Callout: wait for response to QUIT before closing
[exim.git] / src / src / verify.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions concerned with verifying things. The original code for callout
9 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
10
11
12 #include "exim.h"
13 #include "transports/smtp.h"
14
15 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
17 static smtp_outblock ctblock;
18 uschar ctbuffer[8192];
19
20
21 /* Structure for caching DNSBL lookups */
22
23 typedef struct dnsbl_cache_block {
24 time_t expiry;
25 dns_address *rhs;
26 uschar *text;
27 int rc;
28 BOOL text_set;
29 } dnsbl_cache_block;
30
31
32 /* Anchor for DNSBL cache */
33
34 static tree_node *dnsbl_cache = NULL;
35
36
37 /* Bits for match_type in one_check_dnsbl() */
38
39 #define MT_NOT 1
40 #define MT_ALL 2
41
42 static uschar cutthrough_response(char, uschar **, int);
43
44
45
46 /*************************************************
47 * Retrieve a callout cache record *
48 *************************************************/
49
50 /* If a record exists, check whether it has expired.
51
52 Arguments:
53 dbm_file an open hints file
54 key the record key
55 type "address" or "domain"
56 positive_expire expire time for positive records
57 negative_expire expire time for negative records
58
59 Returns: the cache record if a non-expired one exists, else NULL
60 */
61
62 static dbdata_callout_cache *
63 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
64 int positive_expire, int negative_expire)
65 {
66 BOOL negative;
67 int length, expire;
68 time_t now;
69 dbdata_callout_cache *cache_record;
70
71 cache_record = dbfn_read_with_length(dbm_file, key, &length);
72
73 if (cache_record == NULL)
74 {
75 HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
76 return NULL;
77 }
78
79 /* We treat a record as "negative" if its result field is not positive, or if
80 it is a domain record and the postmaster field is negative. */
81
82 negative = cache_record->result != ccache_accept ||
83 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
84 expire = negative? negative_expire : positive_expire;
85 now = time(NULL);
86
87 if (now - cache_record->time_stamp > expire)
88 {
89 HDEBUG(D_verify) debug_printf("callout cache: %s record expired for %s\n", type, key);
90 return NULL;
91 }
92
93 /* If this is a non-reject domain record, check for the obsolete format version
94 that doesn't have the postmaster and random timestamps, by looking at the
95 length. If so, copy it to a new-style block, replicating the record's
96 timestamp. Then check the additional timestamps. (There's no point wasting
97 effort if connections are rejected.) */
98
99 if (type[0] == 'd' && cache_record->result != ccache_reject)
100 {
101 if (length == sizeof(dbdata_callout_cache_obs))
102 {
103 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
104 memcpy(new, cache_record, length);
105 new->postmaster_stamp = new->random_stamp = new->time_stamp;
106 cache_record = new;
107 }
108
109 if (now - cache_record->postmaster_stamp > expire)
110 cache_record->postmaster_result = ccache_unknown;
111
112 if (now - cache_record->random_stamp > expire)
113 cache_record->random_result = ccache_unknown;
114 }
115
116 HDEBUG(D_verify) debug_printf("callout cache: found %s record for %s\n", type, key);
117 return cache_record;
118 }
119
120
121
122 /*************************************************
123 * Do callout verification for an address *
124 *************************************************/
125
126 /* This function is called from verify_address() when the address has routed to
127 a host list, and a callout has been requested. Callouts are expensive; that is
128 why a cache is used to improve the efficiency.
129
130 Arguments:
131 addr the address that's been routed
132 host_list the list of hosts to try
133 tf the transport feedback block
134
135 ifstring "interface" option from transport, or NULL
136 portstring "port" option from transport, or NULL
137 protocolstring "protocol" option from transport, or NULL
138 callout the per-command callout timeout
139 callout_overall the overall callout timeout (if < 0 use 4*callout)
140 callout_connect the callout connection timeout (if < 0 use callout)
141 options the verification options - these bits are used:
142 vopt_is_recipient => this is a recipient address
143 vopt_callout_no_cache => don't use callout cache
144 vopt_callout_fullpm => if postmaster check, do full one
145 vopt_callout_random => do the "random" thing
146 vopt_callout_recipsender => use real sender for recipient
147 vopt_callout_recippmaster => use postmaster for recipient
148 se_mailfrom MAIL FROM address for sender verify; NULL => ""
149 pm_mailfrom if non-NULL, do the postmaster check with this sender
150
151 Returns: OK/FAIL/DEFER
152 */
153
154 static int
155 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
156 int callout, int callout_overall, int callout_connect, int options,
157 uschar *se_mailfrom, uschar *pm_mailfrom)
158 {
159 int yield = OK;
160 int old_domain_cache_result = ccache_accept;
161 BOOL done = FALSE;
162 uschar *address_key;
163 uschar *from_address;
164 uschar *random_local_part = NULL;
165 const uschar *save_deliver_domain = deliver_domain;
166 uschar **failure_ptr = options & vopt_is_recipient
167 ? &recipient_verify_failure : &sender_verify_failure;
168 open_db dbblock;
169 open_db *dbm_file = NULL;
170 dbdata_callout_cache new_domain_record;
171 dbdata_callout_cache_address new_address_record;
172 host_item *host;
173 time_t callout_start_time;
174 uschar peer_offered = 0;
175
176 new_domain_record.result = ccache_unknown;
177 new_domain_record.postmaster_result = ccache_unknown;
178 new_domain_record.random_result = ccache_unknown;
179
180 memset(&new_address_record, 0, sizeof(new_address_record));
181
182 /* For a recipient callout, the key used for the address cache record must
183 include the sender address if we are using the real sender in the callout,
184 because that may influence the result of the callout. */
185
186 address_key = addr->address;
187 from_address = US"";
188
189 if (options & vopt_is_recipient)
190 {
191 if (options & vopt_callout_recipsender)
192 {
193 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
194 from_address = sender_address;
195 if (cutthrough.delivery) options |= vopt_callout_no_cache;
196 }
197 else if (options & vopt_callout_recippmaster)
198 {
199 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
200 qualify_domain_sender);
201 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
202 }
203 }
204
205 /* For a sender callout, we must adjust the key if the mailfrom address is not
206 empty. */
207
208 else
209 {
210 from_address = (se_mailfrom == NULL)? US"" : se_mailfrom;
211 if (from_address[0] != 0)
212 address_key = string_sprintf("%s/<%s>", addr->address, from_address);
213 }
214
215 /* Open the callout cache database, it it exists, for reading only at this
216 stage, unless caching has been disabled. */
217
218 if (options & vopt_callout_no_cache)
219 {
220 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
221 }
222 else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
223 {
224 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
225 }
226
227 /* If a cache database is available see if we can avoid the need to do an
228 actual callout by making use of previously-obtained data. */
229
230 if (dbm_file)
231 {
232 dbdata_callout_cache_address *cache_address_record;
233 dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
234 addr->domain, US"domain",
235 callout_cache_domain_positive_expire,
236 callout_cache_domain_negative_expire);
237
238 /* If an unexpired cache record was found for this domain, see if the callout
239 process can be short-circuited. */
240
241 if (cache_record)
242 {
243 /* In most cases, if an early command (up to and including MAIL FROM:<>)
244 was rejected, there is no point carrying on. The callout fails. However, if
245 we are doing a recipient verification with use_sender or use_postmaster
246 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
247 will be using a non-empty sender. We have to remember this situation so as
248 not to disturb the cached domain value if this whole verification succeeds
249 (we don't want it turning into "accept"). */
250
251 old_domain_cache_result = cache_record->result;
252
253 if (cache_record->result == ccache_reject ||
254 (*from_address == 0 && cache_record->result == ccache_reject_mfnull))
255 {
256 setflag(addr, af_verify_nsfail);
257 HDEBUG(D_verify)
258 debug_printf("callout cache: domain gave initial rejection, or "
259 "does not accept HELO or MAIL FROM:<>\n");
260 setflag(addr, af_verify_nsfail);
261 addr->user_message = US"(result of an earlier callout reused).";
262 yield = FAIL;
263 *failure_ptr = US"mail";
264 goto END_CALLOUT;
265 }
266
267 /* If a previous check on a "random" local part was accepted, we assume
268 that the server does not do any checking on local parts. There is therefore
269 no point in doing the callout, because it will always be successful. If a
270 random check previously failed, arrange not to do it again, but preserve
271 the data in the new record. If a random check is required but hasn't been
272 done, skip the remaining cache processing. */
273
274 if (options & vopt_callout_random) switch(cache_record->random_result)
275 {
276 case ccache_accept:
277 HDEBUG(D_verify)
278 debug_printf("callout cache: domain accepts random addresses\n");
279 goto END_CALLOUT; /* Default yield is OK */
280
281 case ccache_reject:
282 HDEBUG(D_verify)
283 debug_printf("callout cache: domain rejects random addresses\n");
284 options &= ~vopt_callout_random;
285 new_domain_record.random_result = ccache_reject;
286 new_domain_record.random_stamp = cache_record->random_stamp;
287 break;
288
289 default:
290 HDEBUG(D_verify)
291 debug_printf("callout cache: need to check random address handling "
292 "(not cached or cache expired)\n");
293 goto END_CACHE;
294 }
295
296 /* If a postmaster check is requested, but there was a previous failure,
297 there is again no point in carrying on. If a postmaster check is required,
298 but has not been done before, we are going to have to do a callout, so skip
299 remaining cache processing. */
300
301 if (pm_mailfrom)
302 {
303 if (cache_record->postmaster_result == ccache_reject)
304 {
305 setflag(addr, af_verify_pmfail);
306 HDEBUG(D_verify)
307 debug_printf("callout cache: domain does not accept "
308 "RCPT TO:<postmaster@domain>\n");
309 yield = FAIL;
310 *failure_ptr = US"postmaster";
311 setflag(addr, af_verify_pmfail);
312 addr->user_message = US"(result of earlier verification reused).";
313 goto END_CALLOUT;
314 }
315 if (cache_record->postmaster_result == ccache_unknown)
316 {
317 HDEBUG(D_verify)
318 debug_printf("callout cache: need to check RCPT "
319 "TO:<postmaster@domain> (not cached or cache expired)\n");
320 goto END_CACHE;
321 }
322
323 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
324 postmaster check if the address itself has to be checked. Also ensure
325 that the value in the cache record is preserved (with its old timestamp).
326 */
327
328 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
329 "TO:<postmaster@domain>\n");
330 pm_mailfrom = NULL;
331 new_domain_record.postmaster_result = ccache_accept;
332 new_domain_record.postmaster_stamp = cache_record->postmaster_stamp;
333 }
334 }
335
336 /* We can't give a result based on information about the domain. See if there
337 is an unexpired cache record for this specific address (combined with the
338 sender address if we are doing a recipient callout with a non-empty sender).
339 */
340
341 cache_address_record = (dbdata_callout_cache_address *)
342 get_callout_cache_record(dbm_file,
343 address_key, US"address",
344 callout_cache_positive_expire,
345 callout_cache_negative_expire);
346
347 if (cache_address_record)
348 {
349 if (cache_address_record->result == ccache_accept)
350 {
351 HDEBUG(D_verify)
352 debug_printf("callout cache: address record is positive\n");
353 }
354 else
355 {
356 HDEBUG(D_verify)
357 debug_printf("callout cache: address record is negative\n");
358 addr->user_message = US"Previous (cached) callout verification failure";
359 *failure_ptr = US"recipient";
360 yield = FAIL;
361 }
362 goto END_CALLOUT;
363 }
364
365 /* Close the cache database while we actually do the callout for real. */
366
367 END_CACHE:
368 dbfn_close(dbm_file);
369 dbm_file = NULL;
370 }
371
372 if (!addr->transport)
373 {
374 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
375 }
376 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
377 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
378 addr->transport->name, addr->transport->driver_name);
379 else
380 {
381 smtp_transport_options_block *ob =
382 (smtp_transport_options_block *)addr->transport->options_block;
383
384 /* The information wasn't available in the cache, so we have to do a real
385 callout and save the result in the cache for next time, unless no_cache is set,
386 or unless we have a previously cached negative random result. If we are to test
387 with a random local part, ensure that such a local part is available. If not,
388 log the fact, but carry on without randomming. */
389
390 if (options & vopt_callout_random && callout_random_local_part != NULL)
391 if (!(random_local_part = expand_string(callout_random_local_part)))
392 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
393 "callout_random_local_part: %s", expand_string_message);
394
395 /* Default the connect and overall callout timeouts if not set, and record the
396 time we are starting so that we can enforce it. */
397
398 if (callout_overall < 0) callout_overall = 4 * callout;
399 if (callout_connect < 0) callout_connect = callout;
400 callout_start_time = time(NULL);
401
402 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
403 output because a callout might take some time. When PIPELINING is active and
404 there are many recipients, the total time for doing lots of callouts can add up
405 and cause the client to time out. So in this case we forgo the PIPELINING
406 optimization. */
407
408 if (smtp_out && !disable_callout_flush) mac_smtp_fflush();
409
410 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
411 and we are holding a cutthrough conn open, we can just append the rcpt to
412 that conn for verification purposes (and later delivery also). Simplest
413 coding means skipping this whole loop and doing the append separately.
