OpenSSL: Capture peercert/dn in mainline not verify-callback. Bug 1571
[exim.git] / src / src / verify.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions concerned with verifying things. The original code for callout
9 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
10
11
12 #include "exim.h"
13 #include "transports/smtp.h"
14
15 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
17 static smtp_outblock ctblock;
18 uschar ctbuffer[8192];
19
20
21 /* Structure for caching DNSBL lookups */
22
23 typedef struct dnsbl_cache_block {
24 dns_address *rhs;
25 uschar *text;
26 int rc;
27 BOOL text_set;
28 } dnsbl_cache_block;
29
30
31 /* Anchor for DNSBL cache */
32
33 static tree_node *dnsbl_cache = NULL;
34
35
36 /* Bits for match_type in one_check_dnsbl() */
37
38 #define MT_NOT 1
39 #define MT_ALL 2
40
41 static uschar cutthrough_response(char, uschar **);
42
43
44 /*************************************************
45 * Retrieve a callout cache record *
46 *************************************************/
47
48 /* If a record exists, check whether it has expired.
49
50 Arguments:
51 dbm_file an open hints file
52 key the record key
53 type "address" or "domain"
54 positive_expire expire time for positive records
55 negative_expire expire time for negative records
56
57 Returns: the cache record if a non-expired one exists, else NULL
58 */
59
60 static dbdata_callout_cache *
61 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
62 int positive_expire, int negative_expire)
63 {
64 BOOL negative;
65 int length, expire;
66 time_t now;
67 dbdata_callout_cache *cache_record;
68
69 cache_record = dbfn_read_with_length(dbm_file, key, &length);
70
71 if (cache_record == NULL)
72 {
73 HDEBUG(D_verify) debug_printf("callout cache: no %s record found\n", type);
74 return NULL;
75 }
76
77 /* We treat a record as "negative" if its result field is not positive, or if
78 it is a domain record and the postmaster field is negative. */
79
80 negative = cache_record->result != ccache_accept ||
81 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
82 expire = negative? negative_expire : positive_expire;
83 now = time(NULL);
84
85 if (now - cache_record->time_stamp > expire)
86 {
87 HDEBUG(D_verify) debug_printf("callout cache: %s record expired\n", type);
88 return NULL;
89 }
90
91 /* If this is a non-reject domain record, check for the obsolete format version
92 that doesn't have the postmaster and random timestamps, by looking at the
93 length. If so, copy it to a new-style block, replicating the record's
94 timestamp. Then check the additional timestamps. (There's no point wasting
95 effort if connections are rejected.) */
96
97 if (type[0] == 'd' && cache_record->result != ccache_reject)
98 {
99 if (length == sizeof(dbdata_callout_cache_obs))
100 {
101 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
102 memcpy(new, cache_record, length);
103 new->postmaster_stamp = new->random_stamp = new->time_stamp;
104 cache_record = new;
105 }
106
107 if (now - cache_record->postmaster_stamp > expire)
108 cache_record->postmaster_result = ccache_unknown;
109
110 if (now - cache_record->random_stamp > expire)
111 cache_record->random_result = ccache_unknown;
112 }
113
114 HDEBUG(D_verify) debug_printf("callout cache: found %s record\n", type);
115 return cache_record;
116 }
117
118
119
120 /*************************************************
121 * Do callout verification for an address *
122 *************************************************/
123
124 /* This function is called from verify_address() when the address has routed to
125 a host list, and a callout has been requested. Callouts are expensive; that is
126 why a cache is used to improve the efficiency.
127
128 Arguments:
129 addr the address that's been routed
130 host_list the list of hosts to try
131 tf the transport feedback block
132
133 ifstring "interface" option from transport, or NULL
134 portstring "port" option from transport, or NULL
135 protocolstring "protocol" option from transport, or NULL
136 callout the per-command callout timeout
137 callout_overall the overall callout timeout (if < 0 use 4*callout)
138 callout_connect the callout connection timeout (if < 0 use callout)
139 options the verification options - these bits are used:
140 vopt_is_recipient => this is a recipient address
141 vopt_callout_no_cache => don't use callout cache
142 vopt_callout_fullpm => if postmaster check, do full one
143 vopt_callout_random => do the "random" thing
144 vopt_callout_recipsender => use real sender for recipient
145 vopt_callout_recippmaster => use postmaster for recipient
146 se_mailfrom MAIL FROM address for sender verify; NULL => ""
147 pm_mailfrom if non-NULL, do the postmaster check with this sender
148
149 Returns: OK/FAIL/DEFER
150 */
151
152 static int
153 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
154 int callout, int callout_overall, int callout_connect, int options,
155 uschar *se_mailfrom, uschar *pm_mailfrom)
156 {
157 BOOL is_recipient = (options & vopt_is_recipient) != 0;
158 BOOL callout_no_cache = (options & vopt_callout_no_cache) != 0;
159 BOOL callout_random = (options & vopt_callout_random) != 0;
160
161 int yield = OK;
162 int old_domain_cache_result = ccache_accept;
163 BOOL done = FALSE;
164 uschar *address_key;
165 uschar *from_address;
166 uschar *random_local_part = NULL;
167 const uschar *save_deliver_domain = deliver_domain;
168 uschar **failure_ptr = is_recipient?
169 &recipient_verify_failure : &sender_verify_failure;
170 open_db dbblock;
171 open_db *dbm_file = NULL;
172 dbdata_callout_cache new_domain_record;
173 dbdata_callout_cache_address new_address_record;
174 host_item *host;
175 time_t callout_start_time;
176
177 new_domain_record.result = ccache_unknown;
178 new_domain_record.postmaster_result = ccache_unknown;
179 new_domain_record.random_result = ccache_unknown;
180
181 memset(&new_address_record, 0, sizeof(new_address_record));
182
183 /* For a recipient callout, the key used for the address cache record must
184 include the sender address if we are using the real sender in the callout,
185 because that may influence the result of the callout. */
186
187 address_key = addr->address;
188 from_address = US"";
189
190 if (is_recipient)
191 {
192 if (options & vopt_callout_recipsender)
193 {
194 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
195 from_address = sender_address;
196 }
197 else if (options & vopt_callout_recippmaster)
198 {
199 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
200 qualify_domain_sender);
201 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
202 }
203 }
204
205 /* For a sender callout, we must adjust the key if the mailfrom address is not
206 empty. */
207
208 else
209 {
210 from_address = (se_mailfrom == NULL)? US"" : se_mailfrom;
211 if (from_address[0] != 0)
212 address_key = string_sprintf("%s/<%s>", addr->address, from_address);
213 }
214
215 /* Open the callout cache database, it it exists, for reading only at this
216 stage, unless caching has been disabled. */
217
218 if (callout_no_cache)
219 {
220 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
221 }
222 else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
223 {
224 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
225 }
226
227 /* If a cache database is available see if we can avoid the need to do an
228 actual callout by making use of previously-obtained data. */
229
230 if (dbm_file != NULL)
231 {
232 dbdata_callout_cache_address *cache_address_record;
233 dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
234 addr->domain, US"domain",
235 callout_cache_domain_positive_expire,
236 callout_cache_domain_negative_expire);
237
238 /* If an unexpired cache record was found for this domain, see if the callout
239 process can be short-circuited. */
240
241 if (cache_record != NULL)
242 {
243 /* In most cases, if an early command (up to and including MAIL FROM:<>)
244 was rejected, there is no point carrying on. The callout fails. However, if
245 we are doing a recipient verification with use_sender or use_postmaster
246 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
247 will be using a non-empty sender. We have to remember this situation so as
248 not to disturb the cached domain value if this whole verification succeeds
249 (we don't want it turning into "accept"). */
250
251 old_domain_cache_result = cache_record->result;
252
253 if (cache_record->result == ccache_reject ||
254 (*from_address == 0 && cache_record->result == ccache_reject_mfnull))
255 {
256 setflag(addr, af_verify_nsfail);
257 HDEBUG(D_verify)
258 debug_printf("callout cache: domain gave initial rejection, or "
259 "does not accept HELO or MAIL FROM:<>\n");
260 setflag(addr, af_verify_nsfail);
261 addr->user_message = US"(result of an earlier callout reused).";
262 yield = FAIL;
263 *failure_ptr = US"mail";
264 goto END_CALLOUT;
265 }
266
267 /* If a previous check on a "random" local part was accepted, we assume
268 that the server does not do any checking on local parts. There is therefore
269 no point in doing the callout, because it will always be successful. If a
270 random check previously failed, arrange not to do it again, but preserve
271 the data in the new record. If a random check is required but hasn't been
272 done, skip the remaining cache processing. */
273
274 if (callout_random) switch(cache_record->random_result)
275 {
276 case ccache_accept:
277 HDEBUG(D_verify)
278 debug_printf("callout cache: domain accepts random addresses\n");
279 goto END_CALLOUT; /* Default yield is OK */
280
281 case ccache_reject:
282 HDEBUG(D_verify)
283 debug_printf("callout cache: domain rejects random addresses\n");
284 callout_random = FALSE;
285 new_domain_record.random_result = ccache_reject;
286 new_domain_record.random_stamp = cache_record->random_stamp;
287 break;
288
289 default:
290 HDEBUG(D_verify)
291 debug_printf("callout cache: need to check random address handling "
292 "(not cached or cache expired)\n");
293 goto END_CACHE;
294 }
295
296 /* If a postmaster check is requested, but there was a previous failure,
297 there is again no point in carrying on. If a postmaster check is required,
298 but has not been done before, we are going to have to do a callout, so skip
299 remaining cache processing. */
300
301 if (pm_mailfrom != NULL)
302 {
303 if (cache_record->postmaster_result == ccache_reject)
304 {
305 setflag(addr, af_verify_pmfail);
306 HDEBUG(D_verify)
307 debug_printf("callout cache: domain does not accept "
308 "RCPT TO:<postmaster@domain>\n");
309 yield = FAIL;
310 *failure_ptr = US"postmaster";
311 setflag(addr, af_verify_pmfail);
312 addr->user_message = US"(result of earlier verification reused).";
313 goto END_CALLOUT;
314 }
315 if (cache_record->postmaster_result == ccache_unknown)
316 {
317 HDEBUG(D_verify)
318 debug_printf("callout cache: need to check RCPT "
319 "TO:<postmaster@domain> (not cached or cache expired)\n");
320 goto END_CACHE;
321 }
322
323 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
324 postmaster check if the address itself has to be checked. Also ensure
325 that the value in the cache record is preserved (with its old timestamp).
326 */
327
328 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
329 "TO:<postmaster@domain>\n");
330 pm_mailfrom = NULL;
331 new_domain_record.postmaster_result = ccache_accept;
332 new_domain_record.postmaster_stamp = cache_record->postmaster_stamp;
333 }
334 }
335
336 /* We can't give a result based on information about the domain. See if there
337 is an unexpired cache record for this specific address (combined with the
338 sender address if we are doing a recipient callout with a non-empty sender).
339 */
340
341 cache_address_record = (dbdata_callout_cache_address *)
342 get_callout_cache_record(dbm_file,
343 address_key, US"address",
344 callout_cache_positive_expire,
345 callout_cache_negative_expire);
346
347 if (cache_address_record != NULL)
348 {
349 if (cache_address_record->result == ccache_accept)
350 {
351 HDEBUG(D_verify)
352 debug_printf("callout cache: address record is positive\n");
353 }
354 else
355 {
356 HDEBUG(D_verify)
357 debug_printf("callout cache: address record is negative\n");
358 addr->user_message = US"Previous (cached) callout verification failure";
359 *failure_ptr = US"recipient";
360 yield = FAIL;
361 }
362 goto END_CALLOUT;
363 }
364
365 /* Close the cache database while we actually do the callout for real. */
366
367 END_CACHE:
368 dbfn_close(dbm_file);
369 dbm_file = NULL;
370 }
371
372 if (!addr->transport)
373 {
374 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
375 }
376 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
377 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
378 addr->transport->name, addr->transport->driver_name);
379 else
380 {
381 smtp_transport_options_block *ob =
382 (smtp_transport_options_block *)addr->transport->options_block;
383
384 /* The information wasn't available in the cache, so we have to do a real
385 callout and save the result in the cache for next time, unless no_cache is set,
386 or unless we have a previously cached negative random result. If we are to test
387 with a random local part, ensure that such a local part is available. If not,
388 log the fact, but carry on without randomming. */
389
390 if (callout_random && callout_random_local_part != NULL)
391 {
392 random_local_part = expand_string(callout_random_local_part);
393 if (random_local_part == NULL)
394 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
395 "callout_random_local_part: %s", expand_string_message);
396 }
397
398 /* Default the connect and overall callout timeouts if not set, and record the
399 time we are starting so that we can enforce it. */
400
401 if (callout_overall < 0) callout_overall = 4 * callout;
402 if (callout_connect < 0) callout_connect = callout;
403 callout_start_time = time(NULL);
404
405 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
406 output because a callout might take some time. When PIPELINING is active and
407 there are many recipients, the total time for doing lots of callouts can add up
408 and cause the client to time out. So in this case we forgo the PIPELINING
409 optimization. */
410
411 if (smtp_out != NULL && !disable_callout_flush) mac_smtp_fflush();
412
413 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
414 and we are holding a cutthrough conn open, we can just append the rcpt to
415 that conn for verification purposes (and later delivery also). Simplest
416 coding means skipping this whole loop and doing the append separately.
