Avoid pure-ACK TCP segments during command phase
[exim.git] / src / src / verify.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions concerned with verifying things. The original code for callout
9 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
10
11
12 #include "exim.h"
13 #include "transports/smtp.h"
14
15 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
17 static smtp_outblock ctblock;
18 uschar ctbuffer[8192];
19
20
21 /* Structure for caching DNSBL lookups */
22
23 typedef struct dnsbl_cache_block {
24 time_t expiry;
25 dns_address *rhs;
26 uschar *text;
27 int rc;
28 BOOL text_set;
29 } dnsbl_cache_block;
30
31
32 /* Anchor for DNSBL cache */
33
34 static tree_node *dnsbl_cache = NULL;
35
36
37 /* Bits for match_type in one_check_dnsbl() */
38
39 #define MT_NOT 1
40 #define MT_ALL 2
41
42 static uschar cutthrough_response(char, uschar **);
43
44 static int off = 0; /* for use by setsockopt */
45
46
47 /*************************************************
48 * Retrieve a callout cache record *
49 *************************************************/
50
51 /* If a record exists, check whether it has expired.
52
53 Arguments:
54 dbm_file an open hints file
55 key the record key
56 type "address" or "domain"
57 positive_expire expire time for positive records
58 negative_expire expire time for negative records
59
60 Returns: the cache record if a non-expired one exists, else NULL
61 */
62
63 static dbdata_callout_cache *
64 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
65 int positive_expire, int negative_expire)
66 {
67 BOOL negative;
68 int length, expire;
69 time_t now;
70 dbdata_callout_cache *cache_record;
71
72 cache_record = dbfn_read_with_length(dbm_file, key, &length);
73
74 if (cache_record == NULL)
75 {
76 HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
77 return NULL;
78 }
79
80 /* We treat a record as "negative" if its result field is not positive, or if
81 it is a domain record and the postmaster field is negative. */
82
83 negative = cache_record->result != ccache_accept ||
84 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
85 expire = negative? negative_expire : positive_expire;
86 now = time(NULL);
87
88 if (now - cache_record->time_stamp > expire)
89 {
90 HDEBUG(D_verify) debug_printf("callout cache: %s record expired for %s\n", type, key);
91 return NULL;
92 }
93
94 /* If this is a non-reject domain record, check for the obsolete format version
95 that doesn't have the postmaster and random timestamps, by looking at the
96 length. If so, copy it to a new-style block, replicating the record's
97 timestamp. Then check the additional timestamps. (There's no point wasting
98 effort if connections are rejected.) */
99
100 if (type[0] == 'd' && cache_record->result != ccache_reject)
101 {
102 if (length == sizeof(dbdata_callout_cache_obs))
103 {
104 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
105 memcpy(new, cache_record, length);
106 new->postmaster_stamp = new->random_stamp = new->time_stamp;
107 cache_record = new;
108 }
109
110 if (now - cache_record->postmaster_stamp > expire)
111 cache_record->postmaster_result = ccache_unknown;
112
113 if (now - cache_record->random_stamp > expire)
114 cache_record->random_result = ccache_unknown;
115 }
116
117 HDEBUG(D_verify) debug_printf("callout cache: found %s record for %s\n", type, key);
118 return cache_record;
119 }
120
121
122
123 /*************************************************
124 * Do callout verification for an address *
125 *************************************************/
126
127 /* This function is called from verify_address() when the address has routed to
128 a host list, and a callout has been requested. Callouts are expensive; that is
129 why a cache is used to improve the efficiency.
130
131 Arguments:
132 addr the address that's been routed
133 host_list the list of hosts to try
134 tf the transport feedback block
135
136 ifstring "interface" option from transport, or NULL
137 portstring "port" option from transport, or NULL
138 protocolstring "protocol" option from transport, or NULL
139 callout the per-command callout timeout
140 callout_overall the overall callout timeout (if < 0 use 4*callout)
141 callout_connect the callout connection timeout (if < 0 use callout)
142 options the verification options - these bits are used:
143 vopt_is_recipient => this is a recipient address
144 vopt_callout_no_cache => don't use callout cache
145 vopt_callout_fullpm => if postmaster check, do full one
146 vopt_callout_random => do the "random" thing
147 vopt_callout_recipsender => use real sender for recipient
148 vopt_callout_recippmaster => use postmaster for recipient
149 se_mailfrom MAIL FROM address for sender verify; NULL => ""
150 pm_mailfrom if non-NULL, do the postmaster check with this sender
151
152 Returns: OK/FAIL/DEFER
153 */
154
155 static int
156 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
157 int callout, int callout_overall, int callout_connect, int options,
158 uschar *se_mailfrom, uschar *pm_mailfrom)
159 {
160 int yield = OK;
161 int old_domain_cache_result = ccache_accept;
162 BOOL done = FALSE;
163 uschar *address_key;
164 uschar *from_address;
165 uschar *random_local_part = NULL;
166 const uschar *save_deliver_domain = deliver_domain;
167 uschar **failure_ptr = options & vopt_is_recipient
168 ? &recipient_verify_failure : &sender_verify_failure;
169 open_db dbblock;
170 open_db *dbm_file = NULL;
171 dbdata_callout_cache new_domain_record;
172 dbdata_callout_cache_address new_address_record;
173 host_item *host;
174 time_t callout_start_time;
175 uschar peer_offered = 0;
176
177 new_domain_record.result = ccache_unknown;
178 new_domain_record.postmaster_result = ccache_unknown;
179 new_domain_record.random_result = ccache_unknown;
180
181 memset(&new_address_record, 0, sizeof(new_address_record));
182
183 /* For a recipient callout, the key used for the address cache record must
184 include the sender address if we are using the real sender in the callout,
185 because that may influence the result of the callout. */
186
187 address_key = addr->address;
188 from_address = US"";
189
190 if (options & vopt_is_recipient)
191 {
192 if (options & vopt_callout_recipsender)
193 {
194 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
195 from_address = sender_address;
196 if (cutthrough.delivery) options |= vopt_callout_no_cache;
197 }
198 else if (options & vopt_callout_recippmaster)
199 {
200 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
201 qualify_domain_sender);
202 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
203 }
204 }
205
206 /* For a sender callout, we must adjust the key if the mailfrom address is not
207 empty. */
208
209 else
210 {
211 from_address = (se_mailfrom == NULL)? US"" : se_mailfrom;
212 if (from_address[0] != 0)
213 address_key = string_sprintf("%s/<%s>", addr->address, from_address);
214 }
215
216 /* Open the callout cache database, it it exists, for reading only at this
217 stage, unless caching has been disabled. */
218
219 if (options & vopt_callout_no_cache)
220 {
221 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
222 }
223 else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
224 {
225 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
226 }
227
228 /* If a cache database is available see if we can avoid the need to do an
229 actual callout by making use of previously-obtained data. */
230
231 if (dbm_file)
232 {
233 dbdata_callout_cache_address *cache_address_record;
234 dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
235 addr->domain, US"domain",
236 callout_cache_domain_positive_expire,
237 callout_cache_domain_negative_expire);
238
239 /* If an unexpired cache record was found for this domain, see if the callout
240 process can be short-circuited. */
241
242 if (cache_record)
243 {
244 /* In most cases, if an early command (up to and including MAIL FROM:<>)
245 was rejected, there is no point carrying on. The callout fails. However, if
246 we are doing a recipient verification with use_sender or use_postmaster
247 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
248 will be using a non-empty sender. We have to remember this situation so as
249 not to disturb the cached domain value if this whole verification succeeds
250 (we don't want it turning into "accept"). */
251
252 old_domain_cache_result = cache_record->result;
253
254 if (cache_record->result == ccache_reject ||
255 (*from_address == 0 && cache_record->result == ccache_reject_mfnull))
256 {
257 setflag(addr, af_verify_nsfail);
258 HDEBUG(D_verify)
259 debug_printf("callout cache: domain gave initial rejection, or "
260 "does not accept HELO or MAIL FROM:<>\n");
261 setflag(addr, af_verify_nsfail);
262 addr->user_message = US"(result of an earlier callout reused).";
263 yield = FAIL;
264 *failure_ptr = US"mail";
265 goto END_CALLOUT;
266 }
267
268 /* If a previous check on a "random" local part was accepted, we assume
269 that the server does not do any checking on local parts. There is therefore
270 no point in doing the callout, because it will always be successful. If a
271 random check previously failed, arrange not to do it again, but preserve
272 the data in the new record. If a random check is required but hasn't been
273 done, skip the remaining cache processing. */
274
275 if (options & vopt_callout_random) switch(cache_record->random_result)
276 {
277 case ccache_accept:
278 HDEBUG(D_verify)
279 debug_printf("callout cache: domain accepts random addresses\n");
280 goto END_CALLOUT; /* Default yield is OK */
281
282 case ccache_reject:
283 HDEBUG(D_verify)
284 debug_printf("callout cache: domain rejects random addresses\n");
285 options &= ~vopt_callout_random;
286 new_domain_record.random_result = ccache_reject;
287 new_domain_record.random_stamp = cache_record->random_stamp;
288 break;
289
290 default:
291 HDEBUG(D_verify)
292 debug_printf("callout cache: need to check random address handling "
293 "(not cached or cache expired)\n");
294 goto END_CACHE;
295 }
296
297 /* If a postmaster check is requested, but there was a previous failure,
298 there is again no point in carrying on. If a postmaster check is required,
299 but has not been done before, we are going to have to do a callout, so skip
300 remaining cache processing. */
301
302 if (pm_mailfrom)
303 {
304 if (cache_record->postmaster_result == ccache_reject)
305 {
306 setflag(addr, af_verify_pmfail);
307 HDEBUG(D_verify)
308 debug_printf("callout cache: domain does not accept "
309 "RCPT TO:<postmaster@domain>\n");
310 yield = FAIL;
311 *failure_ptr = US"postmaster";
312 setflag(addr, af_verify_pmfail);
313 addr->user_message = US"(result of earlier verification reused).";
314 goto END_CALLOUT;
315 }
316 if (cache_record->postmaster_result == ccache_unknown)
317 {
318 HDEBUG(D_verify)
319 debug_printf("callout cache: need to check RCPT "
320 "TO:<postmaster@domain> (not cached or cache expired)\n");
321 goto END_CACHE;
322 }
323
324 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
325 postmaster check if the address itself has to be checked. Also ensure
326 that the value in the cache record is preserved (with its old timestamp).
327 */
328
329 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
330 "TO:<postmaster@domain>\n");
331 pm_mailfrom = NULL;
332 new_domain_record.postmaster_result = ccache_accept;
333 new_domain_record.postmaster_stamp = cache_record->postmaster_stamp;
334 }
335 }
336
337 /* We can't give a result based on information about the domain. See if there
338 is an unexpired cache record for this specific address (combined with the
339 sender address if we are doing a recipient callout with a non-empty sender).
340 */
341
342 cache_address_record = (dbdata_callout_cache_address *)
343 get_callout_cache_record(dbm_file,
344 address_key, US"address",
345 callout_cache_positive_expire,
346 callout_cache_negative_expire);
347
348 if (cache_address_record)
349 {
350 if (cache_address_record->result == ccache_accept)
351 {
352 HDEBUG(D_verify)
353 debug_printf("callout cache: address record is positive\n");
354 }
355 else
356 {
357 HDEBUG(D_verify)
358 debug_printf("callout cache: address record is negative\n");
359 addr->user_message = US"Previous (cached) callout verification failure";
360 *failure_ptr = US"recipient";
361 yield = FAIL;
362 }
363 goto END_CALLOUT;
364 }
365
366 /* Close the cache database while we actually do the callout for real. */
367
368 END_CACHE:
369 dbfn_close(dbm_file);
370 dbm_file = NULL;
371 }
372
373 if (!addr->transport)
374 {
375 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
376 }
377 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
378 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
379 addr->transport->name, addr->transport->driver_name);
380 else
381 {
382 smtp_transport_options_block *ob =
383 (smtp_transport_options_block *)addr->transport->options_block;
384
385 /* The information wasn't available in the cache, so we have to do a real
386 callout and save the result in the cache for next time, unless no_cache is set,
387 or unless we have a previously cached negative random result. If we are to test
388 with a random local part, ensure that such a local part is available. If not,
389 log the fact, but carry on without randomming. */
390
391 if (options & vopt_callout_random && callout_random_local_part != NULL)
392 if (!(random_local_part = expand_string(callout_random_local_part)))
393 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
394 "callout_random_local_part: %s", expand_string_message);
395
396 /* Default the connect and overall callout timeouts if not set, and record the
397 time we are starting so that we can enforce it. */
398
399 if (callout_overall < 0) callout_overall = 4 * callout;
400 if (callout_connect < 0) callout_connect = callout;
401 callout_start_time = time(NULL);
402
403 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
404 output because a callout might take some time. When PIPELINING is active and
405 there are many recipients, the total time for doing lots of callouts can add up
406 and cause the client to time out. So in this case we forgo the PIPELINING
407 optimization. */
408
409 if (smtp_out && !disable_callout_flush) mac_smtp_fflush();
410
411 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
412 and we are holding a cutthrough conn open, we can just append the rcpt to
413 that conn for verification purposes (and later delivery also). Simplest
414 coding means skipping this whole loop and doing the append separately.
