1555838acecda3c5abbebea7d232af4691f1a2cf
[exim.git] / src / src / verify.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions concerned with verifying things. The original code for callout
9 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
10
11
12 #include "exim.h"
13 #include "transports/smtp.h"
14
15 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
17 static smtp_outblock ctblock;
18 uschar ctbuffer[8192];
19
20
21 /* Structure for caching DNSBL lookups */
22
23 typedef struct dnsbl_cache_block {
24 time_t expiry;
25 dns_address *rhs;
26 uschar *text;
27 int rc;
28 BOOL text_set;
29 } dnsbl_cache_block;
30
31
32 /* Anchor for DNSBL cache */
33
34 static tree_node *dnsbl_cache = NULL;
35
36
37 /* Bits for match_type in one_check_dnsbl() */
38
39 #define MT_NOT 1
40 #define MT_ALL 2
41
42 static uschar cutthrough_response(int, char, uschar **, int);
43
44
45
46 /*************************************************
47 * Retrieve a callout cache record *
48 *************************************************/
49
50 /* If a record exists, check whether it has expired.
51
52 Arguments:
53 dbm_file an open hints file
54 key the record key
55 type "address" or "domain"
56 positive_expire expire time for positive records
57 negative_expire expire time for negative records
58
59 Returns: the cache record if a non-expired one exists, else NULL
60 */
61
62 static dbdata_callout_cache *
63 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
64 int positive_expire, int negative_expire)
65 {
66 BOOL negative;
67 int length, expire;
68 time_t now;
69 dbdata_callout_cache *cache_record;
70
71 if (!(cache_record = dbfn_read_with_length(dbm_file, key, &length)))
72 {
73 HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
74 return NULL;
75 }
76
77 /* We treat a record as "negative" if its result field is not positive, or if
78 it is a domain record and the postmaster field is negative. */
79
80 negative = cache_record->result != ccache_accept ||
81 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
82 expire = negative? negative_expire : positive_expire;
83 now = time(NULL);
84
85 if (now - cache_record->time_stamp > expire)
86 {
87 HDEBUG(D_verify) debug_printf("callout cache: %s record expired for %s\n", type, key);
88 return NULL;
89 }
90
91 /* If this is a non-reject domain record, check for the obsolete format version
92 that doesn't have the postmaster and random timestamps, by looking at the
93 length. If so, copy it to a new-style block, replicating the record's
94 timestamp. Then check the additional timestamps. (There's no point wasting
95 effort if connections are rejected.) */
96
97 if (type[0] == 'd' && cache_record->result != ccache_reject)
98 {
99 if (length == sizeof(dbdata_callout_cache_obs))
100 {
101 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
102 memcpy(new, cache_record, length);
103 new->postmaster_stamp = new->random_stamp = new->time_stamp;
104 cache_record = new;
105 }
106
107 if (now - cache_record->postmaster_stamp > expire)
108 cache_record->postmaster_result = ccache_unknown;
109
110 if (now - cache_record->random_stamp > expire)
111 cache_record->random_result = ccache_unknown;
112 }
113
114 HDEBUG(D_verify) debug_printf("callout cache: found %s record for %s\n", type, key);
115 return cache_record;
116 }
117
118
119
120 /* Check the callout cache.
121 Options * pm_mailfrom may be modified by cache partial results.
122
123 Return: TRUE if result found
124 */
125
126 static BOOL
127 cached_callout_lookup(address_item * addr, uschar * address_key,
128 uschar * from_address, int * opt_ptr, uschar ** pm_ptr,
129 int * yield, uschar ** failure_ptr,
130 dbdata_callout_cache * new_domain_record, int * old_domain_res)
131 {
132 int options = *opt_ptr;
133 open_db dbblock;
134 open_db *dbm_file = NULL;
135
136 /* Open the callout cache database, it it exists, for reading only at this
137 stage, unless caching has been disabled. */
138
139 if (options & vopt_callout_no_cache)
140 {
141 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
142 }
143 else if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)))
144 {
145 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
146 }
147 else
148 {
149 /* If a cache database is available see if we can avoid the need to do an
150 actual callout by making use of previously-obtained data. */
151
152 dbdata_callout_cache_address * cache_address_record;
153 dbdata_callout_cache * cache_record = get_callout_cache_record(dbm_file,
154 addr->domain, US"domain",
155 callout_cache_domain_positive_expire, callout_cache_domain_negative_expire);
156
157 /* If an unexpired cache record was found for this domain, see if the callout
158 process can be short-circuited. */
159
160 if (cache_record)
161 {
162 /* In most cases, if an early command (up to and including MAIL FROM:<>)
163 was rejected, there is no point carrying on. The callout fails. However, if
164 we are doing a recipient verification with use_sender or use_postmaster
165 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
166 will be using a non-empty sender. We have to remember this situation so as
167 not to disturb the cached domain value if this whole verification succeeds
168 (we don't want it turning into "accept"). */
169
170 *old_domain_res = cache_record->result;
171
172 if ( cache_record->result == ccache_reject
173 || *from_address == 0 && cache_record->result == ccache_reject_mfnull)
174 {
175 setflag(addr, af_verify_nsfail);
176 HDEBUG(D_verify)
177 debug_printf("callout cache: domain gave initial rejection, or "
178 "does not accept HELO or MAIL FROM:<>\n");
179 setflag(addr, af_verify_nsfail);
180 addr->user_message = US"(result of an earlier callout reused).";
181 *yield = FAIL;
182 *failure_ptr = US"mail";
183 dbfn_close(dbm_file);
184 return TRUE;
185 }
186
187 /* If a previous check on a "random" local part was accepted, we assume
188 that the server does not do any checking on local parts. There is therefore
189 no point in doing the callout, because it will always be successful. If a
190 random check previously failed, arrange not to do it again, but preserve
191 the data in the new record. If a random check is required but hasn't been
192 done, skip the remaining cache processing. */
193
194 if (options & vopt_callout_random) switch(cache_record->random_result)
195 {
196 case ccache_accept:
197 HDEBUG(D_verify)
198 debug_printf("callout cache: domain accepts random addresses\n");
199 dbfn_close(dbm_file);
200 return TRUE; /* Default yield is OK */
201
202 case ccache_reject:
203 HDEBUG(D_verify)
204 debug_printf("callout cache: domain rejects random addresses\n");
205 *opt_ptr = options & ~vopt_callout_random;
206 new_domain_record->random_result = ccache_reject;
207 new_domain_record->random_stamp = cache_record->random_stamp;
208 break;
209
210 default:
211 HDEBUG(D_verify)
212 debug_printf("callout cache: need to check random address handling "
213 "(not cached or cache expired)\n");
214 dbfn_close(dbm_file);
215 return FALSE;
216 }
217
218 /* If a postmaster check is requested, but there was a previous failure,
219 there is again no point in carrying on. If a postmaster check is required,
220 but has not been done before, we are going to have to do a callout, so skip
221 remaining cache processing. */
222
223 if (*pm_ptr)
224 {
225 if (cache_record->postmaster_result == ccache_reject)
226 {
227 setflag(addr, af_verify_pmfail);
228 HDEBUG(D_verify)
229 debug_printf("callout cache: domain does not accept "
230 "RCPT TO:<postmaster@domain>\n");
231 *yield = FAIL;
232 *failure_ptr = US"postmaster";
233 setflag(addr, af_verify_pmfail);
234 addr->user_message = US"(result of earlier verification reused).";
235 dbfn_close(dbm_file);
236 return TRUE;
237 }
238 if (cache_record->postmaster_result == ccache_unknown)
239 {
240 HDEBUG(D_verify)
241 debug_printf("callout cache: need to check RCPT "
242 "TO:<postmaster@domain> (not cached or cache expired)\n");
243 dbfn_close(dbm_file);
244 return FALSE;
245 }
246
247 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
248 postmaster check if the address itself has to be checked. Also ensure
249 that the value in the cache record is preserved (with its old timestamp).
250 */
251
252 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
253 "TO:<postmaster@domain>\n");
254 *pm_ptr = NULL;
255 new_domain_record->postmaster_result = ccache_accept;
256 new_domain_record->postmaster_stamp = cache_record->postmaster_stamp;
257 }
258 }
259
260 /* We can't give a result based on information about the domain. See if there
261 is an unexpired cache record for this specific address (combined with the
262 sender address if we are doing a recipient callout with a non-empty sender).
263 */
264
265 if (!(cache_address_record = (dbdata_callout_cache_address *)
266 get_callout_cache_record(dbm_file, address_key, US"address",
267 callout_cache_positive_expire, callout_cache_negative_expire)))
268 {
269 dbfn_close(dbm_file);
270 return FALSE;
271 }
272
273 if (cache_address_record->result == ccache_accept)
274 {
275 HDEBUG(D_verify)
276 debug_printf("callout cache: address record is positive\n");
277 }
278 else
279 {
280 HDEBUG(D_verify)
281 debug_printf("callout cache: address record is negative\n");
282 addr->user_message = US"Previous (cached) callout verification failure";
283 *failure_ptr = US"recipient";
284 *yield = FAIL;
285 }
286
287 /* Close the cache database while we actually do the callout for real. */
288
289 dbfn_close(dbm_file);
290 return TRUE;
291 }
292 return FALSE;
293 }
294
295
296 /* Write results to callout cache
297 */
298 static void
299 cache_callout_write(dbdata_callout_cache * dom_rec, const uschar * domain,
300 int done, dbdata_callout_cache_address * addr_rec, uschar * address_key)
301 {
302 open_db dbblock;
303 open_db *dbm_file = NULL;
304
305 /* If we get here with done == TRUE, a successful callout happened, and yield
306 will be set OK or FAIL according to the response to the RCPT command.
307 Otherwise, we looped through the hosts but couldn't complete the business.
308 However, there may be domain-specific information to cache in both cases.
309
310 The value of the result field in the new_domain record is ccache_unknown if
311 there was an error before or with MAIL FROM:, and errno was not zero,
312 implying some kind of I/O error. We don't want to write the cache in that case.
313 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
314
315 if (dom_rec->result != ccache_unknown)
316 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE)))
317 {
318 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
319 }
320 else
321 {
322 (void)dbfn_write(dbm_file, domain, dom_rec,
323 (int)sizeof(dbdata_callout_cache));
324 HDEBUG(D_verify) debug_printf("wrote callout cache domain record for %s:\n"
325 " result=%d postmaster=%d random=%d\n",
326 domain,
327 dom_rec->result,
328 dom_rec->postmaster_result,
329 dom_rec->random_result);
330 }
331
332 /* If a definite result was obtained for the callout, cache it unless caching
333 is disabled. */
334
335 if (done && addr_rec->result != ccache_unknown)
336 {
337 if (!dbm_file)
338 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
339 if (!dbm_file)
340 {
341 HDEBUG(D_verify) debug_printf("no callout cache available\n");
342 }
343 else
344 {
345 (void)dbfn_write(dbm_file, address_key, addr_rec,
346 (int)sizeof(dbdata_callout_cache_address));
347 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record for %s\n",
348 addr_rec->result == ccache_accept ? "positive" : "negative",
349 address_key);
350 }
351 }
352
353 if (dbm_file) dbfn_close(dbm_file);
354 }
355
356
357 /* Cutthrough-multi. If the existing cached cutthrough connection matches
358 the one we would make for a subsequent recipient, use it. Send the RCPT TO
359 and check the result, nonpipelined as it may be wanted immediately for
360 recipient-verification.
361
362 It seems simpler to deal with this case separately from the main callout loop.
363 We will need to remember it has sent, or not, so that rcpt-acl tail code
364 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
365
366 Return: TRUE for a definitive result for the recipient
367 */
368 static int
369 cutthrough_multi(address_item * addr, host_item * host_list,
370 transport_feedback * tf, int * yield)
371 {
372 BOOL done = FALSE;
373 host_item * host;
374
375 if (addr->transport == cutthrough.addr.transport)
376 for (host = host_list; host; host = host->next)
377 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
378 {
379 int host_af;
380 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
381 int port = 25;
382
383 deliver_host = host->name;
384 deliver_host_address = host->address;
385 deliver_host_port = host->port;
386 deliver_domain = addr->domain;
387 transport_name = addr->transport->name;
388
389 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
390
391 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
392 US"callout")
393 || !smtp_get_port(tf->port, addr, &port, US"callout")
394 )
395 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
396 addr->message);
397
398 smtp_port_for_connect(host, port);
399
400 if ( ( interface == cutthrough.interface
401 || ( interface
402 && cutthrough.interface
403 && Ustrcmp(interface, cutthrough.interface) == 0
404 ) )
405 && host->port == cutthrough.host.port
406 )
407 {
408 uschar * resp = NULL;
409
410 /* Match! Send the RCPT TO, set done from the response */
411 done =
412 smtp_write_command(&ctblock, SCMD_FLUSH, "RCPT TO:<%.1000s>\r\n",
413 transport_rcpt_address(addr,
414 addr->transport->rcpt_include_affixes)) >= 0 &&
415 cutthrough_response(cutthrough.fd, '2', &resp, CUTTHROUGH_DATA_TIMEOUT) == '2';
416
417 /* This would go horribly wrong if a callout fail was ignored by ACL.
418 We punt by abandoning cutthrough on a reject, like the
419 first-rcpt does. */
420
421 if (done)
422 {
423 address_item * na = store_get(sizeof(address_item));
424 *na = cutthrough.addr;
425 cutthrough.addr = *addr;
426 cutthrough.addr.host_used = &cutthrough.host;
427 cutthrough.addr.next = na;
428
429 cutthrough.nrcpt++;
430 }
431 else
432 {
433 cancel_cutthrough_connection(TRUE, US"recipient rejected");
434 if (!resp || errno == ETIMEDOUT)
435 {
436 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
437 }
438 else if (errno == 0)
439 {
440 if (*resp == 0)
441 Ustrcpy(resp, US"connection dropped");
442
443 addr->message =
444 string_sprintf("response to \"%s\" was: %s",
445 big_buffer, string_printing(resp));
446
447 addr->user_message =
448 string_sprintf("Callout verification failed:\n%s", resp);
449
450 /* Hard rejection ends the process */
451
452 if (resp[0] == '5') /* Address rejected */
453 {
454 *yield = FAIL;
455 done = TRUE;
456 }
457 }
458 }
459 }
460 break; /* host_list */
461 }
462 if (!done)
463 cancel_cutthrough_connection(TRUE, US"incompatible connection");
464 return done;
465 }
466
467
468 /*************************************************
469 * Do callout verification for an address *
470 *************************************************/
471
472 /* This function is called from verify_address() when the address has routed to
473 a host list, and a callout has been requested. Callouts are expensive; that is
474 why a cache is used to improve the efficiency.
