Fix bug #448
[exim.git] / src / src / verify.c
CommitLineData
184e8823 1/* $Cambridge: exim/src/src/verify.c,v 1.45 2007/01/08 10:50:18 ph10 Exp $ */
059ec3d9
PH
2
3/*************************************************
4* Exim - an Internet mail transport agent *
5*************************************************/
6
184e8823 7/* Copyright (c) University of Cambridge 1995 - 2007 */
059ec3d9
PH
8/* See the file NOTICE for conditions of use and distribution. */
9
10/* Functions concerned with verifying things. The original code for callout
11caching was contributed by Kevin Fleming (but I hacked it around a bit). */
12
13
14#include "exim.h"
15
16
17/* Structure for caching DNSBL lookups */
18
19typedef struct dnsbl_cache_block {
20 dns_address *rhs;
21 uschar *text;
22 int rc;
23 BOOL text_set;
24} dnsbl_cache_block;
25
26
27/* Anchor for DNSBL cache */
28
29static tree_node *dnsbl_cache = NULL;
30
31
32
33/*************************************************
34* Retrieve a callout cache record *
35*************************************************/
36
37/* If a record exists, check whether it has expired.
38
39Arguments:
40 dbm_file an open hints file
41 key the record key
42 type "address" or "domain"
43 positive_expire expire time for positive records
44 negative_expire expire time for negative records
45
46Returns: the cache record if a non-expired one exists, else NULL
47*/
48
49static dbdata_callout_cache *
50get_callout_cache_record(open_db *dbm_file, uschar *key, uschar *type,
51 int positive_expire, int negative_expire)
52{
53BOOL negative;
54int length, expire;
55time_t now;
56dbdata_callout_cache *cache_record;
57
58cache_record = dbfn_read_with_length(dbm_file, key, &length);
59
60if (cache_record == NULL)
61 {
62 HDEBUG(D_verify) debug_printf("callout cache: no %s record found\n", type);
63 return NULL;
64 }
65
66/* We treat a record as "negative" if its result field is not positive, or if
67it is a domain record and the postmaster field is negative. */
68
69negative = cache_record->result != ccache_accept ||
70 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
71expire = negative? negative_expire : positive_expire;
72now = time(NULL);
73
74if (now - cache_record->time_stamp > expire)
75 {
76 HDEBUG(D_verify) debug_printf("callout cache: %s record expired\n", type);
77 return NULL;
78 }
79
80/* If this is a non-reject domain record, check for the obsolete format version
81that doesn't have the postmaster and random timestamps, by looking at the
82length. If so, copy it to a new-style block, replicating the record's
83timestamp. Then check the additional timestamps. (There's no point wasting
84effort if connections are rejected.) */
85
86if (type[0] == 'd' && cache_record->result != ccache_reject)
87 {
88 if (length == sizeof(dbdata_callout_cache_obs))
89 {
90 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
91 memcpy(new, cache_record, length);
92 new->postmaster_stamp = new->random_stamp = new->time_stamp;
93 cache_record = new;
94 }
95
96 if (now - cache_record->postmaster_stamp > expire)
97 cache_record->postmaster_result = ccache_unknown;
98
99 if (now - cache_record->random_stamp > expire)
100 cache_record->random_result = ccache_unknown;
101 }
102
103HDEBUG(D_verify) debug_printf("callout cache: found %s record\n", type);
104return cache_record;
105}
106
107
108
109/*************************************************
110* Do callout verification for an address *
111*************************************************/
112
113/* This function is called from verify_address() when the address has routed to
114a host list, and a callout has been requested. Callouts are expensive; that is
115why a cache is used to improve the efficiency.
116
117Arguments:
118 addr the address that's been routed
119 host_list the list of hosts to try
120 tf the transport feedback block
121
122 ifstring "interface" option from transport, or NULL
123 portstring "port" option from transport, or NULL
124 protocolstring "protocol" option from transport, or NULL
125 callout the per-command callout timeout
4deaf07d
PH
126 callout_overall the overall callout timeout (if < 0 use 4*callout)
127 callout_connect the callout connection timeout (if < 0 use callout)
059ec3d9
PH
128 options the verification options - these bits are used:
129 vopt_is_recipient => this is a recipient address
130 vopt_callout_no_cache => don't use callout cache
2a4be8f9 131 vopt_callout_fullpm => if postmaster check, do full one
059ec3d9
PH
132 vopt_callout_random => do the "random" thing
133 vopt_callout_recipsender => use real sender for recipient
134 vopt_callout_recippmaster => use postmaster for recipient
135 se_mailfrom MAIL FROM address for sender verify; NULL => ""
136 pm_mailfrom if non-NULL, do the postmaster check with this sender
137
138Returns: OK/FAIL/DEFER
139*/
140
141static int
142do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
8e669ac1 143 int callout, int callout_overall, int callout_connect, int options,
4deaf07d 144 uschar *se_mailfrom, uschar *pm_mailfrom)
059ec3d9
PH
145{
146BOOL is_recipient = (options & vopt_is_recipient) != 0;
147BOOL callout_no_cache = (options & vopt_callout_no_cache) != 0;
148BOOL callout_random = (options & vopt_callout_random) != 0;
149
150int yield = OK;
2b1c6e3a 151int old_domain_cache_result = ccache_accept;
059ec3d9
PH
152BOOL done = FALSE;
153uschar *address_key;
154uschar *from_address;
155uschar *random_local_part = NULL;
750af86e 156uschar *save_deliver_domain = deliver_domain;
8e669ac1 157uschar **failure_ptr = is_recipient?
2c7db3f5 158 &recipient_verify_failure : &sender_verify_failure;
059ec3d9
PH
159open_db dbblock;
160open_db *dbm_file = NULL;
161dbdata_callout_cache new_domain_record;
162dbdata_callout_cache_address new_address_record;
163host_item *host;
164time_t callout_start_time;
165
166new_domain_record.result = ccache_unknown;
167new_domain_record.postmaster_result = ccache_unknown;
168new_domain_record.random_result = ccache_unknown;
169
170memset(&new_address_record, 0, sizeof(new_address_record));
171
172/* For a recipient callout, the key used for the address cache record must
173include the sender address if we are using the real sender in the callout,
174because that may influence the result of the callout. */
175
176address_key = addr->address;
177from_address = US"";
178
179if (is_recipient)
180 {
181 if ((options & vopt_callout_recipsender) != 0)
182 {
183 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
184 from_address = sender_address;
185 }
186 else if ((options & vopt_callout_recippmaster) != 0)
187 {
188 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
189 qualify_domain_sender);
190 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
191 }
192 }
193
194/* For a sender callout, we must adjust the key if the mailfrom address is not
195empty. */
196
197else
198 {
199 from_address = (se_mailfrom == NULL)? US"" : se_mailfrom;
200 if (from_address[0] != 0)
201 address_key = string_sprintf("%s/<%s>", addr->address, from_address);
202 }
203
204/* Open the callout cache database, it it exists, for reading only at this
205stage, unless caching has been disabled. */
206
207if (callout_no_cache)
208 {
209 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
210 }
211else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
212 {
213 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
214 }
215
216/* If a cache database is available see if we can avoid the need to do an
217actual callout by making use of previously-obtained data. */
218
219if (dbm_file != NULL)
220 {
221 dbdata_callout_cache_address *cache_address_record;
222 dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
223 addr->domain, US"domain",
224 callout_cache_domain_positive_expire,
225 callout_cache_domain_negative_expire);
226
227 /* If an unexpired cache record was found for this domain, see if the callout
228 process can be short-circuited. */
229
230 if (cache_record != NULL)
231 {
2b1c6e3a
PH
232 /* In most cases, if an early command (up to and including MAIL FROM:<>)
233 was rejected, there is no point carrying on. The callout fails. However, if
234 we are doing a recipient verification with use_sender or use_postmaster
235 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
236 will be using a non-empty sender. We have to remember this situation so as
237 not to disturb the cached domain value if this whole verification succeeds
238 (we don't want it turning into "accept"). */
239
240 old_domain_cache_result = cache_record->result;
241
242 if (cache_record->result == ccache_reject ||
243 (*from_address == 0 && cache_record->result == ccache_reject_mfnull))
059ec3d9
PH
244 {
245 setflag(addr, af_verify_nsfail);
246 HDEBUG(D_verify)
247 debug_printf("callout cache: domain gave initial rejection, or "
248 "does not accept HELO or MAIL FROM:<>\n");
249 setflag(addr, af_verify_nsfail);
250 addr->user_message = US"(result of an earlier callout reused).";
251 yield = FAIL;
8e669ac1 252 *failure_ptr = US"mail";
059ec3d9
PH
253 goto END_CALLOUT;
254 }
255
256 /* If a previous check on a "random" local part was accepted, we assume
257 that the server does not do any checking on local parts. There is therefore
258 no point in doing the callout, because it will always be successful. If a
259 random check previously failed, arrange not to do it again, but preserve
260 the data in the new record. If a random check is required but hasn't been
261 done, skip the remaining cache processing. */
262
263 if (callout_random) switch(cache_record->random_result)
264 {
265 case ccache_accept:
266 HDEBUG(D_verify)
267 debug_printf("callout cache: domain accepts random addresses\n");
268 goto END_CALLOUT; /* Default yield is OK */
269
270 case ccache_reject:
271 HDEBUG(D_verify)
272 debug_printf("callout cache: domain rejects random addresses\n");
273 callout_random = FALSE;
274 new_domain_record.random_result = ccache_reject;
275 new_domain_record.random_stamp = cache_record->random_stamp;
276 break;
277
278 default:
279 HDEBUG(D_verify)
280 debug_printf("callout cache: need to check random address handling "
281 "(not cached or cache expired)\n");
282 goto END_CACHE;
283 }
284
285 /* If a postmaster check is requested, but there was a previous failure,
286 there is again no point in carrying on. If a postmaster check is required,
287 but has not been done before, we are going to have to do a callout, so skip
288 remaining cache processing. */
289
290 if (pm_mailfrom != NULL)
291 {
292 if (cache_record->postmaster_result == ccache_reject)
293 {
294 setflag(addr, af_verify_pmfail);
295 HDEBUG(D_verify)
296 debug_printf("callout cache: domain does not accept "
297 "RCPT TO:<postmaster@domain>\n");
298 yield = FAIL;
8e669ac1 299 *failure_ptr = US"postmaster";
059ec3d9
PH
300 setflag(addr, af_verify_pmfail);
301 addr->user_message = US"(result of earlier verification reused).";
302 goto END_CALLOUT;
303 }
304 if (cache_record->postmaster_result == ccache_unknown)
305 {
306 HDEBUG(D_verify)
307 debug_printf("callout cache: need to check RCPT "
308 "TO:<postmaster@domain> (not cached or cache expired)\n");
309 goto END_CACHE;
310 }
311
312 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
313 postmaster check if the address itself has to be checked. Also ensure
314 that the value in the cache record is preserved (with its old timestamp).
315 */
316
317 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
318 "TO:<postmaster@domain>\n");
319 pm_mailfrom = NULL;
320 new_domain_record.postmaster_result = ccache_accept;
321 new_domain_record.postmaster_stamp = cache_record->postmaster_stamp;
322 }
323 }
324
325 /* We can't give a result based on information about the domain. See if there
326 is an unexpired cache record for this specific address (combined with the
327 sender address if we are doing a recipient callout with a non-empty sender).
328 */
329
330 cache_address_record = (dbdata_callout_cache_address *)
331 get_callout_cache_record(dbm_file,
332 address_key, US"address",
333 callout_cache_positive_expire,
334 callout_cache_negative_expire);
335
336 if (cache_address_record != NULL)
337 {
338 if (cache_address_record->result == ccache_accept)
339 {
340 HDEBUG(D_verify)
341 debug_printf("callout cache: address record is positive\n");
342 }
343 else
344 {
345 HDEBUG(D_verify)
346 debug_printf("callout cache: address record is negative\n");
347 addr->user_message = US"Previous (cached) callout verification failure";
8e669ac1 348 *failure_ptr = US"recipient";
059ec3d9
PH
349 yield = FAIL;
350 }
351 goto END_CALLOUT;
352 }
353
354 /* Close the cache database while we actually do the callout for real. */
355
356 END_CACHE:
357 dbfn_close(dbm_file);
358 dbm_file = NULL;
359 }
360
361/* The information wasn't available in the cache, so we have to do a real
362callout and save the result in the cache for next time, unless no_cache is set,
363or unless we have a previously cached negative random result. If we are to test
364with a random local part, ensure that such a local part is available. If not,
365log the fact, but carry on without randomming. */
366
367if (callout_random && callout_random_local_part != NULL)
368 {
369 random_local_part = expand_string(callout_random_local_part);
370 if (random_local_part == NULL)
371 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
372 "callout_random_local_part: %s", expand_string_message);
373 }
374
4deaf07d
PH
375/* Default the connect and overall callout timeouts if not set, and record the
376time we are starting so that we can enforce it. */
059ec3d9
PH
377
378if (callout_overall < 0) callout_overall = 4 * callout;
4deaf07d 379if (callout_connect < 0) callout_connect = callout;
059ec3d9
PH
380callout_start_time = time(NULL);
381
382/* Now make connections to the hosts and do real callouts. The list of hosts
383is passed in as an argument. */
384
385for (host = host_list; host != NULL && !done; host = host->next)
386 {
387 smtp_inblock inblock;
388 smtp_outblock outblock;
389 int host_af;
390 int port = 25;
8e669ac1 391 BOOL send_quit = TRUE;
26da7e20 392 uschar *active_hostname = smtp_active_hostname;
059ec3d9
PH
393 uschar *helo = US"HELO";
394 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
395 uschar inbuffer[4096];
396 uschar outbuffer[1024];
397 uschar responsebuffer[4096];
398
399 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
400 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
401
402 /* Skip this host if we don't have an IP address for it. */
403
404 if (host->address == NULL)
405 {
406 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
407 host->name);
408 continue;
409 }
410
411 /* Check the overall callout timeout */
412
413 if (time(NULL) - callout_start_time >= callout_overall)
414 {
415 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
416 break;
417 }
418
419 /* Set IPv4 or IPv6 */
420
421 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
422
de3a88fb
PH
423 /* Expand and interpret the interface and port strings. The latter will not
424 be used if there is a host-specific port (e.g. from a manualroute router).
