Copyright updates:
[exim.git] / src / src / verify.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
8
9 /* Functions concerned with verifying things. The original code for callout
10 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
11
12
13 #include "exim.h"
14 #include "transports/smtp.h"
15
16 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
17 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
18 static smtp_context ctctx;
19 uschar ctbuffer[8192];
20
21
22 /* Structure for caching DNSBL lookups */
23
24 typedef struct dnsbl_cache_block {
25 time_t expiry;
26 dns_address *rhs;
27 uschar *text;
28 int rc;
29 BOOL text_set;
30 } dnsbl_cache_block;
31
32
33 /* Anchor for DNSBL cache */
34
35 static tree_node *dnsbl_cache = NULL;
36
37
38 /* Bits for match_type in one_check_dnsbl() */
39
40 #define MT_NOT 1
41 #define MT_ALL 2
42
43 static uschar cutthrough_response(client_conn_ctx *, char, uschar **, int);
44
45
46
47 /*************************************************
48 * Retrieve a callout cache record *
49 *************************************************/
50
51 /* If a record exists, check whether it has expired.
52
53 Arguments:
54 dbm_file an open hints file
55 key the record key
56 type "address" or "domain"
57 positive_expire expire time for positive records
58 negative_expire expire time for negative records
59
60 Returns: the cache record if a non-expired one exists, else NULL
61 */
62
63 static dbdata_callout_cache *
64 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
65 int positive_expire, int negative_expire)
66 {
67 BOOL negative;
68 int length, expire;
69 time_t now;
70 dbdata_callout_cache *cache_record;
71
72 if (!(cache_record = dbfn_read_with_length(dbm_file, key, &length)))
73 {
74 HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
75 return NULL;
76 }
77
78 /* We treat a record as "negative" if its result field is not positive, or if
79 it is a domain record and the postmaster field is negative. */
80
81 negative = cache_record->result != ccache_accept ||
82 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
83 expire = negative? negative_expire : positive_expire;
84 now = time(NULL);
85
86 if (now - cache_record->time_stamp > expire)
87 {
88 HDEBUG(D_verify) debug_printf("callout cache: %s record expired for %s\n", type, key);
89 return NULL;
90 }
91
92 /* If this is a non-reject domain record, check for the obsolete format version
93 that doesn't have the postmaster and random timestamps, by looking at the
94 length. If so, copy it to a new-style block, replicating the record's
95 timestamp. Then check the additional timestamps. (There's no point wasting
96 effort if connections are rejected.) */
97
98 if (type[0] == 'd' && cache_record->result != ccache_reject)
99 {
100 if (length == sizeof(dbdata_callout_cache_obs))
101 {
102 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache), FALSE);
103 memcpy(new, cache_record, length);
104 new->postmaster_stamp = new->random_stamp = new->time_stamp;
105 cache_record = new;
106 }
107
108 if (now - cache_record->postmaster_stamp > expire)
109 cache_record->postmaster_result = ccache_unknown;
110
111 if (now - cache_record->random_stamp > expire)
112 cache_record->random_result = ccache_unknown;
113 }
114
115 HDEBUG(D_verify) debug_printf("callout cache: found %s record for %s\n", type, key);
116 return cache_record;
117 }
118
119
120
121 /* Check the callout cache.
122 Options * pm_mailfrom may be modified by cache partial results.
123
124 Return: TRUE if result found
125 */
126
127 static BOOL
128 cached_callout_lookup(address_item * addr, uschar * address_key,
129 uschar * from_address, int * opt_ptr, uschar ** pm_ptr,
130 int * yield, uschar ** failure_ptr,
131 dbdata_callout_cache * new_domain_record, int * old_domain_res)
132 {
133 int options = *opt_ptr;
134 open_db dbblock;
135 open_db *dbm_file = NULL;
136
137 /* Open the callout cache database, it it exists, for reading only at this
138 stage, unless caching has been disabled. */
139
140 if (options & vopt_callout_no_cache)
141 {
142 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
143 }
144 else if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
145 {
146 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
147 }
148 else
149 {
150 /* If a cache database is available see if we can avoid the need to do an
151 actual callout by making use of previously-obtained data. */
152
153 dbdata_callout_cache_address * cache_address_record;
154 dbdata_callout_cache * cache_record = get_callout_cache_record(dbm_file,
155 addr->domain, US"domain",
156 callout_cache_domain_positive_expire, callout_cache_domain_negative_expire);
157
158 /* If an unexpired cache record was found for this domain, see if the callout
159 process can be short-circuited. */
160
161 if (cache_record)
162 {
163 /* In most cases, if an early command (up to and including MAIL FROM:<>)
164 was rejected, there is no point carrying on. The callout fails. However, if
165 we are doing a recipient verification with use_sender or use_postmaster
166 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
167 will be using a non-empty sender. We have to remember this situation so as
168 not to disturb the cached domain value if this whole verification succeeds
169 (we don't want it turning into "accept"). */
170
171 *old_domain_res = cache_record->result;
172
173 if ( cache_record->result == ccache_reject
174 || *from_address == 0 && cache_record->result == ccache_reject_mfnull)
175 {
176 HDEBUG(D_verify)
177 debug_printf("callout cache: domain gave initial rejection, or "
178 "does not accept HELO or MAIL FROM:<>\n");
179 setflag(addr, af_verify_nsfail);
180 addr->user_message = US"(result of an earlier callout reused).";
181 *yield = FAIL;
182 *failure_ptr = US"mail";
183 dbfn_close(dbm_file);
184 return TRUE;
185 }
186
187 /* If a previous check on a "random" local part was accepted, we assume
188 that the server does not do any checking on local parts. There is therefore
189 no point in doing the callout, because it will always be successful. If a
190 random check previously failed, arrange not to do it again, but preserve
191 the data in the new record. If a random check is required but hasn't been
192 done, skip the remaining cache processing. */
193
194 if (options & vopt_callout_random) switch(cache_record->random_result)
195 {
196 case ccache_accept:
197 HDEBUG(D_verify)
198 debug_printf("callout cache: domain accepts random addresses\n");
199 *failure_ptr = US"random";
200 dbfn_close(dbm_file);
201 return TRUE; /* Default yield is OK */
202
203 case ccache_reject:
204 HDEBUG(D_verify)
205 debug_printf("callout cache: domain rejects random addresses\n");
206 *opt_ptr = options & ~vopt_callout_random;
207 new_domain_record->random_result = ccache_reject;
208 new_domain_record->random_stamp = cache_record->random_stamp;
209 break;
210
211 default:
212 HDEBUG(D_verify)
213 debug_printf("callout cache: need to check random address handling "
214 "(not cached or cache expired)\n");
215 dbfn_close(dbm_file);
216 return FALSE;
217 }
218
219 /* If a postmaster check is requested, but there was a previous failure,
220 there is again no point in carrying on. If a postmaster check is required,
221 but has not been done before, we are going to have to do a callout, so skip
222 remaining cache processing. */
223
224 if (*pm_ptr)
225 {
226 if (cache_record->postmaster_result == ccache_reject)
227 {
228 setflag(addr, af_verify_pmfail);
229 HDEBUG(D_verify)
230 debug_printf("callout cache: domain does not accept "
231 "RCPT TO:<postmaster@domain>\n");
232 *yield = FAIL;
233 *failure_ptr = US"postmaster";
234 setflag(addr, af_verify_pmfail);
235 addr->user_message = US"(result of earlier verification reused).";
236 dbfn_close(dbm_file);
237 return TRUE;
238 }
239 if (cache_record->postmaster_result == ccache_unknown)
240 {
241 HDEBUG(D_verify)
242 debug_printf("callout cache: need to check RCPT "
243 "TO:<postmaster@domain> (not cached or cache expired)\n");
244 dbfn_close(dbm_file);
245 return FALSE;
246 }
247
248 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
249 postmaster check if the address itself has to be checked. Also ensure
250 that the value in the cache record is preserved (with its old timestamp).
251 */
252
253 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
254 "TO:<postmaster@domain>\n");
255 *pm_ptr = NULL;
256 new_domain_record->postmaster_result = ccache_accept;
257 new_domain_record->postmaster_stamp = cache_record->postmaster_stamp;
258 }
259 }
260
261 /* We can't give a result based on information about the domain. See if there
262 is an unexpired cache record for this specific address (combined with the
263 sender address if we are doing a recipient callout with a non-empty sender).
264 */
265
266 if (!(cache_address_record = (dbdata_callout_cache_address *)
267 get_callout_cache_record(dbm_file, address_key, US"address",
268 callout_cache_positive_expire, callout_cache_negative_expire)))
269 {
270 dbfn_close(dbm_file);
271 return FALSE;
272 }
273
274 if (cache_address_record->result == ccache_accept)
275 {
276 HDEBUG(D_verify)
277 debug_printf("callout cache: address record is positive\n");
278 }
279 else
280 {
281 HDEBUG(D_verify)
282 debug_printf("callout cache: address record is negative\n");
283 addr->user_message = US"Previous (cached) callout verification failure";
284 *failure_ptr = US"recipient";
285 *yield = FAIL;
286 }
287
288 /* Close the cache database while we actually do the callout for real. */
289
290 dbfn_close(dbm_file);
291 return TRUE;
292 }
293 return FALSE;
294 }
295
296
297 /* Write results to callout cache
298 */
299 static void
300 cache_callout_write(dbdata_callout_cache * dom_rec, const uschar * domain,
301 int done, dbdata_callout_cache_address * addr_rec, uschar * address_key)
302 {
303 open_db dbblock;
304 open_db *dbm_file = NULL;
305
306 /* If we get here with done == TRUE, a successful callout happened, and yield
307 will be set OK or FAIL according to the response to the RCPT command.
308 Otherwise, we looped through the hosts but couldn't complete the business.
309 However, there may be domain-specific information to cache in both cases.
310
311 The value of the result field in the new_domain record is ccache_unknown if
312 there was an error before or with MAIL FROM:, and errno was not zero,
313 implying some kind of I/O error. We don't want to write the cache in that case.
314 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
315
316 if (dom_rec->result != ccache_unknown)
317 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
318 {
319 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
320 }
321 else
322 {
323 (void)dbfn_write(dbm_file, domain, dom_rec,
324 (int)sizeof(dbdata_callout_cache));
325 HDEBUG(D_verify) debug_printf("wrote callout cache domain record for %s:\n"
326 " result=%d postmaster=%d random=%d\n",
327 domain,
328 dom_rec->result,
329 dom_rec->postmaster_result,
330 dom_rec->random_result);
331 }
332
333 /* If a definite result was obtained for the callout, cache it unless caching
334 is disabled. */
335
336 if (done && addr_rec->result != ccache_unknown)
337 {
338 if (!dbm_file)
339 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE);
340 if (!dbm_file)
341 {
342 HDEBUG(D_verify) debug_printf("no callout cache available\n");
343 }
344 else
345 {
346 (void)dbfn_write(dbm_file, address_key, addr_rec,
347 (int)sizeof(dbdata_callout_cache_address));
348 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record for %s\n",
349 addr_rec->result == ccache_accept ? "positive" : "negative",
350 address_key);
351 }
352 }
353
354 if (dbm_file) dbfn_close(dbm_file);
355 }
356
357
358 /* Cutthrough-multi. If the existing cached cutthrough connection matches
359 the one we would make for a subsequent recipient, use it. Send the RCPT TO
360 and check the result, nonpipelined as it may be wanted immediately for
361 recipient-verification.
362
363 It seems simpler to deal with this case separately from the main callout loop.
364 We will need to remember it has sent, or not, so that rcpt-acl tail code
365 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
366
367 Return: TRUE for a definitive result for the recipient
368 */
369 static int
370 cutthrough_multi(address_item * addr, host_item * host_list,
371 transport_feedback * tf, int * yield)
372 {
373 BOOL done = FALSE;
374
375 if (addr->transport == cutthrough.addr.transport)
376 for (host_item * host = host_list; host; host = host->next)
377 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
378 {
379 int host_af;
380 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
381 int port = 25;
382
383 deliver_host = host->name;
384 deliver_host_address = host->address;
385 deliver_host_port = host->port;
386 deliver_domain = addr->domain;
387 transport_name = addr->transport->name;
388
389 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
390
391 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
392 US"callout")
393 || !smtp_get_port(tf->port, addr, &port, US"callout")
394 )
395 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
396 addr->message);
397
398 smtp_port_for_connect(host, port);
399
400 if ( ( interface == cutthrough.interface
401 || ( interface
402 && cutthrough.interface
403 && Ustrcmp(interface, cutthrough.interface) == 0
404 ) )
405 && host->port == cutthrough.host.port
406 )
407 {
408 uschar * resp = NULL;
409
410 /* Match! Send the RCPT TO, set done from the response */
411 done =
412 smtp_write_command(&ctctx, SCMD_FLUSH, "RCPT TO:<%.1000s>\r\n",
413 transport_rcpt_address(addr,
414 addr->transport->rcpt_include_affixes)) >= 0
415 && cutthrough_response(&cutthrough.cctx, '2', &resp,
416 CUTTHROUGH_DATA_TIMEOUT) == '2';
417
418 /* This would go horribly wrong if a callout fail was ignored by ACL.
419 We punt by abandoning cutthrough on a reject, like the
420 first-rcpt does. */
421
422 if (done)
423 {
424 address_item * na = store_get(sizeof(address_item), FALSE);
425 *na = cutthrough.addr;
426 cutthrough.addr = *addr;
427 cutthrough.addr.host_used = &cutthrough.host;
428 cutthrough.addr.next = na;
429
430 cutthrough.nrcpt++;
431 }
432 else
433 {
434 cancel_cutthrough_connection(TRUE, US"recipient rejected");
435 if (!resp || errno == ETIMEDOUT)
436 {
437 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
438 }
439 else if (errno == 0)
440 {
441 if (*resp == 0)
442 Ustrcpy(resp, US"connection dropped");
443
444 addr->message =
445 string_sprintf("response to \"%s\" was: %s",
446 big_buffer, string_printing(resp));
447
448 addr->user_message =
449 string_sprintf("Callout verification failed:\n%s", resp);
450
451 /* Hard rejection ends the process */
452
453 if (resp[0] == '5') /* Address rejected */
454 {
455 *yield = FAIL;
456 done = TRUE;
457 }
458 }
459 }
460 }
461 break; /* host_list */
462 }
463 if (!done)
464 cancel_cutthrough_connection(TRUE, US"incompatible connection");
465 return done;
466 }
467
468
469 /*************************************************
470 * Do callout verification for an address *
471 *************************************************/
472
473 /* This function is called from verify_address() when the address has routed to
474 a host list, and a callout has been requested. Callouts are expensive; that is
475 why a cache is used to improve the efficiency.
