b7e60bfab37faf4387cbef844c9fa50861db479c
[exim.git] / src / src / smtp_in.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions for handling an incoming SMTP call. */
9
10
11 #include "exim.h"
12
13
14 /* Initialize for TCP wrappers if so configured. It appears that the macro
15 HAVE_IPV6 is used in some versions of the tcpd.h header, so we unset it before
16 including that header, and restore its value afterwards. */
17
18 #ifdef USE_TCP_WRAPPERS
19
20 #if HAVE_IPV6
21 #define EXIM_HAVE_IPV6
22 #endif
23 #undef HAVE_IPV6
24 #include <tcpd.h>
25 #undef HAVE_IPV6
26 #ifdef EXIM_HAVE_IPV6
27 #define HAVE_IPV6 TRUE
28 #endif
29
30 int allow_severity = LOG_INFO;
31 int deny_severity = LOG_NOTICE;
32 uschar *tcp_wrappers_name;
33 #endif
34
35
36 /* Size of buffer for reading SMTP commands. We used to use 512, as defined
37 by RFC 821. However, RFC 1869 specifies that this must be increased for SMTP
38 commands that accept arguments, and this in particular applies to AUTH, where
39 the data can be quite long. More recently this value was 2048 in Exim;
40 however, RFC 4954 (circa 2007) recommends 12288 bytes to handle AUTH. Clients
41 such as Thunderbird will send an AUTH with an initial-response for GSSAPI.
42 The maximum size of a Kerberos ticket under Windows 2003 is 12000 bytes, and
43 we need room to handle large base64-encoded AUTHs for GSSAPI.
44 */
45
46 #define smtp_cmd_buffer_size 16384
47
48 /* Size of buffer for reading SMTP incoming packets */
49
50 #define in_buffer_size 8192
51
52 /* Structure for SMTP command list */
53
54 typedef struct {
55 const char *name;
56 int len;
57 short int cmd;
58 short int has_arg;
59 short int is_mail_cmd;
60 } smtp_cmd_list;
61
62 /* Codes for identifying commands. We order them so that those that come first
63 are those for which synchronization is always required. Checking this can help
64 block some spam. */
65
66 enum {
67 /* These commands are required to be synchronized, i.e. to be the last in a
68 block of commands when pipelining. */
69
70 HELO_CMD, EHLO_CMD, DATA_CMD, /* These are listed in the pipelining */
71 VRFY_CMD, EXPN_CMD, NOOP_CMD, /* RFC as requiring synchronization */
72 ETRN_CMD, /* This by analogy with TURN from the RFC */
73 STARTTLS_CMD, /* Required by the STARTTLS RFC */
74
75 /* This is a dummy to identify the non-sync commands when pipelining */
76
77 NON_SYNC_CMD_PIPELINING,
78
79 /* These commands need not be synchronized when pipelining */
80
81 MAIL_CMD, RCPT_CMD, RSET_CMD,
82
83 /* This is a dummy to identify the non-sync commands when not pipelining */
84
85 NON_SYNC_CMD_NON_PIPELINING,
86
87 /* I have been unable to find a statement about the use of pipelining
88 with AUTH, so to be on the safe side it is here, though I kind of feel
89 it should be up there with the synchronized commands. */
90
91 AUTH_CMD,
92
93 /* I'm not sure about these, but I don't think they matter. */
94
95 QUIT_CMD, HELP_CMD,
96
97 #ifdef EXPERIMENTAL_PROXY
98 PROXY_FAIL_IGNORE_CMD,
99 #endif
100
101 /* These are specials that don't correspond to actual commands */
102
103 EOF_CMD, OTHER_CMD, BADARG_CMD, BADCHAR_CMD, BADSYN_CMD,
104 TOO_MANY_NONMAIL_CMD };
105
106
107 /* This is a convenience macro for adding the identity of an SMTP command
108 to the circular buffer that holds a list of the last n received. */
109
110 #define HAD(n) \
111 smtp_connection_had[smtp_ch_index++] = n; \
112 if (smtp_ch_index >= SMTP_HBUFF_SIZE) smtp_ch_index = 0
113
114
115 /*************************************************
116 * Local static variables *
117 *************************************************/
118
119 static auth_instance *authenticated_by;
120 static BOOL auth_advertised;
121 #ifdef SUPPORT_TLS
122 static BOOL tls_advertised;
123 #endif
124 static BOOL esmtp;
125 static BOOL helo_required = FALSE;
126 static BOOL helo_verify = FALSE;
127 static BOOL helo_seen;
128 static BOOL helo_accept_junk;
129 static BOOL count_nonmail;
130 static BOOL pipelining_advertised;
131 static BOOL rcpt_smtp_response_same;
132 static BOOL rcpt_in_progress;
133 static int nonmail_command_count;
134 static BOOL smtp_exit_function_called = 0;
135 static int synprot_error_count;
136 static int unknown_command_count;
137 static int sync_cmd_limit;
138 static int smtp_write_error = 0;
139
140 static uschar *rcpt_smtp_response;
141 static uschar *smtp_data_buffer;
142 static uschar *smtp_cmd_data;
143
144 /* We need to know the position of RSET, HELO, EHLO, AUTH, and STARTTLS. Their
145 final fields of all except AUTH are forced TRUE at the start of a new message
146 setup, to allow one of each between messages that is not counted as a nonmail
147 command. (In fact, only one of HELO/EHLO is not counted.) Also, we have to
148 allow a new EHLO after starting up TLS.
149
150 AUTH is "falsely" labelled as a mail command initially, so that it doesn't get
151 counted. However, the flag is changed when AUTH is received, so that multiple
152 failing AUTHs will eventually hit the limit. After a successful AUTH, another
153 AUTH is already forbidden. After a TLS session is started, AUTH's flag is again
154 forced TRUE, to allow for the re-authentication that can happen at that point.
155
156 QUIT is also "falsely" labelled as a mail command so that it doesn't up the
157 count of non-mail commands and possibly provoke an error. */
158
159 static smtp_cmd_list cmd_list[] = {
160 { "rset", sizeof("rset")-1, RSET_CMD, FALSE, FALSE }, /* First */
161 { "helo", sizeof("helo")-1, HELO_CMD, TRUE, FALSE },
162 { "ehlo", sizeof("ehlo")-1, EHLO_CMD, TRUE, FALSE },
163 { "auth", sizeof("auth")-1, AUTH_CMD, TRUE, TRUE },
164 #ifdef SUPPORT_TLS
165 { "starttls", sizeof("starttls")-1, STARTTLS_CMD, FALSE, FALSE },
166 #endif
167
168 /* If you change anything above here, also fix the definitions below. */
169
170 { "mail from:", sizeof("mail from:")-1, MAIL_CMD, TRUE, TRUE },
171 { "rcpt to:", sizeof("rcpt to:")-1, RCPT_CMD, TRUE, TRUE },
172 { "data", sizeof("data")-1, DATA_CMD, FALSE, TRUE },
173 { "quit", sizeof("quit")-1, QUIT_CMD, FALSE, TRUE },
174 { "noop", sizeof("noop")-1, NOOP_CMD, TRUE, FALSE },
175 { "etrn", sizeof("etrn")-1, ETRN_CMD, TRUE, FALSE },
176 { "vrfy", sizeof("vrfy")-1, VRFY_CMD, TRUE, FALSE },
177 { "expn", sizeof("expn")-1, EXPN_CMD, TRUE, FALSE },
178 { "help", sizeof("help")-1, HELP_CMD, TRUE, FALSE }
179 };
180
181 static smtp_cmd_list *cmd_list_end =
182 cmd_list + sizeof(cmd_list)/sizeof(smtp_cmd_list);
183
184 #define CMD_LIST_RSET 0
185 #define CMD_LIST_HELO 1
186 #define CMD_LIST_EHLO 2
187 #define CMD_LIST_AUTH 3
188 #define CMD_LIST_STARTTLS 4
189
190 /* This list of names is used for performing the smtp_no_mail logging action.
191 It must be kept in step with the SCH_xxx enumerations. */
192
193 static uschar *smtp_names[] =
194 {
195 US"NONE", US"AUTH", US"DATA", US"EHLO", US"ETRN", US"EXPN", US"HELO",
196 US"HELP", US"MAIL", US"NOOP", US"QUIT", US"RCPT", US"RSET", US"STARTTLS",
197 US"VRFY" };
198
199 static uschar *protocols[] = {
200 US"local-smtp", /* HELO */
201 US"local-smtps", /* The rare case EHLO->STARTTLS->HELO */
202 US"local-esmtp", /* EHLO */
203 US"local-esmtps", /* EHLO->STARTTLS->EHLO */
204 US"local-esmtpa", /* EHLO->AUTH */
205 US"local-esmtpsa" /* EHLO->STARTTLS->EHLO->AUTH */
206 };
207
208 #define pnormal 0
209 #define pextend 2
210 #define pcrpted 1 /* added to pextend or pnormal */
211 #define pauthed 2 /* added to pextend */
212 #define pnlocal 6 /* offset to remove "local" */
213
214 /* Sanity check and validate optional args to MAIL FROM: envelope */
215 enum {
216 ENV_MAIL_OPT_SIZE, ENV_MAIL_OPT_BODY, ENV_MAIL_OPT_AUTH,
217 #ifndef DISABLE_PRDR
218 ENV_MAIL_OPT_PRDR,
219 #endif
220 ENV_MAIL_OPT_NULL
221 };
222 typedef struct {
223 uschar * name; /* option requested during MAIL cmd */
224 int value; /* enum type */
225 BOOL need_value; /* TRUE requires value (name=value pair format)
226 FALSE is a singleton */
227 } env_mail_type_t;
228 static env_mail_type_t env_mail_type_list[] = {
229 { US"SIZE", ENV_MAIL_OPT_SIZE, TRUE },
230 { US"BODY", ENV_MAIL_OPT_BODY, TRUE },
231 { US"AUTH", ENV_MAIL_OPT_AUTH, TRUE },
232 #ifndef DISABLE_PRDR
233 { US"PRDR", ENV_MAIL_OPT_PRDR, FALSE },
234 #endif
235 { US"NULL", ENV_MAIL_OPT_NULL, FALSE }
236 };
237
238 /* When reading SMTP from a remote host, we have to use our own versions of the
239 C input-reading functions, in order to be able to flush the SMTP output only
240 when about to read more data from the socket. This is the only way to get
241 optimal performance when the client is using pipelining. Flushing for every
242 command causes a separate packet and reply packet each time; saving all the
243 responses up (when pipelining) combines them into one packet and one response.
244
245 For simplicity, these functions are used for *all* SMTP input, not only when
246 receiving over a socket. However, after setting up a secure socket (SSL), input
247 is read via the OpenSSL library, and another set of functions is used instead
248 (see tls.c).
249
250 These functions are set in the receive_getc etc. variables and called with the
251 same interface as the C functions. However, since there can only ever be
252 one incoming SMTP call, we just use a single buffer and flags. There is no need
253 to implement a complicated private FILE-like structure.*/
254
255 static uschar *smtp_inbuffer;
256 static uschar *smtp_inptr;
257 static uschar *smtp_inend;
258 static int smtp_had_eof;
259 static int smtp_had_error;
260
261
262 /*************************************************
263 * SMTP version of getc() *
264 *************************************************/
265
266 /* This gets the next byte from the SMTP input buffer. If the buffer is empty,
267 it flushes the output, and refills the buffer, with a timeout. The signal
268 handler is set appropriately by the calling function. This function is not used
269 after a connection has negotated itself into an TLS/SSL state.
270
271 Arguments: none
272 Returns: the next character or EOF
273 */
274
275 int
276 smtp_getc(void)
277 {
278 if (smtp_inptr >= smtp_inend)
279 {
280 int rc, save_errno;
281 fflush(smtp_out);
282 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
283 rc = read(fileno(smtp_in), smtp_inbuffer, in_buffer_size);
284 save_errno = errno;
285 alarm(0);
286 if (rc <= 0)
287 {
288 /* Must put the error text in fixed store, because this might be during
289 header reading, where it releases unused store above the header. */
290 if (rc < 0)
291 {
292 smtp_had_error = save_errno;
293 smtp_read_error = string_copy_malloc(
294 string_sprintf(" (error: %s)", strerror(save_errno)));
295 }
296 else smtp_had_eof = 1;
297 return EOF;
298 }
299 #ifndef DISABLE_DKIM
300 dkim_exim_verify_feed(smtp_inbuffer, rc);
301 #endif
302 smtp_inend = smtp_inbuffer + rc;
303 smtp_inptr = smtp_inbuffer;
304 }
305 return *smtp_inptr++;
306 }
307
308
309
310 /*************************************************
311 * SMTP version of ungetc() *
312 *************************************************/
313
314 /* Puts a character back in the input buffer. Only ever
315 called once.
316
317 Arguments:
318 ch the character
319
320 Returns: the character
321 */
322
323 int
324 smtp_ungetc(int ch)
325 {
326 *(--smtp_inptr) = ch;
327 return ch;
328 }
329
330
331
332
333 /*************************************************
334 * SMTP version of feof() *
335 *************************************************/
336
337 /* Tests for a previous EOF
338
339 Arguments: none
340 Returns: non-zero if the eof flag is set
341 */
342
343 int
344 smtp_feof(void)
345 {
346 return smtp_had_eof;
347 }
348
349
350
351
352 /*************************************************
353 * SMTP version of ferror() *
354 *************************************************/
355
356 /* Tests for a previous read error, and returns with errno
357 restored to what it was when the error was detected.
358
359 Arguments: none
360 Returns: non-zero if the error flag is set
361 */
362
363 int
364 smtp_ferror(void)
365 {
366 errno = smtp_had_error;
367 return smtp_had_error;
368 }
369
370
371
372 /*************************************************
373 * Test for characters in the SMTP buffer *
374 *************************************************/
375
376 /* Used at the end of a message
377
378 Arguments: none
379 Returns: TRUE/FALSE
380 */
381
382 BOOL
383 smtp_buffered(void)
384 {
385 return smtp_inptr < smtp_inend;
386 }
387
388
389
390 /*************************************************
391 * Write formatted string to SMTP channel *
392 *************************************************/
393
394 /* This is a separate function so that we don't have to repeat everything for
395 TLS support or debugging. It is global so that the daemon and the
396 authentication functions can use it. It does not return any error indication,
397 because major problems such as dropped connections won't show up till an output
398 flush for non-TLS connections. The smtp_fflush() function is available for
399 checking that: for convenience, TLS output errors are remembered here so that
400 they are also picked up later by smtp_fflush().
401
402 Arguments:
403 format format string
404 ... optional arguments
405
406 Returns: nothing
407 */
408
409 void
410 smtp_printf(const char *format, ...)
411 {
412 va_list ap;
413
414 va_start(ap, format);
415 smtp_vprintf(format, ap);
416 va_end(ap);
417 }
418
419 /* This is split off so that verify.c:respond_printf() can, in effect, call
420 smtp_printf(), bearing in mind that in C a vararg function can't directly
421 call another vararg function, only a function which accepts a va_list. */
422
423 void
424 smtp_vprintf(const char *format, va_list ap)
425 {
426 BOOL yield;
427
428 yield = string_vformat(big_buffer, big_buffer_size, format, ap);
429
430 DEBUG(D_receive)
431 {
432 void *reset_point = store_get(0);
433 uschar *msg_copy, *cr, *end;
434 msg_copy = string_copy(big_buffer);
435 end = msg_copy + Ustrlen(msg_copy);
436 while ((cr = Ustrchr(msg_copy, '\r')) != NULL) /* lose CRs */
437 memmove(cr, cr + 1, (end--) - cr);
438 debug_printf("SMTP>> %s", msg_copy);
439 store_reset(reset_point);
440 }
441
442 if (!yield)
443 {
444 log_write(0, LOG_MAIN|LOG_PANIC, "string too large in smtp_printf()");
445 smtp_closedown(US"Unexpected error");
446 exim_exit(EXIT_FAILURE);
447 }
448
449 /* If this is the first output for a (non-batch) RCPT command, see if all RCPTs
450 have had the same. Note: this code is also present in smtp_respond(). It would
451 be tidier to have it only in one place, but when it was added, it was easier to
452 do it that way, so as not to have to mess with the code for the RCPT command,
453 which sometimes uses smtp_printf() and sometimes smtp_respond(). */
454
455 if (rcpt_in_progress)
456 {
457 if (rcpt_smtp_response == NULL)
458 rcpt_smtp_response = string_copy(big_buffer);
459 else if (rcpt_smtp_response_same &&
460 Ustrcmp(rcpt_smtp_response, big_buffer) != 0)
461 rcpt_smtp_response_same = FALSE;
462 rcpt_in_progress = FALSE;
463 }
464
465 /* Now write the string */
466
467 #ifdef SUPPORT_TLS
468 if (tls_in.active >= 0)
469 {
470 if (tls_write(TRUE, big_buffer, Ustrlen(big_buffer)) < 0)
471 smtp_write_error = -1;
472 }
473 else
474 #endif
475
476 if (fprintf(smtp_out, "%s", big_buffer) < 0) smtp_write_error = -1;
477 }
478
479
480
481 /*************************************************
482 * Flush SMTP out and check for error *
483 *************************************************/
484
485 /* This function isn't currently used within Exim (it detects errors when it
486 tries to read the next SMTP input), but is available for use in local_scan().
487 For non-TLS connections, it flushes the output and checks for errors. For
488 TLS-connections, it checks for a previously-detected TLS write error.
489
490 Arguments: none
491 Returns: 0 for no error; -1 after an error
492 */
493
494 int
495 smtp_fflush(void)
496 {
497 if (tls_in.active < 0 && fflush(smtp_out) != 0) smtp_write_error = -1;
498 return smtp_write_error;
499 }
500
501
502
503 /*************************************************
504 * SMTP command read timeout *
505 *************************************************/
506
507 /* Signal handler for timing out incoming SMTP commands. This attempts to
508 finish off tidily.
509
510 Argument: signal number (SIGALRM)
511 Returns: nothing
512 */
513
514 static void
515 command_timeout_handler(int sig)
516 {
517 sig = sig; /* Keep picky compilers happy */
518 log_write(L_lost_incoming_connection,
519 LOG_MAIN, "SMTP command timeout on%s connection from %s",
520 (tls_in.active >= 0)? " TLS" : "",
521 host_and_ident(FALSE));
522 if (smtp_batched_input)
523 moan_smtp_batch(NULL, "421 SMTP command timeout"); /* Does not return */
524 smtp_notquit_exit(US"command-timeout", US"421",
525 US"%s: SMTP command timeout - closing connection", smtp_active_hostname);
526 exim_exit(EXIT_FAILURE);
527 }
528
529
530
531 /*************************************************
532 * SIGTERM received *
533 *************************************************/
534
535 /* Signal handler for handling SIGTERM. Again, try to finish tidily.