425 This has to be delayed till now, because they may expand differently for
426 different hosts. If there's a failure, log it, but carry on with the
427 defaults. */
059ec3d9
PH
428
429 deliver_host = host->name;
430 deliver_host_address = host->address;
750af86e 431 deliver_domain = addr->domain;
de3a88fb 432
059ec3d9
PH
433 if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
434 US"callout") ||
435 !smtp_get_port(tf->port, addr, &port, US"callout"))
436 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
437 addr->message);
de3a88fb 438
26da7e20
PH
439 /* Expand the helo_data string to find the host name to use. */
440
441 if (tf->helo_data != NULL)
442 {
443 uschar *s = expand_string(tf->helo_data);
e4fa6968 444 if (s == NULL)
26da7e20 445 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
e4fa6968
PH
446 "helo_data value for callout: %s", addr->address,
447 expand_string_message);
26da7e20
PH
448 else active_hostname = s;
449 }
450
059ec3d9 451 deliver_host = deliver_host_address = NULL;
750af86e 452 deliver_domain = save_deliver_domain;
059ec3d9
PH
453
454 /* Set HELO string according to the protocol */
455
456 if (Ustrcmp(tf->protocol, "lmtp") == 0) helo = US"LHLO";
457
458 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", interface, port);
459
460 /* Set up the buffer for reading SMTP response packets. */
461
462 inblock.buffer = inbuffer;
463 inblock.buffersize = sizeof(inbuffer);
464 inblock.ptr = inbuffer;
465 inblock.ptrend = inbuffer;
466
467 /* Set up the buffer for holding SMTP commands while pipelining */
468
469 outblock.buffer = outbuffer;
470 outblock.buffersize = sizeof(outbuffer);
471 outblock.ptr = outbuffer;
472 outblock.cmd_count = 0;
473 outblock.authenticating = FALSE;
474
475 /* Connect to the host; on failure, just loop for the next one, but we
4deaf07d 476 set the error for the last one. Use the callout_connect timeout. */
059ec3d9
PH
477
478 inblock.sock = outblock.sock =
4deaf07d 479 smtp_connect(host, host_af, port, interface, callout_connect, TRUE);
059ec3d9
PH
480 if (inblock.sock < 0)
481 {
482 addr->message = string_sprintf("could not connect to %s [%s]: %s",
483 host->name, host->address, strerror(errno));
484 continue;
485 }
486
2b1c6e3a
PH
487 /* Wait for initial response, and send HELO. The smtp_write_command()
488 function leaves its command in big_buffer. This is used in error responses.
489 Initialize it in case the connection is rejected. */
059ec3d9
PH
490
491 Ustrcpy(big_buffer, "initial connection");
492
493 done =
494 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
495 '2', callout) &&
059ec3d9 496 smtp_write_command(&outblock, FALSE, "%s %s\r\n", helo,
26da7e20 497 active_hostname) >= 0 &&
059ec3d9 498 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
2b1c6e3a 499 '2', callout);
059ec3d9 500
2b1c6e3a
PH
501 /* Failure to accept HELO is cached; this blocks the whole domain for all
502 senders. I/O errors and defer responses are not cached. */
503
504 if (!done)
505 {
506 *failure_ptr = US"mail"; /* At or before MAIL */
507 if (errno == 0 && responsebuffer[0] == '5')
508 {
509 setflag(addr, af_verify_nsfail);
510 new_domain_record.result = ccache_reject;
511 }
512 }
513
514 /* Send the MAIL command */
515
516 else done =
059ec3d9
PH
517 smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>\r\n",
518 from_address) >= 0 &&
519 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
520 '2', callout);
521
2b1c6e3a
PH
522 /* If the host does not accept MAIL FROM:<>, arrange to cache this
523 information, but again, don't record anything for an I/O error or a defer. Do
524 not cache rejections of MAIL when a non-empty sender has been used, because
525 that blocks the whole domain for all senders. */
059ec3d9
PH
526
527 if (!done)
528 {
2b1c6e3a 529 *failure_ptr = US"mail"; /* At or before MAIL */
059ec3d9
PH
530 if (errno == 0 && responsebuffer[0] == '5')
531 {
532 setflag(addr, af_verify_nsfail);
2b1c6e3a
PH
533 if (from_address[0] == 0)
534 new_domain_record.result = ccache_reject_mfnull;
059ec3d9
PH
535 }
536 }
537
538 /* Otherwise, proceed to check a "random" address (if required), then the
539 given address, and the postmaster address (if required). Between each check,
540 issue RSET, because some servers accept only one recipient after MAIL
2b1c6e3a
PH
541 FROM:<>.
542
543 Before doing this, set the result in the domain cache record to "accept",
544 unless its previous value was ccache_reject_mfnull. In that case, the domain
545 rejects MAIL FROM:<> and we want to continue to remember that. When that is
546 the case, we have got here only in the case of a recipient verification with
547 a non-null sender. */
059ec3d9
PH
548
549 else
550 {
2b1c6e3a
PH
551 new_domain_record.result =
552 (old_domain_cache_result == ccache_reject_mfnull)?
553 ccache_reject_mfnull: ccache_accept;
059ec3d9
PH
554
555 /* Do the random local part check first */
556
557 if (random_local_part != NULL)
558 {
559 uschar randombuffer[1024];
560 BOOL random_ok =
561 smtp_write_command(&outblock, FALSE,
562 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part,
563 addr->domain) >= 0 &&
564 smtp_read_response(&inblock, randombuffer,
565 sizeof(randombuffer), '2', callout);
566
567 /* Remember when we last did a random test */
568
569 new_domain_record.random_stamp = time(NULL);
570
571 /* If accepted, we aren't going to do any further tests below. */
572
573 if (random_ok)
574 {
575 new_domain_record.random_result = ccache_accept;
576 }
577
578 /* Otherwise, cache a real negative response, and get back to the right
579 state to send RCPT. Unless there's some problem such as a dropped
580 connection, we expect to succeed, because the commands succeeded above. */
581
582 else if (errno == 0)
583 {
584 if (randombuffer[0] == '5')
585 new_domain_record.random_result = ccache_reject;
586
587 done =
588 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
589 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
590 '2', callout) &&
591
90e9ce59
PH
592 smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>\r\n",
593 from_address) >= 0 &&
059ec3d9
PH
594 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
595 '2', callout);
596 }
597 else done = FALSE; /* Some timeout/connection problem */
598 } /* Random check */
599
600 /* If the host is accepting all local parts, as determined by the "random"
601 check, we don't need to waste time doing any further checking. */
602
603 if (new_domain_record.random_result != ccache_accept && done)
604 {
5417f6d1
PH
605 /* Get the rcpt_include_affixes flag from the transport if there is one,
606 but assume FALSE if there is not. */
607
059ec3d9
PH
608 done =
609 smtp_write_command(&outblock, FALSE, "RCPT TO:<%.1000s>\r\n",
c688b954 610 transport_rcpt_address(addr,
5417f6d1
PH
611 (addr->transport == NULL)? FALSE :
612 addr->transport->rcpt_include_affixes)) >= 0 &&
059ec3d9
PH
613 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
614 '2', callout);
615
616 if (done)
617 new_address_record.result = ccache_accept;
618 else if (errno == 0 && responsebuffer[0] == '5')
2c7db3f5 619 {
8e669ac1 620 *failure_ptr = US"recipient";
059ec3d9 621 new_address_record.result = ccache_reject;
8e669ac1 622 }
059ec3d9 623
2a4be8f9
PH
624 /* Do postmaster check if requested; if a full check is required, we
625 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
059ec3d9
PH
626
627 if (done && pm_mailfrom != NULL)
628 {
629 done =
630 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
631 smtp_read_response(&inblock, responsebuffer,
632 sizeof(responsebuffer), '2', callout) &&
633
634 smtp_write_command(&outblock, FALSE,
635 "MAIL FROM:<%s>\r\n", pm_mailfrom) >= 0 &&
636 smtp_read_response(&inblock, responsebuffer,
637 sizeof(responsebuffer), '2', callout) &&
638
2a4be8f9
PH
639 /* First try using the current domain */
640
641 ((
059ec3d9
PH
642 smtp_write_command(&outblock, FALSE,
643 "RCPT TO:<postmaster@%.1000s>\r\n", addr->domain) >= 0 &&
644 smtp_read_response(&inblock, responsebuffer,
2a4be8f9
PH
645 sizeof(responsebuffer), '2', callout)
646 )
647
648 ||
649
650 /* If that doesn't work, and a full check is requested,
651 try without the domain. */
652
653 (
654 (options & vopt_callout_fullpm) != 0 &&
655 smtp_write_command(&outblock, FALSE,
656 "RCPT TO:<postmaster>\r\n") >= 0 &&
657 smtp_read_response(&inblock, responsebuffer,
658 sizeof(responsebuffer), '2', callout)
659 ));
660
661 /* Sort out the cache record */
059ec3d9
PH
662
663 new_domain_record.postmaster_stamp = time(NULL);
664
665 if (done)
666 new_domain_record.postmaster_result = ccache_accept;
667 else if (errno == 0 && responsebuffer[0] == '5')
668 {
8e669ac1 669 *failure_ptr = US"postmaster";
059ec3d9
PH
670 setflag(addr, af_verify_pmfail);
671 new_domain_record.postmaster_result = ccache_reject;
672 }
673 }
674 } /* Random not accepted */
90e9ce59 675 } /* MAIL FROM: accepted */
059ec3d9
PH
676
677 /* For any failure of the main check, other than a negative response, we just
678 close the connection and carry on. We can identify a negative response by the
679 fact that errno is zero. For I/O errors it will be non-zero
680
681 Set up different error texts for logging and for sending back to the caller
682 as an SMTP response. Log in all cases, using a one-line format. For sender
683 callouts, give a full response to the caller, but for recipient callouts,
684 don't give the IP address because this may be an internal host whose identity
685 is not to be widely broadcast. */
686
687 if (!done)
688 {
689 if (errno == ETIMEDOUT)
690 {
691 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
8e669ac1 692 send_quit = FALSE;
059ec3d9
PH
693 }
694 else if (errno == 0)
695 {
696 if (*responsebuffer == 0) Ustrcpy(responsebuffer, US"connection dropped");
697
698 addr->message =
699 string_sprintf("response to \"%s\" from %s [%s] was: %s",
700 big_buffer, host->name, host->address,
701 string_printing(responsebuffer));
702
703 addr->user_message = is_recipient?
704 string_sprintf("Callout verification failed:\n%s", responsebuffer)
705 :
706 string_sprintf("Called: %s\nSent: %s\nResponse: %s",
707 host->address, big_buffer, responsebuffer);
708
709 /* Hard rejection ends the process */
710
711 if (responsebuffer[0] == '5') /* Address rejected */
712 {
713 yield = FAIL;
714 done = TRUE;
715 }
716 }
717 }
718
719 /* End the SMTP conversation and close the connection. */
720
c9bdd01c 721 if (send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
f1e894f3 722 (void)close(inblock.sock);
059ec3d9
PH
723 } /* Loop through all hosts, while !done */
724
725/* If we get here with done == TRUE, a successful callout happened, and yield
726will be set OK or FAIL according to the response to the RCPT command.
727Otherwise, we looped through the hosts but couldn't complete the business.
728However, there may be domain-specific information to cache in both cases.
729
730The value of the result field in the new_domain record is ccache_unknown if
90e9ce59 731there was an error before or with MAIL FROM:, and errno was not zero,
059ec3d9 732implying some kind of I/O error. We don't want to write the cache in that case.
