1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Functions concerned with verifying things. The original code for callout
9 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
13 #include "transports/smtp.h"
15 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
17 static smtp_outblock ctblock
;
18 uschar ctbuffer
[8192];
21 /* Structure for caching DNSBL lookups */
23 typedef struct dnsbl_cache_block
{
32 /* Anchor for DNSBL cache */
34 static tree_node
*dnsbl_cache
= NULL
;
37 /* Bits for match_type in one_check_dnsbl() */
42 static uschar
cutthrough_response(char, uschar
**, int);
46 /*************************************************
47 * Retrieve a callout cache record *
48 *************************************************/
50 /* If a record exists, check whether it has expired.
53 dbm_file an open hints file
55 type "address" or "domain"
56 positive_expire expire time for positive records
57 negative_expire expire time for negative records
59 Returns: the cache record if a non-expired one exists, else NULL
62 static dbdata_callout_cache
*
63 get_callout_cache_record(open_db
*dbm_file
, const uschar
*key
, uschar
*type
,
64 int positive_expire
, int negative_expire
)
69 dbdata_callout_cache
*cache_record
;
71 cache_record
= dbfn_read_with_length(dbm_file
, key
, &length
);
73 if (cache_record
== NULL
)
75 HDEBUG(D_verify
) debug_printf("callout cache: no %s record found for %s\n", type
, key
);
79 /* We treat a record as "negative" if its result field is not positive, or if
80 it is a domain record and the postmaster field is negative. */
82 negative
= cache_record
->result
!= ccache_accept
||
83 (type
[0] == 'd' && cache_record
->postmaster_result
== ccache_reject
);
84 expire
= negative
? negative_expire
: positive_expire
;
87 if (now
- cache_record
->time_stamp
> expire
)
89 HDEBUG(D_verify
) debug_printf("callout cache: %s record expired for %s\n", type
, key
);
93 /* If this is a non-reject domain record, check for the obsolete format version
94 that doesn't have the postmaster and random timestamps, by looking at the
95 length. If so, copy it to a new-style block, replicating the record's
96 timestamp. Then check the additional timestamps. (There's no point wasting
97 effort if connections are rejected.) */
99 if (type
[0] == 'd' && cache_record
->result
!= ccache_reject
)
101 if (length
== sizeof(dbdata_callout_cache_obs
))
103 dbdata_callout_cache
*new = store_get(sizeof(dbdata_callout_cache
));
104 memcpy(new, cache_record
, length
);
105 new->postmaster_stamp
= new->random_stamp
= new->time_stamp
;
109 if (now
- cache_record
->postmaster_stamp
> expire
)
110 cache_record
->postmaster_result
= ccache_unknown
;
112 if (now
- cache_record
->random_stamp
> expire
)
113 cache_record
->random_result
= ccache_unknown
;
116 HDEBUG(D_verify
) debug_printf("callout cache: found %s record for %s\n", type
, key
);
122 /*************************************************
123 * Do callout verification for an address *
124 *************************************************/
126 /* This function is called from verify_address() when the address has routed to
127 a host list, and a callout has been requested. Callouts are expensive; that is
128 why a cache is used to improve the efficiency.
131 addr the address that's been routed
132 host_list the list of hosts to try
133 tf the transport feedback block
135 ifstring "interface" option from transport, or NULL
136 portstring "port" option from transport, or NULL
137 protocolstring "protocol" option from transport, or NULL
138 callout the per-command callout timeout
139 callout_overall the overall callout timeout (if < 0 use 4*callout)
140 callout_connect the callout connection timeout (if < 0 use callout)
141 options the verification options - these bits are used:
142 vopt_is_recipient => this is a recipient address
143 vopt_callout_no_cache => don't use callout cache
144 vopt_callout_fullpm => if postmaster check, do full one
145 vopt_callout_random => do the "random" thing
146 vopt_callout_recipsender => use real sender for recipient
147 vopt_callout_recippmaster => use postmaster for recipient
148 se_mailfrom MAIL FROM address for sender verify; NULL => ""
149 pm_mailfrom if non-NULL, do the postmaster check with this sender
151 Returns: OK/FAIL/DEFER
155 do_callout(address_item
*addr
, host_item
*host_list
, transport_feedback
*tf
,
156 int callout
, int callout_overall
, int callout_connect
, int options
,
157 uschar
*se_mailfrom
, uschar
*pm_mailfrom
)
160 int old_domain_cache_result
= ccache_accept
;
163 uschar
*from_address
;
164 uschar
*random_local_part
= NULL
;
165 const uschar
*save_deliver_domain
= deliver_domain
;
166 uschar
**failure_ptr
= options
& vopt_is_recipient
167 ? &recipient_verify_failure
: &sender_verify_failure
;
169 open_db
*dbm_file
= NULL
;
170 dbdata_callout_cache new_domain_record
;
171 dbdata_callout_cache_address new_address_record
;
173 time_t callout_start_time
;
175 new_domain_record
.result
= ccache_unknown
;
176 new_domain_record
.postmaster_result
= ccache_unknown
;
177 new_domain_record
.random_result
= ccache_unknown
;
179 memset(&new_address_record
, 0, sizeof(new_address_record
));
181 /* For a recipient callout, the key used for the address cache record must
182 include the sender address if we are using the real sender in the callout,
183 because that may influence the result of the callout. */
185 address_key
= addr
->address
;
188 if (options
& vopt_is_recipient
)
190 if (options
& vopt_callout_recipsender
)
192 address_key
= string_sprintf("%s/<%s>", addr
->address
, sender_address
);
193 from_address
= sender_address
;
194 if (cutthrough
.delivery
) options
|= vopt_callout_no_cache
;
196 else if (options
& vopt_callout_recippmaster
)
198 address_key
= string_sprintf("%s/<postmaster@%s>", addr
->address
,
199 qualify_domain_sender
);
200 from_address
= string_sprintf("postmaster@%s", qualify_domain_sender
);
204 /* For a sender callout, we must adjust the key if the mailfrom address is not
209 from_address
= (se_mailfrom
== NULL
)? US
"" : se_mailfrom
;
210 if (from_address
[0] != 0)
211 address_key
= string_sprintf("%s/<%s>", addr
->address
, from_address
);
214 /* Open the callout cache database, it it exists, for reading only at this
215 stage, unless caching has been disabled. */
217 if (options
& vopt_callout_no_cache
)
219 HDEBUG(D_verify
) debug_printf("callout cache: disabled by no_cache\n");
221 else if ((dbm_file
= dbfn_open(US
"callout", O_RDWR
, &dbblock
, FALSE
)) == NULL
)
223 HDEBUG(D_verify
) debug_printf("callout cache: not available\n");
226 /* If a cache database is available see if we can avoid the need to do an
227 actual callout by making use of previously-obtained data. */
231 dbdata_callout_cache_address
*cache_address_record
;
232 dbdata_callout_cache
*cache_record
= get_callout_cache_record(dbm_file
,
233 addr
->domain
, US
"domain",
234 callout_cache_domain_positive_expire
,
235 callout_cache_domain_negative_expire
);
237 /* If an unexpired cache record was found for this domain, see if the callout
238 process can be short-circuited. */
242 /* In most cases, if an early command (up to and including MAIL FROM:<>)
243 was rejected, there is no point carrying on. The callout fails. However, if
244 we are doing a recipient verification with use_sender or use_postmaster
245 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
246 will be using a non-empty sender. We have to remember this situation so as
247 not to disturb the cached domain value if this whole verification succeeds
248 (we don't want it turning into "accept"). */
250 old_domain_cache_result
= cache_record
->result
;
252 if (cache_record
->result
== ccache_reject
||
253 (*from_address
== 0 && cache_record
->result
== ccache_reject_mfnull
))
255 setflag(addr
, af_verify_nsfail
);
257 debug_printf("callout cache: domain gave initial rejection, or "
258 "does not accept HELO or MAIL FROM:<>\n");
259 setflag(addr
, af_verify_nsfail
);
260 addr
->user_message
= US
"(result of an earlier callout reused).";
262 *failure_ptr
= US
"mail";
266 /* If a previous check on a "random" local part was accepted, we assume
267 that the server does not do any checking on local parts. There is therefore
268 no point in doing the callout, because it will always be successful. If a
269 random check previously failed, arrange not to do it again, but preserve
270 the data in the new record. If a random check is required but hasn't been
271 done, skip the remaining cache processing. */
273 if (options
& vopt_callout_random
) switch(cache_record
->random_result
)
277 debug_printf("callout cache: domain accepts random addresses\n");
278 goto END_CALLOUT
; /* Default yield is OK */
282 debug_printf("callout cache: domain rejects random addresses\n");
283 options
&= ~vopt_callout_random
;
284 new_domain_record
.random_result
= ccache_reject
;
285 new_domain_record
.random_stamp
= cache_record
->random_stamp
;
290 debug_printf("callout cache: need to check random address handling "
291 "(not cached or cache expired)\n");
295 /* If a postmaster check is requested, but there was a previous failure,
296 there is again no point in carrying on. If a postmaster check is required,
297 but has not been done before, we are going to have to do a callout, so skip
298 remaining cache processing. */
302 if (cache_record
->postmaster_result
== ccache_reject
)
304 setflag(addr
, af_verify_pmfail
);
306 debug_printf("callout cache: domain does not accept "
307 "RCPT TO:<postmaster@domain>\n");
309 *failure_ptr
= US
"postmaster";
310 setflag(addr
, af_verify_pmfail
);
311 addr
->user_message
= US
"(result of earlier verification reused).";
314 if (cache_record
->postmaster_result
== ccache_unknown
)
317 debug_printf("callout cache: need to check RCPT "
318 "TO:<postmaster@domain> (not cached or cache expired)\n");
322 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
323 postmaster check if the address itself has to be checked. Also ensure
324 that the value in the cache record is preserved (with its old timestamp).
327 HDEBUG(D_verify
) debug_printf("callout cache: domain accepts RCPT "
328 "TO:<postmaster@domain>\n");
330 new_domain_record
.postmaster_result
= ccache_accept
;
331 new_domain_record
.postmaster_stamp
= cache_record
->postmaster_stamp
;
335 /* We can't give a result based on information about the domain. See if there
336 is an unexpired cache record for this specific address (combined with the
337 sender address if we are doing a recipient callout with a non-empty sender).
340 cache_address_record
= (dbdata_callout_cache_address
*)
341 get_callout_cache_record(dbm_file
,
342 address_key
, US
"address",
343 callout_cache_positive_expire
,
344 callout_cache_negative_expire
);
346 if (cache_address_record
)
348 if (cache_address_record
->result
== ccache_accept
)
351 debug_printf("callout cache: address record is positive\n");
356 debug_printf("callout cache: address record is negative\n");
357 addr
->user_message
= US
"Previous (cached) callout verification failure";
358 *failure_ptr
= US
"recipient";
364 /* Close the cache database while we actually do the callout for real. */
367 dbfn_close(dbm_file
);
371 if (!addr
->transport
)
373 HDEBUG(D_verify
) debug_printf("cannot callout via null transport\n");
375 else if (Ustrcmp(addr
->transport
->driver_name
, "smtp") != 0)
376 log_write(0, LOG_MAIN
|LOG_PANIC
|LOG_CONFIG_FOR
, "callout transport '%s': %s is non-smtp",
377 addr
->transport
->name
, addr
->transport
->driver_name
);
380 smtp_transport_options_block
*ob
=
381 (smtp_transport_options_block
*)addr
->transport
->options_block
;
383 /* The information wasn't available in the cache, so we have to do a real
384 callout and save the result in the cache for next time, unless no_cache is set,
385 or unless we have a previously cached negative random result. If we are to test
386 with a random local part, ensure that such a local part is available. If not,
387 log the fact, but carry on without randomising. */
389 if (options
& vopt_callout_random
&& callout_random_local_part
!= NULL
)
390 if (!(random_local_part
= expand_string(callout_random_local_part
)))
391 log_write(0, LOG_MAIN
|LOG_PANIC
, "failed to expand "
392 "callout_random_local_part: %s", expand_string_message
);
394 /* Default the connect and overall callout timeouts if not set, and record the
395 time we are starting so that we can enforce it. */
397 if (callout_overall
< 0) callout_overall
= 4 * callout
;
398 if (callout_connect
< 0) callout_connect
= callout
;
399 callout_start_time
= time(NULL
);
401 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
402 output because a callout might take some time. When PIPELINING is active and
403 there are many recipients, the total time for doing lots of callouts can add up
404 and cause the client to time out. So in this case we forgo the PIPELINING
407 if (smtp_out
&& !disable_callout_flush
) mac_smtp_fflush();
409 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
410 and we are holding a cutthrough conn open, we can just append the rcpt to
411 that conn for verification purposes (and later delivery also). Simplest
412 coding means skipping this whole loop and doing the append separately.
414 We will need to remember it has been appended so that rcpt-acl tail code
415 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
418 /* Can we re-use an open cutthrough connection? */
419 if ( cutthrough
.fd
>= 0
420 && (options
& (vopt_callout_recipsender
| vopt_callout_recippmaster
))
421 == vopt_callout_recipsender
422 && !random_local_part
426 if (addr
->transport
== cutthrough
.addr
.transport
)
427 for (host
= host_list
; host
; host
= host
->next
)
428 if (Ustrcmp(host
->address
, cutthrough
.host
.address
) == 0)
431 uschar
*interface
= NULL
; /* Outgoing interface to use; NULL => any */
434 deliver_host
= host
->name
;
435 deliver_host_address
= host
->address
;
436 deliver_host_port
= host
->port
;
437 deliver_domain
= addr
->domain
;
438 transport_name
= addr
->transport
->name
;
440 host_af
= (Ustrchr(host
->address
, ':') == NULL
)? AF_INET
:AF_INET6
;
442 if (!smtp_get_interface(tf
->interface
, host_af
, addr
, &interface
,
444 !smtp_get_port(tf
->port
, addr
, &port
, US
"callout"))
445 log_write(0, LOG_MAIN
|LOG_PANIC
, "<%s>: %s", addr
->address
,
448 if ( ( interface
== cutthrough
.interface
450 && cutthrough
.interface
451 && Ustrcmp(interface
, cutthrough
.interface
) == 0
453 && port
== cutthrough
.host
.port
456 uschar
* resp
= NULL
;
458 /* Match! Send the RCPT TO, append the addr, set done */
460 smtp_write_command(&ctblock
, FALSE
, "RCPT TO:<%.1000s>\r\n",
461 transport_rcpt_address(addr
,
462 (addr
->transport
== NULL
)? FALSE
:
463 addr
->transport
->rcpt_include_affixes
)) >= 0 &&
464 cutthrough_response('2', &resp
, CUTTHROUGH_DATA_TIMEOUT
) == '2';
466 /* This would go horribly wrong if a callout fail was ignored by ACL.