536
537 Argument: signal number (SIGTERM)
538 Returns: nothing
539 */
540
541 static void
542 command_sigterm_handler(int sig)
543 {
544 sig = sig; /* Keep picky compilers happy */
545 log_write(0, LOG_MAIN, "%s closed after SIGTERM", smtp_get_connection_info());
546 if (smtp_batched_input)
547 moan_smtp_batch(NULL, "421 SIGTERM received"); /* Does not return */
548 smtp_notquit_exit(US"signal-exit", US"421",
549 US"%s: Service not available - closing connection", smtp_active_hostname);
550 exim_exit(EXIT_FAILURE);
551 }
552
553
554
555
556 #ifdef EXPERIMENTAL_PROXY
557 /*************************************************
558 * Restore socket timeout to previous value *
559 *************************************************/
560 /* If the previous value was successfully retrieved, restore
561 it before returning control to the non-proxy routines
562
563 Arguments: fd - File descriptor for input
564 get_ok - Successfully retrieved previous values
565 tvtmp - Time struct with previous values
566 vslen - Length of time struct
567 Returns: none
568 */
569 static void
570 restore_socket_timeout(int fd, int get_ok, struct timeval tvtmp, socklen_t vslen)
571 {
572 if (get_ok == 0)
573 setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (char *)&tvtmp, vslen);
574 }
575
576 /*************************************************
577 * Check if host is required proxy host *
578 *************************************************/
579 /* The function determines if inbound host will be a regular smtp host
580 or if it is configured that it must use Proxy Protocol.
581
582 Arguments: none
583 Returns: bool
584 */
585
586 static BOOL
587 check_proxy_protocol_host()
588 {
589 int rc;
590 /* Cannot configure local connection as a proxy inbound */
591 if (sender_host_address == NULL) return proxy_session;
592
593 rc = verify_check_this_host(&proxy_required_hosts, NULL, NULL,
594 sender_host_address, NULL);
595 if (rc == OK)
596 {
597 DEBUG(D_receive)
598 debug_printf("Detected proxy protocol configured host\n");
599 proxy_session = TRUE;
600 }
601 return proxy_session;
602 }
603
604
605 /*************************************************
606 * Setup host for proxy protocol *
607 *************************************************/
608 /* The function configures the connection based on a header from the
609 inbound host to use Proxy Protocol. The specification is very exact
610 so exit with an error if do not find the exact required pieces. This
611 includes an incorrect number of spaces separating args.
612
613 Arguments: none
614 Returns: int
615 */
616
617 static BOOL
618 setup_proxy_protocol_host()
619 {
620 union {
621 struct {
622 uschar line[108];
623 } v1;
624 struct {
625 uschar sig[12];
626 uint8_t ver_cmd;
627 uint8_t fam;
628 uint16_t len;
629 union {
630 struct { /* TCP/UDP over IPv4, len = 12 */
631 uint32_t src_addr;
632 uint32_t dst_addr;
633 uint16_t src_port;
634 uint16_t dst_port;
635 } ip4;
636 struct { /* TCP/UDP over IPv6, len = 36 */
637 uint8_t src_addr[16];
638 uint8_t dst_addr[16];
639 uint16_t src_port;
640 uint16_t dst_port;
641 } ip6;
642 struct { /* AF_UNIX sockets, len = 216 */
643 uschar src_addr[108];
644 uschar dst_addr[108];
645 } unx;
646 } addr;
647 } v2;
648 } hdr;
649
650 /* Temp variables used in PPv2 address:port parsing */
651 uint16_t tmpport;
652 char tmpip[INET_ADDRSTRLEN];
653 struct sockaddr_in tmpaddr;
654 char tmpip6[INET6_ADDRSTRLEN];
655 struct sockaddr_in6 tmpaddr6;
656
657 int get_ok = 0;
658 int size, ret, fd;
659 const char v2sig[12] = "\x0D\x0A\x0D\x0A\x00\x0D\x0A\x51\x55\x49\x54\x0A";
660 uschar *iptype; /* To display debug info */
661 struct timeval tv;
662 socklen_t vslen = 0;
663 struct timeval tvtmp;
664
665 vslen = sizeof(struct timeval);
666
667 fd = fileno(smtp_in);
668
669 /* Save current socket timeout values */
670 get_ok = getsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (char *)&tvtmp,
671 &vslen);
672
673 /* Proxy Protocol host must send header within a short time
674 (default 3 seconds) or it's considered invalid */
675 tv.tv_sec = PROXY_NEGOTIATION_TIMEOUT_SEC;
676 tv.tv_usec = PROXY_NEGOTIATION_TIMEOUT_USEC;
677 setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (char *)&tv,
678 sizeof(struct timeval));
679
680 do
681 {
682 /* The inbound host was declared to be a Proxy Protocol host, so
683 don't do a PEEK into the data, actually slurp it up. */
684 ret = recv(fd, &hdr, sizeof(hdr), 0);
685 }
686 while (ret == -1 && errno == EINTR);
687
688 if (ret == -1)
689 {
690 restore_socket_timeout(fd, get_ok, tvtmp, vslen);
691 return (errno == EAGAIN) ? 0 : ERRNO_PROXYFAIL;
692 }
693
694 if (ret >= 16 &&
695 memcmp(&hdr.v2, v2sig, 12) == 0)
696 {
697 uint8_t ver, cmd;
698
699 /* May 2014: haproxy combined the version and command into one byte to
700 allow two full bytes for the length field in order to proxy SSL
701 connections. SSL Proxy is not supported in this version of Exim, but
702 must still seperate values here. */
703 ver = (hdr.v2.ver_cmd & 0xf0) >> 4;
704 cmd = (hdr.v2.ver_cmd & 0x0f);
705
706 if (ver != 0x02)
707 {
708 DEBUG(D_receive) debug_printf("Invalid Proxy Protocol version: %d\n", ver);
709 goto proxyfail;
710 }
711 DEBUG(D_receive) debug_printf("Detected PROXYv2 header\n");
712 /* The v2 header will always be 16 bytes per the spec. */
713 size = 16 + hdr.v2.len;
714 if (ret < size)
715 {
716 DEBUG(D_receive) debug_printf("Truncated or too large PROXYv2 header (%d/%d)\n",
717 ret, size);
718 goto proxyfail;
719 }
720 switch (cmd)
721 {
722 case 0x01: /* PROXY command */
723 switch (hdr.v2.fam)
724 {
725 case 0x11: /* TCPv4 address type */
726 iptype = US"IPv4";
727 tmpaddr.sin_addr.s_addr = hdr.v2.addr.ip4.src_addr;
728 inet_ntop(AF_INET, &(tmpaddr.sin_addr), (char *)&tmpip, sizeof(tmpip));
729 if (!string_is_ip_address(US tmpip,NULL))
730 {
731 DEBUG(D_receive) debug_printf("Invalid %s source IP\n", iptype);
732 return ERRNO_PROXYFAIL;
733 }
734 proxy_host_address = sender_host_address;
735 sender_host_address = string_copy(US tmpip);
736 tmpport = ntohs(hdr.v2.addr.ip4.src_port);
737 proxy_host_port = sender_host_port;
738 sender_host_port = tmpport;
739 /* Save dest ip/port */
740 tmpaddr.sin_addr.s_addr = hdr.v2.addr.ip4.dst_addr;
741 inet_ntop(AF_INET, &(tmpaddr.sin_addr), (char *)&tmpip, sizeof(tmpip));
742 if (!string_is_ip_address(US tmpip,NULL))
743 {
744 DEBUG(D_receive) debug_printf("Invalid %s dest port\n", iptype);
745 return ERRNO_PROXYFAIL;
746 }
747 proxy_target_address = string_copy(US tmpip);
748 tmpport = ntohs(hdr.v2.addr.ip4.dst_port);
749 proxy_target_port = tmpport;
750 goto done;
751 case 0x21: /* TCPv6 address type */
752 iptype = US"IPv6";
753 memmove(tmpaddr6.sin6_addr.s6_addr, hdr.v2.addr.ip6.src_addr, 16);
754 inet_ntop(AF_INET6, &(tmpaddr6.sin6_addr), (char *)&tmpip6, sizeof(tmpip6));
755 if (!string_is_ip_address(US tmpip6,NULL))
756 {
757 DEBUG(D_receive) debug_printf("Invalid %s source IP\n", iptype);
758 return ERRNO_PROXYFAIL;
759 }
760 proxy_host_address = sender_host_address;
761 sender_host_address = string_copy(US tmpip6);
762 tmpport = ntohs(hdr.v2.addr.ip6.src_port);
763 proxy_host_port = sender_host_port;
764 sender_host_port = tmpport;
765 /* Save dest ip/port */
766 memmove(tmpaddr6.sin6_addr.s6_addr, hdr.v2.addr.ip6.dst_addr, 16);
767 inet_ntop(AF_INET6, &(tmpaddr6.sin6_addr), (char *)&tmpip6, sizeof(tmpip6));
768 if (!string_is_ip_address(US tmpip6,NULL))
769 {
770 DEBUG(D_receive) debug_printf("Invalid %s dest port\n", iptype);
771 return ERRNO_PROXYFAIL;
772 }
773 proxy_target_address = string_copy(US tmpip6);
774 tmpport = ntohs(hdr.v2.addr.ip6.dst_port);
775 proxy_target_port = tmpport;
776 goto done;
777 default:
778 DEBUG(D_receive)
779 debug_printf("Unsupported PROXYv2 connection type: 0x%02x\n",
780 hdr.v2.fam);
781 goto proxyfail;
782 }
783 /* Unsupported protocol, keep local connection address */
784 break;
785 case 0x00: /* LOCAL command */
786 /* Keep local connection address for LOCAL */
787 break;
788 default:
789 DEBUG(D_receive)
790 debug_printf("Unsupported PROXYv2 command: 0x%x\n", cmd);
791 goto proxyfail;
792 }
793 }
794 else if (ret >= 8 &&
795 memcmp(hdr.v1.line, "PROXY", 5) == 0)
796 {
797 uschar *p = string_copy(hdr.v1.line);
798 uschar *end = memchr(p, '\r', ret - 1);
799 uschar *sp; /* Utility variables follow */
800 int tmp_port;
801 char *endc;
802
803 if (!end || end[1] != '\n')
804 {
805 DEBUG(D_receive) debug_printf("Partial or invalid PROXY header\n");
806 goto proxyfail;
807 }
808 *end = '\0'; /* Terminate the string */
809 size = end + 2 - hdr.v1.line; /* Skip header + CRLF */
810 DEBUG(D_receive) debug_printf("Detected PROXYv1 header\n");
811 /* Step through the string looking for the required fields. Ensure
812 strict adherance to required formatting, exit for any error. */
813 p += 5;
814 if (!isspace(*(p++)))
815 {
816 DEBUG(D_receive) debug_printf("Missing space after PROXY command\n");
817 goto proxyfail;
818 }
819 if (!Ustrncmp(p, CCS"TCP4", 4))
820 iptype = US"IPv4";
821 else if (!Ustrncmp(p,CCS"TCP6", 4))
822 iptype = US"IPv6";
823 else if (!Ustrncmp(p,CCS"UNKNOWN", 7))
824 {
825 iptype = US"Unknown";
826 goto done;
827 }
828 else
829 {
830 DEBUG(D_receive) debug_printf("Invalid TCP type\n");
831 goto proxyfail;
832 }
833
834 p += Ustrlen(iptype);
835 if (!isspace(*(p++)))
836 {
837 DEBUG(D_receive) debug_printf("Missing space after TCP4/6 command\n");
838 goto proxyfail;
839 }
840 /* Find the end of the arg */
841 if ((sp = Ustrchr(p, ' ')) == NULL)
842 {
843 DEBUG(D_receive)
844 debug_printf("Did not find proxied src %s\n", iptype);
845 goto proxyfail;
846 }
847 *sp = '\0';
848 if(!string_is_ip_address(p,NULL))
849 {
850 DEBUG(D_receive)
851 debug_printf("Proxied src arg is not an %s address\n", iptype);
852 goto proxyfail;
853 }
854 proxy_host_address = sender_host_address;
855 sender_host_address = p;
856 p = sp + 1;
857 if ((sp = Ustrchr(p, ' ')) == NULL)
858 {
859 DEBUG(D_receive)
860 debug_printf("Did not find proxy dest %s\n", iptype);
861 goto proxyfail;
862 }
863 *sp = '\0';
864 if(!string_is_ip_address(p,NULL))
865 {
866 DEBUG(D_receive)
867 debug_printf("Proxy dest arg is not an %s address\n", iptype);
868 goto proxyfail;
869 }
870 proxy_target_address = p;
871 p = sp + 1;
872 if ((sp = Ustrchr(p, ' ')) == NULL)
873 {
874 DEBUG(D_receive) debug_printf("Did not find proxied src port\n");
875 goto proxyfail;
876 }
877 *sp = '\0';
878 tmp_port = strtol(CCS p,&endc,10);
879 if (*endc || tmp_port == 0)
880 {
881 DEBUG(D_receive)
882 debug_printf("Proxied src port '%s' not an integer\n", p);
883 goto proxyfail;
884 }
885 proxy_host_port = sender_host_port;
886 sender_host_port = tmp_port;
887 p = sp + 1;
888 if ((sp = Ustrchr(p, '\0')) == NULL)
889 {
890 DEBUG(D_receive) debug_printf("Did not find proxy dest port\n");
891 goto proxyfail;
892 }
893 tmp_port = strtol(CCS p,&endc,10);
894 if (*endc || tmp_port == 0)
895 {
896 DEBUG(D_receive)
897 debug_printf("Proxy dest port '%s' not an integer\n", p);
898 goto proxyfail;
899 }
900 proxy_target_port = tmp_port;
901 /* Already checked for /r /n above. Good V1 header received. */
902 goto done;
903 }
904 else
905 {
906 /* Wrong protocol */
907 DEBUG(D_receive) debug_printf("Invalid proxy protocol version negotiation\n");
908 goto proxyfail;
909 }
910
911 proxyfail:
912 restore_socket_timeout(fd, get_ok, tvtmp, vslen);
913 /* Don't flush any potential buffer contents. Any input should cause a
914 synchronization failure */
915 return FALSE;
916
917 done:
918 restore_socket_timeout(fd, get_ok, tvtmp, vslen);
919 DEBUG(D_receive)
920 debug_printf("Valid %s sender from Proxy Protocol header\n", iptype);
921 return proxy_session;
922 }
923 #endif
924
925 /*************************************************
926 * Read one command line *
927 *************************************************/
928
929 /* Strictly, SMTP commands coming over the net are supposed to end with CRLF.
930 There are sites that don't do this, and in any case internal SMTP probably
931 should check only for LF. Consequently, we check here for LF only. The line
932 ends up with [CR]LF removed from its end. If we get an overlong line, treat as
933 an unknown command. The command is read into the global smtp_cmd_buffer so that
934 it is available via $smtp_command.
935
936 The character reading routine sets up a timeout for each block actually read
937 from the input (which may contain more than one command). We set up a special
938 signal handler that closes down the session on a timeout. Control does not
939 return when it runs.
940
941 Arguments:
942 check_sync if TRUE, check synchronization rules if global option is TRUE
943
944 Returns: a code identifying the command (enumerated above)
945 */
946
947 static int
948 smtp_read_command(BOOL check_sync)
949 {
950 int c;
951 int ptr = 0;
952 smtp_cmd_list *p;
953 BOOL hadnull = FALSE;
954
955 os_non_restarting_signal(SIGALRM, command_timeout_handler);
956
957 while ((c = (receive_getc)()) != '\n' && c != EOF)
958 {
959 if (ptr >= smtp_cmd_buffer_size)
960 {
961 os_non_restarting_signal(SIGALRM, sigalrm_handler);
962 return OTHER_CMD;
963 }
964 if (c == 0)
965 {
966 hadnull = TRUE;
967 c = '?';
968 }
969 smtp_cmd_buffer[ptr++] = c;
970 }
971
972 receive_linecount++; /* For BSMTP errors */
973 os_non_restarting_signal(SIGALRM, sigalrm_handler);
974
975 /* If hit end of file, return pseudo EOF command. Whether we have a
976 part-line already read doesn't matter, since this is an error state. */
977
978 if (c == EOF) return EOF_CMD;
979
980 /* Remove any CR and white space at the end of the line, and terminate the
981 string. */
982
983 while (ptr > 0 && isspace(smtp_cmd_buffer[ptr-1])) ptr--;
984 smtp_cmd_buffer[ptr] = 0;
985
986 DEBUG(D_receive) debug_printf("SMTP<< %s\n", smtp_cmd_buffer);
987
988 /* NULLs are not allowed in SMTP commands */
989
990 if (hadnull) return BADCHAR_CMD;
991
992 /* Scan command list and return identity, having set the data pointer
993 to the start of the actual data characters. Check for SMTP synchronization
994 if required. */
995
996 for (p = cmd_list; p < cmd_list_end; p++)
997 {
998 #ifdef EXPERIMENTAL_PROXY
999 /* Only allow QUIT command if Proxy Protocol parsing failed */
1000 if (proxy_session && proxy_session_failed)
1001 {
1002 if (p->cmd != QUIT_CMD)
1003 continue;
1004 }
1005 #endif
1006 if (strncmpic(smtp_cmd_buffer, US p->name, p->len) == 0 &&
1007 (smtp_cmd_buffer[p->len-1] == ':' || /* "mail from:" or "rcpt to:" */
1008 smtp_cmd_buffer[p->len] == 0 ||
1009 smtp_cmd_buffer[p->len] == ' '))
1010 {
1011 if (smtp_inptr < smtp_inend && /* Outstanding input */
1012 p->cmd < sync_cmd_limit && /* Command should sync */
1013 check_sync && /* Local flag set */
1014 smtp_enforce_sync && /* Global flag set */
1015 sender_host_address != NULL && /* Not local input */
1016 !sender_host_notsocket) /* Really is a socket */
1017 return BADSYN_CMD;
1018
1019 /* The variables $smtp_command and $smtp_command_argument point into the
1020 unmodified input buffer. A copy of the latter is taken for actual
1021 processing, so that it can be chopped up into separate parts if necessary,
1022 for example, when processing a MAIL command options such as SIZE that can
1023 follow the sender address. */
1024
1025 smtp_cmd_argument = smtp_cmd_buffer + p->len;
1026 while (isspace(*smtp_cmd_argument)) smtp_cmd_argument++;
1027 Ustrcpy(smtp_data_buffer, smtp_cmd_argument);
1028 smtp_cmd_data = smtp_data_buffer;
1029
1030 /* Count non-mail commands from those hosts that are controlled in this
1031 way. The default is all hosts. We don't waste effort checking the list
1032 until we get a non-mail command, but then cache the result to save checking
1033 again. If there's a DEFER while checking the host, assume it's in the list.
1034
1035 Note that one instance of RSET, EHLO/HELO, and STARTTLS is allowed at the
1036 start of each incoming message by fiddling with the value in the table. */
1037
1038 if (!p->is_mail_cmd)
1039 {
1040 if (count_nonmail == TRUE_UNSET) count_nonmail =
1041 verify_check_host(&smtp_accept_max_nonmail_hosts) != FAIL;
1042 if (count_nonmail && ++nonmail_command_count > smtp_accept_max_nonmail)
1043 return TOO_MANY_NONMAIL_CMD;
1044 }
1045
1046 /* If there is data for a command that does not expect it, generate the
1047 error here. */
1048
1049 return (p->has_arg || *smtp_cmd_data == 0)? p->cmd : BADARG_CMD;
1050 }
1051 }
1052
1053 #ifdef EXPERIMENTAL_PROXY
1054 /* Only allow QUIT command if Proxy Protocol parsing failed */
1055 if (proxy_session && proxy_session_failed)
1056 return PROXY_FAIL_IGNORE_CMD;
1057 #endif
1058
1059 /* Enforce synchronization for unknown commands */
1060
1061 if (smtp_inptr < smtp_inend && /* Outstanding input */
1062 check_sync && /* Local flag set */
1063 smtp_enforce_sync && /* Global flag set */
1064 sender_host_address != NULL && /* Not local input */
1065 !sender_host_notsocket) /* Really is a socket */
1066 return BADSYN_CMD;
1067
1068 return OTHER_CMD;
1069 }
1070
1071
1072
1073 /*************************************************
1074 * Recheck synchronization *
1075 *************************************************/
1076
1077 /* Synchronization checks can never be perfect because a packet may be on its
1078 way but not arrived when the check is done. Such checks can in any case only be
1079 done when TLS is not in use. Normally, the checks happen when commands are
1080 read: Exim ensures that there is no more input in the input buffer. In normal
1081 cases, the response to the command will be fast, and there is no further check.