415
416 We will need to remember it has been appended so that rcpt-acl tail code
417 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
418 */
419
420 /* Can we re-use an open cutthrough connection? */
421 if ( cutthrough.fd >= 0
422 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
423 == vopt_callout_recipsender
424 && !random_local_part
425 && !pm_mailfrom
426 )
427 {
428 if (addr->transport == cutthrough.addr.transport)
429 for (host = host_list; host; host = host->next)
430 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
431 {
432 int host_af;
433 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
434 int port = 25;
435
436 deliver_host = host->name;
437 deliver_host_address = host->address;
438 deliver_host_port = host->port;
439 deliver_domain = addr->domain;
440 transport_name = addr->transport->name;
441
442 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
443
444 if (!smtp_get_interface(tf->interface, host_af, addr, &interface,
445 US"callout") ||
446 !smtp_get_port(tf->port, addr, &port, US"callout"))
447 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
448 addr->message);
449
450 if ( ( interface == cutthrough.interface
451 || ( interface
452 && cutthrough.interface
453 && Ustrcmp(interface, cutthrough.interface) == 0
454 ) )
455 && port == cutthrough.host.port
456 )
457 {
458 uschar * resp = NULL;
459
460 /* Match! Send the RCPT TO, append the addr, set done */
461 done =
462 smtp_write_command(&ctblock, FALSE, "RCPT TO:<%.1000s>\r\n",
463 transport_rcpt_address(addr,
464 (addr->transport == NULL)? FALSE :
465 addr->transport->rcpt_include_affixes)) >= 0 &&
466 cutthrough_response('2', &resp) == '2';
467
468 /* This would go horribly wrong if a callout fail was ignored by ACL.
469 We punt by abandoning cutthrough on a reject, like the
470 first-rcpt does. */
471
472 if (done)
473 {
474 address_item * na = store_get(sizeof(address_item));
475 *na = cutthrough.addr;
476 cutthrough.addr = *addr;
477 cutthrough.addr.host_used = &cutthrough.host;
478 cutthrough.addr.next = na;
479
480 cutthrough.nrcpt++;
481 }
482 else
483 {
484 cancel_cutthrough_connection("recipient rejected");
485 if (!resp || errno == ETIMEDOUT)
486 {
487 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
488 }
489 else if (errno == 0)
490 {
491 if (*resp == 0)
492 Ustrcpy(resp, US"connection dropped");
493
494 addr->message =
495 string_sprintf("response to \"%s\" from %s [%s] was: %s",
496 big_buffer, host->name, host->address,
497 string_printing(resp));
498
499 addr->user_message =
500 string_sprintf("Callout verification failed:\n%s", resp);
501
502 /* Hard rejection ends the process */
503
504 if (resp[0] == '5') /* Address rejected */
505 {
506 yield = FAIL;
507 done = TRUE;
508 }
509 }
510 }
511 }
512 break;
513 }
514 if (!done)
515 cancel_cutthrough_connection("incompatible connection");
516 }
517
518 /* Now make connections to the hosts and do real callouts. The list of hosts
519 is passed in as an argument. */
520
521 for (host = host_list; host && !done; host = host->next)
522 {
523 smtp_inblock inblock;
524 smtp_outblock outblock;
525 int host_af;
526 int port = 25;
527 BOOL send_quit = TRUE;
528 uschar *active_hostname = smtp_active_hostname;
529 BOOL lmtp;
530 BOOL smtps;
531 BOOL esmtp;
532 BOOL suppress_tls = FALSE;
533 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
534 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
535 BOOL dane = FALSE;
536 BOOL dane_required;
537 dns_answer tlsa_dnsa;
538 #endif
539 uschar inbuffer[4096];
540 uschar outbuffer[1024];
541 uschar responsebuffer[4096];
542 uschar * size_str;
543
544 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
545 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
546
547 /* Skip this host if we don't have an IP address for it. */
548
549 if (!host->address)
550 {
551 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
552 host->name);
553 continue;
554 }
555
556 /* Check the overall callout timeout */
557
558 if (time(NULL) - callout_start_time >= callout_overall)
559 {
560 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
561 break;
562 }
563
564 /* Set IPv4 or IPv6 */
565
566 host_af = Ustrchr(host->address, ':') == NULL ? AF_INET : AF_INET6;
567
568 /* Expand and interpret the interface and port strings. The latter will not
569 be used if there is a host-specific port (e.g. from a manualroute router).
570 This has to be delayed till now, because they may expand differently for
571 different hosts. If there's a failure, log it, but carry on with the
572 defaults. */
573
574 deliver_host = host->name;
575 deliver_host_address = host->address;
576 deliver_host_port = host->port;
577 deliver_domain = addr->domain;
578 transport_name = addr->transport->name;
579
580 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
581 US"callout")
582 || !smtp_get_port(tf->port, addr, &port, US"callout")
583 )
584 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
585 addr->message);
586
587 /* Set HELO string according to the protocol */
588 lmtp= Ustrcmp(tf->protocol, "lmtp") == 0;
589 smtps= Ustrcmp(tf->protocol, "smtps") == 0;
590
591
592 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", interface, port);
593
594 /* Set up the buffer for reading SMTP response packets. */
595
596 inblock.buffer = inbuffer;
597 inblock.buffersize = sizeof(inbuffer);
598 inblock.ptr = inbuffer;
599 inblock.ptrend = inbuffer;
600
601 /* Set up the buffer for holding SMTP commands while pipelining */
602
603 outblock.buffer = outbuffer;
604 outblock.buffersize = sizeof(outbuffer);
605 outblock.ptr = outbuffer;
606 outblock.cmd_count = 0;
607 outblock.authenticating = FALSE;
608
609 /* Connect to the host; on failure, just loop for the next one, but we
610 set the error for the last one. Use the callout_connect timeout. */
611
612 tls_retry_connection:
613
614 /* Reset the parameters of a TLS session */
615 tls_out.cipher = tls_out.peerdn = tls_out.peercert = NULL;
616
617 inblock.sock = outblock.sock =
618 smtp_connect(host, host_af, port, interface, callout_connect,
619 addr->transport);
620 if (inblock.sock < 0)
621 {
622 HDEBUG(D_verify) debug_printf("connect: %s\n", strerror(errno));
623 addr->message = string_sprintf("could not connect to %s [%s]: %s",
624 host->name, host->address, strerror(errno));
625 transport_name = NULL;
626 deliver_host = deliver_host_address = NULL;
627 deliver_domain = save_deliver_domain;
628 continue;
629 }
630
631 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
632 {
633 int rc;
634
635 tls_out.dane_verified = FALSE;
636 tls_out.tlsa_usage = 0;
637
638 dane_required =
639 verify_check_given_host(&ob->hosts_require_dane, host) == OK;
640
641 if (host->dnssec == DS_YES)
642 {
643 if( dane_required
644 || verify_check_given_host(&ob->hosts_try_dane, host) == OK
645 )
646 {
647 if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required)) != OK)
648 return rc;
649 dane = TRUE;
650 }
651 }
652 else if (dane_required)
653 {
654 log_write(0, LOG_MAIN, "DANE error: %s lookup not DNSSEC", host->name);
655 return FAIL;
656 }
657
658 if (dane)
659 ob->tls_tempfail_tryclear = FALSE;
660 }
661 #endif /*DANE*/
662
663 /* Expand the helo_data string to find the host name to use. */
664
665 if (tf->helo_data)
666 {
667 uschar * s = expand_string(tf->helo_data);
668 if (!s)
669 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
670 "helo_data value for callout: %s", addr->address,
671 expand_string_message);
672 else active_hostname = s;
673 }
674
675 /* Wait for initial response, and send HELO. The smtp_write_command()
676 function leaves its command in big_buffer. This is used in error responses.
677 Initialize it in case the connection is rejected. */
678
679 Ustrcpy(big_buffer, "initial connection");
680
681 /* Unless ssl-on-connect, wait for the initial greeting */
682 smtps_redo_greeting:
683
684 #ifdef SUPPORT_TLS
685 if (!smtps || (smtps && tls_out.active >= 0))
686 #endif
687 {
688 #ifdef TCP_QUICKACK
689 (void) setsockopt(inblock.sock, IPPROTO_TCP, TCP_QUICKACK, US &off, sizeof(off));
690 #endif
691 if (!(done= smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout)))
692 goto RESPONSE_FAILED;
693
694 #ifndef DISABLE_EVENT
695 lookup_dnssec_authenticated = host->dnssec==DS_YES ? US"yes"
696 : host->dnssec==DS_NO ? US"no" : NULL;
697 if (event_raise(addr->transport->event_action,
698 US"smtp:connect", responsebuffer))
699 {
700 lookup_dnssec_authenticated = NULL;
701 /* Logging? Debug? */
702 goto RESPONSE_FAILED;
703 }
704 lookup_dnssec_authenticated = NULL;
705 #endif
706 }
707
708 /* Not worth checking greeting line for ESMTP support */
709 if (!(esmtp = verify_check_given_host(&ob->hosts_avoid_esmtp, host) != OK))
710 DEBUG(D_transport)
711 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
712
713 tls_redo_helo:
714
715 #ifdef SUPPORT_TLS
716 if (smtps && tls_out.active < 0) /* ssl-on-connect, first pass */
717 {
718 peer_offered &= ~PEER_OFFERED_TLS;
719 ob->tls_tempfail_tryclear = FALSE;
720 }
721 else /* all other cases */
722 #endif
723
724 { esmtp_retry:
725
726 if (!(done= smtp_write_command(&outblock, FALSE, "%s %s\r\n",
727 !esmtp? "HELO" : lmtp? "LHLO" : "EHLO", active_hostname) >= 0))
728 goto SEND_FAILED;
729 if (!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout))
730 {
731 if (errno != 0 || responsebuffer[0] == 0 || lmtp || !esmtp || tls_out.active >= 0)
732 {
733 done= FALSE;
734 goto RESPONSE_FAILED;
735 }
736 #ifdef SUPPORT_TLS
737 peer_offered &= ~PEER_OFFERED_TLS;
738 #endif
739 esmtp = FALSE;
740 goto esmtp_retry; /* fallback to HELO */
741 }
742
743 /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
744
745 peer_offered = esmtp
746 ? ehlo_response(responsebuffer, sizeof(responsebuffer),
747 (!suppress_tls && tls_out.active < 0 ? PEER_OFFERED_TLS : 0)
748 | 0 /* no IGNQ */
749 | 0 /* no PRDR */
750 #ifdef SUPPORT_I18N
751 | (addr->prop.utf8_msg && !addr->prop.utf8_downcvt
752 ? PEER_OFFERED_UTF8 : 0)
753 #endif
754 | 0 /* no DSN */
755 | 0 /* no PIPE */
756
757 /* only care about SIZE if we have size from inbound */
758 | (message_size > 0 && ob->size_addition >= 0
759 ? PEER_OFFERED_SIZE : 0)
760 )
761 : 0;
762 }
763
764 size_str = options & vopt_is_recipient && peer_offered & PEER_OFFERED_SIZE
765 ? string_sprintf(" SIZE=%d", message_size + ob->size_addition) : US"";
766
767 #ifdef SUPPORT_TLS
768 smtp_peer_options |= peer_offered & PEER_OFFERED_TLS;
769 #endif
770
771 /* If TLS is available on this connection attempt to
772 start up a TLS session, unless the host is in hosts_avoid_tls. If successful,
773 send another EHLO - the server may give a different answer in secure mode. We
774 use a separate buffer for reading the response to STARTTLS so that if it is
775 negative, the original EHLO data is available for subsequent analysis, should
776 the client not be required to use TLS. If the response is bad, copy the buffer
777 for error analysis. */
778
779 #ifdef SUPPORT_TLS
780 if ( peer_offered & PEER_OFFERED_TLS
781 && verify_check_given_host(&ob->hosts_avoid_tls, host) != OK
782 && verify_check_given_host(&ob->hosts_verify_avoid_tls, host) != OK
783 )
784 {
785 uschar buffer2[4096];
786 if ( !smtps
787 && !(done= smtp_write_command(&outblock, FALSE, "STARTTLS\r\n") >= 0))
788 goto SEND_FAILED;
789
790 /* If there is an I/O error, transmission of this message is deferred. If
791 there is a temporary rejection of STARRTLS and tls_tempfail_tryclear is
792 false, we also defer. However, if there is a temporary rejection of STARTTLS
793 and tls_tempfail_tryclear is true, or if there is an outright rejection of
794 STARTTLS, we carry on. This means we will try to send the message in clear,
795 unless the host is in hosts_require_tls (tested below). */
796
797 if (!smtps && !smtp_read_response(&inblock, buffer2, sizeof(buffer2), '2',
798 ob->command_timeout))
799 {
800 if ( errno != 0
801 || buffer2[0] == 0
802 || buffer2[0] == '4' && !ob->tls_tempfail_tryclear
803 )
804 {
805 Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
806 done= FALSE;
807 goto RESPONSE_FAILED;
808 }
809 }
810
811 /* STARTTLS accepted or ssl-on-connect: try to negotiate a TLS session. */
812 else
813 {
814 int oldtimeout = ob->command_timeout;
815 int rc;
816
817 ob->command_timeout = callout;
818 rc = tls_client_start(inblock.sock, host, addr, addr->transport
819 # ifdef EXPERIMENTAL_DANE
820 , dane ? &tlsa_dnsa : NULL
821 # endif
822 );
823 ob->command_timeout = oldtimeout;
824
825 /* TLS negotiation failed; give an error. Try in clear on a new
826 connection, if the options permit it for this host. */
827 if (rc != OK)
828 {
829 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
830 (void)close(inblock.sock);
831 # ifndef DISABLE_EVENT
832 (void) event_raise(addr->transport->event_action,
833 US"tcp:close", NULL);
834 # endif
835 if ( ob->tls_tempfail_tryclear
836 && !smtps
837 && verify_check_given_host(&ob->hosts_require_tls, host) != OK
838 )
839 {
840 log_write(0, LOG_MAIN, "TLS session failure:"
841 " callout unencrypted to %s [%s] (not in hosts_require_tls)",
842 host->name, host->address);
843 suppress_tls = TRUE;
844 goto tls_retry_connection;
845 }
846
847 /*save_errno = ERRNO_TLSFAILURE;*/
848 /*message = US"failure while setting up TLS session";*/
849 send_quit = FALSE;
850 done= FALSE;
851 goto TLS_FAILED;
852 }
853
854 /* TLS session is set up. Copy info for logging. */
855 addr->cipher = tls_out.cipher;
856 addr->peerdn = tls_out.peerdn;
857
858 /* For SMTPS we need to wait for the initial OK response, then do HELO. */
859 if (smtps)
860 goto smtps_redo_greeting;
861
862 /* For STARTTLS we need to redo EHLO */
863 goto tls_redo_helo;
864 }
865 }
866
867 /* If the host is required to use a secure channel, ensure that we have one. */
868 if (tls_out.active < 0)
869 if (
870 # ifdef EXPERIMENTAL_DANE
871 dane ||
872 # endif
873 verify_check_given_host(&ob->hosts_require_tls, host) == OK
874 )
875 {
876 /*save_errno = ERRNO_TLSREQUIRED;*/
877 log_write(0, LOG_MAIN,
878 "H=%s [%s]: a TLS session is required for this host, but %s",
879 host->name, host->address,
880 peer_offered & PEER_OFFERED_TLS
881 ? "an attempt to start TLS failed"
882 : "the server did not offer TLS support");
883 done= FALSE;
884 goto TLS_FAILED;
885 }
886
