720f85d8ce7f537539bde311acdd7ab6bb60937c
[exim.git] / src / src / verify.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions concerned with verifying things. The original code for callout
9 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
10
11
12 #include "exim.h"
13 #include "transports/smtp.h"
14
15 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
17 static smtp_context ctctx;
18 uschar ctbuffer[8192];
19
20
21 /* Structure for caching DNSBL lookups */
22
23 typedef struct dnsbl_cache_block {
24 time_t expiry;
25 dns_address *rhs;
26 uschar *text;
27 int rc;
28 BOOL text_set;
29 } dnsbl_cache_block;
30
31
32 /* Anchor for DNSBL cache */
33
34 static tree_node *dnsbl_cache = NULL;
35
36
37 /* Bits for match_type in one_check_dnsbl() */
38
39 #define MT_NOT 1
40 #define MT_ALL 2
41
42 static uschar cutthrough_response(client_conn_ctx *, char, uschar **, int);
43
44
45
46 /*************************************************
47 * Retrieve a callout cache record *
48 *************************************************/
49
50 /* If a record exists, check whether it has expired.
51
52 Arguments:
53 dbm_file an open hints file
54 key the record key
55 type "address" or "domain"
56 positive_expire expire time for positive records
57 negative_expire expire time for negative records
58
59 Returns: the cache record if a non-expired one exists, else NULL
60 */
61
62 static dbdata_callout_cache *
63 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
64 int positive_expire, int negative_expire)
65 {
66 BOOL negative;
67 int length, expire;
68 time_t now;
69 dbdata_callout_cache *cache_record;
70
71 if (!(cache_record = dbfn_read_with_length(dbm_file, key, &length)))
72 {
73 HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
74 return NULL;
75 }
76
77 /* We treat a record as "negative" if its result field is not positive, or if
78 it is a domain record and the postmaster field is negative. */
79
80 negative = cache_record->result != ccache_accept ||
81 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
82 expire = negative? negative_expire : positive_expire;
83 now = time(NULL);
84
85 if (now - cache_record->time_stamp > expire)
86 {
87 HDEBUG(D_verify) debug_printf("callout cache: %s record expired for %s\n", type, key);
88 return NULL;
89 }
90
91 /* If this is a non-reject domain record, check for the obsolete format version
92 that doesn't have the postmaster and random timestamps, by looking at the
93 length. If so, copy it to a new-style block, replicating the record's
94 timestamp. Then check the additional timestamps. (There's no point wasting
95 effort if connections are rejected.) */
96
97 if (type[0] == 'd' && cache_record->result != ccache_reject)
98 {
99 if (length == sizeof(dbdata_callout_cache_obs))
100 {
101 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
102 memcpy(new, cache_record, length);
103 new->postmaster_stamp = new->random_stamp = new->time_stamp;
104 cache_record = new;
105 }
106
107 if (now - cache_record->postmaster_stamp > expire)
108 cache_record->postmaster_result = ccache_unknown;
109
110 if (now - cache_record->random_stamp > expire)
111 cache_record->random_result = ccache_unknown;
112 }
113
114 HDEBUG(D_verify) debug_printf("callout cache: found %s record for %s\n", type, key);
115 return cache_record;
116 }
117
118
119
120 /* Check the callout cache.
121 Options * pm_mailfrom may be modified by cache partial results.
122
123 Return: TRUE if result found
124 */
125
126 static BOOL
127 cached_callout_lookup(address_item * addr, uschar * address_key,
128 uschar * from_address, int * opt_ptr, uschar ** pm_ptr,
129 int * yield, uschar ** failure_ptr,
130 dbdata_callout_cache * new_domain_record, int * old_domain_res)
131 {
132 int options = *opt_ptr;
133 open_db dbblock;
134 open_db *dbm_file = NULL;
135
136 /* Open the callout cache database, it it exists, for reading only at this
137 stage, unless caching has been disabled. */
138
139 if (options & vopt_callout_no_cache)
140 {
141 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
142 }
143 else if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
144 {
145 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
146 }
147 else
148 {
149 /* If a cache database is available see if we can avoid the need to do an
150 actual callout by making use of previously-obtained data. */
151
152 dbdata_callout_cache_address * cache_address_record;
153 dbdata_callout_cache * cache_record = get_callout_cache_record(dbm_file,
154 addr->domain, US"domain",
155 callout_cache_domain_positive_expire, callout_cache_domain_negative_expire);
156
157 /* If an unexpired cache record was found for this domain, see if the callout
158 process can be short-circuited. */
159
160 if (cache_record)
161 {
162 /* In most cases, if an early command (up to and including MAIL FROM:<>)
163 was rejected, there is no point carrying on. The callout fails. However, if
164 we are doing a recipient verification with use_sender or use_postmaster
165 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
166 will be using a non-empty sender. We have to remember this situation so as
167 not to disturb the cached domain value if this whole verification succeeds
168 (we don't want it turning into "accept"). */
169
170 *old_domain_res = cache_record->result;
171
172 if ( cache_record->result == ccache_reject
173 || *from_address == 0 && cache_record->result == ccache_reject_mfnull)
174 {
175 HDEBUG(D_verify)
176 debug_printf("callout cache: domain gave initial rejection, or "
177 "does not accept HELO or MAIL FROM:<>\n");
178 setflag(addr, af_verify_nsfail);
179 addr->user_message = US"(result of an earlier callout reused).";
180 *yield = FAIL;
181 *failure_ptr = US"mail";
182 dbfn_close(dbm_file);
183 return TRUE;
184 }
185
186 /* If a previous check on a "random" local part was accepted, we assume
187 that the server does not do any checking on local parts. There is therefore
188 no point in doing the callout, because it will always be successful. If a
189 random check previously failed, arrange not to do it again, but preserve
190 the data in the new record. If a random check is required but hasn't been
191 done, skip the remaining cache processing. */
192
193 if (options & vopt_callout_random) switch(cache_record->random_result)
194 {
195 case ccache_accept:
196 HDEBUG(D_verify)
197 debug_printf("callout cache: domain accepts random addresses\n");
198 *failure_ptr = US"random";
199 dbfn_close(dbm_file);
200 return TRUE; /* Default yield is OK */
201
202 case ccache_reject:
203 HDEBUG(D_verify)
204 debug_printf("callout cache: domain rejects random addresses\n");
205 *opt_ptr = options & ~vopt_callout_random;
206 new_domain_record->random_result = ccache_reject;
207 new_domain_record->random_stamp = cache_record->random_stamp;
208 break;
209
210 default:
211 HDEBUG(D_verify)
212 debug_printf("callout cache: need to check random address handling "
213 "(not cached or cache expired)\n");
214 dbfn_close(dbm_file);
215 return FALSE;
216 }
217
218 /* If a postmaster check is requested, but there was a previous failure,
219 there is again no point in carrying on. If a postmaster check is required,
220 but has not been done before, we are going to have to do a callout, so skip
221 remaining cache processing. */
222
223 if (*pm_ptr)
224 {
225 if (cache_record->postmaster_result == ccache_reject)
226 {
227 setflag(addr, af_verify_pmfail);
228 HDEBUG(D_verify)
229 debug_printf("callout cache: domain does not accept "
230 "RCPT TO:<postmaster@domain>\n");
231 *yield = FAIL;
232 *failure_ptr = US"postmaster";
233 setflag(addr, af_verify_pmfail);
234 addr->user_message = US"(result of earlier verification reused).";
235 dbfn_close(dbm_file);
236 return TRUE;
237 }
238 if (cache_record->postmaster_result == ccache_unknown)
239 {
240 HDEBUG(D_verify)
241 debug_printf("callout cache: need to check RCPT "
242 "TO:<postmaster@domain> (not cached or cache expired)\n");
243 dbfn_close(dbm_file);
244 return FALSE;
245 }
246
247 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
248 postmaster check if the address itself has to be checked. Also ensure
249 that the value in the cache record is preserved (with its old timestamp).
250 */
251
252 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
253 "TO:<postmaster@domain>\n");
254 *pm_ptr = NULL;
255 new_domain_record->postmaster_result = ccache_accept;
256 new_domain_record->postmaster_stamp = cache_record->postmaster_stamp;
257 }
258 }
259
260 /* We can't give a result based on information about the domain. See if there
261 is an unexpired cache record for this specific address (combined with the
262 sender address if we are doing a recipient callout with a non-empty sender).
263 */
264
265 if (!(cache_address_record = (dbdata_callout_cache_address *)
266 get_callout_cache_record(dbm_file, address_key, US"address",
267 callout_cache_positive_expire, callout_cache_negative_expire)))
268 {
269 dbfn_close(dbm_file);
270 return FALSE;
271 }
272
273 if (cache_address_record->result == ccache_accept)
274 {
275 HDEBUG(D_verify)
276 debug_printf("callout cache: address record is positive\n");
277 }
278 else
279 {
280 HDEBUG(D_verify)
281 debug_printf("callout cache: address record is negative\n");
282 addr->user_message = US"Previous (cached) callout verification failure";
283 *failure_ptr = US"recipient";
284 *yield = FAIL;
285 }
286
287 /* Close the cache database while we actually do the callout for real. */
288
289 dbfn_close(dbm_file);
290 return TRUE;
291 }
292 return FALSE;
293 }
294
295
296 /* Write results to callout cache
297 */
298 static void
299 cache_callout_write(dbdata_callout_cache * dom_rec, const uschar * domain,
300 int done, dbdata_callout_cache_address * addr_rec, uschar * address_key)
301 {
302 open_db dbblock;
303 open_db *dbm_file = NULL;
304
305 /* If we get here with done == TRUE, a successful callout happened, and yield
306 will be set OK or FAIL according to the response to the RCPT command.
307 Otherwise, we looped through the hosts but couldn't complete the business.
308 However, there may be domain-specific information to cache in both cases.
309
310 The value of the result field in the new_domain record is ccache_unknown if
311 there was an error before or with MAIL FROM:, and errno was not zero,
312 implying some kind of I/O error. We don't want to write the cache in that case.
313 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
314
315 if (dom_rec->result != ccache_unknown)
316 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
317 {
318 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
319 }
320 else
321 {
322 (void)dbfn_write(dbm_file, domain, dom_rec,
323 (int)sizeof(dbdata_callout_cache));
324 HDEBUG(D_verify) debug_printf("wrote callout cache domain record for %s:\n"
325 " result=%d postmaster=%d random=%d\n",
326 domain,
327 dom_rec->result,
328 dom_rec->postmaster_result,
329 dom_rec->random_result);
330 }
331
332 /* If a definite result was obtained for the callout, cache it unless caching
333 is disabled. */
334
335 if (done && addr_rec->result != ccache_unknown)
336 {
337 if (!dbm_file)
338 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE);
339 if (!dbm_file)
340 {
341 HDEBUG(D_verify) debug_printf("no callout cache available\n");
342 }
343 else
344 {
345 (void)dbfn_write(dbm_file, address_key, addr_rec,
346 (int)sizeof(dbdata_callout_cache_address));
347 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record for %s\n",
348 addr_rec->result == ccache_accept ? "positive" : "negative",
349 address_key);
350 }
351 }
352
353 if (dbm_file) dbfn_close(dbm_file);
354 }
355
356
357 /* Cutthrough-multi. If the existing cached cutthrough connection matches
358 the one we would make for a subsequent recipient, use it. Send the RCPT TO
359 and check the result, nonpipelined as it may be wanted immediately for
360 recipient-verification.
361
362 It seems simpler to deal with this case separately from the main callout loop.
363 We will need to remember it has sent, or not, so that rcpt-acl tail code
364 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
365
366 Return: TRUE for a definitive result for the recipient
367 */
368 static int
369 cutthrough_multi(address_item * addr, host_item * host_list,
370 transport_feedback * tf, int * yield)
371 {
372 BOOL done = FALSE;
373
374 if (addr->transport == cutthrough.addr.transport)
375 for (host_item * host = host_list; host; host = host->next)
376 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
377 {
378 int host_af;
379 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
380 int port = 25;
381
382 deliver_host = host->name;
383 deliver_host_address = host->address;
384 deliver_host_port = host->port;
385 deliver_domain = addr->domain;
386 transport_name = addr->transport->name;
387
388 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
389
390 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
391 US"callout")
392 || !smtp_get_port(tf->port, addr, &port, US"callout")
393 )
394 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
395 addr->message);
396
397 smtp_port_for_connect(host, port);
398
399 if ( ( interface == cutthrough.interface
400 || ( interface
401 && cutthrough.interface
402 && Ustrcmp(interface, cutthrough.interface) == 0
403 ) )
404 && host->port == cutthrough.host.port
405 )
406 {
407 uschar * resp = NULL;
408
409 /* Match! Send the RCPT TO, set done from the response */
410 done =
411 smtp_write_command(&ctctx, SCMD_FLUSH, "RCPT TO:<%.1000s>\r\n",
412 transport_rcpt_address(addr,
413 addr->transport->rcpt_include_affixes)) >= 0
414 && cutthrough_response(&cutthrough.cctx, '2', &resp,
415 CUTTHROUGH_DATA_TIMEOUT) == '2';
416
417 /* This would go horribly wrong if a callout fail was ignored by ACL.
418 We punt by abandoning cutthrough on a reject, like the
419 first-rcpt does. */
420
421 if (done)
422 {
423 address_item * na = store_get(sizeof(address_item));
424 *na = cutthrough.addr;
425 cutthrough.addr = *addr;
426 cutthrough.addr.host_used = &cutthrough.host;
427 cutthrough.addr.next = na;
428
429 cutthrough.nrcpt++;
430 }
431 else
432 {
433 cancel_cutthrough_connection(TRUE, US"recipient rejected");
434 if (!resp || errno == ETIMEDOUT)
435 {
436 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
437 }
438 else if (errno == 0)
439 {
440 if (*resp == 0)
441 Ustrcpy(resp, US"connection dropped");
442
443 addr->message =
444 string_sprintf("response to \"%s\" was: %s",
445 big_buffer, string_printing(resp));
446
447 addr->user_message =
448 string_sprintf("Callout verification failed:\n%s", resp);
449
450 /* Hard rejection ends the process */
451
452 if (resp[0] == '5') /* Address rejected */
453 {
454 *yield = FAIL;
455 done = TRUE;
456 }
457 }
458 }
459 }
460 break; /* host_list */
461 }
462 if (!done)
463 cancel_cutthrough_connection(TRUE, US"incompatible connection");
464 return done;
465 }
466
467
468 /*************************************************
469 * Do callout verification for an address *
470 *************************************************/
471
472 /* This function is called from verify_address() when the address has routed to
473 a host list, and a callout has been requested. Callouts are expensive; that is
474 why a cache is used to improve the efficiency.