1082
1083 However, for some commands an ACL is run, and that can include delays. In those
1084 cases, it is useful to do another check on the input just before sending the
1085 response. This also applies at the start of a connection. This function does
1086 that check by means of the select() function, as long as the facility is not
1087 disabled or inappropriate. A failure of select() is ignored.
1088
1089 When there is unwanted input, we read it so that it appears in the log of the
1090 error.
1091
1092 Arguments: none
1093 Returns: TRUE if all is well; FALSE if there is input pending
1094 */
1095
1096 static BOOL
1097 check_sync(void)
1098 {
1099 int fd, rc;
1100 fd_set fds;
1101 struct timeval tzero;
1102
1103 if (!smtp_enforce_sync || sender_host_address == NULL ||
1104 sender_host_notsocket || tls_in.active >= 0)
1105 return TRUE;
1106
1107 fd = fileno(smtp_in);
1108 FD_ZERO(&fds);
1109 FD_SET(fd, &fds);
1110 tzero.tv_sec = 0;
1111 tzero.tv_usec = 0;
1112 rc = select(fd + 1, (SELECT_ARG2_TYPE *)&fds, NULL, NULL, &tzero);
1113
1114 if (rc <= 0) return TRUE; /* Not ready to read */
1115 rc = smtp_getc();
1116 if (rc < 0) return TRUE; /* End of file or error */
1117
1118 smtp_ungetc(rc);
1119 rc = smtp_inend - smtp_inptr;
1120 if (rc > 150) rc = 150;
1121 smtp_inptr[rc] = 0;
1122 return FALSE;
1123 }
1124
1125
1126
1127 /*************************************************
1128 * Forced closedown of call *
1129 *************************************************/
1130
1131 /* This function is called from log.c when Exim is dying because of a serious
1132 disaster, and also from some other places. If an incoming non-batched SMTP
1133 channel is open, it swallows the rest of the incoming message if in the DATA
1134 phase, sends the reply string, and gives an error to all subsequent commands
1135 except QUIT. The existence of an SMTP call is detected by the non-NULLness of
1136 smtp_in.
1137
1138 Arguments:
1139 message SMTP reply string to send, excluding the code
1140
1141 Returns: nothing
1142 */
1143
1144 void
1145 smtp_closedown(uschar *message)
1146 {
1147 if (smtp_in == NULL || smtp_batched_input) return;
1148 receive_swallow_smtp();
1149 smtp_printf("421 %s\r\n", message);
1150
1151 for (;;)
1152 {
1153 switch(smtp_read_command(FALSE))
1154 {
1155 case EOF_CMD:
1156 return;
1157
1158 case QUIT_CMD:
1159 smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
1160 mac_smtp_fflush();
1161 return;
1162
1163 case RSET_CMD:
1164 smtp_printf("250 Reset OK\r\n");
1165 break;
1166
1167 default:
1168 smtp_printf("421 %s\r\n", message);
1169 break;
1170 }
1171 }
1172 }
1173
1174
1175
1176
1177 /*************************************************
1178 * Set up connection info for logging *
1179 *************************************************/
1180
1181 /* This function is called when logging information about an SMTP connection.
1182 It sets up appropriate source information, depending on the type of connection.
1183 If sender_fullhost is NULL, we are at a very early stage of the connection;
1184 just use the IP address.
1185
1186 Argument: none
1187 Returns: a string describing the connection
1188 */
1189
1190 uschar *
1191 smtp_get_connection_info(void)
1192 {
1193 uschar *hostname = (sender_fullhost == NULL)?
1194 sender_host_address : sender_fullhost;
1195
1196 if (host_checking)
1197 return string_sprintf("SMTP connection from %s", hostname);
1198
1199 if (sender_host_unknown || sender_host_notsocket)
1200 return string_sprintf("SMTP connection from %s", sender_ident);
1201
1202 if (is_inetd)
1203 return string_sprintf("SMTP connection from %s (via inetd)", hostname);
1204
1205 if ((log_extra_selector & LX_incoming_interface) != 0 &&
1206 interface_address != NULL)
1207 return string_sprintf("SMTP connection from %s I=[%s]:%d", hostname,
1208 interface_address, interface_port);
1209
1210 return string_sprintf("SMTP connection from %s", hostname);
1211 }
1212
1213
1214
1215 #ifdef SUPPORT_TLS
1216 /* Append TLS-related information to a log line
1217
1218 Arguments:
1219 s String under construction: allocated string to extend, or NULL
1220 sizep Pointer to current allocation size (update on return), or NULL
1221 ptrp Pointer to index for new entries in string (update on return), or NULL
1222
1223 Returns: Allocated string or NULL
1224 */
1225 static uschar *
1226 s_tlslog(uschar * s, int * sizep, int * ptrp)
1227 {
1228 int size = sizep ? *sizep : 0;
1229 int ptr = ptrp ? *ptrp : 0;
1230
1231 if ((log_extra_selector & LX_tls_cipher) != 0 && tls_in.cipher != NULL)
1232 s = string_append(s, &size, &ptr, 2, US" X=", tls_in.cipher);
1233 if ((log_extra_selector & LX_tls_certificate_verified) != 0 &&
1234 tls_in.cipher != NULL)
1235 s = string_append(s, &size, &ptr, 2, US" CV=",
1236 tls_in.certificate_verified? "yes":"no");
1237 if ((log_extra_selector & LX_tls_peerdn) != 0 && tls_in.peerdn != NULL)
1238 s = string_append(s, &size, &ptr, 3, US" DN=\"",
1239 string_printing(tls_in.peerdn), US"\"");
1240 if ((log_extra_selector & LX_tls_sni) != 0 && tls_in.sni != NULL)
1241 s = string_append(s, &size, &ptr, 3, US" SNI=\"",
1242 string_printing(tls_in.sni), US"\"");
1243
1244 if (s)
1245 {
1246 s[ptr] = '\0';
1247 if (sizep) *sizep = size;
1248 if (ptrp) *ptrp = ptr;
1249 }
1250 return s;
1251 }
1252 #endif
1253
1254 /*************************************************
1255 * Log lack of MAIL if so configured *
1256 *************************************************/
1257
1258 /* This function is called when an SMTP session ends. If the log selector
1259 smtp_no_mail is set, write a log line giving some details of what has happened
1260 in the SMTP session.
1261
1262 Arguments: none
1263 Returns: nothing
1264 */
1265
1266 void
1267 smtp_log_no_mail(void)
1268 {
1269 int size, ptr, i;
1270 uschar *s, *sep;
1271
1272 if (smtp_mailcmd_count > 0 || (log_extra_selector & LX_smtp_no_mail) == 0)
1273 return;
1274
1275 s = NULL;
1276 size = ptr = 0;
1277
1278 if (sender_host_authenticated != NULL)
1279 {
1280 s = string_append(s, &size, &ptr, 2, US" A=", sender_host_authenticated);
1281 if (authenticated_id != NULL)
1282 s = string_append(s, &size, &ptr, 2, US":", authenticated_id);
1283 }
1284
1285 #ifdef SUPPORT_TLS
1286 s = s_tlslog(s, &size, &ptr);
1287 #endif
1288
1289 sep = (smtp_connection_had[SMTP_HBUFF_SIZE-1] != SCH_NONE)?
1290 US" C=..." : US" C=";
1291 for (i = smtp_ch_index; i < SMTP_HBUFF_SIZE; i++)
1292 {
1293 if (smtp_connection_had[i] != SCH_NONE)
1294 {
1295 s = string_append(s, &size, &ptr, 2, sep,
1296 smtp_names[smtp_connection_had[i]]);
1297 sep = US",";
1298 }
1299 }
1300
1301 for (i = 0; i < smtp_ch_index; i++)
1302 {
1303 s = string_append(s, &size, &ptr, 2, sep, smtp_names[smtp_connection_had[i]]);
1304 sep = US",";
1305 }
1306
1307 if (s != NULL) s[ptr] = 0; else s = US"";
1308 log_write(0, LOG_MAIN, "no MAIL in SMTP connection from %s D=%s%s",
1309 host_and_ident(FALSE),
1310 readconf_printtime(time(NULL) - smtp_connection_start), s);
1311 }
1312
1313
1314
1315 /*************************************************
1316 * Check HELO line and set sender_helo_name *
1317 *************************************************/
1318
1319 /* Check the format of a HELO line. The data for HELO/EHLO is supposed to be
1320 the domain name of the sending host, or an ip literal in square brackets. The
1321 arrgument is placed in sender_helo_name, which is in malloc store, because it
1322 must persist over multiple incoming messages. If helo_accept_junk is set, this
1323 host is permitted to send any old junk (needed for some broken hosts).
1324 Otherwise, helo_allow_chars can be used for rogue characters in general
1325 (typically people want to let in underscores).
1326
1327 Argument:
1328 s the data portion of the line (already past any white space)
1329
1330 Returns: TRUE or FALSE
1331 */
1332
1333 static BOOL
1334 check_helo(uschar *s)
1335 {
1336 uschar *start = s;
1337 uschar *end = s + Ustrlen(s);
1338 BOOL yield = helo_accept_junk;
1339
1340 /* Discard any previous helo name */
1341
1342 if (sender_helo_name != NULL)
1343 {
1344 store_free(sender_helo_name);
1345 sender_helo_name = NULL;
1346 }
1347
1348 /* Skip tests if junk is permitted. */
1349
1350 if (!yield)
1351 {
1352 /* Allow the new standard form for IPv6 address literals, namely,
1353 [IPv6:....], and because someone is bound to use it, allow an equivalent
1354 IPv4 form. Allow plain addresses as well. */
1355
1356 if (*s == '[')
1357 {
1358 if (end[-1] == ']')
1359 {
1360 end[-1] = 0;
1361 if (strncmpic(s, US"[IPv6:", 6) == 0)
1362 yield = (string_is_ip_address(s+6, NULL) == 6);
1363 else if (strncmpic(s, US"[IPv4:", 6) == 0)
1364 yield = (string_is_ip_address(s+6, NULL) == 4);
1365 else
1366 yield = (string_is_ip_address(s+1, NULL) != 0);
1367 end[-1] = ']';
1368 }
1369 }
1370
1371 /* Non-literals must be alpha, dot, hyphen, plus any non-valid chars
1372 that have been configured (usually underscore - sigh). */
1373
1374 else if (*s != 0)
1375 {
1376 yield = TRUE;
1377 while (*s != 0)
1378 {
1379 if (!isalnum(*s) && *s != '.' && *s != '-' &&
1380 Ustrchr(helo_allow_chars, *s) == NULL)
1381 {
1382 yield = FALSE;
1383 break;
1384 }
1385 s++;
1386 }
1387 }
1388 }
1389
1390 /* Save argument if OK */
1391
1392 if (yield) sender_helo_name = string_copy_malloc(start);
1393 return yield;
1394 }
1395
1396
1397
1398
1399
1400 /*************************************************
1401 * Extract SMTP command option *
1402 *************************************************/
1403
1404 /* This function picks the next option setting off the end of smtp_cmd_data. It
1405 is called for MAIL FROM and RCPT TO commands, to pick off the optional ESMTP
1406 things that can appear there.
1407
1408 Arguments:
1409 name point this at the name
1410 value point this at the data string
1411
1412 Returns: TRUE if found an option
1413 */
1414
1415 static BOOL
1416 extract_option(uschar **name, uschar **value)
1417 {
1418 uschar *n;
1419 uschar *v = smtp_cmd_data + Ustrlen(smtp_cmd_data) - 1;
1420 while (isspace(*v)) v--;
1421 v[1] = 0;
1422 while (v > smtp_cmd_data && *v != '=' && !isspace(*v)) v--;
1423
1424 n = v;
1425 if (*v == '=')
1426 {
1427 while(isalpha(n[-1])) n--;
1428 /* RFC says SP, but TAB seen in wild and other major MTAs accept it */
1429 if (!isspace(n[-1])) return FALSE;
1430 n[-1] = 0;
1431 }
1432 else
1433 {
1434 n++;
1435 if (v == smtp_cmd_data) return FALSE;
1436 }
1437 *v++ = 0;
1438 *name = n;
1439 *value = v;
1440 return TRUE;
1441 }
1442
1443
1444
1445
1446
1447 /*************************************************
1448 * Reset for new message *
1449 *************************************************/
1450
1451 /* This function is called whenever the SMTP session is reset from
1452 within either of the setup functions.
1453
1454 Argument: the stacking pool storage reset point
1455 Returns: nothing
1456 */
1457
1458 static void
1459 smtp_reset(void *reset_point)
1460 {
1461 store_reset(reset_point);
1462 recipients_list = NULL;
1463 rcpt_count = rcpt_defer_count = rcpt_fail_count =
1464 raw_recipients_count = recipients_count = recipients_list_max = 0;
1465 cancel_cutthrough_connection("smtp reset");
1466 message_linecount = 0;
1467 message_size = -1;
1468 acl_added_headers = NULL;
1469 acl_removed_headers = NULL;
1470 queue_only_policy = FALSE;
1471 rcpt_smtp_response = NULL;
1472 rcpt_smtp_response_same = TRUE;
1473 rcpt_in_progress = FALSE;
1474 deliver_freeze = FALSE; /* Can be set by ACL */
1475 freeze_tell = freeze_tell_config; /* Can be set by ACL */
1476 fake_response = OK; /* Can be set by ACL */
1477 #ifdef WITH_CONTENT_SCAN
1478 no_mbox_unspool = FALSE; /* Can be set by ACL */
1479 #endif
1480 submission_mode = FALSE; /* Can be set by ACL */
1481 suppress_local_fixups = suppress_local_fixups_default; /* Can be set by ACL */
1482 active_local_from_check = local_from_check; /* Can be set by ACL */
1483 active_local_sender_retain = local_sender_retain; /* Can be set by ACL */
1484 sender_address = NULL;
1485 submission_name = NULL; /* Can be set by ACL */
1486 raw_sender = NULL; /* After SMTP rewrite, before qualifying */
1487 sender_address_unrewritten = NULL; /* Set only after verify rewrite */
1488 sender_verified_list = NULL; /* No senders verified */
1489 memset(sender_address_cache, 0, sizeof(sender_address_cache));
1490 memset(sender_domain_cache, 0, sizeof(sender_domain_cache));
1491 authenticated_sender = NULL;
1492 #ifdef EXPERIMENTAL_BRIGHTMAIL
1493 bmi_run = 0;
1494 bmi_verdicts = NULL;
1495 #endif
1496 #ifndef DISABLE_DKIM
1497 dkim_signers = NULL;
1498 dkim_disable_verify = FALSE;
1499 dkim_collect_input = FALSE;
1500 #endif
1501 #ifdef EXPERIMENTAL_SPF
1502 spf_header_comment = NULL;
1503 spf_received = NULL;
1504 spf_result = NULL;
1505 spf_smtp_comment = NULL;
1506 #endif
1507 body_linecount = body_zerocount = 0;
1508
1509 sender_rate = sender_rate_limit = sender_rate_period = NULL;
1510 ratelimiters_mail = NULL; /* Updated by ratelimit ACL condition */
1511 /* Note that ratelimiters_conn persists across resets. */
1512
1513 /* Reset message ACL variables */
1514
1515 acl_var_m = NULL;
1516
1517 /* The message body variables use malloc store. They may be set if this is
1518 not the first message in an SMTP session and the previous message caused them
1519 to be referenced in an ACL. */
1520
1521 if (message_body != NULL)
1522 {
1523 store_free(message_body);
1524 message_body = NULL;
1525 }
1526
1527 if (message_body_end != NULL)
1528 {
1529 store_free(message_body_end);
1530 message_body_end = NULL;
1531 }
1532
1533 /* Warning log messages are also saved in malloc store. They are saved to avoid
1534 repetition in the same message, but it seems right to repeat them for different
1535 messages. */
1536
1537 while (acl_warn_logged != NULL)
1538 {
1539 string_item *this = acl_warn_logged;
1540 acl_warn_logged = acl_warn_logged->next;
1541 store_free(this);
1542 }
1543 }
1544
1545
1546
1547
1548
1549 /*************************************************
1550 * Initialize for incoming batched SMTP message *
1551 *************************************************/
1552
1553 /* This function is called from smtp_setup_msg() in the case when
1554 smtp_batched_input is true. This happens when -bS is used to pass a whole batch
1555 of messages in one file with SMTP commands between them. All errors must be
1556 reported by sending a message, and only MAIL FROM, RCPT TO, and DATA are
1557 relevant. After an error on a sender, or an invalid recipient, the remainder
1558 of the message is skipped. The value of received_protocol is already set.
1559
1560 Argument: none
1561 Returns: > 0 message successfully started (reached DATA)
1562 = 0 QUIT read or end of file reached
1563 < 0 should not occur
1564 */
1565
1566 static int
1567 smtp_setup_batch_msg(void)
1568 {
1569 int done = 0;
1570 void *reset_point = store_get(0);
1571
1572 /* Save the line count at the start of each transaction - single commands
1573 like HELO and RSET count as whole transactions. */
1574
1575 bsmtp_transaction_linecount = receive_linecount;
1576
1577 if ((receive_feof)()) return 0; /* Treat EOF as QUIT */
1578
1579 smtp_reset(reset_point); /* Reset for start of message */
1580
1581 /* Deal with SMTP commands. This loop is exited by setting done to a POSITIVE
1582 value. The values are 2 larger than the required yield of the function. */
1583
1584 while (done <= 0)
1585 {
1586 uschar *errmess;
1587 uschar *recipient = NULL;
1588 int start, end, sender_domain, recipient_domain;
1589
1590 switch(smtp_read_command(FALSE))
1591 {
1592 /* The HELO/EHLO commands set sender_address_helo if they have
1593 valid data; otherwise they are ignored, except that they do
1594 a reset of the state. */
1595
1596 case HELO_CMD:
1597 case EHLO_CMD:
1598
1599 check_helo(smtp_cmd_data);
1600 /* Fall through */
1601
1602 case RSET_CMD:
1603 smtp_reset(reset_point);
1604 bsmtp_transaction_linecount = receive_linecount;
1605 break;
1606
1607
1608 /* The MAIL FROM command requires an address as an operand. All we
1609 do here is to parse it for syntactic correctness. The form "<>" is
1610 a special case which converts into an empty string. The start/end
1611 pointers in the original are not used further for this address, as
1612 it is the canonical extracted address which is all that is kept. */
1613
1614 case MAIL_CMD:
1615 if (sender_address != NULL)
1616 /* The function moan_smtp_batch() does not return. */
1617 moan_smtp_batch(smtp_cmd_buffer, "503 Sender already given");
1618
1619 if (smtp_cmd_data[0] == 0)
1620 /* The function moan_smtp_batch() does not return. */
1621 moan_smtp_batch(smtp_cmd_buffer, "501 MAIL FROM must have an address operand");
1622
1623 /* Reset to start of message */
1624
1625 smtp_reset(reset_point);
1626
1627 /* Apply SMTP rewrite */
1628
1629 raw_sender = ((rewrite_existflags & rewrite_smtp) != 0)?
