Compilation warnings shushing
[exim.git] / src / src / transports / smtp.c
CommitLineData
0756eb3c
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
d4e5e70b 5/* Copyright (c) University of Cambridge 1995 - 2017 */
0756eb3c
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8#include "../exim.h"
9#include "smtp.h"
10
0756eb3c
PH
11
12/* Options specific to the smtp transport. This transport also supports LMTP
13over TCP/IP. The options must be in alphabetic order (note that "_" comes
14before the lower case letters). Some live in the transport_instance block so as
15to be publicly visible; these are flagged with opt_public. */
16
17optionlist smtp_transport_options[] = {
506900af
JH
18 { "*expand_multi_domain", opt_stringptr | opt_hidden | opt_public,
19 (void *)offsetof(transport_instance, expand_multi_domain) },
9c695f6d
JH
20 { "*expand_retry_include_ip_address", opt_stringptr | opt_hidden,
21 (void *)(offsetof(smtp_transport_options_block, expand_retry_include_ip_address)) },
22
48c7f9e2
PH
23 { "address_retry_include_sender", opt_bool,
24 (void *)offsetof(smtp_transport_options_block, address_retry_include_sender) },
0756eb3c
PH
25 { "allow_localhost", opt_bool,
26 (void *)offsetof(smtp_transport_options_block, allow_localhost) },
27 { "authenticated_sender", opt_stringptr,
28 (void *)offsetof(smtp_transport_options_block, authenticated_sender) },
382afc6b
PH
29 { "authenticated_sender_force", opt_bool,
30 (void *)offsetof(smtp_transport_options_block, authenticated_sender_force) },
0756eb3c
PH
31 { "command_timeout", opt_time,
32 (void *)offsetof(smtp_transport_options_block, command_timeout) },
33 { "connect_timeout", opt_time,
34 (void *)offsetof(smtp_transport_options_block, connect_timeout) },
35 { "connection_max_messages", opt_int | opt_public,
36 (void *)offsetof(transport_instance, connection_max_messages) },
37 { "data_timeout", opt_time,
38 (void *)offsetof(smtp_transport_options_block, data_timeout) },
39 { "delay_after_cutoff", opt_bool,
40 (void *)offsetof(smtp_transport_options_block, delay_after_cutoff) },
80a47a2c 41#ifndef DISABLE_DKIM
f7572e5a 42 { "dkim_canon", opt_stringptr,
ff5aac2b 43 (void *)offsetof(smtp_transport_options_block, dkim.dkim_canon) },
f7572e5a 44 { "dkim_domain", opt_stringptr,
ff5aac2b 45 (void *)offsetof(smtp_transport_options_block, dkim.dkim_domain) },
f7572e5a 46 { "dkim_private_key", opt_stringptr,
ff5aac2b 47 (void *)offsetof(smtp_transport_options_block, dkim.dkim_private_key) },
f7572e5a 48 { "dkim_selector", opt_stringptr,
ff5aac2b 49 (void *)offsetof(smtp_transport_options_block, dkim.dkim_selector) },
f7572e5a 50 { "dkim_sign_headers", opt_stringptr,
ff5aac2b 51 (void *)offsetof(smtp_transport_options_block, dkim.dkim_sign_headers) },
f7572e5a 52 { "dkim_strict", opt_stringptr,
ff5aac2b 53 (void *)offsetof(smtp_transport_options_block, dkim.dkim_strict) },
80a47a2c 54#endif
0756eb3c
PH
55 { "dns_qualify_single", opt_bool,
56 (void *)offsetof(smtp_transport_options_block, dns_qualify_single) },
57 { "dns_search_parents", opt_bool,
58 (void *)offsetof(smtp_transport_options_block, dns_search_parents) },
578897ea 59 { "dnssec_request_domains", opt_stringptr,
7cd171b7 60 (void *)offsetof(smtp_transport_options_block, dnssec.request) },
578897ea 61 { "dnssec_require_domains", opt_stringptr,
7cd171b7 62 (void *)offsetof(smtp_transport_options_block, dnssec.require) },
9e4f5962
PP
63 { "dscp", opt_stringptr,
64 (void *)offsetof(smtp_transport_options_block, dscp) },
0756eb3c
PH
65 { "fallback_hosts", opt_stringptr,
66 (void *)offsetof(smtp_transport_options_block, fallback_hosts) },
67 { "final_timeout", opt_time,
68 (void *)offsetof(smtp_transport_options_block, final_timeout) },
69 { "gethostbyname", opt_bool,
70 (void *)offsetof(smtp_transport_options_block, gethostbyname) },
71 { "helo_data", opt_stringptr,
72 (void *)offsetof(smtp_transport_options_block, helo_data) },
73 { "hosts", opt_stringptr,
74 (void *)offsetof(smtp_transport_options_block, hosts) },
75 { "hosts_avoid_esmtp", opt_stringptr,
76 (void *)offsetof(smtp_transport_options_block, hosts_avoid_esmtp) },
c51b8e75
PH
77 { "hosts_avoid_pipelining", opt_stringptr,
78 (void *)offsetof(smtp_transport_options_block, hosts_avoid_pipelining) },
80a47a2c 79#ifdef SUPPORT_TLS
0756eb3c
PH
80 { "hosts_avoid_tls", opt_stringptr,
81 (void *)offsetof(smtp_transport_options_block, hosts_avoid_tls) },
80a47a2c 82#endif
0756eb3c
PH
83 { "hosts_max_try", opt_int,
84 (void *)offsetof(smtp_transport_options_block, hosts_max_try) },
533244af
PH
85 { "hosts_max_try_hardlimit", opt_int,
86 (void *)offsetof(smtp_transport_options_block, hosts_max_try_hardlimit) },
80a47a2c 87#ifdef SUPPORT_TLS
0756eb3c
PH
88 { "hosts_nopass_tls", opt_stringptr,
89 (void *)offsetof(smtp_transport_options_block, hosts_nopass_tls) },
80a47a2c 90#endif
0756eb3c
PH
91 { "hosts_override", opt_bool,
92 (void *)offsetof(smtp_transport_options_block, hosts_override) },
93 { "hosts_randomize", opt_bool,
94 (void *)offsetof(smtp_transport_options_block, hosts_randomize) },
f2de3a33 95#if defined(SUPPORT_TLS) && !defined(DISABLE_OCSP)
44662487
JH
96 { "hosts_request_ocsp", opt_stringptr,
97 (void *)offsetof(smtp_transport_options_block, hosts_request_ocsp) },
98#endif
0756eb3c
PH
99 { "hosts_require_auth", opt_stringptr,
100 (void *)offsetof(smtp_transport_options_block, hosts_require_auth) },
80a47a2c 101#ifdef SUPPORT_TLS
7a31d643
JH
102# ifdef EXPERIMENTAL_DANE
103 { "hosts_require_dane", opt_stringptr,
104 (void *)offsetof(smtp_transport_options_block, hosts_require_dane) },
105# endif
f2de3a33 106# ifndef DISABLE_OCSP
f5d78688
JH
107 { "hosts_require_ocsp", opt_stringptr,
108 (void *)offsetof(smtp_transport_options_block, hosts_require_ocsp) },
109# endif
0756eb3c
PH
110 { "hosts_require_tls", opt_stringptr,
111 (void *)offsetof(smtp_transport_options_block, hosts_require_tls) },
80a47a2c 112#endif
0756eb3c
PH
113 { "hosts_try_auth", opt_stringptr,
114 (void *)offsetof(smtp_transport_options_block, hosts_try_auth) },
f98442df
JH
115 { "hosts_try_chunking", opt_stringptr,
116 (void *)offsetof(smtp_transport_options_block, hosts_try_chunking) },
7a31d643 117#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
96e47838
TL
118 { "hosts_try_dane", opt_stringptr,
119 (void *)offsetof(smtp_transport_options_block, hosts_try_dane) },
120#endif
fb05276a
JH
121 { "hosts_try_fastopen", opt_stringptr,
122 (void *)offsetof(smtp_transport_options_block, hosts_try_fastopen) },
8ccd00b1 123#ifndef DISABLE_PRDR
fd98a5c6
JH
124 { "hosts_try_prdr", opt_stringptr,
125 (void *)offsetof(smtp_transport_options_block, hosts_try_prdr) },
126#endif
99400968
JH
127#ifdef SUPPORT_TLS
128 { "hosts_verify_avoid_tls", opt_stringptr,
129 (void *)offsetof(smtp_transport_options_block, hosts_verify_avoid_tls) },
130#endif
0756eb3c
PH
131 { "interface", opt_stringptr,
132 (void *)offsetof(smtp_transport_options_block, interface) },
133 { "keepalive", opt_bool,
134 (void *)offsetof(smtp_transport_options_block, keepalive) },
f1513293
PH
135 { "lmtp_ignore_quota", opt_bool,
136 (void *)offsetof(smtp_transport_options_block, lmtp_ignore_quota) },
0756eb3c
PH
137 { "max_rcpt", opt_int | opt_public,
138 (void *)offsetof(transport_instance, max_addresses) },
506900af 139 { "multi_domain", opt_expand_bool | opt_public,
0756eb3c
PH
140 (void *)offsetof(transport_instance, multi_domain) },
141 { "port", opt_stringptr,
142 (void *)offsetof(smtp_transport_options_block, port) },
143 { "protocol", opt_stringptr,
144 (void *)offsetof(smtp_transport_options_block, protocol) },
9c695f6d 145 { "retry_include_ip_address", opt_expand_bool,
0756eb3c
PH
146 (void *)offsetof(smtp_transport_options_block, retry_include_ip_address) },
147 { "serialize_hosts", opt_stringptr,
148 (void *)offsetof(smtp_transport_options_block, serialize_hosts) },
149 { "size_addition", opt_int,
150 (void *)offsetof(smtp_transport_options_block, size_addition) }
f0989ec0 151#ifdef SUPPORT_SOCKS
7eb6c37c
JH
152 ,{ "socks_proxy", opt_stringptr,
153 (void *)offsetof(smtp_transport_options_block, socks_proxy) }
154#endif
80a47a2c 155#ifdef SUPPORT_TLS
0756eb3c
PH
156 ,{ "tls_certificate", opt_stringptr,
157 (void *)offsetof(smtp_transport_options_block, tls_certificate) },
158 { "tls_crl", opt_stringptr,
159 (void *)offsetof(smtp_transport_options_block, tls_crl) },
54c90be1
PP
160 { "tls_dh_min_bits", opt_int,
161 (void *)offsetof(smtp_transport_options_block, tls_dh_min_bits) },
0756eb3c
PH
162 { "tls_privatekey", opt_stringptr,
163 (void *)offsetof(smtp_transport_options_block, tls_privatekey) },
3f0945ff 164 { "tls_require_ciphers", opt_stringptr,
0756eb3c 165 (void *)offsetof(smtp_transport_options_block, tls_require_ciphers) },
3f0945ff
PP
166 { "tls_sni", opt_stringptr,
167 (void *)offsetof(smtp_transport_options_block, tls_sni) },
0756eb3c
PH
168 { "tls_tempfail_tryclear", opt_bool,
169 (void *)offsetof(smtp_transport_options_block, tls_tempfail_tryclear) },
a63be306
WB
170 { "tls_try_verify_hosts", opt_stringptr,
171 (void *)offsetof(smtp_transport_options_block, tls_try_verify_hosts) },
e51c7be2
JH
172 { "tls_verify_cert_hostnames", opt_stringptr,
173 (void *)offsetof(smtp_transport_options_block,tls_verify_cert_hostnames)},
0756eb3c 174 { "tls_verify_certificates", opt_stringptr,
a63be306
WB
175 (void *)offsetof(smtp_transport_options_block, tls_verify_certificates) },
176 { "tls_verify_hosts", opt_stringptr,
177 (void *)offsetof(smtp_transport_options_block, tls_verify_hosts) }
80a47a2c 178#endif
0756eb3c
PH
179};
180
181/* Size of the options list. An extern variable has to be used so that its
182address can appear in the tables drtables.c. */
183
184int smtp_transport_options_count =
185 sizeof(smtp_transport_options)/sizeof(optionlist);
186
187/* Default private options block for the smtp transport. */
188
189smtp_transport_options_block smtp_transport_option_defaults = {
190 NULL, /* hosts */
191 NULL, /* fallback_hosts */
192 NULL, /* hostlist */
193 NULL, /* fallback_hostlist */
194 NULL, /* authenticated_sender */
195 US"$primary_hostname", /* helo_data */
196 NULL, /* interface */
197 NULL, /* port */
198 US"smtp", /* protocol */
9e4f5962 199 NULL, /* DSCP */
0756eb3c
PH
200 NULL, /* serialize_hosts */
201 NULL, /* hosts_try_auth */
202 NULL, /* hosts_require_auth */
f98442df 203 US"*", /* hosts_try_chunking */
96e47838
TL
204#ifdef EXPERIMENTAL_DANE
205 NULL, /* hosts_try_dane */
7a31d643 206 NULL, /* hosts_require_dane */
96e47838 207#endif
fb05276a 208 NULL, /* hosts_try_fastopen */
8ccd00b1 209#ifndef DISABLE_PRDR
f98442df 210 US"*", /* hosts_try_prdr */
fd98a5c6 211#endif
f2de3a33 212#ifndef DISABLE_OCSP
0e66b3b6 213 US"*", /* hosts_request_ocsp (except under DANE; tls_client_start()) */
f5d78688
JH
214 NULL, /* hosts_require_ocsp */
215#endif
0756eb3c
PH
216 NULL, /* hosts_require_tls */
217 NULL, /* hosts_avoid_tls */
6c9ed72e 218 NULL, /* hosts_verify_avoid_tls */
c51b8e75 219 NULL, /* hosts_avoid_pipelining */
0756eb3c
PH
220 NULL, /* hosts_avoid_esmtp */
221 NULL, /* hosts_nopass_tls */
222 5*60, /* command_timeout */
223 5*60, /* connect_timeout; shorter system default overrides */
224 5*60, /* data timeout */
225 10*60, /* final timeout */
226 1024, /* size_addition */
227 5, /* hosts_max_try */
8e669ac1 228 50, /* hosts_max_try_hardlimit */
48c7f9e2 229 TRUE, /* address_retry_include_sender */
0756eb3c 230 FALSE, /* allow_localhost */
382afc6b 231 FALSE, /* authenticated_sender_force */
0756eb3c
PH
232 FALSE, /* gethostbyname */
233 TRUE, /* dns_qualify_single */
234 FALSE, /* dns_search_parents */
0539a19d 235 { NULL, NULL }, /* dnssec_domains {request,require} */
0756eb3c
PH
236 TRUE, /* delay_after_cutoff */
237 FALSE, /* hosts_override */
238 FALSE, /* hosts_randomize */
239 TRUE, /* keepalive */
f1513293 240 FALSE, /* lmtp_ignore_quota */
9c695f6d 241 NULL, /* expand_retry_include_ip_address */
0756eb3c 242 TRUE /* retry_include_ip_address */
f0989ec0 243#ifdef SUPPORT_SOCKS
7eb6c37c 244 ,NULL /* socks_proxy */
b8bf753b 245#endif
80a47a2c 246#ifdef SUPPORT_TLS
0756eb3c
PH
247 ,NULL, /* tls_certificate */
248 NULL, /* tls_crl */
249 NULL, /* tls_privatekey */
250 NULL, /* tls_require_ciphers */
54c90be1 251 NULL, /* tls_sni */
0e0f3f56 252 US"system", /* tls_verify_certificates */
54c90be1
PP
253 EXIM_CLIENT_DH_DEFAULT_MIN_BITS,
254 /* tls_dh_min_bits */
a63be306
WB
255 TRUE, /* tls_tempfail_tryclear */
256 NULL, /* tls_verify_hosts */
610ff438 257 US"*", /* tls_try_verify_hosts */
01a4a5c5 258 US"*" /* tls_verify_cert_hostnames */
80a47a2c
TK
259#endif
260#ifndef DISABLE_DKIM
ff5aac2b
JH
261 , {NULL, /* dkim_canon */
262 NULL, /* dkim_domain */
263 NULL, /* dkim_private_key */
264 NULL, /* dkim_selector */
265 NULL, /* dkim_sign_headers */
e983e85a
JH
266 NULL, /* dkim_strict */
267 FALSE} /* dot_stuffed */
80a47a2c 268#endif
0756eb3c
PH
269};
270
6c1c3d1d
WB
271/* some DSN flags for use later */
272
273static int rf_list[] = {rf_notify_never, rf_notify_success,
274 rf_notify_failure, rf_notify_delay };
275
45500060 276static uschar *rf_names[] = { US"NEVER", US"SUCCESS", US"FAILURE", US"DELAY" };
6c1c3d1d
WB
277
278
0756eb3c
PH
279
280/* Local statics */
281
87cb4a16
JH
282static uschar *smtp_command; /* Points to last cmd for error messages */
283static uschar *mail_command; /* Points to MAIL cmd for error messages */
284static uschar *data_command = US""; /* Points to DATA cmd for error messages */
285static BOOL update_waiting; /* TRUE to update the "wait" database */
286static BOOL pipelining_active; /* current transaction is in pipe mode */
0756eb3c
PH
287
288
289/*************************************************
290* Setup entry point *
291*************************************************/
292
293/* This function is called when the transport is about to be used,
294but before running it in a sub-process. It is used for two things:
295
296 (1) To set the fallback host list in addresses, when delivering.
26da7e20
PH
297 (2) To pass back the interface, port, protocol, and other options, for use
298 during callout verification.
0756eb3c
PH
299
300Arguments:
301 tblock pointer to the transport instance block
302 addrlist list of addresses about to be transported
303 tf if not NULL, pointer to block in which to return options
929ba01c
PH
304 uid the uid that will be set (not used)
305 gid the gid that will be set (not used)
0756eb3c
PH
306 errmsg place for error message (not used)
307
308Returns: OK always (FAIL, DEFER not used)
309*/
310
311static int
312smtp_transport_setup(transport_instance *tblock, address_item *addrlist,
929ba01c 313 transport_feedback *tf, uid_t uid, gid_t gid, uschar **errmsg)
0756eb3c
PH
314{
315smtp_transport_options_block *ob =
316 (smtp_transport_options_block *)(tblock->options_block);
317
318errmsg = errmsg; /* Keep picky compilers happy */
929ba01c
PH
319uid = uid;
320gid = gid;
0756eb3c
PH
321
322/* Pass back options if required. This interface is getting very messy. */
323
02b41d71 324if (tf)
0756eb3c
PH
325 {
326 tf->interface = ob->interface;
327 tf->port = ob->port;
328 tf->protocol = ob->protocol;
329 tf->hosts = ob->hosts;
330 tf->hosts_override = ob->hosts_override;
331 tf->hosts_randomize = ob->hosts_randomize;
332 tf->gethostbyname = ob->gethostbyname;
333 tf->qualify_single = ob->dns_qualify_single;
334 tf->search_parents = ob->dns_search_parents;
26da7e20 335 tf->helo_data = ob->helo_data;
0756eb3c
PH
336 }
337
338/* Set the fallback host list for all the addresses that don't have fallback
339host lists, provided that the local host wasn't present in the original host
340list. */
341
342if (!testflag(addrlist, af_local_host_removed))
02b41d71
JH
343 for (; addrlist; addrlist = addrlist->next)
344 if (!addrlist->fallback_hosts) addrlist->fallback_hosts = ob->fallback_hostlist;
0756eb3c
PH
345
346return OK;
347}
348
349
350
351/*************************************************
352* Initialization entry point *
353*************************************************/
354
355/* Called for each instance, after its options have been read, to
356enable consistency checks to be done, or anything else that needs
357to be set up.