475
476 Arguments:
477 addr the address that's been routed
478 host_list the list of hosts to try
479 tf the transport feedback block
480
481 ifstring "interface" option from transport, or NULL
482 portstring "port" option from transport, or NULL
483 protocolstring "protocol" option from transport, or NULL
484 callout the per-command callout timeout
485 callout_overall the overall callout timeout (if < 0 use 4*callout)
486 callout_connect the callout connection timeout (if < 0 use callout)
487 options the verification options - these bits are used:
488 vopt_is_recipient => this is a recipient address
489 vopt_callout_no_cache => don't use callout cache
490 vopt_callout_fullpm => if postmaster check, do full one
491 vopt_callout_random => do the "random" thing
492 vopt_callout_recipsender => use real sender for recipient
493 vopt_callout_recippmaster => use postmaster for recipient
494 vopt_callout_hold => lazy close connection
495 se_mailfrom MAIL FROM address for sender verify; NULL => ""
496 pm_mailfrom if non-NULL, do the postmaster check with this sender
497
498 Returns: OK/FAIL/DEFER
499 */
500
501 static int
502 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
503 int callout, int callout_overall, int callout_connect, int options,
504 uschar *se_mailfrom, uschar *pm_mailfrom)
505 {
506 int yield = OK;
507 int old_domain_cache_result = ccache_accept;
508 BOOL done = FALSE;
509 uschar *address_key;
510 uschar *from_address;
511 uschar *random_local_part = NULL;
512 const uschar *save_deliver_domain = deliver_domain;
513 uschar **failure_ptr = options & vopt_is_recipient
514 ? &recipient_verify_failure : &sender_verify_failure;
515 dbdata_callout_cache new_domain_record;
516 dbdata_callout_cache_address new_address_record;
517 time_t callout_start_time;
518
519 new_domain_record.result = ccache_unknown;
520 new_domain_record.postmaster_result = ccache_unknown;
521 new_domain_record.random_result = ccache_unknown;
522
523 memset(&new_address_record, 0, sizeof(new_address_record));
524
525 /* For a recipient callout, the key used for the address cache record must
526 include the sender address if we are using the real sender in the callout,
527 because that may influence the result of the callout. */
528
529 if (options & vopt_is_recipient)
530 if (options & vopt_callout_recipsender)
531 {
532 from_address = sender_address;
533 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
534 if (cutthrough.delivery) options |= vopt_callout_no_cache;
535 }
536 else if (options & vopt_callout_recippmaster)
537 {
538 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
539 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
540 qualify_domain_sender);
541 }
542 else
543 {
544 from_address = US"";
545 address_key = addr->address;
546 }
547
548 /* For a sender callout, we must adjust the key if the mailfrom address is not
549 empty. */
550
551 else
552 {
553 from_address = se_mailfrom ? se_mailfrom : US"";
554 address_key = *from_address
555 ? string_sprintf("%s/<%s>", addr->address, from_address) : addr->address;
556 }
557
558 if (cached_callout_lookup(addr, address_key, from_address,
559 &options, &pm_mailfrom, &yield, failure_ptr,
560 &new_domain_record, &old_domain_cache_result))
561 {
562 cancel_cutthrough_connection(TRUE, US"cache-hit");
563 goto END_CALLOUT;
564 }
565
566 if (!addr->transport)
567 {
568 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
569 }
570 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
571 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
572 addr->transport->name, addr->transport->driver_name);
573 else
574 {
575 smtp_transport_options_block *ob =
576 (smtp_transport_options_block *)addr->transport->options_block;
577
578 /* The information wasn't available in the cache, so we have to do a real
579 callout and save the result in the cache for next time, unless no_cache is set,
580 or unless we have a previously cached negative random result. If we are to test
581 with a random local part, ensure that such a local part is available. If not,
582 log the fact, but carry on without randomising. */
583
584 if (options & vopt_callout_random && callout_random_local_part)
585 if (!(random_local_part = expand_string(callout_random_local_part)))
586 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
587 "callout_random_local_part: %s", expand_string_message);
588
589 /* Default the connect and overall callout timeouts if not set, and record the
590 time we are starting so that we can enforce it. */
591
592 if (callout_overall < 0) callout_overall = 4 * callout;
593 if (callout_connect < 0) callout_connect = callout;
594 callout_start_time = time(NULL);
595
596 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
597 output because a callout might take some time. When PIPELINING is active and
598 there are many recipients, the total time for doing lots of callouts can add up
599 and cause the client to time out. So in this case we forgo the PIPELINING
600 optimization. */
601
602 if (smtp_out && !f.disable_callout_flush) mac_smtp_fflush();
603
604 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
605 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
606
607 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
608 and we are holding a cutthrough conn open, we can just append the rcpt to
609 that conn for verification purposes (and later delivery also). Simplest
610 coding means skipping this whole loop and doing the append separately. */
611
612 /* Can we re-use an open cutthrough connection? */
613 if ( cutthrough.cctx.sock >= 0
614 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
615 == vopt_callout_recipsender
616 && !random_local_part
617 && !pm_mailfrom
618 )
619 done = cutthrough_multi(addr, host_list, tf, &yield);
620
621 /* If we did not use a cached connection, make connections to the hosts
622 and do real callouts. The list of hosts is passed in as an argument. */
623
624 for (host_item * host = host_list; host && !done; host = host->next)
625 {
626 int host_af;
627 int port = 25;
628 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
629 smtp_context sx;
630
631 if (!host->address)
632 {
633 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
634 host->name);
635 continue;
636 }
637
638 /* Check the overall callout timeout */
639
640 if (time(NULL) - callout_start_time >= callout_overall)
641 {
642 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
643 break;
644 }
645
646 /* Set IPv4 or IPv6 */
647
648 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
649
650 /* Expand and interpret the interface and port strings. The latter will not
651 be used if there is a host-specific port (e.g. from a manualroute router).
652 This has to be delayed till now, because they may expand differently for
653 different hosts. If there's a failure, log it, but carry on with the
654 defaults. */
655
656 deliver_host = host->name;
657 deliver_host_address = host->address;
658 deliver_host_port = host->port;
659 deliver_domain = addr->domain;
660 transport_name = addr->transport->name;
661
662 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
663 US"callout")
664 || !smtp_get_port(tf->port, addr, &port, US"callout")
665 )
666 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
667 addr->message);
668
669 sx.addrlist = addr;
670 sx.conn_args.host = host;
671 sx.conn_args.host_af = host_af,
672 sx.port = port;
673 sx.conn_args.interface = interface;
674 sx.helo_data = tf->helo_data;
675 sx.conn_args.tblock = addr->transport;
676 sx.verify = TRUE;
677
678 tls_retry_connection:
679 /* Set the address state so that errors are recorded in it */
680
681 addr->transport_return = PENDING_DEFER;
682 ob->connect_timeout = callout_connect;
683 ob->command_timeout = callout;
684
685 /* Get the channel set up ready for a message (MAIL FROM being the next
686 SMTP command to send. If we tried TLS but it failed, try again without
687 if permitted */
688
689 yield = smtp_setup_conn(&sx, FALSE);
690 #ifdef SUPPORT_TLS
691 if ( yield == DEFER
692 && addr->basic_errno == ERRNO_TLSFAILURE
693 && ob->tls_tempfail_tryclear
694 && verify_check_given_host(CUSS &ob->hosts_require_tls, host) != OK
695 )
696 {
697 log_write(0, LOG_MAIN,
698 "%s: callout unencrypted to %s [%s] (not in hosts_require_tls)",
699 addr->message, host->name, host->address);
700 addr->transport_return = PENDING_DEFER;
701 yield = smtp_setup_conn(&sx, TRUE);
702 }
703 #endif
704 if (yield != OK)
705 {
706 errno = addr->basic_errno;
707 transport_name = NULL;
708 deliver_host = deliver_host_address = NULL;
709 deliver_domain = save_deliver_domain;
710
711 /* Failure to accept HELO is cached; this blocks the whole domain for all
712 senders. I/O errors and defer responses are not cached. */
713
714 if (yield == FAIL && (errno == 0 || errno == ERRNO_SMTPCLOSED))
715 {
716 setflag(addr, af_verify_nsfail);
717 new_domain_record.result = ccache_reject;
718 done = TRUE;
719 }
720 else
721 done = FALSE;
722 goto no_conn;
723 }
724
725 /* If we needed to authenticate, smtp_setup_conn() did that. Copy
726 the AUTH info for logging */
727
728 addr->authenticator = client_authenticator;
729 addr->auth_id = client_authenticated_id;
730
731 sx.from_addr = from_address;
732 sx.first_addr = sx.sync_addr = addr;
733 sx.ok = FALSE; /*XXX these 3 last might not be needed for verify? */
734 sx.send_rset = TRUE;
735 sx.completed_addr = FALSE;
736
737 new_domain_record.result = old_domain_cache_result == ccache_reject_mfnull
738 ? ccache_reject_mfnull : ccache_accept;
739
740 /* Do the random local part check first. Temporarily replace the recipient
741 with the "random" value */
742
743 if (random_local_part)
744 {
745 uschar * main_address = addr->address;
746 const uschar * rcpt_domain = addr->domain;
747
748 #ifdef SUPPORT_I18N
749 uschar * errstr = NULL;
750 if ( testflag(addr, af_utf8_downcvt)
751 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
752 &errstr), errstr)
753 )
754 {
755 addr->message = errstr;
756 errno = ERRNO_EXPANDFAIL;
757 setflag(addr, af_verify_nsfail);
758 done = FALSE;
759 rcpt_domain = US""; /*XXX errorhandling! */
760 }
761 #endif
762
763 /* This would be ok for 1st rcpt of a cutthrough (the case handled here;
764 subsequents are done in cutthrough_multi()), but no way to
765 handle a subsequent because of the RSET vaporising the MAIL FROM.
766 So refuse to support any. Most cutthrough use will not involve
767 random_local_part, so no loss. */
768 cancel_cutthrough_connection(TRUE, US"random-recipient");
769
770 addr->address = string_sprintf("%s@%.1000s",
771 random_local_part, rcpt_domain);
772 done = FALSE;
773
774 /* If accepted, we aren't going to do any further tests below.
775 Otherwise, cache a real negative response, and get back to the right
776 state to send RCPT. Unless there's some problem such as a dropped
777 connection, we expect to succeed, because the commands succeeded above.
778 However, some servers drop the connection after responding to an
779 invalid recipient, so on (any) error we drop and remake the connection.
780 XXX We don't care about that for postmaster_full. Should we?
781
782 XXX could we add another flag to the context, and have the common
783 code emit the RSET too? Even pipelined after the RCPT...
784 Then the main-verify call could use it if there's to be a subsequent
785 postmaster-verify.
786 The sync_responses() would need to be taught about it and we'd
787 need another return code filtering out to here.
788
789 Avoid using a SIZE option on the MAIL for all random-rcpt checks.
790 */
791
792 sx.avoid_option = OPTION_SIZE;
793
794 /* Remember when we last did a random test */
795 new_domain_record.random_stamp = time(NULL);
796
797 if (smtp_write_mail_and_rcpt_cmds(&sx, &yield) == 0)
798 switch(addr->transport_return)
799 {
800 case PENDING_OK: /* random was accepted, unfortunately */
801 new_domain_record.random_result = ccache_accept;
802 yield = OK; /* Only usable verify result we can return */
803 done = TRUE;
804 *failure_ptr = US"random";
805 goto no_conn;
806 case FAIL: /* rejected: the preferred result */
807 new_domain_record.random_result = ccache_reject;
808 sx.avoid_option = 0;
809
810 /* Between each check, issue RSET, because some servers accept only
811 one recipient after MAIL FROM:<>.
812 XXX We don't care about that for postmaster_full. Should we? */
813
814 if ((done =
815 smtp_write_command(&sx, SCMD_FLUSH, "RSET\r\n") >= 0 &&
816 smtp_read_response(&sx, sx.buffer, sizeof(sx.buffer), '2', callout)))
817 break;
818
819 HDEBUG(D_acl|D_v)
820 debug_printf_indent("problem after random/rset/mfrom; reopen conn\n");
821 random_local_part = NULL;
822 #ifdef SUPPORT_TLS
823 tls_close(sx.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
824 #endif
825 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
826 (void)close(sx.cctx.sock);
827 sx.cctx.sock = -1;
828 #ifndef DISABLE_EVENT
829 (void) event_raise(addr->transport->event_action,
830 US"tcp:close", NULL);
831 #endif
832 addr->address = main_address;
833 addr->transport_return = PENDING_DEFER;
834 sx.first_addr = sx.sync_addr = addr;
835 sx.ok = FALSE;
836 sx.send_rset = TRUE;
837 sx.completed_addr = FALSE;
838 goto tls_retry_connection;
839 case DEFER: /* 4xx response to random */
840 break; /* Just to be clear. ccache_unknown, !done. */
841 }
842
843 /* Re-setup for main verify, or for the error message when failing */
844 addr->address = main_address;
845 addr->transport_return = PENDING_DEFER;
846 sx.first_addr = sx.sync_addr = addr;
847 sx.ok = FALSE;
848 sx.send_rset = TRUE;
849 sx.completed_addr = FALSE;
850 }
851 else
852 done = TRUE;
853
854 /* Main verify. For rcpt-verify use SIZE if we know it and we're not cacheing;
855 for sndr-verify never use it. */
856
857 if (done)
858 {
859 if (!(options & vopt_is_recipient && options & vopt_callout_no_cache))
860 sx.avoid_option = OPTION_SIZE;
861
862 done = FALSE;
863 switch(smtp_write_mail_and_rcpt_cmds(&sx, &yield))
864 {
865 case 0: switch(addr->transport_return) /* ok so far */
866 {
867 case PENDING_OK: done = TRUE;
868 new_address_record.result = ccache_accept;
869 break;
870 case FAIL: done = TRUE;
871 yield = FAIL;
872 *failure_ptr = US"recipient";
873 new_address_record.result = ccache_reject;
874 break;
875 default: break;
876 }
877 break;
878
879 case -1: /* MAIL response error */
880 *failure_ptr = US"mail";
881 if (errno == 0 && sx.buffer[0] == '5')
882 {
883 setflag(addr, af_verify_nsfail);
884 if (from_address[0] == 0)
885 new_domain_record.result = ccache_reject_mfnull;
886 }
887 break;
888 /* non-MAIL read i/o error */
889 /* non-MAIL response timeout */
890 /* internal error; channel still usable */
891 default: break; /* transmit failed */
892 }
893 }
894
895 addr->auth_sndr = client_authenticated_sender;
896
897 deliver_host = deliver_host_address = NULL;
898 deliver_domain = save_deliver_domain;
899
900 /* Do postmaster check if requested; if a full check is required, we
901 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
902
903 if (done && pm_mailfrom)
904 {
905 /* Could possibly shift before main verify, just above, and be ok
906 for cutthrough. But no way to handle a subsequent rcpt, so just
907 refuse any */
908 cancel_cutthrough_connection(TRUE, US"postmaster verify");
909 HDEBUG(D_acl|D_v) debug_printf_indent("Cutthrough cancelled by presence of postmaster verify\n");
910
911 done = smtp_write_command(&sx, SCMD_FLUSH, "RSET\r\n") >= 0
912 && smtp_read_response(&sx, sx.buffer, sizeof(sx.buffer), '2', callout);
913
914 if (done)
915 {
916 uschar * main_address = addr->address;
917
918 /*XXX oops, affixes */
919 addr->address = string_sprintf("postmaster@%.1000s", addr->domain);
920 addr->transport_return = PENDING_DEFER;
921
922 sx.from_addr = pm_mailfrom;
923 sx.first_addr = sx.sync_addr = addr;
924 sx.ok = FALSE;
925 sx.send_rset = TRUE;
926 sx.completed_addr = FALSE;
927 sx.avoid_option = OPTION_SIZE;
928
929 if( smtp_write_mail_and_rcpt_cmds(&sx, &yield) == 0
930 && addr->transport_return == PENDING_OK
931 )
932 done = TRUE;
933 else
934 done = (options & vopt_callout_fullpm) != 0
935 && smtp_write_command(&sx, SCMD_FLUSH,
936 "RCPT TO:<postmaster>\r\n") >= 0
937 && smtp_read_response(&sx, sx.buffer,
938 sizeof(sx.buffer), '2', callout);
939
940 /* Sort out the cache record */
941
942 new_domain_record.postmaster_stamp = time(NULL);
943
944 if (done)
945 new_domain_record.postmaster_result = ccache_accept;
946 else if (errno == 0 && sx.buffer[0] == '5')
947 {
948 *failure_ptr = US"postmaster";
949 setflag(addr, af_verify_pmfail);
950 new_domain_record.postmaster_result = ccache_reject;
951 }
952
953 addr->address = main_address;
954 }
955 }
956 /* For any failure of the main check, other than a negative response, we just
957 close the connection and carry on. We can identify a negative response by the
958 fact that errno is zero. For I/O errors it will be non-zero
959
960 Set up different error texts for logging and for sending back to the caller
961 as an SMTP response. Log in all cases, using a one-line format. For sender
962 callouts, give a full response to the caller, but for recipient callouts,
963 don't give the IP address because this may be an internal host whose identity
964 is not to be widely broadcast. */
965
966 no_conn:
967 switch(errno)
968 {
969 case ETIMEDOUT:
970 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
971 sx.send_quit = FALSE;
972 break;
973
974 #ifdef SUPPORT_I18N
975 case ERRNO_UTF8_FWD:
976 {
977 extern int acl_where; /* src/acl.c */
978 errno = 0;
979 addr->message = string_sprintf(
980 "response to \"EHLO\" did not include SMTPUTF8");
981 addr->user_message = acl_where == ACL_WHERE_RCPT
982 ? US"533 no support for internationalised mailbox name"
983 : US"550 mailbox unavailable";
984 yield = FAIL;
985 done = TRUE;
986 }
987 break;
988 #endif
989 case ECONNREFUSED:
990 sx.send_quit = FALSE;
991 break;
992
993 case 0:
994 if (*sx.buffer == 0) Ustrcpy(sx.buffer, US"connection dropped");
995
996 /*XXX test here is ugly; seem to have a split of responsibility for
997 building this message. Need to rationalise. Where is it done
998 before here, and when not?