2b1c6e3a 733Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
059ec3d9
PH
734
735if (!callout_no_cache && new_domain_record.result != ccache_unknown)
736 {
737 if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
738 == NULL)
739 {
740 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
741 }
742 else
743 {
744 (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
745 (int)sizeof(dbdata_callout_cache));
746 HDEBUG(D_verify) debug_printf("wrote callout cache domain record:\n"
747 " result=%d postmaster=%d random=%d\n",
748 new_domain_record.result,
749 new_domain_record.postmaster_result,
750 new_domain_record.random_result);
751 }
752 }
753
754/* If a definite result was obtained for the callout, cache it unless caching
755is disabled. */
756
757if (done)
758 {
759 if (!callout_no_cache && new_address_record.result != ccache_unknown)
760 {
761 if (dbm_file == NULL)
762 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
763 if (dbm_file == NULL)
764 {
765 HDEBUG(D_verify) debug_printf("no callout cache available\n");
766 }
767 else
768 {
769 (void)dbfn_write(dbm_file, address_key, &new_address_record,
770 (int)sizeof(dbdata_callout_cache_address));
771 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record\n",
772 (new_address_record.result == ccache_accept)? "positive" : "negative");
773 }
774 }
775 } /* done */
776
777/* Failure to connect to any host, or any response other than 2xx or 5xx is a
778temporary error. If there was only one host, and a response was received, leave
779it alone if supplying details. Otherwise, give a generic response. */
780
781else /* !done */
782 {
783 uschar *dullmsg = string_sprintf("Could not complete %s verify callout",
784 is_recipient? "recipient" : "sender");
785 yield = DEFER;
786
787 if (host_list->next != NULL || addr->message == NULL) addr->message = dullmsg;
788
789 addr->user_message = (!smtp_return_error_details)? dullmsg :
790 string_sprintf("%s for <%s>.\n"
791 "The mail server(s) for the domain may be temporarily unreachable, or\n"
792 "they may be permanently unreachable from this server. In the latter case,\n%s",
793 dullmsg, addr->address,
794 is_recipient?
795 "the address will never be accepted."
796 :
797 "you need to change the address or create an MX record for its domain\n"
798 "if it is supposed to be generally accessible from the Internet.\n"
799 "Talk to your mail administrator for details.");
800
801 /* Force a specific error code */
802
803 addr->basic_errno = ERRNO_CALLOUTDEFER;
804 }
805
806/* Come here from within the cache-reading code on fast-track exit. */
807
808END_CALLOUT:
809if (dbm_file != NULL) dbfn_close(dbm_file);
810return yield;
811}
812
813
814
815/*************************************************
816* Copy error to toplevel address *
817*************************************************/
818
819/* This function is used when a verify fails or defers, to ensure that the
820failure or defer information is in the original toplevel address. This applies
821when an address is redirected to a single new address, and the failure or
822deferral happens to the child address.
823
824Arguments:
825 vaddr the verify address item
826 addr the final address item
827 yield FAIL or DEFER
828
829Returns: the value of YIELD
830*/
831
832static int
833copy_error(address_item *vaddr, address_item *addr, int yield)
834{
835if (addr != vaddr)
836 {
837 vaddr->message = addr->message;
838 vaddr->user_message = addr->user_message;
839 vaddr->basic_errno = addr->basic_errno;
840 vaddr->more_errno = addr->more_errno;
b37c4101 841 vaddr->p.address_data = addr->p.address_data;
059ec3d9
PH
842 }
843return yield;
844}
845
846
847
848
849/*************************************************
850* Verify an email address *
851*************************************************/
852
853/* This function is used both for verification (-bv and at other times) and
854address testing (-bt), which is indicated by address_test_mode being set.
855
856Arguments:
857 vaddr contains the address to verify; the next field in this block
858 must be NULL
859 f if not NULL, write the result to this file
860 options various option bits:
861 vopt_fake_sender => this sender verify is not for the real
862 sender (it was verify=sender=xxxx or an address from a
863 header line) - rewriting must not change sender_address
864 vopt_is_recipient => this is a recipient address, otherwise
865 it's a sender address - this affects qualification and
866 rewriting and messages from callouts
867 vopt_qualify => qualify an unqualified address; else error
868 vopt_expn => called from SMTP EXPN command
eafd343b
TK
869 vopt_success_on_redirect => when a new address is generated
870 the verification instantly succeeds
059ec3d9
PH
871
872 These ones are used by do_callout() -- the options variable
873 is passed to it.
874
2a4be8f9 875 vopt_callout_fullpm => if postmaster check, do full one
059ec3d9
PH
876 vopt_callout_no_cache => don't use callout cache
877 vopt_callout_random => do the "random" thing
878 vopt_callout_recipsender => use real sender for recipient
879 vopt_callout_recippmaster => use postmaster for recipient
880
881 callout if > 0, specifies that callout is required, and gives timeout
4deaf07d 882 for individual commands
059ec3d9
PH
883 callout_overall if > 0, gives overall timeout for the callout function;
884 if < 0, a default is used (see do_callout())
8e669ac1 885 callout_connect the connection timeout for callouts
059ec3d9
PH
886 se_mailfrom when callout is requested to verify a sender, use this
887 in MAIL FROM; NULL => ""
888 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
889 thing and use this as the sender address (may be "")
890
891 routed if not NULL, set TRUE if routing succeeded, so we can
892 distinguish between routing failed and callout failed
893
894Returns: OK address verified
895 FAIL address failed to verify
896 DEFER can't tell at present
897*/
898
899int
900verify_address(address_item *vaddr, FILE *f, int options, int callout,
8e669ac1 901 int callout_overall, int callout_connect, uschar *se_mailfrom,
4deaf07d 902 uschar *pm_mailfrom, BOOL *routed)
059ec3d9
PH
903{
904BOOL allok = TRUE;
905BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
906BOOL is_recipient = (options & vopt_is_recipient) != 0;
907BOOL expn = (options & vopt_expn) != 0;
eafd343b 908BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
059ec3d9
PH
909int i;
910int yield = OK;
911int verify_type = expn? v_expn :
912 address_test_mode? v_none :
913 is_recipient? v_recipient : v_sender;
914address_item *addr_list;
915address_item *addr_new = NULL;
916address_item *addr_remote = NULL;
917address_item *addr_local = NULL;
918address_item *addr_succeed = NULL;
8e669ac1 919uschar **failure_ptr = is_recipient?
2c7db3f5 920 &recipient_verify_failure : &sender_verify_failure;
059ec3d9
PH
921uschar *ko_prefix, *cr;
922uschar *address = vaddr->address;
923uschar *save_sender;
924uschar null_sender[] = { 0 }; /* Ensure writeable memory */
925
2c7db3f5
PH
926/* Clear, just in case */
927
928*failure_ptr = NULL;
929
059ec3d9
PH
930/* Set up a prefix and suffix for error message which allow us to use the same
931output statements both in EXPN mode (where an SMTP response is needed) and when
932debugging with an output file. */
933
934if (expn)
935 {
936 ko_prefix = US"553 ";
937 cr = US"\r";
938 }
939else ko_prefix = cr = US"";
940
941/* Add qualify domain if permitted; otherwise an unqualified address fails. */
942
943if (parse_find_at(address) == NULL)
944 {
945 if ((options & vopt_qualify) == 0)
946 {
947 if (f != NULL)
948 fprintf(f, "%sA domain is required for \"%s\"%s\n", ko_prefix, address,
949 cr);
8e669ac1 950 *failure_ptr = US"qualify";
059ec3d9
PH
951 return FAIL;
952 }
953 address = rewrite_address_qualify(address, is_recipient);
954 }
955
956DEBUG(D_verify)
957 {
958 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
959 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
960 }
961
962/* Rewrite and report on it. Clear the domain and local part caches - these
963may have been set by domains and local part tests during an ACL. */
964
965if (global_rewrite_rules != NULL)
966 {
967 uschar *old = address;
968 address = rewrite_address(address, is_recipient, FALSE,
969 global_rewrite_rules, rewrite_existflags);
970 if (address != old)
971 {
972 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
973 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
974 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
975 }
976 }
977
978/* If this is the real sender address, we must update sender_address at
979this point, because it may be referred to in the routers. */
980
981if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
982 sender_address = address;
983
984/* If the address was rewritten to <> no verification can be done, and we have
985to return OK. This rewriting is permitted only for sender addresses; for other
986addresses, such rewriting fails. */
987
988if (address[0] == 0) return OK;
989
990/* Save a copy of the sender address for re-instating if we change it to <>
991while verifying a sender address (a nice bit of self-reference there). */
992
993save_sender = sender_address;
994
995/* Update the address structure with the possibly qualified and rewritten
996address. Set it up as the starting address on the chain of new addresses. */
997
998vaddr->address = address;
999addr_new = vaddr;
1000
1001/* We need a loop, because an address can generate new addresses. We must also
1002cope with generated pipes and files at the top level. (See also the code and
1003comment in deliver.c.) However, it is usually the case that the router for
1004user's .forward files has its verify flag turned off.
1005
1006If an address generates more than one child, the loop is used only when
1007full_info is set, and this can only be set locally. Remote enquiries just get
1008information about the top level address, not anything that it generated. */
1009
1010while (addr_new != NULL)
1011 {
1012 int rc;
1013 address_item *addr = addr_new;
1014
1015 addr_new = addr->next;
1016 addr->next = NULL;
1017
1018 DEBUG(D_verify)
1019 {
1020 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1021 debug_printf("Considering %s\n", addr->address);
1022 }
1023
1024 /* Handle generated pipe, file or reply addresses. We don't get these
1025 when handling EXPN, as it does only one level of expansion. */
1026
1027 if (testflag(addr, af_pfr))
1028 {
1029 allok = FALSE;
1030 if (f != NULL)
1031 {
1032 BOOL allow;
1033
1034 if (addr->address[0] == '>')
1035 {
1036 allow = testflag(addr, af_allow_reply);
1037 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1038 }
1039 else
1040 {
1041 allow = (addr->address[0] == '|')?
1042 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1043 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1044 }
1045
1046 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1047 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1048 "%s\n", addr->message);
1049 else if (allow)
1050 fprintf(f, "\n transport = %s\n", addr->transport->name);
1051 else
1052 fprintf(f, " *** forbidden ***\n");
1053 }
1054 continue;
1055 }
1056
1057 /* Just in case some router parameter refers to it. */
1058
1059 return_path = (addr->p.errors_address != NULL)?
