Fix sender-verify callout to not use trigger-message SIZE
[exim.git] / src / src / verify.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions concerned with verifying things. The original code for callout
9 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
10
11
12 #include "exim.h"
13 #include "transports/smtp.h"
14
15 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
17 static smtp_outblock ctblock;
18 uschar ctbuffer[8192];
19
20
21 /* Structure for caching DNSBL lookups */
22
23 typedef struct dnsbl_cache_block {
24 time_t expiry;
25 dns_address *rhs;
26 uschar *text;
27 int rc;
28 BOOL text_set;
29 } dnsbl_cache_block;
30
31
32 /* Anchor for DNSBL cache */
33
34 static tree_node *dnsbl_cache = NULL;
35
36
37 /* Bits for match_type in one_check_dnsbl() */
38
39 #define MT_NOT 1
40 #define MT_ALL 2
41
42 static uschar cutthrough_response(char, uschar **);
43
44
45 /*************************************************
46 * Retrieve a callout cache record *
47 *************************************************/
48
49 /* If a record exists, check whether it has expired.
50
51 Arguments:
52 dbm_file an open hints file
53 key the record key
54 type "address" or "domain"
55 positive_expire expire time for positive records
56 negative_expire expire time for negative records
57
58 Returns: the cache record if a non-expired one exists, else NULL
59 */
60
61 static dbdata_callout_cache *
62 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
63 int positive_expire, int negative_expire)
64 {
65 BOOL negative;
66 int length, expire;
67 time_t now;
68 dbdata_callout_cache *cache_record;
69
70 cache_record = dbfn_read_with_length(dbm_file, key, &length);
71
72 if (cache_record == NULL)
73 {
74 HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
75 return NULL;
76 }
77
78 /* We treat a record as "negative" if its result field is not positive, or if
79 it is a domain record and the postmaster field is negative. */
80
81 negative = cache_record->result != ccache_accept ||
82 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
83 expire = negative? negative_expire : positive_expire;
84 now = time(NULL);
85
86 if (now - cache_record->time_stamp > expire)
87 {
88 HDEBUG(D_verify) debug_printf("callout cache: %s record expired for %s\n", type, key);
89 return NULL;
90 }
91
92 /* If this is a non-reject domain record, check for the obsolete format version
93 that doesn't have the postmaster and random timestamps, by looking at the
94 length. If so, copy it to a new-style block, replicating the record's
95 timestamp. Then check the additional timestamps. (There's no point wasting
96 effort if connections are rejected.) */
97
98 if (type[0] == 'd' && cache_record->result != ccache_reject)
99 {
100 if (length == sizeof(dbdata_callout_cache_obs))
101 {
102 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
103 memcpy(new, cache_record, length);
104 new->postmaster_stamp = new->random_stamp = new->time_stamp;
105 cache_record = new;
106 }
107
108 if (now - cache_record->postmaster_stamp > expire)
109 cache_record->postmaster_result = ccache_unknown;
110
111 if (now - cache_record->random_stamp > expire)
112 cache_record->random_result = ccache_unknown;
113 }
114
115 HDEBUG(D_verify) debug_printf("callout cache: found %s record for %s\n", type, key);
116 return cache_record;
117 }
118
119
120
121 /*************************************************
122 * Do callout verification for an address *
123 *************************************************/
124
125 /* This function is called from verify_address() when the address has routed to
126 a host list, and a callout has been requested. Callouts are expensive; that is
127 why a cache is used to improve the efficiency.
128
129 Arguments:
130 addr the address that's been routed
131 host_list the list of hosts to try
132 tf the transport feedback block
133
134 ifstring "interface" option from transport, or NULL
135 portstring "port" option from transport, or NULL
136 protocolstring "protocol" option from transport, or NULL
137 callout the per-command callout timeout
138 callout_overall the overall callout timeout (if < 0 use 4*callout)
139 callout_connect the callout connection timeout (if < 0 use callout)
140 options the verification options - these bits are used:
141 vopt_is_recipient => this is a recipient address
142 vopt_callout_no_cache => don't use callout cache
143 vopt_callout_fullpm => if postmaster check, do full one
144 vopt_callout_random => do the "random" thing
145 vopt_callout_recipsender => use real sender for recipient
146 vopt_callout_recippmaster => use postmaster for recipient
147 se_mailfrom MAIL FROM address for sender verify; NULL => ""
148 pm_mailfrom if non-NULL, do the postmaster check with this sender
149
150 Returns: OK/FAIL/DEFER
151 */
152
153 static int
154 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
155 int callout, int callout_overall, int callout_connect, int options,
156 uschar *se_mailfrom, uschar *pm_mailfrom)
157 {
158 int yield = OK;
159 int old_domain_cache_result = ccache_accept;
160 BOOL done = FALSE;
161 uschar *address_key;
162 uschar *from_address;
163 uschar *random_local_part = NULL;
164 const uschar *save_deliver_domain = deliver_domain;
165 uschar **failure_ptr = options & vopt_is_recipient
166 ? &recipient_verify_failure : &sender_verify_failure;
167 open_db dbblock;
168 open_db *dbm_file = NULL;
169 dbdata_callout_cache new_domain_record;
170 dbdata_callout_cache_address new_address_record;
171 host_item *host;
172 time_t callout_start_time;
173 uschar peer_offered = 0;
174
175 new_domain_record.result = ccache_unknown;
176 new_domain_record.postmaster_result = ccache_unknown;
177 new_domain_record.random_result = ccache_unknown;
178
179 memset(&new_address_record, 0, sizeof(new_address_record));
180
181 /* For a recipient callout, the key used for the address cache record must
182 include the sender address if we are using the real sender in the callout,
183 because that may influence the result of the callout. */
184
185 address_key = addr->address;
186 from_address = US"";
187
188 if (options & vopt_is_recipient)
189 {
190 if (options & vopt_callout_recipsender)
191 {
192 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
193 from_address = sender_address;
194 if (cutthrough.delivery) options |= vopt_callout_no_cache;
195 }
196 else if (options & vopt_callout_recippmaster)
197 {
198 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
199 qualify_domain_sender);
200 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
201 }
202 }
203
204 /* For a sender callout, we must adjust the key if the mailfrom address is not
205 empty. */
206
207 else
208 {
209 from_address = (se_mailfrom == NULL)? US"" : se_mailfrom;
210 if (from_address[0] != 0)
211 address_key = string_sprintf("%s/<%s>", addr->address, from_address);
212 }
213
214 /* Open the callout cache database, it it exists, for reading only at this
215 stage, unless caching has been disabled. */
216
217 if (options & vopt_callout_no_cache)
218 {
219 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
220 }
221 else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
222 {
223 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
224 }
225
226 /* If a cache database is available see if we can avoid the need to do an
227 actual callout by making use of previously-obtained data. */
228
229 if (dbm_file)
230 {
231 dbdata_callout_cache_address *cache_address_record;
232 dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
233 addr->domain, US"domain",
234 callout_cache_domain_positive_expire,
235 callout_cache_domain_negative_expire);
236
237 /* If an unexpired cache record was found for this domain, see if the callout
238 process can be short-circuited. */
239
240 if (cache_record)
241 {
242 /* In most cases, if an early command (up to and including MAIL FROM:<>)
243 was rejected, there is no point carrying on. The callout fails. However, if
244 we are doing a recipient verification with use_sender or use_postmaster
245 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
246 will be using a non-empty sender. We have to remember this situation so as
