for
+ * code that is simpler and more robust.
+ */
+ for (i = 0; i < count - 1; i++) {
+ int running_sum;
+ int threshold;
+ int k;
+ DNS_RR *temp;
+
+ /*
+ * Choose a random threshold [0..unordered_weights] inclusive.
+ */
+ threshold = myrand() % (unordered_weights + 1);
+
+ /*
+ * Move the first record with running_sum >= threshold to the ordered
+ * list, and update unordered_weights.
+ */
+ for (running_sum = 0, k = i; k < count; k++) {
+ running_sum += array[k]->weight;
+ if (running_sum >= threshold) {
+ unordered_weights -= array[k]->weight;
+ temp = array[i];
+ array[i] = array[k];
+ array[k] = temp;
+ break;
+ }
+ }
+ }
+}
+
+/* dns_srv_rr_sort - sort resource record list */
+
+DNS_RR *dns_srv_rr_sort(DNS_RR *list)
+{
+ int (*saved_user) (DNS_RR *, DNS_RR *);
+ DNS_RR **rr_array;
+ DNS_RR *rr;
+ int len;
+ int i;
+ int r;
+ int cur_pref;
+ int left_bound; /* inclusive */
+ int right_bound; /* non-inclusive */
+
+ /*
+ * Avoid mymalloc() panic, or rr_array[0] fence-post error.
+ */
+ if (list == 0)
+ return (list);
+
+ /*
+ * Save state and initialize.
+ */
+ saved_user = dns_rr_sort_user;
+ dns_rr_sort_user = dns_rr_compare_pref_any;
+
+ /*
+ * Build linear array with pointers to each list element.
+ */
+ for (len = 0, rr = list; rr != 0; len++, rr = rr->next)
+ /* void */ ;
+ rr_array = (DNS_RR **) mymalloc(len * sizeof(*rr_array));
+ for (len = 0, rr = list; rr != 0; len++, rr = rr->next)
+ rr_array[len] = rr;
+
+ /*
+ * Shuffle resource records. Every element has an equal chance of landing
+ * in slot 0. After that every remaining element has an equal chance of
+ * landing in slot 1, ... This is exactly n! states for n! permutations.
+ */
+ for (i = 0; i < len - 1; i++) {
+ r = i + (myrand() % (len - i)); /* Victor&Son */
+ rr = rr_array[i];
+ rr_array[i] = rr_array[r];
+ rr_array[r] = rr;
+ }
+
+ /* First order the records by preference. */
+ qsort((void *) rr_array, len, sizeof(*rr_array), dns_rr_sort_callback);
+
+ /*
+ * Walk through records and sort the records in every same-preference
+ * partition according to their weight. Note that left_bound is
+ * inclusive, and that right-bound is non-inclusive.
+ */
+ left_bound = 0;
+ cur_pref = rr_array[left_bound]->pref; /* assumes len > 0 */
+
+ for (right_bound = 1; /* see below */ ; right_bound++) {
+ if (right_bound == len || rr_array[right_bound]->pref != cur_pref) {
+ if (right_bound - left_bound > 1)
+ weight_order(rr_array + left_bound, right_bound - left_bound);
+ if (right_bound == len)
+ break;
+ left_bound = right_bound;
+ cur_pref = rr_array[left_bound]->pref;
+ }
+ }
+
+ /*
+ * Fix the links.
+ */
+ for (i = 0; i < len - 1; i++)
+ rr_array[i]->next = rr_array[i + 1];
+ rr_array[i]->next = 0;
+ list = rr_array[0];
+
+ /*
+ * Cleanup.
+ */
+ myfree((void *) rr_array);
+ dns_rr_sort_user = saved_user;
+ return (list);
+}
diff --git a/src/dns/dns_sa_to_rr.c b/src/dns/dns_sa_to_rr.c
index 6b9efcc..b5dee20 100644
--- a/src/dns/dns_sa_to_rr.c
+++ b/src/dns/dns_sa_to_rr.c
@@ -55,14 +55,14 @@ DNS_RR *dns_sa_to_rr(const char *hostname, unsigned pref, struct sockaddr *sa)
#define DUMMY_TTL 0
if (sa->sa_family == AF_INET) {
- return (dns_rr_create(hostname, hostname, T_A, C_IN, DUMMY_TTL, pref,
- (char *) &SOCK_ADDR_IN_ADDR(sa),
- sizeof(SOCK_ADDR_IN_ADDR(sa))));
+ return (dns_rr_create_noport(hostname, hostname, T_A, C_IN, DUMMY_TTL,
+ pref, (char *) &SOCK_ADDR_IN_ADDR(sa),
+ sizeof(SOCK_ADDR_IN_ADDR(sa))));
#ifdef HAS_IPV6
} else if (sa->sa_family == AF_INET6) {
- return (dns_rr_create(hostname, hostname, T_AAAA, C_IN, DUMMY_TTL, pref,
- (char *) &SOCK_ADDR_IN6_ADDR(sa),
- sizeof(SOCK_ADDR_IN6_ADDR(sa))));
+ return (dns_rr_create_noport(hostname, hostname, T_AAAA, C_IN, DUMMY_TTL,
+ pref, (char *) &SOCK_ADDR_IN6_ADDR(sa),
+ sizeof(SOCK_ADDR_IN6_ADDR(sa))));
#endif
} else {
errno = EAFNOSUPPORT;
@@ -121,7 +121,7 @@ int main(int argc, char **argv)
resv[len++] = res;
qsort((void *) resv, len, sizeof(*resv), compare_family);
for (n = 0; n < len; n++) {
- if ((rr = dns_sa_to_rr(argv[0], 0, resv[n]->ai_addr)) == 0)
+ if ((rr = dns_sa_to_rr(argv[0], DNS_RR_NOPREF, resv[n]->ai_addr)) == 0)
msg_fatal("dns_sa_to_rr: %m");
if (dns_rr_to_pa(rr, &hostaddr) == 0)
msg_fatal("dns_rr_to_pa: %m");
diff --git a/src/dns/dns_strrecord.c b/src/dns/dns_strrecord.c
index 6b8e989..1e3b743 100644
--- a/src/dns/dns_strrecord.c
+++ b/src/dns/dns_strrecord.c
@@ -80,6 +80,10 @@ char *dns_strrecord(VSTRING *buf, DNS_RR *rr)
case T_MX:
vstring_sprintf_append(buf, "%u %s.", rr->pref, rr->data);
break;
+ case T_SRV:
+ vstring_sprintf_append(buf, "%u %u %u %s.", rr->pref, rr->weight,
+ rr->port, rr->data);
+ break;
case T_TLSA:
if (rr->data_len >= 3) {
uint8_t *ip = (uint8_t *) rr->data;
diff --git a/src/dns/dns_strtype.c b/src/dns/dns_strtype.c
index 70e59ac..7eebe3c 100644
--- a/src/dns/dns_strtype.c
+++ b/src/dns/dns_strtype.c
@@ -180,6 +180,9 @@ static struct dns_type_map dns_type_map[] = {
#ifdef T_ANY
T_ANY, "ANY",
#endif
+#ifdef T_SRV
+ T_SRV, "SRV",
+#endif
};
/* dns_strtype - translate DNS query type to string */
diff --git a/src/global/mail_params.h b/src/global/mail_params.h
index 74459d9..f8bb550 100644
--- a/src/global/mail_params.h
+++ b/src/global/mail_params.h
@@ -4206,6 +4206,21 @@ extern char *var_info_log_addr_form;
#define DEF_RHEL_IPV6_NORMALIZE 0
extern bool var_rhel_ipv6_normalize;
+ /*
+ * SRV lookup support.
