1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2015 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Functions for handling an incoming SMTP call. */
14 /* Initialize for TCP wrappers if so configured. It appears that the macro
15 HAVE_IPV6 is used in some versions of the tcpd.h header, so we unset it before
16 including that header, and restore its value afterwards. */
18 #ifdef USE_TCP_WRAPPERS
21 #define EXIM_HAVE_IPV6
27 #define HAVE_IPV6 TRUE
30 int allow_severity
= LOG_INFO
;
31 int deny_severity
= LOG_NOTICE
;
32 uschar
*tcp_wrappers_name
;
36 /* Size of buffer for reading SMTP commands. We used to use 512, as defined
37 by RFC 821. However, RFC 1869 specifies that this must be increased for SMTP
38 commands that accept arguments, and this in particular applies to AUTH, where
39 the data can be quite long. More recently this value was 2048 in Exim;
40 however, RFC 4954 (circa 2007) recommends 12288 bytes to handle AUTH. Clients
41 such as Thunderbird will send an AUTH with an initial-response for GSSAPI.
42 The maximum size of a Kerberos ticket under Windows 2003 is 12000 bytes, and
43 we need room to handle large base64-encoded AUTHs for GSSAPI.
46 #define smtp_cmd_buffer_size 16384
48 /* Size of buffer for reading SMTP incoming packets */
50 #define in_buffer_size 8192
52 /* Structure for SMTP command list */
59 short int is_mail_cmd
;
62 /* Codes for identifying commands. We order them so that those that come first
63 are those for which synchronization is always required. Checking this can help
67 /* These commands are required to be synchronized, i.e. to be the last in a
68 block of commands when pipelining. */
70 HELO_CMD
, EHLO_CMD
, DATA_CMD
, /* These are listed in the pipelining */
71 VRFY_CMD
, EXPN_CMD
, NOOP_CMD
, /* RFC as requiring synchronization */
72 ETRN_CMD
, /* This by analogy with TURN from the RFC */
73 STARTTLS_CMD
, /* Required by the STARTTLS RFC */
74 TLS_AUTH_CMD
, /* auto-command at start of SSL */
76 /* This is a dummy to identify the non-sync commands when pipelining */
78 NON_SYNC_CMD_PIPELINING
,
80 /* These commands need not be synchronized when pipelining */
82 MAIL_CMD
, RCPT_CMD
, RSET_CMD
,
84 /* This is a dummy to identify the non-sync commands when not pipelining */
86 NON_SYNC_CMD_NON_PIPELINING
,
88 /* I have been unable to find a statement about the use of pipelining
89 with AUTH, so to be on the safe side it is here, though I kind of feel
90 it should be up there with the synchronized commands. */
94 /* I'm not sure about these, but I don't think they matter. */
98 #ifdef EXPERIMENTAL_PROXY
99 PROXY_FAIL_IGNORE_CMD
,
102 /* These are specials that don't correspond to actual commands */
104 EOF_CMD
, OTHER_CMD
, BADARG_CMD
, BADCHAR_CMD
, BADSYN_CMD
,
105 TOO_MANY_NONMAIL_CMD
};
108 /* This is a convenience macro for adding the identity of an SMTP command
109 to the circular buffer that holds a list of the last n received. */
112 smtp_connection_had[smtp_ch_index++] = n; \
113 if (smtp_ch_index >= SMTP_HBUFF_SIZE) smtp_ch_index = 0
116 /*************************************************
117 * Local static variables *
118 *************************************************/
120 static auth_instance
*authenticated_by
;
121 static BOOL auth_advertised
;
123 static BOOL tls_advertised
;
125 static BOOL dsn_advertised
;
127 static BOOL helo_required
= FALSE
;
128 static BOOL helo_verify
= FALSE
;
129 static BOOL helo_seen
;
130 static BOOL helo_accept_junk
;
131 static BOOL count_nonmail
;
132 static BOOL pipelining_advertised
;
133 static BOOL rcpt_smtp_response_same
;
134 static BOOL rcpt_in_progress
;
135 static int nonmail_command_count
;
136 static BOOL smtp_exit_function_called
= 0;
137 #ifdef EXPERIMENTAL_INTERNATIONAL
138 static BOOL smtputf8_advertised
;
140 static int synprot_error_count
;
141 static int unknown_command_count
;
142 static int sync_cmd_limit
;
143 static int smtp_write_error
= 0;
145 static uschar
*rcpt_smtp_response
;
146 static uschar
*smtp_data_buffer
;
147 static uschar
*smtp_cmd_data
;
149 /* We need to know the position of RSET, HELO, EHLO, AUTH, and STARTTLS. Their
150 final fields of all except AUTH are forced TRUE at the start of a new message
151 setup, to allow one of each between messages that is not counted as a nonmail
152 command. (In fact, only one of HELO/EHLO is not counted.) Also, we have to
153 allow a new EHLO after starting up TLS.
155 AUTH is "falsely" labelled as a mail command initially, so that it doesn't get
156 counted. However, the flag is changed when AUTH is received, so that multiple
157 failing AUTHs will eventually hit the limit. After a successful AUTH, another
158 AUTH is already forbidden. After a TLS session is started, AUTH's flag is again
159 forced TRUE, to allow for the re-authentication that can happen at that point.
161 QUIT is also "falsely" labelled as a mail command so that it doesn't up the
162 count of non-mail commands and possibly provoke an error. */
164 static smtp_cmd_list cmd_list
[] = {
165 /* name len cmd has_arg is_mail_cmd */
167 { "rset", sizeof("rset")-1, RSET_CMD
, FALSE
, FALSE
}, /* First */
168 { "helo", sizeof("helo")-1, HELO_CMD
, TRUE
, FALSE
},
169 { "ehlo", sizeof("ehlo")-1, EHLO_CMD
, TRUE
, FALSE
},
170 { "auth", sizeof("auth")-1, AUTH_CMD
, TRUE
, TRUE
},
172 { "starttls", sizeof("starttls")-1, STARTTLS_CMD
, FALSE
, FALSE
},
173 { "tls_auth", 0, TLS_AUTH_CMD
, FALSE
, TRUE
},
176 /* If you change anything above here, also fix the definitions below. */
178 { "mail from:", sizeof("mail from:")-1, MAIL_CMD
, TRUE
, TRUE
},
179 { "rcpt to:", sizeof("rcpt to:")-1, RCPT_CMD
, TRUE
, TRUE
},
180 { "data", sizeof("data")-1, DATA_CMD
, FALSE
, TRUE
},
181 { "quit", sizeof("quit")-1, QUIT_CMD
, FALSE
, TRUE
},
182 { "noop", sizeof("noop")-1, NOOP_CMD
, TRUE
, FALSE
},
183 { "etrn", sizeof("etrn")-1, ETRN_CMD
, TRUE
, FALSE
},
184 { "vrfy", sizeof("vrfy")-1, VRFY_CMD
, TRUE
, FALSE
},
185 { "expn", sizeof("expn")-1, EXPN_CMD
, TRUE
, FALSE
},
186 { "help", sizeof("help")-1, HELP_CMD
, TRUE
, FALSE
}
189 static smtp_cmd_list
*cmd_list_end
=
190 cmd_list
+ sizeof(cmd_list
)/sizeof(smtp_cmd_list
);
192 #define CMD_LIST_RSET 0
193 #define CMD_LIST_HELO 1
194 #define CMD_LIST_EHLO 2
195 #define CMD_LIST_AUTH 3
196 #define CMD_LIST_STARTTLS 4
197 #define CMD_LIST_TLS_AUTH 5
199 /* This list of names is used for performing the smtp_no_mail logging action.
200 It must be kept in step with the SCH_xxx enumerations. */
202 static uschar
*smtp_names
[] =
204 US
"NONE", US
"AUTH", US
"DATA", US
"EHLO", US
"ETRN", US
"EXPN", US
"HELO",
205 US
"HELP", US
"MAIL", US
"NOOP", US
"QUIT", US
"RCPT", US
"RSET", US
"STARTTLS",
208 static uschar
*protocols_local
[] = {
209 US
"local-smtp", /* HELO */
210 US
"local-smtps", /* The rare case EHLO->STARTTLS->HELO */
211 US
"local-esmtp", /* EHLO */
212 US
"local-esmtps", /* EHLO->STARTTLS->EHLO */
213 US
"local-esmtpa", /* EHLO->AUTH */
214 US
"local-esmtpsa" /* EHLO->STARTTLS->EHLO->AUTH */
216 static uschar
*protocols
[] = {
218 US
"smtps", /* The rare case EHLO->STARTTLS->HELO */
219 US
"esmtp", /* EHLO */
220 US
"esmtps", /* EHLO->STARTTLS->EHLO */
221 US
"esmtpa", /* EHLO->AUTH */
222 US
"esmtpsa" /* EHLO->STARTTLS->EHLO->AUTH */
227 #define pcrpted 1 /* added to pextend or pnormal */
228 #define pauthed 2 /* added to pextend */
230 /* Sanity check and validate optional args to MAIL FROM: envelope */
232 ENV_MAIL_OPT_SIZE
, ENV_MAIL_OPT_BODY
, ENV_MAIL_OPT_AUTH
,
236 ENV_MAIL_OPT_RET
, ENV_MAIL_OPT_ENVID
,
237 #ifdef EXPERIMENTAL_INTERNATIONAL
243 uschar
* name
; /* option requested during MAIL cmd */
244 int value
; /* enum type */
245 BOOL need_value
; /* TRUE requires value (name=value pair format)
246 FALSE is a singleton */
248 static env_mail_type_t env_mail_type_list
[] = {
249 { US
"SIZE", ENV_MAIL_OPT_SIZE
, TRUE
},
250 { US
"BODY", ENV_MAIL_OPT_BODY
, TRUE
},
251 { US
"AUTH", ENV_MAIL_OPT_AUTH
, TRUE
},
253 { US
"PRDR", ENV_MAIL_OPT_PRDR
, FALSE
},
255 { US
"RET", ENV_MAIL_OPT_RET
, TRUE
},
256 { US
"ENVID", ENV_MAIL_OPT_ENVID
, TRUE
},
257 #ifdef EXPERIMENTAL_INTERNATIONAL
258 { US
"SMTPUTF8",ENV_MAIL_OPT_UTF8
, FALSE
}, /* rfc6531 */
260 { US
"NULL", ENV_MAIL_OPT_NULL
, FALSE
}
263 /* When reading SMTP from a remote host, we have to use our own versions of the
264 C input-reading functions, in order to be able to flush the SMTP output only
265 when about to read more data from the socket. This is the only way to get
266 optimal performance when the client is using pipelining. Flushing for every
267 command causes a separate packet and reply packet each time; saving all the
268 responses up (when pipelining) combines them into one packet and one response.
270 For simplicity, these functions are used for *all* SMTP input, not only when
271 receiving over a socket. However, after setting up a secure socket (SSL), input
272 is read via the OpenSSL library, and another set of functions is used instead
275 These functions are set in the receive_getc etc. variables and called with the
276 same interface as the C functions. However, since there can only ever be
277 one incoming SMTP call, we just use a single buffer and flags. There is no need
278 to implement a complicated private FILE-like structure.*/
280 static uschar
*smtp_inbuffer
;
281 static uschar
*smtp_inptr
;
282 static uschar
*smtp_inend
;
283 static int smtp_had_eof
;
284 static int smtp_had_error
;
287 /*************************************************
288 * SMTP version of getc() *
289 *************************************************/
291 /* This gets the next byte from the SMTP input buffer. If the buffer is empty,
292 it flushes the output, and refills the buffer, with a timeout. The signal
293 handler is set appropriately by the calling function. This function is not used
294 after a connection has negotated itself into an TLS/SSL state.
297 Returns: the next character or EOF
303 if (smtp_inptr
>= smtp_inend
)
307 if (smtp_receive_timeout
> 0) alarm(smtp_receive_timeout
);
308 rc
= read(fileno(smtp_in
), smtp_inbuffer
, in_buffer_size
);
313 /* Must put the error text in fixed store, because this might be during
314 header reading, where it releases unused store above the header. */
317 smtp_had_error
= save_errno
;
318 smtp_read_error
= string_copy_malloc(
319 string_sprintf(" (error: %s)", strerror(save_errno
)));
321 else smtp_had_eof
= 1;
325 dkim_exim_verify_feed(smtp_inbuffer
, rc
);
327 smtp_inend
= smtp_inbuffer
+ rc
;
328 smtp_inptr
= smtp_inbuffer
;
330 return *smtp_inptr
++;
335 /*************************************************
336 * SMTP version of ungetc() *
337 *************************************************/
339 /* Puts a character back in the input buffer. Only ever
345 Returns: the character
351 *(--smtp_inptr
) = ch
;
358 /*************************************************
359 * SMTP version of feof() *
360 *************************************************/
362 /* Tests for a previous EOF
365 Returns: non-zero if the eof flag is set
377 /*************************************************
378 * SMTP version of ferror() *
379 *************************************************/
381 /* Tests for a previous read error, and returns with errno
382 restored to what it was when the error was detected.
385 Returns: non-zero if the error flag is set
391 errno
= smtp_had_error
;
392 return smtp_had_error
;
397 /*************************************************
398 * Test for characters in the SMTP buffer *
399 *************************************************/
401 /* Used at the end of a message
410 return smtp_inptr
< smtp_inend
;
415 /*************************************************
416 * Write formatted string to SMTP channel *
417 *************************************************/
419 /* This is a separate function so that we don't have to repeat everything for
420 TLS support or debugging. It is global so that the daemon and the
421 authentication functions can use it. It does not return any error indication,
422 because major problems such as dropped connections won't show up till an output
423 flush for non-TLS connections. The smtp_fflush() function is available for
424 checking that: for convenience, TLS output errors are remembered here so that
425 they are also picked up later by smtp_fflush().
429 ... optional arguments
435 smtp_printf(const char *format
, ...)
439 va_start(ap
, format
);
440 smtp_vprintf(format
, ap
);
444 /* This is split off so that verify.c:respond_printf() can, in effect, call
445 smtp_printf(), bearing in mind that in C a vararg function can't directly
446 call another vararg function, only a function which accepts a va_list. */
449 smtp_vprintf(const char *format
, va_list ap
)
453 yield
= string_vformat(big_buffer
, big_buffer_size
, format
, ap
);
457 void *reset_point
= store_get(0);
458 uschar
*msg_copy
, *cr
, *end
;
459 msg_copy
= string_copy(big_buffer
);
460 end
= msg_copy
+ Ustrlen(msg_copy
);
461 while ((cr
= Ustrchr(msg_copy
, '\r')) != NULL
) /* lose CRs */
462 memmove(cr
, cr
+ 1, (end
--) - cr
);
463 debug_printf("SMTP>> %s", msg_copy
);
464 store_reset(reset_point
);
469 log_write(0, LOG_MAIN
|LOG_PANIC
, "string too large in smtp_printf()");
470 smtp_closedown(US
"Unexpected error");
471 exim_exit(EXIT_FAILURE
);
474 /* If this is the first output for a (non-batch) RCPT command, see if all RCPTs
475 have had the same. Note: this code is also present in smtp_respond(). It would
476 be tidier to have it only in one place, but when it was added, it was easier to
477 do it that way, so as not to have to mess with the code for the RCPT command,
478 which sometimes uses smtp_printf() and sometimes smtp_respond(). */
480 if (rcpt_in_progress
)
482 if (rcpt_smtp_response
== NULL
)
483 rcpt_smtp_response
= string_copy(big_buffer
);
484 else if (rcpt_smtp_response_same
&&
485 Ustrcmp(rcpt_smtp_response
, big_buffer
) != 0)
486 rcpt_smtp_response_same
= FALSE
;
487 rcpt_in_progress
= FALSE
;
490 /* Now write the string */
493 if (tls_in
.active
>= 0)
495 if (tls_write(TRUE
, big_buffer
, Ustrlen(big_buffer
)) < 0)
496 smtp_write_error
= -1;
501 if (fprintf(smtp_out
, "%s", big_buffer
) < 0) smtp_write_error
= -1;
506 /*************************************************
507 * Flush SMTP out and check for error *
508 *************************************************/
510 /* This function isn't currently used within Exim (it detects errors when it
511 tries to read the next SMTP input), but is available for use in local_scan().
512 For non-TLS connections, it flushes the output and checks for errors. For
513 TLS-connections, it checks for a previously-detected TLS write error.
516 Returns: 0 for no error; -1 after an error
522 if (tls_in
.active
< 0 && fflush(smtp_out
) != 0) smtp_write_error
= -1;
523 return smtp_write_error
;
528 /*************************************************
529 * SMTP command read timeout *
530 *************************************************/
532 /* Signal handler for timing out incoming SMTP commands. This attempts to
535 Argument: signal number (SIGALRM)
540 command_timeout_handler(int sig
)
542 sig
= sig
; /* Keep picky compilers happy */
543 log_write(L_lost_incoming_connection
,
544 LOG_MAIN
, "SMTP command timeout on%s connection from %s",
545 (tls_in
.active
>= 0)? " TLS" : "",
546 host_and_ident(FALSE
));
547 if (smtp_batched_input
)
548 moan_smtp_batch(NULL
, "421 SMTP command timeout"); /* Does not return */
549 smtp_notquit_exit(US
"command-timeout", US
"421",
550 US
"%s: SMTP command timeout - closing connection", smtp_active_hostname
);
551 exim_exit(EXIT_FAILURE
);
556 /*************************************************
558 *************************************************/
560 /* Signal handler for handling SIGTERM. Again, try to finish tidily.
562 Argument: signal number (SIGTERM)
567 command_sigterm_handler(int sig
)
569 sig
= sig
; /* Keep picky compilers happy */
570 log_write(0, LOG_MAIN
, "%s closed after SIGTERM", smtp_get_connection_info());
571 if (smtp_batched_input
)
572 moan_smtp_batch(NULL
, "421 SIGTERM received"); /* Does not return */
573 smtp_notquit_exit(US
"signal-exit", US
"421",
574 US
"%s: Service not available - closing connection", smtp_active_hostname
);
575 exim_exit(EXIT_FAILURE
);
581 #ifdef EXPERIMENTAL_PROXY
582 /*************************************************
583 * Restore socket timeout to previous value *
584 *************************************************/
585 /* If the previous value was successfully retrieved, restore
586 it before returning control to the non-proxy routines
588 Arguments: fd - File descriptor for input
589 get_ok - Successfully retrieved previous values
590 tvtmp - Time struct with previous values
591 vslen - Length of time struct
595 restore_socket_timeout(int fd
, int get_ok
, struct timeval tvtmp
, socklen_t vslen
)
598 setsockopt(fd
, SOL_SOCKET
, SO_RCVTIMEO
, (char *)&tvtmp
, vslen
);
601 /*************************************************
602 * Check if host is required proxy host *
603 *************************************************/
604 /* The function determines if inbound host will be a regular smtp host
605 or if it is configured that it must use Proxy Protocol.
612 check_proxy_protocol_host()
615 /* Cannot configure local connection as a proxy inbound */
616 if (sender_host_address
== NULL
) return proxy_session
;
618 rc
= verify_check_this_host(&proxy_required_hosts
, NULL
, NULL
,
619 sender_host_address
, NULL
);
623 debug_printf("Detected proxy protocol configured host\n");
624 proxy_session
= TRUE
;
626 return proxy_session
;
630 /*************************************************
631 * Setup host for proxy protocol *
632 *************************************************/
633 /* The function configures the connection based on a header from the
634 inbound host to use Proxy Protocol. The specification is very exact
635 so exit with an error if do not find the exact required pieces. This
636 includes an incorrect number of spaces separating args.