247 not to disturb the cached domain value if this whole verification succeeds
248 (we don't want it turning into "accept"). */
249
250 old_domain_cache_result = cache_record->result;
251
252 if (cache_record->result == ccache_reject ||
253 (*from_address == 0 && cache_record->result == ccache_reject_mfnull))
254 {
255 setflag(addr, af_verify_nsfail);
256 HDEBUG(D_verify)
257 debug_printf("callout cache: domain gave initial rejection, or "
258 "does not accept HELO or MAIL FROM:<>\n");
259 setflag(addr, af_verify_nsfail);
260 addr->user_message = US"(result of an earlier callout reused).";
261 yield = FAIL;
262 *failure_ptr = US"mail";
263 goto END_CALLOUT;
264 }
265
266 /* If a previous check on a "random" local part was accepted, we assume
267 that the server does not do any checking on local parts. There is therefore
268 no point in doing the callout, because it will always be successful. If a
269 random check previously failed, arrange not to do it again, but preserve
270 the data in the new record. If a random check is required but hasn't been
271 done, skip the remaining cache processing. */
272
273 if (options & vopt_callout_random) switch(cache_record->random_result)
274 {
275 case ccache_accept:
276 HDEBUG(D_verify)
277 debug_printf("callout cache: domain accepts random addresses\n");
278 goto END_CALLOUT; /* Default yield is OK */
279
280 case ccache_reject:
281 HDEBUG(D_verify)
282 debug_printf("callout cache: domain rejects random addresses\n");
283 options &= ~vopt_callout_random;
284 new_domain_record.random_result = ccache_reject;
285 new_domain_record.random_stamp = cache_record->random_stamp;
286 break;
287
288 default:
289 HDEBUG(D_verify)
290 debug_printf("callout cache: need to check random address handling "
291 "(not cached or cache expired)\n");
292 goto END_CACHE;
293 }
294
295 /* If a postmaster check is requested, but there was a previous failure,
296 there is again no point in carrying on. If a postmaster check is required,
297 but has not been done before, we are going to have to do a callout, so skip
298 remaining cache processing. */
299
300 if (pm_mailfrom)
301 {
302 if (cache_record->postmaster_result == ccache_reject)
303 {
304 setflag(addr, af_verify_pmfail);
305 HDEBUG(D_verify)
306 debug_printf("callout cache: domain does not accept "
307 "RCPT TO:<postmaster@domain>\n");
308 yield = FAIL;
309 *failure_ptr = US"postmaster";
310 setflag(addr, af_verify_pmfail);
311 addr->user_message = US"(result of earlier verification reused).";
312 goto END_CALLOUT;
313 }
314 if (cache_record->postmaster_result == ccache_unknown)
315 {
316 HDEBUG(D_verify)
317 debug_printf("callout cache: need to check RCPT "
318 "TO:<postmaster@domain> (not cached or cache expired)\n");
319 goto END_CACHE;
320 }
321
322 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
323 postmaster check if the address itself has to be checked. Also ensure
324 that the value in the cache record is preserved (with its old timestamp).
325 */
326
327 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
328 "TO:<postmaster@domain>\n");
329 pm_mailfrom = NULL;
330 new_domain_record.postmaster_result = ccache_accept;
331 new_domain_record.postmaster_stamp = cache_record->postmaster_stamp;
332 }
333 }
334
335 /* We can't give a result based on information about the domain. See if there
336 is an unexpired cache record for this specific address (combined with the
337 sender address if we are doing a recipient callout with a non-empty sender).
338 */
339
340 cache_address_record = (dbdata_callout_cache_address *)
341 get_callout_cache_record(dbm_file,
342 address_key, US"address",
343 callout_cache_positive_expire,
344 callout_cache_negative_expire);
345
346 if (cache_address_record)
347 {
348 if (cache_address_record->result == ccache_accept)
349 {
350 HDEBUG(D_verify)
351 debug_printf("callout cache: address record is positive\n");
352 }
353 else
354 {
355 HDEBUG(D_verify)
356 debug_printf("callout cache: address record is negative\n");
357 addr->user_message = US"Previous (cached) callout verification failure";
358 *failure_ptr = US"recipient";
359 yield = FAIL;
360 }
361 goto END_CALLOUT;
362 }
363
364 /* Close the cache database while we actually do the callout for real. */
365
366 END_CACHE:
367 dbfn_close(dbm_file);
368 dbm_file = NULL;
369 }
370
371 if (!addr->transport)
372 {
373 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
374 }
375 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
376 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
377 addr->transport->name, addr->transport->driver_name);
378 else
379 {
380 smtp_transport_options_block *ob =
381 (smtp_transport_options_block *)addr->transport->options_block;
382
383 /* The information wasn't available in the cache, so we have to do a real
384 callout and save the result in the cache for next time, unless no_cache is set,
385 or unless we have a previously cached negative random result. If we are to test
386 with a random local part, ensure that such a local part is available. If not,
387 log the fact, but carry on without randomming. */
388
389 if (options & vopt_callout_random && callout_random_local_part != NULL)
390 if (!(random_local_part = expand_string(callout_random_local_part)))
391 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
392 "callout_random_local_part: %s", expand_string_message);
393
394 /* Default the connect and overall callout timeouts if not set, and record the
395 time we are starting so that we can enforce it. */
396
397 if (callout_overall < 0) callout_overall = 4 * callout;
398 if (callout_connect < 0) callout_connect = callout;
399 callout_start_time = time(NULL);
400
401 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
402 output because a callout might take some time. When PIPELINING is active and
403 there are many recipients, the total time for doing lots of callouts can add up
404 and cause the client to time out. So in this case we forgo the PIPELINING
405 optimization. */
406
407 if (smtp_out && !disable_callout_flush) mac_smtp_fflush();
408
409 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
410 and we are holding a cutthrough conn open, we can just append the rcpt to
411 that conn for verification purposes (and later delivery also). Simplest
412 coding means skipping this whole loop and doing the append separately.
413
414 We will need to remember it has been appended so that rcpt-acl tail code
415 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
416 */
417
418 /* Can we re-use an open cutthrough connection? */
419 if ( cutthrough.fd >= 0
420 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
421 == vopt_callout_recipsender
422 && !random_local_part
423 && !pm_mailfrom
424 )
425 {
426 if (addr->transport == cutthrough.addr.transport)
427 for (host = host_list; host; host = host->next)
428 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
429 {
430 int host_af;
431 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
432 int port = 25;
433
434 deliver_host = host->name;
435 deliver_host_address = host->address;
436 deliver_host_port = host->port;
437 deliver_domain = addr->domain;
438 transport_name = addr->transport->name;
439
440 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
441
442 if (!smtp_get_interface(tf->interface, host_af, addr, &interface,
443 US"callout") ||
444 !smtp_get_port(tf->port, addr, &port, US"callout"))
445 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
446 addr->message);
447
448 if ( ( interface == cutthrough.interface
449 || ( interface
450 && cutthrough.interface
451 && Ustrcmp(interface, cutthrough.interface) == 0
452 ) )
453 && port == cutthrough.host.port
454 )
455 {
456 uschar * resp = NULL;
457
458 /* Match! Send the RCPT TO, append the addr, set done */
459 done =
460 smtp_write_command(&ctblock, FALSE, "RCPT TO:<%.1000s>\r\n",
461 transport_rcpt_address(addr,
462 (addr->transport == NULL)? FALSE :
463 addr->transport->rcpt_include_affixes)) >= 0 &&
464 cutthrough_response('2', &resp) == '2';
465
466 /* This would go horribly wrong if a callout fail was ignored by ACL.