1630 rewrite_one(smtp_cmd_data, rewrite_smtp|rewrite_smtp_sender, NULL, FALSE,
1631 US"", global_rewrite_rules) : smtp_cmd_data;
1632
1633 /* Extract the address; the TRUE flag allows <> as valid */
1634
1635 raw_sender =
1636 parse_extract_address(raw_sender, &errmess, &start, &end, &sender_domain,
1637 TRUE);
1638
1639 if (raw_sender == NULL)
1640 /* The function moan_smtp_batch() does not return. */
1641 moan_smtp_batch(smtp_cmd_buffer, "501 %s", errmess);
1642
1643 sender_address = string_copy(raw_sender);
1644
1645 /* Qualify unqualified sender addresses if permitted to do so. */
1646
1647 if (sender_domain == 0 && sender_address[0] != 0 && sender_address[0] != '@')
1648 {
1649 if (allow_unqualified_sender)
1650 {
1651 sender_address = rewrite_address_qualify(sender_address, FALSE);
1652 DEBUG(D_receive) debug_printf("unqualified address %s accepted "
1653 "and rewritten\n", raw_sender);
1654 }
1655 /* The function moan_smtp_batch() does not return. */
1656 else moan_smtp_batch(smtp_cmd_buffer, "501 sender address must contain "
1657 "a domain");
1658 }
1659 break;
1660
1661
1662 /* The RCPT TO command requires an address as an operand. All we do
1663 here is to parse it for syntactic correctness. There may be any number
1664 of RCPT TO commands, specifying multiple senders. We build them all into
1665 a data structure that is in argc/argv format. The start/end values
1666 given by parse_extract_address are not used, as we keep only the
1667 extracted address. */
1668
1669 case RCPT_CMD:
1670 if (sender_address == NULL)
1671 /* The function moan_smtp_batch() does not return. */
1672 moan_smtp_batch(smtp_cmd_buffer, "503 No sender yet given");
1673
1674 if (smtp_cmd_data[0] == 0)
1675 /* The function moan_smtp_batch() does not return. */
1676 moan_smtp_batch(smtp_cmd_buffer, "501 RCPT TO must have an address operand");
1677
1678 /* Check maximum number allowed */
1679
1680 if (recipients_max > 0 && recipients_count + 1 > recipients_max)
1681 /* The function moan_smtp_batch() does not return. */
1682 moan_smtp_batch(smtp_cmd_buffer, "%s too many recipients",
1683 recipients_max_reject? "552": "452");
1684
1685 /* Apply SMTP rewrite, then extract address. Don't allow "<>" as a
1686 recipient address */
1687
1688 recipient = ((rewrite_existflags & rewrite_smtp) != 0)?
1689 rewrite_one(smtp_cmd_data, rewrite_smtp, NULL, FALSE, US"",
1690 global_rewrite_rules) : smtp_cmd_data;
1691
1692 /* rfc821_domains = TRUE; << no longer needed */
1693 recipient = parse_extract_address(recipient, &errmess, &start, &end,
1694 &recipient_domain, FALSE);
1695 /* rfc821_domains = FALSE; << no longer needed */
1696
1697 if (recipient == NULL)
1698 /* The function moan_smtp_batch() does not return. */
1699 moan_smtp_batch(smtp_cmd_buffer, "501 %s", errmess);
1700
1701 /* If the recipient address is unqualified, qualify it if permitted. Then
1702 add it to the list of recipients. */
1703
1704 if (recipient_domain == 0)
1705 {
1706 if (allow_unqualified_recipient)
1707 {
1708 DEBUG(D_receive) debug_printf("unqualified address %s accepted\n",
1709 recipient);
1710 recipient = rewrite_address_qualify(recipient, TRUE);
1711 }
1712 /* The function moan_smtp_batch() does not return. */
1713 else moan_smtp_batch(smtp_cmd_buffer, "501 recipient address must contain "
1714 "a domain");
1715 }
1716 receive_add_recipient(recipient, -1);
1717 break;
1718
1719
1720 /* The DATA command is legal only if it follows successful MAIL FROM
1721 and RCPT TO commands. This function is complete when a valid DATA
1722 command is encountered. */
1723
1724 case DATA_CMD:
1725 if (sender_address == NULL || recipients_count <= 0)
1726 {
1727 /* The function moan_smtp_batch() does not return. */
1728 if (sender_address == NULL)
1729 moan_smtp_batch(smtp_cmd_buffer,
1730 "503 MAIL FROM:<sender> command must precede DATA");
1731 else
1732 moan_smtp_batch(smtp_cmd_buffer,
1733 "503 RCPT TO:<recipient> must precede DATA");
1734 }
1735 else
1736 {
1737 done = 3; /* DATA successfully achieved */
1738 message_ended = END_NOTENDED; /* Indicate in middle of message */
1739 }
1740 break;
1741
1742
1743 /* The VRFY, EXPN, HELP, ETRN, and NOOP commands are ignored. */
1744
1745 case VRFY_CMD:
1746 case EXPN_CMD:
1747 case HELP_CMD:
1748 case NOOP_CMD:
1749 case ETRN_CMD:
1750 bsmtp_transaction_linecount = receive_linecount;
1751 break;
1752
1753
1754 case EOF_CMD:
1755 case QUIT_CMD:
1756 done = 2;
1757 break;
1758
1759
1760 case BADARG_CMD:
1761 /* The function moan_smtp_batch() does not return. */
1762 moan_smtp_batch(smtp_cmd_buffer, "501 Unexpected argument data");
1763 break;
1764
1765
1766 case BADCHAR_CMD:
1767 /* The function moan_smtp_batch() does not return. */
1768 moan_smtp_batch(smtp_cmd_buffer, "501 Unexpected NULL in SMTP command");
1769 break;
1770
1771
1772 default:
1773 /* The function moan_smtp_batch() does not return. */
1774 moan_smtp_batch(smtp_cmd_buffer, "500 Command unrecognized");
1775 break;
1776 }
1777 }
1778
1779 return done - 2; /* Convert yield values */
1780 }
1781
1782
1783
1784
1785 /*************************************************
1786 * Start an SMTP session *
1787 *************************************************/
1788
1789 /* This function is called at the start of an SMTP session. Thereafter,
1790 smtp_setup_msg() is called to initiate each separate message. This
1791 function does host-specific testing, and outputs the banner line.
1792
1793 Arguments: none
1794 Returns: FALSE if the session can not continue; something has
1795 gone wrong, or the connection to the host is blocked
1796 */
1797
1798 BOOL
1799 smtp_start_session(void)
1800 {
1801 int size = 256;
1802 int ptr, esclen;
1803 uschar *user_msg, *log_msg;
1804 uschar *code, *esc;
1805 uschar *p, *s, *ss;
1806
1807 smtp_connection_start = time(NULL);
1808 for (smtp_ch_index = 0; smtp_ch_index < SMTP_HBUFF_SIZE; smtp_ch_index++)
1809 smtp_connection_had[smtp_ch_index] = SCH_NONE;
1810 smtp_ch_index = 0;
1811
1812 /* Default values for certain variables */
1813
1814 helo_seen = esmtp = helo_accept_junk = FALSE;
1815 smtp_mailcmd_count = 0;
1816 count_nonmail = TRUE_UNSET;
1817 synprot_error_count = unknown_command_count = nonmail_command_count = 0;
1818 smtp_delay_mail = smtp_rlm_base;
1819 auth_advertised = FALSE;
1820 pipelining_advertised = FALSE;
1821 pipelining_enable = TRUE;
1822 sync_cmd_limit = NON_SYNC_CMD_NON_PIPELINING;
1823 smtp_exit_function_called = FALSE; /* For avoiding loop in not-quit exit */
1824
1825 memset(sender_host_cache, 0, sizeof(sender_host_cache));
1826
1827 /* If receiving by -bs from a trusted user, or testing with -bh, we allow
1828 authentication settings from -oMaa to remain in force. */
1829
1830 if (!host_checking && !sender_host_notsocket) sender_host_authenticated = NULL;
1831 authenticated_by = NULL;
1832
1833 #ifdef SUPPORT_TLS
1834 tls_in.cipher = tls_in.peerdn = NULL;
1835 tls_in.ourcert = tls_in.peercert = NULL;
1836 tls_in.sni = NULL;
1837 tls_in.ocsp = OCSP_NOT_REQ;
1838 tls_advertised = FALSE;
1839 #endif
1840
1841 /* Reset ACL connection variables */
1842
1843 acl_var_c = NULL;
1844
1845 /* Allow for trailing 0 in the command and data buffers. */
1846
1847 smtp_cmd_buffer = (uschar *)malloc(2*smtp_cmd_buffer_size + 2);
1848 if (smtp_cmd_buffer == NULL)
1849 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1850 "malloc() failed for SMTP command buffer");
1851 smtp_cmd_buffer[0] = 0;
1852 smtp_data_buffer = smtp_cmd_buffer + smtp_cmd_buffer_size + 1;
1853
1854 /* For batched input, the protocol setting can be overridden from the
1855 command line by a trusted caller. */
1856
1857 if (smtp_batched_input)
1858 {
1859 if (received_protocol == NULL) received_protocol = US"local-bsmtp";
1860 }
1861
1862 /* For non-batched SMTP input, the protocol setting is forced here. It will be
1863 reset later if any of EHLO/AUTH/STARTTLS are received. */
1864
1865 else
1866 received_protocol =
1867 protocols[pnormal] + ((sender_host_address != NULL)? pnlocal : 0);
1868
1869 /* Set up the buffer for inputting using direct read() calls, and arrange to
1870 call the local functions instead of the standard C ones. */
1871
1872 smtp_inbuffer = (uschar *)malloc(in_buffer_size);
1873 if (smtp_inbuffer == NULL)
1874 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "malloc() failed for SMTP input buffer");
1875 receive_getc = smtp_getc;
1876 receive_ungetc = smtp_ungetc;
1877 receive_feof = smtp_feof;
1878 receive_ferror = smtp_ferror;
1879 receive_smtp_buffered = smtp_buffered;
1880 smtp_inptr = smtp_inend = smtp_inbuffer;
1881 smtp_had_eof = smtp_had_error = 0;
1882
1883 /* Set up the message size limit; this may be host-specific */
1884
1885 thismessage_size_limit = expand_string_integer(message_size_limit, TRUE);
1886 if (expand_string_message != NULL)
1887 {
1888 if (thismessage_size_limit == -1)
1889 log_write(0, LOG_MAIN|LOG_PANIC, "unable to expand message_size_limit: "
1890 "%s", expand_string_message);
1891 else
1892 log_write(0, LOG_MAIN|LOG_PANIC, "invalid message_size_limit: "
1893 "%s", expand_string_message);
1894 smtp_closedown(US"Temporary local problem - please try later");
1895 return FALSE;
1896 }
1897
1898 /* When a message is input locally via the -bs or -bS options, sender_host_
1899 unknown is set unless -oMa was used to force an IP address, in which case it
1900 is checked like a real remote connection. When -bs is used from inetd, this
1901 flag is not set, causing the sending host to be checked. The code that deals
1902 with IP source routing (if configured) is never required for -bs or -bS and
1903 the flag sender_host_notsocket is used to suppress it.
1904
1905 If smtp_accept_max and smtp_accept_reserve are set, keep some connections in
1906 reserve for certain hosts and/or networks. */
1907
1908 if (!sender_host_unknown)
1909 {
1910 int rc;
1911 BOOL reserved_host = FALSE;
1912
1913 /* Look up IP options (source routing info) on the socket if this is not an
1914 -oMa "host", and if any are found, log them and drop the connection.
1915
1916 Linux (and others now, see below) is different to everyone else, so there
1917 has to be some conditional compilation here. Versions of Linux before 2.1.15
1918 used a structure whose name was "options". Somebody finally realized that
1919 this name was silly, and it got changed to "ip_options". I use the
1920 newer name here, but there is a fudge in the script that sets up os.h
1921 to define a macro in older Linux systems.
1922
1923 Sigh. Linux is a fast-moving target. Another generation of Linux uses
1924 glibc 2, which has chosen ip_opts for the structure name. This is now
1925 really a glibc thing rather than a Linux thing, so the condition name
1926 has been changed to reflect this. It is relevant also to GNU/Hurd.
1927
1928 Mac OS 10.x (Darwin) is like the later glibc versions, but without the
1929 setting of the __GLIBC__ macro, so we can't detect it automatically. There's
1930 a special macro defined in the os.h file.
1931
1932 Some DGUX versions on older hardware appear not to support IP options at
1933 all, so there is now a general macro which can be set to cut out this
1934 support altogether.
1935
1936 How to do this properly in IPv6 is not yet known. */
1937
1938 #if !HAVE_IPV6 && !defined(NO_IP_OPTIONS)
1939
1940 #ifdef GLIBC_IP_OPTIONS
1941 #if (!defined __GLIBC__) || (__GLIBC__ < 2)
1942 #define OPTSTYLE 1
1943 #else
1944 #define OPTSTYLE 2
1945 #endif
1946 #elif defined DARWIN_IP_OPTIONS
1947 #define OPTSTYLE 2
1948 #else
1949 #define OPTSTYLE 3
1950 #endif
1951
1952 if (!host_checking && !sender_host_notsocket)
1953 {
1954 #if OPTSTYLE == 1
1955 EXIM_SOCKLEN_T optlen = sizeof(struct ip_options) + MAX_IPOPTLEN;
1956 struct ip_options *ipopt = store_get(optlen);
1957 #elif OPTSTYLE == 2
1958 struct ip_opts ipoptblock;
1959 struct ip_opts *ipopt = &ipoptblock;
1960 EXIM_SOCKLEN_T optlen = sizeof(ipoptblock);
1961 #else
1962 struct ipoption ipoptblock;
1963 struct ipoption *ipopt = &ipoptblock;
1964 EXIM_SOCKLEN_T optlen = sizeof(ipoptblock);
1965 #endif
1966
1967 /* Occasional genuine failures of getsockopt() have been seen - for
1968 example, "reset by peer". Therefore, just log and give up on this
1969 call, unless the error is ENOPROTOOPT. This error is given by systems
1970 that have the interfaces but not the mechanism - e.g. GNU/Hurd at the time
1971 of writing. So for that error, carry on - we just can't do an IP options
1972 check. */
1973
1974 DEBUG(D_receive) debug_printf("checking for IP options\n");
1975
1976 if (getsockopt(fileno(smtp_out), IPPROTO_IP, IP_OPTIONS, (uschar *)(ipopt),
1977 &optlen) < 0)
1978 {
1979 if (errno != ENOPROTOOPT)
1980 {
1981 log_write(0, LOG_MAIN, "getsockopt() failed from %s: %s",
1982 host_and_ident(FALSE), strerror(errno));
1983 smtp_printf("451 SMTP service not available\r\n");
1984 return FALSE;
1985 }
1986 }
1987
1988 /* Deal with any IP options that are set. On the systems I have looked at,
1989 the value of MAX_IPOPTLEN has been 40, meaning that there should never be
1990 more logging data than will fit in big_buffer. Nevertheless, after somebody
1991 questioned this code, I've added in some paranoid checking. */
1992
1993 else if (optlen > 0)
1994 {
1995 uschar *p = big_buffer;
1996 uschar *pend = big_buffer + big_buffer_size;
1997 uschar *opt, *adptr;
1998 int optcount;
1999 struct in_addr addr;
2000
2001 #if OPTSTYLE == 1
2002 uschar *optstart = (uschar *)(ipopt->__data);
2003 #elif OPTSTYLE == 2
2004 uschar *optstart = (uschar *)(ipopt->ip_opts);
2005 #else
2006 uschar *optstart = (uschar *)(ipopt->ipopt_list);
2007 #endif
2008
2009 DEBUG(D_receive) debug_printf("IP options exist\n");
2010
2011 Ustrcpy(p, "IP options on incoming call:");
2012 p += Ustrlen(p);
2013
2014 for (opt = optstart; opt != NULL &&
2015 opt < (uschar *)(ipopt) + optlen;)
2016 {
2017 switch (*opt)
2018 {
2019 case IPOPT_EOL:
2020 opt = NULL;
2021 break;
2022
2023 case IPOPT_NOP:
2024 opt++;
2025 break;
2026
2027 case IPOPT_SSRR:
2028 case IPOPT_LSRR:
2029 if (!string_format(p, pend-p, " %s [@%s",
2030 (*opt == IPOPT_SSRR)? "SSRR" : "LSRR",
2031 #if OPTSTYLE == 1
2032 inet_ntoa(*((struct in_addr *)(&(ipopt->faddr))))))
2033 #elif OPTSTYLE == 2
2034 inet_ntoa(ipopt->ip_dst)))
2035 #else
2036 inet_ntoa(ipopt->ipopt_dst)))
2037 #endif
2038 {
2039 opt = NULL;
2040 break;
2041 }
2042
2043 p += Ustrlen(p);
2044 optcount = (opt[1] - 3) / sizeof(struct in_addr);
2045 adptr = opt + 3;
2046 while (optcount-- > 0)
2047 {
2048 memcpy(&addr, adptr, sizeof(addr));
2049 if (!string_format(p, pend - p - 1, "%s%s",
2050 (optcount == 0)? ":" : "@", inet_ntoa(addr)))
2051 {
2052 opt = NULL;
2053 break;
2054 }
2055 p += Ustrlen(p);
2056 adptr += sizeof(struct in_addr);
2057 }
2058 *p++ = ']';
2059 opt += opt[1];
2060 break;
2061
2062 default:
2063 {
2064 int i;
2065 if (pend - p < 4 + 3*opt[1]) { opt = NULL; break; }
2066 Ustrcat(p, "[ ");
2067 p += 2;
2068 for (i = 0; i < opt[1]; i++)
2069 {
2070 sprintf(CS p, "%2.2x ", opt[i]);
2071 p += 3;
2072 }
2073 *p++ = ']';
2074 }
2075 opt += opt[1];
2076 break;
2077 }
2078 }
2079
2080 *p = 0;
2081 log_write(0, LOG_MAIN, "%s", big_buffer);
2082
2083 /* Refuse any call with IP options. This is what tcpwrappers 7.5 does. */
2084
2085 log_write(0, LOG_MAIN|LOG_REJECT,
2086 "connection from %s refused (IP options)", host_and_ident(FALSE));
2087
2088 smtp_printf("554 SMTP service not available\r\n");
2089 return FALSE;
2090 }
2091
2092 /* Length of options = 0 => there are no options */
2093
2094 else DEBUG(D_receive) debug_printf("no IP options found\n");
2095 }
2096 #endif /* HAVE_IPV6 && !defined(NO_IP_OPTIONS) */
2097
2098 /* Set keep-alive in socket options. The option is on by default. This
2099 setting is an attempt to get rid of some hanging connections that stick in
2100 read() when the remote end (usually a dialup) goes away. */
2101
2102 if (smtp_accept_keepalive && !sender_host_notsocket)
2103 ip_keepalive(fileno(smtp_out), sender_host_address, FALSE);
2104
2105 /* If the current host matches host_lookup, set the name by doing a
2106 reverse lookup. On failure, sender_host_name will be NULL and
2107 host_lookup_failed will be TRUE. This may or may not be serious - optional
2108 checks later. */
2109
2110 if (verify_check_host(&host_lookup) == OK)
2111 {
2112 (void)host_name_lookup();
2113 host_build_sender_fullhost();
2114 }
2115
2116 /* Delay this until we have the full name, if it is looked up. */
2117
2118 set_process_info("handling incoming connection from %s",
2119 host_and_ident(FALSE));
2120
2121 /* Start up TLS if tls_on_connect is set. This is for supporting the legacy
2122 smtps port for use with older style SSL MTAs. */
2123
2124 #ifdef SUPPORT_TLS
2125 if (tls_in.on_connect && tls_server_start(tls_require_ciphers) != OK)
2126 return FALSE;
2127 #endif
2128
2129 /* Test for explicit connection rejection */
