Merge branch 'master' into dane
[exim.git] / src / src / verify.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions concerned with verifying things. The original code for callout
9 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
10
11
12 #include "exim.h"
13 #include "transports/smtp.h"
14
15 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
17 address_item cutthrough_addr;
18 static smtp_outblock ctblock;
19 uschar ctbuffer[8192];
20
21
22 /* Structure for caching DNSBL lookups */
23
24 typedef struct dnsbl_cache_block {
25 dns_address *rhs;
26 uschar *text;
27 int rc;
28 BOOL text_set;
29 } dnsbl_cache_block;
30
31
32 /* Anchor for DNSBL cache */
33
34 static tree_node *dnsbl_cache = NULL;
35
36
37 /* Bits for match_type in one_check_dnsbl() */
38
39 #define MT_NOT 1
40 #define MT_ALL 2
41
42
43
44 /*************************************************
45 * Retrieve a callout cache record *
46 *************************************************/
47
48 /* If a record exists, check whether it has expired.
49
50 Arguments:
51 dbm_file an open hints file
52 key the record key
53 type "address" or "domain"
54 positive_expire expire time for positive records
55 negative_expire expire time for negative records
56
57 Returns: the cache record if a non-expired one exists, else NULL
58 */
59
60 static dbdata_callout_cache *
61 get_callout_cache_record(open_db *dbm_file, uschar *key, uschar *type,
62 int positive_expire, int negative_expire)
63 {
64 BOOL negative;
65 int length, expire;
66 time_t now;
67 dbdata_callout_cache *cache_record;
68
69 cache_record = dbfn_read_with_length(dbm_file, key, &length);
70
71 if (cache_record == NULL)
72 {
73 HDEBUG(D_verify) debug_printf("callout cache: no %s record found\n", type);
74 return NULL;
75 }
76
77 /* We treat a record as "negative" if its result field is not positive, or if
78 it is a domain record and the postmaster field is negative. */
79
80 negative = cache_record->result != ccache_accept ||
81 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
82 expire = negative? negative_expire : positive_expire;
83 now = time(NULL);
84
85 if (now - cache_record->time_stamp > expire)
86 {
87 HDEBUG(D_verify) debug_printf("callout cache: %s record expired\n", type);
88 return NULL;
89 }
90
91 /* If this is a non-reject domain record, check for the obsolete format version
92 that doesn't have the postmaster and random timestamps, by looking at the
93 length. If so, copy it to a new-style block, replicating the record's
94 timestamp. Then check the additional timestamps. (There's no point wasting
95 effort if connections are rejected.) */
96
97 if (type[0] == 'd' && cache_record->result != ccache_reject)
98 {
99 if (length == sizeof(dbdata_callout_cache_obs))
100 {
101 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
102 memcpy(new, cache_record, length);
103 new->postmaster_stamp = new->random_stamp = new->time_stamp;
104 cache_record = new;
105 }
106
107 if (now - cache_record->postmaster_stamp > expire)
108 cache_record->postmaster_result = ccache_unknown;
109
110 if (now - cache_record->random_stamp > expire)
111 cache_record->random_result = ccache_unknown;
112 }
113
114 HDEBUG(D_verify) debug_printf("callout cache: found %s record\n", type);
115 return cache_record;
116 }
117
118
119
120 /*************************************************
121 * Do callout verification for an address *
122 *************************************************/
123
124 /* This function is called from verify_address() when the address has routed to
125 a host list, and a callout has been requested. Callouts are expensive; that is
126 why a cache is used to improve the efficiency.
127
128 Arguments:
129 addr the address that's been routed
130 host_list the list of hosts to try
131 tf the transport feedback block
132
133 ifstring "interface" option from transport, or NULL
134 portstring "port" option from transport, or NULL
135 protocolstring "protocol" option from transport, or NULL
136 callout the per-command callout timeout
137 callout_overall the overall callout timeout (if < 0 use 4*callout)
138 callout_connect the callout connection timeout (if < 0 use callout)
139 options the verification options - these bits are used:
140 vopt_is_recipient => this is a recipient address
141 vopt_callout_no_cache => don't use callout cache
142 vopt_callout_fullpm => if postmaster check, do full one
143 vopt_callout_random => do the "random" thing
144 vopt_callout_recipsender => use real sender for recipient
145 vopt_callout_recippmaster => use postmaster for recipient
146 se_mailfrom MAIL FROM address for sender verify; NULL => ""
147 pm_mailfrom if non-NULL, do the postmaster check with this sender
148
149 Returns: OK/FAIL/DEFER
150 */
151
152 static int
153 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
154 int callout, int callout_overall, int callout_connect, int options,
155 uschar *se_mailfrom, uschar *pm_mailfrom)
156 {
157 BOOL is_recipient = (options & vopt_is_recipient) != 0;
158 BOOL callout_no_cache = (options & vopt_callout_no_cache) != 0;
159 BOOL callout_random = (options & vopt_callout_random) != 0;
160
161 int yield = OK;
162 int old_domain_cache_result = ccache_accept;
163 BOOL done = FALSE;
164 uschar *address_key;
165 uschar *from_address;
166 uschar *random_local_part = NULL;
167 uschar *save_deliver_domain = deliver_domain;
168 uschar **failure_ptr = is_recipient?
169 &recipient_verify_failure : &sender_verify_failure;
170 open_db dbblock;
171 open_db *dbm_file = NULL;
172 dbdata_callout_cache new_domain_record;
173 dbdata_callout_cache_address new_address_record;
174 host_item *host;
175 time_t callout_start_time;
176
177 new_domain_record.result = ccache_unknown;
178 new_domain_record.postmaster_result = ccache_unknown;
179 new_domain_record.random_result = ccache_unknown;
180
181 memset(&new_address_record, 0, sizeof(new_address_record));
182
183 /* For a recipient callout, the key used for the address cache record must
184 include the sender address if we are using the real sender in the callout,
185 because that may influence the result of the callout. */
186
187 address_key = addr->address;
188 from_address = US"";
189
190 if (is_recipient)
191 {
192 if ((options & vopt_callout_recipsender) != 0)
193 {
194 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
195 from_address = sender_address;
196 }
197 else if ((options & vopt_callout_recippmaster) != 0)
198 {
199 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
200 qualify_domain_sender);
201 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
202 }
203 }
204
205 /* For a sender callout, we must adjust the key if the mailfrom address is not
206 empty. */
207
208 else
209 {
210 from_address = (se_mailfrom == NULL)? US"" : se_mailfrom;
211 if (from_address[0] != 0)
212 address_key = string_sprintf("%s/<%s>", addr->address, from_address);
213 }
214
215 /* Open the callout cache database, it it exists, for reading only at this
216 stage, unless caching has been disabled. */
217
218 if (callout_no_cache)
219 {
220 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
221 }
222 else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
223 {
224 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
225 }
226
227 /* If a cache database is available see if we can avoid the need to do an
228 actual callout by making use of previously-obtained data. */
229
230 if (dbm_file != NULL)
231 {
232 dbdata_callout_cache_address *cache_address_record;
233 dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
234 addr->domain, US"domain",
235 callout_cache_domain_positive_expire,
236 callout_cache_domain_negative_expire);
237
238 /* If an unexpired cache record was found for this domain, see if the callout
239 process can be short-circuited. */
240
241 if (cache_record != NULL)
242 {
243 /* In most cases, if an early command (up to and including MAIL FROM:<>)
244 was rejected, there is no point carrying on. The callout fails. However, if
245 we are doing a recipient verification with use_sender or use_postmaster
246 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
247 will be using a non-empty sender. We have to remember this situation so as
248 not to disturb the cached domain value if this whole verification succeeds
249 (we don't want it turning into "accept"). */
250
251 old_domain_cache_result = cache_record->result;
252
253 if (cache_record->result == ccache_reject ||
254 (*from_address == 0 && cache_record->result == ccache_reject_mfnull))
255 {
256 setflag(addr, af_verify_nsfail);
257 HDEBUG(D_verify)
258 debug_printf("callout cache: domain gave initial rejection, or "
259 "does not accept HELO or MAIL FROM:<>\n");
260 setflag(addr, af_verify_nsfail);
261 addr->user_message = US"(result of an earlier callout reused).";
262 yield = FAIL;
263 *failure_ptr = US"mail";
264 goto END_CALLOUT;
265 }
266
267 /* If a previous check on a "random" local part was accepted, we assume
268 that the server does not do any checking on local parts. There is therefore
269 no point in doing the callout, because it will always be successful. If a
270 random check previously failed, arrange not to do it again, but preserve
271 the data in the new record. If a random check is required but hasn't been
272 done, skip the remaining cache processing. */
273
274 if (callout_random) switch(cache_record->random_result)
275 {
276 case ccache_accept:
277 HDEBUG(D_verify)
278 debug_printf("callout cache: domain accepts random addresses\n");
279 goto END_CALLOUT; /* Default yield is OK */
280
281 case ccache_reject:
282 HDEBUG(D_verify)
283 debug_printf("callout cache: domain rejects random addresses\n");
284 callout_random = FALSE;
285 new_domain_record.random_result = ccache_reject;
286 new_domain_record.random_stamp = cache_record->random_stamp;
287 break;
288
289 default:
290 HDEBUG(D_verify)
291 debug_printf("callout cache: need to check random address handling "
292 "(not cached or cache expired)\n");
293 goto END_CACHE;
294 }
295
296 /* If a postmaster check is requested, but there was a previous failure,
297 there is again no point in carrying on. If a postmaster check is required,
298 but has not been done before, we are going to have to do a callout, so skip
299 remaining cache processing. */
300
301 if (pm_mailfrom != NULL)
302 {
303 if (cache_record->postmaster_result == ccache_reject)
304 {
305 setflag(addr, af_verify_pmfail);
306 HDEBUG(D_verify)
307 debug_printf("callout cache: domain does not accept "
308 "RCPT TO:<postmaster@domain>\n");
309 yield = FAIL;
310 *failure_ptr = US"postmaster";
311 setflag(addr, af_verify_pmfail);
312 addr->user_message = US"(result of earlier verification reused).";
313 goto END_CALLOUT;
314 }
315 if (cache_record->postmaster_result == ccache_unknown)
316 {
317 HDEBUG(D_verify)
318 debug_printf("callout cache: need to check RCPT "
319 "TO:<postmaster@domain> (not cached or cache expired)\n");
320 goto END_CACHE;
321 }
322
323 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
324 postmaster check if the address itself has to be checked. Also ensure
325 that the value in the cache record is preserved (with its old timestamp).
326 */
327
328 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
329 "TO:<postmaster@domain>\n");
330 pm_mailfrom = NULL;
331 new_domain_record.postmaster_result = ccache_accept;
332 new_domain_record.postmaster_stamp = cache_record->postmaster_stamp;
333 }
334 }
335
336 /* We can't give a result based on information about the domain. See if there
337 is an unexpired cache record for this specific address (combined with the
338 sender address if we are doing a recipient callout with a non-empty sender).
339 */
340
341 cache_address_record = (dbdata_callout_cache_address *)
342 get_callout_cache_record(dbm_file,
343 address_key, US"address",
344 callout_cache_positive_expire,
345 callout_cache_negative_expire);
346
347 if (cache_address_record != NULL)
348 {
349 if (cache_address_record->result == ccache_accept)
350 {
351 HDEBUG(D_verify)
352 debug_printf("callout cache: address record is positive\n");
353 }
354 else
355 {
356 HDEBUG(D_verify)
357 debug_printf("callout cache: address record is negative\n");
358 addr->user_message = US"Previous (cached) callout verification failure";
359 *failure_ptr = US"recipient";
360 yield = FAIL;
361 }
362 goto END_CALLOUT;
363 }
364
365 /* Close the cache database while we actually do the callout for real. */
366
367 END_CACHE:
368 dbfn_close(dbm_file);
369 dbm_file = NULL;
370 }
371
372 if (!addr->transport)
373 {
374 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
375 }
376 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
377 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
378 addr->transport->name, addr->transport->driver_name);
379 else
380 {
381 smtp_transport_options_block *ob =
382 (smtp_transport_options_block *)addr->transport->options_block;
383
384 /* The information wasn't available in the cache, so we have to do a real
385 callout and save the result in the cache for next time, unless no_cache is set,
386 or unless we have a previously cached negative random result. If we are to test
387 with a random local part, ensure that such a local part is available. If not,
388 log the fact, but carry on without randomming. */
389
390 if (callout_random && callout_random_local_part != NULL)
391 {
392 random_local_part = expand_string(callout_random_local_part);
393 if (random_local_part == NULL)
394 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
395 "callout_random_local_part: %s", expand_string_message);
396 }
397
398 /* Default the connect and overall callout timeouts if not set, and record the
399 time we are starting so that we can enforce it. */
400
401 if (callout_overall < 0) callout_overall = 4 * callout;
402 if (callout_connect < 0) callout_connect = callout;
403 callout_start_time = time(NULL);
404
405 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
406 output because a callout might take some time. When PIPELINING is active and
407 there are many recipients, the total time for doing lots of callouts can add up
408 and cause the client to time out. So in this case we forgo the PIPELINING
409 optimization. */
410
411 if (smtp_out != NULL && !disable_callout_flush) mac_smtp_fflush();
412
413 /* Now make connections to the hosts and do real callouts. The list of hosts
414 is passed in as an argument. */
415
416 for (host = host_list; host != NULL && !done; host = host->next)
417 {
418 smtp_inblock inblock;
419 smtp_outblock outblock;
420 int host_af;
421 int port = 25;
422 BOOL send_quit = TRUE;
423 uschar *active_hostname = smtp_active_hostname;
424 BOOL lmtp;
425 BOOL smtps;
426 BOOL esmtp;
427 BOOL suppress_tls = FALSE;
428 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
429 uschar inbuffer[4096];
430 uschar outbuffer[1024];
431 uschar responsebuffer[4096];
432
433 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
434 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
435
436 /* Skip this host if we don't have an IP address for it. */
437
438 if (host->address == NULL)
439 {
440 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
441 host->name);
442 continue;
443 }
444
445 /* Check the overall callout timeout */
446
447 if (time(NULL) - callout_start_time >= callout_overall)
448 {
449 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
450 break;
451 }
452
453 /* Set IPv4 or IPv6 */
454
455 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
456
457 /* Expand and interpret the interface and port strings. The latter will not
458 be used if there is a host-specific port (e.g. from a manualroute router).