467 We punt by abandoning cutthrough on a reject, like the
468 first-rcpt does. */
469
470 if (done)
471 {
472 address_item * na = store_get(sizeof(address_item));
473 *na = cutthrough.addr;
474 cutthrough.addr = *addr;
475 cutthrough.addr.host_used = &cutthrough.host;
476 cutthrough.addr.next = na;
477
478 cutthrough.nrcpt++;
479 }
480 else
481 {
482 cancel_cutthrough_connection("recipient rejected");
483 if (!resp || errno == ETIMEDOUT)
484 {
485 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
486 }
487 else if (errno == 0)
488 {
489 if (*resp == 0)
490 Ustrcpy(resp, US"connection dropped");
491
492 addr->message =
493 string_sprintf("response to \"%s\" from %s [%s] was: %s",
494 big_buffer, host->name, host->address,
495 string_printing(resp));
496
497 addr->user_message =
498 string_sprintf("Callout verification failed:\n%s", resp);
499
500 /* Hard rejection ends the process */
501
502 if (resp[0] == '5') /* Address rejected */
503 {
504 yield = FAIL;
505 done = TRUE;
506 }
507 }
508 }
509 }
510 break;
511 }
512 if (!done)
513 cancel_cutthrough_connection("incompatible connection");
514 }
515
516 /* Now make connections to the hosts and do real callouts. The list of hosts
517 is passed in as an argument. */
518
519 for (host = host_list; host && !done; host = host->next)
520 {
521 smtp_inblock inblock;
522 smtp_outblock outblock;
523 int host_af;
524 int port = 25;
525 BOOL send_quit = TRUE;
526 uschar *active_hostname = smtp_active_hostname;
527 BOOL lmtp;
528 BOOL smtps;
529 BOOL esmtp;
530 BOOL suppress_tls = FALSE;
531 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
532 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
533 BOOL dane = FALSE;
534 BOOL dane_required;
535 dns_answer tlsa_dnsa;
536 #endif
537 uschar inbuffer[4096];
538 uschar outbuffer[1024];
539 uschar responsebuffer[4096];
540 uschar * size_str;
541
542 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
543 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
544
545 /* Skip this host if we don't have an IP address for it. */
546
547 if (!host->address)
548 {
549 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
550 host->name);
551 continue;
552 }
553
554 /* Check the overall callout timeout */
555
556 if (time(NULL) - callout_start_time >= callout_overall)
557 {
558 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
559 break;
560 }
561
562 /* Set IPv4 or IPv6 */
563
564 host_af = Ustrchr(host->address, ':') == NULL ? AF_INET : AF_INET6;
565
566 /* Expand and interpret the interface and port strings. The latter will not
567 be used if there is a host-specific port (e.g. from a manualroute router).
568 This has to be delayed till now, because they may expand differently for
569 different hosts. If there's a failure, log it, but carry on with the
570 defaults. */
571
572 deliver_host = host->name;
573 deliver_host_address = host->address;
574 deliver_host_port = host->port;
575 deliver_domain = addr->domain;
576 transport_name = addr->transport->name;
577
578 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
579 US"callout")
580 || !smtp_get_port(tf->port, addr, &port, US"callout")
581 )
582 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
583 addr->message);
584
585 /* Set HELO string according to the protocol */
586 lmtp= Ustrcmp(tf->protocol, "lmtp") == 0;
587 smtps= Ustrcmp(tf->protocol, "smtps") == 0;
588
589
590 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", interface, port);
591
592 /* Set up the buffer for reading SMTP response packets. */
593
594 inblock.buffer = inbuffer;
595 inblock.buffersize = sizeof(inbuffer);
596 inblock.ptr = inbuffer;
597 inblock.ptrend = inbuffer;
598
599 /* Set up the buffer for holding SMTP commands while pipelining */
600
601 outblock.buffer = outbuffer;
602 outblock.buffersize = sizeof(outbuffer);
603 outblock.ptr = outbuffer;
604 outblock.cmd_count = 0;
605 outblock.authenticating = FALSE;
606
607 /* Connect to the host; on failure, just loop for the next one, but we
608 set the error for the last one. Use the callout_connect timeout. */
609
610 tls_retry_connection:
611
612 /* Reset the parameters of a TLS session */
613 tls_out.cipher = tls_out.peerdn = tls_out.peercert = NULL;
614
615 inblock.sock = outblock.sock =
616 smtp_connect(host, host_af, port, interface, callout_connect,
617 addr->transport);
618 if (inblock.sock < 0)
619 {
620 HDEBUG(D_verify) debug_printf("connect: %s\n", strerror(errno));
621 addr->message = string_sprintf("could not connect to %s [%s]: %s",
622 host->name, host->address, strerror(errno));
623 transport_name = NULL;
624 deliver_host = deliver_host_address = NULL;
625 deliver_domain = save_deliver_domain;
626 continue;
627 }
628
629 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_DANE)
630 {
631 int rc;
632
633 tls_out.dane_verified = FALSE;
634 tls_out.tlsa_usage = 0;
635
636 dane_required =
637 verify_check_given_host(&ob->hosts_require_dane, host) == OK;
638
639 if (host->dnssec == DS_YES)
640 {
641 if( dane_required
642 || verify_check_given_host(&ob->hosts_try_dane, host) == OK
643 )
644 {
645 if ((rc = tlsa_lookup(host, &tlsa_dnsa, dane_required)) != OK)
646 return rc;
647 dane = TRUE;
648 }
649 }
650 else if (dane_required)
651 {
652 log_write(0, LOG_MAIN, "DANE error: %s lookup not DNSSEC", host->name);
653 return FAIL;
654 }
655
656 if (dane)
657 ob->tls_tempfail_tryclear = FALSE;
658 }
659 #endif /*DANE*/
660
661 /* Expand the helo_data string to find the host name to use. */
662
663 if (tf->helo_data)
664 {
665 uschar * s = expand_string(tf->helo_data);
666 if (!s)
667 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
668 "helo_data value for callout: %s", addr->address,
669 expand_string_message);
670 else active_hostname = s;
671 }
672
673 /* Wait for initial response, and send HELO. The smtp_write_command()
674 function leaves its command in big_buffer. This is used in error responses.