2130
2131 if (verify_check_host(&host_reject_connection) == OK)
2132 {
2133 log_write(L_connection_reject, LOG_MAIN|LOG_REJECT, "refused connection "
2134 "from %s (host_reject_connection)", host_and_ident(FALSE));
2135 smtp_printf("554 SMTP service not available\r\n");
2136 return FALSE;
2137 }
2138
2139 /* Test with TCP Wrappers if so configured. There is a problem in that
2140 hosts_ctl() returns 0 (deny) under a number of system failure circumstances,
2141 such as disks dying. In these cases, it is desirable to reject with a 4xx
2142 error instead of a 5xx error. There isn't a "right" way to detect such
2143 problems. The following kludge is used: errno is zeroed before calling
2144 hosts_ctl(). If the result is "reject", a 5xx error is given only if the
2145 value of errno is 0 or ENOENT (which happens if /etc/hosts.{allow,deny} does
2146 not exist). */
2147
2148 #ifdef USE_TCP_WRAPPERS
2149 errno = 0;
2150 tcp_wrappers_name = expand_string(tcp_wrappers_daemon_name);
2151 if (tcp_wrappers_name == NULL)
2152 {
2153 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Expansion of \"%s\" "
2154 "(tcp_wrappers_name) failed: %s", string_printing(tcp_wrappers_name),
2155 expand_string_message);
2156 }
2157 if (!hosts_ctl(tcp_wrappers_name,
2158 (sender_host_name == NULL)? STRING_UNKNOWN : CS sender_host_name,
2159 (sender_host_address == NULL)? STRING_UNKNOWN : CS sender_host_address,
2160 (sender_ident == NULL)? STRING_UNKNOWN : CS sender_ident))
2161 {
2162 if (errno == 0 || errno == ENOENT)
2163 {
2164 HDEBUG(D_receive) debug_printf("tcp wrappers rejection\n");
2165 log_write(L_connection_reject,
2166 LOG_MAIN|LOG_REJECT, "refused connection from %s "
2167 "(tcp wrappers)", host_and_ident(FALSE));
2168 smtp_printf("554 SMTP service not available\r\n");
2169 }
2170 else
2171 {
2172 int save_errno = errno;
2173 HDEBUG(D_receive) debug_printf("tcp wrappers rejected with unexpected "
2174 "errno value %d\n", save_errno);
2175 log_write(L_connection_reject,
2176 LOG_MAIN|LOG_REJECT, "temporarily refused connection from %s "
2177 "(tcp wrappers errno=%d)", host_and_ident(FALSE), save_errno);
2178 smtp_printf("451 Temporary local problem - please try later\r\n");
2179 }
2180 return FALSE;
2181 }
2182 #endif
2183
2184 /* Check for reserved slots. The value of smtp_accept_count has already been
2185 incremented to include this process. */
2186
2187 if (smtp_accept_max > 0 &&
2188 smtp_accept_count > smtp_accept_max - smtp_accept_reserve)
2189 {
2190 if ((rc = verify_check_host(&smtp_reserve_hosts)) != OK)
2191 {
2192 log_write(L_connection_reject,
2193 LOG_MAIN, "temporarily refused connection from %s: not in "
2194 "reserve list: connected=%d max=%d reserve=%d%s",
2195 host_and_ident(FALSE), smtp_accept_count - 1, smtp_accept_max,
2196 smtp_accept_reserve, (rc == DEFER)? " (lookup deferred)" : "");
2197 smtp_printf("421 %s: Too many concurrent SMTP connections; "
2198 "please try again later\r\n", smtp_active_hostname);
2199 return FALSE;
2200 }
2201 reserved_host = TRUE;
2202 }
2203
2204 /* If a load level above which only messages from reserved hosts are
2205 accepted is set, check the load. For incoming calls via the daemon, the
2206 check is done in the superior process if there are no reserved hosts, to
2207 save a fork. In all cases, the load average will already be available
2208 in a global variable at this point. */
2209
2210 if (smtp_load_reserve >= 0 &&
2211 load_average > smtp_load_reserve &&
2212 !reserved_host &&
2213 verify_check_host(&smtp_reserve_hosts) != OK)
2214 {
2215 log_write(L_connection_reject,
2216 LOG_MAIN, "temporarily refused connection from %s: not in "
2217 "reserve list and load average = %.2f", host_and_ident(FALSE),
2218 (double)load_average/1000.0);
2219 smtp_printf("421 %s: Too much load; please try again later\r\n",
2220 smtp_active_hostname);
2221 return FALSE;
2222 }
2223
2224 /* Determine whether unqualified senders or recipients are permitted
2225 for this host. Unfortunately, we have to do this every time, in order to
2226 set the flags so that they can be inspected when considering qualifying
2227 addresses in the headers. For a site that permits no qualification, this
2228 won't take long, however. */
2229
2230 allow_unqualified_sender =
2231 verify_check_host(&sender_unqualified_hosts) == OK;
2232
2233 allow_unqualified_recipient =
2234 verify_check_host(&recipient_unqualified_hosts) == OK;
2235
2236 /* Determine whether HELO/EHLO is required for this host. The requirement
2237 can be hard or soft. */
2238
2239 helo_required = verify_check_host(&helo_verify_hosts) == OK;
2240 if (!helo_required)
2241 helo_verify = verify_check_host(&helo_try_verify_hosts) == OK;
2242
2243 /* Determine whether this hosts is permitted to send syntactic junk
2244 after a HELO or EHLO command. */
2245
2246 helo_accept_junk = verify_check_host(&helo_accept_junk_hosts) == OK;
2247 }
2248
2249 /* For batch SMTP input we are now done. */
2250
2251 if (smtp_batched_input) return TRUE;
2252
2253 #ifdef EXPERIMENTAL_PROXY
2254 /* If valid Proxy Protocol source is connecting, set up session.
2255 * Failure will not allow any SMTP function other than QUIT. */
2256 proxy_session = FALSE;
2257 proxy_session_failed = FALSE;
2258 if (check_proxy_protocol_host())
2259 {
2260 if (setup_proxy_protocol_host() == FALSE)
2261 {
2262 proxy_session_failed = TRUE;
2263 DEBUG(D_receive)
2264 debug_printf("Failure to extract proxied host, only QUIT allowed\n");
2265 }
2266 else
2267 {
2268 sender_host_name = NULL;
2269 (void)host_name_lookup();
2270 host_build_sender_fullhost();
2271 }
2272 }
2273 #endif
2274
2275 /* Run the ACL if it exists */
2276
2277 user_msg = NULL;
2278 if (acl_smtp_connect != NULL)
2279 {
2280 int rc;
2281 rc = acl_check(ACL_WHERE_CONNECT, NULL, acl_smtp_connect, &user_msg,
2282 &log_msg);
2283 if (rc != OK)
2284 {
2285 (void)smtp_handle_acl_fail(ACL_WHERE_CONNECT, rc, user_msg, log_msg);
2286 return FALSE;
2287 }
2288 }
2289
2290 /* Output the initial message for a two-way SMTP connection. It may contain
2291 newlines, which then cause a multi-line response to be given. */
2292
2293 code = US"220"; /* Default status code */
2294 esc = US""; /* Default extended status code */
2295 esclen = 0; /* Length of esc */
2296
2297 if (user_msg == NULL)
2298 {
2299 s = expand_string(smtp_banner);
2300 if (s == NULL)
2301 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Expansion of \"%s\" (smtp_banner) "
2302 "failed: %s", smtp_banner, expand_string_message);
2303 }
2304 else
2305 {
2306 int codelen = 3;
2307 s = user_msg;
2308 smtp_message_code(&code, &codelen, &s, NULL);
2309 if (codelen > 4)
2310 {
2311 esc = code + 4;
2312 esclen = codelen - 4;
2313 }
2314 }
2315
2316 /* Remove any terminating newlines; might as well remove trailing space too */
2317
2318 p = s + Ustrlen(s);
2319 while (p > s && isspace(p[-1])) p--;
2320 *p = 0;
2321
2322 /* It seems that CC:Mail is braindead, and assumes that the greeting message
2323 is all contained in a single IP packet. The original code wrote out the
2324 greeting using several calls to fprint/fputc, and on busy servers this could
2325 cause it to be split over more than one packet - which caused CC:Mail to fall
2326 over when it got the second part of the greeting after sending its first
2327 command. Sigh. To try to avoid this, build the complete greeting message
2328 first, and output it in one fell swoop. This gives a better chance of it
2329 ending up as a single packet. */
2330
2331 ss = store_get(size);
2332 ptr = 0;
2333
2334 p = s;
2335 do /* At least once, in case we have an empty string */
2336 {
2337 int len;
2338 uschar *linebreak = Ustrchr(p, '\n');
2339 ss = string_cat(ss, &size, &ptr, code, 3);
2340 if (linebreak == NULL)
2341 {
2342 len = Ustrlen(p);
2343 ss = string_cat(ss, &size, &ptr, US" ", 1);
2344 }
2345 else
2346 {
2347 len = linebreak - p;
2348 ss = string_cat(ss, &size, &ptr, US"-", 1);
2349 }
2350 ss = string_cat(ss, &size, &ptr, esc, esclen);
2351 ss = string_cat(ss, &size, &ptr, p, len);
2352 ss = string_cat(ss, &size, &ptr, US"\r\n", 2);
2353 p += len;
2354 if (linebreak != NULL) p++;
2355 }
2356 while (*p != 0);
2357
2358 ss[ptr] = 0; /* string_cat leaves room for this */
2359
2360 /* Before we write the banner, check that there is no input pending, unless
2361 this synchronisation check is disabled. */
2362
2363 if (!check_sync())
2364 {
2365 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP protocol "
2366 "synchronization error (input sent without waiting for greeting): "
2367 "rejected connection from %s input=\"%s\"", host_and_ident(TRUE),
2368 string_printing(smtp_inptr));
2369 smtp_printf("554 SMTP synchronization error\r\n");
2370 return FALSE;
2371 }
2372
2373 /* Now output the banner */
2374
2375 smtp_printf("%s", ss);
2376 return TRUE;
2377 }
2378
2379
2380
2381
2382
2383 /*************************************************
2384 * Handle SMTP syntax and protocol errors *
2385 *************************************************/
2386
2387 /* Write to the log for SMTP syntax errors in incoming commands, if configured
2388 to do so. Then transmit the error response. The return value depends on the
2389 number of syntax and protocol errors in this SMTP session.
2390
2391 Arguments:
2392 type error type, given as a log flag bit
2393 code response code; <= 0 means don't send a response
2394 data data to reflect in the response (can be NULL)
2395 errmess the error message
2396
2397 Returns: -1 limit of syntax/protocol errors NOT exceeded
2398 +1 limit of syntax/protocol errors IS exceeded
2399
2400 These values fit in with the values of the "done" variable in the main
2401 processing loop in smtp_setup_msg(). */
2402
2403 static int
2404 synprot_error(int type, int code, uschar *data, uschar *errmess)
2405 {
2406 int yield = -1;
2407
2408 log_write(type, LOG_MAIN, "SMTP %s error in \"%s\" %s %s",
2409 (type == L_smtp_syntax_error)? "syntax" : "protocol",
2410 string_printing(smtp_cmd_buffer), host_and_ident(TRUE), errmess);
2411
2412 if (++synprot_error_count > smtp_max_synprot_errors)
2413 {
2414 yield = 1;
2415 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP call from %s dropped: too many "
2416 "syntax or protocol errors (last command was \"%s\")",
2417 host_and_ident(FALSE), smtp_cmd_buffer);
2418 }
2419
2420 if (code > 0)
2421 {
2422 smtp_printf("%d%c%s%s%s\r\n", code, (yield == 1)? '-' : ' ',
2423 (data == NULL)? US"" : data, (data == NULL)? US"" : US": ", errmess);
2424 if (yield == 1)
2425 smtp_printf("%d Too many syntax or protocol errors\r\n", code);
2426 }
2427
2428 return yield;
2429 }
2430
2431
2432
2433
2434 /*************************************************
2435 * Log incomplete transactions *
2436 *************************************************/
2437
2438 /* This function is called after a transaction has been aborted by RSET, QUIT,
2439 connection drops or other errors. It logs the envelope information received
2440 so far in order to preserve address verification attempts.
2441
2442 Argument: string to indicate what aborted the transaction
2443 Returns: nothing
2444 */
2445
2446 static void
2447 incomplete_transaction_log(uschar *what)
2448 {
2449 if (sender_address == NULL || /* No transaction in progress */
2450 (log_write_selector & L_smtp_incomplete_transaction) == 0 /* Not logging */
2451 ) return;
2452
2453 /* Build list of recipients for logging */
2454
2455 if (recipients_count > 0)
2456 {
2457 int i;
2458 raw_recipients = store_get(recipients_count * sizeof(uschar *));
2459 for (i = 0; i < recipients_count; i++)
2460 raw_recipients[i] = recipients_list[i].address;
2461 raw_recipients_count = recipients_count;
2462 }
2463
2464 log_write(L_smtp_incomplete_transaction, LOG_MAIN|LOG_SENDER|LOG_RECIPIENTS,
2465 "%s incomplete transaction (%s)", host_and_ident(TRUE), what);
2466 }
2467
2468
2469
2470
2471 /*************************************************
2472 * Send SMTP response, possibly multiline *
2473 *************************************************/
2474
2475 /* There are, it seems, broken clients out there that cannot handle multiline
2476 responses. If no_multiline_responses is TRUE (it can be set from an ACL), we
2477 output nothing for non-final calls, and only the first line for anything else.
2478
2479 Arguments:
2480 code SMTP code, may involve extended status codes
2481 codelen length of smtp code; if > 4 there's an ESC
2482 final FALSE if the last line isn't the final line
2483 msg message text, possibly containing newlines
2484
2485 Returns: nothing
2486 */
2487
2488 void
2489 smtp_respond(uschar* code, int codelen, BOOL final, uschar *msg)
2490 {
2491 int esclen = 0;
2492 uschar *esc = US"";
2493
2494 if (!final && no_multiline_responses) return;
2495
2496 if (codelen > 4)
2497 {
2498 esc = code + 4;
2499 esclen = codelen - 4;
2500 }
2501
2502 /* If this is the first output for a (non-batch) RCPT command, see if all RCPTs
2503 have had the same. Note: this code is also present in smtp_printf(). It would
2504 be tidier to have it only in one place, but when it was added, it was easier to
2505 do it that way, so as not to have to mess with the code for the RCPT command,
2506 which sometimes uses smtp_printf() and sometimes smtp_respond(). */
2507
2508 if (rcpt_in_progress)
2509 {
2510 if (rcpt_smtp_response == NULL)
2511 rcpt_smtp_response = string_copy(msg);
2512 else if (rcpt_smtp_response_same &&
2513 Ustrcmp(rcpt_smtp_response, msg) != 0)
2514 rcpt_smtp_response_same = FALSE;
2515 rcpt_in_progress = FALSE;
2516 }
2517
2518 /* Not output the message, splitting it up into multiple lines if necessary. */
2519
2520 for (;;)
2521 {
2522 uschar *nl = Ustrchr(msg, '\n');
2523 if (nl == NULL)
2524 {
2525 smtp_printf("%.3s%c%.*s%s\r\n", code, final? ' ':'-', esclen, esc, msg);
2526 return;
2527 }
2528 else if (nl[1] == 0 || no_multiline_responses)
2529 {
2530 smtp_printf("%.3s%c%.*s%.*s\r\n", code, final? ' ':'-', esclen, esc,
2531 (int)(nl - msg), msg);
2532 return;
2533 }
2534 else
2535 {
2536 smtp_printf("%.3s-%.*s%.*s\r\n", code, esclen, esc, (int)(nl - msg), msg);
2537 msg = nl + 1;
2538 while (isspace(*msg)) msg++;
2539 }
2540 }
2541 }
2542
2543
2544
2545
2546 /*************************************************
2547 * Parse user SMTP message *
2548 *************************************************/
2549
2550 /* This function allows for user messages overriding the response code details
2551 by providing a suitable response code string at the start of the message
2552 user_msg. Check the message for starting with a response code and optionally an
2553 extended status code. If found, check that the first digit is valid, and if so,
2554 change the code pointer and length to use the replacement. An invalid code
2555 causes a panic log; in this case, if the log messages is the same as the user
2556 message, we must also adjust the value of the log message to show the code that
2557 is actually going to be used (the original one).
2558
2559 This function is global because it is called from receive.c as well as within
2560 this module.
2561
2562 Note that the code length returned includes the terminating whitespace
2563 character, which is always included in the regex match.
2564
2565 Arguments:
2566 code SMTP code, may involve extended status codes
2567 codelen length of smtp code; if > 4 there's an ESC
2568 msg message text
2569 log_msg optional log message, to be adjusted with the new SMTP code
2570
2571 Returns: nothing
2572 */
2573
2574 void
2575 smtp_message_code(uschar **code, int *codelen, uschar **msg, uschar **log_msg)
2576 {
2577 int n;
2578 int ovector[3];
2579
2580 if (msg == NULL || *msg == NULL) return;
2581
2582 n = pcre_exec(regex_smtp_code, NULL, CS *msg, Ustrlen(*msg), 0,
2583 PCRE_EOPT, ovector, sizeof(ovector)/sizeof(int));
2584 if (n < 0) return;
2585
2586 if ((*msg)[0] != (*code)[0])
2587 {
2588 log_write(0, LOG_MAIN|LOG_PANIC, "configured error code starts with "
2589 "incorrect digit (expected %c) in \"%s\"", (*code)[0], *msg);
2590 if (log_msg != NULL && *log_msg == *msg)
2591 *log_msg = string_sprintf("%s %s", *code, *log_msg + ovector[1]);
2592 }
2593 else
2594 {
2595 *code = *msg;
2596 *codelen = ovector[1]; /* Includes final space */
2597 }
2598 *msg += ovector[1]; /* Chop the code off the message */
2599 return;
2600 }
2601
2602
2603
2604
2605 /*************************************************
2606 * Handle an ACL failure *
2607 *************************************************/
2608
2609 /* This function is called when acl_check() fails. As well as calls from within
2610 this module, it is called from receive.c for an ACL after DATA. It sorts out
2611 logging the incident, and sets up the error response. A message containing
2612 newlines is turned into a multiline SMTP response, but for logging, only the
2613 first line is used.