999 Not == 5xx resp to MAIL on main-verify
1000 */
1001 if (!addr->message) addr->message =
1002 string_sprintf("response to \"%s\" was: %s",
1003 big_buffer, string_printing(sx.buffer));
1004
1005 addr->user_message = options & vopt_is_recipient
1006 ? string_sprintf("Callout verification failed:\n%s", sx.buffer)
1007 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1008 host->address, big_buffer, sx.buffer);
1009
1010 /* Hard rejection ends the process */
1011
1012 if (sx.buffer[0] == '5') /* Address rejected */
1013 {
1014 yield = FAIL;
1015 done = TRUE;
1016 }
1017 break;
1018 }
1019
1020 /* End the SMTP conversation and close the connection. */
1021
1022 /* Cutthrough - on a successful connect and recipient-verify with
1023 use-sender and we are 1st rcpt and have no cutthrough conn so far
1024 here is where we want to leave the conn open. Ditto for a lazy-close
1025 verify. */
1026
1027 if (cutthrough.delivery)
1028 {
1029 if (addr->transport->filter_command)
1030 {
1031 cutthrough.delivery= FALSE;
1032 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
1033 }
1034 #ifndef DISABLE_DKIM
1035 if (ob->dkim.dkim_domain)
1036 {
1037 cutthrough.delivery= FALSE;
1038 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
1039 }
1040 #endif
1041 #ifdef EXPERIMENTAL_ARC
1042 if (ob->arc_sign)
1043 {
1044 cutthrough.delivery= FALSE;
1045 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of ARC signing\n");
1046 }
1047 #endif
1048 }
1049
1050 if ( (cutthrough.delivery || options & vopt_callout_hold)
1051 && rcpt_count == 1
1052 && done
1053 && yield == OK
1054 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1055 == vopt_callout_recipsender
1056 && !random_local_part
1057 && !pm_mailfrom
1058 && cutthrough.cctx.sock < 0
1059 && !sx.lmtp
1060 )
1061 {
1062 HDEBUG(D_acl|D_v) debug_printf_indent("holding verify callout open for %s\n",
1063 cutthrough.delivery
1064 ? "cutthrough delivery" : "potential further verifies and delivery");
1065
1066 cutthrough.callout_hold_only = !cutthrough.delivery;
1067 cutthrough.is_tls = tls_out.active.sock >= 0;
1068 /* We assume no buffer in use in the outblock */
1069 cutthrough.cctx = sx.cctx;
1070 cutthrough.nrcpt = 1;
1071 cutthrough.transport = addr->transport->name;
1072 cutthrough.interface = interface;
1073 cutthrough.snd_port = sending_port;
1074 cutthrough.peer_options = smtp_peer_options;
1075 cutthrough.host = *host;
1076 {
1077 int oldpool = store_pool;
1078 store_pool = POOL_PERM;
1079 cutthrough.snd_ip = string_copy(sending_ip_address);
1080 cutthrough.host.name = string_copy(host->name);
1081 cutthrough.host.address = string_copy(host->address);
1082 store_pool = oldpool;
1083 }
1084
1085 /* Save the address_item and parent chain for later logging */
1086 cutthrough.addr = *addr;
1087 cutthrough.addr.next = NULL;
1088 cutthrough.addr.host_used = &cutthrough.host;
1089 for (address_item * caddr = &cutthrough.addr, * parent = addr->parent;
1090 parent;
1091 caddr = caddr->parent, parent = parent->parent)
1092 *(caddr->parent = store_get(sizeof(address_item))) = *parent;
1093
1094 ctctx.outblock.buffer = ctbuffer;
1095 ctctx.outblock.buffersize = sizeof(ctbuffer);
1096 ctctx.outblock.ptr = ctbuffer;
1097 /* ctctx.outblock.cmd_count = 0; ctctx.outblock.authenticating = FALSE; */
1098 ctctx.outblock.cctx = &cutthrough.cctx;
1099 }
1100 else
1101 {
1102 /* Ensure no cutthrough on multiple verifies that were incompatible */
1103 if (options & vopt_callout_recipsender)
1104 cancel_cutthrough_connection(TRUE, US"not usable for cutthrough");
1105 if (sx.send_quit)
1106 {
1107 (void) smtp_write_command(&sx, SCMD_FLUSH, "QUIT\r\n");
1108
1109 /* Wait a short time for response, and discard it */
1110 smtp_read_response(&sx, sx.buffer, sizeof(sx.buffer), '2', 1);
1111 }
1112
1113 if (sx.cctx.sock >= 0)
1114 {
1115 #ifdef SUPPORT_TLS
1116 if (sx.cctx.tls_ctx)
1117 {
1118 tls_close(sx.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1119 sx.cctx.tls_ctx = NULL;
1120 }
1121 #endif
1122 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1123 (void)close(sx.cctx.sock);
1124 sx.cctx.sock = -1;
1125 #ifndef DISABLE_EVENT
1126 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
1127 #endif
1128 }
1129 }
1130
1131 if (!done || yield != OK)
1132 addr->message = string_sprintf("%s [%s] : %s", host->name, host->address,
1133 addr->message);
1134 } /* Loop through all hosts, while !done */
1135 }
1136
1137 /* If we get here with done == TRUE, a successful callout happened, and yield
1138 will be set OK or FAIL according to the response to the RCPT command.
1139 Otherwise, we looped through the hosts but couldn't complete the business.
1140 However, there may be domain-specific information to cache in both cases. */
1141
1142 if (!(options & vopt_callout_no_cache))
1143 cache_callout_write(&new_domain_record, addr->domain,
1144 done, &new_address_record, address_key);
1145
1146 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1147 temporary error. If there was only one host, and a response was received, leave
1148 it alone if supplying details. Otherwise, give a generic response. */
1149
1150 if (!done)
1151 {
1152 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
1153 options & vopt_is_recipient ? "recipient" : "sender");
1154 yield = DEFER;
1155
1156 addr->message = host_list->next || !addr->message
1157 ? dullmsg : string_sprintf("%s: %s", dullmsg, addr->message);
1158
1159 addr->user_message = smtp_return_error_details
1160 ? string_sprintf("%s for <%s>.\n"
1161 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1162 "they may be permanently unreachable from this server. In the latter case,\n%s",
1163 dullmsg, addr->address,
1164 options & vopt_is_recipient
1165 ? "the address will never be accepted."
1166 : "you need to change the address or create an MX record for its domain\n"
1167 "if it is supposed to be generally accessible from the Internet.\n"
1168 "Talk to your mail administrator for details.")
1169 : dullmsg;
1170
1171 /* Force a specific error code */
1172
1173 addr->basic_errno = ERRNO_CALLOUTDEFER;
1174 }
1175
1176 /* Come here from within the cache-reading code on fast-track exit. */
1177
1178 END_CALLOUT:
1179 tls_modify_variables(&tls_in);
1180 return yield;
1181 }
1182
1183
1184
1185 /* Called after recipient-acl to get a cutthrough connection open when
1186 one was requested and a recipient-verify wasn't subsequently done.
1187 */
1188 int
1189 open_cutthrough_connection(address_item * addr)
1190 {
1191 address_item addr2;
1192 int rc;
1193
1194 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1195 /* We must use a copy of the address for verification, because it might
1196 get rewritten. */
1197
1198 addr2 = *addr;
1199 HDEBUG(D_acl) debug_printf_indent("----------- %s cutthrough setup ------------\n",
1200 rcpt_count > 1 ? "more" : "start");
1201 rc = verify_address(&addr2, NULL,
1202 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1203 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1204 NULL, NULL, NULL);
1205 addr->message = addr2.message;
1206 addr->user_message = addr2.user_message;
1207 HDEBUG(D_acl) debug_printf_indent("----------- end cutthrough setup ------------\n");
1208 return rc;
1209 }
1210
1211
1212
1213 /* Send given number of bytes from the buffer */
1214 static BOOL
1215 cutthrough_send(int n)
1216 {
1217 if(cutthrough.cctx.sock < 0)
1218 return TRUE;
1219
1220 if(
1221 #ifdef SUPPORT_TLS
1222 cutthrough.is_tls
1223 ? tls_write(cutthrough.cctx.tls_ctx, ctctx.outblock.buffer, n, FALSE)
1224 :
1225 #endif
1226 send(cutthrough.cctx.sock, ctctx.outblock.buffer, n, 0) > 0
1227 )
1228 {
1229 transport_count += n;
1230 ctctx.outblock.ptr= ctctx.outblock.buffer;
1231 return TRUE;
1232 }
1233
1234 HDEBUG(D_transport|D_acl) debug_printf_indent("cutthrough_send failed: %s\n", strerror(errno));
1235 return FALSE;
1236 }
1237
1238
1239
1240 static BOOL
1241 _cutthrough_puts(uschar * cp, int n)
1242 {
1243 while(n--)
1244 {
1245 if(ctctx.outblock.ptr >= ctctx.outblock.buffer+ctctx.outblock.buffersize)
1246 if(!cutthrough_send(ctctx.outblock.buffersize))
1247 return FALSE;
1248
1249 *ctctx.outblock.ptr++ = *cp++;
1250 }
1251 return TRUE;
1252 }
1253
1254 /* Buffered output of counted data block. Return boolean success */
1255 static BOOL
1256 cutthrough_puts(uschar * cp, int n)
1257 {
1258 if (cutthrough.cctx.sock < 0) return TRUE;
1259 if (_cutthrough_puts(cp, n)) return TRUE;
1260 cancel_cutthrough_connection(TRUE, US"transmit failed");
1261 return FALSE;
1262 }
1263
1264 void
1265 cutthrough_data_puts(uschar * cp, int n)
1266 {
1267 if (cutthrough.delivery) (void) cutthrough_puts(cp, n);
1268 return;
1269 }
1270
1271
1272 static BOOL
1273 _cutthrough_flush_send(void)
1274 {
1275 int n = ctctx.outblock.ptr - ctctx.outblock.buffer;
1276
1277 if(n>0)
1278 if(!cutthrough_send(n))
1279 return FALSE;
1280 return TRUE;
1281 }
1282
1283
1284 /* Send out any bufferred output. Return boolean success. */
1285 BOOL
1286 cutthrough_flush_send(void)
1287 {
1288 if (_cutthrough_flush_send()) return TRUE;
1289 cancel_cutthrough_connection(TRUE, US"transmit failed");
1290 return FALSE;
1291 }
1292
1293
1294 static BOOL
1295 cutthrough_put_nl(void)
1296 {
1297 return cutthrough_puts(US"\r\n", 2);
1298 }
1299
1300
1301 void
1302 cutthrough_data_put_nl(void)
1303 {
1304 cutthrough_data_puts(US"\r\n", 2);
1305 }
1306
1307
1308 /* Get and check response from cutthrough target */
1309 static uschar
1310 cutthrough_response(client_conn_ctx * cctx, char expect, uschar ** copy, int timeout)
1311 {
1312 smtp_context sx = {0};
1313 uschar inbuffer[4096];
1314 uschar responsebuffer[4096];
1315
1316 sx.inblock.buffer = inbuffer;
1317 sx.inblock.buffersize = sizeof(inbuffer);
1318 sx.inblock.ptr = inbuffer;
1319 sx.inblock.ptrend = inbuffer;
1320 sx.inblock.cctx = cctx;
1321 if(!smtp_read_response(&sx, responsebuffer, sizeof(responsebuffer), expect, timeout))
1322 cancel_cutthrough_connection(TRUE, US"target timeout on read");
1323
1324 if(copy)
1325 {
1326 uschar * cp;
1327 *copy = cp = string_copy(responsebuffer);
1328 /* Trim the trailing end of line */
1329 cp += Ustrlen(responsebuffer);
1330 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1331 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1332 }
1333
1334 return responsebuffer[0];
1335 }
1336
1337
1338 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1339 BOOL
1340 cutthrough_predata(void)
1341 {
1342 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1343 return FALSE;
1344
1345 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> DATA\n");
1346 cutthrough_puts(US"DATA\r\n", 6);
1347 cutthrough_flush_send();
1348
1349 /* Assume nothing buffered. If it was it gets ignored. */
1350 return cutthrough_response(&cutthrough.cctx, '3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
1351 }
1352
1353
1354 /* tctx arg only to match write_chunk() */
1355 static BOOL
1356 cutthrough_write_chunk(transport_ctx * tctx, uschar * s, int len)
1357 {
1358 uschar * s2;
1359 while(s && (s2 = Ustrchr(s, '\n')))
1360 {
1361 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1362 return FALSE;
1363 s = s2+1;
1364 }
1365 return TRUE;
1366 }
1367
1368
1369 /* Buffered send of headers. Return success boolean. */
1370 /* Expands newlines to wire format (CR,NL). */
1371 /* Also sends header-terminating blank line. */
1372 BOOL
1373 cutthrough_headers_send(void)
1374 {
1375 transport_ctx tctx;
1376
1377 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1378 return FALSE;
1379
1380 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1381 but having a separate buffered-output function (for now)
1382 */
1383 HDEBUG(D_acl) debug_printf_indent("----------- start cutthrough headers send -----------\n");
1384
1385 tctx.u.fd = cutthrough.cctx.sock;
1386 tctx.tblock = cutthrough.addr.transport;
1387 tctx.addr = &cutthrough.addr;
1388 tctx.check_string = US".";
1389 tctx.escape_string = US"..";
1390 /*XXX check under spool_files_wireformat. Might be irrelevant */
1391 tctx.options = topt_use_crlf;
1392
1393 if (!transport_headers_send(&tctx, &cutthrough_write_chunk))
1394 return FALSE;
1395
1396 HDEBUG(D_acl) debug_printf_indent("----------- done cutthrough headers send ------------\n");
1397 return TRUE;
1398 }
1399
1400
1401 static void
1402 close_cutthrough_connection(const uschar * why)
1403 {
1404 int fd = cutthrough.cctx.sock;
1405 if(fd >= 0)
1406 {
1407 /* We could be sending this after a bunch of data, but that is ok as
1408 the only way to cancel the transfer in dataphase is to drop the tcp
1409 conn before the final dot.