643 setup_proxy_protocol_host()
655 struct { /* TCP/UDP over IPv4, len = 12 */
661 struct { /* TCP/UDP over IPv6, len = 36 */
662 uint8_t src_addr
[16];
663 uint8_t dst_addr
[16];
667 struct { /* AF_UNIX sockets, len = 216 */
668 uschar src_addr
[108];
669 uschar dst_addr
[108];
675 /* Temp variables used in PPv2 address:port parsing */
677 char tmpip
[INET_ADDRSTRLEN
];
678 struct sockaddr_in tmpaddr
;
679 char tmpip6
[INET6_ADDRSTRLEN
];
680 struct sockaddr_in6 tmpaddr6
;
684 const char v2sig
[12] = "\x0D\x0A\x0D\x0A\x00\x0D\x0A\x51\x55\x49\x54\x0A";
685 uschar
*iptype
; /* To display debug info */
688 struct timeval tvtmp
;
690 vslen
= sizeof(struct timeval
);
692 fd
= fileno(smtp_in
);
694 /* Save current socket timeout values */
695 get_ok
= getsockopt(fd
, SOL_SOCKET
, SO_RCVTIMEO
, (char *)&tvtmp
,
698 /* Proxy Protocol host must send header within a short time
699 (default 3 seconds) or it's considered invalid */
700 tv
.tv_sec
= PROXY_NEGOTIATION_TIMEOUT_SEC
;
701 tv
.tv_usec
= PROXY_NEGOTIATION_TIMEOUT_USEC
;
702 setsockopt(fd
, SOL_SOCKET
, SO_RCVTIMEO
, (char *)&tv
,
703 sizeof(struct timeval
));
707 /* The inbound host was declared to be a Proxy Protocol host, so
708 don't do a PEEK into the data, actually slurp it up. */
709 ret
= recv(fd
, &hdr
, sizeof(hdr
), 0);
711 while (ret
== -1 && errno
== EINTR
);
715 restore_socket_timeout(fd
, get_ok
, tvtmp
, vslen
);
716 return (errno
== EAGAIN
) ? 0 : ERRNO_PROXYFAIL
;
720 memcmp(&hdr
.v2
, v2sig
, 12) == 0)
724 /* May 2014: haproxy combined the version and command into one byte to
725 allow two full bytes for the length field in order to proxy SSL
726 connections. SSL Proxy is not supported in this version of Exim, but
727 must still seperate values here. */
728 ver
= (hdr
.v2
.ver_cmd
& 0xf0) >> 4;
729 cmd
= (hdr
.v2
.ver_cmd
& 0x0f);
733 DEBUG(D_receive
) debug_printf("Invalid Proxy Protocol version: %d\n", ver
);
736 DEBUG(D_receive
) debug_printf("Detected PROXYv2 header\n");
737 /* The v2 header will always be 16 bytes per the spec. */
738 size
= 16 + hdr
.v2
.len
;
741 DEBUG(D_receive
) debug_printf("Truncated or too large PROXYv2 header (%d/%d)\n",
747 case 0x01: /* PROXY command */
750 case 0x11: /* TCPv4 address type */
752 tmpaddr
.sin_addr
.s_addr
= hdr
.v2
.addr
.ip4
.src_addr
;
753 inet_ntop(AF_INET
, &(tmpaddr
.sin_addr
), (char *)&tmpip
, sizeof(tmpip
));
754 if (!string_is_ip_address(US tmpip
,NULL
))
756 DEBUG(D_receive
) debug_printf("Invalid %s source IP\n", iptype
);
757 return ERRNO_PROXYFAIL
;
759 proxy_host_address
= sender_host_address
;
760 sender_host_address
= string_copy(US tmpip
);
761 tmpport
= ntohs(hdr
.v2
.addr
.ip4
.src_port
);
762 proxy_host_port
= sender_host_port
;
763 sender_host_port
= tmpport
;
764 /* Save dest ip/port */
765 tmpaddr
.sin_addr
.s_addr
= hdr
.v2
.addr
.ip4
.dst_addr
;
766 inet_ntop(AF_INET
, &(tmpaddr
.sin_addr
), (char *)&tmpip
, sizeof(tmpip
));
767 if (!string_is_ip_address(US tmpip
,NULL
))
769 DEBUG(D_receive
) debug_printf("Invalid %s dest port\n", iptype
);
770 return ERRNO_PROXYFAIL
;
772 proxy_target_address
= string_copy(US tmpip
);
773 tmpport
= ntohs(hdr
.v2
.addr
.ip4
.dst_port
);
774 proxy_target_port
= tmpport
;
776 case 0x21: /* TCPv6 address type */
778 memmove(tmpaddr6
.sin6_addr
.s6_addr
, hdr
.v2
.addr
.ip6
.src_addr
, 16);
779 inet_ntop(AF_INET6
, &(tmpaddr6
.sin6_addr
), (char *)&tmpip6
, sizeof(tmpip6
));
780 if (!string_is_ip_address(US tmpip6
,NULL
))
782 DEBUG(D_receive
) debug_printf("Invalid %s source IP\n", iptype
);
783 return ERRNO_PROXYFAIL
;
785 proxy_host_address
= sender_host_address
;
786 sender_host_address
= string_copy(US tmpip6
);
787 tmpport
= ntohs(hdr
.v2
.addr
.ip6
.src_port
);
788 proxy_host_port
= sender_host_port
;
789 sender_host_port
= tmpport
;
790 /* Save dest ip/port */
791 memmove(tmpaddr6
.sin6_addr
.s6_addr
, hdr
.v2
.addr
.ip6
.dst_addr
, 16);
792 inet_ntop(AF_INET6
, &(tmpaddr6
.sin6_addr
), (char *)&tmpip6
, sizeof(tmpip6
));
793 if (!string_is_ip_address(US tmpip6
,NULL
))
795 DEBUG(D_receive
) debug_printf("Invalid %s dest port\n", iptype
);
796 return ERRNO_PROXYFAIL
;
798 proxy_target_address
= string_copy(US tmpip6
);
799 tmpport
= ntohs(hdr
.v2
.addr
.ip6
.dst_port
);
800 proxy_target_port
= tmpport
;
804 debug_printf("Unsupported PROXYv2 connection type: 0x%02x\n",
808 /* Unsupported protocol, keep local connection address */
810 case 0x00: /* LOCAL command */
811 /* Keep local connection address for LOCAL */
815 debug_printf("Unsupported PROXYv2 command: 0x%x\n", cmd
);
820 memcmp(hdr
.v1
.line
, "PROXY", 5) == 0)
822 uschar
*p
= string_copy(hdr
.v1
.line
);
823 uschar
*end
= memchr(p
, '\r', ret
- 1);
824 uschar
*sp
; /* Utility variables follow */
828 if (!end
|| end
[1] != '\n')
830 DEBUG(D_receive
) debug_printf("Partial or invalid PROXY header\n");
833 *end
= '\0'; /* Terminate the string */
834 size
= end
+ 2 - hdr
.v1
.line
; /* Skip header + CRLF */
835 DEBUG(D_receive
) debug_printf("Detected PROXYv1 header\n");
836 /* Step through the string looking for the required fields. Ensure
837 strict adherance to required formatting, exit for any error. */
839 if (!isspace(*(p
++)))
841 DEBUG(D_receive
) debug_printf("Missing space after PROXY command\n");
844 if (!Ustrncmp(p
, CCS
"TCP4", 4))
846 else if (!Ustrncmp(p
,CCS
"TCP6", 4))
848 else if (!Ustrncmp(p
,CCS
"UNKNOWN", 7))
850 iptype
= US
"Unknown";
855 DEBUG(D_receive
) debug_printf("Invalid TCP type\n");
859 p
+= Ustrlen(iptype
);
860 if (!isspace(*(p
++)))
862 DEBUG(D_receive
) debug_printf("Missing space after TCP4/6 command\n");
865 /* Find the end of the arg */
866 if ((sp
= Ustrchr(p
, ' ')) == NULL
)
869 debug_printf("Did not find proxied src %s\n", iptype
);
873 if(!string_is_ip_address(p
,NULL
))
876 debug_printf("Proxied src arg is not an %s address\n", iptype
);
879 proxy_host_address
= sender_host_address
;
880 sender_host_address
= p
;
882 if ((sp
= Ustrchr(p
, ' ')) == NULL
)
885 debug_printf("Did not find proxy dest %s\n", iptype
);
889 if(!string_is_ip_address(p
,NULL
))
892 debug_printf("Proxy dest arg is not an %s address\n", iptype
);
895 proxy_target_address
= p
;
897 if ((sp
= Ustrchr(p
, ' ')) == NULL
)
899 DEBUG(D_receive
) debug_printf("Did not find proxied src port\n");
903 tmp_port
= strtol(CCS p
,&endc
,10);
904 if (*endc
|| tmp_port
== 0)
907 debug_printf("Proxied src port '%s' not an integer\n", p
);
910 proxy_host_port
= sender_host_port
;
911 sender_host_port
= tmp_port
;
913 if ((sp
= Ustrchr(p
, '\0')) == NULL
)
915 DEBUG(D_receive
) debug_printf("Did not find proxy dest port\n");
918 tmp_port
= strtol(CCS p
,&endc
,10);
919 if (*endc
|| tmp_port
== 0)
922 debug_printf("Proxy dest port '%s' not an integer\n", p
);
925 proxy_target_port
= tmp_port
;
926 /* Already checked for /r /n above. Good V1 header received. */
932 DEBUG(D_receive
) debug_printf("Invalid proxy protocol version negotiation\n");
937 restore_socket_timeout(fd
, get_ok
, tvtmp
, vslen
);
938 /* Don't flush any potential buffer contents. Any input should cause a
939 synchronization failure */
943 restore_socket_timeout(fd
, get_ok
, tvtmp
, vslen
);
945 debug_printf("Valid %s sender from Proxy Protocol header\n", iptype
);
946 return proxy_session
;
950 /*************************************************
951 * Read one command line *
952 *************************************************/
954 /* Strictly, SMTP commands coming over the net are supposed to end with CRLF.
955 There are sites that don't do this, and in any case internal SMTP probably
956 should check only for LF. Consequently, we check here for LF only. The line
957 ends up with [CR]LF removed from its end. If we get an overlong line, treat as
958 an unknown command. The command is read into the global smtp_cmd_buffer so that
959 it is available via $smtp_command.
961 The character reading routine sets up a timeout for each block actually read
962 from the input (which may contain more than one command). We set up a special
963 signal handler that closes down the session on a timeout. Control does not
967 check_sync if TRUE, check synchronization rules if global option is TRUE
969 Returns: a code identifying the command (enumerated above)
973 smtp_read_command(BOOL check_sync
)
978 BOOL hadnull
= FALSE
;
980 os_non_restarting_signal(SIGALRM
, command_timeout_handler
);
982 while ((c
= (receive_getc
)()) != '\n' && c
!= EOF
)
984 if (ptr
>= smtp_cmd_buffer_size
)
986 os_non_restarting_signal(SIGALRM
, sigalrm_handler
);
994 smtp_cmd_buffer
[ptr
++] = c
;
997 receive_linecount
++; /* For BSMTP errors */
998 os_non_restarting_signal(SIGALRM
, sigalrm_handler
);
1000 /* If hit end of file, return pseudo EOF command. Whether we have a
1001 part-line already read doesn't matter, since this is an error state. */
1003 if (c
== EOF
) return EOF_CMD
;
1005 /* Remove any CR and white space at the end of the line, and terminate the
1008 while (ptr
> 0 && isspace(smtp_cmd_buffer
[ptr
-1])) ptr
--;
1009 smtp_cmd_buffer
[ptr
] = 0;
1011 DEBUG(D_receive
) debug_printf("SMTP<< %s\n", smtp_cmd_buffer
);
1013 /* NULLs are not allowed in SMTP commands */
1015 if (hadnull
) return BADCHAR_CMD
;
1017 /* Scan command list and return identity, having set the data pointer
1018 to the start of the actual data characters. Check for SMTP synchronization
1021 for (p
= cmd_list
; p
< cmd_list_end
; p
++)
1023 #ifdef EXPERIMENTAL_PROXY
1024 /* Only allow QUIT command if Proxy Protocol parsing failed */
1025 if (proxy_session
&& proxy_session_failed
)
1027 if (p
->cmd
!= QUIT_CMD
)
1031 if (strncmpic(smtp_cmd_buffer
, US p
->name
, p
->len
) == 0 &&
1032 (smtp_cmd_buffer
[p
->len
-1] == ':' || /* "mail from:" or "rcpt to:" */
1033 smtp_cmd_buffer
[p
->len
] == 0 ||
1034 smtp_cmd_buffer
[p
->len
] == ' '))
1036 if (smtp_inptr
< smtp_inend
&& /* Outstanding input */
1037 p
->cmd
< sync_cmd_limit
&& /* Command should sync */
1038 check_sync
&& /* Local flag set */
1039 smtp_enforce_sync
&& /* Global flag set */
1040 sender_host_address
!= NULL
&& /* Not local input */
1041 !sender_host_notsocket
) /* Really is a socket */
1044 /* The variables $smtp_command and $smtp_command_argument point into the
1045 unmodified input buffer. A copy of the latter is taken for actual
1046 processing, so that it can be chopped up into separate parts if necessary,
1047 for example, when processing a MAIL command options such as SIZE that can
1048 follow the sender address. */
1050 smtp_cmd_argument
= smtp_cmd_buffer
+ p
->len
;
1051 while (isspace(*smtp_cmd_argument
)) smtp_cmd_argument
++;
1052 Ustrcpy(smtp_data_buffer
, smtp_cmd_argument
);
1053 smtp_cmd_data
= smtp_data_buffer
;
1055 /* Count non-mail commands from those hosts that are controlled in this
1056 way. The default is all hosts. We don't waste effort checking the list
1057 until we get a non-mail command, but then cache the result to save checking
1058 again. If there's a DEFER while checking the host, assume it's in the list.
1060 Note that one instance of RSET, EHLO/HELO, and STARTTLS is allowed at the
1061 start of each incoming message by fiddling with the value in the table. */
1063 if (!p
->is_mail_cmd
)
1065 if (count_nonmail
== TRUE_UNSET
) count_nonmail
=
1066 verify_check_host(&smtp_accept_max_nonmail_hosts
) != FAIL
;
1067 if (count_nonmail
&& ++nonmail_command_count
> smtp_accept_max_nonmail
)
1068 return TOO_MANY_NONMAIL_CMD
;
1071 /* If there is data for a command that does not expect it, generate the
1074 return (p
->has_arg
|| *smtp_cmd_data
== 0)? p
->cmd
: BADARG_CMD
;
1078 #ifdef EXPERIMENTAL_PROXY
1079 /* Only allow QUIT command if Proxy Protocol parsing failed */
1080 if (proxy_session
&& proxy_session_failed
)
1081 return PROXY_FAIL_IGNORE_CMD
;
1084 /* Enforce synchronization for unknown commands */
1086 if (smtp_inptr
< smtp_inend
&& /* Outstanding input */
1087 check_sync
&& /* Local flag set */
1088 smtp_enforce_sync
&& /* Global flag set */
1089 sender_host_address
!= NULL
&& /* Not local input */
1090 !sender_host_notsocket
) /* Really is a socket */
1098 /*************************************************
1099 * Recheck synchronization *
1100 *************************************************/
1102 /* Synchronization checks can never be perfect because a packet may be on its
1103 way but not arrived when the check is done. Such checks can in any case only be
1104 done when TLS is not in use. Normally, the checks happen when commands are
1105 read: Exim ensures that there is no more input in the input buffer. In normal
1106 cases, the response to the command will be fast, and there is no further check.
1108 However, for some commands an ACL is run, and that can include delays. In those
1109 cases, it is useful to do another check on the input just before sending the
1110 response. This also applies at the start of a connection. This function does
1111 that check by means of the select() function, as long as the facility is not
1112 disabled or inappropriate. A failure of select() is ignored.
1114 When there is unwanted input, we read it so that it appears in the log of the
1118 Returns: TRUE if all is well; FALSE if there is input pending
1126 struct timeval tzero
;
1128 if (!smtp_enforce_sync
|| sender_host_address
== NULL
||
1129 sender_host_notsocket
|| tls_in
.active
>= 0)
1132 fd
= fileno(smtp_in
);
1137 rc
= select(fd
+ 1, (SELECT_ARG2_TYPE
*)&fds
, NULL
, NULL
, &tzero
);
1139 if (rc
<= 0) return TRUE
; /* Not ready to read */
1141 if (rc
< 0) return TRUE
; /* End of file or error */
1144 rc
= smtp_inend
- smtp_inptr
;
1145 if (rc
> 150) rc
= 150;
1152 /*************************************************
1153 * Forced closedown of call *
1154 *************************************************/
1156 /* This function is called from log.c when Exim is dying because of a serious
1157 disaster, and also from some other places. If an incoming non-batched SMTP
1158 channel is open, it swallows the rest of the incoming message if in the DATA
1159 phase, sends the reply string, and gives an error to all subsequent commands
1160 except QUIT. The existence of an SMTP call is detected by the non-NULLness of
1164 message SMTP reply string to send, excluding the code
1170 smtp_closedown(uschar
*message
)
1172 if (smtp_in
== NULL
|| smtp_batched_input
) return;
1173 receive_swallow_smtp();
1174 smtp_printf("421 %s\r\n", message
);
1178 switch(smtp_read_command(FALSE
))
1184 smtp_printf("221 %s closing connection\r\n", smtp_active_hostname
);
1189 smtp_printf("250 Reset OK\r\n");
1193 smtp_printf("421 %s\r\n", message
);
1202 /*************************************************
1203 * Set up connection info for logging *
1204 *************************************************/
1206 /* This function is called when logging information about an SMTP connection.
1207 It sets up appropriate source information, depending on the type of connection.
1208 If sender_fullhost is NULL, we are at a very early stage of the connection;
1209 just use the IP address.
1212 Returns: a string describing the connection
1216 smtp_get_connection_info(void)
1218 uschar
*hostname
= (sender_fullhost
== NULL
)?
1219 sender_host_address
: sender_fullhost
;
1222 return string_sprintf("SMTP connection from %s", hostname
);
1224 if (sender_host_unknown
|| sender_host_notsocket
)
1225 return string_sprintf("SMTP connection from %s", sender_ident
);
1228 return string_sprintf("SMTP connection from %s (via inetd)", hostname
);
1230 if ((log_extra_selector
& LX_incoming_interface
) != 0 &&
1231 interface_address
!= NULL
)
1232 return string_sprintf("SMTP connection from %s I=[%s]:%d", hostname
,
1233 interface_address
, interface_port
);
1235 return string_sprintf("SMTP connection from %s", hostname
);
1241 /* Append TLS-related information to a log line
1244 s String under construction: allocated string to extend, or NULL
1245 sizep Pointer to current allocation size (update on return), or NULL
1246 ptrp Pointer to index for new entries in string (update on return), or NULL
1248 Returns: Allocated string or NULL
1251 s_tlslog(uschar
* s
, int * sizep
, int * ptrp
)
1253 int size
= sizep
? *sizep
: 0;
1254 int ptr
= ptrp
? *ptrp
: 0;
1256 if ((log_extra_selector
& LX_tls_cipher
) != 0 && tls_in
.cipher
!= NULL
)
1257 s
= string_append(s
, &size
, &ptr
, 2, US
" X=", tls_in
.cipher
);
1258 if ((log_extra_selector
& LX_tls_certificate_verified
) != 0 &&
1259 tls_in
.cipher
!= NULL
)
1260 s
= string_append(s
, &size
, &ptr
, 2, US
" CV=",
1261 tls_in
.certificate_verified
? "yes":"no");
1262 if ((log_extra_selector
& LX_tls_peerdn
) != 0 && tls_in
.peerdn
!= NULL
)
1263 s
= string_append(s
, &size
, &ptr
, 3, US
" DN=\"",
1264 string_printing(tls_in
.peerdn
), US
"\"");
1265 if ((log_extra_selector
& LX_tls_sni
) != 0 && tls_in
.sni
!= NULL
)
1266 s
= string_append(s
, &size
, &ptr
, 3, US
" SNI=\"",
1267 string_printing(tls_in
.sni
), US
"\"");
1272 if (sizep
) *sizep
= size
;
1273 if (ptrp
) *ptrp
= ptr
;
1279 /*************************************************
1280 * Log lack of MAIL if so configured *
1281 *************************************************/
1283 /* This function is called when an SMTP session ends. If the log selector
1284 smtp_no_mail is set, write a log line giving some details of what has happened
1285 in the SMTP session.
1292 smtp_log_no_mail(void)
1297 if (smtp_mailcmd_count
> 0 || (log_extra_selector
& LX_smtp_no_mail
) == 0)
1303 if (sender_host_authenticated
!= NULL
)
1305 s
= string_append(s
, &size
, &ptr
, 2, US
" A=", sender_host_authenticated
);
1306 if (authenticated_id
!= NULL
)
1307 s
= string_append(s
, &size
, &ptr
, 2, US
":", authenticated_id
);
1311 s
= s_tlslog(s
, &size
, &ptr
);
1314 sep
= (smtp_connection_had
[SMTP_HBUFF_SIZE
-1] != SCH_NONE
)?
1315 US
" C=..." : US
" C=";
1316 for (i
= smtp_ch_index
; i
< SMTP_HBUFF_SIZE
; i
++)
1318 if (smtp_connection_had
[i
] != SCH_NONE
)
1320 s
= string_append(s
, &size
, &ptr
, 2, sep
,
1321 smtp_names
[smtp_connection_had
[i
]]);
1326 for (i
= 0; i
< smtp_ch_index
; i
++)
1328 s
= string_append(s
, &size
, &ptr
, 2, sep
, smtp_names
[smtp_connection_had
[i
]]);
1332 if (s
!= NULL
) s
[ptr
] = 0; else s
= US
"";
1333 log_write(0, LOG_MAIN
, "no MAIL in SMTP connection from %s D=%s%s",
1334 host_and_ident(FALSE
),
1335 readconf_printtime( (int) ((long)time(NULL
) - (long)smtp_connection_start
)),
1341 /*************************************************
1342 * Check HELO line and set sender_helo_name *
1343 *************************************************/
1345 /* Check the format of a HELO line. The data for HELO/EHLO is supposed to be
1346 the domain name of the sending host, or an ip literal in square brackets. The
1347 arrgument is placed in sender_helo_name, which is in malloc store, because it
1348 must persist over multiple incoming messages. If helo_accept_junk is set, this
1349 host is permitted to send any old junk (needed for some broken hosts).
1350 Otherwise, helo_allow_chars can be used for rogue characters in general
1351 (typically people want to let in underscores).
