OpenSSL: Capture peercert/dn in mainline not verify-callback. Bug 1571
[exim.git] / src / src / verify.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
2331cfe7 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions concerned with verifying things. The original code for callout
9caching was contributed by Kevin Fleming (but I hacked it around a bit). */
10
11
12#include "exim.h"
817d9f57 13#include "transports/smtp.h"
059ec3d9 14
e4bdf652
JH
15#define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16#define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
817d9f57
JH
17static smtp_outblock ctblock;
18uschar ctbuffer[8192];
19
059ec3d9
PH
20
21/* Structure for caching DNSBL lookups */
22
23typedef struct dnsbl_cache_block {
24 dns_address *rhs;
25 uschar *text;
26 int rc;
27 BOOL text_set;
28} dnsbl_cache_block;
29
30
31/* Anchor for DNSBL cache */
32
33static tree_node *dnsbl_cache = NULL;
34
35
431b7361
PH
36/* Bits for match_type in one_check_dnsbl() */
37
38#define MT_NOT 1
39#define MT_ALL 2
40
5032d1cf 41static uschar cutthrough_response(char, uschar **);
431b7361 42
059ec3d9
PH
43
44/*************************************************
45* Retrieve a callout cache record *
46*************************************************/
47
48/* If a record exists, check whether it has expired.
49
50Arguments:
51 dbm_file an open hints file
52 key the record key
53 type "address" or "domain"
54 positive_expire expire time for positive records
55 negative_expire expire time for negative records
56
57Returns: the cache record if a non-expired one exists, else NULL
58*/
59
60static dbdata_callout_cache *
55414b25 61get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
059ec3d9
PH
62 int positive_expire, int negative_expire)
63{
64BOOL negative;
65int length, expire;
66time_t now;
67dbdata_callout_cache *cache_record;
68
69cache_record = dbfn_read_with_length(dbm_file, key, &length);
70
71if (cache_record == NULL)
72 {
73 HDEBUG(D_verify) debug_printf("callout cache: no %s record found\n", type);
74 return NULL;
75 }
76
77/* We treat a record as "negative" if its result field is not positive, or if
78it is a domain record and the postmaster field is negative. */
79
80negative = cache_record->result != ccache_accept ||
81 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
82expire = negative? negative_expire : positive_expire;
83now = time(NULL);
84
85if (now - cache_record->time_stamp > expire)
86 {
87 HDEBUG(D_verify) debug_printf("callout cache: %s record expired\n", type);
88 return NULL;
89 }
90
91/* If this is a non-reject domain record, check for the obsolete format version
92that doesn't have the postmaster and random timestamps, by looking at the
93length. If so, copy it to a new-style block, replicating the record's
94timestamp. Then check the additional timestamps. (There's no point wasting
95effort if connections are rejected.) */
96
97if (type[0] == 'd' && cache_record->result != ccache_reject)
98 {
99 if (length == sizeof(dbdata_callout_cache_obs))
100 {
101 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
102 memcpy(new, cache_record, length);
103 new->postmaster_stamp = new->random_stamp = new->time_stamp;
104 cache_record = new;
105 }
106
107 if (now - cache_record->postmaster_stamp > expire)
108 cache_record->postmaster_result = ccache_unknown;
109
110 if (now - cache_record->random_stamp > expire)
111 cache_record->random_result = ccache_unknown;
112 }
113
114HDEBUG(D_verify) debug_printf("callout cache: found %s record\n", type);
115return cache_record;
116}
117
118
119
120/*************************************************
121* Do callout verification for an address *
122*************************************************/
123
124/* This function is called from verify_address() when the address has routed to
125a host list, and a callout has been requested. Callouts are expensive; that is
126why a cache is used to improve the efficiency.
127
128Arguments:
129 addr the address that's been routed
130 host_list the list of hosts to try
131 tf the transport feedback block
132
133 ifstring "interface" option from transport, or NULL
134 portstring "port" option from transport, or NULL
135 protocolstring "protocol" option from transport, or NULL
136 callout the per-command callout timeout
4deaf07d
PH
137 callout_overall the overall callout timeout (if < 0 use 4*callout)
138 callout_connect the callout connection timeout (if < 0 use callout)
059ec3d9
PH
139 options the verification options - these bits are used:
140 vopt_is_recipient => this is a recipient address
141 vopt_callout_no_cache => don't use callout cache
2a4be8f9 142 vopt_callout_fullpm => if postmaster check, do full one
059ec3d9
PH
143 vopt_callout_random => do the "random" thing
144 vopt_callout_recipsender => use real sender for recipient
145 vopt_callout_recippmaster => use postmaster for recipient
146 se_mailfrom MAIL FROM address for sender verify; NULL => ""
147 pm_mailfrom if non-NULL, do the postmaster check with this sender
148
149Returns: OK/FAIL/DEFER
150*/
151
152static int
153do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
8e669ac1 154 int callout, int callout_overall, int callout_connect, int options,
4deaf07d 155 uschar *se_mailfrom, uschar *pm_mailfrom)
059ec3d9
PH
156{
157BOOL is_recipient = (options & vopt_is_recipient) != 0;
158BOOL callout_no_cache = (options & vopt_callout_no_cache) != 0;
159BOOL callout_random = (options & vopt_callout_random) != 0;
160
161int yield = OK;
2b1c6e3a 162int old_domain_cache_result = ccache_accept;
059ec3d9
PH
163BOOL done = FALSE;
164uschar *address_key;
165uschar *from_address;
166uschar *random_local_part = NULL;
55414b25 167const uschar *save_deliver_domain = deliver_domain;
8e669ac1 168uschar **failure_ptr = is_recipient?
2c7db3f5 169 &recipient_verify_failure : &sender_verify_failure;
059ec3d9
PH
170open_db dbblock;
171open_db *dbm_file = NULL;
172dbdata_callout_cache new_domain_record;
173dbdata_callout_cache_address new_address_record;
174host_item *host;
175time_t callout_start_time;
176
177new_domain_record.result = ccache_unknown;
178new_domain_record.postmaster_result = ccache_unknown;
179new_domain_record.random_result = ccache_unknown;
180
181memset(&new_address_record, 0, sizeof(new_address_record));
182
183/* For a recipient callout, the key used for the address cache record must
184include the sender address if we are using the real sender in the callout,
185because that may influence the result of the callout. */
186
187address_key = addr->address;
188from_address = US"";
189
190if (is_recipient)
191 {
5032d1cf 192 if (options & vopt_callout_recipsender)
059ec3d9
PH
193 {
194 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
195 from_address = sender_address;
196 }
5032d1cf 197 else if (options & vopt_callout_recippmaster)
059ec3d9
PH
198 {
199 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
200 qualify_domain_sender);
201 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
202 }
203 }
204
205/* For a sender callout, we must adjust the key if the mailfrom address is not
206empty. */
207
208else
209 {
210 from_address = (se_mailfrom == NULL)? US"" : se_mailfrom;
211 if (from_address[0] != 0)
212 address_key = string_sprintf("%s/<%s>", addr->address, from_address);
213 }
214
215/* Open the callout cache database, it it exists, for reading only at this
216stage, unless caching has been disabled. */
217
218if (callout_no_cache)
219 {
220 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
221 }
222else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
223 {
224 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
225 }
226
227/* If a cache database is available see if we can avoid the need to do an
228actual callout by making use of previously-obtained data. */
229
230if (dbm_file != NULL)
231 {
232 dbdata_callout_cache_address *cache_address_record;
233 dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
234 addr->domain, US"domain",
235 callout_cache_domain_positive_expire,
236 callout_cache_domain_negative_expire);
237
238 /* If an unexpired cache record was found for this domain, see if the callout
239 process can be short-circuited. */
240
241 if (cache_record != NULL)
242 {
2b1c6e3a
PH
243 /* In most cases, if an early command (up to and including MAIL FROM:<>)
244 was rejected, there is no point carrying on. The callout fails. However, if
245 we are doing a recipient verification with use_sender or use_postmaster
246 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
247 will be using a non-empty sender. We have to remember this situation so as
248 not to disturb the cached domain value if this whole verification succeeds
249 (we don't want it turning into "accept"). */
250
251 old_domain_cache_result = cache_record->result;
252
253 if (cache_record->result == ccache_reject ||
254 (*from_address == 0 && cache_record->result == ccache_reject_mfnull))
059ec3d9
PH
255 {
256 setflag(addr, af_verify_nsfail);
257 HDEBUG(D_verify)
258 debug_printf("callout cache: domain gave initial rejection, or "
259 "does not accept HELO or MAIL FROM:<>\n");
260 setflag(addr, af_verify_nsfail);
261 addr->user_message = US"(result of an earlier callout reused).";
262 yield = FAIL;
8e669ac1 263 *failure_ptr = US"mail";
059ec3d9
PH
264 goto END_CALLOUT;
265 }
266
267 /* If a previous check on a "random" local part was accepted, we assume
268 that the server does not do any checking on local parts. There is therefore
269 no point in doing the callout, because it will always be successful. If a
270 random check previously failed, arrange not to do it again, but preserve
271 the data in the new record. If a random check is required but hasn't been
272 done, skip the remaining cache processing. */
273
274 if (callout_random) switch(cache_record->random_result)
275 {
276 case ccache_accept:
277 HDEBUG(D_verify)
278 debug_printf("callout cache: domain accepts random addresses\n");
279 goto END_CALLOUT; /* Default yield is OK */
280
281 case ccache_reject:
282 HDEBUG(D_verify)
283 debug_printf("callout cache: domain rejects random addresses\n");
284 callout_random = FALSE;
285 new_domain_record.random_result = ccache_reject;
286 new_domain_record.random_stamp = cache_record->random_stamp;
287 break;
288
289 default:
290 HDEBUG(D_verify)
291 debug_printf("callout cache: need to check random address handling "
292 "(not cached or cache expired)\n");
293 goto END_CACHE;
294 }
295
296 /* If a postmaster check is requested, but there was a previous failure,
297 there is again no point in carrying on. If a postmaster check is required,
298 but has not been done before, we are going to have to do a callout, so skip
299 remaining cache processing. */
300
301 if (pm_mailfrom != NULL)
302 {
303 if (cache_record->postmaster_result == ccache_reject)
304 {
305 setflag(addr, af_verify_pmfail);
306 HDEBUG(D_verify)
307 debug_printf("callout cache: domain does not accept "
308 "RCPT TO:<postmaster@domain>\n");
309 yield = FAIL;
8e669ac1 310 *failure_ptr = US"postmaster";
059ec3d9
PH
311 setflag(addr, af_verify_pmfail);
312 addr->user_message = US"(result of earlier verification reused).";
313 goto END_CALLOUT;
314 }
315 if (cache_record->postmaster_result == ccache_unknown)
316 {
317 HDEBUG(D_verify)
318 debug_printf("callout cache: need to check RCPT "
319 "TO:<postmaster@domain> (not cached or cache expired)\n");
320 goto END_CACHE;
321 }
322
323 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
324 postmaster check if the address itself has to be checked. Also ensure
325 that the value in the cache record is preserved (with its old timestamp).
326 */
327
328 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
329 "TO:<postmaster@domain>\n");
330 pm_mailfrom = NULL;
331 new_domain_record.postmaster_result = ccache_accept;
332 new_domain_record.postmaster_stamp = cache_record->postmaster_stamp;
333 }
334 }
335
336 /* We can't give a result based on information about the domain. See if there
337 is an unexpired cache record for this specific address (combined with the
338 sender address if we are doing a recipient callout with a non-empty sender).
339 */
340
341 cache_address_record = (dbdata_callout_cache_address *)
342 get_callout_cache_record(dbm_file,
343 address_key, US"address",
344 callout_cache_positive_expire,
345 callout_cache_negative_expire);
346
347 if (cache_address_record != NULL)
348 {
349 if (cache_address_record->result == ccache_accept)
350 {
351 HDEBUG(D_verify)
352 debug_printf("callout cache: address record is positive\n");
353 }
354 else
355 {
356 HDEBUG(D_verify)
357 debug_printf("callout cache: address record is negative\n");
358 addr->user_message = US"Previous (cached) callout verification failure";
8e669ac1 359 *failure_ptr = US"recipient";
059ec3d9
PH
360 yield = FAIL;
361 }
362 goto END_CALLOUT;
363 }
364
365 /* Close the cache database while we actually do the callout for real. */
366
367 END_CACHE:
368 dbfn_close(dbm_file);
369 dbm_file = NULL;
370 }
371
193e3acd 372if (!addr->transport)
059ec3d9 373 {
193e3acd 374 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
059ec3d9 375 }
6681531a
HSHR
376else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
377 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
378 addr->transport->name, addr->transport->driver_name);
193e3acd
JH
379else
380 {
381 smtp_transport_options_block *ob =
9d9c3746 382 (smtp_transport_options_block *)addr->transport->options_block;
059ec3d9 383
193e3acd
JH
384 /* The information wasn't available in the cache, so we have to do a real
385 callout and save the result in the cache for next time, unless no_cache is set,
386 or unless we have a previously cached negative random result. If we are to test
387 with a random local part, ensure that such a local part is available. If not,
388 log the fact, but carry on without randomming. */
059ec3d9 389
193e3acd
JH
390 if (callout_random && callout_random_local_part != NULL)
391 {
392 random_local_part = expand_string(callout_random_local_part);
393 if (random_local_part == NULL)
394 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
395 "callout_random_local_part: %s", expand_string_message);
396 }
059ec3d9 397
193e3acd
JH
398 /* Default the connect and overall callout timeouts if not set, and record the
399 time we are starting so that we can enforce it. */
4c590bd1 400
193e3acd
JH
401 if (callout_overall < 0) callout_overall = 4 * callout;
402 if (callout_connect < 0) callout_connect = callout;
403 callout_start_time = time(NULL);
4c590bd1 404
193e3acd
JH
405 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
406 output because a callout might take some time. When PIPELINING is active and
407 there are many recipients, the total time for doing lots of callouts can add up
408 and cause the client to time out. So in this case we forgo the PIPELINING
409 optimization. */
817d9f57 410
193e3acd 411 if (smtp_out != NULL && !disable_callout_flush) mac_smtp_fflush();
059ec3d9 412
5032d1cf
JH
413/* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
414and we are holding a cutthrough conn open, we can just append the rcpt to
415that conn for verification purposes (and later delivery also). Simplest
416coding means skipping this whole loop and doing the append separately.
417
418We will need to remember it has been appended so that rcpt-acl tail code
419can do it there for the non-rcpt-verify case. For this we keep an addresscount.
420*/
421
422 /* Can we re-use an open cutthrough connection? */
423 if ( cutthrough.fd >= 0
424 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
425 == vopt_callout_recipsender
426 && !random_local_part
427 && !pm_mailfrom
428 )
429 {
430 if (addr->transport == cutthrough.addr.transport)
431 for (host = host_list; host; host = host->next)
432 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
433 {
434 int host_af;
435 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
436 int port = 25;
437
438 deliver_host = host->name;
439 deliver_host_address = host->address;
440 deliver_host_port = host->port;
441 deliver_domain = addr->domain;
442 transport_name = addr->transport->name;
443
444 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
445
446 if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
447 US"callout") ||
448 !smtp_get_port(tf->port, addr, &port, US"callout"))
449 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
450 addr->message);
451
452 if ( ( interface == cutthrough.interface
453 || ( interface
454 && cutthrough.interface
455 && Ustrcmp(interface, cutthrough.interface) == 0
456 ) )
457 && port == cutthrough.host.port
458 )
459 {
460 uschar * resp;
461
462 /* Match! Send the RCPT TO, append the addr, set done */
463 done =
464 smtp_write_command(&ctblock, FALSE, "RCPT TO:<%.1000s>\r\n",
465 transport_rcpt_address(addr,
466 (addr->transport == NULL)? FALSE :
467 addr->transport->rcpt_include_affixes)) >= 0 &&
468 cutthrough_response('2', &resp) == '2';
469
470 /* This would go horribly wrong if a callout fail was ignored by ACL.
