016a92d6bc1634bc612446aa72d5dccc65dc78fb
[exim.git] / src / src / receive.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Code for receiving a message and setting up spool files. */
9
10 #include "exim.h"
11 #include <setjmp.h>
12
13 #ifdef EXPERIMENTAL_DCC
14 extern int dcc_ok;
15 #endif
16
17 #ifdef EXPERIMENTAL_DMARC
18 # include "dmarc.h"
19 #endif /* EXPERIMENTAL_DMARC */
20
21 /*************************************************
22 * Local static variables *
23 *************************************************/
24
25 static int data_fd = -1;
26 static uschar *spool_name = US"";
27
28 enum CH_STATE {LF_SEEN, MID_LINE, CR_SEEN};
29
30 #ifdef HAVE_LOCAL_SCAN
31 jmp_buf local_scan_env; /* error-handling context for local_scan */
32 unsigned had_local_scan_crash;
33 unsigned had_local_scan_timeout;
34 #endif
35
36
37 /*************************************************
38 * Non-SMTP character reading functions *
39 *************************************************/
40
41 /* These are the default functions that are set up in the variables such as
42 receive_getc initially. They just call the standard functions, passing stdin as
43 the file. (When SMTP input is occurring, different functions are used by
44 changing the pointer variables.) */
45
46 int
47 stdin_getc(unsigned lim)
48 {
49 int c = getc(stdin);
50
51 if (had_data_timeout)
52 {
53 fprintf(stderr, "exim: timed out while reading - message abandoned\n");
54 log_write(L_lost_incoming_connection,
55 LOG_MAIN, "timed out while reading local message");
56 receive_bomb_out(US"data-timeout", NULL); /* Does not return */
57 }
58 if (had_data_sigint)
59 {
60 if (filter_test == FTEST_NONE)
61 {
62 fprintf(stderr, "\nexim: %s received - message abandoned\n",
63 had_data_sigint == SIGTERM ? "SIGTERM" : "SIGINT");
64 log_write(0, LOG_MAIN, "%s received while reading local message",
65 had_data_sigint == SIGTERM ? "SIGTERM" : "SIGINT");
66 }
67 receive_bomb_out(US"signal-exit", NULL); /* Does not return */
68 }
69 return c;
70 }
71
72 int
73 stdin_ungetc(int c)
74 {
75 return ungetc(c, stdin);
76 }
77
78 int
79 stdin_feof(void)
80 {
81 return feof(stdin);
82 }
83
84 int
85 stdin_ferror(void)
86 {
87 return ferror(stdin);
88 }
89
90
91
92
93 /*************************************************
94 * Check that a set sender is allowed *
95 *************************************************/
96
97 /* This function is called when a local caller sets an explicit sender address.
98 It checks whether this is permitted, which it is for trusted callers.
99 Otherwise, it must match the pattern(s) in untrusted_set_sender.
100
101 Arguments: the proposed sender address
102 Returns: TRUE for a trusted caller
103 TRUE if the address has been set, untrusted_set_sender has been
104 set, and the address matches something in the list
105 FALSE otherwise
106 */
107
108 BOOL
109 receive_check_set_sender(uschar *newsender)
110 {
111 uschar *qnewsender;
112 if (f.trusted_caller) return TRUE;
113 if (!newsender || !untrusted_set_sender) return FALSE;
114 qnewsender = Ustrchr(newsender, '@')
115 ? newsender : string_sprintf("%s@%s", newsender, qualify_domain_sender);
116 return match_address_list_basic(qnewsender, CUSS &untrusted_set_sender, 0) == OK;
117 }
118
119
120
121
122 /*************************************************
123 * Read space info for a partition *
124 *************************************************/
125
126 /* This function is called by receive_check_fs() below, and also by string
127 expansion for variables such as $spool_space. The field names for the statvfs
128 structure are macros, because not all OS have F_FAVAIL and it seems tidier to
129 have macros for F_BAVAIL and F_FILES as well. Some kinds of file system do not
130 have inodes, and they return -1 for the number available.
131
132 Later: It turns out that some file systems that do not have the concept of
133 inodes return 0 rather than -1. Such systems should also return 0 for the total
134 number of inodes, so we require that to be greater than zero before returning
135 an inode count.
136
137 Arguments:
138 isspool TRUE for spool partition, FALSE for log partition
139 inodeptr address of int to receive inode count; -1 if there isn't one
140
141 Returns: available on-root space, in kilobytes
142 -1 for log partition if there isn't one
143
144 All values are -1 if the STATFS functions are not available.
145 */
146
147 int
148 receive_statvfs(BOOL isspool, int *inodeptr)
149 {
150 #ifdef HAVE_STATFS
151 struct STATVFS statbuf;
152 struct stat dummy;
153 uschar *path;
154 uschar *name;
155 uschar buffer[1024];
156
157 /* The spool directory must always exist. */
158
159 if (isspool)
160 {
161 path = spool_directory;
162 name = US"spool";
163 }
164
165 /* Need to cut down the log file path to the directory, and to ignore any
166 appearance of "syslog" in it. */
167
168 else
169 {
170 int sep = ':'; /* Not variable - outside scripts use */
171 const uschar *p = log_file_path;
172 name = US"log";
173
174 /* An empty log_file_path means "use the default". This is the same as an
175 empty item in a list. */
176
177 if (*p == 0) p = US":";
178 while ((path = string_nextinlist(&p, &sep, buffer, sizeof(buffer))))
179 if (Ustrcmp(path, "syslog") != 0)
180 break;
181
182 if (path == NULL) /* No log files */
183 {
184 *inodeptr = -1;
185 return -1;
186 }
187
188 /* An empty string means use the default, which is in the spool directory.
189 But don't just use the spool directory, as it is possible that the log
190 subdirectory has been symbolically linked elsewhere. */
191
192 if (path[0] == 0)
193 {
194 sprintf(CS buffer, CS"%s/log", CS spool_directory);
195 path = buffer;
196 }
197 else
198 {
199 uschar *cp;
200 if ((cp = Ustrrchr(path, '/')) != NULL) *cp = 0;
201 }
202 }
203
204 /* We now have the path; do the business */
205
206 memset(&statbuf, 0, sizeof(statbuf));
207
208 if (STATVFS(CS path, &statbuf) != 0)
209 if (stat(CS path, &dummy) == -1 && errno == ENOENT)
210 { /* Can happen on first run after installation */
211 *inodeptr = -1;
212 return -1;
213 }
214 else
215 {
216 log_write(0, LOG_MAIN|LOG_PANIC, "cannot accept message: failed to stat "
217 "%s directory %s: %s", name, path, strerror(errno));
218 smtp_closedown(US"spool or log directory problem");
219 exim_exit(EXIT_FAILURE, NULL);
220 }
221
222 *inodeptr = (statbuf.F_FILES > 0)? statbuf.F_FAVAIL : -1;
223
224 /* Disks are getting huge. Take care with computing the size in kilobytes. */
225
226 return (int)(((double)statbuf.F_BAVAIL * (double)statbuf.F_FRSIZE)/1024.0);
227
228 #else
229 /* Unable to find partition sizes in this environment. */
230
231 *inodeptr = -1;
232 return -1;
233 #endif
234 }
235
236
237
238
239 /*************************************************
240 * Check space on spool and log partitions *
241 *************************************************/
242
243 /* This function is called before accepting a message; if any thresholds are
244 set, it checks them. If a message_size is supplied, it checks that there is
245 enough space for that size plus the threshold - i.e. that the message won't
246 reduce the space to the threshold. Not all OS have statvfs(); for those that
247 don't, this function always returns TRUE. For some OS the old function and
248 struct name statfs is used; that is handled by a macro, defined in exim.h.
249
250 Arguments:
251 msg_size the (estimated) size of an incoming message
252
253 Returns: FALSE if there isn't enough space, or if the information cannot
254 be obtained
255 TRUE if no check was done or there is enough space
256 */
257
258 BOOL
259 receive_check_fs(int msg_size)
260 {
261 int space, inodes;
262
263 if (check_spool_space > 0 || msg_size > 0 || check_spool_inodes > 0)
264 {
265 space = receive_statvfs(TRUE, &inodes);
266
267 DEBUG(D_receive)
268 debug_printf("spool directory space = %dK inodes = %d "
269 "check_space = %dK inodes = %d msg_size = %d\n",
270 space, inodes, check_spool_space, check_spool_inodes, msg_size);
271
272 if ((space >= 0 && space < check_spool_space) ||
273 (inodes >= 0 && inodes < check_spool_inodes))
274 {
275 log_write(0, LOG_MAIN, "spool directory space check failed: space=%d "
276 "inodes=%d", space, inodes);
277 return FALSE;
278 }
279 }
280
281 if (check_log_space > 0 || check_log_inodes > 0)
282 {
283 space = receive_statvfs(FALSE, &inodes);
284
285 DEBUG(D_receive)
286 debug_printf("log directory space = %dK inodes = %d "
287 "check_space = %dK inodes = %d\n",
288 space, inodes, check_log_space, check_log_inodes);
289
290 if ((space >= 0 && space < check_log_space) ||
291 (inodes >= 0 && inodes < check_log_inodes))
292 {
293 log_write(0, LOG_MAIN, "log directory space check failed: space=%d "
294 "inodes=%d", space, inodes);
295 return FALSE;
296 }
297 }
298
299 return TRUE;
300 }
301
302
303
304 /*************************************************
305 * Bomb out while reading a message *
306 *************************************************/
307
308 /* The common case of wanting to bomb out is if a SIGTERM or SIGINT is
309 received, or if there is a timeout. A rarer case might be if the log files are
310 screwed up and Exim can't open them to record a message's arrival. Handling
311 that case is done by setting a flag to cause the log functions to call this
312 function if there is an ultimate disaster. That is why it is globally
313 accessible.
314
315 Arguments:
316 reason text reason to pass to the not-quit ACL
317 msg default SMTP response to give if in an SMTP session
318 Returns: it doesn't
319 */
320
321 void
322 receive_bomb_out(uschar *reason, uschar *msg)
323 {
324 static BOOL already_bombing_out;
325 /* The smtp_notquit_exit() below can call ACLs which can trigger recursive
326 timeouts, if someone has something slow in their quit ACL. Since the only
327 things we should be doing are to close down cleanly ASAP, on the second
328 pass we also close down stuff that might be opened again, before bypassing
329 the ACL call and exiting. */
330
331 /* If spool_name is set, it contains the name of the data file that is being
332 written. Unlink it before closing so that it cannot be picked up by a delivery
333 process. Ensure that any header file is also removed. */
334
335 if (spool_name[0] != '\0')
336 {
337 Uunlink(spool_name);
338 spool_name[Ustrlen(spool_name) - 1] = 'H';
339 Uunlink(spool_name);
340 spool_name[0] = '\0';
341 }
342
343 /* Now close the file if it is open, either as a fd or a stream. */
344
345 if (spool_data_file)
346 {
347 (void)fclose(spool_data_file);
348 spool_data_file = NULL;
349 }
350 else if (data_fd >= 0)
351 {
352 (void)close(data_fd);
353 data_fd = -1;
354 }
355
356 /* Attempt to close down an SMTP connection tidily. For non-batched SMTP, call
357 smtp_notquit_exit(), which runs the NOTQUIT ACL, if present, and handles the
358 SMTP response. */
359
360 if (!already_bombing_out)
361 {
362 already_bombing_out = TRUE;
363 if (smtp_input)
364 {
365 if (smtp_batched_input)
366 moan_smtp_batch(NULL, "421 %s - message abandoned", msg); /* No return */
367 smtp_notquit_exit(reason, US"421", US"%s %s - closing connection.",
368 smtp_active_hostname, msg);
369 }
370 }
371
372 /* Exit from the program (non-BSMTP cases) */
373
374 exim_exit(EXIT_FAILURE, NULL);
375 }
376
377
378 /*************************************************
379 * Data read timeout *
380 *************************************************/
381
382 /* Handler function for timeouts that occur while reading the data that
383 comprises a message.
384
385 Argument: the signal number
386 Returns: nothing
387 */
388
389 static void
390 data_timeout_handler(int sig)
391 {
392 had_data_timeout = sig;
393 }
394
395
396
397 #ifdef HAVE_LOCAL_SCAN
398 /*************************************************
399 * local_scan() timeout *
400 *************************************************/
401
402 /* Handler function for timeouts that occur while running a local_scan()
403 function. Posix recommends against calling longjmp() from a signal-handler,
404 but the GCC manual says you can so we will, and trust that it's better than
405 calling probably non-signal-safe funxtions during logging from within the
406 handler, even with other compilers.
407
408 See also https://cwe.mitre.org/data/definitions/745.html which also lists
409 it as unsafe.
410
411 This is all because we have no control over what might be written for a
412 local-scan function, so cannot sprinkle had-signal checks after each
413 call-site. At least with the default "do-nothing" function we won't
414 ever get here.
415
416 Argument: the signal number
417 Returns: nothing
418 */
419
420 static void
421 local_scan_timeout_handler(int sig)
422 {
423 had_local_scan_timeout = sig;
424 siglongjmp(local_scan_env, 1);
425 }
426
427
428
429 /*************************************************
430 * local_scan() crashed *
431 *************************************************/
432
433 /* Handler function for signals that occur while running a local_scan()
434 function.
435
436 Argument: the signal number
437 Returns: nothing
438 */
439
440 static void
441 local_scan_crash_handler(int sig)
442 {
443 had_local_scan_crash = sig;
444 siglongjmp(local_scan_env, 1);
445 }
446
447 #endif /*HAVE_LOCAL_SCAN*/
448
449
450 /*************************************************
451 * SIGTERM or SIGINT received *
452 *************************************************/
453
454 /* Handler for SIGTERM or SIGINT signals that occur while reading the
455 data that comprises a message.
456
457 Argument: the signal number
458 Returns: nothing
459 */
460
461 static void
462 data_sigterm_sigint_handler(int sig)
463 {
464 had_data_sigint = sig;
465 }
466
467
468
469 /*************************************************
470 * Add new recipient to list *
471 *************************************************/
472
473 /* This function builds a list of recipient addresses in argc/argv
474 format.
475
476 Arguments:
477 recipient the next address to add to recipients_list
478 pno parent number for fixed aliases; -1 otherwise
479
480 Returns: nothing
481 */
482
483 void
484 receive_add_recipient(uschar *recipient, int pno)
485 {
486 if (recipients_count >= recipients_list_max)
487 {
488 recipient_item *oldlist = recipients_list;
489 int oldmax = recipients_list_max;
490 recipients_list_max = recipients_list_max ? 2*recipients_list_max : 50;
491 recipients_list = store_get(recipients_list_max * sizeof(recipient_item));
492 if (oldlist != NULL)
493 memcpy(recipients_list, oldlist, oldmax * sizeof(recipient_item));
494 }
495
496 recipients_list[recipients_count].address = recipient;
497 recipients_list[recipients_count].pno = pno;
498 #ifdef EXPERIMENTAL_BRIGHTMAIL
499 recipients_list[recipients_count].bmi_optin = bmi_current_optin;
500 /* reset optin string pointer for next recipient */
501 bmi_current_optin = NULL;
502 #endif
503 recipients_list[recipients_count].orcpt = NULL;
504 recipients_list[recipients_count].dsn_flags = 0;
505 recipients_list[recipients_count++].errors_to = NULL;
506 }
507
508
509
510
511 /*************************************************
512 * Send user response message *
513 *************************************************/
514
515 /* This function is passed a default response code and a user message. It calls
516 smtp_message_code() to check and possibly modify the response code, and then
517 calls smtp_respond() to transmit the response. I put this into a function
518 just to avoid a lot of repetition.
519
520 Arguments:
521 code the response code
522 user_msg the user message
523
524 Returns: nothing
525 */
526
527 #ifndef DISABLE_PRDR
528 static void
529 smtp_user_msg(uschar *code, uschar *user_msg)
530 {
531 int len = 3;
532 smtp_message_code(&code, &len, &user_msg, NULL, TRUE);
533 smtp_respond(code, len, TRUE, user_msg);
534 }
535 #endif
536
537
538
539
540
541 /*************************************************
542 * Remove a recipient from the list *
543 *************************************************/
544
545 /* This function is provided for local_scan() to use.
546
547 Argument:
548 recipient address to remove
549
550 Returns: TRUE if it did remove something; FALSE otherwise
551 */
552
553 BOOL
554 receive_remove_recipient(uschar *recipient)
555 {
556 int count;
557 DEBUG(D_receive) debug_printf("receive_remove_recipient(\"%s\") called\n",
558 recipient);
559 for (count = 0; count < recipients_count; count++)
560 {
561 if (Ustrcmp(recipients_list[count].address, recipient) == 0)
562 {
563 if ((--recipients_count - count) > 0)
564 memmove(recipients_list + count, recipients_list + count + 1,
565 (recipients_count - count)*sizeof(recipient_item));
566 return TRUE;
567 }
568 }
569 return FALSE;
570 }
571
572
573
574
575
576 /*************************************************
577 * Read data portion of a non-SMTP message *
578 *************************************************/
579
580 /* This function is called to read the remainder of a message (following the
581 header) when the input is not from SMTP - we are receiving a local message on
582 a standard input stream. The message is always terminated by EOF, and is also
583 terminated by a dot on a line by itself if the flag dot_ends is TRUE. Split the
584 two cases for maximum efficiency.
585
586 Ensure that the body ends with a newline. This will naturally be the case when
587 the termination is "\n.\n" but may not be otherwise. The RFC defines messages
588 as "sequences of lines" - this of course strictly applies only to SMTP, but
589 deliveries into BSD-type mailbox files also require it. Exim used to have a
590 flag for doing this at delivery time, but as it was always set for all
591 transports, I decided to simplify things by putting the check here instead.
592
593 There is at least one MUA (dtmail) that sends CRLF via this interface, and
594 other programs are known to do this as well. Exim used to have a option for
595 dealing with this: in July 2003, after much discussion, the code has been
596 changed to default to treat any of LF, CRLF, and bare CR as line terminators.
597
598 However, for the case when a dot on a line by itself terminates a message, the
599 only recognized terminating sequences before and after the dot are LF and CRLF.
600 Otherwise, having read EOL . CR, you don't know whether to read another
601 character or not.
602
603 Internally, in messages stored in Exim's spool files, LF is used as the line
604 terminator. Under the new regime, bare CRs will no longer appear in these
605 files.