1410 */
1411 client_conn_ctx tmp_ctx = cutthrough.cctx;
1412 ctctx.outblock.ptr = ctbuffer;
1413 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> QUIT\n");
1414 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1415 _cutthrough_flush_send();
1416 cutthrough.cctx.sock = -1; /* avoid recursion via read timeout */
1417 cutthrough.nrcpt = 0; /* permit re-cutthrough on subsequent message */
1418
1419 /* Wait a short time for response, and discard it */
1420 cutthrough_response(&tmp_ctx, '2', NULL, 1);
1421
1422 #ifdef SUPPORT_TLS
1423 if (cutthrough.is_tls)
1424 {
1425 tls_close(cutthrough.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1426 cutthrough.cctx.tls_ctx = NULL;
1427 cutthrough.is_tls = FALSE;
1428 }
1429 #endif
1430 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1431 (void)close(fd);
1432 HDEBUG(D_acl) debug_printf_indent("----------- cutthrough shutdown (%s) ------------\n", why);
1433 }
1434 ctctx.outblock.ptr = ctbuffer;
1435 }
1436
1437 void
1438 cancel_cutthrough_connection(BOOL close_noncutthrough_verifies, const uschar * why)
1439 {
1440 if (cutthrough.delivery || close_noncutthrough_verifies)
1441 close_cutthrough_connection(why);
1442 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1443 }
1444
1445
1446 void
1447 release_cutthrough_connection(const uschar * why)
1448 {
1449 if (cutthrough.cctx.sock < 0) return;
1450 HDEBUG(D_acl) debug_printf_indent("release cutthrough conn: %s\n", why);
1451 cutthrough.cctx.sock = -1;
1452 cutthrough.cctx.tls_ctx = NULL;
1453 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1454 }
1455
1456
1457
1458
1459 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1460 Log an OK response as a transmission.
1461 Close the connection.
1462 Return smtp response-class digit.
1463 */
1464 uschar *
1465 cutthrough_finaldot(void)
1466 {
1467 uschar res;
1468 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> .\n");
1469
1470 /* Assume data finshed with new-line */
1471 if( !cutthrough_puts(US".", 1)
1472 || !cutthrough_put_nl()
1473 || !cutthrough_flush_send()
1474 )
1475 return cutthrough.addr.message;
1476
1477 res = cutthrough_response(&cutthrough.cctx, '2', &cutthrough.addr.message,
1478 CUTTHROUGH_DATA_TIMEOUT);
1479 for (address_item * addr = &cutthrough.addr; addr; addr = addr->next)
1480 {
1481 addr->message = cutthrough.addr.message;
1482 switch(res)
1483 {
1484 case '2':
1485 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1486 close_cutthrough_connection(US"delivered");
1487 break;
1488
1489 case '4':
1490 delivery_log(LOG_MAIN, addr, 0,
1491 US"tmp-reject from cutthrough after DATA:");
1492 break;
1493
1494 case '5':
1495 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1496 US"rejected after DATA:");
1497 break;
1498
1499 default:
1500 break;
1501 }
1502 }
1503 return cutthrough.addr.message;
1504 }
1505
1506
1507
1508 /*************************************************
1509 * Copy error to toplevel address *
1510 *************************************************/
1511
1512 /* This function is used when a verify fails or defers, to ensure that the
1513 failure or defer information is in the original toplevel address. This applies
1514 when an address is redirected to a single new address, and the failure or
1515 deferral happens to the child address.
1516
1517 Arguments:
1518 vaddr the verify address item
1519 addr the final address item
1520 yield FAIL or DEFER
1521
1522 Returns: the value of YIELD
1523 */
1524
1525 static int
1526 copy_error(address_item *vaddr, address_item *addr, int yield)
1527 {
1528 if (addr != vaddr)
1529 {
1530 vaddr->message = addr->message;
1531 vaddr->user_message = addr->user_message;
1532 vaddr->basic_errno = addr->basic_errno;
1533 vaddr->more_errno = addr->more_errno;
1534 vaddr->prop.address_data = addr->prop.address_data;
1535 copyflag(vaddr, addr, af_pass_message);
1536 }
1537 return yield;
1538 }
1539
1540
1541
1542
1543 /**************************************************
1544 * printf that automatically handles TLS if needed *
1545 ***************************************************/
1546
1547 /* This function is used by verify_address() as a substitute for all fprintf()
1548 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1549 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1550 that assumes that we always use the smtp_out FILE* when not using TLS or the
1551 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1552 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1553 fprintf().
1554
1555 Arguments:
1556 f the candidate FILE* to write to
1557 format format string
1558 ... optional arguments
1559
1560 Returns:
1561 nothing
1562 */
1563
1564 static void PRINTF_FUNCTION(2,3)
1565 respond_printf(FILE *f, const char *format, ...)
1566 {
1567 va_list ap;
1568
1569 va_start(ap, format);
1570 if (smtp_out && (f == smtp_out))
1571 smtp_vprintf(format, FALSE, ap);
1572 else
1573 vfprintf(f, format, ap);
1574 va_end(ap);
1575 }
1576
1577
1578
1579 /*************************************************
1580 * Verify an email address *
1581 *************************************************/
1582
1583 /* This function is used both for verification (-bv and at other times) and
1584 address testing (-bt), which is indicated by address_test_mode being set.
1585
1586 Arguments:
1587 vaddr contains the address to verify; the next field in this block
1588 must be NULL
1589 f if not NULL, write the result to this file
1590 options various option bits:
1591 vopt_fake_sender => this sender verify is not for the real
1592 sender (it was verify=sender=xxxx or an address from a
1593 header line) - rewriting must not change sender_address
1594 vopt_is_recipient => this is a recipient address, otherwise
1595 it's a sender address - this affects qualification and
1596 rewriting and messages from callouts
1597 vopt_qualify => qualify an unqualified address; else error
1598 vopt_expn => called from SMTP EXPN command
1599 vopt_success_on_redirect => when a new address is generated
1600 the verification instantly succeeds
1601
1602 These ones are used by do_callout() -- the options variable
1603 is passed to it.
1604
1605 vopt_callout_fullpm => if postmaster check, do full one
1606 vopt_callout_no_cache => don't use callout cache
1607 vopt_callout_random => do the "random" thing
1608 vopt_callout_recipsender => use real sender for recipient
1609 vopt_callout_recippmaster => use postmaster for recipient
1610
1611 callout if > 0, specifies that callout is required, and gives timeout
1612 for individual commands
1613 callout_overall if > 0, gives overall timeout for the callout function;
1614 if < 0, a default is used (see do_callout())
1615 callout_connect the connection timeout for callouts
1616 se_mailfrom when callout is requested to verify a sender, use this
1617 in MAIL FROM; NULL => ""
1618 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1619 thing and use this as the sender address (may be "")
1620
1621 routed if not NULL, set TRUE if routing succeeded, so we can
1622 distinguish between routing failed and callout failed
1623
1624 Returns: OK address verified
1625 FAIL address failed to verify
1626 DEFER can't tell at present
1627 */
1628
1629 int
1630 verify_address(address_item * vaddr, FILE * fp, int options, int callout,
1631 int callout_overall, int callout_connect, uschar * se_mailfrom,
1632 uschar *pm_mailfrom, BOOL *routed)
1633 {
1634 BOOL allok = TRUE;
1635 BOOL full_info = fp ? debug_selector != 0 : FALSE;
1636 BOOL expn = (options & vopt_expn) != 0;
1637 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1638 int i;
1639 int yield = OK;
1640 int verify_type = expn? v_expn :
1641 f.address_test_mode? v_none :
1642 options & vopt_is_recipient? v_recipient : v_sender;
1643 address_item *addr_list;
1644 address_item *addr_new = NULL;
1645 address_item *addr_remote = NULL;
1646 address_item *addr_local = NULL;
1647 address_item *addr_succeed = NULL;
1648 uschar **failure_ptr = options & vopt_is_recipient
1649 ? &recipient_verify_failure : &sender_verify_failure;
1650 uschar *ko_prefix, *cr;
1651 uschar *address = vaddr->address;
1652 uschar *save_sender;
1653 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1654
1655 /* Clear, just in case */
1656
1657 *failure_ptr = NULL;
1658
1659 /* Set up a prefix and suffix for error message which allow us to use the same
1660 output statements both in EXPN mode (where an SMTP response is needed) and when
1661 debugging with an output file. */
1662
1663 if (expn)
1664 {
1665 ko_prefix = US"553 ";
1666 cr = US"\r";
1667 }
1668 else ko_prefix = cr = US"";
1669
1670 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1671
1672 if (parse_find_at(address) == NULL)
1673 {
1674 if (!(options & vopt_qualify))
1675 {
1676 if (fp)
1677 respond_printf(fp, "%sA domain is required for \"%s\"%s\n",
1678 ko_prefix, address, cr);
1679 *failure_ptr = US"qualify";
1680 return FAIL;
1681 }
1682 address = rewrite_address_qualify(address, options & vopt_is_recipient);
1683 }
1684
1685 DEBUG(D_verify)
1686 {
1687 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1688 debug_printf("%s %s\n", f.address_test_mode? "Testing" : "Verifying", address);
1689 }
1690
1691 /* Rewrite and report on it. Clear the domain and local part caches - these
1692 may have been set by domains and local part tests during an ACL. */
1693
1694 if (global_rewrite_rules)
1695 {
1696 uschar *old = address;
1697 address = rewrite_address(address, options & vopt_is_recipient, FALSE,
1698 global_rewrite_rules, rewrite_existflags);
1699 if (address != old)
1700 {
1701 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1702 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1703 if (fp && !expn) fprintf(fp, "Address rewritten as: %s\n", address);
1704 }
1705 }
1706
1707 /* If this is the real sender address, we must update sender_address at
1708 this point, because it may be referred to in the routers. */
1709
1710 if (!(options & (vopt_fake_sender|vopt_is_recipient)))
1711 sender_address = address;
1712
1713 /* If the address was rewritten to <> no verification can be done, and we have
1714 to return OK. This rewriting is permitted only for sender addresses; for other
1715 addresses, such rewriting fails. */
1716
1717 if (!address[0]) return OK;
1718
1719 /* Flip the legacy TLS-related variables over to the outbound set in case
1720 they're used in the context of a transport used by verification. Reset them
1721 at exit from this routine (so no returns allowed from here on). */
1722
1723 tls_modify_variables(&tls_out);
1724
1725 /* Save a copy of the sender address for re-instating if we change it to <>
1726 while verifying a sender address (a nice bit of self-reference there). */
1727
1728 save_sender = sender_address;
1729
1730 /* Observability variable for router/transport use */
1731
1732 verify_mode = options & vopt_is_recipient ? US"R" : US"S";
1733
1734 /* Update the address structure with the possibly qualified and rewritten
1735 address. Set it up as the starting address on the chain of new addresses. */
1736
1737 vaddr->address = address;
1738 addr_new = vaddr;
1739
1740 /* We need a loop, because an address can generate new addresses. We must also
1741 cope with generated pipes and files at the top level. (See also the code and
1742 comment in deliver.c.) However, it is usually the case that the router for
1743 user's .forward files has its verify flag turned off.
1744
1745 If an address generates more than one child, the loop is used only when
1746 full_info is set, and this can only be set locally. Remote enquiries just get
1747 information about the top level address, not anything that it generated. */
1748
1749 while (addr_new)
1750 {
1751 int rc;
1752 address_item *addr = addr_new;
1753
1754 addr_new = addr->next;
1755 addr->next = NULL;
1756
1757 DEBUG(D_verify)
1758 {
1759 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1760 debug_printf("Considering %s\n", addr->address);
1761 }
1762
1763 /* Handle generated pipe, file or reply addresses. We don't get these
1764 when handling EXPN, as it does only one level of expansion. */
1765
1766 if (testflag(addr, af_pfr))
1767 {
1768 allok = FALSE;
1769 if (fp)
1770 {
1771 BOOL allow;
1772
1773 if (addr->address[0] == '>')
1774 {
1775 allow = testflag(addr, af_allow_reply);
1776 fprintf(fp, "%s -> mail %s", addr->parent->address, addr->address + 1);
1777 }
1778 else
1779 {
1780 allow = addr->address[0] == '|'
1781 ? testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1782 fprintf(fp, "%s -> %s", addr->parent->address, addr->address);
1783 }
1784
1785 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1786 fprintf(fp, "\n*** Error in setting up pipe, file, or autoreply:\n"
1787 "%s\n", addr->message);
1788 else if (allow)
1789 fprintf(fp, "\n transport = %s\n", addr->transport->name);
1790 else
1791 fprintf(fp, " *** forbidden ***\n");
1792 }
1793 continue;
1794 }
1795
1796 /* Just in case some router parameter refers to it. */
1797
1798 return_path = addr->prop.errors_address
1799 ? addr->prop.errors_address : sender_address;
1800
1801 /* Split the address into domain and local part, handling the %-hack if
1802 necessary, and then route it. While routing a sender address, set
1803 $sender_address to <> because that is what it will be if we were trying to
1804 send a bounce to the sender. */
1805
1806 if (routed) *routed = FALSE;
1807 if ((rc = deliver_split_address(addr)) == OK)
1808 {
1809 if (!(options & vopt_is_recipient)) sender_address = null_sender;
1810 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1811 &addr_succeed, verify_type);
1812 sender_address = save_sender; /* Put back the real sender */
1813 }
1814
1815 /* If routing an address succeeded, set the flag that remembers, for use when
1816 an ACL cached a sender verify (in case a callout fails). Then if routing set
1817 up a list of hosts or the transport has a host list, and the callout option
1818 is set, and we aren't in a host checking run, do the callout verification,
1819 and set another flag that notes that a callout happened. */
1820
1821 if (rc == OK)
1822 {
1823 if (routed) *routed = TRUE;
1824 if (callout > 0)
1825 {
1826 transport_instance * tp;
1827 host_item * host_list = addr->host_list;
1828
1829 /* Make up some data for use in the case where there is no remote
1830 transport. */
1831
1832 transport_feedback tf = {
1833 .interface = NULL, /* interface (=> any) */
1834 .port = US"smtp",
1835 .protocol = US"smtp",
1836 .hosts = NULL,
1837 .helo_data = US"$smtp_active_hostname",
1838 .hosts_override = FALSE,
1839 .hosts_randomize = FALSE,
1840 .gethostbyname = FALSE,
1841 .qualify_single = TRUE,
1842 .search_parents = FALSE
1843 };
1844
1845 /* If verification yielded a remote transport, we want to use that
1846 transport's options, so as to mimic what would happen if we were really
1847 sending a message to this address. */
1848
1849 if ((tp = addr->transport) && !tp->info->local)
1850 {
1851 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
1852
1853 /* If the transport has hosts and the router does not, or if the
1854 transport is configured to override the router's hosts, we must build a
1855 host list of the transport's hosts, and find the IP addresses */
1856
1857 if (tf.hosts && (!host_list || tf.hosts_override))
1858 {
1859 uschar *s;
1860 const uschar *save_deliver_domain = deliver_domain;
1861 uschar *save_deliver_localpart = deliver_localpart;
1862
1863 host_list = NULL; /* Ignore the router's hosts */
1864
1865 deliver_domain = addr->domain;
1866 deliver_localpart = addr->local_part;
1867 s = expand_string(tf.hosts);
1868 deliver_domain = save_deliver_domain;
1869 deliver_localpart = save_deliver_localpart;
1870
1871 if (!s)
1872 {
1873 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1874 "\"%s\" in %s transport for callout: %s", tf.hosts,
1875 tp->name, expand_string_message);
1876 }
1877 else
1878 {
1879 int flags;
1880 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1881
1882 /* Just ignore failures to find a host address. If we don't manage
1883 to find any addresses, the callout will defer. Note that more than
1884 one address may be found for a single host, which will result in
1885 additional host items being inserted into the chain. Hence we must