475
476 Arguments:
477 addr the address that's been routed
478 host_list the list of hosts to try
479 tf the transport feedback block
480
481 ifstring "interface" option from transport, or NULL
482 portstring "port" option from transport, or NULL
483 protocolstring "protocol" option from transport, or NULL
484 callout the per-command callout timeout
485 callout_overall the overall callout timeout (if < 0 use 4*callout)
486 callout_connect the callout connection timeout (if < 0 use callout)
487 options the verification options - these bits are used:
488 vopt_is_recipient => this is a recipient address
489 vopt_callout_no_cache => don't use callout cache
490 vopt_callout_fullpm => if postmaster check, do full one
491 vopt_callout_random => do the "random" thing
492 vopt_callout_recipsender => use real sender for recipient
493 vopt_callout_recippmaster => use postmaster for recipient
494 vopt_callout_hold => lazy close connection
495 se_mailfrom MAIL FROM address for sender verify; NULL => ""
496 pm_mailfrom if non-NULL, do the postmaster check with this sender
497
498 Returns: OK/FAIL/DEFER
499 */
500
501 static int
502 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
503 int callout, int callout_overall, int callout_connect, int options,
504 uschar *se_mailfrom, uschar *pm_mailfrom)
505 {
506 int yield = OK;
507 int old_domain_cache_result = ccache_accept;
508 BOOL done = FALSE;
509 uschar *address_key;
510 uschar *from_address;
511 uschar *random_local_part = NULL;
512 const uschar *save_deliver_domain = deliver_domain;
513 uschar **failure_ptr = options & vopt_is_recipient
514 ? &recipient_verify_failure : &sender_verify_failure;
515 dbdata_callout_cache new_domain_record;
516 dbdata_callout_cache_address new_address_record;
517 time_t callout_start_time;
518
519 new_domain_record.result = ccache_unknown;
520 new_domain_record.postmaster_result = ccache_unknown;
521 new_domain_record.random_result = ccache_unknown;
522
523 memset(&new_address_record, 0, sizeof(new_address_record));
524
525 /* For a recipient callout, the key used for the address cache record must
526 include the sender address if we are using the real sender in the callout,
527 because that may influence the result of the callout. */
528
529 if (options & vopt_is_recipient)
530 if (options & vopt_callout_recipsender)
531 {
532 from_address = sender_address;
533 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
534 if (cutthrough.delivery) options |= vopt_callout_no_cache;
535 }
536 else if (options & vopt_callout_recippmaster)
537 {
538 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
539 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
540 qualify_domain_sender);
541 }
542 else
543 {
544 from_address = US"";
545 address_key = addr->address;
546 }
547
548 /* For a sender callout, we must adjust the key if the mailfrom address is not
549 empty. */
550
551 else
552 {
553 from_address = se_mailfrom ? se_mailfrom : US"";
554 address_key = *from_address
555 ? string_sprintf("%s/<%s>", addr->address, from_address) : addr->address;
556 }
557
558 if (cached_callout_lookup(addr, address_key, from_address,
559 &options, &pm_mailfrom, &yield, failure_ptr,
560 &new_domain_record, &old_domain_cache_result))
561 {
562 cancel_cutthrough_connection(TRUE, US"cache-hit");
563 goto END_CALLOUT;
564 }
565
566 if (!addr->transport)
567 {
568 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
569 }
570 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
571 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
572 addr->transport->name, addr->transport->driver_name);
573 else
574 {
575 smtp_transport_options_block *ob =
576 (smtp_transport_options_block *)addr->transport->options_block;
577 host_item * host;
578
579 /* The information wasn't available in the cache, so we have to do a real
580 callout and save the result in the cache for next time, unless no_cache is set,
581 or unless we have a previously cached negative random result. If we are to test
582 with a random local part, ensure that such a local part is available. If not,
583 log the fact, but carry on without randomising. */
584
585 if (options & vopt_callout_random && callout_random_local_part)
586 if (!(random_local_part = expand_string(callout_random_local_part)))
587 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
588 "callout_random_local_part: %s", expand_string_message);
589
590 /* Default the connect and overall callout timeouts if not set, and record the
591 time we are starting so that we can enforce it. */
592
593 if (callout_overall < 0) callout_overall = 4 * callout;
594 if (callout_connect < 0) callout_connect = callout;
595 callout_start_time = time(NULL);
596
597 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
598 output because a callout might take some time. When PIPELINING is active and
599 there are many recipients, the total time for doing lots of callouts can add up
600 and cause the client to time out. So in this case we forgo the PIPELINING
601 optimization. */
602
603 if (smtp_out && !disable_callout_flush) mac_smtp_fflush();
604
605 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
606 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
607
608 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
609 and we are holding a cutthrough conn open, we can just append the rcpt to
610 that conn for verification purposes (and later delivery also). Simplest
611 coding means skipping this whole loop and doing the append separately. */
612
613 /* Can we re-use an open cutthrough connection? */
614 if ( cutthrough.fd >= 0
615 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
616 == vopt_callout_recipsender
617 && !random_local_part
618 && !pm_mailfrom
619 )
620 done = cutthrough_multi(addr, host_list, tf, &yield);
621
622 /* If we did not use a cached connection, make connections to the hosts
623 and do real callouts. The list of hosts is passed in as an argument. */
624
625 for (host = host_list; host && !done; host = host->next)
626 {
627 int host_af;
628 int port = 25;
629 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
630 smtp_context sx;
631
632 if (!host->address)
633 {
634 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
635 host->name);
636 continue;
637 }
638
639 /* Check the overall callout timeout */
640
641 if (time(NULL) - callout_start_time >= callout_overall)
642 {
643 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
644 break;
645 }
646
647 /* Set IPv4 or IPv6 */
648
649 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
650
651 /* Expand and interpret the interface and port strings. The latter will not
652 be used if there is a host-specific port (e.g. from a manualroute router).
653 This has to be delayed till now, because they may expand differently for
654 different hosts. If there's a failure, log it, but carry on with the
655 defaults. */
656
657 deliver_host = host->name;
658 deliver_host_address = host->address;
659 deliver_host_port = host->port;
660 deliver_domain = addr->domain;
661 transport_name = addr->transport->name;
662
663 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
664 US"callout")
665 || !smtp_get_port(tf->port, addr, &port, US"callout")
666 )
667 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
668 addr->message);
669
670 sx.addrlist = addr;
671 sx.host = host;
672 sx.host_af = host_af,
673 sx.port = port;
674 sx.interface = interface;
675 sx.helo_data = tf->helo_data;
676 sx.tblock = addr->transport;
677 sx.verify = TRUE;
678
679 tls_retry_connection:
680 /* Set the address state so that errors are recorded in it */
681
682 addr->transport_return = PENDING_DEFER;
683 ob->connect_timeout = callout_connect;
684 ob->command_timeout = callout;
685
686 /* Get the channel set up ready for a message (MAIL FROM being the next
687 SMTP command to send. If we tried TLS but it failed, try again without
688 if permitted */
689
690 yield = smtp_setup_conn(&sx, FALSE);
691 #ifdef SUPPORT_TLS
692 if ( yield == DEFER
693 && addr->basic_errno == ERRNO_TLSFAILURE
694 && ob->tls_tempfail_tryclear
695 && verify_check_given_host(&ob->hosts_require_tls, host) != OK
696 )
697 {
698 log_write(0, LOG_MAIN,
699 "%s: callout unencrypted to %s [%s] (not in hosts_require_tls)",
700 addr->message, host->name, host->address);
701 addr->transport_return = PENDING_DEFER;
702 yield = smtp_setup_conn(&sx, TRUE);
703 }
704 #endif
705 if (yield != OK)
706 {
707 errno = addr->basic_errno;
708 transport_name = NULL;
709 deliver_host = deliver_host_address = NULL;
710 deliver_domain = save_deliver_domain;
711
712 /* Failure to accept HELO is cached; this blocks the whole domain for all
713 senders. I/O errors and defer responses are not cached. */
714
715 if (yield == FAIL && (errno == 0 || errno == ERRNO_SMTPCLOSED))
716 {
717 setflag(addr, af_verify_nsfail);
718 new_domain_record.result = ccache_reject;
719 done = TRUE;
720 }
721 else
722 done = FALSE;
723 goto no_conn;
724 }
725
726 /* If we needed to authenticate, smtp_setup_conn() did that. Copy
727 the AUTH info for logging */
728
729 addr->authenticator = client_authenticator;
730 addr->auth_id = client_authenticated_id;
731
732 sx.from_addr = from_address;
733 sx.first_addr = sx.sync_addr = addr;
734 sx.ok = FALSE; /*XXX these 3 last might not be needed for verify? */
735 sx.send_rset = TRUE;
736 sx.completed_addr = FALSE;
737
738 new_domain_record.result = old_domain_cache_result == ccache_reject_mfnull
739 ? ccache_reject_mfnull : ccache_accept;
740
741 /* Do the random local part check first. Temporarily replace the recipient
742 with the "random" value */
743
744 if (random_local_part)
745 {
746 uschar * main_address = addr->address;
747 const uschar * rcpt_domain = addr->domain;
748
749 #ifdef SUPPORT_I18N
750 uschar * errstr = NULL;
751 if ( testflag(addr, af_utf8_downcvt)
752 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
753 &errstr), errstr)
754 )
755 {
756 addr->message = errstr;
757 errno = ERRNO_EXPANDFAIL;
758 setflag(addr, af_verify_nsfail);
759 done = FALSE;
760 rcpt_domain = US""; /*XXX errorhandling! */
761 }
762 #endif
763
764 /* This would be ok for 1st rcpt of a cutthrough (the case handled here;
765 subsequents are done in cutthrough_multi()), but no way to
766 handle a subsequent because of the RSET vaporising the MAIL FROM.
767 So refuse to support any. Most cutthrough use will not involve
768 random_local_part, so no loss. */
769 cancel_cutthrough_connection(TRUE, US"random-recipient");
770
771 addr->address = string_sprintf("%s@%.1000s",
772 random_local_part, rcpt_domain);
773 done = FALSE;
774
775 /* If accepted, we aren't going to do any further tests below.
776 Otherwise, cache a real negative response, and get back to the right
777 state to send RCPT. Unless there's some problem such as a dropped
778 connection, we expect to succeed, because the commands succeeded above.
779 However, some servers drop the connection after responding to an
780 invalid recipient, so on (any) error we drop and remake the connection.
781 XXX We don't care about that for postmaster_full. Should we?
782
783 XXX could we add another flag to the context, and have the common
784 code emit the RSET too? Even pipelined after the RCPT...
785 Then the main-verify call could use it if there's to be a subsequent
786 postmaster-verify.
787 The sync_responses() would need to be taught about it and we'd
788 need another return code filtering out to here.
789
790 Avoid using a SIZE option on the MAIL for all randon-rcpt checks.
791 */
792
793 sx.avoid_option = OPTION_SIZE;
794
795 /* Remember when we last did a random test */
796 new_domain_record.random_stamp = time(NULL);
797
798 if (smtp_write_mail_and_rcpt_cmds(&sx, &yield) == 0)
799 switch(addr->transport_return)
800 {
801 case PENDING_OK: /* random was accepted, unfortunately */
802 new_domain_record.random_result = ccache_accept;
803 yield = OK; /* Only usable verify result we can return */
804 done = TRUE;
805 goto no_conn;
806 case FAIL: /* rejected: the preferred result */
807 new_domain_record.random_result = ccache_reject;
808 sx.avoid_option = 0;
809
810 /* Between each check, issue RSET, because some servers accept only
811 one recipient after MAIL FROM:<>.
812 XXX We don't care about that for postmaster_full. Should we? */
813
814 if ((done =
815 smtp_write_command(&sx.outblock, SCMD_FLUSH, "RSET\r\n") >= 0 &&
816 smtp_read_response(&sx.inblock, sx.buffer, sizeof(sx.buffer),
817 '2', callout)))
818 break;
819
820 HDEBUG(D_acl|D_v)
821 debug_printf_indent("problem after random/rset/mfrom; reopen conn\n");
822 random_local_part = NULL;
823 #ifdef SUPPORT_TLS
824 tls_close(FALSE, TLS_SHUTDOWN_NOWAIT);
825 #endif
826 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
827 (void)close(sx.inblock.sock);
828 sx.inblock.sock = sx.outblock.sock = -1;
829 #ifndef DISABLE_EVENT
830 (void) event_raise(addr->transport->event_action,
831 US"tcp:close", NULL);
832 #endif
833 addr->address = main_address;
834 addr->transport_return = PENDING_DEFER;
835 sx.first_addr = sx.sync_addr = addr;
836 sx.ok = FALSE;
837 sx.send_rset = TRUE;
838 sx.completed_addr = FALSE;
839 goto tls_retry_connection;
840 case DEFER: /* 4xx response to random */
841 break; /* Just to be clear. ccache_unknown, !done. */
842 }
843
844 /* Re-setup for main verify, or for the error message when failing */
845 addr->address = main_address;
846 addr->transport_return = PENDING_DEFER;
847 sx.first_addr = sx.sync_addr = addr;
848 sx.ok = FALSE;
849 sx.send_rset = TRUE;
850 sx.completed_addr = FALSE;
851 }
852 else
853 done = TRUE;
854
855 /* Main verify. For rcpt-verify use SIZE if we know it and we're not cacheing;
856 for sndr-verify never use it. */
857
858 if (done)
859 {
860 if (!(options & vopt_is_recipient && options & vopt_callout_no_cache))
861 sx.avoid_option = OPTION_SIZE;
862
863 done = FALSE;
864 switch(smtp_write_mail_and_rcpt_cmds(&sx, &yield))
865 {
866 case 0: switch(addr->transport_return) /* ok so far */
867 {
868 case PENDING_OK: done = TRUE;
869 new_address_record.result = ccache_accept;
870 break;
871 case FAIL: done = TRUE;
872 yield = FAIL;
873 *failure_ptr = US"recipient";
874 new_address_record.result = ccache_reject;
875 break;
876 default: break;
877 }
878 break;
879
880 case -1: /* MAIL response error */
881 *failure_ptr = US"mail";
882 if (errno == 0 && sx.buffer[0] == '5')
883 {
884 setflag(addr, af_verify_nsfail);
885 if (from_address[0] == 0)
886 new_domain_record.result = ccache_reject_mfnull;
887 }
888 break;
889 /* non-MAIL read i/o error */
890 /* non-MAIL response timeout */
891 /* internal error; channel still usable */
892 default: break; /* transmit failed */
893 }
894 }
895
896 addr->auth_sndr = client_authenticated_sender;
897
898 deliver_host = deliver_host_address = NULL;
899 deliver_domain = save_deliver_domain;
900
901 /* Do postmaster check if requested; if a full check is required, we
902 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
903
904 if (done && pm_mailfrom)
905 {
906 /* Could possibly shift before main verify, just above, and be ok
907 for cutthrough. But no way to handle a subsequent rcpt, so just
908 refuse any */
909 cancel_cutthrough_connection(TRUE, US"postmaster verify");
910 HDEBUG(D_acl|D_v) debug_printf_indent("Cutthrough cancelled by presence of postmaster verify\n");
911
912 done = smtp_write_command(&sx.outblock, SCMD_FLUSH, "RSET\r\n") >= 0
913 && smtp_read_response(&sx.inblock, sx.buffer,
914 sizeof(sx.buffer), '2', callout);
915
916 if (done)
917 {
918 uschar * main_address = addr->address;
919
920 /*XXX oops, affixes */
921 addr->address = string_sprintf("postmaster@%.1000s", addr->domain);
922 addr->transport_return = PENDING_DEFER;
923
924 sx.from_addr = pm_mailfrom;
925 sx.first_addr = sx.sync_addr = addr;
926 sx.ok = FALSE;
927 sx.send_rset = TRUE;
928 sx.completed_addr = FALSE;
929 sx.avoid_option = OPTION_SIZE;
930
931 if( smtp_write_mail_and_rcpt_cmds(&sx, &yield) == 0
932 && addr->transport_return == PENDING_OK
933 )
934 done = TRUE;
935 else
936 done = (options & vopt_callout_fullpm) != 0
937 && smtp_write_command(&sx.outblock, SCMD_FLUSH,
938 "RCPT TO:<postmaster>\r\n") >= 0
939 && smtp_read_response(&sx.inblock, sx.buffer,
940 sizeof(sx.buffer), '2', callout);
941
942 /* Sort out the cache record */
943
944 new_domain_record.postmaster_stamp = time(NULL);
945
946 if (done)
947 new_domain_record.postmaster_result = ccache_accept;
948 else if (errno == 0 && sx.buffer[0] == '5')
949 {
950 *failure_ptr = US"postmaster";
951 setflag(addr, af_verify_pmfail);
952 new_domain_record.postmaster_result = ccache_reject;
953 }
954
955 addr->address = main_address;
956 }
957 }
958 /* For any failure of the main check, other than a negative response, we just
959 close the connection and carry on. We can identify a negative response by the
960 fact that errno is zero. For I/O errors it will be non-zero
961
962 Set up different error texts for logging and for sending back to the caller
963 as an SMTP response. Log in all cases, using a one-line format. For sender
964 callouts, give a full response to the caller, but for recipient callouts,
965 don't give the IP address because this may be an internal host whose identity
966 is not to be widely broadcast. */
967
968 no_conn:
969 switch(errno)
970 {
971 case ETIMEDOUT:
972 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
973 sx.send_quit = FALSE;
974 break;
975
976 #ifdef SUPPORT_I18N
977 case ERRNO_UTF8_FWD:
978 {
979 extern int acl_where; /* src/acl.c */
980 errno = 0;
981 addr->message = string_sprintf(
982 "response to \"EHLO\" did not include SMTPUTF8");
983 addr->user_message = acl_where == ACL_WHERE_RCPT
984 ? US"533 no support for internationalised mailbox name"
985 : US"550 mailbox unavailable";
986 yield = FAIL;
987 done = TRUE;
988 }
989 break;
990 #endif
991 case ECONNREFUSED:
992 sx.send_quit = FALSE;
993 break;
994
995 case 0:
996 if (*sx.buffer == 0) Ustrcpy(sx.buffer, US"connection dropped");
997
998 /*XXX test here is ugly; seem to have a split of responsibility for
999 building this message. Need to rationalise. Where is it done
1000 before here, and when not?