459 This has to be delayed till now, because they may expand differently for
460 different hosts. If there's a failure, log it, but carry on with the
461 defaults. */
462
463 deliver_host = host->name;
464 deliver_host_address = host->address;
465 deliver_host_port = host->port;
466 deliver_domain = addr->domain;
467
468 if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
469 US"callout") ||
470 !smtp_get_port(tf->port, addr, &port, US"callout"))
471 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
472 addr->message);
473
474 /* Set HELO string according to the protocol */
475 lmtp= Ustrcmp(tf->protocol, "lmtp") == 0;
476 smtps= Ustrcmp(tf->protocol, "smtps") == 0;
477
478
479 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", interface, port);
480
481 /* Set up the buffer for reading SMTP response packets. */
482
483 inblock.buffer = inbuffer;
484 inblock.buffersize = sizeof(inbuffer);
485 inblock.ptr = inbuffer;
486 inblock.ptrend = inbuffer;
487
488 /* Set up the buffer for holding SMTP commands while pipelining */
489
490 outblock.buffer = outbuffer;
491 outblock.buffersize = sizeof(outbuffer);
492 outblock.ptr = outbuffer;
493 outblock.cmd_count = 0;
494 outblock.authenticating = FALSE;
495
496 /* Reset the parameters of a TLS session */
497 tls_out.cipher = tls_out.peerdn = NULL;
498
499 /* Connect to the host; on failure, just loop for the next one, but we
500 set the error for the last one. Use the callout_connect timeout. */
501
502 tls_retry_connection:
503
504 inblock.sock = outblock.sock =
505 smtp_connect(host, host_af, port, interface, callout_connect, TRUE, NULL
506 #ifdef EXPERIMENTAL_TPDA
507 /*XXX tpda action? NULL for now. */
508 , NULL
509 #endif
510 );
511 /* reconsider DSCP here */
512 if (inblock.sock < 0)
513 {
514 addr->message = string_sprintf("could not connect to %s [%s]: %s",
515 host->name, host->address, strerror(errno));
516 deliver_host = deliver_host_address = NULL;
517 deliver_domain = save_deliver_domain;
518 continue;
519 }
520
521 /* Expand the helo_data string to find the host name to use. */
522
523 if (tf->helo_data != NULL)
524 {
525 uschar *s = expand_string(tf->helo_data);
526 if (s == NULL)
527 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
528 "helo_data value for callout: %s", addr->address,
529 expand_string_message);
530 else active_hostname = s;
531 }
532
533 /* Wait for initial response, and send HELO. The smtp_write_command()
534 function leaves its command in big_buffer. This is used in error responses.
535 Initialize it in case the connection is rejected. */
536
537 Ustrcpy(big_buffer, "initial connection");
538
539 /* Unless ssl-on-connect, wait for the initial greeting */
540 smtps_redo_greeting:
541
542 #ifdef SUPPORT_TLS
543 if (!smtps || (smtps && tls_out.active >= 0))
544 #endif
545 {
546 if (!(done= smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout)))
547 goto RESPONSE_FAILED;
548
549 #ifdef EXPERIMENTAL_TPDA
550 if (tpda_raise_event(addr->transport->tpda_event_action,
551 US"smtp:connect", responsebuffer) == DEFER)
552 {
553 /* Logging? Debug? */
554 goto RESPONSE_FAILED;
555 }
556 #endif
557 }
558
559 /* Not worth checking greeting line for ESMTP support */
560 if (!(esmtp = verify_check_this_host(&(ob->hosts_avoid_esmtp), NULL,
561 host->name, host->address, NULL) != OK))
562 DEBUG(D_transport)
563 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
564
565 tls_redo_helo:
566
567 #ifdef SUPPORT_TLS
568 if (smtps && tls_out.active < 0) /* ssl-on-connect, first pass */
569 {
570 tls_offered = TRUE;
571 ob->tls_tempfail_tryclear = FALSE;
572 }
573 else /* all other cases */
574 #endif
575
576 { esmtp_retry:
577
578 if (!(done= smtp_write_command(&outblock, FALSE, "%s %s\r\n",
579 !esmtp? "HELO" : lmtp? "LHLO" : "EHLO", active_hostname) >= 0))
580 goto SEND_FAILED;
581 if (!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout))
582 {
583 if (errno != 0 || responsebuffer[0] == 0 || lmtp || !esmtp || tls_out.active >= 0)
584 {
585 done= FALSE;
586 goto RESPONSE_FAILED;
587 }
588 #ifdef SUPPORT_TLS
589 tls_offered = FALSE;
590 #endif
591 esmtp = FALSE;
592 goto esmtp_retry; /* fallback to HELO */
593 }
594
595 /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
596 #ifdef SUPPORT_TLS
597 if (esmtp && !suppress_tls && tls_out.active < 0)
598 {
599 if (regex_STARTTLS == NULL) regex_STARTTLS =
600 regex_must_compile(US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)", FALSE, TRUE);
601
602 tls_offered = pcre_exec(regex_STARTTLS, NULL, CS responsebuffer,
603 Ustrlen(responsebuffer), 0, PCRE_EOPT, NULL, 0) >= 0;
604 }
605 else
606 tls_offered = FALSE;
607 #endif
608 }
609
610 /* If TLS is available on this connection attempt to
611 start up a TLS session, unless the host is in hosts_avoid_tls. If successful,
612 send another EHLO - the server may give a different answer in secure mode. We
613 use a separate buffer for reading the response to STARTTLS so that if it is
614 negative, the original EHLO data is available for subsequent analysis, should
615 the client not be required to use TLS. If the response is bad, copy the buffer
616 for error analysis. */
617
618 #ifdef SUPPORT_TLS
619 if (tls_offered &&
620 verify_check_this_host(&(ob->hosts_avoid_tls), NULL, host->name,
621 host->address, NULL) != OK &&
622 verify_check_this_host(&(ob->hosts_verify_avoid_tls), NULL, host->name,
623 host->address, NULL) != OK
624 )
625 {
626 uschar buffer2[4096];
627 if ( !smtps
628 && !(done= smtp_write_command(&outblock, FALSE, "STARTTLS\r\n") >= 0))
629 goto SEND_FAILED;
630
631 /* If there is an I/O error, transmission of this message is deferred. If
632 there is a temporary rejection of STARRTLS and tls_tempfail_tryclear is
633 false, we also defer. However, if there is a temporary rejection of STARTTLS
634 and tls_tempfail_tryclear is true, or if there is an outright rejection of
635 STARTTLS, we carry on. This means we will try to send the message in clear,
636 unless the host is in hosts_require_tls (tested below). */
637
638 if (!smtps && !smtp_read_response(&inblock, buffer2, sizeof(buffer2), '2',
639 ob->command_timeout))
640 {
641 if (errno != 0 || buffer2[0] == 0 ||
642 (buffer2[0] == '4' && !ob->tls_tempfail_tryclear))
643 {
644 Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
645 done= FALSE;
646 goto RESPONSE_FAILED;
647 }
648 }
649
650 /* STARTTLS accepted or ssl-on-connect: try to negotiate a TLS session. */
651 else
652 {
653 int oldtimeout = ob->command_timeout;
654 int rc;
655
656 ob->command_timeout = callout;
657 rc = tls_client_start(inblock.sock, host, addr, addr->transport);
658 ob->command_timeout = oldtimeout;
659
660 /* TLS negotiation failed; give an error. Try in clear on a new connection,
661 if the options permit it for this host. */
662 if (rc != OK)
663 {
664 if ( rc == DEFER
665 && ob->tls_tempfail_tryclear
666 && !smtps
667 && verify_check_this_host(&(ob->hosts_require_tls), NULL,
668 host->name, host->address, NULL) != OK
669 #ifdef EXPERIMENTAL_DANE
670 && verify_check_this_host(&(ob->hosts_require_dane), NULL,
671 host->name, host->address, NULL) != OK
672 #endif
673 )
674 {
675 (void)close(inblock.sock);
676 log_write(0, LOG_MAIN, "TLS session failure: delivering unencrypted "
677 "to %s [%s] (not in hosts_require_tls)", host->name, host->address);
678 suppress_tls = TRUE;
679 goto tls_retry_connection;
680 }
681 /*save_errno = ERRNO_TLSFAILURE;*/
682 /*message = US"failure while setting up TLS session";*/
683 send_quit = FALSE;
684 done= FALSE;
685 goto TLS_FAILED;
686 }
687
688 /* TLS session is set up. Copy info for logging. */
689 addr->cipher = tls_out.cipher;
690 addr->peerdn = tls_out.peerdn;
691
692 /* For SMTPS we need to wait for the initial OK response, then do HELO. */
693 if (smtps)
694 goto smtps_redo_greeting;
695
696 /* For STARTTLS we need to redo EHLO */
697 goto tls_redo_helo;
698 }
699 }
700
701 /* If the host is required to use a secure channel, ensure that we have one. */
702 if (tls_out.active < 0)
703 if ( verify_check_this_host(&(ob->hosts_require_tls), NULL, host->name,
704 host->address, NULL) == OK
705 #ifdef EXPERIMENTAL_DANE
706 || verify_check_this_host(&(ob->hosts_require_dane), NULL, host->name,
707 host->address, NULL) == OK
708 #endif
709 )
710 {
711 /*save_errno = ERRNO_TLSREQUIRED;*/
712 log_write(0, LOG_MAIN, "a TLS session is required for %s [%s], but %s",
713 host->name, host->address,
714 tls_offered? "an attempt to start TLS failed" : "the server did not offer TLS support");
715 done= FALSE;
716 goto TLS_FAILED;
717 }
718
719 #endif /*SUPPORT_TLS*/
720
721 done = TRUE; /* so far so good; have response to HELO */
722
723 /*XXX the EHLO response would be analyzed here for IGNOREQUOTA, SIZE, PIPELINING */
724
725 /* For now, transport_filter by cutthrough-delivery is not supported */
726 /* Need proper integration with the proper transport mechanism. */
727 if (cutthrough_delivery)
728 {
729 if (addr->transport->filter_command)
730 {
731 cutthrough_delivery= FALSE;
732 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
733 }
734 #ifndef DISABLE_DKIM
735 if (ob->dkim_domain)
736 {
737 cutthrough_delivery= FALSE;
738 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
739 }
740 #endif
741 }
742
743 SEND_FAILED:
744 RESPONSE_FAILED:
745 TLS_FAILED:
746 ;
747 /* Clear down of the TLS, SMTP and TCP layers on error is handled below. */
748
749 /* Failure to accept HELO is cached; this blocks the whole domain for all
750 senders. I/O errors and defer responses are not cached. */
751
752 if (!done)
753 {
754 *failure_ptr = US"mail"; /* At or before MAIL */
755 if (errno == 0 && responsebuffer[0] == '5')
756 {
757 setflag(addr, af_verify_nsfail);
758 new_domain_record.result = ccache_reject;
759 }
760 }
761
762 /* If we haven't authenticated, but are required to, give up. */
763 /* Try to AUTH */
764
765 else done = smtp_auth(responsebuffer, sizeof(responsebuffer),
766 addr, host, ob, esmtp, &inblock, &outblock) == OK &&
767
768 /* Copy AUTH info for logging */
769 ( (addr->authenticator = client_authenticator),
770 (addr->auth_id = client_authenticated_id),
771
772 /* Build a mail-AUTH string (re-using responsebuffer for convenience */
773 !smtp_mail_auth_str(responsebuffer, sizeof(responsebuffer), addr, ob)
774 ) &&
775
776 ( (addr->auth_sndr = client_authenticated_sender),
777
778 /* Send the MAIL command */
779 (smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>%s\r\n",
780 from_address, responsebuffer) >= 0)
781 ) &&
782
783 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
784 '2', callout);
785
786 deliver_host = deliver_host_address = NULL;
787 deliver_domain = save_deliver_domain;
788
789 /* If the host does not accept MAIL FROM:<>, arrange to cache this
790 information, but again, don't record anything for an I/O error or a defer. Do
791 not cache rejections of MAIL when a non-empty sender has been used, because
792 that blocks the whole domain for all senders. */
793
794 if (!done)
795 {
796 *failure_ptr = US"mail"; /* At or before MAIL */
797 if (errno == 0 && responsebuffer[0] == '5')
798 {
799 setflag(addr, af_verify_nsfail);
800 if (from_address[0] == 0)
801 new_domain_record.result = ccache_reject_mfnull;
802 }
803 }
804
805 /* Otherwise, proceed to check a "random" address (if required), then the
806 given address, and the postmaster address (if required). Between each check,
807 issue RSET, because some servers accept only one recipient after MAIL
808 FROM:<>.
809
810 Before doing this, set the result in the domain cache record to "accept",
811 unless its previous value was ccache_reject_mfnull. In that case, the domain
812 rejects MAIL FROM:<> and we want to continue to remember that. When that is
813 the case, we have got here only in the case of a recipient verification with
814 a non-null sender. */
815
816 else
817 {
818 new_domain_record.result =
819 (old_domain_cache_result == ccache_reject_mfnull)?