476
477 Arguments:
478 addr the address that's been routed
479 host_list the list of hosts to try
480 tf the transport feedback block
481
482 ifstring "interface" option from transport, or NULL
483 portstring "port" option from transport, or NULL
484 protocolstring "protocol" option from transport, or NULL
485 callout the per-command callout timeout
486 callout_overall the overall callout timeout (if < 0 use 4*callout)
487 callout_connect the callout connection timeout (if < 0 use callout)
488 options the verification options - these bits are used:
489 vopt_is_recipient => this is a recipient address
490 vopt_callout_no_cache => don't use callout cache
491 vopt_callout_fullpm => if postmaster check, do full one
492 vopt_callout_random => do the "random" thing
493 vopt_callout_recipsender => use real sender for recipient
494 vopt_callout_recippmaster => use postmaster for recipient
495 vopt_callout_hold => lazy close connection
496 se_mailfrom MAIL FROM address for sender verify; NULL => ""
497 pm_mailfrom if non-NULL, do the postmaster check with this sender
498
499 Returns: OK/FAIL/DEFER
500 */
501
502 static int
503 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
504 int callout, int callout_overall, int callout_connect, int options,
505 uschar *se_mailfrom, uschar *pm_mailfrom)
506 {
507 int yield = OK;
508 int old_domain_cache_result = ccache_accept;
509 BOOL done = FALSE;
510 uschar *address_key;
511 uschar *from_address;
512 uschar *random_local_part = NULL;
513 const uschar *save_deliver_domain = deliver_domain;
514 uschar **failure_ptr = options & vopt_is_recipient
515 ? &recipient_verify_failure : &sender_verify_failure;
516 dbdata_callout_cache new_domain_record;
517 dbdata_callout_cache_address new_address_record;
518 time_t callout_start_time;
519
520 new_domain_record.result = ccache_unknown;
521 new_domain_record.postmaster_result = ccache_unknown;
522 new_domain_record.random_result = ccache_unknown;
523
524 memset(&new_address_record, 0, sizeof(new_address_record));
525
526 /* For a recipient callout, the key used for the address cache record must
527 include the sender address if we are using the real sender in the callout,
528 because that may influence the result of the callout. */
529
530 if (options & vopt_is_recipient)
531 if (options & vopt_callout_recipsender)
532 {
533 from_address = sender_address;
534 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
535 if (cutthrough.delivery) options |= vopt_callout_no_cache;
536 }
537 else if (options & vopt_callout_recippmaster)
538 {
539 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
540 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
541 qualify_domain_sender);
542 }
543 else
544 {
545 from_address = US"";
546 address_key = addr->address;
547 }
548
549 /* For a sender callout, we must adjust the key if the mailfrom address is not
550 empty. */
551
552 else
553 {
554 from_address = se_mailfrom ? se_mailfrom : US"";
555 address_key = *from_address
556 ? string_sprintf("%s/<%s>", addr->address, from_address) : addr->address;
557 }
558
559 if (cached_callout_lookup(addr, address_key, from_address,
560 &options, &pm_mailfrom, &yield, failure_ptr,
561 &new_domain_record, &old_domain_cache_result))
562 {
563 cancel_cutthrough_connection(TRUE, US"cache-hit");
564 goto END_CALLOUT;
565 }
566
567 if (!addr->transport)
568 {
569 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
570 }
571 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
572 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
573 addr->transport->name, addr->transport->driver_name);
574 else
575 {
576 smtp_transport_options_block *ob =
577 (smtp_transport_options_block *)addr->transport->options_block;
578 smtp_context * sx = NULL;
579
580 /* The information wasn't available in the cache, so we have to do a real
581 callout and save the result in the cache for next time, unless no_cache is set,
582 or unless we have a previously cached negative random result. If we are to test
583 with a random local part, ensure that such a local part is available. If not,
584 log the fact, but carry on without randomising. */
585
586 if (options & vopt_callout_random && callout_random_local_part)
587 if (!(random_local_part = expand_string(callout_random_local_part)))
588 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
589 "callout_random_local_part: %s", expand_string_message);
590
591 /* Compile regex' used by client-side smtp */
592
593 smtp_deliver_init();
594
595 /* Default the connect and overall callout timeouts if not set, and record the
596 time we are starting so that we can enforce it. */
597
598 if (callout_overall < 0) callout_overall = 4 * callout;
599 if (callout_connect < 0) callout_connect = callout;
600 callout_start_time = time(NULL);
601
602 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
603 output because a callout might take some time. When PIPELINING is active and
604 there are many recipients, the total time for doing lots of callouts can add up
605 and cause the client to time out. So in this case we forgo the PIPELINING
606 optimization. */
607
608 if (smtp_out && !f.disable_callout_flush) mac_smtp_fflush();
609
610 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
611 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
612
613 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
614 and we are holding a cutthrough conn open, we can just append the rcpt to
615 that conn for verification purposes (and later delivery also). Simplest
616 coding means skipping this whole loop and doing the append separately. */
617
618 /* Can we re-use an open cutthrough connection? */
619 if ( cutthrough.cctx.sock >= 0
620 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
621 == vopt_callout_recipsender
622 && !random_local_part
623 && !pm_mailfrom
624 )
625 done = cutthrough_multi(addr, host_list, tf, &yield);
626
627 /* If we did not use a cached connection, make connections to the hosts
628 and do real callouts. The list of hosts is passed in as an argument. */
629
630 for (host_item * host = host_list; host && !done; host = host->next)
631 {
632 int host_af;
633 int port = 25;
634 uschar * interface = NULL; /* Outgoing interface to use; NULL => any */
635
636 if (!host->address)
637 {
638 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
639 host->name);
640 continue;
641 }
642
643 /* Check the overall callout timeout */
644
645 if (time(NULL) - callout_start_time >= callout_overall)
646 {
647 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
648 break;
649 }
650
651 /* Set IPv4 or IPv6 */
652
653 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
654
655 /* Expand and interpret the interface and port strings. The latter will not
656 be used if there is a host-specific port (e.g. from a manualroute router).
657 This has to be delayed till now, because they may expand differently for
658 different hosts. If there's a failure, log it, but carry on with the
659 defaults. */
660
661 deliver_host = host->name;
662 deliver_host_address = host->address;
663 deliver_host_port = host->port;
664 deliver_domain = addr->domain;
665 transport_name = addr->transport->name;
666
667 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
668 US"callout")
669 || !smtp_get_port(tf->port, addr, &port, US"callout")
670 )
671 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
672 addr->message);
673
674 if (!sx) sx = store_get(sizeof(*sx), TRUE); /* tainted buffers */
675 memset(sx, 0, sizeof(*sx));
676
677 sx->addrlist = addr;
678 sx->conn_args.host = host;
679 sx->conn_args.host_af = host_af,
680 sx->port = port;
681 sx->conn_args.interface = interface;
682 sx->helo_data = tf->helo_data;
683 sx->conn_args.tblock = addr->transport;
684 sx->verify = TRUE;
685
686 tls_retry_connection:
687 /* Set the address state so that errors are recorded in it */
688
689 addr->transport_return = PENDING_DEFER;
690 ob->connect_timeout = callout_connect;
691 ob->command_timeout = callout;
692
693 /* Get the channel set up ready for a message (MAIL FROM being the next
694 SMTP command to send. If we tried TLS but it failed, try again without
695 if permitted */
696
697 yield = smtp_setup_conn(sx, FALSE);
698 #ifndef DISABLE_TLS
699 if ( yield == DEFER
700 && addr->basic_errno == ERRNO_TLSFAILURE
701 && ob->tls_tempfail_tryclear
702 && verify_check_given_host(CUSS &ob->hosts_require_tls, host) != OK
703 )
704 {
705 log_write(0, LOG_MAIN,
706 "%s: callout unencrypted to %s [%s] (not in hosts_require_tls)",
707 addr->message, host->name, host->address);
708 addr->transport_return = PENDING_DEFER;
709 yield = smtp_setup_conn(sx, TRUE);
710 }
711 #endif
712 if (yield != OK)
713 {
714 errno = addr->basic_errno;
715 transport_name = NULL;
716 deliver_host = deliver_host_address = NULL;
717 deliver_domain = save_deliver_domain;
718
719 /* Failure to accept HELO is cached; this blocks the whole domain for all
720 senders. I/O errors and defer responses are not cached. */
721
722 if (yield == FAIL && (errno == 0 || errno == ERRNO_SMTPCLOSED))
723 {
724 setflag(addr, af_verify_nsfail);
725 new_domain_record.result = ccache_reject;
726 done = TRUE;
727 }
728 else
729 done = FALSE;
730 goto no_conn;
731 }
732
733 /* If we needed to authenticate, smtp_setup_conn() did that. Copy
734 the AUTH info for logging */
735
736 addr->authenticator = client_authenticator;
737 addr->auth_id = client_authenticated_id;
738
739 sx->from_addr = from_address;
740 sx->first_addr = sx->sync_addr = addr;
741 sx->ok = FALSE; /*XXX these 3 last might not be needed for verify? */
742 sx->send_rset = TRUE;
743 sx->completed_addr = FALSE;
744
745 new_domain_record.result = old_domain_cache_result == ccache_reject_mfnull
746 ? ccache_reject_mfnull : ccache_accept;
747
748 /* Do the random local part check first. Temporarily replace the recipient
749 with the "random" value */
750
751 if (random_local_part)
752 {
753 uschar * main_address = addr->address;
754 const uschar * rcpt_domain = addr->domain;
755
756 #ifdef SUPPORT_I18N
757 uschar * errstr = NULL;
758 if ( testflag(addr, af_utf8_downcvt)
759 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
760 &errstr), errstr)
761 )
762 {
763 addr->message = errstr;
764 errno = ERRNO_EXPANDFAIL;
765 setflag(addr, af_verify_nsfail);
766 done = FALSE;
767 rcpt_domain = US""; /*XXX errorhandling! */
768 }
769 #endif
770
771 /* This would be ok for 1st rcpt of a cutthrough (the case handled here;
772 subsequents are done in cutthrough_multi()), but no way to
773 handle a subsequent because of the RSET vaporising the MAIL FROM.
774 So refuse to support any. Most cutthrough use will not involve
775 random_local_part, so no loss. */
776 cancel_cutthrough_connection(TRUE, US"random-recipient");
777
778 addr->address = string_sprintf("%s@%.1000s",
779 random_local_part, rcpt_domain);
780 done = FALSE;
781
782 /* If accepted, we aren't going to do any further tests below.
783 Otherwise, cache a real negative response, and get back to the right
784 state to send RCPT. Unless there's some problem such as a dropped
785 connection, we expect to succeed, because the commands succeeded above.
786 However, some servers drop the connection after responding to an
787 invalid recipient, so on (any) error we drop and remake the connection.
788 XXX We don't care about that for postmaster_full. Should we?
789
790 XXX could we add another flag to the context, and have the common
791 code emit the RSET too? Even pipelined after the RCPT...
792 Then the main-verify call could use it if there's to be a subsequent
793 postmaster-verify.
794 The sync_responses() would need to be taught about it and we'd
795 need another return code filtering out to here.
796
797 Avoid using a SIZE option on the MAIL for all random-rcpt checks.
798 */
799
800 sx->avoid_option = OPTION_SIZE;
801
802 /* Remember when we last did a random test */
803 new_domain_record.random_stamp = time(NULL);
804
805 if (smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0)
806 switch(addr->transport_return)
807 {
808 case PENDING_OK: /* random was accepted, unfortunately */
809 new_domain_record.random_result = ccache_accept;
810 yield = OK; /* Only usable verify result we can return */
811 done = TRUE;
812 *failure_ptr = US"random";
813 goto no_conn;
814 case FAIL: /* rejected: the preferred result */
815 new_domain_record.random_result = ccache_reject;
816 sx->avoid_option = 0;
817
818 /* Between each check, issue RSET, because some servers accept only
819 one recipient after MAIL FROM:<>.