1001 Not == 5xx resp to MAIL on main-verify
1002 */
1003 if (!addr->message) addr->message =
1004 string_sprintf("response to \"%s\" was: %s",
1005 big_buffer, string_printing(sx.buffer));
1006
1007 addr->user_message = options & vopt_is_recipient
1008 ? string_sprintf("Callout verification failed:\n%s", sx.buffer)
1009 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1010 host->address, big_buffer, sx.buffer);
1011
1012 /* Hard rejection ends the process */
1013
1014 if (sx.buffer[0] == '5') /* Address rejected */
1015 {
1016 yield = FAIL;
1017 done = TRUE;
1018 }
1019 break;
1020 }
1021
1022 /* End the SMTP conversation and close the connection. */
1023
1024 /* Cutthrough - on a successful connect and recipient-verify with
1025 use-sender and we are 1st rcpt and have no cutthrough conn so far
1026 here is where we want to leave the conn open. Ditto for a lazy-close
1027 verify. */
1028
1029 if (cutthrough.delivery)
1030 {
1031 if (addr->transport->filter_command)
1032 {
1033 cutthrough.delivery= FALSE;
1034 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
1035 }
1036 if (ob->dkim.dkim_domain || ob->arc_sign)
1037 {
1038 cutthrough.delivery= FALSE;
1039 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM or ARC signing\n");
1040 }
1041 }
1042
1043 if ( (cutthrough.delivery || options & vopt_callout_hold)
1044 && rcpt_count == 1
1045 && done
1046 && yield == OK
1047 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1048 == vopt_callout_recipsender
1049 && !random_local_part
1050 && !pm_mailfrom
1051 && cutthrough.fd < 0
1052 && !sx.lmtp
1053 )
1054 {
1055 HDEBUG(D_acl|D_v) debug_printf_indent("holding verify callout open for %s\n",
1056 cutthrough.delivery
1057 ? "cutthrough delivery" : "potential further verifies and delivery");
1058
1059 cutthrough.callout_hold_only = !cutthrough.delivery;
1060 cutthrough.is_tls = tls_out.active >= 0;
1061 cutthrough.fd = sx.outblock.sock; /* We assume no buffer in use in the outblock */
1062 cutthrough.nrcpt = 1;
1063 cutthrough.transport = addr->transport->name;
1064 cutthrough.interface = interface;
1065 cutthrough.snd_port = sending_port;
1066 cutthrough.peer_options = smtp_peer_options;
1067 cutthrough.host = *host;
1068 {
1069 int oldpool = store_pool;
1070 store_pool = POOL_PERM;
1071 cutthrough.snd_ip = string_copy(sending_ip_address);
1072 cutthrough.host.name = string_copy(host->name);
1073 cutthrough.host.address = string_copy(host->address);
1074 store_pool = oldpool;
1075 }
1076 cutthrough.addr = *addr; /* Save the address_item for later logging */
1077 cutthrough.addr.next = NULL;
1078 cutthrough.addr.host_used = &cutthrough.host;
1079 if (addr->parent)
1080 *(cutthrough.addr.parent = store_get(sizeof(address_item))) =
1081 *addr->parent;
1082 ctblock.buffer = ctbuffer;
1083 ctblock.buffersize = sizeof(ctbuffer);
1084 ctblock.ptr = ctbuffer;
1085 /* ctblock.cmd_count = 0; ctblock.authenticating = FALSE; */
1086 ctblock.sock = cutthrough.fd;
1087 }
1088 else
1089 {
1090 /* Ensure no cutthrough on multiple verifies that were incompatible */
1091 if (options & vopt_callout_recipsender)
1092 cancel_cutthrough_connection(TRUE, US"not usable for cutthrough");
1093 if (sx.send_quit)
1094 {
1095 (void) smtp_write_command(&sx.outblock, SCMD_FLUSH, "QUIT\r\n");
1096
1097 /* Wait a short time for response, and discard it */
1098 smtp_read_response(&sx.inblock, sx.buffer, sizeof(sx.buffer),
1099 '2', 1);
1100 }
1101
1102 if (sx.inblock.sock >= 0)
1103 {
1104 #ifdef SUPPORT_TLS
1105 tls_close(FALSE, TLS_SHUTDOWN_NOWAIT);
1106 #endif
1107 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1108 (void)close(sx.inblock.sock);
1109 sx.inblock.sock = sx.outblock.sock = -1;
1110 #ifndef DISABLE_EVENT
1111 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
1112 #endif
1113 }
1114 }
1115
1116 if (!done || yield != OK)
1117 addr->message = string_sprintf("%s [%s] : %s", host->name, host->address,
1118 addr->message);
1119 } /* Loop through all hosts, while !done */
1120 }
1121
1122 /* If we get here with done == TRUE, a successful callout happened, and yield
1123 will be set OK or FAIL according to the response to the RCPT command.
1124 Otherwise, we looped through the hosts but couldn't complete the business.
1125 However, there may be domain-specific information to cache in both cases. */
1126
1127 if (!(options & vopt_callout_no_cache))
1128 cache_callout_write(&new_domain_record, addr->domain,
1129 done, &new_address_record, address_key);
1130
1131 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1132 temporary error. If there was only one host, and a response was received, leave
1133 it alone if supplying details. Otherwise, give a generic response. */
1134
1135 if (!done)
1136 {
1137 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
1138 options & vopt_is_recipient ? "recipient" : "sender");
1139 yield = DEFER;
1140
1141 addr->message = host_list->next || !addr->message
1142 ? dullmsg : string_sprintf("%s: %s", dullmsg, addr->message);
1143
1144 addr->user_message = smtp_return_error_details
1145 ? string_sprintf("%s for <%s>.\n"
1146 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1147 "they may be permanently unreachable from this server. In the latter case,\n%s",
1148 dullmsg, addr->address,
1149 options & vopt_is_recipient
1150 ? "the address will never be accepted."
1151 : "you need to change the address or create an MX record for its domain\n"
1152 "if it is supposed to be generally accessible from the Internet.\n"
1153 "Talk to your mail administrator for details.")
1154 : dullmsg;
1155
1156 /* Force a specific error code */
1157
1158 addr->basic_errno = ERRNO_CALLOUTDEFER;
1159 }
1160
1161 /* Come here from within the cache-reading code on fast-track exit. */
1162
1163 END_CALLOUT:
1164 tls_modify_variables(&tls_in);
1165 return yield;
1166 }
1167
1168
1169
1170 /* Called after recipient-acl to get a cutthrough connection open when
1171 one was requested and a recipient-verify wasn't subsequently done.
1172 */
1173 int
1174 open_cutthrough_connection( address_item * addr )
1175 {
1176 address_item addr2;
1177 int rc;
1178
1179 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1180 /* We must use a copy of the address for verification, because it might
1181 get rewritten. */
1182
1183 addr2 = *addr;
1184 HDEBUG(D_acl) debug_printf_indent("----------- %s cutthrough setup ------------\n",
1185 rcpt_count > 1 ? "more" : "start");
1186 rc = verify_address(&addr2, NULL,
1187 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1188 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1189 NULL, NULL, NULL);
1190 addr->message = addr2.message;
1191 addr->user_message = addr2.user_message;
1192 HDEBUG(D_acl) debug_printf_indent("----------- end cutthrough setup ------------\n");
1193 return rc;
1194 }
1195
1196
1197
1198 /* Send given number of bytes from the buffer */
1199 static BOOL
1200 cutthrough_send(int n)
1201 {
1202 if(cutthrough.fd < 0)
1203 return TRUE;
1204
1205 if(
1206 #ifdef SUPPORT_TLS
1207 tls_out.active == cutthrough.fd ? tls_write(FALSE, ctblock.buffer, n, FALSE) :
1208 #endif
1209 send(cutthrough.fd, ctblock.buffer, n, 0) > 0
1210 )
1211 {
1212 transport_count += n;
1213 ctblock.ptr= ctblock.buffer;
1214 return TRUE;
1215 }
1216
1217 HDEBUG(D_transport|D_acl) debug_printf_indent("cutthrough_send failed: %s\n", strerror(errno));
1218 return FALSE;
1219 }
1220
1221
1222
1223 static BOOL
1224 _cutthrough_puts(uschar * cp, int n)
1225 {
1226 while(n--)
1227 {
1228 if(ctblock.ptr >= ctblock.buffer+ctblock.buffersize)
1229 if(!cutthrough_send(ctblock.buffersize))
1230 return FALSE;
1231
1232 *ctblock.ptr++ = *cp++;
1233 }
1234 return TRUE;
1235 }
1236
1237 /* Buffered output of counted data block. Return boolean success */
1238 static BOOL
1239 cutthrough_puts(uschar * cp, int n)
1240 {
1241 if (cutthrough.fd < 0) return TRUE;
1242 if (_cutthrough_puts(cp, n)) return TRUE;
1243 cancel_cutthrough_connection(TRUE, US"transmit failed");
1244 return FALSE;
1245 }
1246
1247 void
1248 cutthrough_data_puts(uschar * cp, int n)
1249 {
1250 if (cutthrough.delivery) (void) cutthrough_puts(cp, n);
1251 return;
1252 }
1253
1254
1255 static BOOL
1256 _cutthrough_flush_send(void)
1257 {
1258 int n = ctblock.ptr - ctblock.buffer;
1259
1260 if(n>0)
1261 if(!cutthrough_send(n))
1262 return FALSE;
1263 return TRUE;
1264 }
1265
1266
1267 /* Send out any bufferred output. Return boolean success. */
1268 BOOL
1269 cutthrough_flush_send(void)
1270 {
1271 if (_cutthrough_flush_send()) return TRUE;
1272 cancel_cutthrough_connection(TRUE, US"transmit failed");
1273 return FALSE;
1274 }
1275
1276
1277 static BOOL
1278 cutthrough_put_nl(void)
1279 {
1280 return cutthrough_puts(US"\r\n", 2);
1281 }
1282
1283
1284 void
1285 cutthrough_data_put_nl(void)
1286 {
1287 cutthrough_data_puts(US"\r\n", 2);
1288 }
1289
1290
1291 /* Get and check response from cutthrough target */
1292 static uschar
1293 cutthrough_response(int fd, char expect, uschar ** copy, int timeout)
1294 {
1295 smtp_inblock inblock;
1296 uschar inbuffer[4096];
1297 uschar responsebuffer[4096];
1298
1299 inblock.buffer = inbuffer;
1300 inblock.buffersize = sizeof(inbuffer);
1301 inblock.ptr = inbuffer;
1302 inblock.ptrend = inbuffer;
1303 inblock.sock = fd;
1304 /* this relies on (inblock.sock == tls_out.active) */
1305 if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, timeout))
1306 cancel_cutthrough_connection(TRUE, US"target timeout on read");
1307
1308 if(copy)
1309 {
1310 uschar * cp;
1311 *copy = cp = string_copy(responsebuffer);
1312 /* Trim the trailing end of line */
1313 cp += Ustrlen(responsebuffer);
1314 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1315 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1316 }
1317
1318 return responsebuffer[0];
1319 }
1320
1321
1322 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1323 BOOL
1324 cutthrough_predata(void)
1325 {
1326 if(cutthrough.fd < 0 || cutthrough.callout_hold_only)
1327 return FALSE;
1328
1329 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> DATA\n");
1330 cutthrough_puts(US"DATA\r\n", 6);
1331 cutthrough_flush_send();
1332
1333 /* Assume nothing buffered. If it was it gets ignored. */
1334 return cutthrough_response(cutthrough.fd, '3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
1335 }
1336
1337
1338 /* tctx arg only to match write_chunk() */
1339 static BOOL
1340 cutthrough_write_chunk(transport_ctx * tctx, uschar * s, int len)
1341 {
1342 uschar * s2;
1343 while(s && (s2 = Ustrchr(s, '\n')))
1344 {
1345 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1346 return FALSE;
1347 s = s2+1;
1348 }
1349 return TRUE;
1350 }
1351
1352
1353 /* Buffered send of headers. Return success boolean. */
1354 /* Expands newlines to wire format (CR,NL). */
1355 /* Also sends header-terminating blank line. */
1356 BOOL
1357 cutthrough_headers_send(void)
1358 {
1359 transport_ctx tctx;
1360
1361 if(cutthrough.fd < 0 || cutthrough.callout_hold_only)
1362 return FALSE;
1363
1364 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1365 but having a separate buffered-output function (for now)
1366 */
1367 HDEBUG(D_acl) debug_printf_indent("----------- start cutthrough headers send -----------\n");
1368
1369 tctx.u.fd = cutthrough.fd;
1370 tctx.tblock = cutthrough.addr.transport;
1371 tctx.addr = &cutthrough.addr;
1372 tctx.check_string = US".";
1373 tctx.escape_string = US"..";
1374 /*XXX check under spool_files_wireformat. Might be irrelevant */
1375 tctx.options = topt_use_crlf;
1376
1377 if (!transport_headers_send(&tctx, &cutthrough_write_chunk))
1378 return FALSE;
1379
1380 HDEBUG(D_acl) debug_printf_indent("----------- done cutthrough headers send ------------\n");
1381 return TRUE;
1382 }
1383
1384
1385 static void
1386 close_cutthrough_connection(const uschar * why)
1387 {
1388 int fd = cutthrough.fd;
1389 if(fd >= 0)
1390 {
1391 /* We could be sending this after a bunch of data, but that is ok as
1392 the only way to cancel the transfer in dataphase is to drop the tcp
1393 conn before the final dot.