606
607 Arguments:
608 fout a FILE to which to write the message
609
610 Returns: One of the END_xxx values indicating why it stopped reading
611 */
612
613 static int
614 read_message_data(FILE *fout)
615 {
616 int ch_state;
617 register int ch;
618 register int linelength = 0;
619
620 /* Handle the case when only EOF terminates the message */
621
622 if (!f.dot_ends)
623 {
624 register int last_ch = '\n';
625
626 for (; (ch = (receive_getc)(GETC_BUFFER_UNLIMITED)) != EOF; last_ch = ch)
627 {
628 if (ch == 0) body_zerocount++;
629 if (last_ch == '\r' && ch != '\n')
630 {
631 if (linelength > max_received_linelength)
632 max_received_linelength = linelength;
633 linelength = 0;
634 if (fputc('\n', fout) == EOF) return END_WERROR;
635 message_size++;
636 body_linecount++;
637 }
638 if (ch == '\r') continue;
639
640 if (fputc(ch, fout) == EOF) return END_WERROR;
641 if (ch == '\n')
642 {
643 if (linelength > max_received_linelength)
644 max_received_linelength = linelength;
645 linelength = 0;
646 body_linecount++;
647 }
648 else linelength++;
649 if (++message_size > thismessage_size_limit) return END_SIZE;
650 }
651
652 if (last_ch != '\n')
653 {
654 if (linelength > max_received_linelength)
655 max_received_linelength = linelength;
656 if (fputc('\n', fout) == EOF) return END_WERROR;
657 message_size++;
658 body_linecount++;
659 }
660
661 return END_EOF;
662 }
663
664 /* Handle the case when a dot on a line on its own, or EOF, terminates. */
665
666 ch_state = 1;
667
668 while ((ch = (receive_getc)(GETC_BUFFER_UNLIMITED)) != EOF)
669 {
670 if (ch == 0) body_zerocount++;
671 switch (ch_state)
672 {
673 case 0: /* Normal state (previous char written) */
674 if (ch == '\n')
675 {
676 body_linecount++;
677 if (linelength > max_received_linelength)
678 max_received_linelength = linelength;
679 linelength = -1;
680 ch_state = 1;
681 }
682 else if (ch == '\r')
683 { ch_state = 2; continue; }
684 break;
685
686 case 1: /* After written "\n" */
687 if (ch == '.') { ch_state = 3; continue; }
688 if (ch == '\r') { ch_state = 2; continue; }
689 if (ch == '\n') { body_linecount++; linelength = -1; }
690 else ch_state = 0;
691 break;
692
693 case 2:
694 body_linecount++; /* After unwritten "\r" */
695 if (linelength > max_received_linelength)
696 max_received_linelength = linelength;
697 if (ch == '\n')
698 {
699 ch_state = 1;
700 linelength = -1;
701 }
702 else
703 {
704 if (message_size++, fputc('\n', fout) == EOF) return END_WERROR;
705 if (ch == '\r') continue;
706 ch_state = 0;
707 linelength = 0;
708 }
709 break;
710
711 case 3: /* After "\n." (\n written, dot not) */
712 if (ch == '\n') return END_DOT;
713 if (ch == '\r') { ch_state = 4; continue; }
714 message_size++;
715 linelength++;
716 if (fputc('.', fout) == EOF) return END_WERROR;
717 ch_state = 0;
718 break;
719
720 case 4: /* After "\n.\r" (\n written, rest not) */
721 if (ch == '\n') return END_DOT;
722 message_size += 2;
723 body_linecount++;
724 if (fputs(".\n", fout) == EOF) return END_WERROR;
725 if (ch == '\r') { ch_state = 2; continue; }
726 ch_state = 0;
727 break;
728 }
729
730 linelength++;
731 if (fputc(ch, fout) == EOF) return END_WERROR;
732 if (++message_size > thismessage_size_limit) return END_SIZE;
733 }
734
735 /* Get here if EOF read. Unless we have just written "\n", we need to ensure
736 the message ends with a newline, and we must also write any characters that
737 were saved up while testing for an ending dot. */
738
739 if (ch_state != 1)
740 {
741 static uschar *ends[] = { US"\n", NULL, US"\n", US".\n", US".\n" };
742 if (fputs(CS ends[ch_state], fout) == EOF) return END_WERROR;
743 message_size += Ustrlen(ends[ch_state]);
744 body_linecount++;
745 }
746
747 return END_EOF;
748 }
749
750
751
752
753 /*************************************************
754 * Read data portion of an SMTP message *
755 *************************************************/
756
757 /* This function is called to read the remainder of an SMTP message (after the
758 headers), or to skip over it when an error has occurred. In this case, the
759 output file is passed as NULL.
760
761 If any line begins with a dot, that character is skipped. The input should only
762 be successfully terminated by CR LF . CR LF unless it is local (non-network)
763 SMTP, in which case the CRs are optional, but...
764
765 FUDGE: It seems that sites on the net send out messages with just LF
766 terminators, despite the warnings in the RFCs, and other MTAs handle this. So
767 we make the CRs optional in all cases.
768
769 July 2003: Bare CRs cause trouble. We now treat them as line terminators as
770 well, so that there are no CRs in spooled messages. However, the message
771 terminating dot is not recognized between two bare CRs.
772
773 Arguments:
774 fout a FILE to which to write the message; NULL if skipping
775
776 Returns: One of the END_xxx values indicating why it stopped reading
777 */
778
779 static int
780 read_message_data_smtp(FILE *fout)
781 {
782 int ch_state = 0;
783 int ch;
784 int linelength = 0;
785
786 while ((ch = (receive_getc)(GETC_BUFFER_UNLIMITED)) != EOF)
787 {
788 if (ch == 0) body_zerocount++;
789 switch (ch_state)
790 {
791 case 0: /* After LF or CRLF */
792 if (ch == '.')
793 {
794 ch_state = 3;
795 continue; /* Don't ever write . after LF */
796 }
797 ch_state = 1;
798
799 /* Else fall through to handle as normal uschar. */
800
801 case 1: /* Normal state */
802 if (ch == '\n')
803 {
804 ch_state = 0;
805 body_linecount++;
806 if (linelength > max_received_linelength)
807 max_received_linelength = linelength;
808 linelength = -1;
809 }
810 else if (ch == '\r')
811 {
812 ch_state = 2;
813 continue;
814 }
815 break;
816
817 case 2: /* After (unwritten) CR */
818 body_linecount++;
819 if (linelength > max_received_linelength)
820 max_received_linelength = linelength;
821 linelength = -1;
822 if (ch == '\n')
823 {
824 ch_state = 0;
825 }
826 else
827 {
828 message_size++;
829 if (fout != NULL && fputc('\n', fout) == EOF) return END_WERROR;
830 cutthrough_data_put_nl();
831 if (ch != '\r') ch_state = 1; else continue;
832 }
833 break;
834
835 case 3: /* After [CR] LF . */
836 if (ch == '\n')
837 return END_DOT;
838 if (ch == '\r')
839 {
840 ch_state = 4;
841 continue;
842 }
843 /* The dot was removed at state 3. For a doubled dot, here, reinstate
844 it to cutthrough. The current ch, dot or not, is passed both to cutthrough
845 and to file below. */
846 if (ch == '.')
847 {
848 uschar c= ch;
849 cutthrough_data_puts(&c, 1);
850 }
851 ch_state = 1;
852 break;
853
854 case 4: /* After [CR] LF . CR */
855 if (ch == '\n') return END_DOT;
856 message_size++;
857 body_linecount++;
858 if (fout != NULL && fputc('\n', fout) == EOF) return END_WERROR;
859 cutthrough_data_put_nl();
860 if (ch == '\r')
861 {
862 ch_state = 2;
863 continue;
864 }
865 ch_state = 1;
866 break;
867 }
868
869 /* Add the character to the spool file, unless skipping; then loop for the
870 next. */
871
872 message_size++;
873 linelength++;
874 if (fout)
875 {
876 if (fputc(ch, fout) == EOF) return END_WERROR;
877 if (message_size > thismessage_size_limit) return END_SIZE;
878 }
879 if(ch == '\n')
880 cutthrough_data_put_nl();
881 else
882 {
883 uschar c = ch;
884 cutthrough_data_puts(&c, 1);
885 }
886 }
887
888 /* Fall through here if EOF encountered. This indicates some kind of error,
889 since a correct message is terminated by [CR] LF . [CR] LF. */
890
891 return END_EOF;
892 }
893
894
895
896
897 /* Variant of the above read_message_data_smtp() specialised for RFC 3030
898 CHUNKING. Accept input lines separated by either CRLF or CR or LF and write
899 LF-delimited spoolfile. Until we have wireformat spoolfiles, we need the
900 body_linecount accounting for proper re-expansion for the wire, so use
901 a cut-down version of the state-machine above; we don't need to do leading-dot
902 detection and unstuffing.
903
904 Arguments:
905 fout a FILE to which to write the message; NULL if skipping;
906 must be open for both writing and reading.
907
908 Returns: One of the END_xxx values indicating why it stopped reading
909 */
910
911 static int
912 read_message_bdat_smtp(FILE *fout)
913 {
914 int linelength = 0, ch;
915 enum CH_STATE ch_state = LF_SEEN;
916 BOOL fix_nl = FALSE;
917
918 for(;;)
919 {
920 switch ((ch = bdat_getc(GETC_BUFFER_UNLIMITED)))
921 {
922 case EOF: return END_EOF;
923 case ERR: return END_PROTOCOL;
924 case EOD:
925 /* Nothing to get from the sender anymore. We check the last
926 character written to the spool.
927
928 RFC 3030 states, that BDAT chunks are normal text, terminated by CRLF.
929 If we would be strict, we would refuse such broken messages.
930 But we are liberal, so we fix it. It would be easy just to append
931 the "\n" to the spool.
932
933 But there are some more things (line counting, message size calculation and such),
934 that would need to be duplicated here. So we simply do some ungetc
935 trickery.
936 */
937 if (fout)
938 {
939 if (fseek(fout, -1, SEEK_CUR) < 0) return END_PROTOCOL;
940 if (fgetc(fout) == '\n') return END_DOT;
941 }
942
943 if (linelength == -1) /* \r already seen (see below) */
944 {
945 DEBUG(D_receive) debug_printf("Add missing LF\n");
946 bdat_ungetc('\n');
947 continue;
948 }
949 DEBUG(D_receive) debug_printf("Add missing CRLF\n");
950 bdat_ungetc('\r'); /* not even \r was seen */
951 fix_nl = TRUE;
952
953 continue;
954 case '\0': body_zerocount++; break;
955 }
956 switch (ch_state)
957 {
958 case LF_SEEN: /* After LF or CRLF */
959 ch_state = MID_LINE;
960 /* fall through to handle as normal uschar. */
961
962 case MID_LINE: /* Mid-line state */
963 if (ch == '\n')
964 {
965 ch_state = LF_SEEN;
966 body_linecount++;
967 if (linelength > max_received_linelength)
968 max_received_linelength = linelength;
969 linelength = -1;
970 }
971 else if (ch == '\r')
972 {
973 ch_state = CR_SEEN;
974 if (fix_nl) bdat_ungetc('\n');
975 continue; /* don't write CR */
976 }
977 break;
978
979 case CR_SEEN: /* After (unwritten) CR */
980 body_linecount++;
981 if (linelength > max_received_linelength)
982 max_received_linelength = linelength;
983 linelength = -1;
984 if (ch == '\n')
985 ch_state = LF_SEEN;
986 else
987 {
988 message_size++;
989 if (fout && fputc('\n', fout) == EOF) return END_WERROR;
990 cutthrough_data_put_nl();
991 if (ch == '\r') continue; /* don't write CR */
992 ch_state = MID_LINE;
993 }
994 break;
995 }
996
997 /* Add the character to the spool file, unless skipping */
998
999 message_size++;
1000 linelength++;
1001 if (fout)
1002 {
1003 if (fputc(ch, fout) == EOF) return END_WERROR;
1004 if (message_size > thismessage_size_limit) return END_SIZE;
1005 }
1006 if(ch == '\n')
1007 cutthrough_data_put_nl();
1008 else
1009 {
1010 uschar c = ch;
1011 cutthrough_data_puts(&c, 1);
1012 }
1013 }
1014 /*NOTREACHED*/
1015 }
1016
1017 static int
1018 read_message_bdat_smtp_wire(FILE *fout)
1019 {
1020 int ch;
1021
1022 /* Remember that this message uses wireformat. */
1023
1024 DEBUG(D_receive) debug_printf("CHUNKING: %s\n",
1025 fout ? "writing spoolfile in wire format" : "flushing input");
1026 f.spool_file_wireformat = TRUE;
1027
1028 for (;;)
1029 {
1030 if (chunking_data_left > 0)
1031 {
1032 unsigned len = MAX(chunking_data_left, thismessage_size_limit - message_size + 1);
1033 uschar * buf = bdat_getbuf(&len);
1034
1035 if (!buf) return END_EOF;
1036 message_size += len;
1037 if (fout && fwrite(buf, len, 1, fout) != 1) return END_WERROR;
1038 }
1039 else switch (ch = bdat_getc(GETC_BUFFER_UNLIMITED))
1040 {
1041 case EOF: return END_EOF;
1042 case EOD: return END_DOT;
1043 case ERR: return END_PROTOCOL;
1044
1045 default:
1046 message_size++;
1047 /*XXX not done:
1048 linelength
1049 max_received_linelength
1050 body_linecount
1051 body_zerocount
1052 */
1053 if (fout && fputc(ch, fout) == EOF) return END_WERROR;
1054 break;
1055 }
1056 if (message_size > thismessage_size_limit) return END_SIZE;
1057 }
1058 /*NOTREACHED*/
1059 }
1060
1061
1062
1063
1064 /*************************************************
1065 * Swallow SMTP message *
1066 *************************************************/
1067
1068 /* This function is called when there has been some kind of error while reading
1069 an SMTP message, and the remaining data may need to be swallowed. It is global
1070 because it is called from smtp_closedown() to shut down an incoming call
1071 tidily.
1072
1073 Argument: a FILE from which to read the message
1074 Returns: nothing
1075 */
1076
1077 void
1078 receive_swallow_smtp(void)
1079 {
1080 if (message_ended >= END_NOTENDED)
1081 message_ended = chunking_state <= CHUNKING_OFFERED
1082 ? read_message_data_smtp(NULL)
1083 : read_message_bdat_smtp_wire(NULL);
1084 }
1085
1086
1087
1088 /*************************************************
1089 * Handle lost SMTP connection *
1090 *************************************************/
1091
1092 /* This function logs connection loss incidents and generates an appropriate
1093 SMTP response.
1094
1095 Argument: additional data for the message
1096 Returns: the SMTP response
1097 */
1098
1099 static uschar *
1100 handle_lost_connection(uschar *s)
1101 {
1102 log_write(L_lost_incoming_connection | L_smtp_connection, LOG_MAIN,
1103 "%s lost while reading message data%s", smtp_get_connection_info(), s);
1104 smtp_notquit_exit(US"connection-lost", NULL, NULL);
1105 return US"421 Lost incoming connection";
1106 }
1107
1108
1109
1110
1111 /*************************************************
1112 * Handle a non-smtp reception error *
1113 *************************************************/
1114
1115 /* This function is called for various errors during the reception of non-SMTP
1116 messages. It either sends a message to the sender of the problem message, or it
1117 writes to the standard error stream.
1118
1119 Arguments:
1120 errcode code for moan_to_sender(), identifying the error
1121 text1 first message text, passed to moan_to_sender()
1122 text2 second message text, used only for stderrr
1123 error_rc code to pass to exim_exit if no problem
1124 f FILE containing body of message (may be stdin)
1125 hptr pointer to instore headers or NULL
1126
1127 Returns: calls exim_exit(), which does not return
1128 */
1129
1130 static void
1131 give_local_error(int errcode, uschar *text1, uschar *text2, int error_rc,
1132 FILE *f, header_line *hptr)
1133 {
1134 if (error_handling == ERRORS_SENDER)
1135 {
1136 error_block eblock;
1137 eblock.next = NULL;
1138 eblock.text1 = text1;
1139 eblock.text2 = US"";
1140 if (!moan_to_sender(errcode, &eblock, hptr, f, FALSE))
1141 error_rc = EXIT_FAILURE;
1142 }
1143 else
1144 fprintf(stderr, "exim: %s%s\n", text2, text1); /* Sic */
1145 (void)fclose(f);
1146 exim_exit(error_rc, US"");
1147 }
1148
1149
1150
1151 /*************************************************
1152 * Add header lines set up by ACL *
1153 *************************************************/
1154
1155 /* This function is called to add the header lines that were set up by
1156 statements in an ACL to the list of headers in memory. It is done in two stages
1157 like this, because when the ACL for RCPT is running, the other headers have not
1158 yet been received. This function is called twice; once just before running the
1159 DATA ACL, and once after. This is so that header lines added by MAIL or RCPT
1160 are visible to the DATA ACL.
1161
1162 Originally these header lines were added at the end. Now there is support for
1163 three different places: top, bottom, and after the Received: header(s). There
1164 will always be at least one Received: header, even if it is marked deleted, and
1165 even if something else has been put in front of it.
