Copyright updates:
[exim.git] / src / src / verify.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
1e1ddfac 6/* Copyright (c) The Exim Maintainers 2020 */
059ec3d9
PH
7/* See the file NOTICE for conditions of use and distribution. */
8
9/* Functions concerned with verifying things. The original code for callout
10caching was contributed by Kevin Fleming (but I hacked it around a bit). */
11
12
13#include "exim.h"
817d9f57 14#include "transports/smtp.h"
059ec3d9 15
e4bdf652
JH
16#define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
17#define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
251b9eb4 18static smtp_context ctctx;
817d9f57
JH
19uschar ctbuffer[8192];
20
059ec3d9
PH
21
22/* Structure for caching DNSBL lookups */
23
24typedef struct dnsbl_cache_block {
14b3c5bc 25 time_t expiry;
059ec3d9
PH
26 dns_address *rhs;
27 uschar *text;
28 int rc;
29 BOOL text_set;
30} dnsbl_cache_block;
31
32
33/* Anchor for DNSBL cache */
34
35static tree_node *dnsbl_cache = NULL;
36
37
431b7361
PH
38/* Bits for match_type in one_check_dnsbl() */
39
40#define MT_NOT 1
41#define MT_ALL 2
42
74f1a423 43static uschar cutthrough_response(client_conn_ctx *, char, uschar **, int);
431b7361 44
8d330698 45
059ec3d9
PH
46
47/*************************************************
48* Retrieve a callout cache record *
49*************************************************/
50
51/* If a record exists, check whether it has expired.
52
53Arguments:
54 dbm_file an open hints file
55 key the record key
56 type "address" or "domain"
57 positive_expire expire time for positive records
58 negative_expire expire time for negative records
59
60Returns: the cache record if a non-expired one exists, else NULL
61*/
62
63static dbdata_callout_cache *
55414b25 64get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
059ec3d9
PH
65 int positive_expire, int negative_expire)
66{
67BOOL negative;
68int length, expire;
69time_t now;
70dbdata_callout_cache *cache_record;
71
b6323c75 72if (!(cache_record = dbfn_read_with_length(dbm_file, key, &length)))
059ec3d9 73 {
6f4d5ad3 74 HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
059ec3d9
PH
75 return NULL;
76 }
77
78/* We treat a record as "negative" if its result field is not positive, or if
79it is a domain record and the postmaster field is negative. */
80
81negative = cache_record->result != ccache_accept ||
82 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
83expire = negative? negative_expire : positive_expire;
84now = time(NULL);
85
86if (now - cache_record->time_stamp > expire)
87 {
6f4d5ad3 88 HDEBUG(D_verify) debug_printf("callout cache: %s record expired for %s\n", type, key);
059ec3d9
PH
89 return NULL;
90 }
91
92/* If this is a non-reject domain record, check for the obsolete format version
93that doesn't have the postmaster and random timestamps, by looking at the
94length. If so, copy it to a new-style block, replicating the record's
95timestamp. Then check the additional timestamps. (There's no point wasting
96effort if connections are rejected.) */
97
98if (type[0] == 'd' && cache_record->result != ccache_reject)
99 {
100 if (length == sizeof(dbdata_callout_cache_obs))
101 {
f3ebb786 102 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache), FALSE);
059ec3d9
PH
103 memcpy(new, cache_record, length);
104 new->postmaster_stamp = new->random_stamp = new->time_stamp;
105 cache_record = new;
106 }
107
108 if (now - cache_record->postmaster_stamp > expire)
109 cache_record->postmaster_result = ccache_unknown;
110
111 if (now - cache_record->random_stamp > expire)
112 cache_record->random_result = ccache_unknown;
113 }
114
6f4d5ad3 115HDEBUG(D_verify) debug_printf("callout cache: found %s record for %s\n", type, key);
059ec3d9
PH
116return cache_record;
117}
118
119
120
707ee5b1
JH
121/* Check the callout cache.
122Options * pm_mailfrom may be modified by cache partial results.
059ec3d9 123
707ee5b1 124Return: TRUE if result found
059ec3d9
PH
125*/
126
707ee5b1
JH
127static BOOL
128cached_callout_lookup(address_item * addr, uschar * address_key,
129 uschar * from_address, int * opt_ptr, uschar ** pm_ptr,
130 int * yield, uschar ** failure_ptr,
131 dbdata_callout_cache * new_domain_record, int * old_domain_res)
059ec3d9 132{
707ee5b1 133int options = *opt_ptr;
059ec3d9
PH
134open_db dbblock;
135open_db *dbm_file = NULL;
059ec3d9
PH
136
137/* Open the callout cache database, it it exists, for reading only at this
138stage, unless caching has been disabled. */
139
8b9476ba 140if (options & vopt_callout_no_cache)
059ec3d9
PH
141 {
142 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
143 }
b10c87b3 144else if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
059ec3d9
PH
145 {
146 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
147 }
707ee5b1 148else
059ec3d9 149 {
707ee5b1
JH
150 /* If a cache database is available see if we can avoid the need to do an
151 actual callout by making use of previously-obtained data. */
152
153 dbdata_callout_cache_address * cache_address_record;
154 dbdata_callout_cache * cache_record = get_callout_cache_record(dbm_file,
155 addr->domain, US"domain",
156 callout_cache_domain_positive_expire, callout_cache_domain_negative_expire);
059ec3d9
PH
157
158 /* If an unexpired cache record was found for this domain, see if the callout
159 process can be short-circuited. */
160
ff5929e3 161 if (cache_record)
059ec3d9 162 {
2b1c6e3a
PH
163 /* In most cases, if an early command (up to and including MAIL FROM:<>)
164 was rejected, there is no point carrying on. The callout fails. However, if
165 we are doing a recipient verification with use_sender or use_postmaster
166 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
167 will be using a non-empty sender. We have to remember this situation so as
168 not to disturb the cached domain value if this whole verification succeeds
169 (we don't want it turning into "accept"). */
170
707ee5b1 171 *old_domain_res = cache_record->result;
2b1c6e3a 172
707ee5b1
JH
173 if ( cache_record->result == ccache_reject
174 || *from_address == 0 && cache_record->result == ccache_reject_mfnull)
059ec3d9 175 {
059ec3d9 176 HDEBUG(D_verify)
707ee5b1
JH
177 debug_printf("callout cache: domain gave initial rejection, or "
178 "does not accept HELO or MAIL FROM:<>\n");
059ec3d9
PH
179 setflag(addr, af_verify_nsfail);
180 addr->user_message = US"(result of an earlier callout reused).";
707ee5b1 181 *yield = FAIL;
8e669ac1 182 *failure_ptr = US"mail";
707ee5b1
JH
183 dbfn_close(dbm_file);
184 return TRUE;
059ec3d9
PH
185 }
186
187 /* If a previous check on a "random" local part was accepted, we assume
188 that the server does not do any checking on local parts. There is therefore
189 no point in doing the callout, because it will always be successful. If a
190 random check previously failed, arrange not to do it again, but preserve
191 the data in the new record. If a random check is required but hasn't been
192 done, skip the remaining cache processing. */
193
8b9476ba 194 if (options & vopt_callout_random) switch(cache_record->random_result)
059ec3d9
PH
195 {
196 case ccache_accept:
8b9476ba
JH
197 HDEBUG(D_verify)
198 debug_printf("callout cache: domain accepts random addresses\n");
2ddb4094 199 *failure_ptr = US"random";
707ee5b1
JH
200 dbfn_close(dbm_file);
201 return TRUE; /* Default yield is OK */
059ec3d9
PH
202
203 case ccache_reject:
8b9476ba
JH
204 HDEBUG(D_verify)
205 debug_printf("callout cache: domain rejects random addresses\n");
707ee5b1
JH
206 *opt_ptr = options & ~vopt_callout_random;
207 new_domain_record->random_result = ccache_reject;
208 new_domain_record->random_stamp = cache_record->random_stamp;
8b9476ba 209 break;
059ec3d9
PH
210
211 default:
8b9476ba
JH
212 HDEBUG(D_verify)
213 debug_printf("callout cache: need to check random address handling "
214 "(not cached or cache expired)\n");
707ee5b1
JH
215 dbfn_close(dbm_file);
216 return FALSE;
059ec3d9
PH
217 }
218
219 /* If a postmaster check is requested, but there was a previous failure,
220 there is again no point in carrying on. If a postmaster check is required,
221 but has not been done before, we are going to have to do a callout, so skip
222 remaining cache processing. */
223
707ee5b1 224 if (*pm_ptr)
059ec3d9
PH
225 {
226 if (cache_record->postmaster_result == ccache_reject)
707ee5b1
JH
227 {
228 setflag(addr, af_verify_pmfail);
229 HDEBUG(D_verify)
230 debug_printf("callout cache: domain does not accept "
231 "RCPT TO:<postmaster@domain>\n");
232 *yield = FAIL;
233 *failure_ptr = US"postmaster";
234 setflag(addr, af_verify_pmfail);
235 addr->user_message = US"(result of earlier verification reused).";
236 dbfn_close(dbm_file);
237 return TRUE;
238 }
059ec3d9 239 if (cache_record->postmaster_result == ccache_unknown)
707ee5b1
JH
240 {
241 HDEBUG(D_verify)
242 debug_printf("callout cache: need to check RCPT "
243 "TO:<postmaster@domain> (not cached or cache expired)\n");
244 dbfn_close(dbm_file);
245 return FALSE;
246 }
059ec3d9
PH
247
248 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
249 postmaster check if the address itself has to be checked. Also ensure
250 that the value in the cache record is preserved (with its old timestamp).
251 */
252
253 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
707ee5b1
JH
254 "TO:<postmaster@domain>\n");
255 *pm_ptr = NULL;
256 new_domain_record->postmaster_result = ccache_accept;
257 new_domain_record->postmaster_stamp = cache_record->postmaster_stamp;
059ec3d9
PH
258 }
259 }
260
261 /* We can't give a result based on information about the domain. See if there
262 is an unexpired cache record for this specific address (combined with the
263 sender address if we are doing a recipient callout with a non-empty sender).
264 */
265
707ee5b1
JH
266 if (!(cache_address_record = (dbdata_callout_cache_address *)
267 get_callout_cache_record(dbm_file, address_key, US"address",
268 callout_cache_positive_expire, callout_cache_negative_expire)))
269 {
270 dbfn_close(dbm_file);
271 return FALSE;
272 }
059ec3d9 273
707ee5b1 274 if (cache_address_record->result == ccache_accept)
059ec3d9 275 {
707ee5b1
JH
276 HDEBUG(D_verify)
277 debug_printf("callout cache: address record is positive\n");
278 }
279 else
280 {
281 HDEBUG(D_verify)
282 debug_printf("callout cache: address record is negative\n");
283 addr->user_message = US"Previous (cached) callout verification failure";
284 *failure_ptr = US"recipient";
285 *yield = FAIL;
059ec3d9
PH
286 }
287
288 /* Close the cache database while we actually do the callout for real. */
289
059ec3d9 290 dbfn_close(dbm_file);
707ee5b1
JH
291 return TRUE;
292 }
293return FALSE;
294}
295
296
297/* Write results to callout cache
298*/
299static void
300cache_callout_write(dbdata_callout_cache * dom_rec, const uschar * domain,
301 int done, dbdata_callout_cache_address * addr_rec, uschar * address_key)
302{
303open_db dbblock;
304open_db *dbm_file = NULL;
305
306/* If we get here with done == TRUE, a successful callout happened, and yield
307will be set OK or FAIL according to the response to the RCPT command.
308Otherwise, we looped through the hosts but couldn't complete the business.
309However, there may be domain-specific information to cache in both cases.
310
311The value of the result field in the new_domain record is ccache_unknown if
312there was an error before or with MAIL FROM:, and errno was not zero,
313implying some kind of I/O error. We don't want to write the cache in that case.
314Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
315
316if (dom_rec->result != ccache_unknown)
b10c87b3 317 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
707ee5b1
JH
318 {
319 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
320 }
321 else
322 {
323 (void)dbfn_write(dbm_file, domain, dom_rec,
324 (int)sizeof(dbdata_callout_cache));
325 HDEBUG(D_verify) debug_printf("wrote callout cache domain record for %s:\n"
326 " result=%d postmaster=%d random=%d\n",
327 domain,
328 dom_rec->result,
329 dom_rec->postmaster_result,
330 dom_rec->random_result);
331 }
332
333/* If a definite result was obtained for the callout, cache it unless caching
334is disabled. */
335
336if (done && addr_rec->result != ccache_unknown)
337 {
338 if (!dbm_file)
b10c87b3 339 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE);
707ee5b1
JH
340 if (!dbm_file)
341 {
342 HDEBUG(D_verify) debug_printf("no callout cache available\n");
343 }
344 else
345 {
346 (void)dbfn_write(dbm_file, address_key, addr_rec,
347 (int)sizeof(dbdata_callout_cache_address));
348 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record for %s\n",
349 addr_rec->result == ccache_accept ? "positive" : "negative",
350 address_key);
351 }
352 }
353
354if (dbm_file) dbfn_close(dbm_file);
355}
356
357
c4c940fd
JH
358/* Cutthrough-multi. If the existing cached cutthrough connection matches
359the one we would make for a subsequent recipient, use it. Send the RCPT TO
360and check the result, nonpipelined as it may be wanted immediately for
361recipient-verification.
362
363It seems simpler to deal with this case separately from the main callout loop.
364We will need to remember it has sent, or not, so that rcpt-acl tail code
365can do it there for the non-rcpt-verify case. For this we keep an addresscount.
366
367Return: TRUE for a definitive result for the recipient
368*/
369static int
370cutthrough_multi(address_item * addr, host_item * host_list,
371 transport_feedback * tf, int * yield)
372{
373BOOL done = FALSE;
c4c940fd
JH
374
375if (addr->transport == cutthrough.addr.transport)
d7978c0f 376 for (host_item * host = host_list; host; host = host->next)
c4c940fd
JH
377 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
378 {
379 int host_af;
380 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
381 int port = 25;
382
383 deliver_host = host->name;
384 deliver_host_address = host->address;
385 deliver_host_port = host->port;
386 deliver_domain = addr->domain;
387 transport_name = addr->transport->name;
388
57cc2785 389 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
c4c940fd 390
f83a760f
JH
391 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
392 US"callout")
393 || !smtp_get_port(tf->port, addr, &port, US"callout")
394 )
c4c940fd
JH
395 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
396 addr->message);
397
f83a760f
JH
398 smtp_port_for_connect(host, port);
399
c4c940fd
JH
400 if ( ( interface == cutthrough.interface
401 || ( interface
402 && cutthrough.interface
403 && Ustrcmp(interface, cutthrough.interface) == 0
404 ) )
f83a760f 405 && host->port == cutthrough.host.port
c4c940fd
JH
406 )
407 {
408 uschar * resp = NULL;
409
410 /* Match! Send the RCPT TO, set done from the response */
411 done =
251b9eb4 412 smtp_write_command(&ctctx, SCMD_FLUSH, "RCPT TO:<%.1000s>\r\n",
74f1a423
JH
413 transport_rcpt_address(addr,
414 addr->transport->rcpt_include_affixes)) >= 0
415 && cutthrough_response(&cutthrough.cctx, '2', &resp,
416 CUTTHROUGH_DATA_TIMEOUT) == '2';
c4c940fd
JH
417
418 /* This would go horribly wrong if a callout fail was ignored by ACL.
419 We punt by abandoning cutthrough on a reject, like the
420 first-rcpt does. */
421
422 if (done)
423 {
f3ebb786 424 address_item * na = store_get(sizeof(address_item), FALSE);
c4c940fd
JH
425 *na = cutthrough.addr;
426 cutthrough.addr = *addr;
427 cutthrough.addr.host_used = &cutthrough.host;
428 cutthrough.addr.next = na;
429
430 cutthrough.nrcpt++;
431 }
432 else
433 {
57cc2785 434 cancel_cutthrough_connection(TRUE, US"recipient rejected");
c4c940fd
JH
435 if (!resp || errno == ETIMEDOUT)
436 {
437 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
438 }
439 else if (errno == 0)
440 {
441 if (*resp == 0)
442 Ustrcpy(resp, US"connection dropped");
443
444 addr->message =
e9166683
JH
445 string_sprintf("response to \"%s\" was: %s",
446 big_buffer, string_printing(resp));
c4c940fd
JH
447
448 addr->user_message =
449 string_sprintf("Callout verification failed:\n%s", resp);
450
451 /* Hard rejection ends the process */
452
453 if (resp[0] == '5') /* Address rejected */
454 {
455 *yield = FAIL;
456 done = TRUE;
457 }
458 }
459 }
460 }
461 break; /* host_list */
462 }
463if (!done)
57cc2785 464 cancel_cutthrough_connection(TRUE, US"incompatible connection");
c4c940fd
JH
465return done;
466}
467
468
707ee5b1
JH
469/*************************************************
470* Do callout verification for an address *
471*************************************************/
472
473/* This function is called from verify_address() when the address has routed to
474a host list, and a callout has been requested. Callouts are expensive; that is
475why a cache is used to improve the efficiency.