820 XXX We don't care about that for postmaster_full. Should we? */
821
822 if ((done =
823 smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0 &&
824 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout)))
825 break;
826
827 HDEBUG(D_acl|D_v)
828 debug_printf_indent("problem after random/rset/mfrom; reopen conn\n");
829 random_local_part = NULL;
830 #ifndef DISABLE_TLS
831 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
832 #endif
833 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
834 (void)close(sx->cctx.sock);
835 sx->cctx.sock = -1;
836 #ifndef DISABLE_EVENT
837 (void) event_raise(addr->transport->event_action,
838 US"tcp:close", NULL);
839 #endif
840 addr->address = main_address;
841 addr->transport_return = PENDING_DEFER;
842 sx->first_addr = sx->sync_addr = addr;
843 sx->ok = FALSE;
844 sx->send_rset = TRUE;
845 sx->completed_addr = FALSE;
846 goto tls_retry_connection;
847 case DEFER: /* 4xx response to random */
848 break; /* Just to be clear. ccache_unknown, !done. */
849 }
850
851 /* Re-setup for main verify, or for the error message when failing */
852 addr->address = main_address;
853 addr->transport_return = PENDING_DEFER;
854 sx->first_addr = sx->sync_addr = addr;
855 sx->ok = FALSE;
856 sx->send_rset = TRUE;
857 sx->completed_addr = FALSE;
858 }
859 else
860 done = TRUE;
861
862 /* Main verify. For rcpt-verify use SIZE if we know it and we're not cacheing;
863 for sndr-verify never use it. */
864
865 if (done)
866 {
867 if (!(options & vopt_is_recipient && options & vopt_callout_no_cache))
868 sx->avoid_option = OPTION_SIZE;
869
870 done = FALSE;
871 switch(smtp_write_mail_and_rcpt_cmds(sx, &yield))
872 {
873 case 0: switch(addr->transport_return) /* ok so far */
874 {
875 case PENDING_OK: done = TRUE;
876 new_address_record.result = ccache_accept;
877 break;
878 case FAIL: done = TRUE;
879 yield = FAIL;
880 *failure_ptr = US"recipient";
881 new_address_record.result = ccache_reject;
882 break;
883 default: break;
884 }
885 break;
886
887 case -1: /* MAIL response error */
888 *failure_ptr = US"mail";
889 if (errno == 0 && sx->buffer[0] == '5')
890 {
891 setflag(addr, af_verify_nsfail);
892 if (from_address[0] == 0)
893 new_domain_record.result = ccache_reject_mfnull;
894 }
895 break;
896 /* non-MAIL read i/o error */
897 /* non-MAIL response timeout */
898 /* internal error; channel still usable */
899 default: break; /* transmit failed */
900 }
901 }
902
903 addr->auth_sndr = client_authenticated_sender;
904
905 deliver_host = deliver_host_address = NULL;
906 deliver_domain = save_deliver_domain;
907
908 /* Do postmaster check if requested; if a full check is required, we
909 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
910
911 if (done && pm_mailfrom)
912 {
913 /* Could possibly shift before main verify, just above, and be ok
914 for cutthrough. But no way to handle a subsequent rcpt, so just
915 refuse any */
916 cancel_cutthrough_connection(TRUE, US"postmaster verify");
917 HDEBUG(D_acl|D_v) debug_printf_indent("Cutthrough cancelled by presence of postmaster verify\n");
918
919 done = smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0
920 && smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout);
921
922 if (done)
923 {
924 uschar * main_address = addr->address;
925
926 /*XXX oops, affixes */
927 addr->address = string_sprintf("postmaster@%.1000s", addr->domain);
928 addr->transport_return = PENDING_DEFER;
929
930 sx->from_addr = pm_mailfrom;
931 sx->first_addr = sx->sync_addr = addr;
932 sx->ok = FALSE;
933 sx->send_rset = TRUE;
934 sx->completed_addr = FALSE;
935 sx->avoid_option = OPTION_SIZE;
936
937 if( smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0
938 && addr->transport_return == PENDING_OK
939 )
940 done = TRUE;
941 else
942 done = (options & vopt_callout_fullpm) != 0
943 && smtp_write_command(sx, SCMD_FLUSH,
944 "RCPT TO:<postmaster>\r\n") >= 0
945 && smtp_read_response(sx, sx->buffer,
946 sizeof(sx->buffer), '2', callout);
947
948 /* Sort out the cache record */
949
950 new_domain_record.postmaster_stamp = time(NULL);
951
952 if (done)
953 new_domain_record.postmaster_result = ccache_accept;
954 else if (errno == 0 && sx->buffer[0] == '5')
955 {
956 *failure_ptr = US"postmaster";
957 setflag(addr, af_verify_pmfail);
958 new_domain_record.postmaster_result = ccache_reject;
959 }
960
961 addr->address = main_address;
962 }
963 }
964 /* For any failure of the main check, other than a negative response, we just
965 close the connection and carry on. We can identify a negative response by the
966 fact that errno is zero. For I/O errors it will be non-zero
967
968 Set up different error texts for logging and for sending back to the caller
969 as an SMTP response. Log in all cases, using a one-line format. For sender
970 callouts, give a full response to the caller, but for recipient callouts,
971 don't give the IP address because this may be an internal host whose identity
972 is not to be widely broadcast. */
973
974 no_conn:
975 switch(errno)
976 {
977 case ETIMEDOUT:
978 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
979 sx->send_quit = FALSE;
980 break;
981
982 #ifdef SUPPORT_I18N
983 case ERRNO_UTF8_FWD:
984 {
985 extern int acl_where; /* src/acl.c */
986 errno = 0;
987 addr->message = US"response to \"EHLO\" did not include SMTPUTF8";
988 addr->user_message = acl_where == ACL_WHERE_RCPT
989 ? US"533 no support for internationalised mailbox name"
990 : US"550 mailbox unavailable";
991 yield = FAIL;
992 done = TRUE;
993 }
994 break;
995 #endif
996 case ECONNREFUSED:
997 sx->send_quit = FALSE;
998 break;
999
1000 case 0:
1001 if (*sx->buffer == 0) Ustrcpy(sx->buffer, US"connection dropped");
1002
1003 /*XXX test here is ugly; seem to have a split of responsibility for
1004 building this message. Need to rationalise. Where is it done
1005 before here, and when not?
1006 Not == 5xx resp to MAIL on main-verify
1007 */
1008 if (!addr->message) addr->message =
1009 string_sprintf("response to \"%s\" was: %s",
1010 big_buffer, string_printing(sx->buffer));
1011
1012 /* RFC 5321 section 4.2: the text portion of the response may have only
1013 HT, SP, Printable US-ASCII. Deal with awkward chars by cutting the
1014 received message off before passing it onward. Newlines are ok; they
1015 just become a multiline response (but wrapped in the error code we
1016 produce). */
1017
1018 for (uschar * s = sx->buffer;
1019 *s && s < sx->buffer + sizeof(sx->buffer);
1020 s++)
1021 {
1022 uschar c = *s;
1023 if (c != '\t' && c != '\n' && (c < ' ' || c > '~'))
1024 {
1025 if (s - sx->buffer < sizeof(sx->buffer) - 12)
1026 memcpy(s, "(truncated)", 12);
1027 else
1028 *s = '\0';
1029 break;
1030 }
1031 }
1032 addr->user_message = options & vopt_is_recipient
1033 ? string_sprintf("Callout verification failed:\n%s", sx->buffer)
1034 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1035 host->address, big_buffer, sx->buffer);
1036
1037 /* Hard rejection ends the process */
1038
1039 if (sx->buffer[0] == '5') /* Address rejected */
1040 {
1041 yield = FAIL;
1042 done = TRUE;
1043 }
1044 break;
1045 }
1046
1047 /* End the SMTP conversation and close the connection. */
1048
1049 /* Cutthrough - on a successful connect and recipient-verify with
1050 use-sender and we are 1st rcpt and have no cutthrough conn so far
1051 here is where we want to leave the conn open. Ditto for a lazy-close
1052 verify. */
1053
1054 if (cutthrough.delivery)
1055 {
1056 if (addr->transport->filter_command)
1057 {
1058 cutthrough.delivery= FALSE;
1059 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
1060 }
1061 #ifndef DISABLE_DKIM
1062 if (ob->dkim.dkim_domain)
1063 {
1064 cutthrough.delivery= FALSE;
1065 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
1066 }
1067 #endif
1068 #ifdef EXPERIMENTAL_ARC
1069 if (ob->arc_sign)
1070 {
1071 cutthrough.delivery= FALSE;
1072 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of ARC signing\n");
1073 }
1074 #endif
1075 }
1076
1077 if ( (cutthrough.delivery || options & vopt_callout_hold)
1078 && rcpt_count == 1
1079 && done
1080 && yield == OK
1081 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1082 == vopt_callout_recipsender
1083 && !random_local_part
1084 && !pm_mailfrom
1085 && cutthrough.cctx.sock < 0
1086 && !sx->lmtp
1087 )
1088 {
1089 HDEBUG(D_acl|D_v) debug_printf_indent("holding verify callout open for %s\n",
1090 cutthrough.delivery
1091 ? "cutthrough delivery" : "potential further verifies and delivery");
1092
1093 cutthrough.callout_hold_only = !cutthrough.delivery;
1094 cutthrough.is_tls = tls_out.active.sock >= 0;
1095 /* We assume no buffer in use in the outblock */
1096 cutthrough.cctx = sx->cctx;
1097 cutthrough.nrcpt = 1;
1098 cutthrough.transport = addr->transport->name;
1099 cutthrough.interface = interface;
1100 cutthrough.snd_port = sending_port;
1101 cutthrough.peer_options = smtp_peer_options;
1102 cutthrough.host = *host;
1103 {
1104 int oldpool = store_pool;
1105 store_pool = POOL_PERM;
1106 cutthrough.snd_ip = string_copy(sending_ip_address);
1107 cutthrough.host.name = string_copy(host->name);
1108 cutthrough.host.address = string_copy(host->address);
1109 store_pool = oldpool;
1110 }
1111
1112 /* Save the address_item and parent chain for later logging */
1113 cutthrough.addr = *addr;
1114 cutthrough.addr.next = NULL;
1115 cutthrough.addr.host_used = &cutthrough.host;
1116 for (address_item * caddr = &cutthrough.addr, * parent = addr->parent;
1117 parent;
1118 caddr = caddr->parent, parent = parent->parent)
1119 *(caddr->parent = store_get(sizeof(address_item), FALSE)) = *parent;
1120
1121 ctctx.outblock.buffer = ctbuffer;
1122 ctctx.outblock.buffersize = sizeof(ctbuffer);
1123 ctctx.outblock.ptr = ctbuffer;
1124 /* ctctx.outblock.cmd_count = 0; ctctx.outblock.authenticating = FALSE; */
1125 ctctx.outblock.cctx = &cutthrough.cctx;
1126 }
1127 else
1128 {
1129 /* Ensure no cutthrough on multiple verifies that were incompatible */
1130 if (options & vopt_callout_recipsender)
1131 cancel_cutthrough_connection(TRUE, US"not usable for cutthrough");
1132 if (sx->send_quit)
1133 if (smtp_write_command(sx, SCMD_FLUSH, "QUIT\r\n") != -1)
1134 /* Wait a short time for response, and discard it */
1135 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', 1);
1136
1137 if (sx->cctx.sock >= 0)
1138 {
1139 #ifndef DISABLE_TLS
1140 if (sx->cctx.tls_ctx)
1141 {
1142 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1143 sx->cctx.tls_ctx = NULL;
1144 }
1145 #endif
1146 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1147 (void)close(sx->cctx.sock);
1148 sx->cctx.sock = -1;
1149 #ifndef DISABLE_EVENT
1150 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
1151 #endif
1152 }
1153 }
1154
1155 if (!done || yield != OK)
1156 addr->message = string_sprintf("%s [%s] : %s", host->name, host->address,
1157 addr->message);
1158 } /* Loop through all hosts, while !done */
1159 }
1160
1161 /* If we get here with done == TRUE, a successful callout happened, and yield
1162 will be set OK or FAIL according to the response to the RCPT command.
1163 Otherwise, we looped through the hosts but couldn't complete the business.
1164 However, there may be domain-specific information to cache in both cases. */
1165
1166 if (!(options & vopt_callout_no_cache))
1167 cache_callout_write(&new_domain_record, addr->domain,
1168 done, &new_address_record, address_key);
1169
1170 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1171 temporary error. If there was only one host, and a response was received, leave
1172 it alone if supplying details. Otherwise, give a generic response. */
1173
1174 if (!done)
1175 {
1176 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
1177 options & vopt_is_recipient ? "recipient" : "sender");
1178 yield = DEFER;
1179
1180 addr->message = host_list->next || !addr->message
1181 ? dullmsg : string_sprintf("%s: %s", dullmsg, addr->message);
1182
1183 addr->user_message = smtp_return_error_details
1184 ? string_sprintf("%s for <%s>.\n"
1185 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1186 "they may be permanently unreachable from this server. In the latter case,\n%s",
1187 dullmsg, addr->address,
1188 options & vopt_is_recipient
1189 ? "the address will never be accepted."
1190 : "you need to change the address or create an MX record for its domain\n"
1191 "if it is supposed to be generally accessible from the Internet.\n"
1192 "Talk to your mail administrator for details.")
1193 : dullmsg;
1194
1195 /* Force a specific error code */
1196
1197 addr->basic_errno = ERRNO_CALLOUTDEFER;
1198 }
1199
1200 /* Come here from within the cache-reading code on fast-track exit. */
1201
1202 END_CALLOUT:
1203 tls_modify_variables(&tls_in); /* return variables to inbound values */
1204 return yield;
1205 }
1206
1207
1208
1209 /* Called after recipient-acl to get a cutthrough connection open when
1210 one was requested and a recipient-verify wasn't subsequently done.