467 We punt by abandoning cutthrough on a reject, like the
472 address_item
* na
= store_get(sizeof(address_item
));
473 *na
= cutthrough
.addr
;
474 cutthrough
.addr
= *addr
;
475 cutthrough
.addr
.host_used
= &cutthrough
.host
;
476 cutthrough
.addr
.next
= na
;
482 cancel_cutthrough_connection("recipient rejected");
483 if (!resp
|| errno
== ETIMEDOUT
)
485 HDEBUG(D_verify
) debug_printf("SMTP timeout\n");
490 Ustrcpy(resp
, US
"connection dropped");
493 string_sprintf("response to \"%s\" from %s [%s] was: %s",
494 big_buffer
, host
->name
, host
->address
,
495 string_printing(resp
));
498 string_sprintf("Callout verification failed:\n%s", resp
);
500 /* Hard rejection ends the process */
502 if (resp
[0] == '5') /* Address rejected */
510 break; /* host_list */
513 cancel_cutthrough_connection("incompatible connection");
516 /* Now make connections to the hosts and do real callouts. The list of hosts
517 is passed in as an argument. */
519 for (host
= host_list
; host
&& !done
; host
= host
->next
)
523 uschar
*interface
= NULL
; /* Outgoing interface to use; NULL => any */
525 uschar responsebuffer
[4096];
527 clearflag(addr
, af_verify_pmfail
); /* postmaster callout flag */
528 clearflag(addr
, af_verify_nsfail
); /* null sender callout flag */
530 /* Skip this host if we don't have an IP address for it. */
534 DEBUG(D_verify
) debug_printf("no IP address for host name %s: skipping\n",
539 /* Check the overall callout timeout */
541 if (time(NULL
) - callout_start_time
>= callout_overall
)
543 HDEBUG(D_verify
) debug_printf("overall timeout for callout exceeded\n");
547 /* Set IPv4 or IPv6 */
549 host_af
= Ustrchr(host
->address
, ':') == NULL
? AF_INET
: AF_INET6
;
551 /* Expand and interpret the interface and port strings. The latter will not
552 be used if there is a host-specific port (e.g. from a manualroute router).
553 This has to be delayed till now, because they may expand differently for
554 different hosts. If there's a failure, log it, but carry on with the
557 deliver_host
= host
->name
;
558 deliver_host_address
= host
->address
;
559 deliver_host_port
= host
->port
;
560 deliver_domain
= addr
->domain
;
561 transport_name
= addr
->transport
->name
;
563 if ( !smtp_get_interface(tf
->interface
, host_af
, addr
, &interface
,
565 || !smtp_get_port(tf
->port
, addr
, &port
, US
"callout")
567 log_write(0, LOG_MAIN
|LOG_PANIC
, "<%s>: %s", addr
->address
,
572 sx
.host_af
= host_af
,
574 sx
.interface
= interface
;
575 sx
.helo_data
= tf
->helo_data
;
576 sx
.tblock
= addr
->transport
;
578 tls_retry_connection
:
579 /* Set the address state so that errors are recorded in it */
581 addr
->transport_return
= PENDING_DEFER
;
582 ob
->connect_timeout
= callout_connect
;
583 ob
->command_timeout
= callout
;
585 /* Get the channel set up ready for a message (MAIL FROM being the next
586 SMTP command to send. If we tried TLS but it failed, try again without
589 if ( (yield
= smtp_setup_conn(&sx
, FALSE
, TRUE
)) == DEFER
590 && addr
->basic_errno
== ERRNO_TLSFAILURE
591 && ob
->tls_tempfail_tryclear
592 && verify_check_given_host(&ob
->hosts_require_tls
, host
) != OK
595 log_write(0, LOG_MAIN
, "TLS session failure:"
596 " callout unencrypted to %s [%s] (not in hosts_require_tls)",
597 host
->name
, host
->address
);
598 yield
= smtp_setup_conn(&sx
, TRUE
, TRUE
);
602 if (addr
->message
) addr
->message
= string_sprintf("%s [%s] %s",
603 host
->name
, host
->address
, addr
->message
);
604 errno
= addr
->basic_errno
;
605 transport_name
= NULL
;
606 deliver_host
= deliver_host_address
= NULL
;
607 deliver_domain
= save_deliver_domain
;
609 /* Failure to accept HELO is cached; this blocks the whole domain for all
610 senders. I/O errors and defer responses are not cached. */
612 if (yield
== FAIL
&& (errno
== 0 || errno
== ERRNO_SMTPCLOSED
))
614 setflag(addr
, af_verify_nsfail
);
615 new_domain_record
.result
= ccache_reject
;
623 /* If we needed to authenticate, smtp_setup_conn() did that. Copy
624 the AUTH info for logging */
626 addr
->authenticator
= client_authenticator
;
627 addr
->auth_id
= client_authenticated_id
;
629 /* Build a mail-AUTH string (re-using responsebuffer for convenience */
632 !smtp_mail_auth_str(responsebuffer
, sizeof(responsebuffer
), addr
, ob
)
634 (addr
->auth_sndr
= client_authenticated_sender
),
636 /* Send the MAIL command */
638 (smtp_write_command(&sx
.outblock
, FALSE
,
640 addr
->prop
.utf8_msg
&& !addr
->prop
.utf8_downcvt
641 ? "MAIL FROM:<%s>%s%s SMTPUTF8\r\n"
644 "MAIL FROM:<%s>%s%s\r\n",
647 options
& vopt_is_recipient
&& sx
.peer_offered
& PEER_OFFERED_SIZE
648 ? string_sprintf(" SIZE=%d", message_size
+ ob
->size_addition
)
654 && smtp_read_response(&sx
.inblock
, responsebuffer
, sizeof(responsebuffer
),
657 deliver_host
= deliver_host_address
= NULL
;
658 deliver_domain
= save_deliver_domain
;
660 /* If the host does not accept MAIL FROM:<>, arrange to cache this
661 information, but again, don't record anything for an I/O error or a defer. Do
662 not cache rejections of MAIL when a non-empty sender has been used, because
663 that blocks the whole domain for all senders. */
667 *failure_ptr
= US
"mail"; /* At or before MAIL */
668 if (errno
== 0 && responsebuffer
[0] == '5')
670 setflag(addr
, af_verify_nsfail
);
671 if (from_address
[0] == 0)
672 new_domain_record
.result
= ccache_reject_mfnull
;
676 /* Otherwise, proceed to check a "random" address (if required), then the
677 given address, and the postmaster address (if required). Between each check,
678 issue RSET, because some servers accept only one recipient after MAIL
681 Before doing this, set the result in the domain cache record to "accept",
682 unless its previous value was ccache_reject_mfnull. In that case, the domain
683 rejects MAIL FROM:<> and we want to continue to remember that. When that is
684 the case, we have got here only in the case of a recipient verification with
685 a non-null sender. */
689 const uschar
* rcpt_domain
= addr
->domain
;
692 uschar
* errstr
= NULL
;
693 if ( testflag(addr
, af_utf8_downcvt
)
694 && (rcpt_domain
= string_domain_utf8_to_alabel(rcpt_domain
,
698 addr
->message
= errstr
;
699 errno
= ERRNO_EXPANDFAIL
;
700 setflag(addr
, af_verify_nsfail
);
702 rcpt_domain
= US
""; /*XXX errorhandling! */
706 new_domain_record
.result
=
707 (old_domain_cache_result
== ccache_reject_mfnull
)?
708 ccache_reject_mfnull
: ccache_accept
;
710 /* Do the random local part check first */
712 if (random_local_part
!= NULL
)
714 uschar randombuffer
[1024];
716 smtp_write_command(&sx
.outblock
, FALSE
,
717 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part
,
719 smtp_read_response(&sx
.inblock
, randombuffer
,
720 sizeof(randombuffer
), '2', callout
);
722 /* Remember when we last did a random test */
724 new_domain_record
.random_stamp
= time(NULL
);
726 /* If accepted, we aren't going to do any further tests below. */
729 new_domain_record
.random_result
= ccache_accept
;
731 /* Otherwise, cache a real negative response, and get back to the right
732 state to send RCPT. Unless there's some problem such as a dropped
733 connection, we expect to succeed, because the commands succeeded above.
734 However, some servers drop the connection after responding to an
735 invalid recipient, so on (any) error we drop and remake the connection.
740 /* This would be ok for 1st rcpt a cutthrough, but no way to
741 handle a subsequent. So refuse to support any */
742 cancel_cutthrough_connection("random-recipient");
744 if (randombuffer
[0] == '5')
745 new_domain_record
.random_result
= ccache_reject
;
748 smtp_write_command(&sx
.outblock
, FALSE
, "RSET\r\n") >= 0 &&
749 smtp_read_response(&sx
.inblock
, responsebuffer
, sizeof(responsebuffer
),
752 smtp_write_command(&sx
.outblock
, FALSE
,
754 addr
->prop
.utf8_msg
&& !addr
->prop
.utf8_downcvt
755 ? "MAIL FROM:<%s> SMTPUTF8\r\n"
758 "MAIL FROM:<%s>\r\n",
759 from_address
) >= 0 &&
760 smtp_read_response(&sx
.inblock
, responsebuffer
, sizeof(responsebuffer
),
766 debug_printf("problem after random/rset/mfrom; reopen conn\n");
767 random_local_part
= NULL
;
769 tls_close(FALSE
, TRUE
);
771 HDEBUG(D_transport
|D_acl
|D_v
) debug_printf(" SMTP(close)>>\n");
772 (void)close(sx
.inblock
.sock
);
773 #ifndef DISABLE_EVENT
774 (void) event_raise(addr
->transport
->event_action
,
775 US
"tcp:close", NULL
);
777 goto tls_retry_connection
;
780 else done
= FALSE
; /* Some timeout/connection problem */
783 /* If the host is accepting all local parts, as determined by the "random"
784 check, we don't need to waste time doing any further checking. */
786 if (new_domain_record
.random_result
!= ccache_accept
&& done
)
788 /* Get the rcpt_include_affixes flag from the transport if there is one,
789 but assume FALSE if there is not. */
791 uschar
* rcpt
= transport_rcpt_address(addr
,
792 addr
->transport
? addr
->transport
->rcpt_include_affixes
: FALSE
);
795 /*XXX should the conversion be moved into transport_rcpt_address() ? */
796 if ( testflag(addr
, af_utf8_downcvt
)
797 && !(rcpt
= string_address_utf8_to_alabel(rcpt
, NULL
))
800 errno
= ERRNO_EXPANDFAIL
;
801 *failure_ptr
= US
"recipient";
808 smtp_write_command(&sx
.outblock
, FALSE
, "RCPT TO:<%.1000s>\r\n",
810 smtp_read_response(&sx
.inblock
, responsebuffer
, sizeof(responsebuffer
),
814 new_address_record
.result
= ccache_accept
;
815 else if (errno
== 0 && responsebuffer
[0] == '5')
817 *failure_ptr
= US
"recipient";
818 new_address_record
.result
= ccache_reject
;
821 /* Do postmaster check if requested; if a full check is required, we
822 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
824 if (done
&& pm_mailfrom
)
826 /* Could possibly shift before main verify, just above, and be ok
827 for cutthrough. But no way to handle a subsequent rcpt, so just
829 cancel_cutthrough_connection("postmaster verify");
830 HDEBUG(D_acl
|D_v
) debug_printf("Cutthrough cancelled by presence of postmaster verify\n");
833 smtp_write_command(&sx
.outblock
, FALSE
, "RSET\r\n") >= 0 &&
834 smtp_read_response(&sx
.inblock
, responsebuffer
,
835 sizeof(responsebuffer
), '2', callout
) &&
837 smtp_write_command(&sx
.outblock
, FALSE
,
838 "MAIL FROM:<%s>\r\n", pm_mailfrom
) >= 0 &&
839 smtp_read_response(&sx
.inblock
, responsebuffer
,
840 sizeof(responsebuffer
), '2', callout
) &&
842 /* First try using the current domain */
845 smtp_write_command(&sx
.outblock
, FALSE
,
846 "RCPT TO:<postmaster@%.1000s>\r\n", rcpt_domain
) >= 0 &&
847 smtp_read_response(&sx
.inblock
, responsebuffer
,
848 sizeof(responsebuffer
), '2', callout
)
853 /* If that doesn't work, and a full check is requested,
854 try without the domain. */
857 (options
& vopt_callout_fullpm
) != 0 &&
858 smtp_write_command(&sx
.outblock
, FALSE
,
859 "RCPT TO:<postmaster>\r\n") >= 0 &&
860 smtp_read_response(&sx
.inblock
, responsebuffer
,
861 sizeof(responsebuffer
), '2', callout
)
864 /* Sort out the cache record */
866 new_domain_record
.postmaster_stamp
= time(NULL
);
869 new_domain_record
.postmaster_result
= ccache_accept
;
870 else if (errno
== 0 && responsebuffer
[0] == '5')
872 *failure_ptr
= US
"postmaster";
873 setflag(addr
, af_verify_pmfail
);
874 new_domain_record
.postmaster_result
= ccache_reject
;
877 } /* Random not accepted */
878 } /* MAIL FROM: accepted */
880 /* For any failure of the main check, other than a negative response, we just
881 close the connection and carry on. We can identify a negative response by the
882 fact that errno is zero. For I/O errors it will be non-zero
884 Set up different error texts for logging and for sending back to the caller
885 as an SMTP response. Log in all cases, using a one-line format. For sender
886 callouts, give a full response to the caller, but for recipient callouts,
887 don't give the IP address because this may be an internal host whose identity
888 is not to be widely broadcast. */
891 if (!done
) switch(errno
)
894 HDEBUG(D_verify
) debug_printf("SMTP timeout\n");
895 sx
.send_quit
= FALSE
;
901 extern int acl_where
; /* src/acl.c */
903 addr
->message
= string_sprintf(
904 "response to \"EHLO\" from %s [%s] did not include SMTPUTF8",
905 host
->name
, host
->address
);
906 addr
->user_message
= acl_where
== ACL_WHERE_RCPT
907 ? US
"533 no support for internationalised mailbox name"
908 : US
"550 mailbox unavailable";
915 sx
.send_quit
= FALSE
;
919 if (*responsebuffer
== 0) Ustrcpy(responsebuffer
, US
"connection dropped");
922 string_sprintf("response to \"%s\" from %s [%s] was: %s",
923 big_buffer
, host
->name
, host
->address
,
924 string_printing(responsebuffer
));
926 addr
->user_message
= options
& vopt_is_recipient
927 ? string_sprintf("Callout verification failed:\n%s", responsebuffer
)
928 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
929 host
->address
, big_buffer
, responsebuffer
);
931 /* Hard rejection ends the process */
933 if (responsebuffer
[0] == '5') /* Address rejected */
941 /* End the SMTP conversation and close the connection. */
943 /* Cutthrough - on a successful connect and recipient-verify with
944 use-sender and we are 1st rcpt and have no cutthrough conn so far
945 here is where we want to leave the conn open */
946 if ( cutthrough
.delivery
950 && (options
& (vopt_callout_recipsender
|vopt_callout_recippmaster
|vopt_success_on_redirect
))
951 == vopt_callout_recipsender
952 && !random_local_part
958 HDEBUG(D_acl
|D_v
) debug_printf("holding verify callout open for cutthrough delivery\n");
960 cutthrough
.fd
= sx
.outblock
.sock
; /* We assume no buffer in use in the outblock */
961 cutthrough
.nrcpt
= 1;
962 cutthrough
.interface
= interface
;
963 cutthrough
.host
= *host
;
964 cutthrough
.addr
= *addr
; /* Save the address_item for later logging */
965 cutthrough
.addr
.next
= NULL
;
966 cutthrough
.addr
.host_used
= &cutthrough
.host
;
968 *(cutthrough
.addr
.parent
= store_get(sizeof(address_item
))) =
970 ctblock
.buffer
= ctbuffer
;
971 ctblock
.buffersize
= sizeof(ctbuffer
);
972 ctblock
.ptr
= ctbuffer
;
973 /* ctblock.cmd_count = 0; ctblock.authenticating = FALSE; */
974 ctblock
.sock
= cutthrough
.fd
;
978 /* Ensure no cutthrough on multiple address verifies */
979 if (options
& vopt_callout_recipsender
)
980 cancel_cutthrough_connection("not usable for cutthrough");
983 (void) smtp_write_command(&sx
.outblock
, FALSE
, "QUIT\r\n");
985 /* Wait a short time for response, and discard it */
986 smtp_read_response(&sx
.inblock
, responsebuffer
, sizeof(responsebuffer
),
990 if (sx
.inblock
.sock
>= 0)
993 tls_close(FALSE
, TRUE
);
995 HDEBUG(D_transport
|D_acl
|D_v
) debug_printf(" SMTP(close)>>\n");
996 (void)close(sx
.inblock
.sock
);
997 sx
.inblock
.sock
= sx
.outblock
.sock
= -1;
998 #ifndef DISABLE_EVENT
999 (void) event_raise(addr
->transport
->event_action
, US
"tcp:close", NULL
);
1004 } /* Loop through all hosts, while !done */
1007 /* If we get here with done == TRUE, a successful callout happened, and yield
1008 will be set OK or FAIL according to the response to the RCPT command.
