Revert "Show the DNSSEC status (ad=) always in -bt/-bv output"
[exim.git] / src / src / verify.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions concerned with verifying things. The original code for callout
9caching was contributed by Kevin Fleming (but I hacked it around a bit). */
10
11
12#include "exim.h"
817d9f57 13#include "transports/smtp.h"
059ec3d9 14
e4bdf652
JH
15#define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16#define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
817d9f57
JH
17static smtp_outblock ctblock;
18uschar ctbuffer[8192];
19
059ec3d9
PH
20
21/* Structure for caching DNSBL lookups */
22
23typedef struct dnsbl_cache_block {
24 dns_address *rhs;
25 uschar *text;
26 int rc;
27 BOOL text_set;
28} dnsbl_cache_block;
29
30
31/* Anchor for DNSBL cache */
32
33static tree_node *dnsbl_cache = NULL;
34
35
431b7361
PH
36/* Bits for match_type in one_check_dnsbl() */
37
38#define MT_NOT 1
39#define MT_ALL 2
40
5032d1cf 41static uschar cutthrough_response(char, uschar **);
431b7361 42
059ec3d9
PH
43
44/*************************************************
45* Retrieve a callout cache record *
46*************************************************/
47
48/* If a record exists, check whether it has expired.
49
50Arguments:
51 dbm_file an open hints file
52 key the record key
53 type "address" or "domain"
54 positive_expire expire time for positive records
55 negative_expire expire time for negative records
56
57Returns: the cache record if a non-expired one exists, else NULL
58*/
59
60static dbdata_callout_cache *
55414b25 61get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
059ec3d9
PH
62 int positive_expire, int negative_expire)
63{
64BOOL negative;
65int length, expire;
66time_t now;
67dbdata_callout_cache *cache_record;
68
69cache_record = dbfn_read_with_length(dbm_file, key, &length);
70
71if (cache_record == NULL)
72 {
6f4d5ad3 73 HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
059ec3d9
PH
74 return NULL;
75 }
76
77/* We treat a record as "negative" if its result field is not positive, or if
78it is a domain record and the postmaster field is negative. */
79
80negative = cache_record->result != ccache_accept ||
81 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
82expire = negative? negative_expire : positive_expire;
83now = time(NULL);
84
85if (now - cache_record->time_stamp > expire)
86 {
6f4d5ad3 87 HDEBUG(D_verify) debug_printf("callout cache: %s record expired for %s\n", type, key);
059ec3d9
PH
88 return NULL;
89 }
90
91/* If this is a non-reject domain record, check for the obsolete format version
92that doesn't have the postmaster and random timestamps, by looking at the
93length. If so, copy it to a new-style block, replicating the record's
94timestamp. Then check the additional timestamps. (There's no point wasting
95effort if connections are rejected.) */
96
97if (type[0] == 'd' && cache_record->result != ccache_reject)
98 {
99 if (length == sizeof(dbdata_callout_cache_obs))
100 {
101 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
102 memcpy(new, cache_record, length);
103 new->postmaster_stamp = new->random_stamp = new->time_stamp;
104 cache_record = new;
105 }
106
107 if (now - cache_record->postmaster_stamp > expire)
108 cache_record->postmaster_result = ccache_unknown;
109
110 if (now - cache_record->random_stamp > expire)
111 cache_record->random_result = ccache_unknown;
112 }
113
6f4d5ad3 114HDEBUG(D_verify) debug_printf("callout cache: found %s record for %s\n", type, key);
059ec3d9
PH
115return cache_record;
116}
117
118
119
120/*************************************************
121* Do callout verification for an address *
122*************************************************/
123
124/* This function is called from verify_address() when the address has routed to
125a host list, and a callout has been requested. Callouts are expensive; that is
126why a cache is used to improve the efficiency.
127
128Arguments:
129 addr the address that's been routed
130 host_list the list of hosts to try
131 tf the transport feedback block
132
133 ifstring "interface" option from transport, or NULL
134 portstring "port" option from transport, or NULL
135 protocolstring "protocol" option from transport, or NULL
136 callout the per-command callout timeout
4deaf07d
PH
137 callout_overall the overall callout timeout (if < 0 use 4*callout)
138 callout_connect the callout connection timeout (if < 0 use callout)
059ec3d9
PH
139 options the verification options - these bits are used:
140 vopt_is_recipient => this is a recipient address
141 vopt_callout_no_cache => don't use callout cache
2a4be8f9 142 vopt_callout_fullpm => if postmaster check, do full one
059ec3d9
PH
143 vopt_callout_random => do the "random" thing
144 vopt_callout_recipsender => use real sender for recipient
145 vopt_callout_recippmaster => use postmaster for recipient
146 se_mailfrom MAIL FROM address for sender verify; NULL => ""
147 pm_mailfrom if non-NULL, do the postmaster check with this sender
148
149Returns: OK/FAIL/DEFER
150*/
151
152static int
153do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
8e669ac1 154 int callout, int callout_overall, int callout_connect, int options,
4deaf07d 155 uschar *se_mailfrom, uschar *pm_mailfrom)
059ec3d9
PH
156{
157BOOL is_recipient = (options & vopt_is_recipient) != 0;
158BOOL callout_no_cache = (options & vopt_callout_no_cache) != 0;
159BOOL callout_random = (options & vopt_callout_random) != 0;
160
161int yield = OK;
2b1c6e3a 162int old_domain_cache_result = ccache_accept;
059ec3d9
PH
163BOOL done = FALSE;
164uschar *address_key;
165uschar *from_address;
166uschar *random_local_part = NULL;
55414b25 167const uschar *save_deliver_domain = deliver_domain;
8e669ac1 168uschar **failure_ptr = is_recipient?
2c7db3f5 169 &recipient_verify_failure : &sender_verify_failure;
059ec3d9
PH
170open_db dbblock;
171open_db *dbm_file = NULL;
172dbdata_callout_cache new_domain_record;
173dbdata_callout_cache_address new_address_record;
174host_item *host;
175time_t callout_start_time;
3c8b3577
JH
176#ifdef EXPERIMENTAL_INTERNATIONAL
177BOOL utf8_offered = FALSE;
178#endif
059ec3d9
PH
179
180new_domain_record.result = ccache_unknown;
181new_domain_record.postmaster_result = ccache_unknown;
182new_domain_record.random_result = ccache_unknown;
183
184memset(&new_address_record, 0, sizeof(new_address_record));
185
186/* For a recipient callout, the key used for the address cache record must
187include the sender address if we are using the real sender in the callout,
188because that may influence the result of the callout. */
189
190address_key = addr->address;
191from_address = US"";
192
193if (is_recipient)
194 {
5032d1cf 195 if (options & vopt_callout_recipsender)
059ec3d9
PH
196 {
197 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
198 from_address = sender_address;
199 }
5032d1cf 200 else if (options & vopt_callout_recippmaster)
059ec3d9
PH
201 {
202 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
203 qualify_domain_sender);
204 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
205 }
206 }
207
208/* For a sender callout, we must adjust the key if the mailfrom address is not
209empty. */
210
211else
212 {
213 from_address = (se_mailfrom == NULL)? US"" : se_mailfrom;
214 if (from_address[0] != 0)
215 address_key = string_sprintf("%s/<%s>", addr->address, from_address);
216 }
217
218/* Open the callout cache database, it it exists, for reading only at this
219stage, unless caching has been disabled. */
220
221if (callout_no_cache)
222 {
223 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
224 }
225else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
226 {
227 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
228 }
229
230/* If a cache database is available see if we can avoid the need to do an
231actual callout by making use of previously-obtained data. */
232
233if (dbm_file != NULL)
234 {
235 dbdata_callout_cache_address *cache_address_record;
236 dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
237 addr->domain, US"domain",
238 callout_cache_domain_positive_expire,
239 callout_cache_domain_negative_expire);
240
241 /* If an unexpired cache record was found for this domain, see if the callout
242 process can be short-circuited. */
243
244 if (cache_record != NULL)
245 {
2b1c6e3a
PH
246 /* In most cases, if an early command (up to and including MAIL FROM:<>)
247 was rejected, there is no point carrying on. The callout fails. However, if
248 we are doing a recipient verification with use_sender or use_postmaster
249 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
250 will be using a non-empty sender. We have to remember this situation so as
251 not to disturb the cached domain value if this whole verification succeeds
252 (we don't want it turning into "accept"). */
253
254 old_domain_cache_result = cache_record->result;
255
256 if (cache_record->result == ccache_reject ||
257 (*from_address == 0 && cache_record->result == ccache_reject_mfnull))
059ec3d9
PH
258 {
259 setflag(addr, af_verify_nsfail);
260 HDEBUG(D_verify)
261 debug_printf("callout cache: domain gave initial rejection, or "
262 "does not accept HELO or MAIL FROM:<>\n");
263 setflag(addr, af_verify_nsfail);
264 addr->user_message = US"(result of an earlier callout reused).";
265 yield = FAIL;
8e669ac1 266 *failure_ptr = US"mail";
059ec3d9
PH
267 goto END_CALLOUT;
268 }
269
270 /* If a previous check on a "random" local part was accepted, we assume
271 that the server does not do any checking on local parts. There is therefore
272 no point in doing the callout, because it will always be successful. If a
273 random check previously failed, arrange not to do it again, but preserve
274 the data in the new record. If a random check is required but hasn't been
275 done, skip the remaining cache processing. */
276
277 if (callout_random) switch(cache_record->random_result)
278 {
279 case ccache_accept:
280 HDEBUG(D_verify)
281 debug_printf("callout cache: domain accepts random addresses\n");
282 goto END_CALLOUT; /* Default yield is OK */
283
284 case ccache_reject:
285 HDEBUG(D_verify)
286 debug_printf("callout cache: domain rejects random addresses\n");
287 callout_random = FALSE;
288 new_domain_record.random_result = ccache_reject;
289 new_domain_record.random_stamp = cache_record->random_stamp;
290 break;
291
292 default:
293 HDEBUG(D_verify)
294 debug_printf("callout cache: need to check random address handling "
295 "(not cached or cache expired)\n");
296 goto END_CACHE;
297 }
298
299 /* If a postmaster check is requested, but there was a previous failure,
300 there is again no point in carrying on. If a postmaster check is required,
301 but has not been done before, we are going to have to do a callout, so skip
302 remaining cache processing. */
303
304 if (pm_mailfrom != NULL)
305 {
306 if (cache_record->postmaster_result == ccache_reject)
307 {
308 setflag(addr, af_verify_pmfail);
309 HDEBUG(D_verify)
310 debug_printf("callout cache: domain does not accept "
311 "RCPT TO:<postmaster@domain>\n");
312 yield = FAIL;
8e669ac1 313 *failure_ptr = US"postmaster";
059ec3d9
PH
314 setflag(addr, af_verify_pmfail);
315 addr->user_message = US"(result of earlier verification reused).";
316 goto END_CALLOUT;
317 }
318 if (cache_record->postmaster_result == ccache_unknown)
319 {
320 HDEBUG(D_verify)
321 debug_printf("callout cache: need to check RCPT "
322 "TO:<postmaster@domain> (not cached or cache expired)\n");
323 goto END_CACHE;
324 }
325
326 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
327 postmaster check if the address itself has to be checked. Also ensure
328 that the value in the cache record is preserved (with its old timestamp).
329 */
330
331 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
332 "TO:<postmaster@domain>\n");
333 pm_mailfrom = NULL;
334 new_domain_record.postmaster_result = ccache_accept;
335 new_domain_record.postmaster_stamp = cache_record->postmaster_stamp;
336 }
337 }
338
339 /* We can't give a result based on information about the domain. See if there
340 is an unexpired cache record for this specific address (combined with the
341 sender address if we are doing a recipient callout with a non-empty sender).
342 */
343
344 cache_address_record = (dbdata_callout_cache_address *)
345 get_callout_cache_record(dbm_file,
346 address_key, US"address",
347 callout_cache_positive_expire,
348 callout_cache_negative_expire);
349
350 if (cache_address_record != NULL)
351 {
352 if (cache_address_record->result == ccache_accept)
353 {
354 HDEBUG(D_verify)
355 debug_printf("callout cache: address record is positive\n");
356 }
357 else
358 {
359 HDEBUG(D_verify)
360 debug_printf("callout cache: address record is negative\n");
361 addr->user_message = US"Previous (cached) callout verification failure";
8e669ac1 362 *failure_ptr = US"recipient";
059ec3d9
PH
363 yield = FAIL;
364 }
365 goto END_CALLOUT;
366 }
367
368 /* Close the cache database while we actually do the callout for real. */
369
370 END_CACHE:
371 dbfn_close(dbm_file);
372 dbm_file = NULL;
373 }
374
193e3acd 375if (!addr->transport)
059ec3d9 376 {
193e3acd 377 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
059ec3d9 378 }
6681531a
HSHR
379else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
380 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
381 addr->transport->name, addr->transport->driver_name);
193e3acd
JH
382else
383 {
384 smtp_transport_options_block *ob =
9d9c3746 385 (smtp_transport_options_block *)addr->transport->options_block;
059ec3d9 386
193e3acd
JH
387 /* The information wasn't available in the cache, so we have to do a real
388 callout and save the result in the cache for next time, unless no_cache is set,
389 or unless we have a previously cached negative random result. If we are to test
390 with a random local part, ensure that such a local part is available. If not,
391 log the fact, but carry on without randomming. */
059ec3d9 392
193e3acd 393 if (callout_random && callout_random_local_part != NULL)
65f1c92a 394 if (!(random_local_part = expand_string(callout_random_local_part)))
193e3acd
JH
395 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
396 "callout_random_local_part: %s", expand_string_message);
059ec3d9 397
193e3acd
JH
398 /* Default the connect and overall callout timeouts if not set, and record the
399 time we are starting so that we can enforce it. */
4c590bd1 400
193e3acd
JH
401 if (callout_overall < 0) callout_overall = 4 * callout;
402 if (callout_connect < 0) callout_connect = callout;
403 callout_start_time = time(NULL);
4c590bd1 404
193e3acd
JH
405 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
406 output because a callout might take some time. When PIPELINING is active and
407 there are many recipients, the total time for doing lots of callouts can add up
408 and cause the client to time out. So in this case we forgo the PIPELINING
409 optimization. */
817d9f57 410
193e3acd 411 if (smtp_out != NULL && !disable_callout_flush) mac_smtp_fflush();
059ec3d9 412
5032d1cf
JH
413/* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
414and we are holding a cutthrough conn open, we can just append the rcpt to
415that conn for verification purposes (and later delivery also). Simplest
416coding means skipping this whole loop and doing the append separately.
417
418We will need to remember it has been appended so that rcpt-acl tail code
419can do it there for the non-rcpt-verify case. For this we keep an addresscount.
420*/
421
422 /* Can we re-use an open cutthrough connection? */
423 if ( cutthrough.fd >= 0
424 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
425 == vopt_callout_recipsender
426 && !random_local_part
427 && !pm_mailfrom
428 )
429 {
430 if (addr->transport == cutthrough.addr.transport)
431 for (host = host_list; host; host = host->next)
432 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
433 {
434 int host_af;
435 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
436 int port = 25;
437
438 deliver_host = host->name;
439 deliver_host_address = host->address;
440 deliver_host_port = host->port;
441 deliver_domain = addr->domain;
442 transport_name = addr->transport->name;
443
444 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
445
446 if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
447 US"callout") ||
448 !smtp_get_port(tf->port, addr, &port, US"callout"))
449 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
450 addr->message);
451
452 if ( ( interface == cutthrough.interface
453 || ( interface
454 && cutthrough.interface
455 && Ustrcmp(interface, cutthrough.interface) == 0
456 ) )
457 && port == cutthrough.host.port
458 )
459 {
460 uschar * resp;
461
462 /* Match! Send the RCPT TO, append the addr, set done */
463 done =
464 smtp_write_command(&ctblock, FALSE, "RCPT TO:<%.1000s>\r\n",
465 transport_rcpt_address(addr,
466 (addr->transport == NULL)? FALSE :
467 addr->transport->rcpt_include_affixes)) >= 0 &&
468 cutthrough_response('2', &resp) == '2';
469
470 /* This would go horribly wrong if a callout fail was ignored by ACL.