+ */
+#define VAR_USE_SRV_LOOKUP "use_srv_lookup"
+#define DEF_USE_SRV_LOOKUP ""
+extern char *var_use_srv_lookup;
+
+#define VAR_IGN_SRV_LOOKUP_ERR "ignore_srv_lookup_error"
+#define DEF_IGN_SRV_LOOKUP_ERR 0
+extern bool var_ign_srv_lookup_err;
+
+#define VAR_ALLOW_SRV_FALLBACK "allow_srv_lookup_fallback"
+#define DEF_ALLOW_SRV_FALLBACK 0
+extern bool var_allow_srv_fallback;
+
/* LICENSE
/* .ad
/* .fi
diff --git a/src/posttls-finger/posttls-finger.c b/src/posttls-finger/posttls-finger.c
index a3a9946..b428cb3 100644
--- a/src/posttls-finger/posttls-finger.c
+++ b/src/posttls-finger/posttls-finger.c
@@ -236,6 +236,8 @@
/* is encountered, up to 5 times or as specified with the \fB-m\fR option.
/* By default reconnection is disabled, specify a positive delay to
/* enable this behavior.
+/* .IP "\fB-R\fR"
+/* Use SRV lookup instead of MX.
/* .IP "\fB-s \fIservername\fR"
/* The server name to send with the TLS Server Name Indication (SNI)
/* extension. When the server has DANE TLSA records, this parameter
@@ -466,6 +468,7 @@ typedef struct STATE {
DNS_RR *mx; /* MX RRset qname, rname, valid */
int pass; /* Pass number, 2 for reconnect */
int nochat; /* disable chat logging */
+ int dosrv; /* look up SRV records instead of MX */
char *helo; /* Server name from EHLO reply */
DSN_BUF *why; /* SMTP-style error message */
VSTRING *buffer; /* Response buffer */
@@ -1150,7 +1153,7 @@ static VSTREAM *connect_addr(STATE *state, DNS_RR *addr)
/* addr_one - address lookup for one host name */
static DNS_RR *addr_one(STATE *state, DNS_RR *addr_list, const char *host,
- int res_opt, unsigned pref)
+ int res_opt, unsigned pref, unsigned port)
{
static const char *myname = "addr_one";
DSN_BUF *why = state->why;
@@ -1173,6 +1176,8 @@ static DNS_RR *addr_one(STATE *state, DNS_RR *addr_list, const char *host,
if ((addr = dns_sa_to_rr(host, pref, res0->ai_addr)) == 0)
msg_fatal("host %s: conversion error for address family %d: %m",
host, ((struct sockaddr *) (res0->ai_addr))->sa_family);
+ addr->pref = pref;
+ addr->port = port;
addr_list = dns_rr_append(addr_list, addr);
freeaddrinfo(res0);
return (addr_list);
@@ -1189,8 +1194,10 @@ static DNS_RR *addr_one(STATE *state, DNS_RR *addr_list, const char *host,
why->reason, DNS_REQ_FLAG_NONE,
proto_info->dns_atype_list)) {
case DNS_OK:
- for (rr = addr; rr; rr = rr->next)
+ for (rr = addr; rr; rr = rr->next) {
rr->pref = pref;
+ rr->port = port;
+ }
addr_list = dns_rr_append(addr_list, addr);
return (addr_list);
default:
@@ -1277,15 +1284,15 @@ static DNS_RR *mx_addr_list(STATE *state, DNS_RR *mx_names)
#endif
for (rr = mx_names; rr; rr = rr->next) {
- if (rr->type != T_MX)
+ if (rr->type != T_MX && rr->type != T_SRV)
msg_panic("%s: bad resource type: %d", myname, rr->type);
addr_list = addr_one(state, addr_list, (char *) rr->data, res_opt,
- rr->pref);
+ rr->pref, rr->port);
}
return (addr_list);
}
-/* smtp_domain_addr - mail exchanger address lookup */
+/* domain_addr - mail exchanger address lookup */
static DNS_RR *domain_addr(STATE *state, char *domain)
{
@@ -1350,6 +1357,74 @@ static DNS_RR *domain_addr(STATE *state, char *domain)
return (addr_list);
}
+/* service_addr - mail exchanger address lookup */
+
+static DNS_RR *service_addr(STATE *state, const char *domain,
+ const char *service)
+{
+ VSTRING *srv_qname = vstring_alloc(100);
+ char *str_srv_qname;
+ DNS_RR *srv_names;
+ DNS_RR *addr_list = 0;
+ int r = 0; /* Resolver flags */
+ const char *aname;
+
+ dsb_reset(state->why);
+
+#if (RES_USE_DNSSEC != 0) && (RES_USE_EDNS0 != 0)
+ r |= RES_USE_DNSSEC;
+#endif
+
+ vstring_sprintf(srv_qname, "_%s._tcp.%s", service, domain);
+ str_srv_qname = STR(srv_qname);
+
+ /*
+ * IDNA support.
