Fix sender-verify callout to not use trigger-message SIZE
[exim.git] / src / src / verify.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
80fea873 5/* Copyright (c) University of Cambridge 1995 - 2016 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions concerned with verifying things. The original code for callout
9caching was contributed by Kevin Fleming (but I hacked it around a bit). */
10
11
12#include "exim.h"
817d9f57 13#include "transports/smtp.h"
059ec3d9 14
e4bdf652
JH
15#define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16#define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
817d9f57
JH
17static smtp_outblock ctblock;
18uschar ctbuffer[8192];
19
059ec3d9
PH
20
21/* Structure for caching DNSBL lookups */
22
23typedef struct dnsbl_cache_block {
14b3c5bc 24 time_t expiry;
059ec3d9
PH
25 dns_address *rhs;
26 uschar *text;
27 int rc;
28 BOOL text_set;
29} dnsbl_cache_block;
30
31
32/* Anchor for DNSBL cache */
33
34static tree_node *dnsbl_cache = NULL;
35
36
431b7361
PH
37/* Bits for match_type in one_check_dnsbl() */
38
39#define MT_NOT 1
40#define MT_ALL 2
41
5032d1cf 42static uschar cutthrough_response(char, uschar **);
431b7361 43
059ec3d9
PH
44
45/*************************************************
46* Retrieve a callout cache record *
47*************************************************/
48
49/* If a record exists, check whether it has expired.
50
51Arguments:
52 dbm_file an open hints file
53 key the record key
54 type "address" or "domain"
55 positive_expire expire time for positive records
56 negative_expire expire time for negative records
57
58Returns: the cache record if a non-expired one exists, else NULL
59*/
60
61static dbdata_callout_cache *
55414b25 62get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
059ec3d9
PH
63 int positive_expire, int negative_expire)
64{
65BOOL negative;
66int length, expire;
67time_t now;
68dbdata_callout_cache *cache_record;
69
70cache_record = dbfn_read_with_length(dbm_file, key, &length);
71
72if (cache_record == NULL)
73 {
6f4d5ad3 74 HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
059ec3d9
PH
75 return NULL;
76 }
77
78/* We treat a record as "negative" if its result field is not positive, or if
79it is a domain record and the postmaster field is negative. */
80
81negative = cache_record->result != ccache_accept ||
82 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
83expire = negative? negative_expire : positive_expire;
84now = time(NULL);
85
86if (now - cache_record->time_stamp > expire)
87 {
6f4d5ad3 88 HDEBUG(D_verify) debug_printf("callout cache: %s record expired for %s\n", type, key);
059ec3d9
PH
89 return NULL;
90 }
91
92/* If this is a non-reject domain record, check for the obsolete format version
93that doesn't have the postmaster and random timestamps, by looking at the
94length. If so, copy it to a new-style block, replicating the record's
95timestamp. Then check the additional timestamps. (There's no point wasting
96effort if connections are rejected.) */
97
98if (type[0] == 'd' && cache_record->result != ccache_reject)
99 {
100 if (length == sizeof(dbdata_callout_cache_obs))
101 {
102 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
103 memcpy(new, cache_record, length);
104 new->postmaster_stamp = new->random_stamp = new->time_stamp;
105 cache_record = new;
106 }
107
108 if (now - cache_record->postmaster_stamp > expire)
109 cache_record->postmaster_result = ccache_unknown;
110
111 if (now - cache_record->random_stamp > expire)
112 cache_record->random_result = ccache_unknown;
113 }
114
6f4d5ad3 115HDEBUG(D_verify) debug_printf("callout cache: found %s record for %s\n", type, key);
059ec3d9
PH
116return cache_record;
117}
118
119
120
121/*************************************************
122* Do callout verification for an address *
123*************************************************/
124
125/* This function is called from verify_address() when the address has routed to
126a host list, and a callout has been requested. Callouts are expensive; that is
127why a cache is used to improve the efficiency.
128
129Arguments:
130 addr the address that's been routed
131 host_list the list of hosts to try
132 tf the transport feedback block
133
134 ifstring "interface" option from transport, or NULL
135 portstring "port" option from transport, or NULL
136 protocolstring "protocol" option from transport, or NULL
137 callout the per-command callout timeout
4deaf07d
PH
138 callout_overall the overall callout timeout (if < 0 use 4*callout)
139 callout_connect the callout connection timeout (if < 0 use callout)
059ec3d9
PH
140 options the verification options - these bits are used:
141 vopt_is_recipient => this is a recipient address
142 vopt_callout_no_cache => don't use callout cache
2a4be8f9 143 vopt_callout_fullpm => if postmaster check, do full one
059ec3d9
PH
144 vopt_callout_random => do the "random" thing
145 vopt_callout_recipsender => use real sender for recipient
146 vopt_callout_recippmaster => use postmaster for recipient
147 se_mailfrom MAIL FROM address for sender verify; NULL => ""
148 pm_mailfrom if non-NULL, do the postmaster check with this sender
149
150Returns: OK/FAIL/DEFER
151*/
152
153static int
154do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
8e669ac1 155 int callout, int callout_overall, int callout_connect, int options,
4deaf07d 156 uschar *se_mailfrom, uschar *pm_mailfrom)
059ec3d9 157{
059ec3d9 158int yield = OK;
2b1c6e3a 159int old_domain_cache_result = ccache_accept;
059ec3d9
PH
160BOOL done = FALSE;
161uschar *address_key;
162uschar *from_address;
163uschar *random_local_part = NULL;
55414b25 164const uschar *save_deliver_domain = deliver_domain;
8b9476ba
JH
165uschar **failure_ptr = options & vopt_is_recipient
166 ? &recipient_verify_failure : &sender_verify_failure;
059ec3d9
PH
167open_db dbblock;
168open_db *dbm_file = NULL;
169dbdata_callout_cache new_domain_record;
170dbdata_callout_cache_address new_address_record;
171host_item *host;
172time_t callout_start_time;
9094b84b 173uschar peer_offered = 0;
059ec3d9
PH
174
175new_domain_record.result = ccache_unknown;
176new_domain_record.postmaster_result = ccache_unknown;
177new_domain_record.random_result = ccache_unknown;
178
179memset(&new_address_record, 0, sizeof(new_address_record));
180
181/* For a recipient callout, the key used for the address cache record must
182include the sender address if we are using the real sender in the callout,
183because that may influence the result of the callout. */
184
185address_key = addr->address;
186from_address = US"";
187
8b9476ba 188if (options & vopt_is_recipient)
059ec3d9 189 {
5032d1cf 190 if (options & vopt_callout_recipsender)
059ec3d9
PH
191 {
192 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
193 from_address = sender_address;
8b9476ba 194 if (cutthrough.delivery) options |= vopt_callout_no_cache;
059ec3d9 195 }
5032d1cf 196 else if (options & vopt_callout_recippmaster)
059ec3d9
PH
197 {
198 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
199 qualify_domain_sender);
200 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
201 }
202 }
203
204/* For a sender callout, we must adjust the key if the mailfrom address is not
205empty. */
206
207else
208 {
209 from_address = (se_mailfrom == NULL)? US"" : se_mailfrom;
210 if (from_address[0] != 0)
211 address_key = string_sprintf("%s/<%s>", addr->address, from_address);
212 }
213
214/* Open the callout cache database, it it exists, for reading only at this
215stage, unless caching has been disabled. */
216
8b9476ba 217if (options & vopt_callout_no_cache)
059ec3d9
PH
218 {
219 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
220 }
221else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
222 {
223 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
224 }
225
226/* If a cache database is available see if we can avoid the need to do an
227actual callout by making use of previously-obtained data. */
228
ff5929e3 229if (dbm_file)
059ec3d9
PH
230 {
231 dbdata_callout_cache_address *cache_address_record;
232 dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
233 addr->domain, US"domain",
234 callout_cache_domain_positive_expire,
235 callout_cache_domain_negative_expire);
236
237 /* If an unexpired cache record was found for this domain, see if the callout
238 process can be short-circuited. */
239
ff5929e3 240 if (cache_record)
059ec3d9 241 {
2b1c6e3a
PH
242 /* In most cases, if an early command (up to and including MAIL FROM:<>)
243 was rejected, there is no point carrying on. The callout fails. However, if
244 we are doing a recipient verification with use_sender or use_postmaster
245 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
246 will be using a non-empty sender. We have to remember this situation so as
247 not to disturb the cached domain value if this whole verification succeeds
248 (we don't want it turning into "accept"). */
249
250 old_domain_cache_result = cache_record->result;
251
252 if (cache_record->result == ccache_reject ||
253 (*from_address == 0 && cache_record->result == ccache_reject_mfnull))
059ec3d9
PH
254 {
255 setflag(addr, af_verify_nsfail);
256 HDEBUG(D_verify)
257 debug_printf("callout cache: domain gave initial rejection, or "
258 "does not accept HELO or MAIL FROM:<>\n");
259 setflag(addr, af_verify_nsfail);
260 addr->user_message = US"(result of an earlier callout reused).";
261 yield = FAIL;
8e669ac1 262 *failure_ptr = US"mail";
059ec3d9
PH
263 goto END_CALLOUT;
264 }
265
266 /* If a previous check on a "random" local part was accepted, we assume
267 that the server does not do any checking on local parts. There is therefore
268 no point in doing the callout, because it will always be successful. If a
269 random check previously failed, arrange not to do it again, but preserve
270 the data in the new record. If a random check is required but hasn't been
271 done, skip the remaining cache processing. */
272
8b9476ba 273 if (options & vopt_callout_random) switch(cache_record->random_result)
059ec3d9
PH
274 {
275 case ccache_accept:
8b9476ba
JH
276 HDEBUG(D_verify)
277 debug_printf("callout cache: domain accepts random addresses\n");
278 goto END_CALLOUT; /* Default yield is OK */
059ec3d9
PH
279
280 case ccache_reject:
8b9476ba
JH
281 HDEBUG(D_verify)
282 debug_printf("callout cache: domain rejects random addresses\n");
283 options &= ~vopt_callout_random;
284 new_domain_record.random_result = ccache_reject;
285 new_domain_record.random_stamp = cache_record->random_stamp;
286 break;
059ec3d9
PH
287
288 default:
8b9476ba
JH
289 HDEBUG(D_verify)
290 debug_printf("callout cache: need to check random address handling "
291 "(not cached or cache expired)\n");
292 goto END_CACHE;
059ec3d9
PH
293 }
294
295 /* If a postmaster check is requested, but there was a previous failure,
296 there is again no point in carrying on. If a postmaster check is required,
297 but has not been done before, we are going to have to do a callout, so skip
298 remaining cache processing. */
299
ff5929e3 300 if (pm_mailfrom)
059ec3d9
PH
301 {
302 if (cache_record->postmaster_result == ccache_reject)
303 {
304 setflag(addr, af_verify_pmfail);
305 HDEBUG(D_verify)
306 debug_printf("callout cache: domain does not accept "
307 "RCPT TO:<postmaster@domain>\n");
308 yield = FAIL;
8e669ac1 309 *failure_ptr = US"postmaster";
059ec3d9
PH
310 setflag(addr, af_verify_pmfail);
311 addr->user_message = US"(result of earlier verification reused).";
312 goto END_CALLOUT;
313 }
314 if (cache_record->postmaster_result == ccache_unknown)
315 {
316 HDEBUG(D_verify)
317 debug_printf("callout cache: need to check RCPT "
318 "TO:<postmaster@domain> (not cached or cache expired)\n");
319 goto END_CACHE;
320 }
321
322 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
323 postmaster check if the address itself has to be checked. Also ensure
324 that the value in the cache record is preserved (with its old timestamp).
325 */
326
327 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
328 "TO:<postmaster@domain>\n");
329 pm_mailfrom = NULL;
330 new_domain_record.postmaster_result = ccache_accept;
331 new_domain_record.postmaster_stamp = cache_record->postmaster_stamp;
332 }
333 }
334
335 /* We can't give a result based on information about the domain. See if there
336 is an unexpired cache record for this specific address (combined with the
337 sender address if we are doing a recipient callout with a non-empty sender).
338 */
339
340 cache_address_record = (dbdata_callout_cache_address *)
341 get_callout_cache_record(dbm_file,
342 address_key, US"address",
343 callout_cache_positive_expire,
344 callout_cache_negative_expire);
345
ff5929e3 346 if (cache_address_record)
059ec3d9
PH
347 {
348 if (cache_address_record->result == ccache_accept)
349 {
350 HDEBUG(D_verify)
351 debug_printf("callout cache: address record is positive\n");
352 }
353 else
354 {
355 HDEBUG(D_verify)
356 debug_printf("callout cache: address record is negative\n");
357 addr->user_message = US"Previous (cached) callout verification failure";
8e669ac1 358 *failure_ptr = US"recipient";
059ec3d9
PH
359 yield = FAIL;
360 }
361 goto END_CALLOUT;
362 }
363
364 /* Close the cache database while we actually do the callout for real. */
365
366 END_CACHE:
367 dbfn_close(dbm_file);
368 dbm_file = NULL;
369 }
370
193e3acd 371if (!addr->transport)
059ec3d9 372 {
193e3acd 373 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
059ec3d9 374 }
6681531a
HSHR
375else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
376 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
377 addr->transport->name, addr->transport->driver_name);
193e3acd
JH
378else
379 {
380 smtp_transport_options_block *ob =
9d9c3746 381 (smtp_transport_options_block *)addr->transport->options_block;
059ec3d9 382
193e3acd
JH
383 /* The information wasn't available in the cache, so we have to do a real
384 callout and save the result in the cache for next time, unless no_cache is set,
385 or unless we have a previously cached negative random result. If we are to test
386 with a random local part, ensure that such a local part is available. If not,
387 log the fact, but carry on without randomming. */
059ec3d9 388
8b9476ba 389 if (options & vopt_callout_random && callout_random_local_part != NULL)
65f1c92a 390 if (!(random_local_part = expand_string(callout_random_local_part)))
193e3acd
JH
391 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
392 "callout_random_local_part: %s", expand_string_message);
059ec3d9 393
193e3acd
JH
394 /* Default the connect and overall callout timeouts if not set, and record the
395 time we are starting so that we can enforce it. */
4c590bd1 396
193e3acd
JH
397 if (callout_overall < 0) callout_overall = 4 * callout;
398 if (callout_connect < 0) callout_connect = callout;
399 callout_start_time = time(NULL);
4c590bd1 400
193e3acd
JH
401 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
402 output because a callout might take some time. When PIPELINING is active and
403 there are many recipients, the total time for doing lots of callouts can add up
404 and cause the client to time out. So in this case we forgo the PIPELINING
405 optimization. */
817d9f57 406
ff5929e3 407 if (smtp_out && !disable_callout_flush) mac_smtp_fflush();
059ec3d9 408
5032d1cf
JH
409/* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
410and we are holding a cutthrough conn open, we can just append the rcpt to
411that conn for verification purposes (and later delivery also). Simplest
412coding means skipping this whole loop and doing the append separately.
413
414We will need to remember it has been appended so that rcpt-acl tail code
415can do it there for the non-rcpt-verify case. For this we keep an addresscount.
416*/
417
418 /* Can we re-use an open cutthrough connection? */
419 if ( cutthrough.fd >= 0
420 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
421 == vopt_callout_recipsender
422 && !random_local_part
423 && !pm_mailfrom
424 )
425 {
426 if (addr->transport == cutthrough.addr.transport)
427 for (host = host_list; host; host = host->next)
428 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
429 {
430 int host_af;
431 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
432 int port = 25;
433
434 deliver_host = host->name;
435 deliver_host_address = host->address;
436 deliver_host_port = host->port;
437 deliver_domain = addr->domain;
438 transport_name = addr->transport->name;
439
440 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
441
6f6dedcc 442 if (!smtp_get_interface(tf->interface, host_af, addr, &interface,
5032d1cf
JH
443 US"callout") ||
444 !smtp_get_port(tf->port, addr, &port, US"callout"))
445 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
446 addr->message);
447
448 if ( ( interface == cutthrough.interface
449 || ( interface
450 && cutthrough.interface
451 && Ustrcmp(interface, cutthrough.interface) == 0
452 ) )
453 && port == cutthrough.host.port
454 )
455 {
806c3df9 456 uschar * resp = NULL;
5032d1cf
JH
457
458 /* Match! Send the RCPT TO, append the addr, set done */
459 done =
460 smtp_write_command(&ctblock, FALSE, "RCPT TO:<%.1000s>\r\n",
461 transport_rcpt_address(addr,
462 (addr->transport == NULL)? FALSE :
463 addr->transport->rcpt_include_affixes)) >= 0 &&
464 cutthrough_response('2', &resp) == '2';
465
466 /* This would go horribly wrong if a callout fail was ignored by ACL.