471 We punt by abandoning cutthrough on a reject, like the
472 first-rcpt does. */
473
474 if (done)
475 {
476 address_item * na = store_get(sizeof(address_item));
477 *na = cutthrough.addr;
478 cutthrough.addr = *addr;
479 cutthrough.addr.host_used = &cutthrough.host;
480 cutthrough.addr.next = na;
481
482 cutthrough.nrcpt++;
483 }
484 else
485 {
486 cancel_cutthrough_connection("recipient rejected");
487 if (errno == ETIMEDOUT)
488 {
489 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
490 }
491 else if (errno == 0)
492 {
493 if (*resp == 0)
494 Ustrcpy(resp, US"connection dropped");
495
496 addr->message =
497 string_sprintf("response to \"%s\" from %s [%s] was: %s",
498 big_buffer, host->name, host->address,
499 string_printing(resp));
500
501 addr->user_message =
502 string_sprintf("Callout verification failed:\n%s", resp);
503
504 /* Hard rejection ends the process */
505
506 if (resp[0] == '5') /* Address rejected */
507 {
508 yield = FAIL;
509 done = TRUE;
510 }
511 }
512 }
513 }
514 break;
515 }
516 if (!done)
517 cancel_cutthrough_connection("incompatible connection");
518 }
519
193e3acd
JH
520 /* Now make connections to the hosts and do real callouts. The list of hosts
521 is passed in as an argument. */
059ec3d9 522
193e3acd 523 for (host = host_list; host != NULL && !done; host = host->next)
059ec3d9 524 {
193e3acd
JH
525 smtp_inblock inblock;
526 smtp_outblock outblock;
527 int host_af;
528 int port = 25;
529 BOOL send_quit = TRUE;
530 uschar *active_hostname = smtp_active_hostname;
531 BOOL lmtp;
532 BOOL smtps;
533 BOOL esmtp;
534 BOOL suppress_tls = FALSE;
535 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
0e66b3b6
JH
536#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
537 BOOL dane = FALSE;
6ebd79ec 538 BOOL dane_required;
0e66b3b6
JH
539 dns_answer tlsa_dnsa;
540#endif
193e3acd
JH
541 uschar inbuffer[4096];
542 uschar outbuffer[1024];
543 uschar responsebuffer[4096];
544
545 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
546 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
547
548 /* Skip this host if we don't have an IP address for it. */
549
550 if (host->address == NULL)
551 {
552 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
553 host->name);
554 continue;
555 }
059ec3d9 556
193e3acd 557 /* Check the overall callout timeout */
059ec3d9 558
193e3acd
JH
559 if (time(NULL) - callout_start_time >= callout_overall)
560 {
561 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
562 break;
563 }
059ec3d9 564
193e3acd 565 /* Set IPv4 or IPv6 */
059ec3d9 566
193e3acd 567 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
de3a88fb 568
193e3acd
JH
569 /* Expand and interpret the interface and port strings. The latter will not
570 be used if there is a host-specific port (e.g. from a manualroute router).
571 This has to be delayed till now, because they may expand differently for
572 different hosts. If there's a failure, log it, but carry on with the
573 defaults. */
de3a88fb 574
193e3acd
JH
575 deliver_host = host->name;
576 deliver_host_address = host->address;
a7538db1 577 deliver_host_port = host->port;
193e3acd 578 deliver_domain = addr->domain;
aec45841 579 transport_name = addr->transport->name;
059ec3d9 580
bf7aabb4
JH
581 if ( !smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
582 US"callout")
583 || !smtp_get_port(tf->port, addr, &port, US"callout")
584 )
193e3acd
JH
585 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
586 addr->message);
059ec3d9 587
193e3acd
JH
588 /* Set HELO string according to the protocol */
589 lmtp= Ustrcmp(tf->protocol, "lmtp") == 0;
590 smtps= Ustrcmp(tf->protocol, "smtps") == 0;
059ec3d9 591
059ec3d9 592
193e3acd 593 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", interface, port);
059ec3d9 594
193e3acd 595 /* Set up the buffer for reading SMTP response packets. */
059ec3d9 596
193e3acd
JH
597 inblock.buffer = inbuffer;
598 inblock.buffersize = sizeof(inbuffer);
599 inblock.ptr = inbuffer;
600 inblock.ptrend = inbuffer;
059ec3d9 601
193e3acd 602 /* Set up the buffer for holding SMTP commands while pipelining */
817d9f57 603
193e3acd
JH
604 outblock.buffer = outbuffer;
605 outblock.buffersize = sizeof(outbuffer);
606 outblock.ptr = outbuffer;
607 outblock.cmd_count = 0;
608 outblock.authenticating = FALSE;
059ec3d9 609
193e3acd
JH
610 /* Connect to the host; on failure, just loop for the next one, but we
611 set the error for the last one. Use the callout_connect timeout. */
059ec3d9 612
193e3acd 613 tls_retry_connection:
41c7c167 614
65f1c92a
JH
615 /* Reset the parameters of a TLS session */
616 tls_out.cipher = tls_out.peerdn = tls_out.peercert = NULL;
617
193e3acd 618 inblock.sock = outblock.sock =
7eb6c37c
JH
619 smtp_connect(host, host_af, port, interface, callout_connect,
620 addr->transport);
193e3acd
JH
621 if (inblock.sock < 0)
622 {
623 addr->message = string_sprintf("could not connect to %s [%s]: %s",
624 host->name, host->address, strerror(errno));
aec45841 625 transport_name = NULL;
193e3acd
JH
626 deliver_host = deliver_host_address = NULL;
627 deliver_domain = save_deliver_domain;
628 continue;
629 }
41c7c167 630
bf7aabb4
JH
631#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
632 {
633 int rc;
634
635 tls_out.dane_verified = FALSE;
636 tls_out.tlsa_usage = 0;
637
638 dane_required =
639 verify_check_given_host(&ob->hosts_require_dane, host) == OK;
640
641 if (host->dnssec == DS_YES)
642 {
643 if( ( dane_required
644 || verify_check_given_host(&ob->hosts_try_dane, host) == OK
645 )
646 && (rc = tlsa_lookup(host, &tlsa_dnsa, dane_required, &dane)) != OK
647 )
648 return rc;
649 }
650 else if (dane_required)
651 {
652 log_write(0, LOG_MAIN, "DANE error: %s lookup not DNSSEC", host->name);
653 return FAIL;
654 }
655
656 if (dane)
657 ob->tls_tempfail_tryclear = FALSE;
658 }
659#endif /*DANE*/
660
193e3acd 661 /* Expand the helo_data string to find the host name to use. */
41c7c167 662
193e3acd
JH
663 if (tf->helo_data != NULL)
664 {
665 uschar *s = expand_string(tf->helo_data);
666 if (s == NULL)
667 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
668 "helo_data value for callout: %s", addr->address,
669 expand_string_message);
670 else active_hostname = s;
671 }
059ec3d9 672
193e3acd
JH
673 /* Wait for initial response, and send HELO. The smtp_write_command()
674 function leaves its command in big_buffer. This is used in error responses.
675 Initialize it in case the connection is rejected. */
817d9f57 676
193e3acd 677 Ustrcpy(big_buffer, "initial connection");
817d9f57 678
193e3acd
JH
679 /* Unless ssl-on-connect, wait for the initial greeting */
680 smtps_redo_greeting:
817d9f57 681
a7538db1 682#ifdef SUPPORT_TLS
193e3acd 683 if (!smtps || (smtps && tls_out.active >= 0))
a7538db1
JH
684#endif
685 {
193e3acd
JH
686 if (!(done= smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout)))
687 goto RESPONSE_FAILED;
770747fd 688
774ef2d7 689#ifdef EXPERIMENTAL_EVENT
aaedd1b5
JH
690 lookup_dnssec_authenticated = host->dnssec==DS_YES ? US"yes"
691 : host->dnssec==DS_NO ? US"no" : NULL;
774ef2d7 692 if (event_raise(addr->transport->event_action,
b30275b8 693 US"smtp:connect", responsebuffer))
a7538db1 694 {
aaedd1b5 695 lookup_dnssec_authenticated = NULL;
a7538db1
JH
696 /* Logging? Debug? */
697 goto RESPONSE_FAILED;
698 }
aaedd1b5 699 lookup_dnssec_authenticated = NULL;
a7538db1
JH
700#endif
701 }
702
193e3acd 703 /* Not worth checking greeting line for ESMTP support */
55414b25 704 if (!(esmtp = verify_check_given_host(&ob->hosts_avoid_esmtp, host) != OK))
193e3acd
JH
705 DEBUG(D_transport)
706 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
817d9f57 707
193e3acd 708 tls_redo_helo:
817d9f57 709
a7538db1 710#ifdef SUPPORT_TLS
193e3acd 711 if (smtps && tls_out.active < 0) /* ssl-on-connect, first pass */
817d9f57 712 {
193e3acd
JH
713 tls_offered = TRUE;
714 ob->tls_tempfail_tryclear = FALSE;
817d9f57 715 }
a7538db1
JH
716 else /* all other cases */
717#endif
817d9f57 718
193e3acd 719 { esmtp_retry:
817d9f57 720
193e3acd
JH
721 if (!(done= smtp_write_command(&outblock, FALSE, "%s %s\r\n",
722 !esmtp? "HELO" : lmtp? "LHLO" : "EHLO", active_hostname) >= 0))
723 goto SEND_FAILED;
724 if (!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout))
725 {
4ed8d31a
JH
726 if (errno != 0 || responsebuffer[0] == 0 || lmtp || !esmtp || tls_out.active >= 0)
727 {
728 done= FALSE;
729 goto RESPONSE_FAILED;
730 }
a7538db1 731#ifdef SUPPORT_TLS
193e3acd 732 tls_offered = FALSE;
a7538db1 733#endif
193e3acd
JH
734 esmtp = FALSE;
735 goto esmtp_retry; /* fallback to HELO */
736 }
737
738 /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
a7538db1 739#ifdef SUPPORT_TLS
4ed8d31a 740 if (esmtp && !suppress_tls && tls_out.active < 0)
a7538db1
JH
741 {
742 if (regex_STARTTLS == NULL) regex_STARTTLS =
743 regex_must_compile(US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)", FALSE, TRUE);
4ed8d31a 744
a7538db1
JH
745 tls_offered = pcre_exec(regex_STARTTLS, NULL, CS responsebuffer,
746 Ustrlen(responsebuffer), 0, PCRE_EOPT, NULL, 0) >= 0;
4ed8d31a
JH
747 }
748 else
749 tls_offered = FALSE;
a7538db1 750#endif
817d9f57
JH
751 }
752
193e3acd
JH
753 /* If TLS is available on this connection attempt to
754 start up a TLS session, unless the host is in hosts_avoid_tls. If successful,
755 send another EHLO - the server may give a different answer in secure mode. We
756 use a separate buffer for reading the response to STARTTLS so that if it is
757 negative, the original EHLO data is available for subsequent analysis, should
758 the client not be required to use TLS. If the response is bad, copy the buffer
759 for error analysis. */
760
a7538db1 761#ifdef SUPPORT_TLS
5130845b
JH
762 if ( tls_offered
763 && verify_check_given_host(&ob->hosts_avoid_tls, host) != OK
764 && verify_check_given_host(&ob->hosts_verify_avoid_tls, host) != OK
99400968 765 )
817d9f57 766 {
193e3acd
JH
767 uschar buffer2[4096];
768 if ( !smtps
769 && !(done= smtp_write_command(&outblock, FALSE, "STARTTLS\r\n") >= 0))
770 goto SEND_FAILED;
771
772 /* If there is an I/O error, transmission of this message is deferred. If
773 there is a temporary rejection of STARRTLS and tls_tempfail_tryclear is
774 false, we also defer. However, if there is a temporary rejection of STARTTLS
775 and tls_tempfail_tryclear is true, or if there is an outright rejection of
776 STARTTLS, we carry on. This means we will try to send the message in clear,
777 unless the host is in hosts_require_tls (tested below). */
778
779 if (!smtps && !smtp_read_response(&inblock, buffer2, sizeof(buffer2), '2',
780 ob->command_timeout))
817d9f57 781 {
193e3acd
JH
782 if (errno != 0 || buffer2[0] == 0 ||
783 (buffer2[0] == '4' && !ob->tls_tempfail_tryclear))
a7538db1
JH
784 {
785 Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
786 done= FALSE;
787 goto RESPONSE_FAILED;
788 }
193e3acd 789 }
817d9f57 790
193e3acd
JH
791 /* STARTTLS accepted or ssl-on-connect: try to negotiate a TLS session. */
792 else
793 {
65867078
JH
794 int oldtimeout = ob->command_timeout;
795 int rc;
796
6ebd79ec 797 tls_negotiate:
65867078 798 ob->command_timeout = callout;
0e66b3b6 799 rc = tls_client_start(inblock.sock, host, addr, addr->transport
5032d1cf 800# ifdef EXPERIMENTAL_DANE
0e66b3b6 801 , dane ? &tlsa_dnsa : NULL
5032d1cf 802# endif
0e66b3b6 803 );
65867078 804 ob->command_timeout = oldtimeout;
193e3acd 805
6ebd79ec
JH
806 /* TLS negotiation failed; give an error. Try in clear on a new
807 connection, if the options permit it for this host. */
193e3acd 808 if (rc != OK)
83b27293 809 {
6ebd79ec 810 if (rc == DEFER)
a1bccd48 811 {
83b27293 812 (void)close(inblock.sock);
5032d1cf 813# ifdef EXPERIMENTAL_EVENT
774ef2d7 814 (void) event_raise(addr->transport->event_action,
83b27293 815 US"tcp:close", NULL);
5032d1cf 816# endif
6ebd79ec
JH
817# ifdef EXPERIMENTAL_DANE
818 if (dane)
819 {
820 if (!dane_required)
821 {
822 log_write(0, LOG_MAIN, "DANE attempt failed;"
823 " trying CA-root TLS to %s [%s] (not in hosts_require_dane)",
824 host->name, host->address);
825 dane = FALSE;
826 goto tls_negotiate;
827 }
828 }
829 else
830# endif
831 if ( ob->tls_tempfail_tryclear
832 && !smtps
833 && verify_check_given_host(&ob->hosts_require_tls, host) != OK
834 )
835 {
836 log_write(0, LOG_MAIN, "TLS session failure:"
837 " delivering unencrypted to %s [%s] (not in hosts_require_tls)",
838 host->name, host->address);
839 suppress_tls = TRUE;
840 goto tls_retry_connection;
841 }
a7538db1 842 }
6ebd79ec 843
a7538db1
JH
844 /*save_errno = ERRNO_TLSFAILURE;*/
845 /*message = US"failure while setting up TLS session";*/
846 send_quit = FALSE;
847 done= FALSE;
848 goto TLS_FAILED;
849 }
193e3acd
JH
850
851 /* TLS session is set up. Copy info for logging. */
852 addr->cipher = tls_out.cipher;
853 addr->peerdn = tls_out.peerdn;
854
855 /* For SMTPS we need to wait for the initial OK response, then do HELO. */
856 if (smtps)
a7538db1 857 goto smtps_redo_greeting;
193e3acd
JH
858
859 /* For STARTTLS we need to redo EHLO */
860 goto tls_redo_helo;
861 }
817d9f57
JH
862 }
863
193e3acd
JH
864 /* If the host is required to use a secure channel, ensure that we have one. */
865 if (tls_out.active < 0)
0e66b3b6 866 if (
5032d1cf 867# ifdef EXPERIMENTAL_DANE
0e66b3b6 868 dane ||
5032d1cf 869# endif
5130845b 870 verify_check_given_host(&ob->hosts_require_tls, host) == OK
7a31d643 871 )
193e3acd
JH
872 {
873 /*save_errno = ERRNO_TLSREQUIRED;*/
c562fd30
JH
874 log_write(0, LOG_MAIN,
875 "H=%s [%s]: a TLS session is required for this host, but %s",
193e3acd 876 host->name, host->address,
c562fd30
JH
877 tls_offered ? "an attempt to start TLS failed"
878 : "the server did not offer TLS support");
193e3acd
JH
879 done= FALSE;
880 goto TLS_FAILED;
881 }
817d9f57 882
5032d1cf 883#endif /*SUPPORT_TLS*/
817d9f57 884
193e3acd 885 done = TRUE; /* so far so good; have response to HELO */
817d9f57 886
d6e96b36 887 /*XXX the EHLO response would be analyzed here for IGNOREQUOTA, SIZE, PIPELINING */
817d9f57 888
d6e96b36 889 /* For now, transport_filter by cutthrough-delivery is not supported */
193e3acd 890 /* Need proper integration with the proper transport mechanism. */
5032d1cf 891 if (cutthrough.delivery)
d6e96b36 892 {
6e62c454
JH
893 if (addr->transport->filter_command)
894 {
5032d1cf 895 cutthrough.delivery = FALSE;
6e62c454
JH
896 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
897 }
a7538db1 898#ifndef DISABLE_DKIM
6e62c454
JH
899 if (ob->dkim_domain)
900 {
5032d1cf 901 cutthrough.delivery = FALSE;
6e62c454
JH
902 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
903 }
a7538db1 904#endif
d6e96b36 905 }
817d9f57 906
193e3acd
JH
907 SEND_FAILED:
908 RESPONSE_FAILED:
909 TLS_FAILED:
910 ;
911 /* Clear down of the TLS, SMTP and TCP layers on error is handled below. */
059ec3d9 912
193e3acd
JH
913 /* Failure to accept HELO is cached; this blocks the whole domain for all
914 senders. I/O errors and defer responses are not cached. */
915
916 if (!done)
2b1c6e3a 917 {
193e3acd
JH
918 *failure_ptr = US"mail"; /* At or before MAIL */
919 if (errno == 0 && responsebuffer[0] == '5')
920 {
921 setflag(addr, af_verify_nsfail);
922 new_domain_record.result = ccache_reject;
923 }
2b1c6e3a 924 }
2b1c6e3a 925
9bfc60eb 926#ifdef EXPERIMENTAL_INTERNATIONAL
3c8b3577
JH
927 else if ( addr->prop.utf8_msg
928 && !addr->prop.utf8_downcvt
9bfc60eb
JH
929 && !( esmtp
930 && ( regex_UTF8
931 || ( (regex_UTF8 = regex_must_compile(
932 US"\\n250[\\s\\-]SMTPUTF8(\\s|\\n|$)", FALSE, TRUE)),
933 TRUE
934 ) )
3c8b3577
JH
935 && ( (utf8_offered = pcre_exec(regex_UTF8, NULL,
936 CS responsebuffer, Ustrlen(responsebuffer),
937 0, PCRE_EOPT, NULL, 0) >= 0)
938 || addr->prop.utf8_downcvt_maybe
939 ) ) )
9bfc60eb
JH
940 {
941 HDEBUG(D_acl|D_v) debug_printf("utf8 required but not offered\n");
942 errno = ERRNO_UTF8_FWD;
943 setflag(addr, af_verify_nsfail);
944 done = FALSE;
945 }
3c8b3577
JH
946 else if ( addr->prop.utf8_msg
947 && (addr->prop.utf8_downcvt || !utf8_offered)
921dfc11
JH
948 && (setflag(addr, af_utf8_downcvt),
949 from_address = string_address_utf8_to_alabel(from_address,
950 &addr->message),
951 addr->message
952 ) )
3c8b3577
JH
953 {
954 errno = ERRNO_EXPANDFAIL;
955 setflag(addr, af_verify_nsfail);
956 done = FALSE;
957 }
9bfc60eb
JH
958#endif
959
d6e96b36 960 /* If we haven't authenticated, but are required to, give up. */
fcc8e047
JH
961 /* Try to AUTH */
962
963 else done = smtp_auth(responsebuffer, sizeof(responsebuffer),
964 addr, host, ob, esmtp, &inblock, &outblock) == OK &&
965
b4a2b536
JH
966 /* Copy AUTH info for logging */
967 ( (addr->authenticator = client_authenticator),
968 (addr->auth_id = client_authenticated_id),
969
fcc8e047 970 /* Build a mail-AUTH string (re-using responsebuffer for convenience */
b4a2b536
JH
971 !smtp_mail_auth_str(responsebuffer, sizeof(responsebuffer), addr, ob)
972 ) &&
973
974 ( (addr->auth_sndr = client_authenticated_sender),
fcc8e047 975
193e3acd 976 /* Send the MAIL command */
9bfc60eb
JH
977 (smtp_write_command(&outblock, FALSE,
978#ifdef EXPERIMENTAL_INTERNATIONAL
921dfc11 979 addr->prop.utf8_msg && !addr->prop.utf8_downcvt
9bfc60eb
JH
980 ? "MAIL FROM:<%s>%s SMTPUTF8\r\n"
981 :
982#endif
983 "MAIL FROM:<%s>%s\r\n",
b4a2b536
JH
984 from_address, responsebuffer) >= 0)
985 ) &&
2b1c6e3a 986
193e3acd
JH
987 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
988 '2', callout);
059ec3d9 989
00bff6f6
JH
990 deliver_host = deliver_host_address = NULL;
991 deliver_domain = save_deliver_domain;
992
193e3acd
JH
993 /* If the host does not accept MAIL FROM:<>, arrange to cache this
994 information, but again, don't record anything for an I/O error or a defer. Do
995 not cache rejections of MAIL when a non-empty sender has been used, because
996 that blocks the whole domain for all senders. */
059ec3d9 997
193e3acd 998 if (!done)
059ec3d9 999 {
193e3acd
JH
1000 *failure_ptr = US"mail"; /* At or before MAIL */
1001 if (errno == 0 && responsebuffer[0] == '5')
1002 {
1003 setflag(addr, af_verify_nsfail);
1004 if (from_address[0] == 0)
1005 new_domain_record.result = ccache_reject_mfnull;
1006 }
059ec3d9 1007 }
059ec3d9 1008
193e3acd
JH
1009 /* Otherwise, proceed to check a "random" address (if required), then the
1010 given address, and the postmaster address (if required). Between each check,