1009 Otherwise, we looped through the hosts but couldn't complete the business.
1010 However, there may be domain-specific information to cache in both cases.
1012 The value of the result field in the new_domain record is ccache_unknown if
1013 there was an error before or with MAIL FROM:, and errno was not zero,
1014 implying some kind of I/O error. We don't want to write the cache in that case.
1015 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
1017 if ( !(options
& vopt_callout_no_cache
)
1018 && new_domain_record
.result
!= ccache_unknown
)
1020 if ((dbm_file
= dbfn_open(US
"callout", O_RDWR
|O_CREAT
, &dbblock
, FALSE
))
1023 HDEBUG(D_verify
) debug_printf("callout cache: not available\n");
1027 (void)dbfn_write(dbm_file
, addr
->domain
, &new_domain_record
,
1028 (int)sizeof(dbdata_callout_cache
));
1029 HDEBUG(D_verify
) debug_printf("wrote callout cache domain record for %s:\n"
1030 " result=%d postmaster=%d random=%d\n",
1032 new_domain_record
.result
,
1033 new_domain_record
.postmaster_result
,
1034 new_domain_record
.random_result
);
1038 /* If a definite result was obtained for the callout, cache it unless caching
1043 if ( !(options
& vopt_callout_no_cache
)
1044 && new_address_record
.result
!= ccache_unknown
)
1047 dbm_file
= dbfn_open(US
"callout", O_RDWR
|O_CREAT
, &dbblock
, FALSE
);
1050 HDEBUG(D_verify
) debug_printf("no callout cache available\n");
1054 (void)dbfn_write(dbm_file
, address_key
, &new_address_record
,
1055 (int)sizeof(dbdata_callout_cache_address
));
1056 HDEBUG(D_verify
) debug_printf("wrote %s callout cache address record for %s\n",
1057 new_address_record
.result
== ccache_accept
? "positive" : "negative",
1063 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1064 temporary error. If there was only one host, and a response was received, leave
1065 it alone if supplying details. Otherwise, give a generic response. */
1069 uschar
* dullmsg
= string_sprintf("Could not complete %s verify callout",
1070 options
& vopt_is_recipient
? "recipient" : "sender");
1073 addr
->message
= host_list
->next
|| !addr
->message
1074 ? dullmsg
: string_sprintf("%s: %s", dullmsg
, addr
->message
);
1076 addr
->user_message
= smtp_return_error_details
1077 ? string_sprintf("%s for <%s>.\n"
1078 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1079 "they may be permanently unreachable from this server. In the latter case,\n%s",
1080 dullmsg
, addr
->address
,
1081 options
& vopt_is_recipient
1082 ? "the address will never be accepted."
1083 : "you need to change the address or create an MX record for its domain\n"
1084 "if it is supposed to be generally accessible from the Internet.\n"
1085 "Talk to your mail administrator for details.")
1088 /* Force a specific error code */
1090 addr
->basic_errno
= ERRNO_CALLOUTDEFER
;
1093 /* Come here from within the cache-reading code on fast-track exit. */
1096 if (dbm_file
) dbfn_close(dbm_file
);
1097 tls_modify_variables(&tls_in
);
1103 /* Called after recipient-acl to get a cutthrough connection open when
1104 one was requested and a recipient-verify wasn't subsequently done.
1107 open_cutthrough_connection( address_item
* addr
)
1112 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1113 /* We must use a copy of the address for verification, because it might
1117 HDEBUG(D_acl
) debug_printf("----------- %s cutthrough setup ------------\n",
1118 rcpt_count
> 1 ? "more" : "start");
1119 rc
= verify_address(&addr2
, NULL
,
1120 vopt_is_recipient
| vopt_callout_recipsender
| vopt_callout_no_cache
,
1121 CUTTHROUGH_CMD_TIMEOUT
, -1, -1,
1123 addr
->message
= addr2
.message
;
1124 addr
->user_message
= addr2
.user_message
;
1125 HDEBUG(D_acl
) debug_printf("----------- end cutthrough setup ------------\n");
1131 /* Send given number of bytes from the buffer */
1133 cutthrough_send(int n
)
1135 if(cutthrough
.fd
< 0)
1140 (tls_out
.active
== cutthrough
.fd
) ? tls_write(FALSE
, ctblock
.buffer
, n
) :
1142 send(cutthrough
.fd
, ctblock
.buffer
, n
, 0) > 0
1145 transport_count
+= n
;
1146 ctblock
.ptr
= ctblock
.buffer
;
1150 HDEBUG(D_transport
|D_acl
) debug_printf("cutthrough_send failed: %s\n", strerror(errno
));
1157 _cutthrough_puts(uschar
* cp
, int n
)
1161 if(ctblock
.ptr
>= ctblock
.buffer
+ctblock
.buffersize
)
1162 if(!cutthrough_send(ctblock
.buffersize
))
1165 *ctblock
.ptr
++ = *cp
++;
1170 /* Buffered output of counted data block. Return boolean success */
1172 cutthrough_puts(uschar
* cp
, int n
)
1174 if (cutthrough
.fd
< 0) return TRUE
;
1175 if (_cutthrough_puts(cp
, n
)) return TRUE
;
1176 cancel_cutthrough_connection("transmit failed");
1182 _cutthrough_flush_send(void)
1184 int n
= ctblock
.ptr
-ctblock
.buffer
;
1187 if(!cutthrough_send(n
))
1193 /* Send out any bufferred output. Return boolean success. */
1195 cutthrough_flush_send(void)
1197 if (_cutthrough_flush_send()) return TRUE
;
1198 cancel_cutthrough_connection("transmit failed");
1204 cutthrough_put_nl(void)
1206 return cutthrough_puts(US
"\r\n", 2);
1210 /* Get and check response from cutthrough target */
1212 cutthrough_response(char expect
, uschar
** copy
, int timeout
)
1214 smtp_inblock inblock
;
1215 uschar inbuffer
[4096];
1216 uschar responsebuffer
[4096];
1218 inblock
.buffer
= inbuffer
;
1219 inblock
.buffersize
= sizeof(inbuffer
);
1220 inblock
.ptr
= inbuffer
;
1221 inblock
.ptrend
= inbuffer
;
1222 inblock
.sock
= cutthrough
.fd
;
1223 /* this relies on (inblock.sock == tls_out.active) */
1224 if(!smtp_read_response(&inblock
, responsebuffer
, sizeof(responsebuffer
), expect
, timeout
))
1225 cancel_cutthrough_connection("target timeout on read");
1230 *copy
= cp
= string_copy(responsebuffer
);
1231 /* Trim the trailing end of line */
1232 cp
+= Ustrlen(responsebuffer
);
1233 if(cp
> *copy
&& cp
[-1] == '\n') *--cp
= '\0';
1234 if(cp
> *copy
&& cp
[-1] == '\r') *--cp
= '\0';
1237 return responsebuffer
[0];
1241 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1243 cutthrough_predata(void)
1245 if(cutthrough
.fd
< 0)
1248 HDEBUG(D_transport
|D_acl
|D_v
) debug_printf(" SMTP>> DATA\n");
1249 cutthrough_puts(US
"DATA\r\n", 6);
1250 cutthrough_flush_send();
1252 /* Assume nothing buffered. If it was it gets ignored. */
1253 return cutthrough_response('3', NULL
, CUTTHROUGH_DATA_TIMEOUT
) == '3';
1257 /* fd and tctx args only to match write_chunk() */
1259 cutthrough_write_chunk(int fd
, transport_ctx
* tctx
, uschar
* s
, int len
)
1262 while(s
&& (s2
= Ustrchr(s
, '\n')))
1264 if(!cutthrough_puts(s
, s2
-s
) || !cutthrough_put_nl())
1272 /* Buffered send of headers. Return success boolean. */
1273 /* Expands newlines to wire format (CR,NL). */
1274 /* Also sends header-terminating blank line. */
1276 cutthrough_headers_send(void)
1280 if(cutthrough
.fd
< 0)
1283 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1284 but having a separate buffered-output function (for now)
1286 HDEBUG(D_acl
) debug_printf("----------- start cutthrough headers send -----------\n");
1288 tctx
.tblock
= cutthrough
.addr
.transport
;
1289 tctx
.addr
= &cutthrough
.addr
;
1290 tctx
.check_string
= US
".";
1291 tctx
.escape_string
= US
"..";
1292 tctx
.options
= topt_use_crlf
;
1294 if (!transport_headers_send(cutthrough
.fd
, &tctx
, &cutthrough_write_chunk
))
1297 HDEBUG(D_acl
) debug_printf("----------- done cutthrough headers send ------------\n");
1303 close_cutthrough_connection(const char * why
)
1305 if(cutthrough
.fd
>= 0)
1307 /* We could be sending this after a bunch of data, but that is ok as
1308 the only way to cancel the transfer in dataphase is to drop the tcp
1309 conn before the final dot.
1311 ctblock
.ptr
= ctbuffer
;
1312 HDEBUG(D_transport
|D_acl
|D_v
) debug_printf(" SMTP>> QUIT\n");
1313 _cutthrough_puts(US
"QUIT\r\n", 6); /* avoid recursion */
1314 _cutthrough_flush_send();
1316 /* Wait a short time for response, and discard it */
1317 cutthrough_response('2', NULL
, 1);
1320 tls_close(FALSE
, TRUE
);
1322 HDEBUG(D_transport
|D_acl
|D_v
) debug_printf(" SMTP(close)>>\n");
1323 (void)close(cutthrough
.fd
);
1325 HDEBUG(D_acl
) debug_printf("----------- cutthrough shutdown (%s) ------------\n", why
);
1327 ctblock
.ptr
= ctbuffer
;
1331 cancel_cutthrough_connection(const char * why
)
1333 close_cutthrough_connection(why
);
1334 cutthrough
.delivery
= FALSE
;
1340 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1341 Log an OK response as a transmission.
1342 Close the connection.
1343 Return smtp response-class digit.
1346 cutthrough_finaldot(void)
1349 address_item
* addr
;
1350 HDEBUG(D_transport
|D_acl
|D_v
) debug_printf(" SMTP>> .\n");
1352 /* Assume data finshed with new-line */
1353 if( !cutthrough_puts(US
".", 1)
1354 || !cutthrough_put_nl()
1355 || !cutthrough_flush_send()
1357 return cutthrough
.addr
.message
;
1359 res
= cutthrough_response('2', &cutthrough
.addr
.message
, CUTTHROUGH_DATA_TIMEOUT
);
1360 for (addr
= &cutthrough
.addr
; addr
; addr
= addr
->next
)
1362 addr
->message
= cutthrough
.addr
.message
;
1366 delivery_log(LOG_MAIN
, addr
, (int)'>', NULL
);
1367 close_cutthrough_connection("delivered");
1371 delivery_log(LOG_MAIN
, addr
, 0,
1372 US
"tmp-reject from cutthrough after DATA:");
1376 delivery_log(LOG_MAIN
|LOG_REJECT
, addr
, 0,
1377 US
"rejected after DATA:");
1384 return cutthrough
.addr
.message
;
1389 /*************************************************
1390 * Copy error to toplevel address *
1391 *************************************************/
1393 /* This function is used when a verify fails or defers, to ensure that the
1394 failure or defer information is in the original toplevel address. This applies
1395 when an address is redirected to a single new address, and the failure or
1396 deferral happens to the child address.
