214 spelling fixes
[exim.git] / src / src / smtp_in.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions for handling an incoming SMTP call. */
9
10
11 #include "exim.h"
12 #include <assert.h>
13
14
15 /* Initialize for TCP wrappers if so configured. It appears that the macro
16 HAVE_IPV6 is used in some versions of the tcpd.h header, so we unset it before
17 including that header, and restore its value afterwards. */
18
19 #ifdef USE_TCP_WRAPPERS
20
21 #if HAVE_IPV6
22 #define EXIM_HAVE_IPV6
23 #endif
24 #undef HAVE_IPV6
25 #include <tcpd.h>
26 #undef HAVE_IPV6
27 #ifdef EXIM_HAVE_IPV6
28 #define HAVE_IPV6 TRUE
29 #endif
30
31 int allow_severity = LOG_INFO;
32 int deny_severity = LOG_NOTICE;
33 uschar *tcp_wrappers_name;
34 #endif
35
36
37 /* Size of buffer for reading SMTP commands. We used to use 512, as defined
38 by RFC 821. However, RFC 1869 specifies that this must be increased for SMTP
39 commands that accept arguments, and this in particular applies to AUTH, where
40 the data can be quite long. More recently this value was 2048 in Exim;
41 however, RFC 4954 (circa 2007) recommends 12288 bytes to handle AUTH. Clients
42 such as Thunderbird will send an AUTH with an initial-response for GSSAPI.
43 The maximum size of a Kerberos ticket under Windows 2003 is 12000 bytes, and
44 we need room to handle large base64-encoded AUTHs for GSSAPI.
45 */
46
47 #define smtp_cmd_buffer_size 16384
48
49 /* Size of buffer for reading SMTP incoming packets */
50
51 #define in_buffer_size 8192
52
53 /* Structure for SMTP command list */
54
55 typedef struct {
56 const char *name;
57 int len;
58 short int cmd;
59 short int has_arg;
60 short int is_mail_cmd;
61 } smtp_cmd_list;
62
63 /* Codes for identifying commands. We order them so that those that come first
64 are those for which synchronization is always required. Checking this can help
65 block some spam. */
66
67 enum {
68 /* These commands are required to be synchronized, i.e. to be the last in a
69 block of commands when pipelining. */
70
71 HELO_CMD, EHLO_CMD, DATA_CMD, /* These are listed in the pipelining */
72 VRFY_CMD, EXPN_CMD, NOOP_CMD, /* RFC as requiring synchronization */
73 ETRN_CMD, /* This by analogy with TURN from the RFC */
74 STARTTLS_CMD, /* Required by the STARTTLS RFC */
75 TLS_AUTH_CMD, /* auto-command at start of SSL */
76
77 /* This is a dummy to identify the non-sync commands when pipelining */
78
79 NON_SYNC_CMD_PIPELINING,
80
81 /* These commands need not be synchronized when pipelining */
82
83 MAIL_CMD, RCPT_CMD, RSET_CMD,
84
85 /* This is a dummy to identify the non-sync commands when not pipelining */
86
87 NON_SYNC_CMD_NON_PIPELINING,
88
89 /* RFC3030 section 2: "After all MAIL and RCPT responses are collected and
90 processed the message is sent using a series of BDAT commands"
91 implies that BDAT should be synchronized. However, we see Google, at least,
92 sending MAIL,RCPT,BDAT-LAST in a single packet, clearly not waiting for
93 processing of the RCPT response(s). We shall do the same, and not require
94 synch for BDAT. Worse, as the chunk may (very likely will) follow the
95 command-header in the same packet we cannot do the usual "is there any
96 follow-on data after the command line" even for non-pipeline mode.
97 So we'll need an explicit check after reading the expected chunk amount
98 when non-pipe, before sending the ACK. */
99
100 BDAT_CMD,
101
102 /* I have been unable to find a statement about the use of pipelining
103 with AUTH, so to be on the safe side it is here, though I kind of feel
104 it should be up there with the synchronized commands. */
105
106 AUTH_CMD,
107
108 /* I'm not sure about these, but I don't think they matter. */
109
110 QUIT_CMD, HELP_CMD,
111
112 #ifdef SUPPORT_PROXY
113 PROXY_FAIL_IGNORE_CMD,
114 #endif
115
116 /* These are specials that don't correspond to actual commands */
117
118 EOF_CMD, OTHER_CMD, BADARG_CMD, BADCHAR_CMD, BADSYN_CMD,
119 TOO_MANY_NONMAIL_CMD };
120
121
122 /* This is a convenience macro for adding the identity of an SMTP command
123 to the circular buffer that holds a list of the last n received. */
124
125 #define HAD(n) \
126 smtp_connection_had[smtp_ch_index++] = n; \
127 if (smtp_ch_index >= SMTP_HBUFF_SIZE) smtp_ch_index = 0
128
129
130 /*************************************************
131 * Local static variables *
132 *************************************************/
133
134 static auth_instance *authenticated_by;
135 static BOOL auth_advertised;
136 #ifdef SUPPORT_TLS
137 static BOOL tls_advertised;
138 #endif
139 static BOOL dsn_advertised;
140 static BOOL esmtp;
141 static BOOL helo_required = FALSE;
142 static BOOL helo_verify = FALSE;
143 static BOOL helo_seen;
144 static BOOL helo_accept_junk;
145 static BOOL count_nonmail;
146 static BOOL pipelining_advertised;
147 static BOOL rcpt_smtp_response_same;
148 static BOOL rcpt_in_progress;
149 static int nonmail_command_count;
150 static BOOL smtp_exit_function_called = 0;
151 #ifdef SUPPORT_I18N
152 static BOOL smtputf8_advertised;
153 #endif
154 static int synprot_error_count;
155 static int unknown_command_count;
156 static int sync_cmd_limit;
157 static int smtp_write_error = 0;
158
159 static uschar *rcpt_smtp_response;
160 static uschar *smtp_data_buffer;
161 static uschar *smtp_cmd_data;
162
163 /* We need to know the position of RSET, HELO, EHLO, AUTH, and STARTTLS. Their
164 final fields of all except AUTH are forced TRUE at the start of a new message
165 setup, to allow one of each between messages that is not counted as a nonmail
166 command. (In fact, only one of HELO/EHLO is not counted.) Also, we have to
167 allow a new EHLO after starting up TLS.
168
169 AUTH is "falsely" labelled as a mail command initially, so that it doesn't get
170 counted. However, the flag is changed when AUTH is received, so that multiple
171 failing AUTHs will eventually hit the limit. After a successful AUTH, another
172 AUTH is already forbidden. After a TLS session is started, AUTH's flag is again
173 forced TRUE, to allow for the re-authentication that can happen at that point.
174
175 QUIT is also "falsely" labelled as a mail command so that it doesn't up the
176 count of non-mail commands and possibly provoke an error.
177
178 tls_auth is a pseudo-command, never expected in input. It is activated
179 on TLS startup and looks for a tls authenticator. */
180
181 static smtp_cmd_list cmd_list[] = {
182 /* name len cmd has_arg is_mail_cmd */
183
184 { "rset", sizeof("rset")-1, RSET_CMD, FALSE, FALSE }, /* First */
185 { "helo", sizeof("helo")-1, HELO_CMD, TRUE, FALSE },
186 { "ehlo", sizeof("ehlo")-1, EHLO_CMD, TRUE, FALSE },
187 { "auth", sizeof("auth")-1, AUTH_CMD, TRUE, TRUE },
188 #ifdef SUPPORT_TLS
189 { "starttls", sizeof("starttls")-1, STARTTLS_CMD, FALSE, FALSE },
190 { "tls_auth", 0, TLS_AUTH_CMD, FALSE, TRUE },
191 #endif
192
193 /* If you change anything above here, also fix the definitions below. */
194
195 { "mail from:", sizeof("mail from:")-1, MAIL_CMD, TRUE, TRUE },
196 { "rcpt to:", sizeof("rcpt to:")-1, RCPT_CMD, TRUE, TRUE },
197 { "data", sizeof("data")-1, DATA_CMD, FALSE, TRUE },
198 { "bdat", sizeof("bdat")-1, BDAT_CMD, TRUE, TRUE },
199 { "quit", sizeof("quit")-1, QUIT_CMD, FALSE, TRUE },
200 { "noop", sizeof("noop")-1, NOOP_CMD, TRUE, FALSE },
201 { "etrn", sizeof("etrn")-1, ETRN_CMD, TRUE, FALSE },
202 { "vrfy", sizeof("vrfy")-1, VRFY_CMD, TRUE, FALSE },
203 { "expn", sizeof("expn")-1, EXPN_CMD, TRUE, FALSE },
204 { "help", sizeof("help")-1, HELP_CMD, TRUE, FALSE }
205 };
206
207 static smtp_cmd_list *cmd_list_end =
208 cmd_list + sizeof(cmd_list)/sizeof(smtp_cmd_list);
209
210 #define CMD_LIST_RSET 0
211 #define CMD_LIST_HELO 1
212 #define CMD_LIST_EHLO 2
213 #define CMD_LIST_AUTH 3
214 #define CMD_LIST_STARTTLS 4
215 #define CMD_LIST_TLS_AUTH 5
216
217 /* This list of names is used for performing the smtp_no_mail logging action.
218 It must be kept in step with the SCH_xxx enumerations. */
219
220 static uschar *smtp_names[] =
221 {
222 US"NONE", US"AUTH", US"DATA", US"BDAT", US"EHLO", US"ETRN", US"EXPN",
223 US"HELO", US"HELP", US"MAIL", US"NOOP", US"QUIT", US"RCPT", US"RSET",
224 US"STARTTLS", US"VRFY" };
225
226 static uschar *protocols_local[] = {
227 US"local-smtp", /* HELO */
228 US"local-smtps", /* The rare case EHLO->STARTTLS->HELO */
229 US"local-esmtp", /* EHLO */
230 US"local-esmtps", /* EHLO->STARTTLS->EHLO */
231 US"local-esmtpa", /* EHLO->AUTH */
232 US"local-esmtpsa" /* EHLO->STARTTLS->EHLO->AUTH */
233 };
234 static uschar *protocols[] = {
235 US"smtp", /* HELO */
236 US"smtps", /* The rare case EHLO->STARTTLS->HELO */
237 US"esmtp", /* EHLO */
238 US"esmtps", /* EHLO->STARTTLS->EHLO */
239 US"esmtpa", /* EHLO->AUTH */
240 US"esmtpsa" /* EHLO->STARTTLS->EHLO->AUTH */
241 };
242
243 #define pnormal 0
244 #define pextend 2
245 #define pcrpted 1 /* added to pextend or pnormal */
246 #define pauthed 2 /* added to pextend */
247
248 /* Sanity check and validate optional args to MAIL FROM: envelope */
249 enum {
250 ENV_MAIL_OPT_NULL,
251 ENV_MAIL_OPT_SIZE, ENV_MAIL_OPT_BODY, ENV_MAIL_OPT_AUTH,
252 #ifndef DISABLE_PRDR
253 ENV_MAIL_OPT_PRDR,
254 #endif
255 ENV_MAIL_OPT_RET, ENV_MAIL_OPT_ENVID,
256 #ifdef SUPPORT_I18N
257 ENV_MAIL_OPT_UTF8,
258 #endif
259 };
260 typedef struct {
261 uschar * name; /* option requested during MAIL cmd */
262 int value; /* enum type */
263 BOOL need_value; /* TRUE requires value (name=value pair format)
264 FALSE is a singleton */
265 } env_mail_type_t;
266 static env_mail_type_t env_mail_type_list[] = {
267 { US"SIZE", ENV_MAIL_OPT_SIZE, TRUE },
268 { US"BODY", ENV_MAIL_OPT_BODY, TRUE },
269 { US"AUTH", ENV_MAIL_OPT_AUTH, TRUE },
270 #ifndef DISABLE_PRDR
271 { US"PRDR", ENV_MAIL_OPT_PRDR, FALSE },
272 #endif
273 { US"RET", ENV_MAIL_OPT_RET, TRUE },
274 { US"ENVID", ENV_MAIL_OPT_ENVID, TRUE },
275 #ifdef SUPPORT_I18N
276 { US"SMTPUTF8",ENV_MAIL_OPT_UTF8, FALSE }, /* rfc6531 */
277 #endif
278 /* keep this the last entry */
279 { US"NULL", ENV_MAIL_OPT_NULL, FALSE },
280 };
281
282 /* When reading SMTP from a remote host, we have to use our own versions of the
283 C input-reading functions, in order to be able to flush the SMTP output only
284 when about to read more data from the socket. This is the only way to get
285 optimal performance when the client is using pipelining. Flushing for every
286 command causes a separate packet and reply packet each time; saving all the
287 responses up (when pipelining) combines them into one packet and one response.
288
289 For simplicity, these functions are used for *all* SMTP input, not only when
290 receiving over a socket. However, after setting up a secure socket (SSL), input
291 is read via the OpenSSL library, and another set of functions is used instead
292 (see tls.c).
293
294 These functions are set in the receive_getc etc. variables and called with the
295 same interface as the C functions. However, since there can only ever be
296 one incoming SMTP call, we just use a single buffer and flags. There is no need
297 to implement a complicated private FILE-like structure.*/
298
299 static uschar *smtp_inbuffer;
300 static uschar *smtp_inptr;
301 static uschar *smtp_inend;
302 static int smtp_had_eof;
303 static int smtp_had_error;
304
305
306 /* forward declarations */
307 int bdat_ungetc(int ch);
308 static int smtp_read_command(BOOL check_sync);
309 static int synprot_error(int type, int code, uschar *data, uschar *errmess);
310 static void smtp_quit_handler(uschar **, uschar **);
311 static void smtp_rset_handler(void);
312
313 /*************************************************
314 * Recheck synchronization *
315 *************************************************/
316
317 /* Synchronization checks can never be perfect because a packet may be on its
318 way but not arrived when the check is done. Such checks can in any case only be
319 done when TLS is not in use. Normally, the checks happen when commands are
320 read: Exim ensures that there is no more input in the input buffer. In normal
321 cases, the response to the command will be fast, and there is no further check.
322
323 However, for some commands an ACL is run, and that can include delays. In those
324 cases, it is useful to do another check on the input just before sending the
325 response. This also applies at the start of a connection. This function does
326 that check by means of the select() function, as long as the facility is not
327 disabled or inappropriate. A failure of select() is ignored.
328
329 When there is unwanted input, we read it so that it appears in the log of the
330 error.
331
332 Arguments: none
333 Returns: TRUE if all is well; FALSE if there is input pending
334 */
335
336 static BOOL
337 check_sync(void)
338 {
339 int fd, rc;
340 fd_set fds;
341 struct timeval tzero;
342
343 if (!smtp_enforce_sync || sender_host_address == NULL ||
344 sender_host_notsocket || tls_in.active >= 0)
345 return TRUE;
346
347 fd = fileno(smtp_in);
348 FD_ZERO(&fds);
349 FD_SET(fd, &fds);
350 tzero.tv_sec = 0;
351 tzero.tv_usec = 0;
352 rc = select(fd + 1, (SELECT_ARG2_TYPE *)&fds, NULL, NULL, &tzero);
353
354 if (rc <= 0) return TRUE; /* Not ready to read */
355 rc = smtp_getc();
356 if (rc < 0) return TRUE; /* End of file or error */
357
358 smtp_ungetc(rc);
359 rc = smtp_inend - smtp_inptr;
360 if (rc > 150) rc = 150;
361 smtp_inptr[rc] = 0;
362 return FALSE;
363 }
364
365
366
367 /*************************************************
368 * Log incomplete transactions *
369 *************************************************/
370
371 /* This function is called after a transaction has been aborted by RSET, QUIT,
372 connection drops or other errors. It logs the envelope information received
373 so far in order to preserve address verification attempts.
374
375 Argument: string to indicate what aborted the transaction
376 Returns: nothing
377 */
378
379 static void
380 incomplete_transaction_log(uschar *what)
381 {
382 if (sender_address == NULL || /* No transaction in progress */
383 !LOGGING(smtp_incomplete_transaction))
384 return;
385
386 /* Build list of recipients for logging */
387
388 if (recipients_count > 0)
389 {
390 int i;
391 raw_recipients = store_get(recipients_count * sizeof(uschar *));
392 for (i = 0; i < recipients_count; i++)
393 raw_recipients[i] = recipients_list[i].address;
394 raw_recipients_count = recipients_count;
395 }
396
397 log_write(L_smtp_incomplete_transaction, LOG_MAIN|LOG_SENDER|LOG_RECIPIENTS,
398 "%s incomplete transaction (%s)", host_and_ident(TRUE), what);
399 }
400
401
402
403
404 /*************************************************
405 * SMTP version of getc() *
406 *************************************************/
407
408 /* This gets the next byte from the SMTP input buffer. If the buffer is empty,
409 it flushes the output, and refills the buffer, with a timeout. The signal
410 handler is set appropriately by the calling function. This function is not used
411 after a connection has negotiated itself into an TLS/SSL state.