417
418 We will need to remember it has been appended so that rcpt-acl tail code
419 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
420 */
421
422 /* Can we re-use an open cutthrough connection? */
423 if ( cutthrough.fd >= 0
424 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
425 == vopt_callout_recipsender
426 && !random_local_part
427 && !pm_mailfrom
428 )
429 {
430 if (addr->transport == cutthrough.addr.transport)
431 for (host = host_list; host; host = host->next)
432 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
433 {
434 int host_af;
435 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
436 int port = 25;
437
438 deliver_host = host->name;
439 deliver_host_address = host->address;
440 deliver_host_port = host->port;
441 deliver_domain = addr->domain;
442 transport_name = addr->transport->name;
443
444 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
445
446 if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
447 US"callout") ||
448 !smtp_get_port(tf->port, addr, &port, US"callout"))
449 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
450 addr->message);
451
452 if ( ( interface == cutthrough.interface
453 || ( interface
454 && cutthrough.interface
455 && Ustrcmp(interface, cutthrough.interface) == 0
456 ) )
457 && port == cutthrough.host.port
458 )
459 {
460 uschar * resp;
461
462 /* Match! Send the RCPT TO, append the addr, set done */
463 done =
464 smtp_write_command(&ctblock, FALSE, "RCPT TO:<%.1000s>\r\n",
465 transport_rcpt_address(addr,
466 (addr->transport == NULL)? FALSE :
467 addr->transport->rcpt_include_affixes)) >= 0 &&
468 cutthrough_response('2', &resp) == '2';
469
470 /* This would go horribly wrong if a callout fail was ignored by ACL.
471 We punt by abandoning cutthrough on a reject, like the
472 first-rcpt does. */
473
474 if (done)
475 {
476 address_item * na = store_get(sizeof(address_item));
477 *na = cutthrough.addr;
478 cutthrough.addr = *addr;
479 cutthrough.addr.host_used = &cutthrough.host;
480 cutthrough.addr.next = na;
481
482 cutthrough.nrcpt++;
483 }
484 else
485 {
486 cancel_cutthrough_connection("recipient rejected");
487 if (errno == ETIMEDOUT)
488 {
489 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
490 }
491 else if (errno == 0)
492 {
493 if (*resp == 0)
494 Ustrcpy(resp, US"connection dropped");
495
496 addr->message =
497 string_sprintf("response to \"%s\" from %s [%s] was: %s",
498 big_buffer, host->name, host->address,
499 string_printing(resp));
500
501 addr->user_message =
502 string_sprintf("Callout verification failed:\n%s", resp);
503
504 /* Hard rejection ends the process */
505
506 if (resp[0] == '5') /* Address rejected */
507 {
508 yield = FAIL;
509 done = TRUE;
510 }
511 }
512 }
513 }
514 break;
515 }
516 if (!done)
517 cancel_cutthrough_connection("incompatible connection");
518 }
519
520 /* Now make connections to the hosts and do real callouts. The list of hosts
521 is passed in as an argument. */
522
523 for (host = host_list; host != NULL && !done; host = host->next)
524 {
525 smtp_inblock inblock;
526 smtp_outblock outblock;
527 int host_af;
528 int port = 25;
529 BOOL send_quit = TRUE;
530 uschar *active_hostname = smtp_active_hostname;
531 BOOL lmtp;
532 BOOL smtps;
533 BOOL esmtp;
534 BOOL suppress_tls = FALSE;
535 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
536 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
537 BOOL dane = FALSE;
538 BOOL dane_required;
539 dns_answer tlsa_dnsa;
540 #endif
541 uschar inbuffer[4096];
542 uschar outbuffer[1024];
543 uschar responsebuffer[4096];
544
545 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
546 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
547
548 /* Skip this host if we don't have an IP address for it. */
549
550 if (host->address == NULL)
551 {
552 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
553 host->name);
554 continue;
555 }
556
557 /* Check the overall callout timeout */
558
559 if (time(NULL) - callout_start_time >= callout_overall)
560 {
561 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
562 break;
563 }
564
565 /* Set IPv4 or IPv6 */
566
567 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
568
569 /* Expand and interpret the interface and port strings. The latter will not
570 be used if there is a host-specific port (e.g. from a manualroute router).
571 This has to be delayed till now, because they may expand differently for
572 different hosts. If there's a failure, log it, but carry on with the
573 defaults. */
574
575 deliver_host = host->name;
576 deliver_host_address = host->address;
577 deliver_host_port = host->port;
578 deliver_domain = addr->domain;
579 transport_name = addr->transport->name;
580
581 if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
582 US"callout") ||
583 !smtp_get_port(tf->port, addr, &port, US"callout"))
584 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
585 addr->message);
586
587 /* Set HELO string according to the protocol */
588 lmtp= Ustrcmp(tf->protocol, "lmtp") == 0;
589 smtps= Ustrcmp(tf->protocol, "smtps") == 0;
590
591
592 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", interface, port);
593
594 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
595 {
596 int rc;
597
598 tls_out.dane_verified = FALSE;
599 tls_out.tlsa_usage = 0;
600
601 dane_required =
602 verify_check_given_host(&ob->hosts_require_dane, host) == OK;
603
604 if (host->dnssec == DS_YES)
605 {
606 if( dane_required
607 || verify_check_given_host(&ob->hosts_try_dane, host) == OK
608 )
609 if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required, &dane)) != OK)
610 return rc;
611 }
612 else if (dane_required)
613 {
614 log_write(0, LOG_MAIN, "DANE error: %s lookup not DNSSEC", host->name);
615 return FAIL;
616 }
617
618 if (dane)
619 ob->tls_tempfail_tryclear = FALSE;
620 }
621 #endif /*DANE*/
622
623 /* Set up the buffer for reading SMTP response packets. */
624
625 inblock.buffer = inbuffer;
626 inblock.buffersize = sizeof(inbuffer);
627 inblock.ptr = inbuffer;
628 inblock.ptrend = inbuffer;
629
630 /* Set up the buffer for holding SMTP commands while pipelining */
631
632 outblock.buffer = outbuffer;
633 outblock.buffersize = sizeof(outbuffer);
634 outblock.ptr = outbuffer;
635 outblock.cmd_count = 0;
636 outblock.authenticating = FALSE;
637
638 /* Reset the parameters of a TLS session */
639 tls_out.cipher = tls_out.peerdn = tls_out.peercert = NULL;
640
641 /* Connect to the host; on failure, just loop for the next one, but we
642 set the error for the last one. Use the callout_connect timeout. */
643
644 tls_retry_connection:
645
646 inblock.sock = outblock.sock =
647 smtp_connect(host, host_af, port, interface, callout_connect, TRUE, NULL
648 #ifdef EXPERIMENTAL_EVENT
649 /*XXX event action? NULL for now. */
650 , NULL
651 #endif
652 );
653 /* reconsider DSCP here */
654 if (inblock.sock < 0)
655 {
656 addr->message = string_sprintf("could not connect to %s [%s]: %s",
657 host->name, host->address, strerror(errno));
658 transport_name = NULL;
659 deliver_host = deliver_host_address = NULL;
660 deliver_domain = save_deliver_domain;
661 continue;
662 }
663
664 /* Expand the helo_data string to find the host name to use. */
665
666 if (tf->helo_data != NULL)
667 {
668 uschar *s = expand_string(tf->helo_data);
669 if (s == NULL)
670 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
671 "helo_data value for callout: %s", addr->address,
672 expand_string_message);
673 else active_hostname = s;
674 }
675
676 /* Wait for initial response, and send HELO. The smtp_write_command()
677 function leaves its command in big_buffer. This is used in error responses.
678 Initialize it in case the connection is rejected. */
679
680 Ustrcpy(big_buffer, "initial connection");
681
682 /* Unless ssl-on-connect, wait for the initial greeting */
683 smtps_redo_greeting:
684
685 #ifdef SUPPORT_TLS
686 if (!smtps || (smtps && tls_out.active >= 0))
687 #endif
688 {
689 if (!(done= smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout)))
690 goto RESPONSE_FAILED;
691
692 #ifdef EXPERIMENTAL_EVENT
693 lookup_dnssec_authenticated = host->dnssec==DS_YES ? US"yes"
694 : host->dnssec==DS_NO ? US"no" : NULL;
695 if (event_raise(addr->transport->event_action,
696 US"smtp:connect", responsebuffer))
697 {
698 lookup_dnssec_authenticated = NULL;
699 /* Logging? Debug? */
700 goto RESPONSE_FAILED;
701 }
702 lookup_dnssec_authenticated = NULL;
703 #endif
704 }
705
706 /* Not worth checking greeting line for ESMTP support */
707 if (!(esmtp = verify_check_given_host(&ob->hosts_avoid_esmtp, host) != OK))
708 DEBUG(D_transport)
709 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
710
711 tls_redo_helo:
712
713 #ifdef SUPPORT_TLS
714 if (smtps && tls_out.active < 0) /* ssl-on-connect, first pass */
715 {
716 tls_offered = TRUE;
717 ob->tls_tempfail_tryclear = FALSE;
718 }
719 else /* all other cases */
720 #endif
721
722 { esmtp_retry:
723
724 if (!(done= smtp_write_command(&outblock, FALSE, "%s %s\r\n",
725 !esmtp? "HELO" : lmtp? "LHLO" : "EHLO", active_hostname) >= 0))
726 goto SEND_FAILED;
727 if (!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout))
728 {
729 if (errno != 0 || responsebuffer[0] == 0 || lmtp || !esmtp || tls_out.active >= 0)
730 {
731 done= FALSE;
732 goto RESPONSE_FAILED;
733 }
734 #ifdef SUPPORT_TLS
735 tls_offered = FALSE;
736 #endif
737 esmtp = FALSE;
738 goto esmtp_retry; /* fallback to HELO */
739 }
740
741 /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
742 #ifdef SUPPORT_TLS
743 if (esmtp && !suppress_tls && tls_out.active < 0)
744 {
745 if (regex_STARTTLS == NULL) regex_STARTTLS =
746 regex_must_compile(US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)", FALSE, TRUE);
747
748 tls_offered = pcre_exec(regex_STARTTLS, NULL, CS responsebuffer,
749 Ustrlen(responsebuffer), 0, PCRE_EOPT, NULL, 0) >= 0;
750 }
751 else
752 tls_offered = FALSE;
753 #endif
754 }
755
756 /* If TLS is available on this connection attempt to
757 start up a TLS session, unless the host is in hosts_avoid_tls. If successful,
758 send another EHLO - the server may give a different answer in secure mode. We
759 use a separate buffer for reading the response to STARTTLS so that if it is
760 negative, the original EHLO data is available for subsequent analysis, should
761 the client not be required to use TLS. If the response is bad, copy the buffer
762 for error analysis. */
763
764 #ifdef SUPPORT_TLS
765 if ( tls_offered
766 && verify_check_given_host(&ob->hosts_avoid_tls, host) != OK
767 && verify_check_given_host(&ob->hosts_verify_avoid_tls, host) != OK
768 )
769 {
770 uschar buffer2[4096];
771 if ( !smtps
772 && !(done= smtp_write_command(&outblock, FALSE, "STARTTLS\r\n") >= 0))
773 goto SEND_FAILED;
774
775 /* If there is an I/O error, transmission of this message is deferred. If
776 there is a temporary rejection of STARRTLS and tls_tempfail_tryclear is
777 false, we also defer. However, if there is a temporary rejection of STARTTLS
778 and tls_tempfail_tryclear is true, or if there is an outright rejection of
779 STARTTLS, we carry on. This means we will try to send the message in clear,
780 unless the host is in hosts_require_tls (tested below). */
781
782 if (!smtps && !smtp_read_response(&inblock, buffer2, sizeof(buffer2), '2',
783 ob->command_timeout))
784 {
785 if (errno != 0 || buffer2[0] == 0 ||
786 (buffer2[0] == '4' && !ob->tls_tempfail_tryclear))
787 {
788 Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
789 done= FALSE;
790 goto RESPONSE_FAILED;
791 }
792 }
793
794 /* STARTTLS accepted or ssl-on-connect: try to negotiate a TLS session. */
795 else
796 {
797 int oldtimeout = ob->command_timeout;
798 int rc;
799
800 tls_negotiate:
801 ob->command_timeout = callout;
802 rc = tls_client_start(inblock.sock, host, addr, addr->transport
803 # ifdef EXPERIMENTAL_DANE
804 , dane ? &tlsa_dnsa : NULL
805 # endif
806 );
807 ob->command_timeout = oldtimeout;
808
809 /* TLS negotiation failed; give an error. Try in clear on a new
810 connection, if the options permit it for this host. */
811 if (rc != OK)
812 {
813 if (rc == DEFER)
814 {
815 (void)close(inblock.sock);
816 # ifdef EXPERIMENTAL_EVENT
817 (void) event_raise(addr->transport->event_action,
818 US"tcp:close", NULL);
819 # endif
820 # ifdef EXPERIMENTAL_DANE
821 if (dane)
822 {
823 if (!dane_required)
824 {
825 log_write(0, LOG_MAIN, "DANE attempt failed;"
826 " trying CA-root TLS to %s [%s] (not in hosts_require_dane)",
827 host->name, host->address);
828 dane = FALSE;
829 goto tls_negotiate;
830 }
831 }
832 else
833 # endif
834 if ( ob->tls_tempfail_tryclear
835 && !smtps
836 && verify_check_given_host(&ob->hosts_require_tls, host) != OK
837 )
838 {
839 log_write(0, LOG_MAIN, "TLS session failure:"
840 " delivering unencrypted to %s [%s] (not in hosts_require_tls)",
841 host->name, host->address);
842 suppress_tls = TRUE;
843 goto tls_retry_connection;
844 }
845 }
846
847 /*save_errno = ERRNO_TLSFAILURE;*/
848 /*message = US"failure while setting up TLS session";*/
849 send_quit = FALSE;
850 done= FALSE;
851 goto TLS_FAILED;
852 }
853
854 /* TLS session is set up. Copy info for logging. */
855 addr->cipher = tls_out.cipher;
856 addr->peerdn = tls_out.peerdn;
857
858 /* For SMTPS we need to wait for the initial OK response, then do HELO. */
859 if (smtps)
860 goto smtps_redo_greeting;
861
862 /* For STARTTLS we need to redo EHLO */
863 goto tls_redo_helo;
864 }
865 }
866
867 /* If the host is required to use a secure channel, ensure that we have one. */
868 if (tls_out.active < 0)
869 if (
870 # ifdef EXPERIMENTAL_DANE
871 dane ||
872 # endif
873 verify_check_given_host(&ob->hosts_require_tls, host) == OK
874 )
875 {
876 /*save_errno = ERRNO_TLSREQUIRED;*/
877 log_write(0, LOG_MAIN,
878 "H=%s [%s]: a TLS session is required for this host, but %s",
879 host->name, host->address,
880 tls_offered ? "an attempt to start TLS failed"
881 : "the server did not offer TLS support");
882 done= FALSE;
883 goto TLS_FAILED;
884 }
885
886 #endif /*SUPPORT_TLS*/
887
888 done = TRUE; /* so far so good; have response to HELO */
889
890 /*XXX the EHLO response would be analyzed here for IGNOREQUOTA, SIZE, PIPELINING */
891
892 /* For now, transport_filter by cutthrough-delivery is not supported */
893 /* Need proper integration with the proper transport mechanism. */
894 if (cutthrough.delivery)
895 {
896 if (addr->transport->filter_command)
897 {
898 cutthrough.delivery = FALSE;
899 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
900 }
901 #ifndef DISABLE_DKIM
902 if (ob->dkim_domain)
903 {
904 cutthrough.delivery = FALSE;
905 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
906 }
907 #endif
908 }
909
910 SEND_FAILED:
911 RESPONSE_FAILED:
912 TLS_FAILED:
913 ;
914 /* Clear down of the TLS, SMTP and TCP layers on error is handled below. */
915
916 /* Failure to accept HELO is cached; this blocks the whole domain for all
917 senders. I/O errors and defer responses are not cached. */
918
919 if (!done)
920 {
921 *failure_ptr = US"mail"; /* At or before MAIL */
922 if (errno == 0 && responsebuffer[0] == '5')
923 {
924 setflag(addr, af_verify_nsfail);
925 new_domain_record.result = ccache_reject;
926 }
927 }
928
929 /* If we haven't authenticated, but are required to, give up. */
930 /* Try to AUTH */
931
932 else done = smtp_auth(responsebuffer, sizeof(responsebuffer),
933 addr, host, ob, esmtp, &inblock, &outblock) == OK &&
934
935 /* Copy AUTH info for logging */
936 ( (addr->authenticator = client_authenticator),
937 (addr->auth_id = client_authenticated_id),
938
939 /* Build a mail-AUTH string (re-using responsebuffer for convenience */
940 !smtp_mail_auth_str(responsebuffer, sizeof(responsebuffer), addr, ob)
941 ) &&
942
943 ( (addr->auth_sndr = client_authenticated_sender),
944
945 /* Send the MAIL command */
946 (smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>%s\r\n",
947 from_address, responsebuffer) >= 0)
948 ) &&
949
950 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
951 '2', callout);
952
953 deliver_host = deliver_host_address = NULL;
954 deliver_domain = save_deliver_domain;
955
956 /* If the host does not accept MAIL FROM:<>, arrange to cache this
957 information, but again, don't record anything for an I/O error or a defer. Do
958 not cache rejections of MAIL when a non-empty sender has been used, because
959 that blocks the whole domain for all senders. */
960
961 if (!done)
962 {
963 *failure_ptr = US"mail"; /* At or before MAIL */
964 if (errno == 0 && responsebuffer[0] == '5')
965 {
966 setflag(addr, af_verify_nsfail);
967 if (from_address[0] == 0)
968 new_domain_record.result = ccache_reject_mfnull;