1011 issue RSET, because some servers accept only one recipient after MAIL
1012 FROM:<>.
2b1c6e3a 1013
193e3acd
JH
1014 Before doing this, set the result in the domain cache record to "accept",
1015 unless its previous value was ccache_reject_mfnull. In that case, the domain
1016 rejects MAIL FROM:<> and we want to continue to remember that. When that is
1017 the case, we have got here only in the case of a recipient verification with
1018 a non-null sender. */
059ec3d9 1019
193e3acd 1020 else
059ec3d9 1021 {
921dfc11
JH
1022 const uschar * rcpt_domain = addr->domain;
1023
1024#ifdef EXPERIMENTAL_INTERNATIONAL
1025 uschar * errstr = NULL;
1026 if ( testflag(addr, af_utf8_downcvt)
1027 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
1028 &errstr), errstr)
1029 )
1030 {
1031 addr->message = errstr;
1032 errno = ERRNO_EXPANDFAIL;
1033 setflag(addr, af_verify_nsfail);
1034 done = FALSE;
1035 rcpt_domain = US""; /*XXX errorhandling! */
1036 }
1037#endif
1038
193e3acd
JH
1039 new_domain_record.result =
1040 (old_domain_cache_result == ccache_reject_mfnull)?
1041 ccache_reject_mfnull: ccache_accept;
059ec3d9 1042
193e3acd 1043 /* Do the random local part check first */
059ec3d9 1044
193e3acd 1045 if (random_local_part != NULL)
059ec3d9 1046 {
193e3acd
JH
1047 uschar randombuffer[1024];
1048 BOOL random_ok =
1049 smtp_write_command(&outblock, FALSE,
1050 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part,
921dfc11 1051 rcpt_domain) >= 0 &&
193e3acd
JH
1052 smtp_read_response(&inblock, randombuffer,
1053 sizeof(randombuffer), '2', callout);
059ec3d9 1054
193e3acd 1055 /* Remember when we last did a random test */
059ec3d9 1056
193e3acd 1057 new_domain_record.random_stamp = time(NULL);
059ec3d9 1058
193e3acd 1059 /* If accepted, we aren't going to do any further tests below. */
059ec3d9 1060
193e3acd 1061 if (random_ok)
193e3acd 1062 new_domain_record.random_result = ccache_accept;
059ec3d9 1063
193e3acd
JH
1064 /* Otherwise, cache a real negative response, and get back to the right
1065 state to send RCPT. Unless there's some problem such as a dropped
65f1c92a
JH
1066 connection, we expect to succeed, because the commands succeeded above.
1067 However, some servers drop the connection after responding to an
1068 invalid recipient, so on (any) error we drop and remake the connection.
1069 */
059ec3d9 1070
193e3acd
JH
1071 else if (errno == 0)
1072 {
65f1c92a
JH
1073 /* This would be ok for 1st rcpt a cutthrough, but no way to
1074 handle a subsequent. So refuse to support any */
5032d1cf
JH
1075 cancel_cutthrough_connection("random-recipient");
1076
193e3acd
JH
1077 if (randombuffer[0] == '5')
1078 new_domain_record.random_result = ccache_reject;
1079
1080 done =
1081 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1082 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1083 '2', callout) &&
1084
9bfc60eb
JH
1085 smtp_write_command(&outblock, FALSE,
1086#ifdef EXPERIMENTAL_INTERNATIONAL
921dfc11 1087 addr->prop.utf8_msg && !addr->prop.utf8_downcvt
9bfc60eb
JH
1088 ? "MAIL FROM:<%s> SMTPUTF8\r\n"
1089 :
1090#endif
1091 "MAIL FROM:<%s>\r\n",
193e3acd
JH
1092 from_address) >= 0 &&
1093 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1094 '2', callout);
65f1c92a
JH
1095
1096 if (!done)
1097 {
1098 HDEBUG(D_acl|D_v)
1099 debug_printf("problem after random/rset/mfrom; reopen conn\n");
1100 random_local_part = NULL;
1101#ifdef SUPPORT_TLS
1102 tls_close(FALSE, TRUE);
1103#endif
1104 (void)close(inblock.sock);
1105#ifdef EXPERIMENTAL_EVENT
1106 (void) event_raise(addr->transport->event_action,
1107 US"tcp:close", NULL);
1108#endif
1109 goto tls_retry_connection;
1110 }
193e3acd
JH
1111 }
1112 else done = FALSE; /* Some timeout/connection problem */
1113 } /* Random check */
059ec3d9 1114
193e3acd
JH
1115 /* If the host is accepting all local parts, as determined by the "random"
1116 check, we don't need to waste time doing any further checking. */
059ec3d9 1117
193e3acd 1118 if (new_domain_record.random_result != ccache_accept && done)
059ec3d9 1119 {
193e3acd
JH
1120 /* Get the rcpt_include_affixes flag from the transport if there is one,
1121 but assume FALSE if there is not. */
e4bdf652 1122
921dfc11
JH
1123 uschar * rcpt = transport_rcpt_address(addr,
1124 addr->transport ? addr->transport->rcpt_include_affixes : FALSE);
1125
1126#ifdef EXPERIMENTAL_INTERNATIONAL
1127 /*XXX should the conversion be moved into transport_rcpt_address() ? */
1128 uschar * dummy_errstr = NULL;
1129 if ( testflag(addr, af_utf8_downcvt)
1130 && (rcpt = string_address_utf8_to_alabel(rcpt, &dummy_errstr),
1131 dummy_errstr
1132 ) )
1133 {
1134 errno = ERRNO_EXPANDFAIL;
1135 *failure_ptr = US"recipient";
1136 done = FALSE;
1137 }
1138 else
1139#endif
1140
059ec3d9 1141 done =
193e3acd 1142 smtp_write_command(&outblock, FALSE, "RCPT TO:<%.1000s>\r\n",
921dfc11 1143 rcpt) >= 0 &&
193e3acd
JH
1144 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1145 '2', callout);
059ec3d9 1146
193e3acd
JH
1147 if (done)
1148 new_address_record.result = ccache_accept;
1149 else if (errno == 0 && responsebuffer[0] == '5')
1150 {
1151 *failure_ptr = US"recipient";
1152 new_address_record.result = ccache_reject;
1153 }
059ec3d9 1154
193e3acd
JH
1155 /* Do postmaster check if requested; if a full check is required, we
1156 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
2a4be8f9 1157
193e3acd
JH
1158 if (done && pm_mailfrom != NULL)
1159 {
65f1c92a
JH
1160 /* Could possibly shift before main verify, just above, and be ok
1161 for cutthrough. But no way to handle a subsequent rcpt, so just
1162 refuse any */
5032d1cf 1163 cancel_cutthrough_connection("postmaster verify");
193e3acd
JH
1164 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of postmaster verify\n");
1165
1166 done =
1167 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1168 smtp_read_response(&inblock, responsebuffer,
1169 sizeof(responsebuffer), '2', callout) &&
1170
1171 smtp_write_command(&outblock, FALSE,
1172 "MAIL FROM:<%s>\r\n", pm_mailfrom) >= 0 &&
1173 smtp_read_response(&inblock, responsebuffer,
1174 sizeof(responsebuffer), '2', callout) &&
1175
1176 /* First try using the current domain */
1177
1178 ((
1179 smtp_write_command(&outblock, FALSE,
921dfc11 1180 "RCPT TO:<postmaster@%.1000s>\r\n", rcpt_domain) >= 0 &&
193e3acd
JH
1181 smtp_read_response(&inblock, responsebuffer,
1182 sizeof(responsebuffer), '2', callout)
1183 )
1184
1185 ||
1186
1187 /* If that doesn't work, and a full check is requested,
1188 try without the domain. */
1189
1190 (
1191 (options & vopt_callout_fullpm) != 0 &&
1192 smtp_write_command(&outblock, FALSE,
1193 "RCPT TO:<postmaster>\r\n") >= 0 &&
1194 smtp_read_response(&inblock, responsebuffer,
1195 sizeof(responsebuffer), '2', callout)
1196 ));
1197
1198 /* Sort out the cache record */
1199
1200 new_domain_record.postmaster_stamp = time(NULL);
1201
1202 if (done)
1203 new_domain_record.postmaster_result = ccache_accept;
1204 else if (errno == 0 && responsebuffer[0] == '5')
1205 {
1206 *failure_ptr = US"postmaster";
1207 setflag(addr, af_verify_pmfail);
1208 new_domain_record.postmaster_result = ccache_reject;
1209 }
1210 }
1211 } /* Random not accepted */
1212 } /* MAIL FROM: accepted */
2a4be8f9 1213
193e3acd
JH
1214 /* For any failure of the main check, other than a negative response, we just
1215 close the connection and carry on. We can identify a negative response by the
1216 fact that errno is zero. For I/O errors it will be non-zero
2a4be8f9 1217
193e3acd
JH
1218 Set up different error texts for logging and for sending back to the caller
1219 as an SMTP response. Log in all cases, using a one-line format. For sender
1220 callouts, give a full response to the caller, but for recipient callouts,
1221 don't give the IP address because this may be an internal host whose identity
1222 is not to be widely broadcast. */
2a4be8f9 1223
193e3acd
JH
1224 if (!done)
1225 {
1226 if (errno == ETIMEDOUT)
1227 {
1228 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
1229 send_quit = FALSE;
1230 }
9bfc60eb
JH
1231#ifdef EXPERIMENTAL_INTERNATIONAL
1232 else if (errno == ERRNO_UTF8_FWD)
1233 {
1234 extern int acl_where; /* src/acl.c */
1235 errno = 0;
1236 addr->message = string_sprintf(
1237 "response to \"%s\" from %s [%s] did not include SMTPUTF8",
1238 big_buffer, host->name, host->address);
1239 addr->user_message = acl_where == ACL_WHERE_RCPT
1240 ? US"533 mailbox name not allowed"
1241 : US"550 mailbox unavailable";
1242 yield = FAIL;
1243 done = TRUE;
1244 }
1245#endif
193e3acd
JH
1246 else if (errno == 0)
1247 {
1248 if (*responsebuffer == 0) Ustrcpy(responsebuffer, US"connection dropped");
2a4be8f9 1249
193e3acd
JH
1250 addr->message =
1251 string_sprintf("response to \"%s\" from %s [%s] was: %s",
1252 big_buffer, host->name, host->address,
1253 string_printing(responsebuffer));
059ec3d9 1254
193e3acd
JH
1255 addr->user_message = is_recipient?
