Avoid potential crash in close of a verify callout
[exim.git] / src / src / verify.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions concerned with verifying things. The original code for callout
9caching was contributed by Kevin Fleming (but I hacked it around a bit). */
10
11
12#include "exim.h"
817d9f57 13#include "transports/smtp.h"
059ec3d9 14
e4bdf652
JH
15#define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16#define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
251b9eb4 17static smtp_context ctctx;
817d9f57
JH
18uschar ctbuffer[8192];
19
059ec3d9
PH
20
21/* Structure for caching DNSBL lookups */
22
23typedef struct dnsbl_cache_block {
14b3c5bc 24 time_t expiry;
059ec3d9
PH
25 dns_address *rhs;
26 uschar *text;
27 int rc;
28 BOOL text_set;
29} dnsbl_cache_block;
30
31
32/* Anchor for DNSBL cache */
33
34static tree_node *dnsbl_cache = NULL;
35
36
431b7361
PH
37/* Bits for match_type in one_check_dnsbl() */
38
39#define MT_NOT 1
40#define MT_ALL 2
41
74f1a423 42static uschar cutthrough_response(client_conn_ctx *, char, uschar **, int);
431b7361 43
8d330698 44
059ec3d9
PH
45
46/*************************************************
47* Retrieve a callout cache record *
48*************************************************/
49
50/* If a record exists, check whether it has expired.
51
52Arguments:
53 dbm_file an open hints file
54 key the record key
55 type "address" or "domain"
56 positive_expire expire time for positive records
57 negative_expire expire time for negative records
58
59Returns: the cache record if a non-expired one exists, else NULL
60*/
61
62static dbdata_callout_cache *
55414b25 63get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
059ec3d9
PH
64 int positive_expire, int negative_expire)
65{
66BOOL negative;
67int length, expire;
68time_t now;
69dbdata_callout_cache *cache_record;
70
b6323c75 71if (!(cache_record = dbfn_read_with_length(dbm_file, key, &length)))
059ec3d9 72 {
6f4d5ad3 73 HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
059ec3d9
PH
74 return NULL;
75 }
76
77/* We treat a record as "negative" if its result field is not positive, or if
78it is a domain record and the postmaster field is negative. */
79
80negative = cache_record->result != ccache_accept ||
81 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
82expire = negative? negative_expire : positive_expire;
83now = time(NULL);
84
85if (now - cache_record->time_stamp > expire)
86 {
6f4d5ad3 87 HDEBUG(D_verify) debug_printf("callout cache: %s record expired for %s\n", type, key);
059ec3d9
PH
88 return NULL;
89 }
90
91/* If this is a non-reject domain record, check for the obsolete format version
92that doesn't have the postmaster and random timestamps, by looking at the
93length. If so, copy it to a new-style block, replicating the record's
94timestamp. Then check the additional timestamps. (There's no point wasting
95effort if connections are rejected.) */
96
97if (type[0] == 'd' && cache_record->result != ccache_reject)
98 {
99 if (length == sizeof(dbdata_callout_cache_obs))
100 {
101 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
102 memcpy(new, cache_record, length);
103 new->postmaster_stamp = new->random_stamp = new->time_stamp;
104 cache_record = new;
105 }
106
107 if (now - cache_record->postmaster_stamp > expire)
108 cache_record->postmaster_result = ccache_unknown;
109
110 if (now - cache_record->random_stamp > expire)
111 cache_record->random_result = ccache_unknown;
112 }
113
6f4d5ad3 114HDEBUG(D_verify) debug_printf("callout cache: found %s record for %s\n", type, key);
059ec3d9
PH
115return cache_record;
116}
117
118
119
707ee5b1
JH
120/* Check the callout cache.
121Options * pm_mailfrom may be modified by cache partial results.
059ec3d9 122
707ee5b1 123Return: TRUE if result found
059ec3d9
PH
124*/
125
707ee5b1
JH
126static BOOL
127cached_callout_lookup(address_item * addr, uschar * address_key,
128 uschar * from_address, int * opt_ptr, uschar ** pm_ptr,
129 int * yield, uschar ** failure_ptr,
130 dbdata_callout_cache * new_domain_record, int * old_domain_res)
059ec3d9 131{
707ee5b1 132int options = *opt_ptr;
059ec3d9
PH
133open_db dbblock;
134open_db *dbm_file = NULL;
059ec3d9
PH
135
136/* Open the callout cache database, it it exists, for reading only at this
137stage, unless caching has been disabled. */
138
8b9476ba 139if (options & vopt_callout_no_cache)
059ec3d9
PH
140 {
141 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
142 }
b10c87b3 143else if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
059ec3d9
PH
144 {
145 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
146 }
707ee5b1 147else
059ec3d9 148 {
707ee5b1
JH
149 /* If a cache database is available see if we can avoid the need to do an
150 actual callout by making use of previously-obtained data. */
151
152 dbdata_callout_cache_address * cache_address_record;
153 dbdata_callout_cache * cache_record = get_callout_cache_record(dbm_file,
154 addr->domain, US"domain",
155 callout_cache_domain_positive_expire, callout_cache_domain_negative_expire);
059ec3d9
PH
156
157 /* If an unexpired cache record was found for this domain, see if the callout
158 process can be short-circuited. */
159
ff5929e3 160 if (cache_record)
059ec3d9 161 {
2b1c6e3a
PH
162 /* In most cases, if an early command (up to and including MAIL FROM:<>)
163 was rejected, there is no point carrying on. The callout fails. However, if
164 we are doing a recipient verification with use_sender or use_postmaster
165 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
166 will be using a non-empty sender. We have to remember this situation so as
167 not to disturb the cached domain value if this whole verification succeeds
168 (we don't want it turning into "accept"). */
169
707ee5b1 170 *old_domain_res = cache_record->result;
2b1c6e3a 171
707ee5b1
JH
172 if ( cache_record->result == ccache_reject
173 || *from_address == 0 && cache_record->result == ccache_reject_mfnull)
059ec3d9 174 {
059ec3d9 175 HDEBUG(D_verify)
707ee5b1
JH
176 debug_printf("callout cache: domain gave initial rejection, or "
177 "does not accept HELO or MAIL FROM:<>\n");
059ec3d9
PH
178 setflag(addr, af_verify_nsfail);
179 addr->user_message = US"(result of an earlier callout reused).";
707ee5b1 180 *yield = FAIL;
8e669ac1 181 *failure_ptr = US"mail";
707ee5b1
JH
182 dbfn_close(dbm_file);
183 return TRUE;
059ec3d9
PH
184 }
185
186 /* If a previous check on a "random" local part was accepted, we assume
187 that the server does not do any checking on local parts. There is therefore
188 no point in doing the callout, because it will always be successful. If a
189 random check previously failed, arrange not to do it again, but preserve
190 the data in the new record. If a random check is required but hasn't been
191 done, skip the remaining cache processing. */
192
8b9476ba 193 if (options & vopt_callout_random) switch(cache_record->random_result)
059ec3d9
PH
194 {
195 case ccache_accept:
8b9476ba
JH
196 HDEBUG(D_verify)
197 debug_printf("callout cache: domain accepts random addresses\n");
2ddb4094 198 *failure_ptr = US"random";
707ee5b1
JH
199 dbfn_close(dbm_file);
200 return TRUE; /* Default yield is OK */
059ec3d9
PH
201
202 case ccache_reject:
8b9476ba
JH
203 HDEBUG(D_verify)
204 debug_printf("callout cache: domain rejects random addresses\n");
707ee5b1
JH
205 *opt_ptr = options & ~vopt_callout_random;
206 new_domain_record->random_result = ccache_reject;
207 new_domain_record->random_stamp = cache_record->random_stamp;
8b9476ba 208 break;
059ec3d9
PH
209
210 default:
8b9476ba
JH
211 HDEBUG(D_verify)
212 debug_printf("callout cache: need to check random address handling "
213 "(not cached or cache expired)\n");
707ee5b1
JH
214 dbfn_close(dbm_file);
215 return FALSE;
059ec3d9
PH
216 }
217
218 /* If a postmaster check is requested, but there was a previous failure,
219 there is again no point in carrying on. If a postmaster check is required,
220 but has not been done before, we are going to have to do a callout, so skip
221 remaining cache processing. */
222
707ee5b1 223 if (*pm_ptr)
059ec3d9
PH
224 {
225 if (cache_record->postmaster_result == ccache_reject)
707ee5b1
JH
226 {
227 setflag(addr, af_verify_pmfail);
228 HDEBUG(D_verify)
229 debug_printf("callout cache: domain does not accept "
230 "RCPT TO:<postmaster@domain>\n");
231 *yield = FAIL;
232 *failure_ptr = US"postmaster";
233 setflag(addr, af_verify_pmfail);
234 addr->user_message = US"(result of earlier verification reused).";
235 dbfn_close(dbm_file);
236 return TRUE;
237 }
059ec3d9 238 if (cache_record->postmaster_result == ccache_unknown)
707ee5b1
JH
239 {
240 HDEBUG(D_verify)
241 debug_printf("callout cache: need to check RCPT "
242 "TO:<postmaster@domain> (not cached or cache expired)\n");
243 dbfn_close(dbm_file);
244 return FALSE;
245 }
059ec3d9
PH
246
247 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
248 postmaster check if the address itself has to be checked. Also ensure
249 that the value in the cache record is preserved (with its old timestamp).
250 */
251
252 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
707ee5b1
JH
253 "TO:<postmaster@domain>\n");
254 *pm_ptr = NULL;
255 new_domain_record->postmaster_result = ccache_accept;
256 new_domain_record->postmaster_stamp = cache_record->postmaster_stamp;
059ec3d9
PH
257 }
258 }
259
260 /* We can't give a result based on information about the domain. See if there
261 is an unexpired cache record for this specific address (combined with the
262 sender address if we are doing a recipient callout with a non-empty sender).
263 */
264
707ee5b1
JH
265 if (!(cache_address_record = (dbdata_callout_cache_address *)
266 get_callout_cache_record(dbm_file, address_key, US"address",
267 callout_cache_positive_expire, callout_cache_negative_expire)))
268 {
269 dbfn_close(dbm_file);
270 return FALSE;
271 }
059ec3d9 272
707ee5b1 273 if (cache_address_record->result == ccache_accept)
059ec3d9 274 {
707ee5b1
JH
275 HDEBUG(D_verify)
276 debug_printf("callout cache: address record is positive\n");
277 }
278 else
279 {
280 HDEBUG(D_verify)
281 debug_printf("callout cache: address record is negative\n");
282 addr->user_message = US"Previous (cached) callout verification failure";
283 *failure_ptr = US"recipient";
284 *yield = FAIL;
059ec3d9
PH
285 }
286
287 /* Close the cache database while we actually do the callout for real. */
288
059ec3d9 289 dbfn_close(dbm_file);
707ee5b1
JH
290 return TRUE;
291 }
292return FALSE;
293}
294
295
296/* Write results to callout cache
297*/
298static void
299cache_callout_write(dbdata_callout_cache * dom_rec, const uschar * domain,
300 int done, dbdata_callout_cache_address * addr_rec, uschar * address_key)
301{
302open_db dbblock;
303open_db *dbm_file = NULL;
304
305/* If we get here with done == TRUE, a successful callout happened, and yield
306will be set OK or FAIL according to the response to the RCPT command.
307Otherwise, we looped through the hosts but couldn't complete the business.
308However, there may be domain-specific information to cache in both cases.
309
310The value of the result field in the new_domain record is ccache_unknown if
311there was an error before or with MAIL FROM:, and errno was not zero,
312implying some kind of I/O error. We don't want to write the cache in that case.
313Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
314
315if (dom_rec->result != ccache_unknown)
b10c87b3 316 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
707ee5b1
JH
317 {
318 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
319 }
320 else
321 {
322 (void)dbfn_write(dbm_file, domain, dom_rec,
323 (int)sizeof(dbdata_callout_cache));
324 HDEBUG(D_verify) debug_printf("wrote callout cache domain record for %s:\n"
325 " result=%d postmaster=%d random=%d\n",
326 domain,
327 dom_rec->result,
328 dom_rec->postmaster_result,
329 dom_rec->random_result);
330 }
331
332/* If a definite result was obtained for the callout, cache it unless caching
333is disabled. */
334
335if (done && addr_rec->result != ccache_unknown)
336 {
337 if (!dbm_file)
b10c87b3 338 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE);
707ee5b1
JH
339 if (!dbm_file)
340 {
341 HDEBUG(D_verify) debug_printf("no callout cache available\n");
342 }
343 else
344 {
345 (void)dbfn_write(dbm_file, address_key, addr_rec,
346 (int)sizeof(dbdata_callout_cache_address));
347 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record for %s\n",
348 addr_rec->result == ccache_accept ? "positive" : "negative",
349 address_key);
350 }
351 }
352
353if (dbm_file) dbfn_close(dbm_file);
354}
355
356
c4c940fd
JH
357/* Cutthrough-multi. If the existing cached cutthrough connection matches
358the one we would make for a subsequent recipient, use it. Send the RCPT TO
359and check the result, nonpipelined as it may be wanted immediately for
360recipient-verification.
361
362It seems simpler to deal with this case separately from the main callout loop.
363We will need to remember it has sent, or not, so that rcpt-acl tail code
364can do it there for the non-rcpt-verify case. For this we keep an addresscount.
365
366Return: TRUE for a definitive result for the recipient
367*/
368static int
369cutthrough_multi(address_item * addr, host_item * host_list,
370 transport_feedback * tf, int * yield)
371{
372BOOL done = FALSE;
c4c940fd
JH
373
374if (addr->transport == cutthrough.addr.transport)
d7978c0f 375 for (host_item * host = host_list; host; host = host->next)
c4c940fd
JH
376 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
377 {
378 int host_af;
379 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
380 int port = 25;
381
382 deliver_host = host->name;
383 deliver_host_address = host->address;
384 deliver_host_port = host->port;
385 deliver_domain = addr->domain;
386 transport_name = addr->transport->name;
387
57cc2785 388 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
c4c940fd 389
f83a760f
JH
390 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
391 US"callout")
392 || !smtp_get_port(tf->port, addr, &port, US"callout")
393 )
c4c940fd
JH
394 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
395 addr->message);
396
f83a760f
JH
397 smtp_port_for_connect(host, port);
398
c4c940fd
JH
399 if ( ( interface == cutthrough.interface
400 || ( interface
401 && cutthrough.interface
402 && Ustrcmp(interface, cutthrough.interface) == 0
403 ) )
f83a760f 404 && host->port == cutthrough.host.port
c4c940fd
JH
405 )
406 {
407 uschar * resp = NULL;
408
409 /* Match! Send the RCPT TO, set done from the response */
410 done =
251b9eb4 411 smtp_write_command(&ctctx, SCMD_FLUSH, "RCPT TO:<%.1000s>\r\n",
74f1a423
JH
412 transport_rcpt_address(addr,
413 addr->transport->rcpt_include_affixes)) >= 0
414 && cutthrough_response(&cutthrough.cctx, '2', &resp,
415 CUTTHROUGH_DATA_TIMEOUT) == '2';
c4c940fd
JH
416
417 /* This would go horribly wrong if a callout fail was ignored by ACL.
418 We punt by abandoning cutthrough on a reject, like the
419 first-rcpt does. */
420
421 if (done)
422 {
423 address_item * na = store_get(sizeof(address_item));
424 *na = cutthrough.addr;
425 cutthrough.addr = *addr;
426 cutthrough.addr.host_used = &cutthrough.host;
427 cutthrough.addr.next = na;
428
429 cutthrough.nrcpt++;
430 }
431 else
432 {
57cc2785 433 cancel_cutthrough_connection(TRUE, US"recipient rejected");
c4c940fd
JH
434 if (!resp || errno == ETIMEDOUT)
435 {
436 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
437 }
438 else if (errno == 0)
439 {
440 if (*resp == 0)
441 Ustrcpy(resp, US"connection dropped");
442
443 addr->message =
e9166683
JH
444 string_sprintf("response to \"%s\" was: %s",
445 big_buffer, string_printing(resp));
c4c940fd
JH
446
447 addr->user_message =
448 string_sprintf("Callout verification failed:\n%s", resp);
449
450 /* Hard rejection ends the process */
451
452 if (resp[0] == '5') /* Address rejected */
453 {
454 *yield = FAIL;
455 done = TRUE;
456 }
457 }
458 }
459 }
460 break; /* host_list */
461 }
462if (!done)
57cc2785 463 cancel_cutthrough_connection(TRUE, US"incompatible connection");
c4c940fd
JH
464return done;
465}
466
467
707ee5b1
JH
468/*************************************************
469* Do callout verification for an address *
470*************************************************/
471
472/* This function is called from verify_address() when the address has routed to
473a host list, and a callout has been requested. Callouts are expensive; that is
474why a cache is used to improve the efficiency.