969 }
970 }
971
972 /* Otherwise, proceed to check a "random" address (if required), then the
973 given address, and the postmaster address (if required). Between each check,
974 issue RSET, because some servers accept only one recipient after MAIL
975 FROM:<>.
976
977 Before doing this, set the result in the domain cache record to "accept",
978 unless its previous value was ccache_reject_mfnull. In that case, the domain
979 rejects MAIL FROM:<> and we want to continue to remember that. When that is
980 the case, we have got here only in the case of a recipient verification with
981 a non-null sender. */
982
983 else
984 {
985 new_domain_record.result =
986 (old_domain_cache_result == ccache_reject_mfnull)?
987 ccache_reject_mfnull: ccache_accept;
988
989 /* Do the random local part check first */
990
991 if (random_local_part != NULL)
992 {
993 uschar randombuffer[1024];
994 BOOL random_ok =
995 smtp_write_command(&outblock, FALSE,
996 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part,
997 addr->domain) >= 0 &&
998 smtp_read_response(&inblock, randombuffer,
999 sizeof(randombuffer), '2', callout);
1000
1001 /* Remember when we last did a random test */
1002
1003 new_domain_record.random_stamp = time(NULL);
1004
1005 /* If accepted, we aren't going to do any further tests below. */
1006
1007 if (random_ok)
1008 new_domain_record.random_result = ccache_accept;
1009
1010 /* Otherwise, cache a real negative response, and get back to the right
1011 state to send RCPT. Unless there's some problem such as a dropped
1012 connection, we expect to succeed, because the commands succeeded above. */
1013
1014 else if (errno == 0)
1015 {
1016 cancel_cutthrough_connection("random-recipient");
1017
1018 if (randombuffer[0] == '5')
1019 new_domain_record.random_result = ccache_reject;
1020
1021 done =
1022 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1023 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1024 '2', callout) &&
1025
1026 smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>\r\n",
1027 from_address) >= 0 &&
1028 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1029 '2', callout);
1030 }
1031 else done = FALSE; /* Some timeout/connection problem */
1032 } /* Random check */
1033
1034 /* If the host is accepting all local parts, as determined by the "random"
1035 check, we don't need to waste time doing any further checking. */
1036
1037 if (new_domain_record.random_result != ccache_accept && done)
1038 {
1039 /* Get the rcpt_include_affixes flag from the transport if there is one,
1040 but assume FALSE if there is not. */
1041
1042 done =
1043 smtp_write_command(&outblock, FALSE, "RCPT TO:<%.1000s>\r\n",
1044 transport_rcpt_address(addr,
1045 (addr->transport == NULL)? FALSE :
1046 addr->transport->rcpt_include_affixes)) >= 0 &&
1047 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1048 '2', callout);
1049
1050 if (done)
1051 new_address_record.result = ccache_accept;
1052 else if (errno == 0 && responsebuffer[0] == '5')
1053 {
1054 *failure_ptr = US"recipient";
1055 new_address_record.result = ccache_reject;
1056 }
1057
1058 /* Do postmaster check if requested; if a full check is required, we
1059 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
1060
1061 if (done && pm_mailfrom != NULL)
1062 {
1063 /*XXX not suitable for cutthrough - we cannot afford to do an RSET
1064 and lose the original mail-from */
1065 cancel_cutthrough_connection("postmaster verify");
1066 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of postmaster verify\n");
1067
1068 done =
1069 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1070 smtp_read_response(&inblock, responsebuffer,
1071 sizeof(responsebuffer), '2', callout) &&
1072
1073 smtp_write_command(&outblock, FALSE,
1074 "MAIL FROM:<%s>\r\n", pm_mailfrom) >= 0 &&
1075 smtp_read_response(&inblock, responsebuffer,
1076 sizeof(responsebuffer), '2', callout) &&
1077
1078 /* First try using the current domain */
1079
1080 ((
1081 smtp_write_command(&outblock, FALSE,
1082 "RCPT TO:<postmaster@%.1000s>\r\n", addr->domain) >= 0 &&
1083 smtp_read_response(&inblock, responsebuffer,
1084 sizeof(responsebuffer), '2', callout)
1085 )
1086
1087 ||
1088
1089 /* If that doesn't work, and a full check is requested,
1090 try without the domain. */
1091
1092 (
1093 (options & vopt_callout_fullpm) != 0 &&
1094 smtp_write_command(&outblock, FALSE,
1095 "RCPT TO:<postmaster>\r\n") >= 0 &&
1096 smtp_read_response(&inblock, responsebuffer,
1097 sizeof(responsebuffer), '2', callout)
1098 ));
1099
1100 /* Sort out the cache record */
1101
1102 new_domain_record.postmaster_stamp = time(NULL);
1103
1104 if (done)
1105 new_domain_record.postmaster_result = ccache_accept;
1106 else if (errno == 0 && responsebuffer[0] == '5')
1107 {
1108 *failure_ptr = US"postmaster";
1109 setflag(addr, af_verify_pmfail);
1110 new_domain_record.postmaster_result = ccache_reject;
1111 }
1112 }
1113 } /* Random not accepted */
1114 } /* MAIL FROM: accepted */
1115
1116 /* For any failure of the main check, other than a negative response, we just
1117 close the connection and carry on. We can identify a negative response by the
1118 fact that errno is zero. For I/O errors it will be non-zero
1119
1120 Set up different error texts for logging and for sending back to the caller
1121 as an SMTP response. Log in all cases, using a one-line format. For sender
1122 callouts, give a full response to the caller, but for recipient callouts,
1123 don't give the IP address because this may be an internal host whose identity
1124 is not to be widely broadcast. */
1125
1126 if (!done)
1127 {
1128 if (errno == ETIMEDOUT)
1129 {
1130 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
1131 send_quit = FALSE;
1132 }
1133 else if (errno == 0)
1134 {
1135 if (*responsebuffer == 0) Ustrcpy(responsebuffer, US"connection dropped");
1136
1137 addr->message =
1138 string_sprintf("response to \"%s\" from %s [%s] was: %s",
1139 big_buffer, host->name, host->address,
1140 string_printing(responsebuffer));
1141
1142 addr->user_message = is_recipient?
1143 string_sprintf("Callout verification failed:\n%s", responsebuffer)
1144 :
1145 string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1146 host->address, big_buffer, responsebuffer);
1147
1148 /* Hard rejection ends the process */
1149
1150 if (responsebuffer[0] == '5') /* Address rejected */
1151 {
1152 yield = FAIL;
1153 done = TRUE;
1154 }
1155 }
1156 }
1157
1158 /* End the SMTP conversation and close the connection. */
1159
1160 /* Cutthrough - on a successfull connect and recipient-verify with
1161 use-sender and we are 1st rcpt and have no cutthrough conn so far
1162 here is where we want to leave the conn open */
1163 if ( cutthrough.delivery
1164 && rcpt_count == 1
1165 && done
1166 && yield == OK
1167 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster)) == vopt_callout_recipsender
1168 && !random_local_part
1169 && !pm_mailfrom
1170 && cutthrough.fd < 0
1171 && !lmtp
1172 )
1173 {
1174 cutthrough.fd = outblock.sock; /* We assume no buffer in use in the outblock */
1175 cutthrough.nrcpt = 1;
1176 cutthrough.interface = interface;
1177 cutthrough.host = *host;
1178 cutthrough.addr = *addr; /* Save the address_item for later logging */
1179 cutthrough.addr.next = NULL;
1180 cutthrough.addr.host_used = &cutthrough.host;
1181 if (addr->parent)
1182 *(cutthrough.addr.parent = store_get(sizeof(address_item))) =
1183 *addr->parent;
1184 ctblock.buffer = ctbuffer;
1185 ctblock.buffersize = sizeof(ctbuffer);
1186 ctblock.ptr = ctbuffer;
1187 /* ctblock.cmd_count = 0; ctblock.authenticating = FALSE; */
1188 ctblock.sock = cutthrough.fd;
1189 }
1190 else
1191 {
1192 /* Ensure no cutthrough on multiple address verifies */
1193 if (options & vopt_callout_recipsender)
1194 cancel_cutthrough_connection("multiple verify calls");
1195 if (send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
1196
1197 #ifdef SUPPORT_TLS
1198 tls_close(FALSE, TRUE);
1199 #endif
1200 (void)close(inblock.sock);
1201 #ifdef EXPERIMENTAL_EVENT
1202 (void) event_raise(addr->transport->event_action,
1203 US"tcp:close", NULL);
1204 #endif
1205 }
1206
1207 } /* Loop through all hosts, while !done */
1208 }
1209
1210 /* If we get here with done == TRUE, a successful callout happened, and yield
1211 will be set OK or FAIL according to the response to the RCPT command.
1212 Otherwise, we looped through the hosts but couldn't complete the business.
1213 However, there may be domain-specific information to cache in both cases.
1214
1215 The value of the result field in the new_domain record is ccache_unknown if
1216 there was an error before or with MAIL FROM:, and errno was not zero,
1217 implying some kind of I/O error. We don't want to write the cache in that case.
1218 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
1219
1220 if (!callout_no_cache && new_domain_record.result != ccache_unknown)
1221 {
1222 if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
1223 == NULL)
1224 {
1225 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
1226 }
1227 else
1228 {
1229 (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
1230 (int)sizeof(dbdata_callout_cache));
1231 HDEBUG(D_verify) debug_printf("wrote callout cache domain record:\n"
1232 " result=%d postmaster=%d random=%d\n",
1233 new_domain_record.result,
1234 new_domain_record.postmaster_result,
1235 new_domain_record.random_result);
1236 }
1237 }
1238
1239 /* If a definite result was obtained for the callout, cache it unless caching
1240 is disabled. */
1241
1242 if (done)
1243 {
1244 if (!callout_no_cache && new_address_record.result != ccache_unknown)
1245 {
1246 if (dbm_file == NULL)
1247 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
1248 if (dbm_file == NULL)
1249 {
1250 HDEBUG(D_verify) debug_printf("no callout cache available\n");
1251 }
1252 else
1253 {
1254 (void)dbfn_write(dbm_file, address_key, &new_address_record,
1255 (int)sizeof(dbdata_callout_cache_address));
1256 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record\n",
1257 (new_address_record.result == ccache_accept)? "positive" : "negative");
1258 }
1259 }
1260 } /* done */
1261
1262 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1263 temporary error. If there was only one host, and a response was received, leave
1264 it alone if supplying details. Otherwise, give a generic response. */
1265
1266 else /* !done */
1267 {
1268 uschar *dullmsg = string_sprintf("Could not complete %s verify callout",
1269 is_recipient? "recipient" : "sender");
1270 yield = DEFER;
1271
1272 if (host_list->next != NULL || addr->message == NULL) addr->message = dullmsg;
1273
1274 addr->user_message = (!smtp_return_error_details)? dullmsg :
1275 string_sprintf("%s for <%s>.\n"
1276 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1277 "they may be permanently unreachable from this server. In the latter case,\n%s",
1278 dullmsg, addr->address,
1279 is_recipient?