1354 s the data portion of the line (already past any white space)
1356 Returns: TRUE or FALSE
1360 check_helo(uschar
*s
)
1363 uschar
*end
= s
+ Ustrlen(s
);
1364 BOOL yield
= helo_accept_junk
;
1366 /* Discard any previous helo name */
1368 if (sender_helo_name
!= NULL
)
1370 store_free(sender_helo_name
);
1371 sender_helo_name
= NULL
;
1374 /* Skip tests if junk is permitted. */
1378 /* Allow the new standard form for IPv6 address literals, namely,
1379 [IPv6:....], and because someone is bound to use it, allow an equivalent
1380 IPv4 form. Allow plain addresses as well. */
1387 if (strncmpic(s
, US
"[IPv6:", 6) == 0)
1388 yield
= (string_is_ip_address(s
+6, NULL
) == 6);
1389 else if (strncmpic(s
, US
"[IPv4:", 6) == 0)
1390 yield
= (string_is_ip_address(s
+6, NULL
) == 4);
1392 yield
= (string_is_ip_address(s
+1, NULL
) != 0);
1397 /* Non-literals must be alpha, dot, hyphen, plus any non-valid chars
1398 that have been configured (usually underscore - sigh). */
1405 if (!isalnum(*s
) && *s
!= '.' && *s
!= '-' &&
1406 Ustrchr(helo_allow_chars
, *s
) == NULL
)
1416 /* Save argument if OK */
1418 if (yield
) sender_helo_name
= string_copy_malloc(start
);
1426 /*************************************************
1427 * Extract SMTP command option *
1428 *************************************************/
1430 /* This function picks the next option setting off the end of smtp_cmd_data. It
1431 is called for MAIL FROM and RCPT TO commands, to pick off the optional ESMTP
1432 things that can appear there.
1435 name point this at the name
1436 value point this at the data string
1438 Returns: TRUE if found an option
1442 extract_option(uschar
**name
, uschar
**value
)
1445 uschar
*v
= smtp_cmd_data
+ Ustrlen(smtp_cmd_data
) - 1;
1446 while (isspace(*v
)) v
--;
1448 while (v
> smtp_cmd_data
&& *v
!= '=' && !isspace(*v
)) v
--;
1453 while(isalpha(n
[-1])) n
--;
1454 /* RFC says SP, but TAB seen in wild and other major MTAs accept it */
1455 if (!isspace(n
[-1])) return FALSE
;
1461 if (v
== smtp_cmd_data
) return FALSE
;
1473 /*************************************************
1474 * Reset for new message *
1475 *************************************************/
1477 /* This function is called whenever the SMTP session is reset from
1478 within either of the setup functions.
1480 Argument: the stacking pool storage reset point
1485 smtp_reset(void *reset_point
)
1487 store_reset(reset_point
);
1488 recipients_list
= NULL
;
1489 rcpt_count
= rcpt_defer_count
= rcpt_fail_count
=
1490 raw_recipients_count
= recipients_count
= recipients_list_max
= 0;
1491 cancel_cutthrough_connection("smtp reset");
1492 message_linecount
= 0;
1494 acl_added_headers
= NULL
;
1495 acl_removed_headers
= NULL
;
1496 queue_only_policy
= FALSE
;
1497 rcpt_smtp_response
= NULL
;
1498 rcpt_smtp_response_same
= TRUE
;
1499 rcpt_in_progress
= FALSE
;
1500 deliver_freeze
= FALSE
; /* Can be set by ACL */
1501 freeze_tell
= freeze_tell_config
; /* Can be set by ACL */
1502 fake_response
= OK
; /* Can be set by ACL */
1503 #ifdef WITH_CONTENT_SCAN
1504 no_mbox_unspool
= FALSE
; /* Can be set by ACL */
1506 submission_mode
= FALSE
; /* Can be set by ACL */
1507 suppress_local_fixups
= suppress_local_fixups_default
; /* Can be set by ACL */
1508 active_local_from_check
= local_from_check
; /* Can be set by ACL */
1509 active_local_sender_retain
= local_sender_retain
; /* Can be set by ACL */
1510 sender_address
= NULL
;
1511 submission_name
= NULL
; /* Can be set by ACL */
1512 raw_sender
= NULL
; /* After SMTP rewrite, before qualifying */
1513 sender_address_unrewritten
= NULL
; /* Set only after verify rewrite */
1514 sender_verified_list
= NULL
; /* No senders verified */
1515 memset(sender_address_cache
, 0, sizeof(sender_address_cache
));
1516 memset(sender_domain_cache
, 0, sizeof(sender_domain_cache
));
1518 #ifndef DISABLE_PRDR
1519 prdr_requested
= FALSE
;
1522 /* Reset the DSN flags */
1526 authenticated_sender
= NULL
;
1527 #ifdef EXPERIMENTAL_BRIGHTMAIL
1529 bmi_verdicts
= NULL
;
1531 #ifndef DISABLE_DKIM
1532 dkim_signers
= NULL
;
1533 dkim_disable_verify
= FALSE
;
1534 dkim_collect_input
= FALSE
;
1536 #ifdef EXPERIMENTAL_SPF
1537 spf_header_comment
= NULL
;
1538 spf_received
= NULL
;
1540 spf_smtp_comment
= NULL
;
1542 #ifdef EXPERIMENTAL_INTERNATIONAL
1543 message_smtputf8
= FALSE
;
1545 body_linecount
= body_zerocount
= 0;
1547 sender_rate
= sender_rate_limit
= sender_rate_period
= NULL
;
1548 ratelimiters_mail
= NULL
; /* Updated by ratelimit ACL condition */
1549 /* Note that ratelimiters_conn persists across resets. */
1551 /* Reset message ACL variables */
1555 /* The message body variables use malloc store. They may be set if this is
1556 not the first message in an SMTP session and the previous message caused them
1557 to be referenced in an ACL. */
1559 if (message_body
!= NULL
)
1561 store_free(message_body
);
1562 message_body
= NULL
;
1565 if (message_body_end
!= NULL
)
1567 store_free(message_body_end
);
1568 message_body_end
= NULL
;
1571 /* Warning log messages are also saved in malloc store. They are saved to avoid
1572 repetition in the same message, but it seems right to repeat them for different
1575 while (acl_warn_logged
!= NULL
)
1577 string_item
*this = acl_warn_logged
;
1578 acl_warn_logged
= acl_warn_logged
->next
;
1587 /*************************************************
1588 * Initialize for incoming batched SMTP message *
1589 *************************************************/
1591 /* This function is called from smtp_setup_msg() in the case when
1592 smtp_batched_input is true. This happens when -bS is used to pass a whole batch
1593 of messages in one file with SMTP commands between them. All errors must be
1594 reported by sending a message, and only MAIL FROM, RCPT TO, and DATA are
1595 relevant. After an error on a sender, or an invalid recipient, the remainder
1596 of the message is skipped. The value of received_protocol is already set.
1599 Returns: > 0 message successfully started (reached DATA)
1600 = 0 QUIT read or end of file reached
1601 < 0 should not occur
1605 smtp_setup_batch_msg(void)
1608 void *reset_point
= store_get(0);
1610 /* Save the line count at the start of each transaction - single commands
1611 like HELO and RSET count as whole transactions. */
1613 bsmtp_transaction_linecount
= receive_linecount
;
1615 if ((receive_feof
)()) return 0; /* Treat EOF as QUIT */
1617 smtp_reset(reset_point
); /* Reset for start of message */
1619 /* Deal with SMTP commands. This loop is exited by setting done to a POSITIVE
1620 value. The values are 2 larger than the required yield of the function. */
1625 uschar
*recipient
= NULL
;
1626 int start
, end
, sender_domain
, recipient_domain
;
1628 switch(smtp_read_command(FALSE
))
1630 /* The HELO/EHLO commands set sender_address_helo if they have
1631 valid data; otherwise they are ignored, except that they do
1632 a reset of the state. */
1637 check_helo(smtp_cmd_data
);
1641 smtp_reset(reset_point
);
1642 bsmtp_transaction_linecount
= receive_linecount
;
1646 /* The MAIL FROM command requires an address as an operand. All we
1647 do here is to parse it for syntactic correctness. The form "<>" is
1648 a special case which converts into an empty string. The start/end
1649 pointers in the original are not used further for this address, as
1650 it is the canonical extracted address which is all that is kept. */
1653 smtp_mailcmd_count
++; /* Count for no-mail log */
1654 if (sender_address
!= NULL
)
1655 /* The function moan_smtp_batch() does not return. */
1656 moan_smtp_batch(smtp_cmd_buffer
, "503 Sender already given");
1658 if (smtp_cmd_data
[0] == 0)
1659 /* The function moan_smtp_batch() does not return. */
1660 moan_smtp_batch(smtp_cmd_buffer
, "501 MAIL FROM must have an address operand");
1662 /* Reset to start of message */
1664 smtp_reset(reset_point
);
1666 /* Apply SMTP rewrite */
1668 raw_sender
= ((rewrite_existflags
& rewrite_smtp
) != 0)?
1669 rewrite_one(smtp_cmd_data
, rewrite_smtp
|rewrite_smtp_sender
, NULL
, FALSE
,
1670 US
"", global_rewrite_rules
) : smtp_cmd_data
;
1672 /* Extract the address; the TRUE flag allows <> as valid */
1675 parse_extract_address(raw_sender
, &errmess
, &start
, &end
, &sender_domain
,
1678 if (raw_sender
== NULL
)
1679 /* The function moan_smtp_batch() does not return. */
1680 moan_smtp_batch(smtp_cmd_buffer
, "501 %s", errmess
);
1682 sender_address
= string_copy(raw_sender
);
1684 /* Qualify unqualified sender addresses if permitted to do so. */
1686 if (sender_domain
== 0 && sender_address
[0] != 0 && sender_address
[0] != '@')
1688 if (allow_unqualified_sender
)
1690 sender_address
= rewrite_address_qualify(sender_address
, FALSE
);
1691 DEBUG(D_receive
) debug_printf("unqualified address %s accepted "
1692 "and rewritten\n", raw_sender
);
1694 /* The function moan_smtp_batch() does not return. */
1695 else moan_smtp_batch(smtp_cmd_buffer
, "501 sender address must contain "
1701 /* The RCPT TO command requires an address as an operand. All we do
1702 here is to parse it for syntactic correctness. There may be any number
1703 of RCPT TO commands, specifying multiple senders. We build them all into
1704 a data structure that is in argc/argv format. The start/end values
1705 given by parse_extract_address are not used, as we keep only the
1706 extracted address. */
1709 if (sender_address
== NULL
)
1710 /* The function moan_smtp_batch() does not return. */
1711 moan_smtp_batch(smtp_cmd_buffer
, "503 No sender yet given");
1713 if (smtp_cmd_data
[0] == 0)
1714 /* The function moan_smtp_batch() does not return. */
1715 moan_smtp_batch(smtp_cmd_buffer
, "501 RCPT TO must have an address operand");
1717 /* Check maximum number allowed */
1719 if (recipients_max
> 0 && recipients_count
+ 1 > recipients_max
)
1720 /* The function moan_smtp_batch() does not return. */
1721 moan_smtp_batch(smtp_cmd_buffer
, "%s too many recipients",
1722 recipients_max_reject
? "552": "452");
1724 /* Apply SMTP rewrite, then extract address. Don't allow "<>" as a
1725 recipient address */
1727 recipient
= ((rewrite_existflags
& rewrite_smtp
) != 0)?
1728 rewrite_one(smtp_cmd_data
, rewrite_smtp
, NULL
, FALSE
, US
"",
1729 global_rewrite_rules
) : smtp_cmd_data
;
1731 /* rfc821_domains = TRUE; << no longer needed */
1732 recipient
= parse_extract_address(recipient
, &errmess
, &start
, &end
,
1733 &recipient_domain
, FALSE
);
1734 /* rfc821_domains = FALSE; << no longer needed */
1736 if (recipient
== NULL
)
1737 /* The function moan_smtp_batch() does not return. */
1738 moan_smtp_batch(smtp_cmd_buffer
, "501 %s", errmess
);
1740 /* If the recipient address is unqualified, qualify it if permitted. Then
1741 add it to the list of recipients. */
1743 if (recipient_domain
== 0)
1745 if (allow_unqualified_recipient
)
1747 DEBUG(D_receive
) debug_printf("unqualified address %s accepted\n",
1749 recipient
= rewrite_address_qualify(recipient
, TRUE
);
1751 /* The function moan_smtp_batch() does not return. */
1752 else moan_smtp_batch(smtp_cmd_buffer
, "501 recipient address must contain "
1755 receive_add_recipient(recipient
, -1);
1759 /* The DATA command is legal only if it follows successful MAIL FROM
1760 and RCPT TO commands. This function is complete when a valid DATA
1761 command is encountered. */
1764 if (sender_address
== NULL
|| recipients_count
<= 0)
1766 /* The function moan_smtp_batch() does not return. */
1767 if (sender_address
== NULL
)
1768 moan_smtp_batch(smtp_cmd_buffer
,
1769 "503 MAIL FROM:<sender> command must precede DATA");
1771 moan_smtp_batch(smtp_cmd_buffer
,
1772 "503 RCPT TO:<recipient> must precede DATA");
1776 done
= 3; /* DATA successfully achieved */
1777 message_ended
= END_NOTENDED
; /* Indicate in middle of message */
1782 /* The VRFY, EXPN, HELP, ETRN, and NOOP commands are ignored. */
1789 bsmtp_transaction_linecount
= receive_linecount
;
1800 /* The function moan_smtp_batch() does not return. */
1801 moan_smtp_batch(smtp_cmd_buffer
, "501 Unexpected argument data");
1806 /* The function moan_smtp_batch() does not return. */
1807 moan_smtp_batch(smtp_cmd_buffer
, "501 Unexpected NULL in SMTP command");
1812 /* The function moan_smtp_batch() does not return. */
1813 moan_smtp_batch(smtp_cmd_buffer
, "500 Command unrecognized");
1818 return done
- 2; /* Convert yield values */
1824 /*************************************************
1825 * Start an SMTP session *
1826 *************************************************/
1828 /* This function is called at the start of an SMTP session. Thereafter,
1829 smtp_setup_msg() is called to initiate each separate message. This
1830 function does host-specific testing, and outputs the banner line.
1833 Returns: FALSE if the session can not continue; something has
1834 gone wrong, or the connection to the host is blocked
1838 smtp_start_session(void)
1842 uschar
*user_msg
, *log_msg
;
1846 smtp_connection_start
= time(NULL
);
1847 for (smtp_ch_index
= 0; smtp_ch_index
< SMTP_HBUFF_SIZE
; smtp_ch_index
++)
1848 smtp_connection_had
[smtp_ch_index
] = SCH_NONE
;
1851 /* Default values for certain variables */
1853 helo_seen
= esmtp
= helo_accept_junk
= FALSE
;
1854 smtp_mailcmd_count
= 0;
1855 count_nonmail
= TRUE_UNSET
;
1856 synprot_error_count
= unknown_command_count
= nonmail_command_count
= 0;
1857 smtp_delay_mail
= smtp_rlm_base
;
1858 auth_advertised
= FALSE
;
1859 pipelining_advertised
= FALSE
;
1860 pipelining_enable
= TRUE
;
1861 sync_cmd_limit
= NON_SYNC_CMD_NON_PIPELINING
;
1862 smtp_exit_function_called
= FALSE
; /* For avoiding loop in not-quit exit */
1864 memset(sender_host_cache
, 0, sizeof(sender_host_cache
));
1866 /* If receiving by -bs from a trusted user, or testing with -bh, we allow
1867 authentication settings from -oMaa to remain in force. */
1869 if (!host_checking
&& !sender_host_notsocket
) sender_host_authenticated
= NULL
;
1870 authenticated_by
= NULL
;
1873 tls_in
.cipher
= tls_in
.peerdn
= NULL
;
1874 tls_in
.ourcert
= tls_in
.peercert
= NULL
;
1876 tls_in
.ocsp
= OCSP_NOT_REQ
;
1877 tls_advertised
= FALSE
;
1879 dsn_advertised
= FALSE
;
1880 #ifdef EXPERIMENTAL_INTERNATIONAL
1881 smtputf8_advertised
= FALSE
;
1884 /* Reset ACL connection variables */
1888 /* Allow for trailing 0 in the command and data buffers. */
1890 smtp_cmd_buffer
= (uschar
*)malloc(2*smtp_cmd_buffer_size
+ 2);
1891 if (smtp_cmd_buffer
== NULL
)
1892 log_write(0, LOG_MAIN
|LOG_PANIC_DIE
,
1893 "malloc() failed for SMTP command buffer");
1894 smtp_cmd_buffer
[0] = 0;
1895 smtp_data_buffer
= smtp_cmd_buffer
+ smtp_cmd_buffer_size
+ 1;
1897 /* For batched input, the protocol setting can be overridden from the
1898 command line by a trusted caller. */
1900 if (smtp_batched_input
)
1902 if (received_protocol
== NULL
) received_protocol
= US
"local-bsmtp";
1905 /* For non-batched SMTP input, the protocol setting is forced here. It will be
1906 reset later if any of EHLO/AUTH/STARTTLS are received. */
1910 (sender_host_address
? protocols
: protocols_local
) [pnormal
];
1912 /* Set up the buffer for inputting using direct read() calls, and arrange to
1913 call the local functions instead of the standard C ones. */
1915 smtp_inbuffer
= (uschar
*)malloc(in_buffer_size
);
1916 if (smtp_inbuffer
== NULL
)
1917 log_write(0, LOG_MAIN
|LOG_PANIC_DIE
, "malloc() failed for SMTP input buffer");
1918 receive_getc
= smtp_getc
;
1919 receive_ungetc
= smtp_ungetc
;
1920 receive_feof
= smtp_feof
;
1921 receive_ferror
= smtp_ferror
;
1922 receive_smtp_buffered
= smtp_buffered
;
1923 smtp_inptr
= smtp_inend
= smtp_inbuffer
;
1924 smtp_had_eof
= smtp_had_error
= 0;
1926 /* Set up the message size limit; this may be host-specific */
1928 thismessage_size_limit
= expand_string_integer(message_size_limit
, TRUE
);
1929 if (expand_string_message
!= NULL
)
1931 if (thismessage_size_limit
== -1)
1932 log_write(0, LOG_MAIN
|LOG_PANIC
, "unable to expand message_size_limit: "
1933 "%s", expand_string_message
);
1935 log_write(0, LOG_MAIN
|LOG_PANIC
, "invalid message_size_limit: "
1936 "%s", expand_string_message
);
1937 smtp_closedown(US
"Temporary local problem - please try later");
1941 /* When a message is input locally via the -bs or -bS options, sender_host_
1942 unknown is set unless -oMa was used to force an IP address, in which case it
1943 is checked like a real remote connection. When -bs is used from inetd, this
1944 flag is not set, causing the sending host to be checked. The code that deals
1945 with IP source routing (if configured) is never required for -bs or -bS and
1946 the flag sender_host_notsocket is used to suppress it.
1948 If smtp_accept_max and smtp_accept_reserve are set, keep some connections in
1949 reserve for certain hosts and/or networks. */
1951 if (!sender_host_unknown
)
1954 BOOL reserved_host
= FALSE
;
1956 /* Look up IP options (source routing info) on the socket if this is not an
1957 -oMa "host", and if any are found, log them and drop the connection.
1959 Linux (and others now, see below) is different to everyone else, so there
1960 has to be some conditional compilation here. Versions of Linux before 2.1.15
1961 used a structure whose name was "options". Somebody finally realized that
1962 this name was silly, and it got changed to "ip_options". I use the
1963 newer name here, but there is a fudge in the script that sets up os.h
1964 to define a macro in older Linux systems.
1966 Sigh. Linux is a fast-moving target. Another generation of Linux uses
1967 glibc 2, which has chosen ip_opts for the structure name. This is now
1968 really a glibc thing rather than a Linux thing, so the condition name
1969 has been changed to reflect this. It is relevant also to GNU/Hurd.
1971 Mac OS 10.x (Darwin) is like the later glibc versions, but without the
1972 setting of the __GLIBC__ macro, so we can't detect it automatically. There's
1973 a special macro defined in the os.h file.