1394 */
1395 ctblock.ptr = ctbuffer;
1396 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> QUIT\n");
1397 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1398 _cutthrough_flush_send();
1399 cutthrough.fd = -1; /* avoid recursion via read timeout */
1400 cutthrough.nrcpt = 0; /* permit re-cutthrough on subsequent message */
1401
1402 /* Wait a short time for response, and discard it */
1403 cutthrough_response(fd, '2', NULL, 1);
1404
1405 #ifdef SUPPORT_TLS
1406 tls_close(FALSE, TLS_SHUTDOWN_NOWAIT);
1407 #endif
1408 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1409 (void)close(fd);
1410 HDEBUG(D_acl) debug_printf_indent("----------- cutthrough shutdown (%s) ------------\n", why);
1411 }
1412 ctblock.ptr = ctbuffer;
1413 }
1414
1415 void
1416 cancel_cutthrough_connection(BOOL close_noncutthrough_verifies, const uschar * why)
1417 {
1418 if (cutthrough.delivery || close_noncutthrough_verifies)
1419 close_cutthrough_connection(why);
1420 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1421 }
1422
1423
1424 void
1425 release_cutthrough_connection(const uschar * why)
1426 {
1427 if (cutthrough.fd < 0) return;
1428 HDEBUG(D_acl) debug_printf_indent("release cutthrough conn: %s\n", why);
1429 cutthrough.fd = -1;
1430 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1431 }
1432
1433
1434
1435
1436 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1437 Log an OK response as a transmission.
1438 Close the connection.
1439 Return smtp response-class digit.
1440 */
1441 uschar *
1442 cutthrough_finaldot(void)
1443 {
1444 uschar res;
1445 address_item * addr;
1446 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> .\n");
1447
1448 /* Assume data finshed with new-line */
1449 if( !cutthrough_puts(US".", 1)
1450 || !cutthrough_put_nl()
1451 || !cutthrough_flush_send()
1452 )
1453 return cutthrough.addr.message;
1454
1455 res = cutthrough_response(cutthrough.fd, '2', &cutthrough.addr.message, CUTTHROUGH_DATA_TIMEOUT);
1456 for (addr = &cutthrough.addr; addr; addr = addr->next)
1457 {
1458 addr->message = cutthrough.addr.message;
1459 switch(res)
1460 {
1461 case '2':
1462 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1463 close_cutthrough_connection(US"delivered");
1464 break;
1465
1466 case '4':
1467 delivery_log(LOG_MAIN, addr, 0,
1468 US"tmp-reject from cutthrough after DATA:");
1469 break;
1470
1471 case '5':
1472 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1473 US"rejected after DATA:");
1474 break;
1475
1476 default:
1477 break;
1478 }
1479 }
1480 return cutthrough.addr.message;
1481 }
1482
1483
1484
1485 /*************************************************
1486 * Copy error to toplevel address *
1487 *************************************************/
1488
1489 /* This function is used when a verify fails or defers, to ensure that the
1490 failure or defer information is in the original toplevel address. This applies
1491 when an address is redirected to a single new address, and the failure or
1492 deferral happens to the child address.
1493
1494 Arguments:
1495 vaddr the verify address item
1496 addr the final address item
1497 yield FAIL or DEFER
1498
1499 Returns: the value of YIELD
1500 */
1501
1502 static int
1503 copy_error(address_item *vaddr, address_item *addr, int yield)
1504 {
1505 if (addr != vaddr)
1506 {
1507 vaddr->message = addr->message;
1508 vaddr->user_message = addr->user_message;
1509 vaddr->basic_errno = addr->basic_errno;
1510 vaddr->more_errno = addr->more_errno;
1511 vaddr->prop.address_data = addr->prop.address_data;
1512 copyflag(vaddr, addr, af_pass_message);
1513 }
1514 return yield;
1515 }
1516
1517
1518
1519
1520 /**************************************************
1521 * printf that automatically handles TLS if needed *
1522 ***************************************************/
1523
1524 /* This function is used by verify_address() as a substitute for all fprintf()
1525 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1526 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1527 that assumes that we always use the smtp_out FILE* when not using TLS or the
1528 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1529 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1530 fprintf().
1531
1532 Arguments:
1533 f the candidate FILE* to write to
1534 format format string
1535 ... optional arguments
1536
1537 Returns:
1538 nothing
1539 */
1540
1541 static void PRINTF_FUNCTION(2,3)
1542 respond_printf(FILE *f, const char *format, ...)
1543 {
1544 va_list ap;
1545
1546 va_start(ap, format);
1547 if (smtp_out && (f == smtp_out))
1548 smtp_vprintf(format, FALSE, ap);
1549 else
1550 vfprintf(f, format, ap);
1551 va_end(ap);
1552 }
1553
1554
1555
1556 /*************************************************
1557 * Verify an email address *
1558 *************************************************/
1559
1560 /* This function is used both for verification (-bv and at other times) and
1561 address testing (-bt), which is indicated by address_test_mode being set.
1562
1563 Arguments:
1564 vaddr contains the address to verify; the next field in this block
1565 must be NULL
1566 f if not NULL, write the result to this file
1567 options various option bits:
1568 vopt_fake_sender => this sender verify is not for the real
1569 sender (it was verify=sender=xxxx or an address from a
1570 header line) - rewriting must not change sender_address
1571 vopt_is_recipient => this is a recipient address, otherwise
1572 it's a sender address - this affects qualification and
1573 rewriting and messages from callouts
1574 vopt_qualify => qualify an unqualified address; else error
1575 vopt_expn => called from SMTP EXPN command
1576 vopt_success_on_redirect => when a new address is generated
1577 the verification instantly succeeds
1578
1579 These ones are used by do_callout() -- the options variable
1580 is passed to it.
1581
1582 vopt_callout_fullpm => if postmaster check, do full one
1583 vopt_callout_no_cache => don't use callout cache
1584 vopt_callout_random => do the "random" thing
1585 vopt_callout_recipsender => use real sender for recipient
1586 vopt_callout_recippmaster => use postmaster for recipient
1587
1588 callout if > 0, specifies that callout is required, and gives timeout
1589 for individual commands
1590 callout_overall if > 0, gives overall timeout for the callout function;
1591 if < 0, a default is used (see do_callout())
1592 callout_connect the connection timeout for callouts
1593 se_mailfrom when callout is requested to verify a sender, use this
1594 in MAIL FROM; NULL => ""
1595 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1596 thing and use this as the sender address (may be "")
1597
1598 routed if not NULL, set TRUE if routing succeeded, so we can
1599 distinguish between routing failed and callout failed
1600
1601 Returns: OK address verified
1602 FAIL address failed to verify
1603 DEFER can't tell at present
1604 */
1605
1606 int
1607 verify_address(address_item *vaddr, FILE *f, int options, int callout,
1608 int callout_overall, int callout_connect, uschar *se_mailfrom,
1609 uschar *pm_mailfrom, BOOL *routed)
1610 {
1611 BOOL allok = TRUE;
1612 BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
1613 BOOL expn = (options & vopt_expn) != 0;
1614 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1615 int i;
1616 int yield = OK;
1617 int verify_type = expn? v_expn :
1618 address_test_mode? v_none :
1619 options & vopt_is_recipient? v_recipient : v_sender;
1620 address_item *addr_list;
1621 address_item *addr_new = NULL;
1622 address_item *addr_remote = NULL;
1623 address_item *addr_local = NULL;
1624 address_item *addr_succeed = NULL;
1625 uschar **failure_ptr = options & vopt_is_recipient
1626 ? &recipient_verify_failure : &sender_verify_failure;
1627 uschar *ko_prefix, *cr;
1628 uschar *address = vaddr->address;
1629 uschar *save_sender;
1630 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1631
1632 /* Clear, just in case */
1633
1634 *failure_ptr = NULL;
1635
1636 /* Set up a prefix and suffix for error message which allow us to use the same
1637 output statements both in EXPN mode (where an SMTP response is needed) and when
1638 debugging with an output file. */
1639
1640 if (expn)
1641 {
1642 ko_prefix = US"553 ";
1643 cr = US"\r";
1644 }
1645 else ko_prefix = cr = US"";
1646
1647 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1648
1649 if (parse_find_at(address) == NULL)
1650 {
1651 if ((options & vopt_qualify) == 0)
1652 {
1653 if (f != NULL)
1654 respond_printf(f, "%sA domain is required for \"%s\"%s\n",
1655 ko_prefix, address, cr);
1656 *failure_ptr = US"qualify";
1657 return FAIL;
1658 }
1659 address = rewrite_address_qualify(address, options & vopt_is_recipient);
1660 }
1661
1662 DEBUG(D_verify)
1663 {
1664 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1665 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
1666 }
1667
1668 /* Rewrite and report on it. Clear the domain and local part caches - these
1669 may have been set by domains and local part tests during an ACL. */
1670
1671 if (global_rewrite_rules != NULL)
1672 {
1673 uschar *old = address;
1674 address = rewrite_address(address, options & vopt_is_recipient, FALSE,
1675 global_rewrite_rules, rewrite_existflags);
1676 if (address != old)
1677 {
1678 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1679 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1680 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
1681 }
1682 }
1683
1684 /* If this is the real sender address, we must update sender_address at
1685 this point, because it may be referred to in the routers. */
1686
1687 if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
1688 sender_address = address;
1689
1690 /* If the address was rewritten to <> no verification can be done, and we have
1691 to return OK. This rewriting is permitted only for sender addresses; for other
1692 addresses, such rewriting fails. */
1693
1694 if (address[0] == 0) return OK;
1695
1696 /* Flip the legacy TLS-related variables over to the outbound set in case
1697 they're used in the context of a transport used by verification. Reset them
1698 at exit from this routine (so no returns allowed from here on). */
1699
1700 tls_modify_variables(&tls_out);
1701
1702 /* Save a copy of the sender address for re-instating if we change it to <>
1703 while verifying a sender address (a nice bit of self-reference there). */
1704
1705 save_sender = sender_address;
1706
1707 /* Observability variable for router/transport use */
1708
1709 verify_mode = options & vopt_is_recipient ? US"R" : US"S";
1710
1711 /* Update the address structure with the possibly qualified and rewritten
1712 address. Set it up as the starting address on the chain of new addresses. */
1713
1714 vaddr->address = address;
1715 addr_new = vaddr;
1716
1717 /* We need a loop, because an address can generate new addresses. We must also
1718 cope with generated pipes and files at the top level. (See also the code and
1719 comment in deliver.c.) However, it is usually the case that the router for
1720 user's .forward files has its verify flag turned off.
1721
1722 If an address generates more than one child, the loop is used only when
1723 full_info is set, and this can only be set locally. Remote enquiries just get
1724 information about the top level address, not anything that it generated. */
1725
1726 while (addr_new)
1727 {
1728 int rc;
1729 address_item *addr = addr_new;
1730
1731 addr_new = addr->next;
1732 addr->next = NULL;
1733
1734 DEBUG(D_verify)
1735 {
1736 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1737 debug_printf("Considering %s\n", addr->address);
1738 }
1739
1740 /* Handle generated pipe, file or reply addresses. We don't get these
1741 when handling EXPN, as it does only one level of expansion. */
1742
1743 if (testflag(addr, af_pfr))
1744 {
1745 allok = FALSE;
1746 if (f != NULL)
1747 {
1748 BOOL allow;
1749
1750 if (addr->address[0] == '>')
1751 {
1752 allow = testflag(addr, af_allow_reply);
1753 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1754 }
1755 else
1756 {
1757 allow = (addr->address[0] == '|')?
1758 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1759 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1760 }
1761
1762 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1763 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1764 "%s\n", addr->message);
1765 else if (allow)
1766 fprintf(f, "\n transport = %s\n", addr->transport->name);
1767 else
1768 fprintf(f, " *** forbidden ***\n");
1769 }
1770 continue;
1771 }
1772
1773 /* Just in case some router parameter refers to it. */
1774
1775 return_path = addr->prop.errors_address
1776 ? addr->prop.errors_address : sender_address;
1777
1778 /* Split the address into domain and local part, handling the %-hack if
1779 necessary, and then route it. While routing a sender address, set
1780 $sender_address to <> because that is what it will be if we were trying to
1781 send a bounce to the sender. */
1782
1783 if (routed) *routed = FALSE;
1784 if ((rc = deliver_split_address(addr)) == OK)
1785 {
1786 if (!(options & vopt_is_recipient)) sender_address = null_sender;
1787 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1788 &addr_succeed, verify_type);
1789 sender_address = save_sender; /* Put back the real sender */
1790 }
1791
1792 /* If routing an address succeeded, set the flag that remembers, for use when
1793 an ACL cached a sender verify (in case a callout fails). Then if routing set
1794 up a list of hosts or the transport has a host list, and the callout option
1795 is set, and we aren't in a host checking run, do the callout verification,
1796 and set another flag that notes that a callout happened. */
1797
1798 if (rc == OK)
1799 {
1800 if (routed) *routed = TRUE;
1801 if (callout > 0)
1802 {
1803 transport_instance * tp;
1804 host_item * host_list = addr->host_list;
1805
1806 /* Make up some data for use in the case where there is no remote
1807 transport. */
1808
1809 transport_feedback tf = {
1810 .interface = NULL, /* interface (=> any) */
1811 .port = US"smtp",
1812 .protocol = US"smtp",
1813 .hosts = NULL,
1814 .helo_data = US"$smtp_active_hostname",
1815 .hosts_override = FALSE,
1816 .hosts_randomize = FALSE,
1817 .gethostbyname = FALSE,
1818 .qualify_single = TRUE,
1819 .search_parents = FALSE
1820 };
1821
1822 /* If verification yielded a remote transport, we want to use that
1823 transport's options, so as to mimic what would happen if we were really
1824 sending a message to this address. */
1825
1826 if ((tp = addr->transport) && !tp->info->local)
1827 {
1828 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
1829
1830 /* If the transport has hosts and the router does not, or if the
1831 transport is configured to override the router's hosts, we must build a
1832 host list of the transport's hosts, and find the IP addresses */
1833
1834 if (tf.hosts && (!host_list || tf.hosts_override))
1835 {
1836 uschar *s;
1837 const uschar *save_deliver_domain = deliver_domain;
1838 uschar *save_deliver_localpart = deliver_localpart;
1839
1840 host_list = NULL; /* Ignore the router's hosts */
1841
1842 deliver_domain = addr->domain;
1843 deliver_localpart = addr->local_part;
1844 s = expand_string(tf.hosts);
1845 deliver_domain = save_deliver_domain;
1846 deliver_localpart = save_deliver_localpart;
1847
1848 if (!s)
1849 {
1850 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1851 "\"%s\" in %s transport for callout: %s", tf.hosts,
1852 tp->name, expand_string_message);
1853 }
1854 else
1855 {
1856 int flags;
1857 host_item *host, *nexthost;
1858 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1859
1860 /* Just ignore failures to find a host address. If we don't manage
1861 to find any addresses, the callout will defer. Note that more than
1862 one address may be found for a single host, which will result in
1863 additional host items being inserted into the chain. Hence we must
1864 save the next host first. */
1865
1866 flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
1867 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1868 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1869
1870 for (host = host_list; host; host = nexthost)
1871 {
1872 nexthost = host->next;
1873 if (tf.gethostbyname ||
1874 string_is_ip_address(host->name, NULL) != 0)
1875 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
1876 else
1877 {
1878 dnssec_domains * dnssec_domains = NULL;
1879 if (Ustrcmp(tp->driver_name, "smtp") == 0)
1880 {
1881 smtp_transport_options_block * ob =
1882 (smtp_transport_options_block *) tp->options_block;
1883 dnssec_domains = &ob->dnssec;
1884 }
1885
1886 (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1887 dnssec_domains, NULL, NULL);
1888 }
1889 }
1890 }
1891 }
1892 }
1893
1894 /* Can only do a callout if we have at least one host! If the callout
1895 fails, it will have set ${sender,recipient}_verify_failure. */
1896
1897 if (host_list)
1898 {
1899 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1900 if (host_checking && !host_checking_callout)
1901 {
1902 HDEBUG(D_verify)
1903 debug_printf("... callout omitted by default when host testing\n"
1904 "(Use -bhc if you want the callouts to happen.)\n");
1905 }
1906 else
1907 {
1908 #ifdef SUPPORT_TLS
1909 deliver_set_expansions(addr);
1910 #endif
1911 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
1912 callout_connect, options, se_mailfrom, pm_mailfrom);
1913 }
1914 }
1915 else
1916 {
1917 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
1918 "transport provided a host list\n");
1919 }
1920 }
1921 }
1922
1923 /* Otherwise, any failure is a routing failure */
1924
1925 else *failure_ptr = US"route";
1926
1927 /* A router may return REROUTED if it has set up a child address as a result
1928 of a change of domain name (typically from widening). In this case we always
1929 want to continue to verify the new child. */
1930
1931 if (rc == REROUTED) continue;
1932
1933 /* Handle hard failures */
1934
1935 if (rc == FAIL)
1936 {
1937 allok = FALSE;
1938 if (f)
1939 {
1940 address_item *p = addr->parent;
1941
1942 respond_printf(f, "%s%s %s", ko_prefix,
1943 full_info ? addr->address : address,
1944 address_test_mode ? "is undeliverable" : "failed to verify");
1945 if (!expn && admin_user)
1946 {
1947 if (addr->basic_errno > 0)
1948 respond_printf(f, ": %s", strerror(addr->basic_errno));
1949 if (addr->message)
1950 respond_printf(f, ": %s", addr->message);
1951 }
1952
1953 /* Show parents iff doing full info */
1954
1955 if (full_info) while (p)
1956 {
1957 respond_printf(f, "%s\n <-- %s", cr, p->address);
1958 p = p->parent;
1959 }
1960 respond_printf(f, "%s\n", cr);
1961 }
1962 cancel_cutthrough_connection(TRUE, US"routing hard fail");
1963
1964 if (!full_info)
1965 {
1966 yield = copy_error(vaddr, addr, FAIL);
1967 goto out;
1968 }
1969 yield = FAIL;
1970 }
1971
1972 /* Soft failure */
1973
1974 else if (rc == DEFER)
1975 {
1976 allok = FALSE;
1977 if (f)
1978 {
1979 address_item *p = addr->parent;
1980 respond_printf(f, "%s%s cannot be resolved at this time", ko_prefix,
1981 full_info? addr->address : address);
1982 if (!expn && admin_user)
1983 {
1984 if (addr->basic_errno > 0)
1985 respond_printf(f, ": %s", strerror(addr->basic_errno));
1986 if (addr->message)
1987 respond_printf(f, ": %s", addr->message);
1988 else if (addr->basic_errno <= 0)
1989 respond_printf(f, ": unknown error");
1990 }
1991
1992 /* Show parents iff doing full info */
1993
1994 if (full_info) while (p)
1995 {
1996 respond_printf(f, "%s\n <-- %s", cr, p->address);
1997 p = p->parent;
1998 }
1999 respond_printf(f, "%s\n", cr);
2000 }
2001 cancel_cutthrough_connection(TRUE, US"routing soft fail");
2002
2003 if (!full_info)
2004 {
2005 yield = copy_error(vaddr, addr, DEFER);
2006 goto out;
2007 }
2008 if (yield == OK) yield = DEFER;
2009 }
2010
2011 /* If we are handling EXPN, we do not want to continue to route beyond
2012 the top level (whose address is in "address"). */
2013
2014 else if (expn)
2015 {
2016 uschar *ok_prefix = US"250-";
2017
2018 if (!addr_new)
2019 if (!addr_local && !addr_remote)
2020 respond_printf(f, "250 mail to <%s> is discarded\r\n", address);
2021 else
2022 respond_printf(f, "250 <%s>\r\n", address);
2023
2024 else do
2025 {
2026 address_item *addr2 = addr_new;
2027 addr_new = addr2->next;
2028 if (!addr_new) ok_prefix = US"250 ";
2029 respond_printf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
2030 } while (addr_new);
2031 yield = OK;
2032 goto out;
2033 }
2034
2035 /* Successful routing other than EXPN. */
2036
2037 else
2038 {
2039 /* Handle successful routing when short info wanted. Otherwise continue for
2040 other (generated) addresses. Short info is the operational case. Full info
2041 can be requested only when debug_selector != 0 and a file is supplied.