358
359Argument: pointer to the transport instance block
360Returns: nothing
361*/
362
363void
364smtp_transport_init(transport_instance *tblock)
365{
366smtp_transport_options_block *ob =
367 (smtp_transport_options_block *)(tblock->options_block);
368
369/* Retry_use_local_part defaults FALSE if unset */
370
371if (tblock->retry_use_local_part == TRUE_UNSET)
372 tblock->retry_use_local_part = FALSE;
373
374/* Set the default port according to the protocol */
375
376if (ob->port == NULL)
061b7ebd
PP
377 ob->port = (strcmpic(ob->protocol, US"lmtp") == 0)? US"lmtp" :
378 (strcmpic(ob->protocol, US"smtps") == 0)? US"smtps" : US"smtp";
0756eb3c
PH
379
380/* Set up the setup entry point, to be called before subprocesses for this
381transport. */
382
383tblock->setup = smtp_transport_setup;
384
385/* Complain if any of the timeouts are zero. */
386
387if (ob->command_timeout <= 0 || ob->data_timeout <= 0 ||
388 ob->final_timeout <= 0)
389 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
390 "command, data, or final timeout value is zero for %s transport",
391 tblock->name);
392
393/* If hosts_override is set and there are local hosts, set the global
394flag that stops verify from showing router hosts. */
395
396if (ob->hosts_override && ob->hosts != NULL) tblock->overrides_hosts = TRUE;
397
398/* If there are any fallback hosts listed, build a chain of host items
399for them, but do not do any lookups at this time. */
400
401host_build_hostlist(&(ob->fallback_hostlist), ob->fallback_hosts, FALSE);
402}
403
404
405
406
407
408/*************************************************
409* Set delivery info into all active addresses *
410*************************************************/
411
412/* Only addresses whose status is >= PENDING are relevant. A lesser
413status means that an address is not currently being processed.
414
415Arguments:
447d236c
PH
416 addrlist points to a chain of addresses
417 errno_value to put in each address's errno field
418 msg to put in each address's message field
419 rc to put in each address's transport_return field
420 pass_message if TRUE, set the "pass message" flag in the address
c562fd30 421 host if set, mark addrs as having used this host
895fbaf2
JH
422 smtp_greeting from peer
423 helo_response from peer
0756eb3c
PH
424
425If errno_value has the special value ERRNO_CONNECTTIMEOUT, ETIMEDOUT is put in
426the errno field, and RTEF_CTOUT is ORed into the more_errno field, to indicate
427this particular type of timeout.
428
429Returns: nothing
430*/
431
7cd1141b
PH
432static void
433set_errno(address_item *addrlist, int errno_value, uschar *msg, int rc,
895fbaf2
JH
434 BOOL pass_message, host_item * host
435#ifdef EXPERIMENTAL_DSN_INFO
436 , const uschar * smtp_greeting, const uschar * helo_response
437#endif
438 )
0756eb3c
PH
439{
440address_item *addr;
441int orvalue = 0;
442if (errno_value == ERRNO_CONNECTTIMEOUT)
443 {
444 errno_value = ETIMEDOUT;
445 orvalue = RTEF_CTOUT;
446 }
895fbaf2 447for (addr = addrlist; addr; addr = addr->next)
168dec3b 448 if (addr->transport_return >= PENDING)
447d236c 449 {
168dec3b
JH
450 addr->basic_errno = errno_value;
451 addr->more_errno |= orvalue;
02b41d71 452 if (msg)
168dec3b
JH
453 {
454 addr->message = msg;
455 if (pass_message) setflag(addr, af_pass_message);
456 }
457 addr->transport_return = rc;
458 if (host)
895fbaf2 459 {
168dec3b 460 addr->host_used = host;
895fbaf2
JH
461#ifdef EXPERIMENTAL_DSN_INFO
462 if (smtp_greeting)
463 {uschar * s = Ustrchr(smtp_greeting, '\n'); if (s) *s = '\0';}
464 addr->smtp_greeting = smtp_greeting;
465
466 if (helo_response)
467 {uschar * s = Ustrchr(helo_response, '\n'); if (s) *s = '\0';}
468 addr->helo_response = helo_response;
469#endif
470 }
447d236c 471 }
0756eb3c
PH
472}
473
895fbaf2
JH
474static void
475set_errno_nohost(address_item *addrlist, int errno_value, uschar *msg, int rc,
476 BOOL pass_message)
477{
478set_errno(addrlist, errno_value, msg, rc, pass_message, NULL
479#ifdef EXPERIMENTAL_DSN_INFO
480 , NULL, NULL
481#endif
482 );
483}
0756eb3c
PH
484
485
486/*************************************************
487* Check an SMTP response *
488*************************************************/
489
490/* This function is given an errno code and the SMTP response buffer
491to analyse, together with the host identification for generating messages. It
492sets an appropriate message and puts the first digit of the response code into
493the yield variable. If no response was actually read, a suitable digit is
494chosen.
495
496Arguments:
447d236c
PH
497 host the current host, to get its name for messages
498 errno_value pointer to the errno value
499 more_errno from the top address for use with ERRNO_FILTER_FAIL
500 buffer the SMTP response buffer
501 yield where to put a one-digit SMTP response code
4c04137d 502 message where to put an error message
447d236c
PH
503 pass_message set TRUE if message is an SMTP response
504
505Returns: TRUE if an SMTP "QUIT" command should be sent, else FALSE
0756eb3c
PH
506*/
507
a7538db1
JH
508static BOOL
509check_response(host_item *host, int *errno_value, int more_errno,
447d236c 510 uschar *buffer, int *yield, uschar **message, BOOL *pass_message)
0756eb3c 511{
0d9fa8c0 512uschar * pl = pipelining_active ? US"pipelined " : US"";
e9166683 513const uschar * s;
0756eb3c
PH
514
515*yield = '4'; /* Default setting is to give a temporary error */
516
e9166683 517switch(*errno_value)
0756eb3c 518 {
e9166683
JH
519 case ETIMEDOUT: /* Handle response timeout */
520 *message = US string_sprintf("SMTP timeout after %s%s",
521 pl, smtp_command);
522 if (transport_count > 0)
523 *message = US string_sprintf("%s (%d bytes written)", *message,
524 transport_count);
525 return FALSE;
526
527 case ERRNO_SMTPFORMAT: /* Handle malformed SMTP response */
528 s = string_printing(buffer);
529 while (isspace(*s)) s++;
530 *message = *s == 0
531 ? string_sprintf("Malformed SMTP reply (an empty line) "
532 "in response to %s%s", pl, smtp_command)
533 : string_sprintf("Malformed SMTP reply in response to %s%s: %s",
534 pl, smtp_command, s);
535 return FALSE;
536
537 case ERRNO_FILTER_FAIL: /* Handle a failed filter process error;
538 can't send QUIT as we mustn't end the DATA. */
539 *message = string_sprintf("transport filter process failed (%d)%s",
540 more_errno,
541 more_errno == EX_EXECFAILED ? ": unable to execute command" : "");
542 return FALSE;
543
544 case ERRNO_CHHEADER_FAIL: /* Handle a failed add_headers expansion;
545 can't send QUIT as we mustn't end the DATA. */
546 *message =
547 string_sprintf("failed to expand headers_add or headers_remove: %s",
548 expand_string_message);
549 return FALSE;
550
551 case ERRNO_WRITEINCOMPLETE: /* failure to write a complete data block */
552 *message = string_sprintf("failed to write a data block");
553 return FALSE;
0756eb3c 554
8c5d388a 555#ifdef SUPPORT_I18N
e9166683
JH
556 case ERRNO_UTF8_FWD: /* no advertised SMTPUTF8, for international message */
557 *message = US"utf8 support required but not offered for forwarding";
558 DEBUG(D_deliver|D_transport) debug_printf("%s\n", *message);
559 return TRUE;
250b6871 560#endif
e9166683 561 }
250b6871 562
0756eb3c
PH
563/* Handle error responses from the remote mailer. */
564
565if (buffer[0] != 0)
566 {
e9166683
JH
567 *message = string_sprintf("SMTP error from remote mail server after %s%s: "
568 "%s", pl, smtp_command, s = string_printing(buffer));
447d236c 569 *pass_message = TRUE;
0756eb3c
PH
570 *yield = buffer[0];
571 return TRUE;
572 }
573
574/* No data was read. If there is no errno, this must be the EOF (i.e.
19b9dc85
PH
575connection closed) case, which causes deferral. An explicit connection reset
576error has the same effect. Otherwise, put the host's identity in the message,
577leaving the errno value to be interpreted as well. In all cases, we have to
578assume the connection is now dead. */
0756eb3c 579
19b9dc85 580if (*errno_value == 0 || *errno_value == ECONNRESET)
0756eb3c
PH
581 {
582 *errno_value = ERRNO_SMTPCLOSED;
c562fd30 583 *message = US string_sprintf("Remote host closed connection "
02b41d71 584 "in response to %s%s", pl, smtp_command);
0756eb3c 585 }
de6273b4
JH
586else
587 *message = US string_sprintf("%s [%s]", host->name, host->address);
0756eb3c
PH
588
589return FALSE;
590}
591
592
593
594/*************************************************
595* Write error message to logs *
596*************************************************/
597
598/* This writes to the main log and to the message log.
599
600Arguments:
601 addr the address item containing error information
602 host the current host
603
604Returns: nothing
605*/
606
607static void
608write_logs(address_item *addr, host_item *host)
609{
584ddd64
JH
610uschar * message = LOGGING(outgoing_port)
611 ? string_sprintf("H=%s [%s]:%d", host->name, host->address,
612 host->port == PORT_NONE ? 25 : host->port)
613 : string_sprintf("H=%s [%s]", host->name, host->address);
c562fd30
JH
614
615if (addr->message)
0756eb3c 616 {
c562fd30 617 message = string_sprintf("%s: %s", message, addr->message);
0756eb3c
PH
618 if (addr->basic_errno > 0)
619 message = string_sprintf("%s: %s", message, strerror(addr->basic_errno));
620 log_write(0, LOG_MAIN, "%s", message);
621 deliver_msglog("%s %s\n", tod_stamp(tod_log), message);
622 }
623else
624 {
37f3dc43
JH
625 const uschar * s = exim_errstr(addr->basic_errno);
626 log_write(0, LOG_MAIN, "%s %s", message, s);
627 deliver_msglog("%s %s %s\n", tod_stamp(tod_log), message, s);
0756eb3c
PH
628 }
629}
630
c562fd30
JH
631static void
632msglog_line(host_item * host, uschar * message)
633{
37f3dc43
JH
634deliver_msglog("%s H=%s [%s] %s\n", tod_stamp(tod_log),
635 host->name, host->address, message);
c562fd30
JH
636}
637
0756eb3c
PH
638
639
0cbf2b82 640#ifndef DISABLE_EVENT
d68218c7
JH
641/*************************************************
642* Post-defer action *
643*************************************************/
644
645/* This expands an arbitrary per-transport string.
646 It might, for example, be used to write to the database log.
647
648Arguments:
d68218c7
JH
649 addr the address item containing error information
650 host the current host
651
652Returns: nothing
653*/
654
655static void
774ef2d7 656deferred_event_raise(address_item *addr, host_item *host)
d68218c7 657{
774ef2d7 658uschar * action = addr->transport->event_action;
55414b25 659const uschar * save_domain;
a7538db1
JH
660uschar * save_local;
661
d68218c7 662if (!action)
a7538db1 663 return;
d68218c7 664
a7538db1
JH
665save_domain = deliver_domain;
666save_local = deliver_localpart;
667
668/*XXX would ip & port already be set up? */
669deliver_host_address = string_copy(host->address);
774ef2d7
JH
670deliver_host_port = host->port == PORT_NONE ? 25 : host->port;
671event_defer_errno = addr->basic_errno;
d68218c7
JH
672
673router_name = addr->router->name;
674transport_name = addr->transport->name;
a7538db1
JH
675deliver_domain = addr->domain;
676deliver_localpart = addr->local_part;
677
774ef2d7 678(void) event_raise(action, US"msg:host:defer",
a7538db1
JH
679 addr->message
680 ? addr->basic_errno > 0
681 ? string_sprintf("%s: %s", addr->message, strerror(addr->basic_errno))
682 : string_copy(addr->message)
683 : addr->basic_errno > 0
684 ? string_copy(US strerror(addr->basic_errno))
685 : NULL);
686
687deliver_localpart = save_local;
688deliver_domain = save_domain;
d68218c7
JH
689router_name = transport_name = NULL;
690}
691#endif
692
0756eb3c
PH
693/*************************************************
694* Synchronize SMTP responses *
695*************************************************/
696
697/* This function is called from smtp_deliver() to receive SMTP responses from
698the server, and match them up with the commands to which they relate. When
699PIPELINING is not in use, this function is called after every command, and is
700therefore somewhat over-engineered, but it is simpler to use a single scheme
701that works both with and without PIPELINING instead of having two separate sets
702of code.
703
704The set of commands that are buffered up with pipelining may start with MAIL
705and may end with DATA; in between are RCPT commands that correspond to the
706addresses whose status is PENDING_DEFER. All other commands (STARTTLS, AUTH,
707etc.) are never buffered.
708
709Errors after MAIL or DATA abort the whole process leaving the response in the
710buffer. After MAIL, pending responses are flushed, and the original command is
711re-instated in big_buffer for error messages. For RCPT commands, the remote is
712permitted to reject some recipient addresses while accepting others. However
713certain errors clearly abort the whole process. Set the value in
714transport_return to PENDING_OK if the address is accepted. If there is a
715subsequent general error, it will get reset accordingly. If not, it will get
716converted to OK at the end.
717
718Arguments:
df5b41e3 719 sx smtp connection context
48c7f9e2 720 count the number of responses to read
48c7f9e2
PH
721 pending_DATA 0 if last command sent was not DATA
722 +1 if previously had a good recipient
723 -1 if not previously had a good recipient
0756eb3c
PH
724
725Returns: 3 if at least one address had 2xx and one had 5xx
726 2 if at least one address had 5xx but none had 2xx
727 1 if at least one host had a 2xx response, but none had 5xx
728 0 no address had 2xx or 5xx but no errors (all 4xx, or just DATA)
729 -1 timeout while reading RCPT response
730 -2 I/O or other non-response error for RCPT
731 -3 DATA or MAIL failed - errno and buffer set
732*/
733
734static int
df5b41e3 735sync_responses(smtp_context * sx, int count, int pending_DATA)
0756eb3c 736{
df5b41e3 737address_item *addr = sx->sync_addr;
e9166683
JH
738smtp_transport_options_block *ob =
739 (smtp_transport_options_block *)sx->tblock->options_block;
0756eb3c
PH
740int yield = 0;
741
742/* Handle the response for a MAIL command. On error, reinstate the original
743command in big_buffer for error message use, and flush any further pending
744responses before returning, except after I/O errors and timeouts. */
745
df5b41e3 746if (sx->pending_MAIL)
0756eb3c
PH
747 {
748 count--;
e9166683
JH
749 if (!smtp_read_response(&sx->inblock, sx->buffer, sizeof(sx->buffer),
750 '2', ob->command_timeout))
0756eb3c 751 {
e027f545 752 DEBUG(D_transport) debug_printf("bad response for MAIL\n");
0756eb3c 753 Ustrcpy(big_buffer, mail_command); /* Fits, because it came from there! */
df5b41e3 754 if (errno == 0 && sx->buffer[0] != 0)
0756eb3c
PH
755 {
756 uschar flushbuffer[4096];
e97957bc 757 int save_errno = 0;
df5b41e3 758 if (sx->buffer[0] == '4')
e97957bc
PH
759 {
760 save_errno = ERRNO_MAIL4XX;
df5b41e3 761 addr->more_errno |= ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
e97957bc 762 }
0756eb3c
PH
763 while (count-- > 0)
764 {
df5b41e3 765 if (!smtp_read_response(&sx->inblock, flushbuffer, sizeof(flushbuffer),
e9166683 766 '2', ob->command_timeout)
0756eb3c
PH
767 && (errno != 0 || flushbuffer[0] == 0))
768 break;
769 }
e97957bc 770 errno = save_errno;
0756eb3c 771 }
c562fd30
JH
772
773 if (pending_DATA) count--; /* Number of RCPT responses to come */
774 while (count-- > 0) /* Mark any pending addrs with the host used */
775 {
776 while (addr->transport_return != PENDING_DEFER) addr = addr->next;
df5b41e3 777 addr->host_used = sx->host;
c562fd30
JH
778 addr = addr->next;
779 }
0756eb3c
PH
780 return -3;
781 }
782 }
783
784if (pending_DATA) count--; /* Number of RCPT responses to come */
785
786/* Read and handle the required number of RCPT responses, matching each one up
787with an address by scanning for the next address whose status is PENDING_DEFER.