1975 Some DGUX versions on older hardware appear not to support IP options at
1976 all, so there is now a general macro which can be set to cut out this
1979 How to do this properly in IPv6 is not yet known. */
1981 #if !HAVE_IPV6 && !defined(NO_IP_OPTIONS)
1983 #ifdef GLIBC_IP_OPTIONS
1984 #if (!defined __GLIBC__) || (__GLIBC__ < 2)
1989 #elif defined DARWIN_IP_OPTIONS
1995 if (!host_checking
&& !sender_host_notsocket
)
1998 EXIM_SOCKLEN_T optlen
= sizeof(struct ip_options
) + MAX_IPOPTLEN
;
1999 struct ip_options
*ipopt
= store_get(optlen
);
2001 struct ip_opts ipoptblock
;
2002 struct ip_opts
*ipopt
= &ipoptblock
;
2003 EXIM_SOCKLEN_T optlen
= sizeof(ipoptblock
);
2005 struct ipoption ipoptblock
;
2006 struct ipoption
*ipopt
= &ipoptblock
;
2007 EXIM_SOCKLEN_T optlen
= sizeof(ipoptblock
);
2010 /* Occasional genuine failures of getsockopt() have been seen - for
2011 example, "reset by peer". Therefore, just log and give up on this
2012 call, unless the error is ENOPROTOOPT. This error is given by systems
2013 that have the interfaces but not the mechanism - e.g. GNU/Hurd at the time
2014 of writing. So for that error, carry on - we just can't do an IP options
2017 DEBUG(D_receive
) debug_printf("checking for IP options\n");
2019 if (getsockopt(fileno(smtp_out
), IPPROTO_IP
, IP_OPTIONS
, (uschar
*)(ipopt
),
2022 if (errno
!= ENOPROTOOPT
)
2024 log_write(0, LOG_MAIN
, "getsockopt() failed from %s: %s",
2025 host_and_ident(FALSE
), strerror(errno
));
2026 smtp_printf("451 SMTP service not available\r\n");
2031 /* Deal with any IP options that are set. On the systems I have looked at,
2032 the value of MAX_IPOPTLEN has been 40, meaning that there should never be
2033 more logging data than will fit in big_buffer. Nevertheless, after somebody
2034 questioned this code, I've added in some paranoid checking. */
2036 else if (optlen
> 0)
2038 uschar
*p
= big_buffer
;
2039 uschar
*pend
= big_buffer
+ big_buffer_size
;
2040 uschar
*opt
, *adptr
;
2042 struct in_addr addr
;
2045 uschar
*optstart
= (uschar
*)(ipopt
->__data
);
2047 uschar
*optstart
= (uschar
*)(ipopt
->ip_opts
);
2049 uschar
*optstart
= (uschar
*)(ipopt
->ipopt_list
);
2052 DEBUG(D_receive
) debug_printf("IP options exist\n");
2054 Ustrcpy(p
, "IP options on incoming call:");
2057 for (opt
= optstart
; opt
!= NULL
&&
2058 opt
< (uschar
*)(ipopt
) + optlen
;)
2072 if (!string_format(p
, pend
-p
, " %s [@%s",
2073 (*opt
== IPOPT_SSRR
)? "SSRR" : "LSRR",
2075 inet_ntoa(*((struct in_addr
*)(&(ipopt
->faddr
))))))
2077 inet_ntoa(ipopt
->ip_dst
)))
2079 inet_ntoa(ipopt
->ipopt_dst
)))
2087 optcount
= (opt
[1] - 3) / sizeof(struct in_addr
);
2089 while (optcount
-- > 0)
2091 memcpy(&addr
, adptr
, sizeof(addr
));
2092 if (!string_format(p
, pend
- p
- 1, "%s%s",
2093 (optcount
== 0)? ":" : "@", inet_ntoa(addr
)))
2099 adptr
+= sizeof(struct in_addr
);
2108 if (pend
- p
< 4 + 3*opt
[1]) { opt
= NULL
; break; }
2111 for (i
= 0; i
< opt
[1]; i
++)
2113 sprintf(CS p
, "%2.2x ", opt
[i
]);
2124 log_write(0, LOG_MAIN
, "%s", big_buffer
);
2126 /* Refuse any call with IP options. This is what tcpwrappers 7.5 does. */
2128 log_write(0, LOG_MAIN
|LOG_REJECT
,
2129 "connection from %s refused (IP options)", host_and_ident(FALSE
));
2131 smtp_printf("554 SMTP service not available\r\n");
2135 /* Length of options = 0 => there are no options */
2137 else DEBUG(D_receive
) debug_printf("no IP options found\n");
2139 #endif /* HAVE_IPV6 && !defined(NO_IP_OPTIONS) */
2141 /* Set keep-alive in socket options. The option is on by default. This
2142 setting is an attempt to get rid of some hanging connections that stick in
2143 read() when the remote end (usually a dialup) goes away. */
2145 if (smtp_accept_keepalive
&& !sender_host_notsocket
)
2146 ip_keepalive(fileno(smtp_out
), sender_host_address
, FALSE
);
2148 /* If the current host matches host_lookup, set the name by doing a
2149 reverse lookup. On failure, sender_host_name will be NULL and
2150 host_lookup_failed will be TRUE. This may or may not be serious - optional
2153 if (verify_check_host(&host_lookup
) == OK
)
2155 (void)host_name_lookup();
2156 host_build_sender_fullhost();
2159 /* Delay this until we have the full name, if it is looked up. */
2161 set_process_info("handling incoming connection from %s",
2162 host_and_ident(FALSE
));
2164 /* Expand smtp_receive_timeout, if needed */
2166 if (smtp_receive_timeout_s
)
2169 if ( !(exp
= expand_string(smtp_receive_timeout_s
))
2171 || (smtp_receive_timeout
= readconf_readtime(exp
, 0, FALSE
)) < 0
2173 log_write(0, LOG_MAIN
|LOG_PANIC
,
2174 "bad value for smtp_receive_timeout: '%s'", exp
? exp
: US
"");
2177 /* Start up TLS if tls_on_connect is set. This is for supporting the legacy
2178 smtps port for use with older style SSL MTAs. */
2181 if (tls_in
.on_connect
&& tls_server_start(tls_require_ciphers
) != OK
)
2185 /* Test for explicit connection rejection */
2187 if (verify_check_host(&host_reject_connection
) == OK
)
2189 log_write(L_connection_reject
, LOG_MAIN
|LOG_REJECT
, "refused connection "
2190 "from %s (host_reject_connection)", host_and_ident(FALSE
));
2191 smtp_printf("554 SMTP service not available\r\n");
2195 /* Test with TCP Wrappers if so configured. There is a problem in that
2196 hosts_ctl() returns 0 (deny) under a number of system failure circumstances,
2197 such as disks dying. In these cases, it is desirable to reject with a 4xx
2198 error instead of a 5xx error. There isn't a "right" way to detect such
2199 problems. The following kludge is used: errno is zeroed before calling
2200 hosts_ctl(). If the result is "reject", a 5xx error is given only if the
2201 value of errno is 0 or ENOENT (which happens if /etc/hosts.{allow,deny} does
2204 #ifdef USE_TCP_WRAPPERS
2206 tcp_wrappers_name
= expand_string(tcp_wrappers_daemon_name
);
2207 if (tcp_wrappers_name
== NULL
)
2209 log_write(0, LOG_MAIN
|LOG_PANIC_DIE
, "Expansion of \"%s\" "
2210 "(tcp_wrappers_name) failed: %s", string_printing(tcp_wrappers_name
),
2211 expand_string_message
);
2213 if (!hosts_ctl(tcp_wrappers_name
,
2214 (sender_host_name
== NULL
)? STRING_UNKNOWN
: CS sender_host_name
,
2215 (sender_host_address
== NULL
)? STRING_UNKNOWN
: CS sender_host_address
,
2216 (sender_ident
== NULL
)? STRING_UNKNOWN
: CS sender_ident
))
2218 if (errno
== 0 || errno
== ENOENT
)
2220 HDEBUG(D_receive
) debug_printf("tcp wrappers rejection\n");
2221 log_write(L_connection_reject
,
2222 LOG_MAIN
|LOG_REJECT
, "refused connection from %s "
2223 "(tcp wrappers)", host_and_ident(FALSE
));
2224 smtp_printf("554 SMTP service not available\r\n");
2228 int save_errno
= errno
;
2229 HDEBUG(D_receive
) debug_printf("tcp wrappers rejected with unexpected "
2230 "errno value %d\n", save_errno
);
2231 log_write(L_connection_reject
,
2232 LOG_MAIN
|LOG_REJECT
, "temporarily refused connection from %s "
2233 "(tcp wrappers errno=%d)", host_and_ident(FALSE
), save_errno
);
2234 smtp_printf("451 Temporary local problem - please try later\r\n");
2240 /* Check for reserved slots. The value of smtp_accept_count has already been
2241 incremented to include this process. */
2243 if (smtp_accept_max
> 0 &&
2244 smtp_accept_count
> smtp_accept_max
- smtp_accept_reserve
)
2246 if ((rc
= verify_check_host(&smtp_reserve_hosts
)) != OK
)
2248 log_write(L_connection_reject
,
2249 LOG_MAIN
, "temporarily refused connection from %s: not in "
2250 "reserve list: connected=%d max=%d reserve=%d%s",
2251 host_and_ident(FALSE
), smtp_accept_count
- 1, smtp_accept_max
,
2252 smtp_accept_reserve
, (rc
== DEFER
)? " (lookup deferred)" : "");
2253 smtp_printf("421 %s: Too many concurrent SMTP connections; "
2254 "please try again later\r\n", smtp_active_hostname
);
2257 reserved_host
= TRUE
;
2260 /* If a load level above which only messages from reserved hosts are
2261 accepted is set, check the load. For incoming calls via the daemon, the
2262 check is done in the superior process if there are no reserved hosts, to
2263 save a fork. In all cases, the load average will already be available
2264 in a global variable at this point. */
2266 if (smtp_load_reserve
>= 0 &&
2267 load_average
> smtp_load_reserve
&&
2269 verify_check_host(&smtp_reserve_hosts
) != OK
)
2271 log_write(L_connection_reject
,
2272 LOG_MAIN
, "temporarily refused connection from %s: not in "
2273 "reserve list and load average = %.2f", host_and_ident(FALSE
),
2274 (double)load_average
/1000.0);
2275 smtp_printf("421 %s: Too much load; please try again later\r\n",
2276 smtp_active_hostname
);
2280 /* Determine whether unqualified senders or recipients are permitted
2281 for this host. Unfortunately, we have to do this every time, in order to
2282 set the flags so that they can be inspected when considering qualifying
2283 addresses in the headers. For a site that permits no qualification, this
2284 won't take long, however. */
2286 allow_unqualified_sender
=
2287 verify_check_host(&sender_unqualified_hosts
) == OK
;
2289 allow_unqualified_recipient
=
2290 verify_check_host(&recipient_unqualified_hosts
) == OK
;
2292 /* Determine whether HELO/EHLO is required for this host. The requirement
2293 can be hard or soft. */
2295 helo_required
= verify_check_host(&helo_verify_hosts
) == OK
;
2297 helo_verify
= verify_check_host(&helo_try_verify_hosts
) == OK
;
2299 /* Determine whether this hosts is permitted to send syntactic junk
2300 after a HELO or EHLO command. */
2302 helo_accept_junk
= verify_check_host(&helo_accept_junk_hosts
) == OK
;
2305 /* For batch SMTP input we are now done. */
2307 if (smtp_batched_input
) return TRUE
;
2309 #ifdef EXPERIMENTAL_PROXY
2310 /* If valid Proxy Protocol source is connecting, set up session.
2311 * Failure will not allow any SMTP function other than QUIT. */
2312 proxy_session
= FALSE
;
2313 proxy_session_failed
= FALSE
;
2314 if (check_proxy_protocol_host())
2316 if (setup_proxy_protocol_host() == FALSE
)
2318 proxy_session_failed
= TRUE
;
2320 debug_printf("Failure to extract proxied host, only QUIT allowed\n");
2324 sender_host_name
= NULL
;
2325 (void)host_name_lookup();
2326 host_build_sender_fullhost();
2331 /* Run the ACL if it exists */
2334 if (acl_smtp_connect
!= NULL
)
2337 rc
= acl_check(ACL_WHERE_CONNECT
, NULL
, acl_smtp_connect
, &user_msg
,
2341 (void)smtp_handle_acl_fail(ACL_WHERE_CONNECT
, rc
, user_msg
, log_msg
);
2346 /* Output the initial message for a two-way SMTP connection. It may contain
2347 newlines, which then cause a multi-line response to be given. */
2349 code
= US
"220"; /* Default status code */
2350 esc
= US
""; /* Default extended status code */
2351 esclen
= 0; /* Length of esc */
2353 if (user_msg
== NULL
)
2355 s
= expand_string(smtp_banner
);
2357 log_write(0, LOG_MAIN
|LOG_PANIC_DIE
, "Expansion of \"%s\" (smtp_banner) "
2358 "failed: %s", smtp_banner
, expand_string_message
);
2364 smtp_message_code(&code
, &codelen
, &s
, NULL
);
2368 esclen
= codelen
- 4;
2372 /* Remove any terminating newlines; might as well remove trailing space too */
2375 while (p
> s
&& isspace(p
[-1])) p
--;
2378 /* It seems that CC:Mail is braindead, and assumes that the greeting message
2379 is all contained in a single IP packet. The original code wrote out the
2380 greeting using several calls to fprint/fputc, and on busy servers this could
2381 cause it to be split over more than one packet - which caused CC:Mail to fall
2382 over when it got the second part of the greeting after sending its first
2383 command. Sigh. To try to avoid this, build the complete greeting message
2384 first, and output it in one fell swoop. This gives a better chance of it
2385 ending up as a single packet. */
2387 ss
= store_get(size
);
2391 do /* At least once, in case we have an empty string */
2394 uschar
*linebreak
= Ustrchr(p
, '\n');
2395 ss
= string_cat(ss
, &size
, &ptr
, code
, 3);
2396 if (linebreak
== NULL
)
2399 ss
= string_cat(ss
, &size
, &ptr
, US
" ", 1);
2403 len
= linebreak
- p
;
2404 ss
= string_cat(ss
, &size
, &ptr
, US
"-", 1);
2406 ss
= string_cat(ss
, &size
, &ptr
, esc
, esclen
);
2407 ss
= string_cat(ss
, &size
, &ptr
, p
, len
);
2408 ss
= string_cat(ss
, &size
, &ptr
, US
"\r\n", 2);
2410 if (linebreak
!= NULL
) p
++;
2414 ss
[ptr
] = 0; /* string_cat leaves room for this */
2416 /* Before we write the banner, check that there is no input pending, unless
2417 this synchronisation check is disabled. */
2421 log_write(0, LOG_MAIN
|LOG_REJECT
, "SMTP protocol "
2422 "synchronization error (input sent without waiting for greeting): "
2423 "rejected connection from %s input=\"%s\"", host_and_ident(TRUE
),
2424 string_printing(smtp_inptr
));
2425 smtp_printf("554 SMTP synchronization error\r\n");
2429 /* Now output the banner */
2431 smtp_printf("%s", ss
);
2439 /*************************************************
2440 * Handle SMTP syntax and protocol errors *
2441 *************************************************/
2443 /* Write to the log for SMTP syntax errors in incoming commands, if configured
2444 to do so. Then transmit the error response. The return value depends on the
2445 number of syntax and protocol errors in this SMTP session.
2448 type error type, given as a log flag bit
2449 code response code; <= 0 means don't send a response
2450 data data to reflect in the response (can be NULL)
2451 errmess the error message
2453 Returns: -1 limit of syntax/protocol errors NOT exceeded
2454 +1 limit of syntax/protocol errors IS exceeded
2456 These values fit in with the values of the "done" variable in the main
2457 processing loop in smtp_setup_msg(). */
2460 synprot_error(int type
, int code
, uschar
*data
, uschar
*errmess
)
2464 log_write(type
, LOG_MAIN
, "SMTP %s error in \"%s\" %s %s",
2465 (type
== L_smtp_syntax_error
)? "syntax" : "protocol",
2466 string_printing(smtp_cmd_buffer
), host_and_ident(TRUE
), errmess
);
2468 if (++synprot_error_count
> smtp_max_synprot_errors
)
2471 log_write(0, LOG_MAIN
|LOG_REJECT
, "SMTP call from %s dropped: too many "
2472 "syntax or protocol errors (last command was \"%s\")",
2473 host_and_ident(FALSE
), string_printing(smtp_cmd_buffer
));
2478 smtp_printf("%d%c%s%s%s\r\n", code
, (yield
== 1)? '-' : ' ',
2479 (data
== NULL
)? US
"" : data
, (data
== NULL
)? US
"" : US
": ", errmess
);
2481 smtp_printf("%d Too many syntax or protocol errors\r\n", code
);
2490 /*************************************************
2491 * Log incomplete transactions *
2492 *************************************************/
2494 /* This function is called after a transaction has been aborted by RSET, QUIT,
2495 connection drops or other errors. It logs the envelope information received
2496 so far in order to preserve address verification attempts.
2498 Argument: string to indicate what aborted the transaction
2503 incomplete_transaction_log(uschar
*what
)
2505 if (sender_address
== NULL
|| /* No transaction in progress */
2506 (log_write_selector
& L_smtp_incomplete_transaction
) == 0 /* Not logging */
2509 /* Build list of recipients for logging */
2511 if (recipients_count
> 0)
2514 raw_recipients
= store_get(recipients_count
* sizeof(uschar
*));
2515 for (i
= 0; i
< recipients_count
; i
++)
2516 raw_recipients
[i
] = recipients_list
[i
].address
;
2517 raw_recipients_count
= recipients_count
;
2520 log_write(L_smtp_incomplete_transaction
, LOG_MAIN
|LOG_SENDER
|LOG_RECIPIENTS
,
2521 "%s incomplete transaction (%s)", host_and_ident(TRUE
), what
);
2527 /*************************************************
2528 * Send SMTP response, possibly multiline *
2529 *************************************************/
2531 /* There are, it seems, broken clients out there that cannot handle multiline
2532 responses. If no_multiline_responses is TRUE (it can be set from an ACL), we
2533 output nothing for non-final calls, and only the first line for anything else.
2536 code SMTP code, may involve extended status codes
2537 codelen length of smtp code; if > 4 there's an ESC
2538 final FALSE if the last line isn't the final line
2539 msg message text, possibly containing newlines
2545 smtp_respond(uschar
* code
, int codelen
, BOOL final
, uschar
*msg
)
2550 if (!final
&& no_multiline_responses
) return;
2555 esclen
= codelen
- 4;
2558 /* If this is the first output for a (non-batch) RCPT command, see if all RCPTs
2559 have had the same. Note: this code is also present in smtp_printf(). It would
2560 be tidier to have it only in one place, but when it was added, it was easier to
2561 do it that way, so as not to have to mess with the code for the RCPT command,
2562 which sometimes uses smtp_printf() and sometimes smtp_respond(). */
2564 if (rcpt_in_progress
)
2566 if (rcpt_smtp_response
== NULL
)
2567 rcpt_smtp_response
= string_copy(msg
);
2568 else if (rcpt_smtp_response_same
&&
2569 Ustrcmp(rcpt_smtp_response
, msg
) != 0)
2570 rcpt_smtp_response_same
= FALSE
;
2571 rcpt_in_progress
= FALSE
;
2574 /* Not output the message, splitting it up into multiple lines if necessary. */
2578 uschar
*nl
= Ustrchr(msg
, '\n');
2581 smtp_printf("%.3s%c%.*s%s\r\n", code
, final
? ' ':'-', esclen
, esc
, msg
);
2584 else if (nl
[1] == 0 || no_multiline_responses
)
2586 smtp_printf("%.3s%c%.*s%.*s\r\n", code
, final
? ' ':'-', esclen
, esc
,
2587 (int)(nl
- msg
), msg
);
2592 smtp_printf("%.3s-%.*s%.*s\r\n", code
, esclen
, esc
, (int)(nl
- msg
), msg
);
2594 while (isspace(*msg
)) msg
++;
2602 /*************************************************
2603 * Parse user SMTP message *
2604 *************************************************/
2606 /* This function allows for user messages overriding the response code details
2607 by providing a suitable response code string at the start of the message
2608 user_msg. Check the message for starting with a response code and optionally an
2609 extended status code. If found, check that the first digit is valid, and if so,
2610 change the code pointer and length to use the replacement. An invalid code
2611 causes a panic log; in this case, if the log messages is the same as the user
2612 message, we must also adjust the value of the log message to show the code that
2613 is actually going to be used (the original one).
2615 This function is global because it is called from receive.c as well as within
2618 Note that the code length returned includes the terminating whitespace
2619 character, which is always included in the regex match.
2622 code SMTP code, may involve extended status codes
2623 codelen length of smtp code; if > 4 there's an ESC
2625 log_msg optional log message, to be adjusted with the new SMTP code
2631 smtp_message_code(uschar
**code
, int *codelen
, uschar
**msg
, uschar
**log_msg
)
2636 if (msg
== NULL
|| *msg
== NULL
) return;
2638 n
= pcre_exec(regex_smtp_code
, NULL
, CS
*msg
, Ustrlen(*msg
), 0,
2639 PCRE_EOPT
, ovector
, sizeof(ovector
)/sizeof(int));
2642 if ((*msg
)[0] != (*code
)[0])
2644 log_write(0, LOG_MAIN
|LOG_PANIC
, "configured error code starts with "
2645 "incorrect digit (expected %c) in \"%s\"", (*code
)[0], *msg
);
2646 if (log_msg
!= NULL
&& *log_msg
== *msg
)
2647 *log_msg
= string_sprintf("%s %s", *code
, *log_msg
+ ovector
[1]);
2652 *codelen
= ovector
[1]; /* Includes final space */
2654 *msg
+= ovector
[1]; /* Chop the code off the message */
2661 /*************************************************
2662 * Handle an ACL failure *
2663 *************************************************/
2665 /* This function is called when acl_check() fails. As well as calls from within
2666 this module, it is called from receive.c for an ACL after DATA. It sorts out
2667 logging the incident, and sets up the error response. A message containing
2668 newlines is turned into a multiline SMTP response, but for logging, only the
2671 There's a table of default permanent failure response codes to use in
2672 globals.c, along with the table of names. VFRY is special. Despite RFC1123 it
2673 defaults disabled in Exim. However, discussion in connection with RFC 821bis
2674 (aka RFC 2821) has concluded that the response should be 252 in the disabled
2675 state, because there are broken clients that try VRFY before RCPT. A 5xx
2676 response should be given only when the address is positively known to be
2677 undeliverable. Sigh. Also, for ETRN, 458 is given on refusal, and for AUTH,
2680 From Exim 4.63, it is possible to override the response code details by
2681 providing a suitable response code string at the start of the message provided
2682 in user_msg. The code's first digit is checked for validity.