1060 addr->p.errors_address : sender_address;
1061
1062 /* Split the address into domain and local part, handling the %-hack if
1063 necessary, and then route it. While routing a sender address, set
1064 $sender_address to <> because that is what it will be if we were trying to
1065 send a bounce to the sender. */
1066
1067 if (routed != NULL) *routed = FALSE;
1068 if ((rc = deliver_split_address(addr)) == OK)
1069 {
1070 if (!is_recipient) sender_address = null_sender;
1071 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1072 &addr_succeed, verify_type);
1073 sender_address = save_sender; /* Put back the real sender */
1074 }
1075
1076 /* If routing an address succeeded, set the flag that remembers, for use when
1077 an ACL cached a sender verify (in case a callout fails). Then if routing set
1078 up a list of hosts or the transport has a host list, and the callout option
1079 is set, and we aren't in a host checking run, do the callout verification,
1080 and set another flag that notes that a callout happened. */
1081
1082 if (rc == OK)
1083 {
1084 if (routed != NULL) *routed = TRUE;
1085 if (callout > 0)
1086 {
1087 host_item *host_list = addr->host_list;
1088
26da7e20
PH
1089 /* Make up some data for use in the case where there is no remote
1090 transport. */
1091
1092 transport_feedback tf = {
1093 NULL, /* interface (=> any) */
1094 US"smtp", /* port */
1095 US"smtp", /* protocol */
1096 NULL, /* hosts */
1097 US"$smtp_active_hostname", /* helo_data */
1098 FALSE, /* hosts_override */
1099 FALSE, /* hosts_randomize */
1100 FALSE, /* gethostbyname */
1101 TRUE, /* qualify_single */
1102 FALSE /* search_parents */
1103 };
059ec3d9
PH
1104
1105 /* If verification yielded a remote transport, we want to use that
1106 transport's options, so as to mimic what would happen if we were really
1107 sending a message to this address. */
1108
1109 if (addr->transport != NULL && !addr->transport->info->local)
1110 {
929ba01c 1111 (void)(addr->transport->setup)(addr->transport, addr, &tf, 0, 0, NULL);
059ec3d9
PH
1112
1113 /* If the transport has hosts and the router does not, or if the
1114 transport is configured to override the router's hosts, we must build a
1115 host list of the transport's hosts, and find the IP addresses */
1116
1117 if (tf.hosts != NULL && (host_list == NULL || tf.hosts_override))
1118 {
1119 uschar *s;
750af86e
PH
1120 uschar *save_deliver_domain = deliver_domain;
1121 uschar *save_deliver_localpart = deliver_localpart;
059ec3d9
PH
1122
1123 host_list = NULL; /* Ignore the router's hosts */
1124
1125 deliver_domain = addr->domain;
1126 deliver_localpart = addr->local_part;
1127 s = expand_string(tf.hosts);
750af86e
PH
1128 deliver_domain = save_deliver_domain;
1129 deliver_localpart = save_deliver_localpart;
059ec3d9
PH
1130
1131 if (s == NULL)
1132 {
1133 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1134 "\"%s\" in %s transport for callout: %s", tf.hosts,
1135 addr->transport->name, expand_string_message);
1136 }
1137 else
1138 {
322050c2 1139 int flags;
059ec3d9 1140 uschar *canonical_name;
d8ef3577 1141 host_item *host, *nexthost;
059ec3d9
PH
1142 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1143
1144 /* Just ignore failures to find a host address. If we don't manage
8e669ac1
PH
1145 to find any addresses, the callout will defer. Note that more than
1146 one address may be found for a single host, which will result in
1147 additional host items being inserted into the chain. Hence we must
d8ef3577 1148 save the next host first. */
059ec3d9 1149
322050c2
PH
1150 flags = HOST_FIND_BY_A;
1151 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1152 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1153
d8ef3577 1154 for (host = host_list; host != NULL; host = nexthost)
059ec3d9 1155 {
d8ef3577 1156 nexthost = host->next;
8e669ac1 1157 if (tf.gethostbyname ||
7e66e54d 1158 string_is_ip_address(host->name, NULL) != 0)
322050c2 1159 (void)host_find_byname(host, NULL, flags, &canonical_name, TRUE);
059ec3d9 1160 else
059ec3d9
PH
1161 (void)host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1162 &canonical_name, NULL);
059ec3d9
PH
1163 }
1164 }
1165 }
1166 }
1167
8e669ac1 1168 /* Can only do a callout if we have at least one host! If the callout
2c7db3f5 1169 fails, it will have set ${sender,recipient}_verify_failure. */
059ec3d9
PH
1170
1171 if (host_list != NULL)
1172 {
1173 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1174 if (host_checking && !host_checking_callout)
1175 {
1176 HDEBUG(D_verify)
1177 debug_printf("... callout omitted by default when host testing\n"
1178 "(Use -bhc if you want the callouts to happen.)\n");
1179 }
1180 else
1181 {
1182 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
4deaf07d 1183 callout_connect, options, se_mailfrom, pm_mailfrom);
059ec3d9
PH
1184 }
1185 }
1186 else
1187 {
1188 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
1189 "transport provided a host list\n");
1190 }
1191 }
1192 }
8e669ac1 1193
2c7db3f5 1194 /* Otherwise, any failure is a routing failure */
8e669ac1
PH
1195
1196 else *failure_ptr = US"route";
059ec3d9
PH
1197
1198 /* A router may return REROUTED if it has set up a child address as a result
1199 of a change of domain name (typically from widening). In this case we always
1200 want to continue to verify the new child. */
1201
1202 if (rc == REROUTED) continue;
8e669ac1 1203
059ec3d9
PH
1204 /* Handle hard failures */
1205
1206 if (rc == FAIL)
1207 {
1208 allok = FALSE;
1209 if (f != NULL)
1210 {
e6f6568e
PH
1211 address_item *p = addr->parent;
1212
322050c2 1213 fprintf(f, "%s%s %s", ko_prefix, full_info? addr->address : address,
059ec3d9
PH
1214 address_test_mode? "is undeliverable" : "failed to verify");
1215 if (!expn && admin_user)
1216 {
1217 if (addr->basic_errno > 0)
1218 fprintf(f, ": %s", strerror(addr->basic_errno));
1219 if (addr->message != NULL)
e6f6568e
PH
1220 fprintf(f, ": %s", addr->message);
1221 }
1222
1223 /* Show parents iff doing full info */
1224
1225 if (full_info) while (p != NULL)
1226 {
1227 fprintf(f, "%s\n <-- %s", cr, p->address);
1228 p = p->parent;
059ec3d9
PH
1229 }
1230 fprintf(f, "%s\n", cr);
1231 }
1232
1233 if (!full_info) return copy_error(vaddr, addr, FAIL);
1234 else yield = FAIL;
1235 }
1236
1237 /* Soft failure */
1238
1239 else if (rc == DEFER)
1240 {
1241 allok = FALSE;
1242 if (f != NULL)
1243 {
e6f6568e
PH
1244 address_item *p = addr->parent;
1245 fprintf(f, "%s%s cannot be resolved at this time", ko_prefix,
322050c2 1246 full_info? addr->address : address);
059ec3d9
PH
1247 if (!expn && admin_user)
1248 {
1249 if (addr->basic_errno > 0)
e6f6568e 1250 fprintf(f, ": %s", strerror(addr->basic_errno));
059ec3d9 1251 if (addr->message != NULL)
e6f6568e 1252 fprintf(f, ": %s", addr->message);
059ec3d9 1253 else if (addr->basic_errno <= 0)
e6f6568e 1254 fprintf(f, ": unknown error");
059ec3d9
PH
1255 }
1256
e6f6568e
PH
1257 /* Show parents iff doing full info */
1258
1259 if (full_info) while (p != NULL)
1260 {
1261 fprintf(f, "%s\n <-- %s", cr, p->address);
1262 p = p->parent;
1263 }
059ec3d9
PH
1264 fprintf(f, "%s\n", cr);
1265 }
e6f6568e 1266
059ec3d9
PH
1267 if (!full_info) return copy_error(vaddr, addr, DEFER);
1268 else if (yield == OK) yield = DEFER;
1269 }
1270
1271 /* If we are handling EXPN, we do not want to continue to route beyond
e6f6568e 1272 the top level (whose address is in "address"). */
059ec3d9
PH
1273
1274 else if (expn)
1275 {
1276 uschar *ok_prefix = US"250-";
1277 if (addr_new == NULL)
1278 {
1279 if (addr_local == NULL && addr_remote == NULL)
1280 fprintf(f, "250 mail to <%s> is discarded\r\n", address);
1281 else
1282 fprintf(f, "250 <%s>\r\n", address);
1283 }
1284 else while (addr_new != NULL)
1285 {
1286 address_item *addr2 = addr_new;
1287 addr_new = addr2->next;
1288 if (addr_new == NULL) ok_prefix = US"250 ";
1289 fprintf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
1290 }
1291 return OK;
1292 }
1293
1294 /* Successful routing other than EXPN. */
1295
1296 else
1297 {
1298 /* Handle successful routing when short info wanted. Otherwise continue for
1299 other (generated) addresses. Short info is the operational case. Full info
1300 can be requested only when debug_selector != 0 and a file is supplied.
1301
1302 There is a conflict between the use of aliasing as an alternate email
1303 address, and as a sort of mailing list. If an alias turns the incoming
1304 address into just one address (e.g. J.Caesar->jc44) you may well want to
1305 carry on verifying the generated address to ensure it is valid when
1306 checking incoming mail. If aliasing generates multiple addresses, you
1307 probably don't want to do this. Exim therefore treats the generation of
1308 just a single new address as a special case, and continues on to verify the
1309 generated address. */
1310
1311 if (!full_info && /* Stop if short info wanted AND */
eafd343b
TK
1312 (((addr_new == NULL || /* No new address OR */
1313 addr_new->next != NULL || /* More than one new address OR */
1314 testflag(addr_new, af_pfr))) /* New address is pfr */
1315 || /* OR */
1316 (addr_new != NULL && /* At least one new address AND */
1317 success_on_redirect))) /* success_on_redirect is set */
059ec3d9 1318 {
322050c2 1319 if (f != NULL) fprintf(f, "%s %s\n", address,
059ec3d9
PH
1320 address_test_mode? "is deliverable" : "verified");
1321
1322 /* If we have carried on to verify a child address, we want the value
1323 of $address_data to be that of the child */
1324
1325 vaddr->p.address_data = addr->p.address_data;
1326 return OK;
1327 }
1328 }
1329 } /* Loop for generated addresses */
1330
1331/* Display the full results of the successful routing, including any generated
1332addresses. Control gets here only when full_info is set, which requires f not
1333to be NULL, and this occurs only when a top-level verify is called with the
1334debugging switch on.
1335
1336If there are no local and no remote addresses, and there were no pipes, files,
1337or autoreplies, and there were no errors or deferments, the message is to be
1338discarded, usually because of the use of :blackhole: in an alias file. */
1339
1340if (allok && addr_local == NULL && addr_remote == NULL)
dbcef0ea 1341 {
059ec3d9 1342 fprintf(f, "mail to %s is discarded\n", address);
dbcef0ea
PH
1343 return yield;
1344 }
059ec3d9 1345
dbcef0ea 1346for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
059ec3d9
PH
1347 {
1348 while (addr_list != NULL)
1349 {
1350 address_item *addr = addr_list;
1351 address_item *p = addr->parent;
1352 addr_list = addr->next;
1353
1354 fprintf(f, "%s", CS addr->address);
384152a6
TK
1355#ifdef EXPERIMENTAL_SRS
1356 if(addr->p.srs_sender)
1357 fprintf(f, " [srs = %s]", addr->p.srs_sender);
1358#endif
dbcef0ea
PH
1359
1360 /* If the address is a duplicate, show something about it. */
1361
1362 if (!testflag(addr, af_pfr))
1363 {
1364 tree_node *tnode;
1365 if ((tnode = tree_search(tree_duplicates, addr->unique)) != NULL)
1366 fprintf(f, " [duplicate, would not be delivered]");
1367 else tree_add_duplicate(addr->unique, addr);
1368 }
1369
1370 /* Now show its parents */
1371
059ec3d9
PH
1372 while (p != NULL)
1373 {
1374 fprintf(f, "\n <-- %s", p->address);
1375 p = p->parent;
1376 }
1377 fprintf(f, "\n ");
1378
1379 /* Show router, and transport */
1380
1381 fprintf(f, "router = %s, ", addr->router->name);
1382 fprintf(f, "transport = %s\n", (addr->transport == NULL)? US"unset" :
1383 addr->transport->name);
1384
1385 /* Show any hosts that are set up by a router unless the transport
1386 is going to override them; fiddle a bit to get a nice format. */
1387
1388 if (addr->host_list != NULL && addr->transport != NULL &&
1389 !addr->transport->overrides_hosts)
1390 {
1391 host_item *h;
1392 int maxlen = 0;
1393 int maxaddlen = 0;
1394 for (h = addr->host_list; h != NULL; h = h->next)
1395 {
1396 int len = Ustrlen(h->name);
1397 if (len > maxlen) maxlen = len;
1398 len = (h->address != NULL)? Ustrlen(h->address) : 7;
1399 if (len > maxaddlen) maxaddlen = len;
1400 }
1401 for (h = addr->host_list; h != NULL; h = h->next)
1402 {
1403 int len = Ustrlen(h->name);
1404 fprintf(f, " host %s ", h->name);
1405 while (len++ < maxlen) fprintf(f, " ");
1406 if (h->address != NULL)
1407 {
1408 fprintf(f, "[%s] ", h->address);
1409 len = Ustrlen(h->address);
1410 }
1411 else if (!addr->transport->info->local) /* Omit [unknown] for local */
1412 {
1413 fprintf(f, "[unknown] ");
1414 len = 7;
1415 }
1416 else len = -3;
1417 while (len++ < maxaddlen) fprintf(f," ");
1418 if (h->mx >= 0) fprintf(f, "MX=%d", h->mx);
1419 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
1420 if (h->status == hstatus_unusable) fprintf(f, " ** unusable **");
1421 fprintf(f, "\n");
1422 }
1423 }
1424 }
1425 }
1426
8e669ac1 1427/* Will be DEFER or FAIL if any one address has, only for full_info (which is
2c7db3f5
PH
1428the -bv or -bt case). */
1429
8e669ac1 1430return yield;
059ec3d9
PH
1431}
1432
1433
1434
1435
1436/*************************************************
1437* Check headers for syntax errors *
1438*************************************************/
1439
1440/* This function checks those header lines that contain addresses, and verifies
1441that all the addresses therein are syntactially correct.
1442
1443Arguments:
1444 msgptr where to put an error message
1445
1446Returns: OK
1447 FAIL
1448*/
1449
1450int
1451verify_check_headers(uschar **msgptr)
1452{
1453header_line *h;
1454uschar *colon, *s;
1eccaa59 1455int yield = OK;
059ec3d9 1456
1eccaa59 1457for (h = header_list; h != NULL && yield == OK; h = h->next)
059ec3d9
PH
1458 {
1459 if (h->type != htype_from &&
1460 h->type != htype_reply_to &&
1461 h->type != htype_sender &&
1462 h->type != htype_to &&
1463 h->type != htype_cc &&
1464 h->type != htype_bcc)
1465 continue;
1466
1467 colon = Ustrchr(h->text, ':');
1468 s = colon + 1;
1469 while (isspace(*s)) s++;
1470
1eccaa59
PH
1471 /* Loop for multiple addresses in the header, enabling group syntax. Note
1472 that we have to reset this after the header has been scanned. */
059ec3d9 1473
1eccaa59 1474 parse_allow_group = TRUE;
059ec3d9
PH
1475
1476 while (*s != 0)
1477 {
1478 uschar *ss = parse_find_address_end(s, FALSE);
1479 uschar *recipient, *errmess;
1480 int terminator = *ss;
1481 int start, end, domain;
1482
1483 /* Temporarily terminate the string at this point, and extract the
1eccaa59 1484 operative address within, allowing group syntax. */
059ec3d9
PH
1485
1486 *ss = 0;
1487 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
1488 *ss = terminator;
1489
1490 /* Permit an unqualified address only if the message is local, or if the
1491 sending host is configured to be permitted to send them. */
1492
1493 if (recipient != NULL && domain == 0)
1494 {
1495 if (h->type == htype_from || h->type == htype_sender)
1496 {
1497 if (!allow_unqualified_sender) recipient = NULL;
1498 }
1499 else
1500 {
1501 if (!allow_unqualified_recipient) recipient = NULL;
1502 }
1503 if (recipient == NULL) errmess = US"unqualified address not permitted";
1504 }
1505
1506 /* It's an error if no address could be extracted, except for the special
1507 case of an empty address. */
1508
1509 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
1510 {
1511 uschar *verb = US"is";
1512 uschar *t = ss;
1ab95fa6 1513 uschar *tt = colon;
059ec3d9
PH
1514 int len;
1515
1516 /* Arrange not to include any white space at the end in the
1ab95fa6 1517 error message or the header name. */
059ec3d9
PH
1518
1519 while (t > s && isspace(t[-1])) t--;
1ab95fa6 1520 while (tt > h->text && isspace(tt[-1])) tt--;
059ec3d9 1521
1ab95fa6 1522 /* Add the address that failed to the error message, since in a
059ec3d9
PH
1523 header with very many addresses it is sometimes hard to spot
1524 which one is at fault. However, limit the amount of address to
1525 quote - cases have been seen where, for example, a missing double
1526 quote in a humungous To: header creates an "address" that is longer
1527 than string_sprintf can handle. */
1528
1529 len = t - s;
1530 if (len > 1024)
1531 {
1532 len = 1024;
1533 verb = US"begins";
1534 }
1535
1536 *msgptr = string_printing(
1ab95fa6
PH
1537 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
1538 errmess, tt - h->text, h->text, verb, len, s));
059ec3d9 1539
1eccaa59
PH
1540 yield = FAIL;
1541 break; /* Out of address loop */
059ec3d9
PH
1542 }
1543
1544 /* Advance to the next address */
1545
1546 s = ss + (terminator? 1:0);
1547 while (isspace(*s)) s++;
1548 } /* Next address */
059ec3d9 1549
1eccaa59
PH
1550 parse_allow_group = FALSE;
1551 parse_found_group = FALSE;
1552 } /* Next header unless yield has been set FALSE */
1553
1554return yield;
059ec3d9
PH
1555}
1556
1557
1558
1c41c9cc
PH
1559/*************************************************
1560* Check for blind recipients *
1561*************************************************/
1562
1563/* This function checks that every (envelope) recipient is mentioned in either
1564the To: or Cc: header lines, thus detecting blind carbon copies.