887 #endif /*SUPPORT_TLS*/
888
889 done = TRUE; /* so far so good; have response to HELO */
890
891 /* For now, transport_filter by cutthrough-delivery is not supported */
892 /* Need proper integration with the proper transport mechanism. */
893 if (cutthrough.delivery)
894 {
895 #ifndef DISABLE_DKIM
896 uschar * s;
897 #endif
898 if (addr->transport->filter_command)
899 {
900 cutthrough.delivery = FALSE;
901 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
902 }
903 #ifndef DISABLE_DKIM
904 else if ((s = ob->dkim.dkim_domain) && (s = expand_string(s)) && *s)
905 {
906 cutthrough.delivery = FALSE;
907 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
908 }
909 #endif
910 }
911
912 SEND_FAILED:
913 RESPONSE_FAILED:
914 TLS_FAILED:
915 ;
916 /* Clear down of the TLS, SMTP and TCP layers on error is handled below. */
917
918 /* Failure to accept HELO is cached; this blocks the whole domain for all
919 senders. I/O errors and defer responses are not cached. */
920
921 if (!done)
922 {
923 *failure_ptr = US"mail"; /* At or before MAIL */
924 if (errno == 0 && responsebuffer[0] == '5')
925 {
926 setflag(addr, af_verify_nsfail);
927 new_domain_record.result = ccache_reject;
928 }
929 }
930
931 #ifdef SUPPORT_I18N
932 else if ( addr->prop.utf8_msg
933 && !addr->prop.utf8_downcvt
934 && !(peer_offered & PEER_OFFERED_UTF8)
935 )
936 {
937 HDEBUG(D_acl|D_v) debug_printf("utf8 required but not offered\n");
938 errno = ERRNO_UTF8_FWD;
939 setflag(addr, af_verify_nsfail);
940 done = FALSE;
941 }
942 else if ( addr->prop.utf8_msg
943 && (addr->prop.utf8_downcvt || !(peer_offered & PEER_OFFERED_UTF8))
944 && (setflag(addr, af_utf8_downcvt),
945 from_address = string_address_utf8_to_alabel(from_address,
946 &addr->message),
947 addr->message
948 ) )
949 {
950 errno = ERRNO_EXPANDFAIL;
951 setflag(addr, af_verify_nsfail);
952 done = FALSE;
953 }
954 #endif
955
956 /* If we haven't authenticated, but are required to, give up. */
957 /* Try to AUTH */
958
959 else done = smtp_auth(responsebuffer, sizeof(responsebuffer),
960 addr, host, ob, esmtp, &inblock, &outblock) == OK &&
961
962 /* Copy AUTH info for logging */
963 ( (addr->authenticator = client_authenticator),
964 (addr->auth_id = client_authenticated_id),
965
966 /* Build a mail-AUTH string (re-using responsebuffer for convenience */
967 !smtp_mail_auth_str(responsebuffer, sizeof(responsebuffer), addr, ob)
968 ) &&
969
970 ( (addr->auth_sndr = client_authenticated_sender),
971
972 /* Send the MAIL command */
973 (smtp_write_command(&outblock, FALSE,
974 #ifdef SUPPORT_I18N
975 addr->prop.utf8_msg && !addr->prop.utf8_downcvt
976 ? "MAIL FROM:<%s>%s%s SMTPUTF8\r\n"
977 :
978 #endif
979 "MAIL FROM:<%s>%s%s\r\n",
980 from_address, responsebuffer, size_str) >= 0)
981 ) &&
982
983 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
984 '2', callout);
985
986 deliver_host = deliver_host_address = NULL;
987 deliver_domain = save_deliver_domain;
988
989 /* If the host does not accept MAIL FROM:<>, arrange to cache this
990 information, but again, don't record anything for an I/O error or a defer. Do
991 not cache rejections of MAIL when a non-empty sender has been used, because
992 that blocks the whole domain for all senders. */
993
994 if (!done)
995 {
996 *failure_ptr = US"mail"; /* At or before MAIL */
997 if (errno == 0 && responsebuffer[0] == '5')
998 {
999 setflag(addr, af_verify_nsfail);
1000 if (from_address[0] == 0)
1001 new_domain_record.result = ccache_reject_mfnull;
1002 }
1003 }
1004
1005 /* Otherwise, proceed to check a "random" address (if required), then the
1006 given address, and the postmaster address (if required). Between each check,
1007 issue RSET, because some servers accept only one recipient after MAIL
1008 FROM:<>.
1009
1010 Before doing this, set the result in the domain cache record to "accept",
1011 unless its previous value was ccache_reject_mfnull. In that case, the domain
1012 rejects MAIL FROM:<> and we want to continue to remember that. When that is
1013 the case, we have got here only in the case of a recipient verification with
1014 a non-null sender. */
1015
1016 else
1017 {
1018 const uschar * rcpt_domain = addr->domain;
1019
1020 #ifdef SUPPORT_I18N
1021 uschar * errstr = NULL;
1022 if ( testflag(addr, af_utf8_downcvt)
1023 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
1024 &errstr), errstr)
1025 )
1026 {
1027 addr->message = errstr;
1028 errno = ERRNO_EXPANDFAIL;
1029 setflag(addr, af_verify_nsfail);
1030 done = FALSE;
1031 rcpt_domain = US""; /*XXX errorhandling! */
1032 }
1033 #endif
1034
1035 new_domain_record.result =
1036 (old_domain_cache_result == ccache_reject_mfnull)?
1037 ccache_reject_mfnull: ccache_accept;
1038
1039 /* Do the random local part check first */
1040
1041 if (random_local_part != NULL)
1042 {
1043 uschar randombuffer[1024];
1044 BOOL random_ok =
1045 smtp_write_command(&outblock, FALSE,
1046 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part,
1047 rcpt_domain) >= 0 &&
1048 smtp_read_response(&inblock, randombuffer,
1049 sizeof(randombuffer), '2', callout);
1050
1051 /* Remember when we last did a random test */
1052
1053 new_domain_record.random_stamp = time(NULL);
1054
1055 /* If accepted, we aren't going to do any further tests below. */
1056
1057 if (random_ok)
1058 new_domain_record.random_result = ccache_accept;
1059
1060 /* Otherwise, cache a real negative response, and get back to the right
1061 state to send RCPT. Unless there's some problem such as a dropped
1062 connection, we expect to succeed, because the commands succeeded above.
1063 However, some servers drop the connection after responding to an
1064 invalid recipient, so on (any) error we drop and remake the connection.
1065 */
1066
1067 else if (errno == 0)
1068 {
1069 /* This would be ok for 1st rcpt a cutthrough, but no way to
1070 handle a subsequent. So refuse to support any */
1071 cancel_cutthrough_connection("random-recipient");
1072
1073 if (randombuffer[0] == '5')
1074 new_domain_record.random_result = ccache_reject;
1075
1076 done =
1077 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1078 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1079 '2', callout) &&
1080
1081 smtp_write_command(&outblock, FALSE,
1082 #ifdef SUPPORT_I18N
1083 addr->prop.utf8_msg && !addr->prop.utf8_downcvt
1084 ? "MAIL FROM:<%s> SMTPUTF8\r\n"
1085 :
1086 #endif
1087 "MAIL FROM:<%s>\r\n",
1088 from_address) >= 0 &&
1089 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1090 '2', callout);
1091
1092 if (!done)
1093 {
1094 HDEBUG(D_acl|D_v)
1095 debug_printf("problem after random/rset/mfrom; reopen conn\n");
1096 random_local_part = NULL;
1097 #ifdef SUPPORT_TLS
1098 tls_close(FALSE, TRUE);
1099 #endif
1100 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
1101 (void)close(inblock.sock);
1102 #ifndef DISABLE_EVENT
1103 (void) event_raise(addr->transport->event_action,
1104 US"tcp:close", NULL);
1105 #endif
1106 goto tls_retry_connection;
1107 }
1108 }
1109 else done = FALSE; /* Some timeout/connection problem */
1110 } /* Random check */
1111
1112 /* If the host is accepting all local parts, as determined by the "random"
1113 check, we don't need to waste time doing any further checking. */
1114
1115 if (new_domain_record.random_result != ccache_accept && done)
1116 {
1117 /* Get the rcpt_include_affixes flag from the transport if there is one,
1118 but assume FALSE if there is not. */
1119
1120 uschar * rcpt = transport_rcpt_address(addr,
1121 addr->transport ? addr->transport->rcpt_include_affixes : FALSE);
1122
1123 #ifdef SUPPORT_I18N
1124 /*XXX should the conversion be moved into transport_rcpt_address() ? */
1125 uschar * dummy_errstr = NULL;
1126 if ( testflag(addr, af_utf8_downcvt)
1127 && (rcpt = string_address_utf8_to_alabel(rcpt, &dummy_errstr),
1128 dummy_errstr
1129 ) )
1130 {
1131 errno = ERRNO_EXPANDFAIL;
1132 *failure_ptr = US"recipient";
1133 done = FALSE;
1134 }
1135 else
1136 #endif
1137
1138 done =
1139 smtp_write_command(&outblock, FALSE, "RCPT TO:<%.1000s>\r\n",
1140 rcpt) >= 0 &&
1141 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1142 '2', callout);
1143
1144 if (done)
1145 new_address_record.result = ccache_accept;
1146 else if (errno == 0 && responsebuffer[0] == '5')
1147 {
1148 *failure_ptr = US"recipient";
1149 new_address_record.result = ccache_reject;
1150 }
1151
1152 /* Do postmaster check if requested; if a full check is required, we
1153 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
1154
1155 if (done && pm_mailfrom != NULL)
1156 {
1157 /* Could possibly shift before main verify, just above, and be ok
1158 for cutthrough. But no way to handle a subsequent rcpt, so just
1159 refuse any */
1160 cancel_cutthrough_connection("postmaster verify");
1161 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of postmaster verify\n");
1162
1163 done =
1164 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1165 smtp_read_response(&inblock, responsebuffer,
1166 sizeof(responsebuffer), '2', callout) &&
1167
1168 smtp_write_command(&outblock, FALSE,
1169 "MAIL FROM:<%s>\r\n", pm_mailfrom) >= 0 &&
1170 smtp_read_response(&inblock, responsebuffer,
1171 sizeof(responsebuffer), '2', callout) &&
1172
1173 /* First try using the current domain */
1174
1175 ((
1176 smtp_write_command(&outblock, FALSE,
1177 "RCPT TO:<postmaster@%.1000s>\r\n", rcpt_domain) >= 0 &&
1178 smtp_read_response(&inblock, responsebuffer,
1179 sizeof(responsebuffer), '2', callout)
1180 )
1181
1182 ||
1183
1184 /* If that doesn't work, and a full check is requested,
1185 try without the domain. */
1186
1187 (
1188 (options & vopt_callout_fullpm) != 0 &&
1189 smtp_write_command(&outblock, FALSE,
1190 "RCPT TO:<postmaster>\r\n") >= 0 &&
1191 smtp_read_response(&inblock, responsebuffer,
1192 sizeof(responsebuffer), '2', callout)
1193 ));
1194
1195 /* Sort out the cache record */
1196
1197 new_domain_record.postmaster_stamp = time(NULL);
1198
1199 if (done)
1200 new_domain_record.postmaster_result = ccache_accept;
1201 else if (errno == 0 && responsebuffer[0] == '5')
1202 {
1203 *failure_ptr = US"postmaster";
1204 setflag(addr, af_verify_pmfail);
1205 new_domain_record.postmaster_result = ccache_reject;
1206 }
1207 }
1208 } /* Random not accepted */
1209 } /* MAIL FROM: accepted */
1210
1211 /* For any failure of the main check, other than a negative response, we just
1212 close the connection and carry on. We can identify a negative response by the
1213 fact that errno is zero. For I/O errors it will be non-zero
1214
1215 Set up different error texts for logging and for sending back to the caller
1216 as an SMTP response. Log in all cases, using a one-line format. For sender
1217 callouts, give a full response to the caller, but for recipient callouts,
1218 don't give the IP address because this may be an internal host whose identity
1219 is not to be widely broadcast. */
1220
1221 if (!done)
1222 {
1223 if (errno == ETIMEDOUT)
1224 {
1225 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
1226 send_quit = FALSE;
1227 }
1228 #ifdef SUPPORT_I18N
1229 else if (errno == ERRNO_UTF8_FWD)
1230 {
1231 extern int acl_where; /* src/acl.c */
1232 errno = 0;
1233 addr->message = string_sprintf(
1234 "response to \"%s\" from %s [%s] did not include SMTPUTF8",
1235 big_buffer, host->name, host->address);
1236 addr->user_message = acl_where == ACL_WHERE_RCPT
1237 ? US"533 mailbox name not allowed"
1238 : US"550 mailbox unavailable";
1239 yield = FAIL;
1240 done = TRUE;
1241 }
1242 #endif
1243 else if (errno == 0)
1244 {
1245 if (*responsebuffer == 0) Ustrcpy(responsebuffer, US"connection dropped");
1246
1247 addr->message =
1248 string_sprintf("response to \"%s\" from %s [%s] was: %s",
1249 big_buffer, host->name, host->address,
1250 string_printing(responsebuffer));
1251
1252 addr->user_message = options & vopt_is_recipient
1253 ? string_sprintf("Callout verification failed:\n%s", responsebuffer)
1254 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1255 host->address, big_buffer, responsebuffer);
1256
1257 /* Hard rejection ends the process */
1258
1259 if (responsebuffer[0] == '5') /* Address rejected */
1260 {
1261 yield = FAIL;
1262 done = TRUE;
1263 }
1264 }
1265 }
1266
1267 /* End the SMTP conversation and close the connection. */
1268
1269 /* Cutthrough - on a successfull connect and recipient-verify with
1270 use-sender and we are 1st rcpt and have no cutthrough conn so far
1271 here is where we want to leave the conn open */
1272 if ( cutthrough.delivery
1273 && rcpt_count == 1
1274 && done
1275 && yield == OK
1276 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1277 == vopt_callout_recipsender
1278 && !random_local_part
1279 && !pm_mailfrom
1280 && cutthrough.fd < 0
1281 && !lmtp
1282 )
1283 {
1284 HDEBUG(D_acl|D_v) debug_printf("holding verify callout open for cutthrough delivery\n");
1285
1286 cutthrough.fd = outblock.sock; /* We assume no buffer in use in the outblock */
1287 cutthrough.nrcpt = 1;
1288 cutthrough.interface = interface;
1289 cutthrough.host = *host;
1290 cutthrough.addr = *addr; /* Save the address_item for later logging */
1291 cutthrough.addr.next = NULL;
1292 cutthrough.addr.host_used = &cutthrough.host;
1293 if (addr->parent)
1294 *(cutthrough.addr.parent = store_get(sizeof(address_item))) =
1295 *addr->parent;
1296 ctblock.buffer = ctbuffer;
1297 ctblock.buffersize = sizeof(ctbuffer);
1298 ctblock.ptr = ctbuffer;
1299 /* ctblock.cmd_count = 0; ctblock.authenticating = FALSE; */
1300 ctblock.sock = cutthrough.fd;
1301 }
1302 else
1303 {
1304 /* Ensure no cutthrough on multiple address verifies */
1305 if (options & vopt_callout_recipsender)
1306 cancel_cutthrough_connection("not usable for cutthrough");
1307 if (send_quit)
1308 (void) smtp_write_command(&outblock, FALSE, "QUIT\r\n");
1309
1310 #ifdef SUPPORT_TLS
1311 tls_close(FALSE, TRUE);
1312 #endif
1313 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
1314 (void)close(inblock.sock);
1315 #ifndef DISABLE_EVENT
1316 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
1317 #endif
1318 }
1319
1320 } /* Loop through all hosts, while !done */
1321 }
1322
1323 /* If we get here with done == TRUE, a successful callout happened, and yield
1324 will be set OK or FAIL according to the response to the RCPT command.