1166
1167 Arguments:
1168 acl_name text to identify which ACL
1169
1170 Returns: nothing
1171 */
1172
1173 static void
1174 add_acl_headers(int where, uschar *acl_name)
1175 {
1176 header_line *h, *next;
1177 header_line *last_received = NULL;
1178
1179 switch(where)
1180 {
1181 case ACL_WHERE_DKIM:
1182 case ACL_WHERE_MIME:
1183 case ACL_WHERE_DATA:
1184 if ( cutthrough.cctx.sock >= 0 && cutthrough.delivery
1185 && (acl_removed_headers || acl_added_headers))
1186 {
1187 log_write(0, LOG_MAIN|LOG_PANIC, "Header modification in data ACLs"
1188 " will not take effect on cutthrough deliveries");
1189 return;
1190 }
1191 }
1192
1193 if (acl_removed_headers)
1194 {
1195 DEBUG(D_receive|D_acl) debug_printf_indent(">>Headers removed by %s ACL:\n", acl_name);
1196
1197 for (h = header_list; h; h = h->next) if (h->type != htype_old)
1198 {
1199 const uschar * list = acl_removed_headers;
1200 int sep = ':'; /* This is specified as a colon-separated list */
1201 uschar *s;
1202 uschar buffer[128];
1203
1204 while ((s = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
1205 if (header_testname(h, s, Ustrlen(s), FALSE))
1206 {
1207 h->type = htype_old;
1208 DEBUG(D_receive|D_acl) debug_printf_indent(" %s", h->text);
1209 }
1210 }
1211 acl_removed_headers = NULL;
1212 DEBUG(D_receive|D_acl) debug_printf_indent(">>\n");
1213 }
1214
1215 if (!acl_added_headers) return;
1216 DEBUG(D_receive|D_acl) debug_printf_indent(">>Headers added by %s ACL:\n", acl_name);
1217
1218 for (h = acl_added_headers; h; h = next)
1219 {
1220 next = h->next;
1221
1222 switch(h->type)
1223 {
1224 case htype_add_top:
1225 h->next = header_list;
1226 header_list = h;
1227 DEBUG(D_receive|D_acl) debug_printf_indent(" (at top)");
1228 break;
1229
1230 case htype_add_rec:
1231 if (!last_received)
1232 {
1233 last_received = header_list;
1234 while (!header_testname(last_received, US"Received", 8, FALSE))
1235 last_received = last_received->next;
1236 while (last_received->next &&
1237 header_testname(last_received->next, US"Received", 8, FALSE))
1238 last_received = last_received->next;
1239 }
1240 h->next = last_received->next;
1241 last_received->next = h;
1242 DEBUG(D_receive|D_acl) debug_printf_indent(" (after Received:)");
1243 break;
1244
1245 case htype_add_rfc:
1246 /* add header before any header which is NOT Received: or Resent- */
1247 last_received = header_list;
1248 while ( last_received->next &&
1249 ( (header_testname(last_received->next, US"Received", 8, FALSE)) ||
1250 (header_testname_incomplete(last_received->next, US"Resent-", 7, FALSE)) ) )
1251 last_received = last_received->next;
1252 /* last_received now points to the last Received: or Resent-* header
1253 in an uninterrupted chain of those header types (seen from the beginning
1254 of all headers. Our current header must follow it. */
1255 h->next = last_received->next;
1256 last_received->next = h;
1257 DEBUG(D_receive|D_acl) debug_printf_indent(" (before any non-Received: or Resent-*: header)");
1258 break;
1259
1260 default:
1261 h->next = NULL;
1262 header_last->next = h;
1263 DEBUG(D_receive|D_acl) debug_printf_indent(" ");
1264 break;
1265 }
1266
1267 if (!h->next) header_last = h;
1268
1269 /* Check for one of the known header types (From:, To:, etc.) though in
1270 practice most added headers are going to be "other". Lower case
1271 identification letters are never stored with the header; they are used
1272 for existence tests when messages are received. So discard any lower case
1273 flag values. */
1274
1275 h->type = header_checkname(h, FALSE);
1276 if (h->type >= 'a') h->type = htype_other;
1277
1278 DEBUG(D_receive|D_acl) debug_printf("%s", h->text);
1279 }
1280
1281 acl_added_headers = NULL;
1282 DEBUG(D_receive|D_acl) debug_printf_indent(">>\n");
1283 }
1284
1285
1286
1287 /*************************************************
1288 * Add host information for log line *
1289 *************************************************/
1290
1291 /* Called for acceptance and rejecting log lines. This adds information about
1292 the calling host to a string that is being built dynamically.
1293
1294 Arguments:
1295 s the dynamic string
1296
1297 Returns: the extended string
1298 */
1299
1300 static gstring *
1301 add_host_info_for_log(gstring * g)
1302 {
1303 if (sender_fullhost)
1304 {
1305 if (LOGGING(dnssec) && sender_host_dnssec) /*XXX sender_helo_dnssec? */
1306 g = string_catn(g, US" DS", 3);
1307 g = string_append(g, 2, US" H=", sender_fullhost);
1308 if (LOGGING(incoming_interface) && interface_address != NULL)
1309 {
1310 g = string_cat(g,
1311 string_sprintf(" I=[%s]:%d", interface_address, interface_port));
1312 }
1313 }
1314 if (f.tcp_in_fastopen && !f.tcp_in_fastopen_logged)
1315 {
1316 g = string_catn(g, US" TFO", 4);
1317 f.tcp_in_fastopen_logged = TRUE;
1318 }
1319 if (sender_ident)
1320 g = string_append(g, 2, US" U=", sender_ident);
1321 if (received_protocol)
1322 g = string_append(g, 2, US" P=", received_protocol);
1323 if (LOGGING(pipelining) && f.smtp_in_pipelining_advertised)
1324 g = string_catn(g, US" L-", f.smtp_in_pipelining_used ? 2 : 3);
1325 return g;
1326 }
1327
1328
1329
1330 #ifdef WITH_CONTENT_SCAN
1331
1332 /*************************************************
1333 * Run the MIME ACL on a message *
1334 *************************************************/
1335
1336 /* This code is in a subroutine so that it can be used for both SMTP
1337 and non-SMTP messages. It is called with a non-NULL ACL pointer.
1338
1339 Arguments:
1340 acl The ACL to run (acl_smtp_mime or acl_not_smtp_mime)
1341 smtp_yield_ptr Set FALSE to kill messages after dropped connection
1342 smtp_reply_ptr Where SMTP reply is being built
1343 blackholed_by_ptr Where "blackholed by" message is being built
1344
1345 Returns: TRUE to carry on; FALSE to abandon the message
1346 */
1347
1348 static BOOL
1349 run_mime_acl(uschar *acl, BOOL *smtp_yield_ptr, uschar **smtp_reply_ptr,
1350 uschar **blackholed_by_ptr)
1351 {
1352 FILE *mbox_file;
1353 uschar * rfc822_file_path = NULL;
1354 unsigned long mbox_size;
1355 header_line *my_headerlist;
1356 uschar *user_msg, *log_msg;
1357 int mime_part_count_buffer = -1;
1358 uschar * mbox_filename;
1359 int rc = OK;
1360
1361 /* check if it is a MIME message */
1362
1363 for (my_headerlist = header_list; my_headerlist; my_headerlist = my_headerlist->next)
1364 if ( my_headerlist->type != '*' /* skip deleted headers */
1365 && strncmpic(my_headerlist->text, US"Content-Type:", 13) == 0
1366 )
1367 {
1368 DEBUG(D_receive) debug_printf("Found Content-Type: header - executing acl_smtp_mime.\n");
1369 goto DO_MIME_ACL;
1370 }
1371
1372 DEBUG(D_receive) debug_printf("No Content-Type: header - presumably not a MIME message.\n");
1373 return TRUE;
1374
1375 DO_MIME_ACL:
1376
1377 /* make sure the eml mbox file is spooled up */
1378 if (!(mbox_file = spool_mbox(&mbox_size, NULL, &mbox_filename)))
1379 { /* error while spooling */
1380 log_write(0, LOG_MAIN|LOG_PANIC,
1381 "acl_smtp_mime: error while creating mbox spool file, message temporarily rejected.");
1382 Uunlink(spool_name);
1383 unspool_mbox();
1384 #ifdef EXPERIMENTAL_DCC
1385 dcc_ok = 0;
1386 #endif
1387 smtp_respond(US"451", 3, TRUE, US"temporary local problem");
1388 message_id[0] = 0; /* Indicate no message accepted */
1389 *smtp_reply_ptr = US""; /* Indicate reply already sent */
1390 return FALSE; /* Indicate skip to end of receive function */
1391 }
1392
1393 mime_is_rfc822 = 0;
1394
1395 MIME_ACL_CHECK:
1396 mime_part_count = -1;
1397 rc = mime_acl_check(acl, mbox_file, NULL, &user_msg, &log_msg);
1398 (void)fclose(mbox_file);
1399
1400 if (rfc822_file_path)
1401 {
1402 mime_part_count = mime_part_count_buffer;
1403
1404 if (unlink(CS rfc822_file_path) == -1)
1405 {
1406 log_write(0, LOG_PANIC,
1407 "acl_smtp_mime: can't unlink RFC822 spool file, skipping.");
1408 goto END_MIME_ACL;
1409 }
1410 rfc822_file_path = NULL;
1411 }
1412
1413 /* check if we must check any message/rfc822 attachments */
1414 if (rc == OK)
1415 {
1416 uschar * scandir = string_copyn(mbox_filename,
1417 Ustrrchr(mbox_filename, '/') - mbox_filename);
1418 struct dirent * entry;
1419 DIR * tempdir;
1420
1421 for (tempdir = opendir(CS scandir); entry = readdir(tempdir); )
1422 if (strncmpic(US entry->d_name, US"__rfc822_", 9) == 0)
1423 {
1424 rfc822_file_path = string_sprintf("%s/%s", scandir, entry->d_name);
1425 DEBUG(D_receive)
1426 debug_printf("RFC822 attachment detected: running MIME ACL for '%s'\n",
1427 rfc822_file_path);
1428 break;
1429 }
1430 closedir(tempdir);
1431
1432 if (rfc822_file_path)
1433 {
1434 if ((mbox_file = Ufopen(rfc822_file_path, "rb")))
1435 {
1436 /* set RFC822 expansion variable */
1437 mime_is_rfc822 = 1;
1438 mime_part_count_buffer = mime_part_count;
1439 goto MIME_ACL_CHECK;
1440 }
1441 log_write(0, LOG_PANIC,
1442 "acl_smtp_mime: can't open RFC822 spool file, skipping.");
1443 unlink(CS rfc822_file_path);
1444 }
1445 }
1446
1447 END_MIME_ACL:
1448 add_acl_headers(ACL_WHERE_MIME, US"MIME");
1449 if (rc == DISCARD)
1450 {
1451 recipients_count = 0;
1452 *blackholed_by_ptr = US"MIME ACL";
1453 cancel_cutthrough_connection(TRUE, US"mime acl discard");
1454 }
1455 else if (rc != OK)
1456 {
1457 Uunlink(spool_name);
1458 cancel_cutthrough_connection(TRUE, US"mime acl not ok");
1459 unspool_mbox();
1460 #ifdef EXPERIMENTAL_DCC
1461 dcc_ok = 0;
1462 #endif
1463 if (smtp_input)
1464 {
1465 if (smtp_handle_acl_fail(ACL_WHERE_MIME, rc, user_msg, log_msg) != 0)
1466 *smtp_yield_ptr = FALSE; /* No more messages after dropped connection */
1467 *smtp_reply_ptr = US""; /* Indicate reply already sent */
1468 }
1469 message_id[0] = 0; /* Indicate no message accepted */
1470 return FALSE; /* Cause skip to end of receive function */
1471 }
1472
1473 return TRUE;
1474 }
1475
1476 #endif /* WITH_CONTENT_SCAN */
1477
1478
1479
1480 void
1481 received_header_gen(void)
1482 {
1483 uschar *received;
1484 uschar *timestamp;
1485 header_line *received_header= header_list;
1486
1487 timestamp = expand_string(US"${tod_full}");
1488 if (recipients_count == 1) received_for = recipients_list[0].address;
1489 received = expand_string(received_header_text);
1490 received_for = NULL;
1491
1492 if (!received)
1493 {
1494 if(spool_name[0] != 0)
1495 Uunlink(spool_name); /* Lose the data file */
1496 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Expansion of \"%s\" "
1497 "(received_header_text) failed: %s", string_printing(received_header_text),
1498 expand_string_message);
1499 }
1500
1501 /* The first element on the header chain is reserved for the Received header,
1502 so all we have to do is fill in the text pointer, and set the type. However, if
1503 the result of the expansion is an empty string, we leave the header marked as
1504 "old" so as to refrain from adding a Received header. */
1505
1506 if (received[0] == 0)
1507 {
1508 received_header->text = string_sprintf("Received: ; %s\n", timestamp);
1509 received_header->type = htype_old;
1510 }
1511 else
1512 {
1513 received_header->text = string_sprintf("%s; %s\n", received, timestamp);
1514 received_header->type = htype_received;
1515 }
1516
1517 received_header->slen = Ustrlen(received_header->text);
1518
1519 DEBUG(D_receive) debug_printf(">>Generated Received: header line\n%c %s",
1520 received_header->type, received_header->text);
1521 }
1522
1523
1524
1525 /*************************************************
1526 * Receive message *
1527 *************************************************/
1528
1529 /* Receive a message on the given input, and put it into a pair of spool files.
1530 Either a non-null list of recipients, or the extract flag will be true, or
1531 both. The flag sender_local is true for locally generated messages. The flag
1532 submission_mode is true if an ACL has obeyed "control = submission". The flag
1533 suppress_local_fixups is true if an ACL has obeyed "control =
1534 suppress_local_fixups" or -G was passed on the command-line.
1535 The flag smtp_input is true if the message is to be
1536 handled using SMTP conventions about termination and lines starting with dots.
1537 For non-SMTP messages, dot_ends is true for dot-terminated messages.
1538
1539 If a message was successfully read, message_id[0] will be non-zero.
1540
1541 The general actions of this function are:
1542
1543 . Read the headers of the message (if any) into a chain of store
1544 blocks.
1545
1546 . If there is a "sender:" header and the message is locally originated,
1547 throw it away, unless the caller is trusted, or unless
1548 active_local_sender_retain is set - which can only happen if
1549 active_local_from_check is false.
1550
1551 . If recipients are to be extracted from the message, build the
1552 recipients list from the headers, removing any that were on the
1553 original recipients list (unless extract_addresses_remove_arguments is
1554 false), and at the same time, remove any bcc header that may be present.
1555
1556 . Get the spool file for the data, sort out its unique name, open
1557 and lock it (but don't give it the name yet).
1558
1559 . Generate a "Message-Id" header if the message doesn't have one, for
1560 locally-originated messages.
1561
1562 . Generate a "Received" header.
1563
1564 . Ensure the recipients list is fully qualified and rewritten if necessary.
1565
1566 . If there are any rewriting rules, apply them to the sender address
1567 and also to the headers.
1568
1569 . If there is no from: header, generate one, for locally-generated messages
1570 and messages in "submission mode" only.
1571
1572 . If the sender is local, check that from: is correct, and if not, generate
1573 a Sender: header, unless message comes from a trusted caller, or this
1574 feature is disabled by active_local_from_check being false.
1575
1576 . If there is no "date" header, generate one, for locally-originated
1577 or submission mode messages only.
1578
1579 . Copy the rest of the input, or up to a terminating "." if in SMTP or
1580 dot_ends mode, to the data file. Leave it open, to hold the lock.
1581
1582 . Write the envelope and the headers to a new file.
1583
1584 . Set the name for the header file; close it.
1585
1586 . Set the name for the data file; close it.
1587
1588 Because this function can potentially be called many times in a single
1589 SMTP connection, all store should be got by store_get(), so that it will be
1590 automatically retrieved after the message is accepted.
1591
1592 FUDGE: It seems that sites on the net send out messages with just LF
1593 terminators, despite the warnings in the RFCs, and other MTAs handle this. So
1594 we make the CRs optional in all cases.
1595
1596 July 2003: Bare CRs in messages, especially in header lines, cause trouble. A
1597 new regime is now in place in which bare CRs in header lines are turned into LF
1598 followed by a space, so as not to terminate the header line.
1599
1600 February 2004: A bare LF in a header line in a message whose first line was
1601 terminated by CRLF is treated in the same way as a bare CR.
1602
1603 Arguments:
1604 extract_recip TRUE if recipients are to be extracted from the message's
1605 headers
1606
1607 Returns: TRUE there are more messages to be read (SMTP input)
1608 FALSE there are no more messages to be read (non-SMTP input
1609 or SMTP connection collapsed, or other failure)
1610
1611 When reading a message for filter testing, the returned value indicates
1612 whether the headers (which is all that is read) were terminated by '.' or
1613 not. */
1614
1615 BOOL
1616 receive_msg(BOOL extract_recip)
1617 {
1618 int i;
1619 int rc = FAIL;
1620 int msg_size = 0;
1621 int process_info_len = Ustrlen(process_info);
1622 int error_rc = error_handling == ERRORS_SENDER
1623 ? errors_sender_rc : EXIT_FAILURE;
1624 int header_size = 256;
1625 int start, end, domain;
1626 int id_resolution = 0;
1627 int had_zero = 0;
1628 int prevlines_length = 0;
1629
1630 int ptr = 0;
1631
1632 BOOL contains_resent_headers = FALSE;
1633 BOOL extracted_ignored = FALSE;
1634 BOOL first_line_ended_crlf = TRUE_UNSET;
1635 BOOL smtp_yield = TRUE;
1636 BOOL yield = FALSE;
1637
1638 BOOL resents_exist = FALSE;
1639 uschar *resent_prefix = US"";
1640 uschar *blackholed_by = NULL;
1641 uschar *blackhole_log_msg = US"";
1642 enum {NOT_TRIED, TMP_REJ, PERM_REJ, ACCEPTED} cutthrough_done = NOT_TRIED;
1643
1644 flock_t lock_data;
1645 error_block *bad_addresses = NULL;
1646
1647 uschar *frozen_by = NULL;
1648 uschar *queued_by = NULL;
1649
1650 uschar *errmsg;
1651 gstring * g;
1652 struct stat statbuf;
1653
1654 /* Final message to give to SMTP caller, and messages from ACLs */
1655
1656 uschar *smtp_reply = NULL;
1657 uschar *user_msg, *log_msg;
1658
1659 /* Working header pointers */
1660
1661 header_line *h, *next;
1662
1663 /* Flags for noting the existence of certain headers (only one left) */
1664
1665 BOOL date_header_exists = FALSE;
1666
1667 /* Pointers to receive the addresses of headers whose contents we need. */
1668
1669 header_line *from_header = NULL;
1670 header_line *subject_header = NULL;
1671 header_line *msgid_header = NULL;
1672 header_line *received_header;
1673
1674 #ifdef EXPERIMENTAL_DMARC
1675 int dmarc_up = 0;
1676 #endif /* EXPERIMENTAL_DMARC */
1677
1678 /* Variables for use when building the Received: header. */
1679
1680 uschar *timestamp;
1681 int tslen;
1682
1683
1684 /* Release any open files that might have been cached while preparing to
1685 accept the message - e.g. by verifying addresses - because reading a message
1686 might take a fair bit of real time. */
1687
1688 search_tidyup();
1689
1690 /* Extracting the recipient list from an input file is incompatible with
1691 cutthrough delivery with the no-spool option. It shouldn't be possible
1692 to set up the combination, but just in case kill any ongoing connection. */
1693 if (extract_recip || !smtp_input)
1694 cancel_cutthrough_connection(TRUE, US"not smtp input");
1695
1696 /* Initialize the chain of headers by setting up a place-holder for Received:
1697 header. Temporarily mark it as "old", i.e. not to be used. We keep header_last
1698 pointing to the end of the chain to make adding headers simple. */
1699
1700 received_header = header_list = header_last = store_get(sizeof(header_line));
1701 header_list->next = NULL;
1702 header_list->type = htype_old;
1703 header_list->text = NULL;
1704 header_list->slen = 0;
1705
1706 /* Control block for the next header to be read. */
1707
1708 next = store_get(sizeof(header_line));
1709 next->text = store_get(header_size);
1710
1711 /* Initialize message id to be null (indicating no message read), and the
1712 header names list to be the normal list. Indicate there is no data file open
1713 yet, initialize the size and warning count, and deal with no size limit. */
1714
1715 message_id[0] = 0;
1716 spool_data_file = NULL;
1717 data_fd = -1;
1718 spool_name = US"";
1719 message_size = 0;
1720 warning_count = 0;
1721 received_count = 1; /* For the one we will add */
1722
1723 if (thismessage_size_limit <= 0) thismessage_size_limit = INT_MAX;
1724
1725 /* While reading the message, the following counts are computed. */
1726
1727 message_linecount = body_linecount = body_zerocount =
1728 max_received_linelength = 0;
1729
1730 #ifndef DISABLE_DKIM
1731 /* Call into DKIM to set up the context. In CHUNKING mode
1732 we clear the dot-stuffing flag */
1733 if (smtp_input && !smtp_batched_input && !f.dkim_disable_verify)
1734 dkim_exim_verify_init(chunking_state <= CHUNKING_OFFERED);
1735 #endif
1736
1737 #ifdef EXPERIMENTAL_DMARC
1738 /* initialize libopendmarc */
1739 dmarc_up = dmarc_init();
1740 #endif
1741
1742 /* Remember the time of reception. Exim uses time+pid for uniqueness of message
1743 ids, and fractions of a second are required. See the comments that precede the
1744 message id creation below. */
1745
1746 (void)gettimeofday(&message_id_tv, NULL);
1747
1748 /* For other uses of the received time we can operate with granularity of one
1749 second, and for that we use the global variable received_time. This is for
1750 things like ultimate message timeouts. */
1751
1752 received_time = message_id_tv;
1753
1754 /* If SMTP input, set the special handler for timeouts. The alarm() calls
1755 happen in the smtp_getc() function when it refills its buffer. */
1756
1757 had_data_timeout = 0;
1758 if (smtp_input)
1759 os_non_restarting_signal(SIGALRM, data_timeout_handler);
1760
1761 /* If not SMTP input, timeout happens only if configured, and we just set a
1762 single timeout for the whole message. */
1763
1764 else if (receive_timeout > 0)
1765 {
1766 os_non_restarting_signal(SIGALRM, data_timeout_handler);
1767 alarm(receive_timeout);
1768 }
1769
1770 /* SIGTERM and SIGINT are caught always. */
1771
1772 had_data_sigint = 0;
1773 signal(SIGTERM, data_sigterm_sigint_handler);
1774 signal(SIGINT, data_sigterm_sigint_handler);
1775
1776 /* Header lines in messages are not supposed to be very long, though when
1777 unfolded, to: and cc: headers can take up a lot of store. We must also cope
1778 with the possibility of junk being thrown at us. Start by getting 256 bytes for
1779 storing the header, and extend this as necessary using string_cat().