1256 string_sprintf("Callout verification failed:\n%s", responsebuffer)
1257 :
1258 string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1259 host->address, big_buffer, responsebuffer);
059ec3d9 1260
193e3acd
JH
1261 /* Hard rejection ends the process */
1262
1263 if (responsebuffer[0] == '5') /* Address rejected */
059ec3d9 1264 {
193e3acd
JH
1265 yield = FAIL;
1266 done = TRUE;
059ec3d9
PH
1267 }
1268 }
193e3acd 1269 }
059ec3d9 1270
193e3acd
JH
1271 /* End the SMTP conversation and close the connection. */
1272
5032d1cf
JH
1273 /* Cutthrough - on a successfull connect and recipient-verify with
1274 use-sender and we are 1st rcpt and have no cutthrough conn so far
193e3acd 1275 here is where we want to leave the conn open */
5032d1cf
JH
1276 if ( cutthrough.delivery
1277 && rcpt_count == 1
193e3acd
JH
1278 && done
1279 && yield == OK
1280 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster)) == vopt_callout_recipsender
1281 && !random_local_part
1282 && !pm_mailfrom
5032d1cf 1283 && cutthrough.fd < 0
66ba1a69 1284 && !lmtp
193e3acd 1285 )
059ec3d9 1286 {
5032d1cf
JH
1287 cutthrough.fd = outblock.sock; /* We assume no buffer in use in the outblock */
1288 cutthrough.nrcpt = 1;
1289 cutthrough.interface = interface;
1290 cutthrough.host = *host;
1291 cutthrough.addr = *addr; /* Save the address_item for later logging */
1292 cutthrough.addr.next = NULL;
1293 cutthrough.addr.host_used = &cutthrough.host;
193e3acd 1294 if (addr->parent)
5032d1cf
JH
1295 *(cutthrough.addr.parent = store_get(sizeof(address_item))) =
1296 *addr->parent;
193e3acd
JH
1297 ctblock.buffer = ctbuffer;
1298 ctblock.buffersize = sizeof(ctbuffer);
1299 ctblock.ptr = ctbuffer;
1300 /* ctblock.cmd_count = 0; ctblock.authenticating = FALSE; */
5032d1cf 1301 ctblock.sock = cutthrough.fd;
059ec3d9 1302 }
193e3acd 1303 else
059ec3d9 1304 {
2e5b33cd 1305 /* Ensure no cutthrough on multiple address verifies */
193e3acd 1306 if (options & vopt_callout_recipsender)
2e5b33cd 1307 cancel_cutthrough_connection("multiple verify calls");
193e3acd 1308 if (send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
059ec3d9 1309
a7538db1 1310#ifdef SUPPORT_TLS
193e3acd 1311 tls_close(FALSE, TRUE);
a7538db1 1312#endif
193e3acd 1313 (void)close(inblock.sock);
774ef2d7
JH
1314#ifdef EXPERIMENTAL_EVENT
1315 (void) event_raise(addr->transport->event_action,
a7538db1
JH
1316 US"tcp:close", NULL);
1317#endif
059ec3d9 1318 }
059ec3d9 1319
193e3acd
JH
1320 } /* Loop through all hosts, while !done */
1321 }
059ec3d9
PH
1322
1323/* If we get here with done == TRUE, a successful callout happened, and yield
1324will be set OK or FAIL according to the response to the RCPT command.
1325Otherwise, we looped through the hosts but couldn't complete the business.
1326However, there may be domain-specific information to cache in both cases.
1327
1328The value of the result field in the new_domain record is ccache_unknown if
90e9ce59 1329there was an error before or with MAIL FROM:, and errno was not zero,
059ec3d9 1330implying some kind of I/O error. We don't want to write the cache in that case.
2b1c6e3a 1331Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
059ec3d9
PH
1332
1333if (!callout_no_cache && new_domain_record.result != ccache_unknown)
1334 {
1335 if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
1336 == NULL)
1337 {
1338 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
1339 }
1340 else
1341 {
1342 (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
1343 (int)sizeof(dbdata_callout_cache));
1344 HDEBUG(D_verify) debug_printf("wrote callout cache domain record:\n"
1345 " result=%d postmaster=%d random=%d\n",
1346 new_domain_record.result,
1347 new_domain_record.postmaster_result,
1348 new_domain_record.random_result);
1349 }
1350 }
1351
1352/* If a definite result was obtained for the callout, cache it unless caching
1353is disabled. */
1354
1355if (done)
1356 {
1357 if (!callout_no_cache && new_address_record.result != ccache_unknown)
1358 {
1359 if (dbm_file == NULL)
1360 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
1361 if (dbm_file == NULL)
1362 {
1363 HDEBUG(D_verify) debug_printf("no callout cache available\n");
1364 }
1365 else
1366 {
1367 (void)dbfn_write(dbm_file, address_key, &new_address_record,
1368 (int)sizeof(dbdata_callout_cache_address));
1369 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record\n",
1370 (new_address_record.result == ccache_accept)? "positive" : "negative");
1371 }
1372 }
1373 } /* done */
1374
1375/* Failure to connect to any host, or any response other than 2xx or 5xx is a
1376temporary error. If there was only one host, and a response was received, leave
1377it alone if supplying details. Otherwise, give a generic response. */
1378
1379else /* !done */
1380 {
1381 uschar *dullmsg = string_sprintf("Could not complete %s verify callout",
1382 is_recipient? "recipient" : "sender");
1383 yield = DEFER;
1384
1385 if (host_list->next != NULL || addr->message == NULL) addr->message = dullmsg;
1386
1387 addr->user_message = (!smtp_return_error_details)? dullmsg :
1388 string_sprintf("%s for <%s>.\n"
1389 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1390 "they may be permanently unreachable from this server. In the latter case,\n%s",
1391 dullmsg, addr->address,
1392 is_recipient?
1393 "the address will never be accepted."
1394 :
1395 "you need to change the address or create an MX record for its domain\n"
1396 "if it is supposed to be generally accessible from the Internet.\n"
1397 "Talk to your mail administrator for details.");
1398
1399 /* Force a specific error code */
1400
1401 addr->basic_errno = ERRNO_CALLOUTDEFER;
1402 }
1403
1404/* Come here from within the cache-reading code on fast-track exit. */
1405
1406END_CALLOUT:
1407if (dbm_file != NULL) dbfn_close(dbm_file);
1408return yield;
1409}
1410
1411
1412
817d9f57
JH
1413/* Called after recipient-acl to get a cutthrough connection open when
1414 one was requested and a recipient-verify wasn't subsequently done.
1415*/
e4bdf652
JH
1416void
1417open_cutthrough_connection( address_item * addr )
1418{
1419address_item addr2;
1420
1421/* Use a recipient-verify-callout to set up the cutthrough connection. */
1422/* We must use a copy of the address for verification, because it might
1423get rewritten. */
1424
1425addr2 = *addr;
5032d1cf
JH
1426HDEBUG(D_acl) debug_printf("----------- %s cutthrough setup ------------\n",
1427 rcpt_count > 1 ? "more" : "start");
e4bdf652
JH
1428(void) verify_address(&addr2, NULL,
1429 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1430 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1431 NULL, NULL, NULL);
1432HDEBUG(D_acl) debug_printf("----------- end cutthrough setup ------------\n");
1433return;
1434}
1435
1436
e4bdf652 1437
817d9f57
JH
1438/* Send given number of bytes from the buffer */
1439static BOOL
1440cutthrough_send(int n)
e4bdf652 1441{
5032d1cf 1442if(cutthrough.fd < 0)
817d9f57 1443 return TRUE;
e4bdf652 1444
817d9f57
JH
1445if(
1446#ifdef SUPPORT_TLS
5032d1cf 1447 (tls_out.active == cutthrough.fd) ? tls_write(FALSE, ctblock.buffer, n) :
817d9f57 1448#endif
5032d1cf 1449 send(cutthrough.fd, ctblock.buffer, n, 0) > 0
817d9f57
JH
1450 )
1451{
1452 transport_count += n;
1453 ctblock.ptr= ctblock.buffer;
1454 return TRUE;
1455}
e4bdf652 1456
817d9f57
JH
1457HDEBUG(D_transport|D_acl) debug_printf("cutthrough_send failed: %s\n", strerror(errno));
1458return FALSE;
e4bdf652
JH
1459}
1460
1461
1462
817d9f57
JH
1463static BOOL
1464_cutthrough_puts(uschar * cp, int n)
1465{
1466while(n--)
1467 {
1468 if(ctblock.ptr >= ctblock.buffer+ctblock.buffersize)
1469 if(!cutthrough_send(ctblock.buffersize))
1470 return FALSE;
1471
1472 *ctblock.ptr++ = *cp++;
1473 }
1474return TRUE;
1475}
1476
1477/* Buffered output of counted data block. Return boolean success */
e4bdf652
JH
1478BOOL
1479cutthrough_puts(uschar * cp, int n)
1480{
5032d1cf 1481if (cutthrough.fd < 0) return TRUE;
817d9f57 1482if (_cutthrough_puts(cp, n)) return TRUE;
2e5b33cd 1483cancel_cutthrough_connection("transmit failed");
817d9f57
JH
1484return FALSE;
1485}
e4bdf652 1486
e4bdf652 1487
817d9f57 1488static BOOL
5032d1cf 1489_cutthrough_flush_send(void)
817d9f57
JH
1490{
1491int n= ctblock.ptr-ctblock.buffer;
e4bdf652 1492
817d9f57
JH
1493if(n>0)
1494 if(!cutthrough_send(n))
1495 return FALSE;
1496return TRUE;
e4bdf652
JH
1497}
1498
817d9f57
JH
1499
1500/* Send out any bufferred output. Return boolean success. */
e4bdf652 1501BOOL
5032d1cf 1502cutthrough_flush_send(void)
e4bdf652 1503{
817d9f57 1504if (_cutthrough_flush_send()) return TRUE;
2e5b33cd 1505cancel_cutthrough_connection("transmit failed");
e4bdf652
JH
1506return FALSE;
1507}
1508
1509
1510BOOL
5032d1cf 1511cutthrough_put_nl(void)
e4bdf652
JH
1512{
1513return cutthrough_puts(US"\r\n", 2);
1514}
1515
1516
1517/* Get and check response from cutthrough target */
1518static uschar
1519cutthrough_response(char expect, uschar ** copy)
1520{
1521smtp_inblock inblock;
1522uschar inbuffer[4096];
1523uschar responsebuffer[4096];
1524
1525inblock.buffer = inbuffer;
1526inblock.buffersize = sizeof(inbuffer);
1527inblock.ptr = inbuffer;
1528inblock.ptrend = inbuffer;
5032d1cf 1529inblock.sock = cutthrough.fd;
817d9f57 1530/* this relies on (inblock.sock == tls_out.active) */
e4bdf652 1531if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, CUTTHROUGH_DATA_TIMEOUT))
2e5b33cd 1532 cancel_cutthrough_connection("target timeout on read");
e4bdf652
JH
1533
1534if(copy != NULL)
1535 {
1536 uschar * cp;
5032d1cf 1537 *copy = cp = string_copy(responsebuffer);
e4bdf652
JH
1538 /* Trim the trailing end of line */
1539 cp += Ustrlen(responsebuffer);
1540 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1541 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1542 }
1543
1544return responsebuffer[0];
1545}
1546
1547
1548/* Negotiate dataphase with the cutthrough target, returning success boolean */
1549BOOL
5032d1cf 1550cutthrough_predata(void)
e4bdf652 1551{
5032d1cf 1552if(cutthrough.fd < 0)
e4bdf652
JH
1553 return FALSE;
1554
1555HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> DATA\n");
817d9f57
JH
1556cutthrough_puts(US"DATA\r\n", 6);
1557cutthrough_flush_send();
e4bdf652
JH
1558
1559/* Assume nothing buffered. If it was it gets ignored. */
1560return cutthrough_response('3', NULL) == '3';
1561}
1562
1563
511a6c14
JH
1564/* fd and use_crlf args only to match write_chunk() */
1565static BOOL
1566cutthrough_write_chunk(int fd, uschar * s, int len, BOOL use_crlf)
1567{
1568uschar * s2;
1569while(s && (s2 = Ustrchr(s, '\n')))
1570 {
1571 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1572 return FALSE;
1573 s = s2+1;
1574 }
1575return TRUE;
1576}
1577
1578
e4bdf652 1579/* Buffered send of headers. Return success boolean. */
817d9f57 1580/* Expands newlines to wire format (CR,NL). */
e4bdf652 1581/* Also sends header-terminating blank line. */
e4bdf652 1582BOOL
5032d1cf 1583cutthrough_headers_send(void)
e4bdf652 1584{
5032d1cf 1585if(cutthrough.fd < 0)
e4bdf652
JH
1586 return FALSE;
1587
511a6c14
JH
1588/* We share a routine with the mainline transport to handle header add/remove/rewrites,
1589 but having a separate buffered-output function (for now)
1590*/
1591HDEBUG(D_acl) debug_printf("----------- start cutthrough headers send -----------\n");
e4bdf652 1592
5032d1cf
JH
1593if (!transport_headers_send(&cutthrough.addr, cutthrough.fd,
1594 cutthrough.addr.transport->add_headers,
1595 cutthrough.addr.transport->remove_headers,
511a6c14 1596 &cutthrough_write_chunk, TRUE,
5032d1cf
JH
1597 cutthrough.addr.transport->rewrite_rules,
1598 cutthrough.addr.transport->rewrite_existflags))
511a6c14
JH
1599 return FALSE;
1600
1601HDEBUG(D_acl) debug_printf("----------- done cutthrough headers send ------------\n");
1602return TRUE;
817d9f57
JH
1603}
1604
1605
1606static void
5032d1cf 1607close_cutthrough_connection(const char * why)
817d9f57 1608{
5032d1cf 1609if(cutthrough.fd >= 0)
817d9f57
JH
1610 {
1611 /* We could be sending this after a bunch of data, but that is ok as
1612 the only way to cancel the transfer in dataphase is to drop the tcp
1613 conn before the final dot.
1614 */
1615 ctblock.ptr = ctbuffer;
1616 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> QUIT\n");
1617 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1618 _cutthrough_flush_send();
1619 /* No wait for response */
1620
1621 #ifdef SUPPORT_TLS
1622 tls_close(FALSE, TRUE);
1623 #endif
5032d1cf
JH
1624 (void)close(cutthrough.fd);
1625 cutthrough.fd = -1;
2e5b33cd 1626 HDEBUG(D_acl) debug_printf("----------- cutthrough shutdown (%s) ------------\n", why);
817d9f57
JH
1627 }
1628ctblock.ptr = ctbuffer;
e4bdf652
JH
1629}
1630
817d9f57 1631void
5032d1cf 1632cancel_cutthrough_connection(const char * why)
817d9f57 1633{
2e5b33cd 1634close_cutthrough_connection(why);
5032d1cf 1635cutthrough.delivery = FALSE;
817d9f57
JH
1636}
1637
1638
1639
e4bdf652
JH
1640
1641/* Have senders final-dot. Send one to cutthrough target, and grab the response.
1642 Log an OK response as a transmission.
817d9f57 1643 Close the connection.
e4bdf652 1644 Return smtp response-class digit.
e4bdf652
JH
1645*/
1646uschar *
5032d1cf 1647cutthrough_finaldot(void)
e4bdf652 1648{
5032d1cf
JH
1649uschar res;
1650address_item * addr;
e4bdf652
JH
1651HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> .\n");
1652
1653/* Assume data finshed with new-line */
5032d1cf
JH
1654if( !cutthrough_puts(US".", 1)
1655 || !cutthrough_put_nl()
1656 || !cutthrough_flush_send()
1657 )
1658 return cutthrough.addr.message;
e4bdf652 1659
5032d1cf
JH
1660res = cutthrough_response('2', &cutthrough.addr.message);
1661for (addr = &cutthrough.addr; addr; addr = addr->next)
817d9f57 1662 {
5032d1cf
JH
1663 addr->message = cutthrough.addr.message;
1664 switch(res)
1665 {
1666 case '2':
1667 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1668 close_cutthrough_connection("delivered");
1669 break;
817d9f57 1670
5032d1cf
JH
1671 case '4':
1672 delivery_log(LOG_MAIN, addr, 0,
1673 US"tmp-reject from cutthrough after DATA:");
1674 break;
e4bdf652 1675
5032d1cf
JH
1676 case '5':
1677 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1678 US"rejected after DATA:");
1679 break;
e4bdf652 1680
5032d1cf
JH
1681 default:
1682 break;
1683 }
817d9f57 1684 }
5032d1cf 1685return cutthrough.addr.message;
e4bdf652
JH
1686}
1687
1688
817d9f57 1689
059ec3d9
PH
1690/*************************************************
1691* Copy error to toplevel address *
1692*************************************************/
1693
1694/* This function is used when a verify fails or defers, to ensure that the
1695failure or defer information is in the original toplevel address. This applies
1696when an address is redirected to a single new address, and the failure or
1697deferral happens to the child address.
1698
1699Arguments:
1700 vaddr the verify address item
1701 addr the final address item
1702 yield FAIL or DEFER
1703
1704Returns: the value of YIELD
1705*/
1706
1707static int
1708copy_error(address_item *vaddr, address_item *addr, int yield)
1709{
1710if (addr != vaddr)
1711 {
1712 vaddr->message = addr->message;
1713 vaddr->user_message = addr->user_message;
1714 vaddr->basic_errno = addr->basic_errno;
1715 vaddr->more_errno = addr->more_errno;
d43cbe25 1716 vaddr->prop.address_data = addr->prop.address_data;
42855d71 1717 copyflag(vaddr, addr, af_pass_message);
059ec3d9
PH
1718 }
1719return yield;
1720}
1721
1722
1723
1724
ce552449
NM
1725/**************************************************
1726* printf that automatically handles TLS if needed *
1727***************************************************/
1728
1729/* This function is used by verify_address() as a substitute for all fprintf()
1730calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1731as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1732that assumes that we always use the smtp_out FILE* when not using TLS or the
1733ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1734that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1735fprintf().