471 We punt by abandoning cutthrough on a reject, like the
472 first-rcpt does. */
473
474 if (done)
475 {
476 address_item * na = store_get(sizeof(address_item));
477 *na = cutthrough.addr;
478 cutthrough.addr = *addr;
479 cutthrough.addr.host_used = &cutthrough.host;
480 cutthrough.addr.next = na;
481
482 cutthrough.nrcpt++;
483 }
484 else
485 {
486 cancel_cutthrough_connection("recipient rejected");
487 if (errno == ETIMEDOUT)
488 {
489 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
490 }
491 else if (errno == 0)
492 {
493 if (*resp == 0)
494 Ustrcpy(resp, US"connection dropped");
495
496 addr->message =
497 string_sprintf("response to \"%s\" from %s [%s] was: %s",
498 big_buffer, host->name, host->address,
499 string_printing(resp));
500
501 addr->user_message =
502 string_sprintf("Callout verification failed:\n%s", resp);
503
504 /* Hard rejection ends the process */
505
506 if (resp[0] == '5') /* Address rejected */
507 {
508 yield = FAIL;
509 done = TRUE;
510 }
511 }
512 }
513 }
514 break;
515 }
516 if (!done)
517 cancel_cutthrough_connection("incompatible connection");
518 }
519
193e3acd
JH
520 /* Now make connections to the hosts and do real callouts. The list of hosts
521 is passed in as an argument. */
059ec3d9 522
193e3acd 523 for (host = host_list; host != NULL && !done; host = host->next)
059ec3d9 524 {
193e3acd
JH
525 smtp_inblock inblock;
526 smtp_outblock outblock;
527 int host_af;
528 int port = 25;
529 BOOL send_quit = TRUE;
530 uschar *active_hostname = smtp_active_hostname;
531 BOOL lmtp;
532 BOOL smtps;
533 BOOL esmtp;
534 BOOL suppress_tls = FALSE;
535 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
0e66b3b6
JH
536#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
537 BOOL dane = FALSE;
6ebd79ec 538 BOOL dane_required;
0e66b3b6
JH
539 dns_answer tlsa_dnsa;
540#endif
193e3acd
JH
541 uschar inbuffer[4096];
542 uschar outbuffer[1024];
543 uschar responsebuffer[4096];
544
545 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
546 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
547
548 /* Skip this host if we don't have an IP address for it. */
549
550 if (host->address == NULL)
551 {
552 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
553 host->name);
554 continue;
555 }
059ec3d9 556
193e3acd 557 /* Check the overall callout timeout */
059ec3d9 558
193e3acd
JH
559 if (time(NULL) - callout_start_time >= callout_overall)
560 {
561 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
562 break;
563 }
059ec3d9 564
193e3acd 565 /* Set IPv4 or IPv6 */
059ec3d9 566
193e3acd 567 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
de3a88fb 568
193e3acd
JH
569 /* Expand and interpret the interface and port strings. The latter will not
570 be used if there is a host-specific port (e.g. from a manualroute router).
571 This has to be delayed till now, because they may expand differently for
572 different hosts. If there's a failure, log it, but carry on with the
573 defaults. */
de3a88fb 574
193e3acd
JH
575 deliver_host = host->name;
576 deliver_host_address = host->address;
a7538db1 577 deliver_host_port = host->port;
193e3acd 578 deliver_domain = addr->domain;
aec45841 579 transport_name = addr->transport->name;
059ec3d9 580
193e3acd
JH
581 if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
582 US"callout") ||
583 !smtp_get_port(tf->port, addr, &port, US"callout"))
584 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
585 addr->message);
059ec3d9 586
193e3acd
JH
587 /* Set HELO string according to the protocol */
588 lmtp= Ustrcmp(tf->protocol, "lmtp") == 0;
589 smtps= Ustrcmp(tf->protocol, "smtps") == 0;
059ec3d9 590
059ec3d9 591
193e3acd 592 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", interface, port);
059ec3d9 593
0e66b3b6
JH
594#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
595 {
0e66b3b6
JH
596 int rc;
597
598 tls_out.dane_verified = FALSE;
599 tls_out.tlsa_usage = 0;
600
5130845b
JH
601 dane_required =
602 verify_check_given_host(&ob->hosts_require_dane, host) == OK;
0e66b3b6
JH
603
604 if (host->dnssec == DS_YES)
605 {
606 if( dane_required
5130845b 607 || verify_check_given_host(&ob->hosts_try_dane, host) == OK
0e66b3b6
JH
608 )
609 if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required, &dane)) != OK)
610 return rc;
611 }
612 else if (dane_required)
613 {
614 log_write(0, LOG_MAIN, "DANE error: %s lookup not DNSSEC", host->name);
615 return FAIL;
616 }
617
618 if (dane)
619 ob->tls_tempfail_tryclear = FALSE;
620 }
621#endif /*DANE*/
622
193e3acd 623 /* Set up the buffer for reading SMTP response packets. */
059ec3d9 624
193e3acd
JH
625 inblock.buffer = inbuffer;
626 inblock.buffersize = sizeof(inbuffer);
627 inblock.ptr = inbuffer;
628 inblock.ptrend = inbuffer;
059ec3d9 629
193e3acd 630 /* Set up the buffer for holding SMTP commands while pipelining */
817d9f57 631
193e3acd
JH
632 outblock.buffer = outbuffer;
633 outblock.buffersize = sizeof(outbuffer);
634 outblock.ptr = outbuffer;
635 outblock.cmd_count = 0;
636 outblock.authenticating = FALSE;
059ec3d9 637
193e3acd 638 /* Reset the parameters of a TLS session */
f69979cf 639 tls_out.cipher = tls_out.peerdn = tls_out.peercert = NULL;
817d9f57 640
193e3acd
JH
641 /* Connect to the host; on failure, just loop for the next one, but we
642 set the error for the last one. Use the callout_connect timeout. */
059ec3d9 643
193e3acd 644 tls_retry_connection:
41c7c167 645
193e3acd 646 inblock.sock = outblock.sock =
a7538db1 647 smtp_connect(host, host_af, port, interface, callout_connect, TRUE, NULL
774ef2d7
JH
648#ifdef EXPERIMENTAL_EVENT
649 /*XXX event action? NULL for now. */
a7538db1
JH
650 , NULL
651#endif
652 );
193e3acd
JH
653 /* reconsider DSCP here */
654 if (inblock.sock < 0)
655 {
656 addr->message = string_sprintf("could not connect to %s [%s]: %s",
657 host->name, host->address, strerror(errno));
aec45841 658 transport_name = NULL;
193e3acd
JH
659 deliver_host = deliver_host_address = NULL;
660 deliver_domain = save_deliver_domain;
661 continue;
662 }
41c7c167 663
193e3acd 664 /* Expand the helo_data string to find the host name to use. */
41c7c167 665
193e3acd
JH
666 if (tf->helo_data != NULL)
667 {
668 uschar *s = expand_string(tf->helo_data);
669 if (s == NULL)
670 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
671 "helo_data value for callout: %s", addr->address,
672 expand_string_message);
673 else active_hostname = s;
674 }
059ec3d9 675
193e3acd
JH
676 /* Wait for initial response, and send HELO. The smtp_write_command()
677 function leaves its command in big_buffer. This is used in error responses.
678 Initialize it in case the connection is rejected. */
817d9f57 679
193e3acd 680 Ustrcpy(big_buffer, "initial connection");
817d9f57 681
193e3acd
JH
682 /* Unless ssl-on-connect, wait for the initial greeting */
683 smtps_redo_greeting:
817d9f57 684
a7538db1 685#ifdef SUPPORT_TLS
193e3acd 686 if (!smtps || (smtps && tls_out.active >= 0))
a7538db1
JH
687#endif
688 {
193e3acd
JH
689 if (!(done= smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout)))
690 goto RESPONSE_FAILED;
770747fd 691
774ef2d7 692#ifdef EXPERIMENTAL_EVENT
aaedd1b5
JH
693 lookup_dnssec_authenticated = host->dnssec==DS_YES ? US"yes"
694 : host->dnssec==DS_NO ? US"no" : NULL;
774ef2d7 695 if (event_raise(addr->transport->event_action,
b30275b8 696 US"smtp:connect", responsebuffer))
a7538db1 697 {
aaedd1b5 698 lookup_dnssec_authenticated = NULL;
a7538db1
JH
699 /* Logging? Debug? */
700 goto RESPONSE_FAILED;
701 }
aaedd1b5 702 lookup_dnssec_authenticated = NULL;
a7538db1
JH
703#endif
704 }
705
193e3acd 706 /* Not worth checking greeting line for ESMTP support */
55414b25 707 if (!(esmtp = verify_check_given_host(&ob->hosts_avoid_esmtp, host) != OK))
193e3acd
JH
708 DEBUG(D_transport)
709 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
817d9f57 710
193e3acd 711 tls_redo_helo:
817d9f57 712
a7538db1 713#ifdef SUPPORT_TLS
193e3acd 714 if (smtps && tls_out.active < 0) /* ssl-on-connect, first pass */
817d9f57 715 {
193e3acd
JH
716 tls_offered = TRUE;
717 ob->tls_tempfail_tryclear = FALSE;
817d9f57 718 }
a7538db1
JH
719 else /* all other cases */
720#endif
817d9f57 721
193e3acd 722 { esmtp_retry:
817d9f57 723
193e3acd
JH
724 if (!(done= smtp_write_command(&outblock, FALSE, "%s %s\r\n",
725 !esmtp? "HELO" : lmtp? "LHLO" : "EHLO", active_hostname) >= 0))
726 goto SEND_FAILED;
727 if (!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout))
728 {
4ed8d31a
JH
729 if (errno != 0 || responsebuffer[0] == 0 || lmtp || !esmtp || tls_out.active >= 0)
730 {
731 done= FALSE;
732 goto RESPONSE_FAILED;
733 }
a7538db1 734#ifdef SUPPORT_TLS
193e3acd 735 tls_offered = FALSE;
a7538db1 736#endif
193e3acd
JH
737 esmtp = FALSE;
738 goto esmtp_retry; /* fallback to HELO */
739 }
740
741 /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
a7538db1 742#ifdef SUPPORT_TLS
4ed8d31a 743 if (esmtp && !suppress_tls && tls_out.active < 0)
a7538db1
JH
744 {
745 if (regex_STARTTLS == NULL) regex_STARTTLS =
746 regex_must_compile(US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)", FALSE, TRUE);
4ed8d31a 747
a7538db1
JH
748 tls_offered = pcre_exec(regex_STARTTLS, NULL, CS responsebuffer,
749 Ustrlen(responsebuffer), 0, PCRE_EOPT, NULL, 0) >= 0;
4ed8d31a
JH
750 }
751 else
752 tls_offered = FALSE;
a7538db1 753#endif
817d9f57
JH
754 }
755
193e3acd
JH
756 /* If TLS is available on this connection attempt to
757 start up a TLS session, unless the host is in hosts_avoid_tls. If successful,
758 send another EHLO - the server may give a different answer in secure mode. We
759 use a separate buffer for reading the response to STARTTLS so that if it is
760 negative, the original EHLO data is available for subsequent analysis, should
761 the client not be required to use TLS. If the response is bad, copy the buffer
762 for error analysis. */
763
a7538db1 764#ifdef SUPPORT_TLS
5130845b
JH
765 if ( tls_offered
766 && verify_check_given_host(&ob->hosts_avoid_tls, host) != OK
767 && verify_check_given_host(&ob->hosts_verify_avoid_tls, host) != OK
99400968 768 )
817d9f57 769 {
193e3acd
JH
770 uschar buffer2[4096];
771 if ( !smtps
772 && !(done= smtp_write_command(&outblock, FALSE, "STARTTLS\r\n") >= 0))
773 goto SEND_FAILED;
774
775 /* If there is an I/O error, transmission of this message is deferred. If
776 there is a temporary rejection of STARRTLS and tls_tempfail_tryclear is
777 false, we also defer. However, if there is a temporary rejection of STARTTLS
778 and tls_tempfail_tryclear is true, or if there is an outright rejection of
779 STARTTLS, we carry on. This means we will try to send the message in clear,
780 unless the host is in hosts_require_tls (tested below). */
781
782 if (!smtps && !smtp_read_response(&inblock, buffer2, sizeof(buffer2), '2',
783 ob->command_timeout))
817d9f57 784 {
193e3acd
JH
785 if (errno != 0 || buffer2[0] == 0 ||
786 (buffer2[0] == '4' && !ob->tls_tempfail_tryclear))
a7538db1
JH
787 {
788 Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
789 done= FALSE;
790 goto RESPONSE_FAILED;
791 }
193e3acd 792 }
817d9f57 793
193e3acd
JH
794 /* STARTTLS accepted or ssl-on-connect: try to negotiate a TLS session. */
795 else
796 {
65867078
JH
797 int oldtimeout = ob->command_timeout;
798 int rc;
799
6ebd79ec 800 tls_negotiate:
65867078 801 ob->command_timeout = callout;
0e66b3b6 802 rc = tls_client_start(inblock.sock, host, addr, addr->transport
5032d1cf 803# ifdef EXPERIMENTAL_DANE
0e66b3b6 804 , dane ? &tlsa_dnsa : NULL
5032d1cf 805# endif
0e66b3b6 806 );
65867078 807 ob->command_timeout = oldtimeout;
193e3acd 808
6ebd79ec
JH
809 /* TLS negotiation failed; give an error. Try in clear on a new
810 connection, if the options permit it for this host. */
193e3acd 811 if (rc != OK)
83b27293 812 {
6ebd79ec 813 if (rc == DEFER)
a1bccd48 814 {
83b27293 815 (void)close(inblock.sock);
5032d1cf 816# ifdef EXPERIMENTAL_EVENT
774ef2d7 817 (void) event_raise(addr->transport->event_action,
83b27293 818 US"tcp:close", NULL);
5032d1cf 819# endif
6ebd79ec
JH
820# ifdef EXPERIMENTAL_DANE
821 if (dane)
822 {
823 if (!dane_required)
824 {
825 log_write(0, LOG_MAIN, "DANE attempt failed;"
826 " trying CA-root TLS to %s [%s] (not in hosts_require_dane)",
827 host->name, host->address);
828 dane = FALSE;
829 goto tls_negotiate;
830 }
831 }
832 else
833# endif
834 if ( ob->tls_tempfail_tryclear
835 && !smtps
836 && verify_check_given_host(&ob->hosts_require_tls, host) != OK
837 )
838 {
839 log_write(0, LOG_MAIN, "TLS session failure:"
840 " delivering unencrypted to %s [%s] (not in hosts_require_tls)",
841 host->name, host->address);
842 suppress_tls = TRUE;
843 goto tls_retry_connection;
844 }
a7538db1 845 }
6ebd79ec 846
a7538db1
JH
847 /*save_errno = ERRNO_TLSFAILURE;*/
848 /*message = US"failure while setting up TLS session";*/
849 send_quit = FALSE;
850 done= FALSE;
851 goto TLS_FAILED;
852 }
193e3acd
JH
853
854 /* TLS session is set up. Copy info for logging. */
855 addr->cipher = tls_out.cipher;
856 addr->peerdn = tls_out.peerdn;
857
858 /* For SMTPS we need to wait for the initial OK response, then do HELO. */
859 if (smtps)
a7538db1 860 goto smtps_redo_greeting;
193e3acd
JH
861
862 /* For STARTTLS we need to redo EHLO */
863 goto tls_redo_helo;
864 }
817d9f57
JH
865 }
866
193e3acd
JH
867 /* If the host is required to use a secure channel, ensure that we have one. */
868 if (tls_out.active < 0)
0e66b3b6 869 if (
5032d1cf 870# ifdef EXPERIMENTAL_DANE
0e66b3b6 871 dane ||
5032d1cf 872# endif
5130845b 873 verify_check_given_host(&ob->hosts_require_tls, host) == OK
7a31d643 874 )
193e3acd
JH
875 {
876 /*save_errno = ERRNO_TLSREQUIRED;*/
c562fd30
JH
877 log_write(0, LOG_MAIN,
878 "H=%s [%s]: a TLS session is required for this host, but %s",
193e3acd 879 host->name, host->address,
c562fd30
JH
880 tls_offered ? "an attempt to start TLS failed"
881 : "the server did not offer TLS support");
193e3acd
JH
882 done= FALSE;
883 goto TLS_FAILED;
884 }
817d9f57 885
5032d1cf 886#endif /*SUPPORT_TLS*/
817d9f57 887
193e3acd 888 done = TRUE; /* so far so good; have response to HELO */
817d9f57 889
d6e96b36 890 /*XXX the EHLO response would be analyzed here for IGNOREQUOTA, SIZE, PIPELINING */
817d9f57 891
d6e96b36 892 /* For now, transport_filter by cutthrough-delivery is not supported */
193e3acd 893 /* Need proper integration with the proper transport mechanism. */
5032d1cf 894 if (cutthrough.delivery)
d6e96b36 895 {
6e62c454
JH
896 if (addr->transport->filter_command)
897 {
5032d1cf 898 cutthrough.delivery = FALSE;
6e62c454
JH
899 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
900 }
a7538db1 901#ifndef DISABLE_DKIM
6e62c454
JH
902 if (ob->dkim_domain)
903 {
5032d1cf 904 cutthrough.delivery = FALSE;
6e62c454
JH
905 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
906 }
a7538db1 907#endif
d6e96b36 908 }
817d9f57 909
193e3acd
JH
910 SEND_FAILED:
911 RESPONSE_FAILED:
912 TLS_FAILED:
913 ;
914 /* Clear down of the TLS, SMTP and TCP layers on error is handled below. */
059ec3d9 915
193e3acd
JH
916 /* Failure to accept HELO is cached; this blocks the whole domain for all
917 senders. I/O errors and defer responses are not cached. */
918
919 if (!done)
2b1c6e3a 920 {
193e3acd
JH
921 *failure_ptr = US"mail"; /* At or before MAIL */
922 if (errno == 0 && responsebuffer[0] == '5')
923 {
924 setflag(addr, af_verify_nsfail);
925 new_domain_record.result = ccache_reject;
926 }
2b1c6e3a 927 }
2b1c6e3a 928
d6e96b36 929 /* If we haven't authenticated, but are required to, give up. */
fcc8e047
JH
930 /* Try to AUTH */
931
932 else done = smtp_auth(responsebuffer, sizeof(responsebuffer),
933 addr, host, ob, esmtp, &inblock, &outblock) == OK &&
934
b4a2b536
JH
935 /* Copy AUTH info for logging */
936 ( (addr->authenticator = client_authenticator),
937 (addr->auth_id = client_authenticated_id),
938
fcc8e047 939 /* Build a mail-AUTH string (re-using responsebuffer for convenience */
b4a2b536
JH
940 !smtp_mail_auth_str(responsebuffer, sizeof(responsebuffer), addr, ob)
941 ) &&
942
943 ( (addr->auth_sndr = client_authenticated_sender),
fcc8e047 944
193e3acd 945 /* Send the MAIL command */
b4a2b536
JH
946 (smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>%s\r\n",
947 from_address, responsebuffer) >= 0)
948 ) &&
2b1c6e3a 949
193e3acd
JH
950 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
951 '2', callout);
059ec3d9 952
00bff6f6
JH
953 deliver_host = deliver_host_address = NULL;
954 deliver_domain = save_deliver_domain;
955
193e3acd
JH
956 /* If the host does not accept MAIL FROM:<>, arrange to cache this
957 information, but again, don't record anything for an I/O error or a defer. Do
958 not cache rejections of MAIL when a non-empty sender has been used, because
959 that blocks the whole domain for all senders. */
059ec3d9 960
193e3acd 961 if (!done)
059ec3d9 962 {
193e3acd
JH
963 *failure_ptr = US"mail"; /* At or before MAIL */
964 if (errno == 0 && responsebuffer[0] == '5')
965 {
966 setflag(addr, af_verify_nsfail);
967 if (from_address[0] == 0)
968 new_domain_record.result = ccache_reject_mfnull;