1780
1781 To cope with total lunacies, impose an upper limit on the length of the header
1782 section of the message, as otherwise the store will fill up. We must also cope
1783 with the possibility of binary zeros in the data. Hence we cannot use fgets().
1784 Folded header lines are joined into one string, leaving the '\n' characters
1785 inside them, so that writing them out reproduces the input.
1786
1787 Loop for each character of each header; the next structure for chaining the
1788 header is set up already, with ptr the offset of the next character in
1789 next->text. */
1790
1791 for (;;)
1792 {
1793 int ch = (receive_getc)(GETC_BUFFER_UNLIMITED);
1794
1795 /* If we hit EOF on a SMTP connection, it's an error, since incoming
1796 SMTP must have a correct "." terminator. */
1797
1798 if (ch == EOF && smtp_input /* && !smtp_batched_input */)
1799 {
1800 smtp_reply = handle_lost_connection(US" (header)");
1801 smtp_yield = FALSE;
1802 goto TIDYUP; /* Skip to end of function */
1803 }
1804
1805 /* See if we are at the current header's size limit - there must be at least
1806 four bytes left. This allows for the new character plus a zero, plus two for
1807 extra insertions when we are playing games with dots and carriage returns. If
1808 we are at the limit, extend the text buffer. This could have been done
1809 automatically using string_cat() but because this is a tightish loop storing
1810 only one character at a time, we choose to do it inline. Normally
1811 store_extend() will be able to extend the block; only at the end of a big
1812 store block will a copy be needed. To handle the case of very long headers
1813 (and sometimes lunatic messages can have ones that are 100s of K long) we
1814 call store_release() for strings that have been copied - if the string is at
1815 the start of a block (and therefore the only thing in it, because we aren't
1816 doing any other gets), the block gets freed. We can only do this release if
1817 there were no allocations since the once that we want to free. */
1818
1819 if (ptr >= header_size - 4)
1820 {
1821 int oldsize = header_size;
1822 /* header_size += 256; */
1823 header_size *= 2;
1824 if (!store_extend(next->text, oldsize, header_size))
1825 next->text = store_newblock(next->text, header_size, ptr);
1826 }
1827
1828 /* Cope with receiving a binary zero. There is dispute about whether
1829 these should be allowed in RFC 822 messages. The middle view is that they
1830 should not be allowed in headers, at least. Exim takes this attitude at
1831 the moment. We can't just stomp on them here, because we don't know that
1832 this line is a header yet. Set a flag to cause scanning later. */
1833
1834 if (ch == 0) had_zero++;
1835
1836 /* Test for termination. Lines in remote SMTP are terminated by CRLF, while
1837 those from data files use just LF. Treat LF in local SMTP input as a
1838 terminator too. Treat EOF as a line terminator always. */
1839
1840 if (ch == EOF) goto EOL;
1841
1842 /* FUDGE: There are sites out there that don't send CRs before their LFs, and
1843 other MTAs accept this. We are therefore forced into this "liberalisation"
1844 too, so we accept LF as a line terminator whatever the source of the message.
1845 However, if the first line of the message ended with a CRLF, we treat a bare
1846 LF specially by inserting a white space after it to ensure that the header
1847 line is not terminated. */
1848
1849 if (ch == '\n')
1850 {
1851 if (first_line_ended_crlf == TRUE_UNSET) first_line_ended_crlf = FALSE;
1852 else if (first_line_ended_crlf) receive_ungetc(' ');
1853 goto EOL;
1854 }
1855
1856 /* This is not the end of the line. If this is SMTP input and this is
1857 the first character in the line and it is a "." character, ignore it.
1858 This implements the dot-doubling rule, though header lines starting with
1859 dots aren't exactly common. They are legal in RFC 822, though. If the
1860 following is CRLF or LF, this is the line that that terminates the
1861 entire message. We set message_ended to indicate this has happened (to
1862 prevent further reading), and break out of the loop, having freed the
1863 empty header, and set next = NULL to indicate no data line. */
1864
1865 if (ptr == 0 && ch == '.' && f.dot_ends)
1866 {
1867 ch = (receive_getc)(GETC_BUFFER_UNLIMITED);
1868 if (ch == '\r')
1869 {
1870 ch = (receive_getc)(GETC_BUFFER_UNLIMITED);
1871 if (ch != '\n')
1872 {
1873 receive_ungetc(ch);
1874 ch = '\r'; /* Revert to CR */
1875 }
1876 }
1877 if (ch == '\n')
1878 {
1879 message_ended = END_DOT;
1880 store_reset(next);
1881 next = NULL;
1882 break; /* End character-reading loop */
1883 }
1884
1885 /* For non-SMTP input, the dot at the start of the line was really a data
1886 character. What is now in ch is the following character. We guaranteed
1887 enough space for this above. */
1888
1889 if (!smtp_input)
1890 {
1891 next->text[ptr++] = '.';
1892 message_size++;
1893 }
1894 }
1895
1896 /* If CR is immediately followed by LF, end the line, ignoring the CR, and
1897 remember this case if this is the first line ending. */
1898
1899 if (ch == '\r')
1900 {
1901 ch = (receive_getc)(GETC_BUFFER_UNLIMITED);
1902 if (ch == '\n')
1903 {
1904 if (first_line_ended_crlf == TRUE_UNSET) first_line_ended_crlf = TRUE;
1905 goto EOL;
1906 }
1907
1908 /* Otherwise, put back the character after CR, and turn the bare CR
1909 into LF SP. */
1910
1911 ch = (receive_ungetc)(ch);
1912 next->text[ptr++] = '\n';
1913 message_size++;
1914 ch = ' ';
1915 }
1916
1917 /* We have a data character for the header line. */
1918
1919 next->text[ptr++] = ch; /* Add to buffer */
1920 message_size++; /* Total message size so far */
1921
1922 /* Handle failure due to a humungously long header section. The >= allows
1923 for the terminating \n. Add what we have so far onto the headers list so
1924 that it gets reflected in any error message, and back up the just-read
1925 character. */
1926
1927 if (message_size >= header_maxsize)
1928 {
1929 next->text[ptr] = 0;
1930 next->slen = ptr;
1931 next->type = htype_other;
1932 next->next = NULL;
1933 header_last->next = next;
1934 header_last = next;
1935
1936 log_write(0, LOG_MAIN, "ridiculously long message header received from "
1937 "%s (more than %d characters): message abandoned",
1938 f.sender_host_unknown ? sender_ident : sender_fullhost, header_maxsize);
1939
1940 if (smtp_input)
1941 {
1942 smtp_reply = US"552 Message header is ridiculously long";
1943 receive_swallow_smtp();
1944 goto TIDYUP; /* Skip to end of function */
1945 }
1946
1947 else
1948 {
1949 give_local_error(ERRMESS_VLONGHEADER,
1950 string_sprintf("message header longer than %d characters received: "
1951 "message not accepted", header_maxsize), US"", error_rc, stdin,
1952 header_list->next);
1953 /* Does not return */
1954 }
1955 }
1956
1957 continue; /* With next input character */
1958
1959 /* End of header line reached */
1960
1961 EOL:
1962
1963 /* Keep track of lines for BSMTP errors and overall message_linecount. */
1964
1965 receive_linecount++;
1966 message_linecount++;
1967
1968 /* Keep track of maximum line length */
1969
1970 if (ptr - prevlines_length > max_received_linelength)
1971 max_received_linelength = ptr - prevlines_length;
1972 prevlines_length = ptr + 1;
1973
1974 /* Now put in the terminating newline. There is always space for
1975 at least two more characters. */
1976
1977 next->text[ptr++] = '\n';
1978 message_size++;
1979
1980 /* A blank line signals the end of the headers; release the unwanted
1981 space and set next to NULL to indicate this. */
1982
1983 if (ptr == 1)
1984 {
1985 store_reset(next);
1986 next = NULL;
1987 break;
1988 }
1989
1990 /* There is data in the line; see if the next input character is a
1991 whitespace character. If it is, we have a continuation of this header line.
1992 There is always space for at least one character at this point. */
1993
1994 if (ch != EOF)
1995 {
1996 int nextch = (receive_getc)(GETC_BUFFER_UNLIMITED);
1997 if (nextch == ' ' || nextch == '\t')
1998 {
1999 next->text[ptr++] = nextch;
2000 message_size++;
2001 continue; /* Iterate the loop */
2002 }
2003 else if (nextch != EOF) (receive_ungetc)(nextch); /* For next time */
2004 else ch = EOF; /* Cause main loop to exit at end */
2005 }
2006
2007 /* We have got to the real line end. Terminate the string and release store
2008 beyond it. If it turns out to be a real header, internal binary zeros will
2009 be squashed later. */
2010
2011 next->text[ptr] = 0;
2012 next->slen = ptr;
2013 store_reset(next->text + ptr + 1);
2014
2015 /* Check the running total size against the overall message size limit. We
2016 don't expect to fail here, but if the overall limit is set less than MESSAGE_
2017 MAXSIZE and a big header is sent, we want to catch it. Just stop reading
2018 headers - the code to read the body will then also hit the buffer. */
2019
2020 if (message_size > thismessage_size_limit) break;
2021
2022 /* A line that is not syntactically correct for a header also marks
2023 the end of the headers. In this case, we leave next containing the
2024 first data line. This might actually be several lines because of the
2025 continuation logic applied above, but that doesn't matter.
2026
2027 It turns out that smail, and presumably sendmail, accept leading lines
2028 of the form
2029
2030 From ph10 Fri Jan 5 12:35 GMT 1996
2031
2032 in messages. The "mail" command on Solaris 2 sends such lines. I cannot
2033 find any documentation of this, but for compatibility it had better be
2034 accepted. Exim restricts it to the case of non-smtp messages, and
2035 treats it as an alternative to the -f command line option. Thus it is
2036 ignored except for trusted users or filter testing. Otherwise it is taken
2037 as the sender address, unless -f was used (sendmail compatibility).
2038
2039 It further turns out that some UUCPs generate the From_line in a different
2040 format, e.g.
2041
2042 From ph10 Fri, 7 Jan 97 14:00:00 GMT
2043
2044 The regex for matching these things is now capable of recognizing both
2045 formats (including 2- and 4-digit years in the latter). In fact, the regex
2046 is now configurable, as is the expansion string to fish out the sender.
2047
2048 Even further on it has been discovered that some broken clients send
2049 these lines in SMTP messages. There is now an option to ignore them from
2050 specified hosts or networks. Sigh. */
2051
2052 if ( header_last == header_list
2053 && ( !smtp_input
2054 || ( sender_host_address
2055 && verify_check_host(&ignore_fromline_hosts) == OK
2056 )
2057 || (!sender_host_address && ignore_fromline_local)
2058 )
2059 && regex_match_and_setup(regex_From, next->text, 0, -1)
2060 )
2061 {
2062 if (!f.sender_address_forced)
2063 {
2064 uschar *uucp_sender = expand_string(uucp_from_sender);
2065 if (!uucp_sender)
2066 log_write(0, LOG_MAIN|LOG_PANIC,
2067 "expansion of \"%s\" failed after matching "
2068 "\"From \" line: %s", uucp_from_sender, expand_string_message);
2069 else
2070 {
2071 int start, end, domain;
2072 uschar *errmess;
2073 uschar *newsender = parse_extract_address(uucp_sender, &errmess,
2074 &start, &end, &domain, TRUE);
2075 if (newsender)
2076 {
2077 if (domain == 0 && newsender[0] != 0)
2078 newsender = rewrite_address_qualify(newsender, FALSE);
2079
2080 if (filter_test != FTEST_NONE || receive_check_set_sender(newsender))
2081 {
2082 sender_address = newsender;
2083
2084 if (f.trusted_caller || filter_test != FTEST_NONE)
2085 {
2086 authenticated_sender = NULL;
2087 originator_name = US"";
2088 f.sender_local = FALSE;
2089 }
2090
2091 if (filter_test != FTEST_NONE)
2092 printf("Sender taken from \"From \" line\n");
2093 }
2094 }
2095 }
2096 }
2097 }
2098
2099 /* Not a leading "From " line. Check to see if it is a valid header line.
2100 Header names may contain any non-control characters except space and colon,
2101 amazingly. */
2102
2103 else
2104 {
2105 uschar *p = next->text;
2106
2107 /* If not a valid header line, break from the header reading loop, leaving
2108 next != NULL, indicating that it holds the first line of the body. */
2109
2110 if (isspace(*p)) break;
2111 while (mac_isgraph(*p) && *p != ':') p++;
2112 while (isspace(*p)) p++;
2113 if (*p != ':')
2114 {
2115 body_zerocount = had_zero;
2116 break;
2117 }
2118
2119 /* We have a valid header line. If there were any binary zeroes in
2120 the line, stomp on them here. */
2121
2122 if (had_zero > 0)
2123 for (p = next->text; p < next->text + ptr; p++) if (*p == 0) *p = '?';
2124
2125 /* It is perfectly legal to have an empty continuation line
2126 at the end of a header, but it is confusing to humans
2127 looking at such messages, since it looks like a blank line.
2128 Reduce confusion by removing redundant white space at the
2129 end. We know that there is at least one printing character
2130 (the ':' tested for above) so there is no danger of running
2131 off the end. */
2132
2133 p = next->text + ptr - 2;
2134 for (;;)
2135 {
2136 while (*p == ' ' || *p == '\t') p--;
2137 if (*p != '\n') break;
2138 ptr = (p--) - next->text + 1;
2139 message_size -= next->slen - ptr;
2140 next->text[ptr] = 0;
2141 next->slen = ptr;
2142 }
2143
2144 /* Add the header to the chain */
2145
2146 next->type = htype_other;
2147 next->next = NULL;
2148 header_last->next = next;
2149 header_last = next;
2150
2151 /* Check the limit for individual line lengths. This comes after adding to
2152 the chain so that the failing line is reflected if a bounce is generated
2153 (for a local message). */
2154
2155 if (header_line_maxsize > 0 && next->slen > header_line_maxsize)
2156 {
2157 log_write(0, LOG_MAIN, "overlong message header line received from "
2158 "%s (more than %d characters): message abandoned",
2159 f.sender_host_unknown ? sender_ident : sender_fullhost,
2160 header_line_maxsize);
2161
2162 if (smtp_input)
2163 {
2164 smtp_reply = US"552 A message header line is too long";
2165 receive_swallow_smtp();
2166 goto TIDYUP; /* Skip to end of function */
2167 }
2168
2169 else
2170 give_local_error(ERRMESS_VLONGHDRLINE,
2171 string_sprintf("message header line longer than %d characters "
2172 "received: message not accepted", header_line_maxsize), US"",
2173 error_rc, stdin, header_list->next);
2174 /* Does not return */
2175 }
2176
2177 /* Note if any resent- fields exist. */
2178
2179 if (!resents_exist && strncmpic(next->text, US"resent-", 7) == 0)
2180 {
2181 resents_exist = TRUE;
2182 resent_prefix = US"Resent-";
2183 }
2184 }
2185
2186 /* Reject CHUNKING messages that do not CRLF their first header line */
2187
2188 if (!first_line_ended_crlf && chunking_state > CHUNKING_OFFERED)
2189 {
2190 log_write(L_size_reject, LOG_MAIN|LOG_REJECT, "rejected from <%s>%s%s%s%s: "
2191 "Non-CRLF-terminated header, under CHUNKING: message abandoned",
2192 sender_address,
2193 sender_fullhost ? " H=" : "", sender_fullhost ? sender_fullhost : US"",
2194 sender_ident ? " U=" : "", sender_ident ? sender_ident : US"");
2195 smtp_printf("552 Message header not CRLF terminated\r\n", FALSE);
2196 bdat_flush_data();
2197 smtp_reply = US"";
2198 goto TIDYUP; /* Skip to end of function */
2199 }
2200
2201 /* The line has been handled. If we have hit EOF, break out of the loop,
2202 indicating no pending data line. */
2203
2204 if (ch == EOF) { next = NULL; break; }
2205
2206 /* Set up for the next header */
2207
2208 header_size = 256;
2209 next = store_get(sizeof(header_line));
2210 next->text = store_get(header_size);
2211 ptr = 0;
2212 had_zero = 0;
2213 prevlines_length = 0;
2214 } /* Continue, starting to read the next header */
2215
2216 /* At this point, we have read all the headers into a data structure in main
2217 store. The first header is still the dummy placeholder for the Received: header
2218 we are going to generate a bit later on. If next != NULL, it contains the first
2219 data line - which terminated the headers before reaching a blank line (not the
2220 normal case). */
2221
2222 DEBUG(D_receive)
2223 {
2224 debug_printf(">>Headers received:\n");
2225 for (h = header_list->next; h; h = h->next)
2226 debug_printf("%s", h->text);
2227 debug_printf("\n");
2228 }
2229
2230 /* End of file on any SMTP connection is an error. If an incoming SMTP call
2231 is dropped immediately after valid headers, the next thing we will see is EOF.