820 ccache_reject_mfnull: ccache_accept;
821
822 /* Do the random local part check first */
823
824 if (random_local_part != NULL)
825 {
826 uschar randombuffer[1024];
827 BOOL random_ok =
828 smtp_write_command(&outblock, FALSE,
829 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part,
830 addr->domain) >= 0 &&
831 smtp_read_response(&inblock, randombuffer,
832 sizeof(randombuffer), '2', callout);
833
834 /* Remember when we last did a random test */
835
836 new_domain_record.random_stamp = time(NULL);
837
838 /* If accepted, we aren't going to do any further tests below. */
839
840 if (random_ok)
841 {
842 new_domain_record.random_result = ccache_accept;
843 }
844
845 /* Otherwise, cache a real negative response, and get back to the right
846 state to send RCPT. Unless there's some problem such as a dropped
847 connection, we expect to succeed, because the commands succeeded above. */
848
849 else if (errno == 0)
850 {
851 if (randombuffer[0] == '5')
852 new_domain_record.random_result = ccache_reject;
853
854 done =
855 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
856 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
857 '2', callout) &&
858
859 smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>\r\n",
860 from_address) >= 0 &&
861 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
862 '2', callout);
863 }
864 else done = FALSE; /* Some timeout/connection problem */
865 } /* Random check */
866
867 /* If the host is accepting all local parts, as determined by the "random"
868 check, we don't need to waste time doing any further checking. */
869
870 if (new_domain_record.random_result != ccache_accept && done)
871 {
872 /* Get the rcpt_include_affixes flag from the transport if there is one,
873 but assume FALSE if there is not. */
874
875 done =
876 smtp_write_command(&outblock, FALSE, "RCPT TO:<%.1000s>\r\n",
877 transport_rcpt_address(addr,
878 (addr->transport == NULL)? FALSE :
879 addr->transport->rcpt_include_affixes)) >= 0 &&
880 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
881 '2', callout);
882
883 if (done)
884 new_address_record.result = ccache_accept;
885 else if (errno == 0 && responsebuffer[0] == '5')
886 {
887 *failure_ptr = US"recipient";
888 new_address_record.result = ccache_reject;
889 }
890
891 /* Do postmaster check if requested; if a full check is required, we
892 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
893
894 if (done && pm_mailfrom != NULL)
895 {
896 /*XXX not suitable for cutthrough - sequencing problems */
897 cutthrough_delivery= FALSE;
898 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of postmaster verify\n");
899
900 done =
901 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
902 smtp_read_response(&inblock, responsebuffer,
903 sizeof(responsebuffer), '2', callout) &&
904
905 smtp_write_command(&outblock, FALSE,
906 "MAIL FROM:<%s>\r\n", pm_mailfrom) >= 0 &&
907 smtp_read_response(&inblock, responsebuffer,
908 sizeof(responsebuffer), '2', callout) &&
909
910 /* First try using the current domain */
911
912 ((
913 smtp_write_command(&outblock, FALSE,
914 "RCPT TO:<postmaster@%.1000s>\r\n", addr->domain) >= 0 &&
915 smtp_read_response(&inblock, responsebuffer,
916 sizeof(responsebuffer), '2', callout)
917 )
918
919 ||
920
921 /* If that doesn't work, and a full check is requested,
922 try without the domain. */
923
924 (
925 (options & vopt_callout_fullpm) != 0 &&
926 smtp_write_command(&outblock, FALSE,
927 "RCPT TO:<postmaster>\r\n") >= 0 &&
928 smtp_read_response(&inblock, responsebuffer,
929 sizeof(responsebuffer), '2', callout)
930 ));
931
932 /* Sort out the cache record */
933
934 new_domain_record.postmaster_stamp = time(NULL);
935
936 if (done)
937 new_domain_record.postmaster_result = ccache_accept;
938 else if (errno == 0 && responsebuffer[0] == '5')
939 {
940 *failure_ptr = US"postmaster";
941 setflag(addr, af_verify_pmfail);
942 new_domain_record.postmaster_result = ccache_reject;
943 }
944 }
945 } /* Random not accepted */
946 } /* MAIL FROM: accepted */
947
948 /* For any failure of the main check, other than a negative response, we just
949 close the connection and carry on. We can identify a negative response by the
950 fact that errno is zero. For I/O errors it will be non-zero
951
952 Set up different error texts for logging and for sending back to the caller
953 as an SMTP response. Log in all cases, using a one-line format. For sender
954 callouts, give a full response to the caller, but for recipient callouts,
955 don't give the IP address because this may be an internal host whose identity
956 is not to be widely broadcast. */
957
958 if (!done)
959 {
960 if (errno == ETIMEDOUT)
961 {
962 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
963 send_quit = FALSE;
964 }
965 else if (errno == 0)
966 {
967 if (*responsebuffer == 0) Ustrcpy(responsebuffer, US"connection dropped");
968
969 addr->message =
970 string_sprintf("response to \"%s\" from %s [%s] was: %s",
971 big_buffer, host->name, host->address,
972 string_printing(responsebuffer));
973
974 addr->user_message = is_recipient?
975 string_sprintf("Callout verification failed:\n%s", responsebuffer)
976 :
977 string_sprintf("Called: %s\nSent: %s\nResponse: %s",
978 host->address, big_buffer, responsebuffer);
979
980 /* Hard rejection ends the process */
981
982 if (responsebuffer[0] == '5') /* Address rejected */
983 {
984 yield = FAIL;
985 done = TRUE;
986 }
987 }
988 }
989
990 /* End the SMTP conversation and close the connection. */
991
992 /* Cutthrough - on a successfull connect and recipient-verify with use-sender
993 and we have no cutthrough conn so far
994 here is where we want to leave the conn open */
995 if ( cutthrough_delivery
996 && done
997 && yield == OK
998 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster)) == vopt_callout_recipsender
999 && !random_local_part
1000 && !pm_mailfrom
1001 && cutthrough_fd < 0
1002 )
1003 {
1004 cutthrough_fd= outblock.sock; /* We assume no buffer in use in the outblock */
1005 cutthrough_addr = *addr; /* Save the address_item for later logging */
1006 cutthrough_addr.next = NULL;
1007 cutthrough_addr.host_used = store_get(sizeof(host_item));
1008 cutthrough_addr.host_used->name = host->name;
1009 cutthrough_addr.host_used->address = host->address;
1010 cutthrough_addr.host_used->port = port;
1011 if (addr->parent)
1012 *(cutthrough_addr.parent = store_get(sizeof(address_item)))= *addr->parent;
1013 ctblock.buffer = ctbuffer;
1014 ctblock.buffersize = sizeof(ctbuffer);
1015 ctblock.ptr = ctbuffer;
1016 /* ctblock.cmd_count = 0; ctblock.authenticating = FALSE; */
1017 ctblock.sock = cutthrough_fd;
1018 }
1019 else
1020 {
1021 /* Ensure no cutthrough on multiple address verifies */
1022 if (options & vopt_callout_recipsender)
1023 cancel_cutthrough_connection("multiple verify calls");
1024 if (send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
1025
1026 #ifdef SUPPORT_TLS
1027 tls_close(FALSE, TRUE);
1028 #endif
1029 (void)close(inblock.sock);
1030 #ifdef EXPERIMENTAL_TPDA
1031 (void) tpda_raise_event(addr->transport->tpda_event_action,
1032 US"tcp:close", NULL);
1033 #endif
1034 }
1035
1036 } /* Loop through all hosts, while !done */
1037 }
1038
1039 /* If we get here with done == TRUE, a successful callout happened, and yield
1040 will be set OK or FAIL according to the response to the RCPT command.
1041 Otherwise, we looped through the hosts but couldn't complete the business.
1042 However, there may be domain-specific information to cache in both cases.
1043
1044 The value of the result field in the new_domain record is ccache_unknown if
1045 there was an error before or with MAIL FROM:, and errno was not zero,
1046 implying some kind of I/O error. We don't want to write the cache in that case.
1047 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
1048
1049 if (!callout_no_cache && new_domain_record.result != ccache_unknown)
1050 {
1051 if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
1052 == NULL)
1053 {
1054 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
1055 }
1056 else
1057 {
1058 (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
1059 (int)sizeof(dbdata_callout_cache));
1060 HDEBUG(D_verify) debug_printf("wrote callout cache domain record:\n"
1061 " result=%d postmaster=%d random=%d\n",
1062 new_domain_record.result,
1063 new_domain_record.postmaster_result,
1064 new_domain_record.random_result);
1065 }
1066 }
1067
1068 /* If a definite result was obtained for the callout, cache it unless caching
1069 is disabled. */
1070
1071 if (done)
1072 {
1073 if (!callout_no_cache && new_address_record.result != ccache_unknown)
1074 {
1075 if (dbm_file == NULL)
1076 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
1077 if (dbm_file == NULL)
1078 {
1079 HDEBUG(D_verify) debug_printf("no callout cache available\n");
1080 }
1081 else
1082 {
1083 (void)dbfn_write(dbm_file, address_key, &new_address_record,
1084 (int)sizeof(dbdata_callout_cache_address));
1085 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record\n",
1086 (new_address_record.result == ccache_accept)? "positive" : "negative");
1087 }
1088 }
1089 } /* done */
1090
1091 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1092 temporary error. If there was only one host, and a response was received, leave
1093 it alone if supplying details. Otherwise, give a generic response. */
1094
1095 else /* !done */
1096 {
1097 uschar *dullmsg = string_sprintf("Could not complete %s verify callout",
1098 is_recipient? "recipient" : "sender");
1099 yield = DEFER;
1100
1101 if (host_list->next != NULL || addr->message == NULL) addr->message = dullmsg;
1102
1103 addr->user_message = (!smtp_return_error_details)? dullmsg :
1104 string_sprintf("%s for <%s>.\n"
1105 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1106 "they may be permanently unreachable from this server. In the latter case,\n%s",
1107 dullmsg, addr->address,
1108 is_recipient?
1109 "the address will never be accepted."
1110 :
1111 "you need to change the address or create an MX record for its domain\n"
1112 "if it is supposed to be generally accessible from the Internet.\n"
1113 "Talk to your mail administrator for details.");
1114
1115 /* Force a specific error code */
1116
1117 addr->basic_errno = ERRNO_CALLOUTDEFER;
1118 }
1119
1120 /* Come here from within the cache-reading code on fast-track exit. */
1121
1122 END_CALLOUT:
1123 if (dbm_file != NULL) dbfn_close(dbm_file);
1124 return yield;
1125 }
1126
1127
1128
1129 /* Called after recipient-acl to get a cutthrough connection open when
1130 one was requested and a recipient-verify wasn't subsequently done.
1131 */
1132 void
1133 open_cutthrough_connection( address_item * addr )
1134 {
1135 address_item addr2;
1136
1137 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1138 /* We must use a copy of the address for verification, because it might
1139 get rewritten. */
1140
1141 addr2 = *addr;
1142 HDEBUG(D_acl) debug_printf("----------- start cutthrough setup ------------\n");
1143 (void) verify_address(&addr2, NULL,
1144 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1145 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1146 NULL, NULL, NULL);
1147 HDEBUG(D_acl) debug_printf("----------- end cutthrough setup ------------\n");
1148 return;
1149 }
1150
1151
1152
1153 /* Send given number of bytes from the buffer */
1154 static BOOL
1155 cutthrough_send(int n)
1156 {
1157 if(cutthrough_fd < 0)
1158 return TRUE;
1159
1160 if(
1161 #ifdef SUPPORT_TLS
1162 (tls_out.active == cutthrough_fd) ? tls_write(FALSE, ctblock.buffer, n) :
1163 #endif
1164 send(cutthrough_fd, ctblock.buffer, n, 0) > 0
1165 )
1166 {
1167 transport_count += n;
1168 ctblock.ptr= ctblock.buffer;
1169 return TRUE;
1170 }
1171
1172 HDEBUG(D_transport|D_acl) debug_printf("cutthrough_send failed: %s\n", strerror(errno));
1173 return FALSE;
1174 }
1175
1176
1177
1178 static BOOL
1179 _cutthrough_puts(uschar * cp, int n)
1180 {
1181 while(n--)
1182 {
1183 if(ctblock.ptr >= ctblock.buffer+ctblock.buffersize)
1184 if(!cutthrough_send(ctblock.buffersize))
1185 return FALSE;
1186
1187 *ctblock.ptr++ = *cp++;
1188 }
1189 return TRUE;
1190 }
1191
1192 /* Buffered output of counted data block. Return boolean success */
1193 BOOL
1194 cutthrough_puts(uschar * cp, int n)
1195 {
1196 if (cutthrough_fd < 0) return TRUE;
1197 if (_cutthrough_puts(cp, n)) return TRUE;
1198 cancel_cutthrough_connection("transmit failed");
1199 return FALSE;
1200 }
1201
1202
1203 static BOOL
1204 _cutthrough_flush_send( void )
1205 {
1206 int n= ctblock.ptr-ctblock.buffer;
1207
1208 if(n>0)
1209 if(!cutthrough_send(n))
1210 return FALSE;
1211 return TRUE;
1212 }
1213
1214
1215 /* Send out any bufferred output. Return boolean success. */
1216 BOOL
1217 cutthrough_flush_send( void )
1218 {
1219 if (_cutthrough_flush_send()) return TRUE;
1220 cancel_cutthrough_connection("transmit failed");
1221 return FALSE;
1222 }
1223
1224
1225 BOOL
1226 cutthrough_put_nl( void )
1227 {
1228 return cutthrough_puts(US"\r\n", 2);
1229 }
1230
1231
1232 /* Get and check response from cutthrough target */
1233 static uschar
1234 cutthrough_response(char expect, uschar ** copy)
1235 {
1236 smtp_inblock inblock;
1237 uschar inbuffer[4096];
1238 uschar responsebuffer[4096];
1239
1240 inblock.buffer = inbuffer;
1241 inblock.buffersize = sizeof(inbuffer);
1242 inblock.ptr = inbuffer;
1243 inblock.ptrend = inbuffer;
1244 inblock.sock = cutthrough_fd;
1245 /* this relies on (inblock.sock == tls_out.active) */
1246 if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, CUTTHROUGH_DATA_TIMEOUT))
1247 cancel_cutthrough_connection("target timeout on read");
1248
1249 if(copy != NULL)
1250 {
1251 uschar * cp;
1252 *copy= cp= string_copy(responsebuffer);
1253 /* Trim the trailing end of line */
1254 cp += Ustrlen(responsebuffer);
1255 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1256 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1257 }
1258
1259 return responsebuffer[0];
1260 }
1261
1262
1263 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1264 BOOL
1265 cutthrough_predata( void )
1266 {
1267 if(cutthrough_fd < 0)
1268 return FALSE;
1269
1270 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> DATA\n");
1271 cutthrough_puts(US"DATA\r\n", 6);
1272 cutthrough_flush_send();
1273
1274 /* Assume nothing buffered. If it was it gets ignored. */
1275 return cutthrough_response('3', NULL) == '3';
1276 }
1277
1278
1279 /* fd and use_crlf args only to match write_chunk() */
1280 static BOOL
1281 cutthrough_write_chunk(int fd, uschar * s, int len, BOOL use_crlf)
1282 {
1283 uschar * s2;
1284 while(s && (s2 = Ustrchr(s, '\n')))
1285 {
1286 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1287 return FALSE;
1288 s = s2+1;
1289 }
1290 return TRUE;
1291 }
1292
1293
1294 /* Buffered send of headers. Return success boolean. */
1295 /* Expands newlines to wire format (CR,NL). */
1296 /* Also sends header-terminating blank line. */
1297 BOOL
1298 cutthrough_headers_send( void )
1299 {
1300 if(cutthrough_fd < 0)
1301 return FALSE;
1302
1303 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1304 but having a separate buffered-output function (for now)
1305 */
1306 HDEBUG(D_acl) debug_printf("----------- start cutthrough headers send -----------\n");
1307
1308 if (!transport_headers_send(&cutthrough_addr, cutthrough_fd,
1309 cutthrough_addr.transport->add_headers, cutthrough_addr.transport->remove_headers,
1310 &cutthrough_write_chunk, TRUE,
1311 cutthrough_addr.transport->rewrite_rules, cutthrough_addr.transport->rewrite_existflags))
1312 return FALSE;
1313
1314 HDEBUG(D_acl) debug_printf("----------- done cutthrough headers send ------------\n");
1315 return TRUE;
1316 }
1317
1318
1319 static void
1320 close_cutthrough_connection( const char * why )
1321 {
1322 if(cutthrough_fd >= 0)
1323 {
1324 /* We could be sending this after a bunch of data, but that is ok as
1325 the only way to cancel the transfer in dataphase is to drop the tcp
1326 conn before the final dot.