467 We punt by abandoning cutthrough on a reject, like the
468 first-rcpt does. */
469
470 if (done)
471 {
472 address_item * na = store_get(sizeof(address_item));
473 *na = cutthrough.addr;
474 cutthrough.addr = *addr;
475 cutthrough.addr.host_used = &cutthrough.host;
476 cutthrough.addr.next = na;
477
478 cutthrough.nrcpt++;
479 }
480 else
481 {
482 cancel_cutthrough_connection("recipient rejected");
806c3df9 483 if (!resp || errno == ETIMEDOUT)
5032d1cf
JH
484 {
485 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
486 }
487 else if (errno == 0)
488 {
489 if (*resp == 0)
490 Ustrcpy(resp, US"connection dropped");
491
492 addr->message =
493 string_sprintf("response to \"%s\" from %s [%s] was: %s",
494 big_buffer, host->name, host->address,
495 string_printing(resp));
496
497 addr->user_message =
498 string_sprintf("Callout verification failed:\n%s", resp);
499
500 /* Hard rejection ends the process */
501
502 if (resp[0] == '5') /* Address rejected */
503 {
504 yield = FAIL;
505 done = TRUE;
506 }
507 }
508 }
509 }
510 break;
511 }
512 if (!done)
513 cancel_cutthrough_connection("incompatible connection");
514 }
515
193e3acd
JH
516 /* Now make connections to the hosts and do real callouts. The list of hosts
517 is passed in as an argument. */
059ec3d9 518
ff5929e3 519 for (host = host_list; host && !done; host = host->next)
059ec3d9 520 {
193e3acd
JH
521 smtp_inblock inblock;
522 smtp_outblock outblock;
523 int host_af;
524 int port = 25;
525 BOOL send_quit = TRUE;
526 uschar *active_hostname = smtp_active_hostname;
527 BOOL lmtp;
528 BOOL smtps;
529 BOOL esmtp;
530 BOOL suppress_tls = FALSE;
531 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
0e66b3b6
JH
532#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
533 BOOL dane = FALSE;
6ebd79ec 534 BOOL dane_required;
0e66b3b6
JH
535 dns_answer tlsa_dnsa;
536#endif
193e3acd
JH
537 uschar inbuffer[4096];
538 uschar outbuffer[1024];
539 uschar responsebuffer[4096];
9094b84b 540 uschar * size_str;
193e3acd
JH
541
542 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
543 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
544
545 /* Skip this host if we don't have an IP address for it. */
546
ff5929e3 547 if (!host->address)
193e3acd
JH
548 {
549 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
550 host->name);
551 continue;
552 }
059ec3d9 553
193e3acd 554 /* Check the overall callout timeout */
059ec3d9 555
193e3acd
JH
556 if (time(NULL) - callout_start_time >= callout_overall)
557 {
558 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
559 break;
560 }
059ec3d9 561
193e3acd 562 /* Set IPv4 or IPv6 */
059ec3d9 563
ff5929e3 564 host_af = Ustrchr(host->address, ':') == NULL ? AF_INET : AF_INET6;
de3a88fb 565
193e3acd
JH
566 /* Expand and interpret the interface and port strings. The latter will not
567 be used if there is a host-specific port (e.g. from a manualroute router).
568 This has to be delayed till now, because they may expand differently for
569 different hosts. If there's a failure, log it, but carry on with the
570 defaults. */
de3a88fb 571
193e3acd
JH
572 deliver_host = host->name;
573 deliver_host_address = host->address;
a7538db1 574 deliver_host_port = host->port;
193e3acd 575 deliver_domain = addr->domain;
aec45841 576 transport_name = addr->transport->name;
059ec3d9 577
6f6dedcc 578 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
bf7aabb4
JH
579 US"callout")
580 || !smtp_get_port(tf->port, addr, &port, US"callout")
581 )
193e3acd
JH
582 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
583 addr->message);
059ec3d9 584
193e3acd
JH
585 /* Set HELO string according to the protocol */
586 lmtp= Ustrcmp(tf->protocol, "lmtp") == 0;
587 smtps= Ustrcmp(tf->protocol, "smtps") == 0;
059ec3d9 588
059ec3d9 589
193e3acd 590 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", interface, port);
059ec3d9 591
193e3acd 592 /* Set up the buffer for reading SMTP response packets. */
059ec3d9 593
193e3acd
JH
594 inblock.buffer = inbuffer;
595 inblock.buffersize = sizeof(inbuffer);
596 inblock.ptr = inbuffer;
597 inblock.ptrend = inbuffer;
059ec3d9 598
193e3acd 599 /* Set up the buffer for holding SMTP commands while pipelining */
817d9f57 600
193e3acd
JH
601 outblock.buffer = outbuffer;
602 outblock.buffersize = sizeof(outbuffer);
603 outblock.ptr = outbuffer;
604 outblock.cmd_count = 0;
605 outblock.authenticating = FALSE;
059ec3d9 606
193e3acd
JH
607 /* Connect to the host; on failure, just loop for the next one, but we
608 set the error for the last one. Use the callout_connect timeout. */
059ec3d9 609
193e3acd 610 tls_retry_connection:
41c7c167 611
65f1c92a
JH
612 /* Reset the parameters of a TLS session */
613 tls_out.cipher = tls_out.peerdn = tls_out.peercert = NULL;
614
193e3acd 615 inblock.sock = outblock.sock =
7eb6c37c
JH
616 smtp_connect(host, host_af, port, interface, callout_connect,
617 addr->transport);
193e3acd
JH
618 if (inblock.sock < 0)
619 {
ae5afa61 620 HDEBUG(D_verify) debug_printf("connect: %s\n", strerror(errno));
193e3acd
JH
621 addr->message = string_sprintf("could not connect to %s [%s]: %s",
622 host->name, host->address, strerror(errno));
aec45841 623 transport_name = NULL;
193e3acd
JH
624 deliver_host = deliver_host_address = NULL;
625 deliver_domain = save_deliver_domain;
626 continue;
627 }
41c7c167 628
bf7aabb4
JH
629#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
630 {
631 int rc;
632
633 tls_out.dane_verified = FALSE;
634 tls_out.tlsa_usage = 0;
635
636 dane_required =
637 verify_check_given_host(&ob->hosts_require_dane, host) == OK;
638
639 if (host->dnssec == DS_YES)
640 {
4b0fe319
JH
641 if( dane_required
642 || verify_check_given_host(&ob->hosts_try_dane, host) == OK
bf7aabb4 643 )
4b0fe319
JH
644 {
645 if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required)) != OK)
646 return rc;
647 dane = TRUE;
648 }
bf7aabb4
JH
649 }
650 else if (dane_required)
651 {
652 log_write(0, LOG_MAIN, "DANE error: %s lookup not DNSSEC", host->name);
653 return FAIL;
654 }
655
656 if (dane)
657 ob->tls_tempfail_tryclear = FALSE;
658 }
659#endif /*DANE*/
660
193e3acd 661 /* Expand the helo_data string to find the host name to use. */
41c7c167 662
ff5929e3 663 if (tf->helo_data)
193e3acd 664 {
ff5929e3
JH
665 uschar * s = expand_string(tf->helo_data);
666 if (!s)
193e3acd
JH
667 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
668 "helo_data value for callout: %s", addr->address,
669 expand_string_message);
670 else active_hostname = s;
671 }
059ec3d9 672
193e3acd
JH
673 /* Wait for initial response, and send HELO. The smtp_write_command()
674 function leaves its command in big_buffer. This is used in error responses.
675 Initialize it in case the connection is rejected. */
817d9f57 676
193e3acd 677 Ustrcpy(big_buffer, "initial connection");
817d9f57 678
193e3acd
JH
679 /* Unless ssl-on-connect, wait for the initial greeting */
680 smtps_redo_greeting:
817d9f57 681
a7538db1 682#ifdef SUPPORT_TLS
193e3acd 683 if (!smtps || (smtps && tls_out.active >= 0))
a7538db1
JH
684#endif
685 {
193e3acd
JH
686 if (!(done= smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout)))
687 goto RESPONSE_FAILED;
770747fd 688
0cbf2b82 689#ifndef DISABLE_EVENT
aaedd1b5
JH
690 lookup_dnssec_authenticated = host->dnssec==DS_YES ? US"yes"
691 : host->dnssec==DS_NO ? US"no" : NULL;
774ef2d7 692 if (event_raise(addr->transport->event_action,
b30275b8 693 US"smtp:connect", responsebuffer))
a7538db1 694 {
aaedd1b5 695 lookup_dnssec_authenticated = NULL;
a7538db1
JH
696 /* Logging? Debug? */
697 goto RESPONSE_FAILED;
698 }
aaedd1b5 699 lookup_dnssec_authenticated = NULL;
a7538db1
JH
700#endif
701 }
702
193e3acd 703 /* Not worth checking greeting line for ESMTP support */
55414b25 704 if (!(esmtp = verify_check_given_host(&ob->hosts_avoid_esmtp, host) != OK))
193e3acd
JH
705 DEBUG(D_transport)
706 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
817d9f57 707
193e3acd 708 tls_redo_helo:
817d9f57 709
a7538db1 710#ifdef SUPPORT_TLS
193e3acd 711 if (smtps && tls_out.active < 0) /* ssl-on-connect, first pass */
817d9f57 712 {
9094b84b 713 peer_offered &= ~PEER_OFFERED_TLS;
193e3acd 714 ob->tls_tempfail_tryclear = FALSE;
817d9f57 715 }
a7538db1
JH
716 else /* all other cases */
717#endif
817d9f57 718
193e3acd 719 { esmtp_retry:
817d9f57 720
193e3acd
JH
721 if (!(done= smtp_write_command(&outblock, FALSE, "%s %s\r\n",
722 !esmtp? "HELO" : lmtp? "LHLO" : "EHLO", active_hostname) >= 0))
723 goto SEND_FAILED;
724 if (!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout))
725 {
4ed8d31a
JH
726 if (errno != 0 || responsebuffer[0] == 0 || lmtp || !esmtp || tls_out.active >= 0)
727 {
728 done= FALSE;
729 goto RESPONSE_FAILED;
730 }
a7538db1 731#ifdef SUPPORT_TLS
9094b84b 732 peer_offered &= ~PEER_OFFERED_TLS;
a7538db1 733#endif
193e3acd
JH
734 esmtp = FALSE;
735 goto esmtp_retry; /* fallback to HELO */
736 }
737
738 /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
4ed8d31a 739
9094b84b
JH
740 peer_offered = esmtp
741 ? ehlo_response(responsebuffer, sizeof(responsebuffer),
742 (!suppress_tls && tls_out.active < 0 ? PEER_OFFERED_TLS : 0)
743 | 0 /* no IGNQ */
744 | 0 /* no PRDR */
745#ifdef SUPPORT_I18N
746 | (addr->prop.utf8_msg && !addr->prop.utf8_downcvt
747 ? PEER_OFFERED_UTF8 : 0)
a7538db1 748#endif
9094b84b
JH
749 | 0 /* no DSN */
750 | 0 /* no PIPE */
751
752 /* only care about SIZE if we have size from inbound */
753 | (message_size > 0 && ob->size_addition >= 0
754 ? PEER_OFFERED_SIZE : 0)
755 )
756 : 0;
817d9f57
JH
757 }
758
91d08eb3 759 size_str = options & vopt_is_recipient && peer_offered & PEER_OFFERED_SIZE
9094b84b
JH
760 ? string_sprintf(" SIZE=%d", message_size + ob->size_addition) : US"";
761
762#ifdef SUPPORT_TLS
2d14f397 763 smtp_peer_options |= peer_offered & PEER_OFFERED_TLS;
9094b84b
JH
764#endif
765
193e3acd
JH
766 /* If TLS is available on this connection attempt to
767 start up a TLS session, unless the host is in hosts_avoid_tls. If successful,
768 send another EHLO - the server may give a different answer in secure mode. We
769 use a separate buffer for reading the response to STARTTLS so that if it is
770 negative, the original EHLO data is available for subsequent analysis, should
771 the client not be required to use TLS. If the response is bad, copy the buffer
772 for error analysis. */
773
a7538db1 774#ifdef SUPPORT_TLS
9094b84b 775 if ( peer_offered & PEER_OFFERED_TLS
5130845b
JH
776 && verify_check_given_host(&ob->hosts_avoid_tls, host) != OK
777 && verify_check_given_host(&ob->hosts_verify_avoid_tls, host) != OK
99400968 778 )
817d9f57 779 {
193e3acd
JH
780 uschar buffer2[4096];
781 if ( !smtps
782 && !(done= smtp_write_command(&outblock, FALSE, "STARTTLS\r\n") >= 0))
783 goto SEND_FAILED;
784
785 /* If there is an I/O error, transmission of this message is deferred. If
786 there is a temporary rejection of STARRTLS and tls_tempfail_tryclear is
787 false, we also defer. However, if there is a temporary rejection of STARTTLS
788 and tls_tempfail_tryclear is true, or if there is an outright rejection of
789 STARTTLS, we carry on. This means we will try to send the message in clear,
790 unless the host is in hosts_require_tls (tested below). */
791
792 if (!smtps && !smtp_read_response(&inblock, buffer2, sizeof(buffer2), '2',
793 ob->command_timeout))
817d9f57 794 {
4b0fe319
JH
795 if ( errno != 0
796 || buffer2[0] == 0
797 || buffer2[0] == '4' && !ob->tls_tempfail_tryclear
798 )
a7538db1
JH
799 {
800 Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
801 done= FALSE;
802 goto RESPONSE_FAILED;
803 }
193e3acd 804 }
817d9f57 805
193e3acd
JH
806 /* STARTTLS accepted or ssl-on-connect: try to negotiate a TLS session. */
807 else
808 {
65867078
JH
809 int oldtimeout = ob->command_timeout;
810 int rc;
811
812 ob->command_timeout = callout;
0e66b3b6 813 rc = tls_client_start(inblock.sock, host, addr, addr->transport
5032d1cf 814# ifdef EXPERIMENTAL_DANE
0e66b3b6 815 , dane ? &tlsa_dnsa : NULL
5032d1cf 816# endif
0e66b3b6 817 );
65867078 818 ob->command_timeout = oldtimeout;
193e3acd 819
6ebd79ec
JH
820 /* TLS negotiation failed; give an error. Try in clear on a new
821 connection, if the options permit it for this host. */
193e3acd 822 if (rc != OK)
83b27293 823 {
ae5afa61
JH
824 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
825 (void)close(inblock.sock);
0cbf2b82 826# ifndef DISABLE_EVENT
ae5afa61
JH
827 (void) event_raise(addr->transport->event_action,
828 US"tcp:close", NULL);
5032d1cf 829# endif
ae5afa61
JH
830 if ( ob->tls_tempfail_tryclear
831 && !smtps
832 && verify_check_given_host(&ob->hosts_require_tls, host) != OK
833 )
834 {
835 log_write(0, LOG_MAIN, "TLS session failure:"
836 " callout unencrypted to %s [%s] (not in hosts_require_tls)",
837 host->name, host->address);
838 suppress_tls = TRUE;
839 goto tls_retry_connection;
a7538db1 840 }
6ebd79ec 841
a7538db1
JH
842 /*save_errno = ERRNO_TLSFAILURE;*/
843 /*message = US"failure while setting up TLS session";*/
844 send_quit = FALSE;
845 done= FALSE;
846 goto TLS_FAILED;
847 }
193e3acd
JH
848
849 /* TLS session is set up. Copy info for logging. */
850 addr->cipher = tls_out.cipher;
851 addr->peerdn = tls_out.peerdn;
852
853 /* For SMTPS we need to wait for the initial OK response, then do HELO. */
854 if (smtps)
a7538db1 855 goto smtps_redo_greeting;
193e3acd
JH
856
857 /* For STARTTLS we need to redo EHLO */
858 goto tls_redo_helo;
859 }
817d9f57
JH
860 }
861
193e3acd
JH
862 /* If the host is required to use a secure channel, ensure that we have one. */
863 if (tls_out.active < 0)
0e66b3b6 864 if (
5032d1cf 865# ifdef EXPERIMENTAL_DANE
0e66b3b6 866 dane ||
5032d1cf 867# endif
5130845b 868 verify_check_given_host(&ob->hosts_require_tls, host) == OK
7a31d643 869 )
193e3acd
JH
870 {
871 /*save_errno = ERRNO_TLSREQUIRED;*/
c562fd30
JH
872 log_write(0, LOG_MAIN,
873 "H=%s [%s]: a TLS session is required for this host, but %s",
193e3acd 874 host->name, host->address,
9094b84b
JH
875 peer_offered & PEER_OFFERED_TLS
876 ? "an attempt to start TLS failed"
877 : "the server did not offer TLS support");
193e3acd
JH
878 done= FALSE;
879 goto TLS_FAILED;
880 }
817d9f57 881
5032d1cf 882#endif /*SUPPORT_TLS*/
817d9f57 883
193e3acd 884 done = TRUE; /* so far so good; have response to HELO */
817d9f57 885
d6e96b36 886 /* For now, transport_filter by cutthrough-delivery is not supported */
193e3acd 887 /* Need proper integration with the proper transport mechanism. */
5032d1cf 888 if (cutthrough.delivery)
d6e96b36 889 {
07eeb4df 890#ifndef DISABLE_DKIM
ae8386f0 891 uschar * s;
07eeb4df 892#endif
6e62c454
JH
893 if (addr->transport->filter_command)
894 {
5032d1cf 895 cutthrough.delivery = FALSE;
6e62c454
JH
896 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
897 }
a7538db1 898#ifndef DISABLE_DKIM
ff5aac2b 899 else if ((s = ob->dkim.dkim_domain) && (s = expand_string(s)) && *s)
6e62c454 900 {
5032d1cf 901 cutthrough.delivery = FALSE;
6e62c454
JH
902 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
903 }
a7538db1 904#endif
d6e96b36 905 }
817d9f57 906
193e3acd
JH
907 SEND_FAILED:
908 RESPONSE_FAILED:
909 TLS_FAILED:
910 ;
911 /* Clear down of the TLS, SMTP and TCP layers on error is handled below. */