1565
1566There are two ways of scanning that could be used: either scan the header lines
1567and tick off the recipients, or scan the recipients and check the header lines.
1568The original proposed patch did the former, but I have chosen to do the latter,
1569because (a) it requires no memory and (b) will use fewer resources when there
1570are many addresses in To: and/or Cc: and only one or two envelope recipients.
1571
1572Arguments: none
1573Returns: OK if there are no blind recipients
1574 FAIL if there is at least one blind recipient
1575*/
1576
1577int
1578verify_check_notblind(void)
1579{
1580int i;
1581for (i = 0; i < recipients_count; i++)
1582 {
1583 header_line *h;
1584 BOOL found = FALSE;
1585 uschar *address = recipients_list[i].address;
1586
1587 for (h = header_list; !found && h != NULL; h = h->next)
1588 {
1589 uschar *colon, *s;
1590
1591 if (h->type != htype_to && h->type != htype_cc) continue;
1592
1593 colon = Ustrchr(h->text, ':');
1594 s = colon + 1;
1595 while (isspace(*s)) s++;
1596
1eccaa59
PH
1597 /* Loop for multiple addresses in the header, enabling group syntax. Note
1598 that we have to reset this after the header has been scanned. */
1c41c9cc 1599
1eccaa59 1600 parse_allow_group = TRUE;
1c41c9cc
PH
1601
1602 while (*s != 0)
1603 {
1604 uschar *ss = parse_find_address_end(s, FALSE);
1605 uschar *recipient,*errmess;
1606 int terminator = *ss;
1607 int start, end, domain;
1608
1609 /* Temporarily terminate the string at this point, and extract the
1eccaa59 1610 operative address within, allowing group syntax. */
1c41c9cc
PH
1611
1612 *ss = 0;
1613 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
1614 *ss = terminator;
1615
1616 /* If we found a valid recipient that has a domain, compare it with the
1617 envelope recipient. Local parts are compared case-sensitively, domains
1618 case-insensitively. By comparing from the start with length "domain", we
1619 include the "@" at the end, which ensures that we are comparing the whole
1620 local part of each address. */
1621
1622 if (recipient != NULL && domain != 0)
1623 {
1624 found = Ustrncmp(recipient, address, domain) == 0 &&
1625 strcmpic(recipient + domain, address + domain) == 0;
1626 if (found) break;
1627 }
1628
1629 /* Advance to the next address */
1630
1631 s = ss + (terminator? 1:0);
1632 while (isspace(*s)) s++;
1633 } /* Next address */
1eccaa59
PH
1634
1635 parse_allow_group = FALSE;
1636 parse_found_group = FALSE;
1c41c9cc
PH
1637 } /* Next header (if found is false) */
1638
1639 if (!found) return FAIL;
1640 } /* Next recipient */
1641
1642return OK;
1643}
1644
1645
059ec3d9
PH
1646
1647/*************************************************
1648* Find if verified sender *
1649*************************************************/
1650
1651/* Usually, just a single address is verified as the sender of the message.
1652However, Exim can be made to verify other addresses as well (often related in
1653some way), and this is useful in some environments. There may therefore be a
1654chain of such addresses that have previously been tested. This function finds
1655whether a given address is on the chain.
1656
1657Arguments: the address to be verified
1658Returns: pointer to an address item, or NULL
1659*/
1660
1661address_item *
1662verify_checked_sender(uschar *sender)
1663{
1664address_item *addr;
1665for (addr = sender_verified_list; addr != NULL; addr = addr->next)
1666 if (Ustrcmp(sender, addr->address) == 0) break;
1667return addr;
1668}
1669
1670
1671
1672
1673
1674/*************************************************
1675* Get valid header address *
1676*************************************************/
1677
1678/* Scan the originator headers of the message, looking for an address that
1679verifies successfully. RFC 822 says:
1680
1681 o The "Sender" field mailbox should be sent notices of
1682 any problems in transport or delivery of the original
1683 messages. If there is no "Sender" field, then the
1684 "From" field mailbox should be used.
1685
1686 o If the "Reply-To" field exists, then the reply should
1687 go to the addresses indicated in that field and not to
1688 the address(es) indicated in the "From" field.
1689
1690So we check a Sender field if there is one, else a Reply_to field, else a From
1691field. As some strange messages may have more than one of these fields,
1692especially if they are resent- fields, check all of them if there is more than
1693one.
1694
1695Arguments:
1696 user_msgptr points to where to put a user error message
1697 log_msgptr points to where to put a log error message
1698 callout timeout for callout check (passed to verify_address())
1699 callout_overall overall callout timeout (ditto)
8e669ac1 1700 callout_connect connect callout timeout (ditto)
059ec3d9
PH
1701 se_mailfrom mailfrom for verify; NULL => ""
1702 pm_mailfrom sender for pm callout check (passed to verify_address())
1703 options callout options (passed to verify_address())
8e669ac1 1704 verrno where to put the address basic_errno
059ec3d9
PH
1705
1706If log_msgptr is set to something without setting user_msgptr, the caller
1707normally uses log_msgptr for both things.
1708
1709Returns: result of the verification attempt: OK, FAIL, or DEFER;
1710 FAIL is given if no appropriate headers are found
1711*/
1712
1713int
1714verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
8e669ac1 1715 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
fe5b5d0b 1716 uschar *pm_mailfrom, int options, int *verrno)
059ec3d9
PH
1717{
1718static int header_types[] = { htype_sender, htype_reply_to, htype_from };
1eccaa59 1719BOOL done = FALSE;
059ec3d9
PH
1720int yield = FAIL;
1721int i;
1722
1eccaa59 1723for (i = 0; i < 3 && !done; i++)
059ec3d9
PH
1724 {
1725 header_line *h;
1eccaa59 1726 for (h = header_list; h != NULL && !done; h = h->next)
059ec3d9
PH
1727 {
1728 int terminator, new_ok;
1729 uschar *s, *ss, *endname;
1730
1731 if (h->type != header_types[i]) continue;
1732 s = endname = Ustrchr(h->text, ':') + 1;
1733
1eccaa59
PH
1734 /* Scan the addresses in the header, enabling group syntax. Note that we
1735 have to reset this after the header has been scanned. */
1736
1737 parse_allow_group = TRUE;
1738
059ec3d9
PH
1739 while (*s != 0)
1740 {
1741 address_item *vaddr;
1742
1743 while (isspace(*s) || *s == ',') s++;
1744 if (*s == 0) break; /* End of header */
1745
1746 ss = parse_find_address_end(s, FALSE);
1747
1748 /* The terminator is a comma or end of header, but there may be white
1749 space preceding it (including newline for the last address). Move back
1750 past any white space so we can check against any cached envelope sender
1751 address verifications. */
1752
1753 while (isspace(ss[-1])) ss--;
1754 terminator = *ss;
1755 *ss = 0;
1756
1757 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
1758 (int)(endname - h->text), h->text, s);
1759
1760 /* See if we have already verified this address as an envelope sender,
1761 and if so, use the previous answer. */
1762
1763 vaddr = verify_checked_sender(s);
1764
1765 if (vaddr != NULL && /* Previously checked */
1766 (callout <= 0 || /* No callout needed; OR */
1767 vaddr->special_action > 256)) /* Callout was done */
1768 {
1769 new_ok = vaddr->special_action & 255;
1770 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
1771 *ss = terminator; /* Restore shortened string */
1772 }
1773
1774 /* Otherwise we run the verification now. We must restore the shortened
1775 string before running the verification, so the headers are correct, in
1776 case there is any rewriting. */
1777
1778 else
1779 {
1780 int start, end, domain;
1eccaa59
PH
1781 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
1782 &domain, FALSE);
059ec3d9
PH
1783
1784 *ss = terminator;
1785
1eccaa59
PH
1786 /* If we found an empty address, just carry on with the next one, but
1787 kill the message. */
1788
1789 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
1790 {
1791 *log_msgptr = NULL;
1792 s = ss;
1793 continue;
1794 }
1795
059ec3d9
PH
1796 /* If verification failed because of a syntax error, fail this
1797 function, and ensure that the failing address gets added to the error
1798 message. */
1799
1800 if (address == NULL)
1801 {
1802 new_ok = FAIL;
1eccaa59
PH
1803 while (ss > s && isspace(ss[-1])) ss--;
1804 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
1805 "scanning for sender: %s in \"%.*s\"",
1806 endname - h->text, h->text, *log_msgptr, ss - s, s);
1807 yield = FAIL;
1808 done = TRUE;
1809 break;
059ec3d9
PH
1810 }
1811
2f6603e1 1812 /* Else go ahead with the sender verification. But it isn't *the*
059ec3d9
PH
1813 sender of the message, so set vopt_fake_sender to stop sender_address
1814 being replaced after rewriting or qualification. */
1815
1816 else
1817 {
1818 vaddr = deliver_make_addr(address, FALSE);
1819 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
8e669ac1 1820 callout, callout_overall, callout_connect, se_mailfrom,
4deaf07d 1821 pm_mailfrom, NULL);
059ec3d9
PH
1822 }
1823 }
1824
1825 /* We now have the result, either newly found, or cached. If we are
1826 giving out error details, set a specific user error. This means that the
1827 last of these will be returned to the user if all three fail. We do not
1828 set a log message - the generic one below will be used. */
1829
fe5b5d0b 1830 if (new_ok != OK)
059ec3d9 1831 {
8e669ac1 1832 *verrno = vaddr->basic_errno;
fe5b5d0b
PH
1833 if (smtp_return_error_details)
1834 {
1835 *user_msgptr = string_sprintf("Rejected after DATA: "
1836 "could not verify \"%.*s\" header address\n%s: %s",
1837 endname - h->text, h->text, vaddr->address, vaddr->message);
1838 }
8e669ac1 1839 }
059ec3d9
PH
1840
1841 /* Success or defer */
1842
1eccaa59
PH
1843 if (new_ok == OK)
1844 {
1845 yield = OK;
1846 done = TRUE;
1847 break;
1848 }
1849
059ec3d9
PH
1850 if (new_ok == DEFER) yield = DEFER;
1851
1852 /* Move on to any more addresses in the header */
1853
1854 s = ss;
1eccaa59
PH
1855 } /* Next address */
1856
1857 parse_allow_group = FALSE;
1858 parse_found_group = FALSE;
1859 } /* Next header, unless done */
1860 } /* Next header type unless done */
059ec3d9
PH
1861
1862if (yield == FAIL && *log_msgptr == NULL)
1863 *log_msgptr = US"there is no valid sender in any header line";
1864
1865if (yield == DEFER && *log_msgptr == NULL)
1866 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
1867
1868return yield;
1869}
1870
1871
1872
1873
1874/*************************************************
1875* Get RFC 1413 identification *
1876*************************************************/
1877
1878/* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
1879the timeout is set to zero, then the query is not done. There may also be lists
1880of hosts and nets which are exempt. To guard against malefactors sending
1881non-printing characters which could, for example, disrupt a message's headers,
1882make sure the string consists of printing characters only.
1883
1884Argument:
1885 port the port to connect to; usually this is IDENT_PORT (113), but when
1886 running in the test harness with -bh a different value is used.