412
413 Arguments: none
414 Returns: the next character or EOF
415 */
416
417 int
418 smtp_getc(void)
419 {
420 if (smtp_inptr >= smtp_inend)
421 {
422 int rc, save_errno;
423 if (!smtp_out) return EOF;
424 fflush(smtp_out);
425 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
426 rc = read(fileno(smtp_in), smtp_inbuffer, in_buffer_size);
427 save_errno = errno;
428 alarm(0);
429 if (rc <= 0)
430 {
431 /* Must put the error text in fixed store, because this might be during
432 header reading, where it releases unused store above the header. */
433 if (rc < 0)
434 {
435 smtp_had_error = save_errno;
436 smtp_read_error = string_copy_malloc(
437 string_sprintf(" (error: %s)", strerror(save_errno)));
438 }
439 else smtp_had_eof = 1;
440 return EOF;
441 }
442 #ifndef DISABLE_DKIM
443 dkim_exim_verify_feed(smtp_inbuffer, rc);
444 #endif
445 smtp_inend = smtp_inbuffer + rc;
446 smtp_inptr = smtp_inbuffer;
447 }
448 return *smtp_inptr++;
449 }
450
451 void
452 smtp_get_cache(void)
453 {
454 #ifndef DISABLE_DKIM
455 int n = smtp_inend - smtp_inptr;
456 if (n > 0)
457 dkim_exim_verify_feed(smtp_inptr, n);
458 #endif
459 }
460
461
462 /* Get a byte from the smtp input, in CHUNKING mode. Handle ack of the
463 previous BDAT chunk and getting new ones when we run out. Uses the
464 underlying smtp_getc or tls_getc both for that and for getting the
465 (buffered) data byte. EOD signals (an expected) no further data.
466 ERR signals a protocol error, and EOF a closed input stream.
467
468 Called from read_bdat_smtp() in receive.c for the message body, but also
469 by the headers read loop in receive_msg(); manipulates chunking_state
470 to handle the BDAT command/response.
471 Placed here due to the correlation with the above smtp_getc(), which it wraps,
472 and also by the need to do smtp command/response handling.
473
474 Arguments: none
475 Returns: the next character or ERR, EOD or EOF
476 */
477
478 int
479 bdat_getc(void)
480 {
481 uschar * user_msg = NULL;
482 uschar * log_msg;
483
484 for(;;)
485 {
486 if (chunking_data_left-- > 0)
487 return lwr_receive_getc();
488
489 receive_getc = lwr_receive_getc;
490 receive_ungetc = lwr_receive_ungetc;
491
492 /* Unless PIPELINING was offered, there should be no next command
493 until after we ack that chunk */
494
495 if (!pipelining_advertised && !check_sync())
496 {
497 incomplete_transaction_log(US"sync failure");
498 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP protocol synchronization error "
499 "(next input sent too soon: pipelining was not advertised): "
500 "rejected \"%s\" %s next input=\"%s\"",
501 smtp_cmd_buffer, host_and_ident(TRUE),
502 string_printing(smtp_inptr));
503 (void) synprot_error(L_smtp_protocol_error, 554, NULL,
504 US"SMTP synchronization error");
505 goto repeat_until_rset;
506 }
507
508 /* If not the last, ack the received chunk. The last response is delayed
509 until after the data ACL decides on it */
510
511 if (chunking_state == CHUNKING_LAST)
512 {
513 #ifndef DISABLE_DKIM
514 dkim_exim_verify_feed(NULL, 0); /* notify EOD */
515 #endif
516 return EOD;
517 }
518
519 chunking_state = CHUNKING_OFFERED;
520 smtp_printf("250 %u byte chunk received\r\n", chunking_datasize);
521
522 /* Expect another BDAT cmd from input. RFC 3030 says nothing about
523 QUIT, RSET or NOOP but handling them seems obvious */
524
525 next_cmd:
526 switch(smtp_read_command(TRUE))
527 {
528 default:
529 (void) synprot_error(L_smtp_protocol_error, 503, NULL,
530 US"only BDAT permissible after non-LAST BDAT");
531
532 repeat_until_rset:
533 switch(smtp_read_command(TRUE))
534 {
535 case QUIT_CMD: smtp_quit_handler(&user_msg, &log_msg); /*FALLTHROUGH */
536 case EOF_CMD: return EOF;
537 case RSET_CMD: smtp_rset_handler(); return ERR;
538 default: if (synprot_error(L_smtp_protocol_error, 503, NULL,
539 US"only RSET accepted now") > 0)
540 return EOF;
541 goto repeat_until_rset;
542 }
543
544 case QUIT_CMD:
545 smtp_quit_handler(&user_msg, &log_msg);
546 /*FALLTHROUGH*/
547 case EOF_CMD:
548 return EOF;
549
550 case RSET_CMD:
551 smtp_rset_handler();
552 return ERR;
553
554 case NOOP_CMD:
555 HAD(SCH_NOOP);
556 smtp_printf("250 OK\r\n");
557 goto next_cmd;
558
559 case BDAT_CMD:
560 {
561 int n;
562
563 if (sscanf(CS smtp_cmd_data, "%u %n", &chunking_datasize, &n) < 1)
564 {
565 (void) synprot_error(L_smtp_protocol_error, 501, NULL,
566 US"missing size for BDAT command");
567 return ERR;
568 }
569 chunking_state = strcmpic(smtp_cmd_data+n, US"LAST") == 0
570 ? CHUNKING_LAST : CHUNKING_ACTIVE;
571 chunking_data_left = chunking_datasize;
572
573 if (chunking_datasize == 0)
574 if (chunking_state == CHUNKING_LAST)
575 return EOD;
576 else
577 {
578 (void) synprot_error(L_smtp_protocol_error, 504, NULL,
579 US"zero size for BDAT command");
580 goto repeat_until_rset;
581 }
582
583 receive_getc = bdat_getc;
584 receive_ungetc = bdat_ungetc;
585 break; /* to top of main loop */
586 }
587 }
588 }
589 }
590
591 static void
592 bdat_flush_data(void)
593 {
594 while (chunking_data_left-- > 0)
595 if (lwr_receive_getc() < 0)
596 break;
597
598 receive_getc = lwr_receive_getc;
599 receive_ungetc = lwr_receive_ungetc;
600
601 if (chunking_state != CHUNKING_LAST)
602 chunking_state = CHUNKING_OFFERED;
603 }
604
605
606
607
608 /*************************************************
609 * SMTP version of ungetc() *
610 *************************************************/
611
612 /* Puts a character back in the input buffer. Only ever
613 called once.
614
615 Arguments:
616 ch the character
617
618 Returns: the character
619 */
620
621 int
622 smtp_ungetc(int ch)
623 {
624 *--smtp_inptr = ch;
625 return ch;
626 }
627
628
629 int
630 bdat_ungetc(int ch)
631 {
632 chunking_data_left++;
633 return lwr_receive_ungetc(ch);
634 }
635
636
637
638 /*************************************************
639 * SMTP version of feof() *
640 *************************************************/
641
642 /* Tests for a previous EOF
643
644 Arguments: none
645 Returns: non-zero if the eof flag is set
646 */
647
648 int
649 smtp_feof(void)
650 {
651 return smtp_had_eof;
652 }
653
654
655
656
657 /*************************************************
658 * SMTP version of ferror() *
659 *************************************************/
660
661 /* Tests for a previous read error, and returns with errno
662 restored to what it was when the error was detected.
663
664 Arguments: none
665 Returns: non-zero if the error flag is set
666 */
667
668 int
669 smtp_ferror(void)
670 {
671 errno = smtp_had_error;
672 return smtp_had_error;
673 }
674
675
676
677 /*************************************************
678 * Test for characters in the SMTP buffer *
679 *************************************************/
680
681 /* Used at the end of a message
682
683 Arguments: none
684 Returns: TRUE/FALSE
685 */
686
687 BOOL
688 smtp_buffered(void)
689 {
690 return smtp_inptr < smtp_inend;
691 }
692
693
694
695 /*************************************************
696 * Write formatted string to SMTP channel *
697 *************************************************/
698
699 /* This is a separate function so that we don't have to repeat everything for
700 TLS support or debugging. It is global so that the daemon and the
701 authentication functions can use it. It does not return any error indication,
702 because major problems such as dropped connections won't show up till an output
703 flush for non-TLS connections. The smtp_fflush() function is available for
704 checking that: for convenience, TLS output errors are remembered here so that
705 they are also picked up later by smtp_fflush().
706
707 Arguments:
708 format format string
709 ... optional arguments
710
711 Returns: nothing
712 */
713
714 void
715 smtp_printf(const char *format, ...)
716 {
717 va_list ap;
718
719 va_start(ap, format);
720 smtp_vprintf(format, ap);
721 va_end(ap);
722 }
723
724 /* This is split off so that verify.c:respond_printf() can, in effect, call
725 smtp_printf(), bearing in mind that in C a vararg function can't directly
726 call another vararg function, only a function which accepts a va_list. */
727
728 void
729 smtp_vprintf(const char *format, va_list ap)
730 {
731 BOOL yield;
732
733 yield = string_vformat(big_buffer, big_buffer_size, format, ap);
734
735 DEBUG(D_receive)
736 {
737 void *reset_point = store_get(0);
738 uschar *msg_copy, *cr, *end;
739 msg_copy = string_copy(big_buffer);
740 end = msg_copy + Ustrlen(msg_copy);
741 while ((cr = Ustrchr(msg_copy, '\r')) != NULL) /* lose CRs */
742 memmove(cr, cr + 1, (end--) - cr);
743 debug_printf("SMTP>> %s", msg_copy);
744 store_reset(reset_point);
745 }
746
747 if (!yield)
748 {
749 log_write(0, LOG_MAIN|LOG_PANIC, "string too large in smtp_printf()");
750 smtp_closedown(US"Unexpected error");
751 exim_exit(EXIT_FAILURE);
752 }
753
754 /* If this is the first output for a (non-batch) RCPT command, see if all RCPTs
755 have had the same. Note: this code is also present in smtp_respond(). It would
756 be tidier to have it only in one place, but when it was added, it was easier to
757 do it that way, so as not to have to mess with the code for the RCPT command,
758 which sometimes uses smtp_printf() and sometimes smtp_respond(). */
759
760 if (rcpt_in_progress)
761 {
762 if (rcpt_smtp_response == NULL)
763 rcpt_smtp_response = string_copy(big_buffer);
764 else if (rcpt_smtp_response_same &&
765 Ustrcmp(rcpt_smtp_response, big_buffer) != 0)
766 rcpt_smtp_response_same = FALSE;
767 rcpt_in_progress = FALSE;
768 }
769
770 /* Now write the string */
771
772 #ifdef SUPPORT_TLS
773 if (tls_in.active >= 0)
774 {
775 if (tls_write(TRUE, big_buffer, Ustrlen(big_buffer)) < 0)
776 smtp_write_error = -1;
777 }
778 else
779 #endif
780
781 if (fprintf(smtp_out, "%s", big_buffer) < 0) smtp_write_error = -1;
782 }
783
784
785
786 /*************************************************
787 * Flush SMTP out and check for error *
788 *************************************************/
789
790 /* This function isn't currently used within Exim (it detects errors when it
791 tries to read the next SMTP input), but is available for use in local_scan().
792 For non-TLS connections, it flushes the output and checks for errors. For
793 TLS-connections, it checks for a previously-detected TLS write error.
794
795 Arguments: none
796 Returns: 0 for no error; -1 after an error
797 */
798
799 int
800 smtp_fflush(void)
801 {
802 if (tls_in.active < 0 && fflush(smtp_out) != 0) smtp_write_error = -1;
803 return smtp_write_error;
804 }
805
806
807
808 /*************************************************
809 * SMTP command read timeout *
810 *************************************************/
811
812 /* Signal handler for timing out incoming SMTP commands. This attempts to
813 finish off tidily.
814
815 Argument: signal number (SIGALRM)
816 Returns: nothing
817 */
818
819 static void
820 command_timeout_handler(int sig)
821 {
822 sig = sig; /* Keep picky compilers happy */
823 log_write(L_lost_incoming_connection,
824 LOG_MAIN, "SMTP command timeout on%s connection from %s",
825 (tls_in.active >= 0)? " TLS" : "",
826 host_and_ident(FALSE));
827 if (smtp_batched_input)
828 moan_smtp_batch(NULL, "421 SMTP command timeout"); /* Does not return */
829 smtp_notquit_exit(US"command-timeout", US"421",
830 US"%s: SMTP command timeout - closing connection", smtp_active_hostname);
831 exim_exit(EXIT_FAILURE);
832 }
833
834
835
836 /*************************************************
837 * SIGTERM received *
838 *************************************************/
839
840 /* Signal handler for handling SIGTERM. Again, try to finish tidily.
841
842 Argument: signal number (SIGTERM)
843 Returns: nothing
844 */
845
846 static void
847 command_sigterm_handler(int sig)
848 {
849 sig = sig; /* Keep picky compilers happy */
850 log_write(0, LOG_MAIN, "%s closed after SIGTERM", smtp_get_connection_info());
851 if (smtp_batched_input)
852 moan_smtp_batch(NULL, "421 SIGTERM received"); /* Does not return */
853 smtp_notquit_exit(US"signal-exit", US"421",
854 US"%s: Service not available - closing connection", smtp_active_hostname);
855 exim_exit(EXIT_FAILURE);
856 }
857
858
859
860
861 #ifdef SUPPORT_PROXY
862 /*************************************************
863 * Restore socket timeout to previous value *
864 *************************************************/
865 /* If the previous value was successfully retrieved, restore
866 it before returning control to the non-proxy routines
867
868 Arguments: fd - File descriptor for input
869 get_ok - Successfully retrieved previous values
870 tvtmp - Time struct with previous values
871 vslen - Length of time struct
872 Returns: none
873 */
874 static void
875 restore_socket_timeout(int fd, int get_ok, struct timeval * tvtmp, socklen_t vslen)
876 {
877 if (get_ok == 0)
878 (void) setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, CS tvtmp, vslen);
879 }
880
881 /*************************************************
882 * Check if host is required proxy host *
883 *************************************************/
884 /* The function determines if inbound host will be a regular smtp host
885 or if it is configured that it must use Proxy Protocol.
886
887 Arguments: none
888 Returns: bool
889 */
890
891 static BOOL
892 check_proxy_protocol_host()
893 {
894 int rc;
895 /* Cannot configure local connection as a proxy inbound */
896 if (sender_host_address == NULL) return proxy_session;
897
898 rc = verify_check_this_host(CUSS &hosts_proxy, NULL, NULL,
899 sender_host_address, NULL);
900 if (rc == OK)
901 {
902 DEBUG(D_receive)
903 debug_printf("Detected proxy protocol configured host\n");
904 proxy_session = TRUE;
905 }
906 return proxy_session;
907 }
908
909
910 /*************************************************
911 * Setup host for proxy protocol *
912 *************************************************/
913 /* The function configures the connection based on a header from the
914 inbound host to use Proxy Protocol. The specification is very exact
915 so exit with an error if do not find the exact required pieces. This
916 includes an incorrect number of spaces separating args.