059ec3d9 912
193e3acd
JH
913 /* Failure to accept HELO is cached; this blocks the whole domain for all
914 senders. I/O errors and defer responses are not cached. */
915
916 if (!done)
2b1c6e3a 917 {
193e3acd
JH
918 *failure_ptr = US"mail"; /* At or before MAIL */
919 if (errno == 0 && responsebuffer[0] == '5')
920 {
921 setflag(addr, af_verify_nsfail);
922 new_domain_record.result = ccache_reject;
923 }
2b1c6e3a 924 }
2b1c6e3a 925
8c5d388a 926#ifdef SUPPORT_I18N
3c8b3577
JH
927 else if ( addr->prop.utf8_msg
928 && !addr->prop.utf8_downcvt
9094b84b
JH
929 && !(peer_offered & PEER_OFFERED_UTF8)
930 )
9bfc60eb
JH
931 {
932 HDEBUG(D_acl|D_v) debug_printf("utf8 required but not offered\n");
933 errno = ERRNO_UTF8_FWD;
934 setflag(addr, af_verify_nsfail);
935 done = FALSE;
936 }
3c8b3577 937 else if ( addr->prop.utf8_msg
9094b84b 938 && (addr->prop.utf8_downcvt || !(peer_offered & PEER_OFFERED_UTF8))
921dfc11
JH
939 && (setflag(addr, af_utf8_downcvt),
940 from_address = string_address_utf8_to_alabel(from_address,
941 &addr->message),
942 addr->message
943 ) )
3c8b3577
JH
944 {
945 errno = ERRNO_EXPANDFAIL;
946 setflag(addr, af_verify_nsfail);
947 done = FALSE;
948 }
9bfc60eb
JH
949#endif
950
d6e96b36 951 /* If we haven't authenticated, but are required to, give up. */
fcc8e047
JH
952 /* Try to AUTH */
953
954 else done = smtp_auth(responsebuffer, sizeof(responsebuffer),
955 addr, host, ob, esmtp, &inblock, &outblock) == OK &&
956
b4a2b536
JH
957 /* Copy AUTH info for logging */
958 ( (addr->authenticator = client_authenticator),
959 (addr->auth_id = client_authenticated_id),
960
fcc8e047 961 /* Build a mail-AUTH string (re-using responsebuffer for convenience */
b4a2b536
JH
962 !smtp_mail_auth_str(responsebuffer, sizeof(responsebuffer), addr, ob)
963 ) &&
964
965 ( (addr->auth_sndr = client_authenticated_sender),
fcc8e047 966
193e3acd 967 /* Send the MAIL command */
9bfc60eb 968 (smtp_write_command(&outblock, FALSE,
8c5d388a 969#ifdef SUPPORT_I18N
921dfc11 970 addr->prop.utf8_msg && !addr->prop.utf8_downcvt
9094b84b 971 ? "MAIL FROM:<%s>%s%s SMTPUTF8\r\n"
9bfc60eb
JH
972 :
973#endif
9094b84b
JH
974 "MAIL FROM:<%s>%s%s\r\n",
975 from_address, responsebuffer, size_str) >= 0)
b4a2b536 976 ) &&
2b1c6e3a 977
193e3acd
JH
978 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
979 '2', callout);
059ec3d9 980
00bff6f6
JH
981 deliver_host = deliver_host_address = NULL;
982 deliver_domain = save_deliver_domain;
983
193e3acd
JH
984 /* If the host does not accept MAIL FROM:<>, arrange to cache this
985 information, but again, don't record anything for an I/O error or a defer. Do
986 not cache rejections of MAIL when a non-empty sender has been used, because
987 that blocks the whole domain for all senders. */
059ec3d9 988
193e3acd 989 if (!done)
059ec3d9 990 {
193e3acd
JH
991 *failure_ptr = US"mail"; /* At or before MAIL */
992 if (errno == 0 && responsebuffer[0] == '5')
993 {
994 setflag(addr, af_verify_nsfail);
995 if (from_address[0] == 0)
996 new_domain_record.result = ccache_reject_mfnull;
997 }
059ec3d9 998 }
059ec3d9 999
193e3acd
JH
1000 /* Otherwise, proceed to check a "random" address (if required), then the
1001 given address, and the postmaster address (if required). Between each check,
1002 issue RSET, because some servers accept only one recipient after MAIL
1003 FROM:<>.
2b1c6e3a 1004
193e3acd
JH
1005 Before doing this, set the result in the domain cache record to "accept",
1006 unless its previous value was ccache_reject_mfnull. In that case, the domain
1007 rejects MAIL FROM:<> and we want to continue to remember that. When that is
1008 the case, we have got here only in the case of a recipient verification with
1009 a non-null sender. */
059ec3d9 1010
193e3acd 1011 else
059ec3d9 1012 {
921dfc11
JH
1013 const uschar * rcpt_domain = addr->domain;
1014
8c5d388a 1015#ifdef SUPPORT_I18N
921dfc11
JH
1016 uschar * errstr = NULL;
1017 if ( testflag(addr, af_utf8_downcvt)
1018 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
1019 &errstr), errstr)
1020 )
1021 {
1022 addr->message = errstr;
1023 errno = ERRNO_EXPANDFAIL;
1024 setflag(addr, af_verify_nsfail);
1025 done = FALSE;
1026 rcpt_domain = US""; /*XXX errorhandling! */
1027 }
1028#endif
1029
193e3acd
JH
1030 new_domain_record.result =
1031 (old_domain_cache_result == ccache_reject_mfnull)?
1032 ccache_reject_mfnull: ccache_accept;
059ec3d9 1033
193e3acd 1034 /* Do the random local part check first */
059ec3d9 1035
193e3acd 1036 if (random_local_part != NULL)
059ec3d9 1037 {
193e3acd
JH
1038 uschar randombuffer[1024];
1039 BOOL random_ok =
1040 smtp_write_command(&outblock, FALSE,
1041 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part,
921dfc11 1042 rcpt_domain) >= 0 &&
193e3acd
JH
1043 smtp_read_response(&inblock, randombuffer,
1044 sizeof(randombuffer), '2', callout);
059ec3d9 1045
193e3acd 1046 /* Remember when we last did a random test */
059ec3d9 1047
193e3acd 1048 new_domain_record.random_stamp = time(NULL);
059ec3d9 1049
193e3acd 1050 /* If accepted, we aren't going to do any further tests below. */
059ec3d9 1051
193e3acd 1052 if (random_ok)
193e3acd 1053 new_domain_record.random_result = ccache_accept;
059ec3d9 1054
193e3acd
JH
1055 /* Otherwise, cache a real negative response, and get back to the right
1056 state to send RCPT. Unless there's some problem such as a dropped
65f1c92a
JH
1057 connection, we expect to succeed, because the commands succeeded above.
1058 However, some servers drop the connection after responding to an
1059 invalid recipient, so on (any) error we drop and remake the connection.
1060 */
059ec3d9 1061
193e3acd
JH
1062 else if (errno == 0)
1063 {
65f1c92a
JH
1064 /* This would be ok for 1st rcpt a cutthrough, but no way to
1065 handle a subsequent. So refuse to support any */
5032d1cf
JH
1066 cancel_cutthrough_connection("random-recipient");
1067
193e3acd
JH
1068 if (randombuffer[0] == '5')
1069 new_domain_record.random_result = ccache_reject;
1070
1071 done =
1072 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1073 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1074 '2', callout) &&
1075
9bfc60eb 1076 smtp_write_command(&outblock, FALSE,
8c5d388a 1077#ifdef SUPPORT_I18N
921dfc11 1078 addr->prop.utf8_msg && !addr->prop.utf8_downcvt
9bfc60eb
JH
1079 ? "MAIL FROM:<%s> SMTPUTF8\r\n"
1080 :
1081#endif
1082 "MAIL FROM:<%s>\r\n",
193e3acd
JH
1083 from_address) >= 0 &&
1084 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1085 '2', callout);
65f1c92a
JH
1086
1087 if (!done)
1088 {
1089 HDEBUG(D_acl|D_v)
1090 debug_printf("problem after random/rset/mfrom; reopen conn\n");
1091 random_local_part = NULL;
1092#ifdef SUPPORT_TLS
1093 tls_close(FALSE, TRUE);
1094#endif
ae5afa61 1095 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
65f1c92a 1096 (void)close(inblock.sock);
0cbf2b82 1097#ifndef DISABLE_EVENT
65f1c92a
JH
1098 (void) event_raise(addr->transport->event_action,
1099 US"tcp:close", NULL);
1100#endif
1101 goto tls_retry_connection;
1102 }
193e3acd
JH
1103 }
1104 else done = FALSE; /* Some timeout/connection problem */
1105 } /* Random check */
059ec3d9 1106
193e3acd
JH
1107 /* If the host is accepting all local parts, as determined by the "random"
1108 check, we don't need to waste time doing any further checking. */
059ec3d9 1109
193e3acd 1110 if (new_domain_record.random_result != ccache_accept && done)
059ec3d9 1111 {
193e3acd
JH
1112 /* Get the rcpt_include_affixes flag from the transport if there is one,
1113 but assume FALSE if there is not. */
e4bdf652 1114
921dfc11
JH
1115 uschar * rcpt = transport_rcpt_address(addr,
1116 addr->transport ? addr->transport->rcpt_include_affixes : FALSE);
1117
8c5d388a 1118#ifdef SUPPORT_I18N
921dfc11
JH
1119 /*XXX should the conversion be moved into transport_rcpt_address() ? */
1120 uschar * dummy_errstr = NULL;
1121 if ( testflag(addr, af_utf8_downcvt)
1122 && (rcpt = string_address_utf8_to_alabel(rcpt, &dummy_errstr),
1123 dummy_errstr
1124 ) )
1125 {
1126 errno = ERRNO_EXPANDFAIL;
1127 *failure_ptr = US"recipient";
1128 done = FALSE;
1129 }
1130 else
1131#endif
1132
059ec3d9 1133 done =
193e3acd 1134 smtp_write_command(&outblock, FALSE, "RCPT TO:<%.1000s>\r\n",
921dfc11 1135 rcpt) >= 0 &&
193e3acd
JH
1136 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1137 '2', callout);
059ec3d9 1138
193e3acd
JH
1139 if (done)
1140 new_address_record.result = ccache_accept;
1141 else if (errno == 0 && responsebuffer[0] == '5')
1142 {
1143 *failure_ptr = US"recipient";
1144 new_address_record.result = ccache_reject;
1145 }
059ec3d9 1146
193e3acd
JH
1147 /* Do postmaster check if requested; if a full check is required, we
1148 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
2a4be8f9 1149
193e3acd
JH
1150 if (done && pm_mailfrom != NULL)
1151 {
65f1c92a
JH
1152 /* Could possibly shift before main verify, just above, and be ok
1153 for cutthrough. But no way to handle a subsequent rcpt, so just
1154 refuse any */
5032d1cf 1155 cancel_cutthrough_connection("postmaster verify");
193e3acd
JH
1156 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of postmaster verify\n");
1157
1158 done =
1159 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1160 smtp_read_response(&inblock, responsebuffer,
1161 sizeof(responsebuffer), '2', callout) &&
1162
1163 smtp_write_command(&outblock, FALSE,
1164 "MAIL FROM:<%s>\r\n", pm_mailfrom) >= 0 &&
1165 smtp_read_response(&inblock, responsebuffer,
1166 sizeof(responsebuffer), '2', callout) &&
1167
1168 /* First try using the current domain */
1169
1170 ((
1171 smtp_write_command(&outblock, FALSE,
921dfc11 1172 "RCPT TO:<postmaster@%.1000s>\r\n", rcpt_domain) >= 0 &&
193e3acd
JH
1173 smtp_read_response(&inblock, responsebuffer,
1174 sizeof(responsebuffer), '2', callout)
1175 )
1176
1177 ||
1178
1179 /* If that doesn't work, and a full check is requested,
1180 try without the domain. */
1181
1182 (
1183 (options & vopt_callout_fullpm) != 0 &&
1184 smtp_write_command(&outblock, FALSE,
1185 "RCPT TO:<postmaster>\r\n") >= 0 &&
1186 smtp_read_response(&inblock, responsebuffer,
1187 sizeof(responsebuffer), '2', callout)
1188 ));
1189
1190 /* Sort out the cache record */
1191
1192 new_domain_record.postmaster_stamp = time(NULL);
1193
1194 if (done)
1195 new_domain_record.postmaster_result = ccache_accept;
1196 else if (errno == 0 && responsebuffer[0] == '5')
1197 {
1198 *failure_ptr = US"postmaster";
1199 setflag(addr, af_verify_pmfail);
1200 new_domain_record.postmaster_result = ccache_reject;
1201 }
1202 }
1203 } /* Random not accepted */
1204 } /* MAIL FROM: accepted */
2a4be8f9 1205
193e3acd
JH
1206 /* For any failure of the main check, other than a negative response, we just
1207 close the connection and carry on. We can identify a negative response by the
1208 fact that errno is zero. For I/O errors it will be non-zero
2a4be8f9 1209
193e3acd
JH
1210 Set up different error texts for logging and for sending back to the caller
1211 as an SMTP response. Log in all cases, using a one-line format. For sender
1212 callouts, give a full response to the caller, but for recipient callouts,
1213 don't give the IP address because this may be an internal host whose identity
1214 is not to be widely broadcast. */
2a4be8f9 1215
193e3acd
JH
1216 if (!done)
1217 {
1218 if (errno == ETIMEDOUT)
1219 {
1220 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
1221 send_quit = FALSE;
1222 }
8c5d388a 1223#ifdef SUPPORT_I18N
9bfc60eb
JH
1224 else if (errno == ERRNO_UTF8_FWD)
1225 {
1226 extern int acl_where; /* src/acl.c */
1227 errno = 0;
1228 addr->message = string_sprintf(
1229 "response to \"%s\" from %s [%s] did not include SMTPUTF8",
1230 big_buffer, host->name, host->address);
1231 addr->user_message = acl_where == ACL_WHERE_RCPT
1232 ? US"533 mailbox name not allowed"
1233 : US"550 mailbox unavailable";
1234 yield = FAIL;
1235 done = TRUE;
1236 }
1237#endif
193e3acd
JH
1238 else if (errno == 0)
1239 {
1240 if (*responsebuffer == 0) Ustrcpy(responsebuffer, US"connection dropped");
2a4be8f9 1241
193e3acd
JH
1242 addr->message =
1243 string_sprintf("response to \"%s\" from %s [%s] was: %s",
1244 big_buffer, host->name, host->address,
1245 string_printing(responsebuffer));
059ec3d9 1246
8b9476ba
JH
1247 addr->user_message = options & vopt_is_recipient
1248 ? string_sprintf("Callout verification failed:\n%s", responsebuffer)
1249 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
193e3acd 1250 host->address, big_buffer, responsebuffer);
059ec3d9 1251
193e3acd
JH
1252 /* Hard rejection ends the process */
1253
1254 if (responsebuffer[0] == '5') /* Address rejected */
059ec3d9 1255 {
193e3acd
JH
1256 yield = FAIL;
1257 done = TRUE;
059ec3d9
PH
1258 }
1259 }
193e3acd 1260 }
059ec3d9 1261
193e3acd
JH
1262 /* End the SMTP conversation and close the connection. */
1263
5032d1cf
JH
1264 /* Cutthrough - on a successfull connect and recipient-verify with
1265 use-sender and we are 1st rcpt and have no cutthrough conn so far
193e3acd 1266 here is where we want to leave the conn open */
5032d1cf
JH
1267 if ( cutthrough.delivery
1268 && rcpt_count == 1
193e3acd
JH
1269 && done
1270 && yield == OK
98c82a3d
JH
1271 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1272 == vopt_callout_recipsender
193e3acd
JH
1273 && !random_local_part
1274 && !pm_mailfrom
5032d1cf 1275 && cutthrough.fd < 0
66ba1a69 1276 && !lmtp
193e3acd 1277 )
059ec3d9 1278 {
8b9476ba
JH
1279 HDEBUG(D_acl|D_v) debug_printf("holding verify callout open for cutthrough delivery\n");
1280
5032d1cf
JH
1281 cutthrough.fd = outblock.sock; /* We assume no buffer in use in the outblock */
1282 cutthrough.nrcpt = 1;
1283 cutthrough.interface = interface;
1284 cutthrough.host = *host;
1285 cutthrough.addr = *addr; /* Save the address_item for later logging */
1286 cutthrough.addr.next = NULL;
1287 cutthrough.addr.host_used = &cutthrough.host;
193e3acd 1288 if (addr->parent)
5032d1cf
JH
1289 *(cutthrough.addr.parent = store_get(sizeof(address_item))) =
1290 *addr->parent;
193e3acd
JH
1291 ctblock.buffer = ctbuffer;
1292 ctblock.buffersize = sizeof(ctbuffer);
1293 ctblock.ptr = ctbuffer;
1294 /* ctblock.cmd_count = 0; ctblock.authenticating = FALSE; */
5032d1cf 1295 ctblock.sock = cutthrough.fd;
059ec3d9 1296 }
193e3acd 1297 else
059ec3d9 1298 {
2e5b33cd 1299 /* Ensure no cutthrough on multiple address verifies */
193e3acd 1300 if (options & vopt_callout_recipsender)
ff5929e3
JH
1301 cancel_cutthrough_connection("not usable for cutthrough");
1302 if (send_quit)
1303 (void) smtp_write_command(&outblock, FALSE, "QUIT\r\n");
059ec3d9 1304
a7538db1 1305#ifdef SUPPORT_TLS
193e3acd 1306 tls_close(FALSE, TRUE);
a7538db1 1307#endif
ae5afa61 1308 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
193e3acd 1309 (void)close(inblock.sock);
0cbf2b82 1310#ifndef DISABLE_EVENT
08f3b11b 1311 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
a7538db1 1312#endif
059ec3d9 1313 }
059ec3d9 1314
193e3acd
JH
1315 } /* Loop through all hosts, while !done */
1316 }
059ec3d9
PH
1317
1318/* If we get here with done == TRUE, a successful callout happened, and yield
1319will be set OK or FAIL according to the response to the RCPT command.