1887
1888Returns: nothing
1889
1890Side effect: any received ident value is put in sender_ident (NULL otherwise)
1891*/
1892
1893void
1894verify_get_ident(int port)
1895{
1896int sock, host_af, qlen;
1897int received_sender_port, received_interface_port, n;
1898uschar *p;
1899uschar buffer[2048];
1900
1901/* Default is no ident. Check whether we want to do an ident check for this
1902host. */
1903
1904sender_ident = NULL;
1905if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
1906 return;
1907
1908DEBUG(D_ident) debug_printf("doing ident callback\n");
1909
1910/* Set up a connection to the ident port of the remote host. Bind the local end
1911to the incoming interface address. If the sender host address is an IPv6
1912address, the incoming interface address will also be IPv6. */
1913
1914host_af = (Ustrchr(sender_host_address, ':') == NULL)? AF_INET : AF_INET6;
1915sock = ip_socket(SOCK_STREAM, host_af);
1916if (sock < 0) return;
1917
1918if (ip_bind(sock, host_af, interface_address, 0) < 0)
1919 {
1920 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
1921 strerror(errno));
1922 goto END_OFF;
1923 }
1924
1925if (ip_connect(sock, host_af, sender_host_address, port, rfc1413_query_timeout)
1926 < 0)
1927 {
1928 if (errno == ETIMEDOUT && (log_extra_selector & LX_ident_timeout) != 0)
1929 {
1930 log_write(0, LOG_MAIN, "ident connection to %s timed out",
1931 sender_host_address);
1932 }
1933 else
1934 {
1935 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
1936 sender_host_address, strerror(errno));
1937 }
1938 goto END_OFF;
1939 }
1940
1941/* Construct and send the query. */
1942
1943sprintf(CS buffer, "%d , %d\r\n", sender_host_port, interface_port);
1944qlen = Ustrlen(buffer);
1945if (send(sock, buffer, qlen, 0) < 0)
1946 {
1947 DEBUG(D_ident) debug_printf("ident send failed: %s\n", strerror(errno));
1948 goto END_OFF;
1949 }
1950
1951/* Read a response line. We put it into the rest of the buffer, using several
1952recv() calls if necessary. */
1953
1954p = buffer + qlen;
1955
1956for (;;)
1957 {
1958 uschar *pp;
1959 int count;
1960 int size = sizeof(buffer) - (p - buffer);
1961
1962 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
1963 count = ip_recv(sock, p, size, rfc1413_query_timeout);
1964 if (count <= 0) goto END_OFF; /* Read error or EOF */
1965
1966 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
1967 generous, and accept a plain \n terminator as well. The only illegal
1968 character is 0. */
1969
1970 for (pp = p; pp < p + count; pp++)
1971 {
1972 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
1973 if (*pp == '\n')
1974 {
1975 if (pp[-1] == '\r') pp--;
1976 *pp = 0;
1977 goto GOT_DATA; /* Break out of both loops */
1978 }
1979 }
1980
1981 /* Reached the end of the data without finding \n. Let the loop continue to
1982 read some more, if there is room. */
1983
1984 p = pp;
1985 }
1986
1987GOT_DATA:
1988
1989/* We have received a line of data. Check it carefully. It must start with the
1990same two port numbers that we sent, followed by data as defined by the RFC. For
1991example,
1992
1993 12345 , 25 : USERID : UNIX :root
1994
1995However, the amount of white space may be different to what we sent. In the
1996"osname" field there may be several sub-fields, comma separated. The data we
1997actually want to save follows the third colon. Some systems put leading spaces
1998in it - we discard those. */
1999
2000if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2001 &received_interface_port, &n) != 2 ||
2002 received_sender_port != sender_host_port ||
2003 received_interface_port != interface_port)
2004 goto END_OFF;
2005
2006p = buffer + qlen + n;
2007while(isspace(*p)) p++;
2008if (*p++ != ':') goto END_OFF;
2009while(isspace(*p)) p++;
2010if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2011p += 6;
2012while(isspace(*p)) p++;
2013if (*p++ != ':') goto END_OFF;
2014while (*p != 0 && *p != ':') p++;
2015if (*p++ == 0) goto END_OFF;
2016while(isspace(*p)) p++;
2017if (*p == 0) goto END_OFF;
2018
2019/* The rest of the line is the data we want. We turn it into printing
2020characters when we save it, so that it cannot mess up the format of any logging
2021or Received: lines into which it gets inserted. We keep a maximum of 127
2022characters. */
2023
2024sender_ident = string_printing(string_copyn(p, 127));
2025DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2026
2027END_OFF:
f1e894f3 2028(void)close(sock);
059ec3d9
PH
2029return;
2030}
2031
2032
2033
2034
2035/*************************************************
2036* Match host to a single host-list item *
2037*************************************************/
2038
2039/* This function compares a host (name or address) against a single item
2040from a host list. The host name gets looked up if it is needed and is not
2041already known. The function is called from verify_check_this_host() via
2042match_check_list(), which is why most of its arguments are in a single block.
2043
2044Arguments:
2045 arg the argument block (see below)
2046 ss the host-list item
2047 valueptr where to pass back looked up data, or NULL
2048 error for error message when returning ERROR
2049
2050The block contains:
32d668a5
PH
2051 host_name (a) the host name, or
2052 (b) NULL, implying use sender_host_name and
2053 sender_host_aliases, looking them up if required, or
2054 (c) the empty string, meaning that only IP address matches
2055 are permitted
059ec3d9
PH
2056 host_address the host address
2057 host_ipv4 the IPv4 address taken from an IPv6 one
2058
2059Returns: OK matched
2060 FAIL did not match
2061 DEFER lookup deferred
32d668a5
PH
2062 ERROR (a) failed to find the host name or IP address, or
2063 (b) unknown lookup type specified, or
2064 (c) host name encountered when only IP addresses are
2065 being matched
059ec3d9
PH
2066*/
2067
32d668a5 2068int
059ec3d9
PH
2069check_host(void *arg, uschar *ss, uschar **valueptr, uschar **error)
2070{
2071check_host_block *cb = (check_host_block *)arg;
32d668a5 2072int mlen = -1;
059ec3d9 2073int maskoffset;
32d668a5 2074BOOL iplookup = FALSE;
059ec3d9 2075BOOL isquery = FALSE;
32d668a5 2076BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
1688f43b 2077uschar *t;
32d668a5 2078uschar *semicolon;
059ec3d9
PH
2079uschar **aliases;
2080
2081/* Optimize for the special case when the pattern is "*". */
2082
2083if (*ss == '*' && ss[1] == 0) return OK;
2084
2085/* If the pattern is empty, it matches only in the case when there is no host -
2086this can occur in ACL checking for SMTP input using the -bs option. In this
2087situation, the host address is the empty string. */
2088
2089if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2090if (*ss == 0) return FAIL;
2091
32d668a5
PH
2092/* If the pattern is precisely "@" then match against the primary host name,
2093provided that host name matching is permitted; if it's "@[]" match against the
2094local host's IP addresses. */
059ec3d9
PH
2095
2096if (*ss == '@')
2097 {
32d668a5
PH
2098 if (ss[1] == 0)
2099 {
2100 if (isiponly) return ERROR;
2101 ss = primary_hostname;
2102 }
059ec3d9
PH
2103 else if (Ustrcmp(ss, "@[]") == 0)
2104 {
2105 ip_address_item *ip;
2106 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
2107 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2108 return FAIL;
2109 }
2110 }
2111
2112/* If the pattern is an IP address, optionally followed by a bitmask count, do
2113a (possibly masked) comparision with the current IP address. */
2114
7e66e54d 2115if (string_is_ip_address(ss, &maskoffset) != 0)
059ec3d9
PH
2116 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2117
1688f43b
PH
2118/* The pattern is not an IP address. A common error that people make is to omit
2119one component of an IPv4 address, either by accident, or believing that, for
2120example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2121which it isn't. (Those applications that do accept 1.2.3 as an IP address
2122interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2123ancient specification.) To aid in debugging these cases, we give a specific
2124error if the pattern contains only digits and dots or contains a slash preceded
2125only by digits and dots (a slash at the start indicates a file name and of
2126course slashes may be present in lookups, but not preceded only by digits and
2127dots). */
2128
2129for (t = ss; isdigit(*t) || *t == '.'; t++);
2130if (*t == 0 || (*t == '/' && t != ss))
2131 {
2132 *error = US"malformed IPv4 address or address mask";
2133 return ERROR;
2134 }
2135
32d668a5 2136/* See if there is a semicolon in the pattern */
059ec3d9 2137
32d668a5
PH
2138semicolon = Ustrchr(ss, ';');
2139
2140/* If we are doing an IP address only match, then all lookups must be IP
df199fec 2141address lookups, even if there is no "net-". */
32d668a5
PH
2142
2143if (isiponly)
059ec3d9 2144 {
32d668a5
PH
2145 iplookup = semicolon != NULL;
2146 }
059ec3d9 2147
32d668a5 2148/* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
df199fec
PH
2149a lookup on a masked IP network, in textual form. We obey this code even if we
2150have already set iplookup, so as to skip over the "net-" prefix and to set the
2151mask length. The net- stuff really only applies to single-key lookups where the
2152key is implicit. For query-style lookups the key is specified in the query.
2153From release 4.30, the use of net- for query style is no longer needed, but we
2154retain it for backward compatibility. */
2155
2156if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
32d668a5
PH
2157 {
2158 mlen = 0;
2159 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2160 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2161 iplookup = (*t++ == '-');
2162 }
1688f43b 2163else t = ss;
059ec3d9 2164
32d668a5 2165/* Do the IP address lookup if that is indeed what we have */
059ec3d9 2166
32d668a5
PH
2167if (iplookup)
2168 {
2169 int insize;
2170 int search_type;
2171 int incoming[4];
2172 void *handle;
2173 uschar *filename, *key, *result;
2174 uschar buffer[64];
059ec3d9 2175
32d668a5 2176 /* Find the search type */
059ec3d9 2177
32d668a5 2178 search_type = search_findtype(t, semicolon - t);
059ec3d9 2179
32d668a5
PH
2180 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2181 search_error_message);
059ec3d9 2182
13b685f9
PH
2183 /* Adjust parameters for the type of lookup. For a query-style lookup, there
2184 is no file name, and the "key" is just the query. For query-style with a file
2185 name, we have to fish the file off the start of the query. For a single-key
2186 lookup, the key is the current IP address, masked appropriately, and
2187 reconverted to text form, with the mask appended. For IPv6 addresses, specify
2188 dot separators instead of colons. */
059ec3d9 2189
13b685f9
PH
2190 if (mac_islookup(search_type, lookup_absfilequery))
2191 {
2192 filename = semicolon + 1;
2193 key = filename;
2194 while (*key != 0 && !isspace(*key)) key++;
2195 filename = string_copyn(filename, key - filename);
2196 while (isspace(*key)) key++;
2197 }
2198 else if (mac_islookup(search_type, lookup_querystyle))
32d668a5
PH
2199 {
2200 filename = NULL;
2201 key = semicolon + 1;
2202 }
2203 else
2204 {
2205 insize = host_aton(cb->host_address, incoming);
2206 host_mask(insize, incoming, mlen);
2207 (void)host_nmtoa(insize, incoming, mlen, buffer, '.');
2208 key = buffer;
2209 filename = semicolon + 1;
059ec3d9 2210 }
32d668a5
PH
2211
2212 /* Now do the actual lookup; note that there is no search_close() because
2213 of the caching arrangements. */
2214
2215 handle = search_open(filename, search_type, 0, NULL, NULL);
2216 if (handle == NULL) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2217 search_error_message);
2218 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
2219 if (valueptr != NULL) *valueptr = result;
2220 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
059ec3d9
PH
2221 }
2222
2223/* The pattern is not an IP address or network reference of any kind. That is,
32d668a5
PH
2224it is a host name pattern. If this is an IP only match, there's an error in the
2225host list. */
2226
2227if (isiponly)
2228 {
2229 *error = US"cannot match host name in match_ip list";
2230 return ERROR;
2231 }
2232
2233/* Check the characters of the pattern to see if they comprise only letters,
2234digits, full stops, and hyphens (the constituents of domain names). Allow
2235underscores, as they are all too commonly found. Sigh. Also, if
2236allow_utf8_domains is set, allow top-bit characters. */
059ec3d9
PH
2237
2238for (t = ss; *t != 0; t++)
2239 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
2240 (!allow_utf8_domains || *t < 128)) break;
2241
2242/* If the pattern is a complete domain name, with no fancy characters, look up
2243its IP address and match against that. Note that a multi-homed host will add
2244items to the chain. */
2245
2246if (*t == 0)
2247 {
2248 int rc;
2249 host_item h;
2250 h.next = NULL;
2251 h.name = ss;
2252 h.address = NULL;
2253 h.mx = MX_NONE;
9b8fadde 2254
322050c2 2255 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
059ec3d9
PH
2256 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
2257 {
2258 host_item *hh;
2259 for (hh = &h; hh != NULL; hh = hh->next)
2260 {
96776534 2261 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
059ec3d9
PH
2262 }
2263 return FAIL;
2264 }
2265 if (rc == HOST_FIND_AGAIN) return DEFER;
2266 *error = string_sprintf("failed to find IP address for %s", ss);
2267 return ERROR;
2268 }
2269
2270/* Almost all subsequent comparisons require the host name, and can be done
2271using the general string matching function. When this function is called for
2272outgoing hosts, the name is always given explicitly. If it is NULL, it means we
2273must use sender_host_name and its aliases, looking them up if necessary. */
2274
2275if (cb->host_name != NULL) /* Explicit host name given */
2276 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
2277 valueptr);
2278
2279/* Host name not given; in principle we need the sender host name and its
2280aliases. However, for query-style lookups, we do not need the name if the
2281query does not contain $sender_host_name. From release 4.23, a reference to
2282$sender_host_name causes it to be looked up, so we don't need to do the lookup
2283on spec. */
2284
2285if ((semicolon = Ustrchr(ss, ';')) != NULL)
2286 {
2287 uschar *affix;
2288 int partial, affixlen, starflags, id;
2289
2290 *semicolon = 0;
2291 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
2292 *semicolon=';';
2293
2294 if (id < 0) /* Unknown lookup type */
2295 {
2296 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
2297 search_error_message, ss);
2298 return DEFER;
2299 }
13b685f9 2300 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
059ec3d9
PH
2301 }
2302
2303if (isquery)
2304 {
2305 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
2306 {
2307 case OK: return OK;
2308 case DEFER: return DEFER;
2309 default: return FAIL;
2310 }
2311 }
2312
2313/* Not a query-style lookup; must ensure the host name is present, and then we
2314do a check on the name and all its aliases. */
2315
2316if (sender_host_name == NULL)
2317 {
2318 HDEBUG(D_host_lookup)
2319 debug_printf("sender host name required, to match against %s\n", ss);
2320 if (host_lookup_failed || host_name_lookup() != OK)
2321 {
2322 *error = string_sprintf("failed to find host name for %s",
2323 sender_host_address);;
2324 return ERROR;
2325 }
2326 host_build_sender_fullhost();
2327 }
2328
2329/* Match on the sender host name, using the general matching function */
2330
2331switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
2332 valueptr))
2333 {
2334 case OK: return OK;
2335 case DEFER: return DEFER;
2336 }
2337
2338/* If there are aliases, try matching on them. */
2339
2340aliases = sender_host_aliases;
2341while (*aliases != NULL)
2342 {
2343 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
2344 {
2345 case OK: return OK;
2346 case DEFER: return DEFER;
2347 }
2348 }
2349return FAIL;
2350}
2351
2352
2353
2354
2355/*************************************************
2356* Check a specific host matches a host list *
2357*************************************************/
2358
2359/* This function is passed a host list containing items in a number of
2360different formats and the identity of a host. Its job is to determine whether
2361the given host is in the set of hosts defined by the list. The host name is
2362passed as a pointer so that it can be looked up if needed and not already
2363known. This is commonly the case when called from verify_check_host() to check
2364an incoming connection. When called from elsewhere the host name should usually
2365be set.