2685 where where the ACL was called from
2687 user_msg a message that can be included in an SMTP response
2688 log_msg a message for logging
2690 Returns: 0 in most cases
2691 2 if the failure code was FAIL_DROP, in which case the
2692 SMTP connection should be dropped (this value fits with the
2693 "done" variable in smtp_setup_msg() below)
2697 smtp_handle_acl_fail(int where
, int rc
, uschar
*user_msg
, uschar
*log_msg
)
2699 BOOL drop
= rc
== FAIL_DROP
;
2703 uschar
*sender_info
= US
"";
2705 #ifdef WITH_CONTENT_SCAN
2706 (where
== ACL_WHERE_MIME
)? US
"during MIME ACL checks" :
2708 (where
== ACL_WHERE_PREDATA
)? US
"DATA" :
2709 (where
== ACL_WHERE_DATA
)? US
"after DATA" :
2710 #ifndef DISABLE_PRDR
2711 (where
== ACL_WHERE_PRDR
)? US
"after DATA PRDR" :
2713 (smtp_cmd_data
== NULL
)?
2714 string_sprintf("%s in \"connect\" ACL", acl_wherenames
[where
]) :
2715 string_sprintf("%s %s", acl_wherenames
[where
], smtp_cmd_data
);
2717 if (drop
) rc
= FAIL
;
2719 /* Set the default SMTP code, and allow a user message to change it. */
2721 smtp_code
= (rc
!= FAIL
)? US
"451" : acl_wherecodes
[where
];
2722 smtp_message_code(&smtp_code
, &codelen
, &user_msg
, &log_msg
);
2724 /* We used to have sender_address here; however, there was a bug that was not
2725 updating sender_address after a rewrite during a verify. When this bug was
2726 fixed, sender_address at this point became the rewritten address. I'm not sure
2727 this is what should be logged, so I've changed to logging the unrewritten
2728 address to retain backward compatibility. */
2730 #ifndef WITH_CONTENT_SCAN
2731 if (where
== ACL_WHERE_RCPT
|| where
== ACL_WHERE_DATA
)
2733 if (where
== ACL_WHERE_RCPT
|| where
== ACL_WHERE_DATA
|| where
== ACL_WHERE_MIME
)
2736 sender_info
= string_sprintf("F=<%s>%s%s%s%s ",
2737 sender_address_unrewritten
? sender_address_unrewritten
: sender_address
,
2738 sender_host_authenticated
? US
" A=" : US
"",
2739 sender_host_authenticated
? sender_host_authenticated
: US
"",
2740 sender_host_authenticated
&& authenticated_id
? US
":" : US
"",
2741 sender_host_authenticated
&& authenticated_id
? authenticated_id
: US
""
2745 /* If there's been a sender verification failure with a specific message, and
2746 we have not sent a response about it yet, do so now, as a preliminary line for
2747 failures, but not defers. However, always log it for defer, and log it for fail
2748 unless the sender_verify_fail log selector has been turned off. */
2750 if (sender_verified_failed
!= NULL
&&
2751 !testflag(sender_verified_failed
, af_sverify_told
))
2753 BOOL save_rcpt_in_progress
= rcpt_in_progress
;
2754 rcpt_in_progress
= FALSE
; /* So as not to treat these as the error */
2756 setflag(sender_verified_failed
, af_sverify_told
);
2758 if (rc
!= FAIL
|| (log_extra_selector
& LX_sender_verify_fail
) != 0)
2759 log_write(0, LOG_MAIN
|LOG_REJECT
, "%s sender verify %s for <%s>%s",
2760 host_and_ident(TRUE
),
2761 ((sender_verified_failed
->special_action
& 255) == DEFER
)? "defer":"fail",
2762 sender_verified_failed
->address
,
2763 (sender_verified_failed
->message
== NULL
)? US
"" :
2764 string_sprintf(": %s", sender_verified_failed
->message
));
2766 if (rc
== FAIL
&& sender_verified_failed
->user_message
!= NULL
)
2767 smtp_respond(smtp_code
, codelen
, FALSE
, string_sprintf(
2768 testflag(sender_verified_failed
, af_verify_pmfail
)?
2769 "Postmaster verification failed while checking <%s>\n%s\n"
2770 "Several RFCs state that you are required to have a postmaster\n"
2771 "mailbox for each mail domain. This host does not accept mail\n"
2772 "from domains whose servers reject the postmaster address."
2774 testflag(sender_verified_failed
, af_verify_nsfail
)?
2775 "Callback setup failed while verifying <%s>\n%s\n"
2776 "The initial connection, or a HELO or MAIL FROM:<> command was\n"
2777 "rejected. Refusing MAIL FROM:<> does not help fight spam, disregards\n"
2778 "RFC requirements, and stops you from receiving standard bounce\n"
2779 "messages. This host does not accept mail from domains whose servers\n"
2782 "Verification failed for <%s>\n%s",
2783 sender_verified_failed
->address
,
2784 sender_verified_failed
->user_message
));
2786 rcpt_in_progress
= save_rcpt_in_progress
;
2789 /* Sort out text for logging */
2791 log_msg
= (log_msg
== NULL
)? US
"" : string_sprintf(": %s", log_msg
);
2792 lognl
= Ustrchr(log_msg
, '\n');
2793 if (lognl
!= NULL
) *lognl
= 0;
2795 /* Send permanent failure response to the command, but the code used isn't
2796 always a 5xx one - see comments at the start of this function. If the original
2797 rc was FAIL_DROP we drop the connection and yield 2. */
2799 if (rc
== FAIL
) smtp_respond(smtp_code
, codelen
, TRUE
, (user_msg
== NULL
)?
2800 US
"Administrative prohibition" : user_msg
);
2802 /* Send temporary failure response to the command. Don't give any details,
2803 unless acl_temp_details is set. This is TRUE for a callout defer, a "defer"
2804 verb, and for a header verify when smtp_return_error_details is set.
2806 This conditional logic is all somewhat of a mess because of the odd
2807 interactions between temp_details and return_error_details. One day it should
2808 be re-implemented in a tidier fashion. */
2812 if (acl_temp_details
&& user_msg
!= NULL
)
2814 if (smtp_return_error_details
&&
2815 sender_verified_failed
!= NULL
&&
2816 sender_verified_failed
->message
!= NULL
)
2818 smtp_respond(smtp_code
, codelen
, FALSE
, sender_verified_failed
->message
);
2820 smtp_respond(smtp_code
, codelen
, TRUE
, user_msg
);
2823 smtp_respond(smtp_code
, codelen
, TRUE
,
2824 US
"Temporary local problem - please try later");
2827 /* Log the incident to the logs that are specified by log_reject_target
2828 (default main, reject). This can be empty to suppress logging of rejections. If
2829 the connection is not forcibly to be dropped, return 0. Otherwise, log why it
2830 is closing if required and return 2. */
2832 if (log_reject_target
!= 0)
2835 uschar
* s
= s_tlslog(NULL
, NULL
, NULL
);
2840 log_write(0, log_reject_target
, "%s%s %s%srejected %s%s",
2841 host_and_ident(TRUE
), s
,
2842 sender_info
, (rc
== FAIL
)? US
"" : US
"temporarily ", what
, log_msg
);
2845 if (!drop
) return 0;
2847 log_write(L_smtp_connection
, LOG_MAIN
, "%s closed by DROP in ACL",
2848 smtp_get_connection_info());
2850 /* Run the not-quit ACL, but without any custom messages. This should not be a
2851 problem, because we get here only if some other ACL has issued "drop", and
2852 in that case, *its* custom messages will have been used above. */
2854 smtp_notquit_exit(US
"acl-drop", NULL
, NULL
);
2861 /*************************************************
2862 * Handle SMTP exit when QUIT is not given *
2863 *************************************************/
2865 /* This function provides a logging/statistics hook for when an SMTP connection
2866 is dropped on the floor or the other end goes away. It's a global function
2867 because it's called from receive.c as well as this module. As well as running
2868 the NOTQUIT ACL, if there is one, this function also outputs a final SMTP
2869 response, either with a custom message from the ACL, or using a default. There
2870 is one case, however, when no message is output - after "drop". In that case,
2871 the ACL that obeyed "drop" has already supplied the custom message, and NULL is
2872 passed to this function.
2874 In case things go wrong while processing this function, causing an error that
2875 may re-enter this funtion, there is a recursion check.
2878 reason What $smtp_notquit_reason will be set to in the ACL;
2879 if NULL, the ACL is not run
2880 code The error code to return as part of the response
2881 defaultrespond The default message if there's no user_msg
2887 smtp_notquit_exit(uschar
*reason
, uschar
*code
, uschar
*defaultrespond
, ...)
2890 uschar
*user_msg
= NULL
;
2891 uschar
*log_msg
= NULL
;
2893 /* Check for recursive acll */
2895 if (smtp_exit_function_called
)
2897 log_write(0, LOG_PANIC
, "smtp_notquit_exit() called more than once (%s)",
2901 smtp_exit_function_called
= TRUE
;
2903 /* Call the not-QUIT ACL, if there is one, unless no reason is given. */
2905 if (acl_smtp_notquit
!= NULL
&& reason
!= NULL
)
2907 smtp_notquit_reason
= reason
;
2908 rc
= acl_check(ACL_WHERE_NOTQUIT
, NULL
, acl_smtp_notquit
, &user_msg
,
2911 log_write(0, LOG_MAIN
|LOG_PANIC
, "ACL for not-QUIT returned ERROR: %s",
2915 /* Write an SMTP response if we are expected to give one. As the default
2916 responses are all internal, they should always fit in the buffer, but code a
2917 warning, just in case. Note that string_vformat() still leaves a complete
2918 string, even if it is incomplete. */
2920 if (code
!= NULL
&& defaultrespond
!= NULL
)
2922 if (user_msg
== NULL
)
2926 va_start(ap
, defaultrespond
);
2927 if (!string_vformat(buffer
, sizeof(buffer
), CS defaultrespond
, ap
))
2928 log_write(0, LOG_MAIN
|LOG_PANIC
, "string too large in smtp_notquit_exit()");
2929 smtp_printf("%s %s\r\n", code
, buffer
);
2933 smtp_respond(code
, 3, TRUE
, user_msg
);
2941 /*************************************************
2942 * Verify HELO argument *
2943 *************************************************/
2945 /* This function is called if helo_verify_hosts or helo_try_verify_hosts is
2946 matched. It is also called from ACL processing if verify = helo is used and
2947 verification was not previously tried (i.e. helo_try_verify_hosts was not
2948 matched). The result of its processing is to set helo_verified and
2949 helo_verify_failed. These variables should both be FALSE for this function to
2952 Note that EHLO/HELO is legitimately allowed to quote an address literal. Allow
2953 for IPv6 ::ffff: literals.
2956 Returns: TRUE if testing was completed;
2957 FALSE on a temporary failure
2961 smtp_verify_helo(void)
2965 HDEBUG(D_receive
) debug_printf("verifying EHLO/HELO argument \"%s\"\n",
2968 if (sender_helo_name
== NULL
)
2970 HDEBUG(D_receive
) debug_printf("no EHLO/HELO command was issued\n");
2973 /* Deal with the case of -bs without an IP address */
2975 else if (sender_host_address
== NULL
)
2977 HDEBUG(D_receive
) debug_printf("no client IP address: assume success\n");
2978 helo_verified
= TRUE
;
2981 /* Deal with the more common case when there is a sending IP address */
2983 else if (sender_helo_name
[0] == '[')
2985 helo_verified
= Ustrncmp(sender_helo_name
+1, sender_host_address
,
2986 Ustrlen(sender_host_address
)) == 0;
2991 if (strncmpic(sender_host_address
, US
"::ffff:", 7) == 0)
2992 helo_verified
= Ustrncmp(sender_helo_name
+ 1,
2993 sender_host_address
+ 7, Ustrlen(sender_host_address
) - 7) == 0;
2998 { if (helo_verified
) debug_printf("matched host address\n"); }
3001 /* Do a reverse lookup if one hasn't already given a positive or negative
3002 response. If that fails, or the name doesn't match, try checking with a forward
3007 if (sender_host_name
== NULL
&& !host_lookup_failed
)
3008 yield
= host_name_lookup() != DEFER
;
3010 /* If a host name is known, check it and all its aliases. */
3012 if (sender_host_name
)
3013 if ((helo_verified
= strcmpic(sender_host_name
, sender_helo_name
) == 0))
3015 sender_helo_dnssec
= sender_host_dnssec
;
3016 HDEBUG(D_receive
) debug_printf("matched host name\n");
3020 uschar
**aliases
= sender_host_aliases
;
3022 if ((helo_verified
= strcmpic(*aliases
++, sender_helo_name
) == 0))
3024 sender_helo_dnssec
= sender_host_dnssec
;
3028 HDEBUG(D_receive
) if (helo_verified
)
3029 debug_printf("matched alias %s\n", *(--aliases
));
3032 /* Final attempt: try a forward lookup of the helo name */
3041 h
.name
= sender_helo_name
;
3048 HDEBUG(D_receive
) debug_printf("getting IP address for %s\n",
3050 rc
= host_find_bydns(&h
, NULL
, HOST_FIND_BY_A
,
3051 NULL
, NULL
, NULL
, &d
, NULL
, NULL
);
3052 if (rc
== HOST_FOUND
|| rc
== HOST_FOUND_LOCAL
)
3053 for (hh
= &h
; hh
; hh
= hh
->next
)
3054 if (Ustrcmp(hh
->address
, sender_host_address
) == 0)
3056 helo_verified
= TRUE
;
3057 if (h
.dnssec
== DS_YES
) sender_helo_dnssec
= TRUE
;
3060 debug_printf("IP address for %s matches calling address\n"
3061 "Forward DNS security status: %sverified\n",
3062 sender_helo_name
, sender_helo_dnssec
? "" : "un");
3069 if (!helo_verified
) helo_verify_failed
= TRUE
; /* We've tried ... */
3076 /*************************************************
3077 * Send user response message *
3078 *************************************************/
3080 /* This function is passed a default response code and a user message. It calls
3081 smtp_message_code() to check and possibly modify the response code, and then
3082 calls smtp_respond() to transmit the response. I put this into a function
3083 just to avoid a lot of repetition.
3086 code the response code
3087 user_msg the user message
3093 smtp_user_msg(uschar
*code
, uschar
*user_msg
)
3096 smtp_message_code(&code
, &len
, &user_msg
, NULL
);
3097 smtp_respond(code
, len
, TRUE
, user_msg
);
3103 smtp_in_auth(auth_instance
*au
, uschar
** s
, uschar
** ss
)
3105 const uschar
*set_id
= NULL
;
3108 /* Run the checking code, passing the remainder of the command line as
3109 data. Initials the $auth<n> variables as empty. Initialize $0 empty and set
3110 it as the only set numerical variable. The authenticator may set $auth<n>
3111 and also set other numeric variables. The $auth<n> variables are preferred
3112 nowadays; the numerical variables remain for backwards compatibility.
3114 Afterwards, have a go at expanding the set_id string, even if
3115 authentication failed - for bad passwords it can be useful to log the
3116 userid. On success, require set_id to expand and exist, and put it in
3117 authenticated_id. Save this in permanent store, as the working store gets
3118 reset at HELO, RSET, etc. */
3120 for (i
= 0; i
< AUTH_VARS
; i
++) auth_vars
[i
] = NULL
;
3122 expand_nlength
[0] = 0; /* $0 contains nothing */
3124 rc
= (au
->info
->servercode
)(au
, smtp_cmd_data
);
3125 if (au
->set_id
) set_id
= expand_string(au
->set_id
);
3126 expand_nmax
= -1; /* Reset numeric variables */
3127 for (i
= 0; i
< AUTH_VARS
; i
++) auth_vars
[i
] = NULL
; /* Reset $auth<n> */
3129 /* The value of authenticated_id is stored in the spool file and printed in
3130 log lines. It must not contain binary zeros or newline characters. In
3131 normal use, it never will, but when playing around or testing, this error
3132 can (did) happen. To guard against this, ensure that the id contains only
3133 printing characters. */
3135 if (set_id
) set_id
= string_printing(set_id
);
3137 /* For the non-OK cases, set up additional logging data if set_id
3141 set_id
= set_id
&& *set_id
3142 ? string_sprintf(" (set_id=%s)", set_id
) : US
"";
3144 /* Switch on the result */
3149 if (!au
->set_id
|| set_id
) /* Complete success */
3151 if (set_id
) authenticated_id
= string_copy_malloc(set_id
);
3152 sender_host_authenticated
= au
->name
;
3153 authentication_failed
= FALSE
;
3154 authenticated_fail_id
= NULL
; /* Impossible to already be set? */
3157 (sender_host_address
? protocols
: protocols_local
)
3158 [pextend
+ pauthed
+ (tls_in
.active
>= 0 ? pcrpted
:0)];
3159 *s
= *ss
= US
"235 Authentication succeeded";
3160 authenticated_by
= au
;
3164 /* Authentication succeeded, but we failed to expand the set_id string.
3165 Treat this as a temporary error. */
3167 auth_defer_msg
= expand_string_message
;
3171 if (set_id
) authenticated_fail_id
= string_copy_malloc(set_id
);
3172 *s
= string_sprintf("435 Unable to authenticate at present%s",
3173 auth_defer_user_msg
);
3174 *ss
= string_sprintf("435 Unable to authenticate at present%s: %s",
3175 set_id
, auth_defer_msg
);
3179 *s
= *ss
= US
"501 Invalid base64 data";
3183 *s
= *ss
= US
"501 Authentication cancelled";
3187 *s
= *ss
= US
"553 Initial data not expected";
3191 if (set_id
) authenticated_fail_id
= string_copy_malloc(set_id
);
3192 *s
= US
"535 Incorrect authentication data";
3193 *ss
= string_sprintf("535 Incorrect authentication data%s", set_id
);
3197 if (set_id
) authenticated_fail_id
= string_copy_malloc(set_id
);
3198 *s
= US
"435 Internal error";
3199 *ss
= string_sprintf("435 Internal error%s: return %d from authentication "
3200 "check", set_id
, rc
);
3209 /*************************************************
3210 * Initialize for SMTP incoming message *
3211 *************************************************/
3213 /* This function conducts the initial dialogue at the start of an incoming SMTP
3214 message, and builds a list of recipients. However, if the incoming message
3215 is part of a batch (-bS option) a separate function is called since it would
3216 be messy having tests splattered about all over this function. This function
3217 therefore handles the case where interaction is occurring. The input and output
3218 files are set up in smtp_in and smtp_out.
3220 The global recipients_list is set to point to a vector of recipient_item
3221 blocks, whose number is given by recipients_count. This is extended by the
3222 receive_add_recipient() function. The global variable sender_address is set to
3223 the sender's address. The yield is +1 if a message has been successfully
3224 started, 0 if a QUIT command was encountered or the connection was refused from
3225 the particular host, or -1 if the connection was lost.
3229 Returns: > 0 message successfully started (reached DATA)
3230 = 0 QUIT read or end of file reached or call refused
3235 smtp_setup_msg(void)
3238 BOOL toomany
= FALSE
;
3239 BOOL discarded
= FALSE
;
3240 BOOL last_was_rej_mail
= FALSE
;
3241 BOOL last_was_rcpt
= FALSE
;
3242 void *reset_point
= store_get(0);
3244 DEBUG(D_receive
) debug_printf("smtp_setup_msg entered\n");
3246 /* Reset for start of new message. We allow one RSET not to be counted as a
3247 nonmail command, for those MTAs that insist on sending it between every
3248 message. Ditto for EHLO/HELO and for STARTTLS, to allow for going in and out of
3249 TLS between messages (an Exim client may do this if it has messages queued up
3250 for the host). Note: we do NOT reset AUTH at this point. */
3252 smtp_reset(reset_point
);
3253 message_ended
= END_NOTSTARTED
;
3255 cmd_list
[CMD_LIST_RSET
].is_mail_cmd
= TRUE
;
3256 cmd_list
[CMD_LIST_HELO
].is_mail_cmd
= TRUE
;
3257 cmd_list
[CMD_LIST_EHLO
].is_mail_cmd
= TRUE
;
3259 cmd_list
[CMD_LIST_STARTTLS
].is_mail_cmd
= TRUE
;
3260 cmd_list
[CMD_LIST_TLS_AUTH
].is_mail_cmd
= TRUE
;
3263 /* Set the local signal handler for SIGTERM - it tries to end off tidily */
3265 os_non_restarting_signal(SIGTERM
, command_sigterm_handler
);
3267 /* Batched SMTP is handled in a different function. */
3269 if (smtp_batched_input
) return smtp_setup_batch_msg();
3271 /* Deal with SMTP commands. This loop is exited by setting done to a POSITIVE
3272 value. The values are 2 larger than the required yield of the function. */
3276 const uschar
**argv
;
3277 uschar
*etrn_command
;
3278 uschar
*etrn_serialize_key
;
3280 uschar
*log_msg
, *smtp_code
;
3281 uschar
*user_msg
= NULL
;
3282 uschar
*recipient
= NULL
;
3283 uschar
*hello
= NULL
;
3285 BOOL was_rej_mail
= FALSE
;
3286 BOOL was_rcpt
= FALSE
;
3287 void (*oldsignal
)(int);
3289 int start
, end
, sender_domain
, recipient_domain
;
3293 uschar
*orcpt
= NULL
;
3296 #if defined(SUPPORT_TLS) && defined(AUTH_TLS)
3297 /* Check once per STARTTLS or SSL-on-connect for a TLS AUTH */
3298 if ( tls_in
.active
>= 0
3300 && tls_in
.certificate_verified
3301 && cmd_list
[CMD_LIST_TLS_AUTH
].is_mail_cmd
3304 cmd_list
[CMD_LIST_TLS_AUTH
].is_mail_cmd
= FALSE
;
3307 rc
= acl_check(ACL_WHERE_AUTH
, NULL
, acl_smtp_auth
, &user_msg
, &log_msg
);
3310 done
= smtp_handle_acl_fail(ACL_WHERE_AUTH
, rc
, user_msg
, log_msg
);
3315 for (au
= auths
; au
; au
= au
->next
)
3316 if (strcmpic(US
"tls", au
->driver_name
) == 0)
3318 smtp_cmd_data
= NULL
;
3320 if ((c
= smtp_in_auth(au
, &s
, &ss
)) != OK
)
3321 log_write(0, LOG_MAIN
|LOG_REJECT
, "%s authenticator failed for %s: %s",
3322 au
->name
, host_and_ident(FALSE
), ss
);
3324 DEBUG(D_auth
) debug_printf("tls auth succeeded\n");
3331 switch(smtp_read_command(TRUE
))
3333 /* The AUTH command is not permitted to occur inside a transaction, and may
3334 occur successfully only once per connection. Actually, that isn't quite
3335 true. When TLS is started, all previous information about a connection must
3336 be discarded, so a new AUTH is permitted at that time.