476
477Arguments:
478 addr the address that's been routed
479 host_list the list of hosts to try
480 tf the transport feedback block
481
482 ifstring "interface" option from transport, or NULL
483 portstring "port" option from transport, or NULL
484 protocolstring "protocol" option from transport, or NULL
485 callout the per-command callout timeout
486 callout_overall the overall callout timeout (if < 0 use 4*callout)
487 callout_connect the callout connection timeout (if < 0 use callout)
488 options the verification options - these bits are used:
489 vopt_is_recipient => this is a recipient address
490 vopt_callout_no_cache => don't use callout cache
491 vopt_callout_fullpm => if postmaster check, do full one
492 vopt_callout_random => do the "random" thing
493 vopt_callout_recipsender => use real sender for recipient
494 vopt_callout_recippmaster => use postmaster for recipient
57cc2785 495 vopt_callout_hold => lazy close connection
707ee5b1
JH
496 se_mailfrom MAIL FROM address for sender verify; NULL => ""
497 pm_mailfrom if non-NULL, do the postmaster check with this sender
498
499Returns: OK/FAIL/DEFER
500*/
501
502static int
503do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
504 int callout, int callout_overall, int callout_connect, int options,
505 uschar *se_mailfrom, uschar *pm_mailfrom)
506{
507int yield = OK;
508int old_domain_cache_result = ccache_accept;
509BOOL done = FALSE;
510uschar *address_key;
511uschar *from_address;
512uschar *random_local_part = NULL;
513const uschar *save_deliver_domain = deliver_domain;
514uschar **failure_ptr = options & vopt_is_recipient
515 ? &recipient_verify_failure : &sender_verify_failure;
516dbdata_callout_cache new_domain_record;
517dbdata_callout_cache_address new_address_record;
707ee5b1
JH
518time_t callout_start_time;
519
520new_domain_record.result = ccache_unknown;
521new_domain_record.postmaster_result = ccache_unknown;
522new_domain_record.random_result = ccache_unknown;
523
524memset(&new_address_record, 0, sizeof(new_address_record));
525
526/* For a recipient callout, the key used for the address cache record must
527include the sender address if we are using the real sender in the callout,
528because that may influence the result of the callout. */
529
530if (options & vopt_is_recipient)
531 if (options & vopt_callout_recipsender)
532 {
533 from_address = sender_address;
534 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
535 if (cutthrough.delivery) options |= vopt_callout_no_cache;
536 }
537 else if (options & vopt_callout_recippmaster)
538 {
539 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
540 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
541 qualify_domain_sender);
542 }
543 else
544 {
545 from_address = US"";
546 address_key = addr->address;
547 }
548
549/* For a sender callout, we must adjust the key if the mailfrom address is not
550empty. */
551
552else
553 {
554 from_address = se_mailfrom ? se_mailfrom : US"";
555 address_key = *from_address
556 ? string_sprintf("%s/<%s>", addr->address, from_address) : addr->address;
059ec3d9
PH
557 }
558
707ee5b1
JH
559if (cached_callout_lookup(addr, address_key, from_address,
560 &options, &pm_mailfrom, &yield, failure_ptr,
561 &new_domain_record, &old_domain_cache_result))
57cc2785
JH
562 {
563 cancel_cutthrough_connection(TRUE, US"cache-hit");
707ee5b1 564 goto END_CALLOUT;
57cc2785 565 }
707ee5b1 566
193e3acd 567if (!addr->transport)
059ec3d9 568 {
193e3acd 569 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
059ec3d9 570 }
6681531a
HSHR
571else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
572 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
573 addr->transport->name, addr->transport->driver_name);
193e3acd
JH
574else
575 {
576 smtp_transport_options_block *ob =
9d9c3746 577 (smtp_transport_options_block *)addr->transport->options_block;
de41aff0 578 smtp_context * sx = NULL;
059ec3d9 579
193e3acd
JH
580 /* The information wasn't available in the cache, so we have to do a real
581 callout and save the result in the cache for next time, unless no_cache is set,
582 or unless we have a previously cached negative random result. If we are to test
583 with a random local part, ensure that such a local part is available. If not,
4c04137d 584 log the fact, but carry on without randomising. */
059ec3d9 585
707ee5b1 586 if (options & vopt_callout_random && callout_random_local_part)
65f1c92a 587 if (!(random_local_part = expand_string(callout_random_local_part)))
193e3acd
JH
588 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
589 "callout_random_local_part: %s", expand_string_message);
059ec3d9 590
d85cdeb5
JH
591 /* Compile regex' used by client-side smtp */
592
593 smtp_deliver_init();
594
193e3acd
JH
595 /* Default the connect and overall callout timeouts if not set, and record the
596 time we are starting so that we can enforce it. */
4c590bd1 597
193e3acd
JH
598 if (callout_overall < 0) callout_overall = 4 * callout;
599 if (callout_connect < 0) callout_connect = callout;
600 callout_start_time = time(NULL);
4c590bd1 601
193e3acd
JH
602 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
603 output because a callout might take some time. When PIPELINING is active and
604 there are many recipients, the total time for doing lots of callouts can add up
605 and cause the client to time out. So in this case we forgo the PIPELINING
606 optimization. */
817d9f57 607
8768d548 608 if (smtp_out && !f.disable_callout_flush) mac_smtp_fflush();
059ec3d9 609
c4c940fd
JH
610 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
611 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
612
5032d1cf
JH
613/* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
614and we are holding a cutthrough conn open, we can just append the rcpt to
615that conn for verification purposes (and later delivery also). Simplest
c4c940fd 616coding means skipping this whole loop and doing the append separately. */
5032d1cf
JH
617
618 /* Can we re-use an open cutthrough connection? */
74f1a423 619 if ( cutthrough.cctx.sock >= 0
5032d1cf
JH
620 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
621 == vopt_callout_recipsender
622 && !random_local_part
623 && !pm_mailfrom
624 )
c4c940fd 625 done = cutthrough_multi(addr, host_list, tf, &yield);
5032d1cf 626
c4c940fd
JH
627 /* If we did not use a cached connection, make connections to the hosts
628 and do real callouts. The list of hosts is passed in as an argument. */
059ec3d9 629
d7978c0f 630 for (host_item * host = host_list; host && !done; host = host->next)
059ec3d9 631 {
193e3acd
JH
632 int host_af;
633 int port = 25;
c58803fd 634 uschar * interface = NULL; /* Outgoing interface to use; NULL => any */
193e3acd 635
ff5929e3 636 if (!host->address)
193e3acd
JH
637 {
638 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
639 host->name);
640 continue;
641 }
059ec3d9 642
193e3acd 643 /* Check the overall callout timeout */
059ec3d9 644
193e3acd
JH
645 if (time(NULL) - callout_start_time >= callout_overall)
646 {
647 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
648 break;
649 }
059ec3d9 650
193e3acd 651 /* Set IPv4 or IPv6 */
059ec3d9 652
e9166683 653 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
de3a88fb 654
193e3acd
JH
655 /* Expand and interpret the interface and port strings. The latter will not
656 be used if there is a host-specific port (e.g. from a manualroute router).
657 This has to be delayed till now, because they may expand differently for
658 different hosts. If there's a failure, log it, but carry on with the
659 defaults. */
de3a88fb 660
193e3acd
JH
661 deliver_host = host->name;
662 deliver_host_address = host->address;
a7538db1 663 deliver_host_port = host->port;
193e3acd 664 deliver_domain = addr->domain;
aec45841 665 transport_name = addr->transport->name;
059ec3d9 666
6f6dedcc 667 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
bf7aabb4
JH
668 US"callout")
669 || !smtp_get_port(tf->port, addr, &port, US"callout")
670 )
193e3acd
JH
671 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
672 addr->message);
059ec3d9 673
de41aff0
JH
674 if (!sx) sx = store_get(sizeof(*sx), TRUE); /* tainted buffers */
675 memset(sx, 0, sizeof(*sx));
676
c58803fd
JH
677 sx->addrlist = addr;
678 sx->conn_args.host = host;
679 sx->conn_args.host_af = host_af,
680 sx->port = port;
681 sx->conn_args.interface = interface;
682 sx->helo_data = tf->helo_data;
683 sx->conn_args.tblock = addr->transport;
684 sx->verify = TRUE;
02b41d71
JH
685
686tls_retry_connection:
687 /* Set the address state so that errors are recorded in it */
688
689 addr->transport_return = PENDING_DEFER;
690 ob->connect_timeout = callout_connect;
691 ob->command_timeout = callout;
692
693 /* Get the channel set up ready for a message (MAIL FROM being the next
694 SMTP command to send. If we tried TLS but it failed, try again without
695 if permitted */
696
c58803fd 697 yield = smtp_setup_conn(sx, FALSE);
01603eec 698#ifndef DISABLE_TLS
f10e3ea3 699 if ( yield == DEFER
02b41d71
JH
700 && addr->basic_errno == ERRNO_TLSFAILURE
701 && ob->tls_tempfail_tryclear
3fb3231c 702 && verify_check_given_host(CUSS &ob->hosts_require_tls, host) != OK
02b41d71 703 )
193e3acd 704 {
cf0c6164
JH
705 log_write(0, LOG_MAIN,
706 "%s: callout unencrypted to %s [%s] (not in hosts_require_tls)",
707 addr->message, host->name, host->address);
e9166683 708 addr->transport_return = PENDING_DEFER;
c58803fd 709 yield = smtp_setup_conn(sx, TRUE);
02b41d71 710 }
f10e3ea3 711#endif
02b41d71
JH
712 if (yield != OK)
713 {
02b41d71 714 errno = addr->basic_errno;
aec45841 715 transport_name = NULL;
193e3acd
JH
716 deliver_host = deliver_host_address = NULL;
717 deliver_domain = save_deliver_domain;
bf7aabb4 718
02b41d71
JH
719 /* Failure to accept HELO is cached; this blocks the whole domain for all
720 senders. I/O errors and defer responses are not cached. */
770747fd 721
02b41d71 722 if (yield == FAIL && (errno == 0 || errno == ERRNO_SMTPCLOSED))
a7538db1 723 {
02b41d71
JH
724 setflag(addr, af_verify_nsfail);
725 new_domain_record.result = ccache_reject;
726 done = TRUE;
a7538db1 727 }
193e3acd 728 else
02b41d71
JH
729 done = FALSE;
730 goto no_conn;
3c8b3577 731 }
9bfc60eb 732
02b41d71
JH
733 /* If we needed to authenticate, smtp_setup_conn() did that. Copy
734 the AUTH info for logging */
fcc8e047 735
02b41d71
JH
736 addr->authenticator = client_authenticator;
737 addr->auth_id = client_authenticated_id;
b4a2b536 738
c58803fd
JH
739 sx->from_addr = from_address;
740 sx->first_addr = sx->sync_addr = addr;
741 sx->ok = FALSE; /*XXX these 3 last might not be needed for verify? */
742 sx->send_rset = TRUE;
743 sx->completed_addr = FALSE;
b4a2b536 744
cf0c6164 745 new_domain_record.result = old_domain_cache_result == ccache_reject_mfnull
e9166683 746 ? ccache_reject_mfnull : ccache_accept;
c4c940fd 747
e9166683
JH
748 /* Do the random local part check first. Temporarily replace the recipient
749 with the "random" value */
02b41d71 750
e9166683 751 if (random_local_part)
059ec3d9 752 {
e9166683 753 uschar * main_address = addr->address;
921dfc11
JH
754 const uschar * rcpt_domain = addr->domain;
755
8c5d388a 756#ifdef SUPPORT_I18N
921dfc11
JH
757 uschar * errstr = NULL;
758 if ( testflag(addr, af_utf8_downcvt)
759 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
760 &errstr), errstr)
761 )
762 {
763 addr->message = errstr;
764 errno = ERRNO_EXPANDFAIL;
765 setflag(addr, af_verify_nsfail);
766 done = FALSE;
767 rcpt_domain = US""; /*XXX errorhandling! */
768 }
769#endif
770
57cc2785
JH
771 /* This would be ok for 1st rcpt of a cutthrough (the case handled here;
772 subsequents are done in cutthrough_multi()), but no way to
773 handle a subsequent because of the RSET vaporising the MAIL FROM.
774 So refuse to support any. Most cutthrough use will not involve
775 random_local_part, so no loss. */
776 cancel_cutthrough_connection(TRUE, US"random-recipient");
059ec3d9 777
e9166683
JH
778 addr->address = string_sprintf("%s@%.1000s",
779 random_local_part, rcpt_domain);
780 done = FALSE;
902fbd69
JH
781
782 /* If accepted, we aren't going to do any further tests below.
783 Otherwise, cache a real negative response, and get back to the right
784 state to send RCPT. Unless there's some problem such as a dropped
785 connection, we expect to succeed, because the commands succeeded above.
786 However, some servers drop the connection after responding to an
787 invalid recipient, so on (any) error we drop and remake the connection.
788 XXX We don't care about that for postmaster_full. Should we?
789
790 XXX could we add another flag to the context, and have the common
791 code emit the RSET too? Even pipelined after the RCPT...
792 Then the main-verify call could use it if there's to be a subsequent
793 postmaster-verify.
794 The sync_responses() would need to be taught about it and we'd
795 need another return code filtering out to here.
14de8063 796
d6e7df90 797 Avoid using a SIZE option on the MAIL for all random-rcpt checks.
902fbd69
JH
798 */
799
c58803fd 800 sx->avoid_option = OPTION_SIZE;
14de8063 801
a65c4156
JH
802 /* Remember when we last did a random test */
803 new_domain_record.random_stamp = time(NULL);
804
c58803fd 805 if (smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0)
e9166683
JH
806 switch(addr->transport_return)
807 {
b6323c75 808 case PENDING_OK: /* random was accepted, unfortunately */
e9166683 809 new_domain_record.random_result = ccache_accept;
b6323c75 810 yield = OK; /* Only usable verify result we can return */
fae8970d 811 done = TRUE;
2ddb4094 812 *failure_ptr = US"random";
fae8970d 813 goto no_conn;
b6323c75 814 case FAIL: /* rejected: the preferred result */
e9166683 815 new_domain_record.random_result = ccache_reject;
c58803fd 816 sx->avoid_option = 0;
193e3acd 817
e9166683 818 /* Between each check, issue RSET, because some servers accept only
902fbd69
JH
819 one recipient after MAIL FROM:<>.