1280 "the address will never be accepted."
1281 :
1282 "you need to change the address or create an MX record for its domain\n"
1283 "if it is supposed to be generally accessible from the Internet.\n"
1284 "Talk to your mail administrator for details.");
1285
1286 /* Force a specific error code */
1287
1288 addr->basic_errno = ERRNO_CALLOUTDEFER;
1289 }
1290
1291 /* Come here from within the cache-reading code on fast-track exit. */
1292
1293 END_CALLOUT:
1294 if (dbm_file != NULL) dbfn_close(dbm_file);
1295 return yield;
1296 }
1297
1298
1299
1300 /* Called after recipient-acl to get a cutthrough connection open when
1301 one was requested and a recipient-verify wasn't subsequently done.
1302 */
1303 void
1304 open_cutthrough_connection( address_item * addr )
1305 {
1306 address_item addr2;
1307
1308 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1309 /* We must use a copy of the address for verification, because it might
1310 get rewritten. */
1311
1312 addr2 = *addr;
1313 HDEBUG(D_acl) debug_printf("----------- %s cutthrough setup ------------\n",
1314 rcpt_count > 1 ? "more" : "start");
1315 (void) verify_address(&addr2, NULL,
1316 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1317 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1318 NULL, NULL, NULL);
1319 HDEBUG(D_acl) debug_printf("----------- end cutthrough setup ------------\n");
1320 return;
1321 }
1322
1323
1324
1325 /* Send given number of bytes from the buffer */
1326 static BOOL
1327 cutthrough_send(int n)
1328 {
1329 if(cutthrough.fd < 0)
1330 return TRUE;
1331
1332 if(
1333 #ifdef SUPPORT_TLS
1334 (tls_out.active == cutthrough.fd) ? tls_write(FALSE, ctblock.buffer, n) :
1335 #endif
1336 send(cutthrough.fd, ctblock.buffer, n, 0) > 0
1337 )
1338 {
1339 transport_count += n;
1340 ctblock.ptr= ctblock.buffer;
1341 return TRUE;
1342 }
1343
1344 HDEBUG(D_transport|D_acl) debug_printf("cutthrough_send failed: %s\n", strerror(errno));
1345 return FALSE;
1346 }
1347
1348
1349
1350 static BOOL
1351 _cutthrough_puts(uschar * cp, int n)
1352 {
1353 while(n--)
1354 {
1355 if(ctblock.ptr >= ctblock.buffer+ctblock.buffersize)
1356 if(!cutthrough_send(ctblock.buffersize))
1357 return FALSE;
1358
1359 *ctblock.ptr++ = *cp++;
1360 }
1361 return TRUE;
1362 }
1363
1364 /* Buffered output of counted data block. Return boolean success */
1365 BOOL
1366 cutthrough_puts(uschar * cp, int n)
1367 {
1368 if (cutthrough.fd < 0) return TRUE;
1369 if (_cutthrough_puts(cp, n)) return TRUE;
1370 cancel_cutthrough_connection("transmit failed");
1371 return FALSE;
1372 }
1373
1374
1375 static BOOL
1376 _cutthrough_flush_send(void)
1377 {
1378 int n= ctblock.ptr-ctblock.buffer;
1379
1380 if(n>0)
1381 if(!cutthrough_send(n))
1382 return FALSE;
1383 return TRUE;
1384 }
1385
1386
1387 /* Send out any bufferred output. Return boolean success. */
1388 BOOL
1389 cutthrough_flush_send(void)
1390 {
1391 if (_cutthrough_flush_send()) return TRUE;
1392 cancel_cutthrough_connection("transmit failed");
1393 return FALSE;
1394 }
1395
1396
1397 BOOL
1398 cutthrough_put_nl(void)
1399 {
1400 return cutthrough_puts(US"\r\n", 2);
1401 }
1402
1403
1404 /* Get and check response from cutthrough target */
1405 static uschar
1406 cutthrough_response(char expect, uschar ** copy)
1407 {
1408 smtp_inblock inblock;
1409 uschar inbuffer[4096];
1410 uschar responsebuffer[4096];
1411
1412 inblock.buffer = inbuffer;
1413 inblock.buffersize = sizeof(inbuffer);
1414 inblock.ptr = inbuffer;
1415 inblock.ptrend = inbuffer;
1416 inblock.sock = cutthrough.fd;
1417 /* this relies on (inblock.sock == tls_out.active) */
1418 if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, CUTTHROUGH_DATA_TIMEOUT))
1419 cancel_cutthrough_connection("target timeout on read");
1420
1421 if(copy != NULL)
1422 {
1423 uschar * cp;
1424 *copy = cp = string_copy(responsebuffer);
1425 /* Trim the trailing end of line */
1426 cp += Ustrlen(responsebuffer);
1427 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1428 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1429 }
1430
1431 return responsebuffer[0];
1432 }
1433
1434
1435 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1436 BOOL
1437 cutthrough_predata(void)
1438 {
1439 if(cutthrough.fd < 0)
1440 return FALSE;
1441
1442 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> DATA\n");
1443 cutthrough_puts(US"DATA\r\n", 6);
1444 cutthrough_flush_send();
1445
1446 /* Assume nothing buffered. If it was it gets ignored. */
1447 return cutthrough_response('3', NULL) == '3';
1448 }
1449
1450
1451 /* fd and use_crlf args only to match write_chunk() */
1452 static BOOL
1453 cutthrough_write_chunk(int fd, uschar * s, int len, BOOL use_crlf)
1454 {
1455 uschar * s2;
1456 while(s && (s2 = Ustrchr(s, '\n')))
1457 {
1458 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1459 return FALSE;
1460 s = s2+1;
1461 }
1462 return TRUE;
1463 }
1464
1465
1466 /* Buffered send of headers. Return success boolean. */
1467 /* Expands newlines to wire format (CR,NL). */
1468 /* Also sends header-terminating blank line. */
1469 BOOL
1470 cutthrough_headers_send(void)
1471 {
1472 if(cutthrough.fd < 0)
1473 return FALSE;
1474
1475 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1476 but having a separate buffered-output function (for now)
1477 */
1478 HDEBUG(D_acl) debug_printf("----------- start cutthrough headers send -----------\n");
1479
1480 if (!transport_headers_send(&cutthrough.addr, cutthrough.fd,
1481 cutthrough.addr.transport->add_headers,
1482 cutthrough.addr.transport->remove_headers,
1483 &cutthrough_write_chunk, TRUE,
1484 cutthrough.addr.transport->rewrite_rules,
1485 cutthrough.addr.transport->rewrite_existflags))
1486 return FALSE;
1487
1488 HDEBUG(D_acl) debug_printf("----------- done cutthrough headers send ------------\n");
1489 return TRUE;
1490 }
1491
1492
1493 static void
1494 close_cutthrough_connection(const char * why)
1495 {
1496 if(cutthrough.fd >= 0)
1497 {
1498 /* We could be sending this after a bunch of data, but that is ok as
1499 the only way to cancel the transfer in dataphase is to drop the tcp
1500 conn before the final dot.
1501 */
1502 ctblock.ptr = ctbuffer;
1503 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> QUIT\n");
1504 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1505 _cutthrough_flush_send();
1506 /* No wait for response */
1507
1508 #ifdef SUPPORT_TLS
1509 tls_close(FALSE, TRUE);
1510 #endif
1511 (void)close(cutthrough.fd);
1512 cutthrough.fd = -1;
1513 HDEBUG(D_acl) debug_printf("----------- cutthrough shutdown (%s) ------------\n", why);
1514 }
1515 ctblock.ptr = ctbuffer;
1516 }
1517
1518 void
1519 cancel_cutthrough_connection(const char * why)
1520 {
1521 close_cutthrough_connection(why);
1522 cutthrough.delivery = FALSE;
1523 }
1524
1525
1526
1527
1528 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1529 Log an OK response as a transmission.
1530 Close the connection.
1531 Return smtp response-class digit.
1532 */
1533 uschar *
1534 cutthrough_finaldot(void)
1535 {
1536 uschar res;
1537 address_item * addr;
1538 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> .\n");
1539
1540 /* Assume data finshed with new-line */
1541 if( !cutthrough_puts(US".", 1)
1542 || !cutthrough_put_nl()
1543 || !cutthrough_flush_send()
1544 )
1545 return cutthrough.addr.message;
1546
1547 res = cutthrough_response('2', &cutthrough.addr.message);
1548 for (addr = &cutthrough.addr; addr; addr = addr->next)
1549 {
1550 addr->message = cutthrough.addr.message;
1551 switch(res)
1552 {
1553 case '2':
1554 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1555 close_cutthrough_connection("delivered");
1556 break;
1557
1558 case '4':
1559 delivery_log(LOG_MAIN, addr, 0,
1560 US"tmp-reject from cutthrough after DATA:");
1561 break;
1562
1563 case '5':
1564 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1565 US"rejected after DATA:");
1566 break;
1567
1568 default:
1569 break;
1570 }
1571 }
1572 return cutthrough.addr.message;
1573 }
1574
1575
1576
1577 /*************************************************
1578 * Copy error to toplevel address *
1579 *************************************************/
1580
1581 /* This function is used when a verify fails or defers, to ensure that the
1582 failure or defer information is in the original toplevel address. This applies
1583 when an address is redirected to a single new address, and the failure or
1584 deferral happens to the child address.
1585
1586 Arguments:
1587 vaddr the verify address item
1588 addr the final address item
1589 yield FAIL or DEFER
1590
1591 Returns: the value of YIELD
1592 */
1593
1594 static int
1595 copy_error(address_item *vaddr, address_item *addr, int yield)
1596 {
1597 if (addr != vaddr)
1598 {
1599 vaddr->message = addr->message;
1600 vaddr->user_message = addr->user_message;
1601 vaddr->basic_errno = addr->basic_errno;
1602 vaddr->more_errno = addr->more_errno;
1603 vaddr->p.address_data = addr->p.address_data;
1604 copyflag(vaddr, addr, af_pass_message);
1605 }
1606 return yield;
1607 }
1608
1609
1610
1611
1612 /**************************************************
1613 * printf that automatically handles TLS if needed *
1614 ***************************************************/
1615
1616 /* This function is used by verify_address() as a substitute for all fprintf()
1617 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1618 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1619 that assumes that we always use the smtp_out FILE* when not using TLS or the
1620 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1621 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1622 fprintf().
1623
1624 Arguments:
1625 f the candidate FILE* to write to
1626 format format string
1627 ... optional arguments
1628
1629 Returns:
1630 nothing
1631 */
1632
1633 static void PRINTF_FUNCTION(2,3)
1634 respond_printf(FILE *f, const char *format, ...)
1635 {
1636 va_list ap;
1637
1638 va_start(ap, format);
1639 if (smtp_out && (f == smtp_out))
1640 smtp_vprintf(format, ap);
1641 else
1642 vfprintf(f, format, ap);
1643 va_end(ap);
1644 }
1645
1646
1647
1648 /*************************************************
1649 * Verify an email address *
1650 *************************************************/
1651
1652 /* This function is used both for verification (-bv and at other times) and
1653 address testing (-bt), which is indicated by address_test_mode being set.
1654
1655 Arguments:
1656 vaddr contains the address to verify; the next field in this block
1657 must be NULL
1658 f if not NULL, write the result to this file
1659 options various option bits:
1660 vopt_fake_sender => this sender verify is not for the real
1661 sender (it was verify=sender=xxxx or an address from a
1662 header line) - rewriting must not change sender_address
1663 vopt_is_recipient => this is a recipient address, otherwise
1664 it's a sender address - this affects qualification and
1665 rewriting and messages from callouts
1666 vopt_qualify => qualify an unqualified address; else error
1667 vopt_expn => called from SMTP EXPN command
1668 vopt_success_on_redirect => when a new address is generated
1669 the verification instantly succeeds
1670
1671 These ones are used by do_callout() -- the options variable
1672 is passed to it.
1673
1674 vopt_callout_fullpm => if postmaster check, do full one
1675 vopt_callout_no_cache => don't use callout cache
1676 vopt_callout_random => do the "random" thing
1677 vopt_callout_recipsender => use real sender for recipient
1678 vopt_callout_recippmaster => use postmaster for recipient
1679
1680 callout if > 0, specifies that callout is required, and gives timeout
1681 for individual commands
1682 callout_overall if > 0, gives overall timeout for the callout function;
1683 if < 0, a default is used (see do_callout())
1684 callout_connect the connection timeout for callouts
1685 se_mailfrom when callout is requested to verify a sender, use this
1686 in MAIL FROM; NULL => ""
1687 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1688 thing and use this as the sender address (may be "")
1689
1690 routed if not NULL, set TRUE if routing succeeded, so we can
1691 distinguish between routing failed and callout failed
1692
1693 Returns: OK address verified
1694 FAIL address failed to verify
1695 DEFER can't tell at present
1696 */
1697
1698 int
1699 verify_address(address_item *vaddr, FILE *f, int options, int callout,
1700 int callout_overall, int callout_connect, uschar *se_mailfrom,
1701 uschar *pm_mailfrom, BOOL *routed)
1702 {
1703 BOOL allok = TRUE;
1704 BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
1705 BOOL is_recipient = (options & vopt_is_recipient) != 0;
1706 BOOL expn = (options & vopt_expn) != 0;
1707 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1708 int i;
1709 int yield = OK;
1710 int verify_type = expn? v_expn :
1711 address_test_mode? v_none :
1712 is_recipient? v_recipient : v_sender;
1713 address_item *addr_list;
1714 address_item *addr_new = NULL;
1715 address_item *addr_remote = NULL;
1716 address_item *addr_local = NULL;
1717 address_item *addr_succeed = NULL;
1718 uschar **failure_ptr = is_recipient?