2042
2043 There is a conflict between the use of aliasing as an alternate email
2044 address, and as a sort of mailing list. If an alias turns the incoming
2045 address into just one address (e.g. J.Caesar->jc44) you may well want to
2046 carry on verifying the generated address to ensure it is valid when
2047 checking incoming mail. If aliasing generates multiple addresses, you
2048 probably don't want to do this. Exim therefore treats the generation of
2049 just a single new address as a special case, and continues on to verify the
2050 generated address. */
2051
2052 if ( !full_info /* Stop if short info wanted AND */
2053 && ( ( !addr_new /* No new address OR */
2054 || addr_new->next /* More than one new address OR */
2055 || testflag(addr_new, af_pfr) /* New address is pfr */
2056 )
2057 || /* OR */
2058 ( addr_new /* At least one new address AND */
2059 && success_on_redirect /* success_on_redirect is set */
2060 ) )
2061 )
2062 {
2063 if (f) fprintf(f, "%s %s\n",
2064 address, address_test_mode ? "is deliverable" : "verified");
2065
2066 /* If we have carried on to verify a child address, we want the value
2067 of $address_data to be that of the child */
2068
2069 vaddr->prop.address_data = addr->prop.address_data;
2070
2071 /* If stopped because more than one new address, cannot cutthrough */
2072
2073 if (addr_new && addr_new->next)
2074 cancel_cutthrough_connection(TRUE, US"multiple addresses from routing");
2075
2076 yield = OK;
2077 goto out;
2078 }
2079 }
2080 } /* Loop for generated addresses */
2081
2082 /* Display the full results of the successful routing, including any generated
2083 addresses. Control gets here only when full_info is set, which requires f not
2084 to be NULL, and this occurs only when a top-level verify is called with the
2085 debugging switch on.
2086
2087 If there are no local and no remote addresses, and there were no pipes, files,
2088 or autoreplies, and there were no errors or deferments, the message is to be
2089 discarded, usually because of the use of :blackhole: in an alias file. */
2090
2091 if (allok && !addr_local && !addr_remote)
2092 {
2093 fprintf(f, "mail to %s is discarded\n", address);
2094 goto out;
2095 }
2096
2097 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2098 while (addr_list)
2099 {
2100 address_item *addr = addr_list;
2101 address_item *p = addr->parent;
2102 transport_instance * tp = addr->transport;
2103
2104 addr_list = addr->next;
2105
2106 fprintf(f, "%s", CS addr->address);
2107 #ifdef EXPERIMENTAL_SRS
2108 if(addr->prop.srs_sender)
2109 fprintf(f, " [srs = %s]", addr->prop.srs_sender);
2110 #endif
2111
2112 /* If the address is a duplicate, show something about it. */
2113
2114 if (!testflag(addr, af_pfr))
2115 {
2116 tree_node *tnode;
2117 if ((tnode = tree_search(tree_duplicates, addr->unique)))
2118 fprintf(f, " [duplicate, would not be delivered]");
2119 else tree_add_duplicate(addr->unique, addr);
2120 }
2121
2122 /* Now show its parents */
2123
2124 for (p = addr->parent; p; p = p->parent)
2125 fprintf(f, "\n <-- %s", p->address);
2126 fprintf(f, "\n ");
2127
2128 /* Show router, and transport */
2129
2130 fprintf(f, "router = %s, transport = %s\n",
2131 addr->router->name, tp ? tp->name : US"unset");
2132
2133 /* Show any hosts that are set up by a router unless the transport
2134 is going to override them; fiddle a bit to get a nice format. */
2135
2136 if (addr->host_list && tp && !tp->overrides_hosts)
2137 {
2138 host_item *h;
2139 int maxlen = 0;
2140 int maxaddlen = 0;
2141 for (h = addr->host_list; h; h = h->next)
2142 { /* get max lengths of host names, addrs */
2143 int len = Ustrlen(h->name);
2144 if (len > maxlen) maxlen = len;
2145 len = h->address ? Ustrlen(h->address) : 7;
2146 if (len > maxaddlen) maxaddlen = len;
2147 }
2148 for (h = addr->host_list; h; h = h->next)
2149 {
2150 fprintf(f, " host %-*s ", maxlen, h->name);
2151
2152 if (h->address)
2153 fprintf(f, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2154 else if (tp->info->local)
2155 fprintf(f, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2156 else
2157 fprintf(f, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2158
2159 if (h->mx >= 0) fprintf(f, " MX=%d", h->mx);
2160 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
2161 if (running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", f);
2162 if (h->status == hstatus_unusable) fputs(" ** unusable **", f);
2163 fputc('\n', f);
2164 }
2165 }
2166 }
2167
2168 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2169 the -bv or -bt case). */
2170
2171 out:
2172 verify_mode = NULL;
2173 tls_modify_variables(&tls_in);
2174
2175 return yield;
2176 }
2177
2178
2179
2180
2181 /*************************************************
2182 * Check headers for syntax errors *
2183 *************************************************/
2184
2185 /* This function checks those header lines that contain addresses, and verifies
2186 that all the addresses therein are 5322-syntactially correct.
2187
2188 Arguments:
2189 msgptr where to put an error message
2190
2191 Returns: OK
2192 FAIL
2193 */
2194
2195 int
2196 verify_check_headers(uschar **msgptr)
2197 {
2198 header_line *h;
2199 uschar *colon, *s;
2200 int yield = OK;
2201
2202 for (h = header_list; h && yield == OK; h = h->next)
2203 {
2204 if (h->type != htype_from &&
2205 h->type != htype_reply_to &&
2206 h->type != htype_sender &&
2207 h->type != htype_to &&
2208 h->type != htype_cc &&
2209 h->type != htype_bcc)
2210 continue;
2211
2212 colon = Ustrchr(h->text, ':');
2213 s = colon + 1;
2214 while (isspace(*s)) s++;
2215
2216 /* Loop for multiple addresses in the header, enabling group syntax. Note
2217 that we have to reset this after the header has been scanned. */
2218
2219 parse_allow_group = TRUE;
2220
2221 while (*s)
2222 {
2223 uschar *ss = parse_find_address_end(s, FALSE);
2224 uschar *recipient, *errmess;
2225 int terminator = *ss;
2226 int start, end, domain;
2227
2228 /* Temporarily terminate the string at this point, and extract the
2229 operative address within, allowing group syntax. */
2230
2231 *ss = 0;
2232 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2233 *ss = terminator;
2234
2235 /* Permit an unqualified address only if the message is local, or if the
2236 sending host is configured to be permitted to send them. */
2237
2238 if (recipient && !domain)
2239 {
2240 if (h->type == htype_from || h->type == htype_sender)
2241 {
2242 if (!allow_unqualified_sender) recipient = NULL;
2243 }
2244 else
2245 {
2246 if (!allow_unqualified_recipient) recipient = NULL;
2247 }
2248 if (recipient == NULL) errmess = US"unqualified address not permitted";
2249 }
2250
2251 /* It's an error if no address could be extracted, except for the special
2252 case of an empty address. */
2253
2254 if (!recipient && Ustrcmp(errmess, "empty address") != 0)
2255 {
2256 uschar *verb = US"is";
2257 uschar *t = ss;
2258 uschar *tt = colon;
2259 int len;
2260
2261 /* Arrange not to include any white space at the end in the
2262 error message or the header name. */
2263
2264 while (t > s && isspace(t[-1])) t--;
2265 while (tt > h->text && isspace(tt[-1])) tt--;
2266
2267 /* Add the address that failed to the error message, since in a
2268 header with very many addresses it is sometimes hard to spot
2269 which one is at fault. However, limit the amount of address to
2270 quote - cases have been seen where, for example, a missing double
2271 quote in a humungous To: header creates an "address" that is longer
2272 than string_sprintf can handle. */
2273
2274 len = t - s;
2275 if (len > 1024)
2276 {
2277 len = 1024;
2278 verb = US"begins";
2279 }
2280
2281 /* deconst cast ok as we're passing a non-const to string_printing() */
2282 *msgptr = US string_printing(
2283 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2284 errmess, (int)(tt - h->text), h->text, verb, len, s));
2285
2286 yield = FAIL;
2287 break; /* Out of address loop */
2288 }
2289
2290 /* Advance to the next address */
2291
2292 s = ss + (terminator ? 1 : 0);
2293 while (isspace(*s)) s++;
2294 } /* Next address */
2295
2296 parse_allow_group = FALSE;
2297 parse_found_group = FALSE;
2298 } /* Next header unless yield has been set FALSE */
2299
2300 return yield;
2301 }
2302
2303
2304 /*************************************************
2305 * Check header names for 8-bit characters *
2306 *************************************************/
2307
2308 /* This function checks for invalid characters in header names. See
2309 RFC 5322, 2.2. and RFC 6532, 3.
2310
2311 Arguments:
2312 msgptr where to put an error message
2313
2314 Returns: OK
2315 FAIL
2316 */
2317
2318 int
2319 verify_check_header_names_ascii(uschar **msgptr)
2320 {
2321 header_line *h;
2322 uschar *colon, *s;
2323
2324 for (h = header_list; h; h = h->next)
2325 {
2326 colon = Ustrchr(h->text, ':');
2327 for(s = h->text; s < colon; s++)
2328 if ((*s < 33) || (*s > 126))
2329 {
2330 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2331 colon - h->text, h->text);
2332 return FAIL;
2333 }
2334 }
2335 return OK;
2336 }
2337
2338 /*************************************************
2339 * Check for blind recipients *
2340 *************************************************/
2341
2342 /* This function checks that every (envelope) recipient is mentioned in either
2343 the To: or Cc: header lines, thus detecting blind carbon copies.
2344
2345 There are two ways of scanning that could be used: either scan the header lines
2346 and tick off the recipients, or scan the recipients and check the header lines.
2347 The original proposed patch did the former, but I have chosen to do the latter,
2348 because (a) it requires no memory and (b) will use fewer resources when there
2349 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2350
2351 Arguments: none
2352 Returns: OK if there are no blind recipients
2353 FAIL if there is at least one blind recipient
2354 */
2355
2356 int
2357 verify_check_notblind(void)
2358 {
2359 int i;
2360 for (i = 0; i < recipients_count; i++)
2361 {
2362 header_line *h;
2363 BOOL found = FALSE;
2364 uschar *address = recipients_list[i].address;
2365
2366 for (h = header_list; !found && h != NULL; h = h->next)
2367 {
2368 uschar *colon, *s;
2369
2370 if (h->type != htype_to && h->type != htype_cc) continue;
2371
2372 colon = Ustrchr(h->text, ':');
2373 s = colon + 1;
2374 while (isspace(*s)) s++;
2375
2376 /* Loop for multiple addresses in the header, enabling group syntax. Note
2377 that we have to reset this after the header has been scanned. */
2378
2379 parse_allow_group = TRUE;
2380
2381 while (*s != 0)
2382 {
2383 uschar *ss = parse_find_address_end(s, FALSE);
2384 uschar *recipient,*errmess;
2385 int terminator = *ss;
2386 int start, end, domain;
2387
2388 /* Temporarily terminate the string at this point, and extract the
2389 operative address within, allowing group syntax. */
2390
2391 *ss = 0;
2392 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2393 *ss = terminator;
2394
2395 /* If we found a valid recipient that has a domain, compare it with the
2396 envelope recipient. Local parts are compared case-sensitively, domains
2397 case-insensitively. By comparing from the start with length "domain", we
2398 include the "@" at the end, which ensures that we are comparing the whole
2399 local part of each address. */
2400
2401 if (recipient != NULL && domain != 0)
2402 {
2403 found = Ustrncmp(recipient, address, domain) == 0 &&
2404 strcmpic(recipient + domain, address + domain) == 0;
2405 if (found) break;
2406 }
2407
2408 /* Advance to the next address */
2409
2410 s = ss + (terminator? 1:0);
2411 while (isspace(*s)) s++;
2412 } /* Next address */
2413
2414 parse_allow_group = FALSE;
2415 parse_found_group = FALSE;
2416 } /* Next header (if found is false) */
2417
2418 if (!found) return FAIL;
2419 } /* Next recipient */
2420
2421 return OK;
2422 }
2423
2424
2425
2426 /*************************************************
2427 * Find if verified sender *
2428 *************************************************/
2429
2430 /* Usually, just a single address is verified as the sender of the message.