3338 AUTH may only be used when it has been advertised. However, it seems that
3339 there are clients that send AUTH when it hasn't been advertised, some of
3340 them even doing this after HELO. And there are MTAs that accept this. Sigh.
3341 So there's a get-out that allows this to happen.
3343 AUTH is initially labelled as a "nonmail command" so that one occurrence
3344 doesn't get counted. We change the label here so that multiple failing
3345 AUTHS will eventually hit the nonmail threshold. */
3349 authentication_failed
= TRUE
;
3350 cmd_list
[CMD_LIST_AUTH
].is_mail_cmd
= FALSE
;
3352 if (!auth_advertised
&& !allow_auth_unadvertised
)
3354 done
= synprot_error(L_smtp_protocol_error
, 503, NULL
,
3355 US
"AUTH command used when not advertised");
3358 if (sender_host_authenticated
)
3360 done
= synprot_error(L_smtp_protocol_error
, 503, NULL
,
3361 US
"already authenticated");
3366 done
= synprot_error(L_smtp_protocol_error
, 503, NULL
,
3367 US
"not permitted in mail transaction");
3375 rc
= acl_check(ACL_WHERE_AUTH
, NULL
, acl_smtp_auth
, &user_msg
, &log_msg
);
3378 done
= smtp_handle_acl_fail(ACL_WHERE_AUTH
, rc
, user_msg
, log_msg
);
3383 /* Find the name of the requested authentication mechanism. */
3386 while ((c
= *smtp_cmd_data
) != 0 && !isspace(c
))
3388 if (!isalnum(c
) && c
!= '-' && c
!= '_')
3390 done
= synprot_error(L_smtp_syntax_error
, 501, NULL
,
3391 US
"invalid character in authentication mechanism name");
3397 /* If not at the end of the line, we must be at white space. Terminate the
3398 name and move the pointer on to any data that may be present. */
3400 if (*smtp_cmd_data
!= 0)
3402 *smtp_cmd_data
++ = 0;
3403 while (isspace(*smtp_cmd_data
)) smtp_cmd_data
++;
3406 /* Search for an authentication mechanism which is configured for use
3407 as a server and which has been advertised (unless, sigh, allow_auth_
3408 unadvertised is set). */
3410 for (au
= auths
; au
; au
= au
->next
)
3411 if (strcmpic(s
, au
->public_name
) == 0 && au
->server
&&
3412 (au
->advertised
|| allow_auth_unadvertised
))
3417 c
= smtp_in_auth(au
, &s
, &ss
);
3419 smtp_printf("%s\r\n", s
);
3421 log_write(0, LOG_MAIN
|LOG_REJECT
, "%s authenticator failed for %s: %s",
3422 au
->name
, host_and_ident(FALSE
), ss
);
3425 done
= synprot_error(L_smtp_protocol_error
, 504, NULL
,
3426 string_sprintf("%s authentication mechanism not supported", s
));
3428 break; /* AUTH_CMD */
3430 /* The HELO/EHLO commands are permitted to appear in the middle of a
3431 session as well as at the beginning. They have the effect of a reset in
3432 addition to their other functions. Their absence at the start cannot be
3433 taken to be an error.
3437 If the EHLO command is not acceptable to the SMTP server, 501, 500,
3438 or 502 failure replies MUST be returned as appropriate. The SMTP
3439 server MUST stay in the same state after transmitting these replies
3440 that it was in before the EHLO was received.
3442 Therefore, we do not do the reset until after checking the command for
3443 acceptability. This change was made for Exim release 4.11. Previously
3444 it did the reset first. */
3457 HELO_EHLO
: /* Common code for HELO and EHLO */
3458 cmd_list
[CMD_LIST_HELO
].is_mail_cmd
= FALSE
;
3459 cmd_list
[CMD_LIST_EHLO
].is_mail_cmd
= FALSE
;
3461 /* Reject the HELO if its argument was invalid or non-existent. A
3462 successful check causes the argument to be saved in malloc store. */
3464 if (!check_helo(smtp_cmd_data
))
3466 smtp_printf("501 Syntactically invalid %s argument(s)\r\n", hello
);
3468 log_write(0, LOG_MAIN
|LOG_REJECT
, "rejected %s from %s: syntactically "
3469 "invalid argument(s): %s", hello
, host_and_ident(FALSE
),
3470 (*smtp_cmd_argument
== 0)? US
"(no argument given)" :
3471 string_printing(smtp_cmd_argument
));
3473 if (++synprot_error_count
> smtp_max_synprot_errors
)
3475 log_write(0, LOG_MAIN
|LOG_REJECT
, "SMTP call from %s dropped: too many "
3476 "syntax or protocol errors (last command was \"%s\")",
3477 host_and_ident(FALSE
), string_printing(smtp_cmd_buffer
));
3484 /* If sender_host_unknown is true, we have got here via the -bs interface,
3485 not called from inetd. Otherwise, we are running an IP connection and the
3486 host address will be set. If the helo name is the primary name of this
3487 host and we haven't done a reverse lookup, force one now. If helo_required
3488 is set, ensure that the HELO name matches the actual host. If helo_verify
3489 is set, do the same check, but softly. */
3491 if (!sender_host_unknown
)
3493 BOOL old_helo_verified
= helo_verified
;
3494 uschar
*p
= smtp_cmd_data
;
3496 while (*p
!= 0 && !isspace(*p
)) { *p
= tolower(*p
); p
++; }
3499 /* Force a reverse lookup if HELO quoted something in helo_lookup_domains
3500 because otherwise the log can be confusing. */
3502 if (sender_host_name
== NULL
&&
3503 (deliver_domain
= sender_helo_name
, /* set $domain */
3504 match_isinlist(sender_helo_name
, CUSS
&helo_lookup_domains
, 0,
3505 &domainlist_anchor
, NULL
, MCL_DOMAIN
, TRUE
, NULL
)) == OK
)
3506 (void)host_name_lookup();
3508 /* Rebuild the fullhost info to include the HELO name (and the real name
3509 if it was looked up.) */
3511 host_build_sender_fullhost(); /* Rebuild */
3512 set_process_info("handling%s incoming connection from %s",
3513 (tls_in
.active
>= 0)? " TLS" : "", host_and_ident(FALSE
));
3515 /* Verify if configured. This doesn't give much security, but it does
3516 make some people happy to be able to do it. If helo_required is set,
3517 (host matches helo_verify_hosts) failure forces rejection. If helo_verify
3518 is set (host matches helo_try_verify_hosts), it does not. This is perhaps
3519 now obsolescent, since the verification can now be requested selectively
3522 helo_verified
= helo_verify_failed
= sender_helo_dnssec
= FALSE
;
3523 if (helo_required
|| helo_verify
)
3525 BOOL tempfail
= !smtp_verify_helo();
3530 smtp_printf("%d %s argument does not match calling host\r\n",
3531 tempfail
? 451 : 550, hello
);
3532 log_write(0, LOG_MAIN
|LOG_REJECT
, "%srejected \"%s %s\" from %s",
3533 tempfail
? "temporarily " : "",
3534 hello
, sender_helo_name
, host_and_ident(FALSE
));
3535 helo_verified
= old_helo_verified
;
3536 break; /* End of HELO/EHLO processing */
3538 HDEBUG(D_all
) debug_printf("%s verification failed but host is in "
3539 "helo_try_verify_hosts\n", hello
);
3544 #ifdef EXPERIMENTAL_SPF
3545 /* set up SPF context */
3546 spf_init(sender_helo_name
, sender_host_address
);
3549 /* Apply an ACL check if one is defined; afterwards, recheck
3550 synchronization in case the client started sending in a delay. */
3552 if (acl_smtp_helo
!= NULL
)
3554 rc
= acl_check(ACL_WHERE_HELO
, NULL
, acl_smtp_helo
, &user_msg
, &log_msg
);
3557 done
= smtp_handle_acl_fail(ACL_WHERE_HELO
, rc
, user_msg
, log_msg
);
3558 sender_helo_name
= NULL
;
3559 host_build_sender_fullhost(); /* Rebuild */
3562 else if (!check_sync()) goto SYNC_FAILURE
;
3565 /* Generate an OK reply. The default string includes the ident if present,
3566 and also the IP address if present. Reflecting back the ident is intended
3567 as a deterrent to mail forgers. For maximum efficiency, and also because
3568 some broken systems expect each response to be in a single packet, arrange
3569 that the entire reply is sent in one write(). */
3571 auth_advertised
= FALSE
;
3572 pipelining_advertised
= FALSE
;
3574 tls_advertised
= FALSE
;
3576 dsn_advertised
= FALSE
;
3577 #ifdef EXPERIMENTAL_INTERNATIONAL
3578 smtputf8_advertised
= FALSE
;
3581 smtp_code
= US
"250 "; /* Default response code plus space*/
3582 if (user_msg
== NULL
)
3584 s
= string_sprintf("%.3s %s Hello %s%s%s",
3586 smtp_active_hostname
,
3587 (sender_ident
== NULL
)? US
"" : sender_ident
,
3588 (sender_ident
== NULL
)? US
"" : US
" at ",
3589 (sender_host_name
== NULL
)? sender_helo_name
: sender_host_name
);
3594 if (sender_host_address
!= NULL
)
3596 s
= string_cat(s
, &size
, &ptr
, US
" [", 2);
3597 s
= string_cat(s
, &size
, &ptr
, sender_host_address
,
3598 Ustrlen(sender_host_address
));
3599 s
= string_cat(s
, &size
, &ptr
, US
"]", 1);
3603 /* A user-supplied EHLO greeting may not contain more than one line. Note
3604 that the code returned by smtp_message_code() includes the terminating
3605 whitespace character. */
3611 smtp_message_code(&smtp_code
, &codelen
, &user_msg
, NULL
);
3612 s
= string_sprintf("%.*s%s", codelen
, smtp_code
, user_msg
);
3613 if ((ss
= strpbrk(CS s
, "\r\n")) != NULL
)
3615 log_write(0, LOG_MAIN
|LOG_PANIC
, "EHLO/HELO response must not contain "
3616 "newlines: message truncated: %s", string_printing(s
));
3623 s
= string_cat(s
, &size
, &ptr
, US
"\r\n", 2);
3625 /* If we received EHLO, we must create a multiline response which includes
3626 the functions supported. */
3632 /* I'm not entirely happy with this, as an MTA is supposed to check
3633 that it has enough room to accept a message of maximum size before
3634 it sends this. However, there seems little point in not sending it.
3635 The actual size check happens later at MAIL FROM time. By postponing it
3636 till then, VRFY and EXPN can be used after EHLO when space is short. */
3638 if (thismessage_size_limit
> 0)
3640 sprintf(CS big_buffer
, "%.3s-SIZE %d\r\n", smtp_code
,
3641 thismessage_size_limit
);
3642 s
= string_cat(s
, &size
, &ptr
, big_buffer
, Ustrlen(big_buffer
));
3646 s
= string_cat(s
, &size
, &ptr
, smtp_code
, 3);
3647 s
= string_cat(s
, &size
, &ptr
, US
"-SIZE\r\n", 7);
3650 /* Exim does not do protocol conversion or data conversion. It is 8-bit
3651 clean; if it has an 8-bit character in its hand, it just sends it. It
3652 cannot therefore specify 8BITMIME and remain consistent with the RFCs.
3653 However, some users want this option simply in order to stop MUAs
3654 mangling messages that contain top-bit-set characters. It is therefore
3655 provided as an option. */
3657 if (accept_8bitmime
)
3659 s
= string_cat(s
, &size
, &ptr
, smtp_code
, 3);
3660 s
= string_cat(s
, &size
, &ptr
, US
"-8BITMIME\r\n", 11);
3663 /* Advertise DSN support if configured to do so. */
3664 if (verify_check_host(&dsn_advertise_hosts
) != FAIL
)
3666 s
= string_cat(s
, &size
, &ptr
, smtp_code
, 3);
3667 s
= string_cat(s
, &size
, &ptr
, US
"-DSN\r\n", 6);
3668 dsn_advertised
= TRUE
;
3671 /* Advertise ETRN if there's an ACL checking whether a host is
3672 permitted to issue it; a check is made when any host actually tries. */
3674 if (acl_smtp_etrn
!= NULL
)
3676 s
= string_cat(s
, &size
, &ptr
, smtp_code
, 3);
3677 s
= string_cat(s
, &size
, &ptr
, US
"-ETRN\r\n", 7);
3680 /* Advertise EXPN if there's an ACL checking whether a host is
3681 permitted to issue it; a check is made when any host actually tries. */
3683 if (acl_smtp_expn
!= NULL
)
3685 s
= string_cat(s
, &size
, &ptr
, smtp_code
, 3);
3686 s
= string_cat(s
, &size
, &ptr
, US
"-EXPN\r\n", 7);
3689 /* Exim is quite happy with pipelining, so let the other end know that
3690 it is safe to use it, unless advertising is disabled. */
3692 if (pipelining_enable
&&
3693 verify_check_host(&pipelining_advertise_hosts
) == OK
)
3695 s
= string_cat(s
, &size
, &ptr
, smtp_code
, 3);
3696 s
= string_cat(s
, &size
, &ptr
, US
"-PIPELINING\r\n", 13);
3697 sync_cmd_limit
= NON_SYNC_CMD_PIPELINING
;
3698 pipelining_advertised
= TRUE
;
3702 /* If any server authentication mechanisms are configured, advertise
3703 them if the current host is in auth_advertise_hosts. The problem with
3704 advertising always is that some clients then require users to
3705 authenticate (and aren't configurable otherwise) even though it may not
3706 be necessary (e.g. if the host is in host_accept_relay).
3708 RFC 2222 states that SASL mechanism names contain only upper case
3709 letters, so output the names in upper case, though we actually recognize
3710 them in either case in the AUTH command. */
3713 #if defined(SUPPORT_TLS) && defined(AUTH_TLS)
3714 && !sender_host_authenticated
3716 && verify_check_host(&auth_advertise_hosts
) == OK
3721 for (au
= auths
; au
; au
= au
->next
)
3722 if (au
->server
&& (au
->advertise_condition
== NULL
||
3723 expand_check_condition(au
->advertise_condition
, au
->name
,
3724 US
"authenticator")))
3729 s
= string_cat(s
, &size
, &ptr
, smtp_code
, 3);
3730 s
= string_cat(s
, &size
, &ptr
, US
"-AUTH", 5);
3732 auth_advertised
= TRUE
;
3735 s
= string_cat(s
, &size
, &ptr
, US
" ", 1);
3736 s
= string_cat(s
, &size
, &ptr
, au
->public_name
,
3737 Ustrlen(au
->public_name
));
3738 while (++saveptr
< ptr
) s
[saveptr
] = toupper(s
[saveptr
]);
3739 au
->advertised
= TRUE
;
3742 au
->advertised
= FALSE
;
3744 if (!first
) s
= string_cat(s
, &size
, &ptr
, US
"\r\n", 2);
3747 /* Advertise TLS (Transport Level Security) aka SSL (Secure Socket Layer)
3748 if it has been included in the binary, and the host matches
3749 tls_advertise_hosts. We must *not* advertise if we are already in a
3750 secure connection. */
3753 if (tls_in
.active
< 0 &&
3754 verify_check_host(&tls_advertise_hosts
) != FAIL
)
3756 s
= string_cat(s
, &size
, &ptr
, smtp_code
, 3);
3757 s
= string_cat(s
, &size
, &ptr
, US
"-STARTTLS\r\n", 11);
3758 tls_advertised
= TRUE
;
3762 #ifndef DISABLE_PRDR
3763 /* Per Recipient Data Response, draft by Eric A. Hall extending RFC */
3766 s
= string_cat(s
, &size
, &ptr
, smtp_code
, 3);
3767 s
= string_cat(s
, &size
, &ptr
, US
"-PRDR\r\n", 7);
3771 #ifdef EXPERIMENTAL_INTERNATIONAL
3772 if ( accept_8bitmime
3773 && verify_check_host(&smtputf8_advertise_hosts
) != FAIL
)
3775 s
= string_cat(s
, &size
, &ptr
, smtp_code
, 3);
3776 s
= string_cat(s
, &size
, &ptr
, US
"-SMTPUTF8\r\n", 11);
3777 smtputf8_advertised
= TRUE
;
3781 /* Finish off the multiline reply with one that is always available. */
3783 s
= string_cat(s
, &size
, &ptr
, smtp_code
, 3);
3784 s
= string_cat(s
, &size
, &ptr
, US
" HELP\r\n", 7);
3787 /* Terminate the string (for debug), write it, and note that HELO/EHLO
3793 if (tls_in
.active
>= 0) (void)tls_write(TRUE
, s
, ptr
); else
3797 int i
= fwrite(s
, 1, ptr
, smtp_out
); i
= i
; /* compiler quietening */
3802 while ((cr
= Ustrchr(s
, '\r')) != NULL
) /* lose CRs */
3803 memmove(cr
, cr
+ 1, (ptr
--) - (cr
- s
));
3804 debug_printf("SMTP>> %s", s
);
3808 /* Reset the protocol and the state, abandoning any previous message. */
3810 (sender_host_address
? protocols
: protocols_local
)
3812 ? pextend
+ (sender_host_authenticated
? pauthed
: 0)
3814 + (tls_in
.active
>= 0 ? pcrpted
: 0)
3816 smtp_reset(reset_point
);
3818 break; /* HELO/EHLO */
3821 /* The MAIL command requires an address as an operand. All we do
3822 here is to parse it for syntactic correctness. The form "<>" is
3823 a special case which converts into an empty string. The start/end
3824 pointers in the original are not used further for this address, as
3825 it is the canonical extracted address which is all that is kept. */
3829 smtp_mailcmd_count
++; /* Count for limit and ratelimit */
3830 was_rej_mail
= TRUE
; /* Reset if accepted */
3831 env_mail_type_t
* mail_args
; /* Sanity check & validate args */
3833 if (helo_required
&& !helo_seen
)
3835 smtp_printf("503 HELO or EHLO required\r\n");
3836 log_write(0, LOG_MAIN
|LOG_REJECT
, "rejected MAIL from %s: no "
3837 "HELO/EHLO given", host_and_ident(FALSE
));
3841 if (sender_address
!= NULL
)
3843 done
= synprot_error(L_smtp_protocol_error
, 503, NULL
,
3844 US
"sender already given");
3848 if (smtp_cmd_data
[0] == 0)
3850 done
= synprot_error(L_smtp_protocol_error
, 501, NULL
,
3851 US
"MAIL must have an address operand");
3855 /* Check to see if the limit for messages per connection would be
3856 exceeded by accepting further messages. */
3858 if (smtp_accept_max_per_connection
> 0 &&
3859 smtp_mailcmd_count
> smtp_accept_max_per_connection
)
3861 smtp_printf("421 too many messages in this connection\r\n");
3862 log_write(0, LOG_MAIN
|LOG_REJECT
, "rejected MAIL command %s: too many "
3863 "messages in one connection", host_and_ident(TRUE
));
3867 /* Reset for start of message - even if this is going to fail, we
3868 obviously need to throw away any previous data. */
3870 smtp_reset(reset_point
);
3872 sender_data
= recipient_data
= NULL
;
3874 /* Loop, checking for ESMTP additions to the MAIL FROM command. */
3878 uschar
*name
, *value
, *end
;
3879 unsigned long int size
;
3880 BOOL arg_error
= FALSE
;
3882 if (!extract_option(&name
, &value
)) break;
3884 for (mail_args
= env_mail_type_list
;
3885 (char *)mail_args
< (char *)env_mail_type_list
+ sizeof(env_mail_type_list
);
3888 if (strcmpic(name
, mail_args
->name
) == 0)
3890 if (mail_args
->need_value
&& strcmpic(value
, US
"") == 0)
3893 switch(mail_args
->value
)
3895 /* Handle SIZE= by reading the value. We don't do the check till later,
3896 in order to be able to log the sender address on failure. */
3897 case ENV_MAIL_OPT_SIZE
:
3898 if (((size
= Ustrtoul(value
, &end
, 10)), *end
== 0))
3900 if ((size
== ULONG_MAX
&& errno
== ERANGE
) || size
> INT_MAX
)
3902 message_size
= (int)size
;
3908 /* If this session was initiated with EHLO and accept_8bitmime is set,
3909 Exim will have indicated that it supports the BODY=8BITMIME option. In
3910 fact, it does not support this according to the RFCs, in that it does not
3911 take any special action for forwarding messages containing 8-bit
3912 characters. That is why accept_8bitmime is not the default setting, but
3913 some sites want the action that is provided. We recognize both "8BITMIME"
3914 and "7BIT" as body types, but take no action. */
3915 case ENV_MAIL_OPT_BODY
:
3916 if (accept_8bitmime
) {
3917 if (strcmpic(value
, US
"8BITMIME") == 0)
3919 else if (strcmpic(value
, US
"7BIT") == 0)
3924 done
= synprot_error(L_smtp_syntax_error
, 501, NULL
,
3925 US
"invalid data for BODY");
3928 DEBUG(D_receive
) debug_printf("8BITMIME: %d\n", body_8bitmime
);
3934 /* Handle the two DSN options, but only if configured to do so (which
3935 will have caused "DSN" to be given in the EHLO response). The code itself
3936 is included only if configured in at build time. */
3938 case ENV_MAIL_OPT_RET
:
3941 /* Check if RET has already been set */
3944 synprot_error(L_smtp_syntax_error
, 501, NULL
,
3945 US
"RET can be specified once only");
3948 dsn_ret
= strcmpic(value
, US
"HDRS") == 0
3950 : strcmpic(value
, US
"FULL") == 0
3953 DEBUG(D_receive
) debug_printf("DSN_RET: %d\n", dsn_ret
);
3954 /* Check for invalid invalid value, and exit with error */
3957 synprot_error(L_smtp_syntax_error
, 501, NULL
,
3958 US
"Value for RET is invalid");
3963 case ENV_MAIL_OPT_ENVID
:
3966 /* Check if the dsn envid has been already set */
3967 if (dsn_envid
!= NULL
)
3969 synprot_error(L_smtp_syntax_error
, 501, NULL
,
3970 US
"ENVID can be specified once only");
3973 dsn_envid
= string_copy(value
);
3974 DEBUG(D_receive
) debug_printf("DSN_ENVID: %s\n", dsn_envid
);
3978 /* Handle the AUTH extension. If the value given is not "<>" and either
3979 the ACL says "yes" or there is no ACL but the sending host is
3980 authenticated, we set it up as the authenticated sender. However, if the
3981 authenticator set a condition to be tested, we ignore AUTH on MAIL unless
3982 the condition is met. The value of AUTH is an xtext, which means that +,
3983 = and cntrl chars are coded in hex; however "<>" is unaffected by this
3985 case ENV_MAIL_OPT_AUTH
:
3986 if (Ustrcmp(value
, "<>") != 0)
3991 if (auth_xtextdecode(value
, &authenticated_sender
) < 0)
3993 /* Put back terminator overrides for error message */
3996 done
= synprot_error(L_smtp_syntax_error
, 501, NULL
,
3997 US
"invalid data for AUTH");
4000 if (acl_smtp_mailauth
== NULL
)
4002 ignore_msg
= US
"client not authenticated";
4003 rc
= (sender_host_authenticated
!= NULL
)? OK
: FAIL
;
4007 ignore_msg
= US
"rejected by ACL";
4008 rc
= acl_check(ACL_WHERE_MAILAUTH
, NULL
, acl_smtp_mailauth
,
4009 &user_msg
, &log_msg
);
4015 if (authenticated_by
== NULL
||
4016 authenticated_by
->mail_auth_condition
== NULL
||
4017 expand_check_condition(authenticated_by
->mail_auth_condition
,
4018 authenticated_by
->name
, US
"authenticator"))
4019 break; /* Accept the AUTH */
4021 ignore_msg
= US
"server_mail_auth_condition failed";
4022 if (authenticated_id
!= NULL
)
4023 ignore_msg
= string_sprintf("%s: authenticated ID=\"%s\"",
4024 ignore_msg
, authenticated_id
);
4029 authenticated_sender
= NULL
;
4030 log_write(0, LOG_MAIN
, "ignoring AUTH=%s from %s (%s)",
4031 value
, host_and_ident(TRUE
), ignore_msg
);
4034 /* Should only get DEFER or ERROR here. Put back terminator
4035 overrides for error message */
4040 (void)smtp_handle_acl_fail(ACL_WHERE_MAILAUTH
, rc
, user_msg
,
4047 #ifndef DISABLE_PRDR
4048 case ENV_MAIL_OPT_PRDR
:
4050 prdr_requested
= TRUE
;
4054 #ifdef EXPERIMENTAL_INTERNATIONAL
4055 case ENV_MAIL_OPT_UTF8
:
4056 if (smtputf8_advertised
)
4058 DEBUG(D_receive
) debug_printf("smtputf8 requested\n");
4059 message_smtputf8
= allow_utf8_domains
= TRUE
;
4060 received_protocol
= string_sprintf("utf8%s", received_protocol
);
4064 /* Unknown option. Stick back the terminator characters and break
4065 the loop. Do the name-terminator second as extract_option sets
4066 value==name when it found no equal-sign.