917
918 Arguments: none
919 Returns: Boolean success
920 */
921
922 static BOOL
923 setup_proxy_protocol_host()
924 {
925 union {
926 struct {
927 uschar line[108];
928 } v1;
929 struct {
930 uschar sig[12];
931 uint8_t ver_cmd;
932 uint8_t fam;
933 uint16_t len;
934 union {
935 struct { /* TCP/UDP over IPv4, len = 12 */
936 uint32_t src_addr;
937 uint32_t dst_addr;
938 uint16_t src_port;
939 uint16_t dst_port;
940 } ip4;
941 struct { /* TCP/UDP over IPv6, len = 36 */
942 uint8_t src_addr[16];
943 uint8_t dst_addr[16];
944 uint16_t src_port;
945 uint16_t dst_port;
946 } ip6;
947 struct { /* AF_UNIX sockets, len = 216 */
948 uschar src_addr[108];
949 uschar dst_addr[108];
950 } unx;
951 } addr;
952 } v2;
953 } hdr;
954
955 /* Temp variables used in PPv2 address:port parsing */
956 uint16_t tmpport;
957 char tmpip[INET_ADDRSTRLEN];
958 struct sockaddr_in tmpaddr;
959 char tmpip6[INET6_ADDRSTRLEN];
960 struct sockaddr_in6 tmpaddr6;
961
962 int get_ok = 0;
963 int size, ret;
964 int fd = fileno(smtp_in);
965 const char v2sig[12] = "\x0D\x0A\x0D\x0A\x00\x0D\x0A\x51\x55\x49\x54\x0A";
966 uschar *iptype; /* To display debug info */
967 struct timeval tv;
968 struct timeval tvtmp;
969 socklen_t vslen = sizeof(struct timeval);
970
971 /* Save current socket timeout values */
972 get_ok = getsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, CS &tvtmp, &vslen);
973
974 /* Proxy Protocol host must send header within a short time
975 (default 3 seconds) or it's considered invalid */
976 tv.tv_sec = PROXY_NEGOTIATION_TIMEOUT_SEC;
977 tv.tv_usec = PROXY_NEGOTIATION_TIMEOUT_USEC;
978 if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, CS &tv, sizeof(tv)) < 0)
979 return FALSE;
980
981 do
982 {
983 /* The inbound host was declared to be a Proxy Protocol host, so
984 don't do a PEEK into the data, actually slurp it up. */
985 ret = recv(fd, &hdr, sizeof(hdr), 0);
986 }
987 while (ret == -1 && errno == EINTR);
988
989 if (ret == -1)
990 goto proxyfail;
991
992 if (ret >= 16 && memcmp(&hdr.v2, v2sig, 12) == 0)
993 {
994 uint8_t ver = (hdr.v2.ver_cmd & 0xf0) >> 4;
995 uint8_t cmd = (hdr.v2.ver_cmd & 0x0f);
996
997 /* May 2014: haproxy combined the version and command into one byte to
998 allow two full bytes for the length field in order to proxy SSL
999 connections. SSL Proxy is not supported in this version of Exim, but
1000 must still separate values here. */
1001
1002 if (ver != 0x02)
1003 {
1004 DEBUG(D_receive) debug_printf("Invalid Proxy Protocol version: %d\n", ver);
1005 goto proxyfail;
1006 }
1007 DEBUG(D_receive) debug_printf("Detected PROXYv2 header\n");
1008 /* The v2 header will always be 16 bytes per the spec. */
1009 size = 16 + ntohs(hdr.v2.len);
1010 if (ret < size)
1011 {
1012 DEBUG(D_receive) debug_printf("Truncated or too large PROXYv2 header (%d/%d)\n",
1013 ret, size);
1014 goto proxyfail;
1015 }
1016 switch (cmd)
1017 {
1018 case 0x01: /* PROXY command */
1019 switch (hdr.v2.fam)
1020 {
1021 case 0x11: /* TCPv4 address type */
1022 iptype = US"IPv4";
1023 tmpaddr.sin_addr.s_addr = hdr.v2.addr.ip4.src_addr;
1024 inet_ntop(AF_INET, &tmpaddr.sin_addr, CS &tmpip, sizeof(tmpip));
1025 if (!string_is_ip_address(US tmpip, NULL))
1026 {
1027 DEBUG(D_receive) debug_printf("Invalid %s source IP\n", iptype);
1028 goto proxyfail;
1029 }
1030 proxy_local_address = sender_host_address;
1031 sender_host_address = string_copy(US tmpip);
1032 tmpport = ntohs(hdr.v2.addr.ip4.src_port);
1033 proxy_local_port = sender_host_port;
1034 sender_host_port = tmpport;
1035 /* Save dest ip/port */
1036 tmpaddr.sin_addr.s_addr = hdr.v2.addr.ip4.dst_addr;
1037 inet_ntop(AF_INET, &tmpaddr.sin_addr, CS &tmpip, sizeof(tmpip));
1038 if (!string_is_ip_address(US tmpip, NULL))
1039 {
1040 DEBUG(D_receive) debug_printf("Invalid %s dest port\n", iptype);
1041 goto proxyfail;
1042 }
1043 proxy_external_address = string_copy(US tmpip);
1044 tmpport = ntohs(hdr.v2.addr.ip4.dst_port);
1045 proxy_external_port = tmpport;
1046 goto done;
1047 case 0x21: /* TCPv6 address type */
1048 iptype = US"IPv6";
1049 memmove(tmpaddr6.sin6_addr.s6_addr, hdr.v2.addr.ip6.src_addr, 16);
1050 inet_ntop(AF_INET6, &tmpaddr6.sin6_addr, CS &tmpip6, sizeof(tmpip6));
1051 if (!string_is_ip_address(US tmpip6, NULL))
1052 {
1053 DEBUG(D_receive) debug_printf("Invalid %s source IP\n", iptype);
1054 goto proxyfail;
1055 }
1056 proxy_local_address = sender_host_address;
1057 sender_host_address = string_copy(US tmpip6);
1058 tmpport = ntohs(hdr.v2.addr.ip6.src_port);
1059 proxy_local_port = sender_host_port;
1060 sender_host_port = tmpport;
1061 /* Save dest ip/port */
1062 memmove(tmpaddr6.sin6_addr.s6_addr, hdr.v2.addr.ip6.dst_addr, 16);
1063 inet_ntop(AF_INET6, &tmpaddr6.sin6_addr, CS &tmpip6, sizeof(tmpip6));
1064 if (!string_is_ip_address(US tmpip6, NULL))
1065 {
1066 DEBUG(D_receive) debug_printf("Invalid %s dest port\n", iptype);
1067 goto proxyfail;
1068 }
1069 proxy_external_address = string_copy(US tmpip6);
1070 tmpport = ntohs(hdr.v2.addr.ip6.dst_port);
1071 proxy_external_port = tmpport;
1072 goto done;
1073 default:
1074 DEBUG(D_receive)
1075 debug_printf("Unsupported PROXYv2 connection type: 0x%02x\n",
1076 hdr.v2.fam);
1077 goto proxyfail;
1078 }
1079 /* Unsupported protocol, keep local connection address */
1080 break;
1081 case 0x00: /* LOCAL command */
1082 /* Keep local connection address for LOCAL */
1083 break;
1084 default:
1085 DEBUG(D_receive)
1086 debug_printf("Unsupported PROXYv2 command: 0x%x\n", cmd);
1087 goto proxyfail;
1088 }
1089 }
1090 else if (ret >= 8 && memcmp(hdr.v1.line, "PROXY", 5) == 0)
1091 {
1092 uschar *p = string_copy(hdr.v1.line);
1093 uschar *end = memchr(p, '\r', ret - 1);
1094 uschar *sp; /* Utility variables follow */
1095 int tmp_port;
1096 char *endc;
1097
1098 if (!end || end[1] != '\n')
1099 {
1100 DEBUG(D_receive) debug_printf("Partial or invalid PROXY header\n");
1101 goto proxyfail;
1102 }
1103 *end = '\0'; /* Terminate the string */
1104 size = end + 2 - hdr.v1.line; /* Skip header + CRLF */
1105 DEBUG(D_receive) debug_printf("Detected PROXYv1 header\n");
1106 /* Step through the string looking for the required fields. Ensure
1107 strict adherence to required formatting, exit for any error. */
1108 p += 5;
1109 if (!isspace(*(p++)))
1110 {
1111 DEBUG(D_receive) debug_printf("Missing space after PROXY command\n");
1112 goto proxyfail;
1113 }
1114 if (!Ustrncmp(p, CCS"TCP4", 4))
1115 iptype = US"IPv4";
1116 else if (!Ustrncmp(p,CCS"TCP6", 4))
1117 iptype = US"IPv6";
1118 else if (!Ustrncmp(p,CCS"UNKNOWN", 7))
1119 {
1120 iptype = US"Unknown";
1121 goto done;
1122 }
1123 else
1124 {
1125 DEBUG(D_receive) debug_printf("Invalid TCP type\n");
1126 goto proxyfail;
1127 }
1128
1129 p += Ustrlen(iptype);
1130 if (!isspace(*(p++)))
1131 {
1132 DEBUG(D_receive) debug_printf("Missing space after TCP4/6 command\n");
1133 goto proxyfail;
1134 }
1135 /* Find the end of the arg */
1136 if ((sp = Ustrchr(p, ' ')) == NULL)
1137 {
1138 DEBUG(D_receive)
1139 debug_printf("Did not find proxied src %s\n", iptype);
1140 goto proxyfail;
1141 }
1142 *sp = '\0';
1143 if(!string_is_ip_address(p, NULL))
1144 {
1145 DEBUG(D_receive)
1146 debug_printf("Proxied src arg is not an %s address\n", iptype);
1147 goto proxyfail;
1148 }
1149 proxy_local_address = sender_host_address;
1150 sender_host_address = p;
1151 p = sp + 1;
1152 if ((sp = Ustrchr(p, ' ')) == NULL)
1153 {
1154 DEBUG(D_receive)
1155 debug_printf("Did not find proxy dest %s\n", iptype);
1156 goto proxyfail;
1157 }
1158 *sp = '\0';
1159 if(!string_is_ip_address(p, NULL))
1160 {
1161 DEBUG(D_receive)
1162 debug_printf("Proxy dest arg is not an %s address\n", iptype);
1163 goto proxyfail;
1164 }
1165 proxy_external_address = p;
1166 p = sp + 1;
1167 if ((sp = Ustrchr(p, ' ')) == NULL)
1168 {
1169 DEBUG(D_receive) debug_printf("Did not find proxied src port\n");
1170 goto proxyfail;
1171 }
1172 *sp = '\0';
1173 tmp_port = strtol(CCS p, &endc, 10);
1174 if (*endc || tmp_port == 0)
1175 {
1176 DEBUG(D_receive)
1177 debug_printf("Proxied src port '%s' not an integer\n", p);
1178 goto proxyfail;
1179 }
1180 proxy_local_port = sender_host_port;
1181 sender_host_port = tmp_port;
1182 p = sp + 1;
1183 if ((sp = Ustrchr(p, '\0')) == NULL)
1184 {
1185 DEBUG(D_receive) debug_printf("Did not find proxy dest port\n");
1186 goto proxyfail;
1187 }
1188 tmp_port = strtol(CCS p, &endc, 10);
1189 if (*endc || tmp_port == 0)
1190 {
1191 DEBUG(D_receive)
1192 debug_printf("Proxy dest port '%s' not an integer\n", p);
1193 goto proxyfail;
1194 }
1195 proxy_external_port = tmp_port;
1196 /* Already checked for /r /n above. Good V1 header received. */
1197 goto done;
1198 }
1199 else
1200 {
1201 /* Wrong protocol */
1202 DEBUG(D_receive) debug_printf("Invalid proxy protocol version negotiation\n");
1203 goto proxyfail;
1204 }
1205
1206 proxyfail:
1207 restore_socket_timeout(fd, get_ok, &tvtmp, vslen);
1208 /* Don't flush any potential buffer contents. Any input should cause a
1209 synchronization failure */
1210 return FALSE;
1211
1212 done:
1213 restore_socket_timeout(fd, get_ok, &tvtmp, vslen);
1214 DEBUG(D_receive)
1215 debug_printf("Valid %s sender from Proxy Protocol header\n", iptype);
1216 return proxy_session;
1217 }
1218 #endif
1219
1220 /*************************************************
1221 * Read one command line *
1222 *************************************************/
1223
1224 /* Strictly, SMTP commands coming over the net are supposed to end with CRLF.
1225 There are sites that don't do this, and in any case internal SMTP probably
1226 should check only for LF. Consequently, we check here for LF only. The line
1227 ends up with [CR]LF removed from its end. If we get an overlong line, treat as
1228 an unknown command. The command is read into the global smtp_cmd_buffer so that
1229 it is available via $smtp_command.
1230
1231 The character reading routine sets up a timeout for each block actually read
1232 from the input (which may contain more than one command). We set up a special
1233 signal handler that closes down the session on a timeout. Control does not
1234 return when it runs.
1235
1236 Arguments:
1237 check_sync if TRUE, check synchronization rules if global option is TRUE
1238
1239 Returns: a code identifying the command (enumerated above)
1240 */
1241
1242 static int
1243 smtp_read_command(BOOL check_sync)
1244 {
1245 int c;
1246 int ptr = 0;
1247 smtp_cmd_list *p;
1248 BOOL hadnull = FALSE;
1249
1250 os_non_restarting_signal(SIGALRM, command_timeout_handler);
1251
1252 while ((c = (receive_getc)()) != '\n' && c != EOF)
1253 {
1254 if (ptr >= smtp_cmd_buffer_size)
1255 {
1256 os_non_restarting_signal(SIGALRM, sigalrm_handler);
1257 return OTHER_CMD;
1258 }
1259 if (c == 0)
1260 {
1261 hadnull = TRUE;
1262 c = '?';
1263 }
1264 smtp_cmd_buffer[ptr++] = c;
1265 }
1266
1267 receive_linecount++; /* For BSMTP errors */
1268 os_non_restarting_signal(SIGALRM, sigalrm_handler);
1269
1270 /* If hit end of file, return pseudo EOF command. Whether we have a
1271 part-line already read doesn't matter, since this is an error state. */
1272
1273 if (c == EOF) return EOF_CMD;
1274
1275 /* Remove any CR and white space at the end of the line, and terminate the
1276 string. */
1277
1278 while (ptr > 0 && isspace(smtp_cmd_buffer[ptr-1])) ptr--;
1279 smtp_cmd_buffer[ptr] = 0;
1280
1281 DEBUG(D_receive) debug_printf("SMTP<< %s\n", smtp_cmd_buffer);
1282
1283 /* NULLs are not allowed in SMTP commands */
1284
1285 if (hadnull) return BADCHAR_CMD;
1286
1287 /* Scan command list and return identity, having set the data pointer
1288 to the start of the actual data characters. Check for SMTP synchronization
1289 if required. */
1290
1291 for (p = cmd_list; p < cmd_list_end; p++)
1292 {
1293 #ifdef SUPPORT_PROXY
1294 /* Only allow QUIT command if Proxy Protocol parsing failed */
1295 if (proxy_session && proxy_session_failed)
1296 {
1297 if (p->cmd != QUIT_CMD)
1298 continue;
1299 }
1300 #endif
1301 if ( p->len
1302 && strncmpic(smtp_cmd_buffer, US p->name, p->len) == 0
1303 && ( smtp_cmd_buffer[p->len-1] == ':' /* "mail from:" or "rcpt to:" */
1304 || smtp_cmd_buffer[p->len] == 0
1305 || smtp_cmd_buffer[p->len] == ' '
1306 ) )
1307 {
1308 if (smtp_inptr < smtp_inend && /* Outstanding input */
1309 p->cmd < sync_cmd_limit && /* Command should sync */
1310 check_sync && /* Local flag set */
1311 smtp_enforce_sync && /* Global flag set */
1312 sender_host_address != NULL && /* Not local input */
1313 !sender_host_notsocket) /* Really is a socket */
1314 return BADSYN_CMD;
1315
1316 /* The variables $smtp_command and $smtp_command_argument point into the
1317 unmodified input buffer. A copy of the latter is taken for actual
1318 processing, so that it can be chopped up into separate parts if necessary,
1319 for example, when processing a MAIL command options such as SIZE that can
1320 follow the sender address. */
1321
1322 smtp_cmd_argument = smtp_cmd_buffer + p->len;
1323 while (isspace(*smtp_cmd_argument)) smtp_cmd_argument++;
1324 Ustrcpy(smtp_data_buffer, smtp_cmd_argument);
1325 smtp_cmd_data = smtp_data_buffer;
1326
1327 /* Count non-mail commands from those hosts that are controlled in this
1328 way. The default is all hosts. We don't waste effort checking the list
1329 until we get a non-mail command, but then cache the result to save checking
1330 again. If there's a DEFER while checking the host, assume it's in the list.