1320Otherwise, we looped through the hosts but couldn't complete the business.
1321However, there may be domain-specific information to cache in both cases.
1322
1323The value of the result field in the new_domain record is ccache_unknown if
90e9ce59 1324there was an error before or with MAIL FROM:, and errno was not zero,
059ec3d9 1325implying some kind of I/O error. We don't want to write the cache in that case.
2b1c6e3a 1326Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
059ec3d9 1327
8b9476ba
JH
1328if ( !(options & vopt_callout_no_cache)
1329 && new_domain_record.result != ccache_unknown)
059ec3d9
PH
1330 {
1331 if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
1332 == NULL)
1333 {
1334 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
1335 }
1336 else
1337 {
1338 (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
1339 (int)sizeof(dbdata_callout_cache));
8b9476ba 1340 HDEBUG(D_verify) debug_printf("wrote callout cache domain record for %s:\n"
059ec3d9 1341 " result=%d postmaster=%d random=%d\n",
8b9476ba 1342 addr->domain,
059ec3d9
PH
1343 new_domain_record.result,
1344 new_domain_record.postmaster_result,
1345 new_domain_record.random_result);
1346 }
1347 }
1348
1349/* If a definite result was obtained for the callout, cache it unless caching
1350is disabled. */
1351
1352if (done)
1353 {
8b9476ba
JH
1354 if ( !(options & vopt_callout_no_cache)
1355 && new_address_record.result != ccache_unknown)
059ec3d9 1356 {
ff5929e3 1357 if (!dbm_file)
059ec3d9 1358 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
ff5929e3 1359 if (!dbm_file)
059ec3d9
PH
1360 {
1361 HDEBUG(D_verify) debug_printf("no callout cache available\n");
1362 }
1363 else
1364 {
1365 (void)dbfn_write(dbm_file, address_key, &new_address_record,
1366 (int)sizeof(dbdata_callout_cache_address));
8b9476ba
JH
1367 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record for %s\n",
1368 new_address_record.result == ccache_accept ? "positive" : "negative",
1369 address_key);
059ec3d9
PH
1370 }
1371 }
1372 } /* done */
1373
1374/* Failure to connect to any host, or any response other than 2xx or 5xx is a
1375temporary error. If there was only one host, and a response was received, leave
1376it alone if supplying details. Otherwise, give a generic response. */
1377
1378else /* !done */
1379 {
ff5929e3 1380 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
8b9476ba 1381 options & vopt_is_recipient ? "recipient" : "sender");
059ec3d9
PH
1382 yield = DEFER;
1383
ff5929e3
JH
1384 if (host_list->next || !addr->message)
1385 addr->message = dullmsg;
059ec3d9 1386
ff5929e3
JH
1387 addr->user_message = smtp_return_error_details
1388 ? string_sprintf("%s for <%s>.\n"
059ec3d9
PH
1389 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1390 "they may be permanently unreachable from this server. In the latter case,\n%s",
1391 dullmsg, addr->address,
8b9476ba 1392 options & vopt_is_recipient
ff5929e3 1393 ? "the address will never be accepted."
8b9476ba
JH
1394 : "you need to change the address or create an MX record for its domain\n"
1395 "if it is supposed to be generally accessible from the Internet.\n"
ff5929e3
JH
1396 "Talk to your mail administrator for details.")
1397 : dullmsg;
059ec3d9
PH
1398
1399 /* Force a specific error code */
1400
1401 addr->basic_errno = ERRNO_CALLOUTDEFER;
1402 }
1403
1404/* Come here from within the cache-reading code on fast-track exit. */
1405
1406END_CALLOUT:
ff5929e3 1407if (dbm_file) dbfn_close(dbm_file);
059ec3d9
PH
1408return yield;
1409}
1410
1411
1412
817d9f57
JH
1413/* Called after recipient-acl to get a cutthrough connection open when
1414 one was requested and a recipient-verify wasn't subsequently done.
1415*/
f9334a28 1416int
e4bdf652
JH
1417open_cutthrough_connection( address_item * addr )
1418{
1419address_item addr2;
f9334a28 1420int rc;
e4bdf652
JH
1421
1422/* Use a recipient-verify-callout to set up the cutthrough connection. */
1423/* We must use a copy of the address for verification, because it might
1424get rewritten. */
1425
1426addr2 = *addr;
5032d1cf
JH
1427HDEBUG(D_acl) debug_printf("----------- %s cutthrough setup ------------\n",
1428 rcpt_count > 1 ? "more" : "start");
ff5929e3 1429rc = verify_address(&addr2, NULL,
e4bdf652
JH
1430 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1431 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1432 NULL, NULL, NULL);
ff5929e3
JH
1433addr->message = addr2.message;
1434addr->user_message = addr2.user_message;
e4bdf652 1435HDEBUG(D_acl) debug_printf("----------- end cutthrough setup ------------\n");
f9334a28 1436return rc;
e4bdf652
JH
1437}
1438
1439
e4bdf652 1440
817d9f57
JH
1441/* Send given number of bytes from the buffer */
1442static BOOL
1443cutthrough_send(int n)
e4bdf652 1444{
5032d1cf 1445if(cutthrough.fd < 0)
817d9f57 1446 return TRUE;
e4bdf652 1447
817d9f57
JH
1448if(
1449#ifdef SUPPORT_TLS
5032d1cf 1450 (tls_out.active == cutthrough.fd) ? tls_write(FALSE, ctblock.buffer, n) :
817d9f57 1451#endif
5032d1cf 1452 send(cutthrough.fd, ctblock.buffer, n, 0) > 0
817d9f57
JH
1453 )
1454{
1455 transport_count += n;
1456 ctblock.ptr= ctblock.buffer;
1457 return TRUE;
1458}
e4bdf652 1459
817d9f57
JH
1460HDEBUG(D_transport|D_acl) debug_printf("cutthrough_send failed: %s\n", strerror(errno));
1461return FALSE;
e4bdf652
JH
1462}
1463
1464
1465
817d9f57
JH
1466static BOOL
1467_cutthrough_puts(uschar * cp, int n)
1468{
1469while(n--)
1470 {
1471 if(ctblock.ptr >= ctblock.buffer+ctblock.buffersize)
1472 if(!cutthrough_send(ctblock.buffersize))
1473 return FALSE;
1474
1475 *ctblock.ptr++ = *cp++;
1476 }
1477return TRUE;
1478}
1479
1480/* Buffered output of counted data block. Return boolean success */
e4bdf652
JH
1481BOOL
1482cutthrough_puts(uschar * cp, int n)
1483{
5032d1cf 1484if (cutthrough.fd < 0) return TRUE;
817d9f57 1485if (_cutthrough_puts(cp, n)) return TRUE;
2e5b33cd 1486cancel_cutthrough_connection("transmit failed");
817d9f57
JH
1487return FALSE;
1488}
e4bdf652 1489
e4bdf652 1490
817d9f57 1491static BOOL
5032d1cf 1492_cutthrough_flush_send(void)
817d9f57
JH
1493{
1494int n= ctblock.ptr-ctblock.buffer;
e4bdf652 1495
817d9f57
JH
1496if(n>0)
1497 if(!cutthrough_send(n))
1498 return FALSE;
1499return TRUE;
e4bdf652
JH
1500}
1501
817d9f57
JH
1502
1503/* Send out any bufferred output. Return boolean success. */
e4bdf652 1504BOOL
5032d1cf 1505cutthrough_flush_send(void)
e4bdf652 1506{
817d9f57 1507if (_cutthrough_flush_send()) return TRUE;
2e5b33cd 1508cancel_cutthrough_connection("transmit failed");
e4bdf652
JH
1509return FALSE;
1510}
1511
1512
1513BOOL
5032d1cf 1514cutthrough_put_nl(void)
e4bdf652
JH
1515{
1516return cutthrough_puts(US"\r\n", 2);
1517}
1518
1519
1520/* Get and check response from cutthrough target */
1521static uschar
1522cutthrough_response(char expect, uschar ** copy)
1523{
1524smtp_inblock inblock;
1525uschar inbuffer[4096];
1526uschar responsebuffer[4096];
1527
1528inblock.buffer = inbuffer;
1529inblock.buffersize = sizeof(inbuffer);
1530inblock.ptr = inbuffer;
1531inblock.ptrend = inbuffer;
5032d1cf 1532inblock.sock = cutthrough.fd;
817d9f57 1533/* this relies on (inblock.sock == tls_out.active) */
e4bdf652 1534if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, CUTTHROUGH_DATA_TIMEOUT))
2e5b33cd 1535 cancel_cutthrough_connection("target timeout on read");
e4bdf652
JH
1536
1537if(copy != NULL)
1538 {
1539 uschar * cp;
5032d1cf 1540 *copy = cp = string_copy(responsebuffer);
e4bdf652
JH
1541 /* Trim the trailing end of line */
1542 cp += Ustrlen(responsebuffer);
1543 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1544 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1545 }
1546
1547return responsebuffer[0];
1548}
1549
1550
1551/* Negotiate dataphase with the cutthrough target, returning success boolean */
1552BOOL
5032d1cf 1553cutthrough_predata(void)
e4bdf652 1554{
5032d1cf 1555if(cutthrough.fd < 0)
e4bdf652
JH
1556 return FALSE;
1557
1558HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> DATA\n");
817d9f57
JH
1559cutthrough_puts(US"DATA\r\n", 6);
1560cutthrough_flush_send();
e4bdf652
JH
1561
1562/* Assume nothing buffered. If it was it gets ignored. */
1563return cutthrough_response('3', NULL) == '3';
1564}
1565
1566
6d5c916c 1567/* fd and tctx args only to match write_chunk() */
511a6c14 1568static BOOL
6d5c916c 1569cutthrough_write_chunk(int fd, transport_ctx * tctx, uschar * s, int len)
511a6c14
JH
1570{
1571uschar * s2;
1572while(s && (s2 = Ustrchr(s, '\n')))
1573 {
1574 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1575 return FALSE;
1576 s = s2+1;
1577 }
1578return TRUE;
1579}
1580
1581
e4bdf652 1582/* Buffered send of headers. Return success boolean. */
817d9f57 1583/* Expands newlines to wire format (CR,NL). */
e4bdf652 1584/* Also sends header-terminating blank line. */
e4bdf652 1585BOOL
5032d1cf 1586cutthrough_headers_send(void)
e4bdf652 1587{
6d5c916c
JH
1588transport_ctx tctx;
1589
5032d1cf 1590if(cutthrough.fd < 0)
e4bdf652
JH
1591 return FALSE;
1592
511a6c14
JH
1593/* We share a routine with the mainline transport to handle header add/remove/rewrites,
1594 but having a separate buffered-output function (for now)
1595*/
1596HDEBUG(D_acl) debug_printf("----------- start cutthrough headers send -----------\n");
e4bdf652 1597
6d5c916c
JH
1598tctx.tblock = cutthrough.addr.transport;
1599tctx.addr = &cutthrough.addr;
1600tctx.check_string = US".";
1601tctx.escape_string = US"..";
1602tctx.options = topt_use_crlf;
1603
1604if (!transport_headers_send(cutthrough.fd, &tctx, &cutthrough_write_chunk))
511a6c14
JH
1605 return FALSE;
1606
1607HDEBUG(D_acl) debug_printf("----------- done cutthrough headers send ------------\n");
1608return TRUE;
817d9f57
JH
1609}
1610
1611
1612static void
5032d1cf 1613close_cutthrough_connection(const char * why)
817d9f57 1614{
5032d1cf 1615if(cutthrough.fd >= 0)
817d9f57
JH
1616 {
1617 /* We could be sending this after a bunch of data, but that is ok as
1618 the only way to cancel the transfer in dataphase is to drop the tcp
1619 conn before the final dot.
1620 */
1621 ctblock.ptr = ctbuffer;
1622 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> QUIT\n");
1623 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1624 _cutthrough_flush_send();
1625 /* No wait for response */
1626
1627 #ifdef SUPPORT_TLS
1628 tls_close(FALSE, TRUE);
1629 #endif
ae5afa61 1630 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
5032d1cf
JH
1631 (void)close(cutthrough.fd);
1632 cutthrough.fd = -1;
2e5b33cd 1633 HDEBUG(D_acl) debug_printf("----------- cutthrough shutdown (%s) ------------\n", why);
817d9f57
JH
1634 }
1635ctblock.ptr = ctbuffer;
e4bdf652
JH
1636}
1637
817d9f57 1638void
5032d1cf 1639cancel_cutthrough_connection(const char * why)
817d9f57 1640{
2e5b33cd 1641close_cutthrough_connection(why);
5032d1cf 1642cutthrough.delivery = FALSE;
817d9f57
JH
1643}
1644
1645
1646
e4bdf652
JH
1647
1648/* Have senders final-dot. Send one to cutthrough target, and grab the response.