+ */
+#ifndef NO_EAI
+ if (!allascii(str_srv_qname)
+ && (aname = midna_domain_to_ascii(str_srv_qname)) != 0) {
+ msg_info("%s asciified to %s", str_srv_qname, aname);
+ } else
+#endif
+ aname = str_srv_qname;
+
+ switch (dns_lookup(aname, T_SRV, r, &srv_names, (VSTRING *) 0,
+ state->why->reason)) {
+ default:
+ dsb_status(state->why, "4.4.3");
+ break;
+ case DNS_INVAL:
+ dsb_status(state->why, "5.4.4");
+ break;
+ case DNS_NULLMX:
+ dsb_status(state->why, "5.1.0");
+ break;
+ case DNS_FAIL:
+ dsb_status(state->why, "5.4.3");
+ break;
+ case DNS_OK:
+ /* Shuffle then sort the SRV rr records by priority and weight. */
+ srv_names = dns_srv_rr_sort(srv_names);
+ addr_list = mx_addr_list(state, srv_names);
+ state->mx = dns_rr_copy(srv_names);
+ dns_rr_free(srv_names);
+ if (addr_list == 0) {
+ msg_warn("no SRV host for %s has a valid address record",
+ str_srv_qname);
+ break;
+ }
+ /* TODO: sort by priority, weight, and address family preference. */
+ break;
+ case DNS_NOTFOUND:
+ dsb_status(state->why, "5.4.4");
+ break;
+ }
+
+ vstring_free(srv_qname);
+ return (addr_list);
+}
+
/* host_addr - direct host lookup */
static DNS_RR *host_addr(STATE *state, const char *host)
@@ -1376,7 +1451,8 @@ static DNS_RR *host_addr(STATE *state, const char *host)
ahost = host;
#define PREF0 0
- addr_list = addr_one(state, (DNS_RR *) 0, ahost, res_opt, PREF0);
+#define NOPORT 0
+ addr_list = addr_one(state, (DNS_RR *) 0, ahost, res_opt, PREF0, NOPORT);
if (addr_list && addr_list->next) {
addr_list = dns_rr_shuffle(addr_list);
if (inet_proto_info()->ai_family_list[1] != 0)
@@ -1465,7 +1541,8 @@ static int dane_host_level(STATE *state, DNS_RR *addr)
/* parse_destination - parse host/port destination */
static char *parse_destination(char *destination, char *def_service,
- char **hostp, unsigned *portp)
+ char **hostp, char **servicep,
+ unsigned *portp)
{
char *buf = mystrdup(destination);
char *service;
@@ -1481,12 +1558,13 @@ static char *parse_destination(char *destination, char *def_service,
* Parse the host/port information. We're working with a copy of the
* destination argument so the parsing can be destructive.
*/
- if ((err = host_port(buf, hostp, (char *) 0, &service, def_service)) != 0)
+ if ((err = host_port(buf, hostp, (char *) 0, servicep, def_service)) != 0)
msg_fatal("%s in server description: %s", err, destination);
/*
* Convert service to port number, network byte order.
*/
+ service = *servicep;
if (alldig(service)) {
if ((port = atoi(service)) >= 65536 || port == 0)
msg_fatal("bad network port in destination: %s", destination);
@@ -1507,17 +1585,21 @@ static char *parse_destination(char *destination, char *def_service,
static void connect_remote(STATE *state, char *dest)
{
DNS_RR *addr;
- char *buf;
- char *domain;
/* When reconnecting use IP address of previous session */
if (state->addr == 0) {
+ char *buf;
+ char *domain;
+ char *service;
+
buf = parse_destination(dest, state->smtp ? "smtp" : "24",
- &domain, &state->port);
+ &domain, &service, &state->port);
if (!state->nexthop)
state->nexthop = mystrdup(domain);
if (state->smtp == 0 || *dest == '[')
state->addr = host_addr(state, domain);
+ else if (state->dosrv)
+ state->addr = service_addr(state, domain, service);
else
state->addr = domain_addr(state, domain);
myfree(buf);
@@ -1531,10 +1613,14 @@ static void connect_remote(STATE *state, char *dest)
for (addr = state->addr; addr; addr = addr->next) {
int level = dane_host_level(state, addr);
+ if (addr->port) /* SRV port override */
+ state->port = htons(addr->port);
+
if (level == TLS_LEV_INVALID
|| (state->stream = connect_addr(state, addr)) == 0) {
- msg_info("Failed to establish session to %s via %s: %s",
- dest, HNAME(addr), vstring_str(state->why->reason));
+ msg_info("Failed to establish session to %s via %s:%u: %s",
+ dest, HNAME(addr), addr->port,
+ vstring_str(state->why->reason));
continue;
}
/* We have a connection */
@@ -1819,6 +1905,7 @@ static void parse_options(STATE *state, int argc, char *argv[])
state->smtp = 1;
state->pass = 1;
+ state->dosrv = 0;
state->reconnect = -1;
state->max_reconnect = 5;
state->wrapper_mode = 0;
@@ -1829,7 +1916,7 @@ static void parse_options(STATE *state, int argc, char *argv[])
memset((void *) &state->options, 0, sizeof(state->options));
state->options.host_lookup = mystrdup("dns");
-#define OPTS "a:ch:o:St:T:v"
+#define OPTS "a:ch:o:RSt:T:v"
#ifdef USE_TLS
#define TLSOPTS "A:Cd:fF:g:H:k:K:l:L:m:M:p:P:r:s:wX"
@@ -1868,6 +1955,9 @@ static void parse_options(STATE *state, int argc, char *argv[])
case 'o':
override(optarg);
break;
+ case 'R':
+ state->dosrv = 1;
+ break;
case 'S':
state->smtp = 0;
break;
diff --git a/src/smtp/lmtp_params.c b/src/smtp/lmtp_params.c
index 973cb5d..ff074cd 100644
--- a/src/smtp/lmtp_params.c
+++ b/src/smtp/lmtp_params.c
@@ -64,6 +64,7 @@
VAR_LMTP_DSN_FILTER, DEF_LMTP_DSN_FILTER, &var_smtp_dsn_filter, 0, 0,
VAR_LMTP_DNS_RE_FILTER, DEF_LMTP_DNS_RE_FILTER, &var_smtp_dns_re_filter, 0, 0,
VAR_TLSPROXY_SERVICE, DEF_TLSPROXY_SERVICE, &var_tlsproxy_service, 1, 0,
+ VAR_USE_SRV_LOOKUP, DEF_USE_SRV_LOOKUP, &var_use_srv_lookup, 0, 0,
0,
};
static const CONFIG_TIME_TABLE lmtp_time_table[] = {
@@ -126,5 +127,7 @@
VAR_LMTP_REC_DEADLINE, DEF_LMTP_REC_DEADLINE, &var_smtp_rec_deadline,
VAR_LMTP_DUMMY_MAIL_AUTH, DEF_LMTP_DUMMY_MAIL_AUTH, &var_smtp_dummy_mail_auth,
VAR_LMTP_BALANCE_INET_PROTO, DEF_LMTP_BALANCE_INET_PROTO, &var_smtp_balance_inet_proto,
+ VAR_IGN_SRV_LOOKUP_ERR, DEF_IGN_SRV_LOOKUP_ERR, &var_ign_srv_lookup_err,
+ VAR_ALLOW_SRV_FALLBACK, DEF_ALLOW_SRV_FALLBACK, &var_allow_srv_fallback,
0,
};
diff --git a/src/smtp/smtp.c b/src/smtp/smtp.c
index 6ca2d5c..f402876 100644
--- a/src/smtp/smtp.c
+++ b/src/smtp/smtp.c
@@ -146,6 +146,7 @@
/* RFC 2046 (MIME: Media Types)
/* RFC 2554 (AUTH command)
/* RFC 2821 (SMTP protocol)
+/* RFC 2782 (SRV resource records)
/* RFC 2920 (SMTP Pipelining)
/* RFC 3207 (STARTTLS command)
/* RFC 3461 (SMTP DSN Extension)
@@ -330,6 +331,17 @@
/* .IP "\fBinfo_log_address_format (external)\fR"
/* The email address form that will be used in non-debug logging
/* (info, warning, etc.).