1886 save the next host first. */
1887
1888 flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
1889 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1890 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1891
1892 for (host_item * host = host_list, * nexthost; host; host = nexthost)
1893 {
1894 nexthost = host->next;
1895 if (tf.gethostbyname ||
1896 string_is_ip_address(host->name, NULL) != 0)
1897 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
1898 else
1899 {
1900 const dnssec_domains * dsp = NULL;
1901 if (Ustrcmp(tp->driver_name, "smtp") == 0)
1902 {
1903 smtp_transport_options_block * ob =
1904 (smtp_transport_options_block *) tp->options_block;
1905 dsp = &ob->dnssec;
1906 }
1907
1908 (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1909 dsp, NULL, NULL);
1910 }
1911 }
1912 }
1913 }
1914 }
1915
1916 /* Can only do a callout if we have at least one host! If the callout
1917 fails, it will have set ${sender,recipient}_verify_failure. */
1918
1919 if (host_list)
1920 {
1921 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1922 if (host_checking && !f.host_checking_callout)
1923 {
1924 HDEBUG(D_verify)
1925 debug_printf("... callout omitted by default when host testing\n"
1926 "(Use -bhc if you want the callouts to happen.)\n");
1927 }
1928 else
1929 {
1930 #ifdef SUPPORT_TLS
1931 deliver_set_expansions(addr);
1932 #endif
1933 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
1934 callout_connect, options, se_mailfrom, pm_mailfrom);
1935 #ifdef SUPPORT_TLS
1936 deliver_set_expansions(NULL);
1937 #endif
1938 }
1939 }
1940 else
1941 {
1942 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
1943 "transport provided a host list, or transport is not smtp\n");
1944 }
1945 }
1946 }
1947
1948 /* Otherwise, any failure is a routing failure */
1949
1950 else *failure_ptr = US"route";
1951
1952 /* A router may return REROUTED if it has set up a child address as a result
1953 of a change of domain name (typically from widening). In this case we always
1954 want to continue to verify the new child. */
1955
1956 if (rc == REROUTED) continue;
1957
1958 /* Handle hard failures */
1959
1960 if (rc == FAIL)
1961 {
1962 allok = FALSE;
1963 if (fp)
1964 {
1965 address_item *p = addr->parent;
1966
1967 respond_printf(fp, "%s%s %s", ko_prefix,
1968 full_info ? addr->address : address,
1969 f.address_test_mode ? "is undeliverable" : "failed to verify");
1970 if (!expn && f.admin_user)
1971 {
1972 if (addr->basic_errno > 0)
1973 respond_printf(fp, ": %s", strerror(addr->basic_errno));
1974 if (addr->message)
1975 respond_printf(fp, ": %s", addr->message);
1976 }
1977
1978 /* Show parents iff doing full info */
1979
1980 if (full_info) while (p)
1981 {
1982 respond_printf(fp, "%s\n <-- %s", cr, p->address);
1983 p = p->parent;
1984 }
1985 respond_printf(fp, "%s\n", cr);
1986 }
1987 cancel_cutthrough_connection(TRUE, US"routing hard fail");
1988
1989 if (!full_info)
1990 {
1991 yield = copy_error(vaddr, addr, FAIL);
1992 goto out;
1993 }
1994 yield = FAIL;
1995 }
1996
1997 /* Soft failure */
1998
1999 else if (rc == DEFER)
2000 {
2001 allok = FALSE;
2002 if (fp)
2003 {
2004 address_item *p = addr->parent;
2005 respond_printf(fp, "%s%s cannot be resolved at this time", ko_prefix,
2006 full_info? addr->address : address);
2007 if (!expn && f.admin_user)
2008 {
2009 if (addr->basic_errno > 0)
2010 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2011 if (addr->message)
2012 respond_printf(fp, ": %s", addr->message);
2013 else if (addr->basic_errno <= 0)
2014 respond_printf(fp, ": unknown error");
2015 }
2016
2017 /* Show parents iff doing full info */
2018
2019 if (full_info) while (p)
2020 {
2021 respond_printf(fp, "%s\n <-- %s", cr, p->address);
2022 p = p->parent;
2023 }
2024 respond_printf(fp, "%s\n", cr);
2025 }
2026 cancel_cutthrough_connection(TRUE, US"routing soft fail");
2027
2028 if (!full_info)
2029 {
2030 yield = copy_error(vaddr, addr, DEFER);
2031 goto out;
2032 }
2033 if (yield == OK) yield = DEFER;
2034 }
2035
2036 /* If we are handling EXPN, we do not want to continue to route beyond
2037 the top level (whose address is in "address"). */
2038
2039 else if (expn)
2040 {
2041 uschar *ok_prefix = US"250-";
2042
2043 if (!addr_new)
2044 if (!addr_local && !addr_remote)
2045 respond_printf(fp, "250 mail to <%s> is discarded\r\n", address);
2046 else
2047 respond_printf(fp, "250 <%s>\r\n", address);
2048
2049 else do
2050 {
2051 address_item *addr2 = addr_new;
2052 addr_new = addr2->next;
2053 if (!addr_new) ok_prefix = US"250 ";
2054 respond_printf(fp, "%s<%s>\r\n", ok_prefix, addr2->address);
2055 } while (addr_new);
2056 yield = OK;
2057 goto out;
2058 }
2059
2060 /* Successful routing other than EXPN. */
2061
2062 else
2063 {
2064 /* Handle successful routing when short info wanted. Otherwise continue for
2065 other (generated) addresses. Short info is the operational case. Full info
2066 can be requested only when debug_selector != 0 and a file is supplied.
2067
2068 There is a conflict between the use of aliasing as an alternate email
2069 address, and as a sort of mailing list. If an alias turns the incoming
2070 address into just one address (e.g. J.Caesar->jc44) you may well want to
2071 carry on verifying the generated address to ensure it is valid when
2072 checking incoming mail. If aliasing generates multiple addresses, you
2073 probably don't want to do this. Exim therefore treats the generation of
2074 just a single new address as a special case, and continues on to verify the
2075 generated address. */
2076
2077 if ( !full_info /* Stop if short info wanted AND */
2078 && ( ( !addr_new /* No new address OR */
2079 || addr_new->next /* More than one new address OR */
2080 || testflag(addr_new, af_pfr) /* New address is pfr */
2081 )
2082 || /* OR */
2083 ( addr_new /* At least one new address AND */
2084 && success_on_redirect /* success_on_redirect is set */
2085 ) )
2086 )
2087 {
2088 if (fp) fprintf(fp, "%s %s\n",
2089 address, f.address_test_mode ? "is deliverable" : "verified");
2090
2091 /* If we have carried on to verify a child address, we want the value
2092 of $address_data to be that of the child */
2093
2094 vaddr->prop.address_data = addr->prop.address_data;
2095
2096 /* If stopped because more than one new address, cannot cutthrough */
2097
2098 if (addr_new && addr_new->next)
2099 cancel_cutthrough_connection(TRUE, US"multiple addresses from routing");
2100
2101 yield = OK;
2102 goto out;
2103 }
2104 }
2105 } /* Loop for generated addresses */
2106
2107 /* Display the full results of the successful routing, including any generated
2108 addresses. Control gets here only when full_info is set, which requires fp not
2109 to be NULL, and this occurs only when a top-level verify is called with the
2110 debugging switch on.
2111
2112 If there are no local and no remote addresses, and there were no pipes, files,
2113 or autoreplies, and there were no errors or deferments, the message is to be
2114 discarded, usually because of the use of :blackhole: in an alias file. */
2115
2116 if (allok && !addr_local && !addr_remote)
2117 {
2118 fprintf(fp, "mail to %s is discarded\n", address);
2119 goto out;
2120 }
2121
2122 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2123 while (addr_list)
2124 {
2125 address_item *addr = addr_list;
2126 transport_instance * tp = addr->transport;
2127
2128 addr_list = addr->next;
2129
2130 fprintf(fp, "%s", CS addr->address);
2131 #ifdef EXPERIMENTAL_SRS
2132 if(addr->prop.srs_sender)
2133 fprintf(fp, " [srs = %s]", addr->prop.srs_sender);
2134 #endif
2135
2136 /* If the address is a duplicate, show something about it. */
2137
2138 if (!testflag(addr, af_pfr))
2139 {
2140 tree_node *tnode;
2141 if ((tnode = tree_search(tree_duplicates, addr->unique)))
2142 fprintf(fp, " [duplicate, would not be delivered]");
2143 else tree_add_duplicate(addr->unique, addr);
2144 }
2145
2146 /* Now show its parents */
2147
2148 for (address_item * p = addr->parent; p; p = p->parent)
2149 fprintf(fp, "\n <-- %s", p->address);
2150 fprintf(fp, "\n ");
2151
2152 /* Show router, and transport */
2153
2154 fprintf(fp, "router = %s, transport = %s\n",
2155 addr->router->name, tp ? tp->name : US"unset");
2156
2157 /* Show any hosts that are set up by a router unless the transport
2158 is going to override them; fiddle a bit to get a nice format. */
2159
2160 if (addr->host_list && tp && !tp->overrides_hosts)
2161 {
2162 int maxlen = 0;
2163 int maxaddlen = 0;
2164 for (host_item * h = addr->host_list; h; h = h->next)
2165 { /* get max lengths of host names, addrs */
2166 int len = Ustrlen(h->name);
2167 if (len > maxlen) maxlen = len;
2168 len = h->address ? Ustrlen(h->address) : 7;
2169 if (len > maxaddlen) maxaddlen = len;
2170 }
2171 for (host_item * h = addr->host_list; h; h = h->next)
2172 {
2173 fprintf(fp, " host %-*s ", maxlen, h->name);
2174
2175 if (h->address)
2176 fprintf(fp, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2177 else if (tp->info->local)
2178 fprintf(fp, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2179 else
2180 fprintf(fp, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2181
2182 if (h->mx >= 0) fprintf(fp, " MX=%d", h->mx);
2183 if (h->port != PORT_NONE) fprintf(fp, " port=%d", h->port);
2184 if (f.running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", fp);
2185 if (h->status == hstatus_unusable) fputs(" ** unusable **", fp);
2186 fputc('\n', fp);
2187 }
2188 }
2189 }
2190
2191 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2192 the -bv or -bt case). */
2193
2194 out:
2195 verify_mode = NULL;
2196 tls_modify_variables(&tls_in);
2197
2198 return yield;
2199 }
2200
2201
2202
2203
2204 /*************************************************
2205 * Check headers for syntax errors *
2206 *************************************************/
2207
2208 /* This function checks those header lines that contain addresses, and verifies
2209 that all the addresses therein are 5322-syntactially correct.
2210
2211 Arguments:
2212 msgptr where to put an error message
2213
2214 Returns: OK
2215 FAIL
2216 */
2217
2218 int
2219 verify_check_headers(uschar **msgptr)
2220 {
2221 uschar *colon, *s;
2222 int yield = OK;
2223
2224 for (header_line * h = header_list; h && yield == OK; h = h->next)
2225 {
2226 if (h->type != htype_from &&
2227 h->type != htype_reply_to &&
2228 h->type != htype_sender &&
2229 h->type != htype_to &&
2230 h->type != htype_cc &&
2231 h->type != htype_bcc)
2232 continue;
2233
2234 colon = Ustrchr(h->text, ':');
2235 s = colon + 1;
2236 while (isspace(*s)) s++;
2237
2238 /* Loop for multiple addresses in the header, enabling group syntax. Note
2239 that we have to reset this after the header has been scanned. */
2240
2241 f.parse_allow_group = TRUE;
2242
2243 while (*s)
2244 {
2245 uschar *ss = parse_find_address_end(s, FALSE);
2246 uschar *recipient, *errmess;
2247 int terminator = *ss;
2248 int start, end, domain;
2249
2250 /* Temporarily terminate the string at this point, and extract the
2251 operative address within, allowing group syntax. */
2252
2253 *ss = 0;
2254 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2255 *ss = terminator;
2256
2257 /* Permit an unqualified address only if the message is local, or if the
2258 sending host is configured to be permitted to send them. */
2259
2260 if (recipient && !domain)
2261 {
2262 if (h->type == htype_from || h->type == htype_sender)
2263 {
2264 if (!f.allow_unqualified_sender) recipient = NULL;
2265 }
2266 else
2267 {
2268 if (!f.allow_unqualified_recipient) recipient = NULL;
2269 }
2270 if (recipient == NULL) errmess = US"unqualified address not permitted";
2271 }
2272
2273 /* It's an error if no address could be extracted, except for the special
2274 case of an empty address. */
2275
2276 if (!recipient && Ustrcmp(errmess, "empty address") != 0)
2277 {
2278 uschar *verb = US"is";
2279 uschar *t = ss;
2280 uschar *tt = colon;
2281 int len;
2282
2283 /* Arrange not to include any white space at the end in the
2284 error message or the header name. */
2285
2286 while (t > s && isspace(t[-1])) t--;
2287 while (tt > h->text && isspace(tt[-1])) tt--;
2288
2289 /* Add the address that failed to the error message, since in a
2290 header with very many addresses it is sometimes hard to spot
2291 which one is at fault. However, limit the amount of address to
2292 quote - cases have been seen where, for example, a missing double
2293 quote in a humungous To: header creates an "address" that is longer
2294 than string_sprintf can handle. */
2295
2296 len = t - s;
2297 if (len > 1024)
2298 {
2299 len = 1024;
2300 verb = US"begins";
2301 }
2302
2303 /* deconst cast ok as we're passing a non-const to string_printing() */
2304 *msgptr = US string_printing(
2305 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2306 errmess, (int)(tt - h->text), h->text, verb, len, s));
2307
2308 yield = FAIL;
2309 break; /* Out of address loop */
2310 }
2311
2312 /* Advance to the next address */
2313
2314 s = ss + (terminator ? 1 : 0);
2315 while (isspace(*s)) s++;
2316 } /* Next address */
2317
2318 f.parse_allow_group = FALSE;
2319 f.parse_found_group = FALSE;
2320 } /* Next header unless yield has been set FALSE */
2321
2322 return yield;
2323 }
2324
2325
2326 /*************************************************
2327 * Check header names for 8-bit characters *
2328 *************************************************/
2329
2330 /* This function checks for invalid characters in header names. See
2331 RFC 5322, 2.2. and RFC 6532, 3.
2332
2333 Arguments:
2334 msgptr where to put an error message
2335
2336 Returns: OK
2337 FAIL
2338 */
2339
2340 int
2341 verify_check_header_names_ascii(uschar **msgptr)
2342 {
2343 uschar *colon;
2344
2345 for (header_line * h = header_list; h; h = h->next)
2346 {
2347 colon = Ustrchr(h->text, ':');
2348 for(uschar * s = h->text; s < colon; s++)
2349 if ((*s < 33) || (*s > 126))
2350 {
2351 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2352 colon - h->text, h->text);
2353 return FAIL;
2354 }
2355 }
2356 return OK;
2357 }
2358
2359 /*************************************************
2360 * Check for blind recipients *
2361 *************************************************/
2362
2363 /* This function checks that every (envelope) recipient is mentioned in either
2364 the To: or Cc: header lines, thus detecting blind carbon copies.
2365
2366 There are two ways of scanning that could be used: either scan the header lines
2367 and tick off the recipients, or scan the recipients and check the header lines.
2368 The original proposed patch did the former, but I have chosen to do the latter,
2369 because (a) it requires no memory and (b) will use fewer resources when there
2370 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2371
2372 Arguments: case_sensitive true if case sensitive matching should be used
2373 Returns: OK if there are no blind recipients
2374 FAIL if there is at least one blind recipient
2375 */
2376
2377 int
2378 verify_check_notblind(BOOL case_sensitive)
2379 {
2380 for (int i = 0; i < recipients_count; i++)
2381 {
2382 BOOL found = FALSE;
2383 uschar *address = recipients_list[i].address;
2384
2385 for (header_line * h = header_list; !found && h; h = h->next)
2386 {
2387 uschar *colon, *s;
2388
2389 if (h->type != htype_to && h->type != htype_cc) continue;
2390
2391 colon = Ustrchr(h->text, ':');
2392 s = colon + 1;
2393 while (isspace(*s)) s++;
2394
2395 /* Loop for multiple addresses in the header, enabling group syntax. Note
2396 that we have to reset this after the header has been scanned. */
2397
2398 f.parse_allow_group = TRUE;
2399
2400 while (*s)
2401 {
2402 uschar * ss = parse_find_address_end(s, FALSE);
2403 uschar * recipient, * errmess;
2404 int terminator = *ss;
2405 int start, end, domain;
2406
2407 /* Temporarily terminate the string at this point, and extract the
2408 operative address within, allowing group syntax. */
2409
2410 *ss = 0;
2411 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2412 *ss = terminator;
2413
2414 /* If we found a valid recipient that has a domain, compare it with the
2415 envelope recipient. Local parts are compared with case-sensitivity
2416 according to the routine arg, domains case-insensitively.