1649 Log an OK response as a transmission.
817d9f57 1650 Close the connection.
e4bdf652 1651 Return smtp response-class digit.
e4bdf652
JH
1652*/
1653uschar *
5032d1cf 1654cutthrough_finaldot(void)
e4bdf652 1655{
5032d1cf
JH
1656uschar res;
1657address_item * addr;
e4bdf652
JH
1658HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> .\n");
1659
1660/* Assume data finshed with new-line */
5032d1cf
JH
1661if( !cutthrough_puts(US".", 1)
1662 || !cutthrough_put_nl()
1663 || !cutthrough_flush_send()
1664 )
1665 return cutthrough.addr.message;
e4bdf652 1666
5032d1cf
JH
1667res = cutthrough_response('2', &cutthrough.addr.message);
1668for (addr = &cutthrough.addr; addr; addr = addr->next)
817d9f57 1669 {
5032d1cf
JH
1670 addr->message = cutthrough.addr.message;
1671 switch(res)
1672 {
1673 case '2':
1674 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1675 close_cutthrough_connection("delivered");
1676 break;
817d9f57 1677
5032d1cf
JH
1678 case '4':
1679 delivery_log(LOG_MAIN, addr, 0,
1680 US"tmp-reject from cutthrough after DATA:");
1681 break;
e4bdf652 1682
5032d1cf
JH
1683 case '5':
1684 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1685 US"rejected after DATA:");
1686 break;
e4bdf652 1687
5032d1cf
JH
1688 default:
1689 break;
1690 }
817d9f57 1691 }
5032d1cf 1692return cutthrough.addr.message;
e4bdf652
JH
1693}
1694
1695
817d9f57 1696
059ec3d9
PH
1697/*************************************************
1698* Copy error to toplevel address *
1699*************************************************/
1700
1701/* This function is used when a verify fails or defers, to ensure that the
1702failure or defer information is in the original toplevel address. This applies
1703when an address is redirected to a single new address, and the failure or
1704deferral happens to the child address.
1705
1706Arguments:
1707 vaddr the verify address item
1708 addr the final address item
1709 yield FAIL or DEFER
1710
1711Returns: the value of YIELD
1712*/
1713
1714static int
1715copy_error(address_item *vaddr, address_item *addr, int yield)
1716{
1717if (addr != vaddr)
1718 {
1719 vaddr->message = addr->message;
1720 vaddr->user_message = addr->user_message;
1721 vaddr->basic_errno = addr->basic_errno;
1722 vaddr->more_errno = addr->more_errno;
d43cbe25 1723 vaddr->prop.address_data = addr->prop.address_data;
42855d71 1724 copyflag(vaddr, addr, af_pass_message);
059ec3d9
PH
1725 }
1726return yield;
1727}
1728
1729
1730
1731
ce552449
NM
1732/**************************************************
1733* printf that automatically handles TLS if needed *
1734***************************************************/
1735
1736/* This function is used by verify_address() as a substitute for all fprintf()
1737calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1738as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1739that assumes that we always use the smtp_out FILE* when not using TLS or the
1740ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1741that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1742fprintf().
1743
1744Arguments:
1745 f the candidate FILE* to write to
1746 format format string
1747 ... optional arguments
1748
1749Returns:
1750 nothing
1751*/
1752
1753static void PRINTF_FUNCTION(2,3)
1ba28e2b 1754respond_printf(FILE *f, const char *format, ...)
ce552449
NM
1755{
1756va_list ap;
1757
1758va_start(ap, format);
1759if (smtp_out && (f == smtp_out))
1760 smtp_vprintf(format, ap);
1761else
513afc6a 1762 vfprintf(f, format, ap);
ce552449
NM
1763va_end(ap);
1764}
1765
1766
1767
059ec3d9
PH
1768/*************************************************
1769* Verify an email address *
1770*************************************************/
1771
1772/* This function is used both for verification (-bv and at other times) and
1773address testing (-bt), which is indicated by address_test_mode being set.
1774
1775Arguments:
1776 vaddr contains the address to verify; the next field in this block
1777 must be NULL
1778 f if not NULL, write the result to this file
1779 options various option bits:
1780 vopt_fake_sender => this sender verify is not for the real
1781 sender (it was verify=sender=xxxx or an address from a
1782 header line) - rewriting must not change sender_address
1783 vopt_is_recipient => this is a recipient address, otherwise
1784 it's a sender address - this affects qualification and
1785 rewriting and messages from callouts
1786 vopt_qualify => qualify an unqualified address; else error
1787 vopt_expn => called from SMTP EXPN command
eafd343b
TK
1788 vopt_success_on_redirect => when a new address is generated
1789 the verification instantly succeeds
059ec3d9
PH
1790
1791 These ones are used by do_callout() -- the options variable
1792 is passed to it.
1793
2a4be8f9 1794 vopt_callout_fullpm => if postmaster check, do full one
059ec3d9
PH
1795 vopt_callout_no_cache => don't use callout cache
1796 vopt_callout_random => do the "random" thing
1797 vopt_callout_recipsender => use real sender for recipient
1798 vopt_callout_recippmaster => use postmaster for recipient
1799
1800 callout if > 0, specifies that callout is required, and gives timeout
4deaf07d 1801 for individual commands
059ec3d9
PH
1802 callout_overall if > 0, gives overall timeout for the callout function;
1803 if < 0, a default is used (see do_callout())
8e669ac1 1804 callout_connect the connection timeout for callouts
059ec3d9
PH
1805 se_mailfrom when callout is requested to verify a sender, use this
1806 in MAIL FROM; NULL => ""
1807 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1808 thing and use this as the sender address (may be "")
1809
1810 routed if not NULL, set TRUE if routing succeeded, so we can
1811 distinguish between routing failed and callout failed
1812
1813Returns: OK address verified
1814 FAIL address failed to verify
1815 DEFER can't tell at present
1816*/
1817
1818int
1819verify_address(address_item *vaddr, FILE *f, int options, int callout,
8e669ac1 1820 int callout_overall, int callout_connect, uschar *se_mailfrom,
4deaf07d 1821 uschar *pm_mailfrom, BOOL *routed)
059ec3d9
PH
1822{
1823BOOL allok = TRUE;
1824BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
059ec3d9 1825BOOL expn = (options & vopt_expn) != 0;
eafd343b 1826BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
059ec3d9
PH
1827int i;
1828int yield = OK;
1829int verify_type = expn? v_expn :
1830 address_test_mode? v_none :
8b9476ba 1831 options & vopt_is_recipient? v_recipient : v_sender;
059ec3d9
PH
1832address_item *addr_list;
1833address_item *addr_new = NULL;
1834address_item *addr_remote = NULL;
1835address_item *addr_local = NULL;
1836address_item *addr_succeed = NULL;
8b9476ba
JH
1837uschar **failure_ptr = options & vopt_is_recipient
1838 ? &recipient_verify_failure : &sender_verify_failure;
059ec3d9
PH
1839uschar *ko_prefix, *cr;
1840uschar *address = vaddr->address;
1841uschar *save_sender;
1842uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1843
2c7db3f5
PH
1844/* Clear, just in case */
1845
1846*failure_ptr = NULL;
1847
059ec3d9
PH
1848/* Set up a prefix and suffix for error message which allow us to use the same
1849output statements both in EXPN mode (where an SMTP response is needed) and when
1850debugging with an output file. */
1851
1852if (expn)
1853 {
1854 ko_prefix = US"553 ";
1855 cr = US"\r";
1856 }
1857else ko_prefix = cr = US"";
1858
1859/* Add qualify domain if permitted; otherwise an unqualified address fails. */
1860
1861if (parse_find_at(address) == NULL)
1862 {
1863 if ((options & vopt_qualify) == 0)
1864 {
1865 if (f != NULL)
ce552449
NM
1866 respond_printf(f, "%sA domain is required for \"%s\"%s\n",
1867 ko_prefix, address, cr);
8e669ac1 1868 *failure_ptr = US"qualify";
059ec3d9
PH
1869 return FAIL;
1870 }
8b9476ba 1871 address = rewrite_address_qualify(address, options & vopt_is_recipient);
059ec3d9
PH
1872 }
1873
1874DEBUG(D_verify)
1875 {
1876 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1877 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
1878 }
1879
1880/* Rewrite and report on it. Clear the domain and local part caches - these
1881may have been set by domains and local part tests during an ACL. */
1882
1883if (global_rewrite_rules != NULL)
1884 {
1885 uschar *old = address;
8b9476ba 1886 address = rewrite_address(address, options & vopt_is_recipient, FALSE,
059ec3d9
PH
1887 global_rewrite_rules, rewrite_existflags);
1888 if (address != old)
1889 {
1890 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1891 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1892 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
1893 }
1894 }
1895
1896/* If this is the real sender address, we must update sender_address at
1897this point, because it may be referred to in the routers. */
1898
1899if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
1900 sender_address = address;
1901
1902/* If the address was rewritten to <> no verification can be done, and we have
1903to return OK. This rewriting is permitted only for sender addresses; for other
1904addresses, such rewriting fails. */
1905
1906if (address[0] == 0) return OK;
1907
d9b2312b
JH
1908/* Flip the legacy TLS-related variables over to the outbound set in case
1909they're used in the context of a transport used by verification. Reset them
ea90b718 1910at exit from this routine (so no returns allowed from here on). */
d9b2312b 1911
35aba663 1912tls_modify_variables(&tls_out);
d9b2312b 1913
059ec3d9
PH
1914/* Save a copy of the sender address for re-instating if we change it to <>
1915while verifying a sender address (a nice bit of self-reference there). */
1916
1917save_sender = sender_address;
1918
ea90b718
JH
1919/* Observability variable for router/transport use */
1920
8b9476ba 1921verify_mode = options & vopt_is_recipient ? US"R" : US"S";
ea90b718 1922
059ec3d9
PH
1923/* Update the address structure with the possibly qualified and rewritten
1924address. Set it up as the starting address on the chain of new addresses. */
1925
1926vaddr->address = address;
1927addr_new = vaddr;
1928
1929/* We need a loop, because an address can generate new addresses. We must also
1930cope with generated pipes and files at the top level. (See also the code and
1931comment in deliver.c.) However, it is usually the case that the router for
1932user's .forward files has its verify flag turned off.
1933
1934If an address generates more than one child, the loop is used only when
1935full_info is set, and this can only be set locally. Remote enquiries just get
1936information about the top level address, not anything that it generated. */
1937
ea90b718 1938while (addr_new)
059ec3d9
PH
1939 {
1940 int rc;
1941 address_item *addr = addr_new;
1942
1943 addr_new = addr->next;
1944 addr->next = NULL;
1945
1946 DEBUG(D_verify)
1947 {
1948 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1949 debug_printf("Considering %s\n", addr->address);
1950 }
1951
1952 /* Handle generated pipe, file or reply addresses. We don't get these
1953 when handling EXPN, as it does only one level of expansion. */
1954
1955 if (testflag(addr, af_pfr))
1956 {
1957 allok = FALSE;
1958 if (f != NULL)
1959 {
1960 BOOL allow;
1961
1962 if (addr->address[0] == '>')
1963 {
1964 allow = testflag(addr, af_allow_reply);
1965 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1966 }
1967 else
1968 {
1969 allow = (addr->address[0] == '|')?
1970 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1971 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1972 }
1973
1974 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1975 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1976 "%s\n", addr->message);
1977 else if (allow)
1978 fprintf(f, "\n transport = %s\n", addr->transport->name);
1979 else
1980 fprintf(f, " *** forbidden ***\n");
1981 }
1982 continue;
1983 }
1984
1985 /* Just in case some router parameter refers to it. */
1986
2f682e45
JH
1987 return_path = addr->prop.errors_address
1988 ? addr->prop.errors_address : sender_address;
059ec3d9
PH
1989
1990 /* Split the address into domain and local part, handling the %-hack if
1991 necessary, and then route it. While routing a sender address, set
1992 $sender_address to <> because that is what it will be if we were trying to
1993 send a bounce to the sender. */
1994
2f682e45 1995 if (routed) *routed = FALSE;
059ec3d9
PH
1996 if ((rc = deliver_split_address(addr)) == OK)
1997 {
8b9476ba 1998 if (!(options & vopt_is_recipient)) sender_address = null_sender;
059ec3d9
PH
1999 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
2000 &addr_succeed, verify_type);
2001 sender_address = save_sender; /* Put back the real sender */
2002 }
2003
2004 /* If routing an address succeeded, set the flag that remembers, for use when
2005 an ACL cached a sender verify (in case a callout fails). Then if routing set
2006 up a list of hosts or the transport has a host list, and the callout option
2007 is set, and we aren't in a host checking run, do the callout verification,
2008 and set another flag that notes that a callout happened. */
2009
2010 if (rc == OK)
2011 {
2f682e45 2012 if (routed) *routed = TRUE;
059ec3d9
PH
2013 if (callout > 0)
2014 {
08f3b11b 2015 transport_instance * tp;
2f682e45 2016 host_item * host_list = addr->host_list;
059ec3d9 2017
26da7e20
PH
2018 /* Make up some data for use in the case where there is no remote
2019 transport. */
2020
2021 transport_feedback tf = {
2022 NULL, /* interface (=> any) */
2023 US"smtp", /* port */
2024 US"smtp", /* protocol */
2025 NULL, /* hosts */
2026 US"$smtp_active_hostname", /* helo_data */
2027 FALSE, /* hosts_override */
2028 FALSE, /* hosts_randomize */
2029 FALSE, /* gethostbyname */
2030 TRUE, /* qualify_single */
2031 FALSE /* search_parents */
2032 };
059ec3d9
PH
2033
2034 /* If verification yielded a remote transport, we want to use that
2035 transport's options, so as to mimic what would happen if we were really
2036 sending a message to this address. */
2037
08f3b11b 2038 if ((tp = addr->transport) && !tp->info->local)
059ec3d9 2039 {
08f3b11b 2040 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
059ec3d9
PH
2041
2042 /* If the transport has hosts and the router does not, or if the
2043 transport is configured to override the router's hosts, we must build a
2044 host list of the transport's hosts, and find the IP addresses */
2045
2f682e45 2046 if (tf.hosts && (!host_list || tf.hosts_override))
059ec3d9
PH
2047 {
2048 uschar *s;
55414b25 2049 const uschar *save_deliver_domain = deliver_domain;
750af86e 2050 uschar *save_deliver_localpart = deliver_localpart;
059ec3d9
PH
2051
2052 host_list = NULL; /* Ignore the router's hosts */
2053
2054 deliver_domain = addr->domain;
2055 deliver_localpart = addr->local_part;
2056 s = expand_string(tf.hosts);
750af86e
PH
2057 deliver_domain = save_deliver_domain;
2058 deliver_localpart = save_deliver_localpart;
059ec3d9 2059
2f682e45 2060 if (!s)
059ec3d9
PH
2061 {
2062 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
2063 "\"%s\" in %s transport for callout: %s", tf.hosts,
08f3b11b 2064 tp->name, expand_string_message);
059ec3d9
PH
2065 }
2066 else
2067 {
322050c2 2068 int flags;
d8ef3577 2069 host_item *host, *nexthost;
059ec3d9
PH
2070 host_build_hostlist(&host_list, s, tf.hosts_randomize);
2071
2072 /* Just ignore failures to find a host address. If we don't manage
8e669ac1
PH
2073 to find any addresses, the callout will defer. Note that more than
2074 one address may be found for a single host, which will result in
2075 additional host items being inserted into the chain. Hence we must
d8ef3577 2076 save the next host first. */
059ec3d9 2077
322050c2
PH
2078 flags = HOST_FIND_BY_A;
2079 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
2080 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