1327 */
1328 ctblock.ptr = ctbuffer;
1329 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> QUIT\n");
1330 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1331 _cutthrough_flush_send();
1332 /* No wait for response */
1333
1334 #ifdef SUPPORT_TLS
1335 tls_close(FALSE, TRUE);
1336 #endif
1337 (void)close(cutthrough_fd);
1338 cutthrough_fd= -1;
1339 HDEBUG(D_acl) debug_printf("----------- cutthrough shutdown (%s) ------------\n", why);
1340 }
1341 ctblock.ptr = ctbuffer;
1342 }
1343
1344 void
1345 cancel_cutthrough_connection( const char * why )
1346 {
1347 close_cutthrough_connection(why);
1348 cutthrough_delivery= FALSE;
1349 }
1350
1351
1352
1353
1354 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1355 Log an OK response as a transmission.
1356 Close the connection.
1357 Return smtp response-class digit.
1358 */
1359 uschar *
1360 cutthrough_finaldot( void )
1361 {
1362 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> .\n");
1363
1364 /* Assume data finshed with new-line */
1365 if(!cutthrough_puts(US".", 1) || !cutthrough_put_nl() || !cutthrough_flush_send())
1366 return cutthrough_addr.message;
1367
1368 switch(cutthrough_response('2', &cutthrough_addr.message))
1369 {
1370 case '2':
1371 delivery_log(LOG_MAIN, &cutthrough_addr, (int)'>', NULL);
1372 close_cutthrough_connection("delivered");
1373 break;
1374
1375 case '4':
1376 delivery_log(LOG_MAIN, &cutthrough_addr, 0, US"tmp-reject from cutthrough after DATA:");
1377 break;
1378
1379 case '5':
1380 delivery_log(LOG_MAIN|LOG_REJECT, &cutthrough_addr, 0, US"rejected after DATA:");
1381 break;
1382
1383 default:
1384 break;
1385 }
1386 return cutthrough_addr.message;
1387 }
1388
1389
1390
1391 /*************************************************
1392 * Copy error to toplevel address *
1393 *************************************************/
1394
1395 /* This function is used when a verify fails or defers, to ensure that the
1396 failure or defer information is in the original toplevel address. This applies
1397 when an address is redirected to a single new address, and the failure or
1398 deferral happens to the child address.
1399
1400 Arguments:
1401 vaddr the verify address item
1402 addr the final address item
1403 yield FAIL or DEFER
1404
1405 Returns: the value of YIELD
1406 */
1407
1408 static int
1409 copy_error(address_item *vaddr, address_item *addr, int yield)
1410 {
1411 if (addr != vaddr)
1412 {
1413 vaddr->message = addr->message;
1414 vaddr->user_message = addr->user_message;
1415 vaddr->basic_errno = addr->basic_errno;
1416 vaddr->more_errno = addr->more_errno;
1417 vaddr->p.address_data = addr->p.address_data;
1418 copyflag(vaddr, addr, af_pass_message);
1419 }
1420 return yield;
1421 }
1422
1423
1424
1425
1426 /**************************************************
1427 * printf that automatically handles TLS if needed *
1428 ***************************************************/
1429
1430 /* This function is used by verify_address() as a substitute for all fprintf()
1431 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1432 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1433 that assumes that we always use the smtp_out FILE* when not using TLS or the
1434 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1435 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1436 fprintf().
1437
1438 Arguments:
1439 f the candidate FILE* to write to
1440 format format string
1441 ... optional arguments
1442
1443 Returns:
1444 nothing
1445 */
1446
1447 static void PRINTF_FUNCTION(2,3)
1448 respond_printf(FILE *f, const char *format, ...)
1449 {
1450 va_list ap;
1451
1452 va_start(ap, format);
1453 if (smtp_out && (f == smtp_out))
1454 smtp_vprintf(format, ap);
1455 else
1456 vfprintf(f, format, ap);
1457 va_end(ap);
1458 }
1459
1460
1461
1462 /*************************************************
1463 * Verify an email address *
1464 *************************************************/
1465
1466 /* This function is used both for verification (-bv and at other times) and
1467 address testing (-bt), which is indicated by address_test_mode being set.
1468
1469 Arguments:
1470 vaddr contains the address to verify; the next field in this block
1471 must be NULL
1472 f if not NULL, write the result to this file
1473 options various option bits:
1474 vopt_fake_sender => this sender verify is not for the real
1475 sender (it was verify=sender=xxxx or an address from a
1476 header line) - rewriting must not change sender_address
1477 vopt_is_recipient => this is a recipient address, otherwise
1478 it's a sender address - this affects qualification and
1479 rewriting and messages from callouts
1480 vopt_qualify => qualify an unqualified address; else error
1481 vopt_expn => called from SMTP EXPN command
1482 vopt_success_on_redirect => when a new address is generated
1483 the verification instantly succeeds
1484
1485 These ones are used by do_callout() -- the options variable
1486 is passed to it.
1487
1488 vopt_callout_fullpm => if postmaster check, do full one
1489 vopt_callout_no_cache => don't use callout cache
1490 vopt_callout_random => do the "random" thing
1491 vopt_callout_recipsender => use real sender for recipient
1492 vopt_callout_recippmaster => use postmaster for recipient
1493
1494 callout if > 0, specifies that callout is required, and gives timeout
1495 for individual commands
1496 callout_overall if > 0, gives overall timeout for the callout function;
1497 if < 0, a default is used (see do_callout())
1498 callout_connect the connection timeout for callouts
1499 se_mailfrom when callout is requested to verify a sender, use this
1500 in MAIL FROM; NULL => ""
1501 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1502 thing and use this as the sender address (may be "")
1503
1504 routed if not NULL, set TRUE if routing succeeded, so we can
1505 distinguish between routing failed and callout failed
1506
1507 Returns: OK address verified
1508 FAIL address failed to verify
1509 DEFER can't tell at present
1510 */
1511
1512 int
1513 verify_address(address_item *vaddr, FILE *f, int options, int callout,
1514 int callout_overall, int callout_connect, uschar *se_mailfrom,
1515 uschar *pm_mailfrom, BOOL *routed)
1516 {
1517 BOOL allok = TRUE;
1518 BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
1519 BOOL is_recipient = (options & vopt_is_recipient) != 0;
1520 BOOL expn = (options & vopt_expn) != 0;
1521 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1522 int i;
1523 int yield = OK;
1524 int verify_type = expn? v_expn :
1525 address_test_mode? v_none :
1526 is_recipient? v_recipient : v_sender;
1527 address_item *addr_list;
1528 address_item *addr_new = NULL;
1529 address_item *addr_remote = NULL;
1530 address_item *addr_local = NULL;
1531 address_item *addr_succeed = NULL;
1532 uschar **failure_ptr = is_recipient?
1533 &recipient_verify_failure : &sender_verify_failure;
1534 uschar *ko_prefix, *cr;
1535 uschar *address = vaddr->address;
1536 uschar *save_sender;
1537 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1538
1539 /* Clear, just in case */
1540
1541 *failure_ptr = NULL;
1542
1543 /* Set up a prefix and suffix for error message which allow us to use the same
1544 output statements both in EXPN mode (where an SMTP response is needed) and when
1545 debugging with an output file. */
1546
1547 if (expn)
1548 {
1549 ko_prefix = US"553 ";
1550 cr = US"\r";
1551 }
1552 else ko_prefix = cr = US"";
1553
1554 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1555
1556 if (parse_find_at(address) == NULL)
1557 {
1558 if ((options & vopt_qualify) == 0)
1559 {
1560 if (f != NULL)
1561 respond_printf(f, "%sA domain is required for \"%s\"%s\n",
1562 ko_prefix, address, cr);
1563 *failure_ptr = US"qualify";
1564 return FAIL;
1565 }
1566 address = rewrite_address_qualify(address, is_recipient);
1567 }
1568
1569 DEBUG(D_verify)
1570 {
1571 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1572 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
1573 }
1574
1575 /* Rewrite and report on it. Clear the domain and local part caches - these
1576 may have been set by domains and local part tests during an ACL. */
1577
1578 if (global_rewrite_rules != NULL)
1579 {
1580 uschar *old = address;
1581 address = rewrite_address(address, is_recipient, FALSE,
1582 global_rewrite_rules, rewrite_existflags);
1583 if (address != old)
1584 {
1585 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1586 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1587 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
1588 }
1589 }
1590
1591 /* If this is the real sender address, we must update sender_address at
1592 this point, because it may be referred to in the routers. */
1593
1594 if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
1595 sender_address = address;
1596
1597 /* If the address was rewritten to <> no verification can be done, and we have
1598 to return OK. This rewriting is permitted only for sender addresses; for other
1599 addresses, such rewriting fails. */
1600
1601 if (address[0] == 0) return OK;
1602
1603 /* Flip the legacy TLS-related variables over to the outbound set in case
1604 they're used in the context of a transport used by verification. Reset them
1605 at exit from this routine. */
1606
1607 tls_modify_variables(&tls_out);
1608
1609 /* Save a copy of the sender address for re-instating if we change it to <>
1610 while verifying a sender address (a nice bit of self-reference there). */
1611
1612 save_sender = sender_address;
1613
1614 /* Update the address structure with the possibly qualified and rewritten
1615 address. Set it up as the starting address on the chain of new addresses. */
1616
1617 vaddr->address = address;
1618 addr_new = vaddr;
1619
1620 /* We need a loop, because an address can generate new addresses. We must also
1621 cope with generated pipes and files at the top level. (See also the code and
1622 comment in deliver.c.) However, it is usually the case that the router for
1623 user's .forward files has its verify flag turned off.
1624
1625 If an address generates more than one child, the loop is used only when
1626 full_info is set, and this can only be set locally. Remote enquiries just get
1627 information about the top level address, not anything that it generated. */
1628
1629 while (addr_new != NULL)
1630 {
1631 int rc;
1632 address_item *addr = addr_new;
1633
1634 addr_new = addr->next;
1635 addr->next = NULL;
1636
1637 DEBUG(D_verify)
1638 {
1639 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1640 debug_printf("Considering %s\n", addr->address);
1641 }
1642
1643 /* Handle generated pipe, file or reply addresses. We don't get these
1644 when handling EXPN, as it does only one level of expansion. */
1645
1646 if (testflag(addr, af_pfr))
1647 {
1648 allok = FALSE;
1649 if (f != NULL)
1650 {
1651 BOOL allow;
1652
1653 if (addr->address[0] == '>')
1654 {
1655 allow = testflag(addr, af_allow_reply);
1656 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1657 }
1658 else
1659 {
1660 allow = (addr->address[0] == '|')?
1661 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1662 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1663 }
1664
1665 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1666 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1667 "%s\n", addr->message);
1668 else if (allow)
1669 fprintf(f, "\n transport = %s\n", addr->transport->name);
1670 else
1671 fprintf(f, " *** forbidden ***\n");
1672 }
1673 continue;
1674 }
1675
1676 /* Just in case some router parameter refers to it. */
1677
1678 return_path = (addr->p.errors_address != NULL)?