475
476Arguments:
477 addr the address that's been routed
478 host_list the list of hosts to try
479 tf the transport feedback block
480
481 ifstring "interface" option from transport, or NULL
482 portstring "port" option from transport, or NULL
483 protocolstring "protocol" option from transport, or NULL
484 callout the per-command callout timeout
485 callout_overall the overall callout timeout (if < 0 use 4*callout)
486 callout_connect the callout connection timeout (if < 0 use callout)
487 options the verification options - these bits are used:
488 vopt_is_recipient => this is a recipient address
489 vopt_callout_no_cache => don't use callout cache
490 vopt_callout_fullpm => if postmaster check, do full one
491 vopt_callout_random => do the "random" thing
492 vopt_callout_recipsender => use real sender for recipient
493 vopt_callout_recippmaster => use postmaster for recipient
57cc2785 494 vopt_callout_hold => lazy close connection
707ee5b1
JH
495 se_mailfrom MAIL FROM address for sender verify; NULL => ""
496 pm_mailfrom if non-NULL, do the postmaster check with this sender
497
498Returns: OK/FAIL/DEFER
499*/
500
501static int
502do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
503 int callout, int callout_overall, int callout_connect, int options,
504 uschar *se_mailfrom, uschar *pm_mailfrom)
505{
506int yield = OK;
507int old_domain_cache_result = ccache_accept;
508BOOL done = FALSE;
509uschar *address_key;
510uschar *from_address;
511uschar *random_local_part = NULL;
512const uschar *save_deliver_domain = deliver_domain;
513uschar **failure_ptr = options & vopt_is_recipient
514 ? &recipient_verify_failure : &sender_verify_failure;
515dbdata_callout_cache new_domain_record;
516dbdata_callout_cache_address new_address_record;
707ee5b1
JH
517time_t callout_start_time;
518
519new_domain_record.result = ccache_unknown;
520new_domain_record.postmaster_result = ccache_unknown;
521new_domain_record.random_result = ccache_unknown;
522
523memset(&new_address_record, 0, sizeof(new_address_record));
524
525/* For a recipient callout, the key used for the address cache record must
526include the sender address if we are using the real sender in the callout,
527because that may influence the result of the callout. */
528
529if (options & vopt_is_recipient)
530 if (options & vopt_callout_recipsender)
531 {
532 from_address = sender_address;
533 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
534 if (cutthrough.delivery) options |= vopt_callout_no_cache;
535 }
536 else if (options & vopt_callout_recippmaster)
537 {
538 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
539 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
540 qualify_domain_sender);
541 }
542 else
543 {
544 from_address = US"";
545 address_key = addr->address;
546 }
547
548/* For a sender callout, we must adjust the key if the mailfrom address is not
549empty. */
550
551else
552 {
553 from_address = se_mailfrom ? se_mailfrom : US"";
554 address_key = *from_address
555 ? string_sprintf("%s/<%s>", addr->address, from_address) : addr->address;
059ec3d9
PH
556 }
557
707ee5b1
JH
558if (cached_callout_lookup(addr, address_key, from_address,
559 &options, &pm_mailfrom, &yield, failure_ptr,
560 &new_domain_record, &old_domain_cache_result))
57cc2785
JH
561 {
562 cancel_cutthrough_connection(TRUE, US"cache-hit");
707ee5b1 563 goto END_CALLOUT;
57cc2785 564 }
707ee5b1 565
193e3acd 566if (!addr->transport)
059ec3d9 567 {
193e3acd 568 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
059ec3d9 569 }
6681531a
HSHR
570else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
571 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
572 addr->transport->name, addr->transport->driver_name);
193e3acd
JH
573else
574 {
575 smtp_transport_options_block *ob =
9d9c3746 576 (smtp_transport_options_block *)addr->transport->options_block;
059ec3d9 577
193e3acd
JH
578 /* The information wasn't available in the cache, so we have to do a real
579 callout and save the result in the cache for next time, unless no_cache is set,
580 or unless we have a previously cached negative random result. If we are to test
581 with a random local part, ensure that such a local part is available. If not,
4c04137d 582 log the fact, but carry on without randomising. */
059ec3d9 583
707ee5b1 584 if (options & vopt_callout_random && callout_random_local_part)
65f1c92a 585 if (!(random_local_part = expand_string(callout_random_local_part)))
193e3acd
JH
586 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
587 "callout_random_local_part: %s", expand_string_message);
059ec3d9 588
193e3acd
JH
589 /* Default the connect and overall callout timeouts if not set, and record the
590 time we are starting so that we can enforce it. */
4c590bd1 591
193e3acd
JH
592 if (callout_overall < 0) callout_overall = 4 * callout;
593 if (callout_connect < 0) callout_connect = callout;
594 callout_start_time = time(NULL);
4c590bd1 595
193e3acd
JH
596 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
597 output because a callout might take some time. When PIPELINING is active and
598 there are many recipients, the total time for doing lots of callouts can add up
599 and cause the client to time out. So in this case we forgo the PIPELINING
600 optimization. */
817d9f57 601
8768d548 602 if (smtp_out && !f.disable_callout_flush) mac_smtp_fflush();
059ec3d9 603
c4c940fd
JH
604 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
605 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
606
5032d1cf
JH
607/* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
608and we are holding a cutthrough conn open, we can just append the rcpt to
609that conn for verification purposes (and later delivery also). Simplest
c4c940fd 610coding means skipping this whole loop and doing the append separately. */
5032d1cf
JH
611
612 /* Can we re-use an open cutthrough connection? */
74f1a423 613 if ( cutthrough.cctx.sock >= 0
5032d1cf
JH
614 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
615 == vopt_callout_recipsender
616 && !random_local_part
617 && !pm_mailfrom
618 )
c4c940fd 619 done = cutthrough_multi(addr, host_list, tf, &yield);
5032d1cf 620
c4c940fd
JH
621 /* If we did not use a cached connection, make connections to the hosts
622 and do real callouts. The list of hosts is passed in as an argument. */
059ec3d9 623
d7978c0f 624 for (host_item * host = host_list; host && !done; host = host->next)
059ec3d9 625 {
193e3acd
JH
626 int host_af;
627 int port = 25;
193e3acd 628 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
02b41d71 629 smtp_context sx;
193e3acd 630
ff5929e3 631 if (!host->address)
193e3acd
JH
632 {
633 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
634 host->name);
635 continue;
636 }
059ec3d9 637
193e3acd 638 /* Check the overall callout timeout */
059ec3d9 639
193e3acd
JH
640 if (time(NULL) - callout_start_time >= callout_overall)
641 {
642 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
643 break;
644 }
059ec3d9 645
193e3acd 646 /* Set IPv4 or IPv6 */
059ec3d9 647
e9166683 648 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
de3a88fb 649
193e3acd
JH
650 /* Expand and interpret the interface and port strings. The latter will not
651 be used if there is a host-specific port (e.g. from a manualroute router).
652 This has to be delayed till now, because they may expand differently for
653 different hosts. If there's a failure, log it, but carry on with the
654 defaults. */
de3a88fb 655
193e3acd
JH
656 deliver_host = host->name;
657 deliver_host_address = host->address;
a7538db1 658 deliver_host_port = host->port;
193e3acd 659 deliver_domain = addr->domain;
aec45841 660 transport_name = addr->transport->name;
059ec3d9 661
6f6dedcc 662 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
bf7aabb4
JH
663 US"callout")
664 || !smtp_get_port(tf->port, addr, &port, US"callout")
665 )
193e3acd
JH
666 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
667 addr->message);
059ec3d9 668
02b41d71 669 sx.addrlist = addr;
ee8b8090
JH
670 sx.conn_args.host = host;
671 sx.conn_args.host_af = host_af,
02b41d71 672 sx.port = port;
ee8b8090 673 sx.conn_args.interface = interface;
02b41d71 674 sx.helo_data = tf->helo_data;
ee8b8090 675 sx.conn_args.tblock = addr->transport;
e9166683 676 sx.verify = TRUE;
02b41d71
JH
677
678tls_retry_connection:
679 /* Set the address state so that errors are recorded in it */
680
681 addr->transport_return = PENDING_DEFER;
682 ob->connect_timeout = callout_connect;
683 ob->command_timeout = callout;
684
685 /* Get the channel set up ready for a message (MAIL FROM being the next
686 SMTP command to send. If we tried TLS but it failed, try again without
687 if permitted */
688
f10e3ea3
JH
689 yield = smtp_setup_conn(&sx, FALSE);
690#ifdef SUPPORT_TLS
691 if ( yield == DEFER
02b41d71
JH
692 && addr->basic_errno == ERRNO_TLSFAILURE
693 && ob->tls_tempfail_tryclear
3fb3231c 694 && verify_check_given_host(CUSS &ob->hosts_require_tls, host) != OK
02b41d71 695 )
193e3acd 696 {
cf0c6164
JH
697 log_write(0, LOG_MAIN,
698 "%s: callout unencrypted to %s [%s] (not in hosts_require_tls)",
699 addr->message, host->name, host->address);
e9166683
JH
700 addr->transport_return = PENDING_DEFER;
701 yield = smtp_setup_conn(&sx, TRUE);
02b41d71 702 }
f10e3ea3 703#endif
02b41d71
JH
704 if (yield != OK)
705 {
02b41d71 706 errno = addr->basic_errno;
aec45841 707 transport_name = NULL;
193e3acd
JH
708 deliver_host = deliver_host_address = NULL;
709 deliver_domain = save_deliver_domain;
bf7aabb4 710
02b41d71
JH
711 /* Failure to accept HELO is cached; this blocks the whole domain for all
712 senders. I/O errors and defer responses are not cached. */
770747fd 713
02b41d71 714 if (yield == FAIL && (errno == 0 || errno == ERRNO_SMTPCLOSED))
a7538db1 715 {
02b41d71
JH
716 setflag(addr, af_verify_nsfail);
717 new_domain_record.result = ccache_reject;
718 done = TRUE;
a7538db1 719 }
193e3acd 720 else
02b41d71
JH
721 done = FALSE;
722 goto no_conn;
3c8b3577 723 }
9bfc60eb 724
02b41d71
JH
725 /* If we needed to authenticate, smtp_setup_conn() did that. Copy
726 the AUTH info for logging */
fcc8e047 727
02b41d71
JH
728 addr->authenticator = client_authenticator;
729 addr->auth_id = client_authenticated_id;
b4a2b536 730
e9166683
JH
731 sx.from_addr = from_address;
732 sx.first_addr = sx.sync_addr = addr;
733 sx.ok = FALSE; /*XXX these 3 last might not be needed for verify? */
734 sx.send_rset = TRUE;
735 sx.completed_addr = FALSE;
b4a2b536 736
cf0c6164 737 new_domain_record.result = old_domain_cache_result == ccache_reject_mfnull
e9166683 738 ? ccache_reject_mfnull : ccache_accept;
c4c940fd 739
e9166683
JH
740 /* Do the random local part check first. Temporarily replace the recipient
741 with the "random" value */
02b41d71 742
e9166683 743 if (random_local_part)
059ec3d9 744 {
e9166683 745 uschar * main_address = addr->address;
921dfc11
JH
746 const uschar * rcpt_domain = addr->domain;
747
8c5d388a 748#ifdef SUPPORT_I18N
921dfc11
JH
749 uschar * errstr = NULL;
750 if ( testflag(addr, af_utf8_downcvt)
751 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
752 &errstr), errstr)
753 )
754 {
755 addr->message = errstr;
756 errno = ERRNO_EXPANDFAIL;
757 setflag(addr, af_verify_nsfail);
758 done = FALSE;
759 rcpt_domain = US""; /*XXX errorhandling! */
760 }
761#endif
762
57cc2785
JH
763 /* This would be ok for 1st rcpt of a cutthrough (the case handled here;
764 subsequents are done in cutthrough_multi()), but no way to
765 handle a subsequent because of the RSET vaporising the MAIL FROM.
766 So refuse to support any. Most cutthrough use will not involve
767 random_local_part, so no loss. */
768 cancel_cutthrough_connection(TRUE, US"random-recipient");
059ec3d9 769
e9166683
JH
770 addr->address = string_sprintf("%s@%.1000s",
771 random_local_part, rcpt_domain);
772 done = FALSE;
902fbd69
JH
773
774 /* If accepted, we aren't going to do any further tests below.
775 Otherwise, cache a real negative response, and get back to the right
776 state to send RCPT. Unless there's some problem such as a dropped
777 connection, we expect to succeed, because the commands succeeded above.
778 However, some servers drop the connection after responding to an
779 invalid recipient, so on (any) error we drop and remake the connection.
780 XXX We don't care about that for postmaster_full. Should we?
781
782 XXX could we add another flag to the context, and have the common
783 code emit the RSET too? Even pipelined after the RCPT...
784 Then the main-verify call could use it if there's to be a subsequent
785 postmaster-verify.
786 The sync_responses() would need to be taught about it and we'd
787 need another return code filtering out to here.
14de8063 788
d6e7df90 789 Avoid using a SIZE option on the MAIL for all random-rcpt checks.
902fbd69
JH
790 */
791
14de8063
JH
792 sx.avoid_option = OPTION_SIZE;
793
a65c4156
JH
794 /* Remember when we last did a random test */
795 new_domain_record.random_stamp = time(NULL);
796
e9166683
JH
797 if (smtp_write_mail_and_rcpt_cmds(&sx, &yield) == 0)
798 switch(addr->transport_return)
799 {
b6323c75 800 case PENDING_OK: /* random was accepted, unfortunately */
e9166683 801 new_domain_record.random_result = ccache_accept;
b6323c75 802 yield = OK; /* Only usable verify result we can return */
fae8970d 803 done = TRUE;
2ddb4094 804 *failure_ptr = US"random";
fae8970d 805 goto no_conn;
b6323c75 806 case FAIL: /* rejected: the preferred result */
e9166683 807 new_domain_record.random_result = ccache_reject;
14de8063 808 sx.avoid_option = 0;
193e3acd 809
e9166683 810 /* Between each check, issue RSET, because some servers accept only
902fbd69
JH
811 one recipient after MAIL FROM:<>.