1325 Otherwise, we looped through the hosts but couldn't complete the business.
1326 However, there may be domain-specific information to cache in both cases.
1327
1328 The value of the result field in the new_domain record is ccache_unknown if
1329 there was an error before or with MAIL FROM:, and errno was not zero,
1330 implying some kind of I/O error. We don't want to write the cache in that case.
1331 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
1332
1333 if ( !(options & vopt_callout_no_cache)
1334 && new_domain_record.result != ccache_unknown)
1335 {
1336 if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
1337 == NULL)
1338 {
1339 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
1340 }
1341 else
1342 {
1343 (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
1344 (int)sizeof(dbdata_callout_cache));
1345 HDEBUG(D_verify) debug_printf("wrote callout cache domain record for %s:\n"
1346 " result=%d postmaster=%d random=%d\n",
1347 addr->domain,
1348 new_domain_record.result,
1349 new_domain_record.postmaster_result,
1350 new_domain_record.random_result);
1351 }
1352 }
1353
1354 /* If a definite result was obtained for the callout, cache it unless caching
1355 is disabled. */
1356
1357 if (done)
1358 {
1359 if ( !(options & vopt_callout_no_cache)
1360 && new_address_record.result != ccache_unknown)
1361 {
1362 if (!dbm_file)
1363 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
1364 if (!dbm_file)
1365 {
1366 HDEBUG(D_verify) debug_printf("no callout cache available\n");
1367 }
1368 else
1369 {
1370 (void)dbfn_write(dbm_file, address_key, &new_address_record,
1371 (int)sizeof(dbdata_callout_cache_address));
1372 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record for %s\n",
1373 new_address_record.result == ccache_accept ? "positive" : "negative",
1374 address_key);
1375 }
1376 }
1377 } /* done */
1378
1379 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1380 temporary error. If there was only one host, and a response was received, leave
1381 it alone if supplying details. Otherwise, give a generic response. */
1382
1383 else /* !done */
1384 {
1385 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
1386 options & vopt_is_recipient ? "recipient" : "sender");
1387 yield = DEFER;
1388
1389 if (host_list->next || !addr->message)
1390 addr->message = dullmsg;
1391
1392 addr->user_message = smtp_return_error_details
1393 ? string_sprintf("%s for <%s>.\n"
1394 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1395 "they may be permanently unreachable from this server. In the latter case,\n%s",
1396 dullmsg, addr->address,
1397 options & vopt_is_recipient
1398 ? "the address will never be accepted."
1399 : "you need to change the address or create an MX record for its domain\n"
1400 "if it is supposed to be generally accessible from the Internet.\n"
1401 "Talk to your mail administrator for details.")
1402 : dullmsg;
1403
1404 /* Force a specific error code */
1405
1406 addr->basic_errno = ERRNO_CALLOUTDEFER;
1407 }
1408
1409 /* Come here from within the cache-reading code on fast-track exit. */
1410
1411 END_CALLOUT:
1412 if (dbm_file) dbfn_close(dbm_file);
1413 return yield;
1414 }
1415
1416
1417
1418 /* Called after recipient-acl to get a cutthrough connection open when
1419 one was requested and a recipient-verify wasn't subsequently done.
1420 */
1421 int
1422 open_cutthrough_connection( address_item * addr )
1423 {
1424 address_item addr2;
1425 int rc;
1426
1427 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1428 /* We must use a copy of the address for verification, because it might
1429 get rewritten. */
1430
1431 addr2 = *addr;
1432 HDEBUG(D_acl) debug_printf("----------- %s cutthrough setup ------------\n",
1433 rcpt_count > 1 ? "more" : "start");
1434 rc = verify_address(&addr2, NULL,
1435 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1436 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1437 NULL, NULL, NULL);
1438 addr->message = addr2.message;
1439 addr->user_message = addr2.user_message;
1440 HDEBUG(D_acl) debug_printf("----------- end cutthrough setup ------------\n");
1441 return rc;
1442 }
1443
1444
1445
1446 /* Send given number of bytes from the buffer */
1447 static BOOL
1448 cutthrough_send(int n)
1449 {
1450 if(cutthrough.fd < 0)
1451 return TRUE;
1452
1453 if(
1454 #ifdef SUPPORT_TLS
1455 (tls_out.active == cutthrough.fd) ? tls_write(FALSE, ctblock.buffer, n) :
1456 #endif
1457 send(cutthrough.fd, ctblock.buffer, n, 0) > 0
1458 )
1459 {
1460 transport_count += n;
1461 ctblock.ptr= ctblock.buffer;
1462 return TRUE;
1463 }
1464
1465 HDEBUG(D_transport|D_acl) debug_printf("cutthrough_send failed: %s\n", strerror(errno));
1466 return FALSE;
1467 }
1468
1469
1470
1471 static BOOL
1472 _cutthrough_puts(uschar * cp, int n)
1473 {
1474 while(n--)
1475 {
1476 if(ctblock.ptr >= ctblock.buffer+ctblock.buffersize)
1477 if(!cutthrough_send(ctblock.buffersize))
1478 return FALSE;
1479
1480 *ctblock.ptr++ = *cp++;
1481 }
1482 return TRUE;
1483 }
1484
1485 /* Buffered output of counted data block. Return boolean success */
1486 BOOL
1487 cutthrough_puts(uschar * cp, int n)
1488 {
1489 if (cutthrough.fd < 0) return TRUE;
1490 if (_cutthrough_puts(cp, n)) return TRUE;
1491 cancel_cutthrough_connection("transmit failed");
1492 return FALSE;
1493 }
1494
1495
1496 static BOOL
1497 _cutthrough_flush_send(void)
1498 {
1499 int n= ctblock.ptr-ctblock.buffer;
1500
1501 if(n>0)
1502 if(!cutthrough_send(n))
1503 return FALSE;
1504 return TRUE;
1505 }
1506
1507
1508 /* Send out any bufferred output. Return boolean success. */
1509 BOOL
1510 cutthrough_flush_send(void)
1511 {
1512 if (_cutthrough_flush_send()) return TRUE;
1513 cancel_cutthrough_connection("transmit failed");
1514 return FALSE;
1515 }
1516
1517
1518 BOOL
1519 cutthrough_put_nl(void)
1520 {
1521 return cutthrough_puts(US"\r\n", 2);
1522 }
1523
1524
1525 /* Get and check response from cutthrough target */
1526 static uschar
1527 cutthrough_response(char expect, uschar ** copy)
1528 {
1529 smtp_inblock inblock;
1530 uschar inbuffer[4096];
1531 uschar responsebuffer[4096];
1532
1533 inblock.buffer = inbuffer;
1534 inblock.buffersize = sizeof(inbuffer);
1535 inblock.ptr = inbuffer;
1536 inblock.ptrend = inbuffer;
1537 inblock.sock = cutthrough.fd;
1538 /* this relies on (inblock.sock == tls_out.active) */
1539 if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, CUTTHROUGH_DATA_TIMEOUT))
1540 cancel_cutthrough_connection("target timeout on read");
1541
1542 if(copy != NULL)
1543 {
1544 uschar * cp;
1545 *copy = cp = string_copy(responsebuffer);
1546 /* Trim the trailing end of line */
1547 cp += Ustrlen(responsebuffer);
1548 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1549 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1550 }
1551
1552 return responsebuffer[0];
1553 }
1554
1555
1556 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1557 BOOL
1558 cutthrough_predata(void)
1559 {
1560 if(cutthrough.fd < 0)
1561 return FALSE;
1562
1563 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> DATA\n");
1564 cutthrough_puts(US"DATA\r\n", 6);
1565 cutthrough_flush_send();
1566
1567 /* Assume nothing buffered. If it was it gets ignored. */
1568 return cutthrough_response('3', NULL) == '3';
1569 }
1570
1571
1572 /* fd and tctx args only to match write_chunk() */
1573 static BOOL
1574 cutthrough_write_chunk(int fd, transport_ctx * tctx, uschar * s, int len)
1575 {
1576 uschar * s2;
1577 while(s && (s2 = Ustrchr(s, '\n')))
1578 {
1579 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1580 return FALSE;
1581 s = s2+1;
1582 }
1583 return TRUE;
1584 }
1585
1586
1587 /* Buffered send of headers. Return success boolean. */
1588 /* Expands newlines to wire format (CR,NL). */
1589 /* Also sends header-terminating blank line. */
1590 BOOL
1591 cutthrough_headers_send(void)
1592 {
1593 transport_ctx tctx;
1594
1595 if(cutthrough.fd < 0)
1596 return FALSE;
1597
1598 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1599 but having a separate buffered-output function (for now)
1600 */
1601 HDEBUG(D_acl) debug_printf("----------- start cutthrough headers send -----------\n");
1602
1603 tctx.tblock = cutthrough.addr.transport;
1604 tctx.addr = &cutthrough.addr;
1605 tctx.check_string = US".";
1606 tctx.escape_string = US"..";
1607 tctx.options = topt_use_crlf;
1608
1609 if (!transport_headers_send(cutthrough.fd, &tctx, &cutthrough_write_chunk))
1610 return FALSE;
1611
1612 HDEBUG(D_acl) debug_printf("----------- done cutthrough headers send ------------\n");
1613 return TRUE;
1614 }
1615
1616
1617 static void
1618 close_cutthrough_connection(const char * why)
1619 {
1620 if(cutthrough.fd >= 0)
1621 {
1622 /* We could be sending this after a bunch of data, but that is ok as
1623 the only way to cancel the transfer in dataphase is to drop the tcp
1624 conn before the final dot.
1625 */
1626 ctblock.ptr = ctbuffer;
1627 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> QUIT\n");
1628 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1629 _cutthrough_flush_send();
1630 /* No wait for response */
1631
1632 #ifdef SUPPORT_TLS
1633 tls_close(FALSE, TRUE);
1634 #endif
1635 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
1636 (void)close(cutthrough.fd);
1637 cutthrough.fd = -1;
1638 HDEBUG(D_acl) debug_printf("----------- cutthrough shutdown (%s) ------------\n", why);
1639 }
1640 ctblock.ptr = ctbuffer;
1641 }
1642
1643 void
1644 cancel_cutthrough_connection(const char * why)
1645 {
1646 close_cutthrough_connection(why);
1647 cutthrough.delivery = FALSE;
1648 }
1649
1650
1651
1652
1653 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1654 Log an OK response as a transmission.