1399 vaddr the verify address item
1400 addr the final address item
1403 Returns: the value of YIELD
1407 copy_error(address_item
*vaddr
, address_item
*addr
, int yield
)
1411 vaddr
->message
= addr
->message
;
1412 vaddr
->user_message
= addr
->user_message
;
1413 vaddr
->basic_errno
= addr
->basic_errno
;
1414 vaddr
->more_errno
= addr
->more_errno
;
1415 vaddr
->prop
.address_data
= addr
->prop
.address_data
;
1416 copyflag(vaddr
, addr
, af_pass_message
);
1424 /**************************************************
1425 * printf that automatically handles TLS if needed *
1426 ***************************************************/
1428 /* This function is used by verify_address() as a substitute for all fprintf()
1429 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1430 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1431 that assumes that we always use the smtp_out FILE* when not using TLS or the
1432 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1433 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1437 f the candidate FILE* to write to
1438 format format string
1439 ... optional arguments
1445 static void PRINTF_FUNCTION(2,3)
1446 respond_printf(FILE *f
, const char *format
, ...)
1450 va_start(ap
, format
);
1451 if (smtp_out
&& (f
== smtp_out
))
1452 smtp_vprintf(format
, ap
);
1454 vfprintf(f
, format
, ap
);
1460 /*************************************************
1461 * Verify an email address *
1462 *************************************************/
1464 /* This function is used both for verification (-bv and at other times) and
1465 address testing (-bt), which is indicated by address_test_mode being set.
1468 vaddr contains the address to verify; the next field in this block
1470 f if not NULL, write the result to this file
1471 options various option bits:
1472 vopt_fake_sender => this sender verify is not for the real
1473 sender (it was verify=sender=xxxx or an address from a
1474 header line) - rewriting must not change sender_address
1475 vopt_is_recipient => this is a recipient address, otherwise
1476 it's a sender address - this affects qualification and
1477 rewriting and messages from callouts
1478 vopt_qualify => qualify an unqualified address; else error
1479 vopt_expn => called from SMTP EXPN command
1480 vopt_success_on_redirect => when a new address is generated
1481 the verification instantly succeeds
1483 These ones are used by do_callout() -- the options variable
1486 vopt_callout_fullpm => if postmaster check, do full one
1487 vopt_callout_no_cache => don't use callout cache
1488 vopt_callout_random => do the "random" thing
1489 vopt_callout_recipsender => use real sender for recipient
1490 vopt_callout_recippmaster => use postmaster for recipient
1492 callout if > 0, specifies that callout is required, and gives timeout
1493 for individual commands
1494 callout_overall if > 0, gives overall timeout for the callout function;
1495 if < 0, a default is used (see do_callout())
1496 callout_connect the connection timeout for callouts
1497 se_mailfrom when callout is requested to verify a sender, use this
1498 in MAIL FROM; NULL => ""
1499 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1500 thing and use this as the sender address (may be "")
1502 routed if not NULL, set TRUE if routing succeeded, so we can
1503 distinguish between routing failed and callout failed
1505 Returns: OK address verified
1506 FAIL address failed to verify
1507 DEFER can't tell at present
1511 verify_address(address_item
*vaddr
, FILE *f
, int options
, int callout
,
1512 int callout_overall
, int callout_connect
, uschar
*se_mailfrom
,
1513 uschar
*pm_mailfrom
, BOOL
*routed
)
1516 BOOL full_info
= (f
== NULL
)? FALSE
: (debug_selector
!= 0);
1517 BOOL expn
= (options
& vopt_expn
) != 0;
1518 BOOL success_on_redirect
= (options
& vopt_success_on_redirect
) != 0;
1521 int verify_type
= expn
? v_expn
:
1522 address_test_mode
? v_none
:
1523 options
& vopt_is_recipient
? v_recipient
: v_sender
;
1524 address_item
*addr_list
;
1525 address_item
*addr_new
= NULL
;
1526 address_item
*addr_remote
= NULL
;
1527 address_item
*addr_local
= NULL
;
1528 address_item
*addr_succeed
= NULL
;
1529 uschar
**failure_ptr
= options
& vopt_is_recipient
1530 ? &recipient_verify_failure
: &sender_verify_failure
;
1531 uschar
*ko_prefix
, *cr
;
1532 uschar
*address
= vaddr
->address
;
1533 uschar
*save_sender
;
1534 uschar null_sender
[] = { 0 }; /* Ensure writeable memory */
1536 /* Clear, just in case */
1538 *failure_ptr
= NULL
;
1540 /* Set up a prefix and suffix for error message which allow us to use the same
1541 output statements both in EXPN mode (where an SMTP response is needed) and when
1542 debugging with an output file. */
1546 ko_prefix
= US
"553 ";
1549 else ko_prefix
= cr
= US
"";
1551 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1553 if (parse_find_at(address
) == NULL
)
1555 if ((options
& vopt_qualify
) == 0)
1558 respond_printf(f
, "%sA domain is required for \"%s\"%s\n",
1559 ko_prefix
, address
, cr
);
1560 *failure_ptr
= US
"qualify";
1563 address
= rewrite_address_qualify(address
, options
& vopt_is_recipient
);
1568 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1569 debug_printf("%s %s\n", address_test_mode
? "Testing" : "Verifying", address
);
1572 /* Rewrite and report on it. Clear the domain and local part caches - these
1573 may have been set by domains and local part tests during an ACL. */
1575 if (global_rewrite_rules
!= NULL
)
1577 uschar
*old
= address
;
1578 address
= rewrite_address(address
, options
& vopt_is_recipient
, FALSE
,
1579 global_rewrite_rules
, rewrite_existflags
);
1582 for (i
= 0; i
< (MAX_NAMED_LIST
* 2)/32; i
++) vaddr
->localpart_cache
[i
] = 0;
1583 for (i
= 0; i
< (MAX_NAMED_LIST
* 2)/32; i
++) vaddr
->domain_cache
[i
] = 0;
1584 if (f
!= NULL
&& !expn
) fprintf(f
, "Address rewritten as: %s\n", address
);
1588 /* If this is the real sender address, we must update sender_address at
1589 this point, because it may be referred to in the routers. */
1591 if ((options
& (vopt_fake_sender
|vopt_is_recipient
)) == 0)
1592 sender_address
= address
;
1594 /* If the address was rewritten to <> no verification can be done, and we have
1595 to return OK. This rewriting is permitted only for sender addresses; for other
1596 addresses, such rewriting fails. */
1598 if (address
[0] == 0) return OK
;
1600 /* Flip the legacy TLS-related variables over to the outbound set in case
1601 they're used in the context of a transport used by verification. Reset them
1602 at exit from this routine (so no returns allowed from here on). */
1604 tls_modify_variables(&tls_out
);
1606 /* Save a copy of the sender address for re-instating if we change it to <>
1607 while verifying a sender address (a nice bit of self-reference there). */
1609 save_sender
= sender_address
;
1611 /* Observability variable for router/transport use */
1613 verify_mode
= options
& vopt_is_recipient
? US
"R" : US
"S";
1615 /* Update the address structure with the possibly qualified and rewritten
1616 address. Set it up as the starting address on the chain of new addresses. */
1618 vaddr
->address
= address
;
1621 /* We need a loop, because an address can generate new addresses. We must also
1622 cope with generated pipes and files at the top level. (See also the code and
1623 comment in deliver.c.) However, it is usually the case that the router for
1624 user's .forward files has its verify flag turned off.
1626 If an address generates more than one child, the loop is used only when
1627 full_info is set, and this can only be set locally. Remote enquiries just get
1628 information about the top level address, not anything that it generated. */
1633 address_item
*addr
= addr_new
;
1635 addr_new
= addr
->next
;
1640 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1641 debug_printf("Considering %s\n", addr
->address
);
1644 /* Handle generated pipe, file or reply addresses. We don't get these
1645 when handling EXPN, as it does only one level of expansion. */
1647 if (testflag(addr
, af_pfr
))
1654 if (addr
->address
[0] == '>')
1656 allow
= testflag(addr
, af_allow_reply
);
1657 fprintf(f
, "%s -> mail %s", addr
->parent
->address
, addr
->address
+ 1);
1661 allow
= (addr
->address
[0] == '|')?
1662 testflag(addr
, af_allow_pipe
) : testflag(addr
, af_allow_file
);
1663 fprintf(f
, "%s -> %s", addr
->parent
->address
, addr
->address
);
1666 if (addr
->basic_errno
== ERRNO_BADTRANSPORT
)
1667 fprintf(f
, "\n*** Error in setting up pipe, file, or autoreply:\n"
1668 "%s\n", addr
->message
);
1670 fprintf(f
, "\n transport = %s\n", addr
->transport
->name
);
1672 fprintf(f
, " *** forbidden ***\n");
1677 /* Just in case some router parameter refers to it. */
1679 return_path
= addr
->prop
.errors_address
1680 ? addr
->prop
.errors_address
: sender_address
;
1682 /* Split the address into domain and local part, handling the %-hack if
1683 necessary, and then route it. While routing a sender address, set
1684 $sender_address to <> because that is what it will be if we were trying to
1685 send a bounce to the sender. */
1687 if (routed
) *routed
= FALSE
;
1688 if ((rc
= deliver_split_address(addr
)) == OK
)
1690 if (!(options
& vopt_is_recipient
)) sender_address
= null_sender
;
1691 rc
= route_address(addr
, &addr_local
, &addr_remote
, &addr_new
,
1692 &addr_succeed
, verify_type
);
1693 sender_address
= save_sender
; /* Put back the real sender */
1696 /* If routing an address succeeded, set the flag that remembers, for use when
1697 an ACL cached a sender verify (in case a callout fails). Then if routing set
1698 up a list of hosts or the transport has a host list, and the callout option
1699 is set, and we aren't in a host checking run, do the callout verification,
1700 and set another flag that notes that a callout happened. */
1704 if (routed
) *routed
= TRUE
;
1707 transport_instance
* tp
;
1708 host_item
* host_list
= addr
->host_list
;
1710 /* Make up some data for use in the case where there is no remote
1713 transport_feedback tf
= {
1714 NULL
, /* interface (=> any) */
1715 US
"smtp", /* port */
1716 US
"smtp", /* protocol */
1718 US
"$smtp_active_hostname", /* helo_data */
1719 FALSE
, /* hosts_override */
1720 FALSE
, /* hosts_randomize */
1721 FALSE
, /* gethostbyname */
1722 TRUE
, /* qualify_single */
1723 FALSE
/* search_parents */
1726 /* If verification yielded a remote transport, we want to use that
1727 transport's options, so as to mimic what would happen if we were really
1728 sending a message to this address. */
1730 if ((tp
= addr
->transport
) && !tp
->info
->local
)
1732 (void)(tp
->setup
)(tp
, addr
, &tf
, 0, 0, NULL
);
1734 /* If the transport has hosts and the router does not, or if the
1735 transport is configured to override the router's hosts, we must build a
1736 host list of the transport's hosts, and find the IP addresses */
1738 if (tf
.hosts
&& (!host_list
|| tf
.hosts_override
))
1741 const uschar
*save_deliver_domain
= deliver_domain
;
1742 uschar
*save_deliver_localpart
= deliver_localpart
;
1744 host_list
= NULL
; /* Ignore the router's hosts */
1746 deliver_domain
= addr
->domain
;
1747 deliver_localpart
= addr
->local_part
;
1748 s
= expand_string(tf
.hosts
);
1749 deliver_domain
= save_deliver_domain
;
1750 deliver_localpart
= save_deliver_localpart
;
1754 log_write(0, LOG_MAIN
|LOG_PANIC
, "failed to expand list of hosts "
1755 "\"%s\" in %s transport for callout: %s", tf
.hosts
,
1756 tp
->name
, expand_string_message
);
1761 host_item
*host
, *nexthost
;
1762 host_build_hostlist(&host_list
, s
, tf
.hosts_randomize
);
1764 /* Just ignore failures to find a host address. If we don't manage
1765 to find any addresses, the callout will defer. Note that more than
1766 one address may be found for a single host, which will result in
1767 additional host items being inserted into the chain. Hence we must
1768 save the next host first. */
1770 flags
= HOST_FIND_BY_A
;
1771 if (tf
.qualify_single
) flags
|= HOST_FIND_QUALIFY_SINGLE
;
1772 if (tf
.search_parents
) flags
|= HOST_FIND_SEARCH_PARENTS
;
1774 for (host
= host_list
; host
; host
= nexthost
)
1776 nexthost
= host
->next
;
1777 if (tf
.gethostbyname
||
1778 string_is_ip_address(host
->name
, NULL
) != 0)
1779 (void)host_find_byname(host
, NULL
, flags
, NULL
, TRUE
);
1782 dnssec_domains
* dnssec_domains
= NULL
;
1783 if (Ustrcmp(tp
->driver_name
, "smtp") == 0)
1785 smtp_transport_options_block
* ob
=
1786 (smtp_transport_options_block
*) tp
->options_block
;
1787 dnssec_domains
= &ob
->dnssec
;
1790 (void)host_find_bydns(host
, NULL
, flags
, NULL
, NULL
, NULL
,
1791 dnssec_domains
, NULL
, NULL
);
1798 /* Can only do a callout if we have at least one host! If the callout
1799 fails, it will have set ${sender,recipient}_verify_failure. */
1803 HDEBUG(D_verify
) debug_printf("Attempting full verification using callout\n");
1804 if (host_checking
&& !host_checking_callout
)
1807 debug_printf("... callout omitted by default when host testing\n"
1808 "(Use -bhc if you want the callouts to happen.)\n");
1813 deliver_set_expansions(addr
);
1815 rc
= do_callout(addr
, host_list
, &tf
, callout
, callout_overall
,
1816 callout_connect
, options
, se_mailfrom
, pm_mailfrom
);
1821 HDEBUG(D_verify
) debug_printf("Cannot do callout: neither router nor "
1822 "transport provided a host list\n");
1827 /* Otherwise, any failure is a routing failure */
1829 else *failure_ptr
= US
"route";
1831 /* A router may return REROUTED if it has set up a child address as a result
1832 of a change of domain name (typically from widening). In this case we always
1833 want to continue to verify the new child. */
1835 if (rc
== REROUTED
) continue;
1837 /* Handle hard failures */
1844 address_item
*p
= addr
->parent
;
1846 respond_printf(f
, "%s%s %s", ko_prefix
,
1847 full_info
? addr
->address
: address
,
1848 address_test_mode
? "is undeliverable" : "failed to verify");
1849 if (!expn
&& admin_user
)
1851 if (addr
->basic_errno
> 0)
1852 respond_printf(f
, ": %s", strerror(addr
->basic_errno
));
1854 respond_printf(f
, ": %s", addr
->message
);
1857 /* Show parents iff doing full info */
1859 if (full_info
) while (p
)
1861 respond_printf(f
, "%s\n <-- %s", cr
, p
->address
);
1864 respond_printf(f
, "%s\n", cr
);
1866 cancel_cutthrough_connection("routing hard fail");
1870 yield
= copy_error(vaddr
, addr
, FAIL
);
1878 else if (rc
== DEFER
)
1883 address_item
*p
= addr
->parent
;
1884 respond_printf(f
, "%s%s cannot be resolved at this time", ko_prefix
,
1885 full_info
? addr
->address
: address
);
1886 if (!expn
&& admin_user
)
1888 if (addr
->basic_errno
> 0)
1889 respond_printf(f
, ": %s", strerror(addr
->basic_errno
));
1891 respond_printf(f
, ": %s", addr
->message
);
1892 else if (addr
->basic_errno
<= 0)
1893 respond_printf(f
, ": unknown error");
1896 /* Show parents iff doing full info */
1898 if (full_info
) while (p
)
1900 respond_printf(f
, "%s\n <-- %s", cr
, p
->address
);
1903 respond_printf(f
, "%s\n", cr
);
1905 cancel_cutthrough_connection("routing soft fail");
1909 yield
= copy_error(vaddr
, addr
, DEFER
);
1912 if (yield
== OK
) yield
= DEFER
;
1915 /* If we are handling EXPN, we do not want to continue to route beyond
1916 the top level (whose address is in "address"). */
1920 uschar
*ok_prefix
= US
"250-";
1923 if (!addr_local
&& !addr_remote
)
1924 respond_printf(f
, "250 mail to <%s> is discarded\r\n", address
);
1926 respond_printf(f
, "250 <%s>\r\n", address
);
1930 address_item
*addr2
= addr_new
;
1931 addr_new
= addr2
->next
;
1932 if (!addr_new
) ok_prefix
= US
"250 ";
1933 respond_printf(f
, "%s<%s>\r\n", ok_prefix
, addr2
->address
);
1939 /* Successful routing other than EXPN. */
1943 /* Handle successful routing when short info wanted. Otherwise continue for
1944 other (generated) addresses. Short info is the operational case. Full info
1945 can be requested only when debug_selector != 0 and a file is supplied.