+/* .PP
+/* Backported from Postfix version 3.8:
+/* .IP "\fBuse_srv_lookup (empty)\fR"
+/* Enables discovery for the specified service(s) using DNS SRV
+/* records.
+/* .IP "\fBignore_srv_lookup_error (no)\fR"
+/* When SRV record lookup fails, fall back to MX or IP address
+/* lookup as if SRV record lookup was not enabled.
+/* .IP "\fBallow_srv_lookup_fallback (no)\fR"
+/* When SRV record lookup fails or no SRV record exists, fall back
+/* to MX or IP address lookup as if SRV record lookup was not enabled.
/* MIME PROCESSING CONTROLS
/* .ad
/* .fi
@@ -1046,6 +1058,9 @@ bool var_smtp_dummy_mail_auth;
char *var_smtp_dsn_filter;
char *var_smtp_dns_re_filter;
bool var_smtp_balance_inet_proto;
+char *var_use_srv_lookup;
+bool var_ign_srv_lookup_err;
+bool var_allow_srv_fallback;
/* Special handling of 535 AUTH errors. */
char *var_smtp_sasl_auth_cache_name;
@@ -1068,6 +1083,7 @@ MAPS *smtp_pix_bug_maps;
HBC_CHECKS *smtp_header_checks; /* limited header checks */
HBC_CHECKS *smtp_body_checks; /* limited body checks */
SMTP_CLI_ATTR smtp_cli_attr; /* parsed command-line */
+STRING_LIST *smtp_use_srv_lookup;
#ifdef USE_TLS
@@ -1351,6 +1367,14 @@ static void post_init(char *unused_name, char **argv)
* the process lifetime.
*/
get_cli_attr(&smtp_cli_attr, argv);
+
+ /*
+ * Service discovery with SRV record lookup.
+ */
+ if (*var_use_srv_lookup)
+ smtp_use_srv_lookup = string_list_init(VAR_USE_SRV_LOOKUP,
+ MATCH_FLAG_RETURN,
+ var_use_srv_lookup);
}
/* pre_init - pre-jail initialization */
diff --git a/src/smtp/smtp.h b/src/smtp/smtp.h
index 281cfe4..3f4c209 100644
--- a/src/smtp/smtp.h
+++ b/src/smtp/smtp.h
@@ -84,6 +84,14 @@ typedef struct SMTP_ITERATOR {
vstring_strcpy((iter)->dest, STR((iter)->saved_dest)); \
} while (0)
+#define SMTP_ITER_UPDATE_HOST(iter, _host, _addr, _rr) do { \
+ vstring_strcpy((iter)->host, (_host)); \
+ vstring_strcpy((iter)->addr, (_addr)); \
+ (iter)->rr = (_rr); \
+ if ((_rr)->port) \
+ (iter)->port = htons((_rr)->port); /* SRV port override */ \
+ } while (0)
+
/*
* TLS Policy support.
*/
@@ -261,6 +269,7 @@ typedef struct SMTP_STATE {
#define SMTP_MISC_FLAG_COMPLETE_SESSION (1<<7)
#define SMTP_MISC_FLAG_PREF_IPV6 (1<<8)
#define SMTP_MISC_FLAG_PREF_IPV4 (1<<9)
+#define SMTP_MISC_FLAG_FALLBACK_SRV_TO_MX (1<<10)
#define SMTP_MISC_FLAG_CONN_CACHE_MASK \
(SMTP_MISC_FLAG_CONN_LOAD | SMTP_MISC_FLAG_CONN_STORE)
@@ -300,6 +309,8 @@ extern MAPS *smtp_generic_maps; /* make internal address valid */
extern int smtp_ext_prop_mask; /* address externsion propagation */
extern unsigned smtp_dns_res_opt; /* DNS query flags */
+extern STRING_LIST *smtp_use_srv_lookup;/* services with SRV record lookup */
+
#ifdef USE_TLS
extern TLS_APPL_STATE *smtp_tls_ctx; /* client-side TLS engine */
diff --git a/src/smtp/smtp_addr.c b/src/smtp/smtp_addr.c
index 2210ff7..7f20838 100644
--- a/src/smtp/smtp_addr.c
+++ b/src/smtp/smtp_addr.c
@@ -17,6 +17,15 @@
/* char *name;
/* int misc_flags;
/* DSN_BUF *why;
+/*
+/* DNS_RR *smtp_service_addr(name, service, mxrr, misc_flags, why,
+/* found_myself)
+/* const char *name;
+/* const char *service;
+/* DNS_RR **mxrr;
+/* int misc_flags;
+/* DSN_BUF *why;
+/* int *found_myself;
/* DESCRIPTION
/* This module implements Internet address lookups. By default,
/* lookups are done via the Internet domain name service (DNS).
@@ -33,6 +42,8 @@
/* destination. If MX records were found, the rname, qname,
/* and dnssec validation status of the MX RRset are returned
/* via mxrr, which the caller must free with dns_rr_free().
+/* Fallback from MX to address lookups is governed by RFC 2821,
+/* and by local policy (var_ign_mx_lookup_err).
/*
/* When no mail exchanger is listed in the DNS for \fIname\fR, the
/* request is passed to smtp_host_addr().
@@ -44,8 +55,18 @@
/* host. The host can be specified as a numerical Internet network
/* address, or as a symbolic host name.
/*
-/* Results from smtp_domain_addr() or smtp_host_addr() are
-/* destroyed by dns_rr_free(), including null lists.
+/* smtp_service_addr() looks up addresses for hosts specified
+/* in SRV records for the specified domain and service. This
+/* supports the features of smtp_domain_addr() except that
+/* the order of SRV records is determined by RFC 2782, and
+/* that address records are not sorted by IP address family
+/* preference. Fallback from SRV to MX or address lookups is
+/* governed by local policy (var_ign_mx_lookup_err and
+/* var_allow_srv_fallback).
+/*
+/* Results from smtp_domain_addr(), smtp_host_addr(), and
+/* smtp_service_addr() are destroyed by dns_rr_free(), including
+/* null lists.
/* DIAGNOSTICS
/* Panics: interface violations. For example, calling smtp_domain_addr()
/* when DNS lookups are explicitly disabled.