414
415 We will need to remember it has been appended so that rcpt-acl tail code
416 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
417 */
418
419 /* Can we re-use an open cutthrough connection? */
420 if ( cutthrough.fd >= 0
421 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
422 == vopt_callout_recipsender
423 && !random_local_part
424 && !pm_mailfrom
425 )
426 {
427 if (addr->transport == cutthrough.addr.transport)
428 for (host = host_list; host; host = host->next)
429 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
430 {
431 int host_af;
432 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
433 int port = 25;
434
435 deliver_host = host->name;
436 deliver_host_address = host->address;
437 deliver_host_port = host->port;
438 deliver_domain = addr->domain;
439 transport_name = addr->transport->name;
440
441 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
442
443 if (!smtp_get_interface(tf->interface, host_af, addr, &interface,
444 US"callout") ||
445 !smtp_get_port(tf->port, addr, &port, US"callout"))
446 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
447 addr->message);
448
449 if ( ( interface == cutthrough.interface
450 || ( interface
451 && cutthrough.interface
452 && Ustrcmp(interface, cutthrough.interface) == 0
453 ) )
454 && port == cutthrough.host.port
455 )
456 {
457 uschar * resp = NULL;
458
459 /* Match! Send the RCPT TO, append the addr, set done */
460 done =
461 smtp_write_command(&ctblock, FALSE, "RCPT TO:<%.1000s>\r\n",
462 transport_rcpt_address(addr,
463 (addr->transport == NULL)? FALSE :
464 addr->transport->rcpt_include_affixes)) >= 0 &&
465 cutthrough_response('2', &resp, CUTTHROUGH_DATA_TIMEOUT) == '2';
466
467 /* This would go horribly wrong if a callout fail was ignored by ACL.
468 We punt by abandoning cutthrough on a reject, like the
469 first-rcpt does. */
470
471 if (done)
472 {
473 address_item * na = store_get(sizeof(address_item));
474 *na = cutthrough.addr;
475 cutthrough.addr = *addr;
476 cutthrough.addr.host_used = &cutthrough.host;
477 cutthrough.addr.next = na;
478
479 cutthrough.nrcpt++;
480 }
481 else
482 {
483 cancel_cutthrough_connection("recipient rejected");
484 if (!resp || errno == ETIMEDOUT)
485 {
486 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
487 }
488 else if (errno == 0)
489 {
490 if (*resp == 0)
491 Ustrcpy(resp, US"connection dropped");
492
493 addr->message =
494 string_sprintf("response to \"%s\" from %s [%s] was: %s",
495 big_buffer, host->name, host->address,
496 string_printing(resp));
497
498 addr->user_message =
499 string_sprintf("Callout verification failed:\n%s", resp);
500
501 /* Hard rejection ends the process */
502
503 if (resp[0] == '5') /* Address rejected */
504 {
505 yield = FAIL;
506 done = TRUE;
507 }
508 }
509 }
510 }
511 break;
512 }
513 if (!done)
514 cancel_cutthrough_connection("incompatible connection");
515 }
516
517 /* Now make connections to the hosts and do real callouts. The list of hosts
518 is passed in as an argument. */
519
520 for (host = host_list; host && !done; host = host->next)
521 {
522 smtp_inblock inblock;
523 smtp_outblock outblock;
524 int host_af;
525 int port = 25;
526 BOOL send_quit = TRUE;
527 uschar *active_hostname = smtp_active_hostname;
528 BOOL lmtp;
529 BOOL smtps;
530 BOOL esmtp;
531 BOOL suppress_tls = FALSE;
532 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
533 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
534 BOOL dane = FALSE;
535 BOOL dane_required;
536 dns_answer tlsa_dnsa;
537 #endif
538 uschar inbuffer[4096];
539 uschar outbuffer[1024];
540 uschar responsebuffer[4096];
541 uschar * size_str;
542
543 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
544 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
545
546 /* Skip this host if we don't have an IP address for it. */
547
548 if (!host->address)
549 {
550 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
551 host->name);
552 continue;
553 }
554
555 /* Check the overall callout timeout */
556
557 if (time(NULL) - callout_start_time >= callout_overall)
558 {
559 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
560 break;
561 }
562
563 /* Set IPv4 or IPv6 */
564
565 host_af = Ustrchr(host->address, ':') == NULL ? AF_INET : AF_INET6;
566
567 /* Expand and interpret the interface and port strings. The latter will not
568 be used if there is a host-specific port (e.g. from a manualroute router).
569 This has to be delayed till now, because they may expand differently for
570 different hosts. If there's a failure, log it, but carry on with the
571 defaults. */
572
573 deliver_host = host->name;
574 deliver_host_address = host->address;
575 deliver_host_port = host->port;
576 deliver_domain = addr->domain;
577 transport_name = addr->transport->name;
578
579 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
580 US"callout")
581 || !smtp_get_port(tf->port, addr, &port, US"callout")
582 )
583 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
584 addr->message);
585
586 /* Set HELO string according to the protocol */
587 lmtp= Ustrcmp(tf->protocol, "lmtp") == 0;
588 smtps= Ustrcmp(tf->protocol, "smtps") == 0;
589
590
591 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", interface, port);
592
593 /* Set up the buffer for reading SMTP response packets. */
594
595 inblock.buffer = inbuffer;
596 inblock.buffersize = sizeof(inbuffer);
597 inblock.ptr = inbuffer;
598 inblock.ptrend = inbuffer;
599
600 /* Set up the buffer for holding SMTP commands while pipelining */
601
602 outblock.buffer = outbuffer;
603 outblock.buffersize = sizeof(outbuffer);
604 outblock.ptr = outbuffer;
605 outblock.cmd_count = 0;
606 outblock.authenticating = FALSE;
607
608 /* Connect to the host; on failure, just loop for the next one, but we
609 set the error for the last one. Use the callout_connect timeout. */
610
611 tls_retry_connection:
612
613 /* Reset the parameters of a TLS session */
614 tls_out.cipher = tls_out.peerdn = tls_out.peercert = NULL;
615
616 inblock.sock = outblock.sock =
617 smtp_connect(host, host_af, port, interface, callout_connect,
618 addr->transport);
619 if (inblock.sock < 0)
620 {
621 HDEBUG(D_verify) debug_printf("connect: %s\n", strerror(errno));
622 addr->message = string_sprintf("could not connect to %s [%s]: %s",
623 host->name, host->address, strerror(errno));
624 transport_name = NULL;
625 deliver_host = deliver_host_address = NULL;
626 deliver_domain = save_deliver_domain;
627 continue;
628 }
629
630 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
631 {
632 int rc;
633
634 tls_out.dane_verified = FALSE;
635 tls_out.tlsa_usage = 0;
636
637 dane_required =
638 verify_check_given_host(&ob->hosts_require_dane, host) == OK;
639
640 if (host->dnssec == DS_YES)
641 {
642 if( dane_required
643 || verify_check_given_host(&ob->hosts_try_dane, host) == OK
644 )
645 {
646 if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required)) != OK)
647 return rc;
648 dane = TRUE;
649 }
650 }
651 else if (dane_required)
652 {
653 log_write(0, LOG_MAIN, "DANE error: %s lookup not DNSSEC", host->name);
654 return FAIL;
655 }
656
657 if (dane)
658 ob->tls_tempfail_tryclear = FALSE;
659 }
660 #endif /*DANE*/
661
662 /* Expand the helo_data string to find the host name to use. */
663
664 if (tf->helo_data)
665 {
666 uschar * s = expand_string(tf->helo_data);
667 if (!s)
668 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
669 "helo_data value for callout: %s", addr->address,
670 expand_string_message);
671 else active_hostname = s;
672 }
673
674 /* Wait for initial response, and send HELO. The smtp_write_command()
675 function leaves its command in big_buffer. This is used in error responses.
676 Initialize it in case the connection is rejected. */
677
678 Ustrcpy(big_buffer, "initial connection");
679
680 /* Unless ssl-on-connect, wait for the initial greeting */
681 smtps_redo_greeting:
682
683 #ifdef SUPPORT_TLS
684 if (!smtps || (smtps && tls_out.active >= 0))
685 #endif
686 {
687 #ifdef TCP_QUICKACK
688 (void) setsockopt(inblock.sock, IPPROTO_TCP, TCP_QUICKACK, US &off, sizeof(off));
689 #endif
690 if (!(done= smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout)))
691 goto RESPONSE_FAILED;
692
693 #ifndef DISABLE_EVENT
694 lookup_dnssec_authenticated = host->dnssec==DS_YES ? US"yes"
695 : host->dnssec==DS_NO ? US"no" : NULL;
696 if (event_raise(addr->transport->event_action,
697 US"smtp:connect", responsebuffer))
698 {
699 lookup_dnssec_authenticated = NULL;
700 /* Logging? Debug? */
701 goto RESPONSE_FAILED;
702 }
703 lookup_dnssec_authenticated = NULL;
704 #endif
705 }
706
707 /* Not worth checking greeting line for ESMTP support */
708 if (!(esmtp = verify_check_given_host(&ob->hosts_avoid_esmtp, host) != OK))
709 DEBUG(D_transport)
710 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
711
712 tls_redo_helo:
713
714 #ifdef SUPPORT_TLS
715 if (smtps && tls_out.active < 0) /* ssl-on-connect, first pass */
716 {
717 peer_offered &= ~PEER_OFFERED_TLS;
718 ob->tls_tempfail_tryclear = FALSE;
719 }
720 else /* all other cases */
721 #endif
722
723 { esmtp_retry:
724
725 if (!(done= smtp_write_command(&outblock, FALSE, "%s %s\r\n",
726 !esmtp? "HELO" : lmtp? "LHLO" : "EHLO", active_hostname) >= 0))
727 goto SEND_FAILED;
728 if (!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout))
729 {
730 if (errno != 0 || responsebuffer[0] == 0 || lmtp || !esmtp || tls_out.active >= 0)
731 {
732 done= FALSE;
733 goto RESPONSE_FAILED;
734 }
735 #ifdef SUPPORT_TLS
736 peer_offered &= ~PEER_OFFERED_TLS;
737 #endif
738 esmtp = FALSE;
739 goto esmtp_retry; /* fallback to HELO */
740 }
741
742 /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
743
744 peer_offered = esmtp
745 ? ehlo_response(responsebuffer, sizeof(responsebuffer),
746 (!suppress_tls && tls_out.active < 0 ? PEER_OFFERED_TLS : 0)
747 | 0 /* no IGNQ */
748 | 0 /* no PRDR */
749 #ifdef SUPPORT_I18N
750 | (addr->prop.utf8_msg && !addr->prop.utf8_downcvt
751 ? PEER_OFFERED_UTF8 : 0)
752 #endif
753 | 0 /* no DSN */
754 | 0 /* no PIPE */
755
756 /* only care about SIZE if we have size from inbound */
757 | (message_size > 0 && ob->size_addition >= 0
758 ? PEER_OFFERED_SIZE : 0)
759 )
760 : 0;
761 }
762
763 size_str = options & vopt_is_recipient && peer_offered & PEER_OFFERED_SIZE
764 ? string_sprintf(" SIZE=%d", message_size + ob->size_addition) : US"";
765
766 #ifdef SUPPORT_TLS
767 smtp_peer_options |= peer_offered & PEER_OFFERED_TLS;
768 #endif
769
770 /* If TLS is available on this connection attempt to
771 start up a TLS session, unless the host is in hosts_avoid_tls. If successful,
772 send another EHLO - the server may give a different answer in secure mode. We
773 use a separate buffer for reading the response to STARTTLS so that if it is
774 negative, the original EHLO data is available for subsequent analysis, should
775 the client not be required to use TLS. If the response is bad, copy the buffer
776 for error analysis. */
777
778 #ifdef SUPPORT_TLS
779 if ( peer_offered & PEER_OFFERED_TLS
780 && verify_check_given_host(&ob->hosts_avoid_tls, host) != OK
781 && verify_check_given_host(&ob->hosts_verify_avoid_tls, host) != OK
782 )
783 {
784 uschar buffer2[4096];
785 if ( !smtps
786 && !(done= smtp_write_command(&outblock, FALSE, "STARTTLS\r\n") >= 0))
787 goto SEND_FAILED;
788
789 /* If there is an I/O error, transmission of this message is deferred. If
790 there is a temporary rejection of STARRTLS and tls_tempfail_tryclear is
791 false, we also defer. However, if there is a temporary rejection of STARTTLS
792 and tls_tempfail_tryclear is true, or if there is an outright rejection of
793 STARTTLS, we carry on. This means we will try to send the message in clear,
794 unless the host is in hosts_require_tls (tested below). */
795
796 if (!smtps && !smtp_read_response(&inblock, buffer2, sizeof(buffer2), '2',
797 ob->command_timeout))
798 {
799 if ( errno != 0
800 || buffer2[0] == 0
801 || buffer2[0] == '4' && !ob->tls_tempfail_tryclear
802 )
803 {
804 Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
805 done= FALSE;
806 goto RESPONSE_FAILED;
807 }
808 }
809
810 /* STARTTLS accepted or ssl-on-connect: try to negotiate a TLS session. */
811 else
812 {
813 int oldtimeout = ob->command_timeout;
814 int rc;
815
816 ob->command_timeout = callout;
817 rc = tls_client_start(inblock.sock, host, addr, addr->transport
818 # ifdef EXPERIMENTAL_DANE
819 , dane ? &tlsa_dnsa : NULL
820 # endif
821 );
822 ob->command_timeout = oldtimeout;
823
824 /* TLS negotiation failed; give an error. Try in clear on a new
825 connection, if the options permit it for this host. */
826 if (rc != OK)
827 {
828 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
829 (void)close(inblock.sock);
830 # ifndef DISABLE_EVENT
831 (void) event_raise(addr->transport->event_action,
832 US"tcp:close", NULL);
833 # endif
834 if ( ob->tls_tempfail_tryclear
835 && !smtps
836 && verify_check_given_host(&ob->hosts_require_tls, host) != OK
837 )
838 {
839 log_write(0, LOG_MAIN, "TLS session failure:"
840 " callout unencrypted to %s [%s] (not in hosts_require_tls)",
841 host->name, host->address);
842 suppress_tls = TRUE;
843 goto tls_retry_connection;
844 }
845
846 /*save_errno = ERRNO_TLSFAILURE;*/
847 /*message = US"failure while setting up TLS session";*/
848 send_quit = FALSE;
849 done= FALSE;
850 goto TLS_FAILED;
851 }
852
853 /* TLS session is set up. Copy info for logging. */
854 addr->cipher = tls_out.cipher;
855 addr->peerdn = tls_out.peerdn;
856
857 /* For SMTPS we need to wait for the initial OK response, then do HELO. */
858 if (smtps)
859 goto smtps_redo_greeting;
860
861 /* For STARTTLS we need to redo EHLO */
862 goto tls_redo_helo;
863 }
864 }
865
866 /* If the host is required to use a secure channel, ensure that we have one. */
867 if (tls_out.active < 0)
868 if (
869 # ifdef EXPERIMENTAL_DANE
870 dane ||
871 # endif
872 verify_check_given_host(&ob->hosts_require_tls, host) == OK
873 )
874 {
875 /*save_errno = ERRNO_TLSREQUIRED;*/
876 log_write(0, LOG_MAIN,
877 "H=%s [%s]: a TLS session is required for this host, but %s",
878 host->name, host->address,
879 peer_offered & PEER_OFFERED_TLS
880 ? "an attempt to start TLS failed"
881 : "the server did not offer TLS support");
882 done= FALSE;
883 goto TLS_FAILED;
884 }
885
886 #endif /*SUPPORT_TLS*/
887