2431 However, Exim can be made to verify other addresses as well (often related in
2432 some way), and this is useful in some environments. There may therefore be a
2433 chain of such addresses that have previously been tested. This function finds
2434 whether a given address is on the chain.
2435
2436 Arguments: the address to be verified
2437 Returns: pointer to an address item, or NULL
2438 */
2439
2440 address_item *
2441 verify_checked_sender(uschar *sender)
2442 {
2443 address_item *addr;
2444 for (addr = sender_verified_list; addr != NULL; addr = addr->next)
2445 if (Ustrcmp(sender, addr->address) == 0) break;
2446 return addr;
2447 }
2448
2449
2450
2451
2452
2453 /*************************************************
2454 * Get valid header address *
2455 *************************************************/
2456
2457 /* Scan the originator headers of the message, looking for an address that
2458 verifies successfully. RFC 822 says:
2459
2460 o The "Sender" field mailbox should be sent notices of
2461 any problems in transport or delivery of the original
2462 messages. If there is no "Sender" field, then the
2463 "From" field mailbox should be used.
2464
2465 o If the "Reply-To" field exists, then the reply should
2466 go to the addresses indicated in that field and not to
2467 the address(es) indicated in the "From" field.
2468
2469 So we check a Sender field if there is one, else a Reply_to field, else a From
2470 field. As some strange messages may have more than one of these fields,
2471 especially if they are resent- fields, check all of them if there is more than
2472 one.
2473
2474 Arguments:
2475 user_msgptr points to where to put a user error message
2476 log_msgptr points to where to put a log error message
2477 callout timeout for callout check (passed to verify_address())
2478 callout_overall overall callout timeout (ditto)
2479 callout_connect connect callout timeout (ditto)
2480 se_mailfrom mailfrom for verify; NULL => ""
2481 pm_mailfrom sender for pm callout check (passed to verify_address())
2482 options callout options (passed to verify_address())
2483 verrno where to put the address basic_errno
2484
2485 If log_msgptr is set to something without setting user_msgptr, the caller
2486 normally uses log_msgptr for both things.
2487
2488 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2489 FAIL is given if no appropriate headers are found
2490 */
2491
2492 int
2493 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2494 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2495 uschar *pm_mailfrom, int options, int *verrno)
2496 {
2497 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2498 BOOL done = FALSE;
2499 int yield = FAIL;
2500 int i;
2501
2502 for (i = 0; i < 3 && !done; i++)
2503 {
2504 header_line *h;
2505 for (h = header_list; h != NULL && !done; h = h->next)
2506 {
2507 int terminator, new_ok;
2508 uschar *s, *ss, *endname;
2509
2510 if (h->type != header_types[i]) continue;
2511 s = endname = Ustrchr(h->text, ':') + 1;
2512
2513 /* Scan the addresses in the header, enabling group syntax. Note that we
2514 have to reset this after the header has been scanned. */
2515
2516 parse_allow_group = TRUE;
2517
2518 while (*s != 0)
2519 {
2520 address_item *vaddr;
2521
2522 while (isspace(*s) || *s == ',') s++;
2523 if (*s == 0) break; /* End of header */
2524
2525 ss = parse_find_address_end(s, FALSE);
2526
2527 /* The terminator is a comma or end of header, but there may be white
2528 space preceding it (including newline for the last address). Move back
2529 past any white space so we can check against any cached envelope sender
2530 address verifications. */
2531
2532 while (isspace(ss[-1])) ss--;
2533 terminator = *ss;
2534 *ss = 0;
2535
2536 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2537 (int)(endname - h->text), h->text, s);
2538
2539 /* See if we have already verified this address as an envelope sender,
2540 and if so, use the previous answer. */
2541
2542 vaddr = verify_checked_sender(s);
2543
2544 if (vaddr != NULL && /* Previously checked */
2545 (callout <= 0 || /* No callout needed; OR */
2546 vaddr->special_action > 256)) /* Callout was done */
2547 {
2548 new_ok = vaddr->special_action & 255;
2549 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2550 *ss = terminator; /* Restore shortened string */
2551 }
2552
2553 /* Otherwise we run the verification now. We must restore the shortened
2554 string before running the verification, so the headers are correct, in
2555 case there is any rewriting. */
2556
2557 else
2558 {
2559 int start, end, domain;
2560 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2561 &domain, FALSE);
2562
2563 *ss = terminator;
2564
2565 /* If we found an empty address, just carry on with the next one, but
2566 kill the message. */
2567
2568 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2569 {
2570 *log_msgptr = NULL;
2571 s = ss;
2572 continue;
2573 }
2574
2575 /* If verification failed because of a syntax error, fail this
2576 function, and ensure that the failing address gets added to the error
2577 message. */
2578
2579 if (address == NULL)
2580 {
2581 new_ok = FAIL;
2582 while (ss > s && isspace(ss[-1])) ss--;
2583 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2584 "scanning for sender: %s in \"%.*s\"",
2585 (int)(endname - h->text), h->text, *log_msgptr, (int)(ss - s), s);
2586 yield = FAIL;
2587 done = TRUE;
2588 break;
2589 }
2590
2591 /* Else go ahead with the sender verification. But it isn't *the*
2592 sender of the message, so set vopt_fake_sender to stop sender_address
2593 being replaced after rewriting or qualification. */
2594
2595 else
2596 {
2597 vaddr = deliver_make_addr(address, FALSE);
2598 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2599 callout, callout_overall, callout_connect, se_mailfrom,
2600 pm_mailfrom, NULL);
2601 }
2602 }
2603
2604 /* We now have the result, either newly found, or cached. If we are
2605 giving out error details, set a specific user error. This means that the
2606 last of these will be returned to the user if all three fail. We do not
2607 set a log message - the generic one below will be used. */
2608
2609 if (new_ok != OK)
2610 {
2611 *verrno = vaddr->basic_errno;
2612 if (smtp_return_error_details)
2613 *user_msgptr = string_sprintf("Rejected after DATA: "
2614 "could not verify \"%.*s\" header address\n%s: %s",
2615 (int)(endname - h->text), h->text, vaddr->address, vaddr->message);
2616 }
2617
2618 /* Success or defer */
2619
2620 if (new_ok == OK)
2621 {
2622 yield = OK;
2623 done = TRUE;
2624 break;
2625 }
2626
2627 if (new_ok == DEFER) yield = DEFER;
2628
2629 /* Move on to any more addresses in the header */
2630
2631 s = ss;
2632 } /* Next address */
2633
2634 parse_allow_group = FALSE;
2635 parse_found_group = FALSE;
2636 } /* Next header, unless done */
2637 } /* Next header type unless done */
2638
2639 if (yield == FAIL && *log_msgptr == NULL)
2640 *log_msgptr = US"there is no valid sender in any header line";
2641
2642 if (yield == DEFER && *log_msgptr == NULL)
2643 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2644
2645 return yield;
2646 }
2647
2648
2649
2650
2651 /*************************************************
2652 * Get RFC 1413 identification *
2653 *************************************************/
2654
2655 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2656 the timeout is set to zero, then the query is not done. There may also be lists
2657 of hosts and nets which are exempt. To guard against malefactors sending
2658 non-printing characters which could, for example, disrupt a message's headers,
2659 make sure the string consists of printing characters only.
2660
2661 Argument:
2662 port the port to connect to; usually this is IDENT_PORT (113), but when
2663 running in the test harness with -bh a different value is used.
2664
2665 Returns: nothing
2666
2667 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2668 */
2669
2670 void
2671 verify_get_ident(int port)
2672 {
2673 int sock, host_af, qlen;
2674 int received_sender_port, received_interface_port, n;
2675 uschar *p;
2676 blob early_data;
2677 uschar buffer[2048];
2678
2679 /* Default is no ident. Check whether we want to do an ident check for this
2680 host. */
2681
2682 sender_ident = NULL;
2683 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2684 return;
2685
2686 DEBUG(D_ident) debug_printf("doing ident callback\n");
2687
2688 /* Set up a connection to the ident port of the remote host. Bind the local end
2689 to the incoming interface address. If the sender host address is an IPv6
2690 address, the incoming interface address will also be IPv6. */
2691
2692 host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
2693 if ((sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
2694
2695 if (ip_bind(sock, host_af, interface_address, 0) < 0)
2696 {
2697 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2698 strerror(errno));
2699 goto END_OFF;
2700 }
2701
2702 /* Construct and send the query. */
2703
2704 qlen = snprintf(CS buffer, sizeof(buffer), "%d , %d\r\n",
2705 sender_host_port, interface_port);
2706 early_data.data = buffer;
2707 early_data.len = qlen;
2708
2709 if (ip_connect(sock, host_af, sender_host_address, port,
2710 rfc1413_query_timeout, &early_data) < 0)
2711 {
2712 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
2713 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2714 sender_host_address);
2715 else
2716 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2717 sender_host_address, strerror(errno));
2718 goto END_OFF;
2719 }
2720
2721 /* Read a response line. We put it into the rest of the buffer, using several
2722 recv() calls if necessary. */
2723
2724 p = buffer + qlen;
2725
2726 for (;;)
2727 {
2728 uschar *pp;
2729 int count;
2730 int size = sizeof(buffer) - (p - buffer);
2731
2732 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2733 count = ip_recv(sock, p, size, rfc1413_query_timeout);
2734 if (count <= 0) goto END_OFF; /* Read error or EOF */
2735
2736 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2737 generous, and accept a plain \n terminator as well. The only illegal
2738 character is 0. */
2739
2740 for (pp = p; pp < p + count; pp++)
2741 {
2742 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2743 if (*pp == '\n')
2744 {
2745 if (pp[-1] == '\r') pp--;
2746 *pp = 0;
2747 goto GOT_DATA; /* Break out of both loops */
2748 }
2749 }
2750
2751 /* Reached the end of the data without finding \n. Let the loop continue to
2752 read some more, if there is room. */
2753
2754 p = pp;
2755 }
2756
2757 GOT_DATA:
2758
2759 /* We have received a line of data. Check it carefully. It must start with the
2760 same two port numbers that we sent, followed by data as defined by the RFC. For
2761 example,
2762
2763 12345 , 25 : USERID : UNIX :root
2764
2765 However, the amount of white space may be different to what we sent. In the
2766 "osname" field there may be several sub-fields, comma separated. The data we
2767 actually want to save follows the third colon. Some systems put leading spaces
2768 in it - we discard those. */
2769
2770 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2771 &received_interface_port, &n) != 2 ||
2772 received_sender_port != sender_host_port ||
2773 received_interface_port != interface_port)
2774 goto END_OFF;
2775
2776 p = buffer + qlen + n;
2777 while(isspace(*p)) p++;
2778 if (*p++ != ':') goto END_OFF;
2779 while(isspace(*p)) p++;
2780 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2781 p += 6;
2782 while(isspace(*p)) p++;
2783 if (*p++ != ':') goto END_OFF;
2784 while (*p != 0 && *p != ':') p++;
2785 if (*p++ == 0) goto END_OFF;
2786 while(isspace(*p)) p++;
2787 if (*p == 0) goto END_OFF;
2788
2789 /* The rest of the line is the data we want. We turn it into printing
2790 characters when we save it, so that it cannot mess up the format of any logging
2791 or Received: lines into which it gets inserted. We keep a maximum of 127
2792 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
2793
2794 sender_ident = US string_printing(string_copyn(p, 127));
2795 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2796
2797 END_OFF:
2798 (void)close(sock);
2799 return;
2800 }
2801
2802
2803
2804
2805 /*************************************************
2806 * Match host to a single host-list item *
2807 *************************************************/
2808
2809 /* This function compares a host (name or address) against a single item
2810 from a host list. The host name gets looked up if it is needed and is not
2811 already known. The function is called from verify_check_this_host() via
2812 match_check_list(), which is why most of its arguments are in a single block.
2813
2814 Arguments:
2815 arg the argument block (see below)
2816 ss the host-list item
2817 valueptr where to pass back looked up data, or NULL
2818 error for error message when returning ERROR
2819
2820 The block contains:
2821 host_name (a) the host name, or
2822 (b) NULL, implying use sender_host_name and
2823 sender_host_aliases, looking them up if required, or
2824 (c) the empty string, meaning that only IP address matches
2825 are permitted
2826 host_address the host address
2827 host_ipv4 the IPv4 address taken from an IPv6 one
2828
2829 Returns: OK matched
2830 FAIL did not match
2831 DEFER lookup deferred
2832 ERROR (a) failed to find the host name or IP address, or
2833 (b) unknown lookup type specified, or
2834 (c) host name encountered when only IP addresses are
2835 being matched
2836 */
2837
2838 int
2839 check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
2840 {
2841 check_host_block *cb = (check_host_block *)arg;
2842 int mlen = -1;
2843 int maskoffset;
2844 BOOL iplookup = FALSE;
2845 BOOL isquery = FALSE;
2846 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
2847 const uschar *t;
2848 uschar *semicolon;
2849 uschar **aliases;
2850
2851 /* Optimize for the special case when the pattern is "*". */
2852
2853 if (*ss == '*' && ss[1] == 0) return OK;
2854
2855 /* If the pattern is empty, it matches only in the case when there is no host -
2856 this can occur in ACL checking for SMTP input using the -bs option. In this
2857 situation, the host address is the empty string. */
2858
2859 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2860 if (*ss == 0) return FAIL;
2861
2862 /* If the pattern is precisely "@" then match against the primary host name,
2863 provided that host name matching is permitted; if it's "@[]" match against the
2864 local host's IP addresses. */
2865
2866 if (*ss == '@')
2867 {
2868 if (ss[1] == 0)
2869 {
2870 if (isiponly) return ERROR;
2871 ss = primary_hostname;
2872 }
2873 else if (Ustrcmp(ss, "@[]") == 0)
2874 {
2875 ip_address_item *ip;
2876 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
2877 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2878 return FAIL;
2879 }
2880 }
2881
2882 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2883 a (possibly masked) comparison with the current IP address. */
2884
2885 if (string_is_ip_address(ss, &maskoffset) != 0)
2886 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2887
2888 /* The pattern is not an IP address. A common error that people make is to omit
2889 one component of an IPv4 address, either by accident, or believing that, for
2890 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2891 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2892 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2893 ancient specification.) To aid in debugging these cases, we give a specific
2894 error if the pattern contains only digits and dots or contains a slash preceded
2895 only by digits and dots (a slash at the start indicates a file name and of
2896 course slashes may be present in lookups, but not preceded only by digits and
2897 dots). */
2898
2899 for (t = ss; isdigit(*t) || *t == '.'; t++);
2900 if (*t == 0 || (*t == '/' && t != ss))
2901 {
2902 *error = US"malformed IPv4 address or address mask";
2903 return ERROR;
2904 }
2905
2906 /* See if there is a semicolon in the pattern */
2907
2908 semicolon = Ustrchr(ss, ';');
2909
2910 /* If we are doing an IP address only match, then all lookups must be IP
2911 address lookups, even if there is no "net-". */
2912
2913 if (isiponly)
2914 {
2915 iplookup = semicolon != NULL;
2916 }
2917
2918 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
2919 a lookup on a masked IP network, in textual form. We obey this code even if we
2920 have already set iplookup, so as to skip over the "net-" prefix and to set the
2921 mask length. The net- stuff really only applies to single-key lookups where the
2922 key is implicit. For query-style lookups the key is specified in the query.