1947 There is a conflict between the use of aliasing as an alternate email
1948 address, and as a sort of mailing list. If an alias turns the incoming
1949 address into just one address (e.g. J.Caesar->jc44) you may well want to
1950 carry on verifying the generated address to ensure it is valid when
1951 checking incoming mail. If aliasing generates multiple addresses, you
1952 probably don't want to do this. Exim therefore treats the generation of
1953 just a single new address as a special case, and continues on to verify the
1954 generated address. */
1956 if ( !full_info
/* Stop if short info wanted AND */
1957 && ( ( !addr_new
/* No new address OR */
1958 || addr_new
->next
/* More than one new address OR */
1959 || testflag(addr_new
, af_pfr
) /* New address is pfr */
1962 ( addr_new
/* At least one new address AND */
1963 && success_on_redirect
/* success_on_redirect is set */
1967 if (f
) fprintf(f
, "%s %s\n",
1968 address
, address_test_mode
? "is deliverable" : "verified");
1970 /* If we have carried on to verify a child address, we want the value
1971 of $address_data to be that of the child */
1973 vaddr
->prop
.address_data
= addr
->prop
.address_data
;
1975 /* If stopped because more than one new address, cannot cutthrough */
1977 if (addr_new
&& addr_new
->next
)
1978 cancel_cutthrough_connection("multiple addresses from routing");
1984 } /* Loop for generated addresses */
1986 /* Display the full results of the successful routing, including any generated
1987 addresses. Control gets here only when full_info is set, which requires f not
1988 to be NULL, and this occurs only when a top-level verify is called with the
1989 debugging switch on.
1991 If there are no local and no remote addresses, and there were no pipes, files,
1992 or autoreplies, and there were no errors or deferments, the message is to be
1993 discarded, usually because of the use of :blackhole: in an alias file. */
1995 if (allok
&& !addr_local
&& !addr_remote
)
1997 fprintf(f
, "mail to %s is discarded\n", address
);
2001 for (addr_list
= addr_local
, i
= 0; i
< 2; addr_list
= addr_remote
, i
++)
2004 address_item
*addr
= addr_list
;
2005 address_item
*p
= addr
->parent
;
2006 transport_instance
* tp
= addr
->transport
;
2008 addr_list
= addr
->next
;
2010 fprintf(f
, "%s", CS addr
->address
);
2011 #ifdef EXPERIMENTAL_SRS
2012 if(addr
->prop
.srs_sender
)
2013 fprintf(f
, " [srs = %s]", addr
->prop
.srs_sender
);
2016 /* If the address is a duplicate, show something about it. */
2018 if (!testflag(addr
, af_pfr
))
2021 if ((tnode
= tree_search(tree_duplicates
, addr
->unique
)))
2022 fprintf(f
, " [duplicate, would not be delivered]");
2023 else tree_add_duplicate(addr
->unique
, addr
);
2026 /* Now show its parents */
2028 for (p
= addr
->parent
; p
; p
= p
->parent
)
2029 fprintf(f
, "\n <-- %s", p
->address
);
2032 /* Show router, and transport */
2034 fprintf(f
, "router = %s, transport = %s\n",
2035 addr
->router
->name
, tp
? tp
->name
: US
"unset");
2037 /* Show any hosts that are set up by a router unless the transport
2038 is going to override them; fiddle a bit to get a nice format. */
2040 if (addr
->host_list
&& tp
&& !tp
->overrides_hosts
)
2045 for (h
= addr
->host_list
; h
; h
= h
->next
)
2046 { /* get max lengths of host names, addrs */
2047 int len
= Ustrlen(h
->name
);
2048 if (len
> maxlen
) maxlen
= len
;
2049 len
= h
->address
? Ustrlen(h
->address
) : 7;
2050 if (len
> maxaddlen
) maxaddlen
= len
;
2052 for (h
= addr
->host_list
; h
; h
= h
->next
)
2054 fprintf(f
, " host %-*s ", maxlen
, h
->name
);
2057 fprintf(f
, "[%s%-*c", h
->address
, maxaddlen
+1 - Ustrlen(h
->address
), ']');
2058 else if (tp
->info
->local
)
2059 fprintf(f
, " %-*s ", maxaddlen
, ""); /* Omit [unknown] for local */
2061 fprintf(f
, "[%s%-*c", "unknown", maxaddlen
+1 - 7, ']');
2063 if (h
->mx
>= 0) fprintf(f
, " MX=%d", h
->mx
);
2064 if (h
->port
!= PORT_NONE
) fprintf(f
, " port=%d", h
->port
);
2065 if (running_in_test_harness
&& h
->dnssec
== DS_YES
) fputs(" AD", f
);
2066 if (h
->status
== hstatus_unusable
) fputs(" ** unusable **", f
);
2072 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2073 the -bv or -bt case). */
2077 tls_modify_variables(&tls_in
);
2085 /*************************************************
2086 * Check headers for syntax errors *
2087 *************************************************/
2089 /* This function checks those header lines that contain addresses, and verifies
2090 that all the addresses therein are syntactially correct.
2093 msgptr where to put an error message
2100 verify_check_headers(uschar
**msgptr
)
2106 for (h
= header_list
; h
!= NULL
&& yield
== OK
; h
= h
->next
)
2108 if (h
->type
!= htype_from
&&
2109 h
->type
!= htype_reply_to
&&
2110 h
->type
!= htype_sender
&&
2111 h
->type
!= htype_to
&&
2112 h
->type
!= htype_cc
&&
2113 h
->type
!= htype_bcc
)
2116 colon
= Ustrchr(h
->text
, ':');
2118 while (isspace(*s
)) s
++;
2120 /* Loop for multiple addresses in the header, enabling group syntax. Note
2121 that we have to reset this after the header has been scanned. */
2123 parse_allow_group
= TRUE
;
2127 uschar
*ss
= parse_find_address_end(s
, FALSE
);
2128 uschar
*recipient
, *errmess
;
2129 int terminator
= *ss
;
2130 int start
, end
, domain
;
2132 /* Temporarily terminate the string at this point, and extract the
2133 operative address within, allowing group syntax. */
2136 recipient
= parse_extract_address(s
,&errmess
,&start
,&end
,&domain
,FALSE
);
2139 /* Permit an unqualified address only if the message is local, or if the
2140 sending host is configured to be permitted to send them. */
2142 if (recipient
!= NULL
&& domain
== 0)
2144 if (h
->type
== htype_from
|| h
->type
== htype_sender
)
2146 if (!allow_unqualified_sender
) recipient
= NULL
;
2150 if (!allow_unqualified_recipient
) recipient
= NULL
;
2152 if (recipient
== NULL
) errmess
= US
"unqualified address not permitted";
2155 /* It's an error if no address could be extracted, except for the special
2156 case of an empty address. */
2158 if (recipient
== NULL
&& Ustrcmp(errmess
, "empty address") != 0)
2160 uschar
*verb
= US
"is";
2165 /* Arrange not to include any white space at the end in the
2166 error message or the header name. */
2168 while (t
> s
&& isspace(t
[-1])) t
--;
2169 while (tt
> h
->text
&& isspace(tt
[-1])) tt
--;
2171 /* Add the address that failed to the error message, since in a
2172 header with very many addresses it is sometimes hard to spot
2173 which one is at fault. However, limit the amount of address to
2174 quote - cases have been seen where, for example, a missing double
2175 quote in a humungous To: header creates an "address" that is longer
2176 than string_sprintf can handle. */
2185 /* deconst cast ok as we're passing a non-const to string_printing() */
2186 *msgptr
= US
string_printing(
2187 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2188 errmess
, tt
- h
->text
, h
->text
, verb
, len
, s
));
2191 break; /* Out of address loop */
2194 /* Advance to the next address */
2196 s
= ss
+ (terminator
? 1:0);
2197 while (isspace(*s
)) s
++;
2198 } /* Next address */
2200 parse_allow_group
= FALSE
;
2201 parse_found_group
= FALSE
;
2202 } /* Next header unless yield has been set FALSE */
2208 /*************************************************
2209 * Check header names for 8-bit characters *
2210 *************************************************/
2212 /* This function checks for invalid characters in header names. See
2213 RFC 5322, 2.2. and RFC 6532, 3.
2216 msgptr where to put an error message
2223 verify_check_header_names_ascii(uschar
**msgptr
)
2228 for (h
= header_list
; h
!= NULL
; h
= h
->next
)
2230 colon
= Ustrchr(h
->text
, ':');
2231 for(s
= h
->text
; s
< colon
; s
++)
2233 if ((*s
< 33) || (*s
> 126))
2235 *msgptr
= string_sprintf("Invalid character in header \"%.*s\" found",
2236 colon
- h
->text
, h
->text
);
2244 /*************************************************
2245 * Check for blind recipients *
2246 *************************************************/
2248 /* This function checks that every (envelope) recipient is mentioned in either
2249 the To: or Cc: header lines, thus detecting blind carbon copies.
2251 There are two ways of scanning that could be used: either scan the header lines
2252 and tick off the recipients, or scan the recipients and check the header lines.
2253 The original proposed patch did the former, but I have chosen to do the latter,
2254 because (a) it requires no memory and (b) will use fewer resources when there
2255 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2258 Returns: OK if there are no blind recipients
2259 FAIL if there is at least one blind recipient
2263 verify_check_notblind(void)
2266 for (i
= 0; i
< recipients_count
; i
++)
2270 uschar
*address
= recipients_list
[i
].address
;
2272 for (h
= header_list
; !found
&& h
!= NULL
; h
= h
->next
)
2276 if (h
->type
!= htype_to
&& h
->type
!= htype_cc
) continue;
2278 colon
= Ustrchr(h
->text
, ':');
2280 while (isspace(*s
)) s
++;
2282 /* Loop for multiple addresses in the header, enabling group syntax. Note
2283 that we have to reset this after the header has been scanned. */
2285 parse_allow_group
= TRUE
;
2289 uschar
*ss
= parse_find_address_end(s
, FALSE
);
2290 uschar
*recipient
,*errmess
;
2291 int terminator
= *ss
;
2292 int start
, end
, domain
;
2294 /* Temporarily terminate the string at this point, and extract the
2295 operative address within, allowing group syntax. */
2298 recipient
= parse_extract_address(s
,&errmess
,&start
,&end
,&domain
,FALSE
);
2301 /* If we found a valid recipient that has a domain, compare it with the
2302 envelope recipient. Local parts are compared case-sensitively, domains
2303 case-insensitively. By comparing from the start with length "domain", we
2304 include the "@" at the end, which ensures that we are comparing the whole
2305 local part of each address. */
2307 if (recipient
!= NULL
&& domain
!= 0)
2309 found
= Ustrncmp(recipient
, address
, domain
) == 0 &&
2310 strcmpic(recipient
+ domain
, address
+ domain
) == 0;
2314 /* Advance to the next address */
2316 s
= ss
+ (terminator
? 1:0);
2317 while (isspace(*s
)) s
++;
2318 } /* Next address */
2320 parse_allow_group
= FALSE
;
2321 parse_found_group
= FALSE
;
2322 } /* Next header (if found is false) */
2324 if (!found
) return FAIL
;
2325 } /* Next recipient */
2332 /*************************************************
2333 * Find if verified sender *
2334 *************************************************/
2336 /* Usually, just a single address is verified as the sender of the message.
2337 However, Exim can be made to verify other addresses as well (often related in
2338 some way), and this is useful in some environments. There may therefore be a
2339 chain of such addresses that have previously been tested. This function finds
2340 whether a given address is on the chain.
2342 Arguments: the address to be verified
2343 Returns: pointer to an address item, or NULL
2347 verify_checked_sender(uschar
*sender
)
2350 for (addr
= sender_verified_list
; addr
!= NULL
; addr
= addr
->next
)
2351 if (Ustrcmp(sender
, addr
->address
) == 0) break;
2359 /*************************************************
2360 * Get valid header address *
2361 *************************************************/
2363 /* Scan the originator headers of the message, looking for an address that
2364 verifies successfully. RFC 822 says:
2366 o The "Sender" field mailbox should be sent notices of
2367 any problems in transport or delivery of the original
2368 messages. If there is no "Sender" field, then the
2369 "From" field mailbox should be used.
2371 o If the "Reply-To" field exists, then the reply should
2372 go to the addresses indicated in that field and not to
2373 the address(es) indicated in the "From" field.