888 done = TRUE; /* so far so good; have response to HELO */
889
890 /* For now, transport_filter by cutthrough-delivery is not supported */
891 /* Need proper integration with the proper transport mechanism. */
892 if (cutthrough.delivery)
893 {
894 #ifndef DISABLE_DKIM
895 uschar * s;
896 #endif
897 if (addr->transport->filter_command)
898 {
899 cutthrough.delivery = FALSE;
900 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
901 }
902 #ifndef DISABLE_DKIM
903 else if ((s = ob->dkim.dkim_domain) && (s = expand_string(s)) && *s)
904 {
905 cutthrough.delivery = FALSE;
906 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
907 }
908 #endif
909 }
910
911 SEND_FAILED:
912 RESPONSE_FAILED:
913 TLS_FAILED:
914 ;
915 /* Clear down of the TLS, SMTP and TCP layers on error is handled below. */
916
917 /* Failure to accept HELO is cached; this blocks the whole domain for all
918 senders. I/O errors and defer responses are not cached. */
919
920 if (!done)
921 {
922 *failure_ptr = US"mail"; /* At or before MAIL */
923 if (errno == 0 && responsebuffer[0] == '5')
924 {
925 setflag(addr, af_verify_nsfail);
926 new_domain_record.result = ccache_reject;
927 }
928 }
929
930 #ifdef SUPPORT_I18N
931 else if ( addr->prop.utf8_msg
932 && !addr->prop.utf8_downcvt
933 && !(peer_offered & PEER_OFFERED_UTF8)
934 )
935 {
936 HDEBUG(D_acl|D_v) debug_printf("utf8 required but not offered\n");
937 errno = ERRNO_UTF8_FWD;
938 setflag(addr, af_verify_nsfail);
939 done = FALSE;
940 }
941 else if ( addr->prop.utf8_msg
942 && (addr->prop.utf8_downcvt || !(peer_offered & PEER_OFFERED_UTF8))
943 && (setflag(addr, af_utf8_downcvt),
944 from_address = string_address_utf8_to_alabel(from_address,
945 &addr->message),
946 addr->message
947 ) )
948 {
949 errno = ERRNO_EXPANDFAIL;
950 setflag(addr, af_verify_nsfail);
951 done = FALSE;
952 }
953 #endif
954
955 /* If we haven't authenticated, but are required to, give up. */
956 /* Try to AUTH */
957
958 else done = smtp_auth(responsebuffer, sizeof(responsebuffer),
959 addr, host, ob, esmtp, &inblock, &outblock) == OK &&
960
961 /* Copy AUTH info for logging */
962 ( (addr->authenticator = client_authenticator),
963 (addr->auth_id = client_authenticated_id),
964
965 /* Build a mail-AUTH string (re-using responsebuffer for convenience */
966 !smtp_mail_auth_str(responsebuffer, sizeof(responsebuffer), addr, ob)
967 ) &&
968
969 ( (addr->auth_sndr = client_authenticated_sender),
970
971 /* Send the MAIL command */
972 (smtp_write_command(&outblock, FALSE,
973 #ifdef SUPPORT_I18N
974 addr->prop.utf8_msg && !addr->prop.utf8_downcvt
975 ? "MAIL FROM:<%s>%s%s SMTPUTF8\r\n"
976 :
977 #endif
978 "MAIL FROM:<%s>%s%s\r\n",
979 from_address, responsebuffer, size_str) >= 0)
980 ) &&
981
982 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
983 '2', callout);
984
985 deliver_host = deliver_host_address = NULL;
986 deliver_domain = save_deliver_domain;
987
988 /* If the host does not accept MAIL FROM:<>, arrange to cache this
989 information, but again, don't record anything for an I/O error or a defer. Do
990 not cache rejections of MAIL when a non-empty sender has been used, because
991 that blocks the whole domain for all senders. */
992
993 if (!done)
994 {
995 *failure_ptr = US"mail"; /* At or before MAIL */
996 if (errno == 0 && responsebuffer[0] == '5')
997 {
998 setflag(addr, af_verify_nsfail);
999 if (from_address[0] == 0)
1000 new_domain_record.result = ccache_reject_mfnull;
1001 }
1002 }
1003
1004 /* Otherwise, proceed to check a "random" address (if required), then the
1005 given address, and the postmaster address (if required). Between each check,
1006 issue RSET, because some servers accept only one recipient after MAIL
1007 FROM:<>.
1008
1009 Before doing this, set the result in the domain cache record to "accept",
1010 unless its previous value was ccache_reject_mfnull. In that case, the domain
1011 rejects MAIL FROM:<> and we want to continue to remember that. When that is
1012 the case, we have got here only in the case of a recipient verification with
1013 a non-null sender. */
1014
1015 else
1016 {
1017 const uschar * rcpt_domain = addr->domain;
1018
1019 #ifdef SUPPORT_I18N
1020 uschar * errstr = NULL;
1021 if ( testflag(addr, af_utf8_downcvt)
1022 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
1023 &errstr), errstr)
1024 )
1025 {
1026 addr->message = errstr;
1027 errno = ERRNO_EXPANDFAIL;
1028 setflag(addr, af_verify_nsfail);
1029 done = FALSE;
1030 rcpt_domain = US""; /*XXX errorhandling! */
1031 }
1032 #endif
1033
1034 new_domain_record.result =
1035 (old_domain_cache_result == ccache_reject_mfnull)?
1036 ccache_reject_mfnull: ccache_accept;
1037
1038 /* Do the random local part check first */
1039
1040 if (random_local_part != NULL)
1041 {
1042 uschar randombuffer[1024];
1043 BOOL random_ok =
1044 smtp_write_command(&outblock, FALSE,
1045 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part,
1046 rcpt_domain) >= 0 &&
1047 smtp_read_response(&inblock, randombuffer,
1048 sizeof(randombuffer), '2', callout);
1049
1050 /* Remember when we last did a random test */
1051
1052 new_domain_record.random_stamp = time(NULL);
1053
1054 /* If accepted, we aren't going to do any further tests below. */
1055
1056 if (random_ok)
1057 new_domain_record.random_result = ccache_accept;
1058
1059 /* Otherwise, cache a real negative response, and get back to the right
1060 state to send RCPT. Unless there's some problem such as a dropped
1061 connection, we expect to succeed, because the commands succeeded above.
1062 However, some servers drop the connection after responding to an
1063 invalid recipient, so on (any) error we drop and remake the connection.
1064 */
1065
1066 else if (errno == 0)
1067 {
1068 /* This would be ok for 1st rcpt a cutthrough, but no way to
1069 handle a subsequent. So refuse to support any */
1070 cancel_cutthrough_connection("random-recipient");
1071
1072 if (randombuffer[0] == '5')
1073 new_domain_record.random_result = ccache_reject;
1074
1075 done =
1076 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1077 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1078 '2', callout) &&
1079
1080 smtp_write_command(&outblock, FALSE,
1081 #ifdef SUPPORT_I18N
1082 addr->prop.utf8_msg && !addr->prop.utf8_downcvt
1083 ? "MAIL FROM:<%s> SMTPUTF8\r\n"
1084 :
1085 #endif
1086 "MAIL FROM:<%s>\r\n",
1087 from_address) >= 0 &&
1088 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1089 '2', callout);
1090
1091 if (!done)
1092 {
1093 HDEBUG(D_acl|D_v)
1094 debug_printf("problem after random/rset/mfrom; reopen conn\n");
1095 random_local_part = NULL;
1096 #ifdef SUPPORT_TLS
1097 tls_close(FALSE, TRUE);
1098 #endif
1099 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
1100 (void)close(inblock.sock);
1101 #ifndef DISABLE_EVENT
1102 (void) event_raise(addr->transport->event_action,
1103 US"tcp:close", NULL);
1104 #endif
1105 goto tls_retry_connection;
1106 }
1107 }
1108 else done = FALSE; /* Some timeout/connection problem */
1109 } /* Random check */
1110
1111 /* If the host is accepting all local parts, as determined by the "random"
1112 check, we don't need to waste time doing any further checking. */
1113
1114 if (new_domain_record.random_result != ccache_accept && done)
1115 {
1116 /* Get the rcpt_include_affixes flag from the transport if there is one,
1117 but assume FALSE if there is not. */
1118
1119 uschar * rcpt = transport_rcpt_address(addr,
1120 addr->transport ? addr->transport->rcpt_include_affixes : FALSE);
1121
1122 #ifdef SUPPORT_I18N
1123 /*XXX should the conversion be moved into transport_rcpt_address() ? */
1124 uschar * dummy_errstr = NULL;
1125 if ( testflag(addr, af_utf8_downcvt)
1126 && (rcpt = string_address_utf8_to_alabel(rcpt, &dummy_errstr),
1127 dummy_errstr
1128 ) )
1129 {
1130 errno = ERRNO_EXPANDFAIL;
1131 *failure_ptr = US"recipient";
1132 done = FALSE;
1133 }
1134 else
1135 #endif
1136
1137 done =
1138 smtp_write_command(&outblock, FALSE, "RCPT TO:<%.1000s>\r\n",
1139 rcpt) >= 0 &&
1140 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1141 '2', callout);
1142
1143 if (done)
1144 new_address_record.result = ccache_accept;
1145 else if (errno == 0 && responsebuffer[0] == '5')
1146 {
1147 *failure_ptr = US"recipient";
1148 new_address_record.result = ccache_reject;
1149 }
1150
1151 /* Do postmaster check if requested; if a full check is required, we
1152 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
1153
1154 if (done && pm_mailfrom != NULL)
1155 {
1156 /* Could possibly shift before main verify, just above, and be ok
1157 for cutthrough. But no way to handle a subsequent rcpt, so just
1158 refuse any */
1159 cancel_cutthrough_connection("postmaster verify");
1160 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of postmaster verify\n");
1161
1162 done =
1163 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1164 smtp_read_response(&inblock, responsebuffer,
1165 sizeof(responsebuffer), '2', callout) &&
1166
1167 smtp_write_command(&outblock, FALSE,
1168 "MAIL FROM:<%s>\r\n", pm_mailfrom) >= 0 &&
1169 smtp_read_response(&inblock, responsebuffer,
1170 sizeof(responsebuffer), '2', callout) &&
1171
1172 /* First try using the current domain */
1173
1174 ((
1175 smtp_write_command(&outblock, FALSE,
1176 "RCPT TO:<postmaster@%.1000s>\r\n", rcpt_domain) >= 0 &&
1177 smtp_read_response(&inblock, responsebuffer,
1178 sizeof(responsebuffer), '2', callout)
1179 )
1180
1181 ||
1182
1183 /* If that doesn't work, and a full check is requested,
1184 try without the domain. */
1185
1186 (
1187 (options & vopt_callout_fullpm) != 0 &&
1188 smtp_write_command(&outblock, FALSE,
1189 "RCPT TO:<postmaster>\r\n") >= 0 &&
1190 smtp_read_response(&inblock, responsebuffer,
1191 sizeof(responsebuffer), '2', callout)
1192 ));
1193
1194 /* Sort out the cache record */
1195
1196 new_domain_record.postmaster_stamp = time(NULL);
1197
1198 if (done)
1199 new_domain_record.postmaster_result = ccache_accept;
1200 else if (errno == 0 && responsebuffer[0] == '5')
1201 {
1202 *failure_ptr = US"postmaster";
1203 setflag(addr, af_verify_pmfail);
1204 new_domain_record.postmaster_result = ccache_reject;
1205 }
1206 }
1207 } /* Random not accepted */
1208 } /* MAIL FROM: accepted */
1209
1210 /* For any failure of the main check, other than a negative response, we just
1211 close the connection and carry on. We can identify a negative response by the
1212 fact that errno is zero. For I/O errors it will be non-zero
1213
1214 Set up different error texts for logging and for sending back to the caller
1215 as an SMTP response. Log in all cases, using a one-line format. For sender
1216 callouts, give a full response to the caller, but for recipient callouts,
1217 don't give the IP address because this may be an internal host whose identity
1218 is not to be widely broadcast. */
1219
1220 if (!done)
1221 {
1222 if (errno == ETIMEDOUT)
1223 {
1224 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
1225 send_quit = FALSE;
1226 }
1227 #ifdef SUPPORT_I18N
1228 else if (errno == ERRNO_UTF8_FWD)
1229 {
1230 extern int acl_where; /* src/acl.c */
1231 errno = 0;
1232 addr->message = string_sprintf(
1233 "response to \"%s\" from %s [%s] did not include SMTPUTF8",
1234 big_buffer, host->name, host->address);
1235 addr->user_message = acl_where == ACL_WHERE_RCPT
1236 ? US"533 mailbox name not allowed"
1237 : US"550 mailbox unavailable";
1238 yield = FAIL;
1239 done = TRUE;
1240 }
1241 #endif
1242 else if (errno == 0)
1243 {
1244 if (*responsebuffer == 0) Ustrcpy(responsebuffer, US"connection dropped");
1245
1246 addr->message =
1247 string_sprintf("response to \"%s\" from %s [%s] was: %s",
1248 big_buffer, host->name, host->address,
1249 string_printing(responsebuffer));
1250
1251 addr->user_message = options & vopt_is_recipient
1252 ? string_sprintf("Callout verification failed:\n%s", responsebuffer)
1253 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1254 host->address, big_buffer, responsebuffer);
1255
1256 /* Hard rejection ends the process */
1257
1258 if (responsebuffer[0] == '5') /* Address rejected */
1259 {
1260 yield = FAIL;
1261 done = TRUE;
1262 }
1263 }
1264 }
1265
1266 /* End the SMTP conversation and close the connection. */
1267
1268 /* Cutthrough - on a successfull connect and recipient-verify with
1269 use-sender and we are 1st rcpt and have no cutthrough conn so far
1270 here is where we want to leave the conn open */
1271 if ( cutthrough.delivery
1272 && rcpt_count == 1
1273 && done
1274 && yield == OK
1275 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1276 == vopt_callout_recipsender
1277 && !random_local_part
1278 && !pm_mailfrom
1279 && cutthrough.fd < 0
1280 && !lmtp
1281 )
1282 {
1283 HDEBUG(D_acl|D_v) debug_printf("holding verify callout open for cutthrough delivery\n");
1284
1285 cutthrough.fd = outblock.sock; /* We assume no buffer in use in the outblock */
1286 cutthrough.nrcpt = 1;
1287 cutthrough.interface = interface;
1288 cutthrough.host = *host;
1289 cutthrough.addr = *addr; /* Save the address_item for later logging */
1290 cutthrough.addr.next = NULL;
1291 cutthrough.addr.host_used = &cutthrough.host;
1292 if (addr->parent)
1293 *(cutthrough.addr.parent = store_get(sizeof(address_item))) =
1294 *addr->parent;
1295 ctblock.buffer = ctbuffer;
1296 ctblock.buffersize = sizeof(ctbuffer);
1297 ctblock.ptr = ctbuffer;
1298 /* ctblock.cmd_count = 0; ctblock.authenticating = FALSE; */
1299 ctblock.sock = cutthrough.fd;
1300 }
1301 else
1302 {
1303 /* Ensure no cutthrough on multiple address verifies */
1304 if (options & vopt_callout_recipsender)
1305 cancel_cutthrough_connection("not usable for cutthrough");
1306 if (send_quit)
1307 {
1308 (void) smtp_write_command(&outblock, FALSE, "QUIT\r\n");
1309
1310 /* Wait a short time for response, and discard it */
1311 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1312 '2', 1);
1313 }
1314
1315 #ifdef SUPPORT_TLS
1316 tls_close(FALSE, TRUE);
1317 #endif
1318 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
1319 (void)close(inblock.sock);
1320 #ifndef DISABLE_EVENT
1321 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
1322 #endif
1323 }
1324
1325 } /* Loop through all hosts, while !done */
1326 }
1327
1328 /* If we get here with done == TRUE, a successful callout happened, and yield
1329 will be set OK or FAIL according to the response to the RCPT command.