@@ -130,7 +151,8 @@ static void smtp_print_addr(const char *what, DNS_RR *addr_list)
/* smtp_addr_one - address lookup for one host name */
static DNS_RR *smtp_addr_one(DNS_RR *addr_list, const char *host, int res_opt,
- unsigned pref, DSN_BUF *why)
+ unsigned pref, unsigned port,
+ DSN_BUF *why)
{
const char *myname = "smtp_addr_one";
DNS_RR *addr = 0;
@@ -153,6 +175,8 @@ static DNS_RR *smtp_addr_one(DNS_RR *addr_list, const char *host, int res_opt,
if ((addr = dns_sa_to_rr(host, pref, res0->ai_addr)) == 0)
msg_fatal("host %s: conversion error for address family "
"%d: %m", host, res0->ai_addr->sa_family);
+ addr->pref = pref;
+ addr->port = port;
addr_list = dns_rr_append(addr_list, addr);
freeaddrinfo(res0);
return (addr_list);
@@ -172,8 +196,10 @@ static DNS_RR *smtp_addr_one(DNS_RR *addr_list, const char *host, int res_opt,
why->reason, DNS_REQ_FLAG_NONE,
proto_info->dns_atype_list)) {
case DNS_OK:
- for (rr = addr; rr; rr = rr->next)
+ for (rr = addr; rr; rr = rr->next) {
rr->pref = pref;
+ rr->port = port;
+ }
addr_list = dns_rr_append(addr_list, addr);
return (addr_list);
default:
@@ -283,10 +309,10 @@ static DNS_RR *smtp_addr_list(DNS_RR *mx_names, DSN_BUF *why)
* tweaking the in-process resolver flags.
*/
for (rr = mx_names; rr; rr = rr->next) {
- if (rr->type != T_MX)
+ if (rr->type != T_MX && rr->type != T_SRV)
msg_panic("smtp_addr_list: bad resource type: %d", rr->type);
addr_list = smtp_addr_one(addr_list, (char *) rr->data, res_opt,
- rr->pref, why);
+ rr->pref, rr->port, why);
}
return (addr_list);
}
@@ -669,7 +695,7 @@ DNS_RR *smtp_host_addr(const char *host, int misc_flags, DSN_BUF *why)
* address to internal form. Otherwise, the host is specified by name.
*/
#define PREF0 0
- addr_list = smtp_addr_one((DNS_RR *) 0, ahost, res_opt, PREF0, why);
+ addr_list = smtp_addr_one((DNS_RR *) 0, ahost, res_opt, PREF0, 0, why);
if (addr_list
&& (misc_flags & SMTP_MISC_FLAG_LOOP_DETECT)
&& smtp_find_self(addr_list) != 0) {
@@ -691,3 +717,135 @@ DNS_RR *smtp_host_addr(const char *host, int misc_flags, DSN_BUF *why)
smtp_print_addr(host, addr_list);
return (addr_list);
}
+
+/* smtp_service_addr - service address lookup */
+
+DNS_RR *smtp_service_addr(const char *name, const char *service, DNS_RR **mxrr,
+ int misc_flags, DSN_BUF *why,
+ int *found_myself)
+{
+ static VSTRING *srv_qname = 0;
+ const char *str_srv_qname;
+ DNS_RR *srv_names = 0;
+ DNS_RR *addr_list = 0;
+ DNS_RR *self = 0;
+ unsigned best_pref;
+ unsigned best_found;
+ int r = 0;
+ const char *aname;
+ int allow_non_srv_fallback = var_allow_srv_fallback;
+
+ dsb_reset(why);
+
+ /*
+ * Sanity check.
+ */
+ if (smtp_dns_support == SMTP_DNS_DISABLED)
+ msg_panic("smtp_service_addr: DNS lookup is disabled");
+
+ if (smtp_dns_support == SMTP_DNS_DNSSEC) {
+ r |= RES_USE_DNSSEC;
+ }
+ if (srv_qname == 0)
+ srv_qname = vstring_alloc(100);
+ vstring_sprintf(srv_qname, "_%s._tcp.%s", service, name);
+ str_srv_qname = STR(srv_qname);
+
+ /*
+ * IDNA support.
+ */
+#ifndef NO_EAI
+ if (!allascii(str_srv_qname)
+ && (aname = midna_domain_to_ascii(str_srv_qname)) != 0) {
+ if (msg_verbose)
+ msg_info("%s asciified to %s", str_srv_qname, aname);
+ } else
+#endif
+ aname = str_srv_qname;
+
+ switch (dns_lookup(aname, T_SRV, r, &srv_names, (VSTRING *) 0,
+ why->reason)) {
+ default:
+ dsb_status(why, "4.4.3");
+ allow_non_srv_fallback |= var_ign_srv_lookup_err;
+ break;
+ case DNS_INVAL:
+ dsb_status(why, "5.4.4");
+ allow_non_srv_fallback |= var_ign_srv_lookup_err;
+ break;
+ case DNS_POLICY:
+ dsb_status(why, "4.7.0");
+ break;
+ case DNS_FAIL:
+ dsb_status(why, "5.4.3");
+ allow_non_srv_fallback |= var_ign_srv_lookup_err;
+ break;
+ case DNS_NULLSRV:
+ dsb_status(why, "5.1.0");
+ break;
+ case DNS_OK:
+ /* Shuffle then sort the SRV rr records by priority and weight. */
+ srv_names = dns_srv_rr_sort(srv_names);
+ best_pref = (srv_names ? srv_names->pref : IMPOSSIBLE_PREFERENCE);
+ addr_list = smtp_addr_list(srv_names, why);
+ if (mxrr)
+ *mxrr = dns_rr_copy(srv_names); /* copies one record! */
+ dns_rr_free(srv_names);
+ if (addr_list == 0) {
+ msg_warn("no SRV host for %s has a valid address record",
+ str_srv_qname);
+ break;
+ }
+ /* Optional loop prevention, similar to smtp_domain_addr(). */
+ best_found = (addr_list ? addr_list->pref : IMPOSSIBLE_PREFERENCE);
+ if (msg_verbose)
+ smtp_print_addr(aname, addr_list);
+ if ((misc_flags & SMTP_MISC_FLAG_LOOP_DETECT)
+ && (self = smtp_find_self(addr_list)) != 0) {
+ addr_list = smtp_truncate_self(addr_list, self->pref);
+ if (addr_list == 0) {
+ if (best_pref != best_found) {
+ dsb_simple(why, "4.4.4",
+ "unable to find primary relay for %s",
+ str_srv_qname);
+ } else {
+ dsb_simple(why, "5.4.6", "mail for %s loops back to myself",
+ str_srv_qname);
+ }
+ }
+ }
+ /* TODO: sort by priority, weight, and address family preference. */
+
+ /* Optional address family balancing, as in smtp_domain_addr(). */
+ if (addr_list && addr_list->next) {
+ if (var_smtp_mxaddr_limit > 0 && var_smtp_balance_inet_proto)
+ addr_list = smtp_balance_inet_proto(addr_list, misc_flags,
+ var_smtp_mxaddr_limit);
+ }
+ break;
+ case DNS_NOTFOUND:
+ dsb_status(why, "5.4.4");
+ break;
+ }
+
+ /*
+ * If permitted, fall back to non-SRV record lookups.