969 }
059ec3d9 970 }
059ec3d9 971
193e3acd
JH
972 /* Otherwise, proceed to check a "random" address (if required), then the
973 given address, and the postmaster address (if required). Between each check,
974 issue RSET, because some servers accept only one recipient after MAIL
975 FROM:<>.
2b1c6e3a 976
193e3acd
JH
977 Before doing this, set the result in the domain cache record to "accept",
978 unless its previous value was ccache_reject_mfnull. In that case, the domain
979 rejects MAIL FROM:<> and we want to continue to remember that. When that is
980 the case, we have got here only in the case of a recipient verification with
981 a non-null sender. */
059ec3d9 982
193e3acd 983 else
059ec3d9 984 {
193e3acd
JH
985 new_domain_record.result =
986 (old_domain_cache_result == ccache_reject_mfnull)?
987 ccache_reject_mfnull: ccache_accept;
059ec3d9 988
193e3acd 989 /* Do the random local part check first */
059ec3d9 990
193e3acd 991 if (random_local_part != NULL)
059ec3d9 992 {
193e3acd
JH
993 uschar randombuffer[1024];
994 BOOL random_ok =
995 smtp_write_command(&outblock, FALSE,
996 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part,
997 addr->domain) >= 0 &&
998 smtp_read_response(&inblock, randombuffer,
999 sizeof(randombuffer), '2', callout);
059ec3d9 1000
193e3acd 1001 /* Remember when we last did a random test */
059ec3d9 1002
193e3acd 1003 new_domain_record.random_stamp = time(NULL);
059ec3d9 1004
193e3acd 1005 /* If accepted, we aren't going to do any further tests below. */
059ec3d9 1006
193e3acd 1007 if (random_ok)
193e3acd 1008 new_domain_record.random_result = ccache_accept;
059ec3d9 1009
193e3acd
JH
1010 /* Otherwise, cache a real negative response, and get back to the right
1011 state to send RCPT. Unless there's some problem such as a dropped
1012 connection, we expect to succeed, because the commands succeeded above. */
059ec3d9 1013
193e3acd
JH
1014 else if (errno == 0)
1015 {
5032d1cf
JH
1016 cancel_cutthrough_connection("random-recipient");
1017
193e3acd
JH
1018 if (randombuffer[0] == '5')
1019 new_domain_record.random_result = ccache_reject;
1020
1021 done =
1022 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1023 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1024 '2', callout) &&
1025
1026 smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>\r\n",
1027 from_address) >= 0 &&
1028 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1029 '2', callout);
1030 }
1031 else done = FALSE; /* Some timeout/connection problem */
1032 } /* Random check */
059ec3d9 1033
193e3acd
JH
1034 /* If the host is accepting all local parts, as determined by the "random"
1035 check, we don't need to waste time doing any further checking. */
059ec3d9 1036
193e3acd 1037 if (new_domain_record.random_result != ccache_accept && done)
059ec3d9 1038 {
193e3acd
JH
1039 /* Get the rcpt_include_affixes flag from the transport if there is one,
1040 but assume FALSE if there is not. */
e4bdf652 1041
059ec3d9 1042 done =
193e3acd
JH
1043 smtp_write_command(&outblock, FALSE, "RCPT TO:<%.1000s>\r\n",
1044 transport_rcpt_address(addr,
1045 (addr->transport == NULL)? FALSE :
1046 addr->transport->rcpt_include_affixes)) >= 0 &&
1047 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1048 '2', callout);
059ec3d9 1049
193e3acd
JH
1050 if (done)
1051 new_address_record.result = ccache_accept;
1052 else if (errno == 0 && responsebuffer[0] == '5')
1053 {
1054 *failure_ptr = US"recipient";
1055 new_address_record.result = ccache_reject;
1056 }
059ec3d9 1057
193e3acd
JH
1058 /* Do postmaster check if requested; if a full check is required, we
1059 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
2a4be8f9 1060
193e3acd
JH
1061 if (done && pm_mailfrom != NULL)
1062 {
5032d1cf
JH
1063 /*XXX not suitable for cutthrough - we cannot afford to do an RSET
1064 and lose the original mail-from */
1065 cancel_cutthrough_connection("postmaster verify");
193e3acd
JH
1066 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of postmaster verify\n");
1067
1068 done =
1069 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1070 smtp_read_response(&inblock, responsebuffer,
1071 sizeof(responsebuffer), '2', callout) &&
1072
1073 smtp_write_command(&outblock, FALSE,
1074 "MAIL FROM:<%s>\r\n", pm_mailfrom) >= 0 &&
1075 smtp_read_response(&inblock, responsebuffer,
1076 sizeof(responsebuffer), '2', callout) &&
1077
1078 /* First try using the current domain */
1079
1080 ((
1081 smtp_write_command(&outblock, FALSE,
1082 "RCPT TO:<postmaster@%.1000s>\r\n", addr->domain) >= 0 &&
1083 smtp_read_response(&inblock, responsebuffer,
1084 sizeof(responsebuffer), '2', callout)
1085 )
1086
1087 ||
1088
1089 /* If that doesn't work, and a full check is requested,
1090 try without the domain. */
1091
1092 (
1093 (options & vopt_callout_fullpm) != 0 &&
1094 smtp_write_command(&outblock, FALSE,
1095 "RCPT TO:<postmaster>\r\n") >= 0 &&
1096 smtp_read_response(&inblock, responsebuffer,
1097 sizeof(responsebuffer), '2', callout)
1098 ));
1099
1100 /* Sort out the cache record */
1101
1102 new_domain_record.postmaster_stamp = time(NULL);
1103
1104 if (done)
1105 new_domain_record.postmaster_result = ccache_accept;
1106 else if (errno == 0 && responsebuffer[0] == '5')
1107 {
1108 *failure_ptr = US"postmaster";
1109 setflag(addr, af_verify_pmfail);
1110 new_domain_record.postmaster_result = ccache_reject;
1111 }
1112 }
1113 } /* Random not accepted */
1114 } /* MAIL FROM: accepted */
2a4be8f9 1115
193e3acd
JH
1116 /* For any failure of the main check, other than a negative response, we just
1117 close the connection and carry on. We can identify a negative response by the
1118 fact that errno is zero. For I/O errors it will be non-zero
2a4be8f9 1119
193e3acd
JH
1120 Set up different error texts for logging and for sending back to the caller
1121 as an SMTP response. Log in all cases, using a one-line format. For sender
1122 callouts, give a full response to the caller, but for recipient callouts,
1123 don't give the IP address because this may be an internal host whose identity
1124 is not to be widely broadcast. */
2a4be8f9 1125
193e3acd
JH
1126 if (!done)
1127 {
1128 if (errno == ETIMEDOUT)
1129 {
1130 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
1131 send_quit = FALSE;
1132 }
1133 else if (errno == 0)
1134 {
1135 if (*responsebuffer == 0) Ustrcpy(responsebuffer, US"connection dropped");
2a4be8f9 1136
193e3acd
JH
1137 addr->message =
1138 string_sprintf("response to \"%s\" from %s [%s] was: %s",
1139 big_buffer, host->name, host->address,
1140 string_printing(responsebuffer));
059ec3d9 1141
193e3acd
JH
1142 addr->user_message = is_recipient?
1143 string_sprintf("Callout verification failed:\n%s", responsebuffer)
1144 :
1145 string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1146 host->address, big_buffer, responsebuffer);
059ec3d9 1147
193e3acd
JH
1148 /* Hard rejection ends the process */
1149
1150 if (responsebuffer[0] == '5') /* Address rejected */
059ec3d9 1151 {
193e3acd
JH
1152 yield = FAIL;
1153 done = TRUE;
059ec3d9
PH
1154 }
1155 }
193e3acd 1156 }
059ec3d9 1157
193e3acd
JH
1158 /* End the SMTP conversation and close the connection. */
1159
5032d1cf
JH
1160 /* Cutthrough - on a successfull connect and recipient-verify with
1161 use-sender and we are 1st rcpt and have no cutthrough conn so far
193e3acd 1162 here is where we want to leave the conn open */
5032d1cf
JH
1163 if ( cutthrough.delivery
1164 && rcpt_count == 1
193e3acd
JH
1165 && done
1166 && yield == OK
1167 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster)) == vopt_callout_recipsender
1168 && !random_local_part
1169 && !pm_mailfrom
5032d1cf 1170 && cutthrough.fd < 0
66ba1a69 1171 && !lmtp
193e3acd 1172 )
059ec3d9 1173 {
5032d1cf
JH
1174 cutthrough.fd = outblock.sock; /* We assume no buffer in use in the outblock */
1175 cutthrough.nrcpt = 1;
1176 cutthrough.interface = interface;
1177 cutthrough.host = *host;
1178 cutthrough.addr = *addr; /* Save the address_item for later logging */
1179 cutthrough.addr.next = NULL;
1180 cutthrough.addr.host_used = &cutthrough.host;
193e3acd 1181 if (addr->parent)
5032d1cf
JH
1182 *(cutthrough.addr.parent = store_get(sizeof(address_item))) =
1183 *addr->parent;
193e3acd
JH
1184 ctblock.buffer = ctbuffer;
1185 ctblock.buffersize = sizeof(ctbuffer);
1186 ctblock.ptr = ctbuffer;
1187 /* ctblock.cmd_count = 0; ctblock.authenticating = FALSE; */
5032d1cf 1188 ctblock.sock = cutthrough.fd;
059ec3d9 1189 }
193e3acd 1190 else
059ec3d9 1191 {
2e5b33cd 1192 /* Ensure no cutthrough on multiple address verifies */
193e3acd 1193 if (options & vopt_callout_recipsender)
2e5b33cd 1194 cancel_cutthrough_connection("multiple verify calls");
193e3acd 1195 if (send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
059ec3d9 1196
a7538db1 1197#ifdef SUPPORT_TLS
193e3acd 1198 tls_close(FALSE, TRUE);
a7538db1 1199#endif
193e3acd 1200 (void)close(inblock.sock);
774ef2d7
JH
1201#ifdef EXPERIMENTAL_EVENT
1202 (void) event_raise(addr->transport->event_action,
a7538db1
JH
1203 US"tcp:close", NULL);
1204#endif
059ec3d9 1205 }
059ec3d9 1206
193e3acd
JH
1207 } /* Loop through all hosts, while !done */
1208 }
059ec3d9
PH
1209
1210/* If we get here with done == TRUE, a successful callout happened, and yield
1211will be set OK or FAIL according to the response to the RCPT command.
1212Otherwise, we looped through the hosts but couldn't complete the business.
1213However, there may be domain-specific information to cache in both cases.
1214
1215The value of the result field in the new_domain record is ccache_unknown if
90e9ce59 1216there was an error before or with MAIL FROM:, and errno was not zero,
059ec3d9 1217implying some kind of I/O error. We don't want to write the cache in that case.
2b1c6e3a 1218Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
059ec3d9
PH
1219
1220if (!callout_no_cache && new_domain_record.result != ccache_unknown)
1221 {
1222 if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
1223 == NULL)
1224 {
1225 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
1226 }
1227 else
1228 {
1229 (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
1230 (int)sizeof(dbdata_callout_cache));
1231 HDEBUG(D_verify) debug_printf("wrote callout cache domain record:\n"
1232 " result=%d postmaster=%d random=%d\n",
1233 new_domain_record.result,
1234 new_domain_record.postmaster_result,
1235 new_domain_record.random_result);
1236 }
1237 }
1238
1239/* If a definite result was obtained for the callout, cache it unless caching
1240is disabled. */
1241
1242if (done)
1243 {
1244 if (!callout_no_cache && new_address_record.result != ccache_unknown)
1245 {
1246 if (dbm_file == NULL)
1247 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
1248 if (dbm_file == NULL)
1249 {
1250 HDEBUG(D_verify) debug_printf("no callout cache available\n");
1251 }
1252 else
1253 {
1254 (void)dbfn_write(dbm_file, address_key, &new_address_record,
1255 (int)sizeof(dbdata_callout_cache_address));
1256 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record\n",
1257 (new_address_record.result == ccache_accept)? "positive" : "negative");
1258 }
1259 }
1260 } /* done */
1261
1262/* Failure to connect to any host, or any response other than 2xx or 5xx is a
1263temporary error. If there was only one host, and a response was received, leave
1264it alone if supplying details. Otherwise, give a generic response. */
1265
1266else /* !done */
1267 {
1268 uschar *dullmsg = string_sprintf("Could not complete %s verify callout",
1269 is_recipient? "recipient" : "sender");
1270 yield = DEFER;
1271
1272 if (host_list->next != NULL || addr->message == NULL) addr->message = dullmsg;
1273
1274 addr->user_message = (!smtp_return_error_details)? dullmsg :
1275 string_sprintf("%s for <%s>.\n"
1276 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1277 "they may be permanently unreachable from this server. In the latter case,\n%s",
1278 dullmsg, addr->address,
1279 is_recipient?
1280 "the address will never be accepted."
1281 :
1282 "you need to change the address or create an MX record for its domain\n"
1283 "if it is supposed to be generally accessible from the Internet.\n"
1284 "Talk to your mail administrator for details.");
1285
1286 /* Force a specific error code */
1287
1288 addr->basic_errno = ERRNO_CALLOUTDEFER;
1289 }
1290
1291/* Come here from within the cache-reading code on fast-track exit. */
1292
1293END_CALLOUT:
1294if (dbm_file != NULL) dbfn_close(dbm_file);
1295return yield;
1296}
1297
1298
1299
817d9f57
JH
1300/* Called after recipient-acl to get a cutthrough connection open when
1301 one was requested and a recipient-verify wasn't subsequently done.