1331
1332 Note that one instance of RSET, EHLO/HELO, and STARTTLS is allowed at the
1333 start of each incoming message by fiddling with the value in the table. */
1334
1335 if (!p->is_mail_cmd)
1336 {
1337 if (count_nonmail == TRUE_UNSET) count_nonmail =
1338 verify_check_host(&smtp_accept_max_nonmail_hosts) != FAIL;
1339 if (count_nonmail && ++nonmail_command_count > smtp_accept_max_nonmail)
1340 return TOO_MANY_NONMAIL_CMD;
1341 }
1342
1343 /* If there is data for a command that does not expect it, generate the
1344 error here. */
1345
1346 return (p->has_arg || *smtp_cmd_data == 0)? p->cmd : BADARG_CMD;
1347 }
1348 }
1349
1350 #ifdef SUPPORT_PROXY
1351 /* Only allow QUIT command if Proxy Protocol parsing failed */
1352 if (proxy_session && proxy_session_failed)
1353 return PROXY_FAIL_IGNORE_CMD;
1354 #endif
1355
1356 /* Enforce synchronization for unknown commands */
1357
1358 if (smtp_inptr < smtp_inend && /* Outstanding input */
1359 check_sync && /* Local flag set */
1360 smtp_enforce_sync && /* Global flag set */
1361 sender_host_address != NULL && /* Not local input */
1362 !sender_host_notsocket) /* Really is a socket */
1363 return BADSYN_CMD;
1364
1365 return OTHER_CMD;
1366 }
1367
1368
1369
1370 /*************************************************
1371 * Forced closedown of call *
1372 *************************************************/
1373
1374 /* This function is called from log.c when Exim is dying because of a serious
1375 disaster, and also from some other places. If an incoming non-batched SMTP
1376 channel is open, it swallows the rest of the incoming message if in the DATA
1377 phase, sends the reply string, and gives an error to all subsequent commands
1378 except QUIT. The existence of an SMTP call is detected by the non-NULLness of
1379 smtp_in.
1380
1381 Arguments:
1382 message SMTP reply string to send, excluding the code
1383
1384 Returns: nothing
1385 */
1386
1387 void
1388 smtp_closedown(uschar *message)
1389 {
1390 if (smtp_in == NULL || smtp_batched_input) return;
1391 receive_swallow_smtp();
1392 smtp_printf("421 %s\r\n", message);
1393
1394 for (;;) switch(smtp_read_command(FALSE))
1395 {
1396 case EOF_CMD:
1397 return;
1398
1399 case QUIT_CMD:
1400 smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
1401 mac_smtp_fflush();
1402 return;
1403
1404 case RSET_CMD:
1405 smtp_printf("250 Reset OK\r\n");
1406 break;
1407
1408 default:
1409 smtp_printf("421 %s\r\n", message);
1410 break;
1411 }
1412 }
1413
1414
1415
1416
1417 /*************************************************
1418 * Set up connection info for logging *
1419 *************************************************/
1420
1421 /* This function is called when logging information about an SMTP connection.
1422 It sets up appropriate source information, depending on the type of connection.
1423 If sender_fullhost is NULL, we are at a very early stage of the connection;
1424 just use the IP address.
1425
1426 Argument: none
1427 Returns: a string describing the connection
1428 */
1429
1430 uschar *
1431 smtp_get_connection_info(void)
1432 {
1433 const uschar * hostname = sender_fullhost
1434 ? sender_fullhost : sender_host_address;
1435
1436 if (host_checking)
1437 return string_sprintf("SMTP connection from %s", hostname);
1438
1439 if (sender_host_unknown || sender_host_notsocket)
1440 return string_sprintf("SMTP connection from %s", sender_ident);
1441
1442 if (is_inetd)
1443 return string_sprintf("SMTP connection from %s (via inetd)", hostname);
1444
1445 if (LOGGING(incoming_interface) && interface_address != NULL)
1446 return string_sprintf("SMTP connection from %s I=[%s]:%d", hostname,
1447 interface_address, interface_port);
1448
1449 return string_sprintf("SMTP connection from %s", hostname);
1450 }
1451
1452
1453
1454 #ifdef SUPPORT_TLS
1455 /* Append TLS-related information to a log line
1456
1457 Arguments:
1458 s String under construction: allocated string to extend, or NULL
1459 sizep Pointer to current allocation size (update on return), or NULL
1460 ptrp Pointer to index for new entries in string (update on return), or NULL
1461
1462 Returns: Allocated string or NULL
1463 */
1464 static uschar *
1465 s_tlslog(uschar * s, int * sizep, int * ptrp)
1466 {
1467 int size = sizep ? *sizep : 0;
1468 int ptr = ptrp ? *ptrp : 0;
1469
1470 if (LOGGING(tls_cipher) && tls_in.cipher != NULL)
1471 s = string_append(s, &size, &ptr, 2, US" X=", tls_in.cipher);
1472 if (LOGGING(tls_certificate_verified) && tls_in.cipher != NULL)
1473 s = string_append(s, &size, &ptr, 2, US" CV=",
1474 tls_in.certificate_verified? "yes":"no");
1475 if (LOGGING(tls_peerdn) && tls_in.peerdn != NULL)
1476 s = string_append(s, &size, &ptr, 3, US" DN=\"",
1477 string_printing(tls_in.peerdn), US"\"");
1478 if (LOGGING(tls_sni) && tls_in.sni != NULL)
1479 s = string_append(s, &size, &ptr, 3, US" SNI=\"",
1480 string_printing(tls_in.sni), US"\"");
1481
1482 if (s)
1483 {
1484 s[ptr] = '\0';
1485 if (sizep) *sizep = size;
1486 if (ptrp) *ptrp = ptr;
1487 }
1488 return s;
1489 }
1490 #endif
1491
1492 /*************************************************
1493 * Log lack of MAIL if so configured *
1494 *************************************************/
1495
1496 /* This function is called when an SMTP session ends. If the log selector
1497 smtp_no_mail is set, write a log line giving some details of what has happened
1498 in the SMTP session.
1499
1500 Arguments: none
1501 Returns: nothing
1502 */
1503
1504 void
1505 smtp_log_no_mail(void)
1506 {
1507 int size, ptr, i;
1508 uschar *s, *sep;
1509
1510 if (smtp_mailcmd_count > 0 || !LOGGING(smtp_no_mail))
1511 return;
1512
1513 s = NULL;
1514 size = ptr = 0;
1515
1516 if (sender_host_authenticated != NULL)
1517 {
1518 s = string_append(s, &size, &ptr, 2, US" A=", sender_host_authenticated);
1519 if (authenticated_id != NULL)
1520 s = string_append(s, &size, &ptr, 2, US":", authenticated_id);
1521 }
1522
1523 #ifdef SUPPORT_TLS
1524 s = s_tlslog(s, &size, &ptr);
1525 #endif
1526
1527 sep = (smtp_connection_had[SMTP_HBUFF_SIZE-1] != SCH_NONE)?
1528 US" C=..." : US" C=";
1529 for (i = smtp_ch_index; i < SMTP_HBUFF_SIZE; i++)
1530 {
1531 if (smtp_connection_had[i] != SCH_NONE)
1532 {
1533 s = string_append(s, &size, &ptr, 2, sep,
1534 smtp_names[smtp_connection_had[i]]);
1535 sep = US",";
1536 }
1537 }
1538
1539 for (i = 0; i < smtp_ch_index; i++)
1540 {
1541 s = string_append(s, &size, &ptr, 2, sep, smtp_names[smtp_connection_had[i]]);
1542 sep = US",";
1543 }
1544
1545 if (s != NULL) s[ptr] = 0; else s = US"";
1546 log_write(0, LOG_MAIN, "no MAIL in SMTP connection from %s D=%s%s",
1547 host_and_ident(FALSE),
1548 readconf_printtime( (int) ((long)time(NULL) - (long)smtp_connection_start)),
1549 s);
1550 }
1551
1552
1553
1554 /*************************************************
1555 * Check HELO line and set sender_helo_name *
1556 *************************************************/
1557
1558 /* Check the format of a HELO line. The data for HELO/EHLO is supposed to be
1559 the domain name of the sending host, or an ip literal in square brackets. The
1560 argument is placed in sender_helo_name, which is in malloc store, because it
1561 must persist over multiple incoming messages. If helo_accept_junk is set, this
1562 host is permitted to send any old junk (needed for some broken hosts).
1563 Otherwise, helo_allow_chars can be used for rogue characters in general
1564 (typically people want to let in underscores).
1565
1566 Argument:
1567 s the data portion of the line (already past any white space)
1568
1569 Returns: TRUE or FALSE
1570 */
1571
1572 static BOOL
1573 check_helo(uschar *s)
1574 {
1575 uschar *start = s;
1576 uschar *end = s + Ustrlen(s);
1577 BOOL yield = helo_accept_junk;
1578
1579 /* Discard any previous helo name */
1580
1581 if (sender_helo_name != NULL)
1582 {
1583 store_free(sender_helo_name);
1584 sender_helo_name = NULL;
1585 }
1586
1587 /* Skip tests if junk is permitted. */
1588
1589 if (!yield)
1590 {
1591 /* Allow the new standard form for IPv6 address literals, namely,
1592 [IPv6:....], and because someone is bound to use it, allow an equivalent
1593 IPv4 form. Allow plain addresses as well. */
1594
1595 if (*s == '[')
1596 {
1597 if (end[-1] == ']')
1598 {
1599 end[-1] = 0;
1600 if (strncmpic(s, US"[IPv6:", 6) == 0)
1601 yield = (string_is_ip_address(s+6, NULL) == 6);
1602 else if (strncmpic(s, US"[IPv4:", 6) == 0)
1603 yield = (string_is_ip_address(s+6, NULL) == 4);
1604 else
1605 yield = (string_is_ip_address(s+1, NULL) != 0);
1606 end[-1] = ']';
1607 }
1608 }
1609
1610 /* Non-literals must be alpha, dot, hyphen, plus any non-valid chars
1611 that have been configured (usually underscore - sigh). */
1612
1613 else if (*s != 0)
1614 {
1615 yield = TRUE;
1616 while (*s != 0)
1617 {
1618 if (!isalnum(*s) && *s != '.' && *s != '-' &&
1619 Ustrchr(helo_allow_chars, *s) == NULL)
1620 {
1621 yield = FALSE;
1622 break;
1623 }
1624 s++;
1625 }
1626 }
1627 }
1628
1629 /* Save argument if OK */
1630
1631 if (yield) sender_helo_name = string_copy_malloc(start);
1632 return yield;
1633 }
1634
1635
1636
1637
1638
1639 /*************************************************
1640 * Extract SMTP command option *
1641 *************************************************/
1642
1643 /* This function picks the next option setting off the end of smtp_cmd_data. It
1644 is called for MAIL FROM and RCPT TO commands, to pick off the optional ESMTP
1645 things that can appear there.
1646
1647 Arguments:
1648 name point this at the name
1649 value point this at the data string
1650
1651 Returns: TRUE if found an option
1652 */
1653
1654 static BOOL
1655 extract_option(uschar **name, uschar **value)
1656 {
1657 uschar *n;
1658 uschar *v = smtp_cmd_data + Ustrlen(smtp_cmd_data) - 1;
1659 while (isspace(*v)) v--;
1660 v[1] = 0;
1661 while (v > smtp_cmd_data && *v != '=' && !isspace(*v)) v--;
1662
1663 n = v;
1664 if (*v == '=')
1665 {
1666 while(isalpha(n[-1])) n--;
1667 /* RFC says SP, but TAB seen in wild and other major MTAs accept it */
1668 if (!isspace(n[-1])) return FALSE;
1669 n[-1] = 0;
1670 }
1671 else
1672 {
1673 n++;
1674 if (v == smtp_cmd_data) return FALSE;
1675 }
1676 *v++ = 0;
1677 *name = n;
1678 *value = v;
1679 return TRUE;
1680 }
1681
1682
1683
1684
1685
1686 /*************************************************
1687 * Reset for new message *
1688 *************************************************/
1689
1690 /* This function is called whenever the SMTP session is reset from
1691 within either of the setup functions.
1692
1693 Argument: the stacking pool storage reset point
1694 Returns: nothing
1695 */
1696
1697 static void
1698 smtp_reset(void *reset_point)
1699 {
1700 store_reset(reset_point);
1701 recipients_list = NULL;
1702 rcpt_count = rcpt_defer_count = rcpt_fail_count =
1703 raw_recipients_count = recipients_count = recipients_list_max = 0;
1704 cancel_cutthrough_connection("smtp reset");
1705 message_linecount = 0;
1706 message_size = -1;
1707 acl_added_headers = NULL;
1708 acl_removed_headers = NULL;
1709 queue_only_policy = FALSE;
1710 rcpt_smtp_response = NULL;
1711 rcpt_smtp_response_same = TRUE;
1712 rcpt_in_progress = FALSE;
1713 deliver_freeze = FALSE; /* Can be set by ACL */
1714 freeze_tell = freeze_tell_config; /* Can be set by ACL */
1715 fake_response = OK; /* Can be set by ACL */
1716 #ifdef WITH_CONTENT_SCAN
1717 no_mbox_unspool = FALSE; /* Can be set by ACL */
1718 #endif
1719 submission_mode = FALSE; /* Can be set by ACL */
1720 suppress_local_fixups = suppress_local_fixups_default; /* Can be set by ACL */
1721 active_local_from_check = local_from_check; /* Can be set by ACL */
1722 active_local_sender_retain = local_sender_retain; /* Can be set by ACL */
1723 sender_address = NULL;
1724 submission_name = NULL; /* Can be set by ACL */
1725 raw_sender = NULL; /* After SMTP rewrite, before qualifying */
1726 sender_address_unrewritten = NULL; /* Set only after verify rewrite */
1727 sender_verified_list = NULL; /* No senders verified */
1728 memset(sender_address_cache, 0, sizeof(sender_address_cache));
1729 memset(sender_domain_cache, 0, sizeof(sender_domain_cache));
1730
1731 authenticated_sender = NULL;
1732 #ifdef EXPERIMENTAL_BRIGHTMAIL
1733 bmi_run = 0;
1734 bmi_verdicts = NULL;
1735 #endif
1736 #ifndef DISABLE_DKIM
1737 dkim_signers = NULL;
1738 dkim_disable_verify = FALSE;
1739 dkim_collect_input = FALSE;
1740 #endif
1741 dsn_ret = 0;
1742 dsn_envid = NULL;
1743 #ifndef DISABLE_PRDR
1744 prdr_requested = FALSE;
1745 #endif
1746 #ifdef EXPERIMENTAL_SPF
1747 spf_header_comment = NULL;
1748 spf_received = NULL;
1749 spf_result = NULL;
1750 spf_smtp_comment = NULL;
1751 #endif
1752 #ifdef SUPPORT_I18N
1753 message_smtputf8 = FALSE;
1754 #endif
1755 body_linecount = body_zerocount = 0;
1756
1757 sender_rate = sender_rate_limit = sender_rate_period = NULL;
1758 ratelimiters_mail = NULL; /* Updated by ratelimit ACL condition */
1759 /* Note that ratelimiters_conn persists across resets. */
1760
1761 /* Reset message ACL variables */
1762
1763 acl_var_m = NULL;
1764
1765 /* The message body variables use malloc store. They may be set if this is
1766 not the first message in an SMTP session and the previous message caused them
1767 to be referenced in an ACL. */
1768
1769 if (message_body != NULL)
1770 {
1771 store_free(message_body);
1772 message_body = NULL;
1773 }
1774
1775 if (message_body_end != NULL)
1776 {
1777 store_free(message_body_end);
1778 message_body_end = NULL;
1779 }
1780
1781 /* Warning log messages are also saved in malloc store. They are saved to avoid
1782 repetition in the same message, but it seems right to repeat them for different
1783 messages. */
1784
1785 while (acl_warn_logged != NULL)
1786 {
1787 string_item *this = acl_warn_logged;
1788 acl_warn_logged = acl_warn_logged->next;
1789 store_free(this);
1790 }
1791 }
1792
1793
1794
1795
1796
1797 /*************************************************
1798 * Initialize for incoming batched SMTP message *
1799 *************************************************/
1800
1801 /* This function is called from smtp_setup_msg() in the case when
1802 smtp_batched_input is true. This happens when -bS is used to pass a whole batch
1803 of messages in one file with SMTP commands between them. All errors must be
1804 reported by sending a message, and only MAIL FROM, RCPT TO, and DATA are
1805 relevant. After an error on a sender, or an invalid recipient, the remainder
1806 of the message is skipped. The value of received_protocol is already set.