2614
2615 There's a table of default permanent failure response codes to use in
2616 globals.c, along with the table of names. VFRY is special. Despite RFC1123 it
2617 defaults disabled in Exim. However, discussion in connection with RFC 821bis
2618 (aka RFC 2821) has concluded that the response should be 252 in the disabled
2619 state, because there are broken clients that try VRFY before RCPT. A 5xx
2620 response should be given only when the address is positively known to be
2621 undeliverable. Sigh. Also, for ETRN, 458 is given on refusal, and for AUTH,
2622 503.
2623
2624 From Exim 4.63, it is possible to override the response code details by
2625 providing a suitable response code string at the start of the message provided
2626 in user_msg. The code's first digit is checked for validity.
2627
2628 Arguments:
2629 where where the ACL was called from
2630 rc the failure code
2631 user_msg a message that can be included in an SMTP response
2632 log_msg a message for logging
2633
2634 Returns: 0 in most cases
2635 2 if the failure code was FAIL_DROP, in which case the
2636 SMTP connection should be dropped (this value fits with the
2637 "done" variable in smtp_setup_msg() below)
2638 */
2639
2640 int
2641 smtp_handle_acl_fail(int where, int rc, uschar *user_msg, uschar *log_msg)
2642 {
2643 BOOL drop = rc == FAIL_DROP;
2644 int codelen = 3;
2645 uschar *smtp_code;
2646 uschar *lognl;
2647 uschar *sender_info = US"";
2648 uschar *what =
2649 #ifdef WITH_CONTENT_SCAN
2650 (where == ACL_WHERE_MIME)? US"during MIME ACL checks" :
2651 #endif
2652 (where == ACL_WHERE_PREDATA)? US"DATA" :
2653 (where == ACL_WHERE_DATA)? US"after DATA" :
2654 #ifndef DISABLE_PRDR
2655 (where == ACL_WHERE_PRDR)? US"after DATA PRDR" :
2656 #endif
2657 (smtp_cmd_data == NULL)?
2658 string_sprintf("%s in \"connect\" ACL", acl_wherenames[where]) :
2659 string_sprintf("%s %s", acl_wherenames[where], smtp_cmd_data);
2660
2661 if (drop) rc = FAIL;
2662
2663 /* Set the default SMTP code, and allow a user message to change it. */
2664
2665 smtp_code = (rc != FAIL)? US"451" : acl_wherecodes[where];
2666 smtp_message_code(&smtp_code, &codelen, &user_msg, &log_msg);
2667
2668 /* We used to have sender_address here; however, there was a bug that was not
2669 updating sender_address after a rewrite during a verify. When this bug was
2670 fixed, sender_address at this point became the rewritten address. I'm not sure
2671 this is what should be logged, so I've changed to logging the unrewritten
2672 address to retain backward compatibility. */
2673
2674 #ifndef WITH_CONTENT_SCAN
2675 if (where == ACL_WHERE_RCPT || where == ACL_WHERE_DATA)
2676 #else
2677 if (where == ACL_WHERE_RCPT || where == ACL_WHERE_DATA || where == ACL_WHERE_MIME)
2678 #endif
2679 {
2680 sender_info = string_sprintf("F=<%s>%s%s%s%s ",
2681 sender_address_unrewritten ? sender_address_unrewritten : sender_address,
2682 sender_host_authenticated ? US" A=" : US"",
2683 sender_host_authenticated ? sender_host_authenticated : US"",
2684 sender_host_authenticated && authenticated_id ? US":" : US"",
2685 sender_host_authenticated && authenticated_id ? authenticated_id : US""
2686 );
2687 }
2688
2689 /* If there's been a sender verification failure with a specific message, and
2690 we have not sent a response about it yet, do so now, as a preliminary line for
2691 failures, but not defers. However, always log it for defer, and log it for fail
2692 unless the sender_verify_fail log selector has been turned off. */
2693
2694 if (sender_verified_failed != NULL &&
2695 !testflag(sender_verified_failed, af_sverify_told))
2696 {
2697 BOOL save_rcpt_in_progress = rcpt_in_progress;
2698 rcpt_in_progress = FALSE; /* So as not to treat these as the error */
2699
2700 setflag(sender_verified_failed, af_sverify_told);
2701
2702 if (rc != FAIL || (log_extra_selector & LX_sender_verify_fail) != 0)
2703 log_write(0, LOG_MAIN|LOG_REJECT, "%s sender verify %s for <%s>%s",
2704 host_and_ident(TRUE),
2705 ((sender_verified_failed->special_action & 255) == DEFER)? "defer":"fail",
2706 sender_verified_failed->address,
2707 (sender_verified_failed->message == NULL)? US"" :
2708 string_sprintf(": %s", sender_verified_failed->message));
2709
2710 if (rc == FAIL && sender_verified_failed->user_message != NULL)
2711 smtp_respond(smtp_code, codelen, FALSE, string_sprintf(
2712 testflag(sender_verified_failed, af_verify_pmfail)?
2713 "Postmaster verification failed while checking <%s>\n%s\n"
2714 "Several RFCs state that you are required to have a postmaster\n"
2715 "mailbox for each mail domain. This host does not accept mail\n"
2716 "from domains whose servers reject the postmaster address."
2717 :
2718 testflag(sender_verified_failed, af_verify_nsfail)?
2719 "Callback setup failed while verifying <%s>\n%s\n"
2720 "The initial connection, or a HELO or MAIL FROM:<> command was\n"
2721 "rejected. Refusing MAIL FROM:<> does not help fight spam, disregards\n"
2722 "RFC requirements, and stops you from receiving standard bounce\n"
2723 "messages. This host does not accept mail from domains whose servers\n"
2724 "refuse bounces."
2725 :
2726 "Verification failed for <%s>\n%s",
2727 sender_verified_failed->address,
2728 sender_verified_failed->user_message));
2729
2730 rcpt_in_progress = save_rcpt_in_progress;
2731 }
2732
2733 /* Sort out text for logging */
2734
2735 log_msg = (log_msg == NULL)? US"" : string_sprintf(": %s", log_msg);
2736 lognl = Ustrchr(log_msg, '\n');
2737 if (lognl != NULL) *lognl = 0;
2738
2739 /* Send permanent failure response to the command, but the code used isn't
2740 always a 5xx one - see comments at the start of this function. If the original
2741 rc was FAIL_DROP we drop the connection and yield 2. */
2742
2743 if (rc == FAIL) smtp_respond(smtp_code, codelen, TRUE, (user_msg == NULL)?
2744 US"Administrative prohibition" : user_msg);
2745
2746 /* Send temporary failure response to the command. Don't give any details,
2747 unless acl_temp_details is set. This is TRUE for a callout defer, a "defer"
2748 verb, and for a header verify when smtp_return_error_details is set.
2749
2750 This conditional logic is all somewhat of a mess because of the odd
2751 interactions between temp_details and return_error_details. One day it should
2752 be re-implemented in a tidier fashion. */
2753
2754 else
2755 {
2756 if (acl_temp_details && user_msg != NULL)
2757 {
2758 if (smtp_return_error_details &&
2759 sender_verified_failed != NULL &&
2760 sender_verified_failed->message != NULL)
2761 {
2762 smtp_respond(smtp_code, codelen, FALSE, sender_verified_failed->message);
2763 }
2764 smtp_respond(smtp_code, codelen, TRUE, user_msg);
2765 }
2766 else
2767 smtp_respond(smtp_code, codelen, TRUE,
2768 US"Temporary local problem - please try later");
2769 }
2770
2771 /* Log the incident to the logs that are specified by log_reject_target
2772 (default main, reject). This can be empty to suppress logging of rejections. If
2773 the connection is not forcibly to be dropped, return 0. Otherwise, log why it
2774 is closing if required and return 2. */
2775
2776 if (log_reject_target != 0)
2777 {
2778 #ifdef SUPPORT_TLS
2779 uschar * s = s_tlslog(NULL, NULL, NULL);
2780 if (!s) s = US"";
2781 #else
2782 uschar * s = US"";
2783 #endif
2784 log_write(0, log_reject_target, "%s%s %s%srejected %s%s",
2785 host_and_ident(TRUE), s,
2786 sender_info, (rc == FAIL)? US"" : US"temporarily ", what, log_msg);
2787 }
2788
2789 if (!drop) return 0;
2790
2791 log_write(L_smtp_connection, LOG_MAIN, "%s closed by DROP in ACL",
2792 smtp_get_connection_info());
2793
2794 /* Run the not-quit ACL, but without any custom messages. This should not be a
2795 problem, because we get here only if some other ACL has issued "drop", and
2796 in that case, *its* custom messages will have been used above. */
2797
2798 smtp_notquit_exit(US"acl-drop", NULL, NULL);
2799 return 2;
2800 }
2801
2802
2803
2804
2805 /*************************************************
2806 * Handle SMTP exit when QUIT is not given *
2807 *************************************************/
2808
2809 /* This function provides a logging/statistics hook for when an SMTP connection
2810 is dropped on the floor or the other end goes away. It's a global function
2811 because it's called from receive.c as well as this module. As well as running
2812 the NOTQUIT ACL, if there is one, this function also outputs a final SMTP
2813 response, either with a custom message from the ACL, or using a default. There
2814 is one case, however, when no message is output - after "drop". In that case,
2815 the ACL that obeyed "drop" has already supplied the custom message, and NULL is
2816 passed to this function.
2817
2818 In case things go wrong while processing this function, causing an error that
2819 may re-enter this funtion, there is a recursion check.
2820
2821 Arguments:
2822 reason What $smtp_notquit_reason will be set to in the ACL;
2823 if NULL, the ACL is not run
2824 code The error code to return as part of the response
2825 defaultrespond The default message if there's no user_msg
2826
2827 Returns: Nothing
2828 */
2829
2830 void
2831 smtp_notquit_exit(uschar *reason, uschar *code, uschar *defaultrespond, ...)
2832 {
2833 int rc;
2834 uschar *user_msg = NULL;
2835 uschar *log_msg = NULL;
2836
2837 /* Check for recursive acll */
2838
2839 if (smtp_exit_function_called)
2840 {
2841 log_write(0, LOG_PANIC, "smtp_notquit_exit() called more than once (%s)",
2842 reason);
2843 return;
2844 }
2845 smtp_exit_function_called = TRUE;
2846
2847 /* Call the not-QUIT ACL, if there is one, unless no reason is given. */
2848
2849 if (acl_smtp_notquit != NULL && reason != NULL)
2850 {
2851 smtp_notquit_reason = reason;
2852 rc = acl_check(ACL_WHERE_NOTQUIT, NULL, acl_smtp_notquit, &user_msg,
2853 &log_msg);
2854 if (rc == ERROR)
2855 log_write(0, LOG_MAIN|LOG_PANIC, "ACL for not-QUIT returned ERROR: %s",
2856 log_msg);
2857 }
2858
2859 /* Write an SMTP response if we are expected to give one. As the default
2860 responses are all internal, they should always fit in the buffer, but code a
2861 warning, just in case. Note that string_vformat() still leaves a complete
2862 string, even if it is incomplete. */
2863
2864 if (code != NULL && defaultrespond != NULL)
2865 {
2866 if (user_msg == NULL)
2867 {
2868 uschar buffer[128];
2869 va_list ap;
2870 va_start(ap, defaultrespond);
2871 if (!string_vformat(buffer, sizeof(buffer), CS defaultrespond, ap))
2872 log_write(0, LOG_MAIN|LOG_PANIC, "string too large in smtp_notquit_exit()");
2873 smtp_printf("%s %s\r\n", code, buffer);
2874 va_end(ap);
2875 }
2876 else
2877 smtp_respond(code, 3, TRUE, user_msg);
2878 mac_smtp_fflush();
2879 }
2880 }
2881
2882
2883
2884
2885 /*************************************************
2886 * Verify HELO argument *
2887 *************************************************/
2888
2889 /* This function is called if helo_verify_hosts or helo_try_verify_hosts is
2890 matched. It is also called from ACL processing if verify = helo is used and
2891 verification was not previously tried (i.e. helo_try_verify_hosts was not
2892 matched). The result of its processing is to set helo_verified and
2893 helo_verify_failed. These variables should both be FALSE for this function to
2894 be called.
2895
2896 Note that EHLO/HELO is legitimately allowed to quote an address literal. Allow
2897 for IPv6 ::ffff: literals.
2898
2899 Argument: none
2900 Returns: TRUE if testing was completed;
2901 FALSE on a temporary failure
2902 */
2903
2904 BOOL
2905 smtp_verify_helo(void)
2906 {
2907 BOOL yield = TRUE;
2908
2909 HDEBUG(D_receive) debug_printf("verifying EHLO/HELO argument \"%s\"\n",
2910 sender_helo_name);
2911
2912 if (sender_helo_name == NULL)
2913 {
2914 HDEBUG(D_receive) debug_printf("no EHLO/HELO command was issued\n");
2915 }
2916
2917 /* Deal with the case of -bs without an IP address */
2918
2919 else if (sender_host_address == NULL)
2920 {
2921 HDEBUG(D_receive) debug_printf("no client IP address: assume success\n");
2922 helo_verified = TRUE;
2923 }
2924
2925 /* Deal with the more common case when there is a sending IP address */
2926
2927 else if (sender_helo_name[0] == '[')
2928 {
2929 helo_verified = Ustrncmp(sender_helo_name+1, sender_host_address,
2930 Ustrlen(sender_host_address)) == 0;
2931
2932 #if HAVE_IPV6
2933 if (!helo_verified)
2934 {
2935 if (strncmpic(sender_host_address, US"::ffff:", 7) == 0)
2936 helo_verified = Ustrncmp(sender_helo_name + 1,
2937 sender_host_address + 7, Ustrlen(sender_host_address) - 7) == 0;
2938 }
2939 #endif
2940
2941 HDEBUG(D_receive)
2942 { if (helo_verified) debug_printf("matched host address\n"); }
2943 }
2944
2945 /* Do a reverse lookup if one hasn't already given a positive or negative
2946 response. If that fails, or the name doesn't match, try checking with a forward
2947 lookup. */
2948
2949 else
2950 {
2951 if (sender_host_name == NULL && !host_lookup_failed)
2952 yield = host_name_lookup() != DEFER;
2953
2954 /* If a host name is known, check it and all its aliases. */
2955
2956 if (sender_host_name != NULL)
2957 {
2958 helo_verified = strcmpic(sender_host_name, sender_helo_name) == 0;
2959
2960 if (helo_verified)
2961 {
2962 HDEBUG(D_receive) debug_printf("matched host name\n");
2963 }
2964 else
2965 {
2966 uschar **aliases = sender_host_aliases;
2967 while (*aliases != NULL)
2968 {
2969 helo_verified = strcmpic(*aliases++, sender_helo_name) == 0;
2970 if (helo_verified) break;
2971 }
2972 HDEBUG(D_receive)
2973 {
2974 if (helo_verified)
2975 debug_printf("matched alias %s\n", *(--aliases));
2976 }
2977 }
2978 }
2979
2980 /* Final attempt: try a forward lookup of the helo name */
2981
2982 if (!helo_verified)
2983 {
2984 int rc;
2985 host_item h;
2986 h.name = sender_helo_name;
2987 h.address = NULL;
2988 h.mx = MX_NONE;
2989 h.next = NULL;
2990 HDEBUG(D_receive) debug_printf("getting IP address for %s\n",
2991 sender_helo_name);
2992 rc = host_find_byname(&h, NULL, 0, NULL, TRUE);
2993 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
2994 {
2995 host_item *hh = &h;
2996 while (hh != NULL)
2997 {
2998 if (Ustrcmp(hh->address, sender_host_address) == 0)
2999 {
3000 helo_verified = TRUE;
3001 HDEBUG(D_receive)
3002 debug_printf("IP address for %s matches calling address\n",
3003 sender_helo_name);
3004 break;
3005 }
3006 hh = hh->next;
3007 }
3008 }
3009 }
3010 }
3011
3012 if (!helo_verified) helo_verify_failed = TRUE; /* We've tried ... */
3013 return yield;
3014 }
3015
3016
3017
3018
3019 /*************************************************
3020 * Send user response message *
3021 *************************************************/
3022
3023 /* This function is passed a default response code and a user message. It calls
3024 smtp_message_code() to check and possibly modify the response code, and then
3025 calls smtp_respond() to transmit the response. I put this into a function
3026 just to avoid a lot of repetition.
3027
3028 Arguments:
3029 code the response code
3030 user_msg the user message
3031
3032 Returns: nothing
3033 */
3034
3035 static void
3036 smtp_user_msg(uschar *code, uschar *user_msg)
3037 {
3038 int len = 3;
3039 smtp_message_code(&code, &len, &user_msg, NULL);
3040 smtp_respond(code, len, TRUE, user_msg);
3041 }
3042
3043
3044
3045 /*************************************************
3046 * Initialize for SMTP incoming message *
3047 *************************************************/
3048
3049 /* This function conducts the initial dialogue at the start of an incoming SMTP
3050 message, and builds a list of recipients. However, if the incoming message
3051 is part of a batch (-bS option) a separate function is called since it would
3052 be messy having tests splattered about all over this function. This function
3053 therefore handles the case where interaction is occurring. The input and output
3054 files are set up in smtp_in and smtp_out.
3055
3056 The global recipients_list is set to point to a vector of recipient_item
3057 blocks, whose number is given by recipients_count. This is extended by the
3058 receive_add_recipient() function. The global variable sender_address is set to
3059 the sender's address. The yield is +1 if a message has been successfully
3060 started, 0 if a QUIT command was encountered or the connection was refused from
3061 the particular host, or -1 if the connection was lost.
3062
3063 Argument: none
3064
3065 Returns: > 0 message successfully started (reached DATA)
3066 = 0 QUIT read or end of file reached or call refused
3067 < 0 lost connection
3068 */
3069
3070 int
3071 smtp_setup_msg(void)
3072 {
3073 int done = 0;
3074 BOOL toomany = FALSE;
3075 BOOL discarded = FALSE;
3076 BOOL last_was_rej_mail = FALSE;
3077 BOOL last_was_rcpt = FALSE;
3078 void *reset_point = store_get(0);
3079
3080 DEBUG(D_receive) debug_printf("smtp_setup_msg entered\n");
3081
3082 /* Reset for start of new message. We allow one RSET not to be counted as a
3083 nonmail command, for those MTAs that insist on sending it between every
3084 message. Ditto for EHLO/HELO and for STARTTLS, to allow for going in and out of
3085 TLS between messages (an Exim client may do this if it has messages queued up
3086 for the host). Note: we do NOT reset AUTH at this point. */
3087
3088 smtp_reset(reset_point);
3089 message_ended = END_NOTSTARTED;
3090
3091 cmd_list[CMD_LIST_RSET].is_mail_cmd = TRUE;
3092 cmd_list[CMD_LIST_HELO].is_mail_cmd = TRUE;
3093 cmd_list[CMD_LIST_EHLO].is_mail_cmd = TRUE;
3094 #ifdef SUPPORT_TLS
3095 cmd_list[CMD_LIST_STARTTLS].is_mail_cmd = TRUE;
3096 #endif
3097
3098 /* Set the local signal handler for SIGTERM - it tries to end off tidily */
3099
3100 os_non_restarting_signal(SIGTERM, command_sigterm_handler);
3101
3102 /* Batched SMTP is handled in a different function. */
3103
3104 if (smtp_batched_input) return smtp_setup_batch_msg();
3105
3106 /* Deal with SMTP commands. This loop is exited by setting done to a POSITIVE
3107 value. The values are 2 larger than the required yield of the function. */
3108
3109 while (done <= 0)
3110 {
3111 uschar **argv;
3112 uschar *etrn_command;
3113 uschar *etrn_serialize_key;
3114 uschar *errmess;
3115 uschar *log_msg, *smtp_code;
3116 uschar *user_msg = NULL;
3117 uschar *recipient = NULL;
3118 uschar *hello = NULL;
3119 uschar *set_id = NULL;
3120 uschar *s, *ss;
3121 BOOL was_rej_mail = FALSE;
3122 BOOL was_rcpt = FALSE;
3123 void (*oldsignal)(int);
3124 pid_t pid;
3125 int start, end, sender_domain, recipient_domain;
3126 int ptr, size, rc;
3127 int c, i;
3128 auth_instance *au;
3129
3130 switch(smtp_read_command(TRUE))
3131 {
3132 /* The AUTH command is not permitted to occur inside a transaction, and may
3133 occur successfully only once per connection. Actually, that isn't quite
3134 true. When TLS is started, all previous information about a connection must
3135 be discarded, so a new AUTH is permitted at that time.