1302*/
e4bdf652
JH
1303void
1304open_cutthrough_connection( address_item * addr )
1305{
1306address_item addr2;
1307
1308/* Use a recipient-verify-callout to set up the cutthrough connection. */
1309/* We must use a copy of the address for verification, because it might
1310get rewritten. */
1311
1312addr2 = *addr;
5032d1cf
JH
1313HDEBUG(D_acl) debug_printf("----------- %s cutthrough setup ------------\n",
1314 rcpt_count > 1 ? "more" : "start");
e4bdf652
JH
1315(void) verify_address(&addr2, NULL,
1316 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1317 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1318 NULL, NULL, NULL);
1319HDEBUG(D_acl) debug_printf("----------- end cutthrough setup ------------\n");
1320return;
1321}
1322
1323
e4bdf652 1324
817d9f57
JH
1325/* Send given number of bytes from the buffer */
1326static BOOL
1327cutthrough_send(int n)
e4bdf652 1328{
5032d1cf 1329if(cutthrough.fd < 0)
817d9f57 1330 return TRUE;
e4bdf652 1331
817d9f57
JH
1332if(
1333#ifdef SUPPORT_TLS
5032d1cf 1334 (tls_out.active == cutthrough.fd) ? tls_write(FALSE, ctblock.buffer, n) :
817d9f57 1335#endif
5032d1cf 1336 send(cutthrough.fd, ctblock.buffer, n, 0) > 0
817d9f57
JH
1337 )
1338{
1339 transport_count += n;
1340 ctblock.ptr= ctblock.buffer;
1341 return TRUE;
1342}
e4bdf652 1343
817d9f57
JH
1344HDEBUG(D_transport|D_acl) debug_printf("cutthrough_send failed: %s\n", strerror(errno));
1345return FALSE;
e4bdf652
JH
1346}
1347
1348
1349
817d9f57
JH
1350static BOOL
1351_cutthrough_puts(uschar * cp, int n)
1352{
1353while(n--)
1354 {
1355 if(ctblock.ptr >= ctblock.buffer+ctblock.buffersize)
1356 if(!cutthrough_send(ctblock.buffersize))
1357 return FALSE;
1358
1359 *ctblock.ptr++ = *cp++;
1360 }
1361return TRUE;
1362}
1363
1364/* Buffered output of counted data block. Return boolean success */
e4bdf652
JH
1365BOOL
1366cutthrough_puts(uschar * cp, int n)
1367{
5032d1cf 1368if (cutthrough.fd < 0) return TRUE;
817d9f57 1369if (_cutthrough_puts(cp, n)) return TRUE;
2e5b33cd 1370cancel_cutthrough_connection("transmit failed");
817d9f57
JH
1371return FALSE;
1372}
e4bdf652 1373
e4bdf652 1374
817d9f57 1375static BOOL
5032d1cf 1376_cutthrough_flush_send(void)
817d9f57
JH
1377{
1378int n= ctblock.ptr-ctblock.buffer;
e4bdf652 1379
817d9f57
JH
1380if(n>0)
1381 if(!cutthrough_send(n))
1382 return FALSE;
1383return TRUE;
e4bdf652
JH
1384}
1385
817d9f57
JH
1386
1387/* Send out any bufferred output. Return boolean success. */
e4bdf652 1388BOOL
5032d1cf 1389cutthrough_flush_send(void)
e4bdf652 1390{
817d9f57 1391if (_cutthrough_flush_send()) return TRUE;
2e5b33cd 1392cancel_cutthrough_connection("transmit failed");
e4bdf652
JH
1393return FALSE;
1394}
1395
1396
1397BOOL
5032d1cf 1398cutthrough_put_nl(void)
e4bdf652
JH
1399{
1400return cutthrough_puts(US"\r\n", 2);
1401}
1402
1403
1404/* Get and check response from cutthrough target */
1405static uschar
1406cutthrough_response(char expect, uschar ** copy)
1407{
1408smtp_inblock inblock;
1409uschar inbuffer[4096];
1410uschar responsebuffer[4096];
1411
1412inblock.buffer = inbuffer;
1413inblock.buffersize = sizeof(inbuffer);
1414inblock.ptr = inbuffer;
1415inblock.ptrend = inbuffer;
5032d1cf 1416inblock.sock = cutthrough.fd;
817d9f57 1417/* this relies on (inblock.sock == tls_out.active) */
e4bdf652 1418if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, CUTTHROUGH_DATA_TIMEOUT))
2e5b33cd 1419 cancel_cutthrough_connection("target timeout on read");
e4bdf652
JH
1420
1421if(copy != NULL)
1422 {
1423 uschar * cp;
5032d1cf 1424 *copy = cp = string_copy(responsebuffer);
e4bdf652
JH
1425 /* Trim the trailing end of line */
1426 cp += Ustrlen(responsebuffer);
1427 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1428 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1429 }
1430
1431return responsebuffer[0];
1432}
1433
1434
1435/* Negotiate dataphase with the cutthrough target, returning success boolean */
1436BOOL
5032d1cf 1437cutthrough_predata(void)
e4bdf652 1438{
5032d1cf 1439if(cutthrough.fd < 0)
e4bdf652
JH
1440 return FALSE;
1441
1442HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> DATA\n");
817d9f57
JH
1443cutthrough_puts(US"DATA\r\n", 6);
1444cutthrough_flush_send();
e4bdf652
JH
1445
1446/* Assume nothing buffered. If it was it gets ignored. */
1447return cutthrough_response('3', NULL) == '3';
1448}
1449
1450
511a6c14
JH
1451/* fd and use_crlf args only to match write_chunk() */
1452static BOOL
1453cutthrough_write_chunk(int fd, uschar * s, int len, BOOL use_crlf)
1454{
1455uschar * s2;
1456while(s && (s2 = Ustrchr(s, '\n')))
1457 {
1458 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1459 return FALSE;
1460 s = s2+1;
1461 }
1462return TRUE;
1463}
1464
1465
e4bdf652 1466/* Buffered send of headers. Return success boolean. */
817d9f57 1467/* Expands newlines to wire format (CR,NL). */
e4bdf652 1468/* Also sends header-terminating blank line. */
e4bdf652 1469BOOL
5032d1cf 1470cutthrough_headers_send(void)
e4bdf652 1471{
5032d1cf 1472if(cutthrough.fd < 0)
e4bdf652
JH
1473 return FALSE;
1474
511a6c14
JH
1475/* We share a routine with the mainline transport to handle header add/remove/rewrites,
1476 but having a separate buffered-output function (for now)
1477*/
1478HDEBUG(D_acl) debug_printf("----------- start cutthrough headers send -----------\n");
e4bdf652 1479
5032d1cf
JH
1480if (!transport_headers_send(&cutthrough.addr, cutthrough.fd,
1481 cutthrough.addr.transport->add_headers,
1482 cutthrough.addr.transport->remove_headers,
511a6c14 1483 &cutthrough_write_chunk, TRUE,
5032d1cf
JH
1484 cutthrough.addr.transport->rewrite_rules,
1485 cutthrough.addr.transport->rewrite_existflags))
511a6c14
JH
1486 return FALSE;
1487
1488HDEBUG(D_acl) debug_printf("----------- done cutthrough headers send ------------\n");
1489return TRUE;
817d9f57
JH
1490}
1491
1492
1493static void
5032d1cf 1494close_cutthrough_connection(const char * why)
817d9f57 1495{
5032d1cf 1496if(cutthrough.fd >= 0)
817d9f57
JH
1497 {
1498 /* We could be sending this after a bunch of data, but that is ok as
1499 the only way to cancel the transfer in dataphase is to drop the tcp
1500 conn before the final dot.
1501 */
1502 ctblock.ptr = ctbuffer;
1503 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> QUIT\n");
1504 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1505 _cutthrough_flush_send();
1506 /* No wait for response */
1507
1508 #ifdef SUPPORT_TLS
1509 tls_close(FALSE, TRUE);
1510 #endif
5032d1cf
JH
1511 (void)close(cutthrough.fd);
1512 cutthrough.fd = -1;
2e5b33cd 1513 HDEBUG(D_acl) debug_printf("----------- cutthrough shutdown (%s) ------------\n", why);
817d9f57
JH
1514 }
1515ctblock.ptr = ctbuffer;
e4bdf652
JH
1516}
1517
817d9f57 1518void
5032d1cf 1519cancel_cutthrough_connection(const char * why)
817d9f57 1520{
2e5b33cd 1521close_cutthrough_connection(why);
5032d1cf 1522cutthrough.delivery = FALSE;
817d9f57
JH
1523}
1524
1525
1526
e4bdf652
JH
1527
1528/* Have senders final-dot. Send one to cutthrough target, and grab the response.
1529 Log an OK response as a transmission.
817d9f57 1530 Close the connection.
e4bdf652 1531 Return smtp response-class digit.
e4bdf652
JH
1532*/
1533uschar *
5032d1cf 1534cutthrough_finaldot(void)
e4bdf652 1535{
5032d1cf
JH
1536uschar res;
1537address_item * addr;
e4bdf652
JH
1538HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> .\n");
1539
1540/* Assume data finshed with new-line */
5032d1cf
JH
1541if( !cutthrough_puts(US".", 1)
1542 || !cutthrough_put_nl()
1543 || !cutthrough_flush_send()
1544 )
1545 return cutthrough.addr.message;
e4bdf652 1546
5032d1cf
JH
1547res = cutthrough_response('2', &cutthrough.addr.message);
1548for (addr = &cutthrough.addr; addr; addr = addr->next)
817d9f57 1549 {
5032d1cf
JH
1550 addr->message = cutthrough.addr.message;
1551 switch(res)
1552 {
1553 case '2':
1554 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1555 close_cutthrough_connection("delivered");
1556 break;
817d9f57 1557
5032d1cf
JH
1558 case '4':
1559 delivery_log(LOG_MAIN, addr, 0,
1560 US"tmp-reject from cutthrough after DATA:");
1561 break;
e4bdf652 1562
5032d1cf
JH
1563 case '5':
1564 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1565 US"rejected after DATA:");
1566 break;
e4bdf652 1567
5032d1cf
JH
1568 default:
1569 break;
1570 }
817d9f57 1571 }
5032d1cf 1572return cutthrough.addr.message;
e4bdf652
JH
1573}
1574
1575
817d9f57 1576
059ec3d9
PH
1577/*************************************************
1578* Copy error to toplevel address *
1579*************************************************/
1580
1581/* This function is used when a verify fails or defers, to ensure that the
1582failure or defer information is in the original toplevel address. This applies
1583when an address is redirected to a single new address, and the failure or
1584deferral happens to the child address.
1585
1586Arguments:
1587 vaddr the verify address item
1588 addr the final address item
1589 yield FAIL or DEFER
1590
1591Returns: the value of YIELD
1592*/
1593
1594static int
1595copy_error(address_item *vaddr, address_item *addr, int yield)
1596{
1597if (addr != vaddr)
1598 {
1599 vaddr->message = addr->message;
1600 vaddr->user_message = addr->user_message;
1601 vaddr->basic_errno = addr->basic_errno;
1602 vaddr->more_errno = addr->more_errno;
b37c4101 1603 vaddr->p.address_data = addr->p.address_data;
42855d71 1604 copyflag(vaddr, addr, af_pass_message);
059ec3d9
PH
1605 }
1606return yield;
1607}
1608
1609
1610
1611
ce552449
NM
1612/**************************************************
1613* printf that automatically handles TLS if needed *
1614***************************************************/
1615
1616/* This function is used by verify_address() as a substitute for all fprintf()
1617calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1618as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1619that assumes that we always use the smtp_out FILE* when not using TLS or the
1620ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1621that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1622fprintf().
1623
1624Arguments:
1625 f the candidate FILE* to write to
1626 format format string
1627 ... optional arguments
1628
1629Returns:
1630 nothing
1631*/
1632
1633static void PRINTF_FUNCTION(2,3)
1ba28e2b 1634respond_printf(FILE *f, const char *format, ...)
ce552449
NM
1635{
1636va_list ap;
1637
1638va_start(ap, format);
1639if (smtp_out && (f == smtp_out))
1640 smtp_vprintf(format, ap);
1641else
513afc6a 1642 vfprintf(f, format, ap);
ce552449
NM
1643va_end(ap);
1644}
1645
1646
1647
059ec3d9
PH
1648/*************************************************
1649* Verify an email address *
1650*************************************************/
1651
1652/* This function is used both for verification (-bv and at other times) and
1653address testing (-bt), which is indicated by address_test_mode being set.
1654
1655Arguments:
1656 vaddr contains the address to verify; the next field in this block
1657 must be NULL
1658 f if not NULL, write the result to this file
1659 options various option bits:
1660 vopt_fake_sender => this sender verify is not for the real
1661 sender (it was verify=sender=xxxx or an address from a
1662 header line) - rewriting must not change sender_address
1663 vopt_is_recipient => this is a recipient address, otherwise
1664 it's a sender address - this affects qualification and
1665 rewriting and messages from callouts
1666 vopt_qualify => qualify an unqualified address; else error
1667 vopt_expn => called from SMTP EXPN command
eafd343b
TK
1668 vopt_success_on_redirect => when a new address is generated
1669 the verification instantly succeeds
059ec3d9
PH
1670
1671 These ones are used by do_callout() -- the options variable
1672 is passed to it.
1673
2a4be8f9 1674 vopt_callout_fullpm => if postmaster check, do full one
059ec3d9
PH
1675 vopt_callout_no_cache => don't use callout cache
1676 vopt_callout_random => do the "random" thing
1677 vopt_callout_recipsender => use real sender for recipient
1678 vopt_callout_recippmaster => use postmaster for recipient
1679
1680 callout if > 0, specifies that callout is required, and gives timeout
4deaf07d 1681 for individual commands
059ec3d9
PH
1682 callout_overall if > 0, gives overall timeout for the callout function;
1683 if < 0, a default is used (see do_callout())
8e669ac1 1684 callout_connect the connection timeout for callouts
059ec3d9
PH
1685 se_mailfrom when callout is requested to verify a sender, use this
1686 in MAIL FROM; NULL => ""
1687 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1688 thing and use this as the sender address (may be "")
1689
1690 routed if not NULL, set TRUE if routing succeeded, so we can
1691 distinguish between routing failed and callout failed
1692
1693Returns: OK address verified
1694 FAIL address failed to verify
1695 DEFER can't tell at present
1696*/
1697
1698int
1699verify_address(address_item *vaddr, FILE *f, int options, int callout,
8e669ac1 1700 int callout_overall, int callout_connect, uschar *se_mailfrom,
4deaf07d 1701 uschar *pm_mailfrom, BOOL *routed)
059ec3d9
PH
1702{
1703BOOL allok = TRUE;
1704BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
1705BOOL is_recipient = (options & vopt_is_recipient) != 0;
1706BOOL expn = (options & vopt_expn) != 0;
eafd343b 1707BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
059ec3d9
PH
1708int i;
1709int yield = OK;
1710int verify_type = expn? v_expn :
1711 address_test_mode? v_none :
1712 is_recipient? v_recipient : v_sender;
1713address_item *addr_list;
1714address_item *addr_new = NULL;
1715address_item *addr_remote = NULL;
1716address_item *addr_local = NULL;
1717address_item *addr_succeed = NULL;
8e669ac1 1718uschar **failure_ptr = is_recipient?