2375 So we check a Sender field if there is one, else a Reply_to field, else a From
2376 field. As some strange messages may have more than one of these fields,
2377 especially if they are resent- fields, check all of them if there is more than
2381 user_msgptr points to where to put a user error message
2382 log_msgptr points to where to put a log error message
2383 callout timeout for callout check (passed to verify_address())
2384 callout_overall overall callout timeout (ditto)
2385 callout_connect connect callout timeout (ditto)
2386 se_mailfrom mailfrom for verify; NULL => ""
2387 pm_mailfrom sender for pm callout check (passed to verify_address())
2388 options callout options (passed to verify_address())
2389 verrno where to put the address basic_errno
2391 If log_msgptr is set to something without setting user_msgptr, the caller
2392 normally uses log_msgptr for both things.
2394 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2395 FAIL is given if no appropriate headers are found
2399 verify_check_header_address(uschar
**user_msgptr
, uschar
**log_msgptr
,
2400 int callout
, int callout_overall
, int callout_connect
, uschar
*se_mailfrom
,
2401 uschar
*pm_mailfrom
, int options
, int *verrno
)
2403 static int header_types
[] = { htype_sender
, htype_reply_to
, htype_from
};
2408 for (i
= 0; i
< 3 && !done
; i
++)
2411 for (h
= header_list
; h
!= NULL
&& !done
; h
= h
->next
)
2413 int terminator
, new_ok
;
2414 uschar
*s
, *ss
, *endname
;
2416 if (h
->type
!= header_types
[i
]) continue;
2417 s
= endname
= Ustrchr(h
->text
, ':') + 1;
2419 /* Scan the addresses in the header, enabling group syntax. Note that we
2420 have to reset this after the header has been scanned. */
2422 parse_allow_group
= TRUE
;
2426 address_item
*vaddr
;
2428 while (isspace(*s
) || *s
== ',') s
++;
2429 if (*s
== 0) break; /* End of header */
2431 ss
= parse_find_address_end(s
, FALSE
);
2433 /* The terminator is a comma or end of header, but there may be white
2434 space preceding it (including newline for the last address). Move back
2435 past any white space so we can check against any cached envelope sender
2436 address verifications. */
2438 while (isspace(ss
[-1])) ss
--;
2442 HDEBUG(D_verify
) debug_printf("verifying %.*s header address %s\n",
2443 (int)(endname
- h
->text
), h
->text
, s
);
2445 /* See if we have already verified this address as an envelope sender,
2446 and if so, use the previous answer. */
2448 vaddr
= verify_checked_sender(s
);
2450 if (vaddr
!= NULL
&& /* Previously checked */
2451 (callout
<= 0 || /* No callout needed; OR */
2452 vaddr
->special_action
> 256)) /* Callout was done */
2454 new_ok
= vaddr
->special_action
& 255;
2455 HDEBUG(D_verify
) debug_printf("previously checked as envelope sender\n");
2456 *ss
= terminator
; /* Restore shortened string */
2459 /* Otherwise we run the verification now. We must restore the shortened
2460 string before running the verification, so the headers are correct, in
2461 case there is any rewriting. */
2465 int start
, end
, domain
;
2466 uschar
*address
= parse_extract_address(s
, log_msgptr
, &start
, &end
,
2471 /* If we found an empty address, just carry on with the next one, but
2472 kill the message. */
2474 if (address
== NULL
&& Ustrcmp(*log_msgptr
, "empty address") == 0)
2481 /* If verification failed because of a syntax error, fail this
2482 function, and ensure that the failing address gets added to the error
2485 if (address
== NULL
)
2488 while (ss
> s
&& isspace(ss
[-1])) ss
--;
2489 *log_msgptr
= string_sprintf("syntax error in '%.*s' header when "
2490 "scanning for sender: %s in \"%.*s\"",
2491 endname
- h
->text
, h
->text
, *log_msgptr
, ss
- s
, s
);
2497 /* Else go ahead with the sender verification. But it isn't *the*
2498 sender of the message, so set vopt_fake_sender to stop sender_address
2499 being replaced after rewriting or qualification. */
2503 vaddr
= deliver_make_addr(address
, FALSE
);
2504 new_ok
= verify_address(vaddr
, NULL
, options
| vopt_fake_sender
,
2505 callout
, callout_overall
, callout_connect
, se_mailfrom
,
2510 /* We now have the result, either newly found, or cached. If we are
2511 giving out error details, set a specific user error. This means that the
2512 last of these will be returned to the user if all three fail. We do not
2513 set a log message - the generic one below will be used. */
2517 *verrno
= vaddr
->basic_errno
;
2518 if (smtp_return_error_details
)
2520 *user_msgptr
= string_sprintf("Rejected after DATA: "
2521 "could not verify \"%.*s\" header address\n%s: %s",
2522 endname
- h
->text
, h
->text
, vaddr
->address
, vaddr
->message
);
2526 /* Success or defer */
2535 if (new_ok
== DEFER
) yield
= DEFER
;
2537 /* Move on to any more addresses in the header */
2540 } /* Next address */
2542 parse_allow_group
= FALSE
;
2543 parse_found_group
= FALSE
;
2544 } /* Next header, unless done */
2545 } /* Next header type unless done */
2547 if (yield
== FAIL
&& *log_msgptr
== NULL
)
2548 *log_msgptr
= US
"there is no valid sender in any header line";
2550 if (yield
== DEFER
&& *log_msgptr
== NULL
)
2551 *log_msgptr
= US
"all attempts to verify a sender in a header line deferred";
2559 /*************************************************
2560 * Get RFC 1413 identification *
2561 *************************************************/
2563 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2564 the timeout is set to zero, then the query is not done. There may also be lists
2565 of hosts and nets which are exempt. To guard against malefactors sending
2566 non-printing characters which could, for example, disrupt a message's headers,
2567 make sure the string consists of printing characters only.
2570 port the port to connect to; usually this is IDENT_PORT (113), but when
2571 running in the test harness with -bh a different value is used.
2575 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2579 verify_get_ident(int port
)
2581 int sock
, host_af
, qlen
;
2582 int received_sender_port
, received_interface_port
, n
;
2584 uschar buffer
[2048];
2586 /* Default is no ident. Check whether we want to do an ident check for this
2589 sender_ident
= NULL
;
2590 if (rfc1413_query_timeout
<= 0 || verify_check_host(&rfc1413_hosts
) != OK
)
2593 DEBUG(D_ident
) debug_printf("doing ident callback\n");
2595 /* Set up a connection to the ident port of the remote host. Bind the local end
2596 to the incoming interface address. If the sender host address is an IPv6
2597 address, the incoming interface address will also be IPv6. */
2599 host_af
= Ustrchr(sender_host_address
, ':') == NULL
? AF_INET
: AF_INET6
;
2600 if ((sock
= ip_socket(SOCK_STREAM
, host_af
)) < 0) return;
2602 if (ip_bind(sock
, host_af
, interface_address
, 0) < 0)
2604 DEBUG(D_ident
) debug_printf("bind socket for ident failed: %s\n",
2609 if (ip_connect(sock
, host_af
, sender_host_address
, port
,
2610 rfc1413_query_timeout
, TRUE
) < 0)
2612 if (errno
== ETIMEDOUT
&& LOGGING(ident_timeout
))
2613 log_write(0, LOG_MAIN
, "ident connection to %s timed out",
2614 sender_host_address
);
2616 DEBUG(D_ident
) debug_printf("ident connection to %s failed: %s\n",
2617 sender_host_address
, strerror(errno
));
2621 /* Construct and send the query. */
2623 sprintf(CS buffer
, "%d , %d\r\n", sender_host_port
, interface_port
);
2624 qlen
= Ustrlen(buffer
);
2625 if (send(sock
, buffer
, qlen
, 0) < 0)
2627 DEBUG(D_ident
) debug_printf("ident send failed: %s\n", strerror(errno
));
2631 /* Read a response line. We put it into the rest of the buffer, using several
2632 recv() calls if necessary. */
2640 int size
= sizeof(buffer
) - (p
- buffer
);
2642 if (size
<= 0) goto END_OFF
; /* Buffer filled without seeing \n. */
2643 count
= ip_recv(sock
, p
, size
, rfc1413_query_timeout
);
2644 if (count
<= 0) goto END_OFF
; /* Read error or EOF */
2646 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2647 generous, and accept a plain \n terminator as well. The only illegal
2650 for (pp
= p
; pp
< p
+ count
; pp
++)
2652 if (*pp
== 0) goto END_OFF
; /* Zero octet not allowed */
2655 if (pp
[-1] == '\r') pp
--;
2657 goto GOT_DATA
; /* Break out of both loops */
2661 /* Reached the end of the data without finding \n. Let the loop continue to
2662 read some more, if there is room. */
2669 /* We have received a line of data. Check it carefully. It must start with the
2670 same two port numbers that we sent, followed by data as defined by the RFC. For
2673 12345 , 25 : USERID : UNIX :root
2675 However, the amount of white space may be different to what we sent. In the
2676 "osname" field there may be several sub-fields, comma separated. The data we
2677 actually want to save follows the third colon. Some systems put leading spaces
2678 in it - we discard those. */
2680 if (sscanf(CS buffer
+ qlen
, "%d , %d%n", &received_sender_port
,
2681 &received_interface_port
, &n
) != 2 ||
2682 received_sender_port
!= sender_host_port
||
2683 received_interface_port
!= interface_port
)
2686 p
= buffer
+ qlen
+ n
;
2687 while(isspace(*p
)) p
++;
2688 if (*p
++ != ':') goto END_OFF
;
2689 while(isspace(*p
)) p
++;
2690 if (Ustrncmp(p
, "USERID", 6) != 0) goto END_OFF
;
2692 while(isspace(*p
)) p
++;
2693 if (*p
++ != ':') goto END_OFF
;
2694 while (*p
!= 0 && *p
!= ':') p
++;
2695 if (*p
++ == 0) goto END_OFF
;
2696 while(isspace(*p
)) p
++;
2697 if (*p
== 0) goto END_OFF
;
2699 /* The rest of the line is the data we want. We turn it into printing
2700 characters when we save it, so that it cannot mess up the format of any logging
2701 or Received: lines into which it gets inserted. We keep a maximum of 127
2702 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
2704 sender_ident
= US
string_printing(string_copyn(p
, 127));
2705 DEBUG(D_ident
) debug_printf("sender_ident = %s\n", sender_ident
);
2715 /*************************************************
2716 * Match host to a single host-list item *
2717 *************************************************/
2719 /* This function compares a host (name or address) against a single item
2720 from a host list. The host name gets looked up if it is needed and is not
2721 already known. The function is called from verify_check_this_host() via
2722 match_check_list(), which is why most of its arguments are in a single block.
2725 arg the argument block (see below)
2726 ss the host-list item
2727 valueptr where to pass back looked up data, or NULL
2728 error for error message when returning ERROR
2731 host_name (a) the host name, or
2732 (b) NULL, implying use sender_host_name and
2733 sender_host_aliases, looking them up if required, or
2734 (c) the empty string, meaning that only IP address matches
2736 host_address the host address
2737 host_ipv4 the IPv4 address taken from an IPv6 one
2741 DEFER lookup deferred
2742 ERROR (a) failed to find the host name or IP address, or
2743 (b) unknown lookup type specified, or
2744 (c) host name encountered when only IP addresses are
2749 check_host(void *arg
, const uschar
*ss
, const uschar
**valueptr
, uschar
**error
)
2751 check_host_block
*cb
= (check_host_block
*)arg
;
2754 BOOL iplookup
= FALSE
;
2755 BOOL isquery
= FALSE
;
2756 BOOL isiponly
= cb
->host_name
!= NULL
&& cb
->host_name
[0] == 0;
2761 /* Optimize for the special case when the pattern is "*". */
2763 if (*ss
== '*' && ss
[1] == 0) return OK
;
2765 /* If the pattern is empty, it matches only in the case when there is no host -
2766 this can occur in ACL checking for SMTP input using the -bs option. In this
2767 situation, the host address is the empty string. */
2769 if (cb
->host_address
[0] == 0) return (*ss
== 0)? OK
: FAIL
;
2770 if (*ss
== 0) return FAIL
;
2772 /* If the pattern is precisely "@" then match against the primary host name,
2773 provided that host name matching is permitted; if it's "@[]" match against the
2774 local host's IP addresses. */
2780 if (isiponly
) return ERROR
;
2781 ss
= primary_hostname
;
2783 else if (Ustrcmp(ss
, "@[]") == 0)
2785 ip_address_item
*ip
;
2786 for (ip
= host_find_interfaces(); ip
!= NULL
; ip
= ip
->next
)
2787 if (Ustrcmp(ip
->address
, cb
->host_address
) == 0) return OK
;
2792 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2793 a (possibly masked) comparison with the current IP address. */
2795 if (string_is_ip_address(ss
, &maskoffset
) != 0)
2796 return (host_is_in_net(cb
->host_address
, ss
, maskoffset
)? OK
: FAIL
);
2798 /* The pattern is not an IP address. A common error that people make is to omit
2799 one component of an IPv4 address, either by accident, or believing that, for
2800 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2801 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2802 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2803 ancient specification.) To aid in debugging these cases, we give a specific
2804 error if the pattern contains only digits and dots or contains a slash preceded
2805 only by digits and dots (a slash at the start indicates a file name and of
2806 course slashes may be present in lookups, but not preceded only by digits and
2809 for (t
= ss
; isdigit(*t
) || *t
== '.'; t
++);
2810 if (*t
== 0 || (*t
== '/' && t
!= ss
))
2812 *error
= US
"malformed IPv4 address or address mask";
2816 /* See if there is a semicolon in the pattern */
2818 semicolon
= Ustrchr(ss
, ';');
2820 /* If we are doing an IP address only match, then all lookups must be IP
2821 address lookups, even if there is no "net-". */
2825 iplookup
= semicolon
!= NULL
;
2828 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
2829 a lookup on a masked IP network, in textual form. We obey this code even if we
2830 have already set iplookup, so as to skip over the "net-" prefix and to set the
2831 mask length. The net- stuff really only applies to single-key lookups where the
2832 key is implicit. For query-style lookups the key is specified in the query.