2366
2367This function is now just a front end to match_check_list(), which runs common
2368code for scanning a list. We pass it the check_host() function to perform a
2369single test.
2370
2371Arguments:
2372 listptr pointer to the host list
2373 cache_bits pointer to cache for named lists, or NULL
2374 host_name the host name or NULL, implying use sender_host_name and
2375 sender_host_aliases, looking them up if required
2376 host_address the IP address
2377 valueptr if not NULL, data from a lookup is passed back here
2378
2379Returns: OK if the host is in the defined set
2380 FAIL if the host is not in the defined set,
2381 DEFER if a data lookup deferred (not a host lookup)
2382
2383If the host name was needed in order to make a comparison, and could not be
2384determined from the IP address, the result is FAIL unless the item
2385"+allow_unknown" was met earlier in the list, in which case OK is returned. */
2386
2387int
2388verify_check_this_host(uschar **listptr, unsigned int *cache_bits,
2389 uschar *host_name, uschar *host_address, uschar **valueptr)
2390{
d4eb88df 2391int rc;
059ec3d9 2392unsigned int *local_cache_bits = cache_bits;
d4eb88df 2393uschar *save_host_address = deliver_host_address;
059ec3d9
PH
2394check_host_block cb;
2395cb.host_name = host_name;
2396cb.host_address = host_address;
2397
2398if (valueptr != NULL) *valueptr = NULL;
2399
2400/* If the host address starts off ::ffff: it is an IPv6 address in
2401IPv4-compatible mode. Find the IPv4 part for checking against IPv4
2402addresses. */
2403
2404cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
2405 host_address + 7 : host_address;
2406
8e669ac1
PH
2407/* During the running of the check, put the IP address into $host_address. In
2408the case of calls from the smtp transport, it will already be there. However,
2409in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
d4eb88df
PH
2410the safe side, any existing setting is preserved, though as I write this
2411(November 2004) I can't see any cases where it is actually needed. */
2412
2413deliver_host_address = host_address;
2414rc = match_check_list(
2415 listptr, /* the list */
2416 0, /* separator character */
2417 &hostlist_anchor, /* anchor pointer */
2418 &local_cache_bits, /* cache pointer */
2419 check_host, /* function for testing */
2420 &cb, /* argument for function */
2421 MCL_HOST, /* type of check */
8e669ac1 2422 (host_address == sender_host_address)?
d4eb88df
PH
2423 US"host" : host_address, /* text for debugging */
2424 valueptr); /* where to pass back data */
2425deliver_host_address = save_host_address;
8e669ac1 2426return rc;
059ec3d9
PH
2427}
2428
2429
2430
2431
2432/*************************************************
2433* Check the remote host matches a list *
2434*************************************************/
2435
2436/* This is a front end to verify_check_this_host(), created because checking
2437the remote host is a common occurrence. With luck, a good compiler will spot
2438the tail recursion and optimize it. If there's no host address, this is
2439command-line SMTP input - check against an empty string for the address.
2440
2441Arguments:
2442 listptr pointer to the host list
2443
2444Returns: the yield of verify_check_this_host(),
2445 i.e. OK, FAIL, or DEFER
2446*/
2447
2448int
2449verify_check_host(uschar **listptr)
2450{
2451return verify_check_this_host(listptr, sender_host_cache, NULL,
2452 (sender_host_address == NULL)? US"" : sender_host_address, NULL);
2453}
2454
2455
2456
2457
2458
2459/*************************************************
2460* Invert an IP address for a DNS black list *
2461*************************************************/
2462
2463/*
2464Arguments:
2465 buffer where to put the answer
2466 address the address to invert
2467*/
2468
2469static void
2470invert_address(uschar *buffer, uschar *address)
2471{
2472int bin[4];
2473uschar *bptr = buffer;
2474
2475/* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
2476to the IPv4 part only. */
2477
2478if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
2479
2480/* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
2481always 1. */
2482
2483if (host_aton(address, bin) == 1)
2484 {
2485 int i;
2486 int x = bin[0];
2487 for (i = 0; i < 4; i++)
2488 {
2489 sprintf(CS bptr, "%d.", x & 255);
2490 while (*bptr) bptr++;
2491 x >>= 8;
2492 }
2493 }
2494
2495/* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
2496in any DNS black lists, and the format in which they will be looked up is
2497unknown. This is just a guess. */
2498
2499#if HAVE_IPV6
2500else
2501 {
2502 int i, j;
2503 for (j = 3; j >= 0; j--)
2504 {
2505 int x = bin[j];
2506 for (i = 0; i < 8; i++)
2507 {
2508 sprintf(CS bptr, "%x.", x & 15);
2509 while (*bptr) bptr++;
2510 x >>= 4;
2511 }
2512 }
2513 }
2514#endif
d6f6e0dc
PH
2515
2516/* Remove trailing period -- this is needed so that both arbitrary
2517dnsbl keydomains and inverted addresses may be combined with the
2518same format string, "%s.%s" */
2519
2520*(--bptr) = 0;
059ec3d9
PH
2521}
2522
2523
2524
2525/*************************************************
0bcb2a0e
PH
2526* Perform a single dnsbl lookup *
2527*************************************************/
2528
d6f6e0dc
PH
2529/* This function is called from verify_check_dnsbl() below. It is also called
2530recursively from within itself when domain and domain_txt are different
2531pointers, in order to get the TXT record from the alternate domain.
0bcb2a0e
PH
2532
2533Arguments:
d6f6e0dc
PH
2534 domain the outer dnsbl domain
2535 domain_txt alternate domain to lookup TXT record on success; when the
2536 same domain is to be used, domain_txt == domain (that is,
2537 the pointers must be identical, not just the text)
8e669ac1 2538 keydomain the current keydomain (for debug message)
d6f6e0dc
PH
2539 prepend subdomain to lookup (like keydomain, but
2540 reversed if IP address)
2541 iplist the list of matching IP addresses, or NULL for "any"
8e669ac1
PH
2542 bitmask true if bitmask matching is wanted
2543 invert_result true if result to be inverted
2544 defer_return what to return for a defer
0bcb2a0e
PH
2545
2546Returns: OK if lookup succeeded
2547 FAIL if not
2548*/
2549
2550static int
d6f6e0dc
PH
2551one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain,
2552 uschar *prepend, uschar *iplist, BOOL bitmask, BOOL invert_result,
2553 int defer_return)
8e669ac1 2554{
0bcb2a0e
PH
2555dns_answer dnsa;
2556dns_scan dnss;
2557tree_node *t;
2558dnsbl_cache_block *cb;
2559int old_pool = store_pool;
d6f6e0dc
PH
2560uschar query[256]; /* DNS domain max length */
2561
2562/* Construct the specific query domainname */
2563
2564if (!string_format(query, sizeof(query), "%s.%s", prepend, domain))
2565 {
2566 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
2567 "(ignored): %s...", query);
2568 return FAIL;
2569 }
0bcb2a0e
PH
2570
2571/* Look for this query in the cache. */
2572
2573t = tree_search(dnsbl_cache, query);
2574
2575/* If not cached from a previous lookup, we must do a DNS lookup, and
2576cache the result in permanent memory. */
2577
2578if (t == NULL)
2579 {
2580 store_pool = POOL_PERM;
2581
2582 /* Set up a tree entry to cache the lookup */
2583
2584 t = store_get(sizeof(tree_node) + Ustrlen(query));
2585 Ustrcpy(t->name, query);
2586 t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block));
2587 (void)tree_insertnode(&dnsbl_cache, t);
2588
2589 /* Do the DNS loopup . */
2590
2591 HDEBUG(D_dnsbl) debug_printf("new DNS lookup for %s\n", query);
2592 cb->rc = dns_basic_lookup(&dnsa, query, T_A);
2593 cb->text_set = FALSE;
2594 cb->text = NULL;
2595 cb->rhs = NULL;
2596
2597 /* If the lookup succeeded, cache the RHS address. The code allows for
2598 more than one address - this was for complete generality and the possible
2599 use of A6 records. However, A6 records have been reduced to experimental
2600 status (August 2001) and may die out. So they may never get used at all,
2601 let alone in dnsbl records. However, leave the code here, just in case.
2602
2603 Quite apart from one A6 RR generating multiple addresses, there are DNS
2604 lists that return more than one A record, so we must handle multiple
2605 addresses generated in that way as well. */
2606
2607 if (cb->rc == DNS_SUCCEED)
2608 {
2609 dns_record *rr;
2610 dns_address **addrp = &(cb->rhs);
2611 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2612 rr != NULL;
2613 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2614 {
2615 if (rr->type == T_A)
2616 {
2617 dns_address *da = dns_address_from_rr(&dnsa, rr);
2618 if (da != NULL)
2619 {
2620 *addrp = da;
2621 while (da->next != NULL) da = da->next;
2622 addrp = &(da->next);
2623 }
2624 }
2625 }
2626
2627 /* If we didn't find any A records, change the return code. This can
2628 happen when there is a CNAME record but there are no A records for what
2629 it points to. */
2630
2631 if (cb->rhs == NULL) cb->rc = DNS_NODATA;
2632 }
2633
2634 store_pool = old_pool;
2635 }
2636
2637/* Previous lookup was cached */
2638
2639else
2640 {
2641 HDEBUG(D_dnsbl) debug_printf("using result of previous DNS lookup\n");
2642 cb = t->data.ptr;
2643 }
2644
2645/* We now have the result of the DNS lookup, either newly done, or cached
2646from a previous call. If the lookup succeeded, check against the address
2647list if there is one. This may be a positive equality list (introduced by
2648"="), a negative equality list (introduced by "!="), a positive bitmask
2649list (introduced by "&"), or a negative bitmask list (introduced by "!&").*/
2650
2651if (cb->rc == DNS_SUCCEED)
2652 {
2653 dns_address *da = NULL;
2654 uschar *addlist = cb->rhs->address;
2655
2656 /* For A and AAAA records, there may be multiple addresses from multiple
2657 records. For A6 records (currently not expected to be used) there may be
2658 multiple addresses from a single record. */
2659
2660 for (da = cb->rhs->next; da != NULL; da = da->next)
2661 addlist = string_sprintf("%s, %s", addlist, da->address);
2662
2663 HDEBUG(D_dnsbl) debug_printf("DNS lookup for %s succeeded (yielding %s)\n",
2664 query, addlist);
2665
2666 /* Address list check; this can be either for equality, or via a bitmask.