1679 addr->p.errors_address : sender_address;
1680
1681 /* Split the address into domain and local part, handling the %-hack if
1682 necessary, and then route it. While routing a sender address, set
1683 $sender_address to <> because that is what it will be if we were trying to
1684 send a bounce to the sender. */
1685
1686 if (routed != NULL) *routed = FALSE;
1687 if ((rc = deliver_split_address(addr)) == OK)
1688 {
1689 if (!is_recipient) sender_address = null_sender;
1690 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1691 &addr_succeed, verify_type);
1692 sender_address = save_sender; /* Put back the real sender */
1693 }
1694
1695 /* If routing an address succeeded, set the flag that remembers, for use when
1696 an ACL cached a sender verify (in case a callout fails). Then if routing set
1697 up a list of hosts or the transport has a host list, and the callout option
1698 is set, and we aren't in a host checking run, do the callout verification,
1699 and set another flag that notes that a callout happened. */
1700
1701 if (rc == OK)
1702 {
1703 if (routed != NULL) *routed = TRUE;
1704 if (callout > 0)
1705 {
1706 host_item *host_list = addr->host_list;
1707
1708 /* Make up some data for use in the case where there is no remote
1709 transport. */
1710
1711 transport_feedback tf = {
1712 NULL, /* interface (=> any) */
1713 US"smtp", /* port */
1714 US"smtp", /* protocol */
1715 NULL, /* hosts */
1716 US"$smtp_active_hostname", /* helo_data */
1717 FALSE, /* hosts_override */
1718 FALSE, /* hosts_randomize */
1719 FALSE, /* gethostbyname */
1720 TRUE, /* qualify_single */
1721 FALSE /* search_parents */
1722 };
1723
1724 /* If verification yielded a remote transport, we want to use that
1725 transport's options, so as to mimic what would happen if we were really
1726 sending a message to this address. */
1727
1728 if (addr->transport != NULL && !addr->transport->info->local)
1729 {
1730 (void)(addr->transport->setup)(addr->transport, addr, &tf, 0, 0, NULL);
1731
1732 /* If the transport has hosts and the router does not, or if the
1733 transport is configured to override the router's hosts, we must build a
1734 host list of the transport's hosts, and find the IP addresses */
1735
1736 if (tf.hosts != NULL && (host_list == NULL || tf.hosts_override))
1737 {
1738 uschar *s;
1739 uschar *save_deliver_domain = deliver_domain;
1740 uschar *save_deliver_localpart = deliver_localpart;
1741
1742 host_list = NULL; /* Ignore the router's hosts */
1743
1744 deliver_domain = addr->domain;
1745 deliver_localpart = addr->local_part;
1746 s = expand_string(tf.hosts);
1747 deliver_domain = save_deliver_domain;
1748 deliver_localpart = save_deliver_localpart;
1749
1750 if (s == NULL)
1751 {
1752 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1753 "\"%s\" in %s transport for callout: %s", tf.hosts,
1754 addr->transport->name, expand_string_message);
1755 }
1756 else
1757 {
1758 int flags;
1759 uschar *canonical_name;
1760 host_item *host, *nexthost;
1761 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1762
1763 /* Just ignore failures to find a host address. If we don't manage
1764 to find any addresses, the callout will defer. Note that more than
1765 one address may be found for a single host, which will result in
1766 additional host items being inserted into the chain. Hence we must
1767 save the next host first. */
1768
1769 flags = HOST_FIND_BY_A;
1770 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1771 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1772
1773 for (host = host_list; host != NULL; host = nexthost)
1774 {
1775 nexthost = host->next;
1776 if (tf.gethostbyname ||
1777 string_is_ip_address(host->name, NULL) != 0)
1778 (void)host_find_byname(host, NULL, flags, &canonical_name, TRUE);
1779 else
1780 {
1781 uschar * d_request = NULL, * d_require = NULL;
1782 if (Ustrcmp(addr->transport->driver_name, "smtp") == 0)
1783 {
1784 smtp_transport_options_block * ob =
1785 (smtp_transport_options_block *)
1786 addr->transport->options_block;
1787 d_request = ob->dnssec_request_domains;
1788 d_require = ob->dnssec_require_domains;
1789 }
1790
1791 (void)host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1792 d_request, d_require, &canonical_name, NULL);
1793 }
1794 }
1795 }
1796 }
1797 }
1798
1799 /* Can only do a callout if we have at least one host! If the callout
1800 fails, it will have set ${sender,recipient}_verify_failure. */
1801
1802 if (host_list != NULL)
1803 {
1804 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1805 if (host_checking && !host_checking_callout)
1806 {
1807 HDEBUG(D_verify)
1808 debug_printf("... callout omitted by default when host testing\n"
1809 "(Use -bhc if you want the callouts to happen.)\n");
1810 }
1811 else
1812 {
1813 #ifdef SUPPORT_TLS
1814 deliver_set_expansions(addr);
1815 #endif
1816 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
1817 callout_connect, options, se_mailfrom, pm_mailfrom);
1818 }
1819 }
1820 else
1821 {
1822 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
1823 "transport provided a host list\n");
1824 }
1825 }
1826 }
1827
1828 /* Otherwise, any failure is a routing failure */
1829
1830 else *failure_ptr = US"route";
1831
1832 /* A router may return REROUTED if it has set up a child address as a result
1833 of a change of domain name (typically from widening). In this case we always
1834 want to continue to verify the new child. */
1835
1836 if (rc == REROUTED) continue;
1837
1838 /* Handle hard failures */
1839
1840 if (rc == FAIL)
1841 {
1842 allok = FALSE;
1843 if (f != NULL)
1844 {
1845 address_item *p = addr->parent;
1846
1847 respond_printf(f, "%s%s %s", ko_prefix,
1848 full_info? addr->address : address,
1849 address_test_mode? "is undeliverable" : "failed to verify");
1850 if (!expn && admin_user)
1851 {
1852 if (addr->basic_errno > 0)
1853 respond_printf(f, ": %s", strerror(addr->basic_errno));
1854 if (addr->message != NULL)
1855 respond_printf(f, ": %s", addr->message);
1856 }
1857
1858 /* Show parents iff doing full info */
1859
1860 if (full_info) while (p != NULL)
1861 {
1862 respond_printf(f, "%s\n <-- %s", cr, p->address);
1863 p = p->parent;
1864 }
1865 respond_printf(f, "%s\n", cr);
1866 }
1867 cancel_cutthrough_connection("routing hard fail");
1868
1869 if (!full_info)
1870 {
1871 yield = copy_error(vaddr, addr, FAIL);
1872 goto out;
1873 }
1874 else yield = FAIL;
1875 }
1876
1877 /* Soft failure */
1878
1879 else if (rc == DEFER)
1880 {
1881 allok = FALSE;
1882 if (f != NULL)
1883 {
1884 address_item *p = addr->parent;
1885 respond_printf(f, "%s%s cannot be resolved at this time", ko_prefix,
1886 full_info? addr->address : address);
1887 if (!expn && admin_user)
1888 {
1889 if (addr->basic_errno > 0)
1890 respond_printf(f, ": %s", strerror(addr->basic_errno));
1891 if (addr->message != NULL)
1892 respond_printf(f, ": %s", addr->message);
1893 else if (addr->basic_errno <= 0)
1894 respond_printf(f, ": unknown error");
1895 }
1896
1897 /* Show parents iff doing full info */
1898
1899 if (full_info) while (p != NULL)
1900 {
1901 respond_printf(f, "%s\n <-- %s", cr, p->address);
1902 p = p->parent;
1903 }
1904 respond_printf(f, "%s\n", cr);
1905 }
1906 cancel_cutthrough_connection("routing soft fail");
1907
1908 if (!full_info)
1909 {
1910 yield = copy_error(vaddr, addr, DEFER);
1911 goto out;
1912 }
1913 else if (yield == OK) yield = DEFER;
1914 }
1915
1916 /* If we are handling EXPN, we do not want to continue to route beyond
1917 the top level (whose address is in "address"). */
1918
1919 else if (expn)
1920 {
1921 uschar *ok_prefix = US"250-";
1922 if (addr_new == NULL)
1923 {
1924 if (addr_local == NULL && addr_remote == NULL)
1925 respond_printf(f, "250 mail to <%s> is discarded\r\n", address);
1926 else
1927 respond_printf(f, "250 <%s>\r\n", address);
1928 }
1929 else while (addr_new != NULL)
1930 {
1931 address_item *addr2 = addr_new;
1932 addr_new = addr2->next;
1933 if (addr_new == NULL) ok_prefix = US"250 ";
1934 respond_printf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
1935 }
1936 yield = OK;
1937 goto out;
1938 }
1939
1940 /* Successful routing other than EXPN. */
1941
1942 else
1943 {
1944 /* Handle successful routing when short info wanted. Otherwise continue for
1945 other (generated) addresses. Short info is the operational case. Full info
1946 can be requested only when debug_selector != 0 and a file is supplied.
1947
1948 There is a conflict between the use of aliasing as an alternate email
1949 address, and as a sort of mailing list. If an alias turns the incoming
1950 address into just one address (e.g. J.Caesar->jc44) you may well want to
1951 carry on verifying the generated address to ensure it is valid when
1952 checking incoming mail. If aliasing generates multiple addresses, you
1953 probably don't want to do this. Exim therefore treats the generation of
1954 just a single new address as a special case, and continues on to verify the
1955 generated address. */
1956
1957 if (!full_info && /* Stop if short info wanted AND */
1958 (((addr_new == NULL || /* No new address OR */
1959 addr_new->next != NULL || /* More than one new address OR */
1960 testflag(addr_new, af_pfr))) /* New address is pfr */
1961 || /* OR */
1962 (addr_new != NULL && /* At least one new address AND */
1963 success_on_redirect))) /* success_on_redirect is set */
1964 {
1965 if (f != NULL) fprintf(f, "%s %s\n", address,
1966 address_test_mode? "is deliverable" : "verified");
1967
1968 /* If we have carried on to verify a child address, we want the value
1969 of $address_data to be that of the child */
1970
1971 vaddr->p.address_data = addr->p.address_data;
1972 yield = OK;
1973 goto out;
1974 }
1975 }
1976 } /* Loop for generated addresses */
1977
1978 /* Display the full results of the successful routing, including any generated
1979 addresses. Control gets here only when full_info is set, which requires f not
1980 to be NULL, and this occurs only when a top-level verify is called with the
1981 debugging switch on.
1982
1983 If there are no local and no remote addresses, and there were no pipes, files,
1984 or autoreplies, and there were no errors or deferments, the message is to be
1985 discarded, usually because of the use of :blackhole: in an alias file. */
1986
1987 if (allok && addr_local == NULL && addr_remote == NULL)
1988 {
1989 fprintf(f, "mail to %s is discarded\n", address);
1990 goto out;
1991 }
1992
1993 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
1994 {
1995 while (addr_list != NULL)
1996 {
1997 address_item *addr = addr_list;
1998 address_item *p = addr->parent;
1999 addr_list = addr->next;
2000
2001 fprintf(f, "%s", CS addr->address);
2002 #ifdef EXPERIMENTAL_SRS
2003 if(addr->p.srs_sender)
2004 fprintf(f, " [srs = %s]", addr->p.srs_sender);
2005 #endif
2006
2007 /* If the address is a duplicate, show something about it. */
2008
2009 if (!testflag(addr, af_pfr))
2010 {
2011 tree_node *tnode;
2012 if ((tnode = tree_search(tree_duplicates, addr->unique)) != NULL)
2013 fprintf(f, " [duplicate, would not be delivered]");
2014 else tree_add_duplicate(addr->unique, addr);
2015 }
2016
2017 /* Now show its parents */
2018
2019 while (p != NULL)
2020 {
2021 fprintf(f, "\n <-- %s", p->address);
2022 p = p->parent;
2023 }
2024 fprintf(f, "\n ");
2025
2026 /* Show router, and transport */
2027
2028 fprintf(f, "router = %s, ", addr->router->name);
2029 fprintf(f, "transport = %s\n", (addr->transport == NULL)? US"unset" :
2030 addr->transport->name);
2031
2032 /* Show any hosts that are set up by a router unless the transport
2033 is going to override them; fiddle a bit to get a nice format. */
2034
2035 if (addr->host_list != NULL && addr->transport != NULL &&
2036 !addr->transport->overrides_hosts)
2037 {
2038 host_item *h;
2039 int maxlen = 0;
2040 int maxaddlen = 0;
2041 for (h = addr->host_list; h != NULL; h = h->next)
2042 {
2043 int len = Ustrlen(h->name);
2044 if (len > maxlen) maxlen = len;
2045 len = (h->address != NULL)? Ustrlen(h->address) : 7;
2046 if (len > maxaddlen) maxaddlen = len;
2047 }
2048 for (h = addr->host_list; h != NULL; h = h->next)
2049 {
2050 int len = Ustrlen(h->name);
2051 fprintf(f, " host %s ", h->name);
2052 while (len++ < maxlen) fprintf(f, " ");
2053 if (h->address != NULL)
2054 {
2055 fprintf(f, "[%s] ", h->address);
2056 len = Ustrlen(h->address);
2057 }
2058 else if (!addr->transport->info->local) /* Omit [unknown] for local */
2059 {
2060 fprintf(f, "[unknown] ");
2061 len = 7;
2062 }
2063 else len = -3;
2064 while (len++ < maxaddlen) fprintf(f," ");
2065 if (h->mx >= 0) fprintf(f, "MX=%d", h->mx);
2066 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
2067 if (h->status == hstatus_unusable) fprintf(f, " ** unusable **");
2068 fprintf(f, "\n");
2069 }
2070 }
2071 }
2072 }
2073
2074 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2075 the -bv or -bt case). */
2076
2077 out:
2078 tls_modify_variables(&tls_in);
2079
2080 return yield;
2081 }
2082
2083
2084
2085
2086 /*************************************************
2087 * Check headers for syntax errors *
2088 *************************************************/
2089
2090 /* This function checks those header lines that contain addresses, and verifies
2091 that all the addresses therein are syntactially correct.