675 Initialize it in case the connection is rejected. */
676
677 Ustrcpy(big_buffer, "initial connection");
678
679 /* Unless ssl-on-connect, wait for the initial greeting */
680 smtps_redo_greeting:
681
682 #ifdef SUPPORT_TLS
683 if (!smtps || (smtps && tls_out.active >= 0))
684 #endif
685 {
686 if (!(done= smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout)))
687 goto RESPONSE_FAILED;
688
689 #ifndef DISABLE_EVENT
690 lookup_dnssec_authenticated = host->dnssec==DS_YES ? US"yes"
691 : host->dnssec==DS_NO ? US"no" : NULL;
692 if (event_raise(addr->transport->event_action,
693 US"smtp:connect", responsebuffer))
694 {
695 lookup_dnssec_authenticated = NULL;
696 /* Logging? Debug? */
697 goto RESPONSE_FAILED;
698 }
699 lookup_dnssec_authenticated = NULL;
700 #endif
701 }
702
703 /* Not worth checking greeting line for ESMTP support */
704 if (!(esmtp = verify_check_given_host(&ob->hosts_avoid_esmtp, host) != OK))
705 DEBUG(D_transport)
706 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
707
708 tls_redo_helo:
709
710 #ifdef SUPPORT_TLS
711 if (smtps && tls_out.active < 0) /* ssl-on-connect, first pass */
712 {
713 peer_offered &= ~PEER_OFFERED_TLS;
714 ob->tls_tempfail_tryclear = FALSE;
715 }
716 else /* all other cases */
717 #endif
718
719 { esmtp_retry:
720
721 if (!(done= smtp_write_command(&outblock, FALSE, "%s %s\r\n",
722 !esmtp? "HELO" : lmtp? "LHLO" : "EHLO", active_hostname) >= 0))
723 goto SEND_FAILED;
724 if (!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), '2', callout))
725 {
726 if (errno != 0 || responsebuffer[0] == 0 || lmtp || !esmtp || tls_out.active >= 0)
727 {
728 done= FALSE;
729 goto RESPONSE_FAILED;
730 }
731 #ifdef SUPPORT_TLS
732 peer_offered &= ~PEER_OFFERED_TLS;
733 #endif
734 esmtp = FALSE;
735 goto esmtp_retry; /* fallback to HELO */
736 }
737
738 /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
739
740 peer_offered = esmtp
741 ? ehlo_response(responsebuffer, sizeof(responsebuffer),
742 (!suppress_tls && tls_out.active < 0 ? PEER_OFFERED_TLS : 0)
743 | 0 /* no IGNQ */
744 | 0 /* no PRDR */
745 #ifdef SUPPORT_I18N
746 | (addr->prop.utf8_msg && !addr->prop.utf8_downcvt
747 ? PEER_OFFERED_UTF8 : 0)
748 #endif
749 | 0 /* no DSN */
750 | 0 /* no PIPE */
751
752 /* only care about SIZE if we have size from inbound */
753 | (message_size > 0 && ob->size_addition >= 0
754 ? PEER_OFFERED_SIZE : 0)
755 )
756 : 0;
757 }
758
759 size_str = options & vopt_is_recipient && peer_offered & PEER_OFFERED_SIZE
760 ? string_sprintf(" SIZE=%d", message_size + ob->size_addition) : US"";
761
762 #ifdef SUPPORT_TLS
763 smtp_peer_options |= peer_offered & PEER_OFFERED_TLS;
764 #endif
765
766 /* If TLS is available on this connection attempt to
767 start up a TLS session, unless the host is in hosts_avoid_tls. If successful,
768 send another EHLO - the server may give a different answer in secure mode. We
769 use a separate buffer for reading the response to STARTTLS so that if it is
770 negative, the original EHLO data is available for subsequent analysis, should
771 the client not be required to use TLS. If the response is bad, copy the buffer
772 for error analysis. */
773
774 #ifdef SUPPORT_TLS
775 if ( peer_offered & PEER_OFFERED_TLS
776 && verify_check_given_host(&ob->hosts_avoid_tls, host) != OK
777 && verify_check_given_host(&ob->hosts_verify_avoid_tls, host) != OK
778 )
779 {
780 uschar buffer2[4096];
781 if ( !smtps
782 && !(done= smtp_write_command(&outblock, FALSE, "STARTTLS\r\n") >= 0))
783 goto SEND_FAILED;
784
785 /* If there is an I/O error, transmission of this message is deferred. If
786 there is a temporary rejection of STARRTLS and tls_tempfail_tryclear is
787 false, we also defer. However, if there is a temporary rejection of STARTTLS
788 and tls_tempfail_tryclear is true, or if there is an outright rejection of
789 STARTTLS, we carry on. This means we will try to send the message in clear,
790 unless the host is in hosts_require_tls (tested below). */
791
792 if (!smtps && !smtp_read_response(&inblock, buffer2, sizeof(buffer2), '2',
793 ob->command_timeout))
794 {
795 if ( errno != 0
796 || buffer2[0] == 0
797 || buffer2[0] == '4' && !ob->tls_tempfail_tryclear
798 )
799 {
800 Ustrncpy(responsebuffer, buffer2, sizeof(responsebuffer));
801 done= FALSE;
802 goto RESPONSE_FAILED;
803 }
804 }
805
806 /* STARTTLS accepted or ssl-on-connect: try to negotiate a TLS session. */
807 else
808 {
809 int oldtimeout = ob->command_timeout;
810 int rc;
811
812 ob->command_timeout = callout;
813 rc = tls_client_start(inblock.sock, host, addr, addr->transport
814 # ifdef EXPERIMENTAL_DANE
815 , dane ? &tlsa_dnsa : NULL
816 # endif
817 );
818 ob->command_timeout = oldtimeout;
819
820 /* TLS negotiation failed; give an error. Try in clear on a new
821 connection, if the options permit it for this host. */
822 if (rc != OK)
823 {
824 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
825 (void)close(inblock.sock);
826 # ifndef DISABLE_EVENT
827 (void) event_raise(addr->transport->event_action,
828 US"tcp:close", NULL);
829 # endif
830 if ( ob->tls_tempfail_tryclear
831 && !smtps
832 && verify_check_given_host(&ob->hosts_require_tls, host) != OK
833 )
834 {
835 log_write(0, LOG_MAIN, "TLS session failure:"
836 " callout unencrypted to %s [%s] (not in hosts_require_tls)",
837 host->name, host->address);
838 suppress_tls = TRUE;
839 goto tls_retry_connection;
840 }
841
842 /*save_errno = ERRNO_TLSFAILURE;*/
843 /*message = US"failure while setting up TLS session";*/
844 send_quit = FALSE;
845 done= FALSE;
846 goto TLS_FAILED;
847 }
848
849 /* TLS session is set up. Copy info for logging. */
850 addr->cipher = tls_out.cipher;
851 addr->peerdn = tls_out.peerdn;
852
853 /* For SMTPS we need to wait for the initial OK response, then do HELO. */
854 if (smtps)
855 goto smtps_redo_greeting;
856
857 /* For STARTTLS we need to redo EHLO */
858 goto tls_redo_helo;
859 }
860 }
861
862 /* If the host is required to use a secure channel, ensure that we have one. */
863 if (tls_out.active < 0)
864 if (
865 # ifdef EXPERIMENTAL_DANE
866 dane ||
867 # endif