1330 Otherwise, we looped through the hosts but couldn't complete the business.
1331 However, there may be domain-specific information to cache in both cases.
1332
1333 The value of the result field in the new_domain record is ccache_unknown if
1334 there was an error before or with MAIL FROM:, and errno was not zero,
1335 implying some kind of I/O error. We don't want to write the cache in that case.
1336 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
1337
1338 if ( !(options & vopt_callout_no_cache)
1339 && new_domain_record.result != ccache_unknown)
1340 {
1341 if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
1342 == NULL)
1343 {
1344 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
1345 }
1346 else
1347 {
1348 (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
1349 (int)sizeof(dbdata_callout_cache));
1350 HDEBUG(D_verify) debug_printf("wrote callout cache domain record for %s:\n"
1351 " result=%d postmaster=%d random=%d\n",
1352 addr->domain,
1353 new_domain_record.result,
1354 new_domain_record.postmaster_result,
1355 new_domain_record.random_result);
1356 }
1357 }
1358
1359 /* If a definite result was obtained for the callout, cache it unless caching
1360 is disabled. */
1361
1362 if (done)
1363 {
1364 if ( !(options & vopt_callout_no_cache)
1365 && new_address_record.result != ccache_unknown)
1366 {
1367 if (!dbm_file)
1368 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
1369 if (!dbm_file)
1370 {
1371 HDEBUG(D_verify) debug_printf("no callout cache available\n");
1372 }
1373 else
1374 {
1375 (void)dbfn_write(dbm_file, address_key, &new_address_record,
1376 (int)sizeof(dbdata_callout_cache_address));
1377 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record for %s\n",
1378 new_address_record.result == ccache_accept ? "positive" : "negative",
1379 address_key);
1380 }
1381 }
1382 } /* done */
1383
1384 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1385 temporary error. If there was only one host, and a response was received, leave
1386 it alone if supplying details. Otherwise, give a generic response. */
1387
1388 else /* !done */
1389 {
1390 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
1391 options & vopt_is_recipient ? "recipient" : "sender");
1392 yield = DEFER;
1393
1394 if (host_list->next || !addr->message)
1395 addr->message = dullmsg;
1396
1397 addr->user_message = smtp_return_error_details
1398 ? string_sprintf("%s for <%s>.\n"
1399 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1400 "they may be permanently unreachable from this server. In the latter case,\n%s",
1401 dullmsg, addr->address,
1402 options & vopt_is_recipient
1403 ? "the address will never be accepted."
1404 : "you need to change the address or create an MX record for its domain\n"
1405 "if it is supposed to be generally accessible from the Internet.\n"
1406 "Talk to your mail administrator for details.")
1407 : dullmsg;
1408
1409 /* Force a specific error code */
1410
1411 addr->basic_errno = ERRNO_CALLOUTDEFER;
1412 }
1413
1414 /* Come here from within the cache-reading code on fast-track exit. */
1415
1416 END_CALLOUT:
1417 if (dbm_file) dbfn_close(dbm_file);
1418 return yield;
1419 }
1420
1421
1422
1423 /* Called after recipient-acl to get a cutthrough connection open when
1424 one was requested and a recipient-verify wasn't subsequently done.
1425 */
1426 int
1427 open_cutthrough_connection( address_item * addr )
1428 {
1429 address_item addr2;
1430 int rc;
1431
1432 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1433 /* We must use a copy of the address for verification, because it might
1434 get rewritten. */
1435
1436 addr2 = *addr;
1437 HDEBUG(D_acl) debug_printf("----------- %s cutthrough setup ------------\n",
1438 rcpt_count > 1 ? "more" : "start");
1439 rc = verify_address(&addr2, NULL,
1440 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1441 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1442 NULL, NULL, NULL);
1443 addr->message = addr2.message;
1444 addr->user_message = addr2.user_message;
1445 HDEBUG(D_acl) debug_printf("----------- end cutthrough setup ------------\n");
1446 return rc;
1447 }
1448
1449
1450
1451 /* Send given number of bytes from the buffer */
1452 static BOOL
1453 cutthrough_send(int n)
1454 {
1455 if(cutthrough.fd < 0)
1456 return TRUE;
1457
1458 if(
1459 #ifdef SUPPORT_TLS
1460 (tls_out.active == cutthrough.fd) ? tls_write(FALSE, ctblock.buffer, n) :
1461 #endif
1462 send(cutthrough.fd, ctblock.buffer, n, 0) > 0
1463 )
1464 {
1465 transport_count += n;
1466 ctblock.ptr= ctblock.buffer;
1467 return TRUE;
1468 }
1469
1470 HDEBUG(D_transport|D_acl) debug_printf("cutthrough_send failed: %s\n", strerror(errno));
1471 return FALSE;
1472 }
1473
1474
1475
1476 static BOOL
1477 _cutthrough_puts(uschar * cp, int n)
1478 {
1479 while(n--)
1480 {
1481 if(ctblock.ptr >= ctblock.buffer+ctblock.buffersize)
1482 if(!cutthrough_send(ctblock.buffersize))
1483 return FALSE;
1484
1485 *ctblock.ptr++ = *cp++;
1486 }
1487 return TRUE;
1488 }
1489
1490 /* Buffered output of counted data block. Return boolean success */
1491 BOOL
1492 cutthrough_puts(uschar * cp, int n)
1493 {
1494 if (cutthrough.fd < 0) return TRUE;
1495 if (_cutthrough_puts(cp, n)) return TRUE;
1496 cancel_cutthrough_connection("transmit failed");
1497 return FALSE;
1498 }
1499
1500
1501 static BOOL
1502 _cutthrough_flush_send(void)
1503 {
1504 int n= ctblock.ptr-ctblock.buffer;
1505
1506 if(n>0)
1507 if(!cutthrough_send(n))
1508 return FALSE;
1509 return TRUE;
1510 }
1511
1512
1513 /* Send out any bufferred output. Return boolean success. */
1514 BOOL
1515 cutthrough_flush_send(void)
1516 {
1517 if (_cutthrough_flush_send()) return TRUE;
1518 cancel_cutthrough_connection("transmit failed");
1519 return FALSE;
1520 }
1521
1522
1523 BOOL
1524 cutthrough_put_nl(void)
1525 {
1526 return cutthrough_puts(US"\r\n", 2);
1527 }
1528
1529
1530 /* Get and check response from cutthrough target */
1531 static uschar
1532 cutthrough_response(char expect, uschar ** copy, int timeout)
1533 {
1534 smtp_inblock inblock;
1535 uschar inbuffer[4096];
1536 uschar responsebuffer[4096];
1537
1538 inblock.buffer = inbuffer;
1539 inblock.buffersize = sizeof(inbuffer);
1540 inblock.ptr = inbuffer;
1541 inblock.ptrend = inbuffer;
1542 inblock.sock = cutthrough.fd;
1543 /* this relies on (inblock.sock == tls_out.active) */
1544 if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, timeout))
1545 cancel_cutthrough_connection("target timeout on read");
1546
1547 if(copy != NULL)
1548 {
1549 uschar * cp;
1550 *copy = cp = string_copy(responsebuffer);
1551 /* Trim the trailing end of line */
1552 cp += Ustrlen(responsebuffer);
1553 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1554 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1555 }
1556
1557 return responsebuffer[0];
1558 }
1559
1560
1561 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1562 BOOL
1563 cutthrough_predata(void)
1564 {
1565 if(cutthrough.fd < 0)
1566 return FALSE;
1567
1568 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> DATA\n");
1569 cutthrough_puts(US"DATA\r\n", 6);
1570 cutthrough_flush_send();
1571
1572 /* Assume nothing buffered. If it was it gets ignored. */
1573 return cutthrough_response('3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
1574 }
1575
1576
1577 /* fd and tctx args only to match write_chunk() */
1578 static BOOL
1579 cutthrough_write_chunk(int fd, transport_ctx * tctx, uschar * s, int len)
1580 {
1581 uschar * s2;
1582 while(s && (s2 = Ustrchr(s, '\n')))
1583 {
1584 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1585 return FALSE;
1586 s = s2+1;
1587 }
1588 return TRUE;
1589 }
1590
1591
1592 /* Buffered send of headers. Return success boolean. */
1593 /* Expands newlines to wire format (CR,NL). */
1594 /* Also sends header-terminating blank line. */
1595 BOOL
1596 cutthrough_headers_send(void)
1597 {
1598 transport_ctx tctx;
1599
1600 if(cutthrough.fd < 0)
1601 return FALSE;
1602
1603 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1604 but having a separate buffered-output function (for now)
1605 */
1606 HDEBUG(D_acl) debug_printf("----------- start cutthrough headers send -----------\n");
1607
1608 tctx.tblock = cutthrough.addr.transport;
1609 tctx.addr = &cutthrough.addr;
1610 tctx.check_string = US".";
1611 tctx.escape_string = US"..";
1612 tctx.options = topt_use_crlf;
1613
1614 if (!transport_headers_send(cutthrough.fd, &tctx, &cutthrough_write_chunk))
1615 return FALSE;
1616
1617 HDEBUG(D_acl) debug_printf("----------- done cutthrough headers send ------------\n");
1618 return TRUE;
1619 }
1620
1621
1622 static void
1623 close_cutthrough_connection(const char * why)
1624 {
1625 if(cutthrough.fd >= 0)
1626 {
1627 /* We could be sending this after a bunch of data, but that is ok as
1628 the only way to cancel the transfer in dataphase is to drop the tcp
1629 conn before the final dot.
1630 */
1631 ctblock.ptr = ctbuffer;
1632 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> QUIT\n");
1633 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1634 _cutthrough_flush_send();
1635
1636 /* Wait a short time for response, and discard it */
1637 cutthrough_response('2', NULL, 1);
1638
1639 #ifdef SUPPORT_TLS
1640 tls_close(FALSE, TRUE);
1641 #endif
1642 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
1643 (void)close(cutthrough.fd);
1644 cutthrough.fd = -1;
1645 HDEBUG(D_acl) debug_printf("----------- cutthrough shutdown (%s) ------------\n", why);
1646 }
1647 ctblock.ptr = ctbuffer;
1648 }
1649
1650 void
1651 cancel_cutthrough_connection(const char * why)
1652 {
1653 close_cutthrough_connection(why);
1654 cutthrough.delivery = FALSE;
1655 }
1656
1657
1658
1659
1660 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1661 Log an OK response as a transmission.