3136
3137 AUTH may only be used when it has been advertised. However, it seems that
3138 there are clients that send AUTH when it hasn't been advertised, some of
3139 them even doing this after HELO. And there are MTAs that accept this. Sigh.
3140 So there's a get-out that allows this to happen.
3141
3142 AUTH is initially labelled as a "nonmail command" so that one occurrence
3143 doesn't get counted. We change the label here so that multiple failing
3144 AUTHS will eventually hit the nonmail threshold. */
3145
3146 case AUTH_CMD:
3147 HAD(SCH_AUTH);
3148 authentication_failed = TRUE;
3149 cmd_list[CMD_LIST_AUTH].is_mail_cmd = FALSE;
3150
3151 if (!auth_advertised && !allow_auth_unadvertised)
3152 {
3153 done = synprot_error(L_smtp_protocol_error, 503, NULL,
3154 US"AUTH command used when not advertised");
3155 break;
3156 }
3157 if (sender_host_authenticated != NULL)
3158 {
3159 done = synprot_error(L_smtp_protocol_error, 503, NULL,
3160 US"already authenticated");
3161 break;
3162 }
3163 if (sender_address != NULL)
3164 {
3165 done = synprot_error(L_smtp_protocol_error, 503, NULL,
3166 US"not permitted in mail transaction");
3167 break;
3168 }
3169
3170 /* Check the ACL */
3171
3172 if (acl_smtp_auth != NULL)
3173 {
3174 rc = acl_check(ACL_WHERE_AUTH, NULL, acl_smtp_auth, &user_msg, &log_msg);
3175 if (rc != OK)
3176 {
3177 done = smtp_handle_acl_fail(ACL_WHERE_AUTH, rc, user_msg, log_msg);
3178 break;
3179 }
3180 }
3181
3182 /* Find the name of the requested authentication mechanism. */
3183
3184 s = smtp_cmd_data;
3185 while ((c = *smtp_cmd_data) != 0 && !isspace(c))
3186 {
3187 if (!isalnum(c) && c != '-' && c != '_')
3188 {
3189 done = synprot_error(L_smtp_syntax_error, 501, NULL,
3190 US"invalid character in authentication mechanism name");
3191 goto COMMAND_LOOP;
3192 }
3193 smtp_cmd_data++;
3194 }
3195
3196 /* If not at the end of the line, we must be at white space. Terminate the
3197 name and move the pointer on to any data that may be present. */
3198
3199 if (*smtp_cmd_data != 0)
3200 {
3201 *smtp_cmd_data++ = 0;
3202 while (isspace(*smtp_cmd_data)) smtp_cmd_data++;
3203 }
3204
3205 /* Search for an authentication mechanism which is configured for use
3206 as a server and which has been advertised (unless, sigh, allow_auth_
3207 unadvertised is set). */
3208
3209 for (au = auths; au != NULL; au = au->next)
3210 {
3211 if (strcmpic(s, au->public_name) == 0 && au->server &&
3212 (au->advertised || allow_auth_unadvertised)) break;
3213 }
3214
3215 if (au == NULL)
3216 {
3217 done = synprot_error(L_smtp_protocol_error, 504, NULL,
3218 string_sprintf("%s authentication mechanism not supported", s));
3219 break;
3220 }
3221
3222 /* Run the checking code, passing the remainder of the command line as
3223 data. Initials the $auth<n> variables as empty. Initialize $0 empty and set
3224 it as the only set numerical variable. The authenticator may set $auth<n>
3225 and also set other numeric variables. The $auth<n> variables are preferred
3226 nowadays; the numerical variables remain for backwards compatibility.
3227
3228 Afterwards, have a go at expanding the set_id string, even if
3229 authentication failed - for bad passwords it can be useful to log the
3230 userid. On success, require set_id to expand and exist, and put it in
3231 authenticated_id. Save this in permanent store, as the working store gets
3232 reset at HELO, RSET, etc. */
3233
3234 for (i = 0; i < AUTH_VARS; i++) auth_vars[i] = NULL;
3235 expand_nmax = 0;
3236 expand_nlength[0] = 0; /* $0 contains nothing */
3237
3238 c = (au->info->servercode)(au, smtp_cmd_data);
3239 if (au->set_id != NULL) set_id = expand_string(au->set_id);
3240 expand_nmax = -1; /* Reset numeric variables */
3241 for (i = 0; i < AUTH_VARS; i++) auth_vars[i] = NULL; /* Reset $auth<n> */
3242
3243 /* The value of authenticated_id is stored in the spool file and printed in
3244 log lines. It must not contain binary zeros or newline characters. In
3245 normal use, it never will, but when playing around or testing, this error
3246 can (did) happen. To guard against this, ensure that the id contains only
3247 printing characters. */
3248
3249 if (set_id != NULL) set_id = string_printing(set_id);
3250
3251 /* For the non-OK cases, set up additional logging data if set_id
3252 is not empty. */
3253
3254 if (c != OK)
3255 {
3256 if (set_id != NULL && *set_id != 0)
3257 set_id = string_sprintf(" (set_id=%s)", set_id);
3258 else set_id = US"";
3259 }
3260
3261 /* Switch on the result */
3262
3263 switch(c)
3264 {
3265 case OK:
3266 if (au->set_id == NULL || set_id != NULL) /* Complete success */
3267 {
3268 if (set_id != NULL) authenticated_id = string_copy_malloc(set_id);
3269 sender_host_authenticated = au->name;
3270 authentication_failed = FALSE;
3271 authenticated_fail_id = NULL; /* Impossible to already be set? */
3272 received_protocol =
3273 protocols[pextend + pauthed + ((tls_in.active >= 0)? pcrpted:0)] +
3274 ((sender_host_address != NULL)? pnlocal : 0);
3275 s = ss = US"235 Authentication succeeded";
3276 authenticated_by = au;
3277 break;
3278 }
3279
3280 /* Authentication succeeded, but we failed to expand the set_id string.
3281 Treat this as a temporary error. */
3282
3283 auth_defer_msg = expand_string_message;
3284 /* Fall through */
3285
3286 case DEFER:
3287 if (set_id != NULL) authenticated_fail_id = string_copy_malloc(set_id);
3288 s = string_sprintf("435 Unable to authenticate at present%s",
3289 auth_defer_user_msg);
3290 ss = string_sprintf("435 Unable to authenticate at present%s: %s",
3291 set_id, auth_defer_msg);
3292 break;
3293
3294 case BAD64:
3295 s = ss = US"501 Invalid base64 data";
3296 break;
3297
3298 case CANCELLED:
3299 s = ss = US"501 Authentication cancelled";
3300 break;
3301
3302 case UNEXPECTED:
3303 s = ss = US"553 Initial data not expected";
3304 break;
3305
3306 case FAIL:
3307 if (set_id != NULL) authenticated_fail_id = string_copy_malloc(set_id);
3308 s = US"535 Incorrect authentication data";
3309 ss = string_sprintf("535 Incorrect authentication data%s", set_id);
3310 break;
3311
3312 default:
3313 if (set_id != NULL) authenticated_fail_id = string_copy_malloc(set_id);
3314 s = US"435 Internal error";
3315 ss = string_sprintf("435 Internal error%s: return %d from authentication "
3316 "check", set_id, c);
3317 break;
3318 }
3319
3320 smtp_printf("%s\r\n", s);
3321 if (c != OK)
3322 log_write(0, LOG_MAIN|LOG_REJECT, "%s authenticator failed for %s: %s",
3323 au->name, host_and_ident(FALSE), ss);
3324
3325 break; /* AUTH_CMD */
3326
3327 /* The HELO/EHLO commands are permitted to appear in the middle of a
3328 session as well as at the beginning. They have the effect of a reset in
3329 addition to their other functions. Their absence at the start cannot be
3330 taken to be an error.
3331
3332 RFC 2821 says:
3333
3334 If the EHLO command is not acceptable to the SMTP server, 501, 500,
3335 or 502 failure replies MUST be returned as appropriate. The SMTP
3336 server MUST stay in the same state after transmitting these replies
3337 that it was in before the EHLO was received.
3338
3339 Therefore, we do not do the reset until after checking the command for
3340 acceptability. This change was made for Exim release 4.11. Previously
3341 it did the reset first. */
3342
3343 case HELO_CMD:
3344 HAD(SCH_HELO);
3345 hello = US"HELO";
3346 esmtp = FALSE;
3347 goto HELO_EHLO;
3348
3349 case EHLO_CMD:
3350 HAD(SCH_EHLO);
3351 hello = US"EHLO";
3352 esmtp = TRUE;
3353
3354 HELO_EHLO: /* Common code for HELO and EHLO */
3355 cmd_list[CMD_LIST_HELO].is_mail_cmd = FALSE;
3356 cmd_list[CMD_LIST_EHLO].is_mail_cmd = FALSE;
3357
3358 /* Reject the HELO if its argument was invalid or non-existent. A
3359 successful check causes the argument to be saved in malloc store. */
3360
3361 if (!check_helo(smtp_cmd_data))
3362 {
3363 smtp_printf("501 Syntactically invalid %s argument(s)\r\n", hello);
3364
3365 log_write(0, LOG_MAIN|LOG_REJECT, "rejected %s from %s: syntactically "
3366 "invalid argument(s): %s", hello, host_and_ident(FALSE),
3367 (*smtp_cmd_argument == 0)? US"(no argument given)" :
3368 string_printing(smtp_cmd_argument));
3369
3370 if (++synprot_error_count > smtp_max_synprot_errors)
3371 {
3372 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP call from %s dropped: too many "
3373 "syntax or protocol errors (last command was \"%s\")",
3374 host_and_ident(FALSE), smtp_cmd_buffer);
3375 done = 1;
3376 }
3377
3378 break;
3379 }
3380
3381 /* If sender_host_unknown is true, we have got here via the -bs interface,
3382 not called from inetd. Otherwise, we are running an IP connection and the
3383 host address will be set. If the helo name is the primary name of this
3384 host and we haven't done a reverse lookup, force one now. If helo_required
3385 is set, ensure that the HELO name matches the actual host. If helo_verify
3386 is set, do the same check, but softly. */
3387
3388 if (!sender_host_unknown)
3389 {
3390 BOOL old_helo_verified = helo_verified;
3391 uschar *p = smtp_cmd_data;
3392
3393 while (*p != 0 && !isspace(*p)) { *p = tolower(*p); p++; }
3394 *p = 0;
3395
3396 /* Force a reverse lookup if HELO quoted something in helo_lookup_domains
3397 because otherwise the log can be confusing. */
3398
3399 if (sender_host_name == NULL &&
3400 (deliver_domain = sender_helo_name, /* set $domain */
3401 match_isinlist(sender_helo_name, &helo_lookup_domains, 0,
3402 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL)) == OK)
3403 (void)host_name_lookup();
3404
3405 /* Rebuild the fullhost info to include the HELO name (and the real name
3406 if it was looked up.) */
3407
3408 host_build_sender_fullhost(); /* Rebuild */
3409 set_process_info("handling%s incoming connection from %s",
3410 (tls_in.active >= 0)? " TLS" : "", host_and_ident(FALSE));
3411
3412 /* Verify if configured. This doesn't give much security, but it does
3413 make some people happy to be able to do it. If helo_required is set,
3414 (host matches helo_verify_hosts) failure forces rejection. If helo_verify
3415 is set (host matches helo_try_verify_hosts), it does not. This is perhaps
3416 now obsolescent, since the verification can now be requested selectively
3417 at ACL time. */
3418
3419 helo_verified = helo_verify_failed = FALSE;
3420 if (helo_required || helo_verify)
3421 {
3422 BOOL tempfail = !smtp_verify_helo();
3423 if (!helo_verified)
3424 {
3425 if (helo_required)
3426 {
3427 smtp_printf("%d %s argument does not match calling host\r\n",
3428 tempfail? 451 : 550, hello);
3429 log_write(0, LOG_MAIN|LOG_REJECT, "%srejected \"%s %s\" from %s",
3430 tempfail? "temporarily " : "",
3431 hello, sender_helo_name, host_and_ident(FALSE));
3432 helo_verified = old_helo_verified;
3433 break; /* End of HELO/EHLO processing */
3434 }
3435 HDEBUG(D_all) debug_printf("%s verification failed but host is in "
3436 "helo_try_verify_hosts\n", hello);
3437 }
3438 }
3439 }
3440
3441 #ifdef EXPERIMENTAL_SPF
3442 /* set up SPF context */
3443 spf_init(sender_helo_name, sender_host_address);
3444 #endif
3445
3446 /* Apply an ACL check if one is defined; afterwards, recheck
3447 synchronization in case the client started sending in a delay. */
3448
3449 if (acl_smtp_helo != NULL)
3450 {
3451 rc = acl_check(ACL_WHERE_HELO, NULL, acl_smtp_helo, &user_msg, &log_msg);
3452 if (rc != OK)
3453 {
3454 done = smtp_handle_acl_fail(ACL_WHERE_HELO, rc, user_msg, log_msg);
3455 sender_helo_name = NULL;
3456 host_build_sender_fullhost(); /* Rebuild */
3457 break;
3458 }
3459 else if (!check_sync()) goto SYNC_FAILURE;
3460 }
3461
3462 /* Generate an OK reply. The default string includes the ident if present,
3463 and also the IP address if present. Reflecting back the ident is intended
3464 as a deterrent to mail forgers. For maximum efficiency, and also because
3465 some broken systems expect each response to be in a single packet, arrange
3466 that the entire reply is sent in one write(). */
3467
3468 auth_advertised = FALSE;
3469 pipelining_advertised = FALSE;
3470 #ifdef SUPPORT_TLS
3471 tls_advertised = FALSE;
3472 #endif
3473
3474 smtp_code = US"250 "; /* Default response code plus space*/
3475 if (user_msg == NULL)
3476 {
3477 s = string_sprintf("%.3s %s Hello %s%s%s",
3478 smtp_code,
3479 smtp_active_hostname,
3480 (sender_ident == NULL)? US"" : sender_ident,
3481 (sender_ident == NULL)? US"" : US" at ",
3482 (sender_host_name == NULL)? sender_helo_name : sender_host_name);
3483
3484 ptr = Ustrlen(s);
3485 size = ptr + 1;
3486
3487 if (sender_host_address != NULL)
3488 {
3489 s = string_cat(s, &size, &ptr, US" [", 2);
3490 s = string_cat(s, &size, &ptr, sender_host_address,
3491 Ustrlen(sender_host_address));
3492 s = string_cat(s, &size, &ptr, US"]", 1);
3493 }
3494 }
3495
3496 /* A user-supplied EHLO greeting may not contain more than one line. Note
3497 that the code returned by smtp_message_code() includes the terminating
3498 whitespace character. */
3499
3500 else
3501 {
3502 char *ss;
3503 int codelen = 4;
3504 smtp_message_code(&smtp_code, &codelen, &user_msg, NULL);
3505 s = string_sprintf("%.*s%s", codelen, smtp_code, user_msg);
3506 if ((ss = strpbrk(CS s, "\r\n")) != NULL)
3507 {
3508 log_write(0, LOG_MAIN|LOG_PANIC, "EHLO/HELO response must not contain "
3509 "newlines: message truncated: %s", string_printing(s));
3510 *ss = 0;
3511 }
3512 ptr = Ustrlen(s);
3513 size = ptr + 1;
3514 }
3515
3516 s = string_cat(s, &size, &ptr, US"\r\n", 2);
3517
3518 /* If we received EHLO, we must create a multiline response which includes
3519 the functions supported. */
3520
3521 if (esmtp)
3522 {
3523 s[3] = '-';
3524
3525 /* I'm not entirely happy with this, as an MTA is supposed to check
3526 that it has enough room to accept a message of maximum size before
3527 it sends this. However, there seems little point in not sending it.
3528 The actual size check happens later at MAIL FROM time. By postponing it
3529 till then, VRFY and EXPN can be used after EHLO when space is short. */
3530
3531 if (thismessage_size_limit > 0)
3532 {
3533 sprintf(CS big_buffer, "%.3s-SIZE %d\r\n", smtp_code,
3534 thismessage_size_limit);
3535 s = string_cat(s, &size, &ptr, big_buffer, Ustrlen(big_buffer));
3536 }
3537 else
3538 {
3539 s = string_cat(s, &size, &ptr, smtp_code, 3);
3540 s = string_cat(s, &size, &ptr, US"-SIZE\r\n", 7);
3541 }
3542
3543 /* Exim does not do protocol conversion or data conversion. It is 8-bit
3544 clean; if it has an 8-bit character in its hand, it just sends it. It
3545 cannot therefore specify 8BITMIME and remain consistent with the RFCs.
3546 However, some users want this option simply in order to stop MUAs
3547 mangling messages that contain top-bit-set characters. It is therefore
3548 provided as an option. */
3549
3550 if (accept_8bitmime)
3551 {
3552 s = string_cat(s, &size, &ptr, smtp_code, 3);
3553 s = string_cat(s, &size, &ptr, US"-8BITMIME\r\n", 11);
3554 }
3555
3556 /* Advertise ETRN if there's an ACL checking whether a host is
3557 permitted to issue it; a check is made when any host actually tries. */
3558
3559 if (acl_smtp_etrn != NULL)
3560 {
3561 s = string_cat(s, &size, &ptr, smtp_code, 3);
3562 s = string_cat(s, &size, &ptr, US"-ETRN\r\n", 7);
3563 }
3564
3565 /* Advertise EXPN if there's an ACL checking whether a host is
3566 permitted to issue it; a check is made when any host actually tries. */
3567
3568 if (acl_smtp_expn != NULL)
3569 {
3570 s = string_cat(s, &size, &ptr, smtp_code, 3);
3571 s = string_cat(s, &size, &ptr, US"-EXPN\r\n", 7);
3572 }
3573
3574 /* Exim is quite happy with pipelining, so let the other end know that
3575 it is safe to use it, unless advertising is disabled. */
3576
3577 if (pipelining_enable &&
3578 verify_check_host(&pipelining_advertise_hosts) == OK)
3579 {
3580 s = string_cat(s, &size, &ptr, smtp_code, 3);
3581 s = string_cat(s, &size, &ptr, US"-PIPELINING\r\n", 13);
3582 sync_cmd_limit = NON_SYNC_CMD_PIPELINING;
3583 pipelining_advertised = TRUE;
3584 }
3585
3586
3587 /* If any server authentication mechanisms are configured, advertise
3588 them if the current host is in auth_advertise_hosts. The problem with
3589 advertising always is that some clients then require users to
3590 authenticate (and aren't configurable otherwise) even though it may not
3591 be necessary (e.g. if the host is in host_accept_relay).