820 XXX We don't care about that for postmaster_full. Should we? */
193e3acd 821
e9166683 822 if ((done =
c58803fd
JH
823 smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0 &&
824 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout)))
e9166683 825 break;
65f1c92a 826
65f1c92a 827 HDEBUG(D_acl|D_v)
e1d04f48 828 debug_printf_indent("problem after random/rset/mfrom; reopen conn\n");
65f1c92a 829 random_local_part = NULL;
01603eec 830#ifndef DISABLE_TLS
c58803fd 831 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
65f1c92a 832#endif
e1d04f48 833 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
c58803fd
JH
834 (void)close(sx->cctx.sock);
835 sx->cctx.sock = -1;
0cbf2b82 836#ifndef DISABLE_EVENT
65f1c92a
JH
837 (void) event_raise(addr->transport->event_action,
838 US"tcp:close", NULL);
839#endif
a65c4156
JH
840 addr->address = main_address;
841 addr->transport_return = PENDING_DEFER;
c58803fd
JH
842 sx->first_addr = sx->sync_addr = addr;
843 sx->ok = FALSE;
844 sx->send_rset = TRUE;
845 sx->completed_addr = FALSE;
65f1c92a 846 goto tls_retry_connection;
b6323c75
JH
847 case DEFER: /* 4xx response to random */
848 break; /* Just to be clear. ccache_unknown, !done. */
e9166683 849 }
059ec3d9 850
e9166683
JH
851 /* Re-setup for main verify, or for the error message when failing */
852 addr->address = main_address;
853 addr->transport_return = PENDING_DEFER;
c58803fd
JH
854 sx->first_addr = sx->sync_addr = addr;
855 sx->ok = FALSE;
856 sx->send_rset = TRUE;
857 sx->completed_addr = FALSE;
e9166683
JH
858 }
859 else
860 done = TRUE;
921dfc11 861
14de8063
JH
862 /* Main verify. For rcpt-verify use SIZE if we know it and we're not cacheing;
863 for sndr-verify never use it. */
e9166683
JH
864
865 if (done)
866 {
14de8063 867 if (!(options & vopt_is_recipient && options & vopt_callout_no_cache))
c58803fd 868 sx->avoid_option = OPTION_SIZE;
14de8063 869
e9166683 870 done = FALSE;
c58803fd 871 switch(smtp_write_mail_and_rcpt_cmds(sx, &yield))
e9166683
JH
872 {
873 case 0: switch(addr->transport_return) /* ok so far */
874 {
875 case PENDING_OK: done = TRUE;
876 new_address_record.result = ccache_accept;
877 break;
14de8063 878 case FAIL: done = TRUE;
e9166683
JH
879 yield = FAIL;
880 *failure_ptr = US"recipient";
881 new_address_record.result = ccache_reject;
882 break;
14de8063 883 default: break;
e9166683
JH
884 }
885 break;
886
887 case -1: /* MAIL response error */
888 *failure_ptr = US"mail";
c58803fd 889 if (errno == 0 && sx->buffer[0] == '5')
e9166683
JH
890 {
891 setflag(addr, af_verify_nsfail);
892 if (from_address[0] == 0)
893 new_domain_record.result = ccache_reject_mfnull;
894 }
895 break;
896 /* non-MAIL read i/o error */
897 /* non-MAIL response timeout */
898 /* internal error; channel still usable */
899 default: break; /* transmit failed */
900 }
901 }
902
903 addr->auth_sndr = client_authenticated_sender;
904
905 deliver_host = deliver_host_address = NULL;
906 deliver_domain = save_deliver_domain;
907
908 /* Do postmaster check if requested; if a full check is required, we
909 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
910
911 if (done && pm_mailfrom)
912 {
913 /* Could possibly shift before main verify, just above, and be ok
914 for cutthrough. But no way to handle a subsequent rcpt, so just
915 refuse any */
57cc2785 916 cancel_cutthrough_connection(TRUE, US"postmaster verify");
e1d04f48 917 HDEBUG(D_acl|D_v) debug_printf_indent("Cutthrough cancelled by presence of postmaster verify\n");
e9166683 918
c58803fd
JH
919 done = smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0
920 && smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout);
e9166683
JH
921
922 if (done)
923 {
924 uschar * main_address = addr->address;
925
926 /*XXX oops, affixes */
927 addr->address = string_sprintf("postmaster@%.1000s", addr->domain);
928 addr->transport_return = PENDING_DEFER;
929
c58803fd
JH
930 sx->from_addr = pm_mailfrom;
931 sx->first_addr = sx->sync_addr = addr;
932 sx->ok = FALSE;
933 sx->send_rset = TRUE;
934 sx->completed_addr = FALSE;
935 sx->avoid_option = OPTION_SIZE;
e9166683 936
c58803fd 937 if( smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0
e9166683
JH
938 && addr->transport_return == PENDING_OK
939 )
940 done = TRUE;
921dfc11 941 else
e9166683 942 done = (options & vopt_callout_fullpm) != 0
c58803fd 943 && smtp_write_command(sx, SCMD_FLUSH,
e9166683 944 "RCPT TO:<postmaster>\r\n") >= 0
c58803fd
JH
945 && smtp_read_response(sx, sx->buffer,
946 sizeof(sx->buffer), '2', callout);
921dfc11 947
e9166683 948 /* Sort out the cache record */
2a4be8f9 949
e9166683
JH
950 new_domain_record.postmaster_stamp = time(NULL);
951
952 if (done)
953 new_domain_record.postmaster_result = ccache_accept;
c58803fd 954 else if (errno == 0 && sx->buffer[0] == '5')
e9166683
JH
955 {
956 *failure_ptr = US"postmaster";
957 setflag(addr, af_verify_pmfail);
958 new_domain_record.postmaster_result = ccache_reject;
959 }
960
961 addr->address = main_address;
962 }
963 }
193e3acd
JH
964 /* For any failure of the main check, other than a negative response, we just
965 close the connection and carry on. We can identify a negative response by the
966 fact that errno is zero. For I/O errors it will be non-zero
2a4be8f9 967
193e3acd
JH
968 Set up different error texts for logging and for sending back to the caller
969 as an SMTP response. Log in all cases, using a one-line format. For sender
970 callouts, give a full response to the caller, but for recipient callouts,
971 don't give the IP address because this may be an internal host whose identity
972 is not to be widely broadcast. */
2a4be8f9 973
02b41d71 974no_conn:
e9166683 975 switch(errno)
193e3acd 976 {
02b41d71
JH
977 case ETIMEDOUT:
978 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
c58803fd 979 sx->send_quit = FALSE;
02b41d71
JH
980 break;
981
8c5d388a 982#ifdef SUPPORT_I18N
02b41d71 983 case ERRNO_UTF8_FWD:
9bfc60eb
JH
984 {
985 extern int acl_where; /* src/acl.c */
986 errno = 0;
f3ebb786 987 addr->message = US"response to \"EHLO\" did not include SMTPUTF8";
02b41d71
JH
988 addr->user_message = acl_where == ACL_WHERE_RCPT
989 ? US"533 no support for internationalised mailbox name"
9bfc60eb
JH
990 : US"550 mailbox unavailable";
991 yield = FAIL;
992 done = TRUE;
993 }
02b41d71 994 break;
9bfc60eb 995#endif
02b41d71 996 case ECONNREFUSED:
c58803fd 997 sx->send_quit = FALSE;
02b41d71 998 break;
2a4be8f9 999
02b41d71 1000 case 0:
c58803fd 1001 if (*sx->buffer == 0) Ustrcpy(sx->buffer, US"connection dropped");
059ec3d9 1002
e9166683 1003 /*XXX test here is ugly; seem to have a split of responsibility for
b6323c75 1004 building this message. Need to rationalise. Where is it done
e9166683
JH
1005 before here, and when not?
1006 Not == 5xx resp to MAIL on main-verify
1007 */
1008 if (!addr->message) addr->message =
1009 string_sprintf("response to \"%s\" was: %s",
c58803fd 1010 big_buffer, string_printing(sx->buffer));
02b41d71 1011
7b564712
JH
1012 /* RFC 5321 section 4.2: the text portion of the response may have only
1013 HT, SP, Printable US-ASCII. Deal with awkward chars by cutting the
1014 received message off before passing it onward. Newlines are ok; they
1015 just become a multiline response (but wrapped in the error code we
1016 produce). */
1017
c58803fd
JH
1018 for (uschar * s = sx->buffer;
1019 *s && s < sx->buffer + sizeof(sx->buffer);
7b564712
JH
1020 s++)
1021 {
1022 uschar c = *s;
1023 if (c != '\t' && c != '\n' && (c < ' ' || c > '~'))
1024 {
c58803fd 1025 if (s - sx->buffer < sizeof(sx->buffer) - 12)
7b564712
JH
1026 memcpy(s, "(truncated)", 12);
1027 else
1028 *s = '\0';
1029 break;
1030 }
1031 }
02b41d71 1032 addr->user_message = options & vopt_is_recipient
c58803fd 1033 ? string_sprintf("Callout verification failed:\n%s", sx->buffer)
02b41d71 1034 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
c58803fd 1035 host->address, big_buffer, sx->buffer);
059ec3d9 1036
02b41d71 1037 /* Hard rejection ends the process */
193e3acd 1038
c58803fd 1039 if (sx->buffer[0] == '5') /* Address rejected */
02b41d71
JH
1040 {
1041 yield = FAIL;
1042 done = TRUE;
1043 }
1044 break;
193e3acd 1045 }
059ec3d9 1046
193e3acd
JH
1047 /* End the SMTP conversation and close the connection. */
1048
4c04137d 1049 /* Cutthrough - on a successful connect and recipient-verify with
5032d1cf 1050 use-sender and we are 1st rcpt and have no cutthrough conn so far
57cc2785
JH
1051 here is where we want to leave the conn open. Ditto for a lazy-close
1052 verify. */
1053
857eaf37
JH
1054 if (cutthrough.delivery)
1055 {
1056 if (addr->transport->filter_command)
1057 {
1058 cutthrough.delivery= FALSE;
1059 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
1060 }
72cb765f
JH
1061#ifndef DISABLE_DKIM
1062 if (ob->dkim.dkim_domain)
857eaf37
JH
1063 {
1064 cutthrough.delivery= FALSE;
72cb765f 1065 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
857eaf37 1066 }
72cb765f
JH
1067#endif
1068#ifdef EXPERIMENTAL_ARC
1069 if (ob->arc_sign)
1070 {
1071 cutthrough.delivery= FALSE;
1072 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of ARC signing\n");
1073 }
1074#endif
857eaf37
JH
1075 }
1076
57cc2785 1077 if ( (cutthrough.delivery || options & vopt_callout_hold)
5032d1cf 1078 && rcpt_count == 1
193e3acd
JH
1079 && done
1080 && yield == OK
98c82a3d
JH
1081 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1082 == vopt_callout_recipsender
193e3acd
JH
1083 && !random_local_part
1084 && !pm_mailfrom
74f1a423 1085 && cutthrough.cctx.sock < 0
c58803fd 1086 && !sx->lmtp
193e3acd 1087 )
059ec3d9 1088 {
57cc2785
JH
1089 HDEBUG(D_acl|D_v) debug_printf_indent("holding verify callout open for %s\n",
1090 cutthrough.delivery
1091 ? "cutthrough delivery" : "potential further verifies and delivery");
1092
1093 cutthrough.callout_hold_only = !cutthrough.delivery;
74f1a423
JH
1094 cutthrough.is_tls = tls_out.active.sock >= 0;
1095 /* We assume no buffer in use in the outblock */
c58803fd 1096 cutthrough.cctx = sx->cctx;
57cc2785
JH
1097 cutthrough.nrcpt = 1;
1098 cutthrough.transport = addr->transport->name;
1099 cutthrough.interface = interface;
1100 cutthrough.snd_port = sending_port;
1101 cutthrough.peer_options = smtp_peer_options;
1102 cutthrough.host = *host;
1103 {
1104 int oldpool = store_pool;
1105 store_pool = POOL_PERM;
1106 cutthrough.snd_ip = string_copy(sending_ip_address);
1107 cutthrough.host.name = string_copy(host->name);
1108 cutthrough.host.address = string_copy(host->address);
1109 store_pool = oldpool;
1110 }
8a6b4e02
JH
1111
1112 /* Save the address_item and parent chain for later logging */
1113 cutthrough.addr = *addr;
57cc2785 1114 cutthrough.addr.next = NULL;
5032d1cf 1115 cutthrough.addr.host_used = &cutthrough.host;
d7978c0f 1116 for (address_item * caddr = &cutthrough.addr, * parent = addr->parent;
8a6b4e02 1117 parent;
d16931c8 1118 caddr = caddr->parent, parent = parent->parent)
f3ebb786 1119 *(caddr->parent = store_get(sizeof(address_item), FALSE)) = *parent;
8a6b4e02 1120
251b9eb4
JH
1121 ctctx.outblock.buffer = ctbuffer;
1122 ctctx.outblock.buffersize = sizeof(ctbuffer);
1123 ctctx.outblock.ptr = ctbuffer;
1124 /* ctctx.outblock.cmd_count = 0; ctctx.outblock.authenticating = FALSE; */
1125 ctctx.outblock.cctx = &cutthrough.cctx;
059ec3d9 1126 }
193e3acd 1127 else
059ec3d9 1128 {
57cc2785 1129 /* Ensure no cutthrough on multiple verifies that were incompatible */
193e3acd 1130 if (options & vopt_callout_recipsender)
57cc2785 1131 cancel_cutthrough_connection(TRUE, US"not usable for cutthrough");
c58803fd
JH
1132 if (sx->send_quit)
1133 if (smtp_write_command(sx, SCMD_FLUSH, "QUIT\r\n") != -1)
345f2724 1134 /* Wait a short time for response, and discard it */
c58803fd 1135 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', 1);
2760b518 1136
c58803fd 1137 if (sx->cctx.sock >= 0)
02b41d71 1138 {
01603eec 1139#ifndef DISABLE_TLS
c58803fd 1140 if (sx->cctx.tls_ctx)
74f1a423 1141 {
c58803fd
JH
1142 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1143 sx->cctx.tls_ctx = NULL;
74f1a423 1144 }
a7538db1 1145#endif
e1d04f48 1146 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
c58803fd
JH
1147 (void)close(sx->cctx.sock);
1148 sx->cctx.sock = -1;
0cbf2b82 1149#ifndef DISABLE_EVENT
02b41d71 1150 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
a7538db1 1151#endif
02b41d71 1152 }
059ec3d9 1153 }
059ec3d9 1154
e9166683
JH
1155 if (!done || yield != OK)
1156 addr->message = string_sprintf("%s [%s] : %s", host->name, host->address,
1157 addr->message);
193e3acd
JH
1158 } /* Loop through all hosts, while !done */
1159 }
059ec3d9
PH
1160
1161/* If we get here with done == TRUE, a successful callout happened, and yield
1162will be set OK or FAIL according to the response to the RCPT command.
1163Otherwise, we looped through the hosts but couldn't complete the business.
707ee5b1 1164However, there may be domain-specific information to cache in both cases. */
059ec3d9 1165
707ee5b1
JH
1166if (!(options & vopt_callout_no_cache))
1167 cache_callout_write(&new_domain_record, addr->domain,
1168 done, &new_address_record, address_key);
059ec3d9
PH
1169
1170/* Failure to connect to any host, or any response other than 2xx or 5xx is a
1171temporary error. If there was only one host, and a response was received, leave
1172it alone if supplying details. Otherwise, give a generic response. */
1173
707ee5b1 1174if (!done)
059ec3d9 1175 {
ff5929e3 1176 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
8b9476ba 1177 options & vopt_is_recipient ? "recipient" : "sender");
059ec3d9
PH
1178 yield = DEFER;
1179
02b41d71
JH
1180 addr->message = host_list->next || !addr->message
1181 ? dullmsg : string_sprintf("%s: %s", dullmsg, addr->message);
059ec3d9 1182
ff5929e3
JH
1183 addr->user_message = smtp_return_error_details
1184 ? string_sprintf("%s for <%s>.\n"
059ec3d9
PH
1185 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1186 "they may be permanently unreachable from this server. In the latter case,\n%s",
1187 dullmsg, addr->address,
8b9476ba 1188 options & vopt_is_recipient
ff5929e3 1189 ? "the address will never be accepted."
8b9476ba
JH
1190 : "you need to change the address or create an MX record for its domain\n"
1191 "if it is supposed to be generally accessible from the Internet.\n"
ff5929e3
JH
1192 "Talk to your mail administrator for details.")
1193 : dullmsg;
059ec3d9
PH
1194
1195 /* Force a specific error code */
1196
1197 addr->basic_errno = ERRNO_CALLOUTDEFER;
1198 }
1199
1200/* Come here from within the cache-reading code on fast-track exit. */
1201
1202END_CALLOUT:
bd231acd 1203tls_modify_variables(&tls_in); /* return variables to inbound values */
059ec3d9
PH
1204return yield;
1205}
1206
1207
1208
817d9f57
JH
1209/* Called after recipient-acl to get a cutthrough connection open when
1210 one was requested and a recipient-verify wasn't subsequently done.