2c7db3f5 1719 &recipient_verify_failure : &sender_verify_failure;
059ec3d9
PH
1720uschar *ko_prefix, *cr;
1721uschar *address = vaddr->address;
1722uschar *save_sender;
1723uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1724
2c7db3f5
PH
1725/* Clear, just in case */
1726
1727*failure_ptr = NULL;
1728
059ec3d9
PH
1729/* Set up a prefix and suffix for error message which allow us to use the same
1730output statements both in EXPN mode (where an SMTP response is needed) and when
1731debugging with an output file. */
1732
1733if (expn)
1734 {
1735 ko_prefix = US"553 ";
1736 cr = US"\r";
1737 }
1738else ko_prefix = cr = US"";
1739
1740/* Add qualify domain if permitted; otherwise an unqualified address fails. */
1741
1742if (parse_find_at(address) == NULL)
1743 {
1744 if ((options & vopt_qualify) == 0)
1745 {
1746 if (f != NULL)
ce552449
NM
1747 respond_printf(f, "%sA domain is required for \"%s\"%s\n",
1748 ko_prefix, address, cr);
8e669ac1 1749 *failure_ptr = US"qualify";
059ec3d9
PH
1750 return FAIL;
1751 }
1752 address = rewrite_address_qualify(address, is_recipient);
1753 }
1754
1755DEBUG(D_verify)
1756 {
1757 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1758 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
1759 }
1760
1761/* Rewrite and report on it. Clear the domain and local part caches - these
1762may have been set by domains and local part tests during an ACL. */
1763
1764if (global_rewrite_rules != NULL)
1765 {
1766 uschar *old = address;
1767 address = rewrite_address(address, is_recipient, FALSE,
1768 global_rewrite_rules, rewrite_existflags);
1769 if (address != old)
1770 {
1771 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1772 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1773 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
1774 }
1775 }
1776
1777/* If this is the real sender address, we must update sender_address at
1778this point, because it may be referred to in the routers. */
1779
1780if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
1781 sender_address = address;
1782
1783/* If the address was rewritten to <> no verification can be done, and we have
1784to return OK. This rewriting is permitted only for sender addresses; for other
1785addresses, such rewriting fails. */
1786
1787if (address[0] == 0) return OK;
1788
d9b2312b
JH
1789/* Flip the legacy TLS-related variables over to the outbound set in case
1790they're used in the context of a transport used by verification. Reset them
1791at exit from this routine. */
1792
35aba663 1793tls_modify_variables(&tls_out);
d9b2312b 1794
059ec3d9
PH
1795/* Save a copy of the sender address for re-instating if we change it to <>
1796while verifying a sender address (a nice bit of self-reference there). */
1797
1798save_sender = sender_address;
1799
1800/* Update the address structure with the possibly qualified and rewritten
1801address. Set it up as the starting address on the chain of new addresses. */
1802
1803vaddr->address = address;
1804addr_new = vaddr;
1805
1806/* We need a loop, because an address can generate new addresses. We must also
1807cope with generated pipes and files at the top level. (See also the code and
1808comment in deliver.c.) However, it is usually the case that the router for
1809user's .forward files has its verify flag turned off.
1810
1811If an address generates more than one child, the loop is used only when
1812full_info is set, and this can only be set locally. Remote enquiries just get
1813information about the top level address, not anything that it generated. */
1814
1815while (addr_new != NULL)
1816 {
1817 int rc;
1818 address_item *addr = addr_new;
1819
1820 addr_new = addr->next;
1821 addr->next = NULL;
1822
1823 DEBUG(D_verify)
1824 {
1825 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1826 debug_printf("Considering %s\n", addr->address);
1827 }
1828
1829 /* Handle generated pipe, file or reply addresses. We don't get these
1830 when handling EXPN, as it does only one level of expansion. */
1831
1832 if (testflag(addr, af_pfr))
1833 {
1834 allok = FALSE;
1835 if (f != NULL)
1836 {
1837 BOOL allow;
1838
1839 if (addr->address[0] == '>')
1840 {
1841 allow = testflag(addr, af_allow_reply);
1842 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1843 }
1844 else
1845 {
1846 allow = (addr->address[0] == '|')?
1847 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1848 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1849 }
1850
1851 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1852 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1853 "%s\n", addr->message);
1854 else if (allow)
1855 fprintf(f, "\n transport = %s\n", addr->transport->name);
1856 else
1857 fprintf(f, " *** forbidden ***\n");
1858 }
1859 continue;
1860 }
1861
1862 /* Just in case some router parameter refers to it. */
1863
1864 return_path = (addr->p.errors_address != NULL)?
1865 addr->p.errors_address : sender_address;
1866
1867 /* Split the address into domain and local part, handling the %-hack if
1868 necessary, and then route it. While routing a sender address, set
1869 $sender_address to <> because that is what it will be if we were trying to
1870 send a bounce to the sender. */
1871
1872 if (routed != NULL) *routed = FALSE;
1873 if ((rc = deliver_split_address(addr)) == OK)
1874 {
1875 if (!is_recipient) sender_address = null_sender;
1876 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1877 &addr_succeed, verify_type);
1878 sender_address = save_sender; /* Put back the real sender */
1879 }
1880
1881 /* If routing an address succeeded, set the flag that remembers, for use when
1882 an ACL cached a sender verify (in case a callout fails). Then if routing set
1883 up a list of hosts or the transport has a host list, and the callout option
1884 is set, and we aren't in a host checking run, do the callout verification,
1885 and set another flag that notes that a callout happened. */
1886
1887 if (rc == OK)
1888 {
1889 if (routed != NULL) *routed = TRUE;
1890 if (callout > 0)
1891 {
1892 host_item *host_list = addr->host_list;
1893
26da7e20
PH
1894 /* Make up some data for use in the case where there is no remote
1895 transport. */
1896
1897 transport_feedback tf = {
1898 NULL, /* interface (=> any) */
1899 US"smtp", /* port */
1900 US"smtp", /* protocol */
1901 NULL, /* hosts */
1902 US"$smtp_active_hostname", /* helo_data */
1903 FALSE, /* hosts_override */
1904 FALSE, /* hosts_randomize */
1905 FALSE, /* gethostbyname */
1906 TRUE, /* qualify_single */
1907 FALSE /* search_parents */
1908 };
059ec3d9
PH
1909
1910 /* If verification yielded a remote transport, we want to use that
1911 transport's options, so as to mimic what would happen if we were really
1912 sending a message to this address. */
1913
1914 if (addr->transport != NULL && !addr->transport->info->local)
1915 {
929ba01c 1916 (void)(addr->transport->setup)(addr->transport, addr, &tf, 0, 0, NULL);
059ec3d9
PH
1917
1918 /* If the transport has hosts and the router does not, or if the
1919 transport is configured to override the router's hosts, we must build a
1920 host list of the transport's hosts, and find the IP addresses */
1921
1922 if (tf.hosts != NULL && (host_list == NULL || tf.hosts_override))
1923 {
1924 uschar *s;
55414b25 1925 const uschar *save_deliver_domain = deliver_domain;
750af86e 1926 uschar *save_deliver_localpart = deliver_localpart;
059ec3d9
PH
1927
1928 host_list = NULL; /* Ignore the router's hosts */
1929
1930 deliver_domain = addr->domain;
1931 deliver_localpart = addr->local_part;
1932 s = expand_string(tf.hosts);
750af86e
PH
1933 deliver_domain = save_deliver_domain;
1934 deliver_localpart = save_deliver_localpart;
059ec3d9
PH
1935
1936 if (s == NULL)
1937 {
1938 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1939 "\"%s\" in %s transport for callout: %s", tf.hosts,
1940 addr->transport->name, expand_string_message);
1941 }
1942 else
1943 {
322050c2 1944 int flags;
d8ef3577 1945 host_item *host, *nexthost;
059ec3d9
PH
1946 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1947
1948 /* Just ignore failures to find a host address. If we don't manage
8e669ac1
PH
1949 to find any addresses, the callout will defer. Note that more than
1950 one address may be found for a single host, which will result in
1951 additional host items being inserted into the chain. Hence we must
d8ef3577 1952 save the next host first. */
059ec3d9 1953
322050c2
PH
1954 flags = HOST_FIND_BY_A;
1955 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1956 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1957
d8ef3577 1958 for (host = host_list; host != NULL; host = nexthost)
059ec3d9 1959 {
d8ef3577 1960 nexthost = host->next;
8e669ac1 1961 if (tf.gethostbyname ||
7e66e54d 1962 string_is_ip_address(host->name, NULL) != 0)
55414b25 1963 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
059ec3d9 1964 else
9d9c3746
JH
1965 {
1966 uschar * d_request = NULL, * d_require = NULL;
1967 if (Ustrcmp(addr->transport->driver_name, "smtp") == 0)
1968 {
1969 smtp_transport_options_block * ob =
1970 (smtp_transport_options_block *)
1971 addr->transport->options_block;
1972 d_request = ob->dnssec_request_domains;
1973 d_require = ob->dnssec_require_domains;
1974 }
1975
059ec3d9 1976 (void)host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
55414b25 1977 d_request, d_require, NULL, NULL);
9d9c3746 1978 }
059ec3d9
PH
1979 }
1980 }
1981 }
1982 }
1983
8e669ac1 1984 /* Can only do a callout if we have at least one host! If the callout
2c7db3f5 1985 fails, it will have set ${sender,recipient}_verify_failure. */
059ec3d9
PH
1986
1987 if (host_list != NULL)
1988 {
1989 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1990 if (host_checking && !host_checking_callout)
1991 {
1992 HDEBUG(D_verify)
1993 debug_printf("... callout omitted by default when host testing\n"
1994 "(Use -bhc if you want the callouts to happen.)\n");
1995 }
1996 else
1997 {
4ed8d31a
JH
1998#ifdef SUPPORT_TLS
1999 deliver_set_expansions(addr);
2000#endif
aec45841 2001 verify_mode = is_recipient ? US"R" : US"S";
059ec3d9 2002 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
4deaf07d 2003 callout_connect, options, se_mailfrom, pm_mailfrom);
aec45841 2004 verify_mode = NULL;
059ec3d9
PH
2005 }
2006 }
2007 else
2008 {
2009 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
2010 "transport provided a host list\n");
2011 }
2012 }
2013 }
8e669ac1 2014
2c7db3f5 2015 /* Otherwise, any failure is a routing failure */
8e669ac1
PH
2016
2017 else *failure_ptr = US"route";
059ec3d9
PH
2018
2019 /* A router may return REROUTED if it has set up a child address as a result
2020 of a change of domain name (typically from widening). In this case we always
2021 want to continue to verify the new child. */
2022
2023 if (rc == REROUTED) continue;
8e669ac1 2024
059ec3d9
PH
2025 /* Handle hard failures */
2026
2027 if (rc == FAIL)
2028 {
2029 allok = FALSE;
2030 if (f != NULL)
2031 {
e6f6568e
PH
2032 address_item *p = addr->parent;
2033
ce552449
NM
2034 respond_printf(f, "%s%s %s", ko_prefix,
2035 full_info? addr->address : address,
059ec3d9
PH
2036 address_test_mode? "is undeliverable" : "failed to verify");
2037 if (!expn && admin_user)
2038 {
2039 if (addr->basic_errno > 0)
ce552449 2040 respond_printf(f, ": %s", strerror(addr->basic_errno));
059ec3d9 2041 if (addr->message != NULL)
ce552449 2042 respond_printf(f, ": %s", addr->message);
e6f6568e
PH
2043 }
2044
2045 /* Show parents iff doing full info */
2046
2047 if (full_info) while (p != NULL)
2048 {
ce552449 2049 respond_printf(f, "%s\n <-- %s", cr, p->address);
e6f6568e 2050 p = p->parent;
059ec3d9 2051 }
ce552449 2052 respond_printf(f, "%s\n", cr);
059ec3d9 2053 }
2e5b33cd 2054 cancel_cutthrough_connection("routing hard fail");
059ec3d9 2055
d9b2312b
JH
2056 if (!full_info)
2057 {
2058 yield = copy_error(vaddr, addr, FAIL);
2059 goto out;
2060 }
2061 else yield = FAIL;
059ec3d9
PH
2062 }
2063
2064 /* Soft failure */
2065
2066 else if (rc == DEFER)
2067 {
2068 allok = FALSE;
2069 if (f != NULL)
2070 {
e6f6568e 2071 address_item *p = addr->parent;
ce552449 2072 respond_printf(f, "%s%s cannot be resolved at this time", ko_prefix,
322050c2 2073 full_info? addr->address : address);
059ec3d9
PH
2074 if (!expn && admin_user)
2075 {
2076 if (addr->basic_errno > 0)
ce552449 2077 respond_printf(f, ": %s", strerror(addr->basic_errno));
059ec3d9 2078 if (addr->message != NULL)
ce552449 2079 respond_printf(f, ": %s", addr->message);
059ec3d9 2080 else if (addr->basic_errno <= 0)
ce552449 2081 respond_printf(f, ": unknown error");
059ec3d9
PH
2082 }
2083
e6f6568e
PH
2084 /* Show parents iff doing full info */
2085
2086 if (full_info) while (p != NULL)
2087 {
ce552449 2088 respond_printf(f, "%s\n <-- %s", cr, p->address);
e6f6568e
PH
2089 p = p->parent;
2090 }
ce552449 2091 respond_printf(f, "%s\n", cr);
059ec3d9 2092 }
2e5b33cd 2093 cancel_cutthrough_connection("routing soft fail");
e4bdf652 2094
d9b2312b
JH
2095 if (!full_info)
2096 {
2097 yield = copy_error(vaddr, addr, DEFER);
2098 goto out;
2099 }
2100 else if (yield == OK) yield = DEFER;
059ec3d9
PH
2101 }
2102
2103 /* If we are handling EXPN, we do not want to continue to route beyond
e6f6568e 2104 the top level (whose address is in "address"). */
059ec3d9
PH
2105
2106 else if (expn)
2107 {
2108 uschar *ok_prefix = US"250-";
2109 if (addr_new == NULL)
2110 {
2111 if (addr_local == NULL && addr_remote == NULL)
ce552449 2112 respond_printf(f, "250 mail to <%s> is discarded\r\n", address);
059ec3d9 2113 else
ce552449 2114 respond_printf(f, "250 <%s>\r\n", address);
059ec3d9
PH
2115 }
2116 else while (addr_new != NULL)
2117 {
2118 address_item *addr2 = addr_new;
2119 addr_new = addr2->next;
2120 if (addr_new == NULL) ok_prefix = US"250 ";
ce552449 2121 respond_printf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
059ec3d9 2122 }
d9b2312b
JH
2123 yield = OK;
2124 goto out;
059ec3d9
PH
2125 }
2126
2127 /* Successful routing other than EXPN. */
2128
2129 else
2130 {
2131 /* Handle successful routing when short info wanted. Otherwise continue for
2132 other (generated) addresses. Short info is the operational case. Full info
2133 can be requested only when debug_selector != 0 and a file is supplied.
2134
2135 There is a conflict between the use of aliasing as an alternate email
2136 address, and as a sort of mailing list. If an alias turns the incoming
2137 address into just one address (e.g. J.Caesar->jc44) you may well want to
2138 carry on verifying the generated address to ensure it is valid when
2139 checking incoming mail. If aliasing generates multiple addresses, you
2140 probably don't want to do this. Exim therefore treats the generation of
2141 just a single new address as a special case, and continues on to verify the
2142 generated address. */
2143
2144 if (!full_info && /* Stop if short info wanted AND */
eafd343b
TK
2145 (((addr_new == NULL || /* No new address OR */
2146 addr_new->next != NULL || /* More than one new address OR */
2147 testflag(addr_new, af_pfr))) /* New address is pfr */
2148 || /* OR */
2149 (addr_new != NULL && /* At least one new address AND */
2150 success_on_redirect))) /* success_on_redirect is set */
059ec3d9 2151 {
322050c2 2152 if (f != NULL) fprintf(f, "%s %s\n", address,
059ec3d9
PH
2153 address_test_mode? "is deliverable" : "verified");
2154
2155 /* If we have carried on to verify a child address, we want the value
2156 of $address_data to be that of the child */
2157
2158 vaddr->p.address_data = addr->p.address_data;
d9b2312b
JH
2159 yield = OK;
2160 goto out;
059ec3d9
PH
2161 }
2162 }
2163 } /* Loop for generated addresses */
2164
2165/* Display the full results of the successful routing, including any generated
2166addresses. Control gets here only when full_info is set, which requires f not
2167to be NULL, and this occurs only when a top-level verify is called with the
2168debugging switch on.