2232 We must test for this specially, as further down the reading of the data is
2233 skipped if already at EOF. */
2234
2235 if (smtp_input && (receive_feof)())
2236 {
2237 smtp_reply = handle_lost_connection(US" (after header)");
2238 smtp_yield = FALSE;
2239 goto TIDYUP; /* Skip to end of function */
2240 }
2241
2242 /* If this is a filter test run and no headers were read, output a warning
2243 in case there is a mistake in the test message. */
2244
2245 if (filter_test != FTEST_NONE && header_list->next == NULL)
2246 printf("Warning: no message headers read\n");
2247
2248
2249 /* Scan the headers to identify them. Some are merely marked for later
2250 processing; some are dealt with here. */
2251
2252 for (h = header_list->next; h; h = h->next)
2253 {
2254 BOOL is_resent = strncmpic(h->text, US"resent-", 7) == 0;
2255 if (is_resent) contains_resent_headers = TRUE;
2256
2257 switch (header_checkname(h, is_resent))
2258 {
2259 case htype_bcc:
2260 h->type = htype_bcc; /* Both Bcc: and Resent-Bcc: */
2261 break;
2262
2263 case htype_cc:
2264 h->type = htype_cc; /* Both Cc: and Resent-Cc: */
2265 break;
2266
2267 /* Record whether a Date: or Resent-Date: header exists, as appropriate. */
2268
2269 case htype_date:
2270 if (!resents_exist || is_resent) date_header_exists = TRUE;
2271 break;
2272
2273 /* Same comments as about Return-Path: below. */
2274
2275 case htype_delivery_date:
2276 if (delivery_date_remove) h->type = htype_old;
2277 break;
2278
2279 /* Same comments as about Return-Path: below. */
2280
2281 case htype_envelope_to:
2282 if (envelope_to_remove) h->type = htype_old;
2283 break;
2284
2285 /* Mark all "From:" headers so they get rewritten. Save the one that is to
2286 be used for Sender: checking. For Sendmail compatibility, if the "From:"
2287 header consists of just the login id of the user who called Exim, rewrite
2288 it with the gecos field first. Apply this rule to Resent-From: if there
2289 are resent- fields. */
2290
2291 case htype_from:
2292 h->type = htype_from;
2293 if (!resents_exist || is_resent)
2294 {
2295 from_header = h;
2296 if (!smtp_input)
2297 {
2298 int len;
2299 uschar *s = Ustrchr(h->text, ':') + 1;
2300 while (isspace(*s)) s++;
2301 len = h->slen - (s - h->text) - 1;
2302 if (Ustrlen(originator_login) == len &&
2303 strncmpic(s, originator_login, len) == 0)
2304 {
2305 uschar *name = is_resent? US"Resent-From" : US"From";
2306 header_add(htype_from, "%s: %s <%s@%s>\n", name, originator_name,
2307 originator_login, qualify_domain_sender);
2308 from_header = header_last;
2309 h->type = htype_old;
2310 DEBUG(D_receive|D_rewrite)
2311 debug_printf("rewrote \"%s:\" header using gecos\n", name);
2312 }
2313 }
2314 }
2315 break;
2316
2317 /* Identify the Message-id: header for generating "in-reply-to" in the
2318 autoreply transport. For incoming logging, save any resent- value. In both
2319 cases, take just the first of any multiples. */
2320
2321 case htype_id:
2322 if (!msgid_header && (!resents_exist || is_resent))
2323 {
2324 msgid_header = h;
2325 h->type = htype_id;
2326 }
2327 break;
2328
2329 /* Flag all Received: headers */
2330
2331 case htype_received:
2332 h->type = htype_received;
2333 received_count++;
2334 break;
2335
2336 /* "Reply-to:" is just noted (there is no resent-reply-to field) */
2337
2338 case htype_reply_to:
2339 h->type = htype_reply_to;
2340 break;
2341
2342 /* The Return-path: header is supposed to be added to messages when
2343 they leave the SMTP system. We shouldn't receive messages that already
2344 contain Return-path. However, since Exim generates Return-path: on
2345 local delivery, resent messages may well contain it. We therefore
2346 provide an option (which defaults on) to remove any Return-path: headers
2347 on input. Removal actually means flagging as "old", which prevents the
2348 header being transmitted with the message. */
2349
2350 case htype_return_path:
2351 if (return_path_remove) h->type = htype_old;
2352
2353 /* If we are testing a mail filter file, use the value of the
2354 Return-Path: header to set up the return_path variable, which is not
2355 otherwise set. However, remove any <> that surround the address
2356 because the variable doesn't have these. */
2357
2358 if (filter_test != FTEST_NONE)
2359 {
2360 uschar *start = h->text + 12;
2361 uschar *end = start + Ustrlen(start);
2362 while (isspace(*start)) start++;
2363 while (end > start && isspace(end[-1])) end--;
2364 if (*start == '<' && end[-1] == '>')
2365 {
2366 start++;
2367 end--;
2368 }
2369 return_path = string_copyn(start, end - start);
2370 printf("Return-path taken from \"Return-path:\" header line\n");
2371 }
2372 break;
2373
2374 /* If there is a "Sender:" header and the message is locally originated,
2375 and from an untrusted caller and suppress_local_fixups is not set, or if we
2376 are in submission mode for a remote message, mark it "old" so that it will
2377 not be transmitted with the message, unless active_local_sender_retain is
2378 set. (This can only be true if active_local_from_check is false.) If there
2379 are any resent- headers in the message, apply this rule to Resent-Sender:
2380 instead of Sender:. Messages with multiple resent- header sets cannot be
2381 tidily handled. (For this reason, at least one MUA - Pine - turns old
2382 resent- headers into X-resent- headers when resending, leaving just one
2383 set.) */
2384
2385 case htype_sender:
2386 h->type = !f.active_local_sender_retain
2387 && ( f.sender_local && !f.trusted_caller && !f.suppress_local_fixups
2388 || f.submission_mode
2389 )
2390 && (!resents_exist || is_resent)
2391 ? htype_old : htype_sender;
2392 break;
2393
2394 /* Remember the Subject: header for logging. There is no Resent-Subject */
2395
2396 case htype_subject:
2397 subject_header = h;
2398 break;
2399
2400 /* "To:" gets flagged, and the existence of a recipient header is noted,
2401 whether it's resent- or not. */
2402
2403 case htype_to:
2404 h->type = htype_to;
2405 /****
2406 to_or_cc_header_exists = TRUE;
2407 ****/
2408 break;
2409 }
2410 }
2411
2412 /* Extract recipients from the headers if that is required (the -t option).
2413 Note that this is documented as being done *before* any address rewriting takes
2414 place. There are two possibilities:
2415
2416 (1) According to sendmail documentation for Solaris, IRIX, and HP-UX, any
2417 recipients already listed are to be REMOVED from the message. Smail 3 works
2418 like this. We need to build a non-recipients tree for that list, because in
2419 subsequent processing this data is held in a tree and that's what the
2420 spool_write_header() function expects. Make sure that non-recipient addresses
2421 are fully qualified and rewritten if necessary.
2422
2423 (2) According to other sendmail documentation, -t ADDS extracted recipients to
2424 those in the command line arguments (and it is rumoured some other MTAs do
2425 this). Therefore, there is an option to make Exim behave this way.
2426
2427 *** Notes on "Resent-" header lines ***
2428
2429 The presence of resent-headers in the message makes -t horribly ambiguous.
2430 Experiments with sendmail showed that it uses recipients for all resent-
2431 headers, totally ignoring the concept of "sets of resent- headers" as described
2432 in RFC 2822 section 3.6.6. Sendmail also amalgamates them into a single set
2433 with all the addresses in one instance of each header.
2434
2435 This seems to me not to be at all sensible. Before release 4.20, Exim 4 gave an
2436 error for -t if there were resent- headers in the message. However, after a
2437 discussion on the mailing list, I've learned that there are MUAs that use
2438 resent- headers with -t, and also that the stuff about sets of resent- headers
2439 and their ordering in RFC 2822 is generally ignored. An MUA that submits a
2440 message with -t and resent- header lines makes sure that only *its* resent-
2441 headers are present; previous ones are often renamed as X-resent- for example.
2442
2443 Consequently, Exim has been changed so that, if any resent- header lines are
2444 present, the recipients are taken from all of the appropriate resent- lines,
2445 and not from the ordinary To:, Cc:, etc. */
2446
2447 if (extract_recip)
2448 {
2449 int rcount = 0;
2450 error_block **bnext = &bad_addresses;
2451
2452 if (extract_addresses_remove_arguments)
2453 {
2454 while (recipients_count-- > 0)
2455 {
2456 uschar *s = rewrite_address(recipients_list[recipients_count].address,
2457 TRUE, TRUE, global_rewrite_rules, rewrite_existflags);
2458 tree_add_nonrecipient(s);
2459 }
2460 recipients_list = NULL;
2461 recipients_count = recipients_list_max = 0;
2462 }
2463
2464 /* Now scan the headers */
2465
2466 for (h = header_list->next; h; h = h->next)
2467 {
2468 if ((h->type == htype_to || h->type == htype_cc || h->type == htype_bcc) &&
2469 (!contains_resent_headers || strncmpic(h->text, US"resent-", 7) == 0))
2470 {
2471 uschar *s = Ustrchr(h->text, ':') + 1;
2472 while (isspace(*s)) s++;
2473
2474 f.parse_allow_group = TRUE; /* Allow address group syntax */
2475
2476 while (*s != 0)
2477 {
2478 uschar *ss = parse_find_address_end(s, FALSE);
2479 uschar *recipient, *errmess, *p, *pp;
2480 int start, end, domain;
2481
2482 /* Check on maximum */
2483
2484 if (recipients_max > 0 && ++rcount > recipients_max)
2485 give_local_error(ERRMESS_TOOMANYRECIP, US"too many recipients",
2486 US"message rejected: ", error_rc, stdin, NULL);
2487 /* Does not return */
2488
2489 /* Make a copy of the address, and remove any internal newlines. These
2490 may be present as a result of continuations of the header line. The
2491 white space that follows the newline must not be removed - it is part
2492 of the header. */
2493
2494 pp = recipient = store_get(ss - s + 1);
2495 for (p = s; p < ss; p++) if (*p != '\n') *pp++ = *p;
2496 *pp = 0;
2497
2498 #ifdef SUPPORT_I18N
2499 {
2500 BOOL b = allow_utf8_domains;
2501 allow_utf8_domains = TRUE;
2502 #endif
2503 recipient = parse_extract_address(recipient, &errmess, &start, &end,
2504 &domain, FALSE);
2505
2506 #ifdef SUPPORT_I18N
2507 if (string_is_utf8(recipient))
2508 message_smtputf8 = TRUE;
2509 else
2510 allow_utf8_domains = b;
2511 }
2512 #endif
2513
2514 /* Keep a list of all the bad addresses so we can send a single
2515 error message at the end. However, an empty address is not an error;
2516 just ignore it. This can come from an empty group list like
2517
2518 To: Recipients of list:;
2519
2520 If there are no recipients at all, an error will occur later. */
2521
2522 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
2523 {
2524 int len = Ustrlen(s);
2525 error_block *b = store_get(sizeof(error_block));
2526 while (len > 0 && isspace(s[len-1])) len--;
2527 b->next = NULL;
2528 b->text1 = string_printing(string_copyn(s, len));
2529 b->text2 = errmess;
2530 *bnext = b;
2531 bnext = &(b->next);
2532 }
2533
2534 /* If the recipient is already in the nonrecipients tree, it must
2535 have appeared on the command line with the option extract_addresses_
2536 remove_arguments set. Do not add it to the recipients, and keep a note
2537 that this has happened, in order to give a better error if there are
2538 no recipients left. */
2539
2540 else if (recipient != NULL)
2541 {
2542 if (tree_search(tree_nonrecipients, recipient) == NULL)
2543 receive_add_recipient(recipient, -1);
2544 else
2545 extracted_ignored = TRUE;
2546 }
2547
2548 /* Move on past this address */
2549
2550 s = ss + (*ss? 1:0);
2551 while (isspace(*s)) s++;
2552 } /* Next address */
2553
2554 f.parse_allow_group = FALSE; /* Reset group syntax flags */
2555 f.parse_found_group = FALSE;
2556
2557 /* If this was the bcc: header, mark it "old", which means it
2558 will be kept on the spool, but not transmitted as part of the
2559 message. */
2560
2561 if (h->type == htype_bcc) h->type = htype_old;
2562 } /* For appropriate header line */
2563 } /* For each header line */
2564
2565 }
2566
2567 /* Now build the unique message id. This has changed several times over the
2568 lifetime of Exim. This description was rewritten for Exim 4.14 (February 2003).
2569 Retaining all the history in the comment has become too unwieldy - read
2570 previous release sources if you want it.
2571
2572 The message ID has 3 parts: tttttt-pppppp-ss. Each part is a number in base 62.
2573 The first part is the current time, in seconds. The second part is the current
2574 pid. Both are large enough to hold 32-bit numbers in base 62. The third part
2575 can hold a number in the range 0-3843. It used to be a computed sequence
2576 number, but is now the fractional component of the current time in units of
2577 1/2000 of a second (i.e. a value in the range 0-1999). After a message has been
2578 received, Exim ensures that the timer has ticked at the appropriate level
2579 before proceeding, to avoid duplication if the pid happened to be re-used
2580 within the same time period. It seems likely that most messages will take at
2581 least half a millisecond to be received, so no delay will normally be
2582 necessary. At least for some time...
2583
2584 There is a modification when localhost_number is set. Formerly this was allowed
2585 to be as large as 255. Now it is restricted to the range 0-16, and the final
2586 component of the message id becomes (localhost_number * 200) + fractional time
2587 in units of 1/200 of a second (i.e. a value in the range 0-3399).
2588
2589 Some not-really-Unix operating systems use case-insensitive file names (Darwin,
2590 Cygwin). For these, we have to use base 36 instead of base 62. Luckily, this
2591 still allows the tttttt field to hold a large enough number to last for some
2592 more decades, and the final two-digit field can hold numbers up to 1295, which
2593 is enough for milliseconds (instead of 1/2000 of a second).
2594
2595 However, the pppppp field cannot hold a 32-bit pid, but it can hold a 31-bit
2596 pid, so it is probably safe because pids have to be positive. The
2597 localhost_number is restricted to 0-10 for these hosts, and when it is set, the
2598 final field becomes (localhost_number * 100) + fractional time in centiseconds.
2599
2600 Note that string_base62() returns its data in a static storage block, so it
2601 must be copied before calling string_base62() again. It always returns exactly
2602 6 characters.
2603
2604 There doesn't seem to be anything in the RFC which requires a message id to
2605 start with a letter, but Smail was changed to ensure this. The external form of
2606 the message id (as supplied by string expansion) therefore starts with an
2607 additional leading 'E'. The spool file names do not include this leading
2608 letter and it is not used internally.