1211 */
1212 int
1213 open_cutthrough_connection(address_item * addr)
1214 {
1215 address_item addr2;
1216 int rc;
1217
1218 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1219 /* We must use a copy of the address for verification, because it might
1220 get rewritten. */
1221
1222 addr2 = *addr;
1223 HDEBUG(D_acl) debug_printf_indent("----------- %s cutthrough setup ------------\n",
1224 rcpt_count > 1 ? "more" : "start");
1225 rc = verify_address(&addr2, NULL,
1226 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1227 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1228 NULL, NULL, NULL);
1229 addr->message = addr2.message;
1230 addr->user_message = addr2.user_message;
1231 HDEBUG(D_acl) debug_printf_indent("----------- end cutthrough setup ------------\n");
1232 return rc;
1233 }
1234
1235
1236
1237 /* Send given number of bytes from the buffer */
1238 static BOOL
1239 cutthrough_send(int n)
1240 {
1241 if(cutthrough.cctx.sock < 0)
1242 return TRUE;
1243
1244 if(
1245 #ifndef DISABLE_TLS
1246 cutthrough.is_tls
1247 ? tls_write(cutthrough.cctx.tls_ctx, ctctx.outblock.buffer, n, FALSE)
1248 :
1249 #endif
1250 send(cutthrough.cctx.sock, ctctx.outblock.buffer, n, 0) > 0
1251 )
1252 {
1253 transport_count += n;
1254 ctctx.outblock.ptr= ctctx.outblock.buffer;
1255 return TRUE;
1256 }
1257
1258 HDEBUG(D_transport|D_acl) debug_printf_indent("cutthrough_send failed: %s\n", strerror(errno));
1259 return FALSE;
1260 }
1261
1262
1263
1264 static BOOL
1265 _cutthrough_puts(uschar * cp, int n)
1266 {
1267 while(n--)
1268 {
1269 if(ctctx.outblock.ptr >= ctctx.outblock.buffer+ctctx.outblock.buffersize)
1270 if(!cutthrough_send(ctctx.outblock.buffersize))
1271 return FALSE;
1272
1273 *ctctx.outblock.ptr++ = *cp++;
1274 }
1275 return TRUE;
1276 }
1277
1278 /* Buffered output of counted data block. Return boolean success */
1279 static BOOL
1280 cutthrough_puts(uschar * cp, int n)
1281 {
1282 if (cutthrough.cctx.sock < 0) return TRUE;
1283 if (_cutthrough_puts(cp, n)) return TRUE;
1284 cancel_cutthrough_connection(TRUE, US"transmit failed");
1285 return FALSE;
1286 }
1287
1288 void
1289 cutthrough_data_puts(uschar * cp, int n)
1290 {
1291 if (cutthrough.delivery) (void) cutthrough_puts(cp, n);
1292 return;
1293 }
1294
1295
1296 static BOOL
1297 _cutthrough_flush_send(void)
1298 {
1299 int n = ctctx.outblock.ptr - ctctx.outblock.buffer;
1300
1301 if(n>0)
1302 if(!cutthrough_send(n))
1303 return FALSE;
1304 return TRUE;
1305 }
1306
1307
1308 /* Send out any bufferred output. Return boolean success. */
1309 BOOL
1310 cutthrough_flush_send(void)
1311 {
1312 if (_cutthrough_flush_send()) return TRUE;
1313 cancel_cutthrough_connection(TRUE, US"transmit failed");
1314 return FALSE;
1315 }
1316
1317
1318 static BOOL
1319 cutthrough_put_nl(void)
1320 {
1321 return cutthrough_puts(US"\r\n", 2);
1322 }
1323
1324
1325 void
1326 cutthrough_data_put_nl(void)
1327 {
1328 cutthrough_data_puts(US"\r\n", 2);
1329 }
1330
1331
1332 /* Get and check response from cutthrough target */
1333 static uschar
1334 cutthrough_response(client_conn_ctx * cctx, char expect, uschar ** copy, int timeout)
1335 {
1336 smtp_context sx = {0};
1337 uschar inbuffer[4096];
1338 uschar responsebuffer[4096];
1339
1340 sx.inblock.buffer = inbuffer;
1341 sx.inblock.buffersize = sizeof(inbuffer);
1342 sx.inblock.ptr = inbuffer;
1343 sx.inblock.ptrend = inbuffer;
1344 sx.inblock.cctx = cctx;
1345 if(!smtp_read_response(&sx, responsebuffer, sizeof(responsebuffer), expect, timeout))
1346 cancel_cutthrough_connection(TRUE, US"target timeout on read");
1347
1348 if(copy)
1349 {
1350 uschar * cp;
1351 *copy = cp = string_copy(responsebuffer);
1352 /* Trim the trailing end of line */
1353 cp += Ustrlen(responsebuffer);
1354 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1355 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1356 }
1357
1358 return responsebuffer[0];
1359 }
1360
1361
1362 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1363 BOOL
1364 cutthrough_predata(void)
1365 {
1366 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1367 return FALSE;
1368
1369 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> DATA\n");
1370 cutthrough_puts(US"DATA\r\n", 6);
1371 cutthrough_flush_send();
1372
1373 /* Assume nothing buffered. If it was it gets ignored. */
1374 return cutthrough_response(&cutthrough.cctx, '3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
1375 }
1376
1377
1378 /* tctx arg only to match write_chunk() */
1379 static BOOL
1380 cutthrough_write_chunk(transport_ctx * tctx, uschar * s, int len)
1381 {
1382 uschar * s2;
1383 while(s && (s2 = Ustrchr(s, '\n')))
1384 {
1385 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1386 return FALSE;
1387 s = s2+1;
1388 }
1389 return TRUE;
1390 }
1391
1392
1393 /* Buffered send of headers. Return success boolean. */
1394 /* Expands newlines to wire format (CR,NL). */
1395 /* Also sends header-terminating blank line. */
1396 BOOL
1397 cutthrough_headers_send(void)
1398 {
1399 transport_ctx tctx;
1400
1401 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1402 return FALSE;
1403
1404 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1405 but having a separate buffered-output function (for now)
1406 */
1407 HDEBUG(D_acl) debug_printf_indent("----------- start cutthrough headers send -----------\n");
1408
1409 tctx.u.fd = cutthrough.cctx.sock;
1410 tctx.tblock = cutthrough.addr.transport;
1411 tctx.addr = &cutthrough.addr;
1412 tctx.check_string = US".";
1413 tctx.escape_string = US"..";
1414 /*XXX check under spool_files_wireformat. Might be irrelevant */
1415 tctx.options = topt_use_crlf;
1416
1417 if (!transport_headers_send(&tctx, &cutthrough_write_chunk))
1418 return FALSE;
1419
1420 HDEBUG(D_acl) debug_printf_indent("----------- done cutthrough headers send ------------\n");
1421 return TRUE;
1422 }
1423
1424
1425 static void
1426 close_cutthrough_connection(const uschar * why)
1427 {
1428 int fd = cutthrough.cctx.sock;
1429 if(fd >= 0)
1430 {
1431 /* We could be sending this after a bunch of data, but that is ok as
1432 the only way to cancel the transfer in dataphase is to drop the tcp
1433 conn before the final dot.
1434 */
1435 client_conn_ctx tmp_ctx = cutthrough.cctx;
1436 ctctx.outblock.ptr = ctbuffer;
1437 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> QUIT\n");
1438 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1439 _cutthrough_flush_send();
1440 cutthrough.cctx.sock = -1; /* avoid recursion via read timeout */
1441 cutthrough.nrcpt = 0; /* permit re-cutthrough on subsequent message */
1442
1443 /* Wait a short time for response, and discard it */
1444 cutthrough_response(&tmp_ctx, '2', NULL, 1);
1445
1446 #ifndef DISABLE_TLS
1447 if (cutthrough.is_tls)
1448 {
1449 tls_close(cutthrough.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1450 cutthrough.cctx.tls_ctx = NULL;
1451 cutthrough.is_tls = FALSE;
1452 }
1453 #endif
1454 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1455 (void)close(fd);
1456 HDEBUG(D_acl) debug_printf_indent("----------- cutthrough shutdown (%s) ------------\n", why);
1457 }
1458 ctctx.outblock.ptr = ctbuffer;
1459 }
1460
1461 void
1462 cancel_cutthrough_connection(BOOL close_noncutthrough_verifies, const uschar * why)
1463 {
1464 if (cutthrough.delivery || close_noncutthrough_verifies)
1465 close_cutthrough_connection(why);
1466 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1467 }
1468
1469
1470 void
1471 release_cutthrough_connection(const uschar * why)
1472 {
1473 if (cutthrough.cctx.sock < 0) return;
1474 HDEBUG(D_acl) debug_printf_indent("release cutthrough conn: %s\n", why);
1475 cutthrough.cctx.sock = -1;
1476 cutthrough.cctx.tls_ctx = NULL;
1477 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1478 }
1479
1480
1481
1482
1483 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1484 Log an OK response as a transmission.
1485 Close the connection.
1486 Return smtp response-class digit.
1487 */
1488 uschar *
1489 cutthrough_finaldot(void)
1490 {
1491 uschar res;
1492 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> .\n");
1493
1494 /* Assume data finshed with new-line */
1495 if( !cutthrough_puts(US".", 1)
1496 || !cutthrough_put_nl()
1497 || !cutthrough_flush_send()
1498 )
1499 return cutthrough.addr.message;
1500
1501 res = cutthrough_response(&cutthrough.cctx, '2', &cutthrough.addr.message,
1502 CUTTHROUGH_DATA_TIMEOUT);
1503 for (address_item * addr = &cutthrough.addr; addr; addr = addr->next)
1504 {
1505 addr->message = cutthrough.addr.message;
1506 switch(res)
1507 {
1508 case '2':
1509 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1510 close_cutthrough_connection(US"delivered");
1511 break;
1512
1513 case '4':
1514 delivery_log(LOG_MAIN, addr, 0,
1515 US"tmp-reject from cutthrough after DATA:");
1516 break;
1517
1518 case '5':
1519 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1520 US"rejected after DATA:");
1521 break;
1522
1523 default:
1524 break;
1525 }
1526 }
1527 return cutthrough.addr.message;
1528 }
1529
1530
1531
1532 /*************************************************
1533 * Copy error to toplevel address *
1534 *************************************************/
1535
1536 /* This function is used when a verify fails or defers, to ensure that the
1537 failure or defer information is in the original toplevel address. This applies
1538 when an address is redirected to a single new address, and the failure or
1539 deferral happens to the child address.
1540
1541 Arguments:
1542 vaddr the verify address item
1543 addr the final address item
1544 yield FAIL or DEFER
1545
1546 Returns: the value of YIELD
1547 */
1548
1549 static int
1550 copy_error(address_item *vaddr, address_item *addr, int yield)
1551 {
1552 if (addr != vaddr)
1553 {
1554 vaddr->message = addr->message;
1555 vaddr->user_message = addr->user_message;
1556 vaddr->basic_errno = addr->basic_errno;
1557 vaddr->more_errno = addr->more_errno;
1558 vaddr->prop.address_data = addr->prop.address_data;
1559 vaddr->prop.variables = NULL;
1560 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
1561 copyflag(vaddr, addr, af_pass_message);
1562 }
1563 return yield;
1564 }
1565
1566
1567
1568
1569 /**************************************************
1570 * printf that automatically handles TLS if needed *
1571 ***************************************************/
1572
1573 /* This function is used by verify_address() as a substitute for all fprintf()
1574 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1575 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1576 that assumes that we always use the smtp_out FILE* when not using TLS or the
1577 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1578 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1579 fprintf().
1580
1581 Arguments:
1582 f the candidate FILE* to write to
1583 format format string
1584 ... optional arguments
1585
1586 Returns:
1587 nothing
1588 */
1589
1590 static void PRINTF_FUNCTION(2,3)
1591 respond_printf(FILE *f, const char *format, ...)
1592 {
1593 va_list ap;
1594
1595 va_start(ap, format);
1596 if (smtp_out && (f == smtp_out))
1597 smtp_vprintf(format, FALSE, ap);
1598 else
1599 vfprintf(f, format, ap);
1600 va_end(ap);
1601 }
1602
1603
1604
1605 /*************************************************
1606 * Verify an email address *
1607 *************************************************/
1608
1609 /* This function is used both for verification (-bv and at other times) and
1610 address testing (-bt), which is indicated by address_test_mode being set.
1611
1612 Arguments:
1613 vaddr contains the address to verify; the next field in this block
1614 must be NULL
1615 f if not NULL, write the result to this file
1616 options various option bits:
1617 vopt_fake_sender => this sender verify is not for the real
1618 sender (it was verify=sender=xxxx or an address from a
1619 header line) - rewriting must not change sender_address
1620 vopt_is_recipient => this is a recipient address, otherwise
1621 it's a sender address - this affects qualification and
1622 rewriting and messages from callouts
1623 vopt_qualify => qualify an unqualified address; else error
1624 vopt_expn => called from SMTP EXPN command
1625 vopt_success_on_redirect => when a new address is generated
1626 the verification instantly succeeds
1627
1628 These ones are used by do_callout() -- the options variable
1629 is passed to it.