2833 From release 4.30, the use of net- for query style is no longer needed, but we
2834 retain it for backward compatibility. */
2836 if (Ustrncmp(ss
, "net", 3) == 0 && semicolon
!= NULL
)
2839 for (t
= ss
+ 3; isdigit(*t
); t
++) mlen
= mlen
* 10 + *t
- '0';
2840 if (mlen
== 0 && t
== ss
+3) mlen
= -1; /* No mask supplied */
2841 iplookup
= (*t
++ == '-');
2845 /* Do the IP address lookup if that is indeed what we have */
2853 uschar
*filename
, *key
, *result
;
2856 /* Find the search type */
2858 search_type
= search_findtype(t
, semicolon
- t
);
2860 if (search_type
< 0) log_write(0, LOG_MAIN
|LOG_PANIC_DIE
, "%s",
2861 search_error_message
);
2863 /* Adjust parameters for the type of lookup. For a query-style lookup, there
2864 is no file name, and the "key" is just the query. For query-style with a file
2865 name, we have to fish the file off the start of the query. For a single-key
2866 lookup, the key is the current IP address, masked appropriately, and
2867 reconverted to text form, with the mask appended. For IPv6 addresses, specify
2868 dot separators instead of colons, except when the lookup type is "iplsearch".
2871 if (mac_islookup(search_type
, lookup_absfilequery
))
2873 filename
= semicolon
+ 1;
2875 while (*key
!= 0 && !isspace(*key
)) key
++;
2876 filename
= string_copyn(filename
, key
- filename
);
2877 while (isspace(*key
)) key
++;
2879 else if (mac_islookup(search_type
, lookup_querystyle
))
2882 key
= semicolon
+ 1;
2884 else /* Single-key style */
2886 int sep
= (Ustrcmp(lookup_list
[search_type
]->name
, "iplsearch") == 0)?
2888 insize
= host_aton(cb
->host_address
, incoming
);
2889 host_mask(insize
, incoming
, mlen
);
2890 (void)host_nmtoa(insize
, incoming
, mlen
, buffer
, sep
);
2892 filename
= semicolon
+ 1;
2895 /* Now do the actual lookup; note that there is no search_close() because
2896 of the caching arrangements. */
2898 if (!(handle
= search_open(filename
, search_type
, 0, NULL
, NULL
)))
2899 log_write(0, LOG_MAIN
|LOG_PANIC_DIE
, "%s", search_error_message
);
2901 result
= search_find(handle
, filename
, key
, -1, NULL
, 0, 0, NULL
);
2902 if (valueptr
!= NULL
) *valueptr
= result
;
2903 return (result
!= NULL
)? OK
: search_find_defer
? DEFER
: FAIL
;
2906 /* The pattern is not an IP address or network reference of any kind. That is,
2907 it is a host name pattern. If this is an IP only match, there's an error in the
2912 *error
= US
"cannot match host name in match_ip list";
2916 /* Check the characters of the pattern to see if they comprise only letters,
2917 digits, full stops, and hyphens (the constituents of domain names). Allow
2918 underscores, as they are all too commonly found. Sigh. Also, if
2919 allow_utf8_domains is set, allow top-bit characters. */
2921 for (t
= ss
; *t
!= 0; t
++)
2922 if (!isalnum(*t
) && *t
!= '.' && *t
!= '-' && *t
!= '_' &&
2923 (!allow_utf8_domains
|| *t
< 128)) break;
2925 /* If the pattern is a complete domain name, with no fancy characters, look up
2926 its IP address and match against that. Note that a multi-homed host will add
2927 items to the chain. */
2938 /* Using byname rather than bydns here means we cannot determine dnssec
2939 status. On the other hand it is unclear how that could be either
2940 propagated up or enforced. */
2942 rc
= host_find_byname(&h
, NULL
, HOST_FIND_QUALIFY_SINGLE
, NULL
, FALSE
);
2943 if (rc
== HOST_FOUND
|| rc
== HOST_FOUND_LOCAL
)
2946 for (hh
= &h
; hh
!= NULL
; hh
= hh
->next
)
2948 if (host_is_in_net(hh
->address
, cb
->host_address
, 0)) return OK
;
2952 if (rc
== HOST_FIND_AGAIN
) return DEFER
;
2953 *error
= string_sprintf("failed to find IP address for %s", ss
);
2957 /* Almost all subsequent comparisons require the host name, and can be done
2958 using the general string matching function. When this function is called for
2959 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
2960 must use sender_host_name and its aliases, looking them up if necessary. */
2962 if (cb
->host_name
!= NULL
) /* Explicit host name given */
2963 return match_check_string(cb
->host_name
, ss
, -1, TRUE
, TRUE
, TRUE
,
2966 /* Host name not given; in principle we need the sender host name and its
2967 aliases. However, for query-style lookups, we do not need the name if the
2968 query does not contain $sender_host_name. From release 4.23, a reference to
2969 $sender_host_name causes it to be looked up, so we don't need to do the lookup
2972 if ((semicolon
= Ustrchr(ss
, ';')) != NULL
)
2974 const uschar
*affix
;
2975 int partial
, affixlen
, starflags
, id
;
2978 id
= search_findtype_partial(ss
, &partial
, &affix
, &affixlen
, &starflags
);
2981 if (id
< 0) /* Unknown lookup type */
2983 log_write(0, LOG_MAIN
|LOG_PANIC
, "%s in host list item \"%s\"",
2984 search_error_message
, ss
);
2987 isquery
= mac_islookup(id
, lookup_querystyle
|lookup_absfilequery
);
2992 switch(match_check_string(US
"", ss
, -1, TRUE
, TRUE
, TRUE
, valueptr
))
2995 case DEFER
: return DEFER
;
2996 default: return FAIL
;
3000 /* Not a query-style lookup; must ensure the host name is present, and then we
3001 do a check on the name and all its aliases. */
3003 if (sender_host_name
== NULL
)
3005 HDEBUG(D_host_lookup
)
3006 debug_printf("sender host name required, to match against %s\n", ss
);
3007 if (host_lookup_failed
|| host_name_lookup() != OK
)
3009 *error
= string_sprintf("failed to find host name for %s",
3010 sender_host_address
);;
3013 host_build_sender_fullhost();
3016 /* Match on the sender host name, using the general matching function */
3018 switch(match_check_string(sender_host_name
, ss
, -1, TRUE
, TRUE
, TRUE
,
3022 case DEFER
: return DEFER
;
3025 /* If there are aliases, try matching on them. */
3027 aliases
= sender_host_aliases
;
3028 while (*aliases
!= NULL
)
3030 switch(match_check_string(*aliases
++, ss
, -1, TRUE
, TRUE
, TRUE
, valueptr
))
3033 case DEFER
: return DEFER
;
3042 /*************************************************
3043 * Check a specific host matches a host list *
3044 *************************************************/
3046 /* This function is passed a host list containing items in a number of
3047 different formats and the identity of a host. Its job is to determine whether
3048 the given host is in the set of hosts defined by the list. The host name is
3049 passed as a pointer so that it can be looked up if needed and not already
3050 known. This is commonly the case when called from verify_check_host() to check
3051 an incoming connection. When called from elsewhere the host name should usually
3054 This function is now just a front end to match_check_list(), which runs common
3055 code for scanning a list. We pass it the check_host() function to perform a
3059 listptr pointer to the host list
3060 cache_bits pointer to cache for named lists, or NULL
3061 host_name the host name or NULL, implying use sender_host_name and
3062 sender_host_aliases, looking them up if required
3063 host_address the IP address
3064 valueptr if not NULL, data from a lookup is passed back here
3066 Returns: OK if the host is in the defined set
3067 FAIL if the host is not in the defined set,
3068 DEFER if a data lookup deferred (not a host lookup)
3070 If the host name was needed in order to make a comparison, and could not be
3071 determined from the IP address, the result is FAIL unless the item
3072 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3075 verify_check_this_host(const uschar
**listptr
, unsigned int *cache_bits
,
3076 const uschar
*host_name
, const uschar
*host_address
, const uschar
**valueptr
)
3079 unsigned int *local_cache_bits
= cache_bits
;
3080 const uschar
*save_host_address
= deliver_host_address
;
3081 check_host_block cb
;
3082 cb
.host_name
= host_name
;
3083 cb
.host_address
= host_address
;
3085 if (valueptr
!= NULL
) *valueptr
= NULL
;
3087 /* If the host address starts off ::ffff: it is an IPv6 address in
3088 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3091 cb
.host_ipv4
= (Ustrncmp(host_address
, "::ffff:", 7) == 0)?
3092 host_address
+ 7 : host_address
;
3094 /* During the running of the check, put the IP address into $host_address. In
3095 the case of calls from the smtp transport, it will already be there. However,
3096 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3097 the safe side, any existing setting is preserved, though as I write this
3098 (November 2004) I can't see any cases where it is actually needed. */
3100 deliver_host_address
= host_address
;
3101 rc
= match_check_list(
3102 listptr
, /* the list */
3103 0, /* separator character */
3104 &hostlist_anchor
, /* anchor pointer */
3105 &local_cache_bits
, /* cache pointer */
3106 check_host
, /* function for testing */
3107 &cb
, /* argument for function */
3108 MCL_HOST
, /* type of check */
3109 (host_address
== sender_host_address
)?
3110 US
"host" : host_address
, /* text for debugging */
3111 valueptr
); /* where to pass back data */
3112 deliver_host_address
= save_host_address
;
3119 /*************************************************
3120 * Check the given host item matches a list *
3121 *************************************************/
3123 verify_check_given_host(uschar
**listptr
, host_item
*host
)
3125 return verify_check_this_host(CUSS listptr
, NULL
, host
->name
, host
->address
, NULL
);
3128 /*************************************************
3129 * Check the remote host matches a list *
3130 *************************************************/
3132 /* This is a front end to verify_check_this_host(), created because checking
3133 the remote host is a common occurrence. With luck, a good compiler will spot
3134 the tail recursion and optimize it. If there's no host address, this is
3135 command-line SMTP input - check against an empty string for the address.
3138 listptr pointer to the host list
3140 Returns: the yield of verify_check_this_host(),
3141 i.e. OK, FAIL, or DEFER
3145 verify_check_host(uschar
**listptr
)
3147 return verify_check_this_host(CUSS listptr
, sender_host_cache
, NULL
,
3148 (sender_host_address
== NULL
)? US
"" : sender_host_address
, NULL
);
3155 /*************************************************
3156 * Invert an IP address *
3157 *************************************************/
3159 /* Originally just used for DNS xBL lists, now also used for the
3160 reverse_ip expansion operator.
3163 buffer where to put the answer
3164 address the address to invert
3168 invert_address(uschar
*buffer
, uschar
*address
)
3171 uschar
*bptr
= buffer
;
3173 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3174 to the IPv4 part only. */
3176 if (Ustrncmp(address
, "::ffff:", 7) == 0) address
+= 7;
3178 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3181 if (host_aton(address
, bin
) == 1)
3185 for (i
= 0; i
< 4; i
++)
3187 sprintf(CS bptr
, "%d.", x
& 255);
3188 while (*bptr
) bptr
++;
3193 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3194 in any DNS black lists, and the format in which they will be looked up is
3195 unknown. This is just a guess. */
3201 for (j
= 3; j
>= 0; j
--)
3204 for (i
= 0; i
< 8; i
++)
3206 sprintf(CS bptr
, "%x.", x
& 15);
3207 while (*bptr
) bptr
++;
3214 /* Remove trailing period -- this is needed so that both arbitrary
3215 dnsbl keydomains and inverted addresses may be combined with the
3216 same format string, "%s.%s" */
3223 /*************************************************
3224 * Perform a single dnsbl lookup *
3225 *************************************************/
3227 /* This function is called from verify_check_dnsbl() below. It is also called
3228 recursively from within itself when domain and domain_txt are different
3229 pointers, in order to get the TXT record from the alternate domain.
3232 domain the outer dnsbl domain
3233 domain_txt alternate domain to lookup TXT record on success; when the
3234 same domain is to be used, domain_txt == domain (that is,
3235 the pointers must be identical, not just the text)
3236 keydomain the current keydomain (for debug message)
3237 prepend subdomain to lookup (like keydomain, but
3238 reversed if IP address)
3239 iplist the list of matching IP addresses, or NULL for "any"
3240 bitmask true if bitmask matching is wanted
3241 match_type condition for 'succeed' result
3242 0 => Any RR in iplist (=)
3243 1 => No RR in iplist (!=)
3244 2 => All RRs in iplist (==)
3245 3 => Some RRs not in iplist (!==)
3246 the two bits are defined as MT_NOT and MT_ALL
3247 defer_return what to return for a defer
3249 Returns: OK if lookup succeeded
3254 one_check_dnsbl(uschar
*domain
, uschar
*domain_txt
, uschar
*keydomain
,
3255 uschar
*prepend
, uschar
*iplist
, BOOL bitmask
, int match_type
,
3261 dnsbl_cache_block
*cb
;
3262 int old_pool
= store_pool
;
3263 uschar query
[256]; /* DNS domain max length */
3265 /* Construct the specific query domainname */
3267 if (!string_format(query
, sizeof(query
), "%s.%s", prepend
, domain
))
3269 log_write(0, LOG_MAIN
|LOG_PANIC
, "dnslist query is too long "
3270 "(ignored): %s...", query
);
3274 /* Look for this query in the cache. */
3276 if ( (t
= tree_search(dnsbl_cache
, query
))
3277 && (cb
= t
->data
.ptr
)->expiry
> time(NULL
)
3280 /* Previous lookup was cached */
3283 HDEBUG(D_dnsbl
) debug_printf("using result of previous DNS lookup\n");
3286 /* If not cached from a previous lookup, we must do a DNS lookup, and
3287 cache the result in permanent memory. */
3293 store_pool
= POOL_PERM
;
3297 HDEBUG(D_dnsbl
) debug_printf("cached data found but past valid time; ");
3301 { /* Set up a tree entry to cache the lookup */
3302 t
= store_get(sizeof(tree_node
) + Ustrlen(query
));
3303 Ustrcpy(t
->name
, query
);
3304 t
->data
.ptr
= cb
= store_get(sizeof(dnsbl_cache_block
));
3305 (void)tree_insertnode(&dnsbl_cache
, t
);
3308 /* Do the DNS lookup . */
3310 HDEBUG(D_dnsbl
) debug_printf("new DNS lookup for %s\n", query
);
3311 cb
->rc
= dns_basic_lookup(&dnsa
, query
, T_A
);
3312 cb
->text_set
= FALSE
;
3316 /* If the lookup succeeded, cache the RHS address. The code allows for
3317 more than one address - this was for complete generality and the possible
3318 use of A6 records. However, A6 records have been reduced to experimental
3319 status (August 2001) and may die out. So they may never get used at all,
3320 let alone in dnsbl records. However, leave the code here, just in case.