812 XXX We don't care about that for postmaster_full. Should we? */
193e3acd 813
e9166683 814 if ((done =
251b9eb4
JH
815 smtp_write_command(&sx, SCMD_FLUSH, "RSET\r\n") >= 0 &&
816 smtp_read_response(&sx, sx.buffer, sizeof(sx.buffer), '2', callout)))
e9166683 817 break;
65f1c92a 818
65f1c92a 819 HDEBUG(D_acl|D_v)
e1d04f48 820 debug_printf_indent("problem after random/rset/mfrom; reopen conn\n");
65f1c92a
JH
821 random_local_part = NULL;
822#ifdef SUPPORT_TLS
74f1a423 823 tls_close(sx.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
65f1c92a 824#endif
e1d04f48 825 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
74f1a423
JH
826 (void)close(sx.cctx.sock);
827 sx.cctx.sock = -1;
0cbf2b82 828#ifndef DISABLE_EVENT
65f1c92a
JH
829 (void) event_raise(addr->transport->event_action,
830 US"tcp:close", NULL);
831#endif
a65c4156
JH
832 addr->address = main_address;
833 addr->transport_return = PENDING_DEFER;
834 sx.first_addr = sx.sync_addr = addr;
835 sx.ok = FALSE;
836 sx.send_rset = TRUE;
837 sx.completed_addr = FALSE;
65f1c92a 838 goto tls_retry_connection;
b6323c75
JH
839 case DEFER: /* 4xx response to random */
840 break; /* Just to be clear. ccache_unknown, !done. */
e9166683 841 }
059ec3d9 842
e9166683
JH
843 /* Re-setup for main verify, or for the error message when failing */
844 addr->address = main_address;
845 addr->transport_return = PENDING_DEFER;
846 sx.first_addr = sx.sync_addr = addr;
847 sx.ok = FALSE;
848 sx.send_rset = TRUE;
849 sx.completed_addr = FALSE;
850 }
851 else
852 done = TRUE;
921dfc11 853
14de8063
JH
854 /* Main verify. For rcpt-verify use SIZE if we know it and we're not cacheing;
855 for sndr-verify never use it. */
e9166683
JH
856
857 if (done)
858 {
14de8063
JH
859 if (!(options & vopt_is_recipient && options & vopt_callout_no_cache))
860 sx.avoid_option = OPTION_SIZE;
861
e9166683
JH
862 done = FALSE;
863 switch(smtp_write_mail_and_rcpt_cmds(&sx, &yield))
864 {
865 case 0: switch(addr->transport_return) /* ok so far */
866 {
867 case PENDING_OK: done = TRUE;
868 new_address_record.result = ccache_accept;
869 break;
14de8063 870 case FAIL: done = TRUE;
e9166683
JH
871 yield = FAIL;
872 *failure_ptr = US"recipient";
873 new_address_record.result = ccache_reject;
874 break;
14de8063 875 default: break;
e9166683
JH
876 }
877 break;
878
879 case -1: /* MAIL response error */
880 *failure_ptr = US"mail";
881 if (errno == 0 && sx.buffer[0] == '5')
882 {
883 setflag(addr, af_verify_nsfail);
884 if (from_address[0] == 0)
885 new_domain_record.result = ccache_reject_mfnull;
886 }
887 break;
888 /* non-MAIL read i/o error */
889 /* non-MAIL response timeout */
890 /* internal error; channel still usable */
891 default: break; /* transmit failed */
892 }
893 }
894
895 addr->auth_sndr = client_authenticated_sender;
896
897 deliver_host = deliver_host_address = NULL;
898 deliver_domain = save_deliver_domain;
899
900 /* Do postmaster check if requested; if a full check is required, we
901 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
902
903 if (done && pm_mailfrom)
904 {
905 /* Could possibly shift before main verify, just above, and be ok
906 for cutthrough. But no way to handle a subsequent rcpt, so just
907 refuse any */
57cc2785 908 cancel_cutthrough_connection(TRUE, US"postmaster verify");
e1d04f48 909 HDEBUG(D_acl|D_v) debug_printf_indent("Cutthrough cancelled by presence of postmaster verify\n");
e9166683 910
251b9eb4
JH
911 done = smtp_write_command(&sx, SCMD_FLUSH, "RSET\r\n") >= 0
912 && smtp_read_response(&sx, sx.buffer, sizeof(sx.buffer), '2', callout);
e9166683
JH
913
914 if (done)
915 {
916 uschar * main_address = addr->address;
917
918 /*XXX oops, affixes */
919 addr->address = string_sprintf("postmaster@%.1000s", addr->domain);
920 addr->transport_return = PENDING_DEFER;
921
922 sx.from_addr = pm_mailfrom;
923 sx.first_addr = sx.sync_addr = addr;
924 sx.ok = FALSE;
925 sx.send_rset = TRUE;
926 sx.completed_addr = FALSE;
14de8063 927 sx.avoid_option = OPTION_SIZE;
e9166683
JH
928
929 if( smtp_write_mail_and_rcpt_cmds(&sx, &yield) == 0
930 && addr->transport_return == PENDING_OK
931 )
932 done = TRUE;
921dfc11 933 else
e9166683 934 done = (options & vopt_callout_fullpm) != 0
251b9eb4 935 && smtp_write_command(&sx, SCMD_FLUSH,
e9166683 936 "RCPT TO:<postmaster>\r\n") >= 0
251b9eb4 937 && smtp_read_response(&sx, sx.buffer,
e9166683 938 sizeof(sx.buffer), '2', callout);
921dfc11 939
e9166683 940 /* Sort out the cache record */
2a4be8f9 941
e9166683
JH
942 new_domain_record.postmaster_stamp = time(NULL);
943
944 if (done)
945 new_domain_record.postmaster_result = ccache_accept;
946 else if (errno == 0 && sx.buffer[0] == '5')
947 {
948 *failure_ptr = US"postmaster";
949 setflag(addr, af_verify_pmfail);
950 new_domain_record.postmaster_result = ccache_reject;
951 }
952
953 addr->address = main_address;
954 }
955 }
193e3acd
JH
956 /* For any failure of the main check, other than a negative response, we just
957 close the connection and carry on. We can identify a negative response by the
958 fact that errno is zero. For I/O errors it will be non-zero
2a4be8f9 959
193e3acd
JH
960 Set up different error texts for logging and for sending back to the caller
961 as an SMTP response. Log in all cases, using a one-line format. For sender
962 callouts, give a full response to the caller, but for recipient callouts,
963 don't give the IP address because this may be an internal host whose identity
964 is not to be widely broadcast. */
2a4be8f9 965
02b41d71 966no_conn:
e9166683 967 switch(errno)
193e3acd 968 {
02b41d71
JH
969 case ETIMEDOUT:
970 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
971 sx.send_quit = FALSE;
972 break;
973
8c5d388a 974#ifdef SUPPORT_I18N
02b41d71 975 case ERRNO_UTF8_FWD:
9bfc60eb
JH
976 {
977 extern int acl_where; /* src/acl.c */
978 errno = 0;
979 addr->message = string_sprintf(
e9166683 980 "response to \"EHLO\" did not include SMTPUTF8");
02b41d71
JH
981 addr->user_message = acl_where == ACL_WHERE_RCPT
982 ? US"533 no support for internationalised mailbox name"
9bfc60eb
JH
983 : US"550 mailbox unavailable";
984 yield = FAIL;
985 done = TRUE;
986 }
02b41d71 987 break;
9bfc60eb 988#endif
02b41d71
JH
989 case ECONNREFUSED:
990 sx.send_quit = FALSE;
991 break;
2a4be8f9 992
02b41d71 993 case 0:
e9166683 994 if (*sx.buffer == 0) Ustrcpy(sx.buffer, US"connection dropped");
059ec3d9 995
e9166683 996 /*XXX test here is ugly; seem to have a split of responsibility for
b6323c75 997 building this message. Need to rationalise. Where is it done
e9166683
JH
998 before here, and when not?
999 Not == 5xx resp to MAIL on main-verify
1000 */
1001 if (!addr->message) addr->message =
1002 string_sprintf("response to \"%s\" was: %s",
1003 big_buffer, string_printing(sx.buffer));
02b41d71
JH
1004
1005 addr->user_message = options & vopt_is_recipient
e9166683 1006 ? string_sprintf("Callout verification failed:\n%s", sx.buffer)
02b41d71 1007 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
e9166683 1008 host->address, big_buffer, sx.buffer);
059ec3d9 1009
02b41d71 1010 /* Hard rejection ends the process */
193e3acd 1011
e9166683 1012 if (sx.buffer[0] == '5') /* Address rejected */
02b41d71
JH
1013 {
1014 yield = FAIL;
1015 done = TRUE;
1016 }
1017 break;
193e3acd 1018 }
059ec3d9 1019
193e3acd
JH
1020 /* End the SMTP conversation and close the connection. */
1021
4c04137d 1022 /* Cutthrough - on a successful connect and recipient-verify with
5032d1cf 1023 use-sender and we are 1st rcpt and have no cutthrough conn so far
57cc2785
JH
1024 here is where we want to leave the conn open. Ditto for a lazy-close
1025 verify. */
1026
857eaf37
JH
1027 if (cutthrough.delivery)
1028 {
1029 if (addr->transport->filter_command)
1030 {
1031 cutthrough.delivery= FALSE;
1032 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
1033 }
72cb765f
JH
1034#ifndef DISABLE_DKIM
1035 if (ob->dkim.dkim_domain)
857eaf37
JH
1036 {
1037 cutthrough.delivery= FALSE;
72cb765f 1038 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
857eaf37 1039 }
72cb765f
JH
1040#endif
1041#ifdef EXPERIMENTAL_ARC
1042 if (ob->arc_sign)
1043 {
1044 cutthrough.delivery= FALSE;
1045 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of ARC signing\n");
1046 }
1047#endif
857eaf37
JH
1048 }
1049
57cc2785 1050 if ( (cutthrough.delivery || options & vopt_callout_hold)
5032d1cf 1051 && rcpt_count == 1
193e3acd
JH
1052 && done
1053 && yield == OK
98c82a3d
JH
1054 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1055 == vopt_callout_recipsender
193e3acd
JH
1056 && !random_local_part
1057 && !pm_mailfrom
74f1a423 1058 && cutthrough.cctx.sock < 0
02b41d71 1059 && !sx.lmtp
193e3acd 1060 )
059ec3d9 1061 {
57cc2785
JH
1062 HDEBUG(D_acl|D_v) debug_printf_indent("holding verify callout open for %s\n",
1063 cutthrough.delivery
1064 ? "cutthrough delivery" : "potential further verifies and delivery");
1065
1066 cutthrough.callout_hold_only = !cutthrough.delivery;
74f1a423
JH
1067 cutthrough.is_tls = tls_out.active.sock >= 0;
1068 /* We assume no buffer in use in the outblock */
1069 cutthrough.cctx = sx.cctx;
57cc2785
JH
1070 cutthrough.nrcpt = 1;
1071 cutthrough.transport = addr->transport->name;
1072 cutthrough.interface = interface;
1073 cutthrough.snd_port = sending_port;
1074 cutthrough.peer_options = smtp_peer_options;
1075 cutthrough.host = *host;
1076 {
1077 int oldpool = store_pool;
1078 store_pool = POOL_PERM;
1079 cutthrough.snd_ip = string_copy(sending_ip_address);
1080 cutthrough.host.name = string_copy(host->name);
1081 cutthrough.host.address = string_copy(host->address);
1082 store_pool = oldpool;
1083 }
8a6b4e02
JH
1084
1085 /* Save the address_item and parent chain for later logging */
1086 cutthrough.addr = *addr;
57cc2785 1087 cutthrough.addr.next = NULL;
5032d1cf 1088 cutthrough.addr.host_used = &cutthrough.host;
d7978c0f 1089 for (address_item * caddr = &cutthrough.addr, * parent = addr->parent;
8a6b4e02 1090 parent;
d16931c8 1091 caddr = caddr->parent, parent = parent->parent)
8a6b4e02
JH
1092 *(caddr->parent = store_get(sizeof(address_item))) = *parent;
1093
251b9eb4
JH
1094 ctctx.outblock.buffer = ctbuffer;
1095 ctctx.outblock.buffersize = sizeof(ctbuffer);
1096 ctctx.outblock.ptr = ctbuffer;
1097 /* ctctx.outblock.cmd_count = 0; ctctx.outblock.authenticating = FALSE; */
1098 ctctx.outblock.cctx = &cutthrough.cctx;
059ec3d9 1099 }
193e3acd 1100 else
059ec3d9 1101 {
57cc2785 1102 /* Ensure no cutthrough on multiple verifies that were incompatible */
193e3acd 1103 if (options & vopt_callout_recipsender)
57cc2785 1104 cancel_cutthrough_connection(TRUE, US"not usable for cutthrough");
02b41d71 1105 if (sx.send_quit)
345f2724
JH
1106 if (smtp_write_command(&sx, SCMD_FLUSH, "QUIT\r\n") != -1)
1107 /* Wait a short time for response, and discard it */
1108 smtp_read_response(&sx, sx.buffer, sizeof(sx.buffer), '2', 1);
2760b518 1109
74f1a423 1110 if (sx.cctx.sock >= 0)
02b41d71 1111 {
a7538db1 1112#ifdef SUPPORT_TLS
74f1a423
JH
1113 if (sx.cctx.tls_ctx)
1114 {
1115 tls_close(sx.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1116 sx.cctx.tls_ctx = NULL;
1117 }
a7538db1 1118#endif
e1d04f48 1119 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
74f1a423
JH
1120 (void)close(sx.cctx.sock);
1121 sx.cctx.sock = -1;
0cbf2b82 1122#ifndef DISABLE_EVENT
02b41d71 1123 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
a7538db1 1124#endif
02b41d71 1125 }
059ec3d9 1126 }
059ec3d9 1127
e9166683
JH
1128 if (!done || yield != OK)
1129 addr->message = string_sprintf("%s [%s] : %s", host->name, host->address,
1130 addr->message);
193e3acd
JH
1131 } /* Loop through all hosts, while !done */
1132 }
059ec3d9
PH
1133
1134/* If we get here with done == TRUE, a successful callout happened, and yield
1135will be set OK or FAIL according to the response to the RCPT command.
1136Otherwise, we looped through the hosts but couldn't complete the business.
707ee5b1 1137However, there may be domain-specific information to cache in both cases. */
059ec3d9 1138
707ee5b1
JH
1139if (!(options & vopt_callout_no_cache))
1140 cache_callout_write(&new_domain_record, addr->domain,
1141 done, &new_address_record, address_key);
059ec3d9
PH
1142
1143/* Failure to connect to any host, or any response other than 2xx or 5xx is a
1144temporary error. If there was only one host, and a response was received, leave
1145it alone if supplying details. Otherwise, give a generic response. */
1146
707ee5b1 1147if (!done)
059ec3d9 1148 {
ff5929e3 1149 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
8b9476ba 1150 options & vopt_is_recipient ? "recipient" : "sender");
059ec3d9
PH
1151 yield = DEFER;
1152
02b41d71
JH
1153 addr->message = host_list->next || !addr->message
1154 ? dullmsg : string_sprintf("%s: %s", dullmsg, addr->message);
059ec3d9 1155
ff5929e3
JH
1156 addr->user_message = smtp_return_error_details
1157 ? string_sprintf("%s for <%s>.\n"
059ec3d9
PH
1158 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1159 "they may be permanently unreachable from this server. In the latter case,\n%s",
1160 dullmsg, addr->address,
8b9476ba 1161 options & vopt_is_recipient
ff5929e3 1162 ? "the address will never be accepted."
8b9476ba
JH
1163 : "you need to change the address or create an MX record for its domain\n"
1164 "if it is supposed to be generally accessible from the Internet.\n"
ff5929e3
JH
1165 "Talk to your mail administrator for details.")
1166 : dullmsg;
059ec3d9
PH
1167
1168 /* Force a specific error code */
1169
1170 addr->basic_errno = ERRNO_CALLOUTDEFER;
1171 }
1172
1173/* Come here from within the cache-reading code on fast-track exit. */
1174
1175END_CALLOUT:
02b41d71 1176tls_modify_variables(&tls_in);
059ec3d9
PH
1177return yield;
1178}
1179
1180
1181
817d9f57
JH
1182/* Called after recipient-acl to get a cutthrough connection open when
1183 one was requested and a recipient-verify wasn't subsequently done.