1630
1631 vopt_callout_fullpm => if postmaster check, do full one
1632 vopt_callout_no_cache => don't use callout cache
1633 vopt_callout_random => do the "random" thing
1634 vopt_callout_recipsender => use real sender for recipient
1635 vopt_callout_recippmaster => use postmaster for recipient
1636
1637 callout if > 0, specifies that callout is required, and gives timeout
1638 for individual commands
1639 callout_overall if > 0, gives overall timeout for the callout function;
1640 if < 0, a default is used (see do_callout())
1641 callout_connect the connection timeout for callouts
1642 se_mailfrom when callout is requested to verify a sender, use this
1643 in MAIL FROM; NULL => ""
1644 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1645 thing and use this as the sender address (may be "")
1646
1647 routed if not NULL, set TRUE if routing succeeded, so we can
1648 distinguish between routing failed and callout failed
1649
1650 Returns: OK address verified
1651 FAIL address failed to verify
1652 DEFER can't tell at present
1653 */
1654
1655 int
1656 verify_address(address_item * vaddr, FILE * fp, int options, int callout,
1657 int callout_overall, int callout_connect, uschar * se_mailfrom,
1658 uschar *pm_mailfrom, BOOL *routed)
1659 {
1660 BOOL allok = TRUE;
1661 BOOL full_info = fp ? debug_selector != 0 : FALSE;
1662 BOOL expn = (options & vopt_expn) != 0;
1663 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1664 int i;
1665 int yield = OK;
1666 int verify_type = expn? v_expn :
1667 f.address_test_mode? v_none :
1668 options & vopt_is_recipient? v_recipient : v_sender;
1669 address_item *addr_list;
1670 address_item *addr_new = NULL;
1671 address_item *addr_remote = NULL;
1672 address_item *addr_local = NULL;
1673 address_item *addr_succeed = NULL;
1674 uschar **failure_ptr = options & vopt_is_recipient
1675 ? &recipient_verify_failure : &sender_verify_failure;
1676 uschar *ko_prefix, *cr;
1677 uschar *address = vaddr->address;
1678 uschar *save_sender;
1679 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1680
1681 /* Clear, just in case */
1682
1683 *failure_ptr = NULL;
1684
1685 /* Set up a prefix and suffix for error message which allow us to use the same
1686 output statements both in EXPN mode (where an SMTP response is needed) and when
1687 debugging with an output file. */
1688
1689 if (expn)
1690 {
1691 ko_prefix = US"553 ";
1692 cr = US"\r";
1693 }
1694 else ko_prefix = cr = US"";
1695
1696 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1697
1698 if (parse_find_at(address) == NULL)
1699 {
1700 if (!(options & vopt_qualify))
1701 {
1702 if (fp)
1703 respond_printf(fp, "%sA domain is required for \"%s\"%s\n",
1704 ko_prefix, address, cr);
1705 *failure_ptr = US"qualify";
1706 return FAIL;
1707 }
1708 address = rewrite_address_qualify(address, options & vopt_is_recipient);
1709 }
1710
1711 DEBUG(D_verify)
1712 {
1713 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1714 debug_printf("%s %s\n", f.address_test_mode? "Testing" : "Verifying", address);
1715 }
1716
1717 /* Rewrite and report on it. Clear the domain and local part caches - these
1718 may have been set by domains and local part tests during an ACL. */
1719
1720 if (global_rewrite_rules)
1721 {
1722 uschar *old = address;
1723 address = rewrite_address(address, options & vopt_is_recipient, FALSE,
1724 global_rewrite_rules, rewrite_existflags);
1725 if (address != old)
1726 {
1727 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1728 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1729 if (fp && !expn) fprintf(fp, "Address rewritten as: %s\n", address);
1730 }
1731 }
1732
1733 /* If this is the real sender address, we must update sender_address at
1734 this point, because it may be referred to in the routers. */
1735
1736 if (!(options & (vopt_fake_sender|vopt_is_recipient)))
1737 sender_address = address;
1738
1739 /* If the address was rewritten to <> no verification can be done, and we have
1740 to return OK. This rewriting is permitted only for sender addresses; for other
1741 addresses, such rewriting fails. */
1742
1743 if (!address[0]) return OK;
1744
1745 /* Flip the legacy TLS-related variables over to the outbound set in case
1746 they're used in the context of a transport used by verification. Reset them
1747 at exit from this routine (so no returns allowed from here on). */
1748
1749 tls_modify_variables(&tls_out);
1750
1751 /* Save a copy of the sender address for re-instating if we change it to <>
1752 while verifying a sender address (a nice bit of self-reference there). */
1753
1754 save_sender = sender_address;
1755
1756 /* Observability variable for router/transport use */
1757
1758 verify_mode = options & vopt_is_recipient ? US"R" : US"S";
1759
1760 /* Update the address structure with the possibly qualified and rewritten
1761 address. Set it up as the starting address on the chain of new addresses. */
1762
1763 vaddr->address = address;
1764 addr_new = vaddr;
1765
1766 /* We need a loop, because an address can generate new addresses. We must also
1767 cope with generated pipes and files at the top level. (See also the code and
1768 comment in deliver.c.) However, it is usually the case that the router for
1769 user's .forward files has its verify flag turned off.
1770
1771 If an address generates more than one child, the loop is used only when
1772 full_info is set, and this can only be set locally. Remote enquiries just get
1773 information about the top level address, not anything that it generated. */
1774
1775 while (addr_new)
1776 {
1777 int rc;
1778 address_item *addr = addr_new;
1779
1780 addr_new = addr->next;
1781 addr->next = NULL;
1782
1783 DEBUG(D_verify)
1784 {
1785 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1786 debug_printf("Considering %s\n", addr->address);
1787 }
1788
1789 /* Handle generated pipe, file or reply addresses. We don't get these
1790 when handling EXPN, as it does only one level of expansion. */
1791
1792 if (testflag(addr, af_pfr))
1793 {
1794 allok = FALSE;
1795 if (fp)
1796 {
1797 BOOL allow;
1798
1799 if (addr->address[0] == '>')
1800 {
1801 allow = testflag(addr, af_allow_reply);
1802 fprintf(fp, "%s -> mail %s", addr->parent->address, addr->address + 1);
1803 }
1804 else
1805 {
1806 allow = addr->address[0] == '|'
1807 ? testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1808 fprintf(fp, "%s -> %s", addr->parent->address, addr->address);
1809 }
1810
1811 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1812 fprintf(fp, "\n*** Error in setting up pipe, file, or autoreply:\n"
1813 "%s\n", addr->message);
1814 else if (allow)
1815 fprintf(fp, "\n transport = %s\n", addr->transport->name);
1816 else
1817 fprintf(fp, " *** forbidden ***\n");
1818 }
1819 continue;
1820 }
1821
1822 /* Just in case some router parameter refers to it. */
1823
1824 return_path = addr->prop.errors_address
1825 ? addr->prop.errors_address : sender_address;
1826
1827 /* Split the address into domain and local part, handling the %-hack if
1828 necessary, and then route it. While routing a sender address, set
1829 $sender_address to <> because that is what it will be if we were trying to
1830 send a bounce to the sender. */
1831
1832 if (routed) *routed = FALSE;
1833 if ((rc = deliver_split_address(addr)) == OK)
1834 {
1835 if (!(options & vopt_is_recipient)) sender_address = null_sender;
1836 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1837 &addr_succeed, verify_type);
1838 sender_address = save_sender; /* Put back the real sender */
1839 }
1840
1841 /* If routing an address succeeded, set the flag that remembers, for use when
1842 an ACL cached a sender verify (in case a callout fails). Then if routing set
1843 up a list of hosts or the transport has a host list, and the callout option
1844 is set, and we aren't in a host checking run, do the callout verification,
1845 and set another flag that notes that a callout happened. */
1846
1847 if (rc == OK)
1848 {
1849 if (routed) *routed = TRUE;
1850 if (callout > 0)
1851 {
1852 transport_instance * tp;
1853 host_item * host_list = addr->host_list;
1854
1855 /* Make up some data for use in the case where there is no remote
1856 transport. */
1857
1858 transport_feedback tf = {
1859 .interface = NULL, /* interface (=> any) */
1860 .port = US"smtp",
1861 .protocol = US"smtp",
1862 .hosts = NULL,
1863 .helo_data = US"$smtp_active_hostname",
1864 .hosts_override = FALSE,
1865 .hosts_randomize = FALSE,
1866 .gethostbyname = FALSE,
1867 .qualify_single = TRUE,
1868 .search_parents = FALSE
1869 };
1870
1871 /* If verification yielded a remote transport, we want to use that
1872 transport's options, so as to mimic what would happen if we were really
1873 sending a message to this address. */
1874
1875 if ((tp = addr->transport) && !tp->info->local)
1876 {
1877 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
1878
1879 /* If the transport has hosts and the router does not, or if the
1880 transport is configured to override the router's hosts, we must build a
1881 host list of the transport's hosts, and find the IP addresses */
1882
1883 if (tf.hosts && (!host_list || tf.hosts_override))
1884 {
1885 uschar *s;
1886 const uschar *save_deliver_domain = deliver_domain;
1887 uschar *save_deliver_localpart = deliver_localpart;
1888
1889 host_list = NULL; /* Ignore the router's hosts */
1890
1891 deliver_domain = addr->domain;
1892 deliver_localpart = addr->local_part;
1893 s = expand_string(tf.hosts);
1894 deliver_domain = save_deliver_domain;
1895 deliver_localpart = save_deliver_localpart;
1896
1897 if (!s)
1898 {
1899 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1900 "\"%s\" in %s transport for callout: %s", tf.hosts,
1901 tp->name, expand_string_message);
1902 }
1903 else
1904 {
1905 int flags;
1906 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1907
1908 /* Just ignore failures to find a host address. If we don't manage
1909 to find any addresses, the callout will defer. Note that more than
1910 one address may be found for a single host, which will result in
1911 additional host items being inserted into the chain. Hence we must
1912 save the next host first. */
1913
1914 flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
1915 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1916 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1917
1918 for (host_item * host = host_list, * nexthost; host; host = nexthost)
1919 {
1920 nexthost = host->next;
1921 if (tf.gethostbyname ||
1922 string_is_ip_address(host->name, NULL) != 0)
1923 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
1924 else
1925 {
1926 const dnssec_domains * dsp = NULL;
1927 if (Ustrcmp(tp->driver_name, "smtp") == 0)
1928 {
1929 smtp_transport_options_block * ob =
1930 (smtp_transport_options_block *) tp->options_block;
1931 dsp = &ob->dnssec;
1932 }
1933
1934 (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1935 dsp, NULL, NULL);
1936 }
1937 }
1938 }
1939 }
1940 }
1941
1942 /* Can only do a callout if we have at least one host! If the callout
1943 fails, it will have set ${sender,recipient}_verify_failure. */
1944
1945 if (host_list)
1946 {
1947 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1948 if (host_checking && !f.host_checking_callout)
1949 {
1950 HDEBUG(D_verify)
1951 debug_printf("... callout omitted by default when host testing\n"
1952 "(Use -bhc if you want the callouts to happen.)\n");
1953 }
1954 else
1955 {
1956 #ifndef DISABLE_TLS
1957 deliver_set_expansions(addr);
1958 #endif
1959 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
1960 callout_connect, options, se_mailfrom, pm_mailfrom);
1961 #ifndef DISABLE_TLS
1962 deliver_set_expansions(NULL);
1963 #endif
1964 }
1965 }
1966 else
1967 {
1968 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
1969 "transport provided a host list, or transport is not smtp\n");
1970 }
1971 }
1972 }
1973
1974 /* Otherwise, any failure is a routing failure */
1975
1976 else *failure_ptr = US"route";
1977
1978 /* A router may return REROUTED if it has set up a child address as a result
1979 of a change of domain name (typically from widening). In this case we always
1980 want to continue to verify the new child. */
1981
1982 if (rc == REROUTED) continue;
1983
1984 /* Handle hard failures */
1985
1986 if (rc == FAIL)
1987 {
1988 allok = FALSE;
1989 if (fp)
1990 {
1991 address_item *p = addr->parent;
1992
1993 respond_printf(fp, "%s%s %s", ko_prefix,
1994 full_info ? addr->address : address,
1995 f.address_test_mode ? "is undeliverable" : "failed to verify");
1996 if (!expn && f.admin_user)
1997 {
1998 if (addr->basic_errno > 0)
1999 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2000 if (addr->message)
2001 respond_printf(fp, ": %s", addr->message);
2002 }
2003
2004 /* Show parents iff doing full info */
2005
2006 if (full_info) while (p)
2007 {
2008 respond_printf(fp, "%s\n <-- %s", cr, p->address);
2009 p = p->parent;
2010 }
2011 respond_printf(fp, "%s\n", cr);
2012 }
2013 cancel_cutthrough_connection(TRUE, US"routing hard fail");
2014
2015 if (!full_info)
2016 {
2017 yield = copy_error(vaddr, addr, FAIL);
2018 goto out;
2019 }
2020 yield = FAIL;
2021 }
2022
2023 /* Soft failure */
2024
2025 else if (rc == DEFER)
2026 {
2027 allok = FALSE;
2028 if (fp)
2029 {
2030 address_item *p = addr->parent;
2031 respond_printf(fp, "%s%s cannot be resolved at this time", ko_prefix,
2032 full_info? addr->address : address);
2033 if (!expn && f.admin_user)
2034 {
2035 if (addr->basic_errno > 0)
2036 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2037 if (addr->message)
2038 respond_printf(fp, ": %s", addr->message);
2039 else if (addr->basic_errno <= 0)
2040 respond_printf(fp, ": unknown error");
2041 }
2042
2043 /* Show parents iff doing full info */
2044
2045 if (full_info) while (p)
2046 {
2047 respond_printf(fp, "%s\n <-- %s", cr, p->address);
2048 p = p->parent;
2049 }
2050 respond_printf(fp, "%s\n", cr);
2051 }
2052 cancel_cutthrough_connection(TRUE, US"routing soft fail");
2053
2054 if (!full_info)
2055 {
2056 yield = copy_error(vaddr, addr, DEFER);
2057 goto out;
2058 }
2059 if (yield == OK) yield = DEFER;
2060 }
2061
2062 /* If we are handling EXPN, we do not want to continue to route beyond
2063 the top level (whose address is in "address"). */
2064
2065 else if (expn)
2066 {
2067 uschar *ok_prefix = US"250-";
2068
2069 if (!addr_new)
2070 if (!addr_local && !addr_remote)
2071 respond_printf(fp, "250 mail to <%s> is discarded\r\n", address);
2072 else
2073 respond_printf(fp, "250 <%s>\r\n", address);
2074
2075 else do
2076 {
2077 address_item *addr2 = addr_new;
2078 addr_new = addr2->next;
2079 if (!addr_new) ok_prefix = US"250 ";
2080 respond_printf(fp, "%s<%s>\r\n", ok_prefix, addr2->address);
2081 } while (addr_new);
2082 yield = OK;
2083 goto out;
2084 }
2085
2086 /* Successful routing other than EXPN. */
2087
2088 else
2089 {
2090 /* Handle successful routing when short info wanted. Otherwise continue for
2091 other (generated) addresses. Short info is the operational case. Full info
2092 can be requested only when debug_selector != 0 and a file is supplied.