1211*/
f9334a28 1212int
8a6b4e02 1213open_cutthrough_connection(address_item * addr)
e4bdf652
JH
1214{
1215address_item addr2;
f9334a28 1216int rc;
e4bdf652
JH
1217
1218/* Use a recipient-verify-callout to set up the cutthrough connection. */
1219/* We must use a copy of the address for verification, because it might
1220get rewritten. */
1221
1222addr2 = *addr;
e1d04f48 1223HDEBUG(D_acl) debug_printf_indent("----------- %s cutthrough setup ------------\n",
5032d1cf 1224 rcpt_count > 1 ? "more" : "start");
ff5929e3 1225rc = verify_address(&addr2, NULL,
e4bdf652
JH
1226 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1227 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1228 NULL, NULL, NULL);
ff5929e3
JH
1229addr->message = addr2.message;
1230addr->user_message = addr2.user_message;
e1d04f48 1231HDEBUG(D_acl) debug_printf_indent("----------- end cutthrough setup ------------\n");
f9334a28 1232return rc;
e4bdf652
JH
1233}
1234
1235
e4bdf652 1236
817d9f57
JH
1237/* Send given number of bytes from the buffer */
1238static BOOL
1239cutthrough_send(int n)
e4bdf652 1240{
74f1a423 1241if(cutthrough.cctx.sock < 0)
817d9f57 1242 return TRUE;
e4bdf652 1243
817d9f57 1244if(
01603eec 1245#ifndef DISABLE_TLS
74f1a423 1246 cutthrough.is_tls
251b9eb4 1247 ? tls_write(cutthrough.cctx.tls_ctx, ctctx.outblock.buffer, n, FALSE)
74f1a423 1248 :
817d9f57 1249#endif
251b9eb4 1250 send(cutthrough.cctx.sock, ctctx.outblock.buffer, n, 0) > 0
817d9f57
JH
1251 )
1252{
1253 transport_count += n;
251b9eb4 1254 ctctx.outblock.ptr= ctctx.outblock.buffer;
817d9f57
JH
1255 return TRUE;
1256}
e4bdf652 1257
e1d04f48 1258HDEBUG(D_transport|D_acl) debug_printf_indent("cutthrough_send failed: %s\n", strerror(errno));
817d9f57 1259return FALSE;
e4bdf652
JH
1260}
1261
1262
1263
817d9f57
JH
1264static BOOL
1265_cutthrough_puts(uschar * cp, int n)
1266{
1267while(n--)
1268 {
251b9eb4
JH
1269 if(ctctx.outblock.ptr >= ctctx.outblock.buffer+ctctx.outblock.buffersize)
1270 if(!cutthrough_send(ctctx.outblock.buffersize))
817d9f57
JH
1271 return FALSE;
1272
251b9eb4 1273 *ctctx.outblock.ptr++ = *cp++;
817d9f57
JH
1274 }
1275return TRUE;
1276}
1277
1278/* Buffered output of counted data block. Return boolean success */
57cc2785 1279static BOOL
e4bdf652
JH
1280cutthrough_puts(uschar * cp, int n)
1281{
74f1a423
JH
1282if (cutthrough.cctx.sock < 0) return TRUE;
1283if (_cutthrough_puts(cp, n)) return TRUE;
57cc2785 1284cancel_cutthrough_connection(TRUE, US"transmit failed");
817d9f57
JH
1285return FALSE;
1286}
e4bdf652 1287
6851a9c5 1288void
57cc2785
JH
1289cutthrough_data_puts(uschar * cp, int n)
1290{
6851a9c5 1291if (cutthrough.delivery) (void) cutthrough_puts(cp, n);
78a3bbd5 1292return;
57cc2785
JH
1293}
1294
e4bdf652 1295
817d9f57 1296static BOOL
5032d1cf 1297_cutthrough_flush_send(void)
817d9f57 1298{
251b9eb4 1299int n = ctctx.outblock.ptr - ctctx.outblock.buffer;
e4bdf652 1300
817d9f57
JH
1301if(n>0)
1302 if(!cutthrough_send(n))
1303 return FALSE;
1304return TRUE;
e4bdf652
JH
1305}
1306
817d9f57
JH
1307
1308/* Send out any bufferred output. Return boolean success. */
e4bdf652 1309BOOL
5032d1cf 1310cutthrough_flush_send(void)
e4bdf652 1311{
817d9f57 1312if (_cutthrough_flush_send()) return TRUE;
57cc2785 1313cancel_cutthrough_connection(TRUE, US"transmit failed");
e4bdf652
JH
1314return FALSE;
1315}
1316
1317
57cc2785 1318static BOOL
5032d1cf 1319cutthrough_put_nl(void)
e4bdf652
JH
1320{
1321return cutthrough_puts(US"\r\n", 2);
1322}
1323
1324
6851a9c5 1325void
57cc2785
JH
1326cutthrough_data_put_nl(void)
1327{
6851a9c5 1328cutthrough_data_puts(US"\r\n", 2);
57cc2785
JH
1329}
1330
1331
e4bdf652
JH
1332/* Get and check response from cutthrough target */
1333static uschar
74f1a423 1334cutthrough_response(client_conn_ctx * cctx, char expect, uschar ** copy, int timeout)
e4bdf652 1335{
ee8b8090 1336smtp_context sx = {0};
e4bdf652
JH
1337uschar inbuffer[4096];
1338uschar responsebuffer[4096];
1339
251b9eb4
JH
1340sx.inblock.buffer = inbuffer;
1341sx.inblock.buffersize = sizeof(inbuffer);
1342sx.inblock.ptr = inbuffer;
1343sx.inblock.ptrend = inbuffer;
1344sx.inblock.cctx = cctx;
1345if(!smtp_read_response(&sx, responsebuffer, sizeof(responsebuffer), expect, timeout))
57cc2785 1346 cancel_cutthrough_connection(TRUE, US"target timeout on read");
e4bdf652 1347
57cc2785 1348if(copy)
e4bdf652
JH
1349 {
1350 uschar * cp;
5032d1cf 1351 *copy = cp = string_copy(responsebuffer);
e4bdf652
JH
1352 /* Trim the trailing end of line */
1353 cp += Ustrlen(responsebuffer);
1354 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1355 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1356 }
1357
1358return responsebuffer[0];
1359}
1360
1361
1362/* Negotiate dataphase with the cutthrough target, returning success boolean */
1363BOOL
5032d1cf 1364cutthrough_predata(void)
e4bdf652 1365{
74f1a423 1366if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
e4bdf652
JH
1367 return FALSE;
1368
e1d04f48 1369HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> DATA\n");
817d9f57
JH
1370cutthrough_puts(US"DATA\r\n", 6);
1371cutthrough_flush_send();
e4bdf652
JH
1372
1373/* Assume nothing buffered. If it was it gets ignored. */
74f1a423 1374return cutthrough_response(&cutthrough.cctx, '3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
e4bdf652
JH
1375}
1376
1377
42055a33 1378/* tctx arg only to match write_chunk() */
511a6c14 1379static BOOL
42055a33 1380cutthrough_write_chunk(transport_ctx * tctx, uschar * s, int len)
511a6c14
JH
1381{
1382uschar * s2;
1383while(s && (s2 = Ustrchr(s, '\n')))
1384 {
1385 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1386 return FALSE;
1387 s = s2+1;
1388 }
1389return TRUE;
1390}
1391
1392
e4bdf652 1393/* Buffered send of headers. Return success boolean. */
817d9f57 1394/* Expands newlines to wire format (CR,NL). */
e4bdf652 1395/* Also sends header-terminating blank line. */
e4bdf652 1396BOOL
5032d1cf 1397cutthrough_headers_send(void)
e4bdf652 1398{
6d5c916c
JH
1399transport_ctx tctx;
1400
74f1a423 1401if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
e4bdf652
JH
1402 return FALSE;
1403
511a6c14
JH
1404/* We share a routine with the mainline transport to handle header add/remove/rewrites,
1405 but having a separate buffered-output function (for now)
1406*/
e1d04f48 1407HDEBUG(D_acl) debug_printf_indent("----------- start cutthrough headers send -----------\n");
e4bdf652 1408
74f1a423 1409tctx.u.fd = cutthrough.cctx.sock;
6d5c916c
JH
1410tctx.tblock = cutthrough.addr.transport;
1411tctx.addr = &cutthrough.addr;
1412tctx.check_string = US".";
1413tctx.escape_string = US"..";
328c5688 1414/*XXX check under spool_files_wireformat. Might be irrelevant */
6d5c916c
JH
1415tctx.options = topt_use_crlf;
1416
42055a33 1417if (!transport_headers_send(&tctx, &cutthrough_write_chunk))
511a6c14
JH
1418 return FALSE;
1419
e1d04f48 1420HDEBUG(D_acl) debug_printf_indent("----------- done cutthrough headers send ------------\n");
511a6c14 1421return TRUE;
817d9f57
JH
1422}
1423
1424
1425static void
78a3bbd5 1426close_cutthrough_connection(const uschar * why)
817d9f57 1427{
74f1a423 1428int fd = cutthrough.cctx.sock;
57cc2785 1429if(fd >= 0)
817d9f57
JH
1430 {
1431 /* We could be sending this after a bunch of data, but that is ok as
1432 the only way to cancel the transfer in dataphase is to drop the tcp
1433 conn before the final dot.
1434 */
74f1a423 1435 client_conn_ctx tmp_ctx = cutthrough.cctx;
251b9eb4 1436 ctctx.outblock.ptr = ctbuffer;
e1d04f48 1437 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> QUIT\n");
817d9f57
JH
1438 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1439 _cutthrough_flush_send();
74f1a423 1440 cutthrough.cctx.sock = -1; /* avoid recursion via read timeout */
06fdb9f7 1441 cutthrough.nrcpt = 0; /* permit re-cutthrough on subsequent message */
2760b518
JH
1442
1443 /* Wait a short time for response, and discard it */
74f1a423 1444 cutthrough_response(&tmp_ctx, '2', NULL, 1);
817d9f57 1445
01603eec 1446#ifndef DISABLE_TLS
74f1a423
JH
1447 if (cutthrough.is_tls)
1448 {
1449 tls_close(cutthrough.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1450 cutthrough.cctx.tls_ctx = NULL;
1451 cutthrough.is_tls = FALSE;
1452 }
57cc2785 1453#endif
e1d04f48 1454 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
57cc2785 1455 (void)close(fd);
e1d04f48 1456 HDEBUG(D_acl) debug_printf_indent("----------- cutthrough shutdown (%s) ------------\n", why);
817d9f57 1457 }
251b9eb4 1458ctctx.outblock.ptr = ctbuffer;
e4bdf652
JH
1459}
1460
817d9f57 1461void
57cc2785
JH
1462cancel_cutthrough_connection(BOOL close_noncutthrough_verifies, const uschar * why)
1463{
1464if (cutthrough.delivery || close_noncutthrough_verifies)
1465 close_cutthrough_connection(why);
1466cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1467}
1468
1469
1470void
1471release_cutthrough_connection(const uschar * why)
817d9f57 1472{
74f1a423 1473if (cutthrough.cctx.sock < 0) return;
57cc2785 1474HDEBUG(D_acl) debug_printf_indent("release cutthrough conn: %s\n", why);
74f1a423
JH
1475cutthrough.cctx.sock = -1;
1476cutthrough.cctx.tls_ctx = NULL;
57cc2785 1477cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
817d9f57
JH
1478}
1479
1480
1481
e4bdf652
JH
1482
1483/* Have senders final-dot. Send one to cutthrough target, and grab the response.
1484 Log an OK response as a transmission.
817d9f57 1485 Close the connection.
e4bdf652 1486 Return smtp response-class digit.
e4bdf652
JH
1487*/
1488uschar *
5032d1cf 1489cutthrough_finaldot(void)
e4bdf652 1490{
5032d1cf 1491uschar res;
e1d04f48 1492HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> .\n");
e4bdf652
JH
1493
1494/* Assume data finshed with new-line */
5032d1cf
JH
1495if( !cutthrough_puts(US".", 1)
1496 || !cutthrough_put_nl()
1497 || !cutthrough_flush_send()
1498 )
1499 return cutthrough.addr.message;
e4bdf652 1500
74f1a423
JH
1501res = cutthrough_response(&cutthrough.cctx, '2', &cutthrough.addr.message,
1502 CUTTHROUGH_DATA_TIMEOUT);
d7978c0f 1503for (address_item * addr = &cutthrough.addr; addr; addr = addr->next)
817d9f57 1504 {
5032d1cf
JH
1505 addr->message = cutthrough.addr.message;
1506 switch(res)
1507 {
1508 case '2':
1509 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
78a3bbd5 1510 close_cutthrough_connection(US"delivered");
5032d1cf 1511 break;
817d9f57 1512
5032d1cf
JH
1513 case '4':
1514 delivery_log(LOG_MAIN, addr, 0,
1515 US"tmp-reject from cutthrough after DATA:");
1516 break;
e4bdf652 1517
5032d1cf
JH
1518 case '5':
1519 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1520 US"rejected after DATA:");
1521 break;
e4bdf652 1522
5032d1cf
JH
1523 default:
1524 break;
1525 }
817d9f57 1526 }
5032d1cf 1527return cutthrough.addr.message;
e4bdf652
JH
1528}
1529
1530
817d9f57 1531
059ec3d9
PH
1532/*************************************************
1533* Copy error to toplevel address *
1534*************************************************/
1535
1536/* This function is used when a verify fails or defers, to ensure that the
1537failure or defer information is in the original toplevel address. This applies
1538when an address is redirected to a single new address, and the failure or
1539deferral happens to the child address.
1540
1541Arguments:
1542 vaddr the verify address item
1543 addr the final address item
1544 yield FAIL or DEFER
1545
1546Returns: the value of YIELD
1547*/
1548
1549static int
1550copy_error(address_item *vaddr, address_item *addr, int yield)
1551{
1552if (addr != vaddr)
1553 {
1554 vaddr->message = addr->message;
1555 vaddr->user_message = addr->user_message;
1556 vaddr->basic_errno = addr->basic_errno;
1557 vaddr->more_errno = addr->more_errno;
d43cbe25 1558 vaddr->prop.address_data = addr->prop.address_data;
b4f579d1
JH
1559 vaddr->prop.variables = NULL;
1560 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
42855d71 1561 copyflag(vaddr, addr, af_pass_message);
059ec3d9
PH
1562 }
1563return yield;
1564}
1565
1566
1567
1568
ce552449
NM
1569/**************************************************
1570* printf that automatically handles TLS if needed *
1571***************************************************/
1572
1573/* This function is used by verify_address() as a substitute for all fprintf()
1574calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1575as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1576that assumes that we always use the smtp_out FILE* when not using TLS or the
1577ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1578that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1579fprintf().
1580
1581Arguments:
1582 f the candidate FILE* to write to
1583 format format string
1584 ... optional arguments
1585
1586Returns:
1587 nothing
1588*/
1589
1590static void PRINTF_FUNCTION(2,3)
1ba28e2b 1591respond_printf(FILE *f, const char *format, ...)
ce552449
NM
1592{
1593va_list ap;
1594
1595va_start(ap, format);
1596if (smtp_out && (f == smtp_out))
925ac8e4 1597 smtp_vprintf(format, FALSE, ap);
ce552449 1598else
513afc6a 1599 vfprintf(f, format, ap);
ce552449
NM
1600va_end(ap);
1601}
1602
1603
1604
059ec3d9
PH
1605/*************************************************
1606* Verify an email address *
1607*************************************************/
1608
1609/* This function is used both for verification (-bv and at other times) and
1610address testing (-bt), which is indicated by address_test_mode being set.
1611
1612Arguments:
1613 vaddr contains the address to verify; the next field in this block
1614 must be NULL
1615 f if not NULL, write the result to this file
1616 options various option bits:
1617 vopt_fake_sender => this sender verify is not for the real
1618 sender (it was verify=sender=xxxx or an address from a
1619 header line) - rewriting must not change sender_address
1620 vopt_is_recipient => this is a recipient address, otherwise
1621 it's a sender address - this affects qualification and
1622 rewriting and messages from callouts
1623 vopt_qualify => qualify an unqualified address; else error
1624 vopt_expn => called from SMTP EXPN command
eafd343b
TK
1625 vopt_success_on_redirect => when a new address is generated
1626 the verification instantly succeeds
059ec3d9
PH
1627
1628 These ones are used by do_callout() -- the options variable
1629 is passed to it.