868 verify_check_given_host(&ob->hosts_require_tls, host) == OK
869 )
870 {
871 /*save_errno = ERRNO_TLSREQUIRED;*/
872 log_write(0, LOG_MAIN,
873 "H=%s [%s]: a TLS session is required for this host, but %s",
874 host->name, host->address,
875 peer_offered & PEER_OFFERED_TLS
876 ? "an attempt to start TLS failed"
877 : "the server did not offer TLS support");
878 done= FALSE;
879 goto TLS_FAILED;
880 }
881
882 #endif /*SUPPORT_TLS*/
883
884 done = TRUE; /* so far so good; have response to HELO */
885
886 /* For now, transport_filter by cutthrough-delivery is not supported */
887 /* Need proper integration with the proper transport mechanism. */
888 if (cutthrough.delivery)
889 {
890 #ifndef DISABLE_DKIM
891 uschar * s;
892 #endif
893 if (addr->transport->filter_command)
894 {
895 cutthrough.delivery = FALSE;
896 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
897 }
898 #ifndef DISABLE_DKIM
899 else if ((s = ob->dkim.dkim_domain) && (s = expand_string(s)) && *s)
900 {
901 cutthrough.delivery = FALSE;
902 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
903 }
904 #endif
905 }
906
907 SEND_FAILED:
908 RESPONSE_FAILED:
909 TLS_FAILED:
910 ;
911 /* Clear down of the TLS, SMTP and TCP layers on error is handled below. */
912
913 /* Failure to accept HELO is cached; this blocks the whole domain for all
914 senders. I/O errors and defer responses are not cached. */
915
916 if (!done)
917 {
918 *failure_ptr = US"mail"; /* At or before MAIL */
919 if (errno == 0 && responsebuffer[0] == '5')
920 {
921 setflag(addr, af_verify_nsfail);
922 new_domain_record.result = ccache_reject;
923 }
924 }
925
926 #ifdef SUPPORT_I18N
927 else if ( addr->prop.utf8_msg
928 && !addr->prop.utf8_downcvt
929 && !(peer_offered & PEER_OFFERED_UTF8)
930 )
931 {
932 HDEBUG(D_acl|D_v) debug_printf("utf8 required but not offered\n");
933 errno = ERRNO_UTF8_FWD;
934 setflag(addr, af_verify_nsfail);
935 done = FALSE;
936 }
937 else if ( addr->prop.utf8_msg
938 && (addr->prop.utf8_downcvt || !(peer_offered & PEER_OFFERED_UTF8))
939 && (setflag(addr, af_utf8_downcvt),
940 from_address = string_address_utf8_to_alabel(from_address,
941 &addr->message),
942 addr->message
943 ) )
944 {
945 errno = ERRNO_EXPANDFAIL;
946 setflag(addr, af_verify_nsfail);
947 done = FALSE;
948 }
949 #endif
950
951 /* If we haven't authenticated, but are required to, give up. */
952 /* Try to AUTH */
953
954 else done = smtp_auth(responsebuffer, sizeof(responsebuffer),
955 addr, host, ob, esmtp, &inblock, &outblock) == OK &&
956
957 /* Copy AUTH info for logging */
958 ( (addr->authenticator = client_authenticator),
959 (addr->auth_id = client_authenticated_id),
960
961 /* Build a mail-AUTH string (re-using responsebuffer for convenience */
962 !smtp_mail_auth_str(responsebuffer, sizeof(responsebuffer), addr, ob)
963 ) &&
964
965 ( (addr->auth_sndr = client_authenticated_sender),
966
967 /* Send the MAIL command */
968 (smtp_write_command(&outblock, FALSE,
969 #ifdef SUPPORT_I18N
970 addr->prop.utf8_msg && !addr->prop.utf8_downcvt
971 ? "MAIL FROM:<%s>%s%s SMTPUTF8\r\n"
972 :
973 #endif
974 "MAIL FROM:<%s>%s%s\r\n",
975 from_address, responsebuffer, size_str) >= 0)
976 ) &&
977
978 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
979 '2', callout);
980
981 deliver_host = deliver_host_address = NULL;
982 deliver_domain = save_deliver_domain;
983
984 /* If the host does not accept MAIL FROM:<>, arrange to cache this
985 information, but again, don't record anything for an I/O error or a defer. Do
986 not cache rejections of MAIL when a non-empty sender has been used, because
987 that blocks the whole domain for all senders. */
988
989 if (!done)
990 {
991 *failure_ptr = US"mail"; /* At or before MAIL */
992 if (errno == 0 && responsebuffer[0] == '5')
993 {
994 setflag(addr, af_verify_nsfail);
995 if (from_address[0] == 0)
996 new_domain_record.result = ccache_reject_mfnull;
997 }
998 }
999
1000 /* Otherwise, proceed to check a "random" address (if required), then the
1001 given address, and the postmaster address (if required). Between each check,
1002 issue RSET, because some servers accept only one recipient after MAIL
1003 FROM:<>.
1004
1005 Before doing this, set the result in the domain cache record to "accept",
1006 unless its previous value was ccache_reject_mfnull. In that case, the domain
1007 rejects MAIL FROM:<> and we want to continue to remember that. When that is
1008 the case, we have got here only in the case of a recipient verification with
1009 a non-null sender. */
1010
1011 else
1012 {
1013 const uschar * rcpt_domain = addr->domain;
1014
1015 #ifdef SUPPORT_I18N
1016 uschar * errstr = NULL;
1017 if ( testflag(addr, af_utf8_downcvt)
1018 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
1019 &errstr), errstr)
1020 )
1021 {
1022 addr->message = errstr;
1023 errno = ERRNO_EXPANDFAIL;
1024 setflag(addr, af_verify_nsfail);
1025 done = FALSE;
1026 rcpt_domain = US""; /*XXX errorhandling! */
1027 }
1028 #endif
1029
1030 new_domain_record.result =
1031 (old_domain_cache_result == ccache_reject_mfnull)?
1032 ccache_reject_mfnull: ccache_accept;
1033
1034 /* Do the random local part check first */
1035
1036 if (random_local_part != NULL)
1037 {
1038 uschar randombuffer[1024];
1039 BOOL random_ok =
1040 smtp_write_command(&outblock, FALSE,
1041 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part,
1042 rcpt_domain) >= 0 &&
1043 smtp_read_response(&inblock, randombuffer,
1044 sizeof(randombuffer), '2', callout);
1045
1046 /* Remember when we last did a random test */
1047
1048 new_domain_record.random_stamp = time(NULL);
1049
1050 /* If accepted, we aren't going to do any further tests below. */
1051
1052 if (random_ok)
1053 new_domain_record.random_result = ccache_accept;
1054
1055 /* Otherwise, cache a real negative response, and get back to the right
1056 state to send RCPT. Unless there's some problem such as a dropped
1057 connection, we expect to succeed, because the commands succeeded above.
1058 However, some servers drop the connection after responding to an
1059 invalid recipient, so on (any) error we drop and remake the connection.