1736
1737Arguments:
1738 f the candidate FILE* to write to
1739 format format string
1740 ... optional arguments
1741
1742Returns:
1743 nothing
1744*/
1745
1746static void PRINTF_FUNCTION(2,3)
1ba28e2b 1747respond_printf(FILE *f, const char *format, ...)
ce552449
NM
1748{
1749va_list ap;
1750
1751va_start(ap, format);
1752if (smtp_out && (f == smtp_out))
1753 smtp_vprintf(format, ap);
1754else
513afc6a 1755 vfprintf(f, format, ap);
ce552449
NM
1756va_end(ap);
1757}
1758
1759
1760
059ec3d9
PH
1761/*************************************************
1762* Verify an email address *
1763*************************************************/
1764
1765/* This function is used both for verification (-bv and at other times) and
1766address testing (-bt), which is indicated by address_test_mode being set.
1767
1768Arguments:
1769 vaddr contains the address to verify; the next field in this block
1770 must be NULL
1771 f if not NULL, write the result to this file
1772 options various option bits:
1773 vopt_fake_sender => this sender verify is not for the real
1774 sender (it was verify=sender=xxxx or an address from a
1775 header line) - rewriting must not change sender_address
1776 vopt_is_recipient => this is a recipient address, otherwise
1777 it's a sender address - this affects qualification and
1778 rewriting and messages from callouts
1779 vopt_qualify => qualify an unqualified address; else error
1780 vopt_expn => called from SMTP EXPN command
eafd343b
TK
1781 vopt_success_on_redirect => when a new address is generated
1782 the verification instantly succeeds
059ec3d9
PH
1783
1784 These ones are used by do_callout() -- the options variable
1785 is passed to it.
1786
2a4be8f9 1787 vopt_callout_fullpm => if postmaster check, do full one
059ec3d9
PH
1788 vopt_callout_no_cache => don't use callout cache
1789 vopt_callout_random => do the "random" thing
1790 vopt_callout_recipsender => use real sender for recipient
1791 vopt_callout_recippmaster => use postmaster for recipient
1792
1793 callout if > 0, specifies that callout is required, and gives timeout
4deaf07d 1794 for individual commands
059ec3d9
PH
1795 callout_overall if > 0, gives overall timeout for the callout function;
1796 if < 0, a default is used (see do_callout())
8e669ac1 1797 callout_connect the connection timeout for callouts
059ec3d9
PH
1798 se_mailfrom when callout is requested to verify a sender, use this
1799 in MAIL FROM; NULL => ""
1800 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1801 thing and use this as the sender address (may be "")
1802
1803 routed if not NULL, set TRUE if routing succeeded, so we can
1804 distinguish between routing failed and callout failed
1805
1806Returns: OK address verified
1807 FAIL address failed to verify
1808 DEFER can't tell at present
1809*/
1810
1811int
1812verify_address(address_item *vaddr, FILE *f, int options, int callout,
8e669ac1 1813 int callout_overall, int callout_connect, uschar *se_mailfrom,
4deaf07d 1814 uschar *pm_mailfrom, BOOL *routed)
059ec3d9
PH
1815{
1816BOOL allok = TRUE;
1817BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
1818BOOL is_recipient = (options & vopt_is_recipient) != 0;
1819BOOL expn = (options & vopt_expn) != 0;
eafd343b 1820BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
059ec3d9
PH
1821int i;
1822int yield = OK;
1823int verify_type = expn? v_expn :
1824 address_test_mode? v_none :
1825 is_recipient? v_recipient : v_sender;
1826address_item *addr_list;
1827address_item *addr_new = NULL;
1828address_item *addr_remote = NULL;
1829address_item *addr_local = NULL;
1830address_item *addr_succeed = NULL;
8e669ac1 1831uschar **failure_ptr = is_recipient?
2c7db3f5 1832 &recipient_verify_failure : &sender_verify_failure;
059ec3d9
PH
1833uschar *ko_prefix, *cr;
1834uschar *address = vaddr->address;
1835uschar *save_sender;
1836uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1837
2c7db3f5
PH
1838/* Clear, just in case */
1839
1840*failure_ptr = NULL;
1841
059ec3d9
PH
1842/* Set up a prefix and suffix for error message which allow us to use the same
1843output statements both in EXPN mode (where an SMTP response is needed) and when
1844debugging with an output file. */
1845
1846if (expn)
1847 {
1848 ko_prefix = US"553 ";
1849 cr = US"\r";
1850 }
1851else ko_prefix = cr = US"";
1852
1853/* Add qualify domain if permitted; otherwise an unqualified address fails. */
1854
1855if (parse_find_at(address) == NULL)
1856 {
1857 if ((options & vopt_qualify) == 0)
1858 {
1859 if (f != NULL)
ce552449
NM
1860 respond_printf(f, "%sA domain is required for \"%s\"%s\n",
1861 ko_prefix, address, cr);
8e669ac1 1862 *failure_ptr = US"qualify";
059ec3d9
PH
1863 return FAIL;
1864 }
1865 address = rewrite_address_qualify(address, is_recipient);
1866 }
1867
1868DEBUG(D_verify)
1869 {
1870 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1871 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
1872 }
1873
1874/* Rewrite and report on it. Clear the domain and local part caches - these
1875may have been set by domains and local part tests during an ACL. */
1876
1877if (global_rewrite_rules != NULL)
1878 {
1879 uschar *old = address;
1880 address = rewrite_address(address, is_recipient, FALSE,
1881 global_rewrite_rules, rewrite_existflags);
1882 if (address != old)
1883 {
1884 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1885 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1886 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
1887 }
1888 }
1889
1890/* If this is the real sender address, we must update sender_address at
1891this point, because it may be referred to in the routers. */
1892
1893if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
1894 sender_address = address;
1895
1896/* If the address was rewritten to <> no verification can be done, and we have
1897to return OK. This rewriting is permitted only for sender addresses; for other
1898addresses, such rewriting fails. */
1899
1900if (address[0] == 0) return OK;
1901
d9b2312b
JH
1902/* Flip the legacy TLS-related variables over to the outbound set in case
1903they're used in the context of a transport used by verification. Reset them
1904at exit from this routine. */
1905
35aba663 1906tls_modify_variables(&tls_out);
d9b2312b 1907
059ec3d9
PH
1908/* Save a copy of the sender address for re-instating if we change it to <>
1909while verifying a sender address (a nice bit of self-reference there). */
1910
1911save_sender = sender_address;
1912
1913/* Update the address structure with the possibly qualified and rewritten
1914address. Set it up as the starting address on the chain of new addresses. */
1915
1916vaddr->address = address;
1917addr_new = vaddr;
1918
1919/* We need a loop, because an address can generate new addresses. We must also
1920cope with generated pipes and files at the top level. (See also the code and
1921comment in deliver.c.) However, it is usually the case that the router for
1922user's .forward files has its verify flag turned off.
1923
1924If an address generates more than one child, the loop is used only when
1925full_info is set, and this can only be set locally. Remote enquiries just get
1926information about the top level address, not anything that it generated. */
1927
1928while (addr_new != NULL)
1929 {
1930 int rc;
1931 address_item *addr = addr_new;
1932
1933 addr_new = addr->next;
1934 addr->next = NULL;
1935
1936 DEBUG(D_verify)
1937 {
1938 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1939 debug_printf("Considering %s\n", addr->address);
1940 }
1941
1942 /* Handle generated pipe, file or reply addresses. We don't get these
1943 when handling EXPN, as it does only one level of expansion. */
1944
1945 if (testflag(addr, af_pfr))
1946 {
1947 allok = FALSE;
1948 if (f != NULL)
1949 {
1950 BOOL allow;
1951
1952 if (addr->address[0] == '>')
1953 {
1954 allow = testflag(addr, af_allow_reply);
1955 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1956 }
1957 else
1958 {
1959 allow = (addr->address[0] == '|')?
1960 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1961 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1962 }
1963
1964 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1965 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1966 "%s\n", addr->message);
1967 else if (allow)
1968 fprintf(f, "\n transport = %s\n", addr->transport->name);
1969 else
1970 fprintf(f, " *** forbidden ***\n");
1971 }
1972 continue;
1973 }
1974
1975 /* Just in case some router parameter refers to it. */
1976
d43cbe25
JH
1977 return_path = (addr->prop.errors_address != NULL)?
1978 addr->prop.errors_address : sender_address;
059ec3d9
PH
1979
1980 /* Split the address into domain and local part, handling the %-hack if
1981 necessary, and then route it. While routing a sender address, set
1982 $sender_address to <> because that is what it will be if we were trying to
1983 send a bounce to the sender. */
1984
1985 if (routed != NULL) *routed = FALSE;
1986 if ((rc = deliver_split_address(addr)) == OK)
1987 {
1988 if (!is_recipient) sender_address = null_sender;
1989 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1990 &addr_succeed, verify_type);
1991 sender_address = save_sender; /* Put back the real sender */
1992 }
1993
1994 /* If routing an address succeeded, set the flag that remembers, for use when
1995 an ACL cached a sender verify (in case a callout fails). Then if routing set
1996 up a list of hosts or the transport has a host list, and the callout option
1997 is set, and we aren't in a host checking run, do the callout verification,
1998 and set another flag that notes that a callout happened. */
1999
2000 if (rc == OK)
2001 {
2002 if (routed != NULL) *routed = TRUE;
2003 if (callout > 0)
2004 {
2005 host_item *host_list = addr->host_list;
2006
26da7e20
PH
2007 /* Make up some data for use in the case where there is no remote
2008 transport. */
2009
2010 transport_feedback tf = {
2011 NULL, /* interface (=> any) */
2012 US"smtp", /* port */
2013 US"smtp", /* protocol */
2014 NULL, /* hosts */
2015 US"$smtp_active_hostname", /* helo_data */
2016 FALSE, /* hosts_override */
2017 FALSE, /* hosts_randomize */
2018 FALSE, /* gethostbyname */
2019 TRUE, /* qualify_single */
2020 FALSE /* search_parents */
2021 };
059ec3d9
PH
2022
2023 /* If verification yielded a remote transport, we want to use that
2024 transport's options, so as to mimic what would happen if we were really
2025 sending a message to this address. */
2026
2027 if (addr->transport != NULL && !addr->transport->info->local)
2028 {
929ba01c 2029 (void)(addr->transport->setup)(addr->transport, addr, &tf, 0, 0, NULL);
059ec3d9
PH
2030
2031 /* If the transport has hosts and the router does not, or if the
2032 transport is configured to override the router's hosts, we must build a
2033 host list of the transport's hosts, and find the IP addresses */
2034
2035 if (tf.hosts != NULL && (host_list == NULL || tf.hosts_override))
2036 {
2037 uschar *s;
55414b25 2038 const uschar *save_deliver_domain = deliver_domain;
750af86e 2039 uschar *save_deliver_localpart = deliver_localpart;
059ec3d9
PH
2040
2041 host_list = NULL; /* Ignore the router's hosts */
2042
2043 deliver_domain = addr->domain;
2044 deliver_localpart = addr->local_part;
2045 s = expand_string(tf.hosts);
750af86e
PH
2046 deliver_domain = save_deliver_domain;
2047 deliver_localpart = save_deliver_localpart;
059ec3d9
PH
2048
2049 if (s == NULL)
2050 {
2051 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
2052 "\"%s\" in %s transport for callout: %s", tf.hosts,
2053 addr->transport->name, expand_string_message);
2054 }
2055 else
2056 {
322050c2 2057 int flags;
d8ef3577 2058 host_item *host, *nexthost;
059ec3d9
PH
2059 host_build_hostlist(&host_list, s, tf.hosts_randomize);
2060
2061 /* Just ignore failures to find a host address. If we don't manage
8e669ac1
PH
2062 to find any addresses, the callout will defer. Note that more than
2063 one address may be found for a single host, which will result in
2064 additional host items being inserted into the chain. Hence we must
d8ef3577 2065 save the next host first. */
059ec3d9 2066
322050c2
PH
2067 flags = HOST_FIND_BY_A;
2068 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
2069 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
2070
d8ef3577 2071 for (host = host_list; host != NULL; host = nexthost)
059ec3d9 2072 {
d8ef3577 2073 nexthost = host->next;
8e669ac1 2074 if (tf.gethostbyname ||
7e66e54d 2075 string_is_ip_address(host->name, NULL) != 0)
55414b25 2076 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
059ec3d9 2077 else
9d9c3746 2078 {
7cd171b7 2079 dnssec_domains * dnssec_domains = NULL;
9d9c3746
JH
2080 if (Ustrcmp(addr->transport->driver_name, "smtp") == 0)
2081 {
2082 smtp_transport_options_block * ob =
2083 (smtp_transport_options_block *)
2084 addr->transport->options_block;
7cd171b7 2085 dnssec_domains = &ob->dnssec;
9d9c3746
JH
2086 }
2087
059ec3d9 2088 (void)host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
7cd171b7 2089 dnssec_domains, NULL, NULL);
9d9c3746 2090 }
059ec3d9
PH
2091 }
2092 }
2093 }
2094 }
2095
8e669ac1 2096 /* Can only do a callout if we have at least one host! If the callout
2c7db3f5 2097 fails, it will have set ${sender,recipient}_verify_failure. */
059ec3d9
PH
2098
2099 if (host_list != NULL)
2100 {
2101 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
2102 if (host_checking && !host_checking_callout)
2103 {
2104 HDEBUG(D_verify)
2105 debug_printf("... callout omitted by default when host testing\n"
2106 "(Use -bhc if you want the callouts to happen.)\n");
2107 }
2108 else
2109 {
4ed8d31a
JH
2110#ifdef SUPPORT_TLS
2111 deliver_set_expansions(addr);
2112#endif
aec45841 2113 verify_mode = is_recipient ? US"R" : US"S";
059ec3d9 2114 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
4deaf07d 2115 callout_connect, options, se_mailfrom, pm_mailfrom);
aec45841 2116 verify_mode = NULL;
059ec3d9
PH
2117 }
2118 }
2119 else
2120 {
2121 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
2122 "transport provided a host list\n");
2123 }
2124 }
2125 }
8e669ac1 2126
2c7db3f5 2127 /* Otherwise, any failure is a routing failure */
8e669ac1
PH
2128
2129 else *failure_ptr = US"route";
059ec3d9
PH
2130
2131 /* A router may return REROUTED if it has set up a child address as a result
2132 of a change of domain name (typically from widening). In this case we always
2133 want to continue to verify the new child. */
2134
2135 if (rc == REROUTED) continue;
8e669ac1 2136
059ec3d9
PH
2137 /* Handle hard failures */
2138
2139 if (rc == FAIL)
2140 {
2141 allok = FALSE;
2142 if (f != NULL)
2143 {
e6f6568e
PH
2144 address_item *p = addr->parent;
2145
ce552449
NM
2146 respond_printf(f, "%s%s %s", ko_prefix,
2147 full_info? addr->address : address,
059ec3d9
PH
2148 address_test_mode? "is undeliverable" : "failed to verify");
2149 if (!expn && admin_user)
2150 {
2151 if (addr->basic_errno > 0)
ce552449 2152 respond_printf(f, ": %s", strerror(addr->basic_errno));
059ec3d9 2153 if (addr->message != NULL)
ce552449 2154 respond_printf(f, ": %s", addr->message);
e6f6568e
PH
2155 }
2156
2157 /* Show parents iff doing full info */
2158
2159 if (full_info) while (p != NULL)
2160 {
ce552449 2161 respond_printf(f, "%s\n <-- %s", cr, p->address);
e6f6568e 2162 p = p->parent;
059ec3d9 2163 }
ce552449 2164 respond_printf(f, "%s\n", cr);
059ec3d9 2165 }
2e5b33cd 2166 cancel_cutthrough_connection("routing hard fail");
059ec3d9 2167
d9b2312b
JH
2168 if (!full_info)
2169 {
2170 yield = copy_error(vaddr, addr, FAIL);
2171 goto out;
2172 }
2173 else yield = FAIL;
059ec3d9
PH
2174 }
2175
2176 /* Soft failure */
2177
2178 else if (rc == DEFER)
2179 {
2180 allok = FALSE;
2181 if (f != NULL)
2182 {
e6f6568e 2183 address_item *p = addr->parent;
ce552449 2184 respond_printf(f, "%s%s cannot be resolved at this time", ko_prefix,
322050c2 2185 full_info? addr->address : address);
059ec3d9
PH
2186 if (!expn && admin_user)
2187 {
2188 if (addr->basic_errno > 0)
ce552449 2189 respond_printf(f, ": %s", strerror(addr->basic_errno));
059ec3d9 2190 if (addr->message != NULL)
ce552449 2191 respond_printf(f, ": %s", addr->message);
059ec3d9 2192 else if (addr->basic_errno <= 0)
ce552449 2193 respond_printf(f, ": unknown error");
059ec3d9
PH
2194 }
2195
e6f6568e
PH
2196 /* Show parents iff doing full info */
2197
2198 if (full_info) while (p != NULL)
2199 {
ce552449 2200 respond_printf(f, "%s\n <-- %s", cr, p->address);
e6f6568e
PH
2201 p = p->parent;
2202 }
ce552449 2203 respond_printf(f, "%s\n", cr);
059ec3d9 2204 }
2e5b33cd 2205 cancel_cutthrough_connection("routing soft fail");
e4bdf652 2206
d9b2312b
JH
2207 if (!full_info)
2208 {
2209 yield = copy_error(vaddr, addr, DEFER);
2210 goto out;
2211 }
2212 else if (yield == OK) yield = DEFER;
059ec3d9
PH
2213 }
2214
2215 /* If we are handling EXPN, we do not want to continue to route beyond
e6f6568e 2216 the top level (whose address is in "address"). */
059ec3d9
PH
2217
2218 else if (expn)
2219 {
2220 uschar *ok_prefix = US"250-";
2221 if (addr_new == NULL)
2222 {
2223 if (addr_local == NULL && addr_remote == NULL)
ce552449 2224 respond_printf(f, "250 mail to <%s> is discarded\r\n", address);
059ec3d9 2225 else
ce552449 2226 respond_printf(f, "250 <%s>\r\n", address);
059ec3d9
PH
2227 }
2228 else while (addr_new != NULL)
2229 {
2230 address_item *addr2 = addr_new;
2231 addr_new = addr2->next;
2232 if (addr_new == NULL) ok_prefix = US"250 ";
ce552449 2233 respond_printf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
059ec3d9 2234 }
d9b2312b
JH
2235 yield = OK;
2236 goto out;
059ec3d9
PH
2237 }
2238
2239 /* Successful routing other than EXPN. */
2240
2241 else
2242 {
2243 /* Handle successful routing when short info wanted. Otherwise continue for
2244 other (generated) addresses. Short info is the operational case. Full info
2245 can be requested only when debug_selector != 0 and a file is supplied.