2081
2f682e45 2082 for (host = host_list; host; host = nexthost)
059ec3d9 2083 {
d8ef3577 2084 nexthost = host->next;
8e669ac1 2085 if (tf.gethostbyname ||
7e66e54d 2086 string_is_ip_address(host->name, NULL) != 0)
55414b25 2087 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
059ec3d9 2088 else
9d9c3746 2089 {
7cd171b7 2090 dnssec_domains * dnssec_domains = NULL;
08f3b11b 2091 if (Ustrcmp(tp->driver_name, "smtp") == 0)
9d9c3746
JH
2092 {
2093 smtp_transport_options_block * ob =
08f3b11b 2094 (smtp_transport_options_block *) tp->options_block;
7cd171b7 2095 dnssec_domains = &ob->dnssec;
9d9c3746
JH
2096 }
2097
059ec3d9 2098 (void)host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
7cd171b7 2099 dnssec_domains, NULL, NULL);
9d9c3746 2100 }
059ec3d9
PH
2101 }
2102 }
2103 }
2104 }
2105
8e669ac1 2106 /* Can only do a callout if we have at least one host! If the callout
2c7db3f5 2107 fails, it will have set ${sender,recipient}_verify_failure. */
059ec3d9 2108
2f682e45 2109 if (host_list)
059ec3d9
PH
2110 {
2111 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
2112 if (host_checking && !host_checking_callout)
2113 {
2114 HDEBUG(D_verify)
2115 debug_printf("... callout omitted by default when host testing\n"
2116 "(Use -bhc if you want the callouts to happen.)\n");
2117 }
2118 else
2119 {
4ed8d31a
JH
2120#ifdef SUPPORT_TLS
2121 deliver_set_expansions(addr);
2122#endif
059ec3d9 2123 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
4deaf07d 2124 callout_connect, options, se_mailfrom, pm_mailfrom);
059ec3d9
PH
2125 }
2126 }
2127 else
2128 {
2129 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
2130 "transport provided a host list\n");
2131 }
2132 }
2133 }
8e669ac1 2134
2c7db3f5 2135 /* Otherwise, any failure is a routing failure */
8e669ac1
PH
2136
2137 else *failure_ptr = US"route";
059ec3d9
PH
2138
2139 /* A router may return REROUTED if it has set up a child address as a result
2140 of a change of domain name (typically from widening). In this case we always
2141 want to continue to verify the new child. */
2142
2143 if (rc == REROUTED) continue;
8e669ac1 2144
059ec3d9
PH
2145 /* Handle hard failures */
2146
2147 if (rc == FAIL)
2148 {
2149 allok = FALSE;
2f682e45 2150 if (f)
059ec3d9 2151 {
e6f6568e
PH
2152 address_item *p = addr->parent;
2153
ce552449 2154 respond_printf(f, "%s%s %s", ko_prefix,
2f682e45
JH
2155 full_info ? addr->address : address,
2156 address_test_mode ? "is undeliverable" : "failed to verify");
059ec3d9
PH
2157 if (!expn && admin_user)
2158 {
2159 if (addr->basic_errno > 0)
ce552449 2160 respond_printf(f, ": %s", strerror(addr->basic_errno));
2f682e45 2161 if (addr->message)
ce552449 2162 respond_printf(f, ": %s", addr->message);
e6f6568e
PH
2163 }
2164
2165 /* Show parents iff doing full info */
2166
2f682e45 2167 if (full_info) while (p)
e6f6568e 2168 {
ce552449 2169 respond_printf(f, "%s\n <-- %s", cr, p->address);
e6f6568e 2170 p = p->parent;
059ec3d9 2171 }
ce552449 2172 respond_printf(f, "%s\n", cr);
059ec3d9 2173 }
2e5b33cd 2174 cancel_cutthrough_connection("routing hard fail");
059ec3d9 2175
d9b2312b 2176 if (!full_info)
2f682e45 2177 {
d9b2312b
JH
2178 yield = copy_error(vaddr, addr, FAIL);
2179 goto out;
2f682e45
JH
2180 }
2181 yield = FAIL;
059ec3d9
PH
2182 }
2183
2184 /* Soft failure */
2185
2186 else if (rc == DEFER)
2187 {
2188 allok = FALSE;
2f682e45 2189 if (f)
059ec3d9 2190 {
e6f6568e 2191 address_item *p = addr->parent;
ce552449 2192 respond_printf(f, "%s%s cannot be resolved at this time", ko_prefix,
322050c2 2193 full_info? addr->address : address);
059ec3d9
PH
2194 if (!expn && admin_user)
2195 {
2196 if (addr->basic_errno > 0)
ce552449 2197 respond_printf(f, ": %s", strerror(addr->basic_errno));
2f682e45 2198 if (addr->message)
ce552449 2199 respond_printf(f, ": %s", addr->message);
059ec3d9 2200 else if (addr->basic_errno <= 0)
ce552449 2201 respond_printf(f, ": unknown error");
059ec3d9
PH
2202 }
2203
e6f6568e
PH
2204 /* Show parents iff doing full info */
2205
2f682e45 2206 if (full_info) while (p)
e6f6568e 2207 {
ce552449 2208 respond_printf(f, "%s\n <-- %s", cr, p->address);
e6f6568e
PH
2209 p = p->parent;
2210 }
ce552449 2211 respond_printf(f, "%s\n", cr);
059ec3d9 2212 }
2e5b33cd 2213 cancel_cutthrough_connection("routing soft fail");
e4bdf652 2214
d9b2312b
JH
2215 if (!full_info)
2216 {
2217 yield = copy_error(vaddr, addr, DEFER);
2218 goto out;
2219 }
2f682e45 2220 if (yield == OK) yield = DEFER;
059ec3d9
PH
2221 }
2222
2223 /* If we are handling EXPN, we do not want to continue to route beyond
e6f6568e 2224 the top level (whose address is in "address"). */
059ec3d9
PH
2225
2226 else if (expn)
2227 {
2228 uschar *ok_prefix = US"250-";
2f682e45
JH
2229
2230 if (!addr_new)
2231 if (!addr_local && !addr_remote)
ce552449 2232 respond_printf(f, "250 mail to <%s> is discarded\r\n", address);
059ec3d9 2233 else
ce552449 2234 respond_printf(f, "250 <%s>\r\n", address);
2f682e45
JH
2235
2236 else do
059ec3d9
PH
2237 {
2238 address_item *addr2 = addr_new;
2239 addr_new = addr2->next;
2f682e45 2240 if (!addr_new) ok_prefix = US"250 ";
ce552449 2241 respond_printf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
2f682e45 2242 } while (addr_new);
d9b2312b
JH
2243 yield = OK;
2244 goto out;
059ec3d9
PH
2245 }
2246
2247 /* Successful routing other than EXPN. */
2248
2249 else
2250 {
2251 /* Handle successful routing when short info wanted. Otherwise continue for
2252 other (generated) addresses. Short info is the operational case. Full info
2253 can be requested only when debug_selector != 0 and a file is supplied.
2254
2255 There is a conflict between the use of aliasing as an alternate email
2256 address, and as a sort of mailing list. If an alias turns the incoming
2257 address into just one address (e.g. J.Caesar->jc44) you may well want to
2258 carry on verifying the generated address to ensure it is valid when
2259 checking incoming mail. If aliasing generates multiple addresses, you
2260 probably don't want to do this. Exim therefore treats the generation of
2261 just a single new address as a special case, and continues on to verify the
2262 generated address. */
2263
2f682e45
JH
2264 if ( !full_info /* Stop if short info wanted AND */
2265 && ( ( !addr_new /* No new address OR */
2266 || addr_new->next /* More than one new address OR */
2267 || testflag(addr_new, af_pfr) /* New address is pfr */
2268 )
2269 || /* OR */
2270 ( addr_new /* At least one new address AND */
2271 && success_on_redirect /* success_on_redirect is set */
2272 ) )
2273 )
059ec3d9 2274 {
2f682e45
JH
2275 if (f) fprintf(f, "%s %s\n",
2276 address, address_test_mode ? "is deliverable" : "verified");
059ec3d9
PH
2277
2278 /* If we have carried on to verify a child address, we want the value
2279 of $address_data to be that of the child */
2280
d43cbe25 2281 vaddr->prop.address_data = addr->prop.address_data;
98c82a3d
JH
2282
2283 /* If stopped because more than one new address, cannot cutthrough */
2284
2285 if (addr_new && addr_new->next)
2286 cancel_cutthrough_connection("multiple addresses from routing");
2287
d9b2312b
JH
2288 yield = OK;
2289 goto out;
059ec3d9
PH
2290 }
2291 }
2292 } /* Loop for generated addresses */
2293
2294/* Display the full results of the successful routing, including any generated
2295addresses. Control gets here only when full_info is set, which requires f not
2296to be NULL, and this occurs only when a top-level verify is called with the
2297debugging switch on.
2298
2299If there are no local and no remote addresses, and there were no pipes, files,
2300or autoreplies, and there were no errors or deferments, the message is to be
2301discarded, usually because of the use of :blackhole: in an alias file. */
2302
2f682e45 2303if (allok && !addr_local && !addr_remote)
dbcef0ea 2304 {
059ec3d9 2305 fprintf(f, "mail to %s is discarded\n", address);
d9b2312b 2306 goto out;
dbcef0ea 2307 }
059ec3d9 2308
dbcef0ea 2309for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
08f3b11b 2310 while (addr_list)
059ec3d9
PH
2311 {
2312 address_item *addr = addr_list;
2313 address_item *p = addr->parent;
08f3b11b
JH
2314 transport_instance * tp = addr->transport;
2315
059ec3d9
PH
2316 addr_list = addr->next;
2317
2318 fprintf(f, "%s", CS addr->address);
384152a6 2319#ifdef EXPERIMENTAL_SRS
d43cbe25
JH
2320 if(addr->prop.srs_sender)
2321 fprintf(f, " [srs = %s]", addr->prop.srs_sender);
384152a6 2322#endif
dbcef0ea
PH
2323
2324 /* If the address is a duplicate, show something about it. */
2325
2326 if (!testflag(addr, af_pfr))
2327 {
2328 tree_node *tnode;
08f3b11b 2329 if ((tnode = tree_search(tree_duplicates, addr->unique)))
dbcef0ea
PH
2330 fprintf(f, " [duplicate, would not be delivered]");
2331 else tree_add_duplicate(addr->unique, addr);
2332 }
2333
2334 /* Now show its parents */
2335
08f3b11b 2336 for (p = addr->parent; p; p = p->parent)
059ec3d9 2337 fprintf(f, "\n <-- %s", p->address);
059ec3d9
PH
2338 fprintf(f, "\n ");
2339
2340 /* Show router, and transport */
2341
08f3b11b
JH
2342 fprintf(f, "router = %s, transport = %s\n",
2343 addr->router->name, tp ? tp->name : US"unset");
059ec3d9
PH
2344
2345 /* Show any hosts that are set up by a router unless the transport
2346 is going to override them; fiddle a bit to get a nice format. */
2347
08f3b11b 2348 if (addr->host_list && tp && !tp->overrides_hosts)
059ec3d9
PH
2349 {
2350 host_item *h;
2351 int maxlen = 0;
2352 int maxaddlen = 0;
08f3b11b
JH
2353 for (h = addr->host_list; h; h = h->next)
2354 { /* get max lengths of host names, addrs */
059ec3d9
PH
2355 int len = Ustrlen(h->name);
2356 if (len > maxlen) maxlen = len;
08f3b11b 2357 len = h->address ? Ustrlen(h->address) : 7;
059ec3d9
PH
2358 if (len > maxaddlen) maxaddlen = len;
2359 }
08f3b11b
JH
2360 for (h = addr->host_list; h; h = h->next)
2361 {
2362 fprintf(f, " host %-*s ", maxlen, h->name);
2363
2364 if (h->address)
2365 fprintf(f, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2366 else if (tp->info->local)
2367 fprintf(f, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2368 else
2369 fprintf(f, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2370
2371 if (h->mx >= 0) fprintf(f, " MX=%d", h->mx);
059ec3d9 2372 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
08f3b11b
JH
2373 if (running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", f);
2374 if (h->status == hstatus_unusable) fputs(" ** unusable **", f);
2375 fputc('\n', f);
059ec3d9
PH
2376 }
2377 }
2378 }
059ec3d9 2379
d9b2312b 2380/* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2c7db3f5
PH
2381the -bv or -bt case). */
2382
d9b2312b 2383out:
ea90b718 2384verify_mode = NULL;
35aba663 2385tls_modify_variables(&tls_in);
d9b2312b 2386
8e669ac1 2387return yield;
059ec3d9
PH
2388}
2389
2390
2391
2392
2393/*************************************************
2394* Check headers for syntax errors *
2395*************************************************/
2396
2397/* This function checks those header lines that contain addresses, and verifies
2398that all the addresses therein are syntactially correct.
2399
2400Arguments:
2401 msgptr where to put an error message
2402
2403Returns: OK
2404 FAIL
2405*/
2406
2407int
2408verify_check_headers(uschar **msgptr)
2409{
2410header_line *h;
2411uschar *colon, *s;
1eccaa59 2412int yield = OK;
059ec3d9 2413
1eccaa59 2414for (h = header_list; h != NULL && yield == OK; h = h->next)
059ec3d9
PH
2415 {
2416 if (h->type != htype_from &&
2417 h->type != htype_reply_to &&
2418 h->type != htype_sender &&
2419 h->type != htype_to &&
2420 h->type != htype_cc &&
2421 h->type != htype_bcc)
2422 continue;
2423
2424 colon = Ustrchr(h->text, ':');
2425 s = colon + 1;
2426 while (isspace(*s)) s++;
2427
1eccaa59
PH
2428 /* Loop for multiple addresses in the header, enabling group syntax. Note
2429 that we have to reset this after the header has been scanned. */
059ec3d9 2430
1eccaa59 2431 parse_allow_group = TRUE;
059ec3d9
PH
2432
2433 while (*s != 0)
2434 {
2435 uschar *ss = parse_find_address_end(s, FALSE);
2436 uschar *recipient, *errmess;
2437 int terminator = *ss;
2438 int start, end, domain;
2439
2440 /* Temporarily terminate the string at this point, and extract the
1eccaa59 2441 operative address within, allowing group syntax. */
059ec3d9
PH
2442
2443 *ss = 0;
2444 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2445 *ss = terminator;
2446
2447 /* Permit an unqualified address only if the message is local, or if the
2448 sending host is configured to be permitted to send them. */
2449
2450 if (recipient != NULL && domain == 0)
2451 {
2452 if (h->type == htype_from || h->type == htype_sender)
2453 {
2454 if (!allow_unqualified_sender) recipient = NULL;
2455 }
2456 else
2457 {
2458 if (!allow_unqualified_recipient) recipient = NULL;
2459 }
2460 if (recipient == NULL) errmess = US"unqualified address not permitted";
2461 }
2462
2463 /* It's an error if no address could be extracted, except for the special
2464 case of an empty address. */
2465
2466 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
2467 {
2468 uschar *verb = US"is";
2469 uschar *t = ss;
1ab95fa6 2470 uschar *tt = colon;
059ec3d9
PH
2471 int len;
2472
2473 /* Arrange not to include any white space at the end in the
1ab95fa6 2474 error message or the header name. */
059ec3d9
PH
2475
2476 while (t > s && isspace(t[-1])) t--;
1ab95fa6 2477 while (tt > h->text && isspace(tt[-1])) tt--;
059ec3d9 2478
1ab95fa6 2479 /* Add the address that failed to the error message, since in a
059ec3d9
PH
2480 header with very many addresses it is sometimes hard to spot
2481 which one is at fault. However, limit the amount of address to
2482 quote - cases have been seen where, for example, a missing double
2483 quote in a humungous To: header creates an "address" that is longer
2484 than string_sprintf can handle. */
2485
2486 len = t - s;
2487 if (len > 1024)
2488 {
2489 len = 1024;
2490 verb = US"begins";
2491 }
2492
55414b25
JH
2493 /* deconst cast ok as we're passing a non-const to string_printing() */
2494 *msgptr = US string_printing(
1ab95fa6
PH
2495 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2496 errmess, tt - h->text, h->text, verb, len, s));
059ec3d9 2497
1eccaa59
PH
2498 yield = FAIL;
2499 break; /* Out of address loop */
059ec3d9
PH
2500 }
2501
2502 /* Advance to the next address */
2503
2504 s = ss + (terminator? 1:0);
2505 while (isspace(*s)) s++;
2506 } /* Next address */
059ec3d9 2507
1eccaa59
PH
2508 parse_allow_group = FALSE;
2509 parse_found_group = FALSE;
2510 } /* Next header unless yield has been set FALSE */
2511
2512return yield;
059ec3d9
PH
2513}
2514
2515
770747fd
MFM
2516/*************************************************
2517* Check header names for 8-bit characters *
2518*************************************************/
2519
2520/* This function checks for invalid charcters in header names. See
2521RFC 5322, 2.2. and RFC 6532, 3.
2522
2523Arguments:
2524 msgptr where to put an error message
2525
2526Returns: OK
2527 FAIL
2528*/
2529
2530int
2531verify_check_header_names_ascii(uschar **msgptr)
2532{
2533header_line *h;
2534uschar *colon, *s;
2535
2536for (h = header_list; h != NULL; h = h->next)
2537 {
2538 colon = Ustrchr(h->text, ':');
2539 for(s = h->text; s < colon; s++)
2540 {
2541 if ((*s < 33) || (*s > 126))
2542 {
2543 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2544 colon - h->text, h->text);
2545 return FAIL;
2546 }
2547 }
2548 }
2549return OK;
2550}
059ec3d9 2551
1c41c9cc
PH
2552/*************************************************
2553* Check for blind recipients *
2554*************************************************/
2555
2556/* This function checks that every (envelope) recipient is mentioned in either
2557the To: or Cc: header lines, thus detecting blind carbon copies.