1655 Close the connection.
1656 Return smtp response-class digit.
1657 */
1658 uschar *
1659 cutthrough_finaldot(void)
1660 {
1661 uschar res;
1662 address_item * addr;
1663 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> .\n");
1664
1665 /* Assume data finshed with new-line */
1666 if( !cutthrough_puts(US".", 1)
1667 || !cutthrough_put_nl()
1668 || !cutthrough_flush_send()
1669 )
1670 return cutthrough.addr.message;
1671
1672 res = cutthrough_response('2', &cutthrough.addr.message);
1673 for (addr = &cutthrough.addr; addr; addr = addr->next)
1674 {
1675 addr->message = cutthrough.addr.message;
1676 switch(res)
1677 {
1678 case '2':
1679 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1680 close_cutthrough_connection("delivered");
1681 break;
1682
1683 case '4':
1684 delivery_log(LOG_MAIN, addr, 0,
1685 US"tmp-reject from cutthrough after DATA:");
1686 break;
1687
1688 case '5':
1689 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1690 US"rejected after DATA:");
1691 break;
1692
1693 default:
1694 break;
1695 }
1696 }
1697 return cutthrough.addr.message;
1698 }
1699
1700
1701
1702 /*************************************************
1703 * Copy error to toplevel address *
1704 *************************************************/
1705
1706 /* This function is used when a verify fails or defers, to ensure that the
1707 failure or defer information is in the original toplevel address. This applies
1708 when an address is redirected to a single new address, and the failure or
1709 deferral happens to the child address.
1710
1711 Arguments:
1712 vaddr the verify address item
1713 addr the final address item
1714 yield FAIL or DEFER
1715
1716 Returns: the value of YIELD
1717 */
1718
1719 static int
1720 copy_error(address_item *vaddr, address_item *addr, int yield)
1721 {
1722 if (addr != vaddr)
1723 {
1724 vaddr->message = addr->message;
1725 vaddr->user_message = addr->user_message;
1726 vaddr->basic_errno = addr->basic_errno;
1727 vaddr->more_errno = addr->more_errno;
1728 vaddr->prop.address_data = addr->prop.address_data;
1729 copyflag(vaddr, addr, af_pass_message);
1730 }
1731 return yield;
1732 }
1733
1734
1735
1736
1737 /**************************************************
1738 * printf that automatically handles TLS if needed *
1739 ***************************************************/
1740
1741 /* This function is used by verify_address() as a substitute for all fprintf()
1742 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1743 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1744 that assumes that we always use the smtp_out FILE* when not using TLS or the
1745 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1746 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1747 fprintf().
1748
1749 Arguments:
1750 f the candidate FILE* to write to
1751 format format string
1752 ... optional arguments
1753
1754 Returns:
1755 nothing
1756 */
1757
1758 static void PRINTF_FUNCTION(2,3)
1759 respond_printf(FILE *f, const char *format, ...)
1760 {
1761 va_list ap;
1762
1763 va_start(ap, format);
1764 if (smtp_out && (f == smtp_out))
1765 smtp_vprintf(format, ap);
1766 else
1767 vfprintf(f, format, ap);
1768 va_end(ap);
1769 }
1770
1771
1772
1773 /*************************************************
1774 * Verify an email address *
1775 *************************************************/
1776
1777 /* This function is used both for verification (-bv and at other times) and
1778 address testing (-bt), which is indicated by address_test_mode being set.
1779
1780 Arguments:
1781 vaddr contains the address to verify; the next field in this block
1782 must be NULL
1783 f if not NULL, write the result to this file
1784 options various option bits:
1785 vopt_fake_sender => this sender verify is not for the real
1786 sender (it was verify=sender=xxxx or an address from a
1787 header line) - rewriting must not change sender_address
1788 vopt_is_recipient => this is a recipient address, otherwise
1789 it's a sender address - this affects qualification and
1790 rewriting and messages from callouts
1791 vopt_qualify => qualify an unqualified address; else error
1792 vopt_expn => called from SMTP EXPN command
1793 vopt_success_on_redirect => when a new address is generated
1794 the verification instantly succeeds
1795
1796 These ones are used by do_callout() -- the options variable
1797 is passed to it.
1798
1799 vopt_callout_fullpm => if postmaster check, do full one
1800 vopt_callout_no_cache => don't use callout cache
1801 vopt_callout_random => do the "random" thing
1802 vopt_callout_recipsender => use real sender for recipient
1803 vopt_callout_recippmaster => use postmaster for recipient
1804
1805 callout if > 0, specifies that callout is required, and gives timeout
1806 for individual commands
1807 callout_overall if > 0, gives overall timeout for the callout function;
1808 if < 0, a default is used (see do_callout())
1809 callout_connect the connection timeout for callouts
1810 se_mailfrom when callout is requested to verify a sender, use this
1811 in MAIL FROM; NULL => ""
1812 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1813 thing and use this as the sender address (may be "")
1814
1815 routed if not NULL, set TRUE if routing succeeded, so we can
1816 distinguish between routing failed and callout failed
1817
1818 Returns: OK address verified
1819 FAIL address failed to verify
1820 DEFER can't tell at present
1821 */
1822
1823 int
1824 verify_address(address_item *vaddr, FILE *f, int options, int callout,
1825 int callout_overall, int callout_connect, uschar *se_mailfrom,
1826 uschar *pm_mailfrom, BOOL *routed)
1827 {
1828 BOOL allok = TRUE;
1829 BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
1830 BOOL expn = (options & vopt_expn) != 0;
1831 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1832 int i;
1833 int yield = OK;
1834 int verify_type = expn? v_expn :
1835 address_test_mode? v_none :
1836 options & vopt_is_recipient? v_recipient : v_sender;
1837 address_item *addr_list;
1838 address_item *addr_new = NULL;
1839 address_item *addr_remote = NULL;
1840 address_item *addr_local = NULL;
1841 address_item *addr_succeed = NULL;
1842 uschar **failure_ptr = options & vopt_is_recipient
1843 ? &recipient_verify_failure : &sender_verify_failure;
1844 uschar *ko_prefix, *cr;
1845 uschar *address = vaddr->address;
1846 uschar *save_sender;
1847 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1848
1849 /* Clear, just in case */
1850
1851 *failure_ptr = NULL;
1852
1853 /* Set up a prefix and suffix for error message which allow us to use the same
1854 output statements both in EXPN mode (where an SMTP response is needed) and when
1855 debugging with an output file. */
1856
1857 if (expn)
1858 {
1859 ko_prefix = US"553 ";
1860 cr = US"\r";
1861 }
1862 else ko_prefix = cr = US"";
1863
1864 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1865
1866 if (parse_find_at(address) == NULL)
1867 {
1868 if ((options & vopt_qualify) == 0)
1869 {
1870 if (f != NULL)
1871 respond_printf(f, "%sA domain is required for \"%s\"%s\n",
1872 ko_prefix, address, cr);
1873 *failure_ptr = US"qualify";
1874 return FAIL;
1875 }
1876 address = rewrite_address_qualify(address, options & vopt_is_recipient);
1877 }
1878
1879 DEBUG(D_verify)
1880 {
1881 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1882 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
1883 }
1884
1885 /* Rewrite and report on it. Clear the domain and local part caches - these
1886 may have been set by domains and local part tests during an ACL. */
1887
1888 if (global_rewrite_rules != NULL)
1889 {
1890 uschar *old = address;
1891 address = rewrite_address(address, options & vopt_is_recipient, FALSE,
1892 global_rewrite_rules, rewrite_existflags);
1893 if (address != old)
1894 {
1895 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1896 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1897 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
1898 }
1899 }
1900
1901 /* If this is the real sender address, we must update sender_address at
1902 this point, because it may be referred to in the routers. */
1903
1904 if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
1905 sender_address = address;
1906
1907 /* If the address was rewritten to <> no verification can be done, and we have
1908 to return OK. This rewriting is permitted only for sender addresses; for other
1909 addresses, such rewriting fails. */
1910
1911 if (address[0] == 0) return OK;
1912
1913 /* Flip the legacy TLS-related variables over to the outbound set in case
1914 they're used in the context of a transport used by verification. Reset them
1915 at exit from this routine (so no returns allowed from here on). */
1916
1917 tls_modify_variables(&tls_out);
1918
1919 /* Save a copy of the sender address for re-instating if we change it to <>
1920 while verifying a sender address (a nice bit of self-reference there). */
1921
1922 save_sender = sender_address;
1923
1924 /* Observability variable for router/transport use */
1925
1926 verify_mode = options & vopt_is_recipient ? US"R" : US"S";
1927
1928 /* Update the address structure with the possibly qualified and rewritten
1929 address. Set it up as the starting address on the chain of new addresses. */
1930
1931 vaddr->address = address;
1932 addr_new = vaddr;
1933
1934 /* We need a loop, because an address can generate new addresses. We must also
1935 cope with generated pipes and files at the top level. (See also the code and
1936 comment in deliver.c.) However, it is usually the case that the router for
1937 user's .forward files has its verify flag turned off.
1938
1939 If an address generates more than one child, the loop is used only when
1940 full_info is set, and this can only be set locally. Remote enquiries just get
1941 information about the top level address, not anything that it generated. */
1942
1943 while (addr_new)
1944 {
1945 int rc;
1946 address_item *addr = addr_new;
1947
1948 addr_new = addr->next;
1949 addr->next = NULL;
1950
1951 DEBUG(D_verify)
1952 {
1953 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1954 debug_printf("Considering %s\n", addr->address);
1955 }
1956
1957 /* Handle generated pipe, file or reply addresses. We don't get these
1958 when handling EXPN, as it does only one level of expansion. */
1959
1960 if (testflag(addr, af_pfr))
1961 {
1962 allok = FALSE;
1963 if (f != NULL)
1964 {
1965 BOOL allow;
1966
1967 if (addr->address[0] == '>')
1968 {
1969 allow = testflag(addr, af_allow_reply);
1970 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1971 }
1972 else
1973 {
1974 allow = (addr->address[0] == '|')?
1975 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1976 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1977 }
1978
1979 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1980 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1981 "%s\n", addr->message);
1982 else if (allow)
1983 fprintf(f, "\n transport = %s\n", addr->transport->name);
1984 else
1985 fprintf(f, " *** forbidden ***\n");
1986 }
1987 continue;
1988 }
1989
1990 /* Just in case some router parameter refers to it. */
1991
1992 return_path = addr->prop.errors_address
1993 ? addr->prop.errors_address : sender_address;
1994
1995 /* Split the address into domain and local part, handling the %-hack if
1996 necessary, and then route it. While routing a sender address, set
1997 $sender_address to <> because that is what it will be if we were trying to
1998 send a bounce to the sender. */
1999
2000 if (routed) *routed = FALSE;
2001 if ((rc = deliver_split_address(addr)) == OK)
2002 {
2003 if (!(options & vopt_is_recipient)) sender_address = null_sender;
2004 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
2005 &addr_succeed, verify_type);
2006 sender_address = save_sender; /* Put back the real sender */
2007 }
2008
2009 /* If routing an address succeeded, set the flag that remembers, for use when
2010 an ACL cached a sender verify (in case a callout fails). Then if routing set
2011 up a list of hosts or the transport has a host list, and the callout option
2012 is set, and we aren't in a host checking run, do the callout verification,
2013 and set another flag that notes that a callout happened. */
2014
2015 if (rc == OK)
2016 {
2017 if (routed) *routed = TRUE;
2018 if (callout > 0)
2019 {
2020 transport_instance * tp;
2021 host_item * host_list = addr->host_list;
2022
2023 /* Make up some data for use in the case where there is no remote
2024 transport. */
2025
2026 transport_feedback tf = {
2027 NULL, /* interface (=> any) */
2028 US"smtp", /* port */
2029 US"smtp", /* protocol */
2030 NULL, /* hosts */
2031 US"$smtp_active_hostname", /* helo_data */
2032 FALSE, /* hosts_override */
2033 FALSE, /* hosts_randomize */
2034 FALSE, /* gethostbyname */
2035 TRUE, /* qualify_single */
2036 FALSE /* search_parents */
2037 };
2038
2039 /* If verification yielded a remote transport, we want to use that
2040 transport's options, so as to mimic what would happen if we were really
2041 sending a message to this address. */
2042
2043 if ((tp = addr->transport) && !tp->info->local)
2044 {
2045 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
2046
2047 /* If the transport has hosts and the router does not, or if the
2048 transport is configured to override the router's hosts, we must build a
2049 host list of the transport's hosts, and find the IP addresses */
2050
2051 if (tf.hosts && (!host_list || tf.hosts_override))
2052 {
2053 uschar *s;
2054 const uschar *save_deliver_domain = deliver_domain;
2055 uschar *save_deliver_localpart = deliver_localpart;
2056
2057 host_list = NULL; /* Ignore the router's hosts */
2058
2059 deliver_domain = addr->domain;
2060 deliver_localpart = addr->local_part;
2061 s = expand_string(tf.hosts);
2062 deliver_domain = save_deliver_domain;
2063 deliver_localpart = save_deliver_localpart;
2064
2065 if (!s)
2066 {
2067 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
2068 "\"%s\" in %s transport for callout: %s", tf.hosts,
2069 tp->name, expand_string_message);
2070 }
2071 else
2072 {
2073 int flags;
2074 host_item *host, *nexthost;
2075 host_build_hostlist(&host_list, s, tf.hosts_randomize);
2076
2077 /* Just ignore failures to find a host address. If we don't manage
2078 to find any addresses, the callout will defer. Note that more than
