--- a/src/dnsbl.cpp	Sat May 29 15:36:14 2004 -0700
+++ b/src/dnsbl.cpp	Sun May 30 16:17:44 2004 -0700
@@ -23,6 +23,8 @@
 recipients are rejected even if they would be whitelisted, and the
 data is rejected if sent.
 
+3) Add option to only allow one recipient if the return path is empty.
+
 */
 
 
@@ -113,6 +115,7 @@
 typedef map<char *, DNSBLLP, ltstr>       dnsbllp_map;
 typedef set<char *, ltstr>                string_set;
 typedef list<char *>                      string_list;
+typedef map<char *, int, ltstr>           ns_map;
 
 struct CONFIG {
     // the only mutable stuff once it has been loaded from the config file
@@ -178,6 +181,29 @@
 
 
 ////////////////////////////////////////////////
+// helper to discard the strings and objects held by an ns_map
+//
+static void discard(ns_map &s);
+static void discard(ns_map &s) {
+    for (ns_map::iterator i=s.begin(); i!=s.end(); i++) {
+        char *x = (*i).first;
+        free(x);
+    }
+    s.clear();
+}
+
+////////////////////////////////////////////////
+// helper to register a string in an ns_map
+//
+static void register_string(ns_map &s, char *name);
+static void register_string(ns_map &s, char *name) {
+    ns_map::iterator i = s.find(name);
+    if (i != s.end()) return;
+    char *x = strdup(name);
+    s[x] = 0;
+}
+
+////////////////////////////////////////////////
 // helper to discard the strings held by a string_set
 //
 static void discard(string_set &s);
@@ -379,8 +405,8 @@
 //  caller must ensure thread safety.
 //
 //
-static int dns_interface(char *question, bool maybe_ip);
-static int dns_interface(char *question, bool maybe_ip) {
+static int dns_interface(char *question, bool maybe_ip, ns_map *nameservers);
+static int dns_interface(char *question, bool maybe_ip, ns_map *nameservers) {
 #ifdef NS_PACKETSZ
     u_char answer[NS_PACKETSZ];
     int length = res_search(question, ns_c_in, ns_t_a, answer, sizeof(answer));
@@ -389,6 +415,51 @@
         ns_msg handle;
         ns_rr  rr;
         if (ns_initparse(answer, length, &handle) == 0) {
+            // look for ns names
+            if (nameservers) {
+                ns_map &ns = *nameservers;
+                int rrnum = 0;
+                while (ns_parserr(&handle, ns_s_ns, rrnum++, &rr) == 0) {
+                    if (ns_rr_type(rr) == ns_t_ns) {
+                        char nam[NS_MAXDNAME+1];
+                        char         *n = nam;
+                        const u_char *p = ns_rr_rdata(rr);
+                        while (((n-nam) < NS_MAXDNAME) && ((p-answer) < length) && *p) {
+                            size_t s = *(p++);
+                            if (s > 191) {
+                                // compression pointer
+                                s = (s-192)*256 + *(p++);
+                                if (s >= length) break; // pointer outside bounds of answer
+                                p = answer + s;
+                                s = *(p++);
+                            }
+                            if (s > 0) {
+                                if ((n-nam)    >= (NS_MAXDNAME-s)) break;  // destination would overflow name buffer
+                                if ((p-answer) >= (length-s))      break;  // source outside bounds of answer
+                                memcpy(n, p, s);
+                                n += s;
+                                p += s;
+                                *(n++) = '.';
+                            }
+                        }
+                        *(--n) = '\0';              // remove trailing .
+                        register_string(ns, nam);   // ns host to lookup later
+                    }
+                }
+                rrnum = 0;
+                while (ns_parserr(&handle, ns_s_ar, rrnum++, &rr) == 0) {
+                    if (ns_rr_type(rr) == ns_t_a) {
+                        char* nam = (char*)ns_rr_name(rr);
+                        ns_map::iterator i = ns.find(nam);
+                        if (i != ns.end()) {
+                            // we want this ip address
+                            int address;
+                            memcpy(&address, ns_rr_rdata(rr), sizeof(address));
+                            ns[nam] = address;
+                        }
+                    }
+                }
+            }
             int rrnum = 0;
             while (ns_parserr(&handle, ns_s_an, rrnum++, &rr) == 0) {
                 if (ns_rr_type(rr) == ns_t_a) {
@@ -417,11 +488,11 @@
 #endif
 }
 