2558
2559There are two ways of scanning that could be used: either scan the header lines
2560and tick off the recipients, or scan the recipients and check the header lines.
2561The original proposed patch did the former, but I have chosen to do the latter,
2562because (a) it requires no memory and (b) will use fewer resources when there
2563are many addresses in To: and/or Cc: and only one or two envelope recipients.
2564
2565Arguments: none
2566Returns: OK if there are no blind recipients
2567 FAIL if there is at least one blind recipient
2568*/
2569
2570int
2571verify_check_notblind(void)
2572{
2573int i;
2574for (i = 0; i < recipients_count; i++)
2575 {
2576 header_line *h;
2577 BOOL found = FALSE;
2578 uschar *address = recipients_list[i].address;
2579
2580 for (h = header_list; !found && h != NULL; h = h->next)
2581 {
2582 uschar *colon, *s;
2583
2584 if (h->type != htype_to && h->type != htype_cc) continue;
2585
2586 colon = Ustrchr(h->text, ':');
2587 s = colon + 1;
2588 while (isspace(*s)) s++;
2589
1eccaa59
PH
2590 /* Loop for multiple addresses in the header, enabling group syntax. Note
2591 that we have to reset this after the header has been scanned. */
1c41c9cc 2592
1eccaa59 2593 parse_allow_group = TRUE;
1c41c9cc
PH
2594
2595 while (*s != 0)
2596 {
2597 uschar *ss = parse_find_address_end(s, FALSE);
2598 uschar *recipient,*errmess;
2599 int terminator = *ss;
2600 int start, end, domain;
2601
2602 /* Temporarily terminate the string at this point, and extract the
1eccaa59 2603 operative address within, allowing group syntax. */
1c41c9cc
PH
2604
2605 *ss = 0;
2606 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2607 *ss = terminator;
2608
2609 /* If we found a valid recipient that has a domain, compare it with the
2610 envelope recipient. Local parts are compared case-sensitively, domains
2611 case-insensitively. By comparing from the start with length "domain", we
2612 include the "@" at the end, which ensures that we are comparing the whole
2613 local part of each address. */
2614
2615 if (recipient != NULL && domain != 0)
2616 {
2617 found = Ustrncmp(recipient, address, domain) == 0 &&
2618 strcmpic(recipient + domain, address + domain) == 0;
2619 if (found) break;
2620 }
2621
2622 /* Advance to the next address */
2623
2624 s = ss + (terminator? 1:0);
2625 while (isspace(*s)) s++;
2626 } /* Next address */
1eccaa59
PH
2627
2628 parse_allow_group = FALSE;
2629 parse_found_group = FALSE;
1c41c9cc
PH
2630 } /* Next header (if found is false) */
2631
2632 if (!found) return FAIL;
2633 } /* Next recipient */
2634
2635return OK;
2636}
2637
2638
059ec3d9
PH
2639
2640/*************************************************
2641* Find if verified sender *
2642*************************************************/
2643
2644/* Usually, just a single address is verified as the sender of the message.
2645However, Exim can be made to verify other addresses as well (often related in
2646some way), and this is useful in some environments. There may therefore be a
2647chain of such addresses that have previously been tested. This function finds
2648whether a given address is on the chain.
2649
2650Arguments: the address to be verified
2651Returns: pointer to an address item, or NULL
2652*/
2653
2654address_item *
2655verify_checked_sender(uschar *sender)
2656{
2657address_item *addr;
2658for (addr = sender_verified_list; addr != NULL; addr = addr->next)
2659 if (Ustrcmp(sender, addr->address) == 0) break;
2660return addr;
2661}
2662
2663
2664
2665
2666
2667/*************************************************
2668* Get valid header address *
2669*************************************************/
2670
2671/* Scan the originator headers of the message, looking for an address that
2672verifies successfully. RFC 822 says:
2673
2674 o The "Sender" field mailbox should be sent notices of
2675 any problems in transport or delivery of the original
2676 messages. If there is no "Sender" field, then the
2677 "From" field mailbox should be used.
2678
2679 o If the "Reply-To" field exists, then the reply should
2680 go to the addresses indicated in that field and not to
2681 the address(es) indicated in the "From" field.
2682
2683So we check a Sender field if there is one, else a Reply_to field, else a From
2684field. As some strange messages may have more than one of these fields,
2685especially if they are resent- fields, check all of them if there is more than
2686one.
2687
2688Arguments:
2689 user_msgptr points to where to put a user error message
2690 log_msgptr points to where to put a log error message
2691 callout timeout for callout check (passed to verify_address())
2692 callout_overall overall callout timeout (ditto)
8e669ac1 2693 callout_connect connect callout timeout (ditto)
059ec3d9
PH
2694 se_mailfrom mailfrom for verify; NULL => ""
2695 pm_mailfrom sender for pm callout check (passed to verify_address())
2696 options callout options (passed to verify_address())
8e669ac1 2697 verrno where to put the address basic_errno
059ec3d9
PH
2698
2699If log_msgptr is set to something without setting user_msgptr, the caller
2700normally uses log_msgptr for both things.
2701
2702Returns: result of the verification attempt: OK, FAIL, or DEFER;
2703 FAIL is given if no appropriate headers are found
2704*/
2705
2706int
2707verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
8e669ac1 2708 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
fe5b5d0b 2709 uschar *pm_mailfrom, int options, int *verrno)
059ec3d9
PH
2710{
2711static int header_types[] = { htype_sender, htype_reply_to, htype_from };
1eccaa59 2712BOOL done = FALSE;
059ec3d9
PH
2713int yield = FAIL;
2714int i;
2715
1eccaa59 2716for (i = 0; i < 3 && !done; i++)
059ec3d9
PH
2717 {
2718 header_line *h;
1eccaa59 2719 for (h = header_list; h != NULL && !done; h = h->next)
059ec3d9
PH
2720 {
2721 int terminator, new_ok;
2722 uschar *s, *ss, *endname;
2723
2724 if (h->type != header_types[i]) continue;
2725 s = endname = Ustrchr(h->text, ':') + 1;
2726
1eccaa59
PH
2727 /* Scan the addresses in the header, enabling group syntax. Note that we
2728 have to reset this after the header has been scanned. */
2729
2730 parse_allow_group = TRUE;
2731
059ec3d9
PH
2732 while (*s != 0)
2733 {
2734 address_item *vaddr;
2735
2736 while (isspace(*s) || *s == ',') s++;
2737 if (*s == 0) break; /* End of header */
2738
2739 ss = parse_find_address_end(s, FALSE);
2740
2741 /* The terminator is a comma or end of header, but there may be white
2742 space preceding it (including newline for the last address). Move back
2743 past any white space so we can check against any cached envelope sender
2744 address verifications. */
2745
2746 while (isspace(ss[-1])) ss--;
2747 terminator = *ss;
2748 *ss = 0;
2749
2750 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2751 (int)(endname - h->text), h->text, s);
2752
2753 /* See if we have already verified this address as an envelope sender,
2754 and if so, use the previous answer. */
2755
2756 vaddr = verify_checked_sender(s);
2757
2758 if (vaddr != NULL && /* Previously checked */
2759 (callout <= 0 || /* No callout needed; OR */
2760 vaddr->special_action > 256)) /* Callout was done */
2761 {
2762 new_ok = vaddr->special_action & 255;
2763 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2764 *ss = terminator; /* Restore shortened string */
2765 }
2766
2767 /* Otherwise we run the verification now. We must restore the shortened
2768 string before running the verification, so the headers are correct, in
2769 case there is any rewriting. */
2770
2771 else
2772 {
2773 int start, end, domain;
1eccaa59
PH
2774 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2775 &domain, FALSE);
059ec3d9
PH
2776
2777 *ss = terminator;
2778
1eccaa59
PH
2779 /* If we found an empty address, just carry on with the next one, but
2780 kill the message. */
2781
2782 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2783 {
2784 *log_msgptr = NULL;
2785 s = ss;
2786 continue;
2787 }
2788
059ec3d9
PH
2789 /* If verification failed because of a syntax error, fail this
2790 function, and ensure that the failing address gets added to the error
2791 message. */
2792
2793 if (address == NULL)
2794 {
2795 new_ok = FAIL;
1eccaa59
PH
2796 while (ss > s && isspace(ss[-1])) ss--;
2797 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2798 "scanning for sender: %s in \"%.*s\"",
2799 endname - h->text, h->text, *log_msgptr, ss - s, s);
2800 yield = FAIL;
2801 done = TRUE;
2802 break;
059ec3d9
PH
2803 }
2804
2f6603e1 2805 /* Else go ahead with the sender verification. But it isn't *the*
059ec3d9
PH
2806 sender of the message, so set vopt_fake_sender to stop sender_address
2807 being replaced after rewriting or qualification. */
2808
2809 else
2810 {
2811 vaddr = deliver_make_addr(address, FALSE);
2812 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
8e669ac1 2813 callout, callout_overall, callout_connect, se_mailfrom,
4deaf07d 2814 pm_mailfrom, NULL);
059ec3d9
PH
2815 }
2816 }
2817
2818 /* We now have the result, either newly found, or cached. If we are
2819 giving out error details, set a specific user error. This means that the
2820 last of these will be returned to the user if all three fail. We do not
2821 set a log message - the generic one below will be used. */
2822
fe5b5d0b 2823 if (new_ok != OK)
059ec3d9 2824 {
8e669ac1 2825 *verrno = vaddr->basic_errno;
fe5b5d0b
PH
2826 if (smtp_return_error_details)
2827 {
2828 *user_msgptr = string_sprintf("Rejected after DATA: "
2829 "could not verify \"%.*s\" header address\n%s: %s",
2830 endname - h->text, h->text, vaddr->address, vaddr->message);
2831 }
8e669ac1 2832 }
059ec3d9
PH
2833
2834 /* Success or defer */
2835
1eccaa59
PH
2836 if (new_ok == OK)
2837 {
2838 yield = OK;
2839 done = TRUE;
2840 break;
2841 }
2842
059ec3d9
PH
2843 if (new_ok == DEFER) yield = DEFER;
2844
2845 /* Move on to any more addresses in the header */
2846
2847 s = ss;
1eccaa59
PH
2848 } /* Next address */
2849
2850 parse_allow_group = FALSE;
2851 parse_found_group = FALSE;
2852 } /* Next header, unless done */
2853 } /* Next header type unless done */
059ec3d9
PH
2854
2855if (yield == FAIL && *log_msgptr == NULL)
2856 *log_msgptr = US"there is no valid sender in any header line";
2857
2858if (yield == DEFER && *log_msgptr == NULL)
2859 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2860
2861return yield;
2862}
2863
2864
2865
2866
2867/*************************************************
2868* Get RFC 1413 identification *
2869*************************************************/
2870
2871/* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2872the timeout is set to zero, then the query is not done. There may also be lists
2873of hosts and nets which are exempt. To guard against malefactors sending
2874non-printing characters which could, for example, disrupt a message's headers,
2875make sure the string consists of printing characters only.
2876
2877Argument:
2878 port the port to connect to; usually this is IDENT_PORT (113), but when
2879 running in the test harness with -bh a different value is used.
2880
2881Returns: nothing
2882
2883Side effect: any received ident value is put in sender_ident (NULL otherwise)
2884*/
2885
2886void
2887verify_get_ident(int port)
2888{
2889int sock, host_af, qlen;
2890int received_sender_port, received_interface_port, n;
2891uschar *p;
2892uschar buffer[2048];
2893
2894/* Default is no ident. Check whether we want to do an ident check for this
2895host. */
2896
2897sender_ident = NULL;
2898if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2899 return;
2900
2901DEBUG(D_ident) debug_printf("doing ident callback\n");
2902
2903/* Set up a connection to the ident port of the remote host. Bind the local end
2904to the incoming interface address. If the sender host address is an IPv6
2905address, the incoming interface address will also be IPv6. */
2906
2907host_af = (Ustrchr(sender_host_address, ':') == NULL)? AF_INET : AF_INET6;
2908sock = ip_socket(SOCK_STREAM, host_af);
2909if (sock < 0) return;
2910
2911if (ip_bind(sock, host_af, interface_address, 0) < 0)
2912 {
2913 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2914 strerror(errno));
2915 goto END_OFF;
2916 }
2917
2918if (ip_connect(sock, host_af, sender_host_address, port, rfc1413_query_timeout)
2919 < 0)
2920 {
6c6d6e48 2921 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
059ec3d9
PH
2922 {
2923 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2924 sender_host_address);
2925 }
2926 else
2927 {
2928 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2929 sender_host_address, strerror(errno));
2930 }
2931 goto END_OFF;
2932 }
2933
2934/* Construct and send the query. */
2935
2936sprintf(CS buffer, "%d , %d\r\n", sender_host_port, interface_port);
2937qlen = Ustrlen(buffer);
2938if (send(sock, buffer, qlen, 0) < 0)
2939 {
2940 DEBUG(D_ident) debug_printf("ident send failed: %s\n", strerror(errno));
2941 goto END_OFF;
2942 }
2943
2944/* Read a response line. We put it into the rest of the buffer, using several
2945recv() calls if necessary. */
2946
2947p = buffer + qlen;
2948
2949for (;;)
2950 {
2951 uschar *pp;
2952 int count;
2953 int size = sizeof(buffer) - (p - buffer);
2954
2955 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2956 count = ip_recv(sock, p, size, rfc1413_query_timeout);
2957 if (count <= 0) goto END_OFF; /* Read error or EOF */
2958
2959 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2960 generous, and accept a plain \n terminator as well. The only illegal
2961 character is 0. */
2962
2963 for (pp = p; pp < p + count; pp++)
2964 {
2965 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2966 if (*pp == '\n')
2967 {
2968 if (pp[-1] == '\r') pp--;
2969 *pp = 0;
2970 goto GOT_DATA; /* Break out of both loops */
2971 }
2972 }
2973
2974 /* Reached the end of the data without finding \n. Let the loop continue to
2975 read some more, if there is room. */
2976
2977 p = pp;
2978 }
2979
2980GOT_DATA:
2981
2982/* We have received a line of data. Check it carefully. It must start with the
2983same two port numbers that we sent, followed by data as defined by the RFC. For
2984example,
2985
2986 12345 , 25 : USERID : UNIX :root
2987
2988However, the amount of white space may be different to what we sent. In the
2989"osname" field there may be several sub-fields, comma separated. The data we
2990actually want to save follows the third colon. Some systems put leading spaces
2991in it - we discard those. */
2992
2993if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2994 &received_interface_port, &n) != 2 ||
2995 received_sender_port != sender_host_port ||
2996 received_interface_port != interface_port)
2997 goto END_OFF;
2998
2999p = buffer + qlen + n;
3000while(isspace(*p)) p++;
3001if (*p++ != ':') goto END_OFF;
3002while(isspace(*p)) p++;
3003if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
3004p += 6;
3005while(isspace(*p)) p++;
3006if (*p++ != ':') goto END_OFF;
3007while (*p != 0 && *p != ':') p++;
3008if (*p++ == 0) goto END_OFF;
3009while(isspace(*p)) p++;
3010if (*p == 0) goto END_OFF;
3011
3012/* The rest of the line is the data we want. We turn it into printing
3013characters when we save it, so that it cannot mess up the format of any logging
3014or Received: lines into which it gets inserted. We keep a maximum of 127
55414b25 3015characters. The deconst cast is ok as we fed a nonconst to string_printing() */
059ec3d9 3016
55414b25 3017sender_ident = US string_printing(string_copyn(p, 127));
059ec3d9
PH
3018DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
3019
3020END_OFF:
f1e894f3 3021(void)close(sock);
059ec3d9
PH
3022return;
3023}
3024
3025
3026
3027
3028/*************************************************
3029* Match host to a single host-list item *
3030*************************************************/
3031
3032/* This function compares a host (name or address) against a single item
3033from a host list. The host name gets looked up if it is needed and is not
3034already known. The function is called from verify_check_this_host() via
3035match_check_list(), which is why most of its arguments are in a single block.