1630
2a4be8f9 1631 vopt_callout_fullpm => if postmaster check, do full one
059ec3d9
PH
1632 vopt_callout_no_cache => don't use callout cache
1633 vopt_callout_random => do the "random" thing
1634 vopt_callout_recipsender => use real sender for recipient
1635 vopt_callout_recippmaster => use postmaster for recipient
1636
1637 callout if > 0, specifies that callout is required, and gives timeout
4deaf07d 1638 for individual commands
059ec3d9
PH
1639 callout_overall if > 0, gives overall timeout for the callout function;
1640 if < 0, a default is used (see do_callout())
8e669ac1 1641 callout_connect the connection timeout for callouts
059ec3d9
PH
1642 se_mailfrom when callout is requested to verify a sender, use this
1643 in MAIL FROM; NULL => ""
1644 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1645 thing and use this as the sender address (may be "")
1646
1647 routed if not NULL, set TRUE if routing succeeded, so we can
1648 distinguish between routing failed and callout failed
1649
1650Returns: OK address verified
1651 FAIL address failed to verify
1652 DEFER can't tell at present
1653*/
1654
1655int
8768d548
JH
1656verify_address(address_item * vaddr, FILE * fp, int options, int callout,
1657 int callout_overall, int callout_connect, uschar * se_mailfrom,
4deaf07d 1658 uschar *pm_mailfrom, BOOL *routed)
059ec3d9
PH
1659{
1660BOOL allok = TRUE;
8768d548 1661BOOL full_info = fp ? debug_selector != 0 : FALSE;
059ec3d9 1662BOOL expn = (options & vopt_expn) != 0;
eafd343b 1663BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
059ec3d9
PH
1664int i;
1665int yield = OK;
1666int verify_type = expn? v_expn :
8768d548 1667 f.address_test_mode? v_none :
8b9476ba 1668 options & vopt_is_recipient? v_recipient : v_sender;
059ec3d9
PH
1669address_item *addr_list;
1670address_item *addr_new = NULL;
1671address_item *addr_remote = NULL;
1672address_item *addr_local = NULL;
1673address_item *addr_succeed = NULL;
8b9476ba
JH
1674uschar **failure_ptr = options & vopt_is_recipient
1675 ? &recipient_verify_failure : &sender_verify_failure;
059ec3d9
PH
1676uschar *ko_prefix, *cr;
1677uschar *address = vaddr->address;
1678uschar *save_sender;
1679uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1680
2c7db3f5
PH
1681/* Clear, just in case */
1682
1683*failure_ptr = NULL;
1684
059ec3d9
PH
1685/* Set up a prefix and suffix for error message which allow us to use the same
1686output statements both in EXPN mode (where an SMTP response is needed) and when
1687debugging with an output file. */
1688
1689if (expn)
1690 {
1691 ko_prefix = US"553 ";
1692 cr = US"\r";
1693 }
1694else ko_prefix = cr = US"";
1695
1696/* Add qualify domain if permitted; otherwise an unqualified address fails. */
1697
1698if (parse_find_at(address) == NULL)
1699 {
2ddb4094 1700 if (!(options & vopt_qualify))
059ec3d9 1701 {
8768d548
JH
1702 if (fp)
1703 respond_printf(fp, "%sA domain is required for \"%s\"%s\n",
ce552449 1704 ko_prefix, address, cr);
8e669ac1 1705 *failure_ptr = US"qualify";
059ec3d9
PH
1706 return FAIL;
1707 }
8b9476ba 1708 address = rewrite_address_qualify(address, options & vopt_is_recipient);
059ec3d9
PH
1709 }
1710
1711DEBUG(D_verify)
1712 {
1713 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
8768d548 1714 debug_printf("%s %s\n", f.address_test_mode? "Testing" : "Verifying", address);
059ec3d9
PH
1715 }
1716
1717/* Rewrite and report on it. Clear the domain and local part caches - these
1718may have been set by domains and local part tests during an ACL. */
1719
2ddb4094 1720if (global_rewrite_rules)
059ec3d9
PH
1721 {
1722 uschar *old = address;
8b9476ba 1723 address = rewrite_address(address, options & vopt_is_recipient, FALSE,
059ec3d9
PH
1724 global_rewrite_rules, rewrite_existflags);
1725 if (address != old)
1726 {
d7978c0f
JH
1727 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1728 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
8768d548 1729 if (fp && !expn) fprintf(fp, "Address rewritten as: %s\n", address);
059ec3d9
PH
1730 }
1731 }
1732
1733/* If this is the real sender address, we must update sender_address at
1734this point, because it may be referred to in the routers. */
1735
2ddb4094 1736if (!(options & (vopt_fake_sender|vopt_is_recipient)))
059ec3d9
PH
1737 sender_address = address;
1738
1739/* If the address was rewritten to <> no verification can be done, and we have
1740to return OK. This rewriting is permitted only for sender addresses; for other
1741addresses, such rewriting fails. */
1742
2ddb4094 1743if (!address[0]) return OK;
059ec3d9 1744
d9b2312b
JH
1745/* Flip the legacy TLS-related variables over to the outbound set in case
1746they're used in the context of a transport used by verification. Reset them
ea90b718 1747at exit from this routine (so no returns allowed from here on). */
d9b2312b 1748
35aba663 1749tls_modify_variables(&tls_out);
d9b2312b 1750
059ec3d9
PH
1751/* Save a copy of the sender address for re-instating if we change it to <>
1752while verifying a sender address (a nice bit of self-reference there). */
1753
1754save_sender = sender_address;
1755
ea90b718
JH
1756/* Observability variable for router/transport use */
1757
8b9476ba 1758verify_mode = options & vopt_is_recipient ? US"R" : US"S";
ea90b718 1759
059ec3d9
PH
1760/* Update the address structure with the possibly qualified and rewritten
1761address. Set it up as the starting address on the chain of new addresses. */
1762
1763vaddr->address = address;
1764addr_new = vaddr;
1765
1766/* We need a loop, because an address can generate new addresses. We must also
1767cope with generated pipes and files at the top level. (See also the code and
1768comment in deliver.c.) However, it is usually the case that the router for
1769user's .forward files has its verify flag turned off.
1770
1771If an address generates more than one child, the loop is used only when
1772full_info is set, and this can only be set locally. Remote enquiries just get
1773information about the top level address, not anything that it generated. */
1774
ea90b718 1775while (addr_new)
059ec3d9
PH
1776 {
1777 int rc;
1778 address_item *addr = addr_new;
1779
1780 addr_new = addr->next;
1781 addr->next = NULL;
1782
1783 DEBUG(D_verify)
1784 {
1785 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1786 debug_printf("Considering %s\n", addr->address);
1787 }
1788
1789 /* Handle generated pipe, file or reply addresses. We don't get these
1790 when handling EXPN, as it does only one level of expansion. */
1791
1792 if (testflag(addr, af_pfr))
1793 {
1794 allok = FALSE;
8768d548 1795 if (fp)
059ec3d9
PH
1796 {
1797 BOOL allow;
1798
1799 if (addr->address[0] == '>')
1800 {
1801 allow = testflag(addr, af_allow_reply);
8768d548 1802 fprintf(fp, "%s -> mail %s", addr->parent->address, addr->address + 1);
059ec3d9
PH
1803 }
1804 else
1805 {
2ddb4094
JH
1806 allow = addr->address[0] == '|'
1807 ? testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
8768d548 1808 fprintf(fp, "%s -> %s", addr->parent->address, addr->address);
059ec3d9
PH
1809 }
1810
1811 if (addr->basic_errno == ERRNO_BADTRANSPORT)
8768d548 1812 fprintf(fp, "\n*** Error in setting up pipe, file, or autoreply:\n"
059ec3d9
PH
1813 "%s\n", addr->message);
1814 else if (allow)
8768d548 1815 fprintf(fp, "\n transport = %s\n", addr->transport->name);
059ec3d9 1816 else
8768d548 1817 fprintf(fp, " *** forbidden ***\n");
059ec3d9
PH
1818 }
1819 continue;
1820 }
1821
1822 /* Just in case some router parameter refers to it. */
1823
2f682e45
JH
1824 return_path = addr->prop.errors_address
1825 ? addr->prop.errors_address : sender_address;
059ec3d9
PH
1826
1827 /* Split the address into domain and local part, handling the %-hack if
1828 necessary, and then route it. While routing a sender address, set
1829 $sender_address to <> because that is what it will be if we were trying to
1830 send a bounce to the sender. */
1831
2f682e45 1832 if (routed) *routed = FALSE;
059ec3d9
PH
1833 if ((rc = deliver_split_address(addr)) == OK)
1834 {
8b9476ba 1835 if (!(options & vopt_is_recipient)) sender_address = null_sender;
059ec3d9
PH
1836 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1837 &addr_succeed, verify_type);
1838 sender_address = save_sender; /* Put back the real sender */
1839 }
1840
1841 /* If routing an address succeeded, set the flag that remembers, for use when
1842 an ACL cached a sender verify (in case a callout fails). Then if routing set
1843 up a list of hosts or the transport has a host list, and the callout option
1844 is set, and we aren't in a host checking run, do the callout verification,
1845 and set another flag that notes that a callout happened. */
1846
1847 if (rc == OK)
1848 {
2f682e45 1849 if (routed) *routed = TRUE;
059ec3d9
PH
1850 if (callout > 0)
1851 {
08f3b11b 1852 transport_instance * tp;
2f682e45 1853 host_item * host_list = addr->host_list;
059ec3d9 1854
26da7e20
PH
1855 /* Make up some data for use in the case where there is no remote
1856 transport. */
1857
1858 transport_feedback tf = {
f2ed27cf
JH
1859 .interface = NULL, /* interface (=> any) */
1860 .port = US"smtp",
1861 .protocol = US"smtp",
1862 .hosts = NULL,
1863 .helo_data = US"$smtp_active_hostname",
1864 .hosts_override = FALSE,
1865 .hosts_randomize = FALSE,
1866 .gethostbyname = FALSE,
1867 .qualify_single = TRUE,
1868 .search_parents = FALSE
26da7e20 1869 };
059ec3d9
PH
1870
1871 /* If verification yielded a remote transport, we want to use that
1872 transport's options, so as to mimic what would happen if we were really
1873 sending a message to this address. */
1874
08f3b11b 1875 if ((tp = addr->transport) && !tp->info->local)
059ec3d9 1876 {
08f3b11b 1877 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
059ec3d9
PH
1878
1879 /* If the transport has hosts and the router does not, or if the
1880 transport is configured to override the router's hosts, we must build a
1881 host list of the transport's hosts, and find the IP addresses */
1882
2f682e45 1883 if (tf.hosts && (!host_list || tf.hosts_override))
059ec3d9
PH
1884 {
1885 uschar *s;
55414b25 1886 const uschar *save_deliver_domain = deliver_domain;
750af86e 1887 uschar *save_deliver_localpart = deliver_localpart;
059ec3d9
PH
1888
1889 host_list = NULL; /* Ignore the router's hosts */
1890
1891 deliver_domain = addr->domain;
1892 deliver_localpart = addr->local_part;
1893 s = expand_string(tf.hosts);
750af86e
PH
1894 deliver_domain = save_deliver_domain;
1895 deliver_localpart = save_deliver_localpart;
059ec3d9 1896
2f682e45 1897 if (!s)
059ec3d9
PH
1898 {
1899 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1900 "\"%s\" in %s transport for callout: %s", tf.hosts,
08f3b11b 1901 tp->name, expand_string_message);
059ec3d9
PH
1902 }
1903 else
1904 {
322050c2 1905 int flags;
059ec3d9
PH
1906 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1907
1908 /* Just ignore failures to find a host address. If we don't manage
8e669ac1
PH
1909 to find any addresses, the callout will defer. Note that more than
1910 one address may be found for a single host, which will result in
1911 additional host items being inserted into the chain. Hence we must
d8ef3577 1912 save the next host first. */
059ec3d9 1913
66387a73 1914 flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
322050c2
PH
1915 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1916 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1917
d7978c0f 1918 for (host_item * host = host_list, * nexthost; host; host = nexthost)
059ec3d9 1919 {
d8ef3577 1920 nexthost = host->next;
8e669ac1 1921 if (tf.gethostbyname ||
7e66e54d 1922 string_is_ip_address(host->name, NULL) != 0)
55414b25 1923 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
059ec3d9 1924 else
9d9c3746 1925 {
8ac90765 1926 const dnssec_domains * dsp = NULL;
08f3b11b 1927 if (Ustrcmp(tp->driver_name, "smtp") == 0)
9d9c3746
JH
1928 {
1929 smtp_transport_options_block * ob =
08f3b11b 1930 (smtp_transport_options_block *) tp->options_block;
8ac90765 1931 dsp = &ob->dnssec;
9d9c3746
JH
1932 }
1933
2546388c 1934 (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
8ac90765 1935 dsp, NULL, NULL);
9d9c3746 1936 }
059ec3d9
PH
1937 }
1938 }
1939 }
1940 }
1941
8e669ac1 1942 /* Can only do a callout if we have at least one host! If the callout
2c7db3f5 1943 fails, it will have set ${sender,recipient}_verify_failure. */
059ec3d9 1944
2f682e45 1945 if (host_list)
059ec3d9
PH
1946 {
1947 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
8768d548 1948 if (host_checking && !f.host_checking_callout)
059ec3d9
PH
1949 {
1950 HDEBUG(D_verify)
1951 debug_printf("... callout omitted by default when host testing\n"
1952 "(Use -bhc if you want the callouts to happen.)\n");
1953 }
1954 else
1955 {
01603eec 1956#ifndef DISABLE_TLS
4ed8d31a
JH
1957 deliver_set_expansions(addr);
1958#endif
059ec3d9 1959 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
4deaf07d 1960 callout_connect, options, se_mailfrom, pm_mailfrom);
01603eec 1961#ifndef DISABLE_TLS
8a6b4e02
JH
1962 deliver_set_expansions(NULL);
1963#endif
059ec3d9
PH
1964 }
1965 }
1966 else
1967 {
1968 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
5ffb5d81 1969 "transport provided a host list, or transport is not smtp\n");
059ec3d9
PH
1970 }
1971 }
1972 }
8e669ac1 1973
2c7db3f5 1974 /* Otherwise, any failure is a routing failure */
8e669ac1
PH
1975
1976 else *failure_ptr = US"route";
059ec3d9
PH
1977
1978 /* A router may return REROUTED if it has set up a child address as a result
1979 of a change of domain name (typically from widening). In this case we always
1980 want to continue to verify the new child. */
1981
1982 if (rc == REROUTED) continue;
8e669ac1 1983
059ec3d9
PH
1984 /* Handle hard failures */
1985
1986 if (rc == FAIL)
1987 {
1988 allok = FALSE;
8768d548 1989 if (fp)
059ec3d9 1990 {
e6f6568e
PH
1991 address_item *p = addr->parent;
1992
8768d548 1993 respond_printf(fp, "%s%s %s", ko_prefix,
2f682e45 1994 full_info ? addr->address : address,
8768d548
JH
1995 f.address_test_mode ? "is undeliverable" : "failed to verify");
1996 if (!expn && f.admin_user)
059ec3d9
PH
1997 {
1998 if (addr->basic_errno > 0)
8768d548 1999 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2f682e45 2000 if (addr->message)
8768d548 2001 respond_printf(fp, ": %s", addr->message);
e6f6568e
PH
2002 }
2003
2004 /* Show parents iff doing full info */
2005
2f682e45 2006 if (full_info) while (p)
e6f6568e 2007 {
8768d548 2008 respond_printf(fp, "%s\n <-- %s", cr, p->address);
e6f6568e 2009 p = p->parent;
059ec3d9 2010 }
8768d548 2011 respond_printf(fp, "%s\n", cr);
059ec3d9 2012 }
57cc2785 2013 cancel_cutthrough_connection(TRUE, US"routing hard fail");
059ec3d9 2014
d9b2312b 2015 if (!full_info)
2f682e45 2016 {
d9b2312b
JH
2017 yield = copy_error(vaddr, addr, FAIL);
2018 goto out;
2f682e45
JH
2019 }
2020 yield = FAIL;
059ec3d9
PH
2021 }
2022
2023 /* Soft failure */
2024
2025 else if (rc == DEFER)
2026 {
2027 allok = FALSE;
8768d548 2028 if (fp)
059ec3d9 2029 {
e6f6568e 2030 address_item *p = addr->parent;
8768d548 2031 respond_printf(fp, "%s%s cannot be resolved at this time", ko_prefix,
322050c2 2032 full_info? addr->address : address);
8768d548 2033 if (!expn && f.admin_user)
059ec3d9
PH
2034 {
2035 if (addr->basic_errno > 0)
8768d548 2036 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2f682e45 2037 if (addr->message)
8768d548 2038 respond_printf(fp, ": %s", addr->message);
059ec3d9 2039 else if (addr->basic_errno <= 0)
8768d548 2040 respond_printf(fp, ": unknown error");
059ec3d9
PH
2041 }
2042
e6f6568e
PH
2043 /* Show parents iff doing full info */
2044
2f682e45 2045 if (full_info) while (p)
e6f6568e 2046 {
8768d548 2047 respond_printf(fp, "%s\n <-- %s", cr, p->address);
e6f6568e
PH
2048 p = p->parent;
2049 }
8768d548 2050 respond_printf(fp, "%s\n", cr);
059ec3d9 2051 }
57cc2785 2052 cancel_cutthrough_connection(TRUE, US"routing soft fail");
e4bdf652 2053
d9b2312b
JH
2054 if (!full_info)
2055 {
2056 yield = copy_error(vaddr, addr, DEFER);
2057 goto out;
2058 }
2f682e45 2059 if (yield == OK) yield = DEFER;
059ec3d9
PH
2060 }
2061
2062 /* If we are handling EXPN, we do not want to continue to route beyond
e6f6568e 2063 the top level (whose address is in "address"). */
059ec3d9
PH
2064
2065 else if (expn)
2066 {
2067 uschar *ok_prefix = US"250-";
2f682e45
JH
2068
2069 if (!addr_new)
2070 if (!addr_local && !addr_remote)
8768d548 2071 respond_printf(fp, "250 mail to <%s> is discarded\r\n", address);
059ec3d9 2072 else
8768d548 2073 respond_printf(fp, "250 <%s>\r\n", address);
2f682e45
JH
2074
2075 else do
059ec3d9
PH
2076 {
2077 address_item *addr2 = addr_new;
2078 addr_new = addr2->next;
2f682e45 2079 if (!addr_new) ok_prefix = US"250 ";
8768d548 2080 respond_printf(fp, "%s<%s>\r\n", ok_prefix, addr2->address);
2f682e45 2081 } while (addr_new);
d9b2312b
JH
2082 yield = OK;
2083 goto out;
059ec3d9
PH
2084 }
2085
2086 /* Successful routing other than EXPN. */
2087
2088 else
2089 {
2090 /* Handle successful routing when short info wanted. Otherwise continue for
2091 other (generated) addresses. Short info is the operational case. Full info
2092 can be requested only when debug_selector != 0 and a file is supplied.