2417 By comparing from the start with length "domain", we include the "@" at
2418 the end, which ensures that we are comparing the whole local part of each
2419 address. */
2420
2421 if (recipient && domain != 0)
2422 if ((found = (case_sensitive
2423 ? Ustrncmp(recipient, address, domain) == 0
2424 : strncmpic(recipient, address, domain) == 0)
2425 && strcmpic(recipient + domain, address + domain) == 0))
2426 break;
2427
2428 /* Advance to the next address */
2429
2430 s = ss + (terminator ? 1:0);
2431 while (isspace(*s)) s++;
2432 } /* Next address */
2433
2434 f.parse_allow_group = FALSE;
2435 f.parse_found_group = FALSE;
2436 } /* Next header (if found is false) */
2437
2438 if (!found) return FAIL;
2439 } /* Next recipient */
2440
2441 return OK;
2442 }
2443
2444
2445
2446 /*************************************************
2447 * Find if verified sender *
2448 *************************************************/
2449
2450 /* Usually, just a single address is verified as the sender of the message.
2451 However, Exim can be made to verify other addresses as well (often related in
2452 some way), and this is useful in some environments. There may therefore be a
2453 chain of such addresses that have previously been tested. This function finds
2454 whether a given address is on the chain.
2455
2456 Arguments: the address to be verified
2457 Returns: pointer to an address item, or NULL
2458 */
2459
2460 address_item *
2461 verify_checked_sender(uschar *sender)
2462 {
2463 for (address_item * addr = sender_verified_list; addr; addr = addr->next)
2464 if (Ustrcmp(sender, addr->address) == 0) return addr;
2465 return NULL;
2466 }
2467
2468
2469
2470
2471
2472 /*************************************************
2473 * Get valid header address *
2474 *************************************************/
2475
2476 /* Scan the originator headers of the message, looking for an address that
2477 verifies successfully. RFC 822 says:
2478
2479 o The "Sender" field mailbox should be sent notices of
2480 any problems in transport or delivery of the original
2481 messages. If there is no "Sender" field, then the
2482 "From" field mailbox should be used.
2483
2484 o If the "Reply-To" field exists, then the reply should
2485 go to the addresses indicated in that field and not to
2486 the address(es) indicated in the "From" field.
2487
2488 So we check a Sender field if there is one, else a Reply_to field, else a From
2489 field. As some strange messages may have more than one of these fields,
2490 especially if they are resent- fields, check all of them if there is more than
2491 one.
2492
2493 Arguments:
2494 user_msgptr points to where to put a user error message
2495 log_msgptr points to where to put a log error message
2496 callout timeout for callout check (passed to verify_address())
2497 callout_overall overall callout timeout (ditto)
2498 callout_connect connect callout timeout (ditto)
2499 se_mailfrom mailfrom for verify; NULL => ""
2500 pm_mailfrom sender for pm callout check (passed to verify_address())
2501 options callout options (passed to verify_address())
2502 verrno where to put the address basic_errno
2503
2504 If log_msgptr is set to something without setting user_msgptr, the caller
2505 normally uses log_msgptr for both things.
2506
2507 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2508 FAIL is given if no appropriate headers are found
2509 */
2510
2511 int
2512 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2513 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2514 uschar *pm_mailfrom, int options, int *verrno)
2515 {
2516 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2517 BOOL done = FALSE;
2518 int yield = FAIL;
2519
2520 for (int i = 0; i < 3 && !done; i++)
2521 for (header_line * h = header_list; h != NULL && !done; h = h->next)
2522 {
2523 int terminator, new_ok;
2524 uschar *s, *ss, *endname;
2525
2526 if (h->type != header_types[i]) continue;
2527 s = endname = Ustrchr(h->text, ':') + 1;
2528
2529 /* Scan the addresses in the header, enabling group syntax. Note that we
2530 have to reset this after the header has been scanned. */
2531
2532 f.parse_allow_group = TRUE;
2533
2534 while (*s != 0)
2535 {
2536 address_item *vaddr;
2537
2538 while (isspace(*s) || *s == ',') s++;
2539 if (*s == 0) break; /* End of header */
2540
2541 ss = parse_find_address_end(s, FALSE);
2542
2543 /* The terminator is a comma or end of header, but there may be white
2544 space preceding it (including newline for the last address). Move back
2545 past any white space so we can check against any cached envelope sender
2546 address verifications. */
2547
2548 while (isspace(ss[-1])) ss--;
2549 terminator = *ss;
2550 *ss = 0;
2551
2552 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2553 (int)(endname - h->text), h->text, s);
2554
2555 /* See if we have already verified this address as an envelope sender,
2556 and if so, use the previous answer. */
2557
2558 vaddr = verify_checked_sender(s);
2559
2560 if (vaddr != NULL && /* Previously checked */
2561 (callout <= 0 || /* No callout needed; OR */
2562 vaddr->special_action > 256)) /* Callout was done */
2563 {
2564 new_ok = vaddr->special_action & 255;
2565 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2566 *ss = terminator; /* Restore shortened string */
2567 }
2568
2569 /* Otherwise we run the verification now. We must restore the shortened
2570 string before running the verification, so the headers are correct, in
2571 case there is any rewriting. */
2572
2573 else
2574 {
2575 int start, end, domain;
2576 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2577 &domain, FALSE);
2578
2579 *ss = terminator;
2580
2581 /* If we found an empty address, just carry on with the next one, but
2582 kill the message. */
2583
2584 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2585 {
2586 *log_msgptr = NULL;
2587 s = ss;
2588 continue;
2589 }
2590
2591 /* If verification failed because of a syntax error, fail this
2592 function, and ensure that the failing address gets added to the error
2593 message. */
2594
2595 if (address == NULL)
2596 {
2597 new_ok = FAIL;
2598 while (ss > s && isspace(ss[-1])) ss--;
2599 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2600 "scanning for sender: %s in \"%.*s\"",
2601 (int)(endname - h->text), h->text, *log_msgptr, (int)(ss - s), s);
2602 yield = FAIL;
2603 done = TRUE;
2604 break;
2605 }
2606
2607 /* Else go ahead with the sender verification. But it isn't *the*
2608 sender of the message, so set vopt_fake_sender to stop sender_address
2609 being replaced after rewriting or qualification. */
2610
2611 else
2612 {
2613 vaddr = deliver_make_addr(address, FALSE);
2614 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2615 callout, callout_overall, callout_connect, se_mailfrom,
2616 pm_mailfrom, NULL);
2617 }
2618 }
2619
2620 /* We now have the result, either newly found, or cached. If we are
2621 giving out error details, set a specific user error. This means that the
2622 last of these will be returned to the user if all three fail. We do not
2623 set a log message - the generic one below will be used. */
2624
2625 if (new_ok != OK)
2626 {
2627 *verrno = vaddr->basic_errno;
2628 if (smtp_return_error_details)
2629 *user_msgptr = string_sprintf("Rejected after DATA: "
2630 "could not verify \"%.*s\" header address\n%s: %s",
2631 (int)(endname - h->text), h->text, vaddr->address, vaddr->message);
2632 }
2633
2634 /* Success or defer */
2635
2636 if (new_ok == OK)
2637 {
2638 yield = OK;
2639 done = TRUE;
2640 break;
2641 }
2642
2643 if (new_ok == DEFER) yield = DEFER;
2644
2645 /* Move on to any more addresses in the header */
2646
2647 s = ss;
2648 } /* Next address */
2649
2650 f.parse_allow_group = FALSE;
2651 f.parse_found_group = FALSE;
2652 } /* Next header, unless done */
2653 /* Next header type unless done */
2654
2655 if (yield == FAIL && *log_msgptr == NULL)
2656 *log_msgptr = US"there is no valid sender in any header line";
2657
2658 if (yield == DEFER && *log_msgptr == NULL)
2659 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2660
2661 return yield;
2662 }
2663
2664
2665
2666
2667 /*************************************************
2668 * Get RFC 1413 identification *
2669 *************************************************/
2670
2671 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2672 the timeout is set to zero, then the query is not done. There may also be lists
2673 of hosts and nets which are exempt. To guard against malefactors sending
2674 non-printing characters which could, for example, disrupt a message's headers,
2675 make sure the string consists of printing characters only.
2676
2677 Argument:
2678 port the port to connect to; usually this is IDENT_PORT (113), but when
2679 running in the test harness with -bh a different value is used.
2680
2681 Returns: nothing
2682
2683 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2684 */
2685
2686 void
2687 verify_get_ident(int port)
2688 {
2689 client_conn_ctx ident_conn_ctx = {0};
2690 int host_af, qlen;
2691 int received_sender_port, received_interface_port, n;
2692 uschar *p;
2693 blob early_data;
2694 uschar buffer[2048];
2695
2696 /* Default is no ident. Check whether we want to do an ident check for this
2697 host. */
2698
2699 sender_ident = NULL;
2700 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2701 return;
2702
2703 DEBUG(D_ident) debug_printf("doing ident callback\n");
2704
2705 /* Set up a connection to the ident port of the remote host. Bind the local end
2706 to the incoming interface address. If the sender host address is an IPv6
2707 address, the incoming interface address will also be IPv6. */
2708
2709 host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
2710 if ((ident_conn_ctx.sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
2711
2712 if (ip_bind(ident_conn_ctx.sock, host_af, interface_address, 0) < 0)
2713 {
2714 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2715 strerror(errno));
2716 goto END_OFF;
2717 }
2718
2719 /* Construct and send the query. */
2720
2721 qlen = snprintf(CS buffer, sizeof(buffer), "%d , %d\r\n",
2722 sender_host_port, interface_port);
2723 early_data.data = buffer;
2724 early_data.len = qlen;
2725
2726 /*XXX we trust that the query is idempotent */
2727 if (ip_connect(ident_conn_ctx.sock, host_af, sender_host_address, port,
2728 rfc1413_query_timeout, &early_data) < 0)
2729 {
2730 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
2731 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2732 sender_host_address);
2733 else
2734 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2735 sender_host_address, strerror(errno));
2736 goto END_OFF;
2737 }
2738
2739 /* Read a response line. We put it into the rest of the buffer, using several
2740 recv() calls if necessary. */
2741
2742 p = buffer + qlen;
2743
2744 for (;;)
2745 {
2746 uschar *pp;
2747 int count;
2748 int size = sizeof(buffer) - (p - buffer);
2749
2750 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2751 count = ip_recv(&ident_conn_ctx, p, size, rfc1413_query_timeout);
2752 if (count <= 0) goto END_OFF; /* Read error or EOF */
2753
2754 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2755 generous, and accept a plain \n terminator as well. The only illegal
2756 character is 0. */
2757
2758 for (pp = p; pp < p + count; pp++)
2759 {
2760 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2761 if (*pp == '\n')
2762 {
2763 if (pp[-1] == '\r') pp--;
2764 *pp = 0;
2765 goto GOT_DATA; /* Break out of both loops */
2766 }
2767 }
2768
2769 /* Reached the end of the data without finding \n. Let the loop continue to
2770 read some more, if there is room. */
2771
2772 p = pp;
2773 }
2774
2775 GOT_DATA:
2776
2777 /* We have received a line of data. Check it carefully. It must start with the
2778 same two port numbers that we sent, followed by data as defined by the RFC. For
2779 example,
2780
2781 12345 , 25 : USERID : UNIX :root
2782
2783 However, the amount of white space may be different to what we sent. In the
2784 "osname" field there may be several sub-fields, comma separated. The data we
2785 actually want to save follows the third colon. Some systems put leading spaces
2786 in it - we discard those. */
2787
2788 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2789 &received_interface_port, &n) != 2 ||
2790 received_sender_port != sender_host_port ||
2791 received_interface_port != interface_port)
2792 goto END_OFF;
2793
2794 p = buffer + qlen + n;
2795 while(isspace(*p)) p++;
2796 if (*p++ != ':') goto END_OFF;
2797 while(isspace(*p)) p++;
2798 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2799 p += 6;
2800 while(isspace(*p)) p++;
2801 if (*p++ != ':') goto END_OFF;
2802 while (*p != 0 && *p != ':') p++;
2803 if (*p++ == 0) goto END_OFF;
2804 while(isspace(*p)) p++;
2805 if (*p == 0) goto END_OFF;
2806
2807 /* The rest of the line is the data we want. We turn it into printing
2808 characters when we save it, so that it cannot mess up the format of any logging
2809 or Received: lines into which it gets inserted. We keep a maximum of 127
2810 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
2811
2812 sender_ident = US string_printing(string_copyn(p, 127));
2813 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2814
2815 END_OFF:
2816 (void)close(ident_conn_ctx.sock);
2817 return;
2818 }
2819
2820
2821
2822
2823 /*************************************************
2824 * Match host to a single host-list item *
2825 *************************************************/
2826
2827 /* This function compares a host (name or address) against a single item
2828 from a host list. The host name gets looked up if it is needed and is not
2829 already known. The function is called from verify_check_this_host() via
2830 match_check_list(), which is why most of its arguments are in a single block.
2831
2832 Arguments:
2833 arg the argument block (see below)
2834 ss the host-list item
2835 valueptr where to pass back looked up data, or NULL
2836 error for error message when returning ERROR
2837
2838 The block contains:
2839 host_name (a) the host name, or
2840 (b) NULL, implying use sender_host_name and
2841 sender_host_aliases, looking them up if required, or
2842 (c) the empty string, meaning that only IP address matches
2843 are permitted
2844 host_address the host address
2845 host_ipv4 the IPv4 address taken from an IPv6 one
2846
2847 Returns: OK matched
2848 FAIL did not match
2849 DEFER lookup deferred
2850 ERROR (a) failed to find the host name or IP address, or
2851 (b) unknown lookup type specified, or
2852 (c) host name encountered when only IP addresses are
2853 being matched
2854 */
2855
2856 int
2857 check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
2858 {
2859 check_host_block *cb = (check_host_block *)arg;
2860 int mlen = -1;
2861 int maskoffset;
2862 BOOL iplookup = FALSE;
2863 BOOL isquery = FALSE;
2864 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
2865 const uschar *t;
2866 uschar *semicolon;
2867 uschar **aliases;
2868
2869 /* Optimize for the special case when the pattern is "*". */
2870
2871 if (*ss == '*' && ss[1] == 0) return OK;
2872
2873 /* If the pattern is empty, it matches only in the case when there is no host -
2874 this can occur in ACL checking for SMTP input using the -bs option. In this
2875 situation, the host address is the empty string. */
2876
2877 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2878 if (*ss == 0) return FAIL;
2879
2880 /* If the pattern is precisely "@" then match against the primary host name,
2881 provided that host name matching is permitted; if it's "@[]" match against the
2882 local host's IP addresses. */
2883
2884 if (*ss == '@')
2885 {
2886 if (ss[1] == 0)
2887 {
2888 if (isiponly) return ERROR;
2889 ss = primary_hostname;
2890 }
2891 else if (Ustrcmp(ss, "@[]") == 0)
2892 {
2893 for (ip_address_item * ip = host_find_interfaces(); ip; ip = ip->next)
2894 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2895 return FAIL;
2896 }
2897 }
2898
2899 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2900 a (possibly masked) comparison with the current IP address. */
2901
2902 if (string_is_ip_address(ss, &maskoffset) != 0)
2903 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2904
2905 /* The pattern is not an IP address. A common error that people make is to omit
2906 one component of an IPv4 address, either by accident, or believing that, for
2907 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2908 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2909 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2910 ancient specification.) To aid in debugging these cases, we give a specific
2911 error if the pattern contains only digits and dots or contains a slash preceded
2912 only by digits and dots (a slash at the start indicates a file name and of
2913 course slashes may be present in lookups, but not preceded only by digits and
2914 dots). */
2915
2916 for (t = ss; isdigit(*t) || *t == '.'; ) t++;
2917 if (*t == 0 || (*t == '/' && t != ss))
2918 {
2919 *error = US"malformed IPv4 address or address mask";
2920 return ERROR;
2921 }
2922
2923 /* See if there is a semicolon in the pattern */
2924
2925 semicolon = Ustrchr(ss, ';');
2926
2927 /* If we are doing an IP address only match, then all lookups must be IP
2928 address lookups, even if there is no "net-". */
2929
2930 if (isiponly)
2931 {
2932 iplookup = semicolon != NULL;
2933 }
2934
2935 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
2936 a lookup on a masked IP network, in textual form. We obey this code even if we
2937 have already set iplookup, so as to skip over the "net-" prefix and to set the
2938 mask length. The net- stuff really only applies to single-key lookups where the
2939 key is implicit. For query-style lookups the key is specified in the query.