1060 */
1061
1062 else if (errno == 0)
1063 {
1064 /* This would be ok for 1st rcpt a cutthrough, but no way to
1065 handle a subsequent. So refuse to support any */
1066 cancel_cutthrough_connection("random-recipient");
1067
1068 if (randombuffer[0] == '5')
1069 new_domain_record.random_result = ccache_reject;
1070
1071 done =
1072 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1073 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1074 '2', callout) &&
1075
1076 smtp_write_command(&outblock, FALSE,
1077 #ifdef SUPPORT_I18N
1078 addr->prop.utf8_msg && !addr->prop.utf8_downcvt
1079 ? "MAIL FROM:<%s> SMTPUTF8\r\n"
1080 :
1081 #endif
1082 "MAIL FROM:<%s>\r\n",
1083 from_address) >= 0 &&
1084 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1085 '2', callout);
1086
1087 if (!done)
1088 {
1089 HDEBUG(D_acl|D_v)
1090 debug_printf("problem after random/rset/mfrom; reopen conn\n");
1091 random_local_part = NULL;
1092 #ifdef SUPPORT_TLS
1093 tls_close(FALSE, TRUE);
1094 #endif
1095 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
1096 (void)close(inblock.sock);
1097 #ifndef DISABLE_EVENT
1098 (void) event_raise(addr->transport->event_action,
1099 US"tcp:close", NULL);
1100 #endif
1101 goto tls_retry_connection;
1102 }
1103 }
1104 else done = FALSE; /* Some timeout/connection problem */
1105 } /* Random check */
1106
1107 /* If the host is accepting all local parts, as determined by the "random"
1108 check, we don't need to waste time doing any further checking. */
1109
1110 if (new_domain_record.random_result != ccache_accept && done)
1111 {
1112 /* Get the rcpt_include_affixes flag from the transport if there is one,
1113 but assume FALSE if there is not. */
1114
1115 uschar * rcpt = transport_rcpt_address(addr,
1116 addr->transport ? addr->transport->rcpt_include_affixes : FALSE);
1117
1118 #ifdef SUPPORT_I18N
1119 /*XXX should the conversion be moved into transport_rcpt_address() ? */
1120 uschar * dummy_errstr = NULL;
1121 if ( testflag(addr, af_utf8_downcvt)
1122 && (rcpt = string_address_utf8_to_alabel(rcpt, &dummy_errstr),
1123 dummy_errstr
1124 ) )
1125 {
1126 errno = ERRNO_EXPANDFAIL;
1127 *failure_ptr = US"recipient";
1128 done = FALSE;
1129 }
1130 else
1131 #endif
1132
1133 done =
1134 smtp_write_command(&outblock, FALSE, "RCPT TO:<%.1000s>\r\n",
1135 rcpt) >= 0 &&
1136 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
1137 '2', callout);
1138
1139 if (done)
1140 new_address_record.result = ccache_accept;
1141 else if (errno == 0 && responsebuffer[0] == '5')
1142 {
1143 *failure_ptr = US"recipient";
1144 new_address_record.result = ccache_reject;
1145 }
1146
1147 /* Do postmaster check if requested; if a full check is required, we
1148 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
1149
1150 if (done && pm_mailfrom != NULL)
1151 {
1152 /* Could possibly shift before main verify, just above, and be ok
1153 for cutthrough. But no way to handle a subsequent rcpt, so just
1154 refuse any */
1155 cancel_cutthrough_connection("postmaster verify");
1156 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of postmaster verify\n");
1157
1158 done =
1159 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
1160 smtp_read_response(&inblock, responsebuffer,
1161 sizeof(responsebuffer), '2', callout) &&
1162
1163 smtp_write_command(&outblock, FALSE,
1164 "MAIL FROM:<%s>\r\n", pm_mailfrom) >= 0 &&
1165 smtp_read_response(&inblock, responsebuffer,
1166 sizeof(responsebuffer), '2', callout) &&
1167
1168 /* First try using the current domain */
1169
1170 ((
1171 smtp_write_command(&outblock, FALSE,
1172 "RCPT TO:<postmaster@%.1000s>\r\n", rcpt_domain) >= 0 &&
1173 smtp_read_response(&inblock, responsebuffer,
1174 sizeof(responsebuffer), '2', callout)
1175 )
1176
1177 ||
1178
1179 /* If that doesn't work, and a full check is requested,
1180 try without the domain. */
1181
1182 (
1183 (options & vopt_callout_fullpm) != 0 &&
1184 smtp_write_command(&outblock, FALSE,
1185 "RCPT TO:<postmaster>\r\n") >= 0 &&
1186 smtp_read_response(&inblock, responsebuffer,
1187 sizeof(responsebuffer), '2', callout)
1188 ));
1189
1190 /* Sort out the cache record */
1191
1192 new_domain_record.postmaster_stamp = time(NULL);
1193
1194 if (done)
1195 new_domain_record.postmaster_result = ccache_accept;
1196 else if (errno == 0 && responsebuffer[0] == '5')
1197 {
1198 *failure_ptr = US"postmaster";
1199 setflag(addr, af_verify_pmfail);
1200 new_domain_record.postmaster_result = ccache_reject;
1201 }
1202 }
1203 } /* Random not accepted */
1204 } /* MAIL FROM: accepted */
1205
1206 /* For any failure of the main check, other than a negative response, we just
1207 close the connection and carry on. We can identify a negative response by the
1208 fact that errno is zero. For I/O errors it will be non-zero
1209
1210 Set up different error texts for logging and for sending back to the caller
1211 as an SMTP response. Log in all cases, using a one-line format. For sender
1212 callouts, give a full response to the caller, but for recipient callouts,
1213 don't give the IP address because this may be an internal host whose identity
1214 is not to be widely broadcast. */
1215
1216 if (!done)
1217 {
1218 if (errno == ETIMEDOUT)
1219 {
1220 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
1221 send_quit = FALSE;
1222 }
1223 #ifdef SUPPORT_I18N
1224 else if (errno == ERRNO_UTF8_FWD)
1225 {
1226 extern int acl_where; /* src/acl.c */
1227 errno = 0;
1228 addr->message = string_sprintf(
1229 "response to \"%s\" from %s [%s] did not include SMTPUTF8",
1230 big_buffer, host->name, host->address);
1231 addr->user_message = acl_where == ACL_WHERE_RCPT
1232 ? US"533 mailbox name not allowed"
1233 : US"550 mailbox unavailable";
1234 yield = FAIL;
1235 done = TRUE;
1236 }
1237 #endif
1238 else if (errno == 0)
1239 {
1240 if (*responsebuffer == 0) Ustrcpy(responsebuffer, US"connection dropped");
1241
1242 addr->message =
1243 string_sprintf("response to \"%s\" from %s [%s] was: %s",
1244 big_buffer, host->name, host->address,
1245 string_printing(responsebuffer));
1246
1247 addr->user_message = options & vopt_is_recipient
1248 ? string_sprintf("Callout verification failed:\n%s", responsebuffer)
1249 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1250 host->address, big_buffer, responsebuffer);
1251
1252 /* Hard rejection ends the process */
1253
1254 if (responsebuffer[0] == '5') /* Address rejected */
1255 {
1256 yield = FAIL;
1257 done = TRUE;
1258 }
1259 }
1260 }
1261
1262 /* End the SMTP conversation and close the connection. */
1263
1264 /* Cutthrough - on a successfull connect and recipient-verify with
1265 use-sender and we are 1st rcpt and have no cutthrough conn so far
1266 here is where we want to leave the conn open */
1267 if ( cutthrough.delivery
1268 && rcpt_count == 1
1269 && done
1270 && yield == OK
1271 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1272 == vopt_callout_recipsender
1273 && !random_local_part
1274 && !pm_mailfrom
1275 && cutthrough.fd < 0
1276 && !lmtp
1277 )
1278 {
1279 HDEBUG(D_acl|D_v) debug_printf("holding verify callout open for cutthrough delivery\n");
1280
1281 cutthrough.fd = outblock.sock; /* We assume no buffer in use in the outblock */
1282 cutthrough.nrcpt = 1;
1283 cutthrough.interface = interface;
1284 cutthrough.host = *host;
1285 cutthrough.addr = *addr; /* Save the address_item for later logging */
1286 cutthrough.addr.next = NULL;
1287 cutthrough.addr.host_used = &cutthrough.host;
1288 if (addr->parent)
1289 *(cutthrough.addr.parent = store_get(sizeof(address_item))) =
1290 *addr->parent;
1291 ctblock.buffer = ctbuffer;
1292 ctblock.buffersize = sizeof(ctbuffer);
1293 ctblock.ptr = ctbuffer;
1294 /* ctblock.cmd_count = 0; ctblock.authenticating = FALSE; */
1295 ctblock.sock = cutthrough.fd;
1296 }
1297 else
1298 {
1299 /* Ensure no cutthrough on multiple address verifies */
1300 if (options & vopt_callout_recipsender)
1301 cancel_cutthrough_connection("not usable for cutthrough");
1302 if (send_quit)
1303 (void) smtp_write_command(&outblock, FALSE, "QUIT\r\n");
1304
1305 #ifdef SUPPORT_TLS
1306 tls_close(FALSE, TRUE);
1307 #endif
1308 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
1309 (void)close(inblock.sock);
1310 #ifndef DISABLE_EVENT
1311 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
1312 #endif
1313 }
1314
1315 } /* Loop through all hosts, while !done */
1316 }
1317
1318 /* If we get here with done == TRUE, a successful callout happened, and yield
1319 will be set OK or FAIL according to the response to the RCPT command.