788*/
789
790while (count-- > 0)
791 {
792 while (addr->transport_return != PENDING_DEFER) addr = addr->next;
793
794 /* The address was accepted */
df5b41e3 795 addr->host_used = sx->host;
0756eb3c 796
e9166683
JH
797 if (smtp_read_response(&sx->inblock, sx->buffer, sizeof(sx->buffer),
798 '2', ob->command_timeout))
0756eb3c
PH
799 {
800 yield |= 1;
801 addr->transport_return = PENDING_OK;
802
803 /* If af_dr_retry_exists is set, there was a routing delay on this address;
09945f1e
PH
804 ensure that any address-specific retry record is expunged. We do this both
805 for the basic key and for the version that also includes the sender. */
0756eb3c
PH
806
807 if (testflag(addr, af_dr_retry_exists))
09945f1e
PH
808 {
809 uschar *altkey = string_sprintf("%s:<%s>", addr->address_retry_key,
810 sender_address);
811 retry_add_item(addr, altkey, rf_delete);
0756eb3c 812 retry_add_item(addr, addr->address_retry_key, rf_delete);
09945f1e 813 }
0756eb3c
PH
814 }
815
816 /* Timeout while reading the response */
817
818 else if (errno == ETIMEDOUT)
819 {
c562fd30 820 uschar *message = string_sprintf("SMTP timeout after RCPT TO:<%s>",
e9166683 821 transport_rcpt_address(addr, sx->tblock->rcpt_include_affixes));
df5b41e3 822 set_errno_nohost(sx->first_addr, ETIMEDOUT, message, DEFER, FALSE);
0756eb3c 823 retry_add_item(addr, addr->address_retry_key, 0);
f6c332bd 824 update_waiting = FALSE;
0756eb3c
PH
825 return -1;
826 }
827
828 /* Handle other errors in obtaining an SMTP response by returning -1. This
829 will cause all the addresses to be deferred. Restore the SMTP command in
830 big_buffer for which we are checking the response, so the error message
831 makes sense. */
832
df5b41e3 833 else if (errno != 0 || sx->buffer[0] == 0)
0756eb3c
PH
834 {
835 string_format(big_buffer, big_buffer_size, "RCPT TO:<%s>",
df5b41e3 836 transport_rcpt_address(addr, sx->tblock->rcpt_include_affixes));
0756eb3c
PH
837 return -2;
838 }
839
840 /* Handle SMTP permanent and temporary response codes. */
841
842 else
843 {
844 addr->message =
447d236c 845 string_sprintf("SMTP error from remote mail server after RCPT TO:<%s>: "
df5b41e3
JH
846 "%s", transport_rcpt_address(addr, sx->tblock->rcpt_include_affixes),
847 string_printing(sx->buffer));
447d236c 848 setflag(addr, af_pass_message);
e9166683
JH
849 if (!sx->verify)
850 msglog_line(sx->host, addr->message);
0756eb3c
PH
851
852 /* The response was 5xx */
853
df5b41e3 854 if (sx->buffer[0] == '5')
0756eb3c
PH
855 {
856 addr->transport_return = FAIL;
857 yield |= 2;
858 }
859
860 /* The response was 4xx */
861
862 else
863 {
0756eb3c
PH
864 addr->transport_return = DEFER;
865 addr->basic_errno = ERRNO_RCPT4XX;
df5b41e3 866 addr->more_errno |= ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
0756eb3c 867
e9166683
JH
868 if (!sx->verify)
869 {
0cbf2b82 870#ifndef DISABLE_EVENT
e9166683
JH
871 event_defer_errno = addr->more_errno;
872 msg_event_raise(US"msg:rcpt:host:defer", addr);
5ef5dd52
JB
873#endif
874
e9166683
JH
875 /* Log temporary errors if there are more hosts to be tried.
876 If not, log this last one in the == line. */
0756eb3c 877
e9166683
JH
878 if (sx->host->next)
879 log_write(0, LOG_MAIN, "H=%s [%s]: %s",
880 sx->host->name, sx->host->address, addr->message);
0756eb3c 881
0cbf2b82 882#ifndef DISABLE_EVENT
e9166683
JH
883 else
884 msg_event_raise(US"msg:rcpt:defer", addr);
5ef5dd52
JB
885#endif
886
e9166683
JH
887 /* Do not put this message on the list of those waiting for specific
888 hosts, as otherwise it is likely to be tried too often. */
0756eb3c 889
e9166683 890 update_waiting = FALSE;
0756eb3c 891
e9166683
JH
892 /* Add a retry item for the address so that it doesn't get tried again
893 too soon. If address_retry_include_sender is true, add the sender address
894 to the retry key. */
0756eb3c 895
e9166683
JH
896 retry_add_item(addr,
897 ob->address_retry_include_sender
898 ? string_sprintf("%s:<%s>", addr->address_retry_key, sender_address)
899 : addr->address_retry_key,
900 0);
901 }
0756eb3c
PH
902 }
903 }
904 } /* Loop for next RCPT response */
905
906/* Update where to start at for the next block of responses, unless we
907have already handled all the addresses. */
908
e9166683 909if (addr) sx->sync_addr = addr->next;
0756eb3c
PH
910
911/* Handle a response to DATA. If we have not had any good recipients, either
912previously or in this block, the response is ignored. */
913
914if (pending_DATA != 0 &&
e9166683
JH
915 !smtp_read_response(&sx->inblock, sx->buffer, sizeof(sx->buffer),
916 '3', ob->command_timeout))
0756eb3c
PH
917 {
918 int code;
919 uschar *msg;
447d236c 920 BOOL pass_message;
e97957bc
PH
921 if (pending_DATA > 0 || (yield & 1) != 0)
922 {
df5b41e3 923 if (errno == 0 && sx->buffer[0] == '4')
e97957bc
PH
924 {
925 errno = ERRNO_DATA4XX;
df5b41e3 926 sx->first_addr->more_errno |= ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
e97957bc
PH
927 }
928 return -3;
929 }
df5b41e3 930 (void)check_response(sx->host, &errno, 0, sx->buffer, &code, &msg, &pass_message);
0756eb3c
PH
931 DEBUG(D_transport) debug_printf("%s\nerror for DATA ignored: pipelining "
932 "is in use and there were no good recipients\n", msg);
933 }
934
935/* All responses read and handled; MAIL (if present) received 2xx and DATA (if
936present) received 3xx. If any RCPTs were handled and yielded anything other
937than 4xx, yield will be set non-zero. */
938
939return yield;
940}
941
942
943
fcc8e047
JH
944/* Do the client side of smtp-level authentication */
945/*
946Arguments:
947 buffer EHLO response from server (gets overwritten)
948 addrlist chain of potential addresses to deliver
949 host host to deliver to
950 ob transport options
951 ibp, obp comms channel control blocks
952
953Returns:
954 OK Success, or failed (but not required): global "smtp_authenticated" set
955 DEFER Failed authentication (and was required)
956 ERROR Internal problem
957
958 FAIL_SEND Failed communications - transmit
959 FAIL - response
960*/
961
962int
963smtp_auth(uschar *buffer, unsigned bufsize, address_item *addrlist, host_item *host,
964 smtp_transport_options_block *ob, BOOL is_esmtp,
965 smtp_inblock *ibp, smtp_outblock *obp)
966{
a7538db1
JH
967int require_auth;
968uschar *fail_reason = US"server did not advertise AUTH support";
fcc8e047 969
a7538db1
JH
970smtp_authenticated = FALSE;
971client_authenticator = client_authenticated_id = client_authenticated_sender = NULL;
5130845b 972require_auth = verify_check_given_host(&ob->hosts_require_auth, host);
fcc8e047 973
a7538db1
JH
974if (is_esmtp && !regex_AUTH) regex_AUTH =
975 regex_must_compile(US"\\n250[\\s\\-]AUTH\\s+([\\-\\w\\s]+)(?:\\n|$)",
976 FALSE, TRUE);
fcc8e047 977
a7538db1
JH
978if (is_esmtp && regex_match_and_setup(regex_AUTH, buffer, 0, -1))
979 {
980 uschar *names = string_copyn(expand_nstring[1], expand_nlength[1]);
981 expand_nmax = -1; /* reset */
fcc8e047 982
a7538db1
JH
983 /* Must not do this check until after we have saved the result of the
984 regex match above. */
fcc8e047 985
a7538db1 986 if (require_auth == OK ||
5130845b 987 verify_check_given_host(&ob->hosts_try_auth, host) == OK)
a7538db1
JH
988 {
989 auth_instance *au;
990 fail_reason = US"no common mechanisms were found";
fcc8e047 991
a7538db1 992 DEBUG(D_transport) debug_printf("scanning authentication mechanisms\n");
fcc8e047 993
a7538db1
JH
994 /* Scan the configured authenticators looking for one which is configured
995 for use as a client, which is not suppressed by client_condition, and
996 whose name matches an authentication mechanism supported by the server.
997 If one is found, attempt to authenticate by calling its client function.
998 */
fcc8e047 999
a7538db1
JH
1000 for (au = auths; !smtp_authenticated && au != NULL; au = au->next)
1001 {
1002 uschar *p = names;
1003 if (!au->client ||
1004 (au->client_condition != NULL &&
1005 !expand_check_condition(au->client_condition, au->name,
1006 US"client authenticator")))
1007 {
1008 DEBUG(D_transport) debug_printf("skipping %s authenticator: %s\n",
1009 au->name,
1010 (au->client)? "client_condition is false" :
1011 "not configured as a client");
1012 continue;
1013 }
fcc8e047 1014
a7538db1 1015 /* Loop to scan supported server mechanisms */
fcc8e047 1016
a7538db1
JH
1017 while (*p != 0)
1018 {
1019 int rc;
1020 int len = Ustrlen(au->public_name);
1021 while (isspace(*p)) p++;
fcc8e047 1022
a7538db1
JH
1023 if (strncmpic(au->public_name, p, len) != 0 ||
1024 (p[len] != 0 && !isspace(p[len])))
1025 {
1026 while (*p != 0 && !isspace(*p)) p++;
1027 continue;
1028 }
fcc8e047 1029
a7538db1
JH
1030 /* Found data for a listed mechanism. Call its client entry. Set
1031 a flag in the outblock so that data is overwritten after sending so
1032 that reflections don't show it. */
fcc8e047 1033
a7538db1
JH
1034 fail_reason = US"authentication attempt(s) failed";
1035 obp->authenticating = TRUE;
1036 rc = (au->info->clientcode)(au, ibp, obp,
1037 ob->command_timeout, buffer, bufsize);
1038 obp->authenticating = FALSE;
1039 DEBUG(D_transport) debug_printf("%s authenticator yielded %d\n",
1040 au->name, rc);
fcc8e047 1041
a7538db1
JH
1042 /* A temporary authentication failure must hold up delivery to
1043 this host. After a permanent authentication failure, we carry on
1044 to try other authentication methods. If all fail hard, try to
1045 deliver the message unauthenticated unless require_auth was set. */
fcc8e047 1046
a7538db1
JH
1047 switch(rc)
1048 {
1049 case OK:
1050 smtp_authenticated = TRUE; /* stops the outer loop */
1051 client_authenticator = au->name;
1052 if (au->set_client_id != NULL)
1053 client_authenticated_id = expand_string(au->set_client_id);
1054 break;
1055
1056 /* Failure after writing a command */
1057
1058 case FAIL_SEND:
1059 return FAIL_SEND;
1060
1061 /* Failure after reading a response */
1062
1063 case FAIL:
1064 if (errno != 0 || buffer[0] != '5') return FAIL;
1065 log_write(0, LOG_MAIN, "%s authenticator failed H=%s [%s] %s",
1066 au->name, host->name, host->address, buffer);
1067 break;
1068
1069 /* Failure by some other means. In effect, the authenticator
1070 decided it wasn't prepared to handle this case. Typically this
1071 is the result of "fail" in an expansion string. Do we need to
1072 log anything here? Feb 2006: a message is now put in the buffer
1073 if logging is required. */
1074
1075 case CANCELLED:
1076 if (*buffer != 0)
1077 log_write(0, LOG_MAIN, "%s authenticator cancelled "
1078 "authentication H=%s [%s] %s", au->name, host->name,
1079 host->address, buffer);
1080 break;
1081
1082 /* Internal problem, message in buffer. */
1083
1084 case ERROR:
895fbaf2
JH
1085 set_errno_nohost(addrlist, ERRNO_AUTHPROB, string_copy(buffer),
1086 DEFER, FALSE);
a7538db1
JH
1087 return ERROR;
1088 }
fcc8e047 1089
a7538db1
JH
1090 break; /* If not authenticated, try next authenticator */
1091 } /* Loop for scanning supported server mechanisms */
1092 } /* Loop for further authenticators */
fcc8e047 1093 }
a7538db1 1094 }
fcc8e047 1095
a7538db1 1096/* If we haven't authenticated, but are required to, give up. */
fcc8e047 1097
a7538db1
JH
1098if (require_auth == OK && !smtp_authenticated)
1099 {
895fbaf2 1100 set_errno_nohost(addrlist, ERRNO_AUTHFAIL,
a7538db1 1101 string_sprintf("authentication required but %s", fail_reason), DEFER,
895fbaf2 1102 FALSE);
a7538db1
JH
1103 return DEFER;
1104 }
4d8d62b9 1105
a7538db1 1106return OK;
fcc8e047
JH
1107}
1108
1109
1110/* Construct AUTH appendix string for MAIL TO */
1111/*
1112Arguments
1113 buffer to build string
1114 addrlist chain of potential addresses to deliver
1115 ob transport options
1116
1117Globals smtp_authenticated
1118 client_authenticated_sender
1119Return True on error, otherwise buffer has (possibly empty) terminated string
1120*/
1121
1122BOOL
1123smtp_mail_auth_str(uschar *buffer, unsigned bufsize, address_item *addrlist,
1124 smtp_transport_options_block *ob)
1125{
1126uschar *local_authenticated_sender = authenticated_sender;
1127
1128#ifdef notdef
1129 debug_printf("smtp_mail_auth_str: as<%s> os<%s> SA<%s>\n", authenticated_sender, ob->authenticated_sender, smtp_authenticated?"Y":"N");
1130#endif
1131
1132if (ob->authenticated_sender != NULL)
1133 {
1134 uschar *new = expand_string(ob->authenticated_sender);
1135 if (new == NULL)
1136 {
1137 if (!expand_string_forcedfail)
1138 {
1139 uschar *message = string_sprintf("failed to expand "
1140 "authenticated_sender: %s", expand_string_message);
895fbaf2 1141 set_errno_nohost(addrlist, ERRNO_EXPANDFAIL, message, DEFER, FALSE);
fcc8e047
JH
1142 return TRUE;
1143 }
1144 }
1145 else if (new[0] != 0) local_authenticated_sender = new;
1146 }
1147
1148/* Add the authenticated sender address if present */
1149
1150if ((smtp_authenticated || ob->authenticated_sender_force) &&
1151 local_authenticated_sender != NULL)
1152 {
1153 string_format(buffer, bufsize, " AUTH=%s",
1154 auth_xtextencode(local_authenticated_sender,
1155 Ustrlen(local_authenticated_sender)));
1156 client_authenticated_sender = string_copy(local_authenticated_sender);
1157 }
1158else
1159 *buffer= 0;
1160
1161return FALSE;
1162}
1163
1164
1165
0e66b3b6 1166#ifdef EXPERIMENTAL_DANE
2d5fdd53
JH
1167/* Lookup TLSA record for host/port.
1168Return: OK success with dnssec; DANE mode
1169 DEFER Do not use this host now, may retry later
1170 FAIL_FORCED No TLSA record; DANE not usable
1171 FAIL Do not use this connection
1172*/
1173
0e66b3b6 1174int
4b0fe319 1175tlsa_lookup(const host_item * host, dns_answer * dnsa, BOOL dane_required)
0e66b3b6
JH
1176{
1177/* move this out to host.c given the similarity to dns_lookup() ? */
1178uschar buffer[300];
55414b25 1179const uschar * fullname = buffer;
0e66b3b6
JH
1180
1181/* TLSA lookup string */
1182(void)sprintf(CS buffer, "_%d._tcp.%.256s", host->port, host->name);
1183
1184switch (dns_lookup(dnsa, buffer, T_TLSA, &fullname))
1185 {
0e66b3b6
JH
1186 case DNS_SUCCEED:
1187 if (!dns_is_secure(dnsa))
1188 {
1189 log_write(0, LOG_MAIN, "DANE error: TLSA lookup not DNSSEC");
1190 return DEFER;
1191 }
4b0fe319 1192 return OK;
2d5fdd53
JH
1193
1194 case DNS_AGAIN:
1195 return DEFER; /* just defer this TLS'd conn */
1196
ef3a1a30
JH
1197 case DNS_NODATA: /* no TLSA RR for this lookup */
1198 case DNS_NOMATCH: /* no records at all for this lookup */
2d5fdd53
JH
1199 return dane_required ? FAIL : FAIL_FORCED;
1200
1201 default:
1202 case DNS_FAIL:
1203 return dane_required ? FAIL : DEFER;
0e66b3b6 1204 }
0e66b3b6
JH
1205}
1206#endif
1207
1208
a39bd74d
JB
1209
1210typedef struct smtp_compare_s
1211{
1212 uschar *current_sender_address;
1213 struct transport_instance *tblock;
1214} smtp_compare_t;
1215
d093f8e5
JH
1216
1217/* Create a unique string that identifies this message, it is based on
1218sender_address, helo_data and tls_certificate if enabled.
1219*/
a39bd74d
JB
1220
1221static uschar *
1222smtp_local_identity(uschar * sender, struct transport_instance * tblock)
1223{
1224address_item * addr1;
1225uschar * if1 = US"";
1226uschar * helo1 = US"";
1227#ifdef SUPPORT_TLS
1228uschar * tlsc1 = US"";
1229#endif
1230uschar * save_sender_address = sender_address;
1231uschar * local_identity = NULL;
1232smtp_transport_options_block * ob =
1233 (smtp_transport_options_block *)tblock->options_block;
1234
1235sender_address = sender;
1236
1237addr1 = deliver_make_addr (sender, TRUE);
1238deliver_set_expansions(addr1);
1239
1240if (ob->interface)
1241 if1 = expand_string(ob->interface);
1242
1243if (ob->helo_data)
1244 helo1 = expand_string(ob->helo_data);
1245
1246#ifdef SUPPORT_TLS
1247if (ob->tls_certificate)
1248 tlsc1 = expand_string(ob->tls_certificate);
1249local_identity = string_sprintf ("%s^%s^%s", if1, helo1, tlsc1);
1250#else
1251local_identity = string_sprintf ("%s^%s", if1, helo1);
1252#endif
1253
1254deliver_set_expansions(NULL);
1255sender_address = save_sender_address;
1256
1257return local_identity;
1258}
1259
1260
1261
1262/* This routine is a callback that is called from transport_check_waiting.