2609
2610 NOTE: If ever the format of message ids is changed, the regular expression for
2611 checking that a string is in this format must be updated in a corresponding
2612 way. It appears in the initializing code in exim.c. The macro MESSAGE_ID_LENGTH
2613 must also be changed to reflect the correct string length. The queue-sort code
2614 needs to know the layout. Then, of course, other programs that rely on the
2615 message id format will need updating too. */
2616
2617 Ustrncpy(message_id, string_base62((long int)(message_id_tv.tv_sec)), 6);
2618 message_id[6] = '-';
2619 Ustrncpy(message_id + 7, string_base62((long int)getpid()), 6);
2620
2621 /* Deal with the case where the host number is set. The value of the number was
2622 checked when it was read, to ensure it isn't too big. The timing granularity is
2623 left in id_resolution so that an appropriate wait can be done after receiving
2624 the message, if necessary (we hope it won't be). */
2625
2626 if (host_number_string)
2627 {
2628 id_resolution = BASE_62 == 62 ? 5000 : 10000;
2629 sprintf(CS(message_id + MESSAGE_ID_LENGTH - 3), "-%2s",
2630 string_base62((long int)(
2631 host_number * (1000000/id_resolution) +
2632 message_id_tv.tv_usec/id_resolution)) + 4);
2633 }
2634
2635 /* Host number not set: final field is just the fractional time at an
2636 appropriate resolution. */
2637
2638 else
2639 {
2640 id_resolution = BASE_62 == 62 ? 500 : 1000;
2641 sprintf(CS(message_id + MESSAGE_ID_LENGTH - 3), "-%2s",
2642 string_base62((long int)(message_id_tv.tv_usec/id_resolution)) + 4);
2643 }
2644
2645 /* Add the current message id onto the current process info string if
2646 it will fit. */
2647
2648 (void)string_format(process_info + process_info_len,
2649 PROCESS_INFO_SIZE - process_info_len, " id=%s", message_id);
2650
2651 /* If we are using multiple input directories, set up the one for this message
2652 to be the least significant base-62 digit of the time of arrival. Otherwise
2653 ensure that it is an empty string. */
2654
2655 message_subdir[0] = split_spool_directory ? message_id[5] : 0;
2656
2657 /* Now that we have the message-id, if there is no message-id: header, generate
2658 one, but only for local (without suppress_local_fixups) or submission mode
2659 messages. This can be user-configured if required, but we had better flatten
2660 any illegal characters therein. */
2661
2662 if ( !msgid_header
2663 && ((!sender_host_address && !f.suppress_local_fixups) || f.submission_mode))
2664 {
2665 uschar *p;
2666 uschar *id_text = US"";
2667 uschar *id_domain = primary_hostname;
2668
2669 /* Permit only letters, digits, dots, and hyphens in the domain */
2670
2671 if (message_id_domain)
2672 {
2673 uschar *new_id_domain = expand_string(message_id_domain);
2674 if (!new_id_domain)
2675 {
2676 if (!f.expand_string_forcedfail)
2677 log_write(0, LOG_MAIN|LOG_PANIC,
2678 "expansion of \"%s\" (message_id_header_domain) "
2679 "failed: %s", message_id_domain, expand_string_message);
2680 }
2681 else if (*new_id_domain)
2682 {
2683 id_domain = new_id_domain;
2684 for (p = id_domain; *p; p++)
2685 if (!isalnum(*p) && *p != '.') *p = '-'; /* No need to test '-' ! */
2686 }
2687 }
2688
2689 /* Permit all characters except controls and RFC 2822 specials in the
2690 additional text part. */
2691
2692 if (message_id_text)
2693 {
2694 uschar *new_id_text = expand_string(message_id_text);
2695 if (!new_id_text)
2696 {
2697 if (!f.expand_string_forcedfail)
2698 log_write(0, LOG_MAIN|LOG_PANIC,
2699 "expansion of \"%s\" (message_id_header_text) "
2700 "failed: %s", message_id_text, expand_string_message);
2701 }
2702 else if (*new_id_text)
2703 {
2704 id_text = new_id_text;
2705 for (p = id_text; *p; p++) if (mac_iscntrl_or_special(*p)) *p = '-';
2706 }
2707 }
2708
2709 /* Add the header line
2710 * Resent-* headers are prepended, per RFC 5322 3.6.6. Non-Resent-* are
2711 * appended, to preserve classical expectations of header ordering. */
2712
2713 header_add_at_position(!resents_exist, NULL, FALSE, htype_id,
2714 "%sMessage-Id: <%s%s%s@%s>\n", resent_prefix, message_id_external,
2715 (*id_text == 0)? "" : ".", id_text, id_domain);
2716 }
2717
2718 /* If we are to log recipients, keep a copy of the raw ones before any possible
2719 rewriting. Must copy the count, because later ACLs and the local_scan()
2720 function may mess with the real recipients. */
2721
2722 if (LOGGING(received_recipients))
2723 {
2724 raw_recipients = store_get(recipients_count * sizeof(uschar *));
2725 for (i = 0; i < recipients_count; i++)
2726 raw_recipients[i] = string_copy(recipients_list[i].address);
2727 raw_recipients_count = recipients_count;
2728 }
2729
2730 /* Ensure the recipients list is fully qualified and rewritten. Unqualified
2731 recipients will get here only if the conditions were right (allow_unqualified_
2732 recipient is TRUE). */
2733
2734 for (i = 0; i < recipients_count; i++)
2735 recipients_list[i].address =
2736 rewrite_address(recipients_list[i].address, TRUE, TRUE,
2737 global_rewrite_rules, rewrite_existflags);
2738
2739 /* If there is no From: header, generate one for local (without
2740 suppress_local_fixups) or submission_mode messages. If there is no sender
2741 address, but the sender is local or this is a local delivery error, use the
2742 originator login. This shouldn't happen for genuine bounces, but might happen
2743 for autoreplies. The addition of From: must be done *before* checking for the
2744 possible addition of a Sender: header, because untrusted_set_sender allows an
2745 untrusted user to set anything in the envelope (which might then get info
2746 From:) but we still want to ensure a valid Sender: if it is required. */
2747
2748 if ( !from_header
2749 && ((!sender_host_address && !f.suppress_local_fixups) || f.submission_mode))
2750 {
2751 uschar *oname = US"";
2752
2753 /* Use the originator_name if this is a locally submitted message and the
2754 caller is not trusted. For trusted callers, use it only if -F was used to
2755 force its value or if we have a non-SMTP message for which -f was not used
2756 to set the sender. */
2757
2758 if (!sender_host_address)
2759 {
2760 if (!f.trusted_caller || f.sender_name_forced ||
2761 (!smtp_input && !f.sender_address_forced))
2762 oname = originator_name;
2763 }
2764
2765 /* For non-locally submitted messages, the only time we use the originator
2766 name is when it was forced by the /name= option on control=submission. */
2767
2768 else if (submission_name) oname = submission_name;
2769
2770 /* Envelope sender is empty */
2771
2772 if (!*sender_address)
2773 {
2774 uschar *fromstart, *fromend;
2775
2776 fromstart = string_sprintf("%sFrom: %s%s",
2777 resent_prefix, oname, *oname ? " <" : "");
2778 fromend = *oname ? US">" : US"";
2779
2780 if (f.sender_local || f.local_error_message)
2781 header_add(htype_from, "%s%s@%s%s\n", fromstart,
2782 local_part_quote(originator_login), qualify_domain_sender,
2783 fromend);
2784
2785 else if (f.submission_mode && authenticated_id)
2786 {
2787 if (!submission_domain)
2788 header_add(htype_from, "%s%s@%s%s\n", fromstart,
2789 local_part_quote(authenticated_id), qualify_domain_sender,
2790 fromend);
2791
2792 else if (!*submission_domain) /* empty => whole address set */
2793 header_add(htype_from, "%s%s%s\n", fromstart, authenticated_id,
2794 fromend);
2795
2796 else
2797 header_add(htype_from, "%s%s@%s%s\n", fromstart,
2798 local_part_quote(authenticated_id), submission_domain, fromend);
2799
2800 from_header = header_last; /* To get it checked for Sender: */
2801 }
2802 }
2803
2804 /* There is a non-null envelope sender. Build the header using the original
2805 sender address, before any rewriting that might have been done while
2806 verifying it. */
2807
2808 else
2809 {
2810 header_add(htype_from, "%sFrom: %s%s%s%s\n", resent_prefix,
2811 oname,
2812 *oname ? " <" : "",
2813 sender_address_unrewritten ? sender_address_unrewritten : sender_address,
2814 *oname ? ">" : "");
2815
2816 from_header = header_last; /* To get it checked for Sender: */
2817 }
2818 }
2819
2820
2821 /* If the sender is local (without suppress_local_fixups), or if we are in
2822 submission mode and there is an authenticated_id, check that an existing From:
2823 is correct, and if not, generate a Sender: header, unless disabled. Any
2824 previously-existing Sender: header was removed above. Note that sender_local,
2825 as well as being TRUE if the caller of exim is not trusted, is also true if a
2826 trusted caller did not supply a -f argument for non-smtp input. To allow
2827 trusted callers to forge From: without supplying -f, we have to test explicitly
2828 here. If the From: header contains more than one address, then the call to
2829 parse_extract_address fails, and a Sender: header is inserted, as required. */
2830
2831 if ( from_header
2832 && ( f.active_local_from_check
2833 && ( f.sender_local && !f.trusted_caller && !f.suppress_local_fixups
2834 || f.submission_mode && authenticated_id
2835 ) ) )
2836 {
2837 BOOL make_sender = TRUE;
2838 int start, end, domain;
2839 uschar *errmess;
2840 uschar *from_address =
2841 parse_extract_address(Ustrchr(from_header->text, ':') + 1, &errmess,
2842 &start, &end, &domain, FALSE);
2843 uschar *generated_sender_address;
2844
2845 generated_sender_address = f.submission_mode
2846 ? !submission_domain
2847 ? string_sprintf("%s@%s",
2848 local_part_quote(authenticated_id), qualify_domain_sender)
2849 : !*submission_domain /* empty => full address */
2850 ? string_sprintf("%s", authenticated_id)
2851 : string_sprintf("%s@%s",
2852 local_part_quote(authenticated_id), submission_domain)
2853 : string_sprintf("%s@%s",
2854 local_part_quote(originator_login), qualify_domain_sender);
2855
2856 /* Remove permitted prefixes and suffixes from the local part of the From:
2857 address before doing the comparison with the generated sender. */
2858
2859 if (from_address)
2860 {
2861 int slen;
2862 uschar *at = domain ? from_address + domain - 1 : NULL;
2863
2864 if (at) *at = 0;
2865 from_address += route_check_prefix(from_address, local_from_prefix);
2866 slen = route_check_suffix(from_address, local_from_suffix);
2867 if (slen > 0)
2868 {
2869 memmove(from_address+slen, from_address, Ustrlen(from_address)-slen);
2870 from_address += slen;
2871 }
2872 if (at) *at = '@';
2873
2874 if ( strcmpic(generated_sender_address, from_address) == 0
2875 || (!domain && strcmpic(from_address, originator_login) == 0))
2876 make_sender = FALSE;
2877 }
2878
2879 /* We have to cause the Sender header to be rewritten if there are
2880 appropriate rewriting rules. */
2881
2882 if (make_sender)
2883 if (f.submission_mode && !submission_name)
2884 header_add(htype_sender, "%sSender: %s\n", resent_prefix,
2885 generated_sender_address);
2886 else
2887 header_add(htype_sender, "%sSender: %s <%s>\n",
2888 resent_prefix,
2889 f.submission_mode ? submission_name : originator_name,
2890 generated_sender_address);
2891
2892 /* Ensure that a non-null envelope sender address corresponds to the
2893 submission mode sender address. */
2894
2895 if (f.submission_mode && *sender_address)
2896 {
2897 if (!sender_address_unrewritten)
2898 sender_address_unrewritten = sender_address;
2899 sender_address = generated_sender_address;
2900 if (Ustrcmp(sender_address_unrewritten, generated_sender_address) != 0)
2901 log_write(L_address_rewrite, LOG_MAIN,
2902 "\"%s\" from env-from rewritten as \"%s\" by submission mode",
2903 sender_address_unrewritten, generated_sender_address);
2904 }
2905 }
2906
2907 /* If there are any rewriting rules, apply them to the sender address, unless
2908 it has already been rewritten as part of verification for SMTP input. */
2909
2910 if (global_rewrite_rules && !sender_address_unrewritten && *sender_address)
2911 {
2912 sender_address = rewrite_address(sender_address, FALSE, TRUE,
2913 global_rewrite_rules, rewrite_existflags);
2914 DEBUG(D_receive|D_rewrite)
2915 debug_printf("rewritten sender = %s\n", sender_address);
2916 }
2917
2918
2919 /* The headers must be run through rewrite_header(), because it ensures that
2920 addresses are fully qualified, as well as applying any rewriting rules that may
2921 exist.
2922
2923 Qualification of header addresses in a message from a remote host happens only
2924 if the host is in sender_unqualified_hosts or recipient_unqualified hosts, as
2925 appropriate. For local messages, qualification always happens, unless -bnq is
2926 used to explicitly suppress it. No rewriting is done for an unqualified address
2927 that is left untouched.
2928
2929 We start at the second header, skipping our own Received:. This rewriting is
2930 documented as happening *after* recipient addresses are taken from the headers
2931 by the -t command line option. An added Sender: gets rewritten here. */
2932
2933 for (h = header_list->next; h; h = h->next)
2934 {
2935 header_line *newh = rewrite_header(h, NULL, NULL, global_rewrite_rules,
2936 rewrite_existflags, TRUE);
2937 if (newh) h = newh;
2938 }
2939
2940
2941 /* An RFC 822 (sic) message is not legal unless it has at least one of "to",
2942 "cc", or "bcc". Note that although the minimal examples in RFC 822 show just
2943 "to" or "bcc", the full syntax spec allows "cc" as well. If any resent- header
2944 exists, this applies to the set of resent- headers rather than the normal set.
2945
2946 The requirement for a recipient header has been removed in RFC 2822. At this
2947 point in the code, earlier versions of Exim added a To: header for locally
2948 submitted messages, and an empty Bcc: header for others. In the light of the
2949 changes in RFC 2822, this was dropped in November 2003. */
2950
2951
2952 /* If there is no date header, generate one if the message originates locally
2953 (i.e. not over TCP/IP) and suppress_local_fixups is not set, or if the
2954 submission mode flag is set. Messages without Date: are not valid, but it seems
2955 to be more confusing if Exim adds one to all remotely-originated messages.
2956 As per Message-Id, we prepend if resending, else append.
2957 */
2958
2959 if ( !date_header_exists
2960 && ((!sender_host_address && !f.suppress_local_fixups) || f.submission_mode))
2961 header_add_at_position(!resents_exist, NULL, FALSE, htype_other,
2962 "%sDate: %s\n", resent_prefix, tod_stamp(tod_full));
2963
2964 search_tidyup(); /* Free any cached resources */
2965
2966 /* Show the complete set of headers if debugging. Note that the first one (the
2967 new Received:) has not yet been set. */
2968
2969 DEBUG(D_receive)
2970 {
2971 debug_printf(">>Headers after rewriting and local additions:\n");
2972 for (h = header_list->next; h; h = h->next)
2973 debug_printf("%c %s", h->type, h->text);
2974 debug_printf("\n");
2975 }
2976
2977 /* The headers are now complete in store. If we are running in filter
2978 testing mode, that is all this function does. Return TRUE if the message
2979 ended with a dot. */
2980
2981 if (filter_test != FTEST_NONE)
2982 {
2983 process_info[process_info_len] = 0;
2984 return message_ended == END_DOT;
2985 }
2986
2987 /*XXX CHUNKING: need to cancel cutthrough under BDAT, for now. In future,
2988 think more if it could be handled. Cannot do onward CHUNKING unless
2989 inbound is, but inbound chunking ought to be ok with outbound plain.
2990 Could we do onward CHUNKING given inbound CHUNKING?
2991 */
2992 if (chunking_state > CHUNKING_OFFERED)
2993 cancel_cutthrough_connection(FALSE, US"chunking active");
2994
2995 /* Cutthrough delivery:
2996 We have to create the Received header now rather than at the end of reception,
2997 so the timestamp behaviour is a change to the normal case.
2998 Having created it, send the headers to the destination. */
2999
3000 if (cutthrough.cctx.sock >= 0 && cutthrough.delivery)
3001 {
3002 if (received_count > received_headers_max)
3003 {
3004 cancel_cutthrough_connection(TRUE, US"too many headers");
3005 if (smtp_input) receive_swallow_smtp(); /* Swallow incoming SMTP */
3006 log_write(0, LOG_MAIN|LOG_REJECT, "rejected from <%s>%s%s%s%s: "
3007 "Too many \"Received\" headers",
3008 sender_address,
3009 sender_fullhost ? "H=" : "", sender_fullhost ? sender_fullhost : US"",
3010 sender_ident ? "U=" : "", sender_ident ? sender_ident : US"");
3011 message_id[0] = 0; /* Indicate no message accepted */
3012 smtp_reply = US"550 Too many \"Received\" headers - suspected mail loop";
3013 goto TIDYUP; /* Skip to end of function */
3014 }
3015 received_header_gen();
3016 add_acl_headers(ACL_WHERE_RCPT, US"MAIL or RCPT");
3017 (void) cutthrough_headers_send();
3018 }
3019
3020
3021 /* Open a new spool file for the data portion of the message. We need
3022 to access it both via a file descriptor and a stream. Try to make the
3023 directory if it isn't there. */
3024
3025 spool_name = spool_fname(US"input", message_subdir, message_id, US"-D");
3026 DEBUG(D_receive) debug_printf("Data file name: %s\n", spool_name);
3027
3028 if ((data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE)) < 0)
3029 {
3030 if (errno == ENOENT)
3031 {
3032 (void) directory_make(spool_directory,
3033 spool_sname(US"input", message_subdir),
3034 INPUT_DIRECTORY_MODE, TRUE);
3035 data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
3036 }
3037 if (data_fd < 0)
3038 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Failed to create spool file %s: %s",
3039 spool_name, strerror(errno));
3040 }
3041
3042 /* Make sure the file's group is the Exim gid, and double-check the mode
3043 because the group setting doesn't always get set automatically. */
3044
3045 if (fchown(data_fd, exim_uid, exim_gid))
3046 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
3047 "Failed setting ownership on spool file %s: %s",
3048 spool_name, strerror(errno));
3049 (void)fchmod(data_fd, SPOOL_MODE);
3050
3051 /* We now have data file open. Build a stream for it and lock it. We lock only
3052 the first line of the file (containing the message ID) because otherwise there
3053 are problems when Exim is run under Cygwin (I'm told). See comments in
3054 spool_in.c, where the same locking is done. */
3055
3056 spool_data_file = fdopen(data_fd, "w+");
3057 lock_data.l_type = F_WRLCK;
3058 lock_data.l_whence = SEEK_SET;
3059 lock_data.l_start = 0;
3060 lock_data.l_len = SPOOL_DATA_START_OFFSET;
3061
3062 if (fcntl(data_fd, F_SETLK, &lock_data) < 0)
3063 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Cannot lock %s (%d): %s", spool_name,
3064 errno, strerror(errno));
3065
3066 /* We have an open, locked data file. Write the message id to it to make it
3067 self-identifying. Then read the remainder of the input of this message and
3068 write it to the data file. If the variable next != NULL, it contains the first
3069 data line (which was read as a header but then turned out not to have the right
3070 format); write it (remembering that it might contain binary zeros). The result
3071 of fwrite() isn't inspected; instead we call ferror() below. */
3072
3073 fprintf(spool_data_file, "%s-D\n", message_id);
3074 if (next)
3075 {
3076 uschar *s = next->text;
3077 int len = next->slen;
3078 if (fwrite(s, 1, len, spool_data_file) == len) /* "if" for compiler quietening */
3079 body_linecount++; /* Assumes only 1 line */
3080 }
3081
3082 /* Note that we might already be at end of file, or the logical end of file
3083 (indicated by '.'), or might have encountered an error while writing the
3084 message id or "next" line. */
3085
3086 if (!ferror(spool_data_file) && !(receive_feof)() && message_ended != END_DOT)
3087 {
3088 if (smtp_input)
3089 {
3090 message_ended = chunking_state <= CHUNKING_OFFERED
3091 ? read_message_data_smtp(spool_data_file)
3092 : spool_wireformat
3093 ? read_message_bdat_smtp_wire(spool_data_file)
3094 : read_message_bdat_smtp(spool_data_file);
3095 receive_linecount++; /* The terminating "." line */
3096 }
3097 else
3098 message_ended = read_message_data(spool_data_file);
3099
3100 receive_linecount += body_linecount; /* For BSMTP errors mainly */
3101 message_linecount += body_linecount;
3102
3103 switch (message_ended)
3104 {
3105 /* Handle premature termination of SMTP */
3106
3107 case END_EOF:
3108 if (smtp_input)
3109 {
3110 Uunlink(spool_name); /* Lose data file when closed */
3111 cancel_cutthrough_connection(TRUE, US"sender closed connection");
3112 message_id[0] = 0; /* Indicate no message accepted */
3113 smtp_reply = handle_lost_connection(US"");
3114 smtp_yield = FALSE;
3115 goto TIDYUP; /* Skip to end of function */
3116 }
3117 break;
3118
3119 /* Handle message that is too big. Don't use host_or_ident() in the log
3120 message; we want to see the ident value even for non-remote messages. */
3121
3122 case END_SIZE:
3123 Uunlink(spool_name); /* Lose the data file when closed */
3124 cancel_cutthrough_connection(TRUE, US"mail too big");
3125 if (smtp_input) receive_swallow_smtp(); /* Swallow incoming SMTP */
3126
3127 log_write(L_size_reject, LOG_MAIN|LOG_REJECT, "rejected from <%s>%s%s%s%s: "
3128 "message too big: read=%d max=%d",
3129 sender_address,
3130 sender_fullhost ? " H=" : "",
3131 sender_fullhost ? sender_fullhost : US"",
3132 sender_ident ? " U=" : "",
3133 sender_ident ? sender_ident : US"",
3134 message_size,
3135 thismessage_size_limit);
3136
3137 if (smtp_input)
3138 {
3139 smtp_reply = US"552 Message size exceeds maximum permitted";
3140 message_id[0] = 0; /* Indicate no message accepted */
3141 goto TIDYUP; /* Skip to end of function */
3142 }
3143 else
3144 {
3145 fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
3146 give_local_error(ERRMESS_TOOBIG,
3147 string_sprintf("message too big (max=%d)", thismessage_size_limit),
3148 US"message rejected: ", error_rc, spool_data_file, header_list);
3149 /* Does not return */
3150 }
3151 break;
3152
3153 /* Handle bad BDAT protocol sequence */
3154
3155 case END_PROTOCOL:
3156 Uunlink(spool_name); /* Lose the data file when closed */
3157 cancel_cutthrough_connection(TRUE, US"sender protocol error");
3158 smtp_reply = US""; /* Response already sent */
3159 message_id[0] = 0; /* Indicate no message accepted */
3160 goto TIDYUP; /* Skip to end of function */
3161 }
3162 }
3163
3164 /* Restore the standard SIGALRM handler for any subsequent processing. (For
3165 example, there may be some expansion in an ACL that uses a timer.) */
3166
3167 os_non_restarting_signal(SIGALRM, sigalrm_handler);
3168
3169 /* The message body has now been read into the data file. Call fflush() to
3170 empty the buffers in C, and then call fsync() to get the data written out onto
3171 the disk, as fflush() doesn't do this (or at least, it isn't documented as
3172 having to do this). If there was an I/O error on either input or output,
3173 attempt to send an error message, and unlink the spool file. For non-SMTP input
3174 we can then give up. Note that for SMTP input we must swallow the remainder of
3175 the input in cases of output errors, since the far end doesn't expect to see
3176 anything until the terminating dot line is sent. */
3177
3178 if (fflush(spool_data_file) == EOF || ferror(spool_data_file) ||
3179 EXIMfsync(fileno(spool_data_file)) < 0 || (receive_ferror)())
3180 {
3181 uschar *msg_errno = US strerror(errno);
3182 BOOL input_error = (receive_ferror)() != 0;
3183 uschar *msg = string_sprintf("%s error (%s) while receiving message from %s",
3184 input_error? "Input read" : "Spool write",
3185 msg_errno,
3186 sender_fullhost ? sender_fullhost : sender_ident);
3187
3188 log_write(0, LOG_MAIN, "Message abandoned: %s", msg);
3189 Uunlink(spool_name); /* Lose the data file */
3190 cancel_cutthrough_connection(TRUE, US"error writing spoolfile");
3191
3192 if (smtp_input)
3193 {
3194 if (input_error)
3195 smtp_reply = US"451 Error while reading input data";
3196 else
3197 {
3198 smtp_reply = US"451 Error while writing spool file";
3199 receive_swallow_smtp();
3200 }
3201 message_id[0] = 0; /* Indicate no message accepted */
3202 goto TIDYUP; /* Skip to end of function */
3203 }
3204
3205 else
3206 {
3207 fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
3208 give_local_error(ERRMESS_IOERR, msg, US"", error_rc, spool_data_file,
3209 header_list);
3210 /* Does not return */
3211 }
3212 }
3213
3214
3215 /* No I/O errors were encountered while writing the data file. */
3216
3217 DEBUG(D_receive) debug_printf("Data file written for message %s\n", message_id);
3218 if (LOGGING(receive_time)) timesince(&received_time_taken, &received_time);
3219
3220
3221 /* If there were any bad addresses extracted by -t, or there were no recipients
3222 left after -t, send a message to the sender of this message, or write it to
3223 stderr if the error handling option is set that way. Note that there may
3224 legitimately be no recipients for an SMTP message if they have all been removed
3225 by "discard".