2093
2094 There is a conflict between the use of aliasing as an alternate email
2095 address, and as a sort of mailing list. If an alias turns the incoming
2096 address into just one address (e.g. J.Caesar->jc44) you may well want to
2097 carry on verifying the generated address to ensure it is valid when
2098 checking incoming mail. If aliasing generates multiple addresses, you
2099 probably don't want to do this. Exim therefore treats the generation of
2100 just a single new address as a special case, and continues on to verify the
2101 generated address. */
2102
2103 if ( !full_info /* Stop if short info wanted AND */
2104 && ( ( !addr_new /* No new address OR */
2105 || addr_new->next /* More than one new address OR */
2106 || testflag(addr_new, af_pfr) /* New address is pfr */
2107 )
2108 || /* OR */
2109 ( addr_new /* At least one new address AND */
2110 && success_on_redirect /* success_on_redirect is set */
2111 ) )
2112 )
2113 {
2114 if (fp) fprintf(fp, "%s %s\n",
2115 address, f.address_test_mode ? "is deliverable" : "verified");
2116
2117 /* If we have carried on to verify a child address, we want the value
2118 of $address_data to be that of the child */
2119
2120 vaddr->prop.address_data = addr->prop.address_data;
2121 vaddr->prop.variables = NULL;
2122 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
2123
2124 /* If stopped because more than one new address, cannot cutthrough */
2125
2126 if (addr_new && addr_new->next)
2127 cancel_cutthrough_connection(TRUE, US"multiple addresses from routing");
2128
2129 yield = OK;
2130 goto out;
2131 }
2132 }
2133 } /* Loop for generated addresses */
2134
2135 /* Display the full results of the successful routing, including any generated
2136 addresses. Control gets here only when full_info is set, which requires fp not
2137 to be NULL, and this occurs only when a top-level verify is called with the
2138 debugging switch on.
2139
2140 If there are no local and no remote addresses, and there were no pipes, files,
2141 or autoreplies, and there were no errors or deferments, the message is to be
2142 discarded, usually because of the use of :blackhole: in an alias file. */
2143
2144 if (allok && !addr_local && !addr_remote)
2145 {
2146 fprintf(fp, "mail to %s is discarded\n", address);
2147 goto out;
2148 }
2149
2150 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2151 while (addr_list)
2152 {
2153 address_item *addr = addr_list;
2154 transport_instance * tp = addr->transport;
2155
2156 addr_list = addr->next;
2157
2158 fprintf(fp, "%s", CS addr->address);
2159 #ifdef EXPERIMENTAL_SRS
2160 if(addr->prop.srs_sender)
2161 fprintf(fp, " [srs = %s]", addr->prop.srs_sender);
2162 #endif
2163
2164 /* If the address is a duplicate, show something about it. */
2165
2166 if (!testflag(addr, af_pfr))
2167 {
2168 tree_node *tnode;
2169 if ((tnode = tree_search(tree_duplicates, addr->unique)))
2170 fprintf(fp, " [duplicate, would not be delivered]");
2171 else tree_add_duplicate(addr->unique, addr);
2172 }
2173
2174 /* Now show its parents */
2175
2176 for (address_item * p = addr->parent; p; p = p->parent)
2177 fprintf(fp, "\n <-- %s", p->address);
2178 fprintf(fp, "\n ");
2179
2180 /* Show router, and transport */
2181
2182 fprintf(fp, "router = %s, transport = %s\n",
2183 addr->router->name, tp ? tp->name : US"unset");
2184
2185 /* Show any hosts that are set up by a router unless the transport
2186 is going to override them; fiddle a bit to get a nice format. */
2187
2188 if (addr->host_list && tp && !tp->overrides_hosts)
2189 {
2190 int maxlen = 0;
2191 int maxaddlen = 0;
2192 for (host_item * h = addr->host_list; h; h = h->next)
2193 { /* get max lengths of host names, addrs */
2194 int len = Ustrlen(h->name);
2195 if (len > maxlen) maxlen = len;
2196 len = h->address ? Ustrlen(h->address) : 7;
2197 if (len > maxaddlen) maxaddlen = len;
2198 }
2199 for (host_item * h = addr->host_list; h; h = h->next)
2200 {
2201 fprintf(fp, " host %-*s ", maxlen, h->name);
2202
2203 if (h->address)
2204 fprintf(fp, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2205 else if (tp->info->local)
2206 fprintf(fp, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2207 else
2208 fprintf(fp, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2209
2210 if (h->mx >= 0) fprintf(fp, " MX=%d", h->mx);
2211 if (h->port != PORT_NONE) fprintf(fp, " port=%d", h->port);
2212 if (f.running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", fp);
2213 if (h->status == hstatus_unusable) fputs(" ** unusable **", fp);
2214 fputc('\n', fp);
2215 }
2216 }
2217 }
2218
2219 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2220 the -bv or -bt case). */
2221
2222 out:
2223 verify_mode = NULL;
2224 tls_modify_variables(&tls_in); /* return variables to inbound values */
2225
2226 return yield;
2227 }
2228
2229
2230
2231
2232 /*************************************************
2233 * Check headers for syntax errors *
2234 *************************************************/
2235
2236 /* This function checks those header lines that contain addresses, and verifies
2237 that all the addresses therein are 5322-syntactially correct.
2238
2239 Arguments:
2240 msgptr where to put an error message
2241
2242 Returns: OK
2243 FAIL
2244 */
2245
2246 int
2247 verify_check_headers(uschar **msgptr)
2248 {
2249 uschar *colon, *s;
2250 int yield = OK;
2251
2252 for (header_line * h = header_list; h && yield == OK; h = h->next)
2253 {
2254 if (h->type != htype_from &&
2255 h->type != htype_reply_to &&
2256 h->type != htype_sender &&
2257 h->type != htype_to &&
2258 h->type != htype_cc &&
2259 h->type != htype_bcc)
2260 continue;
2261
2262 colon = Ustrchr(h->text, ':');
2263 s = colon + 1;
2264 Uskip_whitespace(&s);
2265
2266 /* Loop for multiple addresses in the header, enabling group syntax. Note
2267 that we have to reset this after the header has been scanned. */
2268
2269 f.parse_allow_group = TRUE;
2270
2271 while (*s)
2272 {
2273 uschar *ss = parse_find_address_end(s, FALSE);
2274 uschar *recipient, *errmess;
2275 int terminator = *ss;
2276 int start, end, domain;
2277
2278 /* Temporarily terminate the string at this point, and extract the
2279 operative address within, allowing group syntax. */
2280
2281 *ss = 0;
2282 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2283 *ss = terminator;
2284
2285 /* Permit an unqualified address only if the message is local, or if the
2286 sending host is configured to be permitted to send them. */
2287
2288 if (recipient && !domain)
2289 {
2290 if (h->type == htype_from || h->type == htype_sender)
2291 {
2292 if (!f.allow_unqualified_sender) recipient = NULL;
2293 }
2294 else
2295 {
2296 if (!f.allow_unqualified_recipient) recipient = NULL;
2297 }
2298 if (!recipient) errmess = US"unqualified address not permitted";
2299 }
2300
2301 /* It's an error if no address could be extracted, except for the special
2302 case of an empty address. */
2303
2304 if (!recipient && Ustrcmp(errmess, "empty address") != 0)
2305 {
2306 uschar *verb = US"is";
2307 uschar *t = ss;
2308 uschar *tt = colon;
2309 int len;
2310
2311 /* Arrange not to include any white space at the end in the
2312 error message or the header name. */
2313
2314 while (t > s && isspace(t[-1])) t--;
2315 while (tt > h->text && isspace(tt[-1])) tt--;
2316
2317 /* Add the address that failed to the error message, since in a
2318 header with very many addresses it is sometimes hard to spot
2319 which one is at fault. However, limit the amount of address to
2320 quote - cases have been seen where, for example, a missing double
2321 quote in a humungous To: header creates an "address" that is longer
2322 than string_sprintf can handle. */
2323
2324 len = t - s;
2325 if (len > 1024)
2326 {
2327 len = 1024;
2328 verb = US"begins";
2329 }
2330
2331 /* deconst cast ok as we're passing a non-const to string_printing() */
2332 *msgptr = US string_printing(
2333 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2334 errmess, (int)(tt - h->text), h->text, verb, len, s));
2335
2336 yield = FAIL;
2337 break; /* Out of address loop */
2338 }
2339
2340 /* Advance to the next address */
2341
2342 s = ss + (terminator ? 1 : 0);
2343 Uskip_whitespace(&s);
2344 } /* Next address */
2345
2346 f.parse_allow_group = FALSE;
2347 f.parse_found_group = FALSE;
2348 } /* Next header unless yield has been set FALSE */
2349
2350 return yield;
2351 }
2352
2353
2354 /*************************************************
2355 * Check header names for 8-bit characters *
2356 *************************************************/
2357
2358 /* This function checks for invalid characters in header names. See
2359 RFC 5322, 2.2. and RFC 6532, 3.
2360
2361 Arguments:
2362 msgptr where to put an error message
2363
2364 Returns: OK
2365 FAIL
2366 */
2367
2368 int
2369 verify_check_header_names_ascii(uschar **msgptr)
2370 {
2371 uschar *colon;
2372
2373 for (header_line * h = header_list; h; h = h->next)
2374 {
2375 colon = Ustrchr(h->text, ':');
2376 for(uschar * s = h->text; s < colon; s++)
2377 if ((*s < 33) || (*s > 126))
2378 {
2379 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2380 (int)(colon - h->text), h->text);
2381 return FAIL;
2382 }
2383 }
2384 return OK;
2385 }
2386
2387 /*************************************************
2388 * Check for blind recipients *
2389 *************************************************/
2390
2391 /* This function checks that every (envelope) recipient is mentioned in either
2392 the To: or Cc: header lines, thus detecting blind carbon copies.
2393
2394 There are two ways of scanning that could be used: either scan the header lines
2395 and tick off the recipients, or scan the recipients and check the header lines.
2396 The original proposed patch did the former, but I have chosen to do the latter,
2397 because (a) it requires no memory and (b) will use fewer resources when there
2398 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2399
2400 Arguments: case_sensitive true if case sensitive matching should be used
2401 Returns: OK if there are no blind recipients
2402 FAIL if there is at least one blind recipient
2403 */
2404
2405 int
2406 verify_check_notblind(BOOL case_sensitive)
2407 {
2408 for (int i = 0; i < recipients_count; i++)
2409 {
2410 BOOL found = FALSE;
2411 uschar *address = recipients_list[i].address;
2412
2413 for (header_line * h = header_list; !found && h; h = h->next)
2414 {
2415 uschar *colon, *s;
2416
2417 if (h->type != htype_to && h->type != htype_cc) continue;
2418
2419 colon = Ustrchr(h->text, ':');
2420 s = colon + 1;
2421 Uskip_whitespace(&s);
2422
2423 /* Loop for multiple addresses in the header, enabling group syntax. Note
2424 that we have to reset this after the header has been scanned. */
2425
2426 f.parse_allow_group = TRUE;
2427
2428 while (*s)
2429 {
2430 uschar * ss = parse_find_address_end(s, FALSE);
2431 uschar * recipient, * errmess;
2432 int terminator = *ss;
2433 int start, end, domain;
2434
2435 /* Temporarily terminate the string at this point, and extract the
2436 operative address within, allowing group syntax. */
2437
2438 *ss = 0;
2439 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2440 *ss = terminator;
2441
2442 /* If we found a valid recipient that has a domain, compare it with the
2443 envelope recipient. Local parts are compared with case-sensitivity
2444 according to the routine arg, domains case-insensitively.
2445 By comparing from the start with length "domain", we include the "@" at
2446 the end, which ensures that we are comparing the whole local part of each
2447 address. */
2448
2449 if (recipient && domain != 0)
2450 if ((found = (case_sensitive
2451 ? Ustrncmp(recipient, address, domain) == 0
2452 : strncmpic(recipient, address, domain) == 0)
2453 && strcmpic(recipient + domain, address + domain) == 0))
2454 break;
2455
2456 /* Advance to the next address */
2457
2458 s = ss + (terminator ? 1:0);
2459 Uskip_whitespace(&s);
2460 } /* Next address */
2461
2462 f.parse_allow_group = FALSE;
2463 f.parse_found_group = FALSE;
2464 } /* Next header (if found is false) */
2465
2466 if (!found) return FAIL;
2467 } /* Next recipient */
2468
2469 return OK;
2470 }
2471
2472
2473
2474 /*************************************************
2475 * Find if verified sender *
2476 *************************************************/
2477
2478 /* Usually, just a single address is verified as the sender of the message.
2479 However, Exim can be made to verify other addresses as well (often related in
2480 some way), and this is useful in some environments. There may therefore be a
2481 chain of such addresses that have previously been tested. This function finds
2482 whether a given address is on the chain.
2483
2484 Arguments: the address to be verified
2485 Returns: pointer to an address item, or NULL
2486 */
2487
2488 address_item *
2489 verify_checked_sender(uschar *sender)
2490 {
2491 for (address_item * addr = sender_verified_list; addr; addr = addr->next)
2492 if (Ustrcmp(sender, addr->address) == 0) return addr;
2493 return NULL;
2494 }
2495
2496
2497
2498
2499
2500 /*************************************************
2501 * Get valid header address *
2502 *************************************************/
2503
2504 /* Scan the originator headers of the message, looking for an address that
2505 verifies successfully. RFC 822 says:
2506
2507 o The "Sender" field mailbox should be sent notices of
2508 any problems in transport or delivery of the original
2509 messages. If there is no "Sender" field, then the
2510 "From" field mailbox should be used.
2511
2512 o If the "Reply-To" field exists, then the reply should
2513 go to the addresses indicated in that field and not to
2514 the address(es) indicated in the "From" field.
2515
2516 So we check a Sender field if there is one, else a Reply_to field, else a From
2517 field. As some strange messages may have more than one of these fields,
2518 especially if they are resent- fields, check all of them if there is more than
2519 one.
2520
2521 Arguments:
2522 user_msgptr points to where to put a user error message
2523 log_msgptr points to where to put a log error message
2524 callout timeout for callout check (passed to verify_address())
2525 callout_overall overall callout timeout (ditto)
2526 callout_connect connect callout timeout (ditto)
2527 se_mailfrom mailfrom for verify; NULL => ""
2528 pm_mailfrom sender for pm callout check (passed to verify_address())
2529 options callout options (passed to verify_address())
2530 verrno where to put the address basic_errno
2531
2532 If log_msgptr is set to something without setting user_msgptr, the caller
2533 normally uses log_msgptr for both things.