2079 one address may be found for a single host, which will result in
2080 additional host items being inserted into the chain. Hence we must
2081 save the next host first. */
2082
2083 flags = HOST_FIND_BY_A;
2084 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
2085 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
2086
2087 for (host = host_list; host; host = nexthost)
2088 {
2089 nexthost = host->next;
2090 if (tf.gethostbyname ||
2091 string_is_ip_address(host->name, NULL) != 0)
2092 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
2093 else
2094 {
2095 dnssec_domains * dnssec_domains = NULL;
2096 if (Ustrcmp(tp->driver_name, "smtp") == 0)
2097 {
2098 smtp_transport_options_block * ob =
2099 (smtp_transport_options_block *) tp->options_block;
2100 dnssec_domains = &ob->dnssec;
2101 }
2102
2103 (void)host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
2104 dnssec_domains, NULL, NULL);
2105 }
2106 }
2107 }
2108 }
2109 }
2110
2111 /* Can only do a callout if we have at least one host! If the callout
2112 fails, it will have set ${sender,recipient}_verify_failure. */
2113
2114 if (host_list)
2115 {
2116 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
2117 if (host_checking && !host_checking_callout)
2118 {
2119 HDEBUG(D_verify)
2120 debug_printf("... callout omitted by default when host testing\n"
2121 "(Use -bhc if you want the callouts to happen.)\n");
2122 }
2123 else
2124 {
2125 #ifdef SUPPORT_TLS
2126 deliver_set_expansions(addr);
2127 #endif
2128 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
2129 callout_connect, options, se_mailfrom, pm_mailfrom);
2130 }
2131 }
2132 else
2133 {
2134 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
2135 "transport provided a host list\n");
2136 }
2137 }
2138 }
2139
2140 /* Otherwise, any failure is a routing failure */
2141
2142 else *failure_ptr = US"route";
2143
2144 /* A router may return REROUTED if it has set up a child address as a result
2145 of a change of domain name (typically from widening). In this case we always
2146 want to continue to verify the new child. */
2147
2148 if (rc == REROUTED) continue;
2149
2150 /* Handle hard failures */
2151
2152 if (rc == FAIL)
2153 {
2154 allok = FALSE;
2155 if (f)
2156 {
2157 address_item *p = addr->parent;
2158
2159 respond_printf(f, "%s%s %s", ko_prefix,
2160 full_info ? addr->address : address,
2161 address_test_mode ? "is undeliverable" : "failed to verify");
2162 if (!expn && admin_user)
2163 {
2164 if (addr->basic_errno > 0)
2165 respond_printf(f, ": %s", strerror(addr->basic_errno));
2166 if (addr->message)
2167 respond_printf(f, ": %s", addr->message);
2168 }
2169
2170 /* Show parents iff doing full info */
2171
2172 if (full_info) while (p)
2173 {
2174 respond_printf(f, "%s\n <-- %s", cr, p->address);
2175 p = p->parent;
2176 }
2177 respond_printf(f, "%s\n", cr);
2178 }
2179 cancel_cutthrough_connection("routing hard fail");
2180
2181 if (!full_info)
2182 {
2183 yield = copy_error(vaddr, addr, FAIL);
2184 goto out;
2185 }
2186 yield = FAIL;
2187 }
2188
2189 /* Soft failure */
2190
2191 else if (rc == DEFER)
2192 {
2193 allok = FALSE;
2194 if (f)
2195 {
2196 address_item *p = addr->parent;
2197 respond_printf(f, "%s%s cannot be resolved at this time", ko_prefix,
2198 full_info? addr->address : address);
2199 if (!expn && admin_user)
2200 {
2201 if (addr->basic_errno > 0)
2202 respond_printf(f, ": %s", strerror(addr->basic_errno));
2203 if (addr->message)
2204 respond_printf(f, ": %s", addr->message);
2205 else if (addr->basic_errno <= 0)
2206 respond_printf(f, ": unknown error");
2207 }
2208
2209 /* Show parents iff doing full info */
2210
2211 if (full_info) while (p)
2212 {
2213 respond_printf(f, "%s\n <-- %s", cr, p->address);
2214 p = p->parent;
2215 }
2216 respond_printf(f, "%s\n", cr);
2217 }
2218 cancel_cutthrough_connection("routing soft fail");
2219
2220 if (!full_info)
2221 {
2222 yield = copy_error(vaddr, addr, DEFER);
2223 goto out;
2224 }
2225 if (yield == OK) yield = DEFER;
2226 }
2227
2228 /* If we are handling EXPN, we do not want to continue to route beyond
2229 the top level (whose address is in "address"). */
2230
2231 else if (expn)
2232 {
2233 uschar *ok_prefix = US"250-";
2234
2235 if (!addr_new)
2236 if (!addr_local && !addr_remote)
2237 respond_printf(f, "250 mail to <%s> is discarded\r\n", address);
2238 else
2239 respond_printf(f, "250 <%s>\r\n", address);
2240
2241 else do
2242 {
2243 address_item *addr2 = addr_new;
2244 addr_new = addr2->next;
2245 if (!addr_new) ok_prefix = US"250 ";
2246 respond_printf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
2247 } while (addr_new);
2248 yield = OK;
2249 goto out;
2250 }
2251
2252 /* Successful routing other than EXPN. */
2253
2254 else
2255 {
2256 /* Handle successful routing when short info wanted. Otherwise continue for
2257 other (generated) addresses. Short info is the operational case. Full info
2258 can be requested only when debug_selector != 0 and a file is supplied.
2259
2260 There is a conflict between the use of aliasing as an alternate email
2261 address, and as a sort of mailing list. If an alias turns the incoming
2262 address into just one address (e.g. J.Caesar->jc44) you may well want to
2263 carry on verifying the generated address to ensure it is valid when
2264 checking incoming mail. If aliasing generates multiple addresses, you
2265 probably don't want to do this. Exim therefore treats the generation of
2266 just a single new address as a special case, and continues on to verify the
2267 generated address. */
2268
2269 if ( !full_info /* Stop if short info wanted AND */
2270 && ( ( !addr_new /* No new address OR */
2271 || addr_new->next /* More than one new address OR */
2272 || testflag(addr_new, af_pfr) /* New address is pfr */
2273 )
2274 || /* OR */
2275 ( addr_new /* At least one new address AND */
2276 && success_on_redirect /* success_on_redirect is set */
2277 ) )
2278 )
2279 {
2280 if (f) fprintf(f, "%s %s\n",
2281 address, address_test_mode ? "is deliverable" : "verified");
2282
2283 /* If we have carried on to verify a child address, we want the value
2284 of $address_data to be that of the child */
2285
2286 vaddr->prop.address_data = addr->prop.address_data;
2287
2288 /* If stopped because more than one new address, cannot cutthrough */
2289
2290 if (addr_new && addr_new->next)
2291 cancel_cutthrough_connection("multiple addresses from routing");
2292
2293 yield = OK;
2294 goto out;
2295 }
2296 }
2297 } /* Loop for generated addresses */
2298
2299 /* Display the full results of the successful routing, including any generated
2300 addresses. Control gets here only when full_info is set, which requires f not
2301 to be NULL, and this occurs only when a top-level verify is called with the
2302 debugging switch on.
2303
2304 If there are no local and no remote addresses, and there were no pipes, files,
2305 or autoreplies, and there were no errors or deferments, the message is to be
2306 discarded, usually because of the use of :blackhole: in an alias file. */
2307
2308 if (allok && !addr_local && !addr_remote)
2309 {
2310 fprintf(f, "mail to %s is discarded\n", address);
2311 goto out;
2312 }
2313
2314 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2315 while (addr_list)
2316 {
2317 address_item *addr = addr_list;
2318 address_item *p = addr->parent;
2319 transport_instance * tp = addr->transport;
2320
2321 addr_list = addr->next;
2322
2323 fprintf(f, "%s", CS addr->address);
2324 #ifdef EXPERIMENTAL_SRS
2325 if(addr->prop.srs_sender)
2326 fprintf(f, " [srs = %s]", addr->prop.srs_sender);
2327 #endif
2328
2329 /* If the address is a duplicate, show something about it. */
2330
2331 if (!testflag(addr, af_pfr))
2332 {
2333 tree_node *tnode;
2334 if ((tnode = tree_search(tree_duplicates, addr->unique)))
2335 fprintf(f, " [duplicate, would not be delivered]");
2336 else tree_add_duplicate(addr->unique, addr);
2337 }
2338
2339 /* Now show its parents */
2340
2341 for (p = addr->parent; p; p = p->parent)
2342 fprintf(f, "\n <-- %s", p->address);
2343 fprintf(f, "\n ");
2344
2345 /* Show router, and transport */
2346
2347 fprintf(f, "router = %s, transport = %s\n",
2348 addr->router->name, tp ? tp->name : US"unset");
2349
2350 /* Show any hosts that are set up by a router unless the transport
2351 is going to override them; fiddle a bit to get a nice format. */
2352
2353 if (addr->host_list && tp && !tp->overrides_hosts)
2354 {
2355 host_item *h;
2356 int maxlen = 0;
2357 int maxaddlen = 0;
2358 for (h = addr->host_list; h; h = h->next)
2359 { /* get max lengths of host names, addrs */
2360 int len = Ustrlen(h->name);
2361 if (len > maxlen) maxlen = len;
2362 len = h->address ? Ustrlen(h->address) : 7;
2363 if (len > maxaddlen) maxaddlen = len;
2364 }
2365 for (h = addr->host_list; h; h = h->next)
2366 {
2367 fprintf(f, " host %-*s ", maxlen, h->name);
2368
2369 if (h->address)
2370 fprintf(f, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2371 else if (tp->info->local)
2372 fprintf(f, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2373 else
2374 fprintf(f, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2375
2376 if (h->mx >= 0) fprintf(f, " MX=%d", h->mx);
2377 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
2378 if (running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", f);
2379 if (h->status == hstatus_unusable) fputs(" ** unusable **", f);
2380 fputc('\n', f);
2381 }
2382 }
2383 }
2384
2385 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2386 the -bv or -bt case). */
2387
2388 out:
2389 verify_mode = NULL;
2390 tls_modify_variables(&tls_in);
2391
2392 return yield;
2393 }
2394
2395
2396
2397
2398 /*************************************************
2399 * Check headers for syntax errors *
2400 *************************************************/
2401
2402 /* This function checks those header lines that contain addresses, and verifies
2403 that all the addresses therein are syntactially correct.
2404
2405 Arguments:
2406 msgptr where to put an error message
2407
2408 Returns: OK
2409 FAIL
2410 */
2411
2412 int
2413 verify_check_headers(uschar **msgptr)
2414 {
2415 header_line *h;
2416 uschar *colon, *s;
2417 int yield = OK;
2418
2419 for (h = header_list; h != NULL && yield == OK; h = h->next)
2420 {
2421 if (h->type != htype_from &&
2422 h->type != htype_reply_to &&
2423 h->type != htype_sender &&
2424 h->type != htype_to &&
2425 h->type != htype_cc &&
2426 h->type != htype_bcc)
2427 continue;
2428
2429 colon = Ustrchr(h->text, ':');
2430 s = colon + 1;
2431 while (isspace(*s)) s++;
2432
2433 /* Loop for multiple addresses in the header, enabling group syntax. Note
2434 that we have to reset this after the header has been scanned. */
2435
2436 parse_allow_group = TRUE;
2437
2438 while (*s != 0)
2439 {
2440 uschar *ss = parse_find_address_end(s, FALSE);
2441 uschar *recipient, *errmess;
2442 int terminator = *ss;
2443 int start, end, domain;
2444
2445 /* Temporarily terminate the string at this point, and extract the
2446 operative address within, allowing group syntax. */
2447
2448 *ss = 0;
2449 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2450 *ss = terminator;
2451
2452 /* Permit an unqualified address only if the message is local, or if the
2453 sending host is configured to be permitted to send them. */
2454
2455 if (recipient != NULL && domain == 0)
2456 {
2457 if (h->type == htype_from || h->type == htype_sender)
2458 {
2459 if (!allow_unqualified_sender) recipient = NULL;
2460 }
2461 else
2462 {
2463 if (!allow_unqualified_recipient) recipient = NULL;
2464 }
2465 if (recipient == NULL) errmess = US"unqualified address not permitted";
2466 }
2467
2468 /* It's an error if no address could be extracted, except for the special
2469 case of an empty address. */
2470
2471 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
2472 {
2473 uschar *verb = US"is";
2474 uschar *t = ss;
2475 uschar *tt = colon;
2476 int len;
2477
2478 /* Arrange not to include any white space at the end in the
2479 error message or the header name. */
2480
2481 while (t > s && isspace(t[-1])) t--;
2482 while (tt > h->text && isspace(tt[-1])) tt--;
2483
2484 /* Add the address that failed to the error message, since in a
2485 header with very many addresses it is sometimes hard to spot
2486 which one is at fault. However, limit the amount of address to
2487 quote - cases have been seen where, for example, a missing double
2488 quote in a humungous To: header creates an "address" that is longer
2489 than string_sprintf can handle. */
2490
2491 len = t - s;
2492 if (len > 1024)
2493 {
2494 len = 1024;
2495 verb = US"begins";
2496 }
2497
2498 /* deconst cast ok as we're passing a non-const to string_printing() */
2499 *msgptr = US string_printing(
2500 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2501 errmess, tt - h->text, h->text, verb, len, s));
2502
2503 yield = FAIL;
2504 break; /* Out of address loop */
2505 }
2506
2507 /* Advance to the next address */
2508
2509 s = ss + (terminator? 1:0);
2510 while (isspace(*s)) s++;
2511 } /* Next address */
2512
2513 parse_allow_group = FALSE;
2514 parse_found_group = FALSE;
2515 } /* Next header unless yield has been set FALSE */
2516
2517 return yield;
2518 }
2519
2520
2521 /*************************************************
2522 * Check header names for 8-bit characters *
2523 *************************************************/
2524
2525 /* This function checks for invalid charcters in header names. See
2526 RFC 5322, 2.2. and RFC 6532, 3.
2527
2528 Arguments:
2529 msgptr where to put an error message
2530
2531 Returns: OK
2532 FAIL
2533 */
2534
2535 int
2536 verify_check_header_names_ascii(uschar **msgptr)
2537 {
2538 header_line *h;
2539 uschar *colon, *s;
2540
2541 for (h = header_list; h != NULL; h = h->next)
2542 {
2543 colon = Ustrchr(h->text, ':');
2544 for(s = h->text; s < colon; s++)
2545 {
2546 if ((*s < 33) || (*s > 126))
2547 {
2548 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2549 colon - h->text, h->text);
2550 return FAIL;
2551 }
2552 }
2553 }
2554 return OK;
2555 }
2556
2557 /*************************************************
2558 * Check for blind recipients *
2559 *************************************************/
2560
2561 /* This function checks that every (envelope) recipient is mentioned in either
2562 the To: or Cc: header lines, thus detecting blind carbon copies.