2092
2093 Arguments:
2094 msgptr where to put an error message
2095
2096 Returns: OK
2097 FAIL
2098 */
2099
2100 int
2101 verify_check_headers(uschar **msgptr)
2102 {
2103 header_line *h;
2104 uschar *colon, *s;
2105 int yield = OK;
2106
2107 for (h = header_list; h != NULL && yield == OK; h = h->next)
2108 {
2109 if (h->type != htype_from &&
2110 h->type != htype_reply_to &&
2111 h->type != htype_sender &&
2112 h->type != htype_to &&
2113 h->type != htype_cc &&
2114 h->type != htype_bcc)
2115 continue;
2116
2117 colon = Ustrchr(h->text, ':');
2118 s = colon + 1;
2119 while (isspace(*s)) s++;
2120
2121 /* Loop for multiple addresses in the header, enabling group syntax. Note
2122 that we have to reset this after the header has been scanned. */
2123
2124 parse_allow_group = TRUE;
2125
2126 while (*s != 0)
2127 {
2128 uschar *ss = parse_find_address_end(s, FALSE);
2129 uschar *recipient, *errmess;
2130 int terminator = *ss;
2131 int start, end, domain;
2132
2133 /* Temporarily terminate the string at this point, and extract the
2134 operative address within, allowing group syntax. */
2135
2136 *ss = 0;
2137 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2138 *ss = terminator;
2139
2140 /* Permit an unqualified address only if the message is local, or if the
2141 sending host is configured to be permitted to send them. */
2142
2143 if (recipient != NULL && domain == 0)
2144 {
2145 if (h->type == htype_from || h->type == htype_sender)
2146 {
2147 if (!allow_unqualified_sender) recipient = NULL;
2148 }
2149 else
2150 {
2151 if (!allow_unqualified_recipient) recipient = NULL;
2152 }
2153 if (recipient == NULL) errmess = US"unqualified address not permitted";
2154 }
2155
2156 /* It's an error if no address could be extracted, except for the special
2157 case of an empty address. */
2158
2159 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
2160 {
2161 uschar *verb = US"is";
2162 uschar *t = ss;
2163 uschar *tt = colon;
2164 int len;
2165
2166 /* Arrange not to include any white space at the end in the
2167 error message or the header name. */
2168
2169 while (t > s && isspace(t[-1])) t--;
2170 while (tt > h->text && isspace(tt[-1])) tt--;
2171
2172 /* Add the address that failed to the error message, since in a
2173 header with very many addresses it is sometimes hard to spot
2174 which one is at fault. However, limit the amount of address to
2175 quote - cases have been seen where, for example, a missing double
2176 quote in a humungous To: header creates an "address" that is longer
2177 than string_sprintf can handle. */
2178
2179 len = t - s;
2180 if (len > 1024)
2181 {
2182 len = 1024;
2183 verb = US"begins";
2184 }
2185
2186 *msgptr = string_printing(
2187 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2188 errmess, tt - h->text, h->text, verb, len, s));
2189
2190 yield = FAIL;
2191 break; /* Out of address loop */
2192 }
2193
2194 /* Advance to the next address */
2195
2196 s = ss + (terminator? 1:0);
2197 while (isspace(*s)) s++;
2198 } /* Next address */
2199
2200 parse_allow_group = FALSE;
2201 parse_found_group = FALSE;
2202 } /* Next header unless yield has been set FALSE */
2203
2204 return yield;
2205 }
2206
2207
2208 /*************************************************
2209 * Check header names for 8-bit characters *
2210 *************************************************/
2211
2212 /* This function checks for invalid charcters in header names. See
2213 RFC 5322, 2.2. and RFC 6532, 3.
2214
2215 Arguments:
2216 msgptr where to put an error message
2217
2218 Returns: OK
2219 FAIL
2220 */
2221
2222 int
2223 verify_check_header_names_ascii(uschar **msgptr)
2224 {
2225 header_line *h;
2226 uschar *colon, *s;
2227
2228 for (h = header_list; h != NULL; h = h->next)
2229 {
2230 colon = Ustrchr(h->text, ':');
2231 for(s = h->text; s < colon; s++)
2232 {
2233 if ((*s < 33) || (*s > 126))
2234 {
2235 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2236 colon - h->text, h->text);
2237 return FAIL;
2238 }
2239 }
2240 }
2241 return OK;
2242 }
2243
2244 /*************************************************
2245 * Check for blind recipients *
2246 *************************************************/
2247
2248 /* This function checks that every (envelope) recipient is mentioned in either
2249 the To: or Cc: header lines, thus detecting blind carbon copies.
2250
2251 There are two ways of scanning that could be used: either scan the header lines
2252 and tick off the recipients, or scan the recipients and check the header lines.
2253 The original proposed patch did the former, but I have chosen to do the latter,
2254 because (a) it requires no memory and (b) will use fewer resources when there
2255 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2256
2257 Arguments: none
2258 Returns: OK if there are no blind recipients
2259 FAIL if there is at least one blind recipient
2260 */
2261
2262 int
2263 verify_check_notblind(void)
2264 {
2265 int i;
2266 for (i = 0; i < recipients_count; i++)
2267 {
2268 header_line *h;
2269 BOOL found = FALSE;
2270 uschar *address = recipients_list[i].address;
2271
2272 for (h = header_list; !found && h != NULL; h = h->next)
2273 {
2274 uschar *colon, *s;
2275
2276 if (h->type != htype_to && h->type != htype_cc) continue;
2277
2278 colon = Ustrchr(h->text, ':');
2279 s = colon + 1;
2280 while (isspace(*s)) s++;
2281
2282 /* Loop for multiple addresses in the header, enabling group syntax. Note
2283 that we have to reset this after the header has been scanned. */
2284
2285 parse_allow_group = TRUE;
2286
2287 while (*s != 0)
2288 {
2289 uschar *ss = parse_find_address_end(s, FALSE);
2290 uschar *recipient,*errmess;
2291 int terminator = *ss;
2292 int start, end, domain;
2293
2294 /* Temporarily terminate the string at this point, and extract the
2295 operative address within, allowing group syntax. */
2296
2297 *ss = 0;
2298 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2299 *ss = terminator;
2300
2301 /* If we found a valid recipient that has a domain, compare it with the
2302 envelope recipient. Local parts are compared case-sensitively, domains
2303 case-insensitively. By comparing from the start with length "domain", we
2304 include the "@" at the end, which ensures that we are comparing the whole
2305 local part of each address. */
2306
2307 if (recipient != NULL && domain != 0)
2308 {
2309 found = Ustrncmp(recipient, address, domain) == 0 &&
2310 strcmpic(recipient + domain, address + domain) == 0;
2311 if (found) break;
2312 }
2313
2314 /* Advance to the next address */
2315
2316 s = ss + (terminator? 1:0);
2317 while (isspace(*s)) s++;
2318 } /* Next address */
2319
2320 parse_allow_group = FALSE;
2321 parse_found_group = FALSE;
2322 } /* Next header (if found is false) */
2323
2324 if (!found) return FAIL;
2325 } /* Next recipient */
2326
2327 return OK;
2328 }
2329
2330
2331
2332 /*************************************************
2333 * Find if verified sender *
2334 *************************************************/
2335
2336 /* Usually, just a single address is verified as the sender of the message.
2337 However, Exim can be made to verify other addresses as well (often related in
2338 some way), and this is useful in some environments. There may therefore be a
2339 chain of such addresses that have previously been tested. This function finds
2340 whether a given address is on the chain.
2341
2342 Arguments: the address to be verified
2343 Returns: pointer to an address item, or NULL
2344 */
2345
2346 address_item *
2347 verify_checked_sender(uschar *sender)
2348 {
2349 address_item *addr;
2350 for (addr = sender_verified_list; addr != NULL; addr = addr->next)
2351 if (Ustrcmp(sender, addr->address) == 0) break;
2352 return addr;
2353 }
2354
2355
2356
2357
2358
2359 /*************************************************
2360 * Get valid header address *
2361 *************************************************/
2362
2363 /* Scan the originator headers of the message, looking for an address that
2364 verifies successfully. RFC 822 says:
2365
2366 o The "Sender" field mailbox should be sent notices of
2367 any problems in transport or delivery of the original
2368 messages. If there is no "Sender" field, then the
2369 "From" field mailbox should be used.
2370
2371 o If the "Reply-To" field exists, then the reply should
2372 go to the addresses indicated in that field and not to
2373 the address(es) indicated in the "From" field.
2374
2375 So we check a Sender field if there is one, else a Reply_to field, else a From
2376 field. As some strange messages may have more than one of these fields,
2377 especially if they are resent- fields, check all of them if there is more than
2378 one.
2379
2380 Arguments:
2381 user_msgptr points to where to put a user error message
2382 log_msgptr points to where to put a log error message
2383 callout timeout for callout check (passed to verify_address())
2384 callout_overall overall callout timeout (ditto)
2385 callout_connect connect callout timeout (ditto)
2386 se_mailfrom mailfrom for verify; NULL => ""
2387 pm_mailfrom sender for pm callout check (passed to verify_address())
2388 options callout options (passed to verify_address())
2389 verrno where to put the address basic_errno
2390
2391 If log_msgptr is set to something without setting user_msgptr, the caller
2392 normally uses log_msgptr for both things.
2393
2394 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2395 FAIL is given if no appropriate headers are found
2396 */
2397
2398 int
2399 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2400 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2401 uschar *pm_mailfrom, int options, int *verrno)
2402 {
2403 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2404 BOOL done = FALSE;
2405 int yield = FAIL;
2406 int i;
2407
2408 for (i = 0; i < 3 && !done; i++)
2409 {
2410 header_line *h;
2411 for (h = header_list; h != NULL && !done; h = h->next)
2412 {
2413 int terminator, new_ok;
2414 uschar *s, *ss, *endname;
2415
2416 if (h->type != header_types[i]) continue;
2417 s = endname = Ustrchr(h->text, ':') + 1;
2418
2419 /* Scan the addresses in the header, enabling group syntax. Note that we
2420 have to reset this after the header has been scanned. */
2421
2422 parse_allow_group = TRUE;
2423
2424 while (*s != 0)
2425 {
2426 address_item *vaddr;
2427
2428 while (isspace(*s) || *s == ',') s++;
2429 if (*s == 0) break; /* End of header */
2430
2431 ss = parse_find_address_end(s, FALSE);
2432
2433 /* The terminator is a comma or end of header, but there may be white
2434 space preceding it (including newline for the last address). Move back
2435 past any white space so we can check against any cached envelope sender
2436 address verifications. */
2437
2438 while (isspace(ss[-1])) ss--;
2439 terminator = *ss;
2440 *ss = 0;
2441
2442 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2443 (int)(endname - h->text), h->text, s);
2444
2445 /* See if we have already verified this address as an envelope sender,
2446 and if so, use the previous answer. */
2447
2448 vaddr = verify_checked_sender(s);
2449
2450 if (vaddr != NULL && /* Previously checked */
2451 (callout <= 0 || /* No callout needed; OR */
2452 vaddr->special_action > 256)) /* Callout was done */
2453 {
2454 new_ok = vaddr->special_action & 255;
2455 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2456 *ss = terminator; /* Restore shortened string */
2457 }
2458
2459 /* Otherwise we run the verification now. We must restore the shortened
2460 string before running the verification, so the headers are correct, in
2461 case there is any rewriting. */
2462
2463 else
2464 {
2465 int start, end, domain;
2466 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2467 &domain, FALSE);
2468
2469 *ss = terminator;
2470
2471 /* If we found an empty address, just carry on with the next one, but
2472 kill the message. */
2473
2474 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2475 {
2476 *log_msgptr = NULL;
2477 s = ss;
2478 continue;
2479 }
2480
2481 /* If verification failed because of a syntax error, fail this
2482 function, and ensure that the failing address gets added to the error
2483 message. */
2484
2485 if (address == NULL)
2486 {
2487 new_ok = FAIL;
2488 while (ss > s && isspace(ss[-1])) ss--;
2489 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2490 "scanning for sender: %s in \"%.*s\"",
2491 endname - h->text, h->text, *log_msgptr, ss - s, s);
2492 yield = FAIL;
2493 done = TRUE;
2494 break;
2495 }
2496
2497 /* Else go ahead with the sender verification. But it isn't *the*
2498 sender of the message, so set vopt_fake_sender to stop sender_address
2499 being replaced after rewriting or qualification. */
2500
2501 else
2502 {
2503 vaddr = deliver_make_addr(address, FALSE);
2504 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2505 callout, callout_overall, callout_connect, se_mailfrom,
2506 pm_mailfrom, NULL);
2507 }
2508 }
2509
2510 /* We now have the result, either newly found, or cached. If we are
2511 giving out error details, set a specific user error. This means that the
2512 last of these will be returned to the user if all three fail. We do not
2513 set a log message - the generic one below will be used. */
2514
2515 if (new_ok != OK)
2516 {
2517 *verrno = vaddr->basic_errno;
2518 if (smtp_return_error_details)
2519 {
2520 *user_msgptr = string_sprintf("Rejected after DATA: "
2521 "could not verify \"%.*s\" header address\n%s: %s",
2522 endname - h->text, h->text, vaddr->address, vaddr->message);
2523 }
2524 }
2525
2526 /* Success or defer */
2527
2528 if (new_ok == OK)
2529 {
2530 yield = OK;
2531 done = TRUE;
2532 break;
2533 }
2534
2535 if (new_ok == DEFER) yield = DEFER;
2536
2537 /* Move on to any more addresses in the header */
2538
2539 s = ss;
2540 } /* Next address */
2541
2542 parse_allow_group = FALSE;
2543 parse_found_group = FALSE;
2544 } /* Next header, unless done */
2545 } /* Next header type unless done */
2546
2547 if (yield == FAIL && *log_msgptr == NULL)
2548 *log_msgptr = US"there is no valid sender in any header line";
2549
2550 if (yield == DEFER && *log_msgptr == NULL)
2551 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2552
2553 return yield;
2554 }
2555
2556
2557
2558
2559 /*************************************************
2560 * Get RFC 1413 identification *
2561 *************************************************/
2562
2563 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2564 the timeout is set to zero, then the query is not done. There may also be lists
2565 of hosts and nets which are exempt. To guard against malefactors sending
2566 non-printing characters which could, for example, disrupt a message's headers,
2567 make sure the string consists of printing characters only.
2568
2569 Argument:
2570 port the port to connect to; usually this is IDENT_PORT (113), but when
2571 running in the test harness with -bh a different value is used.