-static int protected_dns_interface(char *question, bool maybe_ip);
-static int protected_dns_interface(char *question, bool maybe_ip) {
+static int protected_dns_interface(char *question, bool maybe_ip, ns_map *nameservers);
+static int protected_dns_interface(char *question, bool maybe_ip, ns_map *nameservers) {
     int ans;
     pthread_mutex_lock(&resolve_mutex);
-        ans = dns_interface(question, maybe_ip);
+        ans = dns_interface(question, maybe_ip, nameservers);
     pthread_mutex_unlock(&resolve_mutex);
     return ans;
 
@@ -442,7 +513,7 @@
 #endif
     snprintf(question, sizeof(question), "%u.%u.%u.%u.%s.", src[3], src[2], src[1], src[0], suffix);
     // ask the question, if we get an A record it implies a blacklisted ip address
-    return (protected_dns_interface(question, false)) ? reject : oksofar;
+    return (protected_dns_interface(question, false, NULL)) ? reject : oksofar;
 }
 
 
@@ -491,12 +562,16 @@
     CONFIG     &dc   = *priv.pc;
     if (!dc.content_suffix) return oksofar;
     int count = 0;
+    ns_map nameservers;
+    int lim = priv.pc->host_limit;
     for (string_set::iterator i=priv.memory->hosts.begin(); i!=priv.memory->hosts.end(); i++) {
         count++;
-        int lim = priv.pc->host_limit;
-        if ((count > lim) && (lim > 0)) return reject_host;
+        if ((count > lim) && (lim > 0)) {
+            discard(nameservers);
+            return reject_host;
+        }
         host = *i;
-        ip   = protected_dns_interface(host, true);
+        ip   = protected_dns_interface(host, true, &nameservers);
         if (debug_syslog) {
             char buf[200];
             if (ip) {
@@ -512,13 +587,48 @@
         }
         if (ip) {
             status st = check_single(ip, dc.content_suffix);
-            if (st == reject) return st;
+            if (st == reject) {
+                discard(nameservers);
+                return st;
+            }
         }
     }
+    lim *= 4;   // allow average of 3 ns per host name
+    for (ns_map::iterator i=nameservers.begin(); i!=nameservers.end(); i++) {
+        count++;
+        if ((count > lim) && (lim > 0)) {
+            discard(nameservers);
+            return reject_host;
+        }
+        host = (*i).first;
+        ip   = (*i).second;
+        if (!ip) ip = protected_dns_interface(host, false, NULL);
+        if (debug_syslog) {
+            char buf[200];
+            if (ip) {
+                char adr[sizeof "255.255.255.255"];
+                adr[0] = '\0';
+                inet_ntop(AF_INET, (const u_char *)&ip, adr, sizeof(adr));
+                snprintf(buf, sizeof(buf), "ns %s found at %s", host, adr);
+            }
+            else {
+                snprintf(buf, sizeof(buf), "ns %s not found", host);
+            }
+            my_syslog(buf);
+        }
+        if (ip) {
+            status st = check_single(ip, dc.content_suffix);
+            if (st == reject) {
+                discard(nameservers);
+                return st;
+            }
+        }
+    }
+    discard(nameservers);
     host = NULL;
     int bin = priv.memory->binary_tags;
     int bad = priv.memory->bad_html_tags;
-    int lim = priv.pc->tag_limit;
+    lim = priv.pc->tag_limit;
     if (bin > bad) return oksofar;  // probably .zip or .tar.gz with random content
     if ((bad > lim) && (lim > 0)) return reject_tag;
     return oksofar;