4067 An error for a malformed address will occur. */
4074 /* Break out of for loop if switch() had bad argument or
4075 when start of the email address is reached */
4076 if (arg_error
) break;
4079 /* If we have passed the threshold for rate limiting, apply the current
4080 delay, and update it for next time, provided this is a limited host. */
4082 if (smtp_mailcmd_count
> smtp_rlm_threshold
&&
4083 verify_check_host(&smtp_ratelimit_hosts
) == OK
)
4085 DEBUG(D_receive
) debug_printf("rate limit MAIL: delay %.3g sec\n",
4086 smtp_delay_mail
/1000.0);
4087 millisleep((int)smtp_delay_mail
);
4088 smtp_delay_mail
*= smtp_rlm_factor
;
4089 if (smtp_delay_mail
> (double)smtp_rlm_limit
)
4090 smtp_delay_mail
= (double)smtp_rlm_limit
;
4093 /* Now extract the address, first applying any SMTP-time rewriting. The
4094 TRUE flag allows "<>" as a sender address. */
4096 raw_sender
= rewrite_existflags
& rewrite_smtp
4097 ? rewrite_one(smtp_cmd_data
, rewrite_smtp
, NULL
, FALSE
, US
"",
4098 global_rewrite_rules
)
4101 /* rfc821_domains = TRUE; << no longer needed */
4103 parse_extract_address(raw_sender
, &errmess
, &start
, &end
, &sender_domain
,
4105 /* rfc821_domains = FALSE; << no longer needed */
4107 if (raw_sender
== NULL
)
4109 done
= synprot_error(L_smtp_syntax_error
, 501, smtp_cmd_data
, errmess
);
4113 sender_address
= raw_sender
;
4115 /* If there is a configured size limit for mail, check that this message
4116 doesn't exceed it. The check is postponed to this point so that the sender
4119 if (thismessage_size_limit
> 0 && message_size
> thismessage_size_limit
)
4121 smtp_printf("552 Message size exceeds maximum permitted\r\n");
4122 log_write(L_size_reject
,
4123 LOG_MAIN
|LOG_REJECT
, "rejected MAIL FROM:<%s> %s: "
4124 "message too big: size%s=%d max=%d",
4126 host_and_ident(TRUE
),
4127 (message_size
== INT_MAX
)? ">" : "",
4129 thismessage_size_limit
);
4130 sender_address
= NULL
;
4134 /* Check there is enough space on the disk unless configured not to.
4135 When smtp_check_spool_space is set, the check is for thismessage_size_limit
4136 plus the current message - i.e. we accept the message only if it won't
4137 reduce the space below the threshold. Add 5000 to the size to allow for
4138 overheads such as the Received: line and storing of recipients, etc.
4139 By putting the check here, even when SIZE is not given, it allow VRFY
4140 and EXPN etc. to be used when space is short. */
4142 if (!receive_check_fs(
4143 (smtp_check_spool_space
&& message_size
>= 0)?
4144 message_size
+ 5000 : 0))
4146 smtp_printf("452 Space shortage, please try later\r\n");
4147 sender_address
= NULL
;
4151 /* If sender_address is unqualified, reject it, unless this is a locally
4152 generated message, or the sending host or net is permitted to send
4153 unqualified addresses - typically local machines behaving as MUAs -
4154 in which case just qualify the address. The flag is set above at the start
4155 of the SMTP connection. */
4157 if (sender_domain
== 0 && sender_address
[0] != 0)
4159 if (allow_unqualified_sender
)
4161 sender_domain
= Ustrlen(sender_address
) + 1;
4162 sender_address
= rewrite_address_qualify(sender_address
, FALSE
);
4163 DEBUG(D_receive
) debug_printf("unqualified address %s accepted\n",
4168 smtp_printf("501 %s: sender address must contain a domain\r\n",
4170 log_write(L_smtp_syntax_error
,
4171 LOG_MAIN
|LOG_REJECT
,
4172 "unqualified sender rejected: <%s> %s%s",
4174 host_and_ident(TRUE
),
4176 sender_address
= NULL
;
4181 /* Apply an ACL check if one is defined, before responding. Afterwards,
4182 when pipelining is not advertised, do another sync check in case the ACL
4183 delayed and the client started sending in the meantime. */
4187 rc
= acl_check(ACL_WHERE_MAIL
, NULL
, acl_smtp_mail
, &user_msg
, &log_msg
);
4188 if (rc
== OK
&& !pipelining_advertised
&& !check_sync())
4194 if (rc
== OK
|| rc
== DISCARD
)
4197 smtp_printf("%s%s%s", US
"250 OK",
4198 #ifndef DISABLE_PRDR
4199 prdr_requested
? US
", PRDR Requested" : US
"",
4206 #ifndef DISABLE_PRDR
4208 user_msg
= string_sprintf("%s%s", user_msg
, US
", PRDR Requested");
4210 smtp_user_msg(US
"250", user_msg
);
4212 smtp_delay_rcpt
= smtp_rlr_base
;
4213 recipients_discarded
= (rc
== DISCARD
);
4214 was_rej_mail
= FALSE
;
4218 done
= smtp_handle_acl_fail(ACL_WHERE_MAIL
, rc
, user_msg
, log_msg
);
4219 sender_address
= NULL
;
4224 /* The RCPT command requires an address as an operand. There may be any
4225 number of RCPT commands, specifying multiple recipients. We build them all
4226 into a data structure. The start/end values given by parse_extract_address
4227 are not used, as we keep only the extracted address. */
4232 was_rcpt
= rcpt_in_progress
= TRUE
;
4234 /* There must be a sender address; if the sender was rejected and
4235 pipelining was advertised, we assume the client was pipelining, and do not
4236 count this as a protocol error. Reset was_rej_mail so that further RCPTs
4237 get the same treatment. */
4239 if (sender_address
== NULL
)
4241 if (pipelining_advertised
&& last_was_rej_mail
)
4243 smtp_printf("503 sender not yet given\r\n");
4244 was_rej_mail
= TRUE
;
4248 done
= synprot_error(L_smtp_protocol_error
, 503, NULL
,
4249 US
"sender not yet given");
4250 was_rcpt
= FALSE
; /* Not a valid RCPT */
4256 /* Check for an operand */
4258 if (smtp_cmd_data
[0] == 0)
4260 done
= synprot_error(L_smtp_syntax_error
, 501, NULL
,
4261 US
"RCPT must have an address operand");
4266 /* Set the DSN flags orcpt and dsn_flags from the session*/
4272 uschar
*name
, *value
;
4274 if (!extract_option(&name
, &value
))
4277 if (dsn_advertised
&& strcmpic(name
, US
"ORCPT") == 0)
4279 /* Check whether orcpt has been already set */
4282 synprot_error(L_smtp_syntax_error
, 501, NULL
,
4283 US
"ORCPT can be specified once only");
4286 orcpt
= string_copy(value
);
4287 DEBUG(D_receive
) debug_printf("DSN orcpt: %s\n", orcpt
);
4290 else if (dsn_advertised
&& strcmpic(name
, US
"NOTIFY") == 0)
4292 /* Check if the notify flags have been already set */
4295 synprot_error(L_smtp_syntax_error
, 501, NULL
,
4296 US
"NOTIFY can be specified once only");
4299 if (strcmpic(value
, US
"NEVER") == 0)
4300 flags
|= rf_notify_never
;
4307 while (*pp
!= 0 && *pp
!= ',') pp
++;
4308 if (*pp
== ',') *pp
++ = 0;
4309 if (strcmpic(p
, US
"SUCCESS") == 0)
4311 DEBUG(D_receive
) debug_printf("DSN: Setting notify success\n");
4312 flags
|= rf_notify_success
;
4314 else if (strcmpic(p
, US
"FAILURE") == 0)
4316 DEBUG(D_receive
) debug_printf("DSN: Setting notify failure\n");
4317 flags
|= rf_notify_failure
;
4319 else if (strcmpic(p
, US
"DELAY") == 0)
4321 DEBUG(D_receive
) debug_printf("DSN: Setting notify delay\n");
4322 flags
|= rf_notify_delay
;
4326 /* Catch any strange values */
4327 synprot_error(L_smtp_syntax_error
, 501, NULL
,
4328 US
"Invalid value for NOTIFY parameter");
4333 DEBUG(D_receive
) debug_printf("DSN Flags: %x\n", flags
);
4337 /* Unknown option. Stick back the terminator characters and break
4338 the loop. An error for a malformed address will occur. */
4342 DEBUG(D_receive
) debug_printf("Invalid RCPT option: %s : %s\n", name
, value
);
4349 /* Apply SMTP rewriting then extract the working address. Don't allow "<>"
4350 as a recipient address */
4352 recipient
= ((rewrite_existflags
& rewrite_smtp
) != 0)?
4353 rewrite_one(smtp_cmd_data
, rewrite_smtp
, NULL
, FALSE
, US
"",
4354 global_rewrite_rules
) : smtp_cmd_data
;
4356 /* rfc821_domains = TRUE; << no longer needed */
4357 recipient
= parse_extract_address(recipient
, &errmess
, &start
, &end
,
4358 &recipient_domain
, FALSE
);
4359 /* rfc821_domains = FALSE; << no longer needed */
4361 if (recipient
== NULL
)
4363 done
= synprot_error(L_smtp_syntax_error
, 501, smtp_cmd_data
, errmess
);
4368 /* If the recipient address is unqualified, reject it, unless this is a
4369 locally generated message. However, unqualified addresses are permitted
4370 from a configured list of hosts and nets - typically when behaving as
4371 MUAs rather than MTAs. Sad that SMTP is used for both types of traffic,
4372 really. The flag is set at the start of the SMTP connection.
4374 RFC 1123 talks about supporting "the reserved mailbox postmaster"; I always
4375 assumed this meant "reserved local part", but the revision of RFC 821 and
4376 friends now makes it absolutely clear that it means *mailbox*. Consequently
4377 we must always qualify this address, regardless. */
4379 if (recipient_domain
== 0)
4381 if (allow_unqualified_recipient
||
4382 strcmpic(recipient
, US
"postmaster") == 0)
4384 DEBUG(D_receive
) debug_printf("unqualified address %s accepted\n",
4386 recipient_domain
= Ustrlen(recipient
) + 1;
4387 recipient
= rewrite_address_qualify(recipient
, TRUE
);
4392 smtp_printf("501 %s: recipient address must contain a domain\r\n",
4394 log_write(L_smtp_syntax_error
,
4395 LOG_MAIN
|LOG_REJECT
, "unqualified recipient rejected: "
4396 "<%s> %s%s", recipient
, host_and_ident(TRUE
),
4402 /* Check maximum allowed */
4404 if (rcpt_count
> recipients_max
&& recipients_max
> 0)
4406 if (recipients_max_reject
)
4409 smtp_printf("552 too many recipients\r\n");
4411 log_write(0, LOG_MAIN
|LOG_REJECT
, "too many recipients: message "
4412 "rejected: sender=<%s> %s", sender_address
, host_and_ident(TRUE
));
4417 smtp_printf("452 too many recipients\r\n");
4419 log_write(0, LOG_MAIN
|LOG_REJECT
, "too many recipients: excess "
4420 "temporarily rejected: sender=<%s> %s", sender_address
,
4421 host_and_ident(TRUE
));
4428 /* If we have passed the threshold for rate limiting, apply the current
4429 delay, and update it for next time, provided this is a limited host. */
4431 if (rcpt_count
> smtp_rlr_threshold
&&
4432 verify_check_host(&smtp_ratelimit_hosts
) == OK
)
4434 DEBUG(D_receive
) debug_printf("rate limit RCPT: delay %.3g sec\n",
4435 smtp_delay_rcpt
/1000.0);
4436 millisleep((int)smtp_delay_rcpt
);
4437 smtp_delay_rcpt
*= smtp_rlr_factor
;
4438 if (smtp_delay_rcpt
> (double)smtp_rlr_limit
)
4439 smtp_delay_rcpt
= (double)smtp_rlr_limit
;
4442 /* If the MAIL ACL discarded all the recipients, we bypass ACL checking
4443 for them. Otherwise, check the access control list for this recipient. As
4444 there may be a delay in this, re-check for a synchronization error
4445 afterwards, unless pipelining was advertised. */
4447 if (recipients_discarded
) rc
= DISCARD
; else
4449 rc
= acl_check(ACL_WHERE_RCPT
, recipient
, acl_smtp_rcpt
, &user_msg
,
4451 if (rc
== OK
&& !pipelining_advertised
&& !check_sync())
4455 /* The ACL was happy */
4459 if (user_msg
== NULL
) smtp_printf("250 Accepted\r\n");
4460 else smtp_user_msg(US
"250", user_msg
);
4461 receive_add_recipient(recipient
, -1);
4463 /* Set the dsn flags in the recipients_list */
4464 recipients_list
[recipients_count
-1].orcpt
= orcpt
;
4465 recipients_list
[recipients_count
-1].dsn_flags
= flags
;
4467 DEBUG(D_receive
) debug_printf("DSN: orcpt: %s flags: %d\n",
4468 recipients_list
[recipients_count
-1].orcpt
,
4469 recipients_list
[recipients_count
-1].dsn_flags
);
4472 /* The recipient was discarded */
4474 else if (rc
== DISCARD
)
4476 if (user_msg
== NULL
) smtp_printf("250 Accepted\r\n");
4477 else smtp_user_msg(US
"250", user_msg
);
4480 log_write(0, LOG_MAIN
|LOG_REJECT
, "%s F=<%s> RCPT %s: "
4481 "discarded by %s ACL%s%s", host_and_ident(TRUE
),
4482 sender_address_unrewritten
? sender_address_unrewritten
: sender_address
,
4483 smtp_cmd_argument
, recipients_discarded
? "MAIL" : "RCPT",
4484 log_msg
? US
": " : US
"", log_msg
? log_msg
: US
"");
4487 /* Either the ACL failed the address, or it was deferred. */
4491 if (rc
== FAIL
) rcpt_fail_count
++; else rcpt_defer_count
++;
4492 done
= smtp_handle_acl_fail(ACL_WHERE_RCPT
, rc
, user_msg
, log_msg
);
4497 /* The DATA command is legal only if it follows successful MAIL FROM
4498 and RCPT TO commands. However, if pipelining is advertised, a bad DATA is
4499 not counted as a protocol error if it follows RCPT (which must have been
4500 rejected if there are no recipients.) This function is complete when a
4501 valid DATA command is encountered.
4503 Note concerning the code used: RFC 2821 says this:
4505 - If there was no MAIL, or no RCPT, command, or all such commands
4506 were rejected, the server MAY return a "command out of sequence"
4507 (503) or "no valid recipients" (554) reply in response to the
4510 The example in the pipelining RFC 2920 uses 554, but I use 503 here
4511 because it is the same whether pipelining is in use or not.