2572
2573 Returns: nothing
2574
2575 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2576 */
2577
2578 void
2579 verify_get_ident(int port)
2580 {
2581 int sock, host_af, qlen;
2582 int received_sender_port, received_interface_port, n;
2583 uschar *p;
2584 uschar buffer[2048];
2585
2586 /* Default is no ident. Check whether we want to do an ident check for this
2587 host. */
2588
2589 sender_ident = NULL;
2590 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2591 return;
2592
2593 DEBUG(D_ident) debug_printf("doing ident callback\n");
2594
2595 /* Set up a connection to the ident port of the remote host. Bind the local end
2596 to the incoming interface address. If the sender host address is an IPv6
2597 address, the incoming interface address will also be IPv6. */
2598
2599 host_af = (Ustrchr(sender_host_address, ':') == NULL)? AF_INET : AF_INET6;
2600 sock = ip_socket(SOCK_STREAM, host_af);
2601 if (sock < 0) return;
2602
2603 if (ip_bind(sock, host_af, interface_address, 0) < 0)
2604 {
2605 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2606 strerror(errno));
2607 goto END_OFF;
2608 }
2609
2610 if (ip_connect(sock, host_af, sender_host_address, port, rfc1413_query_timeout)
2611 < 0)
2612 {
2613 if (errno == ETIMEDOUT && (log_extra_selector & LX_ident_timeout) != 0)
2614 {
2615 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2616 sender_host_address);
2617 }
2618 else
2619 {
2620 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2621 sender_host_address, strerror(errno));
2622 }
2623 goto END_OFF;
2624 }
2625
2626 /* Construct and send the query. */
2627
2628 sprintf(CS buffer, "%d , %d\r\n", sender_host_port, interface_port);
2629 qlen = Ustrlen(buffer);
2630 if (send(sock, buffer, qlen, 0) < 0)
2631 {
2632 DEBUG(D_ident) debug_printf("ident send failed: %s\n", strerror(errno));
2633 goto END_OFF;
2634 }
2635
2636 /* Read a response line. We put it into the rest of the buffer, using several
2637 recv() calls if necessary. */
2638
2639 p = buffer + qlen;
2640
2641 for (;;)
2642 {
2643 uschar *pp;
2644 int count;
2645 int size = sizeof(buffer) - (p - buffer);
2646
2647 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2648 count = ip_recv(sock, p, size, rfc1413_query_timeout);
2649 if (count <= 0) goto END_OFF; /* Read error or EOF */
2650
2651 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2652 generous, and accept a plain \n terminator as well. The only illegal
2653 character is 0. */
2654
2655 for (pp = p; pp < p + count; pp++)
2656 {
2657 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2658 if (*pp == '\n')
2659 {
2660 if (pp[-1] == '\r') pp--;
2661 *pp = 0;
2662 goto GOT_DATA; /* Break out of both loops */
2663 }
2664 }
2665
2666 /* Reached the end of the data without finding \n. Let the loop continue to
2667 read some more, if there is room. */
2668
2669 p = pp;
2670 }
2671
2672 GOT_DATA:
2673
2674 /* We have received a line of data. Check it carefully. It must start with the
2675 same two port numbers that we sent, followed by data as defined by the RFC. For
2676 example,
2677
2678 12345 , 25 : USERID : UNIX :root
2679
2680 However, the amount of white space may be different to what we sent. In the
2681 "osname" field there may be several sub-fields, comma separated. The data we
2682 actually want to save follows the third colon. Some systems put leading spaces
2683 in it - we discard those. */
2684
2685 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2686 &received_interface_port, &n) != 2 ||
2687 received_sender_port != sender_host_port ||
2688 received_interface_port != interface_port)
2689 goto END_OFF;
2690
2691 p = buffer + qlen + n;
2692 while(isspace(*p)) p++;
2693 if (*p++ != ':') goto END_OFF;
2694 while(isspace(*p)) p++;
2695 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2696 p += 6;
2697 while(isspace(*p)) p++;
2698 if (*p++ != ':') goto END_OFF;
2699 while (*p != 0 && *p != ':') p++;
2700 if (*p++ == 0) goto END_OFF;
2701 while(isspace(*p)) p++;
2702 if (*p == 0) goto END_OFF;
2703
2704 /* The rest of the line is the data we want. We turn it into printing
2705 characters when we save it, so that it cannot mess up the format of any logging
2706 or Received: lines into which it gets inserted. We keep a maximum of 127
2707 characters. */
2708
2709 sender_ident = string_printing(string_copyn(p, 127));
2710 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2711
2712 END_OFF:
2713 (void)close(sock);
2714 return;
2715 }
2716
2717
2718
2719
2720 /*************************************************
2721 * Match host to a single host-list item *
2722 *************************************************/
2723
2724 /* This function compares a host (name or address) against a single item
2725 from a host list. The host name gets looked up if it is needed and is not
2726 already known. The function is called from verify_check_this_host() via
2727 match_check_list(), which is why most of its arguments are in a single block.
2728
2729 Arguments:
2730 arg the argument block (see below)
2731 ss the host-list item
2732 valueptr where to pass back looked up data, or NULL
2733 error for error message when returning ERROR
2734
2735 The block contains:
2736 host_name (a) the host name, or
2737 (b) NULL, implying use sender_host_name and
2738 sender_host_aliases, looking them up if required, or
2739 (c) the empty string, meaning that only IP address matches
2740 are permitted
2741 host_address the host address
2742 host_ipv4 the IPv4 address taken from an IPv6 one
2743
2744 Returns: OK matched
2745 FAIL did not match
2746 DEFER lookup deferred
2747 ERROR (a) failed to find the host name or IP address, or
2748 (b) unknown lookup type specified, or
2749 (c) host name encountered when only IP addresses are
2750 being matched
2751 */
2752
2753 int
2754 check_host(void *arg, uschar *ss, uschar **valueptr, uschar **error)
2755 {
2756 check_host_block *cb = (check_host_block *)arg;
2757 int mlen = -1;
2758 int maskoffset;
2759 BOOL iplookup = FALSE;
2760 BOOL isquery = FALSE;
2761 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
2762 uschar *t;
2763 uschar *semicolon;
2764 uschar **aliases;
2765
2766 /* Optimize for the special case when the pattern is "*". */
2767
2768 if (*ss == '*' && ss[1] == 0) return OK;
2769
2770 /* If the pattern is empty, it matches only in the case when there is no host -
2771 this can occur in ACL checking for SMTP input using the -bs option. In this
2772 situation, the host address is the empty string. */
2773
2774 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2775 if (*ss == 0) return FAIL;
2776
2777 /* If the pattern is precisely "@" then match against the primary host name,
2778 provided that host name matching is permitted; if it's "@[]" match against the
2779 local host's IP addresses. */
2780
2781 if (*ss == '@')
2782 {
2783 if (ss[1] == 0)
2784 {
2785 if (isiponly) return ERROR;
2786 ss = primary_hostname;
2787 }
2788 else if (Ustrcmp(ss, "@[]") == 0)
2789 {
2790 ip_address_item *ip;
2791 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
2792 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2793 return FAIL;
2794 }
2795 }
2796
2797 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2798 a (possibly masked) comparision with the current IP address. */
2799
2800 if (string_is_ip_address(ss, &maskoffset) != 0)
2801 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2802
2803 /* The pattern is not an IP address. A common error that people make is to omit
2804 one component of an IPv4 address, either by accident, or believing that, for
2805 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2806 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2807 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2808 ancient specification.) To aid in debugging these cases, we give a specific
2809 error if the pattern contains only digits and dots or contains a slash preceded
2810 only by digits and dots (a slash at the start indicates a file name and of
2811 course slashes may be present in lookups, but not preceded only by digits and
2812 dots). */
2813
2814 for (t = ss; isdigit(*t) || *t == '.'; t++);
2815 if (*t == 0 || (*t == '/' && t != ss))
2816 {
2817 *error = US"malformed IPv4 address or address mask";
2818 return ERROR;
2819 }
2820
2821 /* See if there is a semicolon in the pattern */
2822
2823 semicolon = Ustrchr(ss, ';');
2824
2825 /* If we are doing an IP address only match, then all lookups must be IP
2826 address lookups, even if there is no "net-". */
2827
2828 if (isiponly)
2829 {
2830 iplookup = semicolon != NULL;
2831 }
2832
2833 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
2834 a lookup on a masked IP network, in textual form. We obey this code even if we
2835 have already set iplookup, so as to skip over the "net-" prefix and to set the
2836 mask length. The net- stuff really only applies to single-key lookups where the
2837 key is implicit. For query-style lookups the key is specified in the query.
2838 From release 4.30, the use of net- for query style is no longer needed, but we
2839 retain it for backward compatibility. */
2840
2841 if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
2842 {
2843 mlen = 0;
2844 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2845 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2846 iplookup = (*t++ == '-');
2847 }
2848 else t = ss;
2849
2850 /* Do the IP address lookup if that is indeed what we have */
2851
2852 if (iplookup)
2853 {
2854 int insize;
2855 int search_type;
2856 int incoming[4];
2857 void *handle;
2858 uschar *filename, *key, *result;
2859 uschar buffer[64];
2860
2861 /* Find the search type */
2862
2863 search_type = search_findtype(t, semicolon - t);
2864
2865 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2866 search_error_message);
2867
2868 /* Adjust parameters for the type of lookup. For a query-style lookup, there
2869 is no file name, and the "key" is just the query. For query-style with a file
2870 name, we have to fish the file off the start of the query. For a single-key
2871 lookup, the key is the current IP address, masked appropriately, and
2872 reconverted to text form, with the mask appended. For IPv6 addresses, specify
2873 dot separators instead of colons, except when the lookup type is "iplsearch".
2874 */
2875
2876 if (mac_islookup(search_type, lookup_absfilequery))
2877 {
2878 filename = semicolon + 1;
2879 key = filename;
2880 while (*key != 0 && !isspace(*key)) key++;
2881 filename = string_copyn(filename, key - filename);
2882 while (isspace(*key)) key++;
2883 }
2884 else if (mac_islookup(search_type, lookup_querystyle))
2885 {
2886 filename = NULL;
2887 key = semicolon + 1;
2888 }
2889 else /* Single-key style */
2890 {
2891 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
2892 ':' : '.';
2893 insize = host_aton(cb->host_address, incoming);
2894 host_mask(insize, incoming, mlen);
2895 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
2896 key = buffer;
2897 filename = semicolon + 1;
2898 }
2899
2900 /* Now do the actual lookup; note that there is no search_close() because
2901 of the caching arrangements. */
2902
2903 handle = search_open(filename, search_type, 0, NULL, NULL);
2904 if (handle == NULL) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2905 search_error_message);
2906 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
2907 if (valueptr != NULL) *valueptr = result;
2908 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
2909 }
2910
2911 /* The pattern is not an IP address or network reference of any kind. That is,
2912 it is a host name pattern. If this is an IP only match, there's an error in the
2913 host list. */
2914
2915 if (isiponly)
2916 {
2917 *error = US"cannot match host name in match_ip list";
2918 return ERROR;
2919 }
2920
2921 /* Check the characters of the pattern to see if they comprise only letters,
2922 digits, full stops, and hyphens (the constituents of domain names). Allow
2923 underscores, as they are all too commonly found. Sigh. Also, if
2924 allow_utf8_domains is set, allow top-bit characters. */
2925
2926 for (t = ss; *t != 0; t++)
2927 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
2928 (!allow_utf8_domains || *t < 128)) break;
2929
2930 /* If the pattern is a complete domain name, with no fancy characters, look up
2931 its IP address and match against that. Note that a multi-homed host will add
2932 items to the chain. */
2933
2934 if (*t == 0)
2935 {
2936 int rc;
2937 host_item h;
2938 h.next = NULL;
2939 h.name = ss;
2940 h.address = NULL;
2941 h.mx = MX_NONE;
2942
2943 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
2944 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
2945 {
2946 host_item *hh;
2947 for (hh = &h; hh != NULL; hh = hh->next)
2948 {
2949 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
2950 }
2951 return FAIL;
2952 }
2953 if (rc == HOST_FIND_AGAIN) return DEFER;
2954 *error = string_sprintf("failed to find IP address for %s", ss);
2955 return ERROR;
2956 }
2957
2958 /* Almost all subsequent comparisons require the host name, and can be done
2959 using the general string matching function. When this function is called for
2960 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
2961 must use sender_host_name and its aliases, looking them up if necessary. */
2962
2963 if (cb->host_name != NULL) /* Explicit host name given */
2964 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
2965 valueptr);
2966
2967 /* Host name not given; in principle we need the sender host name and its
2968 aliases. However, for query-style lookups, we do not need the name if the
2969 query does not contain $sender_host_name. From release 4.23, a reference to
2970 $sender_host_name causes it to be looked up, so we don't need to do the lookup
2971 on spec. */
2972
2973 if ((semicolon = Ustrchr(ss, ';')) != NULL)
2974 {
2975 uschar *affix;
2976 int partial, affixlen, starflags, id;
2977
2978 *semicolon = 0;
2979 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
2980 *semicolon=';';
2981
2982 if (id < 0) /* Unknown lookup type */
2983 {
2984 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
2985 search_error_message, ss);
2986 return DEFER;
2987 }
2988 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
2989 }
2990
2991 if (isquery)
2992 {
2993 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
2994 {
2995 case OK: return OK;
2996 case DEFER: return DEFER;
2997 default: return FAIL;
2998 }
2999 }
3000
3001 /* Not a query-style lookup; must ensure the host name is present, and then we
3002 do a check on the name and all its aliases. */
3003
3004 if (sender_host_name == NULL)
3005 {
3006 HDEBUG(D_host_lookup)
3007 debug_printf("sender host name required, to match against %s\n", ss);
3008 if (host_lookup_failed || host_name_lookup() != OK)
3009 {
3010 *error = string_sprintf("failed to find host name for %s",
3011 sender_host_address);;
3012 return ERROR;
3013 }
3014 host_build_sender_fullhost();
3015 }
3016
3017 /* Match on the sender host name, using the general matching function */
3018
3019 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
3020 valueptr))
3021 {
3022 case OK: return OK;
3023 case DEFER: return DEFER;
3024 }
3025
3026 /* If there are aliases, try matching on them. */
3027
3028 aliases = sender_host_aliases;
3029 while (*aliases != NULL)
3030 {
3031 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3032 {
3033 case OK: return OK;
3034 case DEFER: return DEFER;
3035 }
3036 }
3037 return FAIL;
3038 }
3039
3040
3041
3042
3043 /*************************************************
3044 * Check a specific host matches a host list *
3045 *************************************************/
3046
3047 /* This function is passed a host list containing items in a number of
3048 different formats and the identity of a host. Its job is to determine whether
3049 the given host is in the set of hosts defined by the list. The host name is
3050 passed as a pointer so that it can be looked up if needed and not already
3051 known. This is commonly the case when called from verify_check_host() to check
3052 an incoming connection. When called from elsewhere the host name should usually
3053 be set.