2246
2247 There is a conflict between the use of aliasing as an alternate email
2248 address, and as a sort of mailing list. If an alias turns the incoming
2249 address into just one address (e.g. J.Caesar->jc44) you may well want to
2250 carry on verifying the generated address to ensure it is valid when
2251 checking incoming mail. If aliasing generates multiple addresses, you
2252 probably don't want to do this. Exim therefore treats the generation of
2253 just a single new address as a special case, and continues on to verify the
2254 generated address. */
2255
2256 if (!full_info && /* Stop if short info wanted AND */
eafd343b
TK
2257 (((addr_new == NULL || /* No new address OR */
2258 addr_new->next != NULL || /* More than one new address OR */
2259 testflag(addr_new, af_pfr))) /* New address is pfr */
2260 || /* OR */
2261 (addr_new != NULL && /* At least one new address AND */
2262 success_on_redirect))) /* success_on_redirect is set */
059ec3d9 2263 {
322050c2 2264 if (f != NULL) fprintf(f, "%s %s\n", address,
059ec3d9
PH
2265 address_test_mode? "is deliverable" : "verified");
2266
2267 /* If we have carried on to verify a child address, we want the value
2268 of $address_data to be that of the child */
2269
d43cbe25 2270 vaddr->prop.address_data = addr->prop.address_data;
d9b2312b
JH
2271 yield = OK;
2272 goto out;
059ec3d9
PH
2273 }
2274 }
2275 } /* Loop for generated addresses */
2276
2277/* Display the full results of the successful routing, including any generated
2278addresses. Control gets here only when full_info is set, which requires f not
2279to be NULL, and this occurs only when a top-level verify is called with the
2280debugging switch on.
2281
2282If there are no local and no remote addresses, and there were no pipes, files,
2283or autoreplies, and there were no errors or deferments, the message is to be
2284discarded, usually because of the use of :blackhole: in an alias file. */
2285
2286if (allok && addr_local == NULL && addr_remote == NULL)
dbcef0ea 2287 {
059ec3d9 2288 fprintf(f, "mail to %s is discarded\n", address);
d9b2312b 2289 goto out;
dbcef0ea 2290 }
059ec3d9 2291
dbcef0ea 2292for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
059ec3d9
PH
2293 {
2294 while (addr_list != NULL)
2295 {
2296 address_item *addr = addr_list;
2297 address_item *p = addr->parent;
2298 addr_list = addr->next;
2299
2300 fprintf(f, "%s", CS addr->address);
384152a6 2301#ifdef EXPERIMENTAL_SRS
d43cbe25
JH
2302 if(addr->prop.srs_sender)
2303 fprintf(f, " [srs = %s]", addr->prop.srs_sender);
384152a6 2304#endif
dbcef0ea
PH
2305
2306 /* If the address is a duplicate, show something about it. */
2307
2308 if (!testflag(addr, af_pfr))
2309 {
2310 tree_node *tnode;
2311 if ((tnode = tree_search(tree_duplicates, addr->unique)) != NULL)
2312 fprintf(f, " [duplicate, would not be delivered]");
2313 else tree_add_duplicate(addr->unique, addr);
2314 }
2315
2316 /* Now show its parents */
2317
059ec3d9
PH
2318 while (p != NULL)
2319 {
2320 fprintf(f, "\n <-- %s", p->address);
2321 p = p->parent;
2322 }
2323 fprintf(f, "\n ");
2324
2325 /* Show router, and transport */
2326
2327 fprintf(f, "router = %s, ", addr->router->name);
2328 fprintf(f, "transport = %s\n", (addr->transport == NULL)? US"unset" :
2329 addr->transport->name);
2330
2331 /* Show any hosts that are set up by a router unless the transport
2332 is going to override them; fiddle a bit to get a nice format. */
2333
2334 if (addr->host_list != NULL && addr->transport != NULL &&
2335 !addr->transport->overrides_hosts)
2336 {
2337 host_item *h;
2338 int maxlen = 0;
2339 int maxaddlen = 0;
2340 for (h = addr->host_list; h != NULL; h = h->next)
2341 {
2342 int len = Ustrlen(h->name);
2343 if (len > maxlen) maxlen = len;
2344 len = (h->address != NULL)? Ustrlen(h->address) : 7;
2345 if (len > maxaddlen) maxaddlen = len;
2346 }
2347 for (h = addr->host_list; h != NULL; h = h->next)
2348 {
2349 int len = Ustrlen(h->name);
2350 fprintf(f, " host %s ", h->name);
2351 while (len++ < maxlen) fprintf(f, " ");
2352 if (h->address != NULL)
2353 {
2354 fprintf(f, "[%s] ", h->address);
2355 len = Ustrlen(h->address);
2356 }
2357 else if (!addr->transport->info->local) /* Omit [unknown] for local */
2358 {
2359 fprintf(f, "[unknown] ");
2360 len = 7;
2361 }
2362 else len = -3;
2363 while (len++ < maxaddlen) fprintf(f," ");
2364 if (h->mx >= 0) fprintf(f, "MX=%d", h->mx);
2365 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
b77f4a14 2366 if (running_in_test_harness)
ded5de15
HSHR
2367#ifndef DISABLE_DNSSEC
2368 fprintf(f, " ad=%s", h->dnssec==DS_YES ? "yes" : "no");
2369#else
2370 fprintf(f, " ad=no");
2371#endif
059ec3d9
PH
2372 if (h->status == hstatus_unusable) fprintf(f, " ** unusable **");
2373 fprintf(f, "\n");
2374 }
2375 }
2376 }
2377 }
2378
d9b2312b 2379/* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2c7db3f5
PH
2380the -bv or -bt case). */
2381
d9b2312b 2382out:
35aba663 2383tls_modify_variables(&tls_in);
d9b2312b 2384
8e669ac1 2385return yield;
059ec3d9
PH
2386}
2387
2388
2389
2390
2391/*************************************************
2392* Check headers for syntax errors *
2393*************************************************/
2394
2395/* This function checks those header lines that contain addresses, and verifies
2396that all the addresses therein are syntactially correct.
2397
2398Arguments:
2399 msgptr where to put an error message
2400
2401Returns: OK
2402 FAIL
2403*/
2404
2405int
2406verify_check_headers(uschar **msgptr)
2407{
2408header_line *h;
2409uschar *colon, *s;
1eccaa59 2410int yield = OK;
059ec3d9 2411
1eccaa59 2412for (h = header_list; h != NULL && yield == OK; h = h->next)
059ec3d9
PH
2413 {
2414 if (h->type != htype_from &&
2415 h->type != htype_reply_to &&
2416 h->type != htype_sender &&
2417 h->type != htype_to &&
2418 h->type != htype_cc &&
2419 h->type != htype_bcc)
2420 continue;
2421
2422 colon = Ustrchr(h->text, ':');
2423 s = colon + 1;
2424 while (isspace(*s)) s++;
2425
1eccaa59
PH
2426 /* Loop for multiple addresses in the header, enabling group syntax. Note
2427 that we have to reset this after the header has been scanned. */
059ec3d9 2428
1eccaa59 2429 parse_allow_group = TRUE;
059ec3d9
PH
2430
2431 while (*s != 0)
2432 {
2433 uschar *ss = parse_find_address_end(s, FALSE);
2434 uschar *recipient, *errmess;
2435 int terminator = *ss;
2436 int start, end, domain;
2437
2438 /* Temporarily terminate the string at this point, and extract the
1eccaa59 2439 operative address within, allowing group syntax. */
059ec3d9
PH
2440
2441 *ss = 0;
2442 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2443 *ss = terminator;
2444
2445 /* Permit an unqualified address only if the message is local, or if the
2446 sending host is configured to be permitted to send them. */
2447
2448 if (recipient != NULL && domain == 0)
2449 {
2450 if (h->type == htype_from || h->type == htype_sender)
2451 {
2452 if (!allow_unqualified_sender) recipient = NULL;
2453 }
2454 else
2455 {
2456 if (!allow_unqualified_recipient) recipient = NULL;
2457 }
2458 if (recipient == NULL) errmess = US"unqualified address not permitted";
2459 }
2460
2461 /* It's an error if no address could be extracted, except for the special
2462 case of an empty address. */
2463
2464 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
2465 {
2466 uschar *verb = US"is";
2467 uschar *t = ss;
1ab95fa6 2468 uschar *tt = colon;
059ec3d9
PH
2469 int len;
2470
2471 /* Arrange not to include any white space at the end in the
1ab95fa6 2472 error message or the header name. */
059ec3d9
PH
2473
2474 while (t > s && isspace(t[-1])) t--;
1ab95fa6 2475 while (tt > h->text && isspace(tt[-1])) tt--;
059ec3d9 2476
1ab95fa6 2477 /* Add the address that failed to the error message, since in a
059ec3d9
PH
2478 header with very many addresses it is sometimes hard to spot
2479 which one is at fault. However, limit the amount of address to
2480 quote - cases have been seen where, for example, a missing double
2481 quote in a humungous To: header creates an "address" that is longer
2482 than string_sprintf can handle. */
2483
2484 len = t - s;
2485 if (len > 1024)
2486 {
2487 len = 1024;
2488 verb = US"begins";
2489 }
2490
55414b25
JH
2491 /* deconst cast ok as we're passing a non-const to string_printing() */
2492 *msgptr = US string_printing(
1ab95fa6
PH
2493 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2494 errmess, tt - h->text, h->text, verb, len, s));
059ec3d9 2495
1eccaa59
PH
2496 yield = FAIL;
2497 break; /* Out of address loop */
059ec3d9
PH
2498 }
2499
2500 /* Advance to the next address */
2501
2502 s = ss + (terminator? 1:0);
2503 while (isspace(*s)) s++;
2504 } /* Next address */
059ec3d9 2505
1eccaa59
PH
2506 parse_allow_group = FALSE;
2507 parse_found_group = FALSE;
2508 } /* Next header unless yield has been set FALSE */
2509
2510return yield;
059ec3d9
PH
2511}
2512
2513
770747fd
MFM
2514/*************************************************
2515* Check header names for 8-bit characters *
2516*************************************************/
2517
2518/* This function checks for invalid charcters in header names. See
2519RFC 5322, 2.2. and RFC 6532, 3.
2520
2521Arguments:
2522 msgptr where to put an error message
2523
2524Returns: OK
2525 FAIL
2526*/
2527
2528int
2529verify_check_header_names_ascii(uschar **msgptr)
2530{
2531header_line *h;
2532uschar *colon, *s;
2533
2534for (h = header_list; h != NULL; h = h->next)
2535 {
2536 colon = Ustrchr(h->text, ':');
2537 for(s = h->text; s < colon; s++)
2538 {
2539 if ((*s < 33) || (*s > 126))
2540 {
2541 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2542 colon - h->text, h->text);
2543 return FAIL;
2544 }
2545 }
2546 }
2547return OK;
2548}
059ec3d9 2549
1c41c9cc
PH
2550/*************************************************
2551* Check for blind recipients *
2552*************************************************/
2553
2554/* This function checks that every (envelope) recipient is mentioned in either
2555the To: or Cc: header lines, thus detecting blind carbon copies.
2556
2557There are two ways of scanning that could be used: either scan the header lines
2558and tick off the recipients, or scan the recipients and check the header lines.
2559The original proposed patch did the former, but I have chosen to do the latter,
2560because (a) it requires no memory and (b) will use fewer resources when there
2561are many addresses in To: and/or Cc: and only one or two envelope recipients.
2562
2563Arguments: none
2564Returns: OK if there are no blind recipients
2565 FAIL if there is at least one blind recipient
2566*/
2567
2568int
2569verify_check_notblind(void)
2570{
2571int i;
2572for (i = 0; i < recipients_count; i++)
2573 {
2574 header_line *h;
2575 BOOL found = FALSE;
2576 uschar *address = recipients_list[i].address;
2577
2578 for (h = header_list; !found && h != NULL; h = h->next)
2579 {
2580 uschar *colon, *s;
2581
2582 if (h->type != htype_to && h->type != htype_cc) continue;
2583
2584 colon = Ustrchr(h->text, ':');
2585 s = colon + 1;
2586 while (isspace(*s)) s++;
2587
1eccaa59
PH
2588 /* Loop for multiple addresses in the header, enabling group syntax. Note
2589 that we have to reset this after the header has been scanned. */
1c41c9cc 2590
1eccaa59 2591 parse_allow_group = TRUE;
1c41c9cc
PH
2592
2593 while (*s != 0)
2594 {
2595 uschar *ss = parse_find_address_end(s, FALSE);
2596 uschar *recipient,*errmess;
2597 int terminator = *ss;
2598 int start, end, domain;
2599
2600 /* Temporarily terminate the string at this point, and extract the
1eccaa59 2601 operative address within, allowing group syntax. */
1c41c9cc
PH
2602
2603 *ss = 0;
2604 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2605 *ss = terminator;
2606
2607 /* If we found a valid recipient that has a domain, compare it with the
2608 envelope recipient. Local parts are compared case-sensitively, domains
2609 case-insensitively. By comparing from the start with length "domain", we
2610 include the "@" at the end, which ensures that we are comparing the whole
2611 local part of each address. */
2612
2613 if (recipient != NULL && domain != 0)
2614 {
2615 found = Ustrncmp(recipient, address, domain) == 0 &&
2616 strcmpic(recipient + domain, address + domain) == 0;
2617 if (found) break;
2618 }
2619
2620 /* Advance to the next address */
2621
2622 s = ss + (terminator? 1:0);
2623 while (isspace(*s)) s++;
2624 } /* Next address */
1eccaa59
PH
2625
2626 parse_allow_group = FALSE;
2627 parse_found_group = FALSE;
1c41c9cc
PH
2628 } /* Next header (if found is false) */
2629
2630 if (!found) return FAIL;
2631 } /* Next recipient */
2632
2633return OK;
2634}
2635
2636
059ec3d9
PH
2637
2638/*************************************************
2639* Find if verified sender *
2640*************************************************/
2641
2642/* Usually, just a single address is verified as the sender of the message.
2643However, Exim can be made to verify other addresses as well (often related in
2644some way), and this is useful in some environments. There may therefore be a
2645chain of such addresses that have previously been tested. This function finds
2646whether a given address is on the chain.
2647
2648Arguments: the address to be verified
2649Returns: pointer to an address item, or NULL
2650*/
2651
2652address_item *
2653verify_checked_sender(uschar *sender)
2654{
2655address_item *addr;
2656for (addr = sender_verified_list; addr != NULL; addr = addr->next)
2657 if (Ustrcmp(sender, addr->address) == 0) break;
2658return addr;
2659}
2660
2661
2662
2663
2664
2665/*************************************************
2666* Get valid header address *
2667*************************************************/
2668
2669/* Scan the originator headers of the message, looking for an address that
2670verifies successfully. RFC 822 says:
2671
2672 o The "Sender" field mailbox should be sent notices of
2673 any problems in transport or delivery of the original
2674 messages. If there is no "Sender" field, then the
2675 "From" field mailbox should be used.