+ */
+ if (addr_list == 0 && allow_non_srv_fallback) {
+ msg_info("skipping SRV lookup for %s: %s",
+ str_srv_qname, STR(why->reason));
+ if (misc_flags & SMTP_MISC_FLAG_FALLBACK_SRV_TO_MX)
+ addr_list = smtp_domain_addr(name, mxrr, misc_flags, why,
+ found_myself);
+ else
+ addr_list = smtp_host_addr(name, misc_flags, why);
+ }
+
+ /*
+ * Only if we're not falling back.
+ */
+ else {
+ *found_myself |= (self != 0);
+ }
+ return (addr_list);
+}
diff --git a/src/smtp/smtp_addr.h b/src/smtp/smtp_addr.h
index 8f20961..3d70413 100644
--- a/src/smtp/smtp_addr.h
+++ b/src/smtp/smtp_addr.h
@@ -18,6 +18,7 @@
*/
extern DNS_RR *smtp_host_addr(const char *, int, DSN_BUF *);
extern DNS_RR *smtp_domain_addr(const char *, DNS_RR **, int, DSN_BUF *, int *);
+extern DNS_RR *smtp_service_addr(const char *, const char *, DNS_RR **, int, DSN_BUF *, int *);
/* LICENSE
/* .ad
diff --git a/src/smtp/smtp_connect.c b/src/smtp/smtp_connect.c
index 4d48883..4b3153f 100644
--- a/src/smtp/smtp_connect.c
+++ b/src/smtp/smtp_connect.c
@@ -28,7 +28,8 @@
/* destinations may be specified as "unix:pathname", "inet:host"
/* or "inet:host:port".
/*
-/* With SMTP, the Internet domain name service is queried for mail
+/* With SMTP, or with SRV record lookup enabled, the Internet
+/* domain name service is queried for mail
/* exchanger hosts. Quote the domain name with `[' and `]' to
/* suppress mail exchanger lookups.
/*
@@ -333,7 +334,8 @@ static SMTP_SESSION *smtp_connect_sock(int sock, struct sockaddr *sa,
/* smtp_parse_destination - parse host/port destination */
static char *smtp_parse_destination(char *destination, char *def_service,
- char **hostp, unsigned *portp)
+ char **hostp, char **servicep,
+ unsigned *portp)
{
char *buf = mystrdup(destination);
char *service;
@@ -349,12 +351,13 @@ static char *smtp_parse_destination(char *destination, char *def_service,
* Parse the host/port information. We're working with a copy of the
* destination argument so the parsing can be destructive.
*/
- if ((err = host_port(buf, hostp, (char *) 0, &service, def_service)) != 0)
+ if ((err = host_port(buf, hostp, (char *) 0, servicep, def_service)) != 0)
msg_fatal("%s in server description: %s", err, destination);
/*
* Convert service to port number, network byte order.
*/
+ service = *servicep;
if (alldig(service)) {
if ((port = atoi(service)) >= 65536 || port == 0)
msg_fatal("bad network port in destination: %s", destination);
@@ -635,6 +638,9 @@ static void smtp_update_addr_list(DNS_RR **addr_list, const char *server_addr,
* XXX Extend the SMTP_SESSION structure with sockaddr information so that
* we can avoid repeated string->binary transformations for the same
* address.
+ *
+ * XXX SRV support: this should match the port, too, otherwise we may
+ * eliminate too many list entries.
*/
if ((aierr = hostaddr_to_sockaddr(server_addr, (char *) 0, 0, &res0)) != 0) {
msg_warn("hostaddr_to_sockaddr %s: %s",
@@ -665,6 +671,18 @@ static int smtp_reuse_session(SMTP_STATE *state, DNS_RR **addr_list,
DSN_BUF *why = state->why;
/*
+ * This code is called after server address/port lookup, before
+ * iter->host, iter->addr, iter->rr and iter->mx are assigned concrete
+ * values, and while iter->port still corresponds to the nexthop service,
+ * or the default service configured with smtp_tcp_port or lmtp_tcp_port.
+ *
+ * When a connection is reused by nexthop/service or by server address/port,
+ * iter->host, iter->addr and iter->port are updated with actual values
+ * from the cached session. Additionally, when a connection is searched
+ * by nexthop/service, iter->rr remains null, and when a connection is
+ * searched by server address/port, iter->rr is updated with an actual
+ * server address/port before the search is made.
+ *
* First, search the cache by delivery request nexthop. We truncate the
* server address list when all the sessions for this destination are
* used up, to reduce the number of variables that need to be checked
@@ -731,9 +749,7 @@ static int smtp_reuse_session(SMTP_STATE *state, DNS_RR **addr_list,
/* XXX Assume there is no code at the end of this loop. */
continue;
}
- vstring_strcpy(iter->addr, hostaddr.buf);
- vstring_strcpy(iter->host, SMTP_HNAME(addr));
- iter->rr = addr;
+ SMTP_ITER_UPDATE_HOST(iter, SMTP_HNAME(addr), hostaddr.buf, addr);
#ifdef USE_TLS
if (!smtp_tls_policy_cache_query(why, state->tls, iter)) {
msg_warn("TLS policy lookup error for %s/%s: %s",
@@ -818,6 +834,7 @@ static void smtp_connect_inet(SMTP_STATE *state, const char *nexthop,
char *dest_buf;
char *domain;
unsigned port;
+ char *service;
DNS_RR *addr_list;
DNS_RR *addr;
DNS_RR *next;
@@ -825,6 +842,8 @@ static void smtp_connect_inet(SMTP_STATE *state, const char *nexthop,
int sess_count;
SMTP_SESSION *session;
int lookup_mx;
+ int non_dns_or_literal;
+ int i_am_mx;
unsigned domain_best_pref;
MAI_HOSTADDR_STR hostaddr;
@@ -834,8 +853,28 @@ static void smtp_connect_inet(SMTP_STATE *state, const char *nexthop,
/*
* Parse the destination. If no TCP port is specified, use the port
* that is reserved for the protocol (SMTP or LMTP).