1184*/
f9334a28 1185int
8a6b4e02 1186open_cutthrough_connection(address_item * addr)
e4bdf652
JH
1187{
1188address_item addr2;
f9334a28 1189int rc;
e4bdf652
JH
1190
1191/* Use a recipient-verify-callout to set up the cutthrough connection. */
1192/* We must use a copy of the address for verification, because it might
1193get rewritten. */
1194
1195addr2 = *addr;
e1d04f48 1196HDEBUG(D_acl) debug_printf_indent("----------- %s cutthrough setup ------------\n",
5032d1cf 1197 rcpt_count > 1 ? "more" : "start");
ff5929e3 1198rc = verify_address(&addr2, NULL,
e4bdf652
JH
1199 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1200 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1201 NULL, NULL, NULL);
ff5929e3
JH
1202addr->message = addr2.message;
1203addr->user_message = addr2.user_message;
e1d04f48 1204HDEBUG(D_acl) debug_printf_indent("----------- end cutthrough setup ------------\n");
f9334a28 1205return rc;
e4bdf652
JH
1206}
1207
1208
e4bdf652 1209
817d9f57
JH
1210/* Send given number of bytes from the buffer */
1211static BOOL
1212cutthrough_send(int n)
e4bdf652 1213{
74f1a423 1214if(cutthrough.cctx.sock < 0)
817d9f57 1215 return TRUE;
e4bdf652 1216
817d9f57
JH
1217if(
1218#ifdef SUPPORT_TLS
74f1a423 1219 cutthrough.is_tls
251b9eb4 1220 ? tls_write(cutthrough.cctx.tls_ctx, ctctx.outblock.buffer, n, FALSE)
74f1a423 1221 :
817d9f57 1222#endif
251b9eb4 1223 send(cutthrough.cctx.sock, ctctx.outblock.buffer, n, 0) > 0
817d9f57
JH
1224 )
1225{
1226 transport_count += n;
251b9eb4 1227 ctctx.outblock.ptr= ctctx.outblock.buffer;
817d9f57
JH
1228 return TRUE;
1229}
e4bdf652 1230
e1d04f48 1231HDEBUG(D_transport|D_acl) debug_printf_indent("cutthrough_send failed: %s\n", strerror(errno));
817d9f57 1232return FALSE;
e4bdf652
JH
1233}
1234
1235
1236
817d9f57
JH
1237static BOOL
1238_cutthrough_puts(uschar * cp, int n)
1239{
1240while(n--)
1241 {
251b9eb4
JH
1242 if(ctctx.outblock.ptr >= ctctx.outblock.buffer+ctctx.outblock.buffersize)
1243 if(!cutthrough_send(ctctx.outblock.buffersize))
817d9f57
JH
1244 return FALSE;
1245
251b9eb4 1246 *ctctx.outblock.ptr++ = *cp++;
817d9f57
JH
1247 }
1248return TRUE;
1249}
1250
1251/* Buffered output of counted data block. Return boolean success */
57cc2785 1252static BOOL
e4bdf652
JH
1253cutthrough_puts(uschar * cp, int n)
1254{
74f1a423
JH
1255if (cutthrough.cctx.sock < 0) return TRUE;
1256if (_cutthrough_puts(cp, n)) return TRUE;
57cc2785 1257cancel_cutthrough_connection(TRUE, US"transmit failed");
817d9f57
JH
1258return FALSE;
1259}
e4bdf652 1260
6851a9c5 1261void
57cc2785
JH
1262cutthrough_data_puts(uschar * cp, int n)
1263{
6851a9c5 1264if (cutthrough.delivery) (void) cutthrough_puts(cp, n);
78a3bbd5 1265return;
57cc2785
JH
1266}
1267
e4bdf652 1268
817d9f57 1269static BOOL
5032d1cf 1270_cutthrough_flush_send(void)
817d9f57 1271{
251b9eb4 1272int n = ctctx.outblock.ptr - ctctx.outblock.buffer;
e4bdf652 1273
817d9f57
JH
1274if(n>0)
1275 if(!cutthrough_send(n))
1276 return FALSE;
1277return TRUE;
e4bdf652
JH
1278}
1279
817d9f57
JH
1280
1281/* Send out any bufferred output. Return boolean success. */
e4bdf652 1282BOOL
5032d1cf 1283cutthrough_flush_send(void)
e4bdf652 1284{
817d9f57 1285if (_cutthrough_flush_send()) return TRUE;
57cc2785 1286cancel_cutthrough_connection(TRUE, US"transmit failed");
e4bdf652
JH
1287return FALSE;
1288}
1289
1290
57cc2785 1291static BOOL
5032d1cf 1292cutthrough_put_nl(void)
e4bdf652
JH
1293{
1294return cutthrough_puts(US"\r\n", 2);
1295}
1296
1297
6851a9c5 1298void
57cc2785
JH
1299cutthrough_data_put_nl(void)
1300{
6851a9c5 1301cutthrough_data_puts(US"\r\n", 2);
57cc2785
JH
1302}
1303
1304
e4bdf652
JH
1305/* Get and check response from cutthrough target */
1306static uschar
74f1a423 1307cutthrough_response(client_conn_ctx * cctx, char expect, uschar ** copy, int timeout)
e4bdf652 1308{
ee8b8090 1309smtp_context sx = {0};
e4bdf652
JH
1310uschar inbuffer[4096];
1311uschar responsebuffer[4096];
1312
251b9eb4
JH
1313sx.inblock.buffer = inbuffer;
1314sx.inblock.buffersize = sizeof(inbuffer);
1315sx.inblock.ptr = inbuffer;
1316sx.inblock.ptrend = inbuffer;
1317sx.inblock.cctx = cctx;
1318if(!smtp_read_response(&sx, responsebuffer, sizeof(responsebuffer), expect, timeout))
57cc2785 1319 cancel_cutthrough_connection(TRUE, US"target timeout on read");
e4bdf652 1320
57cc2785 1321if(copy)
e4bdf652
JH
1322 {
1323 uschar * cp;
5032d1cf 1324 *copy = cp = string_copy(responsebuffer);
e4bdf652
JH
1325 /* Trim the trailing end of line */
1326 cp += Ustrlen(responsebuffer);
1327 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1328 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1329 }
1330
1331return responsebuffer[0];
1332}
1333
1334
1335/* Negotiate dataphase with the cutthrough target, returning success boolean */
1336BOOL
5032d1cf 1337cutthrough_predata(void)
e4bdf652 1338{
74f1a423 1339if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
e4bdf652
JH
1340 return FALSE;
1341
e1d04f48 1342HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> DATA\n");
817d9f57
JH
1343cutthrough_puts(US"DATA\r\n", 6);
1344cutthrough_flush_send();
e4bdf652
JH
1345
1346/* Assume nothing buffered. If it was it gets ignored. */
74f1a423 1347return cutthrough_response(&cutthrough.cctx, '3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
e4bdf652
JH
1348}
1349
1350
42055a33 1351/* tctx arg only to match write_chunk() */
511a6c14 1352static BOOL
42055a33 1353cutthrough_write_chunk(transport_ctx * tctx, uschar * s, int len)
511a6c14
JH
1354{
1355uschar * s2;
1356while(s && (s2 = Ustrchr(s, '\n')))
1357 {
1358 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1359 return FALSE;
1360 s = s2+1;
1361 }
1362return TRUE;
1363}
1364
1365
e4bdf652 1366/* Buffered send of headers. Return success boolean. */
817d9f57 1367/* Expands newlines to wire format (CR,NL). */
e4bdf652 1368/* Also sends header-terminating blank line. */
e4bdf652 1369BOOL
5032d1cf 1370cutthrough_headers_send(void)
e4bdf652 1371{
6d5c916c
JH
1372transport_ctx tctx;
1373
74f1a423 1374if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
e4bdf652
JH
1375 return FALSE;
1376
511a6c14
JH
1377/* We share a routine with the mainline transport to handle header add/remove/rewrites,
1378 but having a separate buffered-output function (for now)
1379*/
e1d04f48 1380HDEBUG(D_acl) debug_printf_indent("----------- start cutthrough headers send -----------\n");
e4bdf652 1381
74f1a423 1382tctx.u.fd = cutthrough.cctx.sock;
6d5c916c
JH
1383tctx.tblock = cutthrough.addr.transport;
1384tctx.addr = &cutthrough.addr;
1385tctx.check_string = US".";
1386tctx.escape_string = US"..";
328c5688 1387/*XXX check under spool_files_wireformat. Might be irrelevant */
6d5c916c
JH
1388tctx.options = topt_use_crlf;
1389
42055a33 1390if (!transport_headers_send(&tctx, &cutthrough_write_chunk))
511a6c14
JH
1391 return FALSE;
1392
e1d04f48 1393HDEBUG(D_acl) debug_printf_indent("----------- done cutthrough headers send ------------\n");
511a6c14 1394return TRUE;
817d9f57
JH
1395}
1396
1397
1398static void
78a3bbd5 1399close_cutthrough_connection(const uschar * why)
817d9f57 1400{
74f1a423 1401int fd = cutthrough.cctx.sock;
57cc2785 1402if(fd >= 0)
817d9f57
JH
1403 {
1404 /* We could be sending this after a bunch of data, but that is ok as
1405 the only way to cancel the transfer in dataphase is to drop the tcp
1406 conn before the final dot.
1407 */
74f1a423 1408 client_conn_ctx tmp_ctx = cutthrough.cctx;
251b9eb4 1409 ctctx.outblock.ptr = ctbuffer;
e1d04f48 1410 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> QUIT\n");
817d9f57
JH
1411 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1412 _cutthrough_flush_send();
74f1a423 1413 cutthrough.cctx.sock = -1; /* avoid recursion via read timeout */
06fdb9f7 1414 cutthrough.nrcpt = 0; /* permit re-cutthrough on subsequent message */
2760b518
JH
1415
1416 /* Wait a short time for response, and discard it */
74f1a423 1417 cutthrough_response(&tmp_ctx, '2', NULL, 1);
817d9f57 1418
57cc2785 1419#ifdef SUPPORT_TLS
74f1a423
JH
1420 if (cutthrough.is_tls)
1421 {
1422 tls_close(cutthrough.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1423 cutthrough.cctx.tls_ctx = NULL;
1424 cutthrough.is_tls = FALSE;
1425 }
57cc2785 1426#endif
e1d04f48 1427 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
57cc2785 1428 (void)close(fd);
e1d04f48 1429 HDEBUG(D_acl) debug_printf_indent("----------- cutthrough shutdown (%s) ------------\n", why);
817d9f57 1430 }
251b9eb4 1431ctctx.outblock.ptr = ctbuffer;
e4bdf652
JH
1432}
1433
817d9f57 1434void
57cc2785
JH
1435cancel_cutthrough_connection(BOOL close_noncutthrough_verifies, const uschar * why)
1436{
1437if (cutthrough.delivery || close_noncutthrough_verifies)
1438 close_cutthrough_connection(why);
1439cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1440}
1441
1442
1443void
1444release_cutthrough_connection(const uschar * why)
817d9f57 1445{
74f1a423 1446if (cutthrough.cctx.sock < 0) return;
57cc2785 1447HDEBUG(D_acl) debug_printf_indent("release cutthrough conn: %s\n", why);
74f1a423
JH
1448cutthrough.cctx.sock = -1;
1449cutthrough.cctx.tls_ctx = NULL;
57cc2785 1450cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
817d9f57
JH
1451}
1452
1453
1454
e4bdf652
JH
1455
1456/* Have senders final-dot. Send one to cutthrough target, and grab the response.
1457 Log an OK response as a transmission.
817d9f57 1458 Close the connection.
e4bdf652 1459 Return smtp response-class digit.
e4bdf652
JH
1460*/
1461uschar *
5032d1cf 1462cutthrough_finaldot(void)
e4bdf652 1463{
5032d1cf 1464uschar res;
e1d04f48 1465HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> .\n");
e4bdf652
JH
1466
1467/* Assume data finshed with new-line */
5032d1cf
JH
1468if( !cutthrough_puts(US".", 1)
1469 || !cutthrough_put_nl()
1470 || !cutthrough_flush_send()
1471 )
1472 return cutthrough.addr.message;
e4bdf652 1473
74f1a423
JH
1474res = cutthrough_response(&cutthrough.cctx, '2', &cutthrough.addr.message,
1475 CUTTHROUGH_DATA_TIMEOUT);
d7978c0f 1476for (address_item * addr = &cutthrough.addr; addr; addr = addr->next)
817d9f57 1477 {
5032d1cf
JH
1478 addr->message = cutthrough.addr.message;
1479 switch(res)
1480 {
1481 case '2':
1482 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
78a3bbd5 1483 close_cutthrough_connection(US"delivered");
5032d1cf 1484 break;
817d9f57 1485
5032d1cf
JH
1486 case '4':
1487 delivery_log(LOG_MAIN, addr, 0,
1488 US"tmp-reject from cutthrough after DATA:");
1489 break;
e4bdf652 1490
5032d1cf
JH
1491 case '5':
1492 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1493 US"rejected after DATA:");
1494 break;
e4bdf652 1495
5032d1cf
JH
1496 default:
1497 break;
1498 }
817d9f57 1499 }
5032d1cf 1500return cutthrough.addr.message;
e4bdf652
JH
1501}
1502
1503
817d9f57 1504
059ec3d9
PH
1505/*************************************************
1506* Copy error to toplevel address *
1507*************************************************/
1508
1509/* This function is used when a verify fails or defers, to ensure that the
1510failure or defer information is in the original toplevel address. This applies
1511when an address is redirected to a single new address, and the failure or
1512deferral happens to the child address.
1513
1514Arguments:
1515 vaddr the verify address item
1516 addr the final address item
1517 yield FAIL or DEFER
1518
1519Returns: the value of YIELD
1520*/
1521
1522static int
1523copy_error(address_item *vaddr, address_item *addr, int yield)
1524{
1525if (addr != vaddr)
1526 {
1527 vaddr->message = addr->message;
1528 vaddr->user_message = addr->user_message;
1529 vaddr->basic_errno = addr->basic_errno;
1530 vaddr->more_errno = addr->more_errno;
d43cbe25 1531 vaddr->prop.address_data = addr->prop.address_data;
42855d71 1532 copyflag(vaddr, addr, af_pass_message);
059ec3d9
PH
1533 }
1534return yield;
1535}
1536
1537
1538
1539
ce552449
NM
1540/**************************************************
1541* printf that automatically handles TLS if needed *
1542***************************************************/
1543
1544/* This function is used by verify_address() as a substitute for all fprintf()
1545calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1546as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1547that assumes that we always use the smtp_out FILE* when not using TLS or the
1548ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1549that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1550fprintf().
1551
1552Arguments:
1553 f the candidate FILE* to write to
1554 format format string
1555 ... optional arguments
1556
1557Returns:
1558 nothing
1559*/
1560
1561static void PRINTF_FUNCTION(2,3)
1ba28e2b 1562respond_printf(FILE *f, const char *format, ...)
ce552449
NM
1563{
1564va_list ap;
1565
1566va_start(ap, format);
1567if (smtp_out && (f == smtp_out))
925ac8e4 1568 smtp_vprintf(format, FALSE, ap);
ce552449 1569else
513afc6a 1570 vfprintf(f, format, ap);
ce552449
NM
1571va_end(ap);
1572}
1573
1574
1575
059ec3d9
PH
1576/*************************************************
1577* Verify an email address *
1578*************************************************/
1579
1580/* This function is used both for verification (-bv and at other times) and
1581address testing (-bt), which is indicated by address_test_mode being set.
1582
1583Arguments:
1584 vaddr contains the address to verify; the next field in this block
1585 must be NULL
1586 f if not NULL, write the result to this file
1587 options various option bits:
1588 vopt_fake_sender => this sender verify is not for the real
1589 sender (it was verify=sender=xxxx or an address from a
1590 header line) - rewriting must not change sender_address
1591 vopt_is_recipient => this is a recipient address, otherwise
1592 it's a sender address - this affects qualification and
1593 rewriting and messages from callouts
1594 vopt_qualify => qualify an unqualified address; else error
1595 vopt_expn => called from SMTP EXPN command
eafd343b
TK
1596 vopt_success_on_redirect => when a new address is generated
1597 the verification instantly succeeds
059ec3d9
PH
1598
1599 These ones are used by do_callout() -- the options variable
1600 is passed to it.