1263This function will evaluate the incoming message versus the previous
1264message. If the incoming message is using a different local identity then
1265we will veto this new message. */
1266
1267static BOOL
1268smtp_are_same_identities(uschar * message_id, smtp_compare_t * s_compare)
1269{
dadff1d4
HSHR
1270uschar * message_local_identity,
1271 * current_local_identity,
1272 * new_sender_address;
1273
1274current_local_identity =
a39bd74d 1275 smtp_local_identity(s_compare->current_sender_address, s_compare->tblock);
a39bd74d 1276
dadff1d4
HSHR
1277if (!(new_sender_address = deliver_get_sender_address(message_id)))
1278 return 0;
1279
1280message_local_identity =
1281 smtp_local_identity(new_sender_address, s_compare->tblock);
a39bd74d
JB
1282
1283return Ustrcmp(current_local_identity, message_local_identity) == 0;
1284}
1285
1286
1287
e9166683
JH
1288static uschar
1289ehlo_response(uschar * buf, uschar checks)
9094b84b 1290{
e9166683
JH
1291size_t bsize = Ustrlen(buf);
1292
9094b84b 1293#ifdef SUPPORT_TLS
ff5aac2b
JH
1294if ( checks & PEER_OFFERED_TLS
1295 && pcre_exec(regex_STARTTLS, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
1296 checks &= ~PEER_OFFERED_TLS;
9094b84b
JH
1297#endif
1298
ff5aac2b
JH
1299if ( checks & PEER_OFFERED_IGNQ
1300 && pcre_exec(regex_IGNOREQUOTA, NULL, CS buf, bsize, 0,
1301 PCRE_EOPT, NULL, 0) < 0)
1302 checks &= ~PEER_OFFERED_IGNQ;
9094b84b 1303
f98442df
JH
1304if ( checks & PEER_OFFERED_CHUNKING
1305 && pcre_exec(regex_CHUNKING, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
1306 checks &= ~PEER_OFFERED_CHUNKING;
1307
9094b84b 1308#ifndef DISABLE_PRDR
ff5aac2b
JH
1309if ( checks & PEER_OFFERED_PRDR
1310 && pcre_exec(regex_PRDR, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
1311 checks &= ~PEER_OFFERED_PRDR;
9094b84b
JH
1312#endif
1313
1314#ifdef SUPPORT_I18N
ff5aac2b
JH
1315if ( checks & PEER_OFFERED_UTF8
1316 && pcre_exec(regex_UTF8, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
1317 checks &= ~PEER_OFFERED_UTF8;
9094b84b
JH
1318#endif
1319
ff5aac2b
JH
1320if ( checks & PEER_OFFERED_DSN
1321 && pcre_exec(regex_DSN, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
1322 checks &= ~PEER_OFFERED_DSN;
9094b84b 1323
ff5aac2b
JH
1324if ( checks & PEER_OFFERED_PIPE
1325 && pcre_exec(regex_PIPELINING, NULL, CS buf, bsize, 0,
1326 PCRE_EOPT, NULL, 0) < 0)
1327 checks &= ~PEER_OFFERED_PIPE;
9094b84b 1328
ff5aac2b
JH
1329if ( checks & PEER_OFFERED_SIZE
1330 && pcre_exec(regex_SIZE, NULL, CS buf, bsize, 0, PCRE_EOPT, NULL, 0) < 0)
1331 checks &= ~PEER_OFFERED_SIZE;
9094b84b
JH
1332
1333return checks;
1334}
1335
1336
6d5c916c
JH
1337
1338/* Callback for emitting a BDAT data chunk header.
6d5c916c 1339
e027f545
JH
1340If given a nonzero size, first flush any buffered SMTP commands
1341then emit the command.
1342
1343Reap previous SMTP command responses if requested.
1344Reap one SMTP command response if requested.
6d5c916c
JH
1345
1346Returns: OK or ERROR
1347*/
1348
1349static int
1350smtp_chunk_cmd_callback(int fd, transport_ctx * tctx,
e027f545 1351 unsigned chunk_size, unsigned flags)
6d5c916c
JH
1352{
1353smtp_transport_options_block * ob =
1354 (smtp_transport_options_block *)(tctx->tblock->options_block);
e9166683 1355smtp_context * sx = tctx->smtp_context;
e027f545
JH
1356int cmd_count = 0;
1357int prev_cmd_count;
6d5c916c 1358
e027f545 1359/* Write SMTP chunk header command */
6d5c916c 1360
e027f545 1361if (chunk_size > 0)
87cb4a16 1362 {
e9166683 1363 if((cmd_count = smtp_write_command(&sx->outblock, FALSE, "BDAT %u%s\r\n",
e027f545
JH
1364 chunk_size,
1365 flags & tc_chunk_last ? " LAST" : "")
1366 ) < 0) return ERROR;
87cb4a16
JH
1367 if (flags & tc_chunk_last)
1368 data_command = string_copy(big_buffer); /* Save for later error message */
1369 }
e027f545 1370
e9166683 1371prev_cmd_count = cmd_count += sx->cmd_count;
6d5c916c 1372
e027f545 1373/* Reap responses for any previous, but not one we just emitted */
6d5c916c 1374
e027f545
JH
1375if (chunk_size > 0)
1376 prev_cmd_count--;
e9166683 1377if (sx->pending_BDAT)
e027f545 1378 prev_cmd_count--;
6d5c916c 1379
e027f545 1380if (flags & tc_reap_prev && prev_cmd_count > 0)
6d5c916c 1381 {
58fc5fb2
JH
1382 DEBUG(D_transport) debug_printf("look for %d responses"
1383 " for previous pipelined cmds\n", prev_cmd_count);
6d5c916c 1384
e9166683 1385 switch(sync_responses(sx, prev_cmd_count, 0))
e027f545
JH
1386 {
1387 case 1: /* 2xx (only) => OK */
e9166683
JH
1388 case 3: sx->good_RCPT = TRUE; /* 2xx & 5xx => OK & progress made */
1389 case 2: sx->completed_addr = TRUE; /* 5xx (only) => progress made */
e027f545
JH
1390 case 0: break; /* No 2xx or 5xx, but no probs */
1391
1392 case -1: /* Timeout on RCPT */
1393 default: return ERROR; /* I/O error, or any MAIL/DATA error */
1394 }
1395 cmd_count = 1;
e9166683 1396 if (!sx->pending_BDAT)
e027f545 1397 pipelining_active = FALSE;
6d5c916c 1398 }
e027f545 1399
58fc5fb2 1400/* Reap response for an outstanding BDAT */
e027f545 1401
e9166683 1402if (sx->pending_BDAT)
e027f545 1403 {
58fc5fb2
JH
1404 DEBUG(D_transport) debug_printf("look for one response for BDAT\n");
1405
e9166683 1406 if (!smtp_read_response(&sx->inblock, sx->buffer, sizeof(sx->buffer), '2',
e027f545
JH
1407 ob->command_timeout))
1408 {
e9166683 1409 if (errno == 0 && sx->buffer[0] == '4')
e027f545
JH
1410 {
1411 errno = ERRNO_DATA4XX; /*XXX does this actually get used? */
36e55f49 1412 sx->addrlist->more_errno |=
e9166683 1413 ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
e027f545
JH
1414 }
1415 return ERROR;
1416 }
1417 cmd_count--;
e9166683 1418 sx->pending_BDAT = FALSE;
e027f545
JH
1419 pipelining_active = FALSE;
1420 }
1421else if (chunk_size > 0)
e9166683 1422 sx->pending_BDAT = TRUE;
e027f545
JH
1423
1424
e9166683 1425sx->cmd_count = cmd_count;
e027f545 1426return OK;
6d5c916c
JH
1427}
1428
1429
1430
0756eb3c 1431/*************************************************
d093f8e5 1432* Make connection for given message *
0756eb3c
PH
1433*************************************************/
1434
d093f8e5
JH
1435/*
1436Arguments:
1437 ctx connection context
d093f8e5
JH
1438 suppress_tls if TRUE, don't attempt a TLS connection - this is set for
1439 a second attempt after TLS initialization fails
d093f8e5
JH
1440
1441Returns: OK - the connection was made and the delivery attempted;
1442 fd is set in the conn context, tls_out set up.
1443 DEFER - the connection could not be made, or something failed
1444 while setting up the SMTP session, or there was a
1445 non-message-specific error, such as a timeout.
1446 ERROR - helo_data or add_headers or authenticated_sender is
1447 specified for this transport, and the string failed
1448 to expand
1449*/
1450int
e9166683 1451smtp_setup_conn(smtp_context * sx, BOOL suppress_tls)
d093f8e5
JH
1452{
1453#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
1454dns_answer tlsa_dnsa;
1455#endif
1456BOOL pass_message = FALSE;
d093f8e5 1457uschar * message = NULL;
d093f8e5
JH
1458int yield = OK;
1459int rc;
1460
02b41d71 1461sx->ob = (smtp_transport_options_block *) sx->tblock->options_block;
d093f8e5
JH
1462
1463sx->lmtp = strcmpic(sx->ob->protocol, US"lmtp") == 0;
1464sx->smtps = strcmpic(sx->ob->protocol, US"smtps") == 0;
1465sx->ok = FALSE;
1466sx->send_rset = TRUE;
1467sx->send_quit = TRUE;
1468sx->setting_up = TRUE;
1469sx->esmtp = TRUE;
1470sx->esmtp_sent = FALSE;
59a286ef 1471#ifdef SUPPORT_I18N
d093f8e5 1472sx->utf8_needed = FALSE;
59a286ef 1473#endif
d093f8e5 1474sx->dsn_all_lasthop = TRUE;
59a286ef 1475#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
d093f8e5
JH
1476sx->dane = FALSE;
1477sx->dane_required = verify_check_given_host(&sx->ob->hosts_require_dane, sx->host) == OK;
1478#endif
1479
1480if ((sx->max_rcpt = sx->tblock->max_addresses) == 0) sx->max_rcpt = 999999;
d093f8e5
JH
1481sx->peer_offered = 0;
1482sx->igquotstr = US"";
02b41d71 1483if (!sx->helo_data) sx->helo_data = sx->ob->helo_data;
d093f8e5
JH
1484#ifdef EXPERIMENTAL_DSN_INFO
1485sx->smtp_greeting = NULL;
1486sx->helo_response = NULL;
59a286ef
JH
1487#endif
1488
0756eb3c 1489smtp_command = US"initial connection";
d093f8e5 1490sx->buffer[0] = '\0';
0756eb3c
PH
1491
1492/* Set up the buffer for reading SMTP response packets. */
1493
d093f8e5
JH
1494sx->inblock.buffer = sx->inbuffer;
1495sx->inblock.buffersize = sizeof(sx->inbuffer);
1496sx->inblock.ptr = sx->inbuffer;
1497sx->inblock.ptrend = sx->inbuffer;
0756eb3c
PH
1498
1499/* Set up the buffer for holding SMTP commands while pipelining */
1500
d093f8e5
JH
1501sx->outblock.buffer = sx->outbuffer;
1502sx->outblock.buffersize = sizeof(sx->outbuffer);
1503sx->outblock.ptr = sx->outbuffer;
1504sx->outblock.cmd_count = 0;
1505sx->outblock.authenticating = FALSE;
0756eb3c 1506
6c512171
PH
1507/* Reset the parameters of a TLS session. */
1508
817d9f57
JH
1509tls_out.bits = 0;
1510tls_out.cipher = NULL; /* the one we may use for this transport */
9d1c15ef
JH
1511tls_out.ourcert = NULL;
1512tls_out.peercert = NULL;
817d9f57
JH
1513tls_out.peerdn = NULL;
1514#if defined(SUPPORT_TLS) && !defined(USE_GNUTLS)
1515tls_out.sni = NULL;
5b456975 1516#endif
018058b2 1517tls_out.ocsp = OCSP_NOT_REQ;
6c512171 1518
35aba663
JH
1519/* Flip the legacy TLS-related variables over to the outbound set in case
1520they're used in the context of the transport. Don't bother resetting
02b41d71
JH
1521afterward (when being used by a transport) as we're in a subprocess.
1522For verify, unflipped once the callout is dealt with */
35aba663
JH
1523
1524tls_modify_variables(&tls_out);
1525
061b7ebd 1526#ifndef SUPPORT_TLS
d093f8e5 1527if (sx->smtps)
061b7ebd 1528 {
d093f8e5 1529 set_errno_nohost(sx->addrlist, ERRNO_TLSFAILURE, US"TLS support not available",
895fbaf2 1530 DEFER, FALSE);
018058b2 1531 return ERROR;
061b7ebd
PP
1532 }
1533#endif
1534
0756eb3c
PH
1535/* Make a connection to the host if this isn't a continued delivery, and handle
1536the initial interaction and HELO/EHLO/LHLO. Connect timeout errors are handled
1537specially so they can be identified for retries. */
1538
1539if (continue_hostname == NULL)
1540 {
e9166683 1541 if (sx->verify)
02b41d71
JH
1542 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", sx->interface, sx->port);
1543
a7538db1 1544 /* This puts port into host->port */
d093f8e5
JH
1545 sx->inblock.sock = sx->outblock.sock =
1546 smtp_connect(sx->host, sx->host_af, sx->port, sx->interface,
1547 sx->ob->connect_timeout, sx->tblock);
4311097e 1548
d093f8e5 1549 if (sx->inblock.sock < 0)
0756eb3c 1550 {
02b41d71 1551 uschar * msg = NULL;
e9166683 1552 if (sx->verify)
02b41d71 1553 {
863bd541 1554 msg = US strerror(errno);
02b41d71
JH
1555 HDEBUG(D_verify) debug_printf("connect: %s\n", msg);
1556 }
1557 set_errno_nohost(sx->addrlist,
829dd842 1558 errno == ETIMEDOUT ? ERRNO_CONNECTTIMEOUT : errno,
e9166683 1559 sx->verify ? string_sprintf("could not connect: %s", msg)
02b41d71
JH
1560 : NULL,
1561 DEFER, FALSE);
1562 sx->send_quit = FALSE;
0756eb3c
PH
1563 return DEFER;
1564 }
1565
0e66b3b6
JH
1566#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
1567 {
0e66b3b6
JH
1568 tls_out.dane_verified = FALSE;
1569 tls_out.tlsa_usage = 0;
1570
d093f8e5 1571 if (sx->host->dnssec == DS_YES)
0e66b3b6 1572 {
d093f8e5
JH
1573 if( sx->dane_required
1574 || verify_check_given_host(&sx->ob->hosts_try_dane, sx->host) == OK
0e66b3b6 1575 )
d093f8e5 1576 switch (rc = tlsa_lookup(sx->host, &tlsa_dnsa, sx->dane_required))
4b0fe319 1577 {
d093f8e5 1578 case OK: sx->dane = TRUE; break;
2d5fdd53 1579 case FAIL_FORCED: break;
d093f8e5 1580 default: set_errno_nohost(sx->addrlist, ERRNO_DNSDEFER,
2d5fdd53
JH
1581 string_sprintf("DANE error: tlsa lookup %s",
1582 rc == DEFER ? "DEFER" : "FAIL"),
1583 rc, FALSE);
1584 return rc;
4b0fe319 1585 }
0e66b3b6 1586 }
d093f8e5 1587 else if (sx->dane_required)
0e66b3b6 1588 {
d093f8e5
JH
1589 set_errno_nohost(sx->addrlist, ERRNO_DNSDEFER,
1590 string_sprintf("DANE error: %s lookup not DNSSEC", sx->host->name),
895fbaf2 1591 FAIL, FALSE);
4b0fe319 1592 return FAIL;
0e66b3b6
JH
1593 }
1594
d093f8e5
JH
1595 if (sx->dane)
1596 sx->ob->tls_tempfail_tryclear = FALSE;
0e66b3b6
JH
1597 }
1598#endif /*DANE*/
1599
41c7c167
PH
1600 /* Expand the greeting message while waiting for the initial response. (Makes
1601 sense if helo_data contains ${lookup dnsdb ...} stuff). The expansion is
1602 delayed till here so that $sending_interface and $sending_port are set. */
1603
02b41d71
JH
1604 if (sx->helo_data)
1605 if (!(sx->helo_data = expand_string(sx->helo_data)))
e9166683 1606 if (sx->verify)
02b41d71
JH
1607 log_write(0, LOG_MAIN|LOG_PANIC,
1608 "<%s>: failed to expand transport's helo_data value for callout: %s",
1609 sx->addrlist->address, expand_string_message);
1610
8c5d388a 1611#ifdef SUPPORT_I18N
d093f8e5 1612 if (sx->helo_data)
810d16ad 1613 {
02b41d71
JH
1614 expand_string_message = NULL;
1615 if ((sx->helo_data = string_domain_utf8_to_alabel(sx->helo_data,
1616 &expand_string_message)),
1617 expand_string_message)
e9166683 1618 if (sx->verify)
02b41d71
JH
1619 log_write(0, LOG_MAIN|LOG_PANIC,
1620 "<%s>: failed to expand transport's helo_data value for callout: %s",
1621 sx->addrlist->address, expand_string_message);
1622 else
1623 sx->helo_data = NULL;
810d16ad
JH
1624 }
1625#endif
41c7c167 1626
0756eb3c
PH
1627 /* The first thing is to wait for an initial OK response. The dreaded "goto"
1628 is nevertheless a reasonably clean way of programming this kind of logic,
1629 where you want to escape on any error. */
1630
d093f8e5 1631 if (!sx->smtps)
061b7ebd 1632 {
8d330698
JH
1633 BOOL good_response;
1634
1635#ifdef TCP_QUICKACK
d093f8e5 1636 (void) setsockopt(sx->inblock.sock, IPPROTO_TCP, TCP_QUICKACK, US &off, sizeof(off));
8d330698 1637#endif
d093f8e5
JH
1638 good_response = smtp_read_response(&sx->inblock, sx->buffer, sizeof(sx->buffer),
1639 '2', sx->ob->command_timeout);
895fbaf2 1640#ifdef EXPERIMENTAL_DSN_INFO
d093f8e5 1641 sx->smtp_greeting = string_copy(sx->buffer);
895fbaf2
JH
1642#endif
1643 if (!good_response) goto RESPONSE_FAILED;
0756eb3c 1644
0cbf2b82 1645#ifndef DISABLE_EVENT
b30275b8 1646 {
805c9d53 1647 uschar * s;
d093f8e5
JH
1648 lookup_dnssec_authenticated = sx->host->dnssec==DS_YES ? US"yes"
1649 : sx->host->dnssec==DS_NO ? US"no" : NULL;
1650 s = event_raise(sx->tblock->event_action, US"smtp:connect", sx->buffer);
b30275b8 1651 if (s)
a7538db1 1652 {
d093f8e5 1653 set_errno_nohost(sx->addrlist, ERRNO_EXPANDFAIL,
b30275b8 1654 string_sprintf("deferred by smtp:connect event expansion: %s", s),
895fbaf2 1655 DEFER, FALSE);
a7538db1
JH
1656 yield = DEFER;
1657 goto SEND_QUIT;
1658 }
b30275b8 1659 }
a7538db1
JH
1660#endif
1661
061b7ebd
PP
1662 /* Now check if the helo_data expansion went well, and sign off cleanly if
1663 it didn't. */
41c7c167 1664
d093f8e5 1665 if (!sx->helo_data)
061b7ebd 1666 {
d093f8e5 1667 message = string_sprintf("failed to expand helo_data: %s",
061b7ebd 1668 expand_string_message);
d093f8e5 1669 set_errno_nohost(sx->addrlist, ERRNO_EXPANDFAIL, message, DEFER, FALSE);
061b7ebd
PP
1670 yield = DEFER;
1671 goto SEND_QUIT;
1672 }
41c7c167
PH
1673 }
1674
0756eb3c 1675/** Debugging without sending a message
d093f8e5 1676sx->addrlist->transport_return = DEFER;
0756eb3c
PH
1677goto SEND_QUIT;
1678**/
1679
1680 /* Errors that occur after this point follow an SMTP command, which is
1681 left in big_buffer by smtp_write_command() for use in error messages. */
1682
1683 smtp_command = big_buffer;
1684
1685 /* Tell the remote who we are...