2534
2535 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2536 FAIL is given if no appropriate headers are found
2537 */
2538
2539 int
2540 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2541 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2542 uschar *pm_mailfrom, int options, int *verrno)
2543 {
2544 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2545 BOOL done = FALSE;
2546 int yield = FAIL;
2547
2548 for (int i = 0; i < 3 && !done; i++)
2549 for (header_line * h = header_list; h != NULL && !done; h = h->next)
2550 {
2551 int terminator, new_ok;
2552 uschar *s, *ss, *endname;
2553
2554 if (h->type != header_types[i]) continue;
2555 s = endname = Ustrchr(h->text, ':') + 1;
2556
2557 /* Scan the addresses in the header, enabling group syntax. Note that we
2558 have to reset this after the header has been scanned. */
2559
2560 f.parse_allow_group = TRUE;
2561
2562 while (*s != 0)
2563 {
2564 address_item *vaddr;
2565
2566 while (isspace(*s) || *s == ',') s++;
2567 if (*s == 0) break; /* End of header */
2568
2569 ss = parse_find_address_end(s, FALSE);
2570
2571 /* The terminator is a comma or end of header, but there may be white
2572 space preceding it (including newline for the last address). Move back
2573 past any white space so we can check against any cached envelope sender
2574 address verifications. */
2575
2576 while (isspace(ss[-1])) ss--;
2577 terminator = *ss;
2578 *ss = 0;
2579
2580 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2581 (int)(endname - h->text), h->text, s);
2582
2583 /* See if we have already verified this address as an envelope sender,
2584 and if so, use the previous answer. */
2585
2586 vaddr = verify_checked_sender(s);
2587
2588 if (vaddr != NULL && /* Previously checked */
2589 (callout <= 0 || /* No callout needed; OR */
2590 vaddr->special_action > 256)) /* Callout was done */
2591 {
2592 new_ok = vaddr->special_action & 255;
2593 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2594 *ss = terminator; /* Restore shortened string */
2595 }
2596
2597 /* Otherwise we run the verification now. We must restore the shortened
2598 string before running the verification, so the headers are correct, in
2599 case there is any rewriting. */
2600
2601 else
2602 {
2603 int start, end, domain;
2604 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2605 &domain, FALSE);
2606
2607 *ss = terminator;
2608
2609 /* If we found an empty address, just carry on with the next one, but
2610 kill the message. */
2611
2612 if (!address && Ustrcmp(*log_msgptr, "empty address") == 0)
2613 {
2614 *log_msgptr = NULL;
2615 s = ss;
2616 continue;
2617 }
2618
2619 /* If verification failed because of a syntax error, fail this
2620 function, and ensure that the failing address gets added to the error
2621 message. */
2622
2623 if (!address)
2624 {
2625 new_ok = FAIL;
2626 while (ss > s && isspace(ss[-1])) ss--;
2627 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2628 "scanning for sender: %s in \"%.*s\"",
2629 (int)(endname - h->text), h->text, *log_msgptr, (int)(ss - s), s);
2630 yield = FAIL;
2631 done = TRUE;
2632 break;
2633 }
2634
2635 /* Else go ahead with the sender verification. But it isn't *the*
2636 sender of the message, so set vopt_fake_sender to stop sender_address
2637 being replaced after rewriting or qualification. */
2638
2639 else
2640 {
2641 vaddr = deliver_make_addr(address, FALSE);
2642 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2643 callout, callout_overall, callout_connect, se_mailfrom,
2644 pm_mailfrom, NULL);
2645 }
2646 }
2647
2648 /* We now have the result, either newly found, or cached. If we are
2649 giving out error details, set a specific user error. This means that the
2650 last of these will be returned to the user if all three fail. We do not
2651 set a log message - the generic one below will be used. */
2652
2653 if (new_ok != OK)
2654 {
2655 *verrno = vaddr->basic_errno;
2656 if (smtp_return_error_details)
2657 *user_msgptr = string_sprintf("Rejected after DATA: "
2658 "could not verify \"%.*s\" header address\n%s: %s",
2659 (int)(endname - h->text), h->text, vaddr->address, vaddr->message);
2660 }
2661
2662 /* Success or defer */
2663
2664 if (new_ok == OK)
2665 {
2666 yield = OK;
2667 done = TRUE;
2668 break;
2669 }
2670
2671 if (new_ok == DEFER) yield = DEFER;
2672
2673 /* Move on to any more addresses in the header */
2674
2675 s = ss;
2676 } /* Next address */
2677
2678 f.parse_allow_group = FALSE;
2679 f.parse_found_group = FALSE;
2680 } /* Next header, unless done */
2681 /* Next header type unless done */
2682
2683 if (yield == FAIL && *log_msgptr == NULL)
2684 *log_msgptr = US"there is no valid sender in any header line";
2685
2686 if (yield == DEFER && *log_msgptr == NULL)
2687 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2688
2689 return yield;
2690 }
2691
2692
2693
2694
2695 /*************************************************
2696 * Get RFC 1413 identification *
2697 *************************************************/
2698
2699 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2700 the timeout is set to zero, then the query is not done. There may also be lists
2701 of hosts and nets which are exempt. To guard against malefactors sending
2702 non-printing characters which could, for example, disrupt a message's headers,
2703 make sure the string consists of printing characters only.
2704
2705 Argument:
2706 port the port to connect to; usually this is IDENT_PORT (113), but when
2707 running in the test harness with -bh a different value is used.
2708
2709 Returns: nothing
2710
2711 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2712 */
2713
2714 void
2715 verify_get_ident(int port)
2716 {
2717 client_conn_ctx ident_conn_ctx = {0};
2718 int host_af, qlen;
2719 int received_sender_port, received_interface_port, n;
2720 uschar *p;
2721 blob early_data;
2722 uschar buffer[2048];
2723
2724 /* Default is no ident. Check whether we want to do an ident check for this
2725 host. */
2726
2727 sender_ident = NULL;
2728 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2729 return;
2730
2731 DEBUG(D_ident) debug_printf("doing ident callback\n");
2732
2733 /* Set up a connection to the ident port of the remote host. Bind the local end
2734 to the incoming interface address. If the sender host address is an IPv6
2735 address, the incoming interface address will also be IPv6. */
2736
2737 host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
2738 if ((ident_conn_ctx.sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
2739
2740 if (ip_bind(ident_conn_ctx.sock, host_af, interface_address, 0) < 0)
2741 {
2742 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2743 strerror(errno));
2744 goto END_OFF;
2745 }
2746
2747 /* Construct and send the query. */
2748
2749 qlen = snprintf(CS buffer, sizeof(buffer), "%d , %d\r\n",
2750 sender_host_port, interface_port);
2751 early_data.data = buffer;
2752 early_data.len = qlen;
2753
2754 /*XXX we trust that the query is idempotent */
2755 if (ip_connect(ident_conn_ctx.sock, host_af, sender_host_address, port,
2756 rfc1413_query_timeout, &early_data) < 0)
2757 {
2758 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
2759 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2760 sender_host_address);
2761 else
2762 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2763 sender_host_address, strerror(errno));
2764 goto END_OFF;
2765 }
2766
2767 /* Read a response line. We put it into the rest of the buffer, using several
2768 recv() calls if necessary. */
2769
2770 p = buffer + qlen;
2771
2772 for (;;)
2773 {
2774 uschar *pp;
2775 int count;
2776 int size = sizeof(buffer) - (p - buffer);
2777
2778 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2779 count = ip_recv(&ident_conn_ctx, p, size, time(NULL) + rfc1413_query_timeout);
2780 if (count <= 0) goto END_OFF; /* Read error or EOF */
2781
2782 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2783 generous, and accept a plain \n terminator as well. The only illegal
2784 character is 0. */
2785
2786 for (pp = p; pp < p + count; pp++)
2787 {
2788 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2789 if (*pp == '\n')
2790 {
2791 if (pp[-1] == '\r') pp--;
2792 *pp = 0;
2793 goto GOT_DATA; /* Break out of both loops */
2794 }
2795 }
2796
2797 /* Reached the end of the data without finding \n. Let the loop continue to
2798 read some more, if there is room. */
2799
2800 p = pp;
2801 }
2802
2803 GOT_DATA:
2804
2805 /* We have received a line of data. Check it carefully. It must start with the
2806 same two port numbers that we sent, followed by data as defined by the RFC. For
2807 example,
2808
2809 12345 , 25 : USERID : UNIX :root
2810
2811 However, the amount of white space may be different to what we sent. In the
2812 "osname" field there may be several sub-fields, comma separated. The data we
2813 actually want to save follows the third colon. Some systems put leading spaces
2814 in it - we discard those. */
2815
2816 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2817 &received_interface_port, &n) != 2 ||
2818 received_sender_port != sender_host_port ||
2819 received_interface_port != interface_port)
2820 goto END_OFF;
2821
2822 p = buffer + qlen + n;
2823 while(isspace(*p)) p++;
2824 if (*p++ != ':') goto END_OFF;
2825 while(isspace(*p)) p++;
2826 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2827 p += 6;
2828 while(isspace(*p)) p++;
2829 if (*p++ != ':') goto END_OFF;
2830 while (*p != 0 && *p != ':') p++;
2831 if (*p++ == 0) goto END_OFF;
2832 while(isspace(*p)) p++;
2833 if (*p == 0) goto END_OFF;
2834
2835 /* The rest of the line is the data we want. We turn it into printing
2836 characters when we save it, so that it cannot mess up the format of any logging
2837 or Received: lines into which it gets inserted. We keep a maximum of 127
2838 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
2839
2840 sender_ident = US string_printing(string_copyn(p, 127));
2841 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2842
2843 END_OFF:
2844 (void)close(ident_conn_ctx.sock);
2845 return;
2846 }
2847
2848
2849
2850
2851 /*************************************************
2852 * Match host to a single host-list item *
2853 *************************************************/
2854
2855 /* This function compares a host (name or address) against a single item
2856 from a host list. The host name gets looked up if it is needed and is not
2857 already known. The function is called from verify_check_this_host() via
2858 match_check_list(), which is why most of its arguments are in a single block.
2859
2860 Arguments:
2861 arg the argument block (see below)
2862 ss the host-list item
2863 valueptr where to pass back looked up data, or NULL
2864 error for error message when returning ERROR
2865
2866 The block contains:
2867 host_name (a) the host name, or
2868 (b) NULL, implying use sender_host_name and
2869 sender_host_aliases, looking them up if required, or
2870 (c) the empty string, meaning that only IP address matches
2871 are permitted
2872 host_address the host address
2873 host_ipv4 the IPv4 address taken from an IPv6 one
2874
2875 Returns: OK matched
2876 FAIL did not match
2877 DEFER lookup deferred
2878 ERROR (a) failed to find the host name or IP address, or
2879 (b) unknown lookup type specified, or
2880 (c) host name encountered when only IP addresses are
2881 being matched
2882 */
2883
2884 int
2885 check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
2886 {
2887 check_host_block *cb = (check_host_block *)arg;
2888 int mlen = -1;
2889 int maskoffset;
2890 BOOL iplookup = FALSE;
2891 BOOL isquery = FALSE;
2892 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
2893 const uschar *t;
2894 uschar * semicolon, * endname, * opts;
2895 uschar **aliases;
2896
2897 /* Optimize for the special case when the pattern is "*". */
2898
2899 if (*ss == '*' && ss[1] == 0) return OK;
2900
2901 /* If the pattern is empty, it matches only in the case when there is no host -
2902 this can occur in ACL checking for SMTP input using the -bs option. In this
2903 situation, the host address is the empty string. */
2904
2905 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2906 if (*ss == 0) return FAIL;
2907
2908 /* If the pattern is precisely "@" then match against the primary host name,
2909 provided that host name matching is permitted; if it's "@[]" match against the
2910 local host's IP addresses. */
2911
2912 if (*ss == '@')
2913 if (ss[1] == 0)
2914 {
2915 if (isiponly) return ERROR;
2916 ss = primary_hostname;
2917 }
2918 else if (Ustrcmp(ss, "@[]") == 0)
2919 {
2920 for (ip_address_item * ip = host_find_interfaces(); ip; ip = ip->next)
2921 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2922 return FAIL;
2923 }
2924
2925 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2926 a (possibly masked) comparison with the current IP address. */
2927
2928 if (string_is_ip_address(ss, &maskoffset) != 0)
2929 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2930
2931 /* The pattern is not an IP address. A common error that people make is to omit
2932 one component of an IPv4 address, either by accident, or believing that, for
2933 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2934 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2935 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2936 ancient specification.) To aid in debugging these cases, we give a specific
2937 error if the pattern contains only digits and dots or contains a slash preceded
2938 only by digits and dots (a slash at the start indicates a file name and of
2939 course slashes may be present in lookups, but not preceded only by digits and
2940 dots). */
2941
2942 for (t = ss; isdigit(*t) || *t == '.'; ) t++;
2943 if (*t == 0 || (*t == '/' && t != ss))
2944 {
2945 *error = US"malformed IPv4 address or address mask";
2946 return ERROR;
2947 }
2948
2949 /* See if there is a semicolon in the pattern, separating a searchtype
2950 prefix. If there is one then check for comma-sep options. */
2951
2952 if ((semicolon = Ustrchr(ss, ';')))
2953 if ((opts = Ustrchr(ss, ',')) && opts < semicolon)
2954 {
2955 endname = opts++;
2956 opts = string_copyn(opts, semicolon - opts);
2957 }
2958 else
2959 {
2960 endname = semicolon;
2961 opts = NULL;
2962 }
2963
2964 /* If we are doing an IP address only match, then all lookups must be IP
2965 address lookups, even if there is no "net-". */
2966
2967 if (isiponly)
2968 iplookup = semicolon != NULL;
2969
2970 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
2971 a lookup on a masked IP network, in textual form. We obey this code even if we
2972 have already set iplookup, so as to skip over the "net-" prefix and to set the
2973 mask length. The net- stuff really only applies to single-key lookups where the
2974 key is implicit. For query-style lookups the key is specified in the query.