1601
2a4be8f9 1602 vopt_callout_fullpm => if postmaster check, do full one
059ec3d9
PH
1603 vopt_callout_no_cache => don't use callout cache
1604 vopt_callout_random => do the "random" thing
1605 vopt_callout_recipsender => use real sender for recipient
1606 vopt_callout_recippmaster => use postmaster for recipient
1607
1608 callout if > 0, specifies that callout is required, and gives timeout
4deaf07d 1609 for individual commands
059ec3d9
PH
1610 callout_overall if > 0, gives overall timeout for the callout function;
1611 if < 0, a default is used (see do_callout())
8e669ac1 1612 callout_connect the connection timeout for callouts
059ec3d9
PH
1613 se_mailfrom when callout is requested to verify a sender, use this
1614 in MAIL FROM; NULL => ""
1615 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1616 thing and use this as the sender address (may be "")
1617
1618 routed if not NULL, set TRUE if routing succeeded, so we can
1619 distinguish between routing failed and callout failed
1620
1621Returns: OK address verified
1622 FAIL address failed to verify
1623 DEFER can't tell at present
1624*/
1625
1626int
8768d548
JH
1627verify_address(address_item * vaddr, FILE * fp, int options, int callout,
1628 int callout_overall, int callout_connect, uschar * se_mailfrom,
4deaf07d 1629 uschar *pm_mailfrom, BOOL *routed)
059ec3d9
PH
1630{
1631BOOL allok = TRUE;
8768d548 1632BOOL full_info = fp ? debug_selector != 0 : FALSE;
059ec3d9 1633BOOL expn = (options & vopt_expn) != 0;
eafd343b 1634BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
059ec3d9
PH
1635int i;
1636int yield = OK;
1637int verify_type = expn? v_expn :
8768d548 1638 f.address_test_mode? v_none :
8b9476ba 1639 options & vopt_is_recipient? v_recipient : v_sender;
059ec3d9
PH
1640address_item *addr_list;
1641address_item *addr_new = NULL;
1642address_item *addr_remote = NULL;
1643address_item *addr_local = NULL;
1644address_item *addr_succeed = NULL;
8b9476ba
JH
1645uschar **failure_ptr = options & vopt_is_recipient
1646 ? &recipient_verify_failure : &sender_verify_failure;
059ec3d9
PH
1647uschar *ko_prefix, *cr;
1648uschar *address = vaddr->address;
1649uschar *save_sender;
1650uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1651
2c7db3f5
PH
1652/* Clear, just in case */
1653
1654*failure_ptr = NULL;
1655
059ec3d9
PH
1656/* Set up a prefix and suffix for error message which allow us to use the same
1657output statements both in EXPN mode (where an SMTP response is needed) and when
1658debugging with an output file. */
1659
1660if (expn)
1661 {
1662 ko_prefix = US"553 ";
1663 cr = US"\r";
1664 }
1665else ko_prefix = cr = US"";
1666
1667/* Add qualify domain if permitted; otherwise an unqualified address fails. */
1668
1669if (parse_find_at(address) == NULL)
1670 {
2ddb4094 1671 if (!(options & vopt_qualify))
059ec3d9 1672 {
8768d548
JH
1673 if (fp)
1674 respond_printf(fp, "%sA domain is required for \"%s\"%s\n",
ce552449 1675 ko_prefix, address, cr);
8e669ac1 1676 *failure_ptr = US"qualify";
059ec3d9
PH
1677 return FAIL;
1678 }
8b9476ba 1679 address = rewrite_address_qualify(address, options & vopt_is_recipient);
059ec3d9
PH
1680 }
1681
1682DEBUG(D_verify)
1683 {
1684 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
8768d548 1685 debug_printf("%s %s\n", f.address_test_mode? "Testing" : "Verifying", address);
059ec3d9
PH
1686 }
1687
1688/* Rewrite and report on it. Clear the domain and local part caches - these
1689may have been set by domains and local part tests during an ACL. */
1690
2ddb4094 1691if (global_rewrite_rules)
059ec3d9
PH
1692 {
1693 uschar *old = address;
8b9476ba 1694 address = rewrite_address(address, options & vopt_is_recipient, FALSE,
059ec3d9
PH
1695 global_rewrite_rules, rewrite_existflags);
1696 if (address != old)
1697 {
d7978c0f
JH
1698 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1699 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
8768d548 1700 if (fp && !expn) fprintf(fp, "Address rewritten as: %s\n", address);
059ec3d9
PH
1701 }
1702 }
1703
1704/* If this is the real sender address, we must update sender_address at
1705this point, because it may be referred to in the routers. */
1706
2ddb4094 1707if (!(options & (vopt_fake_sender|vopt_is_recipient)))
059ec3d9
PH
1708 sender_address = address;
1709
1710/* If the address was rewritten to <> no verification can be done, and we have
1711to return OK. This rewriting is permitted only for sender addresses; for other
1712addresses, such rewriting fails. */
1713
2ddb4094 1714if (!address[0]) return OK;
059ec3d9 1715
d9b2312b
JH
1716/* Flip the legacy TLS-related variables over to the outbound set in case
1717they're used in the context of a transport used by verification. Reset them
ea90b718 1718at exit from this routine (so no returns allowed from here on). */
d9b2312b 1719
35aba663 1720tls_modify_variables(&tls_out);
d9b2312b 1721
059ec3d9
PH
1722/* Save a copy of the sender address for re-instating if we change it to <>
1723while verifying a sender address (a nice bit of self-reference there). */
1724
1725save_sender = sender_address;
1726
ea90b718
JH
1727/* Observability variable for router/transport use */
1728
8b9476ba 1729verify_mode = options & vopt_is_recipient ? US"R" : US"S";
ea90b718 1730
059ec3d9
PH
1731/* Update the address structure with the possibly qualified and rewritten
1732address. Set it up as the starting address on the chain of new addresses. */
1733
1734vaddr->address = address;
1735addr_new = vaddr;
1736
1737/* We need a loop, because an address can generate new addresses. We must also
1738cope with generated pipes and files at the top level. (See also the code and
1739comment in deliver.c.) However, it is usually the case that the router for
1740user's .forward files has its verify flag turned off.
1741
1742If an address generates more than one child, the loop is used only when
1743full_info is set, and this can only be set locally. Remote enquiries just get
1744information about the top level address, not anything that it generated. */
1745
ea90b718 1746while (addr_new)
059ec3d9
PH
1747 {
1748 int rc;
1749 address_item *addr = addr_new;
1750
1751 addr_new = addr->next;
1752 addr->next = NULL;
1753
1754 DEBUG(D_verify)
1755 {
1756 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1757 debug_printf("Considering %s\n", addr->address);
1758 }
1759
1760 /* Handle generated pipe, file or reply addresses. We don't get these
1761 when handling EXPN, as it does only one level of expansion. */
1762
1763 if (testflag(addr, af_pfr))
1764 {
1765 allok = FALSE;
8768d548 1766 if (fp)
059ec3d9
PH
1767 {
1768 BOOL allow;
1769
1770 if (addr->address[0] == '>')
1771 {
1772 allow = testflag(addr, af_allow_reply);
8768d548 1773 fprintf(fp, "%s -> mail %s", addr->parent->address, addr->address + 1);
059ec3d9
PH
1774 }
1775 else
1776 {
2ddb4094
JH
1777 allow = addr->address[0] == '|'
1778 ? testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
8768d548 1779 fprintf(fp, "%s -> %s", addr->parent->address, addr->address);
059ec3d9
PH
1780 }
1781
1782 if (addr->basic_errno == ERRNO_BADTRANSPORT)
8768d548 1783 fprintf(fp, "\n*** Error in setting up pipe, file, or autoreply:\n"
059ec3d9
PH
1784 "%s\n", addr->message);
1785 else if (allow)
8768d548 1786 fprintf(fp, "\n transport = %s\n", addr->transport->name);
059ec3d9 1787 else
8768d548 1788 fprintf(fp, " *** forbidden ***\n");
059ec3d9
PH
1789 }
1790 continue;
1791 }
1792
1793 /* Just in case some router parameter refers to it. */
1794
2f682e45
JH
1795 return_path = addr->prop.errors_address
1796 ? addr->prop.errors_address : sender_address;
059ec3d9
PH
1797
1798 /* Split the address into domain and local part, handling the %-hack if
1799 necessary, and then route it. While routing a sender address, set
1800 $sender_address to <> because that is what it will be if we were trying to
1801 send a bounce to the sender. */
1802
2f682e45 1803 if (routed) *routed = FALSE;
059ec3d9
PH
1804 if ((rc = deliver_split_address(addr)) == OK)
1805 {
8b9476ba 1806 if (!(options & vopt_is_recipient)) sender_address = null_sender;
059ec3d9
PH
1807 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1808 &addr_succeed, verify_type);
1809 sender_address = save_sender; /* Put back the real sender */
1810 }
1811
1812 /* If routing an address succeeded, set the flag that remembers, for use when
1813 an ACL cached a sender verify (in case a callout fails). Then if routing set
1814 up a list of hosts or the transport has a host list, and the callout option
1815 is set, and we aren't in a host checking run, do the callout verification,
1816 and set another flag that notes that a callout happened. */
1817
1818 if (rc == OK)
1819 {
2f682e45 1820 if (routed) *routed = TRUE;
059ec3d9
PH
1821 if (callout > 0)
1822 {
08f3b11b 1823 transport_instance * tp;
2f682e45 1824 host_item * host_list = addr->host_list;
059ec3d9 1825
26da7e20
PH
1826 /* Make up some data for use in the case where there is no remote
1827 transport. */
1828
1829 transport_feedback tf = {
f2ed27cf
JH
1830 .interface = NULL, /* interface (=> any) */
1831 .port = US"smtp",
1832 .protocol = US"smtp",
1833 .hosts = NULL,
1834 .helo_data = US"$smtp_active_hostname",
1835 .hosts_override = FALSE,
1836 .hosts_randomize = FALSE,
1837 .gethostbyname = FALSE,
1838 .qualify_single = TRUE,
1839 .search_parents = FALSE
26da7e20 1840 };
059ec3d9
PH
1841
1842 /* If verification yielded a remote transport, we want to use that
1843 transport's options, so as to mimic what would happen if we were really
1844 sending a message to this address. */
1845
08f3b11b 1846 if ((tp = addr->transport) && !tp->info->local)
059ec3d9 1847 {
08f3b11b 1848 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
059ec3d9
PH
1849
1850 /* If the transport has hosts and the router does not, or if the
1851 transport is configured to override the router's hosts, we must build a
1852 host list of the transport's hosts, and find the IP addresses */
1853
2f682e45 1854 if (tf.hosts && (!host_list || tf.hosts_override))
059ec3d9
PH
1855 {
1856 uschar *s;
55414b25 1857 const uschar *save_deliver_domain = deliver_domain;
750af86e 1858 uschar *save_deliver_localpart = deliver_localpart;
059ec3d9
PH
1859
1860 host_list = NULL; /* Ignore the router's hosts */
1861
1862 deliver_domain = addr->domain;
1863 deliver_localpart = addr->local_part;
1864 s = expand_string(tf.hosts);
750af86e
PH
1865 deliver_domain = save_deliver_domain;
1866 deliver_localpart = save_deliver_localpart;
059ec3d9 1867
2f682e45 1868 if (!s)
059ec3d9
PH
1869 {
1870 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1871 "\"%s\" in %s transport for callout: %s", tf.hosts,
08f3b11b 1872 tp->name, expand_string_message);
059ec3d9
PH
1873 }
1874 else
1875 {
322050c2 1876 int flags;
059ec3d9
PH
1877 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1878
1879 /* Just ignore failures to find a host address. If we don't manage
8e669ac1
PH
1880 to find any addresses, the callout will defer. Note that more than
1881 one address may be found for a single host, which will result in
1882 additional host items being inserted into the chain. Hence we must
d8ef3577 1883 save the next host first. */
059ec3d9 1884
66387a73 1885 flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
322050c2
PH
1886 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1887 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1888
d7978c0f 1889 for (host_item * host = host_list, * nexthost; host; host = nexthost)
059ec3d9 1890 {
d8ef3577 1891 nexthost = host->next;
8e669ac1 1892 if (tf.gethostbyname ||
7e66e54d 1893 string_is_ip_address(host->name, NULL) != 0)
55414b25 1894 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
059ec3d9 1895 else
9d9c3746 1896 {
8ac90765 1897 const dnssec_domains * dsp = NULL;
08f3b11b 1898 if (Ustrcmp(tp->driver_name, "smtp") == 0)
9d9c3746
JH
1899 {
1900 smtp_transport_options_block * ob =
08f3b11b 1901 (smtp_transport_options_block *) tp->options_block;
8ac90765 1902 dsp = &ob->dnssec;
9d9c3746
JH
1903 }
1904
2546388c 1905 (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
8ac90765 1906 dsp, NULL, NULL);
9d9c3746 1907 }
059ec3d9
PH
1908 }
1909 }
1910 }
1911 }
1912
8e669ac1 1913 /* Can only do a callout if we have at least one host! If the callout
2c7db3f5 1914 fails, it will have set ${sender,recipient}_verify_failure. */
059ec3d9 1915
2f682e45 1916 if (host_list)
059ec3d9
PH
1917 {
1918 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
8768d548 1919 if (host_checking && !f.host_checking_callout)
059ec3d9
PH
1920 {
1921 HDEBUG(D_verify)
1922 debug_printf("... callout omitted by default when host testing\n"
1923 "(Use -bhc if you want the callouts to happen.)\n");
1924 }
1925 else
1926 {
4ed8d31a
JH
1927#ifdef SUPPORT_TLS
1928 deliver_set_expansions(addr);
1929#endif
059ec3d9 1930 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
4deaf07d 1931 callout_connect, options, se_mailfrom, pm_mailfrom);
8a6b4e02
JH
1932#ifdef SUPPORT_TLS
1933 deliver_set_expansions(NULL);
1934#endif
059ec3d9
PH
1935 }
1936 }
1937 else
1938 {
1939 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
5ffb5d81 1940 "transport provided a host list, or transport is not smtp\n");
059ec3d9
PH
1941 }
1942 }
1943 }
8e669ac1 1944
2c7db3f5 1945 /* Otherwise, any failure is a routing failure */
8e669ac1
PH
1946
1947 else *failure_ptr = US"route";
059ec3d9
PH
1948
1949 /* A router may return REROUTED if it has set up a child address as a result
1950 of a change of domain name (typically from widening). In this case we always
1951 want to continue to verify the new child. */
1952
1953 if (rc == REROUTED) continue;
8e669ac1 1954
059ec3d9
PH
1955 /* Handle hard failures */
1956
1957 if (rc == FAIL)
1958 {
1959 allok = FALSE;
8768d548 1960 if (fp)
059ec3d9 1961 {
e6f6568e
PH
1962 address_item *p = addr->parent;
1963
8768d548 1964 respond_printf(fp, "%s%s %s", ko_prefix,
2f682e45 1965 full_info ? addr->address : address,
8768d548
JH
1966 f.address_test_mode ? "is undeliverable" : "failed to verify");
1967 if (!expn && f.admin_user)
059ec3d9
PH
1968 {
1969 if (addr->basic_errno > 0)
8768d548 1970 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2f682e45 1971 if (addr->message)
8768d548 1972 respond_printf(fp, ": %s", addr->message);
e6f6568e
PH
1973 }
1974
1975 /* Show parents iff doing full info */
1976
2f682e45 1977 if (full_info) while (p)
e6f6568e 1978 {
8768d548 1979 respond_printf(fp, "%s\n <-- %s", cr, p->address);
e6f6568e 1980 p = p->parent;
059ec3d9 1981 }
8768d548 1982 respond_printf(fp, "%s\n", cr);
059ec3d9 1983 }
57cc2785 1984 cancel_cutthrough_connection(TRUE, US"routing hard fail");
059ec3d9 1985
d9b2312b 1986 if (!full_info)
2f682e45 1987 {
d9b2312b
JH
1988 yield = copy_error(vaddr, addr, FAIL);
1989 goto out;
2f682e45
JH
1990 }
1991 yield = FAIL;
059ec3d9
PH
1992 }
1993
1994 /* Soft failure */
1995
1996 else if (rc == DEFER)
1997 {
1998 allok = FALSE;
8768d548 1999 if (fp)
059ec3d9 2000 {
e6f6568e 2001 address_item *p = addr->parent;
8768d548 2002 respond_printf(fp, "%s%s cannot be resolved at this time", ko_prefix,
322050c2 2003 full_info? addr->address : address);
8768d548 2004 if (!expn && f.admin_user)
059ec3d9
PH
2005 {
2006 if (addr->basic_errno > 0)
8768d548 2007 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2f682e45 2008 if (addr->message)
8768d548 2009 respond_printf(fp, ": %s", addr->message);
059ec3d9 2010 else if (addr->basic_errno <= 0)
8768d548 2011 respond_printf(fp, ": unknown error");
059ec3d9
PH
2012 }
2013
e6f6568e
PH
2014 /* Show parents iff doing full info */
2015
2f682e45 2016 if (full_info) while (p)
e6f6568e 2017 {
8768d548 2018 respond_printf(fp, "%s\n <-- %s", cr, p->address);
e6f6568e
PH
2019 p = p->parent;
2020 }
8768d548 2021 respond_printf(fp, "%s\n", cr);
059ec3d9 2022 }
57cc2785 2023 cancel_cutthrough_connection(TRUE, US"routing soft fail");
e4bdf652 2024
d9b2312b
JH
2025 if (!full_info)
2026 {
2027 yield = copy_error(vaddr, addr, DEFER);
2028 goto out;
2029 }
2f682e45 2030 if (yield == OK) yield = DEFER;
059ec3d9
PH
2031 }
2032
2033 /* If we are handling EXPN, we do not want to continue to route beyond
e6f6568e 2034 the top level (whose address is in "address"). */
059ec3d9
PH
2035
2036 else if (expn)
2037 {
2038 uschar *ok_prefix = US"250-";
2f682e45
JH
2039
2040 if (!addr_new)
2041 if (!addr_local && !addr_remote)
8768d548 2042 respond_printf(fp, "250 mail to <%s> is discarded\r\n", address);
059ec3d9 2043 else
8768d548 2044 respond_printf(fp, "250 <%s>\r\n", address);
2f682e45
JH
2045
2046 else do
059ec3d9
PH
2047 {
2048 address_item *addr2 = addr_new;
2049 addr_new = addr2->next;
2f682e45 2050 if (!addr_new) ok_prefix = US"250 ";
8768d548 2051 respond_printf(fp, "%s<%s>\r\n", ok_prefix, addr2->address);
2f682e45 2052 } while (addr_new);
d9b2312b
JH
2053 yield = OK;
2054 goto out;
059ec3d9
PH
2055 }
2056
2057 /* Successful routing other than EXPN. */
2058
2059 else
2060 {
2061 /* Handle successful routing when short info wanted. Otherwise continue for
2062 other (generated) addresses. Short info is the operational case. Full info
2063 can be requested only when debug_selector != 0 and a file is supplied.