3226
3227 We need to rewind the data file in order to read it. In the case of no
3228 recipients or stderr error writing, throw the data file away afterwards, and
3229 exit. (This can't be SMTP, which always ensures there's at least one
3230 syntactically good recipient address.) */
3231
3232 if (extract_recip && (bad_addresses || recipients_count == 0))
3233 {
3234 DEBUG(D_receive)
3235 {
3236 if (recipients_count == 0) debug_printf("*** No recipients\n");
3237 if (bad_addresses)
3238 {
3239 error_block *eblock = bad_addresses;
3240 debug_printf("*** Bad address(es)\n");
3241 while (eblock != NULL)
3242 {
3243 debug_printf(" %s: %s\n", eblock->text1, eblock->text2);
3244 eblock = eblock->next;
3245 }
3246 }
3247 }
3248
3249 fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
3250
3251 /* If configured to send errors to the sender, but this fails, force
3252 a failure error code. We use a special one for no recipients so that it
3253 can be detected by the autoreply transport. Otherwise error_rc is set to
3254 errors_sender_rc, which is EXIT_FAILURE unless -oee was given, in which case
3255 it is EXIT_SUCCESS. */
3256
3257 if (error_handling == ERRORS_SENDER)
3258 {
3259 if (!moan_to_sender(
3260 (bad_addresses == NULL)?
3261 (extracted_ignored? ERRMESS_IGADDRESS : ERRMESS_NOADDRESS) :
3262 (recipients_list == NULL)? ERRMESS_BADNOADDRESS : ERRMESS_BADADDRESS,
3263 bad_addresses, header_list, spool_data_file, FALSE))
3264 error_rc = (bad_addresses == NULL)? EXIT_NORECIPIENTS : EXIT_FAILURE;
3265 }
3266 else
3267 {
3268 if (!bad_addresses)
3269 if (extracted_ignored)
3270 fprintf(stderr, "exim: all -t recipients overridden by command line\n");
3271 else
3272 fprintf(stderr, "exim: no recipients in message\n");
3273 else
3274 {
3275 fprintf(stderr, "exim: invalid address%s",
3276 bad_addresses->next ? "es:\n" : ":");
3277 for ( ; bad_addresses; bad_addresses = bad_addresses->next)
3278 fprintf(stderr, " %s: %s\n", bad_addresses->text1,
3279 bad_addresses->text2);
3280 }
3281 }
3282
3283 if (recipients_count == 0 || error_handling == ERRORS_STDERR)
3284 {
3285 Uunlink(spool_name);
3286 (void)fclose(spool_data_file);
3287 exim_exit(error_rc, US"receiving");
3288 }
3289 }
3290
3291 /* Data file successfully written. Generate text for the Received: header by
3292 expanding the configured string, and adding a timestamp. By leaving this
3293 operation till now, we ensure that the timestamp is the time that message
3294 reception was completed. However, this is deliberately done before calling the
3295 data ACL and local_scan().
3296
3297 This Received: header may therefore be inspected by the data ACL and by code in
3298 the local_scan() function. When they have run, we update the timestamp to be
3299 the final time of reception.
3300
3301 If there is just one recipient, set up its value in the $received_for variable
3302 for use when we generate the Received: header.
3303
3304 Note: the checking for too many Received: headers is handled by the delivery
3305 code. */
3306 /*XXX eventually add excess Received: check for cutthrough case back when classifying them */
3307
3308 if (!received_header->text) /* Non-cutthrough case */
3309 {
3310 received_header_gen();
3311
3312 /* Set the value of message_body_size for the DATA ACL and for local_scan() */
3313
3314 message_body_size = (fstat(data_fd, &statbuf) == 0)?
3315 statbuf.st_size - SPOOL_DATA_START_OFFSET : -1;
3316
3317 /* If an ACL from any RCPT commands set up any warning headers to add, do so
3318 now, before running the DATA ACL. */
3319
3320 add_acl_headers(ACL_WHERE_RCPT, US"MAIL or RCPT");
3321 }
3322 else
3323 message_body_size = (fstat(data_fd, &statbuf) == 0)?
3324 statbuf.st_size - SPOOL_DATA_START_OFFSET : -1;
3325
3326 /* If an ACL is specified for checking things at this stage of reception of a
3327 message, run it, unless all the recipients were removed by "discard" in earlier
3328 ACLs. That is the only case in which recipients_count can be zero at this
3329 stage. Set deliver_datafile to point to the data file so that $message_body and
3330 $message_body_end can be extracted if needed. Allow $recipients in expansions.
3331 */
3332
3333 deliver_datafile = data_fd;
3334 user_msg = NULL;
3335
3336 f.enable_dollar_recipients = TRUE;
3337
3338 if (recipients_count == 0)
3339 blackholed_by = f.recipients_discarded ? US"MAIL ACL" : US"RCPT ACL";
3340
3341 else
3342 {
3343 /* Handle interactive SMTP messages */
3344
3345 if (smtp_input && !smtp_batched_input)
3346 {
3347
3348 #ifndef DISABLE_DKIM
3349 if (!f.dkim_disable_verify)
3350 {
3351 /* Finish verification */
3352 dkim_exim_verify_finish();
3353
3354 /* Check if we must run the DKIM ACL */
3355 if (acl_smtp_dkim && dkim_verify_signers && *dkim_verify_signers)
3356 {
3357 uschar * dkim_verify_signers_expanded =
3358 expand_string(dkim_verify_signers);
3359 gstring * results = NULL;
3360 int signer_sep = 0;
3361 const uschar * ptr;
3362 uschar * item;
3363 gstring * seen_items = NULL;
3364 int old_pool = store_pool;
3365
3366 store_pool = POOL_PERM; /* Allow created variables to live to data ACL */
3367
3368 if (!(ptr = dkim_verify_signers_expanded))
3369 log_write(0, LOG_MAIN|LOG_PANIC,
3370 "expansion of dkim_verify_signers option failed: %s",
3371 expand_string_message);
3372
3373 /* Default to OK when no items are present */
3374 rc = OK;
3375 while ((item = string_nextinlist(&ptr, &signer_sep, NULL, 0)))
3376 {
3377 /* Prevent running ACL for an empty item */
3378 if (!item || !*item) continue;
3379
3380 /* Only run ACL once for each domain or identity,
3381 no matter how often it appears in the expanded list. */
3382 if (seen_items)
3383 {
3384 uschar * seen_item;
3385 const uschar * seen_items_list = string_from_gstring(seen_items);
3386 int seen_sep = ':';
3387 BOOL seen_this_item = FALSE;
3388
3389 while ((seen_item = string_nextinlist(&seen_items_list, &seen_sep,
3390 NULL, 0)))
3391 if (Ustrcmp(seen_item,item) == 0)
3392 {
3393 seen_this_item = TRUE;
3394 break;
3395 }
3396
3397 if (seen_this_item)
3398 {
3399 DEBUG(D_receive)
3400 debug_printf("acl_smtp_dkim: skipping signer %s, "
3401 "already seen\n", item);
3402 continue;
3403 }
3404
3405 seen_items = string_catn(seen_items, US":", 1);
3406 }
3407 seen_items = string_cat(seen_items, item);
3408
3409 rc = dkim_exim_acl_run(item, &results, &user_msg, &log_msg);
3410 if (rc != OK)
3411 {
3412 DEBUG(D_receive)
3413 debug_printf("acl_smtp_dkim: acl_check returned %d on %s, "
3414 "skipping remaining items\n", rc, item);
3415 cancel_cutthrough_connection(TRUE, US"dkim acl not ok");
3416 break;
3417 }
3418 }
3419 dkim_verify_status = string_from_gstring(results);
3420 store_pool = old_pool;
3421 add_acl_headers(ACL_WHERE_DKIM, US"DKIM");
3422 if (rc == DISCARD)
3423 {
3424 recipients_count = 0;
3425 blackholed_by = US"DKIM ACL";
3426 if (log_msg)
3427 blackhole_log_msg = string_sprintf(": %s", log_msg);
3428 }
3429 else if (rc != OK)
3430 {
3431 Uunlink(spool_name);
3432 if (smtp_handle_acl_fail(ACL_WHERE_DKIM, rc, user_msg, log_msg) != 0)
3433 smtp_yield = FALSE; /* No more messages after dropped connection */
3434 smtp_reply = US""; /* Indicate reply already sent */
3435 message_id[0] = 0; /* Indicate no message accepted */
3436 goto TIDYUP; /* Skip to end of function */
3437 }
3438 }
3439 else
3440 dkim_exim_verify_log_all();
3441 }
3442 #endif /* DISABLE_DKIM */
3443
3444 #ifdef WITH_CONTENT_SCAN
3445 if ( recipients_count > 0
3446 && acl_smtp_mime
3447 && !run_mime_acl(acl_smtp_mime, &smtp_yield, &smtp_reply, &blackholed_by)
3448 )
3449 goto TIDYUP;
3450 #endif /* WITH_CONTENT_SCAN */
3451
3452 #ifdef EXPERIMENTAL_DMARC
3453 dmarc_up = dmarc_store_data(from_header);
3454 #endif /* EXPERIMENTAL_DMARC */
3455
3456 #ifndef DISABLE_PRDR
3457 if (prdr_requested && recipients_count > 1 && acl_smtp_data_prdr)
3458 {
3459 unsigned int c;
3460 int all_pass = OK;
3461 int all_fail = FAIL;
3462
3463 smtp_printf("353 PRDR content analysis beginning\r\n", TRUE);
3464 /* Loop through recipients, responses must be in same order received */
3465 for (c = 0; recipients_count > c; c++)
3466 {
3467 uschar * addr= recipients_list[c].address;
3468 uschar * msg= US"PRDR R=<%s> %s";
3469 uschar * code;
3470 DEBUG(D_receive)
3471 debug_printf("PRDR processing recipient %s (%d of %d)\n",
3472 addr, c+1, recipients_count);
3473 rc = acl_check(ACL_WHERE_PRDR, addr,
3474 acl_smtp_data_prdr, &user_msg, &log_msg);
3475
3476 /* If any recipient rejected content, indicate it in final message */
3477 all_pass |= rc;
3478 /* If all recipients rejected, indicate in final message */
3479 all_fail &= rc;
3480
3481 switch (rc)
3482 {
3483 case OK: case DISCARD: code = US"250"; break;
3484 case DEFER: code = US"450"; break;
3485 default: code = US"550"; break;
3486 }
3487 if (user_msg != NULL)
3488 smtp_user_msg(code, user_msg);
3489 else
3490 {
3491 switch (rc)
3492 {
3493 case OK: case DISCARD:
3494 msg = string_sprintf(CS msg, addr, "acceptance"); break;
3495 case DEFER:
3496 msg = string_sprintf(CS msg, addr, "temporary refusal"); break;
3497 default:
3498 msg = string_sprintf(CS msg, addr, "refusal"); break;
3499 }
3500 smtp_user_msg(code, msg);
3501 }
3502 if (log_msg) log_write(0, LOG_MAIN, "PRDR %s %s", addr, log_msg);
3503 else if (user_msg) log_write(0, LOG_MAIN, "PRDR %s %s", addr, user_msg);
3504 else log_write(0, LOG_MAIN, "%s", CS msg);
3505
3506 if (rc != OK) { receive_remove_recipient(addr); c--; }
3507 }
3508 /* Set up final message, used if data acl gives OK */
3509 smtp_reply = string_sprintf("%s id=%s message %s",
3510 all_fail == FAIL ? US"550" : US"250",
3511 message_id,
3512 all_fail == FAIL
3513 ? US"rejected for all recipients"
3514 : all_pass == OK
3515 ? US"accepted"
3516 : US"accepted for some recipients");
3517 if (recipients_count == 0)
3518 {
3519 message_id[0] = 0; /* Indicate no message accepted */
3520 goto TIDYUP;
3521 }
3522 }
3523 else
3524 prdr_requested = FALSE;
3525 #endif /* !DISABLE_PRDR */
3526
3527 /* Check the recipients count again, as the MIME ACL might have changed
3528 them. */
3529
3530 if (acl_smtp_data != NULL && recipients_count > 0)
3531 {
3532 rc = acl_check(ACL_WHERE_DATA, NULL, acl_smtp_data, &user_msg, &log_msg);
3533 add_acl_headers(ACL_WHERE_DATA, US"DATA");
3534 if (rc == DISCARD)
3535 {
3536 recipients_count = 0;
3537 blackholed_by = US"DATA ACL";
3538 if (log_msg)
3539 blackhole_log_msg = string_sprintf(": %s", log_msg);
3540 cancel_cutthrough_connection(TRUE, US"data acl discard");
3541 }
3542 else if (rc != OK)
3543 {
3544 Uunlink(spool_name);
3545 cancel_cutthrough_connection(TRUE, US"data acl not ok");
3546 #ifdef WITH_CONTENT_SCAN
3547 unspool_mbox();
3548 #endif
3549 #ifdef EXPERIMENTAL_DCC
3550 dcc_ok = 0;
3551 #endif
3552 if (smtp_handle_acl_fail(ACL_WHERE_DATA, rc, user_msg, log_msg) != 0)
3553 smtp_yield = FALSE; /* No more messages after dropped connection */
3554 smtp_reply = US""; /* Indicate reply already sent */
3555 message_id[0] = 0; /* Indicate no message accepted */
3556 goto TIDYUP; /* Skip to end of function */
3557 }
3558 }
3559 }
3560
3561 /* Handle non-SMTP and batch SMTP (i.e. non-interactive) messages. Note that
3562 we cannot take different actions for permanent and temporary rejections. */
3563
3564 else
3565 {
3566
3567 #ifdef WITH_CONTENT_SCAN
3568 if ( acl_not_smtp_mime
3569 && !run_mime_acl(acl_not_smtp_mime, &smtp_yield, &smtp_reply,
3570 &blackholed_by)
3571 )
3572 goto TIDYUP;
3573 #endif /* WITH_CONTENT_SCAN */
3574
3575 if (acl_not_smtp)
3576 {
3577 uschar *user_msg, *log_msg;
3578 f.authentication_local = TRUE;
3579 rc = acl_check(ACL_WHERE_NOTSMTP, NULL, acl_not_smtp, &user_msg, &log_msg);
3580 if (rc == DISCARD)
3581 {
3582 recipients_count = 0;
3583 blackholed_by = US"non-SMTP ACL";
3584 if (log_msg)
3585 blackhole_log_msg = string_sprintf(": %s", log_msg);
3586 }
3587 else if (rc != OK)
3588 {
3589 Uunlink(spool_name);
3590 #ifdef WITH_CONTENT_SCAN
3591 unspool_mbox();
3592 #endif
3593 #ifdef EXPERIMENTAL_DCC
3594 dcc_ok = 0;
3595 #endif
3596 /* The ACL can specify where rejections are to be logged, possibly
3597 nowhere. The default is main and reject logs. */
3598
3599 if (log_reject_target)
3600 log_write(0, log_reject_target, "F=<%s> rejected by non-SMTP ACL: %s",
3601 sender_address, log_msg);
3602
3603 if (!user_msg) user_msg = US"local configuration problem";
3604 if (smtp_batched_input)
3605 moan_smtp_batch(NULL, "%d %s", 550, user_msg);
3606 /* Does not return */
3607 else
3608 {
3609 fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
3610 give_local_error(ERRMESS_LOCAL_ACL, user_msg,
3611 US"message rejected by non-SMTP ACL: ", error_rc, spool_data_file,
3612 header_list);
3613 /* Does not return */
3614 }
3615 }
3616 add_acl_headers(ACL_WHERE_NOTSMTP, US"non-SMTP");
3617 }
3618 }
3619
3620 /* The applicable ACLs have been run */
3621
3622 if (f.deliver_freeze) frozen_by = US"ACL"; /* for later logging */
3623 if (f.queue_only_policy) queued_by = US"ACL";
3624 }
3625
3626 #ifdef WITH_CONTENT_SCAN
3627 unspool_mbox();
3628 #endif
3629
3630 #ifdef EXPERIMENTAL_DCC
3631 dcc_ok = 0;
3632 #endif
3633
3634
3635 #ifdef HAVE_LOCAL_SCAN
3636 /* The final check on the message is to run the scan_local() function. The
3637 version supplied with Exim always accepts, but this is a hook for sysadmins to
3638 supply their own checking code. The local_scan() function is run even when all
3639 the recipients have been discarded. */
3640
3641 lseek(data_fd, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
3642
3643 /* Arrange to catch crashes in local_scan(), so that the -D file gets
3644 deleted, and the incident gets logged. */
3645
3646 if (sigsetjmp(local_scan_env, 1) == 0)
3647 {
3648 had_local_scan_crash = 0;
3649 os_non_restarting_signal(SIGSEGV, local_scan_crash_handler);
3650 os_non_restarting_signal(SIGFPE, local_scan_crash_handler);
3651 os_non_restarting_signal(SIGILL, local_scan_crash_handler);