3036
3037Arguments:
3038 arg the argument block (see below)
3039 ss the host-list item
3040 valueptr where to pass back looked up data, or NULL
3041 error for error message when returning ERROR
3042
3043The block contains:
32d668a5
PH
3044 host_name (a) the host name, or
3045 (b) NULL, implying use sender_host_name and
3046 sender_host_aliases, looking them up if required, or
3047 (c) the empty string, meaning that only IP address matches
3048 are permitted
059ec3d9
PH
3049 host_address the host address
3050 host_ipv4 the IPv4 address taken from an IPv6 one
3051
3052Returns: OK matched
3053 FAIL did not match
3054 DEFER lookup deferred
32d668a5
PH
3055 ERROR (a) failed to find the host name or IP address, or
3056 (b) unknown lookup type specified, or
3057 (c) host name encountered when only IP addresses are
3058 being matched
059ec3d9
PH
3059*/
3060
32d668a5 3061int
55414b25 3062check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
059ec3d9
PH
3063{
3064check_host_block *cb = (check_host_block *)arg;
32d668a5 3065int mlen = -1;
059ec3d9 3066int maskoffset;
32d668a5 3067BOOL iplookup = FALSE;
059ec3d9 3068BOOL isquery = FALSE;
32d668a5 3069BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
55414b25 3070const uschar *t;
32d668a5 3071uschar *semicolon;
059ec3d9
PH
3072uschar **aliases;
3073
3074/* Optimize for the special case when the pattern is "*". */
3075
3076if (*ss == '*' && ss[1] == 0) return OK;
3077
3078/* If the pattern is empty, it matches only in the case when there is no host -
3079this can occur in ACL checking for SMTP input using the -bs option. In this
3080situation, the host address is the empty string. */
3081
3082if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
3083if (*ss == 0) return FAIL;
3084
32d668a5
PH
3085/* If the pattern is precisely "@" then match against the primary host name,
3086provided that host name matching is permitted; if it's "@[]" match against the
3087local host's IP addresses. */
059ec3d9
PH
3088
3089if (*ss == '@')
3090 {
32d668a5
PH
3091 if (ss[1] == 0)
3092 {
3093 if (isiponly) return ERROR;
3094 ss = primary_hostname;
3095 }
059ec3d9
PH
3096 else if (Ustrcmp(ss, "@[]") == 0)
3097 {
3098 ip_address_item *ip;
3099 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
3100 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
3101 return FAIL;
3102 }
3103 }
3104
3105/* If the pattern is an IP address, optionally followed by a bitmask count, do
3106a (possibly masked) comparision with the current IP address. */
3107
7e66e54d 3108if (string_is_ip_address(ss, &maskoffset) != 0)
059ec3d9
PH
3109 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
3110
1688f43b
PH
3111/* The pattern is not an IP address. A common error that people make is to omit
3112one component of an IPv4 address, either by accident, or believing that, for
3113example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
3114which it isn't. (Those applications that do accept 1.2.3 as an IP address
3115interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
3116ancient specification.) To aid in debugging these cases, we give a specific
3117error if the pattern contains only digits and dots or contains a slash preceded
3118only by digits and dots (a slash at the start indicates a file name and of
3119course slashes may be present in lookups, but not preceded only by digits and
3120dots). */
3121
3122for (t = ss; isdigit(*t) || *t == '.'; t++);
3123if (*t == 0 || (*t == '/' && t != ss))
3124 {
3125 *error = US"malformed IPv4 address or address mask";
3126 return ERROR;
3127 }
3128
32d668a5 3129/* See if there is a semicolon in the pattern */
059ec3d9 3130
32d668a5
PH
3131semicolon = Ustrchr(ss, ';');
3132
3133/* If we are doing an IP address only match, then all lookups must be IP
df199fec 3134address lookups, even if there is no "net-". */
32d668a5
PH
3135
3136if (isiponly)
059ec3d9 3137 {
32d668a5
PH
3138 iplookup = semicolon != NULL;
3139 }
059ec3d9 3140
32d668a5 3141/* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
df199fec
PH
3142a lookup on a masked IP network, in textual form. We obey this code even if we
3143have already set iplookup, so as to skip over the "net-" prefix and to set the
3144mask length. The net- stuff really only applies to single-key lookups where the
3145key is implicit. For query-style lookups the key is specified in the query.
3146From release 4.30, the use of net- for query style is no longer needed, but we
3147retain it for backward compatibility. */
3148
3149if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
32d668a5
PH
3150 {
3151 mlen = 0;
3152 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
3153 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
3154 iplookup = (*t++ == '-');
3155 }
1688f43b 3156else t = ss;
059ec3d9 3157
32d668a5 3158/* Do the IP address lookup if that is indeed what we have */
059ec3d9 3159
32d668a5
PH
3160if (iplookup)
3161 {
3162 int insize;
3163 int search_type;
3164 int incoming[4];
3165 void *handle;
3166 uschar *filename, *key, *result;
3167 uschar buffer[64];
059ec3d9 3168
32d668a5 3169 /* Find the search type */
059ec3d9 3170
32d668a5 3171 search_type = search_findtype(t, semicolon - t);
059ec3d9 3172
32d668a5
PH
3173 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3174 search_error_message);
059ec3d9 3175
13b685f9
PH
3176 /* Adjust parameters for the type of lookup. For a query-style lookup, there
3177 is no file name, and the "key" is just the query. For query-style with a file
3178 name, we have to fish the file off the start of the query. For a single-key
3179 lookup, the key is the current IP address, masked appropriately, and
3180 reconverted to text form, with the mask appended. For IPv6 addresses, specify
6a3bceb1
PH
3181 dot separators instead of colons, except when the lookup type is "iplsearch".
3182 */
059ec3d9 3183
13b685f9
PH
3184 if (mac_islookup(search_type, lookup_absfilequery))
3185 {
3186 filename = semicolon + 1;
3187 key = filename;
3188 while (*key != 0 && !isspace(*key)) key++;
3189 filename = string_copyn(filename, key - filename);
3190 while (isspace(*key)) key++;
3191 }
3192 else if (mac_islookup(search_type, lookup_querystyle))
32d668a5
PH
3193 {
3194 filename = NULL;
3195 key = semicolon + 1;
3196 }
6a3bceb1 3197 else /* Single-key style */
32d668a5 3198 {
e6d225ae 3199 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
6a3bceb1 3200 ':' : '.';
32d668a5
PH
3201 insize = host_aton(cb->host_address, incoming);
3202 host_mask(insize, incoming, mlen);
6a3bceb1 3203 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
32d668a5
PH
3204 key = buffer;
3205 filename = semicolon + 1;
059ec3d9 3206 }
32d668a5
PH
3207
3208 /* Now do the actual lookup; note that there is no search_close() because
3209 of the caching arrangements. */
3210
d4ff61d1
JH
3211 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3212 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3213
32d668a5
PH
3214 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
3215 if (valueptr != NULL) *valueptr = result;
3216 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
059ec3d9
PH
3217 }
3218
3219/* The pattern is not an IP address or network reference of any kind. That is,
32d668a5
PH
3220it is a host name pattern. If this is an IP only match, there's an error in the
3221host list. */
3222
3223if (isiponly)
3224 {
3225 *error = US"cannot match host name in match_ip list";
3226 return ERROR;
3227 }
3228
3229/* Check the characters of the pattern to see if they comprise only letters,
3230digits, full stops, and hyphens (the constituents of domain names). Allow
3231underscores, as they are all too commonly found. Sigh. Also, if
3232allow_utf8_domains is set, allow top-bit characters. */
059ec3d9
PH
3233
3234for (t = ss; *t != 0; t++)
3235 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3236 (!allow_utf8_domains || *t < 128)) break;
3237
3238/* If the pattern is a complete domain name, with no fancy characters, look up
3239its IP address and match against that. Note that a multi-homed host will add
3240items to the chain. */
3241
3242if (*t == 0)
3243 {
3244 int rc;
3245 host_item h;
3246 h.next = NULL;
3247 h.name = ss;
3248 h.address = NULL;
3249 h.mx = MX_NONE;
9b8fadde 3250
1f155f8e
JH
3251 /* Using byname rather than bydns here means we cannot determine dnssec
3252 status. On the other hand it is unclear how that could be either
3253 propagated up or enforced. */
3254
322050c2 3255 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
059ec3d9
PH
3256 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3257 {
3258 host_item *hh;
3259 for (hh = &h; hh != NULL; hh = hh->next)
3260 {
96776534 3261 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
059ec3d9
PH
3262 }
3263 return FAIL;
3264 }
3265 if (rc == HOST_FIND_AGAIN) return DEFER;
3266 *error = string_sprintf("failed to find IP address for %s", ss);
3267 return ERROR;
3268 }
3269
3270/* Almost all subsequent comparisons require the host name, and can be done
3271using the general string matching function. When this function is called for
3272outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3273must use sender_host_name and its aliases, looking them up if necessary. */
3274
3275if (cb->host_name != NULL) /* Explicit host name given */
3276 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3277 valueptr);
3278
3279/* Host name not given; in principle we need the sender host name and its
3280aliases. However, for query-style lookups, we do not need the name if the
3281query does not contain $sender_host_name. From release 4.23, a reference to
3282$sender_host_name causes it to be looked up, so we don't need to do the lookup
3283on spec. */
3284
3285if ((semicolon = Ustrchr(ss, ';')) != NULL)
3286 {
55414b25 3287 const uschar *affix;
059ec3d9
PH
3288 int partial, affixlen, starflags, id;
3289
3290 *semicolon = 0;
3291 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
3292 *semicolon=';';
3293
3294 if (id < 0) /* Unknown lookup type */
3295 {
3296 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3297 search_error_message, ss);
3298 return DEFER;
3299 }
13b685f9 3300 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
059ec3d9
PH
3301 }
3302
3303if (isquery)
3304 {
3305 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3306 {
3307 case OK: return OK;
3308 case DEFER: return DEFER;
3309 default: return FAIL;
3310 }
3311 }
3312
3313/* Not a query-style lookup; must ensure the host name is present, and then we
3314do a check on the name and all its aliases. */
3315
3316if (sender_host_name == NULL)
3317 {
3318 HDEBUG(D_host_lookup)
3319 debug_printf("sender host name required, to match against %s\n", ss);
3320 if (host_lookup_failed || host_name_lookup() != OK)
3321 {
3322 *error = string_sprintf("failed to find host name for %s",
3323 sender_host_address);;
3324 return ERROR;
3325 }
3326 host_build_sender_fullhost();
3327 }
3328
3329/* Match on the sender host name, using the general matching function */
3330
3331switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
3332 valueptr))
3333 {
3334 case OK: return OK;
3335 case DEFER: return DEFER;
3336 }
3337
3338/* If there are aliases, try matching on them. */
3339
3340aliases = sender_host_aliases;
3341while (*aliases != NULL)
3342 {
3343 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3344 {
3345 case OK: return OK;
3346 case DEFER: return DEFER;
3347 }
3348 }
3349return FAIL;
3350}
3351
3352
3353
3354
3355/*************************************************
3356* Check a specific host matches a host list *
3357*************************************************/
3358
3359/* This function is passed a host list containing items in a number of
3360different formats and the identity of a host. Its job is to determine whether
3361the given host is in the set of hosts defined by the list. The host name is
3362passed as a pointer so that it can be looked up if needed and not already
3363known. This is commonly the case when called from verify_check_host() to check
3364an incoming connection. When called from elsewhere the host name should usually
3365be set.
3366
3367This function is now just a front end to match_check_list(), which runs common
3368code for scanning a list. We pass it the check_host() function to perform a
3369single test.
3370
3371Arguments:
3372 listptr pointer to the host list
3373 cache_bits pointer to cache for named lists, or NULL
3374 host_name the host name or NULL, implying use sender_host_name and
3375 sender_host_aliases, looking them up if required
3376 host_address the IP address
3377 valueptr if not NULL, data from a lookup is passed back here
3378
3379Returns: OK if the host is in the defined set
3380 FAIL if the host is not in the defined set,
3381 DEFER if a data lookup deferred (not a host lookup)
3382
3383If the host name was needed in order to make a comparison, and could not be
3384determined from the IP address, the result is FAIL unless the item
3385"+allow_unknown" was met earlier in the list, in which case OK is returned. */
3386
3387int
55414b25
JH
3388verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3389 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
059ec3d9 3390{
d4eb88df 3391int rc;
059ec3d9 3392unsigned int *local_cache_bits = cache_bits;
55414b25 3393const uschar *save_host_address = deliver_host_address;
059ec3d9
PH
3394check_host_block cb;
3395cb.host_name = host_name;
3396cb.host_address = host_address;
3397
3398if (valueptr != NULL) *valueptr = NULL;
3399
3400/* If the host address starts off ::ffff: it is an IPv6 address in
3401IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3402addresses. */
3403
3404cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
3405 host_address + 7 : host_address;
3406
8e669ac1
PH
3407/* During the running of the check, put the IP address into $host_address. In
3408the case of calls from the smtp transport, it will already be there. However,
3409in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
d4eb88df
PH
3410the safe side, any existing setting is preserved, though as I write this
3411(November 2004) I can't see any cases where it is actually needed. */
3412
3413deliver_host_address = host_address;
3414rc = match_check_list(
3415 listptr, /* the list */
3416 0, /* separator character */
3417 &hostlist_anchor, /* anchor pointer */
3418 &local_cache_bits, /* cache pointer */
3419 check_host, /* function for testing */
3420 &cb, /* argument for function */
3421 MCL_HOST, /* type of check */
8e669ac1 3422 (host_address == sender_host_address)?
d4eb88df
PH
3423 US"host" : host_address, /* text for debugging */
3424 valueptr); /* where to pass back data */
3425deliver_host_address = save_host_address;
8e669ac1 3426return rc;
059ec3d9
PH
3427}
3428
3429
3430
3431
3432/*************************************************
5130845b
JH
3433* Check the given host item matches a list *
3434*************************************************/
3435int
3436verify_check_given_host(uschar **listptr, host_item *host)
3437{
55414b25 3438return verify_check_this_host(CUSS listptr, NULL, host->name, host->address, NULL);
5130845b
JH
3439}
3440
3441/*************************************************
059ec3d9
PH
3442* Check the remote host matches a list *
3443*************************************************/
3444
3445/* This is a front end to verify_check_this_host(), created because checking
3446the remote host is a common occurrence. With luck, a good compiler will spot
3447the tail recursion and optimize it. If there's no host address, this is
3448command-line SMTP input - check against an empty string for the address.
3449
3450Arguments:
3451 listptr pointer to the host list
3452
3453Returns: the yield of verify_check_this_host(),
3454 i.e. OK, FAIL, or DEFER
3455*/
3456
3457int
3458verify_check_host(uschar **listptr)
3459{
55414b25 3460return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
059ec3d9
PH
3461 (sender_host_address == NULL)? US"" : sender_host_address, NULL);
3462}
3463
3464
3465
3466
3467
3468/*************************************************
83e029d5 3469* Invert an IP address *
059ec3d9
PH
3470*************************************************/
3471
83e029d5
PP
3472/* Originally just used for DNS xBL lists, now also used for the
3473reverse_ip expansion operator.
3474
059ec3d9
PH
3475Arguments:
3476 buffer where to put the answer
3477 address the address to invert
3478*/
3479
83e029d5 3480void
059ec3d9
PH
3481invert_address(uschar *buffer, uschar *address)
3482{
3483int bin[4];
3484uschar *bptr = buffer;
3485
3486/* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3487to the IPv4 part only. */
3488
3489if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3490
3491/* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3492always 1. */
3493
3494if (host_aton(address, bin) == 1)
3495 {
3496 int i;
3497 int x = bin[0];
3498 for (i = 0; i < 4; i++)
3499 {
3500 sprintf(CS bptr, "%d.", x & 255);
3501 while (*bptr) bptr++;
3502 x >>= 8;
3503 }
3504 }
3505
3506/* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3507in any DNS black lists, and the format in which they will be looked up is
3508unknown. This is just a guess. */
3509
3510#if HAVE_IPV6
3511else
3512 {
3513 int i, j;
3514 for (j = 3; j >= 0; j--)
3515 {
3516 int x = bin[j];
3517 for (i = 0; i < 8; i++)
3518 {
3519 sprintf(CS bptr, "%x.", x & 15);
3520 while (*bptr) bptr++;
3521 x >>= 4;
3522 }
3523 }
3524 }
3525#endif
d6f6e0dc
PH
3526
3527/* Remove trailing period -- this is needed so that both arbitrary
3528dnsbl keydomains and inverted addresses may be combined with the
3529same format string, "%s.%s" */
3530
3531*(--bptr) = 0;
059ec3d9
PH