1807
1808 Argument: none
1809 Returns: > 0 message successfully started (reached DATA)
1810 = 0 QUIT read or end of file reached
1811 < 0 should not occur
1812 */
1813
1814 static int
1815 smtp_setup_batch_msg(void)
1816 {
1817 int done = 0;
1818 void *reset_point = store_get(0);
1819
1820 /* Save the line count at the start of each transaction - single commands
1821 like HELO and RSET count as whole transactions. */
1822
1823 bsmtp_transaction_linecount = receive_linecount;
1824
1825 if ((receive_feof)()) return 0; /* Treat EOF as QUIT */
1826
1827 smtp_reset(reset_point); /* Reset for start of message */
1828
1829 /* Deal with SMTP commands. This loop is exited by setting done to a POSITIVE
1830 value. The values are 2 larger than the required yield of the function. */
1831
1832 while (done <= 0)
1833 {
1834 uschar *errmess;
1835 uschar *recipient = NULL;
1836 int start, end, sender_domain, recipient_domain;
1837
1838 switch(smtp_read_command(FALSE))
1839 {
1840 /* The HELO/EHLO commands set sender_address_helo if they have
1841 valid data; otherwise they are ignored, except that they do
1842 a reset of the state. */
1843
1844 case HELO_CMD:
1845 case EHLO_CMD:
1846
1847 check_helo(smtp_cmd_data);
1848 /* Fall through */
1849
1850 case RSET_CMD:
1851 smtp_reset(reset_point);
1852 bsmtp_transaction_linecount = receive_linecount;
1853 break;
1854
1855
1856 /* The MAIL FROM command requires an address as an operand. All we
1857 do here is to parse it for syntactic correctness. The form "<>" is
1858 a special case which converts into an empty string. The start/end
1859 pointers in the original are not used further for this address, as
1860 it is the canonical extracted address which is all that is kept. */
1861
1862 case MAIL_CMD:
1863 smtp_mailcmd_count++; /* Count for no-mail log */
1864 if (sender_address != NULL)
1865 /* The function moan_smtp_batch() does not return. */
1866 moan_smtp_batch(smtp_cmd_buffer, "503 Sender already given");
1867
1868 if (smtp_cmd_data[0] == 0)
1869 /* The function moan_smtp_batch() does not return. */
1870 moan_smtp_batch(smtp_cmd_buffer, "501 MAIL FROM must have an address operand");
1871
1872 /* Reset to start of message */
1873
1874 smtp_reset(reset_point);
1875
1876 /* Apply SMTP rewrite */
1877
1878 raw_sender = ((rewrite_existflags & rewrite_smtp) != 0)?
1879 rewrite_one(smtp_cmd_data, rewrite_smtp|rewrite_smtp_sender, NULL, FALSE,
1880 US"", global_rewrite_rules) : smtp_cmd_data;
1881
1882 /* Extract the address; the TRUE flag allows <> as valid */
1883
1884 raw_sender =
1885 parse_extract_address(raw_sender, &errmess, &start, &end, &sender_domain,
1886 TRUE);
1887
1888 if (raw_sender == NULL)
1889 /* The function moan_smtp_batch() does not return. */
1890 moan_smtp_batch(smtp_cmd_buffer, "501 %s", errmess);
1891
1892 sender_address = string_copy(raw_sender);
1893
1894 /* Qualify unqualified sender addresses if permitted to do so. */
1895
1896 if (sender_domain == 0 && sender_address[0] != 0 && sender_address[0] != '@')
1897 {
1898 if (allow_unqualified_sender)
1899 {
1900 sender_address = rewrite_address_qualify(sender_address, FALSE);
1901 DEBUG(D_receive) debug_printf("unqualified address %s accepted "
1902 "and rewritten\n", raw_sender);
1903 }
1904 /* The function moan_smtp_batch() does not return. */
1905 else moan_smtp_batch(smtp_cmd_buffer, "501 sender address must contain "
1906 "a domain");
1907 }
1908 break;
1909
1910
1911 /* The RCPT TO command requires an address as an operand. All we do
1912 here is to parse it for syntactic correctness. There may be any number
1913 of RCPT TO commands, specifying multiple senders. We build them all into
1914 a data structure that is in argc/argv format. The start/end values
1915 given by parse_extract_address are not used, as we keep only the
1916 extracted address. */
1917
1918 case RCPT_CMD:
1919 if (sender_address == NULL)
1920 /* The function moan_smtp_batch() does not return. */
1921 moan_smtp_batch(smtp_cmd_buffer, "503 No sender yet given");
1922
1923 if (smtp_cmd_data[0] == 0)
1924 /* The function moan_smtp_batch() does not return. */
1925 moan_smtp_batch(smtp_cmd_buffer, "501 RCPT TO must have an address operand");
1926
1927 /* Check maximum number allowed */
1928
1929 if (recipients_max > 0 && recipients_count + 1 > recipients_max)
1930 /* The function moan_smtp_batch() does not return. */
1931 moan_smtp_batch(smtp_cmd_buffer, "%s too many recipients",
1932 recipients_max_reject? "552": "452");
1933
1934 /* Apply SMTP rewrite, then extract address. Don't allow "<>" as a
1935 recipient address */
1936
1937 recipient = rewrite_existflags & rewrite_smtp
1938 ? rewrite_one(smtp_cmd_data, rewrite_smtp, NULL, FALSE, US"",
1939 global_rewrite_rules)
1940 : smtp_cmd_data;
1941
1942 recipient = parse_extract_address(recipient, &errmess, &start, &end,
1943 &recipient_domain, FALSE);
1944
1945 if (!recipient)
1946 /* The function moan_smtp_batch() does not return. */
1947 moan_smtp_batch(smtp_cmd_buffer, "501 %s", errmess);
1948
1949 /* If the recipient address is unqualified, qualify it if permitted. Then
1950 add it to the list of recipients. */
1951
1952 if (recipient_domain == 0)
1953 {
1954 if (allow_unqualified_recipient)
1955 {
1956 DEBUG(D_receive) debug_printf("unqualified address %s accepted\n",
1957 recipient);
1958 recipient = rewrite_address_qualify(recipient, TRUE);
1959 }
1960 /* The function moan_smtp_batch() does not return. */
1961 else moan_smtp_batch(smtp_cmd_buffer, "501 recipient address must contain "
1962 "a domain");
1963 }
1964 receive_add_recipient(recipient, -1);
1965 break;
1966
1967
1968 /* The DATA command is legal only if it follows successful MAIL FROM
1969 and RCPT TO commands. This function is complete when a valid DATA
1970 command is encountered. */
1971
1972 case DATA_CMD:
1973 if (sender_address == NULL || recipients_count <= 0)
1974 {
1975 /* The function moan_smtp_batch() does not return. */
1976 if (sender_address == NULL)
1977 moan_smtp_batch(smtp_cmd_buffer,
1978 "503 MAIL FROM:<sender> command must precede DATA");
1979 else
1980 moan_smtp_batch(smtp_cmd_buffer,
1981 "503 RCPT TO:<recipient> must precede DATA");
1982 }
1983 else
1984 {
1985 done = 3; /* DATA successfully achieved */
1986 message_ended = END_NOTENDED; /* Indicate in middle of message */
1987 }
1988 break;
1989
1990
1991 /* The VRFY, EXPN, HELP, ETRN, and NOOP commands are ignored. */
1992
1993 case VRFY_CMD:
1994 case EXPN_CMD:
1995 case HELP_CMD:
1996 case NOOP_CMD:
1997 case ETRN_CMD:
1998 bsmtp_transaction_linecount = receive_linecount;
1999 break;
2000
2001
2002 case EOF_CMD:
2003 case QUIT_CMD:
2004 done = 2;
2005 break;
2006
2007
2008 case BADARG_CMD:
2009 /* The function moan_smtp_batch() does not return. */
2010 moan_smtp_batch(smtp_cmd_buffer, "501 Unexpected argument data");
2011 break;
2012
2013
2014 case BADCHAR_CMD:
2015 /* The function moan_smtp_batch() does not return. */
2016 moan_smtp_batch(smtp_cmd_buffer, "501 Unexpected NULL in SMTP command");
2017 break;
2018
2019
2020 default:
2021 /* The function moan_smtp_batch() does not return. */
2022 moan_smtp_batch(smtp_cmd_buffer, "500 Command unrecognized");
2023 break;
2024 }
2025 }
2026
2027 return done - 2; /* Convert yield values */
2028 }
2029
2030
2031
2032
2033 /*************************************************
2034 * Start an SMTP session *
2035 *************************************************/
2036
2037 /* This function is called at the start of an SMTP session. Thereafter,
2038 smtp_setup_msg() is called to initiate each separate message. This
2039 function does host-specific testing, and outputs the banner line.
2040
2041 Arguments: none
2042 Returns: FALSE if the session can not continue; something has
2043 gone wrong, or the connection to the host is blocked
2044 */
2045
2046 BOOL
2047 smtp_start_session(void)
2048 {
2049 int size = 256;
2050 int ptr, esclen;
2051 uschar *user_msg, *log_msg;
2052 uschar *code, *esc;
2053 uschar *p, *s, *ss;
2054
2055 smtp_connection_start = time(NULL);
2056 for (smtp_ch_index = 0; smtp_ch_index < SMTP_HBUFF_SIZE; smtp_ch_index++)
2057 smtp_connection_had[smtp_ch_index] = SCH_NONE;
2058 smtp_ch_index = 0;
2059
2060 /* Default values for certain variables */
2061
2062 helo_seen = esmtp = helo_accept_junk = FALSE;
2063 smtp_mailcmd_count = 0;
2064 count_nonmail = TRUE_UNSET;
2065 synprot_error_count = unknown_command_count = nonmail_command_count = 0;
2066 smtp_delay_mail = smtp_rlm_base;
2067 auth_advertised = FALSE;
2068 pipelining_advertised = FALSE;
2069 pipelining_enable = TRUE;
2070 sync_cmd_limit = NON_SYNC_CMD_NON_PIPELINING;
2071 smtp_exit_function_called = FALSE; /* For avoiding loop in not-quit exit */
2072
2073 /* If receiving by -bs from a trusted user, or testing with -bh, we allow
2074 authentication settings from -oMaa to remain in force. */
2075
2076 if (!host_checking && !sender_host_notsocket) sender_host_authenticated = NULL;
2077 authenticated_by = NULL;
2078
2079 #ifdef SUPPORT_TLS
2080 tls_in.cipher = tls_in.peerdn = NULL;
2081 tls_in.ourcert = tls_in.peercert = NULL;
2082 tls_in.sni = NULL;
2083 tls_in.ocsp = OCSP_NOT_REQ;
2084 tls_advertised = FALSE;
2085 #endif
2086 dsn_advertised = FALSE;
2087 #ifdef SUPPORT_I18N
2088 smtputf8_advertised = FALSE;
2089 #endif
2090
2091 /* Reset ACL connection variables */
2092
2093 acl_var_c = NULL;
2094
2095 /* Allow for trailing 0 in the command and data buffers. */
2096
2097 if (!(smtp_cmd_buffer = US malloc(2*smtp_cmd_buffer_size + 2)))
2098 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2099 "malloc() failed for SMTP command buffer");
2100
2101 smtp_cmd_buffer[0] = 0;
2102 smtp_data_buffer = smtp_cmd_buffer + smtp_cmd_buffer_size + 1;
2103
2104 /* For batched input, the protocol setting can be overridden from the
2105 command line by a trusted caller. */
2106
2107 if (smtp_batched_input)
2108 {
2109 if (!received_protocol) received_protocol = US"local-bsmtp";
2110 }
2111
2112 /* For non-batched SMTP input, the protocol setting is forced here. It will be
2113 reset later if any of EHLO/AUTH/STARTTLS are received. */
2114
2115 else
2116 received_protocol =
2117 (sender_host_address ? protocols : protocols_local) [pnormal];
2118
2119 /* Set up the buffer for inputting using direct read() calls, and arrange to
2120 call the local functions instead of the standard C ones. */
2121
2122 if (!(smtp_inbuffer = (uschar *)malloc(in_buffer_size)))
2123 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "malloc() failed for SMTP input buffer");
2124
2125 receive_getc = smtp_getc;
2126 receive_get_cache = smtp_get_cache;
2127 receive_ungetc = smtp_ungetc;
2128 receive_feof = smtp_feof;
2129 receive_ferror = smtp_ferror;
2130 receive_smtp_buffered = smtp_buffered;
2131 smtp_inptr = smtp_inend = smtp_inbuffer;
2132 smtp_had_eof = smtp_had_error = 0;
2133
2134 /* Set up the message size limit; this may be host-specific */
2135
2136 thismessage_size_limit = expand_string_integer(message_size_limit, TRUE);
2137 if (expand_string_message != NULL)
2138 {
2139 if (thismessage_size_limit == -1)
2140 log_write(0, LOG_MAIN|LOG_PANIC, "unable to expand message_size_limit: "
2141 "%s", expand_string_message);
2142 else
2143 log_write(0, LOG_MAIN|LOG_PANIC, "invalid message_size_limit: "
2144 "%s", expand_string_message);
2145 smtp_closedown(US"Temporary local problem - please try later");
2146 return FALSE;
2147 }
2148
2149 /* When a message is input locally via the -bs or -bS options, sender_host_
2150 unknown is set unless -oMa was used to force an IP address, in which case it
2151 is checked like a real remote connection. When -bs is used from inetd, this
2152 flag is not set, causing the sending host to be checked. The code that deals
2153 with IP source routing (if configured) is never required for -bs or -bS and
2154 the flag sender_host_notsocket is used to suppress it.
2155
2156 If smtp_accept_max and smtp_accept_reserve are set, keep some connections in
2157 reserve for certain hosts and/or networks. */
2158
2159 if (!sender_host_unknown)
2160 {
2161 int rc;
2162 BOOL reserved_host = FALSE;
2163
2164 /* Look up IP options (source routing info) on the socket if this is not an
2165 -oMa "host", and if any are found, log them and drop the connection.
2166
2167 Linux (and others now, see below) is different to everyone else, so there
2168 has to be some conditional compilation here. Versions of Linux before 2.1.15
2169 used a structure whose name was "options". Somebody finally realized that
2170 this name was silly, and it got changed to "ip_options". I use the
2171 newer name here, but there is a fudge in the script that sets up os.h
2172 to define a macro in older Linux systems.
2173
2174 Sigh. Linux is a fast-moving target. Another generation of Linux uses
2175 glibc 2, which has chosen ip_opts for the structure name. This is now
2176 really a glibc thing rather than a Linux thing, so the condition name
2177 has been changed to reflect this. It is relevant also to GNU/Hurd.
2178
2179 Mac OS 10.x (Darwin) is like the later glibc versions, but without the
2180 setting of the __GLIBC__ macro, so we can't detect it automatically. There's
2181 a special macro defined in the os.h file.
2182
2183 Some DGUX versions on older hardware appear not to support IP options at
2184 all, so there is now a general macro which can be set to cut out this
2185 support altogether.