1320 Otherwise, we looped through the hosts but couldn't complete the business.
1321 However, there may be domain-specific information to cache in both cases.
1322
1323 The value of the result field in the new_domain record is ccache_unknown if
1324 there was an error before or with MAIL FROM:, and errno was not zero,
1325 implying some kind of I/O error. We don't want to write the cache in that case.
1326 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
1327
1328 if ( !(options & vopt_callout_no_cache)
1329 && new_domain_record.result != ccache_unknown)
1330 {
1331 if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
1332 == NULL)
1333 {
1334 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
1335 }
1336 else
1337 {
1338 (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
1339 (int)sizeof(dbdata_callout_cache));
1340 HDEBUG(D_verify) debug_printf("wrote callout cache domain record for %s:\n"
1341 " result=%d postmaster=%d random=%d\n",
1342 addr->domain,
1343 new_domain_record.result,
1344 new_domain_record.postmaster_result,
1345 new_domain_record.random_result);
1346 }
1347 }
1348
1349 /* If a definite result was obtained for the callout, cache it unless caching
1350 is disabled. */
1351
1352 if (done)
1353 {
1354 if ( !(options & vopt_callout_no_cache)
1355 && new_address_record.result != ccache_unknown)
1356 {
1357 if (!dbm_file)
1358 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
1359 if (!dbm_file)
1360 {
1361 HDEBUG(D_verify) debug_printf("no callout cache available\n");
1362 }
1363 else
1364 {
1365 (void)dbfn_write(dbm_file, address_key, &new_address_record,
1366 (int)sizeof(dbdata_callout_cache_address));
1367 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record for %s\n",
1368 new_address_record.result == ccache_accept ? "positive" : "negative",
1369 address_key);
1370 }
1371 }
1372 } /* done */
1373
1374 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1375 temporary error. If there was only one host, and a response was received, leave
1376 it alone if supplying details. Otherwise, give a generic response. */
1377
1378 else /* !done */
1379 {
1380 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
1381 options & vopt_is_recipient ? "recipient" : "sender");
1382 yield = DEFER;
1383
1384 if (host_list->next || !addr->message)
1385 addr->message = dullmsg;
1386
1387 addr->user_message = smtp_return_error_details
1388 ? string_sprintf("%s for <%s>.\n"
1389 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1390 "they may be permanently unreachable from this server. In the latter case,\n%s",
1391 dullmsg, addr->address,
1392 options & vopt_is_recipient
1393 ? "the address will never be accepted."
1394 : "you need to change the address or create an MX record for its domain\n"
1395 "if it is supposed to be generally accessible from the Internet.\n"
1396 "Talk to your mail administrator for details.")
1397 : dullmsg;
1398
1399 /* Force a specific error code */
1400
1401 addr->basic_errno = ERRNO_CALLOUTDEFER;
1402 }
1403
1404 /* Come here from within the cache-reading code on fast-track exit. */
1405
1406 END_CALLOUT:
1407 if (dbm_file) dbfn_close(dbm_file);
1408 return yield;
1409 }
1410
1411
1412
1413 /* Called after recipient-acl to get a cutthrough connection open when
1414 one was requested and a recipient-verify wasn't subsequently done.
1415 */
1416 int
1417 open_cutthrough_connection( address_item * addr )
1418 {
1419 address_item addr2;
1420 int rc;
1421
1422 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1423 /* We must use a copy of the address for verification, because it might
1424 get rewritten. */
1425
1426 addr2 = *addr;
1427 HDEBUG(D_acl) debug_printf("----------- %s cutthrough setup ------------\n",
1428 rcpt_count > 1 ? "more" : "start");
1429 rc = verify_address(&addr2, NULL,
1430 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1431 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1432 NULL, NULL, NULL);
1433 addr->message = addr2.message;
1434 addr->user_message = addr2.user_message;
1435 HDEBUG(D_acl) debug_printf("----------- end cutthrough setup ------------\n");
1436 return rc;
1437 }
1438
1439
1440
1441 /* Send given number of bytes from the buffer */
1442 static BOOL
1443 cutthrough_send(int n)
1444 {
1445 if(cutthrough.fd < 0)
1446 return TRUE;
1447
1448 if(
1449 #ifdef SUPPORT_TLS
1450 (tls_out.active == cutthrough.fd) ? tls_write(FALSE, ctblock.buffer, n) :
1451 #endif
1452 send(cutthrough.fd, ctblock.buffer, n, 0) > 0
1453 )
1454 {
1455 transport_count += n;
1456 ctblock.ptr= ctblock.buffer;
1457 return TRUE;
1458 }
1459
1460 HDEBUG(D_transport|D_acl) debug_printf("cutthrough_send failed: %s\n", strerror(errno));
1461 return FALSE;
1462 }
1463
1464
1465
1466 static BOOL
1467 _cutthrough_puts(uschar * cp, int n)
1468 {
1469 while(n--)
1470 {
1471 if(ctblock.ptr >= ctblock.buffer+ctblock.buffersize)
1472 if(!cutthrough_send(ctblock.buffersize))
1473 return FALSE;
1474
1475 *ctblock.ptr++ = *cp++;
1476 }
1477 return TRUE;
1478 }
1479
1480 /* Buffered output of counted data block. Return boolean success */
1481 BOOL
1482 cutthrough_puts(uschar * cp, int n)
1483 {
1484 if (cutthrough.fd < 0) return TRUE;
1485 if (_cutthrough_puts(cp, n)) return TRUE;
1486 cancel_cutthrough_connection("transmit failed");
1487 return FALSE;
1488 }
1489
1490
1491 static BOOL
1492 _cutthrough_flush_send(void)
1493 {
1494 int n= ctblock.ptr-ctblock.buffer;
1495
1496 if(n>0)
1497 if(!cutthrough_send(n))
1498 return FALSE;
1499 return TRUE;
1500 }
1501
1502
1503 /* Send out any bufferred output. Return boolean success. */
1504 BOOL
1505 cutthrough_flush_send(void)
1506 {
1507 if (_cutthrough_flush_send()) return TRUE;
1508 cancel_cutthrough_connection("transmit failed");
1509 return FALSE;
1510 }
1511
1512
1513 BOOL
1514 cutthrough_put_nl(void)
1515 {
1516 return cutthrough_puts(US"\r\n", 2);
1517 }
1518
1519
1520 /* Get and check response from cutthrough target */
1521 static uschar