2064
2065 There is a conflict between the use of aliasing as an alternate email
2066 address, and as a sort of mailing list. If an alias turns the incoming
2067 address into just one address (e.g. J.Caesar->jc44) you may well want to
2068 carry on verifying the generated address to ensure it is valid when
2069 checking incoming mail. If aliasing generates multiple addresses, you
2070 probably don't want to do this. Exim therefore treats the generation of
2071 just a single new address as a special case, and continues on to verify the
2072 generated address. */
2073
2f682e45
JH
2074 if ( !full_info /* Stop if short info wanted AND */
2075 && ( ( !addr_new /* No new address OR */
2076 || addr_new->next /* More than one new address OR */
2077 || testflag(addr_new, af_pfr) /* New address is pfr */
2078 )
2079 || /* OR */
2080 ( addr_new /* At least one new address AND */
2081 && success_on_redirect /* success_on_redirect is set */
2082 ) )
2083 )
059ec3d9 2084 {
8768d548
JH
2085 if (fp) fprintf(fp, "%s %s\n",
2086 address, f.address_test_mode ? "is deliverable" : "verified");
059ec3d9
PH
2087
2088 /* If we have carried on to verify a child address, we want the value
2089 of $address_data to be that of the child */
2090
d43cbe25 2091 vaddr->prop.address_data = addr->prop.address_data;
98c82a3d
JH
2092
2093 /* If stopped because more than one new address, cannot cutthrough */
2094
2095 if (addr_new && addr_new->next)
57cc2785 2096 cancel_cutthrough_connection(TRUE, US"multiple addresses from routing");
98c82a3d 2097
d9b2312b
JH
2098 yield = OK;
2099 goto out;
059ec3d9
PH
2100 }
2101 }
2102 } /* Loop for generated addresses */
2103
2104/* Display the full results of the successful routing, including any generated
8768d548 2105addresses. Control gets here only when full_info is set, which requires fp not
059ec3d9
PH
2106to be NULL, and this occurs only when a top-level verify is called with the
2107debugging switch on.
2108
2109If there are no local and no remote addresses, and there were no pipes, files,
2110or autoreplies, and there were no errors or deferments, the message is to be
2111discarded, usually because of the use of :blackhole: in an alias file. */
2112
2f682e45 2113if (allok && !addr_local && !addr_remote)
dbcef0ea 2114 {
8768d548 2115 fprintf(fp, "mail to %s is discarded\n", address);
d9b2312b 2116 goto out;
dbcef0ea 2117 }
059ec3d9 2118
dbcef0ea 2119for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
08f3b11b 2120 while (addr_list)
059ec3d9
PH
2121 {
2122 address_item *addr = addr_list;
08f3b11b
JH
2123 transport_instance * tp = addr->transport;
2124
059ec3d9
PH
2125 addr_list = addr->next;
2126
8768d548 2127 fprintf(fp, "%s", CS addr->address);
384152a6 2128#ifdef EXPERIMENTAL_SRS
d43cbe25 2129 if(addr->prop.srs_sender)
8768d548 2130 fprintf(fp, " [srs = %s]", addr->prop.srs_sender);
384152a6 2131#endif
dbcef0ea
PH
2132
2133 /* If the address is a duplicate, show something about it. */
2134
2135 if (!testflag(addr, af_pfr))
2136 {
2137 tree_node *tnode;
08f3b11b 2138 if ((tnode = tree_search(tree_duplicates, addr->unique)))
8768d548 2139 fprintf(fp, " [duplicate, would not be delivered]");
dbcef0ea
PH
2140 else tree_add_duplicate(addr->unique, addr);
2141 }
2142
2143 /* Now show its parents */
2144
d7978c0f 2145 for (address_item * p = addr->parent; p; p = p->parent)
8768d548
JH
2146 fprintf(fp, "\n <-- %s", p->address);
2147 fprintf(fp, "\n ");
059ec3d9
PH
2148
2149 /* Show router, and transport */
2150
8768d548 2151 fprintf(fp, "router = %s, transport = %s\n",
08f3b11b 2152 addr->router->name, tp ? tp->name : US"unset");
059ec3d9
PH
2153
2154 /* Show any hosts that are set up by a router unless the transport
2155 is going to override them; fiddle a bit to get a nice format. */
2156
08f3b11b 2157 if (addr->host_list && tp && !tp->overrides_hosts)
059ec3d9 2158 {
059ec3d9
PH
2159 int maxlen = 0;
2160 int maxaddlen = 0;
d7978c0f 2161 for (host_item * h = addr->host_list; h; h = h->next)
08f3b11b 2162 { /* get max lengths of host names, addrs */
059ec3d9
PH
2163 int len = Ustrlen(h->name);
2164 if (len > maxlen) maxlen = len;
08f3b11b 2165 len = h->address ? Ustrlen(h->address) : 7;
059ec3d9
PH
2166 if (len > maxaddlen) maxaddlen = len;
2167 }
d7978c0f 2168 for (host_item * h = addr->host_list; h; h = h->next)
08f3b11b 2169 {
8768d548 2170 fprintf(fp, " host %-*s ", maxlen, h->name);
08f3b11b
JH
2171
2172 if (h->address)
8768d548 2173 fprintf(fp, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
08f3b11b 2174 else if (tp->info->local)
8768d548 2175 fprintf(fp, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
08f3b11b 2176 else
8768d548 2177 fprintf(fp, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
08f3b11b 2178
8768d548
JH
2179 if (h->mx >= 0) fprintf(fp, " MX=%d", h->mx);
2180 if (h->port != PORT_NONE) fprintf(fp, " port=%d", h->port);
2181 if (f.running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", fp);
2182 if (h->status == hstatus_unusable) fputs(" ** unusable **", fp);
2183 fputc('\n', fp);
059ec3d9
PH
2184 }
2185 }
2186 }
059ec3d9 2187
d9b2312b 2188/* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2c7db3f5
PH
2189the -bv or -bt case). */
2190
d9b2312b 2191out:
ea90b718 2192verify_mode = NULL;
35aba663 2193tls_modify_variables(&tls_in);
d9b2312b 2194
8e669ac1 2195return yield;
059ec3d9
PH
2196}
2197
2198
2199
2200
2201/*************************************************
2202* Check headers for syntax errors *
2203*************************************************/
2204
2205/* This function checks those header lines that contain addresses, and verifies
db57e575 2206that all the addresses therein are 5322-syntactially correct.
059ec3d9
PH
2207
2208Arguments:
2209 msgptr where to put an error message
2210
2211Returns: OK
2212 FAIL
2213*/
2214
2215int
2216verify_check_headers(uschar **msgptr)
2217{
059ec3d9 2218uschar *colon, *s;
1eccaa59 2219int yield = OK;
059ec3d9 2220
d7978c0f 2221for (header_line * h = header_list; h && yield == OK; h = h->next)
059ec3d9
PH
2222 {
2223 if (h->type != htype_from &&
2224 h->type != htype_reply_to &&
2225 h->type != htype_sender &&
2226 h->type != htype_to &&
2227 h->type != htype_cc &&
2228 h->type != htype_bcc)
2229 continue;
2230
2231 colon = Ustrchr(h->text, ':');
2232 s = colon + 1;
2233 while (isspace(*s)) s++;
2234
1eccaa59
PH
2235 /* Loop for multiple addresses in the header, enabling group syntax. Note
2236 that we have to reset this after the header has been scanned. */
059ec3d9 2237
8768d548 2238 f.parse_allow_group = TRUE;
059ec3d9 2239
db57e575 2240 while (*s)
059ec3d9
PH
2241 {
2242 uschar *ss = parse_find_address_end(s, FALSE);
2243 uschar *recipient, *errmess;
2244 int terminator = *ss;
2245 int start, end, domain;
2246
2247 /* Temporarily terminate the string at this point, and extract the
1eccaa59 2248 operative address within, allowing group syntax. */
059ec3d9
PH
2249
2250 *ss = 0;
2251 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2252 *ss = terminator;
2253
2254 /* Permit an unqualified address only if the message is local, or if the
2255 sending host is configured to be permitted to send them. */
2256
db57e575 2257 if (recipient && !domain)
059ec3d9
PH
2258 {
2259 if (h->type == htype_from || h->type == htype_sender)
2260 {
8768d548 2261 if (!f.allow_unqualified_sender) recipient = NULL;
059ec3d9
PH
2262 }
2263 else
2264 {
8768d548 2265 if (!f.allow_unqualified_recipient) recipient = NULL;
059ec3d9
PH
2266 }
2267 if (recipient == NULL) errmess = US"unqualified address not permitted";
2268 }
2269
2270 /* It's an error if no address could be extracted, except for the special
2271 case of an empty address. */
2272
db57e575 2273 if (!recipient && Ustrcmp(errmess, "empty address") != 0)
059ec3d9
PH
2274 {
2275 uschar *verb = US"is";
2276 uschar *t = ss;
1ab95fa6 2277 uschar *tt = colon;
059ec3d9
PH
2278 int len;
2279
2280 /* Arrange not to include any white space at the end in the
1ab95fa6 2281 error message or the header name. */
059ec3d9
PH
2282
2283 while (t > s && isspace(t[-1])) t--;
1ab95fa6 2284 while (tt > h->text && isspace(tt[-1])) tt--;
059ec3d9 2285
1ab95fa6 2286 /* Add the address that failed to the error message, since in a
059ec3d9
PH
2287 header with very many addresses it is sometimes hard to spot
2288 which one is at fault. However, limit the amount of address to
2289 quote - cases have been seen where, for example, a missing double
2290 quote in a humungous To: header creates an "address" that is longer
2291 than string_sprintf can handle. */
2292
2293 len = t - s;
2294 if (len > 1024)
2295 {
2296 len = 1024;
2297 verb = US"begins";
2298 }
2299
55414b25
JH
2300 /* deconst cast ok as we're passing a non-const to string_printing() */
2301 *msgptr = US string_printing(
1ab95fa6 2302 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
bb07bcd3 2303 errmess, (int)(tt - h->text), h->text, verb, len, s));
059ec3d9 2304
1eccaa59
PH
2305 yield = FAIL;
2306 break; /* Out of address loop */
059ec3d9
PH
2307 }
2308
2309 /* Advance to the next address */
2310
db57e575 2311 s = ss + (terminator ? 1 : 0);
059ec3d9
PH
2312 while (isspace(*s)) s++;
2313 } /* Next address */
059ec3d9 2314
8768d548
JH
2315 f.parse_allow_group = FALSE;
2316 f.parse_found_group = FALSE;
1eccaa59
PH
2317 } /* Next header unless yield has been set FALSE */
2318
2319return yield;
059ec3d9
PH
2320}
2321
2322
770747fd
MFM
2323/*************************************************
2324* Check header names for 8-bit characters *
2325*************************************************/
2326
4c04137d 2327/* This function checks for invalid characters in header names. See
770747fd
MFM
2328RFC 5322, 2.2. and RFC 6532, 3.
2329
2330Arguments:
2331 msgptr where to put an error message
2332
2333Returns: OK
2334 FAIL
2335*/
2336
2337int
2338verify_check_header_names_ascii(uschar **msgptr)
2339{
d7978c0f 2340uschar *colon;
770747fd 2341
d7978c0f 2342for (header_line * h = header_list; h; h = h->next)
770747fd 2343 {
57cc2785 2344 colon = Ustrchr(h->text, ':');
d7978c0f 2345 for(uschar * s = h->text; s < colon; s++)
57cc2785
JH
2346 if ((*s < 33) || (*s > 126))
2347 {
2348 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2349 colon - h->text, h->text);
2350 return FAIL;
2351 }
770747fd
MFM
2352 }
2353return OK;
2354}
059ec3d9 2355
1c41c9cc
PH
2356/*************************************************
2357* Check for blind recipients *
2358*************************************************/
2359
2360/* This function checks that every (envelope) recipient is mentioned in either
2361the To: or Cc: header lines, thus detecting blind carbon copies.
2362
2363There are two ways of scanning that could be used: either scan the header lines
2364and tick off the recipients, or scan the recipients and check the header lines.
2365The original proposed patch did the former, but I have chosen to do the latter,
2366because (a) it requires no memory and (b) will use fewer resources when there
2367are many addresses in To: and/or Cc: and only one or two envelope recipients.
2368
7c498df1 2369Arguments: case_sensitive true if case sensitive matching should be used
1c41c9cc
PH
2370Returns: OK if there are no blind recipients
2371 FAIL if there is at least one blind recipient
2372*/
2373
2374int
7c498df1 2375verify_check_notblind(BOOL case_sensitive)
1c41c9cc 2376{
d7978c0f 2377for (int i = 0; i < recipients_count; i++)
1c41c9cc 2378 {
1c41c9cc
PH
2379 BOOL found = FALSE;
2380 uschar *address = recipients_list[i].address;
2381
d7978c0f 2382 for (header_line * h = header_list; !found && h; h = h->next)
1c41c9cc
PH
2383 {
2384 uschar *colon, *s;
2385
2386 if (h->type != htype_to && h->type != htype_cc) continue;
2387
2388 colon = Ustrchr(h->text, ':');
2389 s = colon + 1;
2390 while (isspace(*s)) s++;
2391
1eccaa59
PH
2392 /* Loop for multiple addresses in the header, enabling group syntax. Note
2393 that we have to reset this after the header has been scanned. */
1c41c9cc 2394
8768d548 2395 f.parse_allow_group = TRUE;
1c41c9cc 2396
d7978c0f 2397 while (*s)
1c41c9cc 2398 {
7c498df1
SA
2399 uschar * ss = parse_find_address_end(s, FALSE);
2400 uschar * recipient, * errmess;
1c41c9cc
PH
2401 int terminator = *ss;
2402 int start, end, domain;
2403
2404 /* Temporarily terminate the string at this point, and extract the
1eccaa59 2405 operative address within, allowing group syntax. */
1c41c9cc
PH
2406
2407 *ss = 0;
2408 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2409 *ss = terminator;
2410
2411 /* If we found a valid recipient that has a domain, compare it with the
7c498df1
SA
2412 envelope recipient. Local parts are compared with case-sensitivity
2413 according to the routine arg, domains case-insensitively.
2414 By comparing from the start with length "domain", we include the "@" at
2415 the end, which ensures that we are comparing the whole local part of each
2416 address. */
2417
2418 if (recipient && domain != 0)
2419 if ((found = (case_sensitive
2420 ? Ustrncmp(recipient, address, domain) == 0
2421 : strncmpic(recipient, address, domain) == 0)
2422 && strcmpic(recipient + domain, address + domain) == 0))
2423 break;
1c41c9cc
PH
2424
2425 /* Advance to the next address */
2426
7c498df1 2427 s = ss + (terminator ? 1:0);
1c41c9cc
PH
2428 while (isspace(*s)) s++;
2429 } /* Next address */
1eccaa59 2430
8768d548
JH
2431 f.parse_allow_group = FALSE;
2432 f.parse_found_group = FALSE;
1c41c9cc
PH
2433 } /* Next header (if found is false) */
2434
2435 if (!found) return FAIL;
2436 } /* Next recipient */
2437
2438return OK;
2439}
2440
2441
059ec3d9
PH
2442
2443/*************************************************
2444* Find if verified sender *
2445*************************************************/
2446
2447/* Usually, just a single address is verified as the sender of the message.
2448However, Exim can be made to verify other addresses as well (often related in
2449some way), and this is useful in some environments. There may therefore be a
2450chain of such addresses that have previously been tested. This function finds
2451whether a given address is on the chain.
2452
2453Arguments: the address to be verified
2454Returns: pointer to an address item, or NULL
2455*/
2456
2457address_item *
2458verify_checked_sender(uschar *sender)
2459{
d7978c0f
JH
2460for (address_item * addr = sender_verified_list; addr; addr = addr->next)
2461 if (Ustrcmp(sender, addr->address) == 0) return addr;
2462return NULL;
059ec3d9
PH
2463}
2464
2465
2466
2467
2468
2469/*************************************************
2470* Get valid header address *
2471*************************************************/
2472
2473/* Scan the originator headers of the message, looking for an address that
2474verifies successfully. RFC 822 says:
2475
2476 o The "Sender" field mailbox should be sent notices of
2477 any problems in transport or delivery of the original
2478 messages. If there is no "Sender" field, then the
2479 "From" field mailbox should be used.
2480
2481 o If the "Reply-To" field exists, then the reply should
2482 go to the addresses indicated in that field and not to
2483 the address(es) indicated in the "From" field.
2484
2485So we check a Sender field if there is one, else a Reply_to field, else a From
2486field. As some strange messages may have more than one of these fields,
2487especially if they are resent- fields, check all of them if there is more than
2488one.