2093
2094 There is a conflict between the use of aliasing as an alternate email
2095 address, and as a sort of mailing list. If an alias turns the incoming
2096 address into just one address (e.g. J.Caesar->jc44) you may well want to
2097 carry on verifying the generated address to ensure it is valid when
2098 checking incoming mail. If aliasing generates multiple addresses, you
2099 probably don't want to do this. Exim therefore treats the generation of
2100 just a single new address as a special case, and continues on to verify the
2101 generated address. */
2102
2f682e45
JH
2103 if ( !full_info /* Stop if short info wanted AND */
2104 && ( ( !addr_new /* No new address OR */
2105 || addr_new->next /* More than one new address OR */
2106 || testflag(addr_new, af_pfr) /* New address is pfr */
2107 )
2108 || /* OR */
2109 ( addr_new /* At least one new address AND */
2110 && success_on_redirect /* success_on_redirect is set */
2111 ) )
2112 )
059ec3d9 2113 {
8768d548
JH
2114 if (fp) fprintf(fp, "%s %s\n",
2115 address, f.address_test_mode ? "is deliverable" : "verified");
059ec3d9
PH
2116
2117 /* If we have carried on to verify a child address, we want the value
2118 of $address_data to be that of the child */
2119
d43cbe25 2120 vaddr->prop.address_data = addr->prop.address_data;
b4f579d1
JH
2121 vaddr->prop.variables = NULL;
2122 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
98c82a3d
JH
2123
2124 /* If stopped because more than one new address, cannot cutthrough */
2125
2126 if (addr_new && addr_new->next)
57cc2785 2127 cancel_cutthrough_connection(TRUE, US"multiple addresses from routing");
98c82a3d 2128
d9b2312b
JH
2129 yield = OK;
2130 goto out;
059ec3d9
PH
2131 }
2132 }
2133 } /* Loop for generated addresses */
2134
2135/* Display the full results of the successful routing, including any generated
8768d548 2136addresses. Control gets here only when full_info is set, which requires fp not
059ec3d9
PH
2137to be NULL, and this occurs only when a top-level verify is called with the
2138debugging switch on.
2139
2140If there are no local and no remote addresses, and there were no pipes, files,
2141or autoreplies, and there were no errors or deferments, the message is to be
2142discarded, usually because of the use of :blackhole: in an alias file. */
2143
2f682e45 2144if (allok && !addr_local && !addr_remote)
dbcef0ea 2145 {
8768d548 2146 fprintf(fp, "mail to %s is discarded\n", address);
d9b2312b 2147 goto out;
dbcef0ea 2148 }
059ec3d9 2149
dbcef0ea 2150for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
08f3b11b 2151 while (addr_list)
059ec3d9
PH
2152 {
2153 address_item *addr = addr_list;
08f3b11b
JH
2154 transport_instance * tp = addr->transport;
2155
059ec3d9
PH
2156 addr_list = addr->next;
2157
8768d548 2158 fprintf(fp, "%s", CS addr->address);
384152a6 2159#ifdef EXPERIMENTAL_SRS
d43cbe25 2160 if(addr->prop.srs_sender)
8768d548 2161 fprintf(fp, " [srs = %s]", addr->prop.srs_sender);
384152a6 2162#endif
dbcef0ea
PH
2163
2164 /* If the address is a duplicate, show something about it. */
2165
2166 if (!testflag(addr, af_pfr))
2167 {
2168 tree_node *tnode;
08f3b11b 2169 if ((tnode = tree_search(tree_duplicates, addr->unique)))
8768d548 2170 fprintf(fp, " [duplicate, would not be delivered]");
dbcef0ea
PH
2171 else tree_add_duplicate(addr->unique, addr);
2172 }
2173
2174 /* Now show its parents */
2175
d7978c0f 2176 for (address_item * p = addr->parent; p; p = p->parent)
8768d548
JH
2177 fprintf(fp, "\n <-- %s", p->address);
2178 fprintf(fp, "\n ");
059ec3d9
PH
2179
2180 /* Show router, and transport */
2181
8768d548 2182 fprintf(fp, "router = %s, transport = %s\n",
08f3b11b 2183 addr->router->name, tp ? tp->name : US"unset");
059ec3d9
PH
2184
2185 /* Show any hosts that are set up by a router unless the transport
2186 is going to override them; fiddle a bit to get a nice format. */
2187
08f3b11b 2188 if (addr->host_list && tp && !tp->overrides_hosts)
059ec3d9 2189 {
059ec3d9
PH
2190 int maxlen = 0;
2191 int maxaddlen = 0;
d7978c0f 2192 for (host_item * h = addr->host_list; h; h = h->next)
08f3b11b 2193 { /* get max lengths of host names, addrs */
059ec3d9
PH
2194 int len = Ustrlen(h->name);
2195 if (len > maxlen) maxlen = len;
08f3b11b 2196 len = h->address ? Ustrlen(h->address) : 7;
059ec3d9
PH
2197 if (len > maxaddlen) maxaddlen = len;
2198 }
d7978c0f 2199 for (host_item * h = addr->host_list; h; h = h->next)
08f3b11b 2200 {
8768d548 2201 fprintf(fp, " host %-*s ", maxlen, h->name);
08f3b11b
JH
2202
2203 if (h->address)
8768d548 2204 fprintf(fp, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
08f3b11b 2205 else if (tp->info->local)
8768d548 2206 fprintf(fp, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
08f3b11b 2207 else
8768d548 2208 fprintf(fp, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
08f3b11b 2209
8768d548
JH
2210 if (h->mx >= 0) fprintf(fp, " MX=%d", h->mx);
2211 if (h->port != PORT_NONE) fprintf(fp, " port=%d", h->port);
2212 if (f.running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", fp);
2213 if (h->status == hstatus_unusable) fputs(" ** unusable **", fp);
2214 fputc('\n', fp);
059ec3d9
PH
2215 }
2216 }
2217 }
059ec3d9 2218
d9b2312b 2219/* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2c7db3f5
PH
2220the -bv or -bt case). */
2221
d9b2312b 2222out:
ea90b718 2223verify_mode = NULL;
bd231acd 2224tls_modify_variables(&tls_in); /* return variables to inbound values */
d9b2312b 2225
8e669ac1 2226return yield;
059ec3d9
PH
2227}
2228
2229
2230
2231
2232/*************************************************
2233* Check headers for syntax errors *
2234*************************************************/
2235
2236/* This function checks those header lines that contain addresses, and verifies
db57e575 2237that all the addresses therein are 5322-syntactially correct.
059ec3d9
PH
2238
2239Arguments:
2240 msgptr where to put an error message
2241
2242Returns: OK
2243 FAIL
2244*/
2245
2246int
2247verify_check_headers(uschar **msgptr)
2248{
059ec3d9 2249uschar *colon, *s;
1eccaa59 2250int yield = OK;
059ec3d9 2251
d7978c0f 2252for (header_line * h = header_list; h && yield == OK; h = h->next)
059ec3d9
PH
2253 {
2254 if (h->type != htype_from &&
2255 h->type != htype_reply_to &&
2256 h->type != htype_sender &&
2257 h->type != htype_to &&
2258 h->type != htype_cc &&
2259 h->type != htype_bcc)
2260 continue;
2261
2262 colon = Ustrchr(h->text, ':');
2263 s = colon + 1;
ba74fb8d 2264 Uskip_whitespace(&s);
059ec3d9 2265
1eccaa59
PH
2266 /* Loop for multiple addresses in the header, enabling group syntax. Note
2267 that we have to reset this after the header has been scanned. */
059ec3d9 2268
8768d548 2269 f.parse_allow_group = TRUE;
059ec3d9 2270
db57e575 2271 while (*s)
059ec3d9
PH
2272 {
2273 uschar *ss = parse_find_address_end(s, FALSE);
2274 uschar *recipient, *errmess;
2275 int terminator = *ss;
2276 int start, end, domain;
2277
2278 /* Temporarily terminate the string at this point, and extract the
1eccaa59 2279 operative address within, allowing group syntax. */
059ec3d9
PH
2280
2281 *ss = 0;
2282 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2283 *ss = terminator;
2284
2285 /* Permit an unqualified address only if the message is local, or if the
2286 sending host is configured to be permitted to send them. */
2287
db57e575 2288 if (recipient && !domain)
059ec3d9
PH
2289 {
2290 if (h->type == htype_from || h->type == htype_sender)
2291 {
8768d548 2292 if (!f.allow_unqualified_sender) recipient = NULL;
059ec3d9
PH
2293 }
2294 else
2295 {
8768d548 2296 if (!f.allow_unqualified_recipient) recipient = NULL;
059ec3d9 2297 }
5fcc791a 2298 if (!recipient) errmess = US"unqualified address not permitted";
059ec3d9
PH
2299 }
2300
2301 /* It's an error if no address could be extracted, except for the special
2302 case of an empty address. */
2303
db57e575 2304 if (!recipient && Ustrcmp(errmess, "empty address") != 0)
059ec3d9
PH
2305 {
2306 uschar *verb = US"is";
2307 uschar *t = ss;
1ab95fa6 2308 uschar *tt = colon;
059ec3d9
PH
2309 int len;
2310
2311 /* Arrange not to include any white space at the end in the
1ab95fa6 2312 error message or the header name. */
059ec3d9
PH
2313
2314 while (t > s && isspace(t[-1])) t--;
1ab95fa6 2315 while (tt > h->text && isspace(tt[-1])) tt--;
059ec3d9 2316
1ab95fa6 2317 /* Add the address that failed to the error message, since in a
059ec3d9
PH
2318 header with very many addresses it is sometimes hard to spot
2319 which one is at fault. However, limit the amount of address to
2320 quote - cases have been seen where, for example, a missing double
2321 quote in a humungous To: header creates an "address" that is longer
2322 than string_sprintf can handle. */
2323
2324 len = t - s;
2325 if (len > 1024)
2326 {
2327 len = 1024;
2328 verb = US"begins";
2329 }
2330
55414b25
JH
2331 /* deconst cast ok as we're passing a non-const to string_printing() */
2332 *msgptr = US string_printing(
1ab95fa6 2333 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
bb07bcd3 2334 errmess, (int)(tt - h->text), h->text, verb, len, s));
059ec3d9 2335
1eccaa59
PH
2336 yield = FAIL;
2337 break; /* Out of address loop */
059ec3d9
PH
2338 }
2339
2340 /* Advance to the next address */
2341
db57e575 2342 s = ss + (terminator ? 1 : 0);
ba74fb8d 2343 Uskip_whitespace(&s);
059ec3d9 2344 } /* Next address */
059ec3d9 2345
8768d548
JH
2346 f.parse_allow_group = FALSE;
2347 f.parse_found_group = FALSE;
1eccaa59
PH
2348 } /* Next header unless yield has been set FALSE */
2349
2350return yield;
059ec3d9
PH
2351}
2352
2353
770747fd
MFM
2354/*************************************************
2355* Check header names for 8-bit characters *
2356*************************************************/
2357
4c04137d 2358/* This function checks for invalid characters in header names. See
770747fd
MFM
2359RFC 5322, 2.2. and RFC 6532, 3.
2360
2361Arguments:
2362 msgptr where to put an error message
2363
2364Returns: OK
2365 FAIL
2366*/
2367
2368int
2369verify_check_header_names_ascii(uschar **msgptr)
2370{
d7978c0f 2371uschar *colon;
770747fd 2372
d7978c0f 2373for (header_line * h = header_list; h; h = h->next)
770747fd 2374 {
57cc2785 2375 colon = Ustrchr(h->text, ':');
d7978c0f 2376 for(uschar * s = h->text; s < colon; s++)
57cc2785
JH
2377 if ((*s < 33) || (*s > 126))
2378 {
2379 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
14ca5d2a 2380 (int)(colon - h->text), h->text);
57cc2785
JH
2381 return FAIL;
2382 }
770747fd
MFM
2383 }
2384return OK;
2385}
059ec3d9 2386
1c41c9cc
PH
2387/*************************************************
2388* Check for blind recipients *
2389*************************************************/
2390
2391/* This function checks that every (envelope) recipient is mentioned in either
2392the To: or Cc: header lines, thus detecting blind carbon copies.
2393
2394There are two ways of scanning that could be used: either scan the header lines
2395and tick off the recipients, or scan the recipients and check the header lines.
2396The original proposed patch did the former, but I have chosen to do the latter,
2397because (a) it requires no memory and (b) will use fewer resources when there
2398are many addresses in To: and/or Cc: and only one or two envelope recipients.
2399
7c498df1 2400Arguments: case_sensitive true if case sensitive matching should be used
1c41c9cc
PH
2401Returns: OK if there are no blind recipients
2402 FAIL if there is at least one blind recipient
2403*/
2404
2405int
7c498df1 2406verify_check_notblind(BOOL case_sensitive)
1c41c9cc 2407{
d7978c0f 2408for (int i = 0; i < recipients_count; i++)
1c41c9cc 2409 {
1c41c9cc
PH
2410 BOOL found = FALSE;
2411 uschar *address = recipients_list[i].address;
2412
d7978c0f 2413 for (header_line * h = header_list; !found && h; h = h->next)
1c41c9cc
PH
2414 {
2415 uschar *colon, *s;
2416
2417 if (h->type != htype_to && h->type != htype_cc) continue;
2418
2419 colon = Ustrchr(h->text, ':');
2420 s = colon + 1;
137ae145 2421 Uskip_whitespace(&s);
1c41c9cc 2422
1eccaa59
PH
2423 /* Loop for multiple addresses in the header, enabling group syntax. Note
2424 that we have to reset this after the header has been scanned. */
1c41c9cc 2425
8768d548 2426 f.parse_allow_group = TRUE;
1c41c9cc 2427
d7978c0f 2428 while (*s)
1c41c9cc 2429 {
7c498df1
SA
2430 uschar * ss = parse_find_address_end(s, FALSE);
2431 uschar * recipient, * errmess;
1c41c9cc
PH
2432 int terminator = *ss;
2433 int start, end, domain;
2434
2435 /* Temporarily terminate the string at this point, and extract the
1eccaa59 2436 operative address within, allowing group syntax. */
1c41c9cc
PH
2437
2438 *ss = 0;
2439 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2440 *ss = terminator;
2441
2442 /* If we found a valid recipient that has a domain, compare it with the
7c498df1
SA
2443 envelope recipient. Local parts are compared with case-sensitivity
2444 according to the routine arg, domains case-insensitively.
2445 By comparing from the start with length "domain", we include the "@" at
2446 the end, which ensures that we are comparing the whole local part of each
2447 address. */
2448
2449 if (recipient && domain != 0)
2450 if ((found = (case_sensitive
2451 ? Ustrncmp(recipient, address, domain) == 0
2452 : strncmpic(recipient, address, domain) == 0)
2453 && strcmpic(recipient + domain, address + domain) == 0))
2454 break;
1c41c9cc
PH
2455
2456 /* Advance to the next address */
2457
7c498df1 2458 s = ss + (terminator ? 1:0);
137ae145 2459 Uskip_whitespace(&s);
1c41c9cc 2460 } /* Next address */
1eccaa59 2461
8768d548
JH
2462 f.parse_allow_group = FALSE;
2463 f.parse_found_group = FALSE;
1c41c9cc
PH
2464 } /* Next header (if found is false) */
2465
2466 if (!found) return FAIL;
2467 } /* Next recipient */
2468
2469return OK;
2470}
2471
2472
059ec3d9
PH
2473
2474/*************************************************
2475* Find if verified sender *
2476*************************************************/
2477
2478/* Usually, just a single address is verified as the sender of the message.