1686
1687 February 1998: A convention has evolved that ESMTP-speaking MTAs include the
1688 string "ESMTP" in their greeting lines, so make Exim send EHLO if the
1689 greeting is of this form. The assumption was that the far end supports it
1690 properly... but experience shows that there are some that give 5xx responses,
1691 even though the banner includes "ESMTP" (there's a bloody-minded one that
1692 says "ESMTP not spoken here"). Cope with that case.
1693
1694 September 2000: Time has passed, and it seems reasonable now to always send
1695 EHLO at the start. It is also convenient to make the change while installing
1696 the TLS stuff.
1697
1698 July 2003: Joachim Wieland met a broken server that advertises "PIPELINING"
1699 but times out after sending MAIL FROM, RCPT TO and DATA all together. There
1700 would be no way to send out the mails, so there is now a host list
1701 "hosts_avoid_esmtp" that disables ESMTP for special hosts and solves the
1702 PIPELINING problem as well. Maybe it can also be useful to cure other
1703 problems with broken servers.
1704
1705 Exim originally sent "Helo" at this point and ran for nearly a year that way.
1706 Then somebody tried it with a Microsoft mailer... It seems that all other
1707 mailers use upper case for some reason (the RFC is quite clear about case
1708 independence) so, for peace of mind, I gave in. */
1709
d093f8e5 1710 sx->esmtp = verify_check_given_host(&sx->ob->hosts_avoid_esmtp, sx->host) != OK;
0756eb3c 1711
061b7ebd
PP
1712 /* Alas; be careful, since this goto is not an error-out, so conceivably
1713 we might set data between here and the target which we assume to exist
1714 and be usable. I can see this coming back to bite us. */
a7538db1 1715#ifdef SUPPORT_TLS
d093f8e5 1716 if (sx->smtps)
061b7ebd 1717 {
2d14f397 1718 smtp_peer_options |= PEER_OFFERED_TLS;
061b7ebd 1719 suppress_tls = FALSE;
d093f8e5 1720 sx->ob->tls_tempfail_tryclear = FALSE;
061b7ebd
PP
1721 smtp_command = US"SSL-on-connect";
1722 goto TLS_NEGOTIATE;
1723 }
a7538db1 1724#endif
061b7ebd 1725
d093f8e5 1726 if (sx->esmtp)
0756eb3c 1727 {
d093f8e5
JH
1728 if (smtp_write_command(&sx->outblock, FALSE, "%s %s\r\n",
1729 sx->lmtp ? "LHLO" : "EHLO", sx->helo_data) < 0)
0756eb3c 1730 goto SEND_FAILED;
d093f8e5
JH
1731 sx->esmtp_sent = TRUE;
1732 if (!smtp_read_response(&sx->inblock, sx->buffer, sizeof(sx->buffer), '2',
1733 sx->ob->command_timeout))
0756eb3c 1734 {
d093f8e5 1735 if (errno != 0 || sx->buffer[0] == 0 || sx->lmtp)
895fbaf2
JH
1736 {
1737#ifdef EXPERIMENTAL_DSN_INFO
d093f8e5 1738 sx->helo_response = string_copy(sx->buffer);
895fbaf2
JH
1739#endif
1740 goto RESPONSE_FAILED;
1741 }
d093f8e5 1742 sx->esmtp = FALSE;
0756eb3c 1743 }
895fbaf2 1744#ifdef EXPERIMENTAL_DSN_INFO
d093f8e5 1745 sx->helo_response = string_copy(sx->buffer);
895fbaf2 1746#endif
0756eb3c
PH
1747 }
1748 else
0756eb3c
PH
1749 DEBUG(D_transport)
1750 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
0756eb3c 1751
d093f8e5 1752 if (!sx->esmtp)
0756eb3c 1753 {
895fbaf2 1754 BOOL good_response;
d093f8e5
JH
1755 int n = sizeof(sx->buffer);
1756 uschar * rsp = sx->buffer;
a57ce043 1757
d093f8e5
JH
1758 if (sx->esmtp_sent && (n = Ustrlen(sx->buffer)) < sizeof(sx->buffer)/2)
1759 { rsp = sx->buffer + n + 1; n = sizeof(sx->buffer) - n; }
895fbaf2 1760
d093f8e5 1761 if (smtp_write_command(&sx->outblock, FALSE, "HELO %s\r\n", sx->helo_data) < 0)
0756eb3c 1762 goto SEND_FAILED;
d093f8e5
JH
1763 good_response = smtp_read_response(&sx->inblock, rsp, n,
1764 '2', sx->ob->command_timeout);
895fbaf2 1765#ifdef EXPERIMENTAL_DSN_INFO
d093f8e5 1766 sx->helo_response = string_copy(rsp);
895fbaf2 1767#endif
a57ce043
JH
1768 if (!good_response)
1769 {
1770 /* Handle special logging for a closed connection after HELO
1771 when had previously sent EHLO */
1772
d093f8e5 1773 if (rsp != sx->buffer && rsp[0] == 0 && (errno == 0 || errno == ECONNRESET))
a57ce043 1774 {
de6273b4
JH
1775 errno = ERRNO_SMTPCLOSED;
1776 goto EHLOHELO_FAILED;
a57ce043 1777 }
d093f8e5 1778 Ustrncpy(sx->buffer, rsp, sizeof(sx->buffer)/2);
a57ce043
JH
1779 goto RESPONSE_FAILED;
1780 }
0756eb3c
PH
1781 }
1782
d093f8e5 1783 sx->peer_offered = smtp_peer_options = 0;
2d14f397 1784
d093f8e5 1785 if (sx->esmtp || sx->lmtp)
2d14f397 1786 {
e9166683 1787 sx->peer_offered = ehlo_response(sx->buffer,
ff5aac2b 1788 PEER_OFFERED_TLS /* others checked later */
9094b84b 1789 );
f1513293 1790
0756eb3c
PH
1791 /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
1792
a7538db1 1793#ifdef SUPPORT_TLS
d093f8e5 1794 smtp_peer_options |= sx->peer_offered & PEER_OFFERED_TLS;
7ade712c 1795#endif
2d14f397 1796 }
0756eb3c
PH
1797 }
1798
1799/* For continuing deliveries down the same channel, the socket is the standard
1800input, and we don't need to redo EHLO here (but may need to do so for TLS - see
1801below). Set up the pointer to where subsequent commands will be left, for
2d14f397 1802error messages. Note that smtp_peer_options will have been
0756eb3c
PH
1803set from the command line if they were set in the process that passed the
1804connection on. */
1805
895fbaf2 1806/*XXX continue case needs to propagate DSN_INFO, prob. in deliver.c
4c04137d 1807as the continue goes via transport_pass_socket() and doublefork and exec.
895fbaf2
JH
1808It does not wait. Unclear how we keep separate host's responses
1809separate - we could match up by host ip+port as a bodge. */
1810
0756eb3c
PH
1811else
1812 {
d093f8e5 1813 sx->inblock.sock = sx->outblock.sock = fileno(stdin);
0756eb3c 1814 smtp_command = big_buffer;
d093f8e5 1815 sx->host->port = sx->port; /* Record the port that was used */
02b41d71 1816 sx->helo_data = NULL; /* ensure we re-expand ob->helo_data */
0756eb3c
PH
1817 }
1818
1819/* If TLS is available on this connection, whether continued or not, attempt to
1820start up a TLS session, unless the host is in hosts_avoid_tls. If successful,
1821send another EHLO - the server may give a different answer in secure mode. We
1822use a separate buffer for reading the response to STARTTLS so that if it is
1823negative, the original EHLO data is available for subsequent analysis, should
1824the client not be required to use TLS. If the response is bad, copy the buffer
1825for error analysis. */
1826
1827#ifdef SUPPORT_TLS
2d14f397 1828if ( smtp_peer_options & PEER_OFFERED_TLS
5130845b 1829 && !suppress_tls
02b41d71 1830 && verify_check_given_host(&sx->ob->hosts_avoid_tls, sx->host) != OK
e9166683 1831 && ( !sx->verify
02b41d71
JH
1832 || verify_check_given_host(&sx->ob->hosts_verify_avoid_tls, sx->host) != OK
1833 ) )
0756eb3c
PH
1834 {
1835 uschar buffer2[4096];
d093f8e5 1836 if (smtp_write_command(&sx->outblock, FALSE, "STARTTLS\r\n") < 0)
0756eb3c
PH
1837 goto SEND_FAILED;
1838
1839 /* If there is an I/O error, transmission of this message is deferred. If
1840 there is a temporary rejection of STARRTLS and tls_tempfail_tryclear is
1841 false, we also defer. However, if there is a temporary rejection of STARTTLS
1842 and tls_tempfail_tryclear is true, or if there is an outright rejection of
1843 STARTTLS, we carry on. This means we will try to send the message in clear,
1844 unless the host is in hosts_require_tls (tested below). */
1845
d093f8e5
JH
1846 if (!smtp_read_response(&sx->inblock, buffer2, sizeof(buffer2), '2',
1847 sx->ob->command_timeout))
0756eb3c 1848 {
4b0fe319
JH
1849 if ( errno != 0
1850 || buffer2[0] == 0
d093f8e5 1851 || (buffer2[0] == '4' && !sx->ob->tls_tempfail_tryclear)
4b0fe319 1852 )
0dda4340 1853 {
d093f8e5 1854 Ustrncpy(sx->buffer, buffer2, sizeof(sx->buffer));
9e7e0f6a 1855 sx->buffer[sizeof(sx->buffer)-1] = '\0';
0756eb3c 1856 goto RESPONSE_FAILED;
0dda4340 1857 }
0756eb3c
PH
1858 }
1859
1860 /* STARTTLS accepted: try to negotiate a TLS session. */
1861
1862 else
061b7ebd 1863 TLS_NEGOTIATE:
0756eb3c 1864 {
d093f8e5 1865 address_item * addr;
cf0c6164
JH
1866 uschar * errstr;
1867 int rc = tls_client_start(sx->inblock.sock, sx->host, sx->addrlist, sx->tblock,
0e66b3b6 1868# ifdef EXPERIMENTAL_DANE
cf0c6164 1869 sx->dane ? &tlsa_dnsa : NULL,
0e66b3b6 1870# endif
cf0c6164 1871 &errstr);
0756eb3c
PH
1872
1873 /* TLS negotiation failed; give an error. From outside, this function may
1874 be called again to try in clear on a new connection, if the options permit
1875 it for this host. */
1876
1877 if (rc != OK)
1878 {
6ebd79ec 1879# ifdef EXPERIMENTAL_DANE
d093f8e5 1880 if (sx->dane) log_write(0, LOG_MAIN,
cf0c6164
JH
1881 "DANE attempt failed; TLS connection to %s [%s]: %s",
1882 sx->host->name, sx->host->address, errstr);
6ebd79ec
JH
1883# endif
1884
de6273b4 1885 errno = ERRNO_TLSFAILURE;
cf0c6164 1886 message = string_sprintf("TLS session: %s", errstr);
d093f8e5 1887 sx->send_quit = FALSE;
0756eb3c
PH
1888 goto TLS_FAILED;
1889 }
1890
1891 /* TLS session is set up */
1892
2d14f397 1893 smtp_peer_options_wrap = smtp_peer_options;
d093f8e5 1894 for (addr = sx->addrlist; addr; addr = addr->next)
5ca2a9a1
PH
1895 if (addr->transport_return == PENDING_DEFER)
1896 {
817d9f57 1897 addr->cipher = tls_out.cipher;
9d1c15ef
JH
1898 addr->ourcert = tls_out.ourcert;
1899 addr->peercert = tls_out.peercert;
817d9f57 1900 addr->peerdn = tls_out.peerdn;
018058b2 1901 addr->ocsp = tls_out.ocsp;
5ca2a9a1 1902 }
0756eb3c
PH
1903 }
1904 }
1905
061b7ebd
PP
1906/* if smtps, we'll have smtp_command set to something else; always safe to
1907reset it here. */
1908smtp_command = big_buffer;
1909
41c7c167
PH
1910/* If we started TLS, redo the EHLO/LHLO exchange over the secure channel. If
1911helo_data is null, we are dealing with a connection that was passed from
1912another process, and so we won't have expanded helo_data above. We have to
1913expand it here. $sending_ip_address and $sending_port are set up right at the
1914start of the Exim process (in exim.c). */
0756eb3c 1915
817d9f57 1916if (tls_out.active >= 0)
0756eb3c 1917 {
061b7ebd 1918 char *greeting_cmd;
895fbaf2
JH
1919 BOOL good_response;
1920
d093f8e5 1921 if (!sx->helo_data && !(sx->helo_data = expand_string(sx->ob->helo_data)))
41c7c167 1922 {
d093f8e5
JH
1923 uschar *message = string_sprintf("failed to expand helo_data: %s",
1924 expand_string_message);
1925 set_errno_nohost(sx->addrlist, ERRNO_EXPANDFAIL, message, DEFER, FALSE);
1926 yield = DEFER;
1927 goto SEND_QUIT;
41c7c167
PH
1928 }
1929
0d0e4455 1930 /* For SMTPS we need to wait for the initial OK response. */
d093f8e5 1931 if (sx->smtps)
061b7ebd 1932 {
d093f8e5
JH
1933 good_response = smtp_read_response(&sx->inblock, sx->buffer, sizeof(sx->buffer),
1934 '2', sx->ob->command_timeout);
895fbaf2 1935#ifdef EXPERIMENTAL_DSN_INFO
d093f8e5 1936 sx->smtp_greeting = string_copy(sx->buffer);
895fbaf2
JH
1937#endif
1938 if (!good_response) goto RESPONSE_FAILED;
0d0e4455
PP
1939 }
1940
d093f8e5 1941 if (sx->esmtp)
0d0e4455
PP
1942 greeting_cmd = "EHLO";
1943 else
1944 {
1945 greeting_cmd = "HELO";
1946 DEBUG(D_transport)
1947 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
061b7ebd
PP
1948 }
1949
d093f8e5
JH
1950 if (smtp_write_command(&sx->outblock, FALSE, "%s %s\r\n",
1951 sx->lmtp ? "LHLO" : greeting_cmd, sx->helo_data) < 0)
0756eb3c 1952 goto SEND_FAILED;
d093f8e5
JH
1953 good_response = smtp_read_response(&sx->inblock, sx->buffer, sizeof(sx->buffer),
1954 '2', sx->ob->command_timeout);
895fbaf2 1955#ifdef EXPERIMENTAL_DSN_INFO
d093f8e5 1956 sx->helo_response = string_copy(sx->buffer);
895fbaf2
JH
1957#endif
1958 if (!good_response) goto RESPONSE_FAILED;
2d14f397 1959 smtp_peer_options = 0;
0756eb3c
PH
1960 }
1961
1962/* If the host is required to use a secure channel, ensure that we
1963have one. */
1964
d093f8e5 1965else if ( sx->smtps
0e66b3b6 1966# ifdef EXPERIMENTAL_DANE
d093f8e5 1967 || sx->dane
0e66b3b6 1968# endif
d093f8e5 1969 || verify_check_given_host(&sx->ob->hosts_require_tls, sx->host) == OK
7a31d643 1970 )
0756eb3c 1971 {
de6273b4 1972 errno = ERRNO_TLSREQUIRED;
c562fd30 1973 message = string_sprintf("a TLS session is required, but %s",
2d14f397
JH
1974 smtp_peer_options & PEER_OFFERED_TLS
1975 ? "an attempt to start TLS failed" : "the server did not offer TLS support");
0756eb3c
PH
1976 goto TLS_FAILED;
1977 }
0e66b3b6 1978#endif /*SUPPORT_TLS*/
0756eb3c
PH
1979
1980/* If TLS is active, we have just started it up and re-done the EHLO command,
1981so its response needs to be analyzed. If TLS is not active and this is a
1982continued session down a previously-used socket, we haven't just done EHLO, so
1983we skip this. */
1984
1985if (continue_hostname == NULL
a7538db1 1986#ifdef SUPPORT_TLS
817d9f57 1987 || tls_out.active >= 0
a7538db1 1988#endif
0756eb3c
PH
1989 )
1990 {
d093f8e5 1991 if (sx->esmtp || sx->lmtp)
2d14f397 1992 {
e9166683 1993 sx->peer_offered = ehlo_response(sx->buffer,
d093f8e5
JH
1994 0 /* no TLS */
1995 | (sx->lmtp && sx->ob->lmtp_ignore_quota ? PEER_OFFERED_IGNQ : 0)
1996 | PEER_OFFERED_CHUNKING
1997 | PEER_OFFERED_PRDR
9094b84b 1998#ifdef SUPPORT_I18N
d093f8e5
JH
1999 | (sx->addrlist->prop.utf8_msg ? PEER_OFFERED_UTF8 : 0)
2000 /*XXX if we hand peercaps on to continued-conn processes,
2001 must not depend on this addr */
9094b84b 2002#endif
d093f8e5
JH
2003 | PEER_OFFERED_DSN
2004 | PEER_OFFERED_PIPE
2005 | (sx->ob->size_addition >= 0 ? PEER_OFFERED_SIZE : 0)
9094b84b
JH
2006 );
2007
2d14f397
JH
2008 /* Set for IGNOREQUOTA if the response to LHLO specifies support and the
2009 lmtp_ignore_quota option was set. */
f1513293 2010
d093f8e5 2011 sx->igquotstr = sx->peer_offered & PEER_OFFERED_IGNQ ? US" IGNOREQUOTA" : US"";
f1513293 2012
2d14f397
JH
2013 /* If the response to EHLO specified support for the SIZE parameter, note
2014 this, provided size_addition is non-negative. */
f1513293 2015
d093f8e5 2016 smtp_peer_options |= sx->peer_offered & PEER_OFFERED_SIZE;
0756eb3c 2017
2d14f397
JH
2018 /* Note whether the server supports PIPELINING. If hosts_avoid_esmtp matched
2019 the current host, esmtp will be false, so PIPELINING can never be used. If
2020 the current host matches hosts_avoid_pipelining, don't do it. */
0756eb3c 2021
d093f8e5
JH
2022 if ( sx->peer_offered & PEER_OFFERED_PIPE
2023 && verify_check_given_host(&sx->ob->hosts_avoid_pipelining, sx->host) != OK)
2d14f397 2024 smtp_peer_options |= PEER_OFFERED_PIPE;
0756eb3c 2025
2d14f397
JH
2026 DEBUG(D_transport) debug_printf("%susing PIPELINING\n",
2027 smtp_peer_options & PEER_OFFERED_PIPE ? "" : "not ");
0756eb3c 2028
d093f8e5
JH
2029 if ( sx->peer_offered & PEER_OFFERED_CHUNKING
2030 && verify_check_given_host(&sx->ob->hosts_try_chunking, sx->host) != OK)
2031 sx->peer_offered &= ~PEER_OFFERED_CHUNKING;
f98442df 2032
d093f8e5 2033 if (sx->peer_offered & PEER_OFFERED_CHUNKING)
2d14f397 2034 {DEBUG(D_transport) debug_printf("CHUNKING usable\n");}
0756eb3c 2035
8ccd00b1 2036#ifndef DISABLE_PRDR
d093f8e5
JH
2037 if ( sx->peer_offered & PEER_OFFERED_PRDR
2038 && verify_check_given_host(&sx->ob->hosts_try_prdr, sx->host) != OK)
2039 sx->peer_offered &= ~PEER_OFFERED_PRDR;
fd98a5c6 2040
d093f8e5 2041 if (sx->peer_offered & PEER_OFFERED_PRDR)
2d14f397 2042 {DEBUG(D_transport) debug_printf("PRDR usable\n");}
fd98a5c6
JH
2043#endif
2044
2d14f397 2045 /* Note if the server supports DSN */
d093f8e5 2046 smtp_peer_options |= sx->peer_offered & PEER_OFFERED_DSN;
2d14f397 2047 DEBUG(D_transport) debug_printf("%susing DSN\n",
d093f8e5 2048 sx->peer_offered & PEER_OFFERED_DSN ? "" : "not ");
6c1c3d1d 2049
2d14f397
JH
2050 /* Note if the response to EHLO specifies support for the AUTH extension.