3592
3593 RFC 2222 states that SASL mechanism names contain only upper case
3594 letters, so output the names in upper case, though we actually recognize
3595 them in either case in the AUTH command. */
3596
3597 if (auths != NULL)
3598 {
3599 if (verify_check_host(&auth_advertise_hosts) == OK)
3600 {
3601 auth_instance *au;
3602 BOOL first = TRUE;
3603 for (au = auths; au != NULL; au = au->next)
3604 {
3605 if (au->server && (au->advertise_condition == NULL ||
3606 expand_check_condition(au->advertise_condition, au->name,
3607 US"authenticator")))
3608 {
3609 int saveptr;
3610 if (first)
3611 {
3612 s = string_cat(s, &size, &ptr, smtp_code, 3);
3613 s = string_cat(s, &size, &ptr, US"-AUTH", 5);
3614 first = FALSE;
3615 auth_advertised = TRUE;
3616 }
3617 saveptr = ptr;
3618 s = string_cat(s, &size, &ptr, US" ", 1);
3619 s = string_cat(s, &size, &ptr, au->public_name,
3620 Ustrlen(au->public_name));
3621 while (++saveptr < ptr) s[saveptr] = toupper(s[saveptr]);
3622 au->advertised = TRUE;
3623 }
3624 else au->advertised = FALSE;
3625 }
3626 if (!first) s = string_cat(s, &size, &ptr, US"\r\n", 2);
3627 }
3628 }
3629
3630 /* Advertise TLS (Transport Level Security) aka SSL (Secure Socket Layer)
3631 if it has been included in the binary, and the host matches
3632 tls_advertise_hosts. We must *not* advertise if we are already in a
3633 secure connection. */
3634
3635 #ifdef SUPPORT_TLS
3636 if (tls_in.active < 0 &&
3637 verify_check_host(&tls_advertise_hosts) != FAIL)
3638 {
3639 s = string_cat(s, &size, &ptr, smtp_code, 3);
3640 s = string_cat(s, &size, &ptr, US"-STARTTLS\r\n", 11);
3641 tls_advertised = TRUE;
3642 }
3643 #endif
3644
3645 #ifndef DISABLE_PRDR
3646 /* Per Recipient Data Response, draft by Eric A. Hall extending RFC */
3647 if (prdr_enable)
3648 {
3649 s = string_cat(s, &size, &ptr, smtp_code, 3);
3650 s = string_cat(s, &size, &ptr, US"-PRDR\r\n", 7);
3651 }
3652 #endif
3653
3654 /* Finish off the multiline reply with one that is always available. */
3655
3656 s = string_cat(s, &size, &ptr, smtp_code, 3);
3657 s = string_cat(s, &size, &ptr, US" HELP\r\n", 7);
3658 }
3659
3660 /* Terminate the string (for debug), write it, and note that HELO/EHLO
3661 has been seen. */
3662
3663 s[ptr] = 0;
3664
3665 #ifdef SUPPORT_TLS
3666 if (tls_in.active >= 0) (void)tls_write(TRUE, s, ptr); else
3667 #endif
3668
3669 {
3670 int i = fwrite(s, 1, ptr, smtp_out); i = i; /* compiler quietening */
3671 }
3672 DEBUG(D_receive)
3673 {
3674 uschar *cr;
3675 while ((cr = Ustrchr(s, '\r')) != NULL) /* lose CRs */
3676 memmove(cr, cr + 1, (ptr--) - (cr - s));
3677 debug_printf("SMTP>> %s", s);
3678 }
3679 helo_seen = TRUE;
3680
3681 /* Reset the protocol and the state, abandoning any previous message. */
3682
3683 received_protocol = (esmtp?
3684 protocols[pextend +
3685 ((sender_host_authenticated != NULL)? pauthed : 0) +
3686 ((tls_in.active >= 0)? pcrpted : 0)]
3687 :
3688 protocols[pnormal + ((tls_in.active >= 0)? pcrpted : 0)])
3689 +
3690 ((sender_host_address != NULL)? pnlocal : 0);
3691
3692 smtp_reset(reset_point);
3693 toomany = FALSE;
3694 break; /* HELO/EHLO */
3695
3696
3697 /* The MAIL command requires an address as an operand. All we do
3698 here is to parse it for syntactic correctness. The form "<>" is
3699 a special case which converts into an empty string. The start/end
3700 pointers in the original are not used further for this address, as
3701 it is the canonical extracted address which is all that is kept. */
3702
3703 case MAIL_CMD:
3704 HAD(SCH_MAIL);
3705 smtp_mailcmd_count++; /* Count for limit and ratelimit */
3706 was_rej_mail = TRUE; /* Reset if accepted */
3707 env_mail_type_t * mail_args; /* Sanity check & validate args */
3708
3709 if (helo_required && !helo_seen)
3710 {
3711 smtp_printf("503 HELO or EHLO required\r\n");
3712 log_write(0, LOG_MAIN|LOG_REJECT, "rejected MAIL from %s: no "
3713 "HELO/EHLO given", host_and_ident(FALSE));
3714 break;
3715 }
3716
3717 if (sender_address != NULL)
3718 {
3719 done = synprot_error(L_smtp_protocol_error, 503, NULL,
3720 US"sender already given");
3721 break;
3722 }
3723
3724 if (smtp_cmd_data[0] == 0)
3725 {
3726 done = synprot_error(L_smtp_protocol_error, 501, NULL,
3727 US"MAIL must have an address operand");
3728 break;
3729 }
3730
3731 /* Check to see if the limit for messages per connection would be
3732 exceeded by accepting further messages. */
3733
3734 if (smtp_accept_max_per_connection > 0 &&
3735 smtp_mailcmd_count > smtp_accept_max_per_connection)
3736 {
3737 smtp_printf("421 too many messages in this connection\r\n");
3738 log_write(0, LOG_MAIN|LOG_REJECT, "rejected MAIL command %s: too many "
3739 "messages in one connection", host_and_ident(TRUE));
3740 break;
3741 }
3742
3743 /* Reset for start of message - even if this is going to fail, we
3744 obviously need to throw away any previous data. */
3745
3746 smtp_reset(reset_point);
3747 toomany = FALSE;
3748 sender_data = recipient_data = NULL;
3749
3750 /* Loop, checking for ESMTP additions to the MAIL FROM command. */
3751
3752 if (esmtp) for(;;)
3753 {
3754 uschar *name, *value, *end;
3755 unsigned long int size;
3756 BOOL arg_error = FALSE;
3757
3758 if (!extract_option(&name, &value)) break;
3759
3760 for (mail_args = env_mail_type_list;
3761 (char *)mail_args < (char *)env_mail_type_list + sizeof(env_mail_type_list);
3762 mail_args++
3763 )
3764 {
3765 if (strcmpic(name, mail_args->name) == 0)
3766 break;
3767 }
3768 if (mail_args->need_value && strcmpic(value, US"") == 0)
3769 break;
3770
3771 switch(mail_args->value)
3772 {
3773 /* Handle SIZE= by reading the value. We don't do the check till later,
3774 in order to be able to log the sender address on failure. */
3775 case ENV_MAIL_OPT_SIZE:
3776 if (((size = Ustrtoul(value, &end, 10)), *end == 0))
3777 {
3778 if ((size == ULONG_MAX && errno == ERANGE) || size > INT_MAX)
3779 size = INT_MAX;
3780 message_size = (int)size;
3781 }
3782 else
3783 arg_error = TRUE;
3784 break;
3785
3786 /* If this session was initiated with EHLO and accept_8bitmime is set,
3787 Exim will have indicated that it supports the BODY=8BITMIME option. In
3788 fact, it does not support this according to the RFCs, in that it does not
3789 take any special action for forwarding messages containing 8-bit
3790 characters. That is why accept_8bitmime is not the default setting, but
3791 some sites want the action that is provided. We recognize both "8BITMIME"
3792 and "7BIT" as body types, but take no action. */
3793 case ENV_MAIL_OPT_BODY:
3794 if (accept_8bitmime) {
3795 if (strcmpic(value, US"8BITMIME") == 0) {
3796 body_8bitmime = 8;
3797 } else if (strcmpic(value, US"7BIT") == 0) {
3798 body_8bitmime = 7;
3799 } else {
3800 body_8bitmime = 0;
3801 done = synprot_error(L_smtp_syntax_error, 501, NULL,
3802 US"invalid data for BODY");
3803 goto COMMAND_LOOP;
3804 }
3805 DEBUG(D_receive) debug_printf("8BITMIME: %d\n", body_8bitmime);
3806 break;
3807 }
3808 arg_error = TRUE;
3809 break;
3810
3811 /* Handle the AUTH extension. If the value given is not "<>" and either
3812 the ACL says "yes" or there is no ACL but the sending host is
3813 authenticated, we set it up as the authenticated sender. However, if the
3814 authenticator set a condition to be tested, we ignore AUTH on MAIL unless
3815 the condition is met. The value of AUTH is an xtext, which means that +,
3816 = and cntrl chars are coded in hex; however "<>" is unaffected by this
3817 coding. */
3818 case ENV_MAIL_OPT_AUTH:
3819 if (Ustrcmp(value, "<>") != 0)
3820 {
3821 int rc;
3822 uschar *ignore_msg;
3823
3824 if (auth_xtextdecode(value, &authenticated_sender) < 0)
3825 {
3826 /* Put back terminator overrides for error message */
3827 value[-1] = '=';
3828 name[-1] = ' ';
3829 done = synprot_error(L_smtp_syntax_error, 501, NULL,
3830 US"invalid data for AUTH");
3831 goto COMMAND_LOOP;
3832 }
3833 if (acl_smtp_mailauth == NULL)
3834 {
3835 ignore_msg = US"client not authenticated";
3836 rc = (sender_host_authenticated != NULL)? OK : FAIL;
3837 }
3838 else
3839 {
3840 ignore_msg = US"rejected by ACL";
3841 rc = acl_check(ACL_WHERE_MAILAUTH, NULL, acl_smtp_mailauth,
3842 &user_msg, &log_msg);
3843 }
3844
3845 switch (rc)
3846 {
3847 case OK:
3848 if (authenticated_by == NULL ||
3849 authenticated_by->mail_auth_condition == NULL ||
3850 expand_check_condition(authenticated_by->mail_auth_condition,
3851 authenticated_by->name, US"authenticator"))
3852 break; /* Accept the AUTH */
3853
3854 ignore_msg = US"server_mail_auth_condition failed";
3855 if (authenticated_id != NULL)
3856 ignore_msg = string_sprintf("%s: authenticated ID=\"%s\"",
3857 ignore_msg, authenticated_id);
3858
3859 /* Fall through */
3860
3861 case FAIL:
3862 authenticated_sender = NULL;
3863 log_write(0, LOG_MAIN, "ignoring AUTH=%s from %s (%s)",
3864 value, host_and_ident(TRUE), ignore_msg);
3865 break;
3866
3867 /* Should only get DEFER or ERROR here. Put back terminator
3868 overrides for error message */
3869
3870 default:
3871 value[-1] = '=';
3872 name[-1] = ' ';
3873 (void)smtp_handle_acl_fail(ACL_WHERE_MAILAUTH, rc, user_msg,
3874 log_msg);
3875 goto COMMAND_LOOP;
3876 }
3877 }
3878 break;
3879
3880 #ifndef DISABLE_PRDR
3881 case ENV_MAIL_OPT_PRDR:
3882 if (prdr_enable)
3883 prdr_requested = TRUE;
3884 break;
3885 #endif
3886
3887 /* Unknown option. Stick back the terminator characters and break
3888 the loop. Do the name-terminator second as extract_option sets
3889 value==name when it found no equal-sign.
3890 An error for a malformed address will occur. */
3891 default:
3892 value[-1] = '=';
3893 name[-1] = ' ';
3894 arg_error = TRUE;
3895 break;
3896 }
3897 /* Break out of for loop if switch() had bad argument or
3898 when start of the email address is reached */
3899 if (arg_error) break;
3900 }
3901
3902 /* If we have passed the threshold for rate limiting, apply the current
3903 delay, and update it for next time, provided this is a limited host. */
3904
3905 if (smtp_mailcmd_count > smtp_rlm_threshold &&
3906 verify_check_host(&smtp_ratelimit_hosts) == OK)
3907 {
3908 DEBUG(D_receive) debug_printf("rate limit MAIL: delay %.3g sec\n",
3909 smtp_delay_mail/1000.0);
3910 millisleep((int)smtp_delay_mail);
3911 smtp_delay_mail *= smtp_rlm_factor;
3912 if (smtp_delay_mail > (double)smtp_rlm_limit)
3913 smtp_delay_mail = (double)smtp_rlm_limit;
3914 }
3915
3916 /* Now extract the address, first applying any SMTP-time rewriting. The
3917 TRUE flag allows "<>" as a sender address. */
3918
3919 raw_sender = ((rewrite_existflags & rewrite_smtp) != 0)?
3920 rewrite_one(smtp_cmd_data, rewrite_smtp, NULL, FALSE, US"",
3921 global_rewrite_rules) : smtp_cmd_data;
3922
3923 /* rfc821_domains = TRUE; << no longer needed */
3924 raw_sender =
3925 parse_extract_address(raw_sender, &errmess, &start, &end, &sender_domain,
3926 TRUE);
3927 /* rfc821_domains = FALSE; << no longer needed */
3928
3929 if (raw_sender == NULL)
3930 {
3931 done = synprot_error(L_smtp_syntax_error, 501, smtp_cmd_data, errmess);
3932 break;
3933 }
3934
3935 sender_address = raw_sender;
3936
3937 /* If there is a configured size limit for mail, check that this message
3938 doesn't exceed it. The check is postponed to this point so that the sender
3939 can be logged. */
3940
3941 if (thismessage_size_limit > 0 && message_size > thismessage_size_limit)
3942 {
3943 smtp_printf("552 Message size exceeds maximum permitted\r\n");
3944 log_write(L_size_reject,
3945 LOG_MAIN|LOG_REJECT, "rejected MAIL FROM:<%s> %s: "
3946 "message too big: size%s=%d max=%d",
3947 sender_address,
3948 host_and_ident(TRUE),
3949 (message_size == INT_MAX)? ">" : "",
3950 message_size,
3951 thismessage_size_limit);
3952 sender_address = NULL;
3953 break;
3954 }
3955
3956 /* Check there is enough space on the disk unless configured not to.
3957 When smtp_check_spool_space is set, the check is for thismessage_size_limit
3958 plus the current message - i.e. we accept the message only if it won't
3959 reduce the space below the threshold. Add 5000 to the size to allow for
3960 overheads such as the Received: line and storing of recipients, etc.
3961 By putting the check here, even when SIZE is not given, it allow VRFY
3962 and EXPN etc. to be used when space is short. */
3963
3964 if (!receive_check_fs(
3965 (smtp_check_spool_space && message_size >= 0)?
3966 message_size + 5000 : 0))
3967 {
3968 smtp_printf("452 Space shortage, please try later\r\n");
3969 sender_address = NULL;
3970 break;
3971 }
3972
3973 /* If sender_address is unqualified, reject it, unless this is a locally
3974 generated message, or the sending host or net is permitted to send
3975 unqualified addresses - typically local machines behaving as MUAs -
3976 in which case just qualify the address. The flag is set above at the start
3977 of the SMTP connection. */
3978
3979 if (sender_domain == 0 && sender_address[0] != 0)
3980 {
3981 if (allow_unqualified_sender)
3982 {
3983 sender_domain = Ustrlen(sender_address) + 1;
3984 sender_address = rewrite_address_qualify(sender_address, FALSE);
3985 DEBUG(D_receive) debug_printf("unqualified address %s accepted\n",
3986 raw_sender);
3987 }
3988 else
3989 {
3990 smtp_printf("501 %s: sender address must contain a domain\r\n",
3991 smtp_cmd_data);
3992 log_write(L_smtp_syntax_error,
3993 LOG_MAIN|LOG_REJECT,
3994 "unqualified sender rejected: <%s> %s%s",
3995 raw_sender,
3996 host_and_ident(TRUE),
3997 host_lookup_msg);
3998 sender_address = NULL;
3999 break;
4000 }
4001 }
4002
4003 /* Apply an ACL check if one is defined, before responding. Afterwards,
4004 when pipelining is not advertised, do another sync check in case the ACL
4005 delayed and the client started sending in the meantime. */
4006
4007 if (acl_smtp_mail)
4008 {
4009 rc = acl_check(ACL_WHERE_MAIL, NULL, acl_smtp_mail, &user_msg, &log_msg);
4010 if (rc == OK && !pipelining_advertised && !check_sync())
4011 goto SYNC_FAILURE;
4012 }
4013 else
4014 rc = OK;
4015
4016 if (rc == OK || rc == DISCARD)
4017 {
4018 if (!user_msg)
4019 smtp_printf("%s%s%s", US"250 OK",
4020 #ifndef DISABLE_PRDR
4021 prdr_requested ? US", PRDR Requested" : US"",
4022 #else
4023 US"",
4024 #endif
4025 US"\r\n");
4026 else
4027 {
4028 #ifndef DISABLE_PRDR
4029 if (prdr_requested)
4030 user_msg = string_sprintf("%s%s", user_msg, US", PRDR Requested");
4031 #endif
4032 smtp_user_msg(US"250", user_msg);
4033 }
4034 smtp_delay_rcpt = smtp_rlr_base;
4035 recipients_discarded = (rc == DISCARD);
4036 was_rej_mail = FALSE;
4037 }
4038 else
4039 {
4040 done = smtp_handle_acl_fail(ACL_WHERE_MAIL, rc, user_msg, log_msg);
4041 sender_address = NULL;
4042 }
4043 break;
4044
4045
4046 /* The RCPT command requires an address as an operand. There may be any
4047 number of RCPT commands, specifying multiple recipients. We build them all
4048 into a data structure. The start/end values given by parse_extract_address
4049 are not used, as we keep only the extracted address. */
4050
4051 case RCPT_CMD:
4052 HAD(SCH_RCPT);
4053 rcpt_count++;
4054 was_rcpt = rcpt_in_progress = TRUE;
4055
4056 /* There must be a sender address; if the sender was rejected and
4057 pipelining was advertised, we assume the client was pipelining, and do not
4058 count this as a protocol error. Reset was_rej_mail so that further RCPTs
4059 get the same treatment. */
4060
4061 if (sender_address == NULL)
4062 {
4063 if (pipelining_advertised && last_was_rej_mail)
4064 {
4065 smtp_printf("503 sender not yet given\r\n");
4066 was_rej_mail = TRUE;
4067 }
4068 else
4069 {
4070 done = synprot_error(L_smtp_protocol_error, 503, NULL,
4071 US"sender not yet given");
4072 was_rcpt = FALSE; /* Not a valid RCPT */
4073 }
4074 rcpt_fail_count++;
4075 break;
4076 }
4077
4078 /* Check for an operand */
4079
4080 if (smtp_cmd_data[0] == 0)