2479However, Exim can be made to verify other addresses as well (often related in
2480some way), and this is useful in some environments. There may therefore be a
2481chain of such addresses that have previously been tested. This function finds
2482whether a given address is on the chain.
2483
2484Arguments: the address to be verified
2485Returns: pointer to an address item, or NULL
2486*/
2487
2488address_item *
2489verify_checked_sender(uschar *sender)
2490{
d7978c0f
JH
2491for (address_item * addr = sender_verified_list; addr; addr = addr->next)
2492 if (Ustrcmp(sender, addr->address) == 0) return addr;
2493return NULL;
059ec3d9
PH
2494}
2495
2496
2497
2498
2499
2500/*************************************************
2501* Get valid header address *
2502*************************************************/
2503
2504/* Scan the originator headers of the message, looking for an address that
2505verifies successfully. RFC 822 says:
2506
2507 o The "Sender" field mailbox should be sent notices of
2508 any problems in transport or delivery of the original
2509 messages. If there is no "Sender" field, then the
2510 "From" field mailbox should be used.
2511
2512 o If the "Reply-To" field exists, then the reply should
2513 go to the addresses indicated in that field and not to
2514 the address(es) indicated in the "From" field.
2515
2516So we check a Sender field if there is one, else a Reply_to field, else a From
2517field. As some strange messages may have more than one of these fields,
2518especially if they are resent- fields, check all of them if there is more than
2519one.
2520
2521Arguments:
2522 user_msgptr points to where to put a user error message
2523 log_msgptr points to where to put a log error message
2524 callout timeout for callout check (passed to verify_address())
2525 callout_overall overall callout timeout (ditto)
8e669ac1 2526 callout_connect connect callout timeout (ditto)
059ec3d9
PH
2527 se_mailfrom mailfrom for verify; NULL => ""
2528 pm_mailfrom sender for pm callout check (passed to verify_address())
2529 options callout options (passed to verify_address())
8e669ac1 2530 verrno where to put the address basic_errno
059ec3d9
PH
2531
2532If log_msgptr is set to something without setting user_msgptr, the caller
2533normally uses log_msgptr for both things.
2534
2535Returns: result of the verification attempt: OK, FAIL, or DEFER;
2536 FAIL is given if no appropriate headers are found
2537*/
2538
2539int
2540verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
8e669ac1 2541 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
fe5b5d0b 2542 uschar *pm_mailfrom, int options, int *verrno)
059ec3d9
PH
2543{
2544static int header_types[] = { htype_sender, htype_reply_to, htype_from };
1eccaa59 2545BOOL done = FALSE;
059ec3d9 2546int yield = FAIL;
059ec3d9 2547
d7978c0f
JH
2548for (int i = 0; i < 3 && !done; i++)
2549 for (header_line * h = header_list; h != NULL && !done; h = h->next)
059ec3d9
PH
2550 {
2551 int terminator, new_ok;
2552 uschar *s, *ss, *endname;
2553
2554 if (h->type != header_types[i]) continue;
2555 s = endname = Ustrchr(h->text, ':') + 1;
2556
1eccaa59
PH
2557 /* Scan the addresses in the header, enabling group syntax. Note that we
2558 have to reset this after the header has been scanned. */
2559
8768d548 2560 f.parse_allow_group = TRUE;
1eccaa59 2561
059ec3d9
PH
2562 while (*s != 0)
2563 {
2564 address_item *vaddr;
2565
2566 while (isspace(*s) || *s == ',') s++;
2567 if (*s == 0) break; /* End of header */
2568
2569 ss = parse_find_address_end(s, FALSE);
2570
2571 /* The terminator is a comma or end of header, but there may be white
2572 space preceding it (including newline for the last address). Move back
2573 past any white space so we can check against any cached envelope sender
2574 address verifications. */
2575
2576 while (isspace(ss[-1])) ss--;
2577 terminator = *ss;
2578 *ss = 0;
2579
2580 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2581 (int)(endname - h->text), h->text, s);
2582
2583 /* See if we have already verified this address as an envelope sender,
2584 and if so, use the previous answer. */
2585
2586 vaddr = verify_checked_sender(s);
2587
2588 if (vaddr != NULL && /* Previously checked */
2589 (callout <= 0 || /* No callout needed; OR */
2590 vaddr->special_action > 256)) /* Callout was done */
2591 {
2592 new_ok = vaddr->special_action & 255;
2593 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2594 *ss = terminator; /* Restore shortened string */
2595 }
2596
2597 /* Otherwise we run the verification now. We must restore the shortened
2598 string before running the verification, so the headers are correct, in
2599 case there is any rewriting. */
2600
2601 else
2602 {
2603 int start, end, domain;
1eccaa59
PH
2604 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2605 &domain, FALSE);
059ec3d9
PH
2606
2607 *ss = terminator;
2608
1eccaa59
PH
2609 /* If we found an empty address, just carry on with the next one, but
2610 kill the message. */
2611
5fcc791a 2612 if (!address && Ustrcmp(*log_msgptr, "empty address") == 0)
1eccaa59
PH
2613 {
2614 *log_msgptr = NULL;
2615 s = ss;
2616 continue;
2617 }
2618
059ec3d9
PH
2619 /* If verification failed because of a syntax error, fail this
2620 function, and ensure that the failing address gets added to the error
2621 message. */
2622
5fcc791a 2623 if (!address)
059ec3d9
PH
2624 {
2625 new_ok = FAIL;
1eccaa59
PH
2626 while (ss > s && isspace(ss[-1])) ss--;
2627 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2628 "scanning for sender: %s in \"%.*s\"",
bb07bcd3 2629 (int)(endname - h->text), h->text, *log_msgptr, (int)(ss - s), s);
1eccaa59
PH
2630 yield = FAIL;
2631 done = TRUE;
2632 break;
059ec3d9
PH
2633 }
2634
2f6603e1 2635 /* Else go ahead with the sender verification. But it isn't *the*
059ec3d9
PH
2636 sender of the message, so set vopt_fake_sender to stop sender_address
2637 being replaced after rewriting or qualification. */
2638
2639 else
2640 {
2641 vaddr = deliver_make_addr(address, FALSE);
2642 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
8e669ac1 2643 callout, callout_overall, callout_connect, se_mailfrom,
4deaf07d 2644 pm_mailfrom, NULL);
059ec3d9
PH
2645 }
2646 }
2647
2648 /* We now have the result, either newly found, or cached. If we are
2649 giving out error details, set a specific user error. This means that the
2650 last of these will be returned to the user if all three fail. We do not
2651 set a log message - the generic one below will be used. */
2652
fe5b5d0b 2653 if (new_ok != OK)
059ec3d9 2654 {
8e669ac1 2655 *verrno = vaddr->basic_errno;
fe5b5d0b 2656 if (smtp_return_error_details)
fe5b5d0b
PH
2657 *user_msgptr = string_sprintf("Rejected after DATA: "
2658 "could not verify \"%.*s\" header address\n%s: %s",
bb07bcd3 2659 (int)(endname - h->text), h->text, vaddr->address, vaddr->message);
8e669ac1 2660 }
059ec3d9
PH
2661
2662 /* Success or defer */
2663
1eccaa59
PH
2664 if (new_ok == OK)
2665 {
2666 yield = OK;
2667 done = TRUE;
2668 break;
2669 }
2670
059ec3d9
PH
2671 if (new_ok == DEFER) yield = DEFER;
2672
2673 /* Move on to any more addresses in the header */
2674
2675 s = ss;
1eccaa59
PH
2676 } /* Next address */
2677
8768d548
JH
2678 f.parse_allow_group = FALSE;
2679 f.parse_found_group = FALSE;
1eccaa59 2680 } /* Next header, unless done */
d7978c0f 2681 /* Next header type unless done */
059ec3d9
PH
2682
2683if (yield == FAIL && *log_msgptr == NULL)
2684 *log_msgptr = US"there is no valid sender in any header line";
2685
2686if (yield == DEFER && *log_msgptr == NULL)
2687 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2688
2689return yield;
2690}
2691
2692
2693
2694
2695/*************************************************
2696* Get RFC 1413 identification *
2697*************************************************/
2698
2699/* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2700the timeout is set to zero, then the query is not done. There may also be lists
2701of hosts and nets which are exempt. To guard against malefactors sending
2702non-printing characters which could, for example, disrupt a message's headers,
2703make sure the string consists of printing characters only.
2704
2705Argument:
2706 port the port to connect to; usually this is IDENT_PORT (113), but when
2707 running in the test harness with -bh a different value is used.
2708
2709Returns: nothing
2710
2711Side effect: any received ident value is put in sender_ident (NULL otherwise)
2712*/
2713
2714void
2715verify_get_ident(int port)
2716{
74f1a423
JH
2717client_conn_ctx ident_conn_ctx = {0};
2718int host_af, qlen;
059ec3d9
PH
2719int received_sender_port, received_interface_port, n;
2720uschar *p;
44e6c20c 2721blob early_data;
059ec3d9
PH
2722uschar buffer[2048];
2723
2724/* Default is no ident. Check whether we want to do an ident check for this
2725host. */
2726
2727sender_ident = NULL;
2728if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2729 return;
2730
2731DEBUG(D_ident) debug_printf("doing ident callback\n");
2732
2733/* Set up a connection to the ident port of the remote host. Bind the local end
2734to the incoming interface address. If the sender host address is an IPv6
2735address, the incoming interface address will also be IPv6. */
2736
fb05276a 2737host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
74f1a423 2738if ((ident_conn_ctx.sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
059ec3d9 2739
74f1a423 2740if (ip_bind(ident_conn_ctx.sock, host_af, interface_address, 0) < 0)
059ec3d9
PH
2741 {
2742 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2743 strerror(errno));
2744 goto END_OFF;
2745 }
2746
44e6c20c
JH
2747/* Construct and send the query. */
2748
2749qlen = snprintf(CS buffer, sizeof(buffer), "%d , %d\r\n",
2750 sender_host_port, interface_port);
2751early_data.data = buffer;
2752early_data.len = qlen;
2753
b536a578 2754/*XXX we trust that the query is idempotent */
74f1a423 2755if (ip_connect(ident_conn_ctx.sock, host_af, sender_host_address, port,
44e6c20c 2756 rfc1413_query_timeout, &early_data) < 0)
059ec3d9 2757 {
6c6d6e48 2758 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
059ec3d9
PH
2759 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2760 sender_host_address);
059ec3d9 2761 else
059ec3d9
PH
2762 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2763 sender_host_address, strerror(errno));
059ec3d9
PH
2764 goto END_OFF;
2765 }
2766
059ec3d9
PH
2767/* Read a response line. We put it into the rest of the buffer, using several
2768recv() calls if necessary. */
2769
2770p = buffer + qlen;
2771
2772for (;;)
2773 {
2774 uschar *pp;
2775 int count;
2776 int size = sizeof(buffer) - (p - buffer);
2777
2778 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
0a5441fc 2779 count = ip_recv(&ident_conn_ctx, p, size, time(NULL) + rfc1413_query_timeout);
059ec3d9
PH
2780 if (count <= 0) goto END_OFF; /* Read error or EOF */
2781
2782 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2783 generous, and accept a plain \n terminator as well. The only illegal
2784 character is 0. */
2785
2786 for (pp = p; pp < p + count; pp++)
2787 {
2788 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2789 if (*pp == '\n')
2790 {
2791 if (pp[-1] == '\r') pp--;
2792 *pp = 0;
2793 goto GOT_DATA; /* Break out of both loops */
2794 }
2795 }
2796
2797 /* Reached the end of the data without finding \n. Let the loop continue to
2798 read some more, if there is room. */
2799
2800 p = pp;
2801 }
2802
2803GOT_DATA:
2804
2805/* We have received a line of data. Check it carefully. It must start with the
2806same two port numbers that we sent, followed by data as defined by the RFC. For
2807example,
2808
2809 12345 , 25 : USERID : UNIX :root
2810
2811However, the amount of white space may be different to what we sent. In the
2812"osname" field there may be several sub-fields, comma separated. The data we
2813actually want to save follows the third colon. Some systems put leading spaces
2814in it - we discard those. */
2815
2816if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2817 &received_interface_port, &n) != 2 ||
2818 received_sender_port != sender_host_port ||
2819 received_interface_port != interface_port)
2820 goto END_OFF;
2821
2822p = buffer + qlen + n;
2823while(isspace(*p)) p++;
2824if (*p++ != ':') goto END_OFF;
2825while(isspace(*p)) p++;
2826if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2827p += 6;
2828while(isspace(*p)) p++;
2829if (*p++ != ':') goto END_OFF;
2830while (*p != 0 && *p != ':') p++;
2831if (*p++ == 0) goto END_OFF;
2832while(isspace(*p)) p++;
2833if (*p == 0) goto END_OFF;
2834
2835/* The rest of the line is the data we want. We turn it into printing
2836characters when we save it, so that it cannot mess up the format of any logging
2837or Received: lines into which it gets inserted. We keep a maximum of 127
55414b25 2838characters. The deconst cast is ok as we fed a nonconst to string_printing() */
059ec3d9 2839
55414b25 2840sender_ident = US string_printing(string_copyn(p, 127));
059ec3d9
PH
2841DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2842
2843END_OFF:
74f1a423 2844(void)close(ident_conn_ctx.sock);
059ec3d9
PH
2845return;
2846}
2847
2848
2849
2850
2851/*************************************************
2852* Match host to a single host-list item *
2853*************************************************/
2854
2855/* This function compares a host (name or address) against a single item
2856from a host list. The host name gets looked up if it is needed and is not
2857already known. The function is called from verify_check_this_host() via
2858match_check_list(), which is why most of its arguments are in a single block.
2859
2860Arguments:
2861 arg the argument block (see below)
2862 ss the host-list item
2863 valueptr where to pass back looked up data, or NULL
2864 error for error message when returning ERROR
2865
2866The block contains:
32d668a5
PH
2867 host_name (a) the host name, or
2868 (b) NULL, implying use sender_host_name and
2869 sender_host_aliases, looking them up if required, or
2870 (c) the empty string, meaning that only IP address matches
2871 are permitted
059ec3d9
PH
2872 host_address the host address
2873 host_ipv4 the IPv4 address taken from an IPv6 one
2874
2875Returns: OK matched
2876 FAIL did not match
2877 DEFER lookup deferred
32d668a5
PH
2878 ERROR (a) failed to find the host name or IP address, or
2879 (b) unknown lookup type specified, or
2880 (c) host name encountered when only IP addresses are
2881 being matched
059ec3d9
PH
2882*/
2883
32d668a5 2884int
55414b25 2885check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
059ec3d9
PH
2886{
2887check_host_block *cb = (check_host_block *)arg;
32d668a5 2888int mlen = -1;
059ec3d9 2889int maskoffset;
32d668a5 2890BOOL iplookup = FALSE;
059ec3d9 2891BOOL isquery = FALSE;
32d668a5 2892BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
55414b25 2893const uschar *t;
67a57a5a 2894uschar * semicolon, * endname, * opts;
059ec3d9
PH
2895uschar **aliases;
2896
2897/* Optimize for the special case when the pattern is "*". */
2898
2899if (*ss == '*' && ss[1] == 0) return OK;
2900
2901/* If the pattern is empty, it matches only in the case when there is no host -
2902this can occur in ACL checking for SMTP input using the -bs option. In this
2903situation, the host address is the empty string. */
2904
2905if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2906if (*ss == 0) return FAIL;
2907
32d668a5
PH
2908/* If the pattern is precisely "@" then match against the primary host name,
2909provided that host name matching is permitted; if it's "@[]" match against the
2910local host's IP addresses. */
059ec3d9
PH
2911
2912if (*ss == '@')
32d668a5
PH
2913 if (ss[1] == 0)
2914 {
2915 if (isiponly) return ERROR;
2916 ss = primary_hostname;
2917 }
059ec3d9
PH
2918 else if (Ustrcmp(ss, "@[]") == 0)
2919 {
d7978c0f 2920 for (ip_address_item * ip = host_find_interfaces(); ip; ip = ip->next)
059ec3d9
PH
2921 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2922 return FAIL;
2923 }
059ec3d9
PH
2924
2925/* If the pattern is an IP address, optionally followed by a bitmask count, do
4c04137d 2926a (possibly masked) comparison with the current IP address. */
059ec3d9 2927
7e66e54d 2928if (string_is_ip_address(ss, &maskoffset) != 0)
059ec3d9
PH
2929 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2930
1688f43b
PH
2931/* The pattern is not an IP address. A common error that people make is to omit
2932one component of an IPv4 address, either by accident, or believing that, for
2933example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2934which it isn't. (Those applications that do accept 1.2.3 as an IP address
2935interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2936ancient specification.) To aid in debugging these cases, we give a specific
2937error if the pattern contains only digits and dots or contains a slash preceded
2938only by digits and dots (a slash at the start indicates a file name and of
2939course slashes may be present in lookups, but not preceded only by digits and
2940dots). */
2941
d7978c0f 2942for (t = ss; isdigit(*t) || *t == '.'; ) t++;
1688f43b
PH
2943if (*t == 0 || (*t == '/' && t != ss))
2944 {
2945 *error = US"malformed IPv4 address or address mask";
2946 return ERROR;
2947 }
2948
f82c06aa
JH
2949/* See if there is a semicolon in the pattern, separating a searchtype
2950prefix. If there is one then check for comma-sep options. */
059ec3d9 2951
67a57a5a 2952if ((semicolon = Ustrchr(ss, ';')))
f82c06aa 2953 if ((opts = Ustrchr(ss, ',')) && opts < semicolon)
01fa9fe0 2954 {
f82c06aa 2955 endname = opts++;
01fa9fe0
JH
2956 opts = string_copyn(opts, semicolon - opts);
2957 }
f82c06aa
JH
2958 else
2959 {
2960 endname = semicolon;
2961 opts = NULL;
2962 }
32d668a5
PH
2963
2964/* If we are doing an IP address only match, then all lookups must be IP
df199fec 2965address lookups, even if there is no "net-". */
32d668a5
PH
2966
2967if (isiponly)
32d668a5 2968 iplookup = semicolon != NULL;
059ec3d9 2969
32d668a5 2970/* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
df199fec
PH
2971a lookup on a masked IP network, in textual form. We obey this code even if we
2972have already set iplookup, so as to skip over the "net-" prefix and to set the
2973mask length. The net- stuff really only applies to single-key lookups where the
2974key is implicit. For query-style lookups the key is specified in the query.