1719 &recipient_verify_failure : &sender_verify_failure;
1720 uschar *ko_prefix, *cr;
1721 uschar *address = vaddr->address;
1722 uschar *save_sender;
1723 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1724
1725 /* Clear, just in case */
1726
1727 *failure_ptr = NULL;
1728
1729 /* Set up a prefix and suffix for error message which allow us to use the same
1730 output statements both in EXPN mode (where an SMTP response is needed) and when
1731 debugging with an output file. */
1732
1733 if (expn)
1734 {
1735 ko_prefix = US"553 ";
1736 cr = US"\r";
1737 }
1738 else ko_prefix = cr = US"";
1739
1740 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1741
1742 if (parse_find_at(address) == NULL)
1743 {
1744 if ((options & vopt_qualify) == 0)
1745 {
1746 if (f != NULL)
1747 respond_printf(f, "%sA domain is required for \"%s\"%s\n",
1748 ko_prefix, address, cr);
1749 *failure_ptr = US"qualify";
1750 return FAIL;
1751 }
1752 address = rewrite_address_qualify(address, is_recipient);
1753 }
1754
1755 DEBUG(D_verify)
1756 {
1757 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1758 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
1759 }
1760
1761 /* Rewrite and report on it. Clear the domain and local part caches - these
1762 may have been set by domains and local part tests during an ACL. */
1763
1764 if (global_rewrite_rules != NULL)
1765 {
1766 uschar *old = address;
1767 address = rewrite_address(address, is_recipient, FALSE,
1768 global_rewrite_rules, rewrite_existflags);
1769 if (address != old)
1770 {
1771 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1772 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1773 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
1774 }
1775 }
1776
1777 /* If this is the real sender address, we must update sender_address at
1778 this point, because it may be referred to in the routers. */
1779
1780 if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
1781 sender_address = address;
1782
1783 /* If the address was rewritten to <> no verification can be done, and we have
1784 to return OK. This rewriting is permitted only for sender addresses; for other
1785 addresses, such rewriting fails. */
1786
1787 if (address[0] == 0) return OK;
1788
1789 /* Flip the legacy TLS-related variables over to the outbound set in case
1790 they're used in the context of a transport used by verification. Reset them
1791 at exit from this routine. */
1792
1793 tls_modify_variables(&tls_out);
1794
1795 /* Save a copy of the sender address for re-instating if we change it to <>
1796 while verifying a sender address (a nice bit of self-reference there). */
1797
1798 save_sender = sender_address;
1799
1800 /* Update the address structure with the possibly qualified and rewritten
1801 address. Set it up as the starting address on the chain of new addresses. */
1802
1803 vaddr->address = address;
1804 addr_new = vaddr;
1805
1806 /* We need a loop, because an address can generate new addresses. We must also
1807 cope with generated pipes and files at the top level. (See also the code and
1808 comment in deliver.c.) However, it is usually the case that the router for
1809 user's .forward files has its verify flag turned off.
1810
1811 If an address generates more than one child, the loop is used only when
1812 full_info is set, and this can only be set locally. Remote enquiries just get
1813 information about the top level address, not anything that it generated. */
1814
1815 while (addr_new != NULL)
1816 {
1817 int rc;
1818 address_item *addr = addr_new;
1819
1820 addr_new = addr->next;
1821 addr->next = NULL;
1822
1823 DEBUG(D_verify)
1824 {
1825 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1826 debug_printf("Considering %s\n", addr->address);
1827 }
1828
1829 /* Handle generated pipe, file or reply addresses. We don't get these
1830 when handling EXPN, as it does only one level of expansion. */
1831
1832 if (testflag(addr, af_pfr))
1833 {
1834 allok = FALSE;
1835 if (f != NULL)
1836 {
1837 BOOL allow;
1838
1839 if (addr->address[0] == '>')
1840 {
1841 allow = testflag(addr, af_allow_reply);
1842 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1843 }
1844 else
1845 {
1846 allow = (addr->address[0] == '|')?
1847 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1848 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1849 }
1850
1851 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1852 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1853 "%s\n", addr->message);
1854 else if (allow)
1855 fprintf(f, "\n transport = %s\n", addr->transport->name);
1856 else
1857 fprintf(f, " *** forbidden ***\n");
1858 }
1859 continue;
1860 }
1861
1862 /* Just in case some router parameter refers to it. */
1863
1864 return_path = (addr->p.errors_address != NULL)?
1865 addr->p.errors_address : sender_address;
1866
1867 /* Split the address into domain and local part, handling the %-hack if
1868 necessary, and then route it. While routing a sender address, set
1869 $sender_address to <> because that is what it will be if we were trying to
1870 send a bounce to the sender. */
1871
1872 if (routed != NULL) *routed = FALSE;
1873 if ((rc = deliver_split_address(addr)) == OK)
1874 {
1875 if (!is_recipient) sender_address = null_sender;
1876 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1877 &addr_succeed, verify_type);
1878 sender_address = save_sender; /* Put back the real sender */
1879 }
1880
1881 /* If routing an address succeeded, set the flag that remembers, for use when
1882 an ACL cached a sender verify (in case a callout fails). Then if routing set
1883 up a list of hosts or the transport has a host list, and the callout option
1884 is set, and we aren't in a host checking run, do the callout verification,
1885 and set another flag that notes that a callout happened. */
1886
1887 if (rc == OK)
1888 {
1889 if (routed != NULL) *routed = TRUE;
1890 if (callout > 0)
1891 {
1892 host_item *host_list = addr->host_list;
1893
1894 /* Make up some data for use in the case where there is no remote
1895 transport. */
1896
1897 transport_feedback tf = {
1898 NULL, /* interface (=> any) */
1899 US"smtp", /* port */
1900 US"smtp", /* protocol */
1901 NULL, /* hosts */
1902 US"$smtp_active_hostname", /* helo_data */
1903 FALSE, /* hosts_override */
1904 FALSE, /* hosts_randomize */
1905 FALSE, /* gethostbyname */
1906 TRUE, /* qualify_single */
1907 FALSE /* search_parents */
1908 };
1909
1910 /* If verification yielded a remote transport, we want to use that
1911 transport's options, so as to mimic what would happen if we were really
1912 sending a message to this address. */
1913
1914 if (addr->transport != NULL && !addr->transport->info->local)
1915 {
1916 (void)(addr->transport->setup)(addr->transport, addr, &tf, 0, 0, NULL);
1917
1918 /* If the transport has hosts and the router does not, or if the
1919 transport is configured to override the router's hosts, we must build a
1920 host list of the transport's hosts, and find the IP addresses */
1921
1922 if (tf.hosts != NULL && (host_list == NULL || tf.hosts_override))
1923 {
1924 uschar *s;
1925 const uschar *save_deliver_domain = deliver_domain;
1926 uschar *save_deliver_localpart = deliver_localpart;
1927
1928 host_list = NULL; /* Ignore the router's hosts */
1929
1930 deliver_domain = addr->domain;
1931 deliver_localpart = addr->local_part;
1932 s = expand_string(tf.hosts);
1933 deliver_domain = save_deliver_domain;
1934 deliver_localpart = save_deliver_localpart;
1935
1936 if (s == NULL)
1937 {
1938 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1939 "\"%s\" in %s transport for callout: %s", tf.hosts,
1940 addr->transport->name, expand_string_message);
1941 }
1942 else
1943 {
1944 int flags;
1945 host_item *host, *nexthost;
1946 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1947
1948 /* Just ignore failures to find a host address. If we don't manage
1949 to find any addresses, the callout will defer. Note that more than
1950 one address may be found for a single host, which will result in
1951 additional host items being inserted into the chain. Hence we must
1952 save the next host first. */
1953
1954 flags = HOST_FIND_BY_A;
1955 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1956 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1957
1958 for (host = host_list; host != NULL; host = nexthost)
1959 {
1960 nexthost = host->next;
1961 if (tf.gethostbyname ||
1962 string_is_ip_address(host->name, NULL) != 0)
1963 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
1964 else
1965 {
1966 uschar * d_request = NULL, * d_require = NULL;
1967 if (Ustrcmp(addr->transport->driver_name, "smtp") == 0)
1968 {
1969 smtp_transport_options_block * ob =
1970 (smtp_transport_options_block *)
1971 addr->transport->options_block;
1972 d_request = ob->dnssec_request_domains;
1973 d_require = ob->dnssec_require_domains;
1974 }
1975
1976 (void)host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1977 d_request, d_require, NULL, NULL);
1978 }
1979 }
1980 }
1981 }
1982 }
1983
1984 /* Can only do a callout if we have at least one host! If the callout
1985 fails, it will have set ${sender,recipient}_verify_failure. */
1986
1987 if (host_list != NULL)
1988 {
1989 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1990 if (host_checking && !host_checking_callout)
1991 {
1992 HDEBUG(D_verify)
1993 debug_printf("... callout omitted by default when host testing\n"
1994 "(Use -bhc if you want the callouts to happen.)\n");
1995 }
1996 else
1997 {
1998 #ifdef SUPPORT_TLS
1999 deliver_set_expansions(addr);
2000 #endif
2001 verify_mode = is_recipient ? US"R" : US"S";
2002 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
2003 callout_connect, options, se_mailfrom, pm_mailfrom);
2004 verify_mode = NULL;
2005 }
2006 }
2007 else
2008 {
2009 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
2010 "transport provided a host list\n");
2011 }
2012 }
2013 }
2014
2015 /* Otherwise, any failure is a routing failure */
2016
2017 else *failure_ptr = US"route";
2018
2019 /* A router may return REROUTED if it has set up a child address as a result
2020 of a change of domain name (typically from widening). In this case we always
2021 want to continue to verify the new child. */
2022
2023 if (rc == REROUTED) continue;
2024
2025 /* Handle hard failures */
2026
2027 if (rc == FAIL)
2028 {
2029 allok = FALSE;
2030 if (f != NULL)
2031 {
2032 address_item *p = addr->parent;
2033
2034 respond_printf(f, "%s%s %s", ko_prefix,
2035 full_info? addr->address : address,
2036 address_test_mode? "is undeliverable" : "failed to verify");
2037 if (!expn && admin_user)
2038 {
2039 if (addr->basic_errno > 0)
2040 respond_printf(f, ": %s", strerror(addr->basic_errno));
2041 if (addr->message != NULL)
2042 respond_printf(f, ": %s", addr->message);
2043 }
2044
2045 /* Show parents iff doing full info */
2046
2047 if (full_info) while (p != NULL)
2048 {
2049 respond_printf(f, "%s\n <-- %s", cr, p->address);
2050 p = p->parent;
2051 }
2052 respond_printf(f, "%s\n", cr);
2053 }
2054 cancel_cutthrough_connection("routing hard fail");
2055
2056 if (!full_info)
2057 {
2058 yield = copy_error(vaddr, addr, FAIL);
2059 goto out;
2060 }
2061 else yield = FAIL;
2062 }
2063
2064 /* Soft failure */
2065
2066 else if (rc == DEFER)
2067 {
2068 allok = FALSE;
2069 if (f != NULL)
2070 {
2071 address_item *p = addr->parent;
2072 respond_printf(f, "%s%s cannot be resolved at this time", ko_prefix,
2073 full_info? addr->address : address);
2074 if (!expn && admin_user)
2075 {
2076 if (addr->basic_errno > 0)
2077 respond_printf(f, ": %s", strerror(addr->basic_errno));
2078 if (addr->message != NULL)
2079 respond_printf(f, ": %s", addr->message);
2080 else if (addr->basic_errno <= 0)
2081 respond_printf(f, ": unknown error");
2082 }
2083
2084 /* Show parents iff doing full info */
2085
2086 if (full_info) while (p != NULL)
2087 {
2088 respond_printf(f, "%s\n <-- %s", cr, p->address);
2089 p = p->parent;
2090 }
2091 respond_printf(f, "%s\n", cr);
2092 }
2093 cancel_cutthrough_connection("routing soft fail");
2094
2095 if (!full_info)
2096 {
2097 yield = copy_error(vaddr, addr, DEFER);
2098 goto out;
2099 }
2100 else if (yield == OK) yield = DEFER;
2101 }
2102
2103 /* If we are handling EXPN, we do not want to continue to route beyond
2104 the top level (whose address is in "address"). */
2105
2106 else if (expn)
2107 {
2108 uschar *ok_prefix = US"250-";
2109 if (addr_new == NULL)
2110 {
2111 if (addr_local == NULL && addr_remote == NULL)
2112 respond_printf(f, "250 mail to <%s> is discarded\r\n", address);
2113 else
2114 respond_printf(f, "250 <%s>\r\n", address);
2115 }
2116 else while (addr_new != NULL)
2117 {
2118 address_item *addr2 = addr_new;
2119 addr_new = addr2->next;
2120 if (addr_new == NULL) ok_prefix = US"250 ";
2121 respond_printf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
2122 }
2123 yield = OK;
2124 goto out;
2125 }
2126
2127 /* Successful routing other than EXPN. */
2128
2129 else
2130 {
2131 /* Handle successful routing when short info wanted. Otherwise continue for
2132 other (generated) addresses. Short info is the operational case. Full info
2133 can be requested only when debug_selector != 0 and a file is supplied.