4513 If all the RCPT commands that precede DATA provoked the same error message
4514 (often indicating some kind of system error), it is helpful to include it
4515 with the DATA rejection (an idea suggested by Tony Finch). */
4519 if (!discarded
&& recipients_count
<= 0)
4521 if (rcpt_smtp_response_same
&& rcpt_smtp_response
!= NULL
)
4523 uschar
*code
= US
"503";
4524 int len
= Ustrlen(rcpt_smtp_response
);
4525 smtp_respond(code
, 3, FALSE
, US
"All RCPT commands were rejected with "
4527 /* Responses from smtp_printf() will have \r\n on the end */
4528 if (len
> 2 && rcpt_smtp_response
[len
-2] == '\r')
4529 rcpt_smtp_response
[len
-2] = 0;
4530 smtp_respond(code
, 3, FALSE
, rcpt_smtp_response
);
4532 if (pipelining_advertised
&& last_was_rcpt
)
4533 smtp_printf("503 Valid RCPT command must precede DATA\r\n");
4535 done
= synprot_error(L_smtp_protocol_error
, 503, NULL
,
4536 US
"valid RCPT command must precede DATA");
4540 if (toomany
&& recipients_max_reject
)
4542 sender_address
= NULL
; /* This will allow a new MAIL without RSET */
4543 sender_address_unrewritten
= NULL
;
4544 smtp_printf("554 Too many recipients\r\n");
4548 /* If there is an ACL, re-check the synchronization afterwards, since the
4549 ACL may have delayed. To handle cutthrough delivery enforce a dummy call
4550 to get the DATA command sent. */
4552 if (acl_smtp_predata
== NULL
&& cutthrough
.fd
< 0) rc
= OK
; else
4554 uschar
* acl
= acl_smtp_predata
? acl_smtp_predata
: US
"accept";
4555 enable_dollar_recipients
= TRUE
;
4556 rc
= acl_check(ACL_WHERE_PREDATA
, NULL
, acl
, &user_msg
,
4558 enable_dollar_recipients
= FALSE
;
4559 if (rc
== OK
&& !check_sync()) goto SYNC_FAILURE
;
4566 if (user_msg
== NULL
)
4567 smtp_printf("%s Enter message, ending with \".\" on a line by itself\r\n", code
);
4568 else smtp_user_msg(code
, user_msg
);
4570 message_ended
= END_NOTENDED
; /* Indicate in middle of data */
4573 /* Either the ACL failed the address, or it was deferred. */
4576 done
= smtp_handle_acl_fail(ACL_WHERE_PREDATA
, rc
, user_msg
, log_msg
);
4582 rc
= acl_check(ACL_WHERE_VRFY
, NULL
, acl_smtp_vrfy
, &user_msg
, &log_msg
);
4584 done
= smtp_handle_acl_fail(ACL_WHERE_VRFY
, rc
, user_msg
, log_msg
);
4590 /* rfc821_domains = TRUE; << no longer needed */
4591 address
= parse_extract_address(smtp_cmd_data
, &errmess
, &start
, &end
,
4592 &recipient_domain
, FALSE
);
4593 /* rfc821_domains = FALSE; << no longer needed */
4595 if (address
== NULL
)
4596 s
= string_sprintf("501 %s", errmess
);
4599 address_item
*addr
= deliver_make_addr(address
, FALSE
);
4600 switch(verify_address(addr
, NULL
, vopt_is_recipient
| vopt_qualify
, -1,
4601 -1, -1, NULL
, NULL
, NULL
))
4604 s
= string_sprintf("250 <%s> is deliverable", address
);
4608 s
= (addr
->user_message
!= NULL
)?
4609 string_sprintf("451 <%s> %s", address
, addr
->user_message
) :
4610 string_sprintf("451 Cannot resolve <%s> at this time", address
);
4614 s
= (addr
->user_message
!= NULL
)?
4615 string_sprintf("550 <%s> %s", address
, addr
->user_message
) :
4616 string_sprintf("550 <%s> is not deliverable", address
);
4617 log_write(0, LOG_MAIN
, "VRFY failed for %s %s",
4618 smtp_cmd_argument
, host_and_ident(TRUE
));
4623 smtp_printf("%s\r\n", s
);
4630 rc
= acl_check(ACL_WHERE_EXPN
, NULL
, acl_smtp_expn
, &user_msg
, &log_msg
);
4632 done
= smtp_handle_acl_fail(ACL_WHERE_EXPN
, rc
, user_msg
, log_msg
);
4635 BOOL save_log_testing_mode
= log_testing_mode
;
4636 address_test_mode
= log_testing_mode
= TRUE
;
4637 (void) verify_address(deliver_make_addr(smtp_cmd_data
, FALSE
),
4638 smtp_out
, vopt_is_recipient
| vopt_qualify
| vopt_expn
, -1, -1, -1,
4640 address_test_mode
= FALSE
;
4641 log_testing_mode
= save_log_testing_mode
; /* true for -bh */
4650 if (!tls_advertised
)
4652 done
= synprot_error(L_smtp_protocol_error
, 503, NULL
,
4653 US
"STARTTLS command used when not advertised");
4657 /* Apply an ACL check if one is defined */
4659 if (acl_smtp_starttls
!= NULL
)
4661 rc
= acl_check(ACL_WHERE_STARTTLS
, NULL
, acl_smtp_starttls
, &user_msg
,
4665 done
= smtp_handle_acl_fail(ACL_WHERE_STARTTLS
, rc
, user_msg
, log_msg
);
4670 /* RFC 2487 is not clear on when this command may be sent, though it
4671 does state that all information previously obtained from the client
4672 must be discarded if a TLS session is started. It seems reasonble to
4673 do an implied RSET when STARTTLS is received. */
4675 incomplete_transaction_log(US
"STARTTLS");
4676 smtp_reset(reset_point
);
4678 cmd_list
[CMD_LIST_STARTTLS
].is_mail_cmd
= FALSE
;
4680 /* There's an attack where more data is read in past the STARTTLS command
4681 before TLS is negotiated, then assumed to be part of the secure session
4682 when used afterwards; we use segregated input buffers, so are not
4683 vulnerable, but we want to note when it happens and, for sheer paranoia,
4684 ensure that the buffer is "wiped".
4685 Pipelining sync checks will normally have protected us too, unless disabled
4686 by configuration. */
4688 if (receive_smtp_buffered())
4691 debug_printf("Non-empty input buffer after STARTTLS; naive attack?");
4692 if (tls_in
.active
< 0)
4693 smtp_inend
= smtp_inptr
= smtp_inbuffer
;
4694 /* and if TLS is already active, tls_server_start() should fail */
4697 /* There is nothing we value in the input buffer and if TLS is succesfully
4698 negotiated, we won't use this buffer again; if TLS fails, we'll just read
4699 fresh content into it. The buffer contains arbitrary content from an
4700 untrusted remote source; eg: NOOP <shellcode>\r\nSTARTTLS\r\n
4701 It seems safest to just wipe away the content rather than leave it as a
4702 target to jump to. */
4704 memset(smtp_inbuffer
, 0, in_buffer_size
);
4706 /* Attempt to start up a TLS session, and if successful, discard all
4707 knowledge that was obtained previously. At least, that's what the RFC says,
4708 and that's what happens by default. However, in order to work round YAEB,
4709 there is an option to remember the esmtp state. Sigh.
4711 We must allow for an extra EHLO command and an extra AUTH command after
4712 STARTTLS that don't add to the nonmail command count. */
4714 if ((rc
= tls_server_start(tls_require_ciphers
)) == OK
)
4716 if (!tls_remember_esmtp
)
4717 helo_seen
= esmtp
= auth_advertised
= pipelining_advertised
= FALSE
;
4718 cmd_list
[CMD_LIST_EHLO
].is_mail_cmd
= TRUE
;
4719 cmd_list
[CMD_LIST_AUTH
].is_mail_cmd
= TRUE
;
4720 cmd_list
[CMD_LIST_TLS_AUTH
].is_mail_cmd
= TRUE
;
4721 if (sender_helo_name
!= NULL
)
4723 store_free(sender_helo_name
);
4724 sender_helo_name
= NULL
;
4725 host_build_sender_fullhost(); /* Rebuild */
4726 set_process_info("handling incoming TLS connection from %s",
4727 host_and_ident(FALSE
));
4730 (sender_host_address
? protocols
: protocols_local
)
4732 ? pextend
+ (sender_host_authenticated
? pauthed
: 0)
4734 + (tls_in
.active
>= 0 ? pcrpted
: 0)
4737 sender_host_authenticated
= NULL
;
4738 authenticated_id
= NULL
;
4739 sync_cmd_limit
= NON_SYNC_CMD_NON_PIPELINING
;
4740 DEBUG(D_tls
) debug_printf("TLS active\n");
4741 break; /* Successful STARTTLS */
4744 /* Some local configuration problem was discovered before actually trying
4745 to do a TLS handshake; give a temporary error. */
4747 else if (rc
== DEFER
)
4749 smtp_printf("454 TLS currently unavailable\r\n");
4753 /* Hard failure. Reject everything except QUIT or closed connection. One
4754 cause for failure is a nested STARTTLS, in which case tls_in.active remains
4755 set, but we must still reject all incoming commands. */
4757 DEBUG(D_tls
) debug_printf("TLS failed to start\n");
4760 switch(smtp_read_command(FALSE
))
4763 log_write(L_smtp_connection
, LOG_MAIN
, "%s closed by EOF",
4764 smtp_get_connection_info());
4765 smtp_notquit_exit(US
"tls-failed", NULL
, NULL
);
4769 /* It is perhaps arguable as to which exit ACL should be called here,
4770 but as it is probably a situation that almost never arises, it
4771 probably doesn't matter. We choose to call the real QUIT ACL, which in
4772 some sense is perhaps "right". */
4776 if (acl_smtp_quit
!= NULL
)
4778 rc
= acl_check(ACL_WHERE_QUIT
, NULL
, acl_smtp_quit
, &user_msg
,
4781 log_write(0, LOG_MAIN
|LOG_PANIC
, "ACL for QUIT returned ERROR: %s",
4784 if (user_msg
== NULL
)
4785 smtp_printf("221 %s closing connection\r\n", smtp_active_hostname
);
4787 smtp_respond(US
"221", 3, TRUE
, user_msg
);
4788 log_write(L_smtp_connection
, LOG_MAIN
, "%s closed by QUIT",
4789 smtp_get_connection_info());
4794 smtp_printf("554 Security failure\r\n");
4798 tls_close(TRUE
, TRUE
);
4803 /* The ACL for QUIT is provided for gathering statistical information or
4804 similar; it does not affect the response code, but it can supply a custom
4809 incomplete_transaction_log(US
"QUIT");
4810 if (acl_smtp_quit
!= NULL
)
4812 rc
= acl_check(ACL_WHERE_QUIT
, NULL
, acl_smtp_quit
, &user_msg
, &log_msg
);
4814 log_write(0, LOG_MAIN
|LOG_PANIC
, "ACL for QUIT returned ERROR: %s",
4817 if (user_msg
== NULL
)
4818 smtp_printf("221 %s closing connection\r\n", smtp_active_hostname
);
4820 smtp_respond(US
"221", 3, TRUE
, user_msg
);
4823 tls_close(TRUE
, TRUE
);
4827 log_write(L_smtp_connection
, LOG_MAIN
, "%s closed by QUIT",
4828 smtp_get_connection_info());
4834 incomplete_transaction_log(US
"RSET");
4835 smtp_reset(reset_point
);
4837 smtp_printf("250 Reset OK\r\n");
4838 cmd_list
[CMD_LIST_RSET
].is_mail_cmd
= FALSE
;
4844 smtp_printf("250 OK\r\n");
4848 /* Show ETRN/EXPN/VRFY if there's an ACL for checking hosts; if actually
4849 used, a check will be done for permitted hosts. Show STARTTLS only if not
4850 already in a TLS session and if it would be advertised in the EHLO
4855 smtp_printf("214-Commands supported:\r\n");
4859 Ustrcat(buffer
, " AUTH");
4861 if (tls_in
.active
< 0 &&
4862 verify_check_host(&tls_advertise_hosts
) != FAIL
)
4863 Ustrcat(buffer
, " STARTTLS");
4865 Ustrcat(buffer
, " HELO EHLO MAIL RCPT DATA");
4866 Ustrcat(buffer
, " NOOP QUIT RSET HELP");
4867 if (acl_smtp_etrn
!= NULL
) Ustrcat(buffer
, " ETRN");
4868 if (acl_smtp_expn
!= NULL
) Ustrcat(buffer
, " EXPN");
4869 if (acl_smtp_vrfy
!= NULL
) Ustrcat(buffer
, " VRFY");
4870 smtp_printf("214%s\r\n", buffer
);
4876 incomplete_transaction_log(US
"connection lost");
4877 smtp_notquit_exit(US
"connection-lost", US
"421",
4878 US
"%s lost input connection", smtp_active_hostname
);
4880 /* Don't log by default unless in the middle of a message, as some mailers
4881 just drop the call rather than sending QUIT, and it clutters up the logs.
4884 if (sender_address
!= NULL
|| recipients_count
> 0)
4885 log_write(L_lost_incoming_connection
,
4887 "unexpected %s while reading SMTP command from %s%s",
4888 sender_host_unknown
? "EOF" : "disconnection",
4889 host_and_ident(FALSE
), smtp_read_error
);
4891 else log_write(L_smtp_connection
, LOG_MAIN
, "%s lost%s",
4892 smtp_get_connection_info(), smtp_read_error
);
4900 if (sender_address
!= NULL
)
4902 done
= synprot_error(L_smtp_protocol_error
, 503, NULL
,
4903 US
"ETRN is not permitted inside a transaction");
4907 log_write(L_etrn
, LOG_MAIN
, "ETRN %s received from %s", smtp_cmd_argument
,
4908 host_and_ident(FALSE
));
4910 rc
= acl_check(ACL_WHERE_ETRN
, NULL
, acl_smtp_etrn
, &user_msg
, &log_msg
);
4913 done
= smtp_handle_acl_fail(ACL_WHERE_ETRN
, rc
, user_msg
, log_msg
);
4917 /* Compute the serialization key for this command. */
4919 etrn_serialize_key
= string_sprintf("etrn-%s\n", smtp_cmd_data
);
4921 /* If a command has been specified for running as a result of ETRN, we
4922 permit any argument to ETRN. If not, only the # standard form is permitted,
4923 since that is strictly the only kind of ETRN that can be implemented
4924 according to the RFC. */
4926 if (smtp_etrn_command
!= NULL
)
4930 etrn_command
= smtp_etrn_command
;
4931 deliver_domain
= smtp_cmd_data
;
4932 rc
= transport_set_up_command(&argv
, smtp_etrn_command
, TRUE
, 0, NULL
,
4933 US
"ETRN processing", &error
);
4934 deliver_domain
= NULL
;
4937 log_write(0, LOG_MAIN
|LOG_PANIC
, "failed to set up ETRN command: %s",
4939 smtp_printf("458 Internal failure\r\n");
4944 /* Else set up to call Exim with the -R option. */
4948 if (*smtp_cmd_data
++ != '#')
4950 done
= synprot_error(L_smtp_syntax_error
, 501, NULL
,
4951 US
"argument must begin with #");
4954 etrn_command
= US
"exim -R";
4955 argv
= CUSS
child_exec_exim(CEE_RETURN_ARGV
, TRUE
, NULL
, TRUE
, 2, US
"-R",
4959 /* If we are host-testing, don't actually do anything. */
4965 debug_printf("ETRN command is: %s\n", etrn_command
);
4966 debug_printf("ETRN command execution skipped\n");
4968 if (user_msg
== NULL
) smtp_printf("250 OK\r\n");
4969 else smtp_user_msg(US
"250", user_msg
);
4974 /* If ETRN queue runs are to be serialized, check the database to
4975 ensure one isn't already running. */
4977 if (smtp_etrn_serialize
&& !enq_start(etrn_serialize_key
))
4979 smtp_printf("458 Already processing %s\r\n", smtp_cmd_data
);
4983 /* Fork a child process and run the command. We don't want to have to
4984 wait for the process at any point, so set SIGCHLD to SIG_IGN before
4985 forking. It should be set that way anyway for external incoming SMTP,
4986 but we save and restore to be tidy. If serialization is required, we
4987 actually run the command in yet another process, so we can wait for it
4988 to complete and then remove the serialization lock. */
4990 oldsignal
= signal(SIGCHLD
, SIG_IGN
);
4992 if ((pid
= fork()) == 0)
4994 smtp_input
= FALSE
; /* This process is not associated with the */
4995 (void)fclose(smtp_in
); /* SMTP call any more. */
4996 (void)fclose(smtp_out
);
4998 signal(SIGCHLD
, SIG_DFL
); /* Want to catch child */
5000 /* If not serializing, do the exec right away. Otherwise, fork down
5001 into another process. */
5003 if (!smtp_etrn_serialize
|| (pid
= fork()) == 0)
5005 DEBUG(D_exec
) debug_print_argv(argv
);
5006 exim_nullstd(); /* Ensure std{in,out,err} exist */
5007 execv(CS argv
[0], (char *const *)argv
);
5008 log_write(0, LOG_MAIN
|LOG_PANIC_DIE
, "exec of \"%s\" (ETRN) failed: %s",
5009 etrn_command
, strerror(errno
));
5010 _exit(EXIT_FAILURE
); /* paranoia */
5013 /* Obey this if smtp_serialize and the 2nd fork yielded non-zero. That
5014 is, we are in the first subprocess, after forking again. All we can do
5015 for a failing fork is to log it. Otherwise, wait for the 2nd process to
5016 complete, before removing the serialization. */
5019 log_write(0, LOG_MAIN
|LOG_PANIC
, "2nd fork for serialized ETRN "
5020 "failed: %s", strerror(errno
));
5024 DEBUG(D_any
) debug_printf("waiting for serialized ETRN process %d\n",
5026 (void)wait(&status
);
5027 DEBUG(D_any
) debug_printf("serialized ETRN process %d ended\n",
5031 enq_end(etrn_serialize_key
);
5032 _exit(EXIT_SUCCESS
);
5035 /* Back in the top level SMTP process. Check that we started a subprocess
5036 and restore the signal state. */
5040 log_write(0, LOG_MAIN
|LOG_PANIC
, "fork of process for ETRN failed: %s",
5042 smtp_printf("458 Unable to fork process\r\n");
5043 if (smtp_etrn_serialize
) enq_end(etrn_serialize_key
);
5047 if (user_msg
== NULL
) smtp_printf("250 OK\r\n");
5048 else smtp_user_msg(US
"250", user_msg
);
5051 signal(SIGCHLD
, oldsignal
);
5056 done
= synprot_error(L_smtp_syntax_error
, 501, NULL
,
5057 US
"unexpected argument data");
5061 /* This currently happens only for NULLs, but could be extended. */
5064 done
= synprot_error(L_smtp_syntax_error
, 0, NULL
, /* Just logs */
5065 US
"NULL character(s) present (shown as '?')");
5066 smtp_printf("501 NULL characters are not allowed in SMTP commands\r\n");
5072 if (smtp_inend
>= smtp_inbuffer
+ in_buffer_size
)
5073 smtp_inend
= smtp_inbuffer
+ in_buffer_size
- 1;
5074 c
= smtp_inend
- smtp_inptr
;
5075 if (c
> 150) c
= 150;
5077 incomplete_transaction_log(US
"sync failure");
5078 log_write(0, LOG_MAIN
|LOG_REJECT
, "SMTP protocol synchronization error "
5079 "(next input sent too soon: pipelining was%s advertised): "
5080 "rejected \"%s\" %s next input=\"%s\"",
5081 pipelining_advertised
? "" : " not",
5082 smtp_cmd_buffer
, host_and_ident(TRUE
),
5083 string_printing(smtp_inptr
));
5084 smtp_notquit_exit(US
"synchronization-error", US
"554",
5085 US
"SMTP synchronization error");
5086 done
= 1; /* Pretend eof - drops connection */
5090 case TOO_MANY_NONMAIL_CMD
:
5091 s
= smtp_cmd_buffer
;
5092 while (*s
!= 0 && !isspace(*s
)) s
++;
5093 incomplete_transaction_log(US
"too many non-mail commands");
5094 log_write(0, LOG_MAIN
|LOG_REJECT
, "SMTP call from %s dropped: too many "
5095 "nonmail commands (last was \"%.*s\")", host_and_ident(FALSE
),
5096 (int)(s
- smtp_cmd_buffer
), smtp_cmd_buffer
);
5097 smtp_notquit_exit(US
"bad-commands", US
"554", US
"Too many nonmail commands");
5098 done
= 1; /* Pretend eof - drops connection */
5101 #ifdef EXPERIMENTAL_PROXY
5102 case PROXY_FAIL_IGNORE_CMD
:
5103 smtp_printf("503 Command refused, required Proxy negotiation failed\r\n");
5108 if (unknown_command_count
++ >= smtp_max_unknown_commands
)
5110 log_write(L_smtp_syntax_error
, LOG_MAIN
,
5111 "SMTP syntax error in \"%s\" %s %s",
5112 string_printing(smtp_cmd_buffer
), host_and_ident(TRUE
),
5113 US
"unrecognized command");
5114 incomplete_transaction_log(US
"unrecognized command");
5115 smtp_notquit_exit(US
"bad-commands", US
"500",
5116 US
"Too many unrecognized commands");
5118 log_write(0, LOG_MAIN
|LOG_REJECT
, "SMTP call from %s dropped: too many "
5119 "unrecognized commands (last was \"%s\")", host_and_ident(FALSE
),
5120 string_printing(smtp_cmd_buffer
));
5123 done
= synprot_error(L_smtp_syntax_error
, 500, NULL
,
5124 US
"unrecognized command");
5128 /* This label is used by goto's inside loops that want to break out to
5129 the end of the command-processing loop. */
5132 last_was_rej_mail
= was_rej_mail
; /* Remember some last commands for */
5133 last_was_rcpt
= was_rcpt
; /* protocol error handling */
5137 return done
- 2; /* Convert yield values */
5142 /* End of smtp_in.c */