1662 Close the connection.
1663 Return smtp response-class digit.
1664 */
1665 uschar *
1666 cutthrough_finaldot(void)
1667 {
1668 uschar res;
1669 address_item * addr;
1670 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> .\n");
1671
1672 /* Assume data finshed with new-line */
1673 if( !cutthrough_puts(US".", 1)
1674 || !cutthrough_put_nl()
1675 || !cutthrough_flush_send()
1676 )
1677 return cutthrough.addr.message;
1678
1679 res = cutthrough_response('2', &cutthrough.addr.message, CUTTHROUGH_DATA_TIMEOUT);
1680 for (addr = &cutthrough.addr; addr; addr = addr->next)
1681 {
1682 addr->message = cutthrough.addr.message;
1683 switch(res)
1684 {
1685 case '2':
1686 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1687 close_cutthrough_connection("delivered");
1688 break;
1689
1690 case '4':
1691 delivery_log(LOG_MAIN, addr, 0,
1692 US"tmp-reject from cutthrough after DATA:");
1693 break;
1694
1695 case '5':
1696 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1697 US"rejected after DATA:");
1698 break;
1699
1700 default:
1701 break;
1702 }
1703 }
1704 return cutthrough.addr.message;
1705 }
1706
1707
1708
1709 /*************************************************
1710 * Copy error to toplevel address *
1711 *************************************************/
1712
1713 /* This function is used when a verify fails or defers, to ensure that the
1714 failure or defer information is in the original toplevel address. This applies
1715 when an address is redirected to a single new address, and the failure or
1716 deferral happens to the child address.
1717
1718 Arguments:
1719 vaddr the verify address item
1720 addr the final address item
1721 yield FAIL or DEFER
1722
1723 Returns: the value of YIELD
1724 */
1725
1726 static int
1727 copy_error(address_item *vaddr, address_item *addr, int yield)
1728 {
1729 if (addr != vaddr)
1730 {
1731 vaddr->message = addr->message;
1732 vaddr->user_message = addr->user_message;
1733 vaddr->basic_errno = addr->basic_errno;
1734 vaddr->more_errno = addr->more_errno;
1735 vaddr->prop.address_data = addr->prop.address_data;
1736 copyflag(vaddr, addr, af_pass_message);
1737 }
1738 return yield;
1739 }
1740
1741
1742
1743
1744 /**************************************************
1745 * printf that automatically handles TLS if needed *
1746 ***************************************************/
1747
1748 /* This function is used by verify_address() as a substitute for all fprintf()
1749 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1750 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1751 that assumes that we always use the smtp_out FILE* when not using TLS or the
1752 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1753 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1754 fprintf().
1755
1756 Arguments:
1757 f the candidate FILE* to write to
1758 format format string
1759 ... optional arguments
1760
1761 Returns:
1762 nothing
1763 */
1764
1765 static void PRINTF_FUNCTION(2,3)
1766 respond_printf(FILE *f, const char *format, ...)
1767 {
1768 va_list ap;
1769
1770 va_start(ap, format);
1771 if (smtp_out && (f == smtp_out))
1772 smtp_vprintf(format, ap);
1773 else
1774 vfprintf(f, format, ap);
1775 va_end(ap);
1776 }
1777
1778
1779
1780 /*************************************************
1781 * Verify an email address *
1782 *************************************************/
1783
1784 /* This function is used both for verification (-bv and at other times) and
1785 address testing (-bt), which is indicated by address_test_mode being set.
1786
1787 Arguments:
1788 vaddr contains the address to verify; the next field in this block
1789 must be NULL
1790 f if not NULL, write the result to this file
1791 options various option bits:
1792 vopt_fake_sender => this sender verify is not for the real
1793 sender (it was verify=sender=xxxx or an address from a
1794 header line) - rewriting must not change sender_address
1795 vopt_is_recipient => this is a recipient address, otherwise
1796 it's a sender address - this affects qualification and
1797 rewriting and messages from callouts
1798 vopt_qualify => qualify an unqualified address; else error
1799 vopt_expn => called from SMTP EXPN command
1800 vopt_success_on_redirect => when a new address is generated
1801 the verification instantly succeeds
1802
1803 These ones are used by do_callout() -- the options variable
1804 is passed to it.
1805
1806 vopt_callout_fullpm => if postmaster check, do full one
1807 vopt_callout_no_cache => don't use callout cache
1808 vopt_callout_random => do the "random" thing
1809 vopt_callout_recipsender => use real sender for recipient
1810 vopt_callout_recippmaster => use postmaster for recipient
1811
1812 callout if > 0, specifies that callout is required, and gives timeout
1813 for individual commands
1814 callout_overall if > 0, gives overall timeout for the callout function;
1815 if < 0, a default is used (see do_callout())
1816 callout_connect the connection timeout for callouts
1817 se_mailfrom when callout is requested to verify a sender, use this
1818 in MAIL FROM; NULL => ""
1819 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1820 thing and use this as the sender address (may be "")
1821
1822 routed if not NULL, set TRUE if routing succeeded, so we can
1823 distinguish between routing failed and callout failed
1824
1825 Returns: OK address verified
1826 FAIL address failed to verify
1827 DEFER can't tell at present
1828 */
1829
1830 int
1831 verify_address(address_item *vaddr, FILE *f, int options, int callout,
1832 int callout_overall, int callout_connect, uschar *se_mailfrom,
1833 uschar *pm_mailfrom, BOOL *routed)
1834 {
1835 BOOL allok = TRUE;
1836 BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
1837 BOOL expn = (options & vopt_expn) != 0;
1838 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1839 int i;
1840 int yield = OK;
1841 int verify_type = expn? v_expn :
1842 address_test_mode? v_none :
1843 options & vopt_is_recipient? v_recipient : v_sender;
1844 address_item *addr_list;
1845 address_item *addr_new = NULL;
1846 address_item *addr_remote = NULL;
1847 address_item *addr_local = NULL;
1848 address_item *addr_succeed = NULL;
1849 uschar **failure_ptr = options & vopt_is_recipient
1850 ? &recipient_verify_failure : &sender_verify_failure;
1851 uschar *ko_prefix, *cr;
1852 uschar *address = vaddr->address;
1853 uschar *save_sender;
1854 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1855
1856 /* Clear, just in case */
1857
1858 *failure_ptr = NULL;
1859
1860 /* Set up a prefix and suffix for error message which allow us to use the same
1861 output statements both in EXPN mode (where an SMTP response is needed) and when
1862 debugging with an output file. */
1863
1864 if (expn)
1865 {
1866 ko_prefix = US"553 ";
1867 cr = US"\r";
1868 }
1869 else ko_prefix = cr = US"";
1870
1871 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1872
1873 if (parse_find_at(address) == NULL)
1874 {
1875 if ((options & vopt_qualify) == 0)
1876 {
1877 if (f != NULL)
1878 respond_printf(f, "%sA domain is required for \"%s\"%s\n",
1879 ko_prefix, address, cr);
1880 *failure_ptr = US"qualify";
1881 return FAIL;
1882 }
1883 address = rewrite_address_qualify(address, options & vopt_is_recipient);
1884 }
1885
1886 DEBUG(D_verify)
1887 {
1888 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1889 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
1890 }
1891
1892 /* Rewrite and report on it. Clear the domain and local part caches - these
1893 may have been set by domains and local part tests during an ACL. */
1894
1895 if (global_rewrite_rules != NULL)
1896 {
1897 uschar *old = address;
1898 address = rewrite_address(address, options & vopt_is_recipient, FALSE,
1899 global_rewrite_rules, rewrite_existflags);
1900 if (address != old)
1901 {
1902 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1903 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1904 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
1905 }
1906 }
1907
1908 /* If this is the real sender address, we must update sender_address at
1909 this point, because it may be referred to in the routers. */
1910
1911 if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
1912 sender_address = address;
1913
1914 /* If the address was rewritten to <> no verification can be done, and we have
1915 to return OK. This rewriting is permitted only for sender addresses; for other
1916 addresses, such rewriting fails. */
1917
1918 if (address[0] == 0) return OK;
1919
1920 /* Flip the legacy TLS-related variables over to the outbound set in case
1921 they're used in the context of a transport used by verification. Reset them
1922 at exit from this routine (so no returns allowed from here on). */
1923
1924 tls_modify_variables(&tls_out);
1925
1926 /* Save a copy of the sender address for re-instating if we change it to <>
1927 while verifying a sender address (a nice bit of self-reference there). */
1928
1929 save_sender = sender_address;
1930
1931 /* Observability variable for router/transport use */
1932
1933 verify_mode = options & vopt_is_recipient ? US"R" : US"S";
1934
1935 /* Update the address structure with the possibly qualified and rewritten
1936 address. Set it up as the starting address on the chain of new addresses. */
1937
1938 vaddr->address = address;
1939 addr_new = vaddr;
1940
1941 /* We need a loop, because an address can generate new addresses. We must also
1942 cope with generated pipes and files at the top level. (See also the code and
1943 comment in deliver.c.) However, it is usually the case that the router for
1944 user's .forward files has its verify flag turned off.
1945
1946 If an address generates more than one child, the loop is used only when
1947 full_info is set, and this can only be set locally. Remote enquiries just get
1948 information about the top level address, not anything that it generated. */
1949
1950 while (addr_new)
1951 {
1952 int rc;
1953 address_item *addr = addr_new;
1954
1955 addr_new = addr->next;
1956 addr->next = NULL;
1957
1958 DEBUG(D_verify)
1959 {
1960 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1961 debug_printf("Considering %s\n", addr->address);
1962 }
1963
1964 /* Handle generated pipe, file or reply addresses. We don't get these
1965 when handling EXPN, as it does only one level of expansion. */
1966
1967 if (testflag(addr, af_pfr))
1968 {
1969 allok = FALSE;
1970 if (f != NULL)
1971 {
1972 BOOL allow;
1973
1974 if (addr->address[0] == '>')
1975 {
1976 allow = testflag(addr, af_allow_reply);
1977 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1978 }
1979 else
1980 {
1981 allow = (addr->address[0] == '|')?