2940 From release 4.30, the use of net- for query style is no longer needed, but we
2941 retain it for backward compatibility. */
2942
2943 if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
2944 {
2945 mlen = 0;
2946 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2947 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2948 iplookup = (*t++ == '-');
2949 }
2950 else
2951 t = ss;
2952
2953 /* Do the IP address lookup if that is indeed what we have */
2954
2955 if (iplookup)
2956 {
2957 int insize;
2958 int search_type;
2959 int incoming[4];
2960 void *handle;
2961 uschar *filename, *key, *result;
2962 uschar buffer[64];
2963
2964 /* Find the search type */
2965
2966 search_type = search_findtype(t, semicolon - t);
2967
2968 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2969 search_error_message);
2970
2971 /* Adjust parameters for the type of lookup. For a query-style lookup, there
2972 is no file name, and the "key" is just the query. For query-style with a file
2973 name, we have to fish the file off the start of the query. For a single-key
2974 lookup, the key is the current IP address, masked appropriately, and
2975 reconverted to text form, with the mask appended. For IPv6 addresses, specify
2976 dot separators instead of colons, except when the lookup type is "iplsearch".
2977 */
2978
2979 if (mac_islookup(search_type, lookup_absfilequery))
2980 {
2981 filename = semicolon + 1;
2982 key = filename;
2983 while (*key != 0 && !isspace(*key)) key++;
2984 filename = string_copyn(filename, key - filename);
2985 while (isspace(*key)) key++;
2986 }
2987 else if (mac_islookup(search_type, lookup_querystyle))
2988 {
2989 filename = NULL;
2990 key = semicolon + 1;
2991 }
2992 else /* Single-key style */
2993 {
2994 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
2995 ':' : '.';
2996 insize = host_aton(cb->host_address, incoming);
2997 host_mask(insize, incoming, mlen);
2998 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
2999 key = buffer;
3000 filename = semicolon + 1;
3001 }
3002
3003 /* Now do the actual lookup; note that there is no search_close() because
3004 of the caching arrangements. */
3005
3006 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3007 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3008
3009 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
3010 if (valueptr) *valueptr = result;
3011 return result ? OK : f.search_find_defer ? DEFER: FAIL;
3012 }
3013
3014 /* The pattern is not an IP address or network reference of any kind. That is,
3015 it is a host name pattern. If this is an IP only match, there's an error in the
3016 host list. */
3017
3018 if (isiponly)
3019 {
3020 *error = US"cannot match host name in match_ip list";
3021 return ERROR;
3022 }
3023
3024 /* Check the characters of the pattern to see if they comprise only letters,
3025 digits, full stops, and hyphens (the constituents of domain names). Allow
3026 underscores, as they are all too commonly found. Sigh. Also, if
3027 allow_utf8_domains is set, allow top-bit characters. */
3028
3029 for (t = ss; *t != 0; t++)
3030 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3031 (!allow_utf8_domains || *t < 128)) break;
3032
3033 /* If the pattern is a complete domain name, with no fancy characters, look up
3034 its IP address and match against that. Note that a multi-homed host will add
3035 items to the chain. */
3036
3037 if (*t == 0)
3038 {
3039 int rc;
3040 host_item h;
3041 h.next = NULL;
3042 h.name = ss;
3043 h.address = NULL;
3044 h.mx = MX_NONE;
3045
3046 /* Using byname rather than bydns here means we cannot determine dnssec
3047 status. On the other hand it is unclear how that could be either
3048 propagated up or enforced. */
3049
3050 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3051 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3052 {
3053 for (host_item * hh = &h; hh; hh = hh->next)
3054 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3055 return FAIL;
3056 }
3057 if (rc == HOST_FIND_AGAIN) return DEFER;
3058 *error = string_sprintf("failed to find IP address for %s", ss);
3059 return ERROR;
3060 }
3061
3062 /* Almost all subsequent comparisons require the host name, and can be done
3063 using the general string matching function. When this function is called for
3064 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3065 must use sender_host_name and its aliases, looking them up if necessary. */
3066
3067 if (cb->host_name != NULL) /* Explicit host name given */
3068 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3069 valueptr);
3070
3071 /* Host name not given; in principle we need the sender host name and its
3072 aliases. However, for query-style lookups, we do not need the name if the
3073 query does not contain $sender_host_name. From release 4.23, a reference to
3074 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3075 on spec. */
3076
3077 if ((semicolon = Ustrchr(ss, ';')) != NULL)
3078 {
3079 const uschar *affix;
3080 int partial, affixlen, starflags, id;
3081
3082 *semicolon = 0;
3083 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
3084 *semicolon=';';
3085
3086 if (id < 0) /* Unknown lookup type */
3087 {
3088 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3089 search_error_message, ss);
3090 return DEFER;
3091 }
3092 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3093 }
3094
3095 if (isquery)
3096 {
3097 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3098 {
3099 case OK: return OK;
3100 case DEFER: return DEFER;
3101 default: return FAIL;
3102 }
3103 }
3104
3105 /* Not a query-style lookup; must ensure the host name is present, and then we
3106 do a check on the name and all its aliases. */
3107
3108 if (!sender_host_name)
3109 {
3110 HDEBUG(D_host_lookup)
3111 debug_printf("sender host name required, to match against %s\n", ss);
3112 if (host_lookup_failed || host_name_lookup() != OK)
3113 {
3114 *error = string_sprintf("failed to find host name for %s",
3115 sender_host_address);;
3116 return ERROR;
3117 }
3118 host_build_sender_fullhost();
3119 }
3120
3121 /* Match on the sender host name, using the general matching function */
3122
3123 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE, valueptr))
3124 {
3125 case OK: return OK;
3126 case DEFER: return DEFER;
3127 }
3128
3129 /* If there are aliases, try matching on them. */
3130
3131 aliases = sender_host_aliases;
3132 while (*aliases)
3133 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3134 {
3135 case OK: return OK;
3136 case DEFER: return DEFER;
3137 }
3138 return FAIL;
3139 }
3140
3141
3142
3143
3144 /*************************************************
3145 * Check a specific host matches a host list *
3146 *************************************************/
3147
3148 /* This function is passed a host list containing items in a number of
3149 different formats and the identity of a host. Its job is to determine whether
3150 the given host is in the set of hosts defined by the list. The host name is
3151 passed as a pointer so that it can be looked up if needed and not already
3152 known. This is commonly the case when called from verify_check_host() to check
3153 an incoming connection. When called from elsewhere the host name should usually
3154 be set.
3155
3156 This function is now just a front end to match_check_list(), which runs common
3157 code for scanning a list. We pass it the check_host() function to perform a
3158 single test.
3159
3160 Arguments:
3161 listptr pointer to the host list
3162 cache_bits pointer to cache for named lists, or NULL
3163 host_name the host name or NULL, implying use sender_host_name and
3164 sender_host_aliases, looking them up if required
3165 host_address the IP address
3166 valueptr if not NULL, data from a lookup is passed back here
3167
3168 Returns: OK if the host is in the defined set
3169 FAIL if the host is not in the defined set,
3170 DEFER if a data lookup deferred (not a host lookup)
3171
3172 If the host name was needed in order to make a comparison, and could not be
3173 determined from the IP address, the result is FAIL unless the item
3174 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3175
3176 int
3177 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3178 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3179 {
3180 int rc;
3181 unsigned int *local_cache_bits = cache_bits;
3182 const uschar *save_host_address = deliver_host_address;
3183 check_host_block cb = { .host_name = host_name, .host_address = host_address };
3184
3185 if (valueptr) *valueptr = NULL;
3186
3187 /* If the host address starts off ::ffff: it is an IPv6 address in
3188 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3189 addresses. */
3190
3191 cb.host_ipv4 = Ustrncmp(host_address, "::ffff:", 7) == 0
3192 ? host_address + 7 : host_address;
3193
3194 /* During the running of the check, put the IP address into $host_address. In
3195 the case of calls from the smtp transport, it will already be there. However,
3196 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3197 the safe side, any existing setting is preserved, though as I write this
3198 (November 2004) I can't see any cases where it is actually needed. */
3199
3200 deliver_host_address = host_address;
3201 rc = match_check_list(
3202 listptr, /* the list */
3203 0, /* separator character */
3204 &hostlist_anchor, /* anchor pointer */
3205 &local_cache_bits, /* cache pointer */
3206 check_host, /* function for testing */
3207 &cb, /* argument for function */
3208 MCL_HOST, /* type of check */
3209 (host_address == sender_host_address)?
3210 US"host" : host_address, /* text for debugging */
3211 valueptr); /* where to pass back data */
3212 deliver_host_address = save_host_address;
3213 return rc;
3214 }
3215
3216
3217
3218
3219 /*************************************************
3220 * Check the given host item matches a list *
3221 *************************************************/
3222 int
3223 verify_check_given_host(const uschar **listptr, const host_item *host)
3224 {
3225 return verify_check_this_host(listptr, NULL, host->name, host->address, NULL);
3226 }
3227
3228 /*************************************************
3229 * Check the remote host matches a list *
3230 *************************************************/
3231
3232 /* This is a front end to verify_check_this_host(), created because checking
3233 the remote host is a common occurrence. With luck, a good compiler will spot
3234 the tail recursion and optimize it. If there's no host address, this is
3235 command-line SMTP input - check against an empty string for the address.
3236
3237 Arguments:
3238 listptr pointer to the host list
3239
3240 Returns: the yield of verify_check_this_host(),
3241 i.e. OK, FAIL, or DEFER
3242 */
3243
3244 int
3245 verify_check_host(uschar **listptr)
3246 {
3247 return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
3248 sender_host_address ? sender_host_address : US"", NULL);
3249 }
3250
3251
3252
3253
3254
3255 /*************************************************
3256 * Invert an IP address *
3257 *************************************************/
3258
3259 /* Originally just used for DNS xBL lists, now also used for the
3260 reverse_ip expansion operator.
3261
3262 Arguments:
3263 buffer where to put the answer
3264 address the address to invert
3265 */
3266
3267 void
3268 invert_address(uschar *buffer, uschar *address)
3269 {
3270 int bin[4];
3271 uschar *bptr = buffer;
3272
3273 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3274 to the IPv4 part only. */
3275
3276 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3277
3278 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3279 always 1. */
3280
3281 if (host_aton(address, bin) == 1)
3282 {
3283 int x = bin[0];
3284 for (int i = 0; i < 4; i++)
3285 {
3286 sprintf(CS bptr, "%d.", x & 255);
3287 while (*bptr) bptr++;
3288 x >>= 8;
3289 }
3290 }
3291
3292 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3293 in any DNS black lists, and the format in which they will be looked up is
3294 unknown. This is just a guess. */
3295
3296 #if HAVE_IPV6
3297 else
3298 for (int j = 3; j >= 0; j--)
3299 {
3300 int x = bin[j];
3301 for (int i = 0; i < 8; i++)
3302 {
3303 sprintf(CS bptr, "%x.", x & 15);
3304 while (*bptr) bptr++;
3305 x >>= 4;
3306 }
3307 }
3308 #endif
3309
3310 /* Remove trailing period -- this is needed so that both arbitrary
3311 dnsbl keydomains and inverted addresses may be combined with the
3312 same format string, "%s.%s" */
3313
3314 *(--bptr) = 0;
3315 }
3316
3317
3318
3319 /*************************************************
3320 * Perform a single dnsbl lookup *
3321 *************************************************/
3322
3323 /* This function is called from verify_check_dnsbl() below. It is also called
3324 recursively from within itself when domain and domain_txt are different
3325 pointers, in order to get the TXT record from the alternate domain.
3326
3327 Arguments:
3328 domain the outer dnsbl domain
3329 domain_txt alternate domain to lookup TXT record on success; when the
3330 same domain is to be used, domain_txt == domain (that is,
3331 the pointers must be identical, not just the text)
3332 keydomain the current keydomain (for debug message)
3333 prepend subdomain to lookup (like keydomain, but
3334 reversed if IP address)
3335 iplist the list of matching IP addresses, or NULL for "any"
3336 bitmask true if bitmask matching is wanted
3337 match_type condition for 'succeed' result
3338 0 => Any RR in iplist (=)
3339 1 => No RR in iplist (!=)
3340 2 => All RRs in iplist (==)
3341 3 => Some RRs not in iplist (!==)
3342 the two bits are defined as MT_NOT and MT_ALL
3343 defer_return what to return for a defer
3344
3345 Returns: OK if lookup succeeded
3346 FAIL if not
3347 */
3348
3349 static int
3350 one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain,
3351 uschar *prepend, uschar *iplist, BOOL bitmask, int match_type,
3352 int defer_return)
3353 {
3354 dns_answer dnsa;
3355 dns_scan dnss;
3356 tree_node *t;
3357 dnsbl_cache_block *cb;
3358 int old_pool = store_pool;
3359 uschar query[256]; /* DNS domain max length */
3360
3361 /* Construct the specific query domainname */
3362
3363 if (!string_format(query, sizeof(query), "%s.%s", prepend, domain))
3364 {
3365 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
3366 "(ignored): %s...", query);
3367 return FAIL;
3368 }
3369
3370 /* Look for this query in the cache. */
3371
3372 if ( (t = tree_search(dnsbl_cache, query))
3373 && (cb = t->data.ptr)->expiry > time(NULL)
3374 )
3375
3376 /* Previous lookup was cached */
3377
3378 {
3379 HDEBUG(D_dnsbl) debug_printf("using result of previous DNS lookup\n");
3380 }
3381
3382 /* If not cached from a previous lookup, we must do a DNS lookup, and
3383 cache the result in permanent memory. */
3384
3385 else
3386 {
3387 uint ttl = 3600;
3388
3389 store_pool = POOL_PERM;
3390
3391 if (t)
3392 {
3393 HDEBUG(D_dnsbl) debug_printf("cached data found but past valid time; ");
3394 }
3395
3396 else
3397 { /* Set up a tree entry to cache the lookup */
3398 t = store_get(sizeof(tree_node) + Ustrlen(query));
3399 Ustrcpy(t->name, query);
3400 t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block));
3401 (void)tree_insertnode(&dnsbl_cache, t);
3402 }
3403
3404 /* Do the DNS lookup . */
3405
3406 HDEBUG(D_dnsbl) debug_printf("new DNS lookup for %s\n", query);
3407 cb->rc = dns_basic_lookup(&dnsa, query, T_A);
3408 cb->text_set = FALSE;
3409 cb->text = NULL;
3410 cb->rhs = NULL;
3411
3412 /* If the lookup succeeded, cache the RHS address. The code allows for
3413 more than one address - this was for complete generality and the possible
3414 use of A6 records. However, A6 records are no longer supported. Leave the code
3415 here, just in case.
3416
3417 Quite apart from one A6 RR generating multiple addresses, there are DNS
3418 lists that return more than one A record, so we must handle multiple
3419 addresses generated in that way as well.