3054
3055 This function is now just a front end to match_check_list(), which runs common
3056 code for scanning a list. We pass it the check_host() function to perform a
3057 single test.
3058
3059 Arguments:
3060 listptr pointer to the host list
3061 cache_bits pointer to cache for named lists, or NULL
3062 host_name the host name or NULL, implying use sender_host_name and
3063 sender_host_aliases, looking them up if required
3064 host_address the IP address
3065 valueptr if not NULL, data from a lookup is passed back here
3066
3067 Returns: OK if the host is in the defined set
3068 FAIL if the host is not in the defined set,
3069 DEFER if a data lookup deferred (not a host lookup)
3070
3071 If the host name was needed in order to make a comparison, and could not be
3072 determined from the IP address, the result is FAIL unless the item
3073 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3074
3075 int
3076 verify_check_this_host(uschar **listptr, unsigned int *cache_bits,
3077 uschar *host_name, uschar *host_address, uschar **valueptr)
3078 {
3079 int rc;
3080 unsigned int *local_cache_bits = cache_bits;
3081 uschar *save_host_address = deliver_host_address;
3082 check_host_block cb;
3083 cb.host_name = host_name;
3084 cb.host_address = host_address;
3085
3086 if (valueptr != NULL) *valueptr = NULL;
3087
3088 /* If the host address starts off ::ffff: it is an IPv6 address in
3089 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3090 addresses. */
3091
3092 cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
3093 host_address + 7 : host_address;
3094
3095 /* During the running of the check, put the IP address into $host_address. In
3096 the case of calls from the smtp transport, it will already be there. However,
3097 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3098 the safe side, any existing setting is preserved, though as I write this
3099 (November 2004) I can't see any cases where it is actually needed. */
3100
3101 deliver_host_address = host_address;
3102 rc = match_check_list(
3103 listptr, /* the list */
3104 0, /* separator character */
3105 &hostlist_anchor, /* anchor pointer */
3106 &local_cache_bits, /* cache pointer */
3107 check_host, /* function for testing */
3108 &cb, /* argument for function */
3109 MCL_HOST, /* type of check */
3110 (host_address == sender_host_address)?
3111 US"host" : host_address, /* text for debugging */
3112 valueptr); /* where to pass back data */
3113 deliver_host_address = save_host_address;
3114 return rc;
3115 }
3116
3117
3118
3119
3120 /*************************************************
3121 * Check the remote host matches a list *
3122 *************************************************/
3123
3124 /* This is a front end to verify_check_this_host(), created because checking
3125 the remote host is a common occurrence. With luck, a good compiler will spot
3126 the tail recursion and optimize it. If there's no host address, this is
3127 command-line SMTP input - check against an empty string for the address.
3128
3129 Arguments:
3130 listptr pointer to the host list
3131
3132 Returns: the yield of verify_check_this_host(),
3133 i.e. OK, FAIL, or DEFER
3134 */
3135
3136 int
3137 verify_check_host(uschar **listptr)
3138 {
3139 return verify_check_this_host(listptr, sender_host_cache, NULL,
3140 (sender_host_address == NULL)? US"" : sender_host_address, NULL);
3141 }
3142
3143
3144
3145
3146
3147 /*************************************************
3148 * Invert an IP address *
3149 *************************************************/
3150
3151 /* Originally just used for DNS xBL lists, now also used for the
3152 reverse_ip expansion operator.
3153
3154 Arguments:
3155 buffer where to put the answer
3156 address the address to invert
3157 */
3158
3159 void
3160 invert_address(uschar *buffer, uschar *address)
3161 {
3162 int bin[4];
3163 uschar *bptr = buffer;
3164
3165 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3166 to the IPv4 part only. */
3167
3168 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3169
3170 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3171 always 1. */
3172
3173 if (host_aton(address, bin) == 1)
3174 {
3175 int i;
3176 int x = bin[0];
3177 for (i = 0; i < 4; i++)
3178 {
3179 sprintf(CS bptr, "%d.", x & 255);
3180 while (*bptr) bptr++;
3181 x >>= 8;
3182 }
3183 }
3184
3185 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3186 in any DNS black lists, and the format in which they will be looked up is
3187 unknown. This is just a guess. */
3188
3189 #if HAVE_IPV6
3190 else
3191 {
3192 int i, j;
3193 for (j = 3; j >= 0; j--)
3194 {
3195 int x = bin[j];
3196 for (i = 0; i < 8; i++)
3197 {
3198 sprintf(CS bptr, "%x.", x & 15);
3199 while (*bptr) bptr++;
3200 x >>= 4;
3201 }
3202 }
3203 }
3204 #endif
3205
3206 /* Remove trailing period -- this is needed so that both arbitrary
3207 dnsbl keydomains and inverted addresses may be combined with the
3208 same format string, "%s.%s" */
3209
3210 *(--bptr) = 0;
3211 }
3212
3213
3214
3215 /*************************************************
3216 * Perform a single dnsbl lookup *
3217 *************************************************/
3218
3219 /* This function is called from verify_check_dnsbl() below. It is also called
3220 recursively from within itself when domain and domain_txt are different
3221 pointers, in order to get the TXT record from the alternate domain.
3222
3223 Arguments:
3224 domain the outer dnsbl domain
3225 domain_txt alternate domain to lookup TXT record on success; when the
3226 same domain is to be used, domain_txt == domain (that is,
3227 the pointers must be identical, not just the text)
3228 keydomain the current keydomain (for debug message)
3229 prepend subdomain to lookup (like keydomain, but
3230 reversed if IP address)
3231 iplist the list of matching IP addresses, or NULL for "any"
3232 bitmask true if bitmask matching is wanted
3233 match_type condition for 'succeed' result
3234 0 => Any RR in iplist (=)
3235 1 => No RR in iplist (!=)
3236 2 => All RRs in iplist (==)
3237 3 => Some RRs not in iplist (!==)
3238 the two bits are defined as MT_NOT and MT_ALL
3239 defer_return what to return for a defer
3240
3241 Returns: OK if lookup succeeded
3242 FAIL if not
3243 */
3244
3245 static int
3246 one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain,
3247 uschar *prepend, uschar *iplist, BOOL bitmask, int match_type,
3248 int defer_return)
3249 {
3250 dns_answer dnsa;
3251 dns_scan dnss;
3252 tree_node *t;
3253 dnsbl_cache_block *cb;
3254 int old_pool = store_pool;
3255 uschar query[256]; /* DNS domain max length */
3256
3257 /* Construct the specific query domainname */
3258
3259 if (!string_format(query, sizeof(query), "%s.%s", prepend, domain))
3260 {
3261 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
3262 "(ignored): %s...", query);
3263 return FAIL;
3264 }
3265
3266 /* Look for this query in the cache. */
3267
3268 t = tree_search(dnsbl_cache, query);
3269
3270 /* If not cached from a previous lookup, we must do a DNS lookup, and
3271 cache the result in permanent memory. */
3272
3273 if (t == NULL)
3274 {
3275 store_pool = POOL_PERM;
3276
3277 /* Set up a tree entry to cache the lookup */
3278
3279 t = store_get(sizeof(tree_node) + Ustrlen(query));
3280 Ustrcpy(t->name, query);
3281 t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block));
3282 (void)tree_insertnode(&dnsbl_cache, t);
3283
3284 /* Do the DNS loopup . */
3285
3286 HDEBUG(D_dnsbl) debug_printf("new DNS lookup for %s\n", query);
3287 cb->rc = dns_basic_lookup(&dnsa, query, T_A);
3288 cb->text_set = FALSE;
3289 cb->text = NULL;
3290 cb->rhs = NULL;
3291
3292 /* If the lookup succeeded, cache the RHS address. The code allows for
3293 more than one address - this was for complete generality and the possible
3294 use of A6 records. However, A6 records have been reduced to experimental
3295 status (August 2001) and may die out. So they may never get used at all,
3296 let alone in dnsbl records. However, leave the code here, just in case.
3297
3298 Quite apart from one A6 RR generating multiple addresses, there are DNS
3299 lists that return more than one A record, so we must handle multiple
3300 addresses generated in that way as well. */
3301
3302 if (cb->rc == DNS_SUCCEED)
3303 {
3304 dns_record *rr;
3305 dns_address **addrp = &(cb->rhs);
3306 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
3307 rr != NULL;
3308 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
3309 {
3310 if (rr->type == T_A)
3311 {
3312 dns_address *da = dns_address_from_rr(&dnsa, rr);
3313 if (da != NULL)
3314 {
3315 *addrp = da;
3316 while (da->next != NULL) da = da->next;
3317 addrp = &(da->next);
3318 }
3319 }
3320 }
3321
3322 /* If we didn't find any A records, change the return code. This can
3323 happen when there is a CNAME record but there are no A records for what
3324 it points to. */
3325
3326 if (cb->rhs == NULL) cb->rc = DNS_NODATA;
3327 }
3328
3329 store_pool = old_pool;
3330 }
3331
3332 /* Previous lookup was cached */
3333
3334 else
3335 {
3336 HDEBUG(D_dnsbl) debug_printf("using result of previous DNS lookup\n");
3337 cb = t->data.ptr;
3338 }
3339
3340 /* We now have the result of the DNS lookup, either newly done, or cached
3341 from a previous call. If the lookup succeeded, check against the address
3342 list if there is one. This may be a positive equality list (introduced by
3343 "="), a negative equality list (introduced by "!="), a positive bitmask
3344 list (introduced by "&"), or a negative bitmask list (introduced by "!&").*/
3345
3346 if (cb->rc == DNS_SUCCEED)
3347 {
3348 dns_address *da = NULL;
3349 uschar *addlist = cb->rhs->address;
3350
3351 /* For A and AAAA records, there may be multiple addresses from multiple
3352 records. For A6 records (currently not expected to be used) there may be
3353 multiple addresses from a single record. */
3354
3355 for (da = cb->rhs->next; da != NULL; da = da->next)
3356 addlist = string_sprintf("%s, %s", addlist, da->address);
3357
3358 HDEBUG(D_dnsbl) debug_printf("DNS lookup for %s succeeded (yielding %s)\n",
3359 query, addlist);
3360
3361 /* Address list check; this can be either for equality, or via a bitmask.
3362 In the latter case, all the bits must match. */
3363
3364 if (iplist != NULL)
3365 {
3366 for (da = cb->rhs; da != NULL; da = da->next)
3367 {
3368 int ipsep = ',';
3369 uschar ip[46];
3370 uschar *ptr = iplist;
3371 uschar *res;
3372
3373 /* Handle exact matching */
3374
3375 if (!bitmask)
3376 {
3377 while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip))) != NULL)
3378 {
3379 if (Ustrcmp(CS da->address, ip) == 0) break;
3380 }
3381 }
3382
3383 /* Handle bitmask matching */
3384
3385 else
3386 {
3387 int address[4];
3388 int mask = 0;
3389
3390 /* At present, all known DNS blocking lists use A records, with
3391 IPv4 addresses on the RHS encoding the information they return. I
3392 wonder if this will linger on as the last vestige of IPv4 when IPv6
3393 is ubiquitous? Anyway, for now we use paranoia code to completely
3394 ignore IPv6 addresses. The default mask is 0, which always matches.
3395 We change this only for IPv4 addresses in the list. */
3396
3397 if (host_aton(da->address, address) == 1) mask = address[0];
3398
3399 /* Scan the returned addresses, skipping any that are IPv6 */
3400
3401 while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip))) != NULL)
3402 {
3403 if (host_aton(ip, address) != 1) continue;
3404 if ((address[0] & mask) == address[0]) break;
3405 }
3406 }
3407
3408 /* If either
3409
3410 (a) An IP address in an any ('=') list matched, or
3411 (b) No IP address in an all ('==') list matched
3412
3413 then we're done searching. */
3414
3415 if (((match_type & MT_ALL) != 0) == (res == NULL)) break;
3416 }
3417
3418 /* If da == NULL, either
3419
3420 (a) No IP address in an any ('=') list matched, or
3421 (b) An IP address in an all ('==') list didn't match
3422
3423 so behave as if the DNSBL lookup had not succeeded, i.e. the host is not on
3424 the list. */
3425
3426 if ((match_type == MT_NOT || match_type == MT_ALL) != (da == NULL))
3427 {
3428 HDEBUG(D_dnsbl)
3429 {
3430 uschar *res = NULL;
3431 switch(match_type)
3432 {
3433 case 0:
3434 res = US"was no match";
3435 break;
3436 case MT_NOT:
3437 res = US"was an exclude match";
3438 break;
3439 case MT_ALL:
3440 res = US"was an IP address that did not match";
3441 break;
3442 case MT_NOT|MT_ALL:
3443 res = US"were no IP addresses that did not match";
3444 break;
3445 }
3446 debug_printf("=> but we are not accepting this block class because\n");
3447 debug_printf("=> there %s for %s%c%s\n",
3448 res,
3449 ((match_type & MT_ALL) == 0)? "" : "=",
3450 bitmask? '&' : '=', iplist);
3451 }
3452 return FAIL;
3453 }
3454 }
3455
3456 /* Either there was no IP list, or the record matched, implying that the
3457 domain is on the list. We now want to find a corresponding TXT record. If an
3458 alternate domain is specified for the TXT record, call this function