2923 From release 4.30, the use of net- for query style is no longer needed, but we
2924 retain it for backward compatibility. */
2925
2926 if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
2927 {
2928 mlen = 0;
2929 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2930 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2931 iplookup = (*t++ == '-');
2932 }
2933 else t = ss;
2934
2935 /* Do the IP address lookup if that is indeed what we have */
2936
2937 if (iplookup)
2938 {
2939 int insize;
2940 int search_type;
2941 int incoming[4];
2942 void *handle;
2943 uschar *filename, *key, *result;
2944 uschar buffer[64];
2945
2946 /* Find the search type */
2947
2948 search_type = search_findtype(t, semicolon - t);
2949
2950 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2951 search_error_message);
2952
2953 /* Adjust parameters for the type of lookup. For a query-style lookup, there
2954 is no file name, and the "key" is just the query. For query-style with a file
2955 name, we have to fish the file off the start of the query. For a single-key
2956 lookup, the key is the current IP address, masked appropriately, and
2957 reconverted to text form, with the mask appended. For IPv6 addresses, specify
2958 dot separators instead of colons, except when the lookup type is "iplsearch".
2959 */
2960
2961 if (mac_islookup(search_type, lookup_absfilequery))
2962 {
2963 filename = semicolon + 1;
2964 key = filename;
2965 while (*key != 0 && !isspace(*key)) key++;
2966 filename = string_copyn(filename, key - filename);
2967 while (isspace(*key)) key++;
2968 }
2969 else if (mac_islookup(search_type, lookup_querystyle))
2970 {
2971 filename = NULL;
2972 key = semicolon + 1;
2973 }
2974 else /* Single-key style */
2975 {
2976 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
2977 ':' : '.';
2978 insize = host_aton(cb->host_address, incoming);
2979 host_mask(insize, incoming, mlen);
2980 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
2981 key = buffer;
2982 filename = semicolon + 1;
2983 }
2984
2985 /* Now do the actual lookup; note that there is no search_close() because
2986 of the caching arrangements. */
2987
2988 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
2989 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
2990
2991 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
2992 if (valueptr != NULL) *valueptr = result;
2993 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
2994 }
2995
2996 /* The pattern is not an IP address or network reference of any kind. That is,
2997 it is a host name pattern. If this is an IP only match, there's an error in the
2998 host list. */
2999
3000 if (isiponly)
3001 {
3002 *error = US"cannot match host name in match_ip list";
3003 return ERROR;
3004 }
3005
3006 /* Check the characters of the pattern to see if they comprise only letters,
3007 digits, full stops, and hyphens (the constituents of domain names). Allow
3008 underscores, as they are all too commonly found. Sigh. Also, if
3009 allow_utf8_domains is set, allow top-bit characters. */
3010
3011 for (t = ss; *t != 0; t++)
3012 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3013 (!allow_utf8_domains || *t < 128)) break;
3014
3015 /* If the pattern is a complete domain name, with no fancy characters, look up
3016 its IP address and match against that. Note that a multi-homed host will add
3017 items to the chain. */
3018
3019 if (*t == 0)
3020 {
3021 int rc;
3022 host_item h;
3023 h.next = NULL;
3024 h.name = ss;
3025 h.address = NULL;
3026 h.mx = MX_NONE;
3027
3028 /* Using byname rather than bydns here means we cannot determine dnssec
3029 status. On the other hand it is unclear how that could be either
3030 propagated up or enforced. */
3031
3032 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3033 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3034 {
3035 host_item *hh;
3036 for (hh = &h; hh != NULL; hh = hh->next)
3037 {
3038 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3039 }
3040 return FAIL;
3041 }
3042 if (rc == HOST_FIND_AGAIN) return DEFER;
3043 *error = string_sprintf("failed to find IP address for %s", ss);
3044 return ERROR;
3045 }
3046
3047 /* Almost all subsequent comparisons require the host name, and can be done
3048 using the general string matching function. When this function is called for
3049 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3050 must use sender_host_name and its aliases, looking them up if necessary. */
3051
3052 if (cb->host_name != NULL) /* Explicit host name given */
3053 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3054 valueptr);
3055
3056 /* Host name not given; in principle we need the sender host name and its
3057 aliases. However, for query-style lookups, we do not need the name if the
3058 query does not contain $sender_host_name. From release 4.23, a reference to
3059 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3060 on spec. */
3061
3062 if ((semicolon = Ustrchr(ss, ';')) != NULL)
3063 {
3064 const uschar *affix;
3065 int partial, affixlen, starflags, id;
3066
3067 *semicolon = 0;
3068 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
3069 *semicolon=';';
3070
3071 if (id < 0) /* Unknown lookup type */
3072 {
3073 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3074 search_error_message, ss);
3075 return DEFER;
3076 }
3077 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3078 }
3079
3080 if (isquery)
3081 {
3082 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3083 {
3084 case OK: return OK;
3085 case DEFER: return DEFER;
3086 default: return FAIL;
3087 }
3088 }
3089
3090 /* Not a query-style lookup; must ensure the host name is present, and then we
3091 do a check on the name and all its aliases. */
3092
3093 if (!sender_host_name)
3094 {
3095 HDEBUG(D_host_lookup)
3096 debug_printf("sender host name required, to match against %s\n", ss);
3097 if (host_lookup_failed || host_name_lookup() != OK)
3098 {
3099 *error = string_sprintf("failed to find host name for %s",
3100 sender_host_address);;
3101 return ERROR;
3102 }
3103 host_build_sender_fullhost();
3104 }
3105
3106 /* Match on the sender host name, using the general matching function */
3107
3108 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE, valueptr))
3109 {
3110 case OK: return OK;
3111 case DEFER: return DEFER;
3112 }
3113
3114 /* If there are aliases, try matching on them. */
3115
3116 aliases = sender_host_aliases;
3117 while (*aliases)
3118 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3119 {
3120 case OK: return OK;
3121 case DEFER: return DEFER;
3122 }
3123 return FAIL;
3124 }
3125
3126
3127
3128
3129 /*************************************************
3130 * Check a specific host matches a host list *
3131 *************************************************/
3132
3133 /* This function is passed a host list containing items in a number of
3134 different formats and the identity of a host. Its job is to determine whether
3135 the given host is in the set of hosts defined by the list. The host name is
3136 passed as a pointer so that it can be looked up if needed and not already
3137 known. This is commonly the case when called from verify_check_host() to check
3138 an incoming connection. When called from elsewhere the host name should usually
3139 be set.
3140
3141 This function is now just a front end to match_check_list(), which runs common
3142 code for scanning a list. We pass it the check_host() function to perform a
3143 single test.
3144
3145 Arguments:
3146 listptr pointer to the host list
3147 cache_bits pointer to cache for named lists, or NULL
3148 host_name the host name or NULL, implying use sender_host_name and
3149 sender_host_aliases, looking them up if required
3150 host_address the IP address
3151 valueptr if not NULL, data from a lookup is passed back here
3152
3153 Returns: OK if the host is in the defined set
3154 FAIL if the host is not in the defined set,
3155 DEFER if a data lookup deferred (not a host lookup)
3156
3157 If the host name was needed in order to make a comparison, and could not be
3158 determined from the IP address, the result is FAIL unless the item
3159 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3160
3161 int
3162 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3163 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3164 {
3165 int rc;
3166 unsigned int *local_cache_bits = cache_bits;
3167 const uschar *save_host_address = deliver_host_address;
3168 check_host_block cb = { .host_name = host_name, .host_address = host_address };
3169
3170 if (valueptr) *valueptr = NULL;
3171
3172 /* If the host address starts off ::ffff: it is an IPv6 address in
3173 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3174 addresses. */
3175
3176 cb.host_ipv4 = Ustrncmp(host_address, "::ffff:", 7) == 0
3177 ? host_address + 7 : host_address;
3178
3179 /* During the running of the check, put the IP address into $host_address. In
3180 the case of calls from the smtp transport, it will already be there. However,
3181 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3182 the safe side, any existing setting is preserved, though as I write this
3183 (November 2004) I can't see any cases where it is actually needed. */
3184
3185 deliver_host_address = host_address;
3186 rc = match_check_list(
3187 listptr, /* the list */
3188 0, /* separator character */
3189 &hostlist_anchor, /* anchor pointer */
3190 &local_cache_bits, /* cache pointer */
3191 check_host, /* function for testing */
3192 &cb, /* argument for function */
3193 MCL_HOST, /* type of check */
3194 (host_address == sender_host_address)?
3195 US"host" : host_address, /* text for debugging */
3196 valueptr); /* where to pass back data */
3197 deliver_host_address = save_host_address;
3198 return rc;
3199 }
3200
3201
3202
3203
3204 /*************************************************
3205 * Check the given host item matches a list *
3206 *************************************************/
3207 int
3208 verify_check_given_host(uschar **listptr, host_item *host)
3209 {
3210 return verify_check_this_host(CUSS listptr, NULL, host->name, host->address, NULL);
3211 }
3212
3213 /*************************************************
3214 * Check the remote host matches a list *
3215 *************************************************/
3216
3217 /* This is a front end to verify_check_this_host(), created because checking
3218 the remote host is a common occurrence. With luck, a good compiler will spot
3219 the tail recursion and optimize it. If there's no host address, this is
3220 command-line SMTP input - check against an empty string for the address.
3221
3222 Arguments:
3223 listptr pointer to the host list
3224
3225 Returns: the yield of verify_check_this_host(),
3226 i.e. OK, FAIL, or DEFER
3227 */
3228
3229 int
3230 verify_check_host(uschar **listptr)
3231 {
3232 return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
3233 (sender_host_address == NULL)? US"" : sender_host_address, NULL);
3234 }
3235
3236
3237
3238
3239
3240 /*************************************************
3241 * Invert an IP address *
3242 *************************************************/
3243
3244 /* Originally just used for DNS xBL lists, now also used for the
3245 reverse_ip expansion operator.
3246
3247 Arguments:
3248 buffer where to put the answer
3249 address the address to invert
3250 */
3251
3252 void
3253 invert_address(uschar *buffer, uschar *address)
3254 {
3255 int bin[4];
3256 uschar *bptr = buffer;
3257
3258 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3259 to the IPv4 part only. */
3260
3261 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3262
3263 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3264 always 1. */
3265
3266 if (host_aton(address, bin) == 1)
3267 {
3268 int i;
3269 int x = bin[0];
3270 for (i = 0; i < 4; i++)
3271 {
3272 sprintf(CS bptr, "%d.", x & 255);
3273 while (*bptr) bptr++;
3274 x >>= 8;
3275 }
3276 }
3277
3278 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3279 in any DNS black lists, and the format in which they will be looked up is
3280 unknown. This is just a guess. */
3281
3282 #if HAVE_IPV6
3283 else
3284 {
3285 int i, j;
3286 for (j = 3; j >= 0; j--)
3287 {
3288 int x = bin[j];
3289 for (i = 0; i < 8; i++)
3290 {
3291 sprintf(CS bptr, "%x.", x & 15);
3292 while (*bptr) bptr++;
3293 x >>= 4;
3294 }
3295 }
3296 }
3297 #endif
3298
3299 /* Remove trailing period -- this is needed so that both arbitrary
3300 dnsbl keydomains and inverted addresses may be combined with the
3301 same format string, "%s.%s" */
3302
3303 *(--bptr) = 0;
3304 }
3305
3306
3307
3308 /*************************************************
3309 * Perform a single dnsbl lookup *
3310 *************************************************/
3311
3312 /* This function is called from verify_check_dnsbl() below. It is also called
3313 recursively from within itself when domain and domain_txt are different
3314 pointers, in order to get the TXT record from the alternate domain.
3315
3316 Arguments:
3317 domain the outer dnsbl domain
3318 domain_txt alternate domain to lookup TXT record on success; when the
3319 same domain is to be used, domain_txt == domain (that is,
3320 the pointers must be identical, not just the text)
3321 keydomain the current keydomain (for debug message)
3322 prepend subdomain to lookup (like keydomain, but
3323 reversed if IP address)
3324 iplist the list of matching IP addresses, or NULL for "any"
3325 bitmask true if bitmask matching is wanted
3326 match_type condition for 'succeed' result
3327 0 => Any RR in iplist (=)
3328 1 => No RR in iplist (!=)
3329 2 => All RRs in iplist (==)
3330 3 => Some RRs not in iplist (!==)
3331 the two bits are defined as MT_NOT and MT_ALL
3332 defer_return what to return for a defer
3333
3334 Returns: OK if lookup succeeded
3335 FAIL if not
3336 */
3337
3338 static int
3339 one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain,
3340 uschar *prepend, uschar *iplist, BOOL bitmask, int match_type,
3341 int defer_return)
3342 {
3343 dns_answer dnsa;
3344 dns_scan dnss;
3345 tree_node *t;
3346 dnsbl_cache_block *cb;
3347 int old_pool = store_pool;
3348 uschar query[256]; /* DNS domain max length */
3349
3350 /* Construct the specific query domainname */
3351
3352 if (!string_format(query, sizeof(query), "%s.%s", prepend, domain))
3353 {
3354 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
3355 "(ignored): %s...", query);
3356 return FAIL;
3357 }
3358
3359 /* Look for this query in the cache. */
3360
3361 if ( (t = tree_search(dnsbl_cache, query))
3362 && (cb = t->data.ptr)->expiry > time(NULL)
3363 )
3364
3365 /* Previous lookup was cached */
3366
3367 {
3368 HDEBUG(D_dnsbl) debug_printf("using result of previous DNS lookup\n");
3369 }
3370
3371 /* If not cached from a previous lookup, we must do a DNS lookup, and
3372 cache the result in permanent memory. */
3373
3374 else
3375 {
3376 uint ttl = 3600;
3377
3378 store_pool = POOL_PERM;
3379
3380 if (t)
3381 {
3382 HDEBUG(D_dnsbl) debug_printf("cached data found but past valid time; ");
3383 }
3384
3385 else
3386 { /* Set up a tree entry to cache the lookup */
3387 t = store_get(sizeof(tree_node) + Ustrlen(query));
3388 Ustrcpy(t->name, query);
3389 t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block));
3390 (void)tree_insertnode(&dnsbl_cache, t);
3391 }
3392
3393 /* Do the DNS lookup . */
3394
3395 HDEBUG(D_dnsbl) debug_printf("new DNS lookup for %s\n", query);
3396 cb->rc = dns_basic_lookup(&dnsa, query, T_A);
3397 cb->text_set = FALSE;
3398 cb->text = NULL;
3399 cb->rhs = NULL;
3400
3401 /* If the lookup succeeded, cache the RHS address. The code allows for
3402 more than one address - this was for complete generality and the possible
3403 use of A6 records. However, A6 records have been reduced to experimental
3404 status (August 2001) and may die out. So they may never get used at all,
3405 let alone in dnsbl records. However, leave the code here, just in case.
3406
3407 Quite apart from one A6 RR generating multiple addresses, there are DNS
3408 lists that return more than one A record, so we must handle multiple
3409 addresses generated in that way as well.