2169
2170If there are no local and no remote addresses, and there were no pipes, files,
2171or autoreplies, and there were no errors or deferments, the message is to be
2172discarded, usually because of the use of :blackhole: in an alias file. */
2173
2174if (allok && addr_local == NULL && addr_remote == NULL)
dbcef0ea 2175 {
059ec3d9 2176 fprintf(f, "mail to %s is discarded\n", address);
d9b2312b 2177 goto out;
dbcef0ea 2178 }
059ec3d9 2179
dbcef0ea 2180for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
059ec3d9
PH
2181 {
2182 while (addr_list != NULL)
2183 {
2184 address_item *addr = addr_list;
2185 address_item *p = addr->parent;
2186 addr_list = addr->next;
2187
2188 fprintf(f, "%s", CS addr->address);
384152a6
TK
2189#ifdef EXPERIMENTAL_SRS
2190 if(addr->p.srs_sender)
2191 fprintf(f, " [srs = %s]", addr->p.srs_sender);
2192#endif
dbcef0ea
PH
2193
2194 /* If the address is a duplicate, show something about it. */
2195
2196 if (!testflag(addr, af_pfr))
2197 {
2198 tree_node *tnode;
2199 if ((tnode = tree_search(tree_duplicates, addr->unique)) != NULL)
2200 fprintf(f, " [duplicate, would not be delivered]");
2201 else tree_add_duplicate(addr->unique, addr);
2202 }
2203
2204 /* Now show its parents */
2205
059ec3d9
PH
2206 while (p != NULL)
2207 {
2208 fprintf(f, "\n <-- %s", p->address);
2209 p = p->parent;
2210 }
2211 fprintf(f, "\n ");
2212
2213 /* Show router, and transport */
2214
2215 fprintf(f, "router = %s, ", addr->router->name);
2216 fprintf(f, "transport = %s\n", (addr->transport == NULL)? US"unset" :
2217 addr->transport->name);
2218
2219 /* Show any hosts that are set up by a router unless the transport
2220 is going to override them; fiddle a bit to get a nice format. */
2221
2222 if (addr->host_list != NULL && addr->transport != NULL &&
2223 !addr->transport->overrides_hosts)
2224 {
2225 host_item *h;
2226 int maxlen = 0;
2227 int maxaddlen = 0;
2228 for (h = addr->host_list; h != NULL; h = h->next)
2229 {
2230 int len = Ustrlen(h->name);
2231 if (len > maxlen) maxlen = len;
2232 len = (h->address != NULL)? Ustrlen(h->address) : 7;
2233 if (len > maxaddlen) maxaddlen = len;
2234 }
2235 for (h = addr->host_list; h != NULL; h = h->next)
2236 {
2237 int len = Ustrlen(h->name);
2238 fprintf(f, " host %s ", h->name);
2239 while (len++ < maxlen) fprintf(f, " ");
2240 if (h->address != NULL)
2241 {
2242 fprintf(f, "[%s] ", h->address);
2243 len = Ustrlen(h->address);
2244 }
2245 else if (!addr->transport->info->local) /* Omit [unknown] for local */
2246 {
2247 fprintf(f, "[unknown] ");
2248 len = 7;
2249 }
2250 else len = -3;
2251 while (len++ < maxaddlen) fprintf(f," ");
2252 if (h->mx >= 0) fprintf(f, "MX=%d", h->mx);
2253 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
2254 if (h->status == hstatus_unusable) fprintf(f, " ** unusable **");
2255 fprintf(f, "\n");
2256 }
2257 }
2258 }
2259 }
2260
d9b2312b 2261/* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2c7db3f5
PH
2262the -bv or -bt case). */
2263
d9b2312b 2264out:
35aba663 2265tls_modify_variables(&tls_in);
d9b2312b 2266
8e669ac1 2267return yield;
059ec3d9
PH
2268}
2269
2270
2271
2272
2273/*************************************************
2274* Check headers for syntax errors *
2275*************************************************/
2276
2277/* This function checks those header lines that contain addresses, and verifies
2278that all the addresses therein are syntactially correct.
2279
2280Arguments:
2281 msgptr where to put an error message
2282
2283Returns: OK
2284 FAIL
2285*/
2286
2287int
2288verify_check_headers(uschar **msgptr)
2289{
2290header_line *h;
2291uschar *colon, *s;
1eccaa59 2292int yield = OK;
059ec3d9 2293
1eccaa59 2294for (h = header_list; h != NULL && yield == OK; h = h->next)
059ec3d9
PH
2295 {
2296 if (h->type != htype_from &&
2297 h->type != htype_reply_to &&
2298 h->type != htype_sender &&
2299 h->type != htype_to &&
2300 h->type != htype_cc &&
2301 h->type != htype_bcc)
2302 continue;
2303
2304 colon = Ustrchr(h->text, ':');
2305 s = colon + 1;
2306 while (isspace(*s)) s++;
2307
1eccaa59
PH
2308 /* Loop for multiple addresses in the header, enabling group syntax. Note
2309 that we have to reset this after the header has been scanned. */
059ec3d9 2310
1eccaa59 2311 parse_allow_group = TRUE;
059ec3d9
PH
2312
2313 while (*s != 0)
2314 {
2315 uschar *ss = parse_find_address_end(s, FALSE);
2316 uschar *recipient, *errmess;
2317 int terminator = *ss;
2318 int start, end, domain;
2319
2320 /* Temporarily terminate the string at this point, and extract the
1eccaa59 2321 operative address within, allowing group syntax. */
059ec3d9
PH
2322
2323 *ss = 0;
2324 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2325 *ss = terminator;
2326
2327 /* Permit an unqualified address only if the message is local, or if the
2328 sending host is configured to be permitted to send them. */
2329
2330 if (recipient != NULL && domain == 0)
2331 {
2332 if (h->type == htype_from || h->type == htype_sender)
2333 {
2334 if (!allow_unqualified_sender) recipient = NULL;
2335 }
2336 else
2337 {
2338 if (!allow_unqualified_recipient) recipient = NULL;
2339 }
2340 if (recipient == NULL) errmess = US"unqualified address not permitted";
2341 }
2342
2343 /* It's an error if no address could be extracted, except for the special
2344 case of an empty address. */
2345
2346 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
2347 {
2348 uschar *verb = US"is";
2349 uschar *t = ss;
1ab95fa6 2350 uschar *tt = colon;
059ec3d9
PH
2351 int len;
2352
2353 /* Arrange not to include any white space at the end in the
1ab95fa6 2354 error message or the header name. */
059ec3d9
PH
2355
2356 while (t > s && isspace(t[-1])) t--;
1ab95fa6 2357 while (tt > h->text && isspace(tt[-1])) tt--;
059ec3d9 2358
1ab95fa6 2359 /* Add the address that failed to the error message, since in a
059ec3d9
PH
2360 header with very many addresses it is sometimes hard to spot
2361 which one is at fault. However, limit the amount of address to
2362 quote - cases have been seen where, for example, a missing double
2363 quote in a humungous To: header creates an "address" that is longer
2364 than string_sprintf can handle. */
2365
2366 len = t - s;
2367 if (len > 1024)
2368 {
2369 len = 1024;
2370 verb = US"begins";
2371 }
2372
55414b25
JH
2373 /* deconst cast ok as we're passing a non-const to string_printing() */
2374 *msgptr = US string_printing(
1ab95fa6
PH
2375 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2376 errmess, tt - h->text, h->text, verb, len, s));
059ec3d9 2377
1eccaa59
PH
2378 yield = FAIL;
2379 break; /* Out of address loop */
059ec3d9
PH
2380 }
2381
2382 /* Advance to the next address */
2383
2384 s = ss + (terminator? 1:0);
2385 while (isspace(*s)) s++;
2386 } /* Next address */
059ec3d9 2387
1eccaa59
PH
2388 parse_allow_group = FALSE;
2389 parse_found_group = FALSE;
2390 } /* Next header unless yield has been set FALSE */
2391
2392return yield;
059ec3d9
PH
2393}
2394
2395
770747fd
MFM
2396/*************************************************
2397* Check header names for 8-bit characters *
2398*************************************************/
2399
2400/* This function checks for invalid charcters in header names. See
2401RFC 5322, 2.2. and RFC 6532, 3.
2402
2403Arguments:
2404 msgptr where to put an error message
2405
2406Returns: OK
2407 FAIL
2408*/
2409
2410int
2411verify_check_header_names_ascii(uschar **msgptr)
2412{
2413header_line *h;
2414uschar *colon, *s;
2415
2416for (h = header_list; h != NULL; h = h->next)
2417 {
2418 colon = Ustrchr(h->text, ':');
2419 for(s = h->text; s < colon; s++)
2420 {
2421 if ((*s < 33) || (*s > 126))
2422 {
2423 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2424 colon - h->text, h->text);
2425 return FAIL;
2426 }
2427 }
2428 }
2429return OK;
2430}
059ec3d9 2431
1c41c9cc
PH
2432/*************************************************
2433* Check for blind recipients *
2434*************************************************/
2435
2436/* This function checks that every (envelope) recipient is mentioned in either
2437the To: or Cc: header lines, thus detecting blind carbon copies.
2438
2439There are two ways of scanning that could be used: either scan the header lines
2440and tick off the recipients, or scan the recipients and check the header lines.
2441The original proposed patch did the former, but I have chosen to do the latter,
2442because (a) it requires no memory and (b) will use fewer resources when there
2443are many addresses in To: and/or Cc: and only one or two envelope recipients.
2444
2445Arguments: none
2446Returns: OK if there are no blind recipients
2447 FAIL if there is at least one blind recipient
2448*/
2449
2450int
2451verify_check_notblind(void)
2452{
2453int i;
2454for (i = 0; i < recipients_count; i++)
2455 {
2456 header_line *h;
2457 BOOL found = FALSE;
2458 uschar *address = recipients_list[i].address;
2459
2460 for (h = header_list; !found && h != NULL; h = h->next)
2461 {
2462 uschar *colon, *s;
2463
2464 if (h->type != htype_to && h->type != htype_cc) continue;
2465
2466 colon = Ustrchr(h->text, ':');
2467 s = colon + 1;
2468 while (isspace(*s)) s++;
2469
1eccaa59
PH
2470 /* Loop for multiple addresses in the header, enabling group syntax. Note
2471 that we have to reset this after the header has been scanned. */
1c41c9cc 2472
1eccaa59 2473 parse_allow_group = TRUE;
1c41c9cc
PH
2474
2475 while (*s != 0)
2476 {
2477 uschar *ss = parse_find_address_end(s, FALSE);
2478 uschar *recipient,*errmess;
2479 int terminator = *ss;
2480 int start, end, domain;
2481
2482 /* Temporarily terminate the string at this point, and extract the
1eccaa59 2483 operative address within, allowing group syntax. */
1c41c9cc
PH
2484
2485 *ss = 0;
2486 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2487 *ss = terminator;
2488
2489 /* If we found a valid recipient that has a domain, compare it with the
2490 envelope recipient. Local parts are compared case-sensitively, domains
2491 case-insensitively. By comparing from the start with length "domain", we
2492 include the "@" at the end, which ensures that we are comparing the whole
2493 local part of each address. */
2494
2495 if (recipient != NULL && domain != 0)
2496 {
2497 found = Ustrncmp(recipient, address, domain) == 0 &&
2498 strcmpic(recipient + domain, address + domain) == 0;
2499 if (found) break;
2500 }
2501
2502 /* Advance to the next address */
2503
2504 s = ss + (terminator? 1:0);
2505 while (isspace(*s)) s++;
2506 } /* Next address */
1eccaa59
PH
2507
2508 parse_allow_group = FALSE;
2509 parse_found_group = FALSE;
1c41c9cc
PH
2510 } /* Next header (if found is false) */
2511
2512 if (!found) return FAIL;
2513 } /* Next recipient */
2514
2515return OK;
2516}
2517
2518
059ec3d9
PH
2519
2520/*************************************************
2521* Find if verified sender *
2522*************************************************/
2523
2524/* Usually, just a single address is verified as the sender of the message.
2525However, Exim can be made to verify other addresses as well (often related in
2526some way), and this is useful in some environments. There may therefore be a
2527chain of such addresses that have previously been tested. This function finds
2528whether a given address is on the chain.
2529
2530Arguments: the address to be verified
2531Returns: pointer to an address item, or NULL
2532*/
2533
2534address_item *
2535verify_checked_sender(uschar *sender)
2536{
2537address_item *addr;
2538for (addr = sender_verified_list; addr != NULL; addr = addr->next)
2539 if (Ustrcmp(sender, addr->address) == 0) break;
2540return addr;
2541}
2542
2543
2544
2545
2546
2547/*************************************************
2548* Get valid header address *
2549*************************************************/
2550
2551/* Scan the originator headers of the message, looking for an address that
2552verifies successfully. RFC 822 says:
2553
2554 o The "Sender" field mailbox should be sent notices of
2555 any problems in transport or delivery of the original
2556 messages. If there is no "Sender" field, then the
2557 "From" field mailbox should be used.
2558
2559 o If the "Reply-To" field exists, then the reply should
2560 go to the addresses indicated in that field and not to
2561 the address(es) indicated in the "From" field.
2562
2563So we check a Sender field if there is one, else a Reply_to field, else a From
2564field. As some strange messages may have more than one of these fields,
2565especially if they are resent- fields, check all of them if there is more than
2566one.
2567
2568Arguments:
2569 user_msgptr points to where to put a user error message
2570 log_msgptr points to where to put a log error message
2571 callout timeout for callout check (passed to verify_address())
2572 callout_overall overall callout timeout (ditto)
8e669ac1 2573 callout_connect connect callout timeout (ditto)
059ec3d9
PH
2574 se_mailfrom mailfrom for verify; NULL => ""
2575 pm_mailfrom sender for pm callout check (passed to verify_address())
2576 options callout options (passed to verify_address())
8e669ac1 2577 verrno where to put the address basic_errno
059ec3d9
PH
2578
2579If log_msgptr is set to something without setting user_msgptr, the caller
2580normally uses log_msgptr for both things.
2581
2582Returns: result of the verification attempt: OK, FAIL, or DEFER;
2583 FAIL is given if no appropriate headers are found
2584*/
2585
2586int
2587verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
8e669ac1 2588 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
fe5b5d0b 2589 uschar *pm_mailfrom, int options, int *verrno)
059ec3d9
PH
2590{
2591static int header_types[] = { htype_sender, htype_reply_to, htype_from };
1eccaa59 2592BOOL done = FALSE;
059ec3d9
PH
2593int yield = FAIL;
2594int i;
2595
1eccaa59 2596for (i = 0; i < 3 && !done; i++)
059ec3d9
PH
2597 {
2598 header_line *h;
1eccaa59 2599 for (h = header_list; h != NULL && !done; h = h->next)
059ec3d9
PH
2600 {
2601 int terminator, new_ok;
2602 uschar *s, *ss, *endname;
2603
2604 if (h->type != header_types[i]) continue;
2605 s = endname = Ustrchr(h->text, ':') + 1;
2606
1eccaa59
PH
2607 /* Scan the addresses in the header, enabling group syntax. Note that we
2608 have to reset this after the header has been scanned. */
2609
2610 parse_allow_group = TRUE;
2611
059ec3d9
PH
2612 while (*s != 0)
2613 {
2614 address_item *vaddr;
2615
2616 while (isspace(*s) || *s == ',') s++;
2617 if (*s == 0) break; /* End of header */
2618
2619 ss = parse_find_address_end(s, FALSE);
2620
2621 /* The terminator is a comma or end of header, but there may be white
2622 space preceding it (including newline for the last address). Move back
2623 past any white space so we can check against any cached envelope sender
2624 address verifications. */
2625
2626 while (isspace(ss[-1])) ss--;
2627 terminator = *ss;
2628 *ss = 0;
2629
2630 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2631 (int)(endname - h->text), h->text, s);
2632
2633 /* See if we have already verified this address as an envelope sender,
2634 and if so, use the previous answer. */
2635
2636 vaddr = verify_checked_sender(s);
2637
2638 if (vaddr != NULL && /* Previously checked */
2639 (callout <= 0 || /* No callout needed; OR */
2640 vaddr->special_action > 256)) /* Callout was done */
2641 {
2642 new_ok = vaddr->special_action & 255;
2643 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2644 *ss = terminator; /* Restore shortened string */
2645 }
2646
2647 /* Otherwise we run the verification now. We must restore the shortened
2648 string before running the verification, so the headers are correct, in
2649 case there is any rewriting. */
2650
2651 else
2652 {
2653 int start, end, domain;
1eccaa59
PH
2654 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2655 &domain, FALSE);
059ec3d9
PH
2656
2657 *ss = terminator;
2658
1eccaa59
PH
2659 /* If we found an empty address, just carry on with the next one, but
2660 kill the message. */
2661
2662 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2663 {
2664 *log_msgptr = NULL;
2665 s = ss;
2666 continue;
2667 }
2668
059ec3d9
PH
2669 /* If verification failed because of a syntax error, fail this
2670 function, and ensure that the failing address gets added to the error
2671 message. */
2672
2673 if (address == NULL)
2674 {
2675 new_ok = FAIL;
1eccaa59
PH
2676 while (ss > s && isspace(ss[-1])) ss--;
2677 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2678 "scanning for sender: %s in \"%.*s\"",
2679 endname - h->text, h->text, *log_msgptr, ss - s, s);
2680 yield = FAIL;
2681 done = TRUE;
2682 break;
059ec3d9
PH
2683 }
2684
2f6603e1 2685 /* Else go ahead with the sender verification. But it isn't *the*
059ec3d9
PH
2686 sender of the message, so set vopt_fake_sender to stop sender_address
2687 being replaced after rewriting or qualification. */
2688
2689 else
2690 {
2691 vaddr = deliver_make_addr(address, FALSE);
2692 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
8e669ac1 2693 callout, callout_overall, callout_connect, se_mailfrom,
4deaf07d 2694 pm_mailfrom, NULL);
059ec3d9
PH
2695 }
2696 }
2697
2698 /* We now have the result, either newly found, or cached. If we are
2699 giving out error details, set a specific user error. This means that the
2700 last of these will be returned to the user if all three fail. We do not
2701 set a log message - the generic one below will be used. */
2702
fe5b5d0b 2703 if (new_ok != OK)
059ec3d9 2704 {
8e669ac1 2705 *verrno = vaddr->basic_errno;
fe5b5d0b
PH
2706 if (smtp_return_error_details)
2707 {
2708 *user_msgptr = string_sprintf("Rejected after DATA: "
2709 "could not verify \"%.*s\" header address\n%s: %s",
2710 endname - h->text, h->text, vaddr->address, vaddr->message);
2711 }
8e669ac1 2712 }
059ec3d9
PH
2713
2714 /* Success or defer */
2715
1eccaa59
PH
2716 if (new_ok == OK)
2717 {
2718 yield = OK;
2719 done = TRUE;
2720 break;
2721 }
2722
059ec3d9
PH
2723 if (new_ok == DEFER) yield = DEFER;
2724
2725 /* Move on to any more addresses in the header */
2726
2727 s = ss;
1eccaa59
PH
2728 } /* Next address */
2729
2730 parse_allow_group = FALSE;
2731 parse_found_group = FALSE;
2732 } /* Next header, unless done */
2733 } /* Next header type unless done */
059ec3d9
PH
2734
2735if (yield == FAIL && *log_msgptr == NULL)
2736 *log_msgptr = US"there is no valid sender in any header line";
2737
2738if (yield == DEFER && *log_msgptr == NULL)
2739 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2740
2741return yield;
2742}
2743
2744
2745
2746
2747/*************************************************
2748* Get RFC 1413 identification *
2749*************************************************/
2750
2751/* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2752the timeout is set to zero, then the query is not done. There may also be lists
2753of hosts and nets which are exempt. To guard against malefactors sending
2754non-printing characters which could, for example, disrupt a message's headers,
2755make sure the string consists of printing characters only.