2563
2564 There are two ways of scanning that could be used: either scan the header lines
2565 and tick off the recipients, or scan the recipients and check the header lines.
2566 The original proposed patch did the former, but I have chosen to do the latter,
2567 because (a) it requires no memory and (b) will use fewer resources when there
2568 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2569
2570 Arguments: none
2571 Returns: OK if there are no blind recipients
2572 FAIL if there is at least one blind recipient
2573 */
2574
2575 int
2576 verify_check_notblind(void)
2577 {
2578 int i;
2579 for (i = 0; i < recipients_count; i++)
2580 {
2581 header_line *h;
2582 BOOL found = FALSE;
2583 uschar *address = recipients_list[i].address;
2584
2585 for (h = header_list; !found && h != NULL; h = h->next)
2586 {
2587 uschar *colon, *s;
2588
2589 if (h->type != htype_to && h->type != htype_cc) continue;
2590
2591 colon = Ustrchr(h->text, ':');
2592 s = colon + 1;
2593 while (isspace(*s)) s++;
2594
2595 /* Loop for multiple addresses in the header, enabling group syntax. Note
2596 that we have to reset this after the header has been scanned. */
2597
2598 parse_allow_group = TRUE;
2599
2600 while (*s != 0)
2601 {
2602 uschar *ss = parse_find_address_end(s, FALSE);
2603 uschar *recipient,*errmess;
2604 int terminator = *ss;
2605 int start, end, domain;
2606
2607 /* Temporarily terminate the string at this point, and extract the
2608 operative address within, allowing group syntax. */
2609
2610 *ss = 0;
2611 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2612 *ss = terminator;
2613
2614 /* If we found a valid recipient that has a domain, compare it with the
2615 envelope recipient. Local parts are compared case-sensitively, domains
2616 case-insensitively. By comparing from the start with length "domain", we
2617 include the "@" at the end, which ensures that we are comparing the whole
2618 local part of each address. */
2619
2620 if (recipient != NULL && domain != 0)
2621 {
2622 found = Ustrncmp(recipient, address, domain) == 0 &&
2623 strcmpic(recipient + domain, address + domain) == 0;
2624 if (found) break;
2625 }
2626
2627 /* Advance to the next address */
2628
2629 s = ss + (terminator? 1:0);
2630 while (isspace(*s)) s++;
2631 } /* Next address */
2632
2633 parse_allow_group = FALSE;
2634 parse_found_group = FALSE;
2635 } /* Next header (if found is false) */
2636
2637 if (!found) return FAIL;
2638 } /* Next recipient */
2639
2640 return OK;
2641 }
2642
2643
2644
2645 /*************************************************
2646 * Find if verified sender *
2647 *************************************************/
2648
2649 /* Usually, just a single address is verified as the sender of the message.
2650 However, Exim can be made to verify other addresses as well (often related in
2651 some way), and this is useful in some environments. There may therefore be a
2652 chain of such addresses that have previously been tested. This function finds
2653 whether a given address is on the chain.
2654
2655 Arguments: the address to be verified
2656 Returns: pointer to an address item, or NULL
2657 */
2658
2659 address_item *
2660 verify_checked_sender(uschar *sender)
2661 {
2662 address_item *addr;
2663 for (addr = sender_verified_list; addr != NULL; addr = addr->next)
2664 if (Ustrcmp(sender, addr->address) == 0) break;
2665 return addr;
2666 }
2667
2668
2669
2670
2671
2672 /*************************************************
2673 * Get valid header address *
2674 *************************************************/
2675
2676 /* Scan the originator headers of the message, looking for an address that
2677 verifies successfully. RFC 822 says:
2678
2679 o The "Sender" field mailbox should be sent notices of
2680 any problems in transport or delivery of the original
2681 messages. If there is no "Sender" field, then the
2682 "From" field mailbox should be used.
2683
2684 o If the "Reply-To" field exists, then the reply should
2685 go to the addresses indicated in that field and not to
2686 the address(es) indicated in the "From" field.
2687
2688 So we check a Sender field if there is one, else a Reply_to field, else a From
2689 field. As some strange messages may have more than one of these fields,
2690 especially if they are resent- fields, check all of them if there is more than
2691 one.
2692
2693 Arguments:
2694 user_msgptr points to where to put a user error message
2695 log_msgptr points to where to put a log error message
2696 callout timeout for callout check (passed to verify_address())
2697 callout_overall overall callout timeout (ditto)
2698 callout_connect connect callout timeout (ditto)
2699 se_mailfrom mailfrom for verify; NULL => ""
2700 pm_mailfrom sender for pm callout check (passed to verify_address())
2701 options callout options (passed to verify_address())
2702 verrno where to put the address basic_errno
2703
2704 If log_msgptr is set to something without setting user_msgptr, the caller
2705 normally uses log_msgptr for both things.
2706
2707 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2708 FAIL is given if no appropriate headers are found
2709 */
2710
2711 int
2712 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2713 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2714 uschar *pm_mailfrom, int options, int *verrno)
2715 {
2716 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2717 BOOL done = FALSE;
2718 int yield = FAIL;
2719 int i;
2720
2721 for (i = 0; i < 3 && !done; i++)
2722 {
2723 header_line *h;
2724 for (h = header_list; h != NULL && !done; h = h->next)
2725 {
2726 int terminator, new_ok;
2727 uschar *s, *ss, *endname;
2728
2729 if (h->type != header_types[i]) continue;
2730 s = endname = Ustrchr(h->text, ':') + 1;
2731
2732 /* Scan the addresses in the header, enabling group syntax. Note that we
2733 have to reset this after the header has been scanned. */
2734
2735 parse_allow_group = TRUE;
2736
2737 while (*s != 0)
2738 {
2739 address_item *vaddr;
2740
2741 while (isspace(*s) || *s == ',') s++;
2742 if (*s == 0) break; /* End of header */
2743
2744 ss = parse_find_address_end(s, FALSE);
2745
2746 /* The terminator is a comma or end of header, but there may be white
2747 space preceding it (including newline for the last address). Move back
2748 past any white space so we can check against any cached envelope sender
2749 address verifications. */
2750
2751 while (isspace(ss[-1])) ss--;
2752 terminator = *ss;
2753 *ss = 0;
2754
2755 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2756 (int)(endname - h->text), h->text, s);
2757
2758 /* See if we have already verified this address as an envelope sender,
2759 and if so, use the previous answer. */
2760
2761 vaddr = verify_checked_sender(s);
2762
2763 if (vaddr != NULL && /* Previously checked */
2764 (callout <= 0 || /* No callout needed; OR */
2765 vaddr->special_action > 256)) /* Callout was done */
2766 {
2767 new_ok = vaddr->special_action & 255;
2768 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2769 *ss = terminator; /* Restore shortened string */
2770 }
2771
2772 /* Otherwise we run the verification now. We must restore the shortened
2773 string before running the verification, so the headers are correct, in
2774 case there is any rewriting. */
2775
2776 else
2777 {
2778 int start, end, domain;
2779 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2780 &domain, FALSE);
2781
2782 *ss = terminator;
2783
2784 /* If we found an empty address, just carry on with the next one, but
2785 kill the message. */
2786
2787 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2788 {
2789 *log_msgptr = NULL;
2790 s = ss;
2791 continue;
2792 }
2793
2794 /* If verification failed because of a syntax error, fail this
2795 function, and ensure that the failing address gets added to the error
2796 message. */
2797
2798 if (address == NULL)
2799 {
2800 new_ok = FAIL;
2801 while (ss > s && isspace(ss[-1])) ss--;
2802 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2803 "scanning for sender: %s in \"%.*s\"",
2804 endname - h->text, h->text, *log_msgptr, ss - s, s);
2805 yield = FAIL;
2806 done = TRUE;
2807 break;
2808 }
2809
2810 /* Else go ahead with the sender verification. But it isn't *the*
2811 sender of the message, so set vopt_fake_sender to stop sender_address
2812 being replaced after rewriting or qualification. */
2813
2814 else
2815 {
2816 vaddr = deliver_make_addr(address, FALSE);
2817 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2818 callout, callout_overall, callout_connect, se_mailfrom,
2819 pm_mailfrom, NULL);
2820 }
2821 }
2822
2823 /* We now have the result, either newly found, or cached. If we are
2824 giving out error details, set a specific user error. This means that the
2825 last of these will be returned to the user if all three fail. We do not
2826 set a log message - the generic one below will be used. */
2827
2828 if (new_ok != OK)
2829 {
2830 *verrno = vaddr->basic_errno;
2831 if (smtp_return_error_details)
2832 {
2833 *user_msgptr = string_sprintf("Rejected after DATA: "
2834 "could not verify \"%.*s\" header address\n%s: %s",
2835 endname - h->text, h->text, vaddr->address, vaddr->message);
2836 }
2837 }
2838
2839 /* Success or defer */
2840
2841 if (new_ok == OK)
2842 {
2843 yield = OK;
2844 done = TRUE;
2845 break;
2846 }
2847
2848 if (new_ok == DEFER) yield = DEFER;
2849
2850 /* Move on to any more addresses in the header */
2851
2852 s = ss;
2853 } /* Next address */
2854
2855 parse_allow_group = FALSE;
2856 parse_found_group = FALSE;
2857 } /* Next header, unless done */
2858 } /* Next header type unless done */
2859
2860 if (yield == FAIL && *log_msgptr == NULL)
2861 *log_msgptr = US"there is no valid sender in any header line";
2862
2863 if (yield == DEFER && *log_msgptr == NULL)
2864 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2865
2866 return yield;
2867 }
2868
2869
2870
2871
2872 /*************************************************
2873 * Get RFC 1413 identification *
2874 *************************************************/
2875
2876 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2877 the timeout is set to zero, then the query is not done. There may also be lists
2878 of hosts and nets which are exempt. To guard against malefactors sending
2879 non-printing characters which could, for example, disrupt a message's headers,
2880 make sure the string consists of printing characters only.
2881
2882 Argument:
2883 port the port to connect to; usually this is IDENT_PORT (113), but when
2884 running in the test harness with -bh a different value is used.
2885
2886 Returns: nothing
2887
2888 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2889 */
2890
2891 void
2892 verify_get_ident(int port)
2893 {
2894 int sock, host_af, qlen;
2895 int received_sender_port, received_interface_port, n;
2896 uschar *p;
2897 uschar buffer[2048];
2898
2899 /* Default is no ident. Check whether we want to do an ident check for this
2900 host. */
2901
2902 sender_ident = NULL;
2903 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2904 return;
2905
2906 DEBUG(D_ident) debug_printf("doing ident callback\n");
2907
2908 /* Set up a connection to the ident port of the remote host. Bind the local end
2909 to the incoming interface address. If the sender host address is an IPv6
2910 address, the incoming interface address will also be IPv6. */
2911
2912 host_af = (Ustrchr(sender_host_address, ':') == NULL)? AF_INET : AF_INET6;
2913 sock = ip_socket(SOCK_STREAM, host_af);
2914 if (sock < 0) return;
2915
2916 if (ip_bind(sock, host_af, interface_address, 0) < 0)
2917 {
2918 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2919 strerror(errno));
2920 goto END_OFF;
2921 }
2922
2923 if (ip_connect(sock, host_af, sender_host_address, port, rfc1413_query_timeout)
2924 < 0)
2925 {
2926 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
2927 {
2928 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2929 sender_host_address);
2930 }
2931 else
2932 {
2933 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2934 sender_host_address, strerror(errno));
2935 }
2936 goto END_OFF;
2937 }
2938
2939 /* Construct and send the query. */
2940
2941 sprintf(CS buffer, "%d , %d\r\n", sender_host_port, interface_port);
2942 qlen = Ustrlen(buffer);
2943 if (send(sock, buffer, qlen, 0) < 0)
2944 {
2945 DEBUG(D_ident) debug_printf("ident send failed: %s\n", strerror(errno));
2946 goto END_OFF;
2947 }
2948
2949 /* Read a response line. We put it into the rest of the buffer, using several
2950 recv() calls if necessary. */
2951
2952 p = buffer + qlen;
2953
2954 for (;;)
2955 {
2956 uschar *pp;
2957 int count;
2958 int size = sizeof(buffer) - (p - buffer);
2959
2960 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2961 count = ip_recv(sock, p, size, rfc1413_query_timeout);
2962 if (count <= 0) goto END_OFF; /* Read error or EOF */
2963
2964 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2965 generous, and accept a plain \n terminator as well. The only illegal
2966 character is 0. */
2967
2968 for (pp = p; pp < p + count; pp++)
2969 {
2970 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2971 if (*pp == '\n')
2972 {
2973 if (pp[-1] == '\r') pp--;
2974 *pp = 0;
2975 goto GOT_DATA; /* Break out of both loops */
2976 }
2977 }
2978
2979 /* Reached the end of the data without finding \n. Let the loop continue to
2980 read some more, if there is room. */
2981
2982 p = pp;
2983 }
2984
2985 GOT_DATA:
2986
2987 /* We have received a line of data. Check it carefully. It must start with the
2988 same two port numbers that we sent, followed by data as defined by the RFC. For
2989 example,
2990
2991 12345 , 25 : USERID : UNIX :root
2992
2993 However, the amount of white space may be different to what we sent. In the
2994 "osname" field there may be several sub-fields, comma separated. The data we
2995 actually want to save follows the third colon. Some systems put leading spaces
2996 in it - we discard those. */
2997
2998 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2999 &received_interface_port, &n) != 2 ||
3000 received_sender_port != sender_host_port ||
3001 received_interface_port != interface_port)
3002 goto END_OFF;
3003
3004 p = buffer + qlen + n;
3005 while(isspace(*p)) p++;
3006 if (*p++ != ':') goto END_OFF;
3007 while(isspace(*p)) p++;
3008 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
3009 p += 6;
3010 while(isspace(*p)) p++;
3011 if (*p++ != ':') goto END_OFF;
3012 while (*p != 0 && *p != ':') p++;
3013 if (*p++ == 0) goto END_OFF;
3014 while(isspace(*p)) p++;
3015 if (*p == 0) goto END_OFF;
3016
3017 /* The rest of the line is the data we want. We turn it into printing
3018 characters when we save it, so that it cannot mess up the format of any logging
3019 or Received: lines into which it gets inserted. We keep a maximum of 127
3020 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
3021
3022 sender_ident = US string_printing(string_copyn(p, 127));
3023 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
3024
3025 END_OFF:
3026 (void)close(sock);
3027 return;
3028 }
3029
3030
3031
3032
3033 /*************************************************
3034 * Match host to a single host-list item *
3035 *************************************************/
3036
3037 /* This function compares a host (name or address) against a single item
3038 from a host list. The host name gets looked up if it is needed and is not
3039 already known. The function is called from verify_check_this_host() via
3040 match_check_list(), which is why most of its arguments are in a single block.