2489
2490Arguments:
2491 user_msgptr points to where to put a user error message
2492 log_msgptr points to where to put a log error message
2493 callout timeout for callout check (passed to verify_address())
2494 callout_overall overall callout timeout (ditto)
8e669ac1 2495 callout_connect connect callout timeout (ditto)
059ec3d9
PH
2496 se_mailfrom mailfrom for verify; NULL => ""
2497 pm_mailfrom sender for pm callout check (passed to verify_address())
2498 options callout options (passed to verify_address())
8e669ac1 2499 verrno where to put the address basic_errno
059ec3d9
PH
2500
2501If log_msgptr is set to something without setting user_msgptr, the caller
2502normally uses log_msgptr for both things.
2503
2504Returns: result of the verification attempt: OK, FAIL, or DEFER;
2505 FAIL is given if no appropriate headers are found
2506*/
2507
2508int
2509verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
8e669ac1 2510 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
fe5b5d0b 2511 uschar *pm_mailfrom, int options, int *verrno)
059ec3d9
PH
2512{
2513static int header_types[] = { htype_sender, htype_reply_to, htype_from };
1eccaa59 2514BOOL done = FALSE;
059ec3d9 2515int yield = FAIL;
059ec3d9 2516
d7978c0f
JH
2517for (int i = 0; i < 3 && !done; i++)
2518 for (header_line * h = header_list; h != NULL && !done; h = h->next)
059ec3d9
PH
2519 {
2520 int terminator, new_ok;
2521 uschar *s, *ss, *endname;
2522
2523 if (h->type != header_types[i]) continue;
2524 s = endname = Ustrchr(h->text, ':') + 1;
2525
1eccaa59
PH
2526 /* Scan the addresses in the header, enabling group syntax. Note that we
2527 have to reset this after the header has been scanned. */
2528
8768d548 2529 f.parse_allow_group = TRUE;
1eccaa59 2530
059ec3d9
PH
2531 while (*s != 0)
2532 {
2533 address_item *vaddr;
2534
2535 while (isspace(*s) || *s == ',') s++;
2536 if (*s == 0) break; /* End of header */
2537
2538 ss = parse_find_address_end(s, FALSE);
2539
2540 /* The terminator is a comma or end of header, but there may be white
2541 space preceding it (including newline for the last address). Move back
2542 past any white space so we can check against any cached envelope sender
2543 address verifications. */
2544
2545 while (isspace(ss[-1])) ss--;
2546 terminator = *ss;
2547 *ss = 0;
2548
2549 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2550 (int)(endname - h->text), h->text, s);
2551
2552 /* See if we have already verified this address as an envelope sender,
2553 and if so, use the previous answer. */
2554
2555 vaddr = verify_checked_sender(s);
2556
2557 if (vaddr != NULL && /* Previously checked */
2558 (callout <= 0 || /* No callout needed; OR */
2559 vaddr->special_action > 256)) /* Callout was done */
2560 {
2561 new_ok = vaddr->special_action & 255;
2562 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2563 *ss = terminator; /* Restore shortened string */
2564 }
2565
2566 /* Otherwise we run the verification now. We must restore the shortened
2567 string before running the verification, so the headers are correct, in
2568 case there is any rewriting. */
2569
2570 else
2571 {
2572 int start, end, domain;
1eccaa59
PH
2573 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2574 &domain, FALSE);
059ec3d9
PH
2575
2576 *ss = terminator;
2577
1eccaa59
PH
2578 /* If we found an empty address, just carry on with the next one, but
2579 kill the message. */
2580
2581 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2582 {
2583 *log_msgptr = NULL;
2584 s = ss;
2585 continue;
2586 }
2587
059ec3d9
PH
2588 /* If verification failed because of a syntax error, fail this
2589 function, and ensure that the failing address gets added to the error
2590 message. */
2591
2592 if (address == NULL)
2593 {
2594 new_ok = FAIL;
1eccaa59
PH
2595 while (ss > s && isspace(ss[-1])) ss--;
2596 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2597 "scanning for sender: %s in \"%.*s\"",
bb07bcd3 2598 (int)(endname - h->text), h->text, *log_msgptr, (int)(ss - s), s);
1eccaa59
PH
2599 yield = FAIL;
2600 done = TRUE;
2601 break;
059ec3d9
PH
2602 }
2603
2f6603e1 2604 /* Else go ahead with the sender verification. But it isn't *the*
059ec3d9
PH
2605 sender of the message, so set vopt_fake_sender to stop sender_address
2606 being replaced after rewriting or qualification. */
2607
2608 else
2609 {
2610 vaddr = deliver_make_addr(address, FALSE);
2611 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
8e669ac1 2612 callout, callout_overall, callout_connect, se_mailfrom,
4deaf07d 2613 pm_mailfrom, NULL);
059ec3d9
PH
2614 }
2615 }
2616
2617 /* We now have the result, either newly found, or cached. If we are
2618 giving out error details, set a specific user error. This means that the
2619 last of these will be returned to the user if all three fail. We do not
2620 set a log message - the generic one below will be used. */
2621
fe5b5d0b 2622 if (new_ok != OK)
059ec3d9 2623 {
8e669ac1 2624 *verrno = vaddr->basic_errno;
fe5b5d0b 2625 if (smtp_return_error_details)
fe5b5d0b
PH
2626 *user_msgptr = string_sprintf("Rejected after DATA: "
2627 "could not verify \"%.*s\" header address\n%s: %s",
bb07bcd3 2628 (int)(endname - h->text), h->text, vaddr->address, vaddr->message);
8e669ac1 2629 }
059ec3d9
PH
2630
2631 /* Success or defer */
2632
1eccaa59
PH
2633 if (new_ok == OK)
2634 {
2635 yield = OK;
2636 done = TRUE;
2637 break;
2638 }
2639
059ec3d9
PH
2640 if (new_ok == DEFER) yield = DEFER;
2641
2642 /* Move on to any more addresses in the header */
2643
2644 s = ss;
1eccaa59
PH
2645 } /* Next address */
2646
8768d548
JH
2647 f.parse_allow_group = FALSE;
2648 f.parse_found_group = FALSE;
1eccaa59 2649 } /* Next header, unless done */
d7978c0f 2650 /* Next header type unless done */
059ec3d9
PH
2651
2652if (yield == FAIL && *log_msgptr == NULL)
2653 *log_msgptr = US"there is no valid sender in any header line";
2654
2655if (yield == DEFER && *log_msgptr == NULL)
2656 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2657
2658return yield;
2659}
2660
2661
2662
2663
2664/*************************************************
2665* Get RFC 1413 identification *
2666*************************************************/
2667
2668/* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2669the timeout is set to zero, then the query is not done. There may also be lists
2670of hosts and nets which are exempt. To guard against malefactors sending
2671non-printing characters which could, for example, disrupt a message's headers,
2672make sure the string consists of printing characters only.
2673
2674Argument:
2675 port the port to connect to; usually this is IDENT_PORT (113), but when
2676 running in the test harness with -bh a different value is used.
2677
2678Returns: nothing
2679
2680Side effect: any received ident value is put in sender_ident (NULL otherwise)
2681*/
2682
2683void
2684verify_get_ident(int port)
2685{
74f1a423
JH
2686client_conn_ctx ident_conn_ctx = {0};
2687int host_af, qlen;
059ec3d9
PH
2688int received_sender_port, received_interface_port, n;
2689uschar *p;
44e6c20c 2690blob early_data;
059ec3d9
PH
2691uschar buffer[2048];
2692
2693/* Default is no ident. Check whether we want to do an ident check for this
2694host. */
2695
2696sender_ident = NULL;
2697if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2698 return;
2699
2700DEBUG(D_ident) debug_printf("doing ident callback\n");
2701
2702/* Set up a connection to the ident port of the remote host. Bind the local end
2703to the incoming interface address. If the sender host address is an IPv6
2704address, the incoming interface address will also be IPv6. */
2705
fb05276a 2706host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
74f1a423 2707if ((ident_conn_ctx.sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
059ec3d9 2708
74f1a423 2709if (ip_bind(ident_conn_ctx.sock, host_af, interface_address, 0) < 0)
059ec3d9
PH
2710 {
2711 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2712 strerror(errno));
2713 goto END_OFF;
2714 }
2715
44e6c20c
JH
2716/* Construct and send the query. */
2717
2718qlen = snprintf(CS buffer, sizeof(buffer), "%d , %d\r\n",
2719 sender_host_port, interface_port);
2720early_data.data = buffer;
2721early_data.len = qlen;
2722
b536a578 2723/*XXX we trust that the query is idempotent */
74f1a423 2724if (ip_connect(ident_conn_ctx.sock, host_af, sender_host_address, port,
44e6c20c 2725 rfc1413_query_timeout, &early_data) < 0)
059ec3d9 2726 {
6c6d6e48 2727 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
059ec3d9
PH
2728 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2729 sender_host_address);
059ec3d9 2730 else
059ec3d9
PH
2731 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2732 sender_host_address, strerror(errno));
059ec3d9
PH
2733 goto END_OFF;
2734 }
2735
059ec3d9
PH
2736/* Read a response line. We put it into the rest of the buffer, using several
2737recv() calls if necessary. */
2738
2739p = buffer + qlen;
2740
2741for (;;)
2742 {
2743 uschar *pp;
2744 int count;
2745 int size = sizeof(buffer) - (p - buffer);
2746
2747 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
74f1a423 2748 count = ip_recv(&ident_conn_ctx, p, size, rfc1413_query_timeout);
059ec3d9
PH
2749 if (count <= 0) goto END_OFF; /* Read error or EOF */
2750
2751 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2752 generous, and accept a plain \n terminator as well. The only illegal
2753 character is 0. */
2754
2755 for (pp = p; pp < p + count; pp++)
2756 {
2757 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2758 if (*pp == '\n')
2759 {
2760 if (pp[-1] == '\r') pp--;
2761 *pp = 0;
2762 goto GOT_DATA; /* Break out of both loops */
2763 }
2764 }
2765
2766 /* Reached the end of the data without finding \n. Let the loop continue to
2767 read some more, if there is room. */
2768
2769 p = pp;
2770 }
2771
2772GOT_DATA:
2773
2774/* We have received a line of data. Check it carefully. It must start with the
2775same two port numbers that we sent, followed by data as defined by the RFC. For
2776example,
2777
2778 12345 , 25 : USERID : UNIX :root
2779
2780However, the amount of white space may be different to what we sent. In the
2781"osname" field there may be several sub-fields, comma separated. The data we
2782actually want to save follows the third colon. Some systems put leading spaces
2783in it - we discard those. */
2784
2785if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2786 &received_interface_port, &n) != 2 ||
2787 received_sender_port != sender_host_port ||
2788 received_interface_port != interface_port)
2789 goto END_OFF;
2790
2791p = buffer + qlen + n;
2792while(isspace(*p)) p++;
2793if (*p++ != ':') goto END_OFF;
2794while(isspace(*p)) p++;
2795if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2796p += 6;
2797while(isspace(*p)) p++;
2798if (*p++ != ':') goto END_OFF;
2799while (*p != 0 && *p != ':') p++;
2800if (*p++ == 0) goto END_OFF;
2801while(isspace(*p)) p++;
2802if (*p == 0) goto END_OFF;
2803
2804/* The rest of the line is the data we want. We turn it into printing
2805characters when we save it, so that it cannot mess up the format of any logging
2806or Received: lines into which it gets inserted. We keep a maximum of 127
55414b25 2807characters. The deconst cast is ok as we fed a nonconst to string_printing() */
059ec3d9 2808
55414b25 2809sender_ident = US string_printing(string_copyn(p, 127));
059ec3d9
PH
2810DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2811
2812END_OFF:
74f1a423 2813(void)close(ident_conn_ctx.sock);
059ec3d9
PH
2814return;
2815}
2816
2817
2818
2819
2820/*************************************************
2821* Match host to a single host-list item *
2822*************************************************/
2823
2824/* This function compares a host (name or address) against a single item
2825from a host list. The host name gets looked up if it is needed and is not
2826already known. The function is called from verify_check_this_host() via
2827match_check_list(), which is why most of its arguments are in a single block.
2828
2829Arguments:
2830 arg the argument block (see below)
2831 ss the host-list item
2832 valueptr where to pass back looked up data, or NULL
2833 error for error message when returning ERROR
2834
2835The block contains:
32d668a5
PH
2836 host_name (a) the host name, or
2837 (b) NULL, implying use sender_host_name and
2838 sender_host_aliases, looking them up if required, or
2839 (c) the empty string, meaning that only IP address matches
2840 are permitted
059ec3d9
PH
2841 host_address the host address
2842 host_ipv4 the IPv4 address taken from an IPv6 one
2843
2844Returns: OK matched
2845 FAIL did not match
2846 DEFER lookup deferred
32d668a5
PH
2847 ERROR (a) failed to find the host name or IP address, or
2848 (b) unknown lookup type specified, or
2849 (c) host name encountered when only IP addresses are
2850 being matched
059ec3d9
PH
2851*/
2852
32d668a5 2853int
55414b25 2854check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
059ec3d9
PH
2855{
2856check_host_block *cb = (check_host_block *)arg;
32d668a5 2857int mlen = -1;
059ec3d9 2858int maskoffset;
32d668a5 2859BOOL iplookup = FALSE;
059ec3d9 2860BOOL isquery = FALSE;
32d668a5 2861BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
55414b25 2862const uschar *t;
32d668a5 2863uschar *semicolon;
059ec3d9
PH
2864uschar **aliases;
2865
2866/* Optimize for the special case when the pattern is "*". */
2867
2868if (*ss == '*' && ss[1] == 0) return OK;
2869
2870/* If the pattern is empty, it matches only in the case when there is no host -
2871this can occur in ACL checking for SMTP input using the -bs option. In this
2872situation, the host address is the empty string. */
2873
2874if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2875if (*ss == 0) return FAIL;
2876
32d668a5
PH
2877/* If the pattern is precisely "@" then match against the primary host name,
2878provided that host name matching is permitted; if it's "@[]" match against the
2879local host's IP addresses. */
059ec3d9
PH
2880
2881if (*ss == '@')
2882 {
32d668a5
PH
2883 if (ss[1] == 0)
2884 {
2885 if (isiponly) return ERROR;
2886 ss = primary_hostname;
2887 }
059ec3d9
PH
2888 else if (Ustrcmp(ss, "@[]") == 0)
2889 {
d7978c0f 2890 for (ip_address_item * ip = host_find_interfaces(); ip; ip = ip->next)
059ec3d9
PH
2891 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2892 return FAIL;
2893 }
2894 }
2895
2896/* If the pattern is an IP address, optionally followed by a bitmask count, do
4c04137d 2897a (possibly masked) comparison with the current IP address. */
059ec3d9 2898
7e66e54d 2899if (string_is_ip_address(ss, &maskoffset) != 0)
059ec3d9
PH
2900 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2901
1688f43b
PH
2902/* The pattern is not an IP address. A common error that people make is to omit
2903one component of an IPv4 address, either by accident, or believing that, for
2904example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2905which it isn't. (Those applications that do accept 1.2.3 as an IP address
2906interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2907ancient specification.) To aid in debugging these cases, we give a specific
2908error if the pattern contains only digits and dots or contains a slash preceded
2909only by digits and dots (a slash at the start indicates a file name and of
2910course slashes may be present in lookups, but not preceded only by digits and
2911dots). */
2912
d7978c0f 2913for (t = ss; isdigit(*t) || *t == '.'; ) t++;
1688f43b
PH
2914if (*t == 0 || (*t == '/' && t != ss))
2915 {
2916 *error = US"malformed IPv4 address or address mask";
2917 return ERROR;
2918 }
2919
32d668a5 2920/* See if there is a semicolon in the pattern */
059ec3d9 2921
32d668a5
PH
2922semicolon = Ustrchr(ss, ';');
2923
2924/* If we are doing an IP address only match, then all lookups must be IP
df199fec 2925address lookups, even if there is no "net-". */
32d668a5
PH
2926
2927if (isiponly)
059ec3d9 2928 {
32d668a5
PH
2929 iplookup = semicolon != NULL;
2930 }
059ec3d9 2931
32d668a5 2932/* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
df199fec
PH
2933a lookup on a masked IP network, in textual form. We obey this code even if we
2934have already set iplookup, so as to skip over the "net-" prefix and to set the
2935mask length. The net- stuff really only applies to single-key lookups where the
2936key is implicit. For query-style lookups the key is specified in the query.