2051 If it has, check that this host is one we want to authenticate to, and do
2052 the business. The host name and address must be available when the
2053 authenticator's client driver is running. */
0756eb3c 2054
d093f8e5
JH
2055 switch (yield = smtp_auth(sx->buffer, sizeof(sx->buffer), sx->addrlist, sx->host,
2056 sx->ob, sx->esmtp, &sx->inblock, &sx->outblock))
2d14f397
JH
2057 {
2058 default: goto SEND_QUIT;
2059 case OK: break;
2060 case FAIL_SEND: goto SEND_FAILED;
2061 case FAIL: goto RESPONSE_FAILED;
2062 }
0756eb3c
PH
2063 }
2064 }
2d14f397 2065pipelining_active = !!(smtp_peer_options & PEER_OFFERED_PIPE);
0756eb3c
PH
2066
2067/* The setting up of the SMTP call is now complete. Any subsequent errors are
2068message-specific. */
2069
d093f8e5 2070sx->setting_up = FALSE;
0756eb3c 2071
8c5d388a 2072#ifdef SUPPORT_I18N
d093f8e5 2073if (sx->addrlist->prop.utf8_msg)
9094b84b 2074 {
d093f8e5
JH
2075 sx->utf8_needed = !sx->addrlist->prop.utf8_downcvt
2076 && !sx->addrlist->prop.utf8_downcvt_maybe;
2077 DEBUG(D_transport) if (!sx->utf8_needed)
59a286ef 2078 debug_printf("utf8: %s downconvert\n",
d093f8e5 2079 sx->addrlist->prop.utf8_downcvt ? "mandatory" : "optional");
9094b84b
JH
2080 }
2081
7ade712c 2082/* If this is an international message we need the host to speak SMTPUTF8 */
d093f8e5 2083if (sx->utf8_needed && !(sx->peer_offered & PEER_OFFERED_UTF8))
7ade712c
JH
2084 {
2085 errno = ERRNO_UTF8_FWD;
2086 goto RESPONSE_FAILED;
2087 }
2088#endif
2089
d093f8e5
JH
2090return OK;
2091
2092
2093 {
2094 int code;
d093f8e5
JH
2095
2096 RESPONSE_FAILED:
d093f8e5 2097 message = NULL;
de6273b4 2098 sx->send_quit = check_response(sx->host, &errno, sx->addrlist->more_errno,
d093f8e5
JH
2099 sx->buffer, &code, &message, &pass_message);
2100 goto FAILED;
d093f8e5
JH
2101
2102 SEND_FAILED:
d093f8e5
JH
2103 code = '4';
2104 message = US string_sprintf("send() to %s [%s] failed: %s",
829dd842 2105 sx->host->name, sx->host->address, strerror(errno));
d093f8e5
JH
2106 sx->send_quit = FALSE;
2107 goto FAILED;
d093f8e5
JH
2108
2109 /* This label is jumped to directly when a TLS negotiation has failed,
2110 or was not done for a host for which it is required. Values will be set
829dd842 2111 in message and errno, and setting_up will always be true. Treat as
d093f8e5
JH
2112 a temporary error. */
2113
de6273b4
JH
2114 EHLOHELO_FAILED:
2115 code = '4';
2116 message = string_sprintf("Remote host closed connection in response to %s"
2117 " (EHLO response was: %s)", smtp_command, sx->buffer);
2118 sx->send_quit = FALSE;
2119 goto FAILED;
2120
d093f8e5
JH
2121#ifdef SUPPORT_TLS
2122 TLS_FAILED:
de6273b4
JH
2123 code = '4';
2124 goto FAILED;
d093f8e5
JH
2125#endif
2126
2127 /* The failure happened while setting up the call; see if the failure was
2128 a 5xx response (this will either be on connection, or following HELO - a 5xx
2129 after EHLO causes it to try HELO). If so, fail all addresses, as this host is
2130 never going to accept them. For other errors during setting up (timeouts or
2131 whatever), defer all addresses, and yield DEFER, so that the host is not
2132 tried again for a while. */
2133
de6273b4 2134FAILED:
d093f8e5 2135 sx->ok = FALSE; /* For when reached by GOTO */
d093f8e5
JH
2136
2137 yield = code == '5'
2138#ifdef SUPPORT_I18N
2139 || errno == ERRNO_UTF8_FWD
2140#endif
2141 ? FAIL : DEFER;
2142
829dd842 2143 set_errno(sx->addrlist, errno, message, yield, pass_message, sx->host
d093f8e5
JH
2144#ifdef EXPERIMENTAL_DSN_INFO
2145 , sx->smtp_greeting, sx->helo_response
2146#endif
2147 );
2148 }
2149
2150
2151SEND_QUIT:
2152
2153if (sx->send_quit)
2154 (void)smtp_write_command(&sx->outblock, FALSE, "QUIT\r\n");
2155
d093f8e5
JH
2156#ifdef SUPPORT_TLS
2157tls_close(FALSE, TRUE);
2158#endif
2159
2160/* Close the socket, and return the appropriate value, first setting
2161works because the NULL setting is passed back to the calling process, and
2162remote_max_parallel is forced to 1 when delivering over an existing connection,
2163
2164If all went well and continue_more is set, we shouldn't actually get here if
2165there are further addresses, as the return above will be taken. However,
2166writing RSET might have failed, or there may be other addresses whose hosts are
2167specified in the transports, and therefore not visible at top level, in which
2168case continue_more won't get set. */
2169
e1d04f48 2170HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
d093f8e5
JH
2171if (sx->send_quit)
2172 {
2173 shutdown(sx->outblock.sock, SHUT_WR);
2174 if (fcntl(sx->inblock.sock, F_SETFL, O_NONBLOCK) == 0)
2175 for (rc = 16; read(sx->inblock.sock, sx->inbuffer, sizeof(sx->inbuffer)) > 0 && rc > 0;)
2176 rc--; /* drain socket */
02b41d71 2177 sx->send_quit = FALSE;
d093f8e5
JH
2178 }
2179(void)close(sx->inblock.sock);
02b41d71 2180sx->inblock.sock = sx->outblock.sock = -1;
d093f8e5
JH
2181
2182#ifndef DISABLE_EVENT
2183(void) event_raise(sx->tblock->event_action, US"tcp:close", NULL);
2184#endif
2185
2186continue_transport = NULL;
2187continue_hostname = NULL;
2188return yield;
2189}
2190
2191
9be4572b
JH
2192
2193
2194/* Create the string of options that will be appended to the MAIL FROM:
2195in the connection context buffer */
2196
2197static int
2198build_mailcmd_options(smtp_context * sx, address_item * addrlist)
2199{
2200uschar * p = sx->buffer;
2201address_item * addr;
2202int address_count;
2203
2204*p = 0;
2205
2206/* If we know the receiving MTA supports the SIZE qualification,
2207send it, adding something to the message size to allow for imprecision
2208and things that get added en route. Exim keeps the number of lines
2209in a message, so we can give an accurate value for the original message, but we
2210need some additional to handle added headers. (Double "." characters don't get
2211included in the count.) */
2212
2213if (sx->peer_offered & PEER_OFFERED_SIZE)
2214 {
2215 sprintf(CS p, " SIZE=%d", message_size+message_linecount+sx->ob->size_addition);
2216 while (*p) p++;
2217 }
2218
2219#ifndef DISABLE_PRDR
2220/* If it supports Per-Recipient Data Reponses, and we have omre than one recipient,
2221request that */
2222
2223sx->prdr_active = FALSE;
2224if (sx->peer_offered & PEER_OFFERED_PRDR)
2225 for (addr = addrlist; addr; addr = addr->next)
2226 if (addr->transport_return == PENDING_DEFER)
2227 {
2228 for (addr = addr->next; addr; addr = addr->next)
2229 if (addr->transport_return == PENDING_DEFER)
2230 { /* at least two recipients to send */
2231 sx->prdr_active = TRUE;
2232 sprintf(CS p, " PRDR"); p += 5;
2233 break;
2234 }
2235 break;
2236 }
2237#endif
2238
2239#ifdef SUPPORT_I18N
2240/* If it supports internationalised messages, and this meesage need that,
2241request it */
2242
2243if ( sx->peer_offered & PEER_OFFERED_UTF8
2244 && addrlist->prop.utf8_msg
2245 && !addrlist->prop.utf8_downcvt
2246 )
2247 Ustrcpy(p, " SMTPUTF8"), p += 9;
2248#endif
2249
2250/* check if all addresses have DSN-lasthop flag; do not send RET and ENVID if so */
2251for (sx->dsn_all_lasthop = TRUE, addr = addrlist, address_count = 0;
2252 addr && address_count < sx->max_rcpt;
2253 addr = addr->next) if (addr->transport_return == PENDING_DEFER)
2254 {
2255 address_count++;
2256 if (!(addr->dsn_flags & rf_dsnlasthop))
2257 {
2258 sx->dsn_all_lasthop = FALSE;
2259 break;
2260 }
2261 }
2262
2263/* Add any DSN flags to the mail command */
2264
2265if (sx->peer_offered & PEER_OFFERED_DSN && !sx->dsn_all_lasthop)
2266 {
2267 if (dsn_ret == dsn_ret_hdrs)
2268 { Ustrcpy(p, " RET=HDRS"); p += 9; }
2269 else if (dsn_ret == dsn_ret_full)
2270 { Ustrcpy(p, " RET=FULL"); p += 9; }
2271
2272 if (dsn_envid)
2273 {
2274 string_format(p, sizeof(sx->buffer) - (p-sx->buffer), " ENVID=%s", dsn_envid);
2275 while (*p) p++;
2276 }
2277 }
2278
2279/* If an authenticated_sender override has been specified for this transport
2280instance, expand it. If the expansion is forced to fail, and there was already
2281an authenticated_sender for this message, the original value will be used.
2282Other expansion failures are serious. An empty result is ignored, but there is
2283otherwise no check - this feature is expected to be used with LMTP and other
2284cases where non-standard addresses (e.g. without domains) might be required. */
2285
2286if (smtp_mail_auth_str(p, sizeof(sx->buffer) - (p-sx->buffer), addrlist, sx->ob))
2287 return ERROR;
2288
2289return OK;
2290}
2291
2292
2293static void
2294build_rcptcmd_options(smtp_context * sx, const address_item * addr)
2295{
2296uschar * p = sx->buffer;
2297*p = 0;
2298
2299/* Add any DSN flags to the rcpt command */
2300
2301if (sx->peer_offered & PEER_OFFERED_DSN && !(addr->dsn_flags & rf_dsnlasthop))
2302 {
2303 if (addr->dsn_flags & rf_dsnflags)
2304 {
2305 int i;
2306 BOOL first = TRUE;
2307
2308 Ustrcpy(p, " NOTIFY=");
2309 while (*p) p++;
2310 for (i = 0; i < nelem(rf_list); i++) if (addr->dsn_flags & rf_list[i])
2311 {
2312 if (!first) *p++ = ',';
2313 first = FALSE;
2314 Ustrcpy(p, rf_names[i]);
2315 while (*p) p++;
2316 }
2317 }
2318
2319 if (addr->dsn_orcpt)
2320 {
2321 string_format(p, sizeof(sx->buffer) - (p-sx->buffer), " ORCPT=%s",
2322 addr->dsn_orcpt);
2323 while (*p) p++;
2324 }
2325 }
2326}
2327
2328
d9c3c8ed
JH
2329
2330/*
2331Return:
e9166683
JH
2332 0 good, rcpt results in addr->transport_return (PENDING_OK, DEFER, FAIL)
2333 -1 MAIL response error
2334 -2 any non-MAIL read i/o error
2335 -3 non-MAIL response timeout
2336 -4 internal error; channel still usable
2337 -5 transmit failed
d9c3c8ed
JH
2338 */
2339
2340int
2341smtp_write_mail_and_rcpt_cmds(smtp_context * sx, int * yield)
2342{
2343address_item * addr;
2344int address_count;
2345int rc;
2346
2347if (build_mailcmd_options(sx, sx->first_addr) != OK)
2348 {
2349 *yield = ERROR;
e9166683 2350 return -4;
d9c3c8ed
JH
2351 }
2352
2353/* From here until we send the DATA command, we can make use of PIPELINING
2354if the server host supports it. The code has to be able to check the responses
2355at any point, for when the buffer fills up, so we write it totally generally.
2356When PIPELINING is off, each command written reports that it has flushed the
2357buffer. */
2358
2359sx->pending_MAIL = TRUE; /* The block starts with MAIL */
2360
2361 {
2362 uschar * s = sx->from_addr;
2363#ifdef SUPPORT_I18N
2364 uschar * errstr = NULL;
2365
2366 /* If we must downconvert, do the from-address here. Remember we had to
2367 for the to-addresses (done below), and also (ugly) for re-doing when building
2368 the delivery log line. */
2369
2370 if ( sx->addrlist->prop.utf8_msg
2371 && (sx->addrlist->prop.utf8_downcvt || !(sx->peer_offered & PEER_OFFERED_UTF8))
2372 )
2373 {
2374 if (s = string_address_utf8_to_alabel(s, &errstr), errstr)
2375 {
2376 set_errno_nohost(sx->addrlist, ERRNO_EXPANDFAIL, errstr, DEFER, FALSE);
2377 *yield = ERROR;
e9166683 2378 return -4;
d9c3c8ed
JH
2379 }
2380 setflag(sx->addrlist, af_utf8_downcvt);
2381 }
2382#endif
2383
2384 rc = smtp_write_command(&sx->outblock, pipelining_active,
2385 "MAIL FROM:<%s>%s\r\n", s, sx->buffer);
2386 }
2387
2388mail_command = string_copy(big_buffer); /* Save for later error message */
2389
2390switch(rc)
2391 {
2392 case -1: /* Transmission error */
e9166683 2393 return -5;
d9c3c8ed 2394
df5b41e3 2395 case +1: /* Cmd was sent */
d9c3c8ed
JH
2396 if (!smtp_read_response(&sx->inblock, sx->buffer, sizeof(sx->buffer), '2',
2397 sx->ob->command_timeout))
2398 {
2399 if (errno == 0 && sx->buffer[0] == '4')
2400 {
2401 errno = ERRNO_MAIL4XX;
2402 sx->addrlist->more_errno |= ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
2403 }
2404 return -1;
2405 }
2406 sx->pending_MAIL = FALSE;
2407 break;
e9166683
JH
2408
2409 /* otherwise zero: command queued for pipeline */
d9c3c8ed
JH
2410 }
2411
2412/* Pass over all the relevant recipient addresses for this host, which are the
2413ones that have status PENDING_DEFER. If we are using PIPELINING, we can send
2414several before we have to read the responses for those seen so far. This
2415checking is done by a subroutine because it also needs to be done at the end.
2416Send only up to max_rcpt addresses at a time, leaving next_addr pointing to
2417the next one if not all are sent.
2418
2419In the MUA wrapper situation, we want to flush the PIPELINING buffer for the
2420last address because we want to abort if any recipients have any kind of
2421problem, temporary or permanent. We know that all recipient addresses will have
2422the PENDING_DEFER status, because only one attempt is ever made, and we know
e9166683
JH
2423that max_rcpt will be large, so all addresses will be done at once.
2424
2425For verify we flush the pipeline after any (the only) rcpt address. */
d9c3c8ed
JH
2426
2427for (addr = sx->first_addr, address_count = 0;
2428 addr && address_count < sx->max_rcpt;
2429 addr = addr->next) if (addr->transport_return == PENDING_DEFER)
2430 {
2431 int count;
2432 BOOL no_flush;
2433 uschar * rcpt_addr;
2434
2435 addr->dsn_aware = sx->peer_offered & PEER_OFFERED_DSN
2436 ? dsn_support_yes : dsn_support_no;
2437
2438 address_count++;
e9166683 2439 no_flush = pipelining_active && !sx->verify && (!mua_wrapper || addr->next);
d9c3c8ed
JH
2440
2441 build_rcptcmd_options(sx, addr);
2442
2443 /* Now send the RCPT command, and process outstanding responses when
2444 necessary. After a timeout on RCPT, we just end the function, leaving the
2445 yield as OK, because this error can often mean that there is a problem with
2446 just one address, so we don't want to delay the host. */
2447
2448 rcpt_addr = transport_rcpt_address(addr, sx->tblock->rcpt_include_affixes);
2449
2450#ifdef SUPPORT_I18N
2451 if ( testflag(sx->addrlist, af_utf8_downcvt)
2452 && !(rcpt_addr = string_address_utf8_to_alabel(rcpt_addr, NULL))
2453 )
2454 {
2455 /*XXX could we use a per-address errstr here? Not fail the whole send? */
2456 errno = ERRNO_EXPANDFAIL;
e9166683 2457 return -5; /*XXX too harsh? */
d9c3c8ed
JH
2458 }
2459#endif
2460
2461 count = smtp_write_command(&sx->outblock, no_flush, "RCPT TO:<%s>%s%s\r\n",
2462 rcpt_addr, sx->igquotstr, sx->buffer);
2463
e9166683 2464 if (count < 0) return -5;
d9c3c8ed
JH
2465 if (count > 0)
2466 {
df5b41e3 2467 switch(sync_responses(sx, count, 0))
d9c3c8ed
JH
2468 {
2469 case 3: sx->ok = TRUE; /* 2xx & 5xx => OK & progress made */
2470 case 2: sx->completed_addr = TRUE; /* 5xx (only) => progress made */
e9166683 2471 break;
d9c3c8ed
JH
2472
2473 case 1: sx->ok = TRUE; /* 2xx (only) => OK, but if LMTP, */
2474 if (!sx->lmtp) /* can't tell about progress yet */
2475 sx->completed_addr = TRUE;
2476 case 0: /* No 2xx or 5xx, but no probs */
2477 break;
2478
e9166683
JH
2479 case -1: return -3; /* Timeout on RCPT */
2480 case -2: return -2; /* non-MAIL read i/o error */
2481 default: return -1; /* any MAIL error */
d9c3c8ed
JH
2482 }
2483 sx->pending_MAIL = FALSE; /* Dealt with MAIL */
2484 }
2485 } /* Loop for next address */
2486
2487sx->next_addr = addr;
2488return 0;
2489}
2490
2491
d093f8e5
JH
2492/*************************************************
2493* Deliver address list to given host *
2494*************************************************/
2495
2496/* If continue_hostname is not null, we get here only when continuing to
2497deliver down an existing channel. The channel was passed as the standard
2498input. TLS is never active on a passed channel; the previous process always
2499closes it down before passing the connection on.