2756
2757Argument:
2758 port the port to connect to; usually this is IDENT_PORT (113), but when
2759 running in the test harness with -bh a different value is used.
2760
2761Returns: nothing
2762
2763Side effect: any received ident value is put in sender_ident (NULL otherwise)
2764*/
2765
2766void
2767verify_get_ident(int port)
2768{
2769int sock, host_af, qlen;
2770int received_sender_port, received_interface_port, n;
2771uschar *p;
2772uschar buffer[2048];
2773
2774/* Default is no ident. Check whether we want to do an ident check for this
2775host. */
2776
2777sender_ident = NULL;
2778if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2779 return;
2780
2781DEBUG(D_ident) debug_printf("doing ident callback\n");
2782
2783/* Set up a connection to the ident port of the remote host. Bind the local end
2784to the incoming interface address. If the sender host address is an IPv6
2785address, the incoming interface address will also be IPv6. */
2786
2787host_af = (Ustrchr(sender_host_address, ':') == NULL)? AF_INET : AF_INET6;
2788sock = ip_socket(SOCK_STREAM, host_af);
2789if (sock < 0) return;
2790
2791if (ip_bind(sock, host_af, interface_address, 0) < 0)
2792 {
2793 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2794 strerror(errno));
2795 goto END_OFF;
2796 }
2797
2798if (ip_connect(sock, host_af, sender_host_address, port, rfc1413_query_timeout)
2799 < 0)
2800 {
2801 if (errno == ETIMEDOUT && (log_extra_selector & LX_ident_timeout) != 0)
2802 {
2803 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2804 sender_host_address);
2805 }
2806 else
2807 {
2808 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2809 sender_host_address, strerror(errno));
2810 }
2811 goto END_OFF;
2812 }
2813
2814/* Construct and send the query. */
2815
2816sprintf(CS buffer, "%d , %d\r\n", sender_host_port, interface_port);
2817qlen = Ustrlen(buffer);
2818if (send(sock, buffer, qlen, 0) < 0)
2819 {
2820 DEBUG(D_ident) debug_printf("ident send failed: %s\n", strerror(errno));
2821 goto END_OFF;
2822 }
2823
2824/* Read a response line. We put it into the rest of the buffer, using several
2825recv() calls if necessary. */
2826
2827p = buffer + qlen;
2828
2829for (;;)
2830 {
2831 uschar *pp;
2832 int count;
2833 int size = sizeof(buffer) - (p - buffer);
2834
2835 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2836 count = ip_recv(sock, p, size, rfc1413_query_timeout);
2837 if (count <= 0) goto END_OFF; /* Read error or EOF */
2838
2839 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2840 generous, and accept a plain \n terminator as well. The only illegal
2841 character is 0. */
2842
2843 for (pp = p; pp < p + count; pp++)
2844 {
2845 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2846 if (*pp == '\n')
2847 {
2848 if (pp[-1] == '\r') pp--;
2849 *pp = 0;
2850 goto GOT_DATA; /* Break out of both loops */
2851 }
2852 }
2853
2854 /* Reached the end of the data without finding \n. Let the loop continue to
2855 read some more, if there is room. */
2856
2857 p = pp;
2858 }
2859
2860GOT_DATA:
2861
2862/* We have received a line of data. Check it carefully. It must start with the
2863same two port numbers that we sent, followed by data as defined by the RFC. For
2864example,
2865
2866 12345 , 25 : USERID : UNIX :root
2867
2868However, the amount of white space may be different to what we sent. In the
2869"osname" field there may be several sub-fields, comma separated. The data we
2870actually want to save follows the third colon. Some systems put leading spaces
2871in it - we discard those. */
2872
2873if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2874 &received_interface_port, &n) != 2 ||
2875 received_sender_port != sender_host_port ||
2876 received_interface_port != interface_port)
2877 goto END_OFF;
2878
2879p = buffer + qlen + n;
2880while(isspace(*p)) p++;
2881if (*p++ != ':') goto END_OFF;
2882while(isspace(*p)) p++;
2883if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2884p += 6;
2885while(isspace(*p)) p++;
2886if (*p++ != ':') goto END_OFF;
2887while (*p != 0 && *p != ':') p++;
2888if (*p++ == 0) goto END_OFF;
2889while(isspace(*p)) p++;
2890if (*p == 0) goto END_OFF;
2891
2892/* The rest of the line is the data we want. We turn it into printing
2893characters when we save it, so that it cannot mess up the format of any logging
2894or Received: lines into which it gets inserted. We keep a maximum of 127
55414b25 2895characters. The deconst cast is ok as we fed a nonconst to string_printing() */
059ec3d9 2896
55414b25 2897sender_ident = US string_printing(string_copyn(p, 127));
059ec3d9
PH
2898DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2899
2900END_OFF:
f1e894f3 2901(void)close(sock);
059ec3d9
PH
2902return;
2903}
2904
2905
2906
2907
2908/*************************************************
2909* Match host to a single host-list item *
2910*************************************************/
2911
2912/* This function compares a host (name or address) against a single item
2913from a host list. The host name gets looked up if it is needed and is not
2914already known. The function is called from verify_check_this_host() via
2915match_check_list(), which is why most of its arguments are in a single block.
2916
2917Arguments:
2918 arg the argument block (see below)
2919 ss the host-list item
2920 valueptr where to pass back looked up data, or NULL
2921 error for error message when returning ERROR
2922
2923The block contains:
32d668a5
PH
2924 host_name (a) the host name, or
2925 (b) NULL, implying use sender_host_name and
2926 sender_host_aliases, looking them up if required, or
2927 (c) the empty string, meaning that only IP address matches
2928 are permitted
059ec3d9
PH
2929 host_address the host address
2930 host_ipv4 the IPv4 address taken from an IPv6 one
2931
2932Returns: OK matched
2933 FAIL did not match
2934 DEFER lookup deferred
32d668a5
PH
2935 ERROR (a) failed to find the host name or IP address, or
2936 (b) unknown lookup type specified, or
2937 (c) host name encountered when only IP addresses are
2938 being matched
059ec3d9
PH
2939*/
2940
32d668a5 2941int
55414b25 2942check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
059ec3d9
PH
2943{
2944check_host_block *cb = (check_host_block *)arg;
32d668a5 2945int mlen = -1;
059ec3d9 2946int maskoffset;
32d668a5 2947BOOL iplookup = FALSE;
059ec3d9 2948BOOL isquery = FALSE;
32d668a5 2949BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
55414b25 2950const uschar *t;
32d668a5 2951uschar *semicolon;
059ec3d9
PH
2952uschar **aliases;
2953
2954/* Optimize for the special case when the pattern is "*". */
2955
2956if (*ss == '*' && ss[1] == 0) return OK;
2957
2958/* If the pattern is empty, it matches only in the case when there is no host -
2959this can occur in ACL checking for SMTP input using the -bs option. In this
2960situation, the host address is the empty string. */
2961
2962if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2963if (*ss == 0) return FAIL;
2964
32d668a5
PH
2965/* If the pattern is precisely "@" then match against the primary host name,
2966provided that host name matching is permitted; if it's "@[]" match against the
2967local host's IP addresses. */
059ec3d9
PH
2968
2969if (*ss == '@')
2970 {
32d668a5
PH
2971 if (ss[1] == 0)
2972 {
2973 if (isiponly) return ERROR;
2974 ss = primary_hostname;
2975 }
059ec3d9
PH
2976 else if (Ustrcmp(ss, "@[]") == 0)
2977 {
2978 ip_address_item *ip;
2979 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
2980 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2981 return FAIL;
2982 }
2983 }
2984
2985/* If the pattern is an IP address, optionally followed by a bitmask count, do
2986a (possibly masked) comparision with the current IP address. */
2987
7e66e54d 2988if (string_is_ip_address(ss, &maskoffset) != 0)
059ec3d9
PH
2989 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2990
1688f43b
PH
2991/* The pattern is not an IP address. A common error that people make is to omit
2992one component of an IPv4 address, either by accident, or believing that, for
2993example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2994which it isn't. (Those applications that do accept 1.2.3 as an IP address
2995interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2996ancient specification.) To aid in debugging these cases, we give a specific
2997error if the pattern contains only digits and dots or contains a slash preceded
2998only by digits and dots (a slash at the start indicates a file name and of
2999course slashes may be present in lookups, but not preceded only by digits and
3000dots). */
3001
3002for (t = ss; isdigit(*t) || *t == '.'; t++);
3003if (*t == 0 || (*t == '/' && t != ss))
3004 {
3005 *error = US"malformed IPv4 address or address mask";
3006 return ERROR;
3007 }
3008
32d668a5 3009/* See if there is a semicolon in the pattern */
059ec3d9 3010
32d668a5
PH
3011semicolon = Ustrchr(ss, ';');
3012
3013/* If we are doing an IP address only match, then all lookups must be IP
df199fec 3014address lookups, even if there is no "net-". */
32d668a5
PH
3015
3016if (isiponly)
059ec3d9 3017 {
32d668a5
PH
3018 iplookup = semicolon != NULL;
3019 }
059ec3d9 3020
32d668a5 3021/* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
df199fec
PH
3022a lookup on a masked IP network, in textual form. We obey this code even if we
3023have already set iplookup, so as to skip over the "net-" prefix and to set the
3024mask length. The net- stuff really only applies to single-key lookups where the
3025key is implicit. For query-style lookups the key is specified in the query.
3026From release 4.30, the use of net- for query style is no longer needed, but we
3027retain it for backward compatibility. */
3028
3029if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
32d668a5
PH
3030 {
3031 mlen = 0;
3032 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
3033 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
3034 iplookup = (*t++ == '-');
3035 }
1688f43b 3036else t = ss;
059ec3d9 3037
32d668a5 3038/* Do the IP address lookup if that is indeed what we have */
059ec3d9 3039
32d668a5
PH
3040if (iplookup)
3041 {
3042 int insize;
3043 int search_type;
3044 int incoming[4];
3045 void *handle;
3046 uschar *filename, *key, *result;
3047 uschar buffer[64];
059ec3d9 3048
32d668a5 3049 /* Find the search type */
059ec3d9 3050
32d668a5 3051 search_type = search_findtype(t, semicolon - t);
059ec3d9 3052
32d668a5
PH
3053 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3054 search_error_message);
059ec3d9 3055
13b685f9
PH
3056 /* Adjust parameters for the type of lookup. For a query-style lookup, there
3057 is no file name, and the "key" is just the query. For query-style with a file
3058 name, we have to fish the file off the start of the query. For a single-key
3059 lookup, the key is the current IP address, masked appropriately, and
3060 reconverted to text form, with the mask appended. For IPv6 addresses, specify
6a3bceb1
PH
3061 dot separators instead of colons, except when the lookup type is "iplsearch".
3062 */
059ec3d9 3063
13b685f9
PH
3064 if (mac_islookup(search_type, lookup_absfilequery))
3065 {
3066 filename = semicolon + 1;
3067 key = filename;
3068 while (*key != 0 && !isspace(*key)) key++;
3069 filename = string_copyn(filename, key - filename);
3070 while (isspace(*key)) key++;
3071 }
3072 else if (mac_islookup(search_type, lookup_querystyle))
32d668a5
PH
3073 {
3074 filename = NULL;
3075 key = semicolon + 1;
3076 }
6a3bceb1 3077 else /* Single-key style */
32d668a5 3078 {
e6d225ae 3079 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
6a3bceb1 3080 ':' : '.';
32d668a5
PH
3081 insize = host_aton(cb->host_address, incoming);
3082 host_mask(insize, incoming, mlen);
6a3bceb1 3083 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
32d668a5
PH
3084 key = buffer;
3085 filename = semicolon + 1;
059ec3d9 3086 }
32d668a5
PH
3087
3088 /* Now do the actual lookup; note that there is no search_close() because
3089 of the caching arrangements. */
3090
3091 handle = search_open(filename, search_type, 0, NULL, NULL);
3092 if (handle == NULL) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3093 search_error_message);
3094 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
3095 if (valueptr != NULL) *valueptr = result;
3096 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
059ec3d9
PH
3097 }
3098
3099/* The pattern is not an IP address or network reference of any kind. That is,
32d668a5
PH
3100it is a host name pattern. If this is an IP only match, there's an error in the
3101host list. */
3102
3103if (isiponly)
3104 {
3105 *error = US"cannot match host name in match_ip list";
3106 return ERROR;
3107 }
3108
3109/* Check the characters of the pattern to see if they comprise only letters,
3110digits, full stops, and hyphens (the constituents of domain names). Allow
3111underscores, as they are all too commonly found. Sigh. Also, if
3112allow_utf8_domains is set, allow top-bit characters. */
059ec3d9
PH
3113
3114for (t = ss; *t != 0; t++)
3115 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3116 (!allow_utf8_domains || *t < 128)) break;
3117
3118/* If the pattern is a complete domain name, with no fancy characters, look up
3119its IP address and match against that. Note that a multi-homed host will add
3120items to the chain. */
3121
3122if (*t == 0)
3123 {
3124 int rc;
3125 host_item h;
3126 h.next = NULL;
3127 h.name = ss;
3128 h.address = NULL;
3129 h.mx = MX_NONE;
9b8fadde 3130
322050c2 3131 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
059ec3d9
PH
3132 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3133 {
3134 host_item *hh;
3135 for (hh = &h; hh != NULL; hh = hh->next)
3136 {
96776534 3137 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
059ec3d9
PH
3138 }
3139 return FAIL;
3140 }
3141 if (rc == HOST_FIND_AGAIN) return DEFER;
3142 *error = string_sprintf("failed to find IP address for %s", ss);
3143 return ERROR;
3144 }
3145
3146/* Almost all subsequent comparisons require the host name, and can be done
3147using the general string matching function. When this function is called for
3148outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3149must use sender_host_name and its aliases, looking them up if necessary. */
3150
3151if (cb->host_name != NULL) /* Explicit host name given */
3152 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3153 valueptr);
3154
3155/* Host name not given; in principle we need the sender host name and its
3156aliases. However, for query-style lookups, we do not need the name if the
3157query does not contain $sender_host_name. From release 4.23, a reference to
3158$sender_host_name causes it to be looked up, so we don't need to do the lookup
3159on spec. */
3160
3161if ((semicolon = Ustrchr(ss, ';')) != NULL)
3162 {
55414b25 3163 const uschar *affix;
059ec3d9
PH
3164 int partial, affixlen, starflags, id;
3165
3166 *semicolon = 0;
3167 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
3168 *semicolon=';';
3169
3170 if (id < 0) /* Unknown lookup type */
3171 {
3172 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3173 search_error_message, ss);
3174 return DEFER;
3175 }
13b685f9 3176 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
059ec3d9
PH
3177 }
3178
3179if (isquery)
3180 {
3181 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3182 {
3183 case OK: return OK;
3184 case DEFER: return DEFER;
3185 default: return FAIL;
3186 }
3187 }
3188
3189/* Not a query-style lookup; must ensure the host name is present, and then we
3190do a check on the name and all its aliases. */
3191
3192if (sender_host_name == NULL)
3193 {
3194 HDEBUG(D_host_lookup)
3195 debug_printf("sender host name required, to match against %s\n", ss);
3196 if (host_lookup_failed || host_name_lookup() != OK)
3197 {
3198 *error = string_sprintf("failed to find host name for %s",
3199 sender_host_address);;
3200 return ERROR;
3201 }
3202 host_build_sender_fullhost();
3203 }
3204
3205/* Match on the sender host name, using the general matching function */
3206
3207switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
3208 valueptr))
3209 {
3210 case OK: return OK;
3211 case DEFER: return DEFER;
3212 }
3213
3214/* If there are aliases, try matching on them. */
3215
3216aliases = sender_host_aliases;
3217while (*aliases != NULL)
3218 {
3219 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3220 {
3221 case OK: return OK;
3222 case DEFER: return DEFER;
3223 }
3224 }
3225return FAIL;
3226}
3227
3228
3229
3230
3231/*************************************************
3232* Check a specific host matches a host list *
3233*************************************************/
3234
3235/* This function is passed a host list containing items in a number of
3236different formats and the identity of a host. Its job is to determine whether
3237the given host is in the set of hosts defined by the list. The host name is
3238passed as a pointer so that it can be looked up if needed and not already
3239known. This is commonly the case when called from verify_check_host() to check
3240an incoming connection. When called from elsewhere the host name should usually
3241be set.