2134
2135 There is a conflict between the use of aliasing as an alternate email
2136 address, and as a sort of mailing list. If an alias turns the incoming
2137 address into just one address (e.g. J.Caesar->jc44) you may well want to
2138 carry on verifying the generated address to ensure it is valid when
2139 checking incoming mail. If aliasing generates multiple addresses, you
2140 probably don't want to do this. Exim therefore treats the generation of
2141 just a single new address as a special case, and continues on to verify the
2142 generated address. */
2143
2144 if (!full_info && /* Stop if short info wanted AND */
2145 (((addr_new == NULL || /* No new address OR */
2146 addr_new->next != NULL || /* More than one new address OR */
2147 testflag(addr_new, af_pfr))) /* New address is pfr */
2148 || /* OR */
2149 (addr_new != NULL && /* At least one new address AND */
2150 success_on_redirect))) /* success_on_redirect is set */
2151 {
2152 if (f != NULL) fprintf(f, "%s %s\n", address,
2153 address_test_mode? "is deliverable" : "verified");
2154
2155 /* If we have carried on to verify a child address, we want the value
2156 of $address_data to be that of the child */
2157
2158 vaddr->p.address_data = addr->p.address_data;
2159 yield = OK;
2160 goto out;
2161 }
2162 }
2163 } /* Loop for generated addresses */
2164
2165 /* Display the full results of the successful routing, including any generated
2166 addresses. Control gets here only when full_info is set, which requires f not
2167 to be NULL, and this occurs only when a top-level verify is called with the
2168 debugging switch on.
2169
2170 If there are no local and no remote addresses, and there were no pipes, files,
2171 or autoreplies, and there were no errors or deferments, the message is to be
2172 discarded, usually because of the use of :blackhole: in an alias file. */
2173
2174 if (allok && addr_local == NULL && addr_remote == NULL)
2175 {
2176 fprintf(f, "mail to %s is discarded\n", address);
2177 goto out;
2178 }
2179
2180 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2181 {
2182 while (addr_list != NULL)
2183 {
2184 address_item *addr = addr_list;
2185 address_item *p = addr->parent;
2186 addr_list = addr->next;
2187
2188 fprintf(f, "%s", CS addr->address);
2189 #ifdef EXPERIMENTAL_SRS
2190 if(addr->p.srs_sender)
2191 fprintf(f, " [srs = %s]", addr->p.srs_sender);
2192 #endif
2193
2194 /* If the address is a duplicate, show something about it. */
2195
2196 if (!testflag(addr, af_pfr))
2197 {
2198 tree_node *tnode;
2199 if ((tnode = tree_search(tree_duplicates, addr->unique)) != NULL)
2200 fprintf(f, " [duplicate, would not be delivered]");
2201 else tree_add_duplicate(addr->unique, addr);
2202 }
2203
2204 /* Now show its parents */
2205
2206 while (p != NULL)
2207 {
2208 fprintf(f, "\n <-- %s", p->address);
2209 p = p->parent;
2210 }
2211 fprintf(f, "\n ");
2212
2213 /* Show router, and transport */
2214
2215 fprintf(f, "router = %s, ", addr->router->name);
2216 fprintf(f, "transport = %s\n", (addr->transport == NULL)? US"unset" :
2217 addr->transport->name);
2218
2219 /* Show any hosts that are set up by a router unless the transport
2220 is going to override them; fiddle a bit to get a nice format. */
2221
2222 if (addr->host_list != NULL && addr->transport != NULL &&
2223 !addr->transport->overrides_hosts)
2224 {
2225 host_item *h;
2226 int maxlen = 0;
2227 int maxaddlen = 0;
2228 for (h = addr->host_list; h != NULL; h = h->next)
2229 {
2230 int len = Ustrlen(h->name);
2231 if (len > maxlen) maxlen = len;
2232 len = (h->address != NULL)? Ustrlen(h->address) : 7;
2233 if (len > maxaddlen) maxaddlen = len;
2234 }
2235 for (h = addr->host_list; h != NULL; h = h->next)
2236 {
2237 int len = Ustrlen(h->name);
2238 fprintf(f, " host %s ", h->name);
2239 while (len++ < maxlen) fprintf(f, " ");
2240 if (h->address != NULL)
2241 {
2242 fprintf(f, "[%s] ", h->address);
2243 len = Ustrlen(h->address);
2244 }
2245 else if (!addr->transport->info->local) /* Omit [unknown] for local */
2246 {
2247 fprintf(f, "[unknown] ");
2248 len = 7;
2249 }
2250 else len = -3;
2251 while (len++ < maxaddlen) fprintf(f," ");
2252 if (h->mx >= 0) fprintf(f, "MX=%d", h->mx);
2253 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
2254 if (h->status == hstatus_unusable) fprintf(f, " ** unusable **");
2255 fprintf(f, "\n");
2256 }
2257 }
2258 }
2259 }
2260
2261 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2262 the -bv or -bt case). */
2263
2264 out:
2265 tls_modify_variables(&tls_in);
2266
2267 return yield;
2268 }
2269
2270
2271
2272
2273 /*************************************************
2274 * Check headers for syntax errors *
2275 *************************************************/
2276
2277 /* This function checks those header lines that contain addresses, and verifies
2278 that all the addresses therein are syntactially correct.
2279
2280 Arguments:
2281 msgptr where to put an error message
2282
2283 Returns: OK
2284 FAIL
2285 */
2286
2287 int
2288 verify_check_headers(uschar **msgptr)
2289 {
2290 header_line *h;
2291 uschar *colon, *s;
2292 int yield = OK;
2293
2294 for (h = header_list; h != NULL && yield == OK; h = h->next)
2295 {
2296 if (h->type != htype_from &&
2297 h->type != htype_reply_to &&
2298 h->type != htype_sender &&
2299 h->type != htype_to &&
2300 h->type != htype_cc &&
2301 h->type != htype_bcc)
2302 continue;
2303
2304 colon = Ustrchr(h->text, ':');
2305 s = colon + 1;
2306 while (isspace(*s)) s++;
2307
2308 /* Loop for multiple addresses in the header, enabling group syntax. Note
2309 that we have to reset this after the header has been scanned. */
2310
2311 parse_allow_group = TRUE;
2312
2313 while (*s != 0)
2314 {
2315 uschar *ss = parse_find_address_end(s, FALSE);
2316 uschar *recipient, *errmess;
2317 int terminator = *ss;
2318 int start, end, domain;
2319
2320 /* Temporarily terminate the string at this point, and extract the
2321 operative address within, allowing group syntax. */
2322
2323 *ss = 0;
2324 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2325 *ss = terminator;
2326
2327 /* Permit an unqualified address only if the message is local, or if the
2328 sending host is configured to be permitted to send them. */
2329
2330 if (recipient != NULL && domain == 0)
2331 {
2332 if (h->type == htype_from || h->type == htype_sender)
2333 {
2334 if (!allow_unqualified_sender) recipient = NULL;
2335 }
2336 else
2337 {
2338 if (!allow_unqualified_recipient) recipient = NULL;
2339 }
2340 if (recipient == NULL) errmess = US"unqualified address not permitted";
2341 }
2342
2343 /* It's an error if no address could be extracted, except for the special
2344 case of an empty address. */
2345
2346 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
2347 {
2348 uschar *verb = US"is";
2349 uschar *t = ss;
2350 uschar *tt = colon;
2351 int len;
2352
2353 /* Arrange not to include any white space at the end in the
2354 error message or the header name. */
2355
2356 while (t > s && isspace(t[-1])) t--;
2357 while (tt > h->text && isspace(tt[-1])) tt--;
2358
2359 /* Add the address that failed to the error message, since in a
2360 header with very many addresses it is sometimes hard to spot
2361 which one is at fault. However, limit the amount of address to
2362 quote - cases have been seen where, for example, a missing double
2363 quote in a humungous To: header creates an "address" that is longer
2364 than string_sprintf can handle. */
2365
2366 len = t - s;
2367 if (len > 1024)
2368 {
2369 len = 1024;
2370 verb = US"begins";
2371 }
2372
2373 /* deconst cast ok as we're passing a non-const to string_printing() */
2374 *msgptr = US string_printing(
2375 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2376 errmess, tt - h->text, h->text, verb, len, s));
2377
2378 yield = FAIL;
2379 break; /* Out of address loop */
2380 }
2381
2382 /* Advance to the next address */
2383
2384 s = ss + (terminator? 1:0);
2385 while (isspace(*s)) s++;
2386 } /* Next address */
2387
2388 parse_allow_group = FALSE;
2389 parse_found_group = FALSE;
2390 } /* Next header unless yield has been set FALSE */
2391
2392 return yield;
2393 }
2394
2395
2396 /*************************************************
2397 * Check header names for 8-bit characters *
2398 *************************************************/
2399
2400 /* This function checks for invalid charcters in header names. See
2401 RFC 5322, 2.2. and RFC 6532, 3.
2402
2403 Arguments:
2404 msgptr where to put an error message
2405
2406 Returns: OK
2407 FAIL
2408 */
2409
2410 int
2411 verify_check_header_names_ascii(uschar **msgptr)
2412 {
2413 header_line *h;
2414 uschar *colon, *s;
2415
2416 for (h = header_list; h != NULL; h = h->next)
2417 {
2418 colon = Ustrchr(h->text, ':');
2419 for(s = h->text; s < colon; s++)
2420 {
2421 if ((*s < 33) || (*s > 126))
2422 {
2423 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2424 colon - h->text, h->text);
2425 return FAIL;
2426 }
2427 }
2428 }
2429 return OK;
2430 }
2431
2432 /*************************************************
2433 * Check for blind recipients *
2434 *************************************************/
2435
2436 /* This function checks that every (envelope) recipient is mentioned in either
2437 the To: or Cc: header lines, thus detecting blind carbon copies.
2438
2439 There are two ways of scanning that could be used: either scan the header lines
2440 and tick off the recipients, or scan the recipients and check the header lines.
2441 The original proposed patch did the former, but I have chosen to do the latter,
2442 because (a) it requires no memory and (b) will use fewer resources when there
2443 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2444
2445 Arguments: none
2446 Returns: OK if there are no blind recipients
2447 FAIL if there is at least one blind recipient
2448 */
2449
2450 int
2451 verify_check_notblind(void)
2452 {
2453 int i;
2454 for (i = 0; i < recipients_count; i++)
2455 {
2456 header_line *h;
2457 BOOL found = FALSE;
2458 uschar *address = recipients_list[i].address;
2459
2460 for (h = header_list; !found && h != NULL; h = h->next)
2461 {
2462 uschar *colon, *s;
2463
2464 if (h->type != htype_to && h->type != htype_cc) continue;
2465
2466 colon = Ustrchr(h->text, ':');
2467 s = colon + 1;
2468 while (isspace(*s)) s++;
2469
2470 /* Loop for multiple addresses in the header, enabling group syntax. Note
2471 that we have to reset this after the header has been scanned. */
2472
2473 parse_allow_group = TRUE;
2474
2475 while (*s != 0)
2476 {
2477 uschar *ss = parse_find_address_end(s, FALSE);
2478 uschar *recipient,*errmess;
2479 int terminator = *ss;
2480 int start, end, domain;
2481
2482 /* Temporarily terminate the string at this point, and extract the
2483 operative address within, allowing group syntax. */
2484
2485 *ss = 0;
2486 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2487 *ss = terminator;
2488
2489 /* If we found a valid recipient that has a domain, compare it with the
2490 envelope recipient. Local parts are compared case-sensitively, domains
2491 case-insensitively. By comparing from the start with length "domain", we
2492 include the "@" at the end, which ensures that we are comparing the whole
2493 local part of each address. */
2494
2495 if (recipient != NULL && domain != 0)
2496 {
2497 found = Ustrncmp(recipient, address, domain) == 0 &&
2498 strcmpic(recipient + domain, address + domain) == 0;
2499 if (found) break;
2500 }
2501
2502 /* Advance to the next address */
2503
2504 s = ss + (terminator? 1:0);
2505 while (isspace(*s)) s++;
2506 } /* Next address */
2507
2508 parse_allow_group = FALSE;
2509 parse_found_group = FALSE;
2510 } /* Next header (if found is false) */
2511
2512 if (!found) return FAIL;
2513 } /* Next recipient */
2514
2515 return OK;
2516 }
2517
2518
2519
2520 /*************************************************
2521 * Find if verified sender *
2522 *************************************************/
2523
2524 /* Usually, just a single address is verified as the sender of the message.
2525 However, Exim can be made to verify other addresses as well (often related in
2526 some way), and this is useful in some environments. There may therefore be a
2527 chain of such addresses that have previously been tested. This function finds
2528 whether a given address is on the chain.
2529
2530 Arguments: the address to be verified
2531 Returns: pointer to an address item, or NULL
2532 */
2533
2534 address_item *
2535 verify_checked_sender(uschar *sender)
2536 {
2537 address_item *addr;
2538 for (addr = sender_verified_list; addr != NULL; addr = addr->next)
2539 if (Ustrcmp(sender, addr->address) == 0) break;
2540 return addr;
2541 }
2542
2543
2544
2545
2546
2547 /*************************************************
2548 * Get valid header address *
2549 *************************************************/
2550
2551 /* Scan the originator headers of the message, looking for an address that
2552 verifies successfully. RFC 822 says:
2553
2554 o The "Sender" field mailbox should be sent notices of
2555 any problems in transport or delivery of the original
2556 messages. If there is no "Sender" field, then the
2557 "From" field mailbox should be used.
2558
2559 o If the "Reply-To" field exists, then the reply should
2560 go to the addresses indicated in that field and not to
2561 the address(es) indicated in the "From" field.