2667 In the latter case, all the bits must match. */
2668
2669 if (iplist != NULL)
2670 {
2671 int ipsep = ',';
2672 uschar ip[46];
2673 uschar *ptr = iplist;
2674
2675 while (string_nextinlist(&ptr, &ipsep, ip, sizeof(ip)) != NULL)
2676 {
2677 /* Handle exact matching */
2678 if (!bitmask)
2679 {
2680 for (da = cb->rhs; da != NULL; da = da->next)
2681 {
2682 if (Ustrcmp(CS da->address, ip) == 0) break;
2683 }
2684 }
2685 /* Handle bitmask matching */
2686 else
2687 {
2688 int address[4];
2689 int mask = 0;
2690
2691 /* At present, all known DNS blocking lists use A records, with
2692 IPv4 addresses on the RHS encoding the information they return. I
2693 wonder if this will linger on as the last vestige of IPv4 when IPv6
2694 is ubiquitous? Anyway, for now we use paranoia code to completely
2695 ignore IPv6 addresses. The default mask is 0, which always matches.
2696 We change this only for IPv4 addresses in the list. */
2697
2698 if (host_aton(ip, address) == 1) mask = address[0];
2699
2700 /* Scan the returned addresses, skipping any that are IPv6 */
2701
2702 for (da = cb->rhs; da != NULL; da = da->next)
2703 {
2704 if (host_aton(da->address, address) != 1) continue;
2705 if ((address[0] & mask) == mask) break;
2706 }
2707 }
2708
2709 /* Break out if a match has been found */
2710
2711 if (da != NULL) break;
2712 }
2713
2714 /* If either
2715
2716 (a) No IP address in a positive list matched, or
2717 (b) An IP address in a negative list did match
2718
2719 then behave as if the DNSBL lookup had not succeeded, i.e. the host is
2720 not on the list. */
2721
2722 if (invert_result != (da == NULL))
2723 {
2724 HDEBUG(D_dnsbl)
2725 {
2726 debug_printf("=> but we are not accepting this block class because\n");
2727 debug_printf("=> there was %s match for %c%s\n",
2728 invert_result? "an exclude":"no", bitmask? '&' : '=', iplist);
2729 }
8e669ac1 2730 return FAIL;
0bcb2a0e
PH
2731 }
2732 }
2733
d6f6e0dc
PH
2734 /* Either there was no IP list, or the record matched, implying that the
2735 domain is on the list. We now want to find a corresponding TXT record. If an
2736 alternate domain is specified for the TXT record, call this function
2737 recursively to look that up; this has the side effect of re-checking that
2738 there is indeed an A record at the alternate domain. */
2739
2740 if (domain_txt != domain)
2741 return one_check_dnsbl(domain_txt, domain_txt, keydomain, prepend, NULL,
2742 FALSE, invert_result, defer_return);
2743
2744 /* If there is no alternate domain, look up a TXT record in the main domain
2745 if it has not previously been cached. */
0bcb2a0e
PH
2746
2747 if (!cb->text_set)
2748 {
2749 cb->text_set = TRUE;
2750 if (dns_basic_lookup(&dnsa, query, T_TXT) == DNS_SUCCEED)
2751 {
2752 dns_record *rr;
2753 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2754 rr != NULL;
2755 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2756 if (rr->type == T_TXT) break;
2757 if (rr != NULL)
2758 {
2759 int len = (rr->data)[0];
2760 if (len > 511) len = 127;
2761 store_pool = POOL_PERM;
2762 cb->text = string_sprintf("%.*s", len, (const uschar *)(rr->data+1));
2763 store_pool = old_pool;
2764 }
2765 }
2766 }
2767
2768 dnslist_value = addlist;
2769 dnslist_text = cb->text;
2770 return OK;
2771 }
2772
2773/* There was a problem with the DNS lookup */
2774
2775if (cb->rc != DNS_NOMATCH && cb->rc != DNS_NODATA)
2776 {
2777 log_write(L_dnslist_defer, LOG_MAIN,
2778 "DNS list lookup defer (probably timeout) for %s: %s", query,
2779 (defer_return == OK)? US"assumed in list" :
2780 (defer_return == FAIL)? US"assumed not in list" :
2781 US"returned DEFER");
2782 return defer_return;
2783 }
2784
2785/* No entry was found in the DNS; continue for next domain */
2786
2787HDEBUG(D_dnsbl)
2788 {
2789 debug_printf("DNS lookup for %s failed\n", query);
2790 debug_printf("=> that means %s is not listed at %s\n",
2791 keydomain, domain);
2792 }
2793
2794return FAIL;
2795}
2796
2797
2798
2799
2800/*************************************************
059ec3d9
PH
2801* Check host against DNS black lists *
2802*************************************************/
2803
2804/* This function runs checks against a list of DNS black lists, until one
2805matches. Each item on the list can be of the form
2806
2807 domain=ip-address/key
2808
2809The domain is the right-most domain that is used for the query, for example,
2810blackholes.mail-abuse.org. If the IP address is present, there is a match only
2811if the DNS lookup returns a matching IP address. Several addresses may be
2812given, comma-separated, for example: x.y.z=127.0.0.1,127.0.0.2.
2813
2814If no key is given, what is looked up in the domain is the inverted IP address
2815of the current client host. If a key is given, it is used to construct the
d6f6e0dc 2816domain for the lookup. For example:
059ec3d9
PH
2817
2818 dsn.rfc-ignorant.org/$sender_address_domain
2819
2820After finding a match in the DNS, the domain is placed in $dnslist_domain, and
2821then we check for a TXT record for an error message, and if found, save its
2822value in $dnslist_text. We also cache everything in a tree, to optimize
2823multiple lookups.
2824
d6f6e0dc
PH
2825The TXT record is normally looked up in the same domain as the A record, but
2826when many lists are combined in a single DNS domain, this will not be a very
2827specific message. It is possible to specify a different domain for looking up
2828TXT records; this is given before the main domain, comma-separated. For
2829example:
2830
2831 dnslists = http.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.2 : \
2832 socks.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.3
2833
2834The caching ensures that only one lookup in dnsbl.sorbs.net is done.
2835
059ec3d9
PH
2836Note: an address for testing RBL is 192.203.178.39
2837Note: an address for testing DUL is 192.203.178.4
2838Note: a domain for testing RFCI is example.tld.dsn.rfc-ignorant.org
2839
2840Arguments:
2841 listptr the domain/address/data list
2842
2843Returns: OK successful lookup (i.e. the address is on the list), or
2844 lookup deferred after +include_unknown
2845 FAIL name not found, or no data found for the given type, or
2846 lookup deferred after +exclude_unknown (default)
2847 DEFER lookup failure, if +defer_unknown was set
2848*/
2849
2850int
2851verify_check_dnsbl(uschar **listptr)
2852{
2853int sep = 0;
2854int defer_return = FAIL;
059ec3d9
PH
2855BOOL invert_result = FALSE;
2856uschar *list = *listptr;
2857uschar *domain;
2858uschar *s;
2859uschar buffer[1024];
059ec3d9
PH
2860uschar revadd[128]; /* Long enough for IPv6 address */
2861
2862/* Indicate that the inverted IP address is not yet set up */
2863
2864revadd[0] = 0;
2865
0bcb2a0e
PH
2866/* In case this is the first time the DNS resolver is being used. */
2867
2868dns_init(FALSE, FALSE);
2869
059ec3d9
PH
2870/* Loop through all the domains supplied, until something matches */
2871
2872while ((domain = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
2873 {
0bcb2a0e 2874 int rc;
059ec3d9 2875 BOOL bitmask = FALSE;
d6f6e0dc
PH
2876 uschar *domain_txt;
2877 uschar *comma;
059ec3d9
PH
2878 uschar *iplist;
2879 uschar *key;
059ec3d9
PH
2880
2881 HDEBUG(D_dnsbl) debug_printf("DNS list check: %s\n", domain);
2882
2883 /* Deal with special values that change the behaviour on defer */
2884
2885 if (domain[0] == '+')
2886 {
2887 if (strcmpic(domain, US"+include_unknown") == 0) defer_return = OK;
2888 else if (strcmpic(domain, US"+exclude_unknown") == 0) defer_return = FAIL;
2889 else if (strcmpic(domain, US"+defer_unknown") == 0) defer_return = DEFER;
2890 else
2891 log_write(0, LOG_MAIN|LOG_PANIC, "unknown item in dnslist (ignored): %s",
2892 domain);
2893 continue;
2894 }
2895
2896 /* See if there's explicit data to be looked up */
2897
2898 key = Ustrchr(domain, '/');
2899 if (key != NULL) *key++ = 0;
2900
2901 /* See if there's a list of addresses supplied after the domain name. This is
2902 introduced by an = or a & character; if preceded by ! we invert the result.
2903 */
2904
2905 iplist = Ustrchr(domain, '=');
2906 if (iplist == NULL)
2907 {
2908 bitmask = TRUE;
2909 iplist = Ustrchr(domain, '&');
2910 }
2911
2912 if (iplist != NULL)
2913 {
2914 if (iplist > domain && iplist[-1] == '!')
2915 {
2916 invert_result = TRUE;
2917 iplist[-1] = 0;
2918 }
2919 *iplist++ = 0;
2920 }
2921
d6f6e0dc
PH
2922 /* If there is a comma in the domain, it indicates that a second domain for
2923 looking up TXT records is provided, before the main domain. Otherwise we must
2924 set domain_txt == domain. */
2925
2926 domain_txt = domain;
2927 comma = Ustrchr(domain, ',');
2928 if (comma != NULL)
2929 {
2930 *comma++ = 0;
2931 domain = comma;
2932 }
2933
059ec3d9
PH
2934 /* Check that what we have left is a sensible domain name. There is no reason
2935 why these domains should in fact use the same syntax as hosts and email
2936 domains, but in practice they seem to. However, there is little point in
2937 actually causing an error here, because that would no doubt hold up incoming
2938 mail. Instead, I'll just log it. */
2939
2940 for (s = domain; *s != 0; s++)
2941 {
2942 if (!isalnum(*s) && *s != '-' && *s != '.')
2943 {
2944 log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains "
2945 "strange characters - is this right?", domain);
2946 break;
2947 }
2948 }
2949
d6f6e0dc
PH
2950 /* Check the alternate domain if present */
2951
2952 if (domain_txt != domain) for (s = domain_txt; *s != 0; s++)
2953 {
2954 if (!isalnum(*s) && *s != '-' && *s != '.')
2955 {
2956 log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains "
2957 "strange characters - is this right?", domain_txt);
2958 break;
2959 }
2960 }
2961
8e669ac1 2962 /* If there is no key string, construct the query by adding the domain name
0bcb2a0e 2963 onto the inverted host address, and perform a single DNS lookup. */
8e669ac1 2964
059ec3d9
PH
2965 if (key == NULL)
2966 {
2967 if (sender_host_address == NULL) return FAIL; /* can never match */
2968 if (revadd[0] == 0) invert_address(revadd, sender_host_address);
d6f6e0dc
PH
2969 rc = one_check_dnsbl(domain, domain_txt, sender_host_address, revadd,
2970 iplist, bitmask, invert_result, defer_return);
0bcb2a0e
PH
2971 if (rc == OK)
2972 {
d6f6e0dc 2973 dnslist_domain = string_copy(domain_txt);
8e669ac1 2974 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
d6f6e0dc 2975 sender_host_address, dnslist_domain);
0bcb2a0e 2976 }
0bcb2a0e 2977 if (rc != FAIL) return rc; /* OK or DEFER */
059ec3d9 2978 }
8e669ac1
PH
2979
2980 /* If there is a key string, it can be a list of domains or IP addresses to
0bcb2a0e 2981 be concatenated with the main domain. */
8e669ac1 2982
059ec3d9
PH
2983 else
2984 {
0bcb2a0e 2985 int keysep = 0;
8e669ac1
PH
2986 BOOL defer = FALSE;
2987 uschar *keydomain;
0bcb2a0e 2988 uschar keybuffer[256];
d6f6e0dc 2989 uschar keyrevadd[128];
8e669ac1
PH
2990
2991 while ((keydomain = string_nextinlist(&key, &keysep, keybuffer,
0bcb2a0e 2992 sizeof(keybuffer))) != NULL)
8e669ac1 2993 {
d6f6e0dc
PH
2994 uschar *prepend = keydomain;
2995
7e66e54d 2996 if (string_is_ip_address(keydomain, NULL) != 0)
059ec3d9 2997 {
0bcb2a0e 2998 invert_address(keyrevadd, keydomain);
d6f6e0dc 2999 prepend = keyrevadd;
059ec3d9 3000 }
8e669ac1 3001
d6f6e0dc
PH
3002 rc = one_check_dnsbl(domain, domain_txt, keydomain, prepend, iplist,
3003 bitmask, invert_result, defer_return);
8e669ac1 3004
0bcb2a0e 3005 if (rc == OK)
059ec3d9 3006 {
d6f6e0dc 3007 dnslist_domain = string_copy(domain_txt);
8e669ac1 3008 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
d6f6e0dc 3009 keydomain, dnslist_domain);
8e669ac1 3010 return OK;
059ec3d9 3011 }
8e669ac1 3012
c38d6da9
PH
3013 /* If the lookup deferred, remember this fact. We keep trying the rest
3014 of the list to see if we get a useful result, and if we don't, we return
3015 DEFER at the end. */
059ec3d9 3016
c38d6da9 3017 if (rc == DEFER) defer = TRUE;
0bcb2a0e 3018 } /* continue with next keystring domain/address */
c38d6da9
PH
3019
3020 if (defer) return DEFER;
8e669ac1 3021 }
0bcb2a0e 3022 } /* continue with next dnsdb outer domain */
059ec3d9
PH
3023
3024return FAIL;
3025}
3026
3027/* End of verify.c */