3242
3243This function is now just a front end to match_check_list(), which runs common
3244code for scanning a list. We pass it the check_host() function to perform a
3245single test.
3246
3247Arguments:
3248 listptr pointer to the host list
3249 cache_bits pointer to cache for named lists, or NULL
3250 host_name the host name or NULL, implying use sender_host_name and
3251 sender_host_aliases, looking them up if required
3252 host_address the IP address
3253 valueptr if not NULL, data from a lookup is passed back here
3254
3255Returns: OK if the host is in the defined set
3256 FAIL if the host is not in the defined set,
3257 DEFER if a data lookup deferred (not a host lookup)
3258
3259If the host name was needed in order to make a comparison, and could not be
3260determined from the IP address, the result is FAIL unless the item
3261"+allow_unknown" was met earlier in the list, in which case OK is returned. */
3262
3263int
55414b25
JH
3264verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3265 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
059ec3d9 3266{
d4eb88df 3267int rc;
059ec3d9 3268unsigned int *local_cache_bits = cache_bits;
55414b25 3269const uschar *save_host_address = deliver_host_address;
059ec3d9
PH
3270check_host_block cb;
3271cb.host_name = host_name;
3272cb.host_address = host_address;
3273
3274if (valueptr != NULL) *valueptr = NULL;
3275
3276/* If the host address starts off ::ffff: it is an IPv6 address in
3277IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3278addresses. */
3279
3280cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
3281 host_address + 7 : host_address;
3282
8e669ac1
PH
3283/* During the running of the check, put the IP address into $host_address. In
3284the case of calls from the smtp transport, it will already be there. However,
3285in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
d4eb88df
PH
3286the safe side, any existing setting is preserved, though as I write this
3287(November 2004) I can't see any cases where it is actually needed. */
3288
3289deliver_host_address = host_address;
3290rc = match_check_list(
3291 listptr, /* the list */
3292 0, /* separator character */
3293 &hostlist_anchor, /* anchor pointer */
3294 &local_cache_bits, /* cache pointer */
3295 check_host, /* function for testing */
3296 &cb, /* argument for function */
3297 MCL_HOST, /* type of check */
8e669ac1 3298 (host_address == sender_host_address)?
d4eb88df
PH
3299 US"host" : host_address, /* text for debugging */
3300 valueptr); /* where to pass back data */
3301deliver_host_address = save_host_address;
8e669ac1 3302return rc;
059ec3d9
PH
3303}
3304
3305
3306
3307
3308/*************************************************
5130845b
JH
3309* Check the given host item matches a list *
3310*************************************************/
3311int
3312verify_check_given_host(uschar **listptr, host_item *host)
3313{
55414b25 3314return verify_check_this_host(CUSS listptr, NULL, host->name, host->address, NULL);
5130845b
JH
3315}
3316
3317/*************************************************
059ec3d9
PH
3318* Check the remote host matches a list *
3319*************************************************/
3320
3321/* This is a front end to verify_check_this_host(), created because checking
3322the remote host is a common occurrence. With luck, a good compiler will spot
3323the tail recursion and optimize it. If there's no host address, this is
3324command-line SMTP input - check against an empty string for the address.
3325
3326Arguments:
3327 listptr pointer to the host list
3328
3329Returns: the yield of verify_check_this_host(),
3330 i.e. OK, FAIL, or DEFER
3331*/
3332
3333int
3334verify_check_host(uschar **listptr)
3335{
55414b25 3336return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
059ec3d9
PH
3337 (sender_host_address == NULL)? US"" : sender_host_address, NULL);
3338}
3339
3340
3341
3342
3343
3344/*************************************************
83e029d5 3345* Invert an IP address *
059ec3d9
PH
3346*************************************************/
3347
83e029d5
PP
3348/* Originally just used for DNS xBL lists, now also used for the
3349reverse_ip expansion operator.
3350
059ec3d9
PH
3351Arguments:
3352 buffer where to put the answer
3353 address the address to invert
3354*/
3355
83e029d5 3356void
059ec3d9
PH
3357invert_address(uschar *buffer, uschar *address)
3358{
3359int bin[4];
3360uschar *bptr = buffer;
3361
3362/* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3363to the IPv4 part only. */
3364
3365if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3366
3367/* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3368always 1. */
3369
3370if (host_aton(address, bin) == 1)
3371 {
3372 int i;
3373 int x = bin[0];
3374 for (i = 0; i < 4; i++)
3375 {
3376 sprintf(CS bptr, "%d.", x & 255);
3377 while (*bptr) bptr++;
3378 x >>= 8;
3379 }
3380 }
3381
3382/* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3383in any DNS black lists, and the format in which they will be looked up is
3384unknown. This is just a guess. */
3385
3386#if HAVE_IPV6
3387else
3388 {
3389 int i, j;
3390 for (j = 3; j >= 0; j--)
3391 {
3392 int x = bin[j];
3393 for (i = 0; i < 8; i++)
3394 {
3395 sprintf(CS bptr, "%x.", x & 15);
3396 while (*bptr) bptr++;
3397 x >>= 4;
3398 }
3399 }
3400 }
3401#endif
d6f6e0dc
PH
3402
3403/* Remove trailing period -- this is needed so that both arbitrary
3404dnsbl keydomains and inverted addresses may be combined with the
3405same format string, "%s.%s" */
3406
3407*(--bptr) = 0;
059ec3d9
PH
3408}
3409
3410
3411
3412/*************************************************
0bcb2a0e
PH
3413* Perform a single dnsbl lookup *
3414*************************************************/
3415
d6f6e0dc
PH
3416/* This function is called from verify_check_dnsbl() below. It is also called
3417recursively from within itself when domain and domain_txt are different
3418pointers, in order to get the TXT record from the alternate domain.
0bcb2a0e
PH
3419
3420Arguments:
d6f6e0dc
PH
3421 domain the outer dnsbl domain
3422 domain_txt alternate domain to lookup TXT record on success; when the
3423 same domain is to be used, domain_txt == domain (that is,
3424 the pointers must be identical, not just the text)
8e669ac1 3425 keydomain the current keydomain (for debug message)
d6f6e0dc
PH
3426 prepend subdomain to lookup (like keydomain, but
3427 reversed if IP address)
3428 iplist the list of matching IP addresses, or NULL for "any"
8e669ac1 3429 bitmask true if bitmask matching is wanted
431b7361
PH
3430 match_type condition for 'succeed' result
3431 0 => Any RR in iplist (=)
3432 1 => No RR in iplist (!=)
3433 2 => All RRs in iplist (==)
3434 3 => Some RRs not in iplist (!==)
3435 the two bits are defined as MT_NOT and MT_ALL
8e669ac1 3436 defer_return what to return for a defer
0bcb2a0e
PH
3437
3438Returns: OK if lookup succeeded
3439 FAIL if not
3440*/
3441
3442static int
d6f6e0dc 3443one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain,
431b7361 3444 uschar *prepend, uschar *iplist, BOOL bitmask, int match_type,
d6f6e0dc 3445 int defer_return)
8e669ac1 3446{
0bcb2a0e
PH
3447dns_answer dnsa;
3448dns_scan dnss;
3449tree_node *t;
3450dnsbl_cache_block *cb;
3451int old_pool = store_pool;
d6f6e0dc
PH
3452uschar query[256]; /* DNS domain max length */
3453
3454/* Construct the specific query domainname */
3455
3456if (!string_format(query, sizeof(query), "%s.%s", prepend, domain))
3457 {
3458 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
3459 "(ignored): %s...", query);
3460 return FAIL;
3461 }
0bcb2a0e
PH
3462
3463/* Look for this query in the cache. */
3464
3465t = tree_search(dnsbl_cache, query);
3466
3467/* If not cached from a previous lookup, we must do a DNS lookup, and
3468cache the result in permanent memory. */
3469
3470if (t == NULL)
3471 {
3472 store_pool = POOL_PERM;
3473
3474 /* Set up a tree entry to cache the lookup */
3475
3476 t = store_get(sizeof(tree_node) + Ustrlen(query));
3477 Ustrcpy(t->name, query);
3478 t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block));
3479 (void)tree_insertnode(&dnsbl_cache, t);
3480
3481 /* Do the DNS loopup . */
3482
3483 HDEBUG(D_dnsbl) debug_printf("new DNS lookup for %s\n", query);
3484 cb->rc = dns_basic_lookup(&dnsa, query, T_A);
3485 cb->text_set = FALSE;
3486 cb->text = NULL;
3487 cb->rhs = NULL;
3488
3489 /* If the lookup succeeded, cache the RHS address. The code allows for
3490 more than one address - this was for complete generality and the possible
3491 use of A6 records. However, A6 records have been reduced to experimental
3492 status (August 2001) and may die out. So they may never get used at all,
3493 let alone in dnsbl records. However, leave the code here, just in case.
3494
3495 Quite apart from one A6 RR generating multiple addresses, there are DNS
3496 lists that return more than one A record, so we must handle multiple
3497 addresses generated in that way as well. */
3498
3499 if (cb->rc == DNS_SUCCEED)
3500 {
3501 dns_record *rr;
3502 dns_address **addrp = &(cb->rhs);
3503 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
3504 rr != NULL;
3505 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
3506 {
3507 if (rr->type == T_A)
3508 {
3509 dns_address *da = dns_address_from_rr(&dnsa, rr);
3510 if (da != NULL)
3511 {
3512 *addrp = da;
3513 while (da->next != NULL) da = da->next;
3514 addrp = &(da->next);
3515 }
3516 }
3517 }
3518
3519 /* If we didn't find any A records, change the return code. This can
3520 happen when there is a CNAME record but there are no A records for what
3521 it points to. */
3522
3523 if (cb->rhs == NULL) cb->rc = DNS_NODATA;
3524 }
3525
3526 store_pool = old_pool;
3527 }
3528
3529/* Previous lookup was cached */
3530
3531else
3532 {
3533 HDEBUG(D_dnsbl) debug_printf("using result of previous DNS lookup\n");
3534 cb = t->data.ptr;
3535 }
3536
3537/* We now have the result of the DNS lookup, either newly done, or cached
3538from a previous call. If the lookup succeeded, check against the address
3539list if there is one. This may be a positive equality list (introduced by
3540"="), a negative equality list (introduced by "!="), a positive bitmask
3541list (introduced by "&"), or a negative bitmask list (introduced by "!&").*/
3542
3543if (cb->rc == DNS_SUCCEED)
3544 {
3545 dns_address *da = NULL;
3546 uschar *addlist = cb->rhs->address;
3547
3548 /* For A and AAAA records, there may be multiple addresses from multiple
3549 records. For A6 records (currently not expected to be used) there may be
3550 multiple addresses from a single record. */
3551
3552 for (da = cb->rhs->next; da != NULL; da = da->next)
3553 addlist = string_sprintf("%s, %s", addlist, da->address);
3554
3555 HDEBUG(D_dnsbl) debug_printf("DNS lookup for %s succeeded (yielding %s)\n",
3556 query, addlist);
3557
3558 /* Address list check; this can be either for equality, or via a bitmask.
3559 In the latter case, all the bits must match. */
3560
3561 if (iplist != NULL)
3562 {
431b7361 3563 for (da = cb->rhs; da != NULL; da = da->next)
0bcb2a0e 3564 {
431b7361
PH
3565 int ipsep = ',';
3566 uschar ip[46];
55414b25 3567 const uschar *ptr = iplist;
431b7361
PH
3568 uschar *res;
3569
0bcb2a0e 3570 /* Handle exact matching */
431b7361 3571
0bcb2a0e
PH
3572 if (!bitmask)
3573 {
431b7361 3574 while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip))) != NULL)
0bcb2a0e
PH
3575 {
3576 if (Ustrcmp(CS da->address, ip) == 0) break;
3577 }
3578 }
431b7361 3579
0bcb2a0e 3580 /* Handle bitmask matching */
431b7361 3581
0bcb2a0e
PH
3582 else
3583 {
3584 int address[4];
3585 int mask = 0;
3586
3587 /* At present, all known DNS blocking lists use A records, with
3588 IPv4 addresses on the RHS encoding the information they return. I
3589 wonder if this will linger on as the last vestige of IPv4 when IPv6
3590 is ubiquitous? Anyway, for now we use paranoia code to completely
3591 ignore IPv6 addresses. The default mask is 0, which always matches.
3592 We change this only for IPv4 addresses in the list. */
3593
431b7361 3594 if (host_aton(da->address, address) == 1) mask = address[0];
0bcb2a0e
PH
3595
3596 /* Scan the returned addresses, skipping any that are IPv6 */
3597
431b7361 3598 while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip))) != NULL)
0bcb2a0e 3599 {
431b7361
PH
3600 if (host_aton(ip, address) != 1) continue;
3601 if ((address[0] & mask) == address[0]) break;
0bcb2a0e
PH
3602 }
3603 }
3604
431b7361
PH
3605 /* If either
3606
3607 (a) An IP address in an any ('=') list matched, or
3608 (b) No IP address in an all ('==') list matched
0bcb2a0e 3609
431b7361
PH
3610 then we're done searching. */
3611
3612 if (((match_type & MT_ALL) != 0) == (res == NULL)) break;
0bcb2a0e
PH
3613 }
3614
431b7361 3615 /* If da == NULL, either
0bcb2a0e 3616
431b7361
PH
3617 (a) No IP address in an any ('=') list matched, or
3618 (b) An IP address in an all ('==') list didn't match
0bcb2a0e 3619
431b7361
PH
3620 so behave as if the DNSBL lookup had not succeeded, i.e. the host is not on
3621 the list. */
0bcb2a0e 3622
431b7361 3623 if ((match_type == MT_NOT || match_type == MT_ALL) != (da == NULL))
0bcb2a0e
PH
3624 {
3625 HDEBUG(D_dnsbl)
3626 {
431b7361
PH
3627 uschar *res = NULL;
3628 switch(match_type)
3629 {
3630 case 0:
3631 res = US"was no match";
3632 break;
3633 case MT_NOT:
3634 res = US"was an exclude match";
3635 break;
3636 case MT_ALL:
3637 res = US"was an IP address that did not match";
3638 break;
3639 case MT_NOT|MT_ALL:
3640 res = US"were no IP addresses that did not match";
3641 break;
3642 }
0bcb2a0e 3643 debug_printf("=> but we are not accepting this block class because\n");
431b7361
PH
3644 debug_printf("=> there %s for %s%c%s\n",
3645 res,
3646 ((match_type & MT_ALL) == 0)? "" : "=",
3647 bitmask? '&' : '=', iplist);
0bcb2a0e 3648 }
8e669ac1 3649 return FAIL;
0bcb2a0e
PH
3650 }
3651 }
3652
d6f6e0dc
PH
3653 /* Either there was no IP list, or the record