1982 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1983 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1984 }
1985
1986 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1987 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1988 "%s\n", addr->message);
1989 else if (allow)
1990 fprintf(f, "\n transport = %s\n", addr->transport->name);
1991 else
1992 fprintf(f, " *** forbidden ***\n");
1993 }
1994 continue;
1995 }
1996
1997 /* Just in case some router parameter refers to it. */
1998
1999 return_path = addr->prop.errors_address
2000 ? addr->prop.errors_address : sender_address;
2001
2002 /* Split the address into domain and local part, handling the %-hack if
2003 necessary, and then route it. While routing a sender address, set
2004 $sender_address to <> because that is what it will be if we were trying to
2005 send a bounce to the sender. */
2006
2007 if (routed) *routed = FALSE;
2008 if ((rc = deliver_split_address(addr)) == OK)
2009 {
2010 if (!(options & vopt_is_recipient)) sender_address = null_sender;
2011 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
2012 &addr_succeed, verify_type);
2013 sender_address = save_sender; /* Put back the real sender */
2014 }
2015
2016 /* If routing an address succeeded, set the flag that remembers, for use when
2017 an ACL cached a sender verify (in case a callout fails). Then if routing set
2018 up a list of hosts or the transport has a host list, and the callout option
2019 is set, and we aren't in a host checking run, do the callout verification,
2020 and set another flag that notes that a callout happened. */
2021
2022 if (rc == OK)
2023 {
2024 if (routed) *routed = TRUE;
2025 if (callout > 0)
2026 {
2027 transport_instance * tp;
2028 host_item * host_list = addr->host_list;
2029
2030 /* Make up some data for use in the case where there is no remote
2031 transport. */
2032
2033 transport_feedback tf = {
2034 NULL, /* interface (=> any) */
2035 US"smtp", /* port */
2036 US"smtp", /* protocol */
2037 NULL, /* hosts */
2038 US"$smtp_active_hostname", /* helo_data */
2039 FALSE, /* hosts_override */
2040 FALSE, /* hosts_randomize */
2041 FALSE, /* gethostbyname */
2042 TRUE, /* qualify_single */
2043 FALSE /* search_parents */
2044 };
2045
2046 /* If verification yielded a remote transport, we want to use that
2047 transport's options, so as to mimic what would happen if we were really
2048 sending a message to this address. */
2049
2050 if ((tp = addr->transport) && !tp->info->local)
2051 {
2052 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
2053
2054 /* If the transport has hosts and the router does not, or if the
2055 transport is configured to override the router's hosts, we must build a
2056 host list of the transport's hosts, and find the IP addresses */
2057
2058 if (tf.hosts && (!host_list || tf.hosts_override))
2059 {
2060 uschar *s;
2061 const uschar *save_deliver_domain = deliver_domain;
2062 uschar *save_deliver_localpart = deliver_localpart;
2063
2064 host_list = NULL; /* Ignore the router's hosts */
2065
2066 deliver_domain = addr->domain;
2067 deliver_localpart = addr->local_part;
2068 s = expand_string(tf.hosts);
2069 deliver_domain = save_deliver_domain;
2070 deliver_localpart = save_deliver_localpart;
2071
2072 if (!s)
2073 {
2074 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
2075 "\"%s\" in %s transport for callout: %s", tf.hosts,
2076 tp->name, expand_string_message);
2077 }
2078 else
2079 {
2080 int flags;
2081 host_item *host, *nexthost;
2082 host_build_hostlist(&host_list, s, tf.hosts_randomize);
2083
2084 /* Just ignore failures to find a host address. If we don't manage
2085 to find any addresses, the callout will defer. Note that more than
2086 one address may be found for a single host, which will result in
2087 additional host items being inserted into the chain. Hence we must
2088 save the next host first. */
2089
2090 flags = HOST_FIND_BY_A;
2091 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
2092 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
2093
2094 for (host = host_list; host; host = nexthost)
2095 {
2096 nexthost = host->next;
2097 if (tf.gethostbyname ||
2098 string_is_ip_address(host->name, NULL) != 0)
2099 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
2100 else
2101 {
2102 dnssec_domains * dnssec_domains = NULL;
2103 if (Ustrcmp(tp->driver_name, "smtp") == 0)
2104 {
2105 smtp_transport_options_block * ob =
2106 (smtp_transport_options_block *) tp->options_block;
2107 dnssec_domains = &ob->dnssec;
2108 }
2109
2110 (void)host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
2111 dnssec_domains, NULL, NULL);
2112 }
2113 }
2114 }
2115 }
2116 }
2117
2118 /* Can only do a callout if we have at least one host! If the callout
2119 fails, it will have set ${sender,recipient}_verify_failure. */
2120
2121 if (host_list)
2122 {
2123 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
2124 if (host_checking && !host_checking_callout)
2125 {
2126 HDEBUG(D_verify)
2127 debug_printf("... callout omitted by default when host testing\n"
2128 "(Use -bhc if you want the callouts to happen.)\n");
2129 }
2130 else
2131 {
2132 #ifdef SUPPORT_TLS
2133 deliver_set_expansions(addr);
2134 #endif
2135 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
2136 callout_connect, options, se_mailfrom, pm_mailfrom);
2137 }
2138 }
2139 else
2140 {
2141 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
2142 "transport provided a host list\n");
2143 }
2144 }
2145 }
2146
2147 /* Otherwise, any failure is a routing failure */
2148
2149 else *failure_ptr = US"route";
2150
2151 /* A router may return REROUTED if it has set up a child address as a result
2152 of a change of domain name (typically from widening). In this case we always
2153 want to continue to verify the new child. */
2154
2155 if (rc == REROUTED) continue;
2156
2157 /* Handle hard failures */
2158
2159 if (rc == FAIL)
2160 {
2161 allok = FALSE;
2162 if (f)
2163 {
2164 address_item *p = addr->parent;
2165
2166 respond_printf(f, "%s%s %s", ko_prefix,
2167 full_info ? addr->address : address,
2168 address_test_mode ? "is undeliverable" : "failed to verify");
2169 if (!expn && admin_user)
2170 {
2171 if (addr->basic_errno > 0)
2172 respond_printf(f, ": %s", strerror(addr->basic_errno));
2173 if (addr->message)
2174 respond_printf(f, ": %s", addr->message);
2175 }
2176
2177 /* Show parents iff doing full info */
2178
2179 if (full_info) while (p)
2180 {
2181 respond_printf(f, "%s\n <-- %s", cr, p->address);
2182 p = p->parent;
2183 }
2184 respond_printf(f, "%s\n", cr);
2185 }
2186 cancel_cutthrough_connection("routing hard fail");
2187
2188 if (!full_info)
2189 {
2190 yield = copy_error(vaddr, addr, FAIL);
2191 goto out;
2192 }
2193 yield = FAIL;
2194 }
2195
2196 /* Soft failure */
2197
2198 else if (rc == DEFER)
2199 {
2200 allok = FALSE;
2201 if (f)
2202 {
2203 address_item *p = addr->parent;
2204 respond_printf(f, "%s%s cannot be resolved at this time", ko_prefix,
2205 full_info? addr->address : address);
2206 if (!expn && admin_user)
2207 {
2208 if (addr->basic_errno > 0)
2209 respond_printf(f, ": %s", strerror(addr->basic_errno));
2210 if (addr->message)
2211 respond_printf(f, ": %s", addr->message);
2212 else if (addr->basic_errno <= 0)
2213 respond_printf(f, ": unknown error");
2214 }
2215
2216 /* Show parents iff doing full info */
2217
2218 if (full_info) while (p)
2219 {
2220 respond_printf(f, "%s\n <-- %s", cr, p->address);
2221 p = p->parent;
2222 }
2223 respond_printf(f, "%s\n", cr);
2224 }
2225 cancel_cutthrough_connection("routing soft fail");
2226
2227 if (!full_info)
2228 {
2229 yield = copy_error(vaddr, addr, DEFER);
2230 goto out;
2231 }
2232 if (yield == OK) yield = DEFER;
2233 }
2234
2235 /* If we are handling EXPN, we do not want to continue to route beyond
2236 the top level (whose address is in "address"). */
2237
2238 else if (expn)
2239 {
2240 uschar *ok_prefix = US"250-";
2241
2242 if (!addr_new)
2243 if (!addr_local && !addr_remote)
2244 respond_printf(f, "250 mail to <%s> is discarded\r\n", address);
2245 else
2246 respond_printf(f, "250 <%s>\r\n", address);
2247
2248 else do
2249 {
2250 address_item *addr2 = addr_new;
2251 addr_new = addr2->next;
2252 if (!addr_new) ok_prefix = US"250 ";
2253 respond_printf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
2254 } while (addr_new);
2255 yield = OK;
2256 goto out;
2257 }
2258
2259 /* Successful routing other than EXPN. */
2260
2261 else
2262 {
2263 /* Handle successful routing when short info wanted. Otherwise continue for
2264 other (generated) addresses. Short info is the operational case. Full info
2265 can be requested only when debug_selector != 0 and a file is supplied.
2266
2267 There is a conflict between the use of aliasing as an alternate email
2268 address, and as a sort of mailing list. If an alias turns the incoming
2269 address into just one address (e.g. J.Caesar->jc44) you may well want to
2270 carry on verifying the generated address to ensure it is valid when
2271 checking incoming mail. If aliasing generates multiple addresses, you
2272 probably don't want to do this. Exim therefore treats the generation of
2273 just a single new address as a special case, and continues on to verify the
2274 generated address. */
2275
2276 if ( !full_info /* Stop if short info wanted AND */
2277 && ( ( !addr_new /* No new address OR */
2278 || addr_new->next /* More than one new address OR */
2279 || testflag(addr_new, af_pfr) /* New address is pfr */
2280 )
2281 || /* OR */
2282 ( addr_new /* At least one new address AND */
2283 && success_on_redirect /* success_on_redirect is set */
2284 ) )
2285 )
2286 {
2287 if (f) fprintf(f, "%s %s\n",
2288 address, address_test_mode ? "is deliverable" : "verified");
2289
2290 /* If we have carried on to verify a child address, we want the value
2291 of $address_data to be that of the child */
2292
2293 vaddr->prop.address_data = addr->prop.address_data;
2294
2295 /* If stopped because more than one new address, cannot cutthrough */
2296
2297 if (addr_new && addr_new->next)
2298 cancel_cutthrough_connection("multiple addresses from routing");
2299
2300 yield = OK;
2301 goto out;
2302 }
2303 }
2304 } /* Loop for generated addresses */
2305
2306 /* Display the full results of the successful routing, including any generated
2307 addresses. Control gets here only when full_info is set, which requires f not
2308 to be NULL, and this occurs only when a top-level verify is called with the
2309 debugging switch on.
2310
2311 If there are no local and no remote addresses, and there were no pipes, files,
2312 or autoreplies, and there were no errors or deferments, the message is to be
2313 discarded, usually because of the use of :blackhole: in an alias file. */
2314
2315 if (allok && !addr_local && !addr_remote)
2316 {
2317 fprintf(f, "mail to %s is discarded\n", address);
2318 goto out;
2319 }
2320
2321 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2322 while (addr_list)
2323 {
2324 address_item *addr = addr_list;
2325 address_item *p = addr->parent;
2326 transport_instance * tp = addr->transport;
2327
2328 addr_list = addr->next;
2329
2330 fprintf(f, "%s", CS addr->address);
2331 #ifdef EXPERIMENTAL_SRS
2332 if(addr->prop.srs_sender)
2333 fprintf(f, " [srs = %s]", addr->prop.srs_sender);
2334 #endif
2335
2336 /* If the address is a duplicate, show something about it. */
2337
2338 if (!testflag(addr, af_pfr))
2339 {
2340 tree_node *tnode;
2341 if ((tnode = tree_search(tree_duplicates, addr->unique)))
2342 fprintf(f, " [duplicate, would not be delivered]");
2343 else tree_add_duplicate(addr->unique, addr);
2344 }
2345
2346 /* Now show its parents */
2347
2348 for (p = addr->parent; p; p = p->parent)
2349 fprintf(f, "\n <-- %s", p->address);
2350 fprintf(f, "\n ");
2351
2352 /* Show router, and transport */
2353
2354 fprintf(f, "router = %s, transport = %s\n",
2355 addr->router->name, tp ? tp->name : US"unset");
2356
2357 /* Show any hosts that are set up by a router unless the transport
2358 is going to override them; fiddle a bit to get a nice format. */
2359
2360 if (addr->host_list && tp && !tp->overrides_hosts)
2361 {
2362 host_item *h;
2363 int maxlen = 0;
2364 int maxaddlen = 0;
2365 for (h = addr->host_list; h; h = h->next)
2366 { /* get max lengths of host names, addrs */
2367 int len = Ustrlen(h->name);
2368 if (len > maxlen) maxlen = len;
2369 len = h->address ? Ustrlen(h->address) : 7;
2370 if (len > maxaddlen) maxaddlen = len;
2371 }
2372 for (h = addr->host_list; h; h = h->next)
2373 {
2374 fprintf(f, " host %-*s ", maxlen, h->name);
2375
2376 if (h->address)
2377 fprintf(f, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2378 else if (tp->info->local)
2379 fprintf(f, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2380 else
2381 fprintf(f, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2382
2383 if (h->mx >= 0) fprintf(f, " MX=%d", h->mx);
2384 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
2385 if (running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", f);
2386 if (h->status == hstatus_unusable) fputs(" ** unusable **", f);
2387 fputc('\n', f);
2388 }
2389 }
2390 }
2391
2392 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2393 the -bv or -bt case). */
2394
2395 out:
2396 verify_mode = NULL;
2397 tls_modify_variables(&tls_in);
2398
2399 return yield;
2400 }
2401
2402
2403
2404
2405 /*************************************************
2406 * Check headers for syntax errors *
2407 *************************************************/
2408
2409 /* This function checks those header lines that contain addresses, and verifies
2410 that all the addresses therein are syntactially correct.
2411
2412 Arguments:
2413 msgptr where to put an error message
2414
2415 Returns: OK
2416 FAIL
2417 */
2418
2419 int
2420 verify_check_headers(uschar **msgptr)
2421 {
2422 header_line *h;
2423 uschar *colon, *s;
2424 int yield = OK;
2425
2426 for (h = header_list; h != NULL && yield == OK; h = h->next)
2427 {
2428 if (h->type != htype_from &&
2429 h->type != htype_reply_to &&
2430 h->type != htype_sender &&
2431 h->type != htype_to &&
2432 h->type != htype_cc &&
2433 h->type != htype_bcc)
2434 continue;
2435
2436 colon = Ustrchr(h->text, ':');
2437 s = colon + 1;
2438 while (isspace(*s)) s++;
2439
2440 /* Loop for multiple addresses in the header, enabling group syntax. Note
2441 that we have to reset this after the header has been scanned. */
2442
2443 parse_allow_group = TRUE;
2444
2445 while (*s != 0)
2446 {
2447 uschar *ss = parse_find_address_end(s, FALSE);
2448 uschar *recipient, *errmess;
2449 int terminator = *ss;
2450 int start, end, domain;
2451
2452 /* Temporarily terminate the string at this point, and extract the
2453 operative address within, allowing group syntax. */
2454
2455 *ss = 0;
2456 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2457 *ss = terminator;
2458
2459 /* Permit an unqualified address only if the message is local, or if the
2460 sending host is configured to be permitted to send them. */
2461
2462 if (recipient != NULL && domain == 0)
2463 {
2464 if (h->type == htype_from || h->type == htype_sender)
2465 {
2466 if (!allow_unqualified_sender) recipient = NULL;
2467 }
2468 else
2469 {
2470 if (!allow_unqualified_recipient) recipient = NULL;
2471 }
2472 if (recipient == NULL) errmess = US"unqualified address not permitted";
2473 }
2474
2475 /* It's an error if no address could be extracted, except for the special
2476 case of an empty address. */
2477
2478 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
2479 {
2480 uschar *verb = US"is";
2481 uschar *t = ss;
2482 uschar *tt = colon;
2483 int len;
2484
2485 /* Arrange not to include any white space at the end in the
2486 error message or the header name. */
2487
2488 while (t > s && isspace(t[-1])) t--;
2489 while (tt > h->text && isspace(tt[-1])) tt--;
2490
2491 /* Add the address that failed to the error message, since in a
2492 header with very many addresses it is sometimes hard to spot
2493 which one is at fault. However, limit the amount of address to
2494 quote - cases have been seen where, for example, a missing double
2495 quote in a humungous To: header creates an "address" that is longer
2496 than string_sprintf can handle. */
2497
2498 len = t - s;
2499 if (len > 1024)
2500 {
2501 len = 1024;
2502 verb = US"begins";
2503 }
2504
2505 /* deconst cast ok as we're passing a non-const to string_printing() */
2506 *msgptr = US string_printing(
2507 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2508 errmess, tt - h->text, h->text, verb, len, s));
2509
2510 yield = FAIL;
2511 break; /* Out of address loop */
2512 }
2513
2514 /* Advance to the next address */
2515
2516 s = ss + (terminator? 1:0);
2517 while (isspace(*s)) s++;
2518 } /* Next address */
2519
2520 parse_allow_group = FALSE;
2521 parse_found_group = FALSE;
2522 } /* Next header unless yield has been set FALSE */
2523
2524 return yield;
2525 }
2526
2527
2528 /*************************************************
2529 * Check header names for 8-bit characters *
2530 *************************************************/
2531
2532 /* This function checks for invalid charcters in header names. See
2533 RFC 5322, 2.2. and RFC 6532, 3.
2534
2535 Arguments:
2536 msgptr where to put an error message
2537
2538 Returns: OK
2539 FAIL
2540 */
2541
2542 int
2543 verify_check_header_names_ascii(uschar **msgptr)
2544 {
2545 header_line *h;
2546 uschar *colon, *s;
2547
2548 for (h = header_list; h != NULL; h = h->next)
2549 {
2550 colon = Ustrchr(h->text, ':');
2551 for(s = h->text; s < colon; s++)
2552 {
2553 if ((*s < 33) || (*s > 126))
2554 {
2555 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2556 colon - h->text, h->text);
2557 return FAIL;
2558 }
2559 }
2560 }
2561 return OK;
2562 }
2563
2564 /*************************************************
2565 * Check for blind recipients *
2566 *************************************************/
2567
2568 /* This function checks that every (envelope) recipient is mentioned in either
2569 the To: or Cc: header lines, thus detecting blind carbon copies.