3041
3042 Arguments:
3043 arg the argument block (see below)
3044 ss the host-list item
3045 valueptr where to pass back looked up data, or NULL
3046 error for error message when returning ERROR
3047
3048 The block contains:
3049 host_name (a) the host name, or
3050 (b) NULL, implying use sender_host_name and
3051 sender_host_aliases, looking them up if required, or
3052 (c) the empty string, meaning that only IP address matches
3053 are permitted
3054 host_address the host address
3055 host_ipv4 the IPv4 address taken from an IPv6 one
3056
3057 Returns: OK matched
3058 FAIL did not match
3059 DEFER lookup deferred
3060 ERROR (a) failed to find the host name or IP address, or
3061 (b) unknown lookup type specified, or
3062 (c) host name encountered when only IP addresses are
3063 being matched
3064 */
3065
3066 int
3067 check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
3068 {
3069 check_host_block *cb = (check_host_block *)arg;
3070 int mlen = -1;
3071 int maskoffset;
3072 BOOL iplookup = FALSE;
3073 BOOL isquery = FALSE;
3074 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
3075 const uschar *t;
3076 uschar *semicolon;
3077 uschar **aliases;
3078
3079 /* Optimize for the special case when the pattern is "*". */
3080
3081 if (*ss == '*' && ss[1] == 0) return OK;
3082
3083 /* If the pattern is empty, it matches only in the case when there is no host -
3084 this can occur in ACL checking for SMTP input using the -bs option. In this
3085 situation, the host address is the empty string. */
3086
3087 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
3088 if (*ss == 0) return FAIL;
3089
3090 /* If the pattern is precisely "@" then match against the primary host name,
3091 provided that host name matching is permitted; if it's "@[]" match against the
3092 local host's IP addresses. */
3093
3094 if (*ss == '@')
3095 {
3096 if (ss[1] == 0)
3097 {
3098 if (isiponly) return ERROR;
3099 ss = primary_hostname;
3100 }
3101 else if (Ustrcmp(ss, "@[]") == 0)
3102 {
3103 ip_address_item *ip;
3104 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
3105 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
3106 return FAIL;
3107 }
3108 }
3109
3110 /* If the pattern is an IP address, optionally followed by a bitmask count, do
3111 a (possibly masked) comparision with the current IP address. */
3112
3113 if (string_is_ip_address(ss, &maskoffset) != 0)
3114 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
3115
3116 /* The pattern is not an IP address. A common error that people make is to omit
3117 one component of an IPv4 address, either by accident, or believing that, for
3118 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
3119 which it isn't. (Those applications that do accept 1.2.3 as an IP address
3120 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
3121 ancient specification.) To aid in debugging these cases, we give a specific
3122 error if the pattern contains only digits and dots or contains a slash preceded
3123 only by digits and dots (a slash at the start indicates a file name and of
3124 course slashes may be present in lookups, but not preceded only by digits and
3125 dots). */
3126
3127 for (t = ss; isdigit(*t) || *t == '.'; t++);
3128 if (*t == 0 || (*t == '/' && t != ss))
3129 {
3130 *error = US"malformed IPv4 address or address mask";
3131 return ERROR;
3132 }
3133
3134 /* See if there is a semicolon in the pattern */
3135
3136 semicolon = Ustrchr(ss, ';');
3137
3138 /* If we are doing an IP address only match, then all lookups must be IP
3139 address lookups, even if there is no "net-". */
3140
3141 if (isiponly)
3142 {
3143 iplookup = semicolon != NULL;
3144 }
3145
3146 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
3147 a lookup on a masked IP network, in textual form. We obey this code even if we
3148 have already set iplookup, so as to skip over the "net-" prefix and to set the
3149 mask length. The net- stuff really only applies to single-key lookups where the
3150 key is implicit. For query-style lookups the key is specified in the query.
3151 From release 4.30, the use of net- for query style is no longer needed, but we
3152 retain it for backward compatibility. */
3153
3154 if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
3155 {
3156 mlen = 0;
3157 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
3158 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
3159 iplookup = (*t++ == '-');
3160 }
3161 else t = ss;
3162
3163 /* Do the IP address lookup if that is indeed what we have */
3164
3165 if (iplookup)
3166 {
3167 int insize;
3168 int search_type;
3169 int incoming[4];
3170 void *handle;
3171 uschar *filename, *key, *result;
3172 uschar buffer[64];
3173
3174 /* Find the search type */
3175
3176 search_type = search_findtype(t, semicolon - t);
3177
3178 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3179 search_error_message);
3180
3181 /* Adjust parameters for the type of lookup. For a query-style lookup, there
3182 is no file name, and the "key" is just the query. For query-style with a file
3183 name, we have to fish the file off the start of the query. For a single-key
3184 lookup, the key is the current IP address, masked appropriately, and
3185 reconverted to text form, with the mask appended. For IPv6 addresses, specify
3186 dot separators instead of colons, except when the lookup type is "iplsearch".
3187 */
3188
3189 if (mac_islookup(search_type, lookup_absfilequery))
3190 {
3191 filename = semicolon + 1;
3192 key = filename;
3193 while (*key != 0 && !isspace(*key)) key++;
3194 filename = string_copyn(filename, key - filename);
3195 while (isspace(*key)) key++;
3196 }
3197 else if (mac_islookup(search_type, lookup_querystyle))
3198 {
3199 filename = NULL;
3200 key = semicolon + 1;
3201 }
3202 else /* Single-key style */
3203 {
3204 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
3205 ':' : '.';
3206 insize = host_aton(cb->host_address, incoming);
3207 host_mask(insize, incoming, mlen);
3208 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
3209 key = buffer;
3210 filename = semicolon + 1;
3211 }
3212
3213 /* Now do the actual lookup; note that there is no search_close() because
3214 of the caching arrangements. */
3215
3216 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3217 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3218
3219 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
3220 if (valueptr != NULL) *valueptr = result;
3221 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
3222 }
3223
3224 /* The pattern is not an IP address or network reference of any kind. That is,
3225 it is a host name pattern. If this is an IP only match, there's an error in the
3226 host list. */
3227
3228 if (isiponly)
3229 {
3230 *error = US"cannot match host name in match_ip list";
3231 return ERROR;
3232 }
3233
3234 /* Check the characters of the pattern to see if they comprise only letters,
3235 digits, full stops, and hyphens (the constituents of domain names). Allow
3236 underscores, as they are all too commonly found. Sigh. Also, if
3237 allow_utf8_domains is set, allow top-bit characters. */
3238
3239 for (t = ss; *t != 0; t++)
3240 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3241 (!allow_utf8_domains || *t < 128)) break;
3242
3243 /* If the pattern is a complete domain name, with no fancy characters, look up
3244 its IP address and match against that. Note that a multi-homed host will add
3245 items to the chain. */
3246
3247 if (*t == 0)
3248 {
3249 int rc;
3250 host_item h;
3251 h.next = NULL;
3252 h.name = ss;
3253 h.address = NULL;
3254 h.mx = MX_NONE;
3255
3256 /* Using byname rather than bydns here means we cannot determine dnssec
3257 status. On the other hand it is unclear how that could be either
3258 propagated up or enforced. */
3259
3260 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3261 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3262 {
3263 host_item *hh;
3264 for (hh = &h; hh != NULL; hh = hh->next)
3265 {
3266 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3267 }
3268 return FAIL;
3269 }
3270 if (rc == HOST_FIND_AGAIN) return DEFER;
3271 *error = string_sprintf("failed to find IP address for %s", ss);
3272 return ERROR;
3273 }
3274
3275 /* Almost all subsequent comparisons require the host name, and can be done
3276 using the general string matching function. When this function is called for
3277 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3278 must use sender_host_name and its aliases, looking them up if necessary. */
3279
3280 if (cb->host_name != NULL) /* Explicit host name given */
3281 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3282 valueptr);
3283
3284 /* Host name not given; in principle we need the sender host name and its
3285 aliases. However, for query-style lookups, we do not need the name if the
3286 query does not contain $sender_host_name. From release 4.23, a reference to
3287 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3288 on spec. */
3289
3290 if ((semicolon = Ustrchr(ss, ';')) != NULL)
3291 {
3292 const uschar *affix;
3293 int partial, affixlen, starflags, id;
3294
3295 *semicolon = 0;
3296 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
3297 *semicolon=';';
3298
3299 if (id < 0) /* Unknown lookup type */
3300 {
3301 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3302 search_error_message, ss);
3303 return DEFER;
3304 }
3305 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3306 }
3307
3308 if (isquery)
3309 {
3310 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3311 {
3312 case OK: return OK;
3313 case DEFER: return DEFER;
3314 default: return FAIL;
3315 }
3316 }
3317
3318 /* Not a query-style lookup; must ensure the host name is present, and then we
3319 do a check on the name and all its aliases. */
3320
3321 if (sender_host_name == NULL)
3322 {
3323 HDEBUG(D_host_lookup)
3324 debug_printf("sender host name required, to match against %s\n", ss);
3325 if (host_lookup_failed || host_name_lookup() != OK)
3326 {
3327 *error = string_sprintf("failed to find host name for %s",
3328 sender_host_address);;
3329 return ERROR;
3330 }
3331 host_build_sender_fullhost();
3332 }
3333
3334 /* Match on the sender host name, using the general matching function */
3335
3336 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
3337 valueptr))
3338 {
3339 case OK: return OK;
3340 case DEFER: return DEFER;
3341 }
3342
3343 /* If there are aliases, try matching on them. */
3344
3345 aliases = sender_host_aliases;
3346 while (*aliases != NULL)
3347 {
3348 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3349 {
3350 case OK: return OK;
3351 case DEFER: return DEFER;
3352 }
3353 }
3354 return FAIL;
3355 }
3356
3357
3358
3359
3360 /*************************************************
3361 * Check a specific host matches a host list *
3362 *************************************************/
3363
3364 /* This function is passed a host list containing items in a number of
3365 different formats and the identity of a host. Its job is to determine whether
3366 the given host is in the set of hosts defined by the list. The host name is
3367 passed as a pointer so that it can be looked up if needed and not already
3368 known. This is commonly the case when called from verify_check_host() to check
3369 an incoming connection. When called from elsewhere the host name should usually
3370 be set.
3371
3372 This function is now just a front end to match_check_list(), which runs common
3373 code for scanning a list. We pass it the check_host() function to perform a
3374 single test.
3375
3376 Arguments:
3377 listptr pointer to the host list
3378 cache_bits pointer to cache for named lists, or NULL
3379 host_name the host name or NULL, implying use sender_host_name and
3380 sender_host_aliases, looking them up if required
3381 host_address the IP address
3382 valueptr if not NULL, data from a lookup is passed back here
3383
3384 Returns: OK if the host is in the defined set
3385 FAIL if the host is not in the defined set,
3386 DEFER if a data lookup deferred (not a host lookup)
3387
3388 If the host name was needed in order to make a comparison, and could not be
3389 determined from the IP address, the result is FAIL unless the item
3390 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3391
3392 int
3393 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3394 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3395 {
3396 int rc;
3397 unsigned int *local_cache_bits = cache_bits;
3398 const uschar *save_host_address = deliver_host_address;
3399 check_host_block cb;
3400 cb.host_name = host_name;
3401 cb.host_address = host_address;
3402
3403 if (valueptr != NULL) *valueptr = NULL;
3404
3405 /* If the host address starts off ::ffff: it is an IPv6 address in
3406 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3407 addresses. */
3408
3409 cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
3410 host_address + 7 : host_address;
3411
3412 /* During the running of the check, put the IP address into $host_address. In
3413 the case of calls from the smtp transport, it will already be there. However,
3414 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3415 the safe side, any existing setting is preserved, though as I write this
3416 (November 2004) I can't see any cases where it is actually needed. */
3417
3418 deliver_host_address = host_address;
3419 rc = match_check_list(
3420 listptr, /* the list */
3421 0, /* separator character */
3422 &hostlist_anchor, /* anchor pointer */
3423 &local_cache_bits, /* cache pointer */
3424 check_host, /* function for testing */
3425 &cb, /* argument for function */
3426 MCL_HOST, /* type of check */
3427 (host_address == sender_host_address)?
3428 US"host" : host_address, /* text for debugging */
3429 valueptr); /* where to pass back data */
3430 deliver_host_address = save_host_address;
3431 return rc;
3432 }
3433
3434
3435
3436
3437 /*************************************************
3438 * Check the given host item matches a list *
3439 *************************************************/
3440 int
3441 verify_check_given_host(uschar **listptr, host_item *host)
3442 {
3443 return verify_check_this_host(CUSS listptr, NULL, host->name, host->address, NULL);
3444 }
3445
3446 /*************************************************