2562
2563 So we check a Sender field if there is one, else a Reply_to field, else a From
2564 field. As some strange messages may have more than one of these fields,
2565 especially if they are resent- fields, check all of them if there is more than
2566 one.
2567
2568 Arguments:
2569 user_msgptr points to where to put a user error message
2570 log_msgptr points to where to put a log error message
2571 callout timeout for callout check (passed to verify_address())
2572 callout_overall overall callout timeout (ditto)
2573 callout_connect connect callout timeout (ditto)
2574 se_mailfrom mailfrom for verify; NULL => ""
2575 pm_mailfrom sender for pm callout check (passed to verify_address())
2576 options callout options (passed to verify_address())
2577 verrno where to put the address basic_errno
2578
2579 If log_msgptr is set to something without setting user_msgptr, the caller
2580 normally uses log_msgptr for both things.
2581
2582 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2583 FAIL is given if no appropriate headers are found
2584 */
2585
2586 int
2587 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2588 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2589 uschar *pm_mailfrom, int options, int *verrno)
2590 {
2591 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2592 BOOL done = FALSE;
2593 int yield = FAIL;
2594 int i;
2595
2596 for (i = 0; i < 3 && !done; i++)
2597 {
2598 header_line *h;
2599 for (h = header_list; h != NULL && !done; h = h->next)
2600 {
2601 int terminator, new_ok;
2602 uschar *s, *ss, *endname;
2603
2604 if (h->type != header_types[i]) continue;
2605 s = endname = Ustrchr(h->text, ':') + 1;
2606
2607 /* Scan the addresses in the header, enabling group syntax. Note that we
2608 have to reset this after the header has been scanned. */
2609
2610 parse_allow_group = TRUE;
2611
2612 while (*s != 0)
2613 {
2614 address_item *vaddr;
2615
2616 while (isspace(*s) || *s == ',') s++;
2617 if (*s == 0) break; /* End of header */
2618
2619 ss = parse_find_address_end(s, FALSE);
2620
2621 /* The terminator is a comma or end of header, but there may be white
2622 space preceding it (including newline for the last address). Move back
2623 past any white space so we can check against any cached envelope sender
2624 address verifications. */
2625
2626 while (isspace(ss[-1])) ss--;
2627 terminator = *ss;
2628 *ss = 0;
2629
2630 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2631 (int)(endname - h->text), h->text, s);
2632
2633 /* See if we have already verified this address as an envelope sender,
2634 and if so, use the previous answer. */
2635
2636 vaddr = verify_checked_sender(s);
2637
2638 if (vaddr != NULL && /* Previously checked */
2639 (callout <= 0 || /* No callout needed; OR */
2640 vaddr->special_action > 256)) /* Callout was done */
2641 {
2642 new_ok = vaddr->special_action & 255;
2643 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2644 *ss = terminator; /* Restore shortened string */
2645 }
2646
2647 /* Otherwise we run the verification now. We must restore the shortened
2648 string before running the verification, so the headers are correct, in
2649 case there is any rewriting. */
2650
2651 else
2652 {
2653 int start, end, domain;
2654 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2655 &domain, FALSE);
2656
2657 *ss = terminator;
2658
2659 /* If we found an empty address, just carry on with the next one, but
2660 kill the message. */
2661
2662 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2663 {
2664 *log_msgptr = NULL;
2665 s = ss;
2666 continue;
2667 }
2668
2669 /* If verification failed because of a syntax error, fail this
2670 function, and ensure that the failing address gets added to the error
2671 message. */
2672
2673 if (address == NULL)
2674 {
2675 new_ok = FAIL;
2676 while (ss > s && isspace(ss[-1])) ss--;
2677 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2678 "scanning for sender: %s in \"%.*s\"",
2679 endname - h->text, h->text, *log_msgptr, ss - s, s);
2680 yield = FAIL;
2681 done = TRUE;
2682 break;
2683 }
2684
2685 /* Else go ahead with the sender verification. But it isn't *the*
2686 sender of the message, so set vopt_fake_sender to stop sender_address
2687 being replaced after rewriting or qualification. */
2688
2689 else
2690 {
2691 vaddr = deliver_make_addr(address, FALSE);
2692 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2693 callout, callout_overall, callout_connect, se_mailfrom,
2694 pm_mailfrom, NULL);
2695 }
2696 }
2697
2698 /* We now have the result, either newly found, or cached. If we are
2699 giving out error details, set a specific user error. This means that the
2700 last of these will be returned to the user if all three fail. We do not
2701 set a log message - the generic one below will be used. */
2702
2703 if (new_ok != OK)
2704 {
2705 *verrno = vaddr->basic_errno;
2706 if (smtp_return_error_details)
2707 {
2708 *user_msgptr = string_sprintf("Rejected after DATA: "
2709 "could not verify \"%.*s\" header address\n%s: %s",
2710 endname - h->text, h->text, vaddr->address, vaddr->message);
2711 }
2712 }
2713
2714 /* Success or defer */
2715
2716 if (new_ok == OK)
2717 {
2718 yield = OK;
2719 done = TRUE;
2720 break;
2721 }
2722
2723 if (new_ok == DEFER) yield = DEFER;
2724
2725 /* Move on to any more addresses in the header */
2726
2727 s = ss;
2728 } /* Next address */
2729
2730 parse_allow_group = FALSE;
2731 parse_found_group = FALSE;
2732 } /* Next header, unless done */
2733 } /* Next header type unless done */
2734
2735 if (yield == FAIL && *log_msgptr == NULL)
2736 *log_msgptr = US"there is no valid sender in any header line";
2737
2738 if (yield == DEFER && *log_msgptr == NULL)
2739 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2740
2741 return yield;
2742 }
2743
2744
2745
2746
2747 /*************************************************
2748 * Get RFC 1413 identification *
2749 *************************************************/
2750
2751 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2752 the timeout is set to zero, then the query is not done. There may also be lists
2753 of hosts and nets which are exempt. To guard against malefactors sending
2754 non-printing characters which could, for example, disrupt a message's headers,
2755 make sure the string consists of printing characters only.
2756
2757 Argument:
2758 port the port to connect to; usually this is IDENT_PORT (113), but when
2759 running in the test harness with -bh a different value is used.
2760
2761 Returns: nothing
2762
2763 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2764 */
2765
2766 void
2767 verify_get_ident(int port)
2768 {
2769 int sock, host_af, qlen;
2770 int received_sender_port, received_interface_port, n;
2771 uschar *p;
2772 uschar buffer[2048];
2773
2774 /* Default is no ident. Check whether we want to do an ident check for this
2775 host. */
2776
2777 sender_ident = NULL;
2778 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2779 return;
2780
2781 DEBUG(D_ident) debug_printf("doing ident callback\n");
2782
2783 /* Set up a connection to the ident port of the remote host. Bind the local end
2784 to the incoming interface address. If the sender host address is an IPv6
2785 address, the incoming interface address will also be IPv6. */
2786
2787 host_af = (Ustrchr(sender_host_address, ':') == NULL)? AF_INET : AF_INET6;
2788 sock = ip_socket(SOCK_STREAM, host_af);
2789 if (sock < 0) return;
2790
2791 if (ip_bind(sock, host_af, interface_address, 0) < 0)
2792 {
2793 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2794 strerror(errno));
2795 goto END_OFF;
2796 }
2797
2798 if (ip_connect(sock, host_af, sender_host_address, port, rfc1413_query_timeout)
2799 < 0)
2800 {
2801 if (errno == ETIMEDOUT && (log_extra_selector & LX_ident_timeout) != 0)
2802 {
2803 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2804 sender_host_address);
2805 }
2806 else
2807 {
2808 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2809 sender_host_address, strerror(errno));
2810 }
2811 goto END_OFF;
2812 }
2813
2814 /* Construct and send the query. */
2815
2816 sprintf(CS buffer, "%d , %d\r\n", sender_host_port, interface_port);
2817 qlen = Ustrlen(buffer);
2818 if (send(sock, buffer, qlen, 0) < 0)
2819 {
2820 DEBUG(D_ident) debug_printf("ident send failed: %s\n", strerror(errno));
2821 goto END_OFF;
2822 }
2823
2824 /* Read a response line. We put it into the rest of the buffer, using several
2825 recv() calls if necessary. */
2826
2827 p = buffer + qlen;
2828
2829 for (;;)
2830 {
2831 uschar *pp;
2832 int count;
2833 int size = sizeof(buffer) - (p - buffer);
2834
2835 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2836 count = ip_recv(sock, p, size, rfc1413_query_timeout);
2837 if (count <= 0) goto END_OFF; /* Read error or EOF */
2838
2839 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2840 generous, and accept a plain \n terminator as well. The only illegal
2841 character is 0. */
2842
2843 for (pp = p; pp < p + count; pp++)
2844 {
2845 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2846 if (*pp == '\n')
2847 {
2848 if (pp[-1] == '\r') pp--;
2849 *pp = 0;
2850 goto GOT_DATA; /* Break out of both loops */
2851 }
2852 }
2853
2854 /* Reached the end of the data without finding \n. Let the loop continue to
2855 read some more, if there is room. */
2856
2857 p = pp;
2858 }
2859
2860 GOT_DATA:
2861
2862 /* We have received a line of data. Check it carefully. It must start with the
2863 same two port numbers that we sent, followed by data as defined by the RFC. For
2864 example,
2865
2866 12345 , 25 : USERID : UNIX :root
2867
2868 However, the amount of white space may be different to what we sent. In the
2869 "osname" field there may be several sub-fields, comma separated. The data we
2870 actually want to save follows the third colon. Some systems put leading spaces
2871 in it - we discard those. */
2872
2873 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2874 &received_interface_port, &n) != 2 ||
2875 received_sender_port != sender_host_port ||
2876 received_interface_port != interface_port)
2877 goto END_OFF;
2878
2879 p = buffer + qlen + n;
2880 while(isspace(*p)) p++;
2881 if (*p++ != ':') goto END_OFF;
2882 while(isspace(*p)) p++;
2883 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2884 p += 6;
2885 while(isspace(*p)) p++;
2886 if (*p++ != ':') goto END_OFF;
2887 while (*p != 0 && *p != ':') p++;
2888 if (*p++ == 0) goto END_OFF;
2889 while(isspace(*p)) p++;
2890 if (*p == 0) goto END_OFF;
2891
2892 /* The rest of the line is the data we want. We turn it into printing
2893 characters when we save it, so that it cannot mess up the format of any logging
2894 or Received: lines into which it gets inserted. We keep a maximum of 127
2895 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
2896
2897 sender_ident = US string_printing(string_copyn(p, 127));
2898 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2899
2900 END_OFF:
2901 (void)close(sock);
2902 return;
2903 }
2904
2905
2906
2907
2908 /*************************************************
2909 * Match host to a single host-list item *
2910 *************************************************/
2911
2912 /* This function compares a host (name or address) against a single item
2913 from a host list. The host name gets looked up if it is needed and is not
2914 already known. The function is called from verify_check_this_host() via
2915 match_check_list(), which is why most of its arguments are in a single block.
2916
2917 Arguments:
2918 arg the argument block (see below)
2919 ss the host-list item
2920 valueptr where to pass back looked up data, or NULL
2921 error for error message when returning ERROR
2922
2923 The block contains:
2924 host_name (a) the host name, or
2925 (b) NULL, implying use sender_host_name and
2926 sender_host_aliases, looking them up if required, or
2927 (c) the empty string, meaning that only IP address matches
2928 are permitted
2929 host_address the host address
2930 host_ipv4 the IPv4 address taken from an IPv6 one
2931
2932 Returns: OK matched
2933 FAIL did not match
2934 DEFER lookup deferred
2935 ERROR (a) failed to find the host name or IP address, or
2936 (b) unknown lookup type specified, or
2937 (c) host name encountered when only IP addresses are
2938 being matched
2939 */
2940
2941 int
2942 check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
2943 {
2944 check_host_block *cb = (check_host_block *)arg;
2945 int mlen = -1;
2946 int maskoffset;
2947 BOOL iplookup = FALSE;
2948 BOOL isquery = FALSE;
2949 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
2950 const uschar *t;
2951 uschar *semicolon;
2952 uschar **aliases;
2953
2954 /* Optimize for the special case when the pattern is "*". */
2955
2956 if (*ss == '*' && ss[1] == 0) return OK;
2957
2958 /* If the pattern is empty, it matches only in the case when there is no host -
2959 this can occur in ACL checking for SMTP input using the -bs option. In this
2960 situation, the host address is the empty string. */
2961
2962 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2963 if (*ss == 0) return FAIL;
2964
2965 /* If the pattern is precisely "@" then match against the primary host name,
2966 provided that host name matching is permitted; if it's "@[]" match against the
2967 local host's IP addresses. */
2968
2969 if (*ss == '@')
2970 {
2971 if (ss[1] == 0)
2972 {
2973 if (isiponly) return ERROR;
2974 ss = primary_hostname;
2975 }
2976 else if (Ustrcmp(ss, "@[]") == 0)
2977 {
2978 ip_address_item *ip;
2979 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
2980 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2981 return FAIL;
2982 }
2983 }
2984
2985 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2986 a (possibly masked) comparision with the current IP address. */
2987
2988 if (string_is_ip_address(ss, &maskoffset) != 0)
2989 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2990
2991 /* The pattern is not an IP address. A common error that people make is to omit
2992 one component of an IPv4 address, either by accident, or believing that, for
2993 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2994 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2995 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2996 ancient specification.) To aid in debugging these cases, we give a specific
2997 error if the pattern contains only digits and dots or contains a slash preceded
2998 only by digits and dots (a slash at the start indicates a file name and of
2999 course slashes may be present in lookups, but not preceded only by digits and
3000 dots). */
3001
3002 for (t = ss; isdigit(*t) || *t == '.'; t++);
3003 if (*t == 0 || (*t == '/' && t != ss))
3004 {
3005 *error = US"malformed IPv4 address or address mask";
3006 return ERROR;
3007 }
3008
3009 /* See if there is a semicolon in the pattern */
3010
3011 semicolon = Ustrchr(ss, ';');
3012
3013 /* If we are doing an IP address only match, then all lookups must be IP
3014 address lookups, even if there is no "net-". */
3015
3016 if (isiponly)
3017 {
3018 iplookup = semicolon != NULL;
3019 }
3020
3021 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
3022 a lookup on a masked IP network, in textual form. We obey this code even if we
3023 have already set iplookup, so as to skip over the "net-" prefix and to set the
3024 mask length. The net- stuff really only applies to single-key lookups where the
3025 key is implicit. For query-style lookups the key is specified in the query.