2186
2187 How to do this properly in IPv6 is not yet known. */
2188
2189 #if !HAVE_IPV6 && !defined(NO_IP_OPTIONS)
2190
2191 #ifdef GLIBC_IP_OPTIONS
2192 #if (!defined __GLIBC__) || (__GLIBC__ < 2)
2193 #define OPTSTYLE 1
2194 #else
2195 #define OPTSTYLE 2
2196 #endif
2197 #elif defined DARWIN_IP_OPTIONS
2198 #define OPTSTYLE 2
2199 #else
2200 #define OPTSTYLE 3
2201 #endif
2202
2203 if (!host_checking && !sender_host_notsocket)
2204 {
2205 #if OPTSTYLE == 1
2206 EXIM_SOCKLEN_T optlen = sizeof(struct ip_options) + MAX_IPOPTLEN;
2207 struct ip_options *ipopt = store_get(optlen);
2208 #elif OPTSTYLE == 2
2209 struct ip_opts ipoptblock;
2210 struct ip_opts *ipopt = &ipoptblock;
2211 EXIM_SOCKLEN_T optlen = sizeof(ipoptblock);
2212 #else
2213 struct ipoption ipoptblock;
2214 struct ipoption *ipopt = &ipoptblock;
2215 EXIM_SOCKLEN_T optlen = sizeof(ipoptblock);
2216 #endif
2217
2218 /* Occasional genuine failures of getsockopt() have been seen - for
2219 example, "reset by peer". Therefore, just log and give up on this
2220 call, unless the error is ENOPROTOOPT. This error is given by systems
2221 that have the interfaces but not the mechanism - e.g. GNU/Hurd at the time
2222 of writing. So for that error, carry on - we just can't do an IP options
2223 check. */
2224
2225 DEBUG(D_receive) debug_printf("checking for IP options\n");
2226
2227 if (getsockopt(fileno(smtp_out), IPPROTO_IP, IP_OPTIONS, (uschar *)(ipopt),
2228 &optlen) < 0)
2229 {
2230 if (errno != ENOPROTOOPT)
2231 {
2232 log_write(0, LOG_MAIN, "getsockopt() failed from %s: %s",
2233 host_and_ident(FALSE), strerror(errno));
2234 smtp_printf("451 SMTP service not available\r\n");
2235 return FALSE;
2236 }
2237 }
2238
2239 /* Deal with any IP options that are set. On the systems I have looked at,
2240 the value of MAX_IPOPTLEN has been 40, meaning that there should never be
2241 more logging data than will fit in big_buffer. Nevertheless, after somebody
2242 questioned this code, I've added in some paranoid checking. */
2243
2244 else if (optlen > 0)
2245 {
2246 uschar *p = big_buffer;
2247 uschar *pend = big_buffer + big_buffer_size;
2248 uschar *opt, *adptr;
2249 int optcount;
2250 struct in_addr addr;
2251
2252 #if OPTSTYLE == 1
2253 uschar *optstart = (uschar *)(ipopt->__data);
2254 #elif OPTSTYLE == 2
2255 uschar *optstart = (uschar *)(ipopt->ip_opts);
2256 #else
2257 uschar *optstart = (uschar *)(ipopt->ipopt_list);
2258 #endif
2259
2260 DEBUG(D_receive) debug_printf("IP options exist\n");
2261
2262 Ustrcpy(p, "IP options on incoming call:");
2263 p += Ustrlen(p);
2264
2265 for (opt = optstart; opt != NULL &&
2266 opt < (uschar *)(ipopt) + optlen;)
2267 {
2268 switch (*opt)
2269 {
2270 case IPOPT_EOL:
2271 opt = NULL;
2272 break;
2273
2274 case IPOPT_NOP:
2275 opt++;
2276 break;
2277
2278 case IPOPT_SSRR:
2279 case IPOPT_LSRR:
2280 if (!string_format(p, pend-p, " %s [@%s",
2281 (*opt == IPOPT_SSRR)? "SSRR" : "LSRR",
2282 #if OPTSTYLE == 1
2283 inet_ntoa(*((struct in_addr *)(&(ipopt->faddr))))))
2284 #elif OPTSTYLE == 2
2285 inet_ntoa(ipopt->ip_dst)))
2286 #else
2287 inet_ntoa(ipopt->ipopt_dst)))
2288 #endif
2289 {
2290 opt = NULL;
2291 break;
2292 }
2293
2294 p += Ustrlen(p);
2295 optcount = (opt[1] - 3) / sizeof(struct in_addr);
2296 adptr = opt + 3;
2297 while (optcount-- > 0)
2298 {
2299 memcpy(&addr, adptr, sizeof(addr));
2300 if (!string_format(p, pend - p - 1, "%s%s",
2301 (optcount == 0)? ":" : "@", inet_ntoa(addr)))
2302 {
2303 opt = NULL;
2304 break;
2305 }
2306 p += Ustrlen(p);
2307 adptr += sizeof(struct in_addr);
2308 }
2309 *p++ = ']';
2310 opt += opt[1];
2311 break;
2312
2313 default:
2314 {
2315 int i;
2316 if (pend - p < 4 + 3*opt[1]) { opt = NULL; break; }
2317 Ustrcat(p, "[ ");
2318 p += 2;
2319 for (i = 0; i < opt[1]; i++)
2320 {
2321 sprintf(CS p, "%2.2x ", opt[i]);
2322 p += 3;
2323 }
2324 *p++ = ']';
2325 }
2326 opt += opt[1];
2327 break;
2328 }
2329 }
2330
2331 *p = 0;
2332 log_write(0, LOG_MAIN, "%s", big_buffer);
2333
2334 /* Refuse any call with IP options. This is what tcpwrappers 7.5 does. */
2335
2336 log_write(0, LOG_MAIN|LOG_REJECT,
2337 "connection from %s refused (IP options)", host_and_ident(FALSE));
2338
2339 smtp_printf("554 SMTP service not available\r\n");
2340 return FALSE;
2341 }
2342
2343 /* Length of options = 0 => there are no options */
2344
2345 else DEBUG(D_receive) debug_printf("no IP options found\n");
2346 }
2347 #endif /* HAVE_IPV6 && !defined(NO_IP_OPTIONS) */
2348
2349 /* Set keep-alive in socket options. The option is on by default. This
2350 setting is an attempt to get rid of some hanging connections that stick in
2351 read() when the remote end (usually a dialup) goes away. */
2352
2353 if (smtp_accept_keepalive && !sender_host_notsocket)
2354 ip_keepalive(fileno(smtp_out), sender_host_address, FALSE);
2355
2356 /* If the current host matches host_lookup, set the name by doing a
2357 reverse lookup. On failure, sender_host_name will be NULL and
2358 host_lookup_failed will be TRUE. This may or may not be serious - optional
2359 checks later. */
2360
2361 if (verify_check_host(&host_lookup) == OK)
2362 {
2363 (void)host_name_lookup();
2364 host_build_sender_fullhost();
2365 }
2366
2367 /* Delay this until we have the full name, if it is looked up. */
2368
2369 set_process_info("handling incoming connection from %s",
2370 host_and_ident(FALSE));
2371
2372 /* Expand smtp_receive_timeout, if needed */
2373
2374 if (smtp_receive_timeout_s)
2375 {
2376 uschar * exp;
2377 if ( !(exp = expand_string(smtp_receive_timeout_s))
2378 || !(*exp)
2379 || (smtp_receive_timeout = readconf_readtime(exp, 0, FALSE)) < 0
2380 )
2381 log_write(0, LOG_MAIN|LOG_PANIC,
2382 "bad value for smtp_receive_timeout: '%s'", exp ? exp : US"");
2383 }
2384
2385 /* Start up TLS if tls_on_connect is set. This is for supporting the legacy
2386 smtps port for use with older style SSL MTAs. */
2387
2388 #ifdef SUPPORT_TLS
2389 if (tls_in.on_connect && tls_server_start(tls_require_ciphers) != OK)
2390 return FALSE;
2391 #endif
2392
2393 /* Test for explicit connection rejection */
2394
2395 if (verify_check_host(&host_reject_connection) == OK)
2396 {
2397 log_write(L_connection_reject, LOG_MAIN|LOG_REJECT, "refused connection "
2398 "from %s (host_reject_connection)", host_and_ident(FALSE));
2399 smtp_printf("554 SMTP service not available\r\n");
2400 return FALSE;
2401 }
2402
2403 /* Test with TCP Wrappers if so configured. There is a problem in that
2404 hosts_ctl() returns 0 (deny) under a number of system failure circumstances,
2405 such as disks dying. In these cases, it is desirable to reject with a 4xx
2406 error instead of a 5xx error. There isn't a "right" way to detect such
2407 problems. The following kludge is used: errno is zeroed before calling
2408 hosts_ctl(). If the result is "reject", a 5xx error is given only if the
2409 value of errno is 0 or ENOENT (which happens if /etc/hosts.{allow,deny} does
2410 not exist). */
2411
2412 #ifdef USE_TCP_WRAPPERS
2413 errno = 0;
2414 tcp_wrappers_name = expand_string(tcp_wrappers_daemon_name);
2415 if (tcp_wrappers_name == NULL)
2416 {
2417 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Expansion of \"%s\" "
2418 "(tcp_wrappers_name) failed: %s", string_printing(tcp_wrappers_name),
2419 expand_string_message);
2420 }
2421 if (!hosts_ctl(tcp_wrappers_name,
2422 (sender_host_name == NULL)? STRING_UNKNOWN : CS sender_host_name,
2423 (sender_host_address == NULL)? STRING_UNKNOWN : CS sender_host_address,
2424 (sender_ident == NULL)? STRING_UNKNOWN : CS sender_ident))
2425 {
2426 if (errno == 0 || errno == ENOENT)
2427 {
2428 HDEBUG(D_receive) debug_printf("tcp wrappers rejection\n");
2429 log_write(L_connection_reject,
2430 LOG_MAIN|LOG_REJECT, "refused connection from %s "
2431 "(tcp wrappers)", host_and_ident(FALSE));
2432 smtp_printf("554 SMTP service not available\r\n");
2433 }
2434 else
2435 {
2436 int save_errno = errno;
2437 HDEBUG(D_receive) debug_printf("tcp wrappers rejected with unexpected "
2438 "errno value %d\n", save_errno);
2439 log_write(L_connection_reject,
2440 LOG_MAIN|LOG_REJECT, "temporarily refused connection from %s "
2441 "(tcp wrappers errno=%d)", host_and_ident(FALSE), save_errno);
2442 smtp_printf("451 Temporary local problem - please try later\r\n");
2443 }
2444 return FALSE;
2445 }
2446 #endif
2447
2448 /* Check for reserved slots. The value of smtp_accept_count has already been
2449 incremented to include this process. */
2450
2451 if (smtp_accept_max > 0 &&
2452 smtp_accept_count > smtp_accept_max - smtp_accept_reserve)
2453 {
2454 if ((rc = verify_check_host(&smtp_reserve_hosts)) != OK)
2455 {
2456 log_write(L_connection_reject,
2457 LOG_MAIN, "temporarily refused connection from %s: not in "
2458 "reserve list: connected=%d max=%d reserve=%d%s",
2459 host_and_ident(FALSE), smtp_accept_count - 1, smtp_accept_max,
2460 smtp_accept_reserve, (rc == DEFER)? " (lookup deferred)" : "");
2461 smtp_printf("421 %s: Too many concurrent SMTP connections; "
2462 "please try again later\r\n", smtp_active_hostname);
2463 return FALSE;
2464 }
2465 reserved_host = TRUE;
2466 }
2467
2468 /* If a load level above which only messages from reserved hosts are
2469 accepted is set, check the load. For incoming calls via the daemon, the
2470 check is done in the superior process if there are no reserved hosts, to
2471 save a fork. In all cases, the load average will already be available
2472 in a global variable at this point. */
2473
2474 if (smtp_load_reserve >= 0 &&
2475 load_average > smtp_load_reserve &&
2476 !reserved_host &&
2477 verify_check_host(&smtp_reserve_hosts) != OK)
2478 {
2479 log_write(L_connection_reject,
2480 LOG_MAIN, "temporarily refused connection from %s: not in "
2481 "reserve list and load average = %.2f", host_and_ident(FALSE),
2482 (double)load_average/1000.0);
2483 smtp_printf("421 %s: Too much load; please try again later\r\n",
2484 smtp_active_hostname);
2485 return FALSE;
2486 }
2487
2488 /* Determine whether unqualified senders or recipients are permitted
2489 for this host. Unfortunately, we have to do this every time, in order to
2490 set the flags so that they can be inspected when considering qualifying
2491 addresses in the headers. For a site that permits no qualification, this
2492 won't take long, however. */
2493
2494 allow_unqualified_sender =
2495 verify_check_host(&sender_unqualified_hosts) == OK;
2496
2497 allow_unqualified_recipient =
2498 verify_check_host(&recipient_unqualified_hosts) == OK;
2499
2500 /* Determine whether HELO/EHLO is required for this host. The requirement
2501 can be hard or soft. */
2502
2503 helo_required = verify_check_host(&helo_verify_hosts) == OK;
2504 if (!helo_required)
2505 helo_verify = verify_check_host(&helo_try_verify_hosts) == OK;
2506
2507 /* Determine whether this hosts is permitted to send syntactic junk
2508 after a HELO or EHLO command. */
2509
2510 helo_accept_junk = verify_check_host(&helo_accept_junk_hosts) == OK;
2511 }
2512
2513 /* For batch SMTP input we are now done. */
2514
2515 if (smtp_batched_input) return TRUE;
2516
2517 #ifdef SUPPORT_PROXY
2518 /* If valid Proxy Protocol source is connecting, set up session.
2519 * Failure will not allow any SMTP function other than QUIT. */
2520 proxy_session = FALSE;
2521 proxy_session_failed = FALSE;
2522 if (check_proxy_protocol_host())
2523 if (!setup_proxy_protocol_host())
2524 {
2525 proxy_session_failed = TRUE;
2526 DEBUG(D_receive)
2527 debug_printf("Failure to extract proxied host, only QUIT allowed\n");
2528 }
2529 else
2530 {
2531 sender_host_name = NULL;
2532 (void)host_name_lookup();
2533 host_build_sender_fullhost();
2534 }
2535 #endif
2536
2537 /* Run the ACL if it exists */
2538
2539 user_msg = NULL;
2540 if (acl_smtp_connect)
2541 {
2542 int rc;
2543 if ((rc = acl_check(ACL_WHERE_CONNECT, NULL, acl_smtp_connect, &user_msg,
2544 &log_msg)) != OK)
2545 {
2546 (void) smtp_handle_acl_fail(ACL_WHERE_CONNECT, rc, user_msg, log_msg);
2547 return FALSE;
2548 }
2549 }
2550
2551 /* Output the initial message for a two-way SMTP connection. It may contain
2552 newlines, which then cause a multi-line response to be given. */
2553
2554 code = US"220"; /* Default status code */
2555 esc = US""; /* Default extended status code */
2556 esclen = 0; /* Length of esc */
2557
2558 if (!user_msg)
2559 {
2560 if (!(s = expand_string(smtp_banner)))
2561 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Expansion of \"%s\" (smtp_banner) "
2562 "failed: %s", smtp_banner, expand_string_message);
2563 }
2564 else
2565 {
2566 int codelen = 3;
2567 s = user_msg;
2568 smtp_message_code(&code, &codelen, &s, NULL, TRUE);
2569 if (codelen > 4)
2570 {
2571 esc = code + 4;
2572 esclen = codelen - 4;
2573 }
2574 }
2575
2576 /* Remove any terminating newlines; might as well remove trailing space too */
2577
2578 p = s + Ustrlen(s);
2579 while (p > s && isspace(p[-1])) p--;
2580 *p = 0;
2581
2582 /* It seems that CC:Mail is braindead, and assumes that the greeting message
2583 is all contained in a single IP packet. The original code wrote out the
2584 greeting using several calls to fprint/fputc, and on busy servers this could
2585 cause it to be split over more than one packet - which caused CC:Mail to fall
2586 over when it got the second part of the greeting after sending its first
2587 command. Sigh. To try to avoid this, build the complete greeting message
2588 first, and output it in one fell swoop. This gives a better chance of it
2589 ending up as a single packet. */
2590
2591 ss = store_get(size);
2592 ptr = 0;
2593
2594 p = s;
2595 do /* At least once, in case we have an empty string */
2596 {
2597 int len;
2598 uschar *linebreak = Ustrchr(p, '\n');
2599 ss = string_catn(ss, &size, &ptr, code, 3);
2600 if (linebreak == NULL)
2601 {
2602 len = Ustrlen(p);
2603 ss = string_catn(ss, &size, &ptr, US" ", 1);
2604 }
2605 else
2606 {
2607 len = linebreak - p;
2608 ss = string_catn(ss, &size, &ptr, US"-", 1);
2609 }
2610 ss = string_catn(ss, &size, &ptr, esc, esclen);
2611 ss = string_catn(ss, &size, &ptr, p, len);
2612 ss = string_catn(ss, &size, &ptr, US"\r\n", 2);
2613 p += len;
2614 if (linebreak != NULL) p++;
2615 }
2616 while (*p != 0);
2617
2618 ss[ptr] = 0; /* string_cat leaves room for this */
2619
2620 /* Before we write the banner, check that there is no input pending, unless
2621 this synchronisation check is disabled. */
2622
2623 if (!check_sync())
2624 {
2625 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP protocol "
2626 "synchronization error (input sent without waiting for greeting): "
2627 "rejected connection from %s input=\"%s\"", host_and_ident(TRUE),
2628 string_printing(smtp_inptr));
2629 smtp_printf("554 SMTP synchronization error\r\n");
2630 return FALSE;
2631 }
2632
2633 /* Now output the banner */
2634
2635 smtp_printf("%s", ss);
2636 return TRUE;
2637 }
2638
2639
2640
2641
2642
2643 /*************************************************
2644 * Handle SMTP syntax and protocol errors *
2645 *************************************************/
2646
2647 /* Write to the log for SMTP syntax errors in incoming commands, if configured
2648 to do so. Then transmit the error response. The return value depends on the
2649 number of syntax and protocol errors in this SMTP session.