2500
2501Otherwise, we have to make a connection to the remote host, and do the
2502initial protocol exchange.
2503
2504When running as an MUA wrapper, if the sender or any recipient is rejected,
2505temporarily or permanently, we force failure for all recipients.
2506
2507Arguments:
2508 addrlist chain of potential addresses to deliver; only those whose
2509 transport_return field is set to PENDING_DEFER are currently
2510 being processed; others should be skipped - they have either
2511 been delivered to an earlier host or IP address, or been
2512 failed by one of them.
2513 host host to deliver to
2514 host_af AF_INET or AF_INET6
2515 port default TCP/IP port to use, in host byte order
2516 interface interface to bind to, or NULL
2517 tblock transport instance block
2518 message_defer set TRUE if yield is OK, but all addresses were deferred
2519 because of a non-recipient, non-host failure, that is, a
2520 4xx response to MAIL FROM, DATA, or ".". This is a defer
2521 that is specific to the message.
2522 suppress_tls if TRUE, don't attempt a TLS connection - this is set for
2523 a second attempt after TLS initialization fails
2524
2525Returns: OK - the connection was made and the delivery attempted;
2526 the result for each address is in its data block.
2527 DEFER - the connection could not be made, or something failed
2528 while setting up the SMTP session, or there was a
2529 non-message-specific error, such as a timeout.
2530 ERROR - a filter command is specified for this transport,
2531 and there was a problem setting it up; OR helo_data
2532 or add_headers or authenticated_sender is specified
2533 for this transport, and the string failed to expand
2534*/
2535
2536static int
2537smtp_deliver(address_item *addrlist, host_item *host, int host_af, int port,
2538 uschar *interface, transport_instance *tblock,
2539 BOOL *message_defer, BOOL suppress_tls)
2540{
2541address_item *addr;
d093f8e5 2542int yield = OK;
d093f8e5
JH
2543int save_errno;
2544int rc;
2545time_t start_delivery_time = time(NULL);
2546
d093f8e5
JH
2547BOOL pass_message = FALSE;
2548uschar *message = NULL;
2549uschar new_message_id[MESSAGE_ID_LENGTH + 1];
2550uschar *p;
2551
2552smtp_context sx;
2553
2554suppress_tls = suppress_tls; /* stop compiler warning when no TLS support */
02b41d71 2555*message_defer = FALSE;
d093f8e5
JH
2556
2557sx.addrlist = addrlist;
2558sx.host = host;
2559sx.host_af = host_af,
2560sx.port = port;
2561sx.interface = interface;
02b41d71 2562sx.helo_data = NULL;
d093f8e5 2563sx.tblock = tblock;
e9166683 2564sx.verify = FALSE;
d093f8e5 2565
9be4572b
JH
2566/* Get the channel set up ready for a message (MAIL FROM being the next
2567SMTP command to send */
2568
e9166683 2569if ((rc = smtp_setup_conn(&sx, suppress_tls)) != OK)
d093f8e5
JH
2570 return rc;
2571
0756eb3c
PH
2572/* If there is a filter command specified for this transport, we can now
2573set it up. This cannot be done until the identify of the host is known. */
2574
e9166683 2575if (tblock->filter_command)
0756eb3c
PH
2576 {
2577 BOOL rc;
76ac1b5b
JH
2578 uschar fbuf[64];
2579 sprintf(CS fbuf, "%.50s transport", tblock->name);
0756eb3c 2580 rc = transport_set_up_command(&transport_filter_argv, tblock->filter_command,
76ac1b5b 2581 TRUE, DEFER, addrlist, fbuf, NULL);
9b989985 2582 transport_filter_timeout = tblock->filter_timeout;
0756eb3c
PH
2583
2584 /* On failure, copy the error to all addresses, abandon the SMTP call, and
2585 yield ERROR. */
2586
2587 if (!rc)
2588 {
895fbaf2
JH
2589 set_errno_nohost(addrlist->next, addrlist->basic_errno, addrlist->message, DEFER,
2590 FALSE);
0756eb3c
PH
2591 yield = ERROR;
2592 goto SEND_QUIT;
2593 }
48f1c853
JH
2594
2595 if ( transport_filter_argv
2596 && *transport_filter_argv
2597 && **transport_filter_argv
d093f8e5 2598 && sx.peer_offered & PEER_OFFERED_CHUNKING
48f1c853
JH
2599 )
2600 {
d093f8e5 2601 sx.peer_offered &= ~PEER_OFFERED_CHUNKING;
48f1c853
JH
2602 DEBUG(D_transport) debug_printf("CHUNKING not usable due to transport filter\n");
2603 }
0756eb3c
PH
2604 }
2605
2606
2607/* For messages that have more than the maximum number of envelope recipients,
2608we want to send several transactions down the same SMTP connection. (See
2609comments in deliver.c as to how this reconciles, heuristically, with
2610remote_max_parallel.) This optimization was added to Exim after the following
2611code was already working. The simplest way to put it in without disturbing the
2612code was to use a goto to jump back to this point when there is another
2613transaction to handle. */
2614
2615SEND_MESSAGE:
d9c3c8ed
JH
2616sx.from_addr = return_path;
2617sx.first_addr = sx.sync_addr = addrlist;
d093f8e5
JH
2618sx.ok = FALSE;
2619sx.send_rset = TRUE;
d9c3c8ed 2620sx.completed_addr = FALSE;
0756eb3c
PH
2621
2622
9be4572b 2623/* Initiate a message transfer. */
6b62e899 2624
d9c3c8ed 2625switch(smtp_write_mail_and_rcpt_cmds(&sx, &yield))
0756eb3c 2626 {
e9166683
JH
2627 case 0: break;
2628 case -1: case -2: goto RESPONSE_FAILED;
2629 case -3: goto END_OFF;
2630 case -4: goto SEND_QUIT;
2631 default: goto SEND_FAILED;
0756eb3c
PH
2632 }
2633
0756eb3c
PH
2634/* If we are an MUA wrapper, abort if any RCPTs were rejected, either
2635permanently or temporarily. We should have flushed and synced after the last
2636RCPT. */
2637
2638if (mua_wrapper)
2639 {
2640 address_item *badaddr;
d9c3c8ed 2641 for (badaddr = sx.first_addr; badaddr; badaddr = badaddr->next)
168dec3b
JH
2642 if (badaddr->transport_return != PENDING_OK)
2643 {
2644 /*XXX could we find a better errno than 0 here? */
895fbaf2
JH
2645 set_errno_nohost(addrlist, 0, badaddr->message, FAIL,
2646 testflag(badaddr, af_pass_message));
d093f8e5 2647 sx.ok = FALSE;
168dec3b
JH
2648 break;
2649 }
0756eb3c
PH
2650 }
2651
2652/* If ok is TRUE, we know we have got at least one good recipient, and must now
2653send DATA, but if it is FALSE (in the normal, non-wrapper case), we may still
2654have a good recipient buffered up if we are pipelining. We don't want to waste
2655time sending DATA needlessly, so we only send it if either ok is TRUE or if we
6d5c916c
JH
2656are pipelining. The responses are all handled by sync_responses().
2657If using CHUNKING, do not send a BDAT until we know how big a chunk we want
2658to send is. */
0756eb3c 2659
d093f8e5
JH
2660if ( !(sx.peer_offered & PEER_OFFERED_CHUNKING)
2661 && (sx.ok || (pipelining_active && !mua_wrapper)))
0756eb3c 2662 {
d093f8e5 2663 int count = smtp_write_command(&sx.outblock, FALSE, "DATA\r\n");
6d5c916c 2664
0756eb3c 2665 if (count < 0) goto SEND_FAILED;
df5b41e3 2666 switch(sync_responses(&sx, count, sx.ok ? +1 : -1))
0756eb3c 2667 {
d093f8e5 2668 case 3: sx.ok = TRUE; /* 2xx & 5xx => OK & progress made */
d9c3c8ed 2669 case 2: sx.completed_addr = TRUE; /* 5xx (only) => progress made */
0756eb3c
PH
2670 break;
2671
d093f8e5 2672 case 1: sx.ok = TRUE; /* 2xx (only) => OK, but if LMTP, */
d9c3c8ed 2673 if (!sx.lmtp) sx.completed_addr = TRUE; /* can't tell about progress yet */
0756eb3c
PH
2674 case 0: break; /* No 2xx or 5xx, but no probs */
2675
2676 case -1: goto END_OFF; /* Timeout on RCPT */
2677 default: goto RESPONSE_FAILED; /* I/O error, or any MAIL/DATA error */
2678 }
0d9fa8c0 2679 pipelining_active = FALSE;
87cb4a16 2680 data_command = string_copy(big_buffer); /* Save for later error message */
0756eb3c
PH
2681 }
2682
0756eb3c
PH
2683/* If there were no good recipients (but otherwise there have been no
2684problems), just set ok TRUE, since we have handled address-specific errors
2685already. Otherwise, it's OK to send the message. Use the check/escape mechanism
2686for handling the SMTP dot-handling protocol, flagging to apply to headers as
2687well as body. Set the appropriate timeout value to be used for each chunk.
2688(Haven't been able to make it work using select() for writing yet.) */
2689
d093f8e5 2690if (!(sx.peer_offered & PEER_OFFERED_CHUNKING) && !sx.ok)
6d5c916c
JH
2691 {
2692 /* Save the first address of the next batch. */
d9c3c8ed 2693 sx.first_addr = sx.next_addr;
6d5c916c 2694
d093f8e5 2695 sx.ok = TRUE;
6d5c916c 2696 }
ff5aac2b 2697else
0756eb3c 2698 {
6b46ecc6
JH
2699 transport_ctx tctx = {
2700 tblock,
2701 addrlist,
2702 US".", US"..", /* Escaping strings */
65de12cc 2703 topt_use_crlf | topt_escape_headers
6b46ecc6
JH
2704 | (tblock->body_only ? topt_no_headers : 0)
2705 | (tblock->headers_only ? topt_no_body : 0)
2706 | (tblock->return_path_add ? topt_add_return_path : 0)
2707 | (tblock->delivery_date_add ? topt_add_delivery_date : 0)
2708 | (tblock->envelope_to_add ? topt_add_envelope_to : 0)
2709 };
2710
6d5c916c
JH
2711 /* If using CHUNKING we need a callback from the generic transport
2712 support to us, for the sending of BDAT smtp commands and the reaping
2713 of responses. The callback needs a whole bunch of state so set up
2714 a transport-context structure to be passed around. */
2715
d093f8e5 2716 if (sx.peer_offered & PEER_OFFERED_CHUNKING)
59932f7d 2717 {
65de12cc 2718 tctx.check_string = tctx.escape_string = NULL;
6d5c916c
JH
2719 tctx.options |= topt_use_bdat;
2720 tctx.chunk_cb = smtp_chunk_cmd_callback;
e9166683
JH
2721 sx.pending_BDAT = FALSE;
2722 sx.good_RCPT = sx.ok;
2723 sx.cmd_count = 0;
2724 tctx.smtp_context = &sx;
59932f7d
JH
2725 }
2726 else
65de12cc 2727 tctx.options |= topt_end_dot;
59932f7d 2728
6d5c916c 2729 /* Save the first address of the next batch. */
d9c3c8ed 2730 sx.first_addr = sx.next_addr;
6d5c916c 2731
e027f545
JH
2732 /* Responses from CHUNKING commands go in buffer. Otherwise,
2733 there has not been a response. */
2734
d093f8e5 2735 sx.buffer[0] = 0;
e027f545 2736
0756eb3c 2737 sigalrm_seen = FALSE;
d093f8e5 2738 transport_write_timeout = sx.ob->data_timeout;
0756eb3c
PH
2739 smtp_command = US"sending data block"; /* For error messages */
2740 DEBUG(D_transport|D_v)
d093f8e5 2741 if (sx.peer_offered & PEER_OFFERED_CHUNKING)
6d5c916c
JH
2742 debug_printf(" will write message using CHUNKING\n");
2743 else
2744 debug_printf(" SMTP>> writing message and terminating \".\"\n");
0756eb3c 2745 transport_count = 0;
a7538db1 2746
80a47a2c 2747#ifndef DISABLE_DKIM
d093f8e5 2748 sx.ok = dkim_transport_write_message(sx.inblock.sock, &tctx, &sx.ob->dkim);
4cd12fe9 2749#else
d093f8e5 2750 sx.ok = transport_write_message(sx.inblock.sock, &tctx, 0);
4cd12fe9 2751#endif
0756eb3c
PH
2752
2753 /* transport_write_message() uses write() because it is called from other
2754 places to write to non-sockets. This means that under some OS (e.g. Solaris)
2755 it can exit with "Broken pipe" as its error. This really means that the
2756 socket got closed at the far end. */
2757
2758 transport_write_timeout = 0; /* for subsequent transports */
2759
2760 /* Failure can either be some kind of I/O disaster (including timeout),
e027f545
JH
2761 or the failure of a transport filter or the expansion of added headers.
2762 Or, when CHUNKING, it can be a protocol-detected failure. */
0756eb3c 2763
d093f8e5 2764 if (!sx.ok)
0756eb3c 2765 goto RESPONSE_FAILED;
0756eb3c
PH
2766
2767 /* We used to send the terminating "." explicitly here, but because of
2768 buffering effects at both ends of TCP/IP connections, you don't gain
2769 anything by keeping it separate, so it might as well go in the final
2770 data buffer for efficiency. This is now done by setting the topt_end_dot
2771 flag above. */
2772
2773 smtp_command = US"end of data";
2774
e9166683 2775 if (sx.peer_offered & PEER_OFFERED_CHUNKING && sx.cmd_count > 1)
6d5c916c
JH
2776 {
2777 /* Reap any outstanding MAIL & RCPT commands, but not a DATA-go-ahead */
e9166683 2778 switch(sync_responses(&sx, sx.cmd_count-1, 0))
6d5c916c 2779 {
d093f8e5 2780 case 3: sx.ok = TRUE; /* 2xx & 5xx => OK & progress made */
d9c3c8ed 2781 case 2: sx.completed_addr = TRUE; /* 5xx (only) => progress made */
6d5c916c
JH
2782 break;
2783
d093f8e5 2784 case 1: sx.ok = TRUE; /* 2xx (only) => OK, but if LMTP, */
d9c3c8ed 2785 if (!sx.lmtp) sx.completed_addr = TRUE; /* can't tell about progress yet */
6d5c916c
JH
2786 case 0: break; /* No 2xx or 5xx, but no probs */
2787
2788 case -1: goto END_OFF; /* Timeout on RCPT */
2789 default: goto RESPONSE_FAILED; /* I/O error, or any MAIL/DATA error */
2790 }
2791 }
2792
8ccd00b1 2793#ifndef DISABLE_PRDR
fd98a5c6
JH
2794 /* For PRDR we optionally get a partial-responses warning
2795 * followed by the individual responses, before going on with
2796 * the overall response. If we don't get the warning then deal
2797 * with per non-PRDR. */
d093f8e5 2798 if(sx.prdr_active)
fd98a5c6 2799 {
d093f8e5
JH
2800 sx.ok = smtp_read_response(&sx.inblock, sx.buffer, sizeof(sx.buffer), '3',
2801 sx.ob->final_timeout);
2802 if (!sx.ok && errno == 0) switch(sx.buffer[0])
e027f545 2803 {
d093f8e5
JH
2804 case '2': sx.prdr_active = FALSE;
2805 sx.ok = TRUE;
e027f545
JH
2806 break;
2807 case '4': errno = ERRNO_DATA4XX;
2808 addrlist->more_errno |=
d093f8e5 2809 ((sx.buffer[1] - '0')*10 + sx.buffer[2] - '0') << 8;
e027f545
JH
2810 break;
2811 }
fd98a5c6
JH
2812 }
2813 else
2814#endif
2815
2816 /* For non-PRDR SMTP, we now read a single response that applies to the
2817 whole message. If it is OK, then all the addresses have been delivered. */
0756eb3c 2818
d093f8e5 2819 if (!sx.lmtp)
e97957bc 2820 {
d093f8e5
JH
2821 sx.ok = smtp_read_response(&sx.inblock, sx.buffer, sizeof(sx.buffer), '2',
2822 sx.ob->final_timeout);
2823 if (!sx.ok && errno == 0 && sx.buffer[0] == '4')
e97957bc
PH
2824 {
2825 errno = ERRNO_DATA4XX;
d093f8e5 2826 addrlist->more_errno |= ((sx.buffer[1] - '0')*10 + sx.buffer[2] - '0') << 8;
e97957bc
PH
2827 }
2828 }
0756eb3c
PH
2829
2830 /* For LMTP, we get back a response for every RCPT command that we sent;
2831 some may be accepted and some rejected. For those that get a response, their
2832 status is fixed; any that are accepted have been handed over, even if later
2833 responses crash - at least, that's how I read RFC 2033.