2676
2677 o If the "Reply-To" field exists, then the reply should
2678 go to the addresses indicated in that field and not to
2679 the address(es) indicated in the "From" field.
2680
2681So we check a Sender field if there is one, else a Reply_to field, else a From
2682field. As some strange messages may have more than one of these fields,
2683especially if they are resent- fields, check all of them if there is more than
2684one.
2685
2686Arguments:
2687 user_msgptr points to where to put a user error message
2688 log_msgptr points to where to put a log error message
2689 callout timeout for callout check (passed to verify_address())
2690 callout_overall overall callout timeout (ditto)
8e669ac1 2691 callout_connect connect callout timeout (ditto)
059ec3d9
PH
2692 se_mailfrom mailfrom for verify; NULL => ""
2693 pm_mailfrom sender for pm callout check (passed to verify_address())
2694 options callout options (passed to verify_address())
8e669ac1 2695 verrno where to put the address basic_errno
059ec3d9
PH
2696
2697If log_msgptr is set to something without setting user_msgptr, the caller
2698normally uses log_msgptr for both things.
2699
2700Returns: result of the verification attempt: OK, FAIL, or DEFER;
2701 FAIL is given if no appropriate headers are found
2702*/
2703
2704int
2705verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
8e669ac1 2706 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
fe5b5d0b 2707 uschar *pm_mailfrom, int options, int *verrno)
059ec3d9
PH
2708{
2709static int header_types[] = { htype_sender, htype_reply_to, htype_from };
1eccaa59 2710BOOL done = FALSE;
059ec3d9
PH
2711int yield = FAIL;
2712int i;
2713
1eccaa59 2714for (i = 0; i < 3 && !done; i++)
059ec3d9
PH
2715 {
2716 header_line *h;
1eccaa59 2717 for (h = header_list; h != NULL && !done; h = h->next)
059ec3d9
PH
2718 {
2719 int terminator, new_ok;
2720 uschar *s, *ss, *endname;
2721
2722 if (h->type != header_types[i]) continue;
2723 s = endname = Ustrchr(h->text, ':') + 1;
2724
1eccaa59
PH
2725 /* Scan the addresses in the header, enabling group syntax. Note that we
2726 have to reset this after the header has been scanned. */
2727
2728 parse_allow_group = TRUE;
2729
059ec3d9
PH
2730 while (*s != 0)
2731 {
2732 address_item *vaddr;
2733
2734 while (isspace(*s) || *s == ',') s++;
2735 if (*s == 0) break; /* End of header */
2736
2737 ss = parse_find_address_end(s, FALSE);
2738
2739 /* The terminator is a comma or end of header, but there may be white
2740 space preceding it (including newline for the last address). Move back
2741 past any white space so we can check against any cached envelope sender
2742 address verifications. */
2743
2744 while (isspace(ss[-1])) ss--;
2745 terminator = *ss;
2746 *ss = 0;
2747
2748 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2749 (int)(endname - h->text), h->text, s);
2750
2751 /* See if we have already verified this address as an envelope sender,
2752 and if so, use the previous answer. */
2753
2754 vaddr = verify_checked_sender(s);
2755
2756 if (vaddr != NULL && /* Previously checked */
2757 (callout <= 0 || /* No callout needed; OR */
2758 vaddr->special_action > 256)) /* Callout was done */
2759 {
2760 new_ok = vaddr->special_action & 255;
2761 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2762 *ss = terminator; /* Restore shortened string */
2763 }
2764
2765 /* Otherwise we run the verification now. We must restore the shortened
2766 string before running the verification, so the headers are correct, in
2767 case there is any rewriting. */
2768
2769 else
2770 {
2771 int start, end, domain;
1eccaa59
PH
2772 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2773 &domain, FALSE);
059ec3d9
PH
2774
2775 *ss = terminator;
2776
1eccaa59
PH
2777 /* If we found an empty address, just carry on with the next one, but
2778 kill the message. */
2779
2780 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2781 {
2782 *log_msgptr = NULL;
2783 s = ss;
2784 continue;
2785 }
2786
059ec3d9
PH
2787 /* If verification failed because of a syntax error, fail this
2788 function, and ensure that the failing address gets added to the error
2789 message. */
2790
2791 if (address == NULL)
2792 {
2793 new_ok = FAIL;
1eccaa59
PH
2794 while (ss > s && isspace(ss[-1])) ss--;
2795 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2796 "scanning for sender: %s in \"%.*s\"",
2797 endname - h->text, h->text, *log_msgptr, ss - s, s);
2798 yield = FAIL;
2799 done = TRUE;
2800 break;
059ec3d9
PH
2801 }
2802
2f6603e1 2803 /* Else go ahead with the sender verification. But it isn't *the*
059ec3d9
PH
2804 sender of the message, so set vopt_fake_sender to stop sender_address
2805 being replaced after rewriting or qualification. */
2806
2807 else
2808 {
2809 vaddr = deliver_make_addr(address, FALSE);
2810 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
8e669ac1 2811 callout, callout_overall, callout_connect, se_mailfrom,
4deaf07d 2812 pm_mailfrom, NULL);
059ec3d9
PH
2813 }
2814 }
2815
2816 /* We now have the result, either newly found, or cached. If we are
2817 giving out error details, set a specific user error. This means that the
2818 last of these will be returned to the user if all three fail. We do not
2819 set a log message - the generic one below will be used. */
2820
fe5b5d0b 2821 if (new_ok != OK)
059ec3d9 2822 {
8e669ac1 2823 *verrno = vaddr->basic_errno;
fe5b5d0b
PH
2824 if (smtp_return_error_details)
2825 {
2826 *user_msgptr = string_sprintf("Rejected after DATA: "
2827 "could not verify \"%.*s\" header address\n%s: %s",
2828 endname - h->text, h->text, vaddr->address, vaddr->message);
2829 }
8e669ac1 2830 }
059ec3d9
PH
2831
2832 /* Success or defer */
2833
1eccaa59
PH
2834 if (new_ok == OK)
2835 {
2836 yield = OK;
2837 done = TRUE;
2838 break;
2839 }
2840
059ec3d9
PH
2841 if (new_ok == DEFER) yield = DEFER;
2842
2843 /* Move on to any more addresses in the header */
2844
2845 s = ss;
1eccaa59
PH
2846 } /* Next address */
2847
2848 parse_allow_group = FALSE;
2849 parse_found_group = FALSE;
2850 } /* Next header, unless done */
2851 } /* Next header type unless done */
059ec3d9
PH
2852
2853if (yield == FAIL && *log_msgptr == NULL)
2854 *log_msgptr = US"there is no valid sender in any header line";
2855
2856if (yield == DEFER && *log_msgptr == NULL)
2857 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2858
2859return yield;
2860}
2861
2862
2863
2864
2865/*************************************************
2866* Get RFC 1413 identification *
2867*************************************************/
2868
2869/* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2870the timeout is set to zero, then the query is not done. There may also be lists
2871of hosts and nets which are exempt. To guard against malefactors sending
2872non-printing characters which could, for example, disrupt a message's headers,
2873make sure the string consists of printing characters only.
2874
2875Argument:
2876 port the port to connect to; usually this is IDENT_PORT (113), but when
2877 running in the test harness with -bh a different value is used.
2878
2879Returns: nothing
2880
2881Side effect: any received ident value is put in sender_ident (NULL otherwise)
2882*/
2883
2884void
2885verify_get_ident(int port)
2886{
2887int sock, host_af, qlen;
2888int received_sender_port, received_interface_port, n;
2889uschar *p;
2890uschar buffer[2048];
2891
2892/* Default is no ident. Check whether we want to do an ident check for this
2893host. */
2894
2895sender_ident = NULL;
2896if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2897 return;
2898
2899DEBUG(D_ident) debug_printf("doing ident callback\n");
2900
2901/* Set up a connection to the ident port of the remote host. Bind the local end
2902to the incoming interface address. If the sender host address is an IPv6
2903address, the incoming interface address will also be IPv6. */
2904
2905host_af = (Ustrchr(sender_host_address, ':') == NULL)? AF_INET : AF_INET6;
2906sock = ip_socket(SOCK_STREAM, host_af);
2907if (sock < 0) return;
2908
2909if (ip_bind(sock, host_af, interface_address, 0) < 0)
2910 {
2911 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2912 strerror(errno));
2913 goto END_OFF;
2914 }
2915
2916if (ip_connect(sock, host_af, sender_host_address, port, rfc1413_query_timeout)
2917 < 0)
2918 {
2919 if (errno == ETIMEDOUT && (log_extra_selector & LX_ident_timeout) != 0)
2920 {
2921 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2922 sender_host_address);
2923 }
2924 else
2925 {
2926 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2927 sender_host_address, strerror(errno));
2928 }
2929 goto END_OFF;
2930 }
2931
2932/* Construct and send the query. */
2933
2934sprintf(CS buffer, "%d , %d\r\n", sender_host_port, interface_port);
2935qlen = Ustrlen(buffer);
2936if (send(sock, buffer, qlen, 0) < 0)
2937 {
2938 DEBUG(D_ident) debug_printf("ident send failed: %s\n", strerror(errno));
2939 goto END_OFF;
2940 }
2941
2942/* Read a response line. We put it into the rest of the buffer, using several
2943recv() calls if necessary. */
2944
2945p = buffer + qlen;
2946
2947for (;;)
2948 {
2949 uschar *pp;
2950 int count;
2951 int size = sizeof(buffer) - (p - buffer);
2952
2953 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2954 count = ip_recv(sock, p, size, rfc1413_query_timeout);
2955 if (count <= 0) goto END_OFF; /* Read error or EOF */
2956
2957 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2958 generous, and accept a plain \n terminator as well. The only illegal
2959 character is 0. */
2960
2961 for (pp = p; pp < p + count; pp++)
2962 {
2963 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2964 if (*pp == '\n')
2965 {
2966 if (pp[-1] == '\r') pp--;
2967 *pp = 0;
2968 goto GOT_DATA; /* Break out of both loops */
2969 }
2970 }
2971
2972 /* Reached the end of the data without finding \n. Let the loop continue to
2973 read some more, if there is room. */
2974
2975 p = pp;
2976 }
2977
2978GOT_DATA:
2979
2980/* We have received a line of data. Check it carefully. It must start with the
2981same two port numbers that we sent, followed by data as defined by the RFC. For
2982example,
2983
2984 12345 , 25 : USERID : UNIX :root
2985
2986However, the amount of white space may be different to what we sent. In the
2987"osname" field there may be several sub-fields, comma separated. The data we
2988actually want to save follows the third colon. Some systems put leading spaces
2989in it - we discard those. */
2990
2991if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2992 &received_interface_port, &n) != 2 ||
2993 received_sender_port != sender_host_port ||
2994 received_interface_port != interface_port)
2995 goto END_OFF;
2996
2997p = buffer + qlen + n;
2998while(isspace(*p)) p++;
2999if (*p++ != ':') goto END_OFF;
3000while(isspace(*p)) p++;
3001if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
3002p += 6;
3003while(isspace(*p)) p++;
3004if (*p++ != ':') goto END_OFF;
3005while (*p != 0 && *p != ':') p++;
3006if (*p++ == 0) goto END_OFF;
3007while(isspace(*p)) p++;
3008if (*p == 0) goto END_OFF;
3009
3010/* The rest of the line is the data we want. We turn it into printing
3011characters when we save it, so that it cannot mess up the format of any logging
3012or Received: lines into which it gets inserted. We keep a maximum of 127
55414b25 3013characters. The deconst cast is ok as we fed a nonconst to string_printing() */
059ec3d9 3014
55414b25 3015sender_ident = US string_printing(string_copyn(p, 127));
059ec3d9
PH
3016DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
3017
3018END_OFF:
f1e894f3 3019(void)close(sock);
059ec3d9
PH
3020return;
3021}
3022
3023
3024
3025
3026/*************************************************
3027* Match host to a single host-list item *
3028*************************************************/
3029
3030/* This function compares a host (name or address) against a single item
3031from a host list. The host name gets looked up if it is needed and is not
3032already known. The function is called from verify_check_this_host() via
3033match_check_list(), which is why most of its arguments are in a single block.
3034
3035Arguments:
3036 arg the argument block (see below)
3037 ss the host-list item
3038 valueptr where to pass back looked up data, or NULL
3039 error for error message when returning ERROR
3040
3041The block contains:
32d668a5
PH
3042 host_name (a) the host name, or
3043 (b) NULL, implying use sender_host_name and
3044 sender_host_aliases, looking them up if required, or
3045 (c) the empty string, meaning that only IP address matches
3046 are permitted
059ec3d9
PH
3047 host_address the host address
3048 host_ipv4 the IPv4 address taken from an IPv6 one
3049
3050Returns: OK matched
3051 FAIL did not match
3052 DEFER lookup deferred
32d668a5
PH
3053 ERROR (a) failed to find the host name or IP address, or
3054 (b) unknown lookup type specified, or
3055 (c) host name encountered when only IP addresses are
3056 being matched
059ec3d9
PH
3057*/
3058
32d668a5 3059int
55414b25 3060check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
059ec3d9
PH
3061{
3062check_host_block *cb = (check_host_block *)arg;
32d668a5 3063int mlen = -1;
059ec3d9 3064int maskoffset;
32d668a5 3065BOOL iplookup = FALSE;
059ec3d9 3066BOOL isquery = FALSE;
32d668a5 3067BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
55414b25 3068const uschar *t;
32d668a5 3069uschar *semicolon;
059ec3d9
PH
3070uschar **aliases;
3071
3072/* Optimize for the special case when the pattern is "*". */
3073
3074if (*ss == '*' && ss[1] == 0) return OK;
3075
3076/* If the pattern is empty, it matches only in the case when there is no host -
3077this can occur in ACL checking for SMTP input using the -bs option. In this
3078situation, the host address is the empty string. */
3079
3080if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
3081if (*ss == 0) return FAIL;
3082
32d668a5
PH
3083/* If the pattern is precisely "@" then match against the primary host name,
3084provided that host name matching is permitted; if it's "@[]" match against the
3085local host's IP addresses. */
059ec3d9
PH
3086
3087if (*ss == '@')
3088 {
32d668a5
PH
3089 if (ss[1] == 0)
3090 {
3091 if (isiponly) return ERROR;
3092 ss = primary_hostname;
3093 }
059ec3d9
PH
3094 else if (Ustrcmp(ss, "@[]") == 0)
3095 {
3096 ip_address_item *ip;
3097 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
3098 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
3099 return FAIL;
3100 }
3101 }
3102
3103/* If the pattern is an IP address, optionally followed by a bitmask count, do
3104a (possibly masked) comparision with the current IP address. */
3105
7e66e54d 3106if (string_is_ip_address(ss, &maskoffset) != 0)
059ec3d9
PH
3107 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
3108
1688f43b
PH
3109/* The pattern is not an IP address. A common error that people make is to omit
3110one component of an IPv4 address, either by accident, or believing that, for
3111example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
3112which it isn't. (Those applications that do accept 1.2.3 as an IP address
3113interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
3114ancient specification.) To aid in debugging these cases, we give a specific
3115error if the pattern contains only digits and dots or contains a slash preceded
3116only by digits and dots (a slash at the start indicates a file name and of
3117course slashes may be present in lookups, but not preceded only by digits and
3118dots). */
3119
3120for (t = ss; isdigit(*t) || *t == '.'; t++);
3121if (*t == 0 || (*t == '/' && t != ss))
3122 {
3123 *error = US"malformed IPv4 address or address mask";
3124 return ERROR;
3125 }
3126
32d668a5 3127/* See if there is a semicolon in the pattern */
059ec3d9 3128
32d668a5
PH
3129semicolon = Ustrchr(ss, ';');
3130
3131/* If we are doing an IP address only match, then all lookups must be IP
df199fec 3132address lookups, even if there is no "net-". */
32d668a5
PH
3133
3134if (isiponly)
059ec3d9 3135 {
32d668a5
PH
3136 iplookup = semicolon != NULL;
3137 }
059ec3d9 3138
32d668a5 3139/* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
df199fec
PH
3140a lookup on a masked IP network, in textual form. We obey this code even if we
3141have already set iplookup, so as to skip over the "net-" prefix and to set the
3142mask length. The net- stuff really only applies to single-key lookups where the
3143key is implicit. For query-style lookups the key is specified in the query.