3322 Quite apart from one A6 RR generating multiple addresses, there are DNS
3323 lists that return more than one A record, so we must handle multiple
3324 addresses generated in that way as well.
3326 Mark the cache entry with the "now" plus the minimum of the address TTLs,
3327 or some suitably far-future time if none were found. */
3329 if (cb
->rc
== DNS_SUCCEED
)
3332 dns_address
**addrp
= &(cb
->rhs
);
3333 for (rr
= dns_next_rr(&dnsa
, &dnss
, RESET_ANSWERS
);
3335 rr
= dns_next_rr(&dnsa
, &dnss
, RESET_NEXT
))
3337 if (rr
->type
== T_A
)
3339 dns_address
*da
= dns_address_from_rr(&dnsa
, rr
);
3343 while (da
->next
!= NULL
) da
= da
->next
;
3344 addrp
= &(da
->next
);
3345 if (ttl
> rr
->ttl
) ttl
= rr
->ttl
;
3350 /* If we didn't find any A records, change the return code. This can
3351 happen when there is a CNAME record but there are no A records for what
3354 if (cb
->rhs
== NULL
) cb
->rc
= DNS_NODATA
;
3357 cb
->expiry
= time(NULL
)+ttl
;
3358 store_pool
= old_pool
;
3361 /* We now have the result of the DNS lookup, either newly done, or cached
3362 from a previous call. If the lookup succeeded, check against the address
3363 list if there is one. This may be a positive equality list (introduced by
3364 "="), a negative equality list (introduced by "!="), a positive bitmask
3365 list (introduced by "&"), or a negative bitmask list (introduced by "!&").*/
3367 if (cb
->rc
== DNS_SUCCEED
)
3369 dns_address
*da
= NULL
;
3370 uschar
*addlist
= cb
->rhs
->address
;
3372 /* For A and AAAA records, there may be multiple addresses from multiple
3373 records. For A6 records (currently not expected to be used) there may be
3374 multiple addresses from a single record. */
3376 for (da
= cb
->rhs
->next
; da
!= NULL
; da
= da
->next
)
3377 addlist
= string_sprintf("%s, %s", addlist
, da
->address
);
3379 HDEBUG(D_dnsbl
) debug_printf("DNS lookup for %s succeeded (yielding %s)\n",
3382 /* Address list check; this can be either for equality, or via a bitmask.
3383 In the latter case, all the bits must match. */
3387 for (da
= cb
->rhs
; da
!= NULL
; da
= da
->next
)
3391 const uschar
*ptr
= iplist
;
3394 /* Handle exact matching */
3398 while ((res
= string_nextinlist(&ptr
, &ipsep
, ip
, sizeof(ip
))) != NULL
)
3400 if (Ustrcmp(CS da
->address
, ip
) == 0) break;
3404 /* Handle bitmask matching */
3411 /* At present, all known DNS blocking lists use A records, with
3412 IPv4 addresses on the RHS encoding the information they return. I
3413 wonder if this will linger on as the last vestige of IPv4 when IPv6
3414 is ubiquitous? Anyway, for now we use paranoia code to completely
3415 ignore IPv6 addresses. The default mask is 0, which always matches.
3416 We change this only for IPv4 addresses in the list. */
3418 if (host_aton(da
->address
, address
) == 1) mask
= address
[0];
3420 /* Scan the returned addresses, skipping any that are IPv6 */
3422 while ((res
= string_nextinlist(&ptr
, &ipsep
, ip
, sizeof(ip
))) != NULL
)
3424 if (host_aton(ip
, address
) != 1) continue;
3425 if ((address
[0] & mask
) == address
[0]) break;
3431 (a) An IP address in an any ('=') list matched, or
3432 (b) No IP address in an all ('==') list matched
3434 then we're done searching. */
3436 if (((match_type
& MT_ALL
) != 0) == (res
== NULL
)) break;
3439 /* If da == NULL, either
3441 (a) No IP address in an any ('=') list matched, or
3442 (b) An IP address in an all ('==') list didn't match
3444 so behave as if the DNSBL lookup had not succeeded, i.e. the host is not on
3447 if ((match_type
== MT_NOT
|| match_type
== MT_ALL
) != (da
== NULL
))
3455 res
= US
"was no match";
3458 res
= US
"was an exclude match";
3461 res
= US
"was an IP address that did not match";
3464 res
= US
"were no IP addresses that did not match";
3467 debug_printf("=> but we are not accepting this block class because\n");
3468 debug_printf("=> there %s for %s%c%s\n",
3470 ((match_type
& MT_ALL
) == 0)? "" : "=",
3471 bitmask
? '&' : '=', iplist
);
3477 /* Either there was no IP list, or the record matched, implying that the
3478 domain is on the list. We now want to find a corresponding TXT record. If an
3479 alternate domain is specified for the TXT record, call this function
3480 recursively to look that up; this has the side effect of re-checking that
3481 there is indeed an A record at the alternate domain. */
3483 if (domain_txt
!= domain
)
3484 return one_check_dnsbl(domain_txt
, domain_txt
, keydomain
, prepend
, NULL
,
3485 FALSE
, match_type
, defer_return
);
3487 /* If there is no alternate domain, look up a TXT record in the main domain
3488 if it has not previously been cached. */
3492 cb
->text_set
= TRUE
;
3493 if (dns_basic_lookup(&dnsa
, query
, T_TXT
) == DNS_SUCCEED
)
3496 for (rr
= dns_next_rr(&dnsa
, &dnss
, RESET_ANSWERS
);
3498 rr
= dns_next_rr(&dnsa
, &dnss
, RESET_NEXT
))
3499 if (rr
->type
== T_TXT
) break;
3502 int len
= (rr
->data
)[0];
3503 if (len
> 511) len
= 127;
3504 store_pool
= POOL_PERM
;
3505 cb
->text
= string_sprintf("%.*s", len
, (const uschar
*)(rr
->data
+1));
3506 store_pool
= old_pool
;
3511 dnslist_value
= addlist
;
3512 dnslist_text
= cb
->text
;
3516 /* There was a problem with the DNS lookup */
3518 if (cb
->rc
!= DNS_NOMATCH
&& cb
->rc
!= DNS_NODATA
)
3520 log_write(L_dnslist_defer
, LOG_MAIN
,
3521 "DNS list lookup defer (probably timeout) for %s: %s", query
,
3522 (defer_return
== OK
)? US
"assumed in list" :
3523 (defer_return
== FAIL
)? US
"assumed not in list" :
3524 US
"returned DEFER");
3525 return defer_return
;
3528 /* No entry was found in the DNS; continue for next domain */
3532 debug_printf("DNS lookup for %s failed\n", query
);
3533 debug_printf("=> that means %s is not listed at %s\n",
3543 /*************************************************
3544 * Check host against DNS black lists *
3545 *************************************************/
3547 /* This function runs checks against a list of DNS black lists, until one
3548 matches. Each item on the list can be of the form
3550 domain=ip-address/key
3552 The domain is the right-most domain that is used for the query, for example,
3553 blackholes.mail-abuse.org. If the IP address is present, there is a match only
3554 if the DNS lookup returns a matching IP address. Several addresses may be
3555 given, comma-separated, for example: x.y.z=127.0.0.1,127.0.0.2.
3557 If no key is given, what is looked up in the domain is the inverted IP address
3558 of the current client host. If a key is given, it is used to construct the
3559 domain for the lookup. For example:
3561 dsn.rfc-ignorant.org/$sender_address_domain
3563 After finding a match in the DNS, the domain is placed in $dnslist_domain, and
3564 then we check for a TXT record for an error message, and if found, save its
3565 value in $dnslist_text. We also cache everything in a tree, to optimize
3568 The TXT record is normally looked up in the same domain as the A record, but
3569 when many lists are combined in a single DNS domain, this will not be a very
3570 specific message. It is possible to specify a different domain for looking up
3571 TXT records; this is given before the main domain, comma-separated. For
3574 dnslists = http.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.2 : \
3575 socks.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.3
3577 The caching ensures that only one lookup in dnsbl.sorbs.net is done.
3579 Note: an address for testing RBL is 192.203.178.39
3580 Note: an address for testing DUL is 192.203.178.4
3581 Note: a domain for testing RFCI is example.tld.dsn.rfc-ignorant.org
3585 listptr the domain/address/data list
3586 log_msgptr log message on error
3588 Returns: OK successful lookup (i.e. the address is on the list), or
3589 lookup deferred after +include_unknown
3590 FAIL name not found, or no data found for the given type, or
3591 lookup deferred after +exclude_unknown (default)
3592 DEFER lookup failure, if +defer_unknown was set
3596 verify_check_dnsbl(int where
, const uschar
** listptr
, uschar
** log_msgptr
)
3599 int defer_return
= FAIL
;
3600 const uschar
*list
= *listptr
;
3603 uschar buffer
[1024];
3604 uschar revadd
[128]; /* Long enough for IPv6 address */
3606 /* Indicate that the inverted IP address is not yet set up */
3610 /* In case this is the first time the DNS resolver is being used. */
3612 dns_init(FALSE
, FALSE
, FALSE
); /*XXX dnssec? */
3614 /* Loop through all the domains supplied, until something matches */
3616 while ((domain
= string_nextinlist(&list
, &sep
, buffer
, sizeof(buffer
))) != NULL
)
3619 BOOL bitmask
= FALSE
;
3626 HDEBUG(D_dnsbl
) debug_printf("DNS list check: %s\n", domain
);
3628 /* Deal with special values that change the behaviour on defer */
3630 if (domain
[0] == '+')
3632 if (strcmpic(domain
, US
"+include_unknown") == 0) defer_return
= OK
;
3633 else if (strcmpic(domain
, US
"+exclude_unknown") == 0) defer_return
= FAIL
;
3634 else if (strcmpic(domain
, US
"+defer_unknown") == 0) defer_return
= DEFER
;
3636 log_write(0, LOG_MAIN
|LOG_PANIC
, "unknown item in dnslist (ignored): %s",
3641 /* See if there's explicit data to be looked up */
3643 if ((key
= Ustrchr(domain
, '/'))) *key
++ = 0;
3645 /* See if there's a list of addresses supplied after the domain name. This is
3646 introduced by an = or a & character; if preceded by = we require all matches
3647 and if preceded by ! we invert the result. */
3649 if (!(iplist
= Ustrchr(domain
, '=')))
3652 iplist
= Ustrchr(domain
, '&');
3655 if (iplist
) /* Found either = or & */
3657 if (iplist
> domain
&& iplist
[-1] == '!') /* Handle preceding ! */
3659 match_type
|= MT_NOT
;
3663 *iplist
++ = 0; /* Terminate domain, move on */
3665 /* If we found = (bitmask == FALSE), check for == or =& */
3667 if (!bitmask
&& (*iplist
== '=' || *iplist
== '&'))
3669 bitmask
= *iplist
++ == '&';
3670 match_type
|= MT_ALL
;
3675 /* If there is a comma in the domain, it indicates that a second domain for
3676 looking up TXT records is provided, before the main domain. Otherwise we must
3677 set domain_txt == domain. */
3679 domain_txt
= domain
;
3680 comma
= Ustrchr(domain
, ',');
3687 /* Check that what we have left is a sensible domain name. There is no reason
3688 why these domains should in fact use the same syntax as hosts and email
3689 domains, but in practice they seem to. However, there is little point in
3690 actually causing an error here, because that would no doubt hold up incoming
3691 mail. Instead, I'll just log it. */
3693 for (s
= domain
; *s
!= 0; s
++)
3695 if (!isalnum(*s
) && *s
!= '-' && *s
!= '.' && *s
!= '_')
3697 log_write(0, LOG_MAIN
, "dnslists domain \"%s\" contains "
3698 "strange characters - is this right?", domain
);
3703 /* Check the alternate domain if present */
3705 if (domain_txt
!= domain
) for (s
= domain_txt
; *s
!= 0; s
++)
3707 if (!isalnum(*s
) && *s
!= '-' && *s
!= '.' && *s
!= '_')
3709 log_write(0, LOG_MAIN
, "dnslists domain \"%s\" contains "
3710 "strange characters - is this right?", domain_txt
);
3715 /* If there is no key string, construct the query by adding the domain name
3716 onto the inverted host address, and perform a single DNS lookup. */
3720 if (where
== ACL_WHERE_NOTSMTP_START
|| where
== ACL_WHERE_NOTSMTP
)
3722 *log_msgptr
= string_sprintf
3723 ("cannot test auto-keyed dnslists condition in %s ACL",
3724 acl_wherenames
[where
]);
3727 if (sender_host_address
== NULL
) return FAIL
; /* can never match */
3728 if (revadd
[0] == 0) invert_address(revadd
, sender_host_address
);
3729 rc
= one_check_dnsbl(domain
, domain_txt
, sender_host_address
, revadd
,
3730 iplist
, bitmask
, match_type
, defer_return
);
3733 dnslist_domain
= string_copy(domain_txt
);
3734 dnslist_matched
= string_copy(sender_host_address
);
3735 HDEBUG(D_dnsbl
) debug_printf("=> that means %s is listed at %s\n",
3736 sender_host_address
, dnslist_domain
);
3738 if (rc
!= FAIL
) return rc
; /* OK or DEFER */
3741 /* If there is a key string, it can be a list of domains or IP addresses to
3742 be concatenated with the main domain. */
3749 uschar keybuffer
[256];
3750 uschar keyrevadd
[128];
3752 while ((keydomain
= string_nextinlist(CUSS
&key
, &keysep
, keybuffer
,
3753 sizeof(keybuffer
))) != NULL
)
3755 uschar
*prepend
= keydomain
;
3757 if (string_is_ip_address(keydomain
, NULL
) != 0)
3759 invert_address(keyrevadd
, keydomain
);
3760 prepend
= keyrevadd
;
3763 rc
= one_check_dnsbl(domain
, domain_txt
, keydomain
, prepend
, iplist
,
3764 bitmask
, match_type
, defer_return
);
3768 dnslist_domain
= string_copy(domain_txt
);
3769 dnslist_matched
= string_copy(keydomain
);
3770 HDEBUG(D_dnsbl
) debug_printf("=> that means %s is listed at %s\n",
3771 keydomain
, dnslist_domain
);
3775 /* If the lookup deferred, remember this fact. We keep trying the rest
3776 of the list to see if we get a useful result, and if we don't, we return
3777 DEFER at the end. */
3779 if (rc
== DEFER
) defer
= TRUE
;
3780 } /* continue with next keystring domain/address */
3782 if (defer
) return DEFER
;
3784 } /* continue with next dnsdb outer domain */
3791 /* End of verify.c */