2975 From release 4.30, the use of net- for query style is no longer needed, but we
2976 retain it for backward compatibility. */
2977
2978 if (Ustrncmp(ss, "net", 3) == 0 && semicolon)
2979 {
2980 mlen = 0;
2981 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2982 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2983 iplookup = *t++ == '-';
2984 }
2985 else
2986 t = ss;
2987
2988 /* Do the IP address lookup if that is indeed what we have */
2989
2990 if (iplookup)
2991 {
2992 int insize;
2993 int search_type;
2994 int incoming[4];
2995 void *handle;
2996 uschar *filename, *key, *result;
2997 uschar buffer[64];
2998
2999 /* Find the search type */
3000
3001 search_type = search_findtype(t, endname - t);
3002
3003 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3004 search_error_message);
3005
3006 /* Adjust parameters for the type of lookup. For a query-style lookup, there
3007 is no file name, and the "key" is just the query. For query-style with a file
3008 name, we have to fish the file off the start of the query. For a single-key
3009 lookup, the key is the current IP address, masked appropriately, and
3010 reconverted to text form, with the mask appended. For IPv6 addresses, specify
3011 dot separators instead of colons, except when the lookup type is "iplsearch".
3012 */
3013
3014 if (mac_islookup(search_type, lookup_absfilequery))
3015 {
3016 filename = semicolon + 1;
3017 key = filename;
3018 while (*key != 0 && !isspace(*key)) key++;
3019 filename = string_copyn(filename, key - filename);
3020 while (isspace(*key)) key++;
3021 }
3022 else if (mac_islookup(search_type, lookup_querystyle))
3023 {
3024 filename = NULL;
3025 key = semicolon + 1;
3026 }
3027 else /* Single-key style */
3028 {
3029 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
3030 ':' : '.';
3031 insize = host_aton(cb->host_address, incoming);
3032 host_mask(insize, incoming, mlen);
3033 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
3034 key = buffer;
3035 filename = semicolon + 1;
3036 }
3037
3038 /* Now do the actual lookup; note that there is no search_close() because
3039 of the caching arrangements. */
3040
3041 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3042 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3043
3044 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL, opts);
3045 if (valueptr) *valueptr = result;
3046 return result ? OK : f.search_find_defer ? DEFER: FAIL;
3047 }
3048
3049 /* The pattern is not an IP address or network reference of any kind. That is,
3050 it is a host name pattern. If this is an IP only match, there's an error in the
3051 host list. */
3052
3053 if (isiponly)
3054 {
3055 *error = US"cannot match host name in match_ip list";
3056 return ERROR;
3057 }
3058
3059 /* Check the characters of the pattern to see if they comprise only letters,
3060 digits, full stops, and hyphens (the constituents of domain names). Allow
3061 underscores, as they are all too commonly found. Sigh. Also, if
3062 allow_utf8_domains is set, allow top-bit characters. */
3063
3064 for (t = ss; *t != 0; t++)
3065 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3066 (!allow_utf8_domains || *t < 128)) break;
3067
3068 /* If the pattern is a complete domain name, with no fancy characters, look up
3069 its IP address and match against that. Note that a multi-homed host will add
3070 items to the chain. */
3071
3072 if (*t == 0)
3073 {
3074 int rc;
3075 host_item h;
3076 h.next = NULL;
3077 h.name = ss;
3078 h.address = NULL;
3079 h.mx = MX_NONE;
3080
3081 /* Using byname rather than bydns here means we cannot determine dnssec
3082 status. On the other hand it is unclear how that could be either
3083 propagated up or enforced. */
3084
3085 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3086 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3087 {
3088 for (host_item * hh = &h; hh; hh = hh->next)
3089 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3090 return FAIL;
3091 }
3092 if (rc == HOST_FIND_AGAIN) return DEFER;
3093 *error = string_sprintf("failed to find IP address for %s", ss);
3094 return ERROR;
3095 }
3096
3097 /* Almost all subsequent comparisons require the host name, and can be done
3098 using the general string matching function. When this function is called for
3099 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3100 must use sender_host_name and its aliases, looking them up if necessary. */
3101
3102 if (cb->host_name) /* Explicit host name given */
3103 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3104 valueptr);
3105
3106 /* Host name not given; in principle we need the sender host name and its
3107 aliases. However, for query-style lookups, we do not need the name if the
3108 query does not contain $sender_host_name. From release 4.23, a reference to
3109 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3110 on spec. */
3111
3112 if ((semicolon = Ustrchr(ss, ';')))
3113 {
3114 const uschar * affix, * opts;
3115 int partial, affixlen, starflags, id;
3116
3117 *semicolon = 0;
3118 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags,
3119 &opts);
3120 *semicolon=';';
3121
3122 if (id < 0) /* Unknown lookup type */
3123 {
3124 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3125 search_error_message, ss);
3126 return DEFER;
3127 }
3128 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3129 }
3130
3131 if (isquery)
3132 {
3133 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3134 {
3135 case OK: return OK;
3136 case DEFER: return DEFER;
3137 default: return FAIL;
3138 }
3139 }
3140
3141 /* Not a query-style lookup; must ensure the host name is present, and then we
3142 do a check on the name and all its aliases. */
3143
3144 if (!sender_host_name)
3145 {
3146 HDEBUG(D_host_lookup)
3147 debug_printf("sender host name required, to match against %s\n", ss);
3148 if (host_lookup_failed || host_name_lookup() != OK)
3149 {
3150 *error = string_sprintf("failed to find host name for %s",
3151 sender_host_address);;
3152 return ERROR;
3153 }
3154 host_build_sender_fullhost();
3155 }
3156
3157 /* Match on the sender host name, using the general matching function */
3158
3159 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE, valueptr))
3160 {
3161 case OK: return OK;
3162 case DEFER: return DEFER;
3163 }
3164
3165 /* If there are aliases, try matching on them. */
3166
3167 aliases = sender_host_aliases;
3168 while (*aliases)
3169 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3170 {
3171 case OK: return OK;
3172 case DEFER: return DEFER;
3173 }
3174 return FAIL;
3175 }
3176
3177
3178
3179
3180 /*************************************************
3181 * Check a specific host matches a host list *
3182 *************************************************/
3183
3184 /* This function is passed a host list containing items in a number of
3185 different formats and the identity of a host. Its job is to determine whether
3186 the given host is in the set of hosts defined by the list. The host name is
3187 passed as a pointer so that it can be looked up if needed and not already
3188 known. This is commonly the case when called from verify_check_host() to check
3189 an incoming connection. When called from elsewhere the host name should usually
3190 be set.
3191
3192 This function is now just a front end to match_check_list(), which runs common
3193 code for scanning a list. We pass it the check_host() function to perform a
3194 single test.
3195
3196 Arguments:
3197 listptr pointer to the host list
3198 cache_bits pointer to cache for named lists, or NULL
3199 host_name the host name or NULL, implying use sender_host_name and
3200 sender_host_aliases, looking them up if required
3201 host_address the IP address
3202 valueptr if not NULL, data from a lookup is passed back here
3203
3204 Returns: OK if the host is in the defined set
3205 FAIL if the host is not in the defined set,
3206 DEFER if a data lookup deferred (not a host lookup)
3207
3208 If the host name was needed in order to make a comparison, and could not be
3209 determined from the IP address, the result is FAIL unless the item
3210 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3211
3212 int
3213 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3214 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3215 {
3216 int rc;
3217 unsigned int *local_cache_bits = cache_bits;
3218 const uschar *save_host_address = deliver_host_address;
3219 check_host_block cb = { .host_name = host_name, .host_address = host_address };
3220
3221 if (valueptr) *valueptr = NULL;
3222
3223 /* If the host address starts off ::ffff: it is an IPv6 address in
3224 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3225 addresses. */
3226
3227 cb.host_ipv4 = Ustrncmp(host_address, "::ffff:", 7) == 0
3228 ? host_address + 7 : host_address;
3229
3230 /* During the running of the check, put the IP address into $host_address. In
3231 the case of calls from the smtp transport, it will already be there. However,
3232 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3233 the safe side, any existing setting is preserved, though as I write this
3234 (November 2004) I can't see any cases where it is actually needed. */
3235
3236 deliver_host_address = host_address;
3237 rc = match_check_list(
3238 listptr, /* the list */
3239 0, /* separator character */
3240 &hostlist_anchor, /* anchor pointer */
3241 &local_cache_bits, /* cache pointer */
3242 check_host, /* function for testing */
3243 &cb, /* argument for function */
3244 MCL_HOST, /* type of check */
3245 (host_address == sender_host_address)?
3246 US"host" : host_address, /* text for debugging */
3247 valueptr); /* where to pass back data */
3248 deliver_host_address = save_host_address;
3249 return rc;
3250 }
3251
3252
3253
3254
3255 /*************************************************
3256 * Check the given host item matches a list *
3257 *************************************************/
3258 int
3259 verify_check_given_host(const uschar **listptr, const host_item *host)
3260 {
3261 return verify_check_this_host(listptr, NULL, host->name, host->address, NULL);
3262 }
3263
3264 /*************************************************
3265 * Check the remote host matches a list *
3266 *************************************************/
3267
3268 /* This is a front end to verify_check_this_host(), created because checking
3269 the remote host is a common occurrence. With luck, a good compiler will spot
3270 the tail recursion and optimize it. If there's no host address, this is
3271 command-line SMTP input - check against an empty string for the address.
3272
3273 Arguments:
3274 listptr pointer to the host list
3275
3276 Returns: the yield of verify_check_this_host(),
3277 i.e. OK, FAIL, or DEFER
3278 */
3279
3280 int
3281 verify_check_host(uschar **listptr)
3282 {
3283 return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
3284 sender_host_address ? sender_host_address : US"", NULL);
3285 }
3286
3287
3288
3289
3290
3291 /*************************************************
3292 * Invert an IP address *
3293 *************************************************/
3294
3295 /* Originally just used for DNS xBL lists, now also used for the
3296 reverse_ip expansion operator.
3297
3298 Arguments:
3299 buffer where to put the answer
3300 address the address to invert
3301 */
3302
3303 void
3304 invert_address(uschar *buffer, uschar *address)
3305 {
3306 int bin[4];
3307 uschar *bptr = buffer;
3308
3309 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3310 to the IPv4 part only. */
3311
3312 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3313
3314 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3315 always 1. */
3316
3317 if (host_aton(address, bin) == 1)
3318 {
3319 int x = bin[0];
3320 for (int i = 0; i < 4; i++)
3321 {
3322 sprintf(CS bptr, "%d.", x & 255);
3323 while (*bptr) bptr++;
3324 x >>= 8;
3325 }
3326 }
3327
3328 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3329 in any DNS black lists, and the format in which they will be looked up is
3330 unknown. This is just a guess. */
3331
3332 #if HAVE_IPV6
3333 else
3334 for (int j = 3; j >= 0; j--)
3335 {
3336 int x = bin[j];
3337 for (int i = 0; i < 8; i++)
3338 {
3339 sprintf(CS bptr, "%x.", x & 15);
3340 while (*bptr) bptr++;
3341 x >>= 4;
3342 }
3343 }
3344 #endif
3345
3346 /* Remove trailing period -- this is needed so that both arbitrary
3347 dnsbl keydomains and inverted addresses may be combined with the
3348 same format string, "%s.%s" */
3349
3350 *(--bptr) = 0;
3351 }
3352
3353
3354
3355 /*************************************************
3356 * Perform a single dnsbl lookup *
3357 *************************************************/
3358
3359 /* This function is called from verify_check_dnsbl() below. It is also called
3360 recursively from within itself when domain and domain_txt are different
3361 pointers, in order to get the TXT record from the alternate domain.
3362
3363 Arguments:
3364 domain the outer dnsbl domain
3365 domain_txt alternate domain to lookup TXT record on success; when the
3366 same domain is to be used, domain_txt == domain (that is,
3367 the pointers must be identical, not just the text)
3368 keydomain the current keydomain (for debug message)
3369 prepend subdomain to lookup (like keydomain, but
3370 reversed if IP address)
3371 iplist the list of matching IP addresses, or NULL for "any"
3372 bitmask true if bitmask matching is wanted
3373 match_type condition for 'succeed' result
3374 0 => Any RR in iplist (=)
3375 1 => No RR in iplist (!=)
3376 2 => All RRs in iplist (==)
3377 3 => Some RRs not in iplist (!==)
3378 the two bits are defined as MT_NOT and MT_ALL
3379 defer_return what to return for a defer
3380
3381 Returns: OK if lookup succeeded
3382 FAIL if not
3383 */
3384
3385 static int
3386 one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain,
3387 uschar *prepend, uschar *iplist, BOOL bitmask, int match_type,
3388 int defer_return)
3389 {
3390 dns_answer * dnsa = store_get_dns_answer();
3391 dns_scan dnss;
3392 tree_node *t;
3393 dnsbl_cache_block *cb;
3394 int old_pool = store_pool;
3395 uschar * query;
3396 int qlen;
3397
3398 /* Construct the specific query domainname */
3399
3400 query = string_sprintf("%s.%s", prepend, domain);
3401 if ((qlen = Ustrlen(query)) >= 256)
3402 {
3403 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
3404 "(ignored): %s...", query);
3405 return FAIL;
3406 }
3407
3408 /* Look for this query in the cache. */
3409
3410 if ( (t = tree_search(dnsbl_cache, query))
3411 && (cb = t->data.ptr)->expiry > time(NULL)
3412 )
3413
3414 /* Previous lookup was cached */
3415
3416 {
3417 HDEBUG(D_dnsbl) debug_printf("dnslists: using result of previous lookup\n");
3418 }
3419
3420 /* If not cached from a previous lookup, we must do a DNS lookup, and
3421 cache the result in permanent memory. */
3422
3423 else
3424 {
3425 uint ttl = 3600; /* max TTL for positive cache entries */
3426
3427 store_pool = POOL_PERM;
3428
3429 if (t)
3430 {
3431 HDEBUG(D_dnsbl) debug_printf("cached data found but past valid time; ");
3432