3026 From release 4.30, the use of net- for query style is no longer needed, but we
3027 retain it for backward compatibility. */
3028
3029 if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
3030 {
3031 mlen = 0;
3032 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
3033 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
3034 iplookup = (*t++ == '-');
3035 }
3036 else t = ss;
3037
3038 /* Do the IP address lookup if that is indeed what we have */
3039
3040 if (iplookup)
3041 {
3042 int insize;
3043 int search_type;
3044 int incoming[4];
3045 void *handle;
3046 uschar *filename, *key, *result;
3047 uschar buffer[64];
3048
3049 /* Find the search type */
3050
3051 search_type = search_findtype(t, semicolon - t);
3052
3053 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3054 search_error_message);
3055
3056 /* Adjust parameters for the type of lookup. For a query-style lookup, there
3057 is no file name, and the "key" is just the query. For query-style with a file
3058 name, we have to fish the file off the start of the query. For a single-key
3059 lookup, the key is the current IP address, masked appropriately, and
3060 reconverted to text form, with the mask appended. For IPv6 addresses, specify
3061 dot separators instead of colons, except when the lookup type is "iplsearch".
3062 */
3063
3064 if (mac_islookup(search_type, lookup_absfilequery))
3065 {
3066 filename = semicolon + 1;
3067 key = filename;
3068 while (*key != 0 && !isspace(*key)) key++;
3069 filename = string_copyn(filename, key - filename);
3070 while (isspace(*key)) key++;
3071 }
3072 else if (mac_islookup(search_type, lookup_querystyle))
3073 {
3074 filename = NULL;
3075 key = semicolon + 1;
3076 }
3077 else /* Single-key style */
3078 {
3079 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
3080 ':' : '.';
3081 insize = host_aton(cb->host_address, incoming);
3082 host_mask(insize, incoming, mlen);
3083 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
3084 key = buffer;
3085 filename = semicolon + 1;
3086 }
3087
3088 /* Now do the actual lookup; note that there is no search_close() because
3089 of the caching arrangements. */
3090
3091 handle = search_open(filename, search_type, 0, NULL, NULL);
3092 if (handle == NULL) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3093 search_error_message);
3094 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
3095 if (valueptr != NULL) *valueptr = result;
3096 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
3097 }
3098
3099 /* The pattern is not an IP address or network reference of any kind. That is,
3100 it is a host name pattern. If this is an IP only match, there's an error in the
3101 host list. */
3102
3103 if (isiponly)
3104 {
3105 *error = US"cannot match host name in match_ip list";
3106 return ERROR;
3107 }
3108
3109 /* Check the characters of the pattern to see if they comprise only letters,
3110 digits, full stops, and hyphens (the constituents of domain names). Allow
3111 underscores, as they are all too commonly found. Sigh. Also, if
3112 allow_utf8_domains is set, allow top-bit characters. */
3113
3114 for (t = ss; *t != 0; t++)
3115 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3116 (!allow_utf8_domains || *t < 128)) break;
3117
3118 /* If the pattern is a complete domain name, with no fancy characters, look up
3119 its IP address and match against that. Note that a multi-homed host will add
3120 items to the chain. */
3121
3122 if (*t == 0)
3123 {
3124 int rc;
3125 host_item h;
3126 h.next = NULL;
3127 h.name = ss;
3128 h.address = NULL;
3129 h.mx = MX_NONE;
3130
3131 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3132 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3133 {
3134 host_item *hh;
3135 for (hh = &h; hh != NULL; hh = hh->next)
3136 {
3137 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3138 }
3139 return FAIL;
3140 }
3141 if (rc == HOST_FIND_AGAIN) return DEFER;
3142 *error = string_sprintf("failed to find IP address for %s", ss);
3143 return ERROR;
3144 }
3145
3146 /* Almost all subsequent comparisons require the host name, and can be done
3147 using the general string matching function. When this function is called for
3148 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3149 must use sender_host_name and its aliases, looking them up if necessary. */
3150
3151 if (cb->host_name != NULL) /* Explicit host name given */
3152 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3153 valueptr);
3154
3155 /* Host name not given; in principle we need the sender host name and its
3156 aliases. However, for query-style lookups, we do not need the name if the
3157 query does not contain $sender_host_name. From release 4.23, a reference to
3158 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3159 on spec. */
3160
3161 if ((semicolon = Ustrchr(ss, ';')) != NULL)
3162 {
3163 const uschar *affix;
3164 int partial, affixlen, starflags, id;
3165
3166 *semicolon = 0;
3167 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
3168 *semicolon=';';
3169
3170 if (id < 0) /* Unknown lookup type */
3171 {
3172 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3173 search_error_message, ss);
3174 return DEFER;
3175 }
3176 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3177 }
3178
3179 if (isquery)
3180 {
3181 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3182 {
3183 case OK: return OK;
3184 case DEFER: return DEFER;
3185 default: return FAIL;
3186 }
3187 }
3188
3189 /* Not a query-style lookup; must ensure the host name is present, and then we
3190 do a check on the name and all its aliases. */
3191
3192 if (sender_host_name == NULL)
3193 {
3194 HDEBUG(D_host_lookup)
3195 debug_printf("sender host name required, to match against %s\n", ss);
3196 if (host_lookup_failed || host_name_lookup() != OK)
3197 {
3198 *error = string_sprintf("failed to find host name for %s",
3199 sender_host_address);;
3200 return ERROR;
3201 }
3202 host_build_sender_fullhost();
3203 }
3204
3205 /* Match on the sender host name, using the general matching function */
3206
3207 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
3208 valueptr))
3209 {
3210 case OK: return OK;
3211 case DEFER: return DEFER;
3212 }
3213
3214 /* If there are aliases, try matching on them. */
3215
3216 aliases = sender_host_aliases;
3217 while (*aliases != NULL)
3218 {
3219 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3220 {
3221 case OK: return OK;
3222 case DEFER: return DEFER;
3223 }
3224 }
3225 return FAIL;
3226 }
3227
3228
3229
3230
3231 /*************************************************
3232 * Check a specific host matches a host list *
3233 *************************************************/
3234
3235 /* This function is passed a host list containing items in a number of
3236 different formats and the identity of a host. Its job is to determine whether
3237 the given host is in the set of hosts defined by the list. The host name is
3238 passed as a pointer so that it can be looked up if needed and not already
3239 known. This is commonly the case when called from verify_check_host() to check
3240 an incoming connection. When called from elsewhere the host name should usually
3241 be set.
3242
3243 This function is now just a front end to match_check_list(), which runs common
3244 code for scanning a list. We pass it the check_host() function to perform a
3245 single test.
3246
3247 Arguments:
3248 listptr pointer to the host list
3249 cache_bits pointer to cache for named lists, or NULL
3250 host_name the host name or NULL, implying use sender_host_name and
3251 sender_host_aliases, looking them up if required
3252 host_address the IP address
3253 valueptr if not NULL, data from a lookup is passed back here
3254
3255 Returns: OK if the host is in the defined set
3256 FAIL if the host is not in the defined set,
3257 DEFER if a data lookup deferred (not a host lookup)
3258
3259 If the host name was needed in order to make a comparison, and could not be
3260 determined from the IP address, the result is FAIL unless the item
3261 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3262
3263 int
3264 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3265 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3266 {
3267 int rc;
3268 unsigned int *local_cache_bits = cache_bits;
3269 const uschar *save_host_address = deliver_host_address;
3270 check_host_block cb;
3271 cb.host_name = host_name;
3272 cb.host_address = host_address;
3273
3274 if (valueptr != NULL) *valueptr = NULL;
3275
3276 /* If the host address starts off ::ffff: it is an IPv6 address in
3277 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3278 addresses. */
3279
3280 cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
3281 host_address + 7 : host_address;
3282
3283 /* During the running of the check, put the IP address into $host_address. In
3284 the case of calls from the smtp transport, it will already be there. However,
3285 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3286 the safe side, any existing setting is preserved, though as I write this
3287 (November 2004) I can't see any cases where it is actually needed. */
3288
3289 deliver_host_address = host_address;
3290 rc = match_check_list(
3291 listptr, /* the list */
3292 0, /* separator character */
3293 &hostlist_anchor, /* anchor pointer */
3294 &local_cache_bits, /* cache pointer */
3295 check_host, /* function for testing */
3296 &cb, /* argument for function */
3297 MCL_HOST, /* type of check */
3298 (host_address == sender_host_address)?
3299 US"host" : host_address, /* text for debugging */
3300 valueptr); /* where to pass back data */
3301 deliver_host_address = save_host_address;
3302 return rc;
3303 }
3304
3305
3306
3307
3308 /*************************************************
3309 * Check the given host item matches a list *
3310 *************************************************/
3311 int
3312 verify_check_given_host(uschar **listptr, host_item *host)
3313 {
3314 return verify_check_this_host(CUSS listptr, NULL, host->name, host->address, NULL);
3315 }
3316
3317 /*************************************************
3318 * Check the remote host matches a list *
3319 *************************************************/
3320
3321 /* This is a front end to verify_check_this_host(), created because checking
3322 the remote host is a common occurrence. With luck, a good compiler will spot
3323 the tail recursion and optimize it. If there's no host address, this is
3324 command-line SMTP input - check against an empty string for the address.
3325
3326 Arguments:
3327 listptr pointer to the host list
3328
3329 Returns: the yield of verify_check_this_host(),
3330 i.e. OK, FAIL, or DEFER
3331 */
3332
3333 int
3334 verify_check_host(uschar **listptr)
3335 {
3336 return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
3337 (sender_host_address == NULL)? US"" : sender_host_address, NULL);
3338 }
3339
3340
3341
3342
3343
3344 /*************************************************
3345 * Invert an IP address *
3346 *************************************************/
3347
3348 /* Originally just used for DNS xBL lists, now also used for the
3349 reverse_ip expansion operator.
3350
3351 Arguments:
3352 buffer where to put the answer
3353 address the address to invert
3354 */
3355
3356 void
3357 invert_address(uschar *buffer, uschar *address)
3358 {
3359 int bin[4];
3360 uschar *bptr = buffer;
3361
3362 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3363 to the IPv4 part only. */
3364
3365 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3366
3367 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3368 always 1. */
3369
3370 if (host_aton(address, bin) == 1)
3371 {
3372 int i;
3373 int x = bin[0];
3374 for (i = 0; i < 4; i++)
3375 {
3376 sprintf(CS bptr, "%d.", x & 255);
3377 while (*bptr) bptr++;
3378 x >>= 8;
3379 }
3380 }
3381
3382 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3383 in any DNS black lists, and the format in which they will be looked up is
3384 unknown. This is just a guess. */
3385
3386 #if HAVE_IPV6
3387 else
3388 {
3389 int i, j;
3390 for (j = 3; j >= 0; j--)
3391 {
3392 int x = bin[j];
3393 for (i = 0; i < 8; i++)
3394 {
3395 sprintf(CS bptr, "%x.", x & 15);
3396 while (*bptr) bptr++;
3397 x >>= 4;
3398 }
3399 }
3400 }
3401 #endif
3402
3403 /* Remove trailing period -- this is needed so that both arbitrary
3404 dnsbl keydomains and inverted addresses may be combined with the
3405 same format string, "%s.%s" */
3406
3407 *(--bptr) = 0;
3408 }
3409
3410
3411
3412 /*************************************************
3413 * Perform a single dnsbl lookup *
3414 *************************************************/
3415
3416 /* This function is called from verify_check_dnsbl() below. It is also called
3417 recursively from within itself when domain and domain_txt are different
3418 pointers, in order to get the TXT record from the alternate domain.
3419
3420 Arguments:
3421 domain the outer dnsbl domain
3422 domain_txt alternate domain to lookup TXT record on success; when the
3423 same domain is to be used, domain_txt == domain (that is,
3424 the pointers must be identical, not just the text)
3425 keydomain the current keydomain (for debug message)
3426 prepend subdomain to lookup (like keydomain, but
3427 reversed if IP address)
3428 iplist the list of matching IP addresses, or NULL for "any"
3429 bitmask true if bitmask matching is wanted
3430 match_type condition for 'succeed' result
3431 0 => Any RR in iplist (=)
3432 1 => No RR in iplist (!=)
3433 2 => All RRs in iplist (==)
3434 3 => Some RRs not in iplist (!==)
3435 the two bits are defined as MT_NOT and MT_ALL
3436 defer_return what to return for a defer
3437
3438 Returns: OK if lookup succeeded
3439 FAIL if not
3440 */
3441
3442 static int
3443 one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain,
3444 uschar *prepend, uschar *iplist, BOOL bitmask, int match_type,
3445 int defer_return)
3446 {
3447 dns_answer dnsa;
3448 dns_scan dnss;
3449 tree_node *t;
3450 dnsbl_cache_block *cb;
3451 int old_pool = store_pool;
3452 uschar query[256]; /* DNS domain max length */
3453
3454 /* Construct the specific query domainname */
3455
3456