3652 os_non_restarting_signal(SIGBUS, local_scan_crash_handler);
3653
3654 DEBUG(D_receive) debug_printf("calling local_scan(); timeout=%d\n",
3655 local_scan_timeout);
3656 local_scan_data = NULL;
3657
3658 had_local_scan_timeout = 0;
3659 os_non_restarting_signal(SIGALRM, local_scan_timeout_handler);
3660 if (local_scan_timeout > 0) alarm(local_scan_timeout);
3661 rc = local_scan(data_fd, &local_scan_data);
3662 alarm(0);
3663 os_non_restarting_signal(SIGALRM, sigalrm_handler);
3664
3665 f.enable_dollar_recipients = FALSE;
3666
3667 store_pool = POOL_MAIN; /* In case changed */
3668 DEBUG(D_receive) debug_printf("local_scan() returned %d %s\n", rc,
3669 local_scan_data);
3670
3671 os_non_restarting_signal(SIGSEGV, SIG_DFL);
3672 os_non_restarting_signal(SIGFPE, SIG_DFL);
3673 os_non_restarting_signal(SIGILL, SIG_DFL);
3674 os_non_restarting_signal(SIGBUS, SIG_DFL);
3675 }
3676 else
3677 {
3678 if (had_local_scan_crash)
3679 {
3680 log_write(0, LOG_MAIN|LOG_REJECT, "local_scan() function crashed with "
3681 "signal %d - message temporarily rejected (size %d)",
3682 had_local_scan_crash, message_size);
3683 receive_bomb_out(US"local-scan-error", US"local verification problem");
3684 /* Does not return */
3685 }
3686 if (had_local_scan_timeout)
3687 {
3688 log_write(0, LOG_MAIN|LOG_REJECT, "local_scan() function timed out - "
3689 "message temporarily rejected (size %d)", message_size);
3690 receive_bomb_out(US"local-scan-timeout", US"local verification problem");
3691 /* Does not return */
3692 }
3693 }
3694
3695 /* The length check is paranoia against some runaway code, and also because
3696 (for a success return) lines in the spool file are read into big_buffer. */
3697
3698 if (local_scan_data)
3699 {
3700 int len = Ustrlen(local_scan_data);
3701 if (len > LOCAL_SCAN_MAX_RETURN) len = LOCAL_SCAN_MAX_RETURN;
3702 local_scan_data = string_copyn(local_scan_data, len);
3703 }
3704
3705 if (rc == LOCAL_SCAN_ACCEPT_FREEZE)
3706 {
3707 if (!f.deliver_freeze) /* ACL might have already frozen */
3708 {
3709 f.deliver_freeze = TRUE;
3710 deliver_frozen_at = time(NULL);
3711 frozen_by = US"local_scan()";
3712 }
3713 rc = LOCAL_SCAN_ACCEPT;
3714 }
3715 else if (rc == LOCAL_SCAN_ACCEPT_QUEUE)
3716 {
3717 if (!f.queue_only_policy) /* ACL might have already queued */
3718 {
3719 f.queue_only_policy = TRUE;
3720 queued_by = US"local_scan()";
3721 }
3722 rc = LOCAL_SCAN_ACCEPT;
3723 }
3724
3725 /* Message accepted: remove newlines in local_scan_data because otherwise
3726 the spool file gets corrupted. Ensure that all recipients are qualified. */
3727
3728 if (rc == LOCAL_SCAN_ACCEPT)
3729 {
3730 if (local_scan_data)
3731 {
3732 uschar *s;
3733 for (s = local_scan_data; *s != 0; s++) if (*s == '\n') *s = ' ';
3734 }
3735 for (i = 0; i < recipients_count; i++)
3736 {
3737 recipient_item *r = recipients_list + i;
3738 r->address = rewrite_address_qualify(r->address, TRUE);
3739 if (r->errors_to != NULL)
3740 r->errors_to = rewrite_address_qualify(r->errors_to, TRUE);
3741 }
3742 if (recipients_count == 0 && blackholed_by == NULL)
3743 blackholed_by = US"local_scan";
3744 }
3745
3746 /* Message rejected: newlines permitted in local_scan_data to generate
3747 multiline SMTP responses. */
3748
3749 else
3750 {
3751 uschar *istemp = US"";
3752 uschar *smtp_code;
3753 gstring * g;
3754
3755 errmsg = local_scan_data;
3756
3757 Uunlink(spool_name); /* Cancel this message */
3758 switch(rc)
3759 {
3760 default:
3761 log_write(0, LOG_MAIN, "invalid return %d from local_scan(). Temporary "
3762 "rejection given", rc);
3763 goto TEMPREJECT;
3764
3765 case LOCAL_SCAN_REJECT_NOLOGHDR:
3766 BIT_CLEAR(log_selector, log_selector_size, Li_rejected_header);
3767 /* Fall through */
3768
3769 case LOCAL_SCAN_REJECT:
3770 smtp_code = US"550";
3771 if (!errmsg) errmsg = US"Administrative prohibition";
3772 break;
3773
3774 case LOCAL_SCAN_TEMPREJECT_NOLOGHDR:
3775 BIT_CLEAR(log_selector, log_selector_size, Li_rejected_header);
3776 /* Fall through */
3777
3778 case LOCAL_SCAN_TEMPREJECT:
3779 TEMPREJECT:
3780 smtp_code = US"451";
3781 if (!errmsg) errmsg = US"Temporary local problem";
3782 istemp = US"temporarily ";
3783 break;
3784 }
3785
3786 g = string_append(NULL, 2, US"F=",
3787 sender_address[0] == 0 ? US"<>" : sender_address);
3788 g = add_host_info_for_log(g);
3789
3790 log_write(0, LOG_MAIN|LOG_REJECT, "%s %srejected by local_scan(): %.256s",
3791 string_from_gstring(g), istemp, string_printing(errmsg));
3792
3793 if (smtp_input)
3794 {
3795 if (!smtp_batched_input)
3796 {
3797 smtp_respond(smtp_code, 3, TRUE, errmsg);
3798 message_id[0] = 0; /* Indicate no message accepted */
3799 smtp_reply = US""; /* Indicate reply already sent */
3800 goto TIDYUP; /* Skip to end of function */
3801 }
3802 else
3803 moan_smtp_batch(NULL, "%s %s", smtp_code, errmsg);
3804 /* Does not return */
3805 }
3806 else
3807 {
3808 fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
3809 give_local_error(ERRMESS_LOCAL_SCAN, errmsg,
3810 US"message rejected by local scan code: ", error_rc, spool_data_file,
3811 header_list);
3812 /* Does not return */
3813 }
3814 }
3815
3816 /* Reset signal handlers to ignore signals that previously would have caused
3817 the message to be abandoned. */
3818
3819 signal(SIGTERM, SIG_IGN);
3820 signal(SIGINT, SIG_IGN);
3821 #endif /* HAVE_LOCAL_SCAN */
3822
3823
3824 /* Ensure the first time flag is set in the newly-received message. */
3825
3826 f.deliver_firsttime = TRUE;
3827
3828 #ifdef EXPERIMENTAL_BRIGHTMAIL
3829 if (bmi_run == 1)
3830 { /* rewind data file */
3831 lseek(data_fd, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
3832 bmi_verdicts = bmi_process_message(header_list, data_fd);
3833 }
3834 #endif
3835
3836 /* Update the timestamp in our Received: header to account for any time taken by
3837 an ACL or by local_scan(). The new time is the time that all reception
3838 processing is complete. */
3839
3840 timestamp = expand_string(US"${tod_full}");
3841 tslen = Ustrlen(timestamp);
3842
3843 memcpy(received_header->text + received_header->slen - tslen - 1,
3844 timestamp, tslen);
3845
3846 /* In MUA wrapper mode, ignore queueing actions set by ACL or local_scan() */
3847
3848 if (mua_wrapper)
3849 {
3850 f.deliver_freeze = FALSE;
3851 f.queue_only_policy = FALSE;
3852 }
3853
3854 /* Keep the data file open until we have written the header file, in order to
3855 hold onto the lock. In a -bh run, or if the message is to be blackholed, we
3856 don't write the header file, and we unlink the data file. If writing the header
3857 file fails, we have failed to accept this message. */
3858
3859 if (host_checking || blackholed_by)
3860 {
3861 header_line *h;
3862 Uunlink(spool_name);
3863 msg_size = 0; /* Compute size for log line */
3864 for (h = header_list; h; h = h->next)
3865 if (h->type != '*') msg_size += h->slen;
3866 }
3867
3868 /* Write the -H file */
3869
3870 else
3871 if ((msg_size = spool_write_header(message_id, SW_RECEIVING, &errmsg)) < 0)
3872 {
3873 log_write(0, LOG_MAIN, "Message abandoned: %s", errmsg);
3874 Uunlink(spool_name); /* Lose the data file */
3875
3876 if (smtp_input)
3877 {
3878 smtp_reply = US"451 Error in writing spool file";
3879 message_id[0] = 0; /* Indicate no message accepted */
3880 goto TIDYUP;
3881 }
3882 else
3883 {
3884 fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
3885 give_local_error(ERRMESS_IOERR, errmsg, US"", error_rc, spool_data_file,
3886 header_list);
3887 /* Does not return */
3888 }
3889 }
3890
3891
3892 /* The message has now been successfully received. */
3893
3894 receive_messagecount++;
3895
3896 /* Add data size to written header size. We do not count the initial file name
3897 that is in the file, but we do add one extra for the notional blank line that
3898 precedes the data. This total differs from message_size in that it include the
3899 added Received: header and any other headers that got created locally. */
3900
3901 if (fflush(spool_data_file))
3902 {
3903 errmsg = string_sprintf("Spool write error: %s", strerror(errno));
3904 log_write(0, LOG_MAIN, "%s\n", errmsg);
3905 Uunlink(spool_name); /* Lose the data file */
3906
3907 if (smtp_input)
3908 {
3909 smtp_reply = US"451 Error in writing spool file";
3910 message_id[0] = 0; /* Indicate no message accepted */
3911 goto TIDYUP;
3912 }
3913 else
3914 {
3915 fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET);
3916 give_local_error(ERRMESS_IOERR, errmsg, US"", error_rc, spool_data_file,
3917 header_list);
3918 /* Does not return */
3919 }
3920 }
3921 fstat(data_fd, &statbuf);
3922
3923 msg_size += statbuf.st_size - SPOOL_DATA_START_OFFSET + 1;
3924
3925 /* Generate a "message received" log entry. We do this by building up a dynamic
3926 string as required. We log the arrival of a new message while the
3927 file is still locked, just in case the machine is *really* fast, and delivers
3928 it first! Include any message id that is in the message - since the syntax of a
3929 message id is actually an addr-spec, we can use the parse routine to canonicalize
3930 it. */
3931
3932 g = string_get(256);
3933
3934 g = string_append(g, 2,
3935 fake_response == FAIL ? US"(= " : US"<= ",
3936 sender_address[0] == 0 ? US"<>" : sender_address);
3937 if (message_reference)
3938 g = string_append(g, 2, US" R=", message_reference);
3939
3940 g = add_host_info_for_log(g);
3941
3942 #ifdef SUPPORT_TLS
3943 if (LOGGING(tls_cipher) && tls_in.cipher)
3944 g = string_append(g, 2, US" X=", tls_in.cipher);
3945 if (LOGGING(tls_certificate_verified) && tls_in.cipher)
3946 g = string_append(g, 2, US" CV=", tls_in.certificate_verified ? "yes":"no");
3947 if (LOGGING(tls_peerdn) && tls_in.peerdn)
3948 g = string_append(g, 3, US" DN=\"", string_printing(tls_in.peerdn), US"\"");
3949 if (LOGGING(tls_sni) && tls_in.sni)
3950 g = string_append(g, 3, US" SNI=\"", string_printing(tls_in.sni), US"\"");
3951 #endif
3952
3953 if (sender_host_authenticated)
3954 {
3955 g = string_append(g, 2, US" A=", sender_host_authenticated);
3956 if (authenticated_id)
3957 {
3958 g = string_append(g, 2, US":", authenticated_id);
3959 if (LOGGING(smtp_mailauth) && authenticated_sender)
3960 g = string_append(g, 2, US":", authenticated_sender);
3961 }
3962 }
3963
3964 #ifndef DISABLE_PRDR
3965 if (prdr_requested)
3966 g = string_catn(g, US" PRDR", 5);
3967 #endif
3968
3969 #ifdef SUPPORT_PROXY
3970 if (proxy_session && LOGGING(proxy))
3971 g = string_append(g, 2, US" PRX=", proxy_local_address);
3972 #endif
3973
3974 if (chunking_state > CHUNKING_OFFERED)
3975 g = string_catn(g, US" K", 2);
3976
3977 sprintf(CS big_buffer, "%d", msg_size);
3978 g = string_append(g, 2, US" S=", big_buffer);
3979
3980 /* log 8BITMIME mode announced in MAIL_FROM
3981 0 ... no BODY= used
3982 7 ... 7BIT
3983 8 ... 8BITMIME */
3984 if (LOGGING(8bitmime))
3985 {
3986 sprintf(CS big_buffer, "%d", body_8bitmime);
3987 g = string_append(g, 2, US" M8S=", big_buffer);
3988 }
3989
3990 #ifndef DISABLE_DKIM
3991 if (LOGGING(dkim) && dkim_verify_overall)
3992 g = string_append(g, 2, US" DKIM=", dkim_verify_overall);
3993 # ifdef EXPERIMENTAL_ARC
3994 if (LOGGING(dkim) && arc_state && Ustrcmp(arc_state, "pass") == 0)
3995 g = string_catn(g, US" ARC", 4);
3996 # endif
3997 #endif
3998
3999 if (LOGGING(receive_time))
4000 g = string_append(g, 2, US" RT=", string_timediff(&received_time_taken));
4001
4002 if (*queue_name)
4003 g = string_append(g, 2, US" Q=", queue_name);
4004
4005 /* If an addr-spec in a message-id contains a quoted string, it can contain
4006 any characters except " \ and CR and so in particular it can contain NL!
4007 Therefore, make sure we use a printing-characters only version for the log.
4008 Also, allow for domain literals in the message id. */
4009
4010 if (msgid_header)
4011 {
4012 uschar *old_id;
4013 BOOL save_allow_domain_literals = allow_domain_literals;
4014 allow_domain_literals = TRUE;
4015 old_id = parse_extract_address(Ustrchr(msgid_header->text, ':') + 1,
4016 &errmsg, &start, &end, &domain, FALSE);
4017 allow_domain_literals = save_allow_domain_literals;
4018 if (old_id != NULL)
4019 g = string_append(g, 2, US" id=", string_printing(old_id));
4020 }
4021
4022 /* If subject logging is turned on, create suitable printing-character
4023 text. By expanding $h_subject: we make use of the MIME decoding. */
4024
4025 if (LOGGING(subject) && subject_header)
4026 {
4027 int i;
4028 uschar *p = big_buffer;
4029 uschar *ss = expand_string(US"$h_subject:");
4030
4031 /* Backslash-quote any double quotes or backslashes so as to make a
4032 a C-like string, and turn any non-printers into escape sequences. */
4033
4034 *p++ = '\"';
4035 if (*ss != 0) for (i = 0; i < 100 && ss[i] != 0; i++)
4036 {
4037 if (ss[i] == '\"' || ss[i] == '\\') *p++ = '\\';
4038 *p++ = ss[i];
4039 }
4040 *p++ = '\"';
4041 *p = 0;
4042 g = string_append(g, 2, US" T=", string_printing(big_buffer));
4043 }
4044
4045 /* Terminate the string: string_cat() and string_append() leave room, but do
4046 not put the zero in. */
4047
4048 (void) string_from_gstring(g);
4049
4050 /* Create a message log file if message logs are being used and this message is
4051 not blackholed. Write the reception stuff to it. We used to leave message log
4052 creation until the first delivery, but this has proved confusing for some
4053 people. */
4054
4055 if (message_logs && !blackholed_by)
4056 {
4057 int fd;
4058 uschar * m_name = spool_fname(US"msglog", message_subdir, message_id, US"");
4059
4060 if ( (fd = Uopen(m_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE)) < 0
4061 && errno == ENOENT
4062 )
4063 {
4064 (void)directory_make(spool_directory,
4065 spool_sname(US"msglog", message_subdir),
4066 MSGLOG_DIRECTORY_MODE, TRUE);
4067 fd = Uopen(m_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE);
4068 }
4069
4070 if (fd < 0)
4071 log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't open message log %s: %s",
40