2834
2835 If all went well, mark the recipient addresses as completed, record which
2836 host/IPaddress they were delivered to, and cut out RSET when sending another
2837 message down the same channel. Write the completed addresses to the journal
2838 now so that they are recorded in case there is a crash of hardware or
2839 software before the spool gets updated. Also record the final SMTP
2840 confirmation if needed (for SMTP only). */
2841
d093f8e5 2842 if (sx.ok)
0756eb3c
PH
2843 {
2844 int flag = '=';
2845 int delivery_time = (int)(time(NULL) - start_delivery_time);
2846 int len;
0756eb3c 2847 uschar *conf = NULL;
0d9fa8c0 2848
d093f8e5 2849 sx.send_rset = FALSE;
0d9fa8c0 2850 pipelining_active = FALSE;
0756eb3c 2851
0756eb3c
PH
2852 /* Set up confirmation if needed - applies only to SMTP */
2853
d68218c7 2854 if (
0cbf2b82 2855#ifdef DISABLE_EVENT
6c6d6e48 2856 LOGGING(smtp_confirmation) &&
a7538db1 2857#endif
d093f8e5 2858 !sx.lmtp
d68218c7 2859 )
0756eb3c 2860 {
d093f8e5 2861 const uschar *s = string_printing(sx.buffer);
55414b25 2862 /* deconst cast ok here as string_printing was checked to have alloc'n'copied */
d093f8e5 2863 conf = (s == sx.buffer)? (uschar *)string_copy(s) : US s;
0756eb3c
PH
2864 }
2865
fd98a5c6 2866 /* Process all transported addresses - for LMTP or PRDR, read a status for
0756eb3c
PH
2867 each one. */
2868
d9c3c8ed 2869 for (addr = addrlist; addr != sx.first_addr; addr = addr->next)
0756eb3c
PH
2870 {
2871 if (addr->transport_return != PENDING_OK) continue;
2872
2873 /* LMTP - if the response fails badly (e.g. timeout), use it for all the
2874 remaining addresses. Otherwise, it's a return code for just the one
75def545
PH
2875 address. For temporary errors, add a retry item for the address so that
2876 it doesn't get tried again too soon. */
0756eb3c 2877
8ccd00b1 2878#ifndef DISABLE_PRDR
d093f8e5 2879 if (sx.lmtp || sx.prdr_active)
fd98a5c6 2880#else
d093f8e5 2881 if (sx.lmtp)
fd98a5c6 2882#endif
0756eb3c 2883 {
d093f8e5
JH
2884 if (!smtp_read_response(&sx.inblock, sx.buffer, sizeof(sx.buffer), '2',
2885 sx.ob->final_timeout))
0756eb3c 2886 {
d093f8e5 2887 if (errno != 0 || sx.buffer[0] == 0) goto RESPONSE_FAILED;
fd98a5c6 2888 addr->message = string_sprintf(
8ccd00b1 2889#ifndef DISABLE_PRDR
d093f8e5 2890 "%s error after %s: %s", sx.prdr_active ? "PRDR":"LMTP",
fd98a5c6
JH
2891#else
2892 "LMTP error after %s: %s",
2893#endif
d093f8e5 2894 data_command, string_printing(sx.buffer));
75def545 2895 setflag(addr, af_pass_message); /* Allow message to go to user */
d093f8e5 2896 if (sx.buffer[0] == '5')
75def545
PH
2897 addr->transport_return = FAIL;
2898 else
2899 {
e97957bc 2900 errno = ERRNO_DATA4XX;
d093f8e5 2901 addr->more_errno |= ((sx.buffer[1] - '0')*10 + sx.buffer[2] - '0') << 8;
75def545 2902 addr->transport_return = DEFER;
8ccd00b1 2903#ifndef DISABLE_PRDR
d093f8e5 2904 if (!sx.prdr_active)
fd98a5c6
JH
2905#endif
2906 retry_add_item(addr, addr->address_retry_key, 0);
75def545 2907 }
0756eb3c
PH
2908 continue;
2909 }
d9c3c8ed 2910 sx.completed_addr = TRUE; /* NOW we can set this flag */
6c6d6e48 2911 if (LOGGING(smtp_confirmation))
c0ea85ab 2912 {
d093f8e5 2913 const uschar *s = string_printing(sx.buffer);
55414b25 2914 /* deconst cast ok here as string_printing was checked to have alloc'n'copied */
d093f8e5 2915 conf = (s == sx.buffer) ? US string_copy(s) : US s;
c0ea85ab 2916 }
0756eb3c
PH
2917 }
2918
2919 /* SMTP, or success return from LMTP for this address. Pass back the
2d280592 2920 actual host that was used. */
0756eb3c
PH
2921
2922 addr->transport_return = OK;
2923 addr->more_errno = delivery_time;
d427a7f9 2924 addr->host_used = host;
0756eb3c
PH
2925 addr->special_action = flag;
2926 addr->message = conf;
8ccd00b1 2927#ifndef DISABLE_PRDR
d093f8e5 2928 if (sx.prdr_active) addr->flags |= af_prdr_used;
fd98a5c6 2929#endif
d093f8e5 2930 if (sx.peer_offered & PEER_OFFERED_CHUNKING) addr->flags |= af_chunking_used;
0756eb3c
PH
2931 flag = '-';
2932
8ccd00b1 2933#ifndef DISABLE_PRDR
d093f8e5 2934 if (!sx.prdr_active)
fd98a5c6
JH
2935#endif
2936 {
2937 /* Update the journal. For homonymic addresses, use the base address plus
2938 the transport name. See lots of comments in deliver.c about the reasons
2939 for the complications when homonyms are involved. Just carry on after
2940 write error, as it may prove possible to update the spool file later. */
4d8d62b9 2941
fd98a5c6 2942 if (testflag(addr, af_homonym))
d093f8e5 2943 sprintf(CS sx.buffer, "%.500s/%s\n", addr->unique + 3, tblock->name);
fd98a5c6 2944 else
d093f8e5 2945 sprintf(CS sx.buffer, "%.500s\n", addr->unique);
4d8d62b9 2946
d093f8e5
JH
2947 DEBUG(D_deliver) debug_printf("journalling %s\n", sx.buffer);
2948 len = Ustrlen(CS sx.buffer);
2949 if (write(journal_fd, sx.buffer, len) != len)
fd98a5c6 2950 log_write(0, LOG_MAIN|LOG_PANIC, "failed to write journal for "
d093f8e5 2951 "%s: %s", sx.buffer, strerror(errno));
fd98a5c6 2952 }
0756eb3c
PH
2953 }
2954
8ccd00b1 2955#ifndef DISABLE_PRDR
d093f8e5 2956 if (sx.prdr_active)
fd98a5c6
JH
2957 {
2958 /* PRDR - get the final, overall response. For any non-success
2959 upgrade all the address statuses. */
d093f8e5
JH
2960 sx.ok = smtp_read_response(&sx.inblock, sx.buffer, sizeof(sx.buffer), '2',
2961 sx.ob->final_timeout);
2962 if (!sx.ok)
fd98a5c6 2963 {
d093f8e5 2964 if(errno == 0 && sx.buffer[0] == '4')
fd98a5c6
JH
2965 {
2966 errno = ERRNO_DATA4XX;
d093f8e5 2967 addrlist->more_errno |= ((sx.buffer[1] - '0')*10 + sx.buffer[2] - '0') << 8;
fd98a5c6 2968 }
d9c3c8ed 2969 for (addr = addrlist; addr != sx.first_addr; addr = addr->next)
d093f8e5 2970 if (sx.buffer[0] == '5' || addr->transport_return == OK)
fd98a5c6
JH
2971 addr->transport_return = PENDING_OK; /* allow set_errno action */
2972 goto RESPONSE_FAILED;
2973 }
2974
2975 /* Update the journal, or setup retry. */
d9c3c8ed 2976 for (addr = addrlist; addr != sx.first_addr; addr = addr->next)
fd98a5c6 2977 if (addr->transport_return == OK)
9be4572b
JH
2978 {
2979 if (testflag(addr, af_homonym))
2980 sprintf(CS sx.buffer, "%.500s/%s\n", addr->unique + 3, tblock->name);
2981 else
2982 sprintf(CS sx.buffer, "%.500s\n", addr->unique);
2983
2984 DEBUG(D_deliver) debug_printf("journalling(PRDR) %s\n", sx.buffer);
2985 len = Ustrlen(CS sx.buffer);
2986 if (write(journal_fd, sx.buffer, len) != len)
2987 log_write(0, LOG_MAIN|LOG_PANIC, "failed to write journal for "
2988 "%s: %s", sx.buffer, strerror(errno));
2989 }
2990 else if (addr->transport_return == DEFER)
2991 retry_add_item(addr, addr->address_retry_key, -2);
fd98a5c6
JH
2992 }
2993#endif
2994
0756eb3c
PH
2995 /* Ensure the journal file is pushed out to disk. */
2996
54fc8428 2997 if (EXIMfsync(journal_fd) < 0)
0756eb3c
PH
2998 log_write(0, LOG_MAIN|LOG_PANIC, "failed to fsync journal: %s",
2999 strerror(errno));
3000 }
3001 }
3002
3003
3004/* Handle general (not specific to one address) failures here. The value of ok
3005is used to skip over this code on the falling through case. A timeout causes a
3006deferral. Other errors may defer or fail according to the response code, and
3007may set up a special errno value, e.g. after connection chopped, which is
3008assumed if errno == 0 and there is no text in the buffer. If control reaches
3009here during the setting up phase (i.e. before MAIL FROM) then always defer, as
3010the problem is not related to this specific message. */
3011
d093f8e5 3012if (!sx.ok)
0756eb3c 3013 {
895fbaf2
JH
3014 int code, set_rc;
3015 uschar * set_message;
0756eb3c
PH
3016
3017 RESPONSE_FAILED:
895fbaf2
JH
3018 {
3019 save_errno = errno;
3020 message = NULL;
d093f8e5
JH
3021 sx.send_quit = check_response(host, &save_errno, addrlist->more_errno,
3022 sx.buffer, &code, &message, &pass_message);
895fbaf2
JH
3023 goto FAILED;
3024 }
0756eb3c
PH
3025
3026 SEND_FAILED:
895fbaf2
JH
3027 {
3028 save_errno = errno;
3029 code = '4';
3030 message = US string_sprintf("send() to %s [%s] failed: %s",
3031 host->name, host->address, strerror(save_errno));
d093f8e5 3032 sx.send_quit = FALSE;
895fbaf2
JH
3033 goto FAILED;
3034 }
0756eb3c 3035
0756eb3c 3036 FAILED:
9be4572b
JH
3037 {
3038 BOOL message_error;
0756eb3c 3039
9be4572b
JH
3040 sx.ok = FALSE; /* For when reached by GOTO */
3041 set_message = message;
0756eb3c 3042
e97957bc 3043 /* We want to handle timeouts after MAIL or "." and loss of connection after
0756eb3c 3044 "." specially. They can indicate a problem with the sender address or with
e97957bc
PH
3045 the contents of the message rather than a real error on the connection. These
3046 cases are treated in the same way as a 4xx response. This next bit of code
3047 does the classification. */
0756eb3c 3048
e97957bc
PH
3049 switch(save_errno)
3050 {
3051 case 0:
3052 case ERRNO_MAIL4XX:
3053 case ERRNO_DATA4XX:
250b6871
JH
3054 message_error = TRUE;
3055 break;
0756eb3c 3056
e97957bc 3057 case ETIMEDOUT:
250b6871
JH
3058 message_error = Ustrncmp(smtp_command,"MAIL",4) == 0 ||
3059 Ustrncmp(smtp_command,"end ",4) == 0;
3060 break;
e97957bc
PH
3061
3062 case ERRNO_SMTPCLOSED:
250b6871
JH
3063 message_error = Ustrncmp(smtp_command,"end ",4) == 0;
3064 break;
e97957bc
PH
3065
3066 default:
250b6871
JH
3067 message_error = FALSE;
3068 break;
e97957bc 3069 }
0756eb3c 3070
e97957bc 3071 /* Handle the cases that are treated as message errors. These are:
0756eb3c 3072
e97957bc
PH
3073 (a) negative response or timeout after MAIL
3074 (b) negative response after DATA
3075 (c) negative response or timeout or dropped connection after "."
250b6871 3076 (d) utf8 support required and not offered
0756eb3c 3077
e97957bc
PH
3078 It won't be a negative response or timeout after RCPT, as that is dealt
3079 with separately above. The action in all cases is to set an appropriate
3080 error code for all the addresses, but to leave yield set to OK because the
3081 host itself has not failed. Of course, it might in practice have failed
3082 when we've had a timeout, but if so, we'll discover that at the next
3083 delivery attempt. For a temporary error, set the message_defer flag, and
3084 write to the logs for information if this is not the last host. The error
3085 for the last host will be logged as part of the address's log line. */
3086
3087 if (message_error)
0756eb3c 3088 {
e97957bc 3089 if (mua_wrapper) code = '5'; /* Force hard failure in wrapper mode */
e97957bc
PH
3090
3091 /* If there's an errno, the message contains just the identity of
3092 the host. */
3093
895fbaf2
JH
3094 if (code == '5')
3095 set_rc = FAIL;
3096 else /* Anything other than 5 is treated as temporary */
e97957bc 3097 {
895fbaf2 3098 set_rc = DEFER;
e97957bc
PH
3099 if (save_errno > 0)
3100 message = US string_sprintf("%s: %s", message, strerror(save_errno));
3101 if (host->next != NULL) log_write(0, LOG_MAIN, "%s", message);
c562fd30 3102 msglog_line(host, message);
e97957bc
PH
3103 *message_defer = TRUE;
3104 }
3105 }
3106
3107 /* Otherwise, we have an I/O error or a timeout other than after MAIL or
3108 ".", or some other transportation error. We defer all addresses and yield
3109 DEFER, except for the case of failed add_headers expansion, or a transport
3110 filter failure, when the yield should be ERROR, to stop it trying other
3111 hosts. */
3112
3113 else
3114 {
895fbaf2 3115 set_rc = DEFER;
e97957bc
PH
3116 yield = (save_errno == ERRNO_CHHEADER_FAIL ||
3117 save_errno == ERRNO_FILTER_FAIL)? ERROR : DEFER;
0756eb3c
PH
3118 }
3119 }
895fbaf2
JH
3120
3121 set_errno(addrlist, save_errno, set_message, set_rc, pass_message, host
3122#ifdef EXPERIMENTAL_DSN_INFO
d093f8e5 3123 , sx.smtp_greeting, sx.helo_response
895fbaf2
JH
3124#endif
3125 );
0756eb3c
PH
3126 }
3127
3128
3129/* If all has gone well, send_quit will be set TRUE, implying we can end the
3130SMTP session tidily. However, if there were too many addresses to send in one
3131message (indicated by first_addr being non-NULL) we want to carry on with the
3132rest of them. Also, it is desirable to send more than one message down the SMTP
3133connection if there are several waiting, provided we haven't already sent so
3134many as to hit the configured limit. The function transport_check_waiting looks
3135for a waiting message and returns its id. Then transport_pass_socket tries to
3136set up a continued delivery by passing the socket on to another process. The
3137variable send_rset is FALSE if a message has just been successfully transfered.
3138
3139If we are already sending down a continued channel, there may be further
3140addresses not yet delivered that are aimed at the same host, but which have not
3141been passed in this run of the transport. In this case, continue_more will be
3142true, and all we should do is send RSET if necessary, and return, leaving the
3143channel open.
3144
3145However, if no address was disposed of, i.e. all addresses got 4xx errors, we
3146do not want to continue with other messages down the same channel, because that
3147can lead to looping between two or more messages, all with the same,
3148temporarily failing address(es). [The retry information isn't updated yet, so
3149new processes keep on trying.] We probably also don't want to try more of this
3150message's addresses either.
3151
3152If we have started a TLS session, we have to end it before passing the
3153connection to a new process. However, not all servers can handle this (Exim
3154can), so we do not pass such a connection on if the host matches
3155hosts_nopass_tls. */
3156
3157DEBUG(D_transport)
3158 debug_printf("ok=%d send_quit=%d send_rset=%d continue_more=%d "
d093f8e5 3159 "yield=%d first_address is %sNULL\n", sx.ok, sx.send_quit,
d9c3c8ed 3160 sx.send_rset, continue_more, yield, sx.first_addr ? "not " : "");
0756eb3c 3161
d9c3c8ed 3162if (sx.completed_addr && sx.ok && sx.send_quit)
0756eb3c
PH
3163 {
3164 BOOL more;
a39bd74d
JB
3165 smtp_compare_t t_compare;
3166
3167 t_compare.tblock = tblock;
3168 t_compare.current_sender_address = sender_address;
3169
d9c3c8ed 3170 if ( sx.first_addr != NULL
5130845b
JH
3171 || continue_more
3172 || ( ( tls_out.active < 0
d093f8e5 3173 || verify_check_given_host(&sx.ob->hosts_nopass_tls, host) != OK
5130845b 3174 )
0756eb3c
PH
3175 &&
3176 transport_check_waiting(tblock->name, host->name,
a39bd74d
JB
3177 tblock->connection_max_messages, new_message_id, &more,
3178 (oicf)smtp_are_same_identities, (void*)&t_compare)
5130845b 3179 ) )
0756eb3c
PH
3180 {
3181 uschar *msg;
447d236c 3182 BOOL pass_message;
0756eb3c 3183
d093f8e5
JH
3184 if (sx.send_rset)
3185 if (! (sx.ok = smtp_write_command(&sx.outblock, FALSE, "RSET\r\n") >= 0))
0756eb3c
PH
3186 {
3187 msg = US string_sprintf("send() to %s [%s] failed: %s", host->name,
9e7e0f6a 3188 host->address, strerror(errno));
d093f8e5 3189 sx.send_quit = FALSE;
0756eb3c 3190 }
d093f8e5
JH
3191 else if (! (sx.ok = smtp_read_response(&sx.inblock, sx.buffer,
3192 sizeof(sx.buffer), '2', sx.ob->command_timeout)))
0756eb3c
PH
3193 {
3194 int code;
d093f8e5 3195 sx.send_quit = check_response(host, &errno, 0, sx.buffer, &code, &msg,
447d236c 3196 &pass_message);
d093f8e5 3197 if (!sx.send_quit)
0756eb3c 3198 {
c562fd30
JH
3199 DEBUG(D_transport) debug_printf("H=%s [%s] %s\n",
3200 host->name, host->address, msg);
0756eb3c
PH
3201 }
3202 }
0756eb3c
PH
3203
3204 /* Either RSET was not needed, or it succeeded */
3205
d093f8e5 3206 if (sx.ok)
0756eb3c 3207 {
d9c3c8ed 3208 if (sx.first_addr != NULL) /* More addresses still to be sent */
0756eb3c
PH
3209 { /* in this run of the transport */
3210 continue_sequence++; /* Causes * in logging */
3211 goto SEND_MESSAGE;
3212 }
3213 if (continue_more) return yield; /* More addresses for another run */
3214
3215 /* Pass the socket to a new Exim process. Before doing so, we must shut
3216 down TLS. Not all MTAs allow for the continuation of the SMTP session
3217 when TLS is shut down. We test for this by sending a new EHLO. If we
3218 don't get a good response, we don't attempt to pass the socket on. */
3219
a7538db1 3220#ifdef SUPPORT_TLS
817d9f57 3221 if (tls_out.active >= 0)
0756eb3c 3222 {
817d9f57 3223 tls_close(FALSE, TRUE);<