2975From release 4.30, the use of net- for query style is no longer needed, but we
2976retain it for backward compatibility. */
2977
67a57a5a 2978if (Ustrncmp(ss, "net", 3) == 0 && semicolon)
32d668a5
PH
2979 {
2980 mlen = 0;
2981 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2982 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
67a57a5a 2983 iplookup = *t++ == '-';
32d668a5 2984 }
d7978c0f
JH
2985else
2986 t = ss;
059ec3d9 2987
32d668a5 2988/* Do the IP address lookup if that is indeed what we have */
059ec3d9 2989
32d668a5
PH
2990if (iplookup)
2991 {
2992 int insize;
2993 int search_type;
2994 int incoming[4];
2995 void *handle;
2996 uschar *filename, *key, *result;
2997 uschar buffer[64];
059ec3d9 2998
32d668a5 2999 /* Find the search type */
059ec3d9 3000
67a57a5a 3001 search_type = search_findtype(t, endname - t);
059ec3d9 3002
32d668a5
PH
3003 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3004 search_error_message);
059ec3d9 3005
13b685f9
PH
3006 /* Adjust parameters for the type of lookup. For a query-style lookup, there
3007 is no file name, and the "key" is just the query. For query-style with a file
3008 name, we have to fish the file off the start of the query. For a single-key
3009 lookup, the key is the current IP address, masked appropriately, and
3010 reconverted to text form, with the mask appended. For IPv6 addresses, specify
6a3bceb1
PH
3011 dot separators instead of colons, except when the lookup type is "iplsearch".
3012 */
059ec3d9 3013
13b685f9
PH
3014 if (mac_islookup(search_type, lookup_absfilequery))
3015 {
3016 filename = semicolon + 1;
3017 key = filename;
3018 while (*key != 0 && !isspace(*key)) key++;
3019 filename = string_copyn(filename, key - filename);
3020 while (isspace(*key)) key++;
3021 }
3022 else if (mac_islookup(search_type, lookup_querystyle))
32d668a5
PH
3023 {
3024 filename = NULL;
3025 key = semicolon + 1;
3026 }
6a3bceb1 3027 else /* Single-key style */
32d668a5 3028 {
e6d225ae 3029 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
6a3bceb1 3030 ':' : '.';
32d668a5
PH
3031 insize = host_aton(cb->host_address, incoming);
3032 host_mask(insize, incoming, mlen);
6a3bceb1 3033 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
32d668a5
PH
3034 key = buffer;
3035 filename = semicolon + 1;
059ec3d9 3036 }
32d668a5
PH
3037
3038 /* Now do the actual lookup; note that there is no search_close() because
3039 of the caching arrangements. */
3040
d4ff61d1
JH
3041 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3042 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3043
67a57a5a 3044 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL, opts);
8768d548
JH
3045 if (valueptr) *valueptr = result;
3046 return result ? OK : f.search_find_defer ? DEFER: FAIL;
059ec3d9
PH
3047 }
3048
3049/* The pattern is not an IP address or network reference of any kind. That is,
32d668a5
PH
3050it is a host name pattern. If this is an IP only match, there's an error in the
3051host list. */
3052
3053if (isiponly)
3054 {
3055 *error = US"cannot match host name in match_ip list";
3056 return ERROR;
3057 }
3058
3059/* Check the characters of the pattern to see if they comprise only letters,
3060digits, full stops, and hyphens (the constituents of domain names). Allow
3061underscores, as they are all too commonly found. Sigh. Also, if
3062allow_utf8_domains is set, allow top-bit characters. */
059ec3d9
PH
3063
3064for (t = ss; *t != 0; t++)
3065 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3066 (!allow_utf8_domains || *t < 128)) break;
3067
3068/* If the pattern is a complete domain name, with no fancy characters, look up
3069its IP address and match against that. Note that a multi-homed host will add
3070items to the chain. */
3071
3072if (*t == 0)
3073 {
3074 int rc;
3075 host_item h;
3076 h.next = NULL;
3077 h.name = ss;
3078 h.address = NULL;
3079 h.mx = MX_NONE;
9b8fadde 3080
1f155f8e
JH
3081 /* Using byname rather than bydns here means we cannot determine dnssec
3082 status. On the other hand it is unclear how that could be either
3083 propagated up or enforced. */
3084
322050c2 3085 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
059ec3d9
PH
3086 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3087 {
d7978c0f 3088 for (host_item * hh = &h; hh; hh = hh->next)
96776534 3089 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
059ec3d9
PH
3090 return FAIL;
3091 }
3092 if (rc == HOST_FIND_AGAIN) return DEFER;
3093 *error = string_sprintf("failed to find IP address for %s", ss);
3094 return ERROR;
3095 }
3096
3097/* Almost all subsequent comparisons require the host name, and can be done
3098using the general string matching function. When this function is called for
3099outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3100must use sender_host_name and its aliases, looking them up if necessary. */
3101
67a57a5a 3102if (cb->host_name) /* Explicit host name given */
059ec3d9
PH
3103 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3104 valueptr);
3105
3106/* Host name not given; in principle we need the sender host name and its
3107aliases. However, for query-style lookups, we do not need the name if the
3108query does not contain $sender_host_name. From release 4.23, a reference to
3109$sender_host_name causes it to be looked up, so we don't need to do the lookup
3110on spec. */
3111
67a57a5a 3112if ((semicolon = Ustrchr(ss, ';')))
059ec3d9 3113 {
67a57a5a 3114 const uschar * affix, * opts;
059ec3d9
PH
3115 int partial, affixlen, starflags, id;
3116
3117 *semicolon = 0;
67a57a5a
JH
3118 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags,
3119 &opts);
059ec3d9
PH
3120 *semicolon=';';
3121
3122 if (id < 0) /* Unknown lookup type */
3123 {
3124 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3125 search_error_message, ss);
3126 return DEFER;
3127 }
13b685f9 3128 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
059ec3d9
PH
3129 }
3130
3131if (isquery)
3132 {
3133 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3134 {
3135 case OK: return OK;
3136 case DEFER: return DEFER;
3137 default: return FAIL;
3138 }
3139 }
3140
3141/* Not a query-style lookup; must ensure the host name is present, and then we
3142do a check on the name and all its aliases. */
3143
2d0dc929 3144if (!sender_host_name)
059ec3d9
PH
3145 {
3146 HDEBUG(D_host_lookup)
3147 debug_printf("sender host name required, to match against %s\n", ss);
3148 if (host_lookup_failed || host_name_lookup() != OK)
3149 {
3150 *error = string_sprintf("failed to find host name for %s",
3151 sender_host_address);;
3152 return ERROR;
3153 }
3154 host_build_sender_fullhost();
3155 }
3156
3157/* Match on the sender host name, using the general matching function */
3158
2d0dc929 3159switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE, valueptr))
059ec3d9
PH
3160 {
3161 case OK: return OK;
3162 case DEFER: return DEFER;
3163 }
3164
3165/* If there are aliases, try matching on them. */
3166
3167aliases = sender_host_aliases;
2d0dc929 3168while (*aliases)
059ec3d9
PH
3169 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3170 {
3171 case OK: return OK;
3172 case DEFER: return DEFER;
3173 }
059ec3d9
PH
3174return FAIL;
3175}
3176
3177
3178
3179
3180/*************************************************
3181* Check a specific host matches a host list *
3182*************************************************/
3183
3184/* This function is passed a host list containing items in a number of
3185different formats and the identity of a host. Its job is to determine whether
3186the given host is in the set of hosts defined by the list. The host name is
3187passed as a pointer so that it can be looked up if needed and not already
3188known. This is commonly the case when called from verify_check_host() to check
3189an incoming connection. When called from elsewhere the host name should usually
3190be set.
3191
3192This function is now just a front end to match_check_list(), which runs common
3193code for scanning a list. We pass it the check_host() function to perform a
3194single test.
3195
3196Arguments:
3197 listptr pointer to the host list
3198 cache_bits pointer to cache for named lists, or NULL
3199 host_name the host name or NULL, implying use sender_host_name and
3200 sender_host_aliases, looking them up if required
3201 host_address the IP address
3202 valueptr if not NULL, data from a lookup is passed back here
3203
3204Returns: OK if the host is in the defined set
3205 FAIL if the host is not in the defined set,
3206 DEFER if a data lookup deferred (not a host lookup)
3207
3208If the host name was needed in order to make a comparison, and could not be
3209determined from the IP address, the result is FAIL unless the item
3210"+allow_unknown" was met earlier in the list, in which case OK is returned. */
3211
3212int
55414b25
JH
3213verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3214 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
059ec3d9 3215{
d4eb88df 3216int rc;
059ec3d9 3217unsigned int *local_cache_bits = cache_bits;
55414b25 3218const uschar *save_host_address = deliver_host_address;
0ab63f3d 3219check_host_block cb = { .host_name = host_name, .host_address = host_address };
059ec3d9 3220
0ab63f3d 3221if (valueptr) *valueptr = NULL;
059ec3d9
PH
3222
3223/* If the host address starts off ::ffff: it is an IPv6 address in
3224IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3225addresses. */
3226
0ab63f3d
JH
3227cb.host_ipv4 = Ustrncmp(host_address, "::ffff:", 7) == 0
3228 ? host_address + 7 : host_address;
059ec3d9 3229
8e669ac1
PH
3230/* During the running of the check, put the IP address into $host_address. In
3231the case of calls from the smtp transport, it will already be there. However,
3232in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
d4eb88df
PH
3233the safe side, any existing setting is preserved, though as I write this
3234(November 2004) I can't see any cases where it is actually needed. */
3235
3236deliver_host_address = host_address;
3237rc = match_check_list(
3238 listptr, /* the list */
3239 0, /* separator character */
3240 &hostlist_anchor, /* anchor pointer */
3241 &local_cache_bits, /* cache pointer */
3242 check_host, /* function for testing */
3243 &cb, /* argument for function */
3244 MCL_HOST, /* type of check */
8e669ac1 3245 (host_address == sender_host_address)?
d4eb88df
PH
3246 US"host" : host_address, /* text for debugging */
3247 valueptr); /* where to pass back data */
3248deliver_host_address = save_host_address;
8e669ac1 3249return rc;
059ec3d9
PH
3250}
3251
3252
3253
3254
3255/*************************************************
5130845b
JH
3256* Check the given host item matches a list *
3257*************************************************/
3258int
3fb3231c 3259verify_check_given_host(const uschar **listptr, const host_item *host)
5130845b 3260{
3fb3231c 3261return verify_check_this_host(listptr, NULL, host->name, host->address, NULL);
5130845b
JH
3262}
3263
3264/*************************************************
059ec3d9
PH
3265* Check the remote host matches a list *
3266*************************************************/
3267
3268/* This is a front end to verify_check_this_host(), created because checking
3269the remote host is a common occurrence. With luck, a good compiler will spot
3270the tail recursion and optimize it. If there's no host address, this is
3271command-line SMTP input - check against an empty string for the address.
3272
3273Arguments:
3274 listptr pointer to the host list
3275
3276Returns: the yield of verify_check_this_host(),
3277 i.e. OK, FAIL, or DEFER
3278*/
3279
3280int
3281verify_check_host(uschar **listptr)
3282{
55414b25 3283return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
b10c87b3 3284 sender_host_address ? sender_host_address : US"", NULL);
059ec3d9
PH
3285}
3286
3287
3288
3289
3290
3291/*************************************************
83e029d5 3292* Invert an IP address *
059ec3d9
PH
3293*************************************************/
3294
83e029d5
PP
3295/* Originally just used for DNS xBL lists, now also used for the
3296reverse_ip expansion operator.
3297
059ec3d9
PH
3298Arguments:
3299 buffer where to put the answer
3300 address the address to invert
3301*/
3302
83e029d5 3303void
059ec3d9
PH
3304invert_address(uschar *buffer, uschar *address)
3305{
3306int bin[4];
3307uschar *bptr = buffer;
3308
3309/* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3310to the IPv4 part only. */
3311
3312if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3313
3314/* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3315always 1. */
3316
3317if (host_aton(address, bin) == 1)
3318 {
059ec3d9 3319 int x = bin[0];
d7978c0f 3320 for (int i = 0; i < 4; i++)
059ec3d9
PH
3321 {
3322 sprintf(CS bptr, "%d.", x & 255);
3323 while (*bptr) bptr++;
3324 x >>= 8;
3325 }
3326 }
3327
3328/* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3329in any DNS black lists, and the format in which they will be looked up is
3330unknown. This is just a guess. */
3331
3332#if HAVE_IPV6
3333else
d7978c0f 3334 for (int j = 3; j >= 0; j--)
059ec3d9
PH
3335 {
3336 int x = bin[j];
d7978c0f 3337 for (int i = 0; i < 8; i++)
059ec3d9
PH
3338 {
3339 sprintf(CS bptr, "%x.", x & 15);
3340 while (*bptr) bptr++;
3341 x >>= 4;
3342 }
3343 }
059ec3d9 3344#endif
d6f6e0dc
PH
3345
3346/* Remove trailing period -- this is needed so that both arbitrary
3347dnsbl keydomains and inverted addresses may be combined with the
3348same format string, "%s.%s" */
3349
3350*(--bptr) = 0;
059ec3d9
PH
3351}
3352
3353
3354
3355/*************************************************
0bcb2a0e
PH
3356* Perform a single dnsbl lookup *
3357*************************************************/
3358
d6f6e0dc
PH
3359/* This function is called from verify_check_dnsbl() below. It is also called
3360recursively from within itself when domain and domain_txt are different
3361pointers, in order to get the TXT record from the alternate domain.
0bcb2a0e
PH
3362
3363Arguments:
d6f6e0dc
PH
3364 domain the outer dnsbl domain
3365 domain_txt alternate domain to lookup TXT record on success; when the
3366 same domain is to be used, domain_txt == domain (that is,
3367 the pointers must be identical, not just the text)
8e669ac1 3368 keydomain the current keydomain (for debug message)
d6f6e0dc
PH
3369 prepend subdomain to lookup (like keydomain, but
3370 reversed if IP address)
3371 iplist the list of matching IP addresses, or NULL for "any"
8e669ac1 3372 bitmask true if bitmask matching is wanted
431b7361
PH
3373 match_type condition for 'succeed' result
3374 0 => Any