2650
2651 Arguments:
2652 type error type, given as a log flag bit
2653 code response code; <= 0 means don't send a response
2654 data data to reflect in the response (can be NULL)
2655 errmess the error message
2656
2657 Returns: -1 limit of syntax/protocol errors NOT exceeded
2658 +1 limit of syntax/protocol errors IS exceeded
2659
2660 These values fit in with the values of the "done" variable in the main
2661 processing loop in smtp_setup_msg(). */
2662
2663 static int
2664 synprot_error(int type, int code, uschar *data, uschar *errmess)
2665 {
2666 int yield = -1;
2667
2668 log_write(type, LOG_MAIN, "SMTP %s error in \"%s\" %s %s",
2669 (type == L_smtp_syntax_error)? "syntax" : "protocol",
2670 string_printing(smtp_cmd_buffer), host_and_ident(TRUE), errmess);
2671
2672 if (++synprot_error_count > smtp_max_synprot_errors)
2673 {
2674 yield = 1;
2675 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP call from %s dropped: too many "
2676 "syntax or protocol errors (last command was \"%s\")",
2677 host_and_ident(FALSE), string_printing(smtp_cmd_buffer));
2678 }
2679
2680 if (code > 0)
2681 {
2682 smtp_printf("%d%c%s%s%s\r\n", code, (yield == 1)? '-' : ' ',
2683 (data == NULL)? US"" : data, (data == NULL)? US"" : US": ", errmess);
2684 if (yield == 1)
2685 smtp_printf("%d Too many syntax or protocol errors\r\n", code);
2686 }
2687
2688 return yield;
2689 }
2690
2691
2692
2693
2694 /*************************************************
2695 * Send SMTP response, possibly multiline *
2696 *************************************************/
2697
2698 /* There are, it seems, broken clients out there that cannot handle multiline
2699 responses. If no_multiline_responses is TRUE (it can be set from an ACL), we
2700 output nothing for non-final calls, and only the first line for anything else.
2701
2702 Arguments:
2703 code SMTP code, may involve extended status codes
2704 codelen length of smtp code; if > 4 there's an ESC
2705 final FALSE if the last line isn't the final line
2706 msg message text, possibly containing newlines
2707
2708 Returns: nothing
2709 */
2710
2711 void
2712 smtp_respond(uschar* code, int codelen, BOOL final, uschar *msg)
2713 {
2714 int esclen = 0;
2715 uschar *esc = US"";
2716
2717 if (!final && no_multiline_responses) return;
2718
2719 if (codelen > 4)
2720 {
2721 esc = code + 4;
2722 esclen = codelen - 4;
2723 }
2724
2725 /* If this is the first output for a (non-batch) RCPT command, see if all RCPTs
2726 have had the same. Note: this code is also present in smtp_printf(). It would
2727 be tidier to have it only in one place, but when it was added, it was easier to
2728 do it that way, so as not to have to mess with the code for the RCPT command,
2729 which sometimes uses smtp_printf() and sometimes smtp_respond(). */
2730
2731 if (rcpt_in_progress)
2732 {
2733 if (rcpt_smtp_response == NULL)
2734 rcpt_smtp_response = string_copy(msg);
2735 else if (rcpt_smtp_response_same &&
2736 Ustrcmp(rcpt_smtp_response, msg) != 0)
2737 rcpt_smtp_response_same = FALSE;
2738 rcpt_in_progress = FALSE;
2739 }
2740
2741 /* Not output the message, splitting it up into multiple lines if necessary. */
2742
2743 for (;;)
2744 {
2745 uschar *nl = Ustrchr(msg, '\n');
2746 if (nl == NULL)
2747 {
2748 smtp_printf("%.3s%c%.*s%s\r\n", code, final? ' ':'-', esclen, esc, msg);
2749 return;
2750 }
2751 else if (nl[1] == 0 || no_multiline_responses)
2752 {
2753 smtp_printf("%.3s%c%.*s%.*s\r\n", code, final? ' ':'-', esclen, esc,
2754 (int)(nl - msg), msg);
2755 return;
2756 }
2757 else
2758 {
2759 smtp_printf("%.3s-%.*s%.*s\r\n", code, esclen, esc, (int)(nl - msg), msg);
2760 msg = nl + 1;
2761 while (isspace(*msg)) msg++;
2762 }
2763 }
2764 }
2765
2766
2767
2768
2769 /*************************************************
2770 * Parse user SMTP message *
2771 *************************************************/
2772
2773 /* This function allows for user messages overriding the response code details
2774 by providing a suitable response code string at the start of the message
2775 user_msg. Check the message for starting with a response code and optionally an
2776 extended status code. If found, check that the first digit is valid, and if so,
2777 change the code pointer and length to use the replacement. An invalid code
2778 causes a panic log; in this case, if the log messages is the same as the user
2779 message, we must also adjust the value of the log message to show the code that
2780 is actually going to be used (the original one).
2781
2782 This function is global because it is called from receive.c as well as within
2783 this module.
2784
2785 Note that the code length returned includes the terminating whitespace
2786 character, which is always included in the regex match.
2787
2788 Arguments:
2789 code SMTP code, may involve extended status codes
2790 codelen length of smtp code; if > 4 there's an ESC
2791 msg message text
2792 log_msg optional log message, to be adjusted with the new SMTP code
2793 check_valid if true, verify the response code
2794
2795 Returns: nothing
2796 */
2797
2798 void
2799 smtp_message_code(uschar **code, int *codelen, uschar **msg, uschar **log_msg,
2800 BOOL check_valid)
2801 {
2802 int n;
2803 int ovector[3];
2804
2805 if (!msg || !*msg) return;
2806
2807 if ((n = pcre_exec(regex_smtp_code, NULL, CS *msg, Ustrlen(*msg), 0,
2808 PCRE_EOPT, ovector, sizeof(ovector)/sizeof(int))) < 0) return;
2809
2810 if (check_valid && (*msg)[0] != (*code)[0])
2811 {
2812 log_write(0, LOG_MAIN|LOG_PANIC, "configured error code starts with "
2813 "incorrect digit (expected %c) in \"%s\"", (*code)[0], *msg);
2814 if (log_msg != NULL && *log_msg == *msg)
2815 *log_msg = string_sprintf("%s %s", *code, *log_msg + ovector[1]);
2816 }
2817 else
2818 {
2819 *code = *msg;
2820 *codelen = ovector[1]; /* Includes final space */
2821 }
2822 *msg += ovector[1]; /* Chop the code off the message */
2823 return;
2824 }
2825
2826
2827
2828
2829 /*************************************************
2830 * Handle an ACL failure *
2831 *************************************************/
2832
2833 /* This function is called when acl_check() fails. As well as calls from within
2834 this module, it is called from receive.c for an ACL after DATA. It sorts out
2835 logging the incident, and sets up the error response. A message containing
2836 newlines is turned into a multiline SMTP response, but for logging, only the
2837 first line is used.
2838
2839 There's a table of default permanent failure response codes to use in
2840 globals.c, along with the table of names. VFRY is special. Despite RFC1123 it
2841 defaults disabled in Exim. However, discussion in connection with RFC 821bis
2842 (aka RFC 2821) has concluded that the response should be 252 in the disabled
2843 state, because there are broken clients that try VRFY before RCPT. A 5xx
2844 response should be given only when the address is positively known to be
2845 undeliverable. Sigh. We return 252 if there is no VRFY ACL or it provides
2846 no explicit code, but if there is one we let it know best.
2847 Also, for ETRN, 458 is given on refusal, and for AUTH, 503.
2848
2849 From Exim 4.63, it is possible to override the response code details by
2850 providing a suitable response code string at the start of the message provided
2851 in user_msg. The code's first digit is checked for validity.
2852
2853 Arguments:
2854 where where the ACL was called from
2855 rc the failure code
2856 user_msg a message that can be included in an SMTP response
2857 log_msg a message for logging
2858
2859 Returns: 0 in most cases
2860 2 if the failure code was FAIL_DROP, in which case the
2861 SMTP connection should be dropped (this value fits with the
2862 "done" variable in smtp_setup_msg() below)
2863 */
2864
2865 int
2866 smtp_handle_acl_fail(int where, int rc, uschar *user_msg, uschar *log_msg)
2867 {
2868 BOOL drop = rc == FAIL_DROP;
2869 int codelen = 3;
2870 uschar *smtp_code;
2871 uschar *lognl;
2872 uschar *sender_info = US"";
2873 uschar *what =
2874 #ifdef WITH_CONTENT_SCAN
2875 where == ACL_WHERE_MIME ? US"during MIME ACL checks" :
2876 #endif
2877 where == ACL_WHERE_PREDATA ? US"DATA" :
2878 where == ACL_WHERE_DATA ? US"after DATA" :
2879 #ifndef DISABLE_PRDR
2880 where == ACL_WHERE_PRDR ? US"after DATA PRDR" :
2881 #endif
2882 smtp_cmd_data ?
2883 string_sprintf("%s %s", acl_wherenames[where], smtp_cmd_data) :
2884 string_sprintf("%s in \"connect\" ACL", acl_wherenames[where]);
2885
2886 if (drop) rc = FAIL;
2887
2888 /* Set the default SMTP code, and allow a user message to change it. */
2889
2890 smtp_code = rc == FAIL ? acl_wherecodes[where] : US"451";
2891 smtp_message_code(&smtp_code, &codelen, &user_msg, &log_msg,
2892 where != ACL_WHERE_VRFY);
2893
2894 /* We used to have sender_address here; however, there was a bug that was not
2895 updating sender_address after a rewrite during a verify. When this bug was
2896 fixed, sender_address at this point became the rewritten address. I'm not sure
2897 this is what should be logged, so I've changed to logging the unrewritten
2898 address to retain backward compatibility. */
2899
2900 #ifndef WITH_CONTENT_SCAN
2901 if (where == ACL_WHERE_RCPT || where == ACL_WHERE_DATA)
2902 #else
2903 if (where == ACL_WHERE_RCPT || where == ACL_WHERE_DATA || where == ACL_WHERE_MIME)
2904 #endif
2905 {
2906 sender_info = string_sprintf("F=<%s>%s%s%s%s ",
2907 sender_address_unrewritten ? sender_address_unrewritten : sender_address,
2908 sender_host_authenticated ? US" A=" : US"",
2909 sender_host_authenticated ? sender_host_authenticated : US"",
2910 sender_host_authenticated && authenticated_id ? US":" : US"",
2911 sender_host_authenticated && authenticated_id ? authenticated_id : US""
2912 );
2913 }
2914
2915 /* If there's been a sender verification failure with a specific message, and
2916 we have not sent a response about it yet, do so now, as a preliminary line for
2917 failures, but not defers. However, always log it for defer, and log it for fail
2918 unless the sender_verify_fail log selector has been turned off. */
2919
2920 if (sender_verified_failed != NULL &&
2921 !testflag(sender_verified_failed, af_sverify_told))
2922 {
2923 BOOL save_rcpt_in_progress = rcpt_in_progress;
2924 rcpt_in_progress = FALSE; /* So as not to treat these as the error */
2925
2926 setflag(sender_verified_failed, af_sverify_told);
2927
2928 if (rc != FAIL || LOGGING(sender_verify_fail))
2929 log_write(0, LOG_MAIN|LOG_REJECT, "%s sender verify %s for <%s>%s",
2930 host_and_ident(TRUE),
2931 ((sender_verified_failed->special_action & 255) == DEFER)? "defer":"fail",
2932 sender_verified_failed->address,
2933 (sender_verified_failed->message == NULL)? US"" :
2934 string_sprintf(": %s", sender_verified_failed->message));
2935
2936 if (rc == FAIL && sender_verified_failed->user_message != NULL)
2937 smtp_respond(smtp_code, codelen, FALSE, string_sprintf(
2938 testflag(sender_verified_failed, af_verify_pmfail)?
2939 "Postmaster verification failed while checking <%s>\n%s\n"
2940 "Several RFCs state that you are required to have a postmaster\n"
2941 "mailbox for each mail domain. This host does not accept mail\n"
2942 "from domains whose servers reject the postmaster address."
2943 :
2944 testflag(sender_verified_failed, af_verify_nsfail)?
2945 "Callback setup failed while verifying <%s>\n%s\n"
2946 "The initial connection, or a HELO or MAIL FROM:<> command was\n"
2947 "rejected. Refusing MAIL FROM:<> does not help fight spam, disregards\n"
2948 "RFC requirements, and stops you from receiving standard bounce\n"
2949 "messages. This host does not accept mail from domains whose servers\n"
2950 "refuse bounces."
2951 :
2952 "Verification failed for <%s>\n%s",
2953 sender_verified_failed->address,
2954 sender_verified_failed->user_message));
2955
2956 rcpt_in_progress = save_rcpt_in_progress;
2957 }
2958
2959 /* Sort out text for logging */
2960
2961 log_msg = log_msg ? string_sprintf(": %s", log_msg) : US"";
2962 if ((lognl = Ustrchr(log_msg, '\n'))) *lognl = 0;
2963
2964 /* Send permanent failure response to the command, but the code used isn't
2965 always a 5xx one - see comments at the start of this function. If the original
2966 rc was FAIL_DROP we drop the connection and yield 2. */
2967
2968 if (rc == FAIL)
2969 smtp_respond(smtp_code, codelen, TRUE,
2970 user_msg ? user_msg : US"Administrative prohibition");
2971
2972 /* Send temporary failure response to the command. Don't give any details,
2973 unless acl_temp_details is set. This is TRUE for a callout defer, a "defer"
2974 verb, and for a header verify when smtp_return_error_details is set.
2975
2976 This conditional logic is all somewhat of a mess because of the odd
2977 interactions between temp_details and return_error_details. One day it should
2978 be re-implemented in a tidier fashion. */
2979
2980 else
2981 if (acl_temp_details && user_msg)
2982 {
2983 if ( smtp_return_error_details
2984 && sender_verified_failed
2985 && sender_verified_failed->message
2986 )
2987 smtp_respond(smtp_code, codelen, FALSE, sender_verified_failed->message);
2988
2989 smtp_respond(smtp_code, codelen, TRUE, user_msg);
2990 }
2991 else
2992 smtp_respond(smtp_code, codelen, TRUE,
2993 US"Temporary local problem - please try later");
2994
2995 /* Log the incident to the logs that are specified by log_reject_target
2996 (default main, reject). This can be empty to suppress logging of rejections. If
2997 the connection is not forcibly to be dropped, return 0. Otherwise, log why it
2998 is closing if required and return 2. */
2999
3000 if (log_reject_target != 0)
3001 {
3002 #ifdef SUPPORT_TLS
3003 uschar * tls = s_tlslog(NULL, NULL, NULL);
3004 if (!tls) tls = US"";
3005 #else
3006 uschar * tls = US"";
3007 #endif
3008 log_write(where == ACL_WHERE_CONNECT ? L_connection_reject : 0,
3009 log_reject_target, "%s%s%s %s%srejected %s%s",
3010 LOGGING(dnssec) && sender_host_dnssec ? US" DS" : US"",
3011 host_and_ident(TRUE),
3012 tls,
3013 sender_info,
3014 rc == FAIL ? US"" : US"temporarily ",
3015 what, log_msg);
3016 }
3017
3018 if (!drop) return 0;
3019
3020 log_write(L_smtp_connection, LOG_MAIN, "%s closed by DROP in ACL",
3021 smtp_get_connection_info());
3022
3023 /* Run the not-quit ACL, but without any custom messages. This should not be a
3024 problem, because we get here only if some other ACL has issued "drop", and
3025 in that case, *its* custom messages will have been used above. */
3026
3027 smtp_notquit_exit(US"acl-drop", NULL, NULL);
3028 return 2;
3029 }
3030
3031
3032
3033
3034 /*************************************************
3035 * Handle SMTP exit when QUIT is not given *
3036 *************************************************/
3037
3038 /* This function provides a logging/statistics hook for when an SMTP connection
3039 is dropped on the floor or the other end goes away. It's a global function
3040 because it's called from receive.c as well as this module. As well as running
3041 the NOTQUIT ACL, if there is one, this function also outputs a final SMTP
3042 response, either with a custom message from the ACL, or using a default. There
3043 is one case, however, when no message is output - after "drop". In that case,
3044 the ACL that obeyed "drop" has already supplied the custom message, and NULL is
3045 passed to this function.
3046
3047 In case things go wrong while processing this function, causing an error that
3048 may re-enter this function, there is a recursion check.
3049
3050 Arguments:
3051 reason What $smtp_notquit_reason will be set to in the ACL;
3052 if NULL, the ACL is not run
3053 code The error code to return as part of the response
3054 defaultrespond The default message if there's no user_msg
3055
3056 Returns: Nothing
3057 */
3058
3059 void
3060 smtp_notquit_exit(uschar *reason, uschar *code, uschar *defaultrespond, ...)