2570
2571 There are two ways of scanning that could be used: either scan the header lines
2572 and tick off the recipients, or scan the recipients and check the header lines.
2573 The original proposed patch did the former, but I have chosen to do the latter,
2574 because (a) it requires no memory and (b) will use fewer resources when there
2575 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2576
2577 Arguments: none
2578 Returns: OK if there are no blind recipients
2579 FAIL if there is at least one blind recipient
2580 */
2581
2582 int
2583 verify_check_notblind(void)
2584 {
2585 int i;
2586 for (i = 0; i < recipients_count; i++)
2587 {
2588 header_line *h;
2589 BOOL found = FALSE;
2590 uschar *address = recipients_list[i].address;
2591
2592 for (h = header_list; !found && h != NULL; h = h->next)
2593 {
2594 uschar *colon, *s;
2595
2596 if (h->type != htype_to && h->type != htype_cc) continue;
2597
2598 colon = Ustrchr(h->text, ':');
2599 s = colon + 1;
2600 while (isspace(*s)) s++;
2601
2602 /* Loop for multiple addresses in the header, enabling group syntax. Note
2603 that we have to reset this after the header has been scanned. */
2604
2605 parse_allow_group = TRUE;
2606
2607 while (*s != 0)
2608 {
2609 uschar *ss = parse_find_address_end(s, FALSE);
2610 uschar *recipient,*errmess;
2611 int terminator = *ss;
2612 int start, end, domain;
2613
2614 /* Temporarily terminate the string at this point, and extract the
2615 operative address within, allowing group syntax. */
2616
2617 *ss = 0;
2618 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2619 *ss = terminator;
2620
2621 /* If we found a valid recipient that has a domain, compare it with the
2622 envelope recipient. Local parts are compared case-sensitively, domains
2623 case-insensitively. By comparing from the start with length "domain", we
2624 include the "@" at the end, which ensures that we are comparing the whole
2625 local part of each address. */
2626
2627 if (recipient != NULL && domain != 0)
2628 {
2629 found = Ustrncmp(recipient, address, domain) == 0 &&
2630 strcmpic(recipient + domain, address + domain) == 0;
2631 if (found) break;
2632 }
2633
2634 /* Advance to the next address */
2635
2636 s = ss + (terminator? 1:0);
2637 while (isspace(*s)) s++;
2638 } /* Next address */
2639
2640 parse_allow_group = FALSE;
2641 parse_found_group = FALSE;
2642 } /* Next header (if found is false) */
2643
2644 if (!found) return FAIL;
2645 } /* Next recipient */
2646
2647 return OK;
2648 }
2649
2650
2651
2652 /*************************************************
2653 * Find if verified sender *
2654 *************************************************/
2655
2656 /* Usually, just a single address is verified as the sender of the message.
2657 However, Exim can be made to verify other addresses as well (often related in
2658 some way), and this is useful in some environments. There may therefore be a
2659 chain of such addresses that have previously been tested. This function finds
2660 whether a given address is on the chain.
2661
2662 Arguments: the address to be verified
2663 Returns: pointer to an address item, or NULL
2664 */
2665
2666 address_item *
2667 verify_checked_sender(uschar *sender)
2668 {
2669 address_item *addr;
2670 for (addr = sender_verified_list; addr != NULL; addr = addr->next)
2671 if (Ustrcmp(sender, addr->address) == 0) break;
2672 return addr;
2673 }
2674
2675
2676
2677
2678
2679 /*************************************************
2680 * Get valid header address *
2681 *************************************************/
2682
2683 /* Scan the originator headers of the message, looking for an address that
2684 verifies successfully. RFC 822 says:
2685
2686 o The "Sender" field mailbox should be sent notices of
2687 any problems in transport or delivery of the original
2688 messages. If there is no "Sender" field, then the
2689 "From" field mailbox should be used.
2690
2691 o If the "Reply-To" field exists, then the reply should
2692 go to the addresses indicated in that field and not to
2693 the address(es) indicated in the "From" field.
2694
2695 So we check a Sender field if there is one, else a Reply_to field, else a From
2696 field. As some strange messages may have more than one of these fields,
2697 especially if they are resent- fields, check all of them if there is more than
2698 one.
2699
2700 Arguments:
2701 user_msgptr points to where to put a user error message
2702 log_msgptr points to where to put a log error message
2703 callout timeout for callout check (passed to verify_address())
2704 callout_overall overall callout timeout (ditto)
2705 callout_connect connect callout timeout (ditto)
2706 se_mailfrom mailfrom for verify; NULL => ""
2707 pm_mailfrom sender for pm callout check (passed to verify_address())
2708 options callout options (passed to verify_address())
2709 verrno where to put the address basic_errno
2710
2711 If log_msgptr is set to something without setting user_msgptr, the caller
2712 normally uses log_msgptr for both things.
2713
2714 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2715 FAIL is given if no appropriate headers are found
2716 */
2717
2718 int
2719 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2720 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2721 uschar *pm_mailfrom, int options, int *verrno)
2722 {
2723 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2724 BOOL done = FALSE;
2725 int yield = FAIL;
2726 int i;
2727
2728 for (i = 0; i < 3 && !done; i++)
2729 {
2730 header_line *h;
2731 for (h = header_list; h != NULL && !done; h = h->next)
2732 {
2733 int terminator, new_ok;
2734 uschar *s, *ss, *endname;
2735
2736 if (h->type != header_types[i]) continue;
2737 s = endname = Ustrchr(h->text, ':') + 1;
2738
2739 /* Scan the addresses in the header, enabling group syntax. Note that we
2740 have to reset this after the header has been scanned. */
2741
2742 parse_allow_group = TRUE;
2743
2744 while (*s != 0)
2745 {
2746 address_item *vaddr;
2747
2748 while (isspace(*s) || *s == ',') s++;
2749 if (*s == 0) break; /* End of header */
2750
2751 ss = parse_find_address_end(s, FALSE);
2752
2753 /* The terminator is a comma or end of header, but there may be white
2754 space preceding it (including newline for the last address). Move back
2755 past any white space so we can check against any cached envelope sender
2756 address verifications. */
2757
2758 while (isspace(ss[-1])) ss--;
2759 terminator = *ss;
2760 *ss = 0;
2761
2762 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2763 (int)(endname - h->text), h->text, s);
2764
2765 /* See if we have already verified this address as an envelope sender,
2766 and if so, use the previous answer. */
2767
2768 vaddr = verify_checked_sender(s);
2769
2770 if (vaddr != NULL && /* Previously checked */
2771 (callout <= 0 || /* No callout needed; OR */
2772 vaddr->special_action > 256)) /* Callout was done */
2773 {
2774 new_ok = vaddr->special_action & 255;
2775 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2776 *ss = terminator; /* Restore shortened string */
2777 }
2778
2779 /* Otherwise we run the verification now. We must restore the shortened
2780 string before running the verification, so the headers are correct, in
2781 case there is any rewriting. */
2782
2783 else
2784 {
2785 int start, end, domain;
2786 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2787 &domain, FALSE);
2788
2789 *ss = terminator;
2790
2791 /* If we found an empty address, just carry on with the next one, but
2792 kill the message. */
2793
2794 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2795 {
2796 *log_msgptr = NULL;
2797 s = ss;
2798 continue;
2799 }
2800
2801 /* If verification failed because of a syntax error, fail this
2802 function, and ensure that the failing address gets added to the error
2803 message. */
2804
2805 if (address == NULL)
2806 {
2807 new_ok = FAIL;
2808 while (ss > s && isspace(ss[-1])) ss--;
2809 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2810 "scanning for sender: %s in \"%.*s\"",
2811 endname - h->text, h->text, *log_msgptr, ss - s, s);
2812 yield = FAIL;
2813 done = TRUE;
2814 break;
2815 }
2816
2817 /* Else go ahead with the sender verification. But it isn't *the*
2818 sender of the message, so set vopt_fake_sender to stop sender_address
2819 being replaced after rewriting or qualification. */
2820
2821 else
2822 {
2823 vaddr = deliver_make_addr(address, FALSE);
2824 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2825 callout, callout_overall, callout_connect, se_mailfrom,
2826 pm_mailfrom, NULL);
2827 }
2828 }
2829
2830 /* We now have the result, either newly found, or cached. If we are
2831 giving out error details, set a specific user error. This means that the
2832 last of these will be returned to the user if all three fail. We do not
2833 set a log message - the generic one below will be used. */
2834
2835 if (new_ok != OK)
2836 {
2837 *verrno = vaddr->basic_errno;
2838 if (smtp_return_error_details)
2839 {
2840 *user_msgptr = string_sprintf("Rejected after DATA: "
2841 "could not verify \"%.*s\" header address\n%s: %s",
2842 endname - h->text, h->text, vaddr->address, vaddr->message);
2843 }
2844 }
2845
2846 /* Success or defer */
2847
2848 if (new_ok == OK)
2849 {
2850 yield = OK;
2851 done = TRUE;
2852 break;
2853 }
2854
2855 if (new_ok == DEFER) yield = DEFER;
2856
2857 /* Move on to any more addresses in the header */
2858
2859 s = ss;
2860 } /* Next address */
2861
2862 parse_allow_group = FALSE;
2863 parse_found_group = FALSE;
2864 } /* Next header, unless done */
2865 } /* Next header type unless done */
2866
2867 if (yield == FAIL && *log_msgptr == NULL)
2868 *log_msgptr = US"there is no valid sender in any header line";
2869
2870 if (yield == DEFER && *log_msgptr == NULL)
2871 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2872
2873 return yield;
2874 }
2875
2876
2877
2878
2879 /*************************************************
2880 * Get RFC 1413 identification *
2881 *************************************************/
2882
2883 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2884 the timeout is set to zero, then the query is not done. There may also be lists
2885 of hosts and nets which are exempt. To guard against malefactors sending
2886 non-printing characters which could, for example, disrupt a message's headers,
2887 make sure the string consists of printing characters only.
2888
2889 Argument:
2890 port the port to connect to; usually this is IDENT_PORT (113), but when
2891 running in the test harness with -bh a different value is used.
2892
2893 Returns: nothing
2894
2895 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2896 */
2897
2898 void
2899 verify_get_ident(int port)
2900 {
2901 int sock, host_af, qlen;
2902 int received_sender_port, received_interface_port, n;
2903 uschar *p;
2904 uschar buffer[2048];
2905
2906 /* Default is no ident. Check whether we want to do an ident check for this
2907 host. */
2908
2909 sender_ident = NULL;
2910 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2911 return;
2912
2913 DEBUG(D_ident) debug_printf("doing ident callback\n");
2914
2915 /* Set up a connection to the ident port of the remote host. Bind the local end
2916 to the incoming interface address. If the sender host address is an IPv6
2917 address, the incoming interface address will also be IPv6. */
2918
2919 host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
2920 if ((sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
2921
2922 if (ip_bind(sock, host_af, interface_address, 0) < 0)
2923 {
2924 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2925 strerror(errno));
2926 goto END_OFF;
2927 }
2928
2929 if (ip_connect(sock, host_af, sender_host_address, port,
2930 rfc1413_query_timeout, TRUE) < 0)
2931 {
2932 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
2933 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2934 sender_host_address);
2935 else
2936 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2937 sender_host_address, strerror(errno));
2938 goto END_OFF;
2939 }
2940
2941 /* Construct and send the query. */
2942
2943 sprintf(CS buffer, "%d , %d\r\n", sender_host_port, interface_port);
2944 qlen = Ustrlen(buffer);
2945 if (send(sock, buffer, qlen, 0) < 0)
2946 {
2947 DEBUG(D_ident) debug_printf("ident send failed: %s\n", strerror(errno));
2948 goto END_OFF;
2949 }
2950
2951 /* Read a response line. We put it into the rest of the buffer, using several
2952 recv() calls if necessary. */
2953
2954 p = buffer + qlen;
2955
2956 for (;;)
2957 {
2958 uschar *pp;
2959 int count;
2960 int size = sizeof(buffer) - (p - buffer);
2961
2962 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2963 count = ip_recv(sock, p, size, rfc1413_query_timeout);
2964 if (count <= 0) goto END_OFF; /* Read error or EOF */
2965
2966 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2967 generous, and accept a plain \n terminator as well. The only illegal
2968 character is 0. */
2969
2970 for (pp = p; pp < p + count; pp++)
2971 {
2972 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2973 if (*pp == '\n')
2974 {
2975 if (pp[-1] == '\r') pp--;
2976 *pp = 0;
2977 goto GOT_DATA; /* Break out of both loops */
2978 }
2979 }
2980
2981 /* Reached the end of the data without finding \n. Let the loop continue to
2982 read some more, if there is room. */
2983
2984 p = pp;
2985 }
2986
2987 GOT_DATA:
2988
2989 /* We have received a line of data. Check it carefully. It must start with the
2990 same two port numbers that we sent, followed by data as defined by the RFC. For
2991 example,
2992
2993 12345 , 25 : USERID : UNIX :root
2994
2995 However, the amount of white space may be different to what we sent. In the
2996 "osname" field there may be several sub-fields, comma separated. The data we
2997 actually want to save follows the third colon. Some systems put leading spaces
2998 in it - we discard those. */
2999
3000 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
3001 &received_interface_port, &n) != 2 ||
3002 received_sender_port != sender_host_port ||
3003 received_interface_port != interface_port)
3004 goto END_OFF;
3005
3006 p = buffer + qlen + n;
3007 while(isspace(*p)) p++;
3008 if (*p++ != ':') goto END_OFF;
3009 while(isspace(*p)) p++;
3010 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
3011 p += 6;
3012 while(isspace(*p)) p++;
3013 if (*p++ != ':') goto END_OFF;
3014 while (*p != 0 && *p != ':') p++;
3015 if (*p++ == 0) goto END_OFF;
3016 while(isspace(*p)) p++;
3017 if (*p == 0) goto END_OFF;
3018
3019 /* The rest of the line is the data we want. We turn it into printing
3020 characters when we save it, so that it cannot mess up the format of any logging
3021 or Received: lines into which it gets inserted. We keep a maximum of 127
3022 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
3023
3024 sender_ident = US string_printing(string_copyn(p, 127));
3025 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
3026
3027 END_OFF:
3028 (void)close(sock);
3029 return;
3030 }
3031
3032
3033
3034
3035 /*************************************************
3036 * Match host to a single host-list item *
3037 *************************************************/
3038
3039 /* This function compares a host (name or address) against a single item
3040 from a host list. The host name gets looked up if it is needed and is not
3041 already known. The function is called from verify_check_this_host() via
3042 match_check_list(), which is why most of its arguments are in a single block.