3420
3421 Mark the cache entry with the "now" plus the minimum of the address TTLs,
3422 or some suitably far-future time if none were found. */
3423
3424 if (cb->rc == DNS_SUCCEED)
3425 {
3426 dns_address ** addrp = &(cb->rhs);
3427 for (dns_record * rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS); rr;
3428 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
3429 if (rr->type == T_A)
3430 {
3431 dns_address *da = dns_address_from_rr(&dnsa, rr);
3432 if (da)
3433 {
3434 *addrp = da;
3435 while (da->next) da = da->next;
3436 addrp = &da->next;
3437 if (ttl > rr->ttl) ttl = rr->ttl;
3438 }
3439 }
3440
3441 /* If we didn't find any A records, change the return code. This can
3442 happen when there is a CNAME record but there are no A records for what
3443 it points to. */
3444
3445 if (!cb->rhs) cb->rc = DNS_NODATA;
3446 }
3447
3448 cb->expiry = time(NULL)+ttl;
3449 store_pool = old_pool;
3450 }
3451
3452 /* We now have the result of the DNS lookup, either newly done, or cached
3453 from a previous call. If the lookup succeeded, check against the address
3454 list if there is one. This may be a positive equality list (introduced by
3455 "="), a negative equality list (introduced by "!="), a positive bitmask
3456 list (introduced by "&"), or a negative bitmask list (introduced by "!&").*/
3457
3458 if (cb->rc == DNS_SUCCEED)
3459 {
3460 dns_address *da = NULL;
3461 uschar *addlist = cb->rhs->address;
3462
3463 /* For A and AAAA records, there may be multiple addresses from multiple
3464 records. For A6 records (currently not expected to be used) there may be
3465 multiple addresses from a single record. */
3466
3467 for (da = cb->rhs->next; da; da = da->next)
3468 addlist = string_sprintf("%s, %s", addlist, da->address);
3469
3470 HDEBUG(D_dnsbl) debug_printf("DNS lookup for %s succeeded (yielding %s)\n",
3471 query, addlist);
3472
3473 /* Address list check; this can be either for equality, or via a bitmask.
3474 In the latter case, all the bits must match. */
3475
3476 if (iplist)
3477 {
3478 for (da = cb->rhs; da; da = da->next)
3479 {
3480 int ipsep = ',';
3481 uschar ip[46];
3482 const uschar *ptr = iplist;
3483 uschar *res;
3484
3485 /* Handle exact matching */
3486
3487 if (!bitmask)
3488 {
3489 while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip))))
3490 if (Ustrcmp(CS da->address, ip) == 0)
3491 break;
3492 }
3493
3494 /* Handle bitmask matching */
3495
3496 else
3497 {
3498 int address[4];
3499 int mask = 0;
3500
3501 /* At present, all known DNS blocking lists use A records, with
3502 IPv4 addresses on the RHS encoding the information they return. I
3503 wonder if this will linger on as the last vestige of IPv4 when IPv6
3504 is ubiquitous? Anyway, for now we use paranoia code to completely
3505 ignore IPv6 addresses. The default mask is 0, which always matches.
3506 We change this only for IPv4 addresses in the list. */
3507
3508 if (host_aton(da->address, address) == 1) mask = address[0];
3509
3510 /* Scan the returned addresses, skipping any that are IPv6 */
3511
3512 while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip))))
3513 {
3514 if (host_aton(ip, address) != 1) continue;
3515 if ((address[0] & mask) == address[0]) break;
3516 }
3517 }
3518
3519 /* If either
3520
3521 (a) An IP address in an any ('=') list matched, or
3522 (b) No IP address in an all ('==') list matched
3523
3524 then we're done searching. */
3525
3526 if (((match_type & MT_ALL) != 0) == (res == NULL)) break;
3527 }
3528
3529 /* If da == NULL, either
3530
3531 (a) No IP address in an any ('=') list matched, or
3532 (b) An IP address in an all ('==') list didn't match
3533
3534 so behave as if the DNSBL lookup had not succeeded, i.e. the host is not on
3535 the list. */
3536
3537 if ((match_type == MT_NOT || match_type == MT_ALL) != (da == NULL))
3538 {
3539 HDEBUG(D_dnsbl)
3540 {
3541 uschar *res = NULL;
3542 switch(match_type)
3543 {
3544 case 0:
3545 res = US"was no match"; break;
3546 case MT_NOT:
3547 res = US"was an exclude match"; break;
3548 case MT_ALL:
3549 res = US"was an IP address that did not match"; break;
3550 case MT_NOT|MT_ALL:
3551 res = US"were no IP addresses that did not match"; break;
3552 }
3553 debug_printf("=> but we are not accepting this block class because\n");
3554 debug_printf("=> there %s for %s%c%s\n",
3555 res,
3556 ((match_type & MT_ALL) == 0)? "" : "=",
3557 bitmask? '&' : '=', iplist);
3558 }
3559 return FAIL;
3560 }
3561 }
3562
3563 /* Either there was no IP list, or the record matched, implying that the
3564 domain is on the list. We now want to find a corresponding TXT record. If an
3565 alternate domain is specified for the TXT record, call this function
3566 recursively to look that up; this has the side effect of re-checking that
3567 there is indeed an A record at the alternate domain. */
3568
3569 if (domain_txt != domain)
3570 return one_check_dnsbl(domain_txt, domain_txt, keydomain, prepend, NULL,
3571 FALSE, match_type, defer_return);
3572
3573 /* If there is no alternate domain, look up a TXT record in the main domain
3574 if it has not previously been cached. */
3575
3576 if (!cb->text_set)
3577 {
3578 cb->text_set = TRUE;
3579 if (dns_basic_lookup(&dnsa, query, T_TXT) == DNS_SUCCEED)
3580 for (dns_record * rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS); rr;
3581 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
3582 if (rr->type == T_TXT)
3583 {
3584 int len = (rr->data)[0];
3585 if (len > 511) len = 127;
3586 store_pool = POOL_PERM;
3587 cb->text = string_sprintf("%.*s", len, CUS (rr->data+1));
3588 store_pool = old_pool;
3589 break;
3590 }
3591 }
3592
3593 dnslist_value = addlist;
3594 dnslist_text = cb->text;
3595 return OK;
3596 }
3597
3598 /* There was a problem with the DNS lookup */
3599
3600 if (cb->rc != DNS_NOMATCH && cb->rc != DNS_NODATA)
3601 {
3602 log_write(L_dnslist_defer, LOG_MAIN,
3603 "DNS list lookup defer (probably timeout) for %s: %s", query,
3604 (defer_return == OK)? US"assumed in list" :
3605 (defer_return == FAIL)? US"assumed not in list" :
3606 US"returned DEFER");
3607 return defer_return;
3608 }
3609
3610 /* No entry was found in the DNS; continue for next domain */
3611
3612 HDEBUG(D_dnsbl)
3613 {
3614 debug_printf("DNS lookup for %s failed\n", query);
3615 debug_printf("=> that means %s is not listed at %s\n",
3616 keydomain, domain);
3617 }
3618
3619 return FAIL;
3620 }
3621
3622
3623
3624
3625 /*************************************************
3626 * Check host against DNS black lists *
3627 *************************************************/
3628
3629 /* This function runs checks against a list of DNS black lists, until one
3630 matches. Each item on the list can be of the form
3631
3632 domain=ip-address/key
3633
3634 The domain is the right-most domain that is used for the query, for example,
3635 blackholes.mail-abuse.org. If the IP address is present, there is a match only
3636 if the DNS lookup returns a matching IP address. Several addresses may be
3637 given, comma-separated, for example: x.y.z=127.0.0.1,127.0.0.2.
3638
3639 If no key is given, what is looked up in the domain is the inverted IP address
3640 of the current client host. If a key is given, it is used to construct the
3641 domain for the lookup. For example:
3642
3643 dsn.rfc-ignorant.org/$sender_address_domain
3644
3645 After finding a match in the DNS, the domain is placed in $dnslist_domain, and
3646 then we check for a TXT record for an error message, and if found, save its
3647 value in $dnslist_text. We also cache everything in a tree, to optimize
3648 multiple lookups.
3649
3650 The TXT record is normally looked up in the same domain as the A record, but
3651 when many lists are combined in a single DNS domain, this will not be a very
3652 specific message. It is possible to specify a different domain for looking up
3653 TXT records; this is given before the main domain, comma-separated. For
3654 example:
3655
3656 dnslists = http.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.2 : \
3657 socks.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.3
3658
3659 The caching ensures that only one lookup in dnsbl.sorbs.net is done.
3660
3661 Note: an address for testing RBL is 192.203.178.39
3662 Note: an address for testing DUL is 192.203.178.4
3663 Note: a domain for testing RFCI is example.tld.dsn.rfc-ignorant.org
3664
3665 Arguments:
3666 where the acl type
3667 listptr the domain/address/data list
3668 log_msgptr log message on error
3669
3670 Returns: OK successful lookup (i.e. the address is on the list), or
3671 lookup deferred after +include_unknown
3672 FAIL name not found, or no data found for the given type, or
3673 lookup deferred after +exclude_unknown (default)
3674 DEFER lookup failure, if +defer_unknown was set
3675 */
3676
3677 int
3678 verify_check_dnsbl(int where, const uschar ** listptr, uschar ** log_msgptr)
3679 {
3680 int sep = 0;
3681 int defer_return = FAIL;
3682 const uschar *list = *listptr;
3683 uschar *domain;
3684 uschar buffer[1024];
3685 uschar revadd[128]; /* Long enough for IPv6 address */
3686
3687 /* Indicate that the inverted IP address is not yet set up */
3688
3689 revadd[0] = 0;
3690
3691 /* In case this is the first time the DNS resolver is being used. */
3692
3693 dns_init(FALSE, FALSE, FALSE); /*XXX dnssec? */
3694
3695 /* Loop through all the domains supplied, until something matches */
3696
3697 while ((domain = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
3698 {
3699 int rc;
3700 BOOL bitmask = FALSE;
3701 int match_type = 0;
3702 uschar *domain_txt;
3703 uschar *comma;
3704 uschar *iplist;
3705 uschar *key;
3706
3707 HDEBUG(D_dnsbl) debug_printf("DNS list check: %s\n", domain);
3708
3709 /* Deal with special values that change the behaviour on defer */
3710
3711 if (domain[0] == '+')
3712 {
3713 if (strcmpic(domain, US"+include_unknown") == 0) defer_return = OK;
3714 else if (strcmpic(domain, US"+exclude_unknown") == 0) defer_return = FAIL;
3715 else if (strcmpic(domain, US"+defer_unknown") == 0) defer_return = DEFER;
3716 else
3717 log_write(0, LOG_MAIN|LOG_PANIC, "unknown item in dnslist (ignored): %s",
3718 domain);
3719 continue;
3720 }
3721
3722 /* See if there's explicit data to be looked up */
3723
3724 if ((key = Ustrchr(domain, '/'))) *key++ = 0;
3725
3726 /* See if there's a list of addresses supplied after the domain name. This is
3727 introduced by an = or a & character; if preceded by = we require all matches
3728 and if preceded by ! we invert the result. */
3729
3730 if (!(iplist = Ustrchr(domain, '=')))
3731 {
3732 bitmask = TRUE;
3733 iplist = Ustrchr(domain, '&');
3734 }
3735
3736 if (iplist) /* Found either = or & */
3737 {
3738 if (iplist > domain && iplist[-1] == '!') /* Handle preceding ! */
3739 {
3740 match_type |= MT_NOT;
3741 iplist[-1] = 0;
3742 }
3743
3744 *iplist++ = 0; /* Terminate domain, move on */
3745
3746 /* If we found = (bitmask == FALSE), check for == or =& */
3747
3748 if (!bitmask && (*iplist == '=' || *iplist == '&'))
3749 {
3750 bitmask = *iplist++ == '&';
3751 match_type |= MT_ALL;
3752 }
3753 }
3754
3755
3756 /* If there is a comma in the domain, it indicates that a second domain for
3757 looking up TXT records is provided, before the main domain. Otherwise we must
3758 set domain_txt == domain. */
3759
3760 domain_txt = domain;
3761 comma = Ustrchr(domain, ',');
3762 if (comma != NULL)
3763 {
3764 *comma++ = 0;
3765 domain = comma;
3766 }
3767
3768 /* Check that what we have left is a sensible domain name. There is no reason
3769 why these domains should in fact use the same syntax as hosts and email
3770 domains, but in practice they seem to. However, there is little point in
3771 actually causing an error here, because that would no doubt hold up incoming
3772 mail. Instead, I'll just log it. */
3773
3774 for (uschar * s = domain; *s; s++)
3775 if (!isalnum(*s) && *s != '-' && *s != '.' && *s != '_')
3776 {
3777 log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains "
3778 "strange characters - is this right?", domain);
3779 break;
3780 }
3781
3782 /* Check the alternate domain if present */
3783
3784 if (domain_txt != domain) for (uschar * s = domain_txt; *s; s++)
3785 if (!isalnum(*s) && *s != '-' && *s != '.' && *s != '_')
3786 {
3787 log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains "
3788 "strange characters - is this right?", domain_txt);
3789 break;
3790 }
3791
3792 /* If there is no key string, construct the query by adding the domain name
3793 onto the inverted host address, and perform a single DNS lookup. */
3794
3795 if (!key)
3796 {
3797 if (where == ACL_WHERE_NOTSMTP_START || where == ACL_WHERE_NOTSMTP)
3798 {
3799 *log_msgptr = string_sprintf
3800 ("cannot test auto-keyed dnslists condition in %s ACL",
3801 acl_wherenames[where]);
3802 return ERROR;
3803 }
3804 if (sender_host_address == NULL) return FAIL; /* can never match */
3805 if (revadd[0] == 0) invert_address(revadd, sender_host_address);
3806 rc = one_check_dnsbl(domain, domain_txt, sender_host_address, revadd,
3807 iplist, bitmask, match_type, defer_return);
3808 if (rc == OK)
3809 {
3810 dnslist_domain = string_copy(domain_txt);
3811 dnslist_matched = string_copy(sender_host_address);
3812 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
3813 sender_host_address, dnslist_domain);
3814 }
3815 if (rc != FAIL) return rc; /* OK or DEFER */
3816 }
3817
3818 /* If there is a key string, it can be a list of domains or IP addresses to
3819 be concatenated with the main domain. */
3820
3821 else
3822 {
3823 int keysep = 0;
3824 BOOL defer = FALSE;
3825 uschar *keydomain;
3826 uschar keybuffer[256];
3827 uschar keyrevadd[128];
3828
3829 while ((keydomain = string_nextinlist(CUSS &key, &keysep, keybuffer,
3830 sizeof(keybuffer))) != NULL)
3831 {
3832 uschar *prepend = keydomain;
3833
3834 if (string_is_ip_address(keydomain, NULL) != 0)
3835 {
3836 invert_address(keyrevadd, keydomain);
3837 prepend = keyrevadd;
3838 }
3839
3840 rc = one_check_dnsbl(domain, domain_txt, keydomain, prepend, iplist,
3841 bitmask, match_type, defer_return);
3842
3843 if (rc == OK)
3844 {
3845 dnslist_domain = string_copy(domain_txt);
3846 dnslist_matched = string_copy(keydomain);
3847 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
3848 keydomain, dnslist_domain);
3849 return OK;
3850 }
3851
3852 /* If the lookup deferred, remember this fact. We keep trying the rest
3853 of the list to see if we get a useful result, and if we don't, we return
3854 DEFER at the end. */
3855
3856 if (rc == DEFER) defer = TRUE;
3857 } /* continue with next keystring domain/address */
3858
3859 if (defer) return DEFER;
3860 }
3861 } /* continue with next dnsdb outer domain */
3862
3863 return FAIL;
3864 }
3865
3866 /* vi: aw ai sw=2
3867 */
3868 /* End of verify.c */