+ *
+ * The 'service' variable corresponds to the remote service specified
+ * with the nexthop, or the default service configured with
+ * smtp_tcp_port or lmtp_tcp_port. The 'port' variable and
+ * SMTP_ITERATOR.port initially correspond to that service. This
+ * determines what loop prevention will be in effect.
+ *
+ * The SMTP_ITERATOR.port will be overwritten after SRV record lookup.
+ * This guarantees that the connection cache key contains the correct
+ * port value when caching and retrieving a connection by its server
+ * address (and port).
+ *
+ * By design, the connection cache key contains NO port information when
+ * caching or retrieving a connection by its nexthop destination.
+ * Instead, the cache key contains the master.cf service name (a
+ * proxy for all the parameter settings including the default service
+ * from smtp_tcp_port or lmtp_tcp_port), together with the nexthop
+ * destination and sender-dependent info. This should be sufficient
+ * to avoid cross talk between mail streams that should be separated.
*/
- dest_buf = smtp_parse_destination(dest, def_service, &domain, &port);
+ dest_buf = smtp_parse_destination(dest, def_service, &domain,
+ &service, &port);
if (var_helpful_warnings && var_smtp_tls_wrappermode == 0
&& ntohs(port) == 465) {
msg_info("SMTPS wrappermode (TCP port 465) requires setting "
@@ -848,32 +887,48 @@ static void smtp_connect_inet(SMTP_STATE *state, const char *nexthop,
SMTP_ITER_INIT(iter, dest, NO_HOST, NO_ADDR, port, state);
/*
- * Resolve an SMTP or LMTP server. In the case of SMTP, skip mail
- * exchanger lookups when a quoted host is specified or when DNS
- * lookups are disabled.
+ * Resolve an SMTP or LMTP server. Skip MX or SRV lookups when a
+ * quoted domain is specified or when DNS lookups are disabled.
*/
if (msg_verbose)
- msg_info("connecting to %s port %d", domain, ntohs(port));
+ msg_info("connecting to %s service %s", domain, service);
+ non_dns_or_literal = (smtp_dns_support == SMTP_DNS_DISABLED
+ || *dest == '[');
if (smtp_mode) {
if (ntohs(port) == IPPORT_SMTP)
state->misc_flags |= SMTP_MISC_FLAG_LOOP_DETECT;
else
state->misc_flags &= ~SMTP_MISC_FLAG_LOOP_DETECT;
- lookup_mx = (smtp_dns_support != SMTP_DNS_DISABLED && *dest != '[');
+ lookup_mx = !non_dns_or_literal;
} else
lookup_mx = 0;
- if (!lookup_mx) {
+
+ /*
+ * Look up SRV and address records and fall back to non-SRV lookups
+ * if permitted by configuration settings, or look up MX and address
+ * records, or look up address records only.
+ */
+ i_am_mx = 0;
+ addr_list = 0;
+ if (!non_dns_or_literal && smtp_use_srv_lookup
+ && string_list_match(smtp_use_srv_lookup, service)) {
+ if (lookup_mx)
+ state->misc_flags |= SMTP_MISC_FLAG_FALLBACK_SRV_TO_MX;
+ else
+ state->misc_flags &= ~SMTP_MISC_FLAG_FALLBACK_SRV_TO_MX;
+ addr_list = smtp_service_addr(domain, service, &iter->mx,
+ state->misc_flags, why, &i_am_mx);
+ } else if (!lookup_mx) {
+ /* Non-DNS, literal, or non-SMTP service */
addr_list = smtp_host_addr(domain, state->misc_flags, why);
/* XXX We could be an MX host for this destination... */
} else {
- int i_am_mx = 0;
-
addr_list = smtp_domain_addr(domain, &iter->mx, state->misc_flags,
why, &i_am_mx);
- /* If we're MX host, don't connect to non-MX backups. */
- if (i_am_mx)
- state->misc_flags |= SMTP_MISC_FLAG_FINAL_NEXTHOP;
}
+ /* If we're MX host, don't connect to non-MX backups. */
+ if (i_am_mx)
+ state->misc_flags |= SMTP_MISC_FLAG_FINAL_NEXTHOP;
/*
* Don't try fall-back hosts if mail loops to myself. That would just
@@ -966,9 +1021,7 @@ static void smtp_connect_inet(SMTP_STATE *state, const char *nexthop,
/* XXX Assume there is no code at the end of this loop. */
continue;
}
- vstring_strcpy(iter->addr, hostaddr.buf);
- vstring_strcpy(iter->host, SMTP_HNAME(addr));
- iter->rr = addr;
+ SMTP_ITER_UPDATE_HOST(iter, SMTP_HNAME(addr), hostaddr.buf, addr);
#ifdef USE_TLS
if (!smtp_tls_policy_cache_query(why, state->tls, iter)) {
msg_warn("TLS policy lookup for %s/%s: %s",
diff --git a/src/smtp/smtp_params.c b/src/smtp/smtp_params.c
index 561f6a0..b893a76 100644
--- a/src/smtp/smtp_params.c
+++ b/src/smtp/smtp_params.c
@@ -65,6 +65,7 @@
VAR_SMTP_DSN_FILTER, DEF_SMTP_DSN_FILTER, &var_smtp_dsn_filter, 0, 0,
VAR_SMTP_DNS_RE_FILTER, DEF_SMTP_DNS_RE_FILTER, &var_smtp_dns_re_filter, 0, 0,
VAR_TLSPROXY_SERVICE, DEF_TLSPROXY_SERVICE, &var_tlsproxy_service, 1, 0,
+ VAR_USE_SRV_LOOKUP, DEF_USE_SRV_LOOKUP, &var_use_srv_lookup, 0, 0,
0,
};
static const CONFIG_TIME_TABLE smtp_time_table[] = {
@@ -130,5 +131,7 @@
VAR_SMTP_REC_DEADLINE, DEF_SMTP_REC_DEADLINE, &var_smtp_rec_deadline,
VAR_SMTP_DUMMY_MAIL_AUTH, DEF_SMTP_DUMMY_MAIL_AUTH, &var_smtp_dummy_mail_auth,