3043
3044 Arguments:
3045 arg the argument block (see below)
3046 ss the host-list item
3047 valueptr where to pass back looked up data, or NULL
3048 error for error message when returning ERROR
3049
3050 The block contains:
3051 host_name (a) the host name, or
3052 (b) NULL, implying use sender_host_name and
3053 sender_host_aliases, looking them up if required, or
3054 (c) the empty string, meaning that only IP address matches
3055 are permitted
3056 host_address the host address
3057 host_ipv4 the IPv4 address taken from an IPv6 one
3058
3059 Returns: OK matched
3060 FAIL did not match
3061 DEFER lookup deferred
3062 ERROR (a) failed to find the host name or IP address, or
3063 (b) unknown lookup type specified, or
3064 (c) host name encountered when only IP addresses are
3065 being matched
3066 */
3067
3068 int
3069 check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
3070 {
3071 check_host_block *cb = (check_host_block *)arg;
3072 int mlen = -1;
3073 int maskoffset;
3074 BOOL iplookup = FALSE;
3075 BOOL isquery = FALSE;
3076 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
3077 const uschar *t;
3078 uschar *semicolon;
3079 uschar **aliases;
3080
3081 /* Optimize for the special case when the pattern is "*". */
3082
3083 if (*ss == '*' && ss[1] == 0) return OK;
3084
3085 /* If the pattern is empty, it matches only in the case when there is no host -
3086 this can occur in ACL checking for SMTP input using the -bs option. In this
3087 situation, the host address is the empty string. */
3088
3089 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
3090 if (*ss == 0) return FAIL;
3091
3092 /* If the pattern is precisely "@" then match against the primary host name,
3093 provided that host name matching is permitted; if it's "@[]" match against the
3094 local host's IP addresses. */
3095
3096 if (*ss == '@')
3097 {
3098 if (ss[1] == 0)
3099 {
3100 if (isiponly) return ERROR;
3101 ss = primary_hostname;
3102 }
3103 else if (Ustrcmp(ss, "@[]") == 0)
3104 {
3105 ip_address_item *ip;
3106 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
3107 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
3108 return FAIL;
3109 }
3110 }
3111
3112 /* If the pattern is an IP address, optionally followed by a bitmask count, do
3113 a (possibly masked) comparision with the current IP address. */
3114
3115 if (string_is_ip_address(ss, &maskoffset) != 0)
3116 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
3117
3118 /* The pattern is not an IP address. A common error that people make is to omit
3119 one component of an IPv4 address, either by accident, or believing that, for
3120 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
3121 which it isn't. (Those applications that do accept 1.2.3 as an IP address
3122 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
3123 ancient specification.) To aid in debugging these cases, we give a specific
3124 error if the pattern contains only digits and dots or contains a slash preceded
3125 only by digits and dots (a slash at the start indicates a file name and of
3126 course slashes may be present in lookups, but not preceded only by digits and
3127 dots). */
3128
3129 for (t = ss; isdigit(*t) || *t == '.'; t++);
3130 if (*t == 0 || (*t == '/' && t != ss))
3131 {
3132 *error = US"malformed IPv4 address or address mask";
3133 return ERROR;
3134 }
3135
3136 /* See if there is a semicolon in the pattern */
3137
3138 semicolon = Ustrchr(ss, ';');
3139
3140 /* If we are doing an IP address only match, then all lookups must be IP
3141 address lookups, even if there is no "net-". */
3142
3143 if (isiponly)
3144 {
3145 iplookup = semicolon != NULL;
3146 }
3147
3148 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
3149 a lookup on a masked IP network, in textual form. We obey this code even if we
3150 have already set iplookup, so as to skip over the "net-" prefix and to set the
3151 mask length. The net- stuff really only applies to single-key lookups where the
3152 key is implicit. For query-style lookups the key is specified in the query.
3153 From release 4.30, the use of net- for query style is no longer needed, but we
3154 retain it for backward compatibility. */
3155
3156 if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
3157 {
3158 mlen = 0;
3159 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
3160 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
3161 iplookup = (*t++ == '-');
3162 }
3163 else t = ss;
3164
3165 /* Do the IP address lookup if that is indeed what we have */
3166
3167 if (iplookup)
3168 {
3169 int insize;
3170 int search_type;
3171 int incoming[4];
3172 void *handle;
3173 uschar *filename, *key, *result;
3174 uschar buffer[64];
3175
3176 /* Find the search type */
3177
3178 search_type = search_findtype(t, semicolon - t);
3179
3180 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3181 search_error_message);
3182
3183 /* Adjust parameters for the type of lookup. For a query-style lookup, there
3184 is no file name, and the "key" is just the query. For query-style with a file
3185 name, we have to fish the file off the start of the query. For a single-key
3186 lookup, the key is the current IP address, masked appropriately, and
3187 reconverted to text form, with the mask appended. For IPv6 addresses, specify
3188 dot separators instead of colons, except when the lookup type is "iplsearch".
3189 */
3190
3191 if (mac_islookup(search_type, lookup_absfilequery))
3192 {
3193 filename = semicolon + 1;
3194 key = filename;
3195 while (*key != 0 && !isspace(*key)) key++;
3196 filename = string_copyn(filename, key - filename);
3197 while (isspace(*key)) key++;
3198 }
3199 else if (mac_islookup(search_type, lookup_querystyle))
3200 {
3201 filename = NULL;
3202 key = semicolon + 1;
3203 }
3204 else /* Single-key style */
3205 {
3206 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
3207 ':' : '.';
3208 insize = host_aton(cb->host_address, incoming);
3209 host_mask(insize, incoming, mlen);
3210 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
3211 key = buffer;
3212 filename = semicolon + 1;
3213 }
3214
3215 /* Now do the actual lookup; note that there is no search_close() because
3216 of the caching arrangements. */
3217
3218 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3219 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3220
3221 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
3222 if (valueptr != NULL) *valueptr = result;
3223 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
3224 }
3225
3226 /* The pattern is not an IP address or network reference of any kind. That is,
3227 it is a host name pattern. If this is an IP only match, there's an error in the
3228 host list. */
3229
3230 if (isiponly)
3231 {
3232 *error = US"cannot match host name in match_ip list";
3233 return ERROR;
3234 }
3235
3236 /* Check the characters of the pattern to see if they comprise only letters,
3237 digits, full stops, and hyphens (the constituents of domain names). Allow
3238 underscores, as they are all too commonly found. Sigh. Also, if
3239 allow_utf8_domains is set, allow top-bit characters. */
3240
3241 for (t = ss; *t != 0; t++)
3242 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3243 (!allow_utf8_domains || *t < 128)) break;
3244
3245 /* If the pattern is a complete domain name, with no fancy characters, look up
3246 its IP address and match against that. Note that a multi-homed host will add
3247 items to the chain. */
3248
3249 if (*t == 0)
3250 {
3251 int rc;
3252 host_item h;
3253 h.next = NULL;
3254 h.name = ss;
3255 h.address = NULL;
3256 h.mx = MX_NONE;
3257
3258 /* Using byname rather than bydns here means we cannot determine dnssec
3259 status. On the other hand it is unclear how that could be either
3260 propagated up or enforced. */
3261
3262 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3263 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3264 {
3265 host_item *hh;
3266 for (hh = &h; hh != NULL; hh = hh->next)
3267 {
3268 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3269 }
3270 return FAIL;
3271 }
3272 if (rc == HOST_FIND_AGAIN) return DEFER;
3273 *error = string_sprintf("failed to find IP address for %s", ss);
3274 return ERROR;
3275 }
3276
3277 /* Almost all subsequent comparisons require the host name, and can be done
3278 using the general string matching function. When this function is called for
3279 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3280 must use sender_host_name and its aliases, looking them up if necessary. */
3281
3282 if (cb->host_name != NULL) /* Explicit host name given */
3283 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3284 valueptr);
3285
3286 /* Host name not given; in principle we need the sender host name and its
3287 aliases. However, for query-style lookups, we do not need the name if the
3288 query does not contain $sender_host_name. From release 4.23, a reference to
3289 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3290 on spec. */
3291
3292 if ((semicolon = Ustrchr(ss, ';')) != NULL)
3293 {
3294 const uschar *affix;
3295 int partial, affixlen, starflags, id;
3296
3297 *semicolon = 0;
3298 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
3299 *semicolon=';';
3300
3301 if (id < 0) /* Unknown lookup type */
3302 {
3303 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3304 search_error_message, ss);
3305 return DEFER;
3306 }
3307 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3308 }
3309
3310 if (isquery)
3311 {
3312 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3313 {
3314 case OK: return OK;
3315 case DEFER: return DEFER;
3316 default: return FAIL;
3317 }
3318 }
3319
3320 /* Not a query-style lookup; must ensure the host name is present, and then we
3321 do a check on the name and all its aliases. */
3322
3323 if (sender_host_name == NULL)
3324 {
3325 HDEBUG(D_host_lookup)
3326 debug_printf("sender host name required, to match against %s\n", ss);
3327 if (host_lookup_failed || host_name_lookup() != OK)
3328 {
3329 *error = string_sprintf("failed to find host name for %s",
3330 sender_host_address);;
3331 return ERROR;
3332 }
3333 host_build_sender_fullhost();
3334 }
3335
3336 /* Match on the sender host name, using the general matching function */
3337
3338 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
3339 valueptr))
3340 {
3341 case OK: return OK;
3342 case DEFER: return DEFER;
3343 }
3344
3345 /* If there are aliases, try matching on them. */
3346
3347 aliases = sender_host_aliases;
3348 while (*aliases != NULL)
3349 {
3350 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3351 {
3352 case OK: return OK;
3353 case DEFER: return DEFER;
3354 }
3355 }
3356 return FAIL;
3357 }
3358
3359
3360
3361
3362 /*************************************************
3363 * Check a specific host matches a host list *
3364 *************************************************/
3365
3366 /* This function is passed a host list containing items in a number of
3367 different formats and the identity of a host. Its job is to determine whether
3368 the given host is in the set of hosts defined by the list. The host name is
3369 passed as a pointer so that it can be looked up if needed and not already
3370 known. This is commonly the case when called from verify_check_host() to check
3371 an incoming connection. When called from elsewhere the host name should usually
3372 be set.
3373
3374 This function is now just a front end to match_check_list(), which runs common
3375 code for scanning a list. We pass it the check_host() function to perform a
3376 single test.
3377
3378 Arguments:
3379 listptr pointer to the host list
3380 cache_bits pointer to cache for named lists, or NULL
3381 host_name the host name or NULL, implying use sender_host_name and
3382 sender_host_aliases, looking them up if required
3383 host_address the IP address
3384 valueptr if not NULL, data from a lookup is passed back here
3385
3386 Returns: OK if the host is in the defined set
3387 FAIL if the host is not in the defined set,
3388 DEFER if a data lookup deferred (not a host lookup)
3389
3390 If the host name was needed in order to make a comparison, and could not be
3391 determined from the IP address, the result is FAIL unless the item
3392 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3393
3394 int
3395 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3396 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3397 {
3398 int rc;
3399 unsigned int *local_cache_bits = cache_bits;
3400 const uschar *save_host_address = deliver_host_address;
3401 check_host_block cb;
3402 cb.host_name = host_name;
3403 cb.host_address = host_address;
3404
3405 if (valueptr != NULL) *valueptr = NULL;
3406
3407 /* If the host address starts off ::ffff: it is an IPv6 address in
3408 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3409 addresses. */
3410
3411 cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
3412 host_address + 7 : host_address;
3413
3414 /* During the running of the check, put the IP address into $host_address. In
3415 the case of calls from the smtp transport, it will already be there. However,
3416 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3417 the safe side, any existing setting is preserved, though as I write this
3418 (November 2004) I can't see any cases where it is actually needed. */
3419
3420 deliver_host_address = host_address;
3421 rc = match_check_list(
3422 listptr, /* the list */
3423 0, /* separator character */
3424 &hostlist_anchor, /* anchor pointer */
3425 &local_cache_bits, /* cache pointer */
3426 check_host, /* function for testing */
3427 &cb, /* argument for function */
3428 MCL_HOST, /* type of check */
3429 (host_address == sender_host_address)?
3430 US"host" : host_address, /* text for debugging */
3431 valueptr); /* where to pass back data */
3432 deliver_host_address = save_host_address;
3433 return rc;
3434 }
3435
3436
3437
3438
3439 /*************************************************
3440 * Check the given host item matches a list *
3441 *************************************************/
3442 int
3443 verify_check_given_host(uschar **listptr, host_item *host)
3444 {