2937From release 4.30, the use of net- for query style is no longer needed, but we
2938retain it for backward compatibility. */
2939
2940if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
32d668a5
PH
2941 {
2942 mlen = 0;
2943 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2944 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2945 iplookup = (*t++ == '-');
2946 }
d7978c0f
JH
2947else
2948 t = ss;
059ec3d9 2949
32d668a5 2950/* Do the IP address lookup if that is indeed what we have */
059ec3d9 2951
32d668a5
PH
2952if (iplookup)
2953 {
2954 int insize;
2955 int search_type;
2956 int incoming[4];
2957 void *handle;
2958 uschar *filename, *key, *result;
2959 uschar buffer[64];
059ec3d9 2960
32d668a5 2961 /* Find the search type */
059ec3d9 2962
32d668a5 2963 search_type = search_findtype(t, semicolon - t);
059ec3d9 2964
32d668a5
PH
2965 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2966 search_error_message);
059ec3d9 2967
13b685f9
PH
2968 /* Adjust parameters for the type of lookup. For a query-style lookup, there
2969 is no file name, and the "key" is just the query. For query-style with a file
2970 name, we have to fish the file off the start of the query. For a single-key
2971 lookup, the key is the current IP address, masked appropriately, and
2972 reconverted to text form, with the mask appended. For IPv6 addresses, specify
6a3bceb1
PH
2973 dot separators instead of colons, except when the lookup type is "iplsearch".
2974 */
059ec3d9 2975
13b685f9
PH
2976 if (mac_islookup(search_type, lookup_absfilequery))
2977 {
2978 filename = semicolon + 1;
2979 key = filename;
2980 while (*key != 0 && !isspace(*key)) key++;
2981 filename = string_copyn(filename, key - filename);
2982 while (isspace(*key)) key++;
2983 }
2984 else if (mac_islookup(search_type, lookup_querystyle))
32d668a5
PH
2985 {
2986 filename = NULL;
2987 key = semicolon + 1;
2988 }
6a3bceb1 2989 else /* Single-key style */
32d668a5 2990 {
e6d225ae 2991 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
6a3bceb1 2992 ':' : '.';
32d668a5
PH
2993 insize = host_aton(cb->host_address, incoming);
2994 host_mask(insize, incoming, mlen);
6a3bceb1 2995 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
32d668a5
PH
2996 key = buffer;
2997 filename = semicolon + 1;
059ec3d9 2998 }
32d668a5
PH
2999
3000 /* Now do the actual lookup; note that there is no search_close() because
3001 of the caching arrangements. */
3002
d4ff61d1
JH
3003 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3004 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3005
32d668a5 3006 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
8768d548
JH
3007 if (valueptr) *valueptr = result;
3008 return result ? OK : f.search_find_defer ? DEFER: FAIL;
059ec3d9
PH
3009 }
3010
3011/* The pattern is not an IP address or network reference of any kind. That is,
32d668a5
PH
3012it is a host name pattern. If this is an IP only match, there's an error in the
3013host list. */
3014
3015if (isiponly)
3016 {
3017 *error = US"cannot match host name in match_ip list";
3018 return ERROR;
3019 }
3020
3021/* Check the characters of the pattern to see if they comprise only letters,
3022digits, full stops, and hyphens (the constituents of domain names). Allow
3023underscores, as they are all too commonly found. Sigh. Also, if
3024allow_utf8_domains is set, allow top-bit characters. */
059ec3d9
PH
3025
3026for (t = ss; *t != 0; t++)
3027 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3028 (!allow_utf8_domains || *t < 128)) break;
3029
3030/* If the pattern is a complete domain name, with no fancy characters, look up
3031its IP address and match against that. Note that a multi-homed host will add
3032items to the chain. */
3033
3034if (*t == 0)
3035 {
3036 int rc;
3037 host_item h;
3038 h.next = NULL;
3039 h.name = ss;
3040 h.address = NULL;
3041 h.mx = MX_NONE;
9b8fadde 3042
1f155f8e
JH
3043 /* Using byname rather than bydns here means we cannot determine dnssec
3044 status. On the other hand it is unclear how that could be either
3045 propagated up or enforced. */
3046
322050c2 3047 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
059ec3d9
PH
3048 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3049 {
d7978c0f 3050 for (host_item * hh = &h; hh; hh = hh->next)
96776534 3051 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
059ec3d9
PH
3052 return FAIL;
3053 }
3054 if (rc == HOST_FIND_AGAIN) return DEFER;
3055 *error = string_sprintf("failed to find IP address for %s", ss);
3056 return ERROR;
3057 }
3058
3059/* Almost all subsequent comparisons require the host name, and can be done
3060using the general string matching function. When this function is called for
3061outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3062must use sender_host_name and its aliases, looking them up if necessary. */
3063
3064if (cb->host_name != NULL) /* Explicit host name given */
3065 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3066 valueptr);
3067
3068/* Host name not given; in principle we need the sender host name and its
3069aliases. However, for query-style lookups, we do not need the name if the
3070query does not contain $sender_host_name. From release 4.23, a reference to
3071$sender_host_name causes it to be looked up, so we don't need to do the lookup
3072on spec. */
3073
3074if ((semicolon = Ustrchr(ss, ';')) != NULL)
3075 {
55414b25 3076 const uschar *affix;
059ec3d9
PH
3077 int partial, affixlen, starflags, id;
3078
3079 *semicolon = 0;
3080 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
3081 *semicolon=';';
3082
3083 if (id < 0) /* Unknown lookup type */
3084 {
3085 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3086 search_error_message, ss);
3087 return DEFER;
3088 }
13b685f9 3089 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
059ec3d9
PH
3090 }
3091
3092if (isquery)
3093 {
3094 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3095 {
3096 case OK: return OK;
3097 case DEFER: return DEFER;
3098 default: return FAIL;
3099 }
3100 }
3101
3102/* Not a query-style lookup; must ensure the host name is present, and then we
3103do a check on the name and all its aliases. */
3104
2d0dc929 3105if (!sender_host_name)
059ec3d9
PH
3106 {
3107 HDEBUG(D_host_lookup)
3108 debug_printf("sender host name required, to match against %s\n", ss);
3109 if (host_lookup_failed || host_name_lookup() != OK)
3110 {
3111 *error = string_sprintf("failed to find host name for %s",
3112 sender_host_address);;
3113 return ERROR;
3114 }
3115 host_build_sender_fullhost();
3116 }
3117
3118/* Match on the sender host name, using the general matching function */
3119
2d0dc929 3120switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE, valueptr))
059ec3d9
PH
3121 {
3122 case OK: return OK;
3123 case DEFER: return DEFER;
3124 }
3125
3126/* If there are aliases, try matching on them. */
3127
3128aliases = sender_host_aliases;
2d0dc929 3129while (*aliases)
059ec3d9
PH
3130 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3131 {
3132 case OK: return OK;
3133 case DEFER: return DEFER;
3134 }
059ec3d9
PH
3135return FAIL;
3136}
3137
3138
3139
3140
3141/*************************************************
3142* Check a specific host matches a host list *
3143*************************************************/
3144
3145/* This function is passed a host list containing items in a number of
3146different formats and the identity of a host. Its job is to determine whether
3147the given host is in the set of hosts defined by the list. The host name is
3148passed as a pointer so that it can be looked up if needed and not already
3149known. This is commonly the case when called from verify_check_host() to check
3150an incoming connection. When called from elsewhere the host name should usually
3151be set.
3152
3153This function is now just a front end to match_check_list(), which runs common
3154code for scanning a list. We pass it the check_host() function to perform a
3155single test.
3156
3157Arguments:
3158 listptr pointer to the host list
3159 cache_bits pointer to cache for named lists, or NULL
3160 host_name the host name or NULL, implying use sender_host_name and
3161 sender_host_aliases, looking them up if required
3162 host_address the IP address
3163 valueptr if not NULL, data from a lookup is passed back here
3164
3165Returns: OK if the host is in the defined set
3166 FAIL if the host is not in the defined set,
3167 DEFER if a data lookup deferred (not a host lookup)
3168
3169If the host name was needed in order to make a comparison, and could not be
3170determined from the IP address, the result is FAIL unless the item
3171"+allow_unknown" was met earlier in the list, in which case OK is returned. */
3172
3173int
55414b25
JH
3174verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3175 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
059ec3d9 3176{
d4eb88df 3177int rc;
059ec3d9 3178unsigned int *local_cache_bits = cache_bits;
55414b25 3179const uschar *save_host_address = deliver_host_address;
0ab63f3d 3180check_host_block cb = { .host_name = host_name, .host_address = host_address };
059ec3d9 3181
0ab63f3d 3182if (valueptr) *valueptr = NULL;
059ec3d9
PH
3183
3184/* If the host address starts off ::ffff: it is an IPv6 address in
3185IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3186addresses. */
3187
0ab63f3d
JH
3188cb.host_ipv4 = Ustrncmp(host_address, "::ffff:", 7) == 0
3189 ? host_address + 7 : host_address;
059ec3d9 3190
8e669ac1
PH
3191/* During the running of the check, put the IP address into $host_address. In
3192the case of calls from the smtp transport, it will already be there. However,
3193in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
d4eb88df
PH
3194the safe side, any existing setting is preserved, though as I write this
3195(November 2004) I can't see any cases where it is actually needed. */
3196
3197deliver_host_address = host_address;
3198rc = match_check_list(
3199 listptr, /* the list */
3200 0, /* separator character */
3201 &hostlist_anchor, /* anchor pointer */
3202 &local_cache_bits, /* cache pointer */
3203 check_host, /* function for testing */
3204 &cb, /* argument for function */
3205 MCL_HOST, /* type of check */
8e669ac1 3206 (host_address == sender_host_address)?
d4eb88df
PH
3207 US"host" : host_address, /* text for debugging */
3208 valueptr); /* where to pass back data */
3209deliver_host_address = save_host_address;
8e669ac1 3210return rc;
059ec3d9
PH
3211}
3212
3213
3214
3215
3216/*************************************************
5130845b
JH
3217* Check the given host item matches a list *
3218*************************************************/
3219int
3fb3231c 3220verify_check_given_host(const uschar **listptr, const host_item *host)
5130845b 3221{
3fb3231c 3222return verify_check_this_host(listptr, NULL, host->name, host->address, NULL);
5130845b
JH
3223}
3224
3225/*************************************************
059ec3d9
PH
3226* Check the remote host matches a list *
3227*************************************************/
3228
3229/* This is a front end to verify_check_this_host(), created because checking
3230the remote host is a common occurrence. With luck, a good compiler will spot
3231the tail recursion and optimize it. If there's no host address, this is
3232command-line SMTP input - check against an empty string for the address.
3233
3234Arguments:
3235 listptr pointer to the host list
3236
3237Returns: the yield of verify_check_this_host(),
3238 i.e. OK, FAIL, or DEFER
3239*/
3240
3241int
3242verify_check_host(uschar **listptr)
3243{
55414b25 3244return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
b10c87b3 3245 sender_host_address ? sender_host_address : US"", NULL);
059ec3d9
PH
3246}
3247
3248
3249
3250
3251
3252/*************************************************
83e029d5 3253* Invert an IP address *
059ec3d9
PH
3254*************************************************/
3255
83e029d5
PP
3256/* Originally just used for DNS xBL lists, now also used for the
3257reverse_ip expansion operator.
3258
059ec3d9
PH
3259Arguments:
3260 buffer where to put the answer
3261 address the address to invert
3262*/
3263
83e029d5 3264void
059ec3d9
PH
3265invert_address(uschar *buffer, uschar *address)
3266{
3267int bin[4];
3268uschar *bptr = buffer;
3269
3270/* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3271to the IPv4 part only. */
3272
3273if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3274
3275/* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3276always 1. */
3277
3278if (host_aton(address, bin) == 1)
3279 {
059ec3d9 3280 int x = bin[0];
d7978c0f 3281 for (int i = 0; i < 4; i++)
059ec3d9
PH
3282 {
3283 sprintf(CS bptr, "%d.", x & 255);
3284 while (*bptr) bptr++;
3285 x >>= 8;
3286 }
3287 }
3288
3289/* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3290in any DNS black lists, and the format in which they will be looked up is
3291unknown. This is just a guess. */
3292
3293#if HAVE_IPV6
3294else
d7978c0f 3295 for (int j = 3; j >= 0; j--)
059ec3d9
PH
3296 {
3297 int x = bin[j];
d7978c0f 3298 for (int i = 0; i < 8; i++)
059ec3d9
PH
3299 {
3300 sprintf(CS bptr, "%x.", x & 15);
3301 while (*bptr) bptr++;
3302 x >>= 4;
3303 }
3304 }
059ec3d9 3305#endif
d6f6e0dc
PH
3306
3307/* Remove trailing period -- this is needed so that both arbitrary
3308dnsbl keydomains and inverted addresses may be combined with the
3309same format string, "%s.%s" */
3310
3311*(--bptr) = 0;
059ec3d9
PH
3312}
3313
3314
3315
3316/*************************************************
0bcb2a0e
PH
3317* Perform a single dnsbl lookup *
3318*************************************************/
3319
d6f6e0dc
PH
3320/* This function is called from verify_check_dnsbl() below. It is also called
3321recursively from within itself when domain and domain_txt are different
3322pointers, in order to get the TXT record from the alternate domain.
0bcb2a0e
PH
3323
3324Arguments:
d6f6e0dc
PH
3325 domain the outer dnsbl domain
3326 domain_txt alternate domain to lookup TXT record on success; when the
3327 same domain is to be used, domain_txt == domain (that is,
3328 the pointers must be identical, not just the text)
8e669ac1 3329 keydomain the current keydomain (for debug message)
d6f6e0dc
PH
3330 prepend subdomain to lookup (like keydomain, but
3331 reversed if IP address)
3332 iplist the list of matching IP addresses, or NULL for "any"
8e669ac1 3333 bitmask true if bitmask matching is wanted
431b7361
PH
3334 match_type condition for 'succeed' result
3335 0 => Any RR in iplist (=)
3336 1 => No RR in iplist (!=)
3337 2 => All RRs in iplist (==)
3338 3 => Some RRs not in iplist (!==)
3339 the two bits are defined as MT_NOT and MT_ALL
8e669ac1 3340 defer_return what to return for a defer
0bcb2a0e
PH
3341
3342Returns: OK if lookup succeeded
3343 FAIL if not
3344*/
3345
3346static int
d6f6e0dc 3347one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain,
431b7361 3348 uschar *prepend, uschar *iplist, BOOL bitmask, int match_type,
d6f6e0dc 3349 int defer_return)
8e669ac1 3350{
0bcb2a0e
PH
3351dns_answer dnsa;
3352dns_scan dnss;
3353tree_node *t;
3354dnsbl_cache_block *cb;
3355int old_pool = store_pool;
d6f6e0dc
PH
3356uschar query[256]; /* DNS domain max length */
3357
3358/* Construct the specific query domainname */
3359
3360if (!string_format(query, sizeof(query), "%s.%s", prepend, domain))
3361 {
3362 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
3363 "(ignored): %s...", query);
3364 return FAIL;
3365 }
0bcb2a0e
PH
3366
3367/* Look for this query in the cache. */
3368
14b3c5bc
JH
3369if ( (t = tree_search(dnsbl_cache, query))
3370 && (cb = t->data.ptr)->expiry > time(NULL)
3371 )
3372
3373/* Previous lookup was cached */
3374
3375 {
3376 HDEBUG(D_dnsbl) debug_printf("using result of previous DNS lookup\n");
3377 }
0bcb2a0e
PH
3378
3379/* If not cached from a previous lookup, we must do a DNS lookup, and
3380cache the result in permanent memory. */
3381
14b3c5bc 3382else
0bcb2a0e 3383 {
e162fc97 3384 uint ttl = 3600;
14b3c5bc 3385
0bcb2a0e
PH
3386 store_pool = POOL_PERM;
3387
14b3c5bc
JH
3388 if (t)
3389 {
3390 HDEBUG(D_dnsbl) debug_printf("cached data found but past valid time; ");
3391 }
0bcb2a0e 3392
14b3c5bc
JH
3393 else
3394 { /* Set up a tree entry to cache the lookup */
3395 t = store_get(sizeof(tree_node) + Ustrlen(query));
3396 Ustrcpy(t->name, query);
3397 t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block));
3398 (void)tree_insertnode(&dnsbl_cache, t);
3399 }
0bcb2a0e 3400
4c04137d 3401 /* Do the DNS lookup . */
0bcb2a0e
PH
3402
3403 HDEBUG(D_dnsbl) debug_printf("new DNS lookup for %s\n", query);
3404 cb->rc = dns_basic_lookup(&dnsa, query, T_A);
3405 cb->text_set = FALSE;
3406 cb->text = NULL;
3407 cb->rhs = NULL;
3408
3409 /* If the lookup succeeded, cache the RHS address. The code allows for
3410 more than one address - this was for complete generality and the possible
d8d9f930
JH
3411 use of A6 records. However, A6 records are no longer supported. Leave the code
3412 here, just in case.
0bcb2a0e<