3410
3411 Mark the cache entry with the "now" plus the minimum of the address TTLs,
3412 or some suitably far-future time if none were found. */
3413
3414 if (cb->rc == DNS_SUCCEED)
3415 {
3416 dns_record *rr;
3417 dns_address **addrp = &(cb->rhs);
3418 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
3419 rr;
3420 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
3421 if (rr->type == T_A)
3422 {
3423 dns_address *da = dns_address_from_rr(&dnsa, rr);
3424 if (da)
3425 {
3426 *addrp = da;
3427 while (da->next) da = da->next;
3428 addrp = &da->next;
3429 if (ttl > rr->ttl) ttl = rr->ttl;
3430 }
3431 }
3432
3433 /* If we didn't find any A records, change the return code. This can
3434 happen when there is a CNAME record but there are no A records for what
3435 it points to. */
3436
3437 if (!cb->rhs) cb->rc = DNS_NODATA;
3438 }
3439
3440 cb->expiry = time(NULL)+ttl;
3441 store_pool = old_pool;
3442 }
3443
3444 /* We now have the result of the DNS lookup, either newly done, or cached
3445 from a previous call. If the lookup succeeded, check against the address
3446 list if there is one. This may be a positive equality list (introduced by
3447 "="), a negative equality list (introduced by "!="), a positive bitmask
3448 list (introduced by "&"), or a negative bitmask list (introduced by "!&").*/
3449
3450 if (cb->rc == DNS_SUCCEED)
3451 {
3452 dns_address *da = NULL;
3453 uschar *addlist = cb->rhs->address;
3454
3455 /* For A and AAAA records, there may be multiple addresses from multiple
3456 records. For A6 records (currently not expected to be used) there may be
3457 multiple addresses from a single record. */
3458
3459 for (da = cb->rhs->next; da; da = da->next)
3460 addlist = string_sprintf("%s, %s", addlist, da->address);
3461
3462 HDEBUG(D_dnsbl) debug_printf("DNS lookup for %s succeeded (yielding %s)\n",
3463 query, addlist);
3464
3465 /* Address list check; this can be either for equality, or via a bitmask.
3466 In the latter case, all the bits must match. */
3467
3468 if (iplist)
3469 {
3470 for (da = cb->rhs; da; da = da->next)
3471 {
3472 int ipsep = ',';
3473 uschar ip[46];
3474 const uschar *ptr = iplist;
3475 uschar *res;
3476
3477 /* Handle exact matching */
3478
3479 if (!bitmask)
3480 {
3481 while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip))))
3482 if (Ustrcmp(CS da->address, ip) == 0)
3483 break;
3484 }
3485
3486 /* Handle bitmask matching */
3487
3488 else
3489 {
3490 int address[4];
3491 int mask = 0;
3492
3493 /* At present, all known DNS blocking lists use A records, with
3494 IPv4 addresses on the RHS encoding the information they return. I
3495 wonder if this will linger on as the last vestige of IPv4 when IPv6
3496 is ubiquitous? Anyway, for now we use paranoia code to completely
3497 ignore IPv6 addresses. The default mask is 0, which always matches.
3498 We change this only for IPv4 addresses in the list. */
3499
3500 if (host_aton(da->address, address) == 1) mask = address[0];
3501
3502 /* Scan the returned addresses, skipping any that are IPv6 */
3503
3504 while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip))))
3505 {
3506 if (host_aton(ip, address) != 1) continue;
3507 if ((address[0] & mask) == address[0]) break;
3508 }
3509 }
3510
3511 /* If either
3512
3513 (a) An IP address in an any ('=') list matched, or
3514 (b) No IP address in an all ('==') list matched
3515
3516 then we're done searching. */
3517
3518 if (((match_type & MT_ALL) != 0) == (res == NULL)) break;
3519 }
3520
3521 /* If da == NULL, either
3522
3523 (a) No IP address in an any ('=') list matched, or
3524 (b) An IP address in an all ('==') list didn't match
3525
3526 so behave as if the DNSBL lookup had not succeeded, i.e. the host is not on
3527 the list. */
3528
3529 if ((match_type == MT_NOT || match_type == MT_ALL) != (da == NULL))
3530 {
3531 HDEBUG(D_dnsbl)
3532 {
3533 uschar *res = NULL;
3534 switch(match_type)
3535 {
3536 case 0:
3537 res = US"was no match"; break;
3538 case MT_NOT:
3539 res = US"was an exclude match"; break;
3540 case MT_ALL:
3541 res = US"was an IP address that did not match"; break;
3542 case MT_NOT|MT_ALL:
3543 res = US"were no IP addresses that did not match"; break;
3544 }
3545 debug_printf("=> but we are not accepting this block class because\n");
3546 debug_printf("=> there %s for %s%c%s\n",
3547 res,
3548 ((match_type & MT_ALL) == 0)? "" : "=",
3549 bitmask? '&' : '=', iplist);
3550 }
3551 return FAIL;
3552 }
3553 }
3554
3555 /* Either there was no IP list, or the record matched, implying that the
3556 domain is on the list. We now want to find a corresponding TXT record. If an
3557 alternate domain is specified for the TXT record, call this function
3558 recursively to look that up; this has the side effect of re-checking that
3559 there is indeed an A record at the alternate domain. */
3560
3561 if (domain_txt != domain)
3562 return one_check_dnsbl(domain_txt, domain_txt, keydomain, prepend, NULL,
3563 FALSE, match_type, defer_return);
3564
3565 /* If there is no alternate domain, look up a TXT record in the main domain
3566 if it has not previously been cached. */
3567
3568 if (!cb->text_set)
3569 {
3570 cb->text_set = TRUE;
3571 if (dns_basic_lookup(&dnsa, query, T_TXT) == DNS_SUCCEED)
3572 {
3573 dns_record *rr;
3574 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
3575 rr;
3576 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
3577 if (rr->type == T_TXT) break;
3578 if (rr)
3579 {
3580 int len = (rr->data)[0];
3581 if (len > 511) len = 127;
3582 store_pool = POOL_PERM;
3583 cb->text = string_sprintf("%.*s", len, CUS (rr->data+1));
3584 store_pool = old_pool;
3585 }
3586 }
3587 }
3588
3589 dnslist_value = addlist;
3590 dnslist_text = cb->text;
3591 return OK;
3592 }
3593
3594 /* There was a problem with the DNS lookup */
3595
3596 if (cb->rc != DNS_NOMATCH && cb->rc != DNS_NODATA)
3597 {
3598 log_write(L_dnslist_defer, LOG_MAIN,
3599 "DNS list lookup defer (probably timeout) for %s: %s", query,
3600 (defer_return == OK)? US"assumed in list" :
3601 (defer_return == FAIL)? US"assumed not in list" :
3602 US"returned DEFER");
3603 return defer_return;
3604 }
3605
3606 /* No entry was found in the DNS; continue for next domain */
3607
3608 HDEBUG(D_dnsbl)
3609 {
3610 debug_printf("DNS lookup for %s failed\n", query);
3611 debug_printf("=> that means %s is not listed at %s\n",
3612 keydomain, domain);
3613 }
3614
3615 return FAIL;
3616 }
3617
3618
3619
3620
3621 /*************************************************
3622 * Check host against DNS black lists *
3623 *************************************************/
3624
3625 /* This function runs checks against a list of DNS black lists, until one
3626 matches. Each item on the list can be of the form
3627
3628 domain=ip-address/key
3629
3630 The domain is the right-most domain that is used for the query, for example,
3631 blackholes.mail-abuse.org. If the IP address is present, there is a match only
3632 if the DNS lookup returns a matching IP address. Several addresses may be
3633 given, comma-separated, for example: x.y.z=127.0.0.1,127.0.0.2.
3634
3635 If no key is given, what is looked up in the domain is the inverted IP address
3636 of the current client host. If a key is given, it is used to construct the
3637 domain for the lookup. For example:
3638
3639 dsn.rfc-ignorant.org/$sender_address_domain
3640
3641 After finding a match in the DNS, the domain is placed in $dnslist_domain, and
3642 then we check for a TXT record for an error message, and if found, save its
3643 value in $dnslist_text. We also cache everything in a tree, to optimize
3644 multiple lookups.
3645
3646 The TXT record is normally looked up in the same domain as the A record, but
3647 when many lists are combined in a single DNS domain, this will not be a very
3648 specific message. It is possible to specify a different domain for looking up
3649 TXT records; this is given before the main domain, comma-separated. For
3650 example:
3651
3652 dnslists = http.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.2 : \
3653 socks.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.3
3654
3655 The caching ensures that only one lookup in dnsbl.sorbs.net is done.
3656
3657 Note: an address for testing RBL is 192.203.178.39
3658 Note: an address for testing DUL is 192.203.178.4
3659 Note: a domain for testing RFCI is example.tld.dsn.rfc-ignorant.org
3660
3661 Arguments:
3662 where the acl type
3663 listptr the domain/address/data list
3664 log_msgptr log message on error
3665
3666 Returns: OK successful lookup (i.e. the address is on the list), or
3667 lookup deferred after +include_unknown
3668 FAIL name not found, or no data found for the given type, or
3669 lookup deferred after +exclude_unknown (default)
3670 DEFER lookup failure, if +defer_unknown was set
3671 */
3672
3673 int
3674 verify_check_dnsbl(int where, const uschar ** listptr, uschar ** log_msgptr)
3675 {
3676 int sep = 0;
3677 int defer_return = FAIL;
3678 const uschar *list = *listptr;
3679 uschar *domain;
3680 uschar *s;
3681 uschar buffer[1024];
3682 uschar revadd[128]; /* Long enough for IPv6 address */
3683
3684 /* Indicate that the inverted IP address is not yet set up */
3685
3686 revadd[0] = 0;
3687
3688 /* In case this is the first time the DNS resolver is being used. */
3689
3690 dns_init(FALSE, FALSE, FALSE); /*XXX dnssec? */
3691
3692 /* Loop through all the domains supplied, until something matches */
3693
3694 while ((domain = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
3695 {
3696 int rc;
3697 BOOL bitmask = FALSE;
3698 int match_type = 0;
3699 uschar *domain_txt;
3700 uschar *comma;
3701 uschar *iplist;
3702 uschar *key;
3703
3704 HDEBUG(D_dnsbl) debug_printf("DNS list check: %s\n", domain);
3705
3706 /* Deal with special values that change the behaviour on defer */
3707
3708 if (domain[0] == '+')
3709 {
3710 if (strcmpic(domain, US"+include_unknown") == 0) defer_return = OK;
3711 else if (strcmpic(domain, US"+exclude_unknown") == 0) defer_return = FAIL;
3712 else if (strcmpic(domain, US"+defer_unknown") == 0) defer_return = DEFER;
3713 else
3714 log_write(0, LOG_MAIN|LOG_PANIC, "unknown item in dnslist (ignored): %s",
3715 domain);
3716 continue;
3717 }
3718
3719 /* See if there's explicit data to be looked up */
3720
3721 if ((key = Ustrchr(domain, '/'))) *key++ = 0;
3722
3723 /* See if there's a list of addresses supplied after the domain name. This is
3724 introduced by an = or a & character; if preceded by = we require all matches
3725 and if preceded by ! we invert the result. */
3726
3727 if (!(iplist = Ustrchr(domain, '=')))
3728 {
3729 bitmask = TRUE;
3730 iplist = Ustrchr(domain, '&');
3731 }
3732
3733 if (iplist) /* Found either = or & */
3734 {
3735 if (iplist > domain && iplist[-1] == '!') /* Handle preceding ! */
3736 {
3737 match_type |= MT_NOT;
3738 iplist[-1] = 0;
3739 }
3740
3741 *iplist++ = 0; /* Terminate domain, move on */
3742
3743 /* If we found = (bitmask == FALSE), check for == or =& */
3744
3745 if (!bitmask && (*iplist == '=' || *iplist == '&'))
3746 {
3747 bitmask = *iplist++ == '&';
3748 match_type |= MT_ALL;
3749 }
3750 }
3751
3752
3753 /* If there is a comma in the domain, it indicates that a second domain for
3754 looking up TXT records is provided, before the main domain. Otherwise we must
3755 set domain_txt == domain. */
3756
3757 domain_txt = domain;
3758 comma = Ustrchr(domain, ',');
3759 if (comma != NULL)
3760 {
3761 *comma++ = 0;
3762 domain = comma;
3763 }
3764
3765 /* Check that what we have left is a sensible domain name. There is no reason
3766 why these domains should in fact use the same syntax as hosts and email
3767 domains, but in practice they seem to. However, there is little point in
3768 actually causing an error here, because that would no doubt hold up incoming
3769 mail. Instead, I'll just log it. */
3770
3771 for (s = domain; *s != 0; s++)
3772 {
3773 if (!isalnum(*s) && *s != '-' && *s != '.' && *s != '_')
3774 {
3775 log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains "
3776 "strange characters - is this right?", domain);
3777 break;
3778 }
3779 }
3780
3781 /* Check the alternate domain if present */
3782
3783 if (domain_txt != domain) for (s = domain_txt; *s != 0; s++)
3784 {
3785 if (!isalnum(*s) && *s != '-' && *s != '.' && *s != '_')
3786 {
3787 log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains "
3788 "strange characters - is this right?", domain_txt);
3789 break;
3790 }
3791 }
3792
3793 /* If there is no key string, construct the query by adding the domain name
3794 onto the inverted host address, and perform a single DNS lookup. */
3795
3796 if (key == NULL)
3797 {
3798 if (where == ACL_WHERE_NOTSMTP_START || where == ACL_WHERE_NOTSMTP)
3799 {
3800 *log_msgptr = string_sprintf
3801 ("cannot test auto-keyed dnslists condition in %s ACL",
3802 acl_wherenames[where]);
3803 return ERROR;
3804 }
3805 if (sender_host_address == NULL) return FAIL; /* can never match */
3806 if (revadd[0] == 0) invert_address(revadd, sender_host_address);
3807 rc = one_check_dnsbl(domain, domain_txt, sender_host_address, revadd,
3808 iplist, bitmask, match_type, defer_return);
3809 if (rc == OK)
3810 {
3811 dnslist_domain = string_copy(domain_txt);
3812 dnslist_matched = string_copy(sender_host_address);
3813 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
3814 sender_host_address, dnslist_domain);
3815 }
3816 if (rc != FAIL) return rc; /* OK or DEFER */
3817 }
3818
3819 /* If there is a key string, it can be a list of domains or IP addresses to
3820 be concatenated with the main domain. */
3821
3822 else
3823 {
3824 int keysep = 0;
3825 BOOL defer = FALSE;
3826 uschar *keydomain;
3827 uschar keybuffer[256];
3828 uschar keyrevadd[128];
3829
3830 while ((keydomain = string_nextinlist(CUSS &key, &keysep, keybuffer,
3831 sizeof(keybuffer))) != NULL)
3832 {
3833 uschar *prepend = keydomain;
3834
3835 if (string_is_ip_address(keydomain, NULL) != 0)
3836 {
3837 invert_address(keyrevadd, keydomain);
3838 prepend = keyrevadd;
3839 }
3840
3841 rc = one_check_dnsbl(domain, domain_txt, keydomain, prepend, iplist,
3842 bitmask, match_type, defer_return);
3843
3844 if (rc == OK)
3845 {
3846 dnslist_domain = string_copy(domain_txt);
3847 dnslist_matched = string_copy(keydomain);
3848 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
3849 keydomain, dnslist_domain);
3850 return OK;
3851 }
3852
3853 /* If the lookup deferred, remember this fact. We keep trying the rest
3854 of the list to see if we get a useful result, and if we don't, we return
3855 DEFER at the end. */
3856
3857 if (rc == DEFER) defer = TRUE;
3858 } /* continue with next keystring domain/address */
3859
3860 if (defer) return DEFER;
3861 }
3862 } /* continue with next dnsdb outer domain */
3863
3864 return FAIL;
3865 }
3866
3867 /* vi: aw ai sw=2
3868 */
3869 /* End of verify.c */