3144From release 4.30, the use of net- for query style is no longer needed, but we
3145retain it for backward compatibility. */
3146
3147if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
32d668a5
PH
3148 {
3149 mlen = 0;
3150 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
3151 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
3152 iplookup = (*t++ == '-');
3153 }
1688f43b 3154else t = ss;
059ec3d9 3155
32d668a5 3156/* Do the IP address lookup if that is indeed what we have */
059ec3d9 3157
32d668a5
PH
3158if (iplookup)
3159 {
3160 int insize;
3161 int search_type;
3162 int incoming[4];
3163 void *handle;
3164 uschar *filename, *key, *result;
3165 uschar buffer[64];
059ec3d9 3166
32d668a5 3167 /* Find the search type */
059ec3d9 3168
32d668a5 3169 search_type = search_findtype(t, semicolon - t);
059ec3d9 3170
32d668a5
PH
3171 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3172 search_error_message);
059ec3d9 3173
13b685f9
PH
3174 /* Adjust parameters for the type of lookup. For a query-style lookup, there
3175 is no file name, and the "key" is just the query. For query-style with a file
3176 name, we have to fish the file off the start of the query. For a single-key
3177 lookup, the key is the current IP address, masked appropriately, and
3178 reconverted to text form, with the mask appended. For IPv6 addresses, specify
6a3bceb1
PH
3179 dot separators instead of colons, except when the lookup type is "iplsearch".
3180 */
059ec3d9 3181
13b685f9
PH
3182 if (mac_islookup(search_type, lookup_absfilequery))
3183 {
3184 filename = semicolon + 1;
3185 key = filename;
3186 while (*key != 0 && !isspace(*key)) key++;
3187 filename = string_copyn(filename, key - filename);
3188 while (isspace(*key)) key++;
3189 }
3190 else if (mac_islookup(search_type, lookup_querystyle))
32d668a5
PH
3191 {
3192 filename = NULL;
3193 key = semicolon + 1;
3194 }
6a3bceb1 3195 else /* Single-key style */
32d668a5 3196 {
e6d225ae 3197 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
6a3bceb1 3198 ':' : '.';
32d668a5
PH
3199 insize = host_aton(cb->host_address, incoming);
3200 host_mask(insize, incoming, mlen);
6a3bceb1 3201 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
32d668a5
PH
3202 key = buffer;
3203 filename = semicolon + 1;
059ec3d9 3204 }
32d668a5
PH
3205
3206 /* Now do the actual lookup; note that there is no search_close() because
3207 of the caching arrangements. */
3208
3209 handle = search_open(filename, search_type, 0, NULL, NULL);
3210 if (handle == NULL) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3211 search_error_message);
3212 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
3213 if (valueptr != NULL) *valueptr = result;
3214 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
059ec3d9
PH
3215 }
3216
3217/* The pattern is not an IP address or network reference of any kind. That is,
32d668a5
PH
3218it is a host name pattern. If this is an IP only match, there's an error in the
3219host list. */
3220
3221if (isiponly)
3222 {
3223 *error = US"cannot match host name in match_ip list";
3224 return ERROR;
3225 }
3226
3227/* Check the characters of the pattern to see if they comprise only letters,
3228digits, full stops, and hyphens (the constituents of domain names). Allow
3229underscores, as they are all too commonly found. Sigh. Also, if
3230allow_utf8_domains is set, allow top-bit characters. */
059ec3d9
PH
3231
3232for (t = ss; *t != 0; t++)
3233 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3234 (!allow_utf8_domains || *t < 128)) break;
3235
3236/* If the pattern is a complete domain name, with no fancy characters, look up
3237its IP address and match against that. Note that a multi-homed host will add
3238items to the chain. */
3239
3240if (*t == 0)
3241 {
3242 int rc;
3243 host_item h;
3244 h.next = NULL;
3245 h.name = ss;
3246 h.address = NULL;
3247 h.mx = MX_NONE;
9b8fadde 3248
1f155f8e
JH
3249 /* Using byname rather than bydns here means we cannot determine dnssec
3250 status. On the other hand it is unclear how that could be either
3251 propagated up or enforced. */
3252
322050c2 3253 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
059ec3d9
PH
3254 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3255 {
3256 host_item *hh;
3257 for (hh = &h; hh != NULL; hh = hh->next)
3258 {
96776534 3259 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
059ec3d9
PH
3260 }
3261 return FAIL;
3262 }
3263 if (rc == HOST_FIND_AGAIN) return DEFER;
3264 *error = string_sprintf("failed to find IP address for %s", ss);
3265 return ERROR;
3266 }
3267
3268/* Almost all subsequent comparisons require the host name, and can be done
3269using the general string matching function. When this function is called for
3270outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3271must use sender_host_name and its aliases, looking them up if necessary. */
3272
3273if (cb->host_name != NULL) /* Explicit host name given */
3274 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3275 valueptr);
3276
3277/* Host name not given; in principle we need the sender host name and its
3278aliases. However, for query-style lookups, we do not need the name if the
3279query does not contain $sender_host_name. From release 4.23, a reference to
3280$sender_host_name causes it to be looked up, so we don't need to do the lookup
3281on spec. */
3282
3283if ((semicolon = Ustrchr(ss, ';')) != NULL)
3284 {
55414b25 3285 const uschar *affix;
059ec3d9
PH
3286 int partial, affixlen, starflags, id;
3287
3288 *semicolon = 0;
3289 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
3290 *semicolon=';';
3291
3292 if (id < 0) /* Unknown lookup type */
3293 {
3294 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3295 search_error_message, ss);
3296 return DEFER;
3297 }
13b685f9 3298 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
059ec3d9
PH
3299 }
3300
3301if (isquery)
3302 {
3303 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3304 {
3305 case OK: return OK;
3306 case DEFER: return DEFER;
3307 default: return FAIL;
3308 }
3309 }
3310
3311/* Not a query-style lookup; must ensure the host name is present, and then we
3312do a check on the name and all its aliases. */
3313
3314if (sender_host_name == NULL)
3315 {
3316 HDEBUG(D_host_lookup)
3317 debug_printf("sender host name required, to match against %s\n", ss);
3318 if (host_lookup_failed || host_name_lookup() != OK)
3319 {
3320 *error = string_sprintf("failed to find host name for %s",
3321 sender_host_address);;
3322 return ERROR;
3323 }
3324 host_build_sender_fullhost();
3325 }
3326
3327/* Match on the sender host name, using the general matching function */
3328
3329switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
3330 valueptr))
3331 {
3332 case OK: return OK;
3333 case DEFER: return DEFER;
3334 }
3335
3336/* If there are aliases, try matching on them. */
3337
3338aliases = sender_host_aliases;
3339while (*aliases != NULL)
3340 {
3341 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3342 {
3343 case OK: return OK;
3344 case DEFER: return DEFER;
3345 }
3346 }
3347return FAIL;
3348}
3349
3350
3351
3352
3353/*************************************************
3354* Check a specific host matches a host list *
3355*************************************************/
3356
3357/* This function is passed a host list containing items in a number of
3358different formats and the identity of a host. Its job is to determine whether
3359the given host is in the set of hosts defined by the list. The host name is
3360passed as a pointer so that it can be looked up if needed and not already
3361known. This is commonly the case when called from verify_check_host() to check
3362an incoming connection. When called from elsewhere the host name should usually
3363be set.
3364
3365This function is now just a front end to match_check_list(), which runs common
3366code for scanning a list. We pass it the check_host() function to perform a
3367single test.
3368
3369Arguments:
3370 listptr pointer to the host list
3371 cache_bits pointer to cache for named lists, or NULL
3372 host_name the host name or NULL, implying use sender_host_name and
3373 sender_host_aliases, looking them up if required
3374 host_address the IP address
3375 valueptr if not NULL, data from a lookup is passed back here
3376
3377Returns: OK if the host is in the defined set
3378 FAIL if the host is not in the defined set,
3379 DEFER if a data lookup deferred (not a host lookup)
3380
3381If the host name was needed in order to make a comparison, and could not be
3382determined from the IP address, the result is FAIL unless the item
3383"+allow_unknown" was met earlier in the list, in which case OK is returned. */
3384
3385int
55414b25
JH
3386verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3387 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
059ec3d9 3388{
d4eb88df 3389int rc;
059ec3d9 3390unsigned int *local_cache_bits = cache_bits;
55414b25 3391const uschar *save_host_address = deliver_host_address;
059ec3d9
PH
3392check_host_block cb;
3393cb.host_name = host_name;
3394cb.host_address = host_address;
3395
3396if (valueptr != NULL) *valueptr = NULL;
3397
3398/* If the host address starts off ::ffff: it is an IPv6 address in
3399IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3400addresses. */
3401
3402cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
3403 host_address + 7 : host_address;
3404
8e669ac1
PH
3405/* During the running of the check, put the IP address into $host_address. In
3406the case of calls from the smtp transport, it will already be there. However,
3407in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
d4eb88df
PH
3408the safe side, any existing setting is preserved, though as I write this
3409(November 2004) I can't see any cases where it is actually needed. */
3410
3411deliver_host_address = host_address;
3412rc = match_check_list(
3413 listptr, /* the list */
3414 0, /* separator character */
3415 &hostlist_anchor, /* anchor pointer */
3416 &local_cache_bits, /* cache pointer */
3417 check_host, /* function for testing */
3418 &cb, /* argument for function */
3419 MCL_HOST, /* type of check */
8e669ac1 3420 (host_address == sender_host_address)?
d4eb88df
PH
3421 US"host" : host_address, /* text for debugging */
3422 valueptr); /* where to pass back data */
3423deliver_host_address = save_host_address;
8e669ac1 3424return rc;
059ec3d9
PH
3425}
3426
3427
3428
3429
3430/*************************************************
5130845b
JH
3431* Check the given host item matches a list *
3432*************************************************/
3433int
3434verify_check_given_host(uschar **listptr, host_item *host)
3435{
55414b25 3436return verify_check_this_host(CUSS listptr, NULL, host->name, host->address, NULL);
5130845b
JH
3437}
3438
3439/*************************************************
059ec3d9
PH
3440* Check the remote host matches a list *
3441*************************************************/
3442
3443/* This is a front end to verify_check_this_host(), created because checking
3444the remote host is a common occurrence. With luck, a good compiler will spot
3445the tail recursion and optimize it. If there's no host address, this is
3446command-line SMTP input - check against an empty string for the address.
3447
3448Arguments:
3449 listptr pointer to the host list
3450
3451Returns: the yield of verify_check_this_host(),
3452 i.e. OK, FAIL, or DEFER
3453*/
3454
3455int
3456verify_check_host(uschar **listptr)
3457{
55414b25 3458return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
059ec3d9
PH
3459 (sender_host_address == NULL)? US"" : sender_host_address, NULL);
3460}
3461
3462
3463
3464
3465
3466/*************************************************
83e029d5 3467* Invert an IP address *
059ec3d9
PH
3468*************************************************/
3469
83e029d5
PP
3470/* Originally just used for DNS xBL lists, now also used for the
3471reverse_ip expansion operator.
3472
059ec3d9
PH
3473Arguments:
3474 buffer where to put the answer
3475 address the address to invert
3476*/
3477
83e029d5 3478void
059ec3d9
PH
3479invert_address(uschar *buffer, uschar *address)
3480{
3481int bin[4];
3482uschar *bptr = buffer;
3483
3484/* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3485to the IPv4 part only. */
3486
3487if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3488
3489/* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3490always 1. */
3491
3492if (host_aton(address, bin) == 1)
3493 {
3494 int i;
3495 int x = bin[0];
3496 for (i = 0; i < 4; i++)
3497 {
3498 sprintf(CS bptr, "%d.", x & 255);
3499 while (*bptr) bptr++;
3500 x >>= 8;
3501 }
3502 }
3503
3504/* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3505in any DNS black lists, and the format in which they will be looked up is
3506unknown. This is just a guess. */
3507
3508#if HAVE_IPV6
3509else
3510 {
3511 int i, j;
3512 for (j = 3; j >= 0; j--)
3513 {
3514 int x = bin[j];
3515 for (i = 0; i < 8; i++)
3516 {
3517 sprintf(CS bptr, "%x.", x & 15);
3518 while (*bptr) bptr++;
3519 x >>= 4;
3520 }
3521 }
3522 }
3523#endif
d6f6e0dc
PH
3524
3525/* Remove trailing period -- this is needed so that both arbitrary
3526dnsbl keydomains and inverted addresses may be combined with the
3527same format string, "%s.%s" */
3528
3529*(--bptr) = 0;
059ec3d9
PH
3530}
3531
3532
3533
3534/*************************************************
0bcb2a0e
PH
3535* Perform a single dnsbl lookup *
3536*************************************************/
3537
d6f6e0dc
PH
3538/* This function is called from verify_check_dnsbl() below. It is also called
3539recursively from within itself when domain and domain_txt are different
3540pointers, in order to get the TXT record from the alternate domain.
0bcb2a0e
PH
3541
3542Arguments:
d6f6e0dc
PH
3543 domain the outer dnsbl domain
3544 domain_txt alternate domain to lookup TXT record on success; when the
3545 same domain is to be used, domain_txt == domain (that is,
3546 the pointers must be identical, not just the text)
8e669ac1 3547 keydomain the current keydomain (for debug message)
d6f6e0dc
PH
3548 prepend subdomain to lookup (like keydomain, but
3549 reversed if IP address)
3550 iplist the list of matching IP addresses, or NULL for "any"
8e669ac1 3551 bitmask true if bitmask matching is wanted
431b7361
PH
3552 match_type condition for 'succeed' result
3553 0 => Any RR in iplist (=)
3554 1 => No RR in iplist (!=)
3555 2 => All RRs in iplist (==)
3556 3 => Some RRs not in iplist (!==)
3557 the two bits are defined as MT_NOT and MT_ALL
8e669ac1 3558 defer_return what to return for a defer
0bcb2a0e
PH
3559
3560Returns: OK if lookup succeeded
3561 FAIL if not
3562*/
3563
3564static int
d6f6e0dc 3565one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain,
431b7361 3566 uschar *prepend, uschar *iplist, BOOL bitmask, int match_type,
d6f6e0dc 3567 int defer_return)
8e669ac1 3568{
0bcb2a0e
PH
3569dns_answer dnsa;
3570dns_scan dnss;
3571tree_node *t;
3572dnsbl_cache_block *cb;
3573int old_pool = store_pool;
d6f6e0dc
PH
3574uschar query[256]; /* DNS domain max length */
3575
3576/* Construct the specific query domainname */
3577
3578if (!string_format(query, sizeof(query), "%s.%s", prepend, domain))
3579 {
3580 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
3581 "(ignored): %s...", query);
3582 return FAIL;
3583 }
0bcb2a0e
PH
3584
3585/* Look for this query in the cache. */
3586
3587t = tree_search(dnsbl_cache, query);
3588
3589/* If not cached from a previous lookup, we must do a DNS lookup, and
3590cache the result in permanent memory. */
3591
3592if (t == NULL)
3593 {
3594 store_pool = POOL_PERM;
3595
3596 /* Set up a tree entry to cache the lookup */
3597
3598 t = store_get(sizeof(tree_node) + Ustrlen(query));
3599 Ustrcpy(t->name, query);
3600 t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block));
3601 (void)tree_insertnode(&dnsbl_cache, t);
3602
3603 /* Do the DNS loopup . */
3604
3605 HDEBUG(D_dnsbl) debug_printf("new DNS lookup for %s\n", query);
3606 cb->rc = dns_basic_lookup(&dnsa, query, T_A);
3607 cb->text_set = FALSE;
3608 cb->text = NULL;
3609 cb->rhs = NULL;
3610
3611 /* If the lookup succeeded, cache the RHS address. The code allows for
3612 more than one address - this was for complete generality and the possible
3613 use of A6 records. However, A6 records have been reduced to experimental
3614 status (August 2001) and may die out. So they may never get used at all,
3615 let alone in dnsbl records. However, leave the code here, just in case.
3616
3617 Quite apart from one A6 RR generating multiple addresses, there are DNS
3618 lists that return more than one A record, so we must handle multiple
3619 addresses generated in that way as well. */
3620
3621 if (cb->rc == DNS_SUCCEED)
3622 {
3623 dns_record *rr;
3624 dns_address **addrp = &(cb->rhs);
3625 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
e1a3f32f 3626 rr;
0bcb2a0e
PH
3627 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
3628 {
3629 if (rr->type == T_A)
3630 {
3631 dns_address *da = dns_address_from_rr(&dnsa, rr);
e1a3f32f 3632 if (da)
0bcb2a0e
PH
3633 {
3634 *addrp = da;
3635 while (da->next != NULL) da = da->next;
3636 addrp = &(da->next);
3637 }
3638 }
3639 }
3640
3641 /* If we didn't find any A records, change the return code. This can
3642 happen when there is a CNAME record but there are no A records for what
3643 it points to. */
3644