3061 {
3062 int rc;
3063 uschar *user_msg = NULL;
3064 uschar *log_msg = NULL;
3065
3066 /* Check for recursive acll */
3067
3068 if (smtp_exit_function_called)
3069 {
3070 log_write(0, LOG_PANIC, "smtp_notquit_exit() called more than once (%s)",
3071 reason);
3072 return;
3073 }
3074 smtp_exit_function_called = TRUE;
3075
3076 /* Call the not-QUIT ACL, if there is one, unless no reason is given. */
3077
3078 if (acl_smtp_notquit && reason)
3079 {
3080 smtp_notquit_reason = reason;
3081 if ((rc = acl_check(ACL_WHERE_NOTQUIT, NULL, acl_smtp_notquit, &user_msg,
3082 &log_msg)) == ERROR)
3083 log_write(0, LOG_MAIN|LOG_PANIC, "ACL for not-QUIT returned ERROR: %s",
3084 log_msg);
3085 }
3086
3087 /* Write an SMTP response if we are expected to give one. As the default
3088 responses are all internal, they should always fit in the buffer, but code a
3089 warning, just in case. Note that string_vformat() still leaves a complete
3090 string, even if it is incomplete. */
3091
3092 if (code && defaultrespond)
3093 {
3094 if (user_msg)
3095 smtp_respond(code, 3, TRUE, user_msg);
3096 else
3097 {
3098 uschar buffer[128];
3099 va_list ap;
3100 va_start(ap, defaultrespond);
3101 if (!string_vformat(buffer, sizeof(buffer), CS defaultrespond, ap))
3102 log_write(0, LOG_MAIN|LOG_PANIC, "string too large in smtp_notquit_exit()");
3103 smtp_printf("%s %s\r\n", code, buffer);
3104 va_end(ap);
3105 }
3106 mac_smtp_fflush();
3107 }
3108 }
3109
3110
3111
3112
3113 /*************************************************
3114 * Verify HELO argument *
3115 *************************************************/
3116
3117 /* This function is called if helo_verify_hosts or helo_try_verify_hosts is
3118 matched. It is also called from ACL processing if verify = helo is used and
3119 verification was not previously tried (i.e. helo_try_verify_hosts was not
3120 matched). The result of its processing is to set helo_verified and
3121 helo_verify_failed. These variables should both be FALSE for this function to
3122 be called.
3123
3124 Note that EHLO/HELO is legitimately allowed to quote an address literal. Allow
3125 for IPv6 ::ffff: literals.
3126
3127 Argument: none
3128 Returns: TRUE if testing was completed;
3129 FALSE on a temporary failure
3130 */
3131
3132 BOOL
3133 smtp_verify_helo(void)
3134 {
3135 BOOL yield = TRUE;
3136
3137 HDEBUG(D_receive) debug_printf("verifying EHLO/HELO argument \"%s\"\n",
3138 sender_helo_name);
3139
3140 if (sender_helo_name == NULL)
3141 {
3142 HDEBUG(D_receive) debug_printf("no EHLO/HELO command was issued\n");
3143 }
3144
3145 /* Deal with the case of -bs without an IP address */
3146
3147 else if (sender_host_address == NULL)
3148 {
3149 HDEBUG(D_receive) debug_printf("no client IP address: assume success\n");
3150 helo_verified = TRUE;
3151 }
3152
3153 /* Deal with the more common case when there is a sending IP address */
3154
3155 else if (sender_helo_name[0] == '[')
3156 {
3157 helo_verified = Ustrncmp(sender_helo_name+1, sender_host_address,
3158 Ustrlen(sender_host_address)) == 0;
3159
3160 #if HAVE_IPV6
3161 if (!helo_verified)
3162 {
3163 if (strncmpic(sender_host_address, US"::ffff:", 7) == 0)
3164 helo_verified = Ustrncmp(sender_helo_name + 1,
3165 sender_host_address + 7, Ustrlen(sender_host_address) - 7) == 0;
3166 }
3167 #endif
3168
3169 HDEBUG(D_receive)
3170 { if (helo_verified) debug_printf("matched host address\n"); }
3171 }
3172
3173 /* Do a reverse lookup if one hasn't already given a positive or negative
3174 response. If that fails, or the name doesn't match, try checking with a forward
3175 lookup. */
3176
3177 else
3178 {
3179 if (sender_host_name == NULL && !host_lookup_failed)
3180 yield = host_name_lookup() != DEFER;
3181
3182 /* If a host name is known, check it and all its aliases. */
3183
3184 if (sender_host_name)
3185 if ((helo_verified = strcmpic(sender_host_name, sender_helo_name) == 0))
3186 {
3187 sender_helo_dnssec = sender_host_dnssec;
3188 HDEBUG(D_receive) debug_printf("matched host name\n");
3189 }
3190 else
3191 {
3192 uschar **aliases = sender_host_aliases;
3193 while (*aliases)
3194 if ((helo_verified = strcmpic(*aliases++, sender_helo_name) == 0))
3195 {
3196 sender_helo_dnssec = sender_host_dnssec;
3197 break;
3198 }
3199
3200 HDEBUG(D_receive) if (helo_verified)
3201 debug_printf("matched alias %s\n", *(--aliases));
3202 }
3203
3204 /* Final attempt: try a forward lookup of the helo name */
3205
3206 if (!helo_verified)
3207 {
3208 int rc;
3209 host_item h;
3210 dnssec_domains d;
3211 host_item *hh;
3212
3213 h.name = sender_helo_name;
3214 h.address = NULL;
3215 h.mx = MX_NONE;
3216 h.next = NULL;
3217 d.request = US"*";
3218 d.require = US"";
3219
3220 HDEBUG(D_receive) debug_printf("getting IP address for %s\n",
3221 sender_helo_name);
3222 rc = host_find_bydns(&h, NULL, HOST_FIND_BY_A,
3223 NULL, NULL, NULL, &d, NULL, NULL);
3224 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3225 for (hh = &h; hh; hh = hh->next)
3226 if (Ustrcmp(hh->address, sender_host_address) == 0)
3227 {
3228 helo_verified = TRUE;
3229 if (h.dnssec == DS_YES) sender_helo_dnssec = TRUE;
3230 HDEBUG(D_receive)
3231 {
3232 debug_printf("IP address for %s matches calling address\n"
3233 "Forward DNS security status: %sverified\n",
3234 sender_helo_name, sender_helo_dnssec ? "" : "un");
3235 }
3236 break;
3237 }
3238 }
3239 }
3240
3241 if (!helo_verified) helo_verify_failed = TRUE; /* We've tried ... */
3242 return yield;
3243 }
3244
3245
3246
3247
3248 /*************************************************
3249 * Send user response message *
3250 *************************************************/
3251
3252 /* This function is passed a default response code and a user message. It calls
3253 smtp_message_code() to check and possibly modify the response code, and then
3254 calls smtp_respond() to transmit the response. I put this into a function
3255 just to avoid a lot of repetition.
3256
3257 Arguments:
3258 code the response code
3259 user_msg the user message
3260
3261 Returns: nothing
3262 */
3263
3264 static void
3265 smtp_user_msg(uschar *code, uschar *user_msg)
3266 {
3267 int len = 3;
3268 smtp_message_code(&code, &len, &user_msg, NULL, TRUE);
3269 smtp_respond(code, len, TRUE, user_msg);
3270 }
3271
3272
3273
3274 static int
3275 smtp_in_auth(auth_instance *au, uschar ** s, uschar ** ss)
3276 {
3277 const uschar *set_id = NULL;
3278 int rc, i;
3279
3280 /* Run the checking code, passing the remainder of the command line as
3281 data. Initials the $auth<n> variables as empty. Initialize $0 empty and set
3282 it as the only set numerical variable. The authenticator may set $auth<n>
3283 and also set other numeric variables. The $auth<n> variables are preferred
3284 nowadays; the numerical variables remain for backwards compatibility.
3285
3286 Afterwards, have a go at expanding the set_id string, even if
3287 authentication failed - for bad passwords it can be useful to log the
3288 userid. On success, require set_id to expand and exist, and put it in
3289 authenticated_id. Save this in permanent store, as the working store gets
3290 reset at HELO, RSET, etc. */
3291
3292 for (i = 0; i < AUTH_VARS; i++) auth_vars[i] = NULL;
3293 expand_nmax = 0;
3294 expand_nlength[0] = 0; /* $0 contains nothing */
3295
3296 rc = (au->info->servercode)(au, smtp_cmd_data);
3297 if (au->set_id) set_id = expand_string(au->set_id);
3298 expand_nmax = -1; /* Reset numeric variables */
3299 for (i = 0; i < AUTH_VARS; i++) auth_vars[i] = NULL; /* Reset $auth<n> */
3300
3301 /* The value of authenticated_id is stored in the spool file and printed in
3302 log lines. It must not contain binary zeros or newline characters. In
3303 normal use, it never will, but when playing around or testing, this error
3304 can (did) happen. To guard against this, ensure that the id contains only
3305 printing characters. */
3306
3307 if (set_id) set_id = string_printing(set_id);
3308
3309 /* For the non-OK cases, set up additional logging data if set_id
3310 is not empty. */
3311
3312 if (rc != OK)
3313 set_id = set_id && *set_id
3314 ? string_sprintf(" (set_id=%s)", set_id) : US"";
3315
3316 /* Switch on the result */
3317
3318 switch(rc)
3319 {
3320 case OK:
3321 if (!au->set_id || set_id) /* Complete success */
3322 {
3323 if (set_id) authenticated_id = string_copy_malloc(set_id);
3324 sender_host_authenticated = au->name;
3325 authentication_failed = FALSE;
3326 authenticated_fail_id = NULL; /* Impossible to already be set? */
3327
3328 received_protocol =
3329 (sender_host_address ? protocols : protocols_local)
3330 [pextend + pauthed + (tls_in.active >= 0 ? pcrpted:0)];
3331 *s = *ss = US"235 Authentication succeeded";
3332 authenticated_by = au;
3333 break;
3334 }
3335
3336 /* Authentication succeeded, but we failed to expand the set_id string.
3337 Treat this as a temporary error. */
3338
3339 auth_defer_msg = expand_string_message;
3340 /* Fall through */
3341
3342 case DEFER:
3343 if (set_id) authenticated_fail_id = string_copy_malloc(set_id);
3344 *s = string_sprintf("435 Unable to authenticate at present%s",
3345 auth_defer_user_msg);
3346 *ss = string_sprintf("435 Unable to authenticate at present%s: %s",
3347 set_id, auth_defer_msg);
3348 break;
3349
3350 case BAD64:
3351 *s = *ss = US"501 Invalid base64 data";
3352 break;
3353
3354 case CANCELLED:
3355 *s = *ss = US"501 Authentication cancelled";
3356 break;
3357
3358 case UNEXPECTED:
3359 *s = *ss = US"553 Initial data not expected";
3360 break;
3361
3362 case FAIL:
3363 if (set_id) authenticated_fail_id = string_copy_malloc(set_id);
3364 *s = US"535 Incorrect authentication data";
3365 *ss = string_sprintf("535 Incorrect authentication data%s", set_id);
3366 break;
3367
3368 default:
3369 if (set_id) authenticated_fail_id = string_copy_malloc(set_id);
3370 *s = US"435 Internal error";
3371 *ss = string_sprintf("435 Internal error%s: return %d from authentication "
3372 "check", set_id, rc);
3373 break;
3374 }
3375
3376 return rc;
3377 }
3378
3379
3380
3381
3382
3383 static int
3384 qualify_recipient(uschar ** recipient, uschar * smtp_cmd_data, uschar * tag)
3385 {
3386 int rd;
3387 if (allow_unqualified_recipient || strcmpic(*recipient, US"postmaster") == 0)
3388 {
3389 DEBUG(D_receive) debug_printf("unqualified address %s accepted\n",
3390 *recipient);
3391 rd = Ustrlen(recipient) + 1;
3392 *recipient = rewrite_address_qualify(*recipient, TRUE);
3393 return rd;
3394 }
3395 smtp_printf("501 %s: recipient address must contain a domain\r\n",
3396 smtp_cmd_data);
3397 log_write(L_smtp_syntax_error,
3398 LOG_MAIN|LOG_REJECT, "unqualified %s rejected: <%s> %s%s",
3399 tag, *recipient, host_and_ident(TRUE), host_lookup_msg);
3400 return 0;
3401 }
3402
3403
3404
3405
3406 static void
3407 smtp_quit_handler(uschar ** user_msgp, uschar ** log_msgp)
3408 {
3409 HAD(SCH_QUIT);
3410 incomplete_transaction_log(US"QUIT");
3411 if (acl_smtp_quit)
3412 {
3413 int rc = acl_check(ACL_WHERE_QUIT, NULL, acl_smtp_quit, user_msgp, log_msgp);
3414 if (rc == ERROR)
3415 log_write(0, LOG_MAIN|LOG_PANIC, "ACL for QUIT returned ERROR: %s",
3416 *log_msgp);
3417 }
3418 if (*user_msgp)
3419 smtp_respond(US"221", 3, TRUE, *user_msgp);
3420 else
3421 smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
3422
3423 #ifdef SUPPORT_TLS
3424 tls_close(TRUE, TRUE);
3425 #endif
3426
3427 log_write(L_smtp_connection, LOG_MAIN, "%s closed by QUIT",
3428 smtp_get_connection_info());
3429 }
3430
3431
3432 static void
3433 smtp_rset_handler(void)
3434 {
3435 HAD(SCH_RSET);
3436 incomplete_transaction_log(US"RSET");
3437 smtp_printf("250 Reset OK\r\n");
3438 cmd_list[CMD_LIST_RSET].is_mail_cmd = FALSE;
3439 }
3440
3441
3442
3443 /*************************************************
3444 * Initialize for SMTP incoming message *
3445 *************************************************/
3446
3447 /* This function conducts the initial dialogue at the start of an incoming SMTP
3448 message, and builds a list of recipients. However, if the incoming message
3449 is part of a batch (-bS option) a separate function is called since it would
3450 be messy having tests splattered about all over this function. This function
3451 therefore handles the case where interaction is occurring. The input and output
3452 files are set up in smtp_in and smtp_out.
3453
3454 The global recipients_list is set to point to a vector of recipient_item
3455 blocks, whose number is given by recipients_count. This is extended by the
3456 receive_add_recipient() function. The global variable sender_address is set to
3457 the sender's address. The yield is +1 if a message has been successfully
3458 started, 0 if a QUIT command was encountered or the connection was refused from
3459 the particular host, or -1 if the connection was lost.
3460
3461 Argument: none
3462
3463 Returns: > 0 message successfully started (reached DATA)
3464 = 0 QUIT read or end of file reached or call refused
3465 < 0 lost connection
3466 */
3467
3468 int
3469 smtp_setup_msg(void)
3470 {
3471 int done = 0;
3472 BOOL toomany = FALSE;
3473 BOOL discarded = FALSE;
3474 BOOL last_was_rej_mail = FALSE;
3475 BOOL last_was_rcpt = FALSE;
3476 void *reset_point = store_get(0);
3477
3478 DEBUG(D_receive) debug_printf("smtp_setup_msg entered\n");
3479
3480 /* Reset for start of new message. We allow one RSET not to be counted as a
3481 nonmail command, for those MTAs that insist on sending it between every
3482 message. Ditto for EHLO/HELO and for STARTTLS, to allow for going in and out of
3483 TLS between messages (an Exim client may do this if it has messages queued up
3484 for the host). Note: we do NOT reset AUTH at this point. */
3485
3486 smtp_reset(reset_point);
3487 message_ended = END_NOTSTARTED;
3488
3489 chunking_state = chunking_offered ? CHUNKING_OFFERED : CHUNKING_NOT_OFFERED;
3490
3491 cmd_list[CMD_LIST_RSET].is_mail_cmd = TRUE;
3492 cmd_list[CMD_LIST_HELO].is_mail_cmd = TRUE;
3493 cmd_list[CMD_LIST_EHLO].is_mail_cmd = TRUE;
3494 #ifdef SUPPORT_TLS
3495 cmd_list[CMD_LIST_STARTTLS].is_mail_cmd = TRUE;
3496 cmd_list[CMD_LIST_TLS_AUTH].is_mail_cmd = TRUE;
3497 #endif
3498
3499 /* Set the local signal handler for SIGTERM - it tries to end off tidily */
3500
3501 os_non_restarting_signal(SIGTERM, command_sigterm_handler);
3502
3503 /* Batched SMTP is handled in a different function. */
3504
3505 if (smtp_batched_input) return smtp_setup_batch_msg();
3506
3507 /* Deal with SMTP commands. This loop is exited by setting done to a POSITIVE
3508 value. The values are 2 larger than the required yield of the function. */
3509
3510 while (done <= 0)
3511 {
3512 const uschar **argv;