VAR_SMTP_BALANCE_INET_PROTO, DEF_SMTP_BALANCE_INET_PROTO, &var_smtp_balance_inet_proto,
+ VAR_IGN_SRV_LOOKUP_ERR, DEF_IGN_SRV_LOOKUP_ERR, &var_ign_srv_lookup_err,
+ VAR_ALLOW_SRV_FALLBACK, DEF_ALLOW_SRV_FALLBACK, &var_allow_srv_fallback,
0,
};
diff --git a/src/smtp/smtp_session.c b/src/smtp/smtp_session.c
index 1b3a20e..3ac4ccc 100644
--- a/src/smtp/smtp_session.c
+++ b/src/smtp/smtp_session.c
@@ -129,6 +129,7 @@
#define SESS_ATTR_DEST "destination"
#define SESS_ATTR_HOST "host_name"
#define SESS_ATTR_ADDR "host_addr"
+#define SESS_ATTR_PORT "host_port"
#define SESS_ATTR_DEST_FEATURES "destination_features"
#define SESS_ATTR_TLS_LEVEL "tls_level"
@@ -258,6 +259,7 @@ int smtp_session_passivate(SMTP_SESSION *session, VSTRING *dest_prop,
SEND_ATTR_STR(SESS_ATTR_DEST, STR(iter->dest)),
SEND_ATTR_STR(SESS_ATTR_HOST, STR(iter->host)),
SEND_ATTR_STR(SESS_ATTR_ADDR, STR(iter->addr)),
+ SEND_ATTR_UINT(SESS_ATTR_PORT, iter->port),
SEND_ATTR_INT(SESS_ATTR_DEST_FEATURES,
session->features & SMTP_FEATURE_DESTINATION_MASK),
ATTR_TYPE_END) != 0
@@ -397,9 +399,10 @@ SMTP_SESSION *smtp_session_activate(int fd, SMTP_ITERATOR *iter,
RECV_ATTR_STR(SESS_ATTR_DEST, iter->dest),
RECV_ATTR_STR(SESS_ATTR_HOST, iter->host),
RECV_ATTR_STR(SESS_ATTR_ADDR, iter->addr),
+ RECV_ATTR_UINT(SESS_ATTR_PORT, &iter->port),
RECV_ATTR_INT(SESS_ATTR_DEST_FEATURES,
&dest_features),
- ATTR_TYPE_END) != 4
+ ATTR_TYPE_END) != 5
|| vstream_fclose(mp) != 0) {
msg_warn("smtp_session_passivate: bad cached dest properties");
SMTP_SESSION_ACTIVATE_ERR_RETURN();
diff --git a/src/smtpd/smtpd_check.c b/src/smtpd/smtpd_check.c
index 85d5944..a60e878 100644
--- a/src/smtpd/smtpd_check.c
+++ b/src/smtpd/smtpd_check.c
@@ -3056,8 +3056,8 @@ static int check_server_access(SMTPD_STATE *state, const char *table,
|| type == T_AAAA
#endif
) {
- server_list = dns_rr_create(domain, domain, T_MX, C_IN, 0, 0,
- domain, strlen(domain) + 1);
+ server_list = dns_rr_create_nopref(domain, domain, T_MX, C_IN, 0,
+ domain, strlen(domain) + 1);
} else {
dns_status = dns_lookup(domain, type, 0, &server_list,
(VSTRING *) 0, (VSTRING *) 0);
@@ -3065,8 +3065,8 @@ static int check_server_access(SMTPD_STATE *state, const char *table,
return (SMTPD_CHECK_DUNNO);
if (dns_status == DNS_NOTFOUND /* Not: h_errno == NO_DATA */ ) {
if (type == T_MX) {
- server_list = dns_rr_create(domain, domain, type, C_IN, 0, 0,
- domain, strlen(domain) + 1);
+ server_list = dns_rr_create_nopref(domain, domain, type, C_IN,
+ 0, domain, strlen(domain) + 1);
dns_status = DNS_OK;
} else if (type == T_NS /* && h_errno == NO_DATA */ ) {
while ((domain = strchr(domain, '.')) != 0 && domain[1]) {
diff --git a/src/util/attr.h b/src/util/attr.h
index dc6f9f7..a890a5b 100644
--- a/src/util/attr.h
+++ b/src/util/attr.h
@@ -61,6 +61,7 @@ typedef int (*ATTR_PRINT_SLAVE_FN) (ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *
* for documentation.
*/
#define SEND_ATTR_INT(name, val) ATTR_TYPE_INT, CHECK_CPTR(ATTR, char, (name)), CHECK_VAL(ATTR, int, (val))
+#define SEND_ATTR_UINT(name, val) ATTR_TYPE_INT, CHECK_CPTR(ATTR, char, (name)), CHECK_VAL(ATTR, unsigned, (val))
#define SEND_ATTR_STR(name, val) ATTR_TYPE_STR, CHECK_CPTR(ATTR, char, (name)), CHECK_CPTR(ATTR, char, (val))
#define SEND_ATTR_HASH(val) ATTR_TYPE_HASH, CHECK_CPTR(ATTR, HTABLE, (val))
#define SEND_ATTR_NV(val) ATTR_TYPE_NV, CHECK_CPTR(ATTR, NVTABLE, (val))
@@ -69,6 +70,7 @@ typedef int (*ATTR_PRINT_SLAVE_FN) (ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *
#define SEND_ATTR_FUNC(func, val) ATTR_TYPE_FUNC, CHECK_VAL(ATTR, ATTR_PRINT_SLAVE_FN, (func)), CHECK_CPTR(ATTR, void, (val))
#define RECV_ATTR_INT(name, val) ATTR_TYPE_INT, CHECK_CPTR(ATTR, char, (name)), CHECK_PTR(ATTR, int, (val))
+#define RECV_ATTR_UINT(name, val) ATTR_TYPE_INT, CHECK_CPTR(ATTR, char, (name)), CHECK_PTR(ATTR, unsigned, (val))
#define RECV_ATTR_STR(name, val) ATTR_TYPE_STR, CHECK_CPTR(ATTR, char, (name)), CHECK_PTR(ATTR, VSTRING, (val))
#define RECV_ATTR_HASH(val) ATTR_TYPE_HASH, CHECK_PTR(ATTR, HTABLE, (val))
#define RECV_ATTR_NV(val) ATTR_TYPE_NV, CHECK_PTR(ATTR, NVTABLE, (val))
@@ -79,9 +81,11 @@ typedef int (*ATTR_PRINT_SLAVE_FN) (ATTR_PRINT_MASTER_FN, VSTREAM *, int, void *
CHECK_VAL_HELPER_DCL(ATTR, ssize_t);
CHECK_VAL_HELPER_DCL(ATTR, long);
CHECK_VAL_HELPER_DCL(ATTR, int);
+CHECK_VAL_HELPER_DCL(ATTR, unsigned);
CHECK_PTR_HELPER_DCL(ATTR, void);
CHECK_PTR_HELPER_DCL(ATTR, long);
CHECK_PTR_HELPER_DCL(ATTR, int);
+CHECK_PTR_HELPER_DCL(ATTR, unsigned);
CHECK_PTR_HELPER_DCL(ATTR, VSTRING);
CHECK_PTR_HELPER_DCL(ATTR, NVTABLE);
CHECK_PTR_HELPER_DCL(ATTR, HTABLE);
Reference in New Issue View Git Blame Copy Permalink