1522 cutthrough_response(char expect, uschar ** copy)
1523 {
1524 smtp_inblock inblock;
1525 uschar inbuffer[4096];
1526 uschar responsebuffer[4096];
1527
1528 inblock.buffer = inbuffer;
1529 inblock.buffersize = sizeof(inbuffer);
1530 inblock.ptr = inbuffer;
1531 inblock.ptrend = inbuffer;
1532 inblock.sock = cutthrough.fd;
1533 /* this relies on (inblock.sock == tls_out.active) */
1534 if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, CUTTHROUGH_DATA_TIMEOUT))
1535 cancel_cutthrough_connection("target timeout on read");
1536
1537 if(copy != NULL)
1538 {
1539 uschar * cp;
1540 *copy = cp = string_copy(responsebuffer);
1541 /* Trim the trailing end of line */
1542 cp += Ustrlen(responsebuffer);
1543 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1544 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1545 }
1546
1547 return responsebuffer[0];
1548 }
1549
1550
1551 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1552 BOOL
1553 cutthrough_predata(void)
1554 {
1555 if(cutthrough.fd < 0)
1556 return FALSE;
1557
1558 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> DATA\n");
1559 cutthrough_puts(US"DATA\r\n", 6);
1560 cutthrough_flush_send();
1561
1562 /* Assume nothing buffered. If it was it gets ignored. */
1563 return cutthrough_response('3', NULL) == '3';
1564 }
1565
1566
1567 /* fd and tctx args only to match write_chunk() */
1568 static BOOL
1569 cutthrough_write_chunk(int fd, transport_ctx * tctx, uschar * s, int len)
1570 {
1571 uschar * s2;
1572 while(s && (s2 = Ustrchr(s, '\n')))
1573 {
1574 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1575 return FALSE;
1576 s = s2+1;
1577 }
1578 return TRUE;
1579 }
1580
1581
1582 /* Buffered send of headers. Return success boolean. */
1583 /* Expands newlines to wire format (CR,NL). */
1584 /* Also sends header-terminating blank line. */
1585 BOOL
1586 cutthrough_headers_send(void)
1587 {
1588 transport_ctx tctx;
1589
1590 if(cutthrough.fd < 0)
1591 return FALSE;
1592
1593 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1594 but having a separate buffered-output function (for now)
1595 */
1596 HDEBUG(D_acl) debug_printf("----------- start cutthrough headers send -----------\n");
1597
1598 tctx.tblock = cutthrough.addr.transport;
1599 tctx.addr = &cutthrough.addr;
1600 tctx.check_string = US".";
1601 tctx.escape_string = US"..";
1602 tctx.options = topt_use_crlf;
1603
1604 if (!transport_headers_send(cutthrough.fd, &tctx, &cutthrough_write_chunk))
1605 return FALSE;
1606
1607 HDEBUG(D_acl) debug_printf("----------- done cutthrough headers send ------------\n");
1608 return TRUE;
1609 }
1610
1611
1612 static void
1613 close_cutthrough_connection(const char * why)
1614 {
1615 if(cutthrough.fd >= 0)
1616 {
1617 /* We could be sending this after a bunch of data, but that is ok as
1618 the only way to cancel the transfer in dataphase is to drop the tcp
1619 conn before the final dot.
1620 */
1621 ctblock.ptr = ctbuffer;
1622 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> QUIT\n");
1623 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1624 _cutthrough_flush_send();
1625 /* No wait for response */
1626
1627 #ifdef SUPPORT_TLS
1628 tls_close(FALSE, TRUE);
1629 #endif
1630 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP(close)>>\n");
1631 (void)close(cutthrough.fd);
1632 cutthrough.fd = -1;
1633 HDEBUG(D_acl) debug_printf("----------- cutthrough shutdown (%s) ------------\n", why);
1634 }
1635 ctblock.ptr = ctbuffer;
1636 }
1637
1638 void
1639 cancel_cutthrough_connection(const char * why)
1640 {
1641 close_cutthrough_connection(why);
1642 cutthrough.delivery = FALSE;
1643 }
1644
1645
1646
1647
1648 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1649 Log an OK response as a transmission.
1650 Close the connection.
1651 Return smtp response-class digit.
1652 */
1653 uschar *
1654 cutthrough_finaldot(void)
1655 {
1656 uschar res;
1657 address_item * addr;
1658 HDEBUG(D_transport|D_acl|D_v) debug_printf(" SMTP>> .\n");
1659
1660 /* Assume data finshed with new-line */
1661 if( !cutthrough_puts(US".", 1)
1662 || !cutthrough_put_nl()
1663 || !cutthrough_flush_send()
1664 )
1665 return cutthrough.addr.message;
1666
1667 res = cutthrough_response('2', &cutthrough.addr.message);
1668 for (addr = &cutthrough.addr; addr; addr = addr->next)
1669 {
1670 addr->message = cutthrough.addr.message;
1671 switch(res)
1672 {
1673 case '2':
1674 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1675 close_cutthrough_connection("delivered");
1676 break;
1677
1678 case '4':
1679 delivery_log(LOG_MAIN, addr, 0,
1680 US"tmp-reject from cutthrough after DATA:");
1681 break;
1682
1683 case '5':
1684 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1685 US"rejected after DATA:");
1686 break;
1687
1688 default:
1689 break;
1690 }
1691 }
1692 return cutthrough.addr.message;
1693 }
1694
1695
1696
1697 /*************************************************
1698 * Copy error to toplevel address *
1699 *************************************************/
1700
1701 /* This function is used when a verify fails or defers, to ensure that the
1702 failure or defer information is in the original toplevel address. This applies
1703 when an address is redirected to a single new address, and the failure or
1704 deferral happens to the child address.
1705
1706 Arguments:
1707 vaddr the verify address item
1708 addr the final address item
1709 yield FAIL or DEFER
1710
1711 Returns: the value of YIELD
1712 */
1713
1714 static int
1715 copy_error(address_item *vaddr, address_item *addr, int yield)
1716 {
1717 if (addr != vaddr)
1718 {
1719 vaddr->message = addr->message;
1720 vaddr->user_message = addr->user_message;
1721 vaddr->basic_errno = addr->basic_errno;
1722 vaddr->more_errno = addr->more_errno;
1723 vaddr->prop.address_data = addr->prop.address_data;
1724 copyflag(vaddr, addr, af_pass_message);
1725 }
1726 return yield;
1727 }
1728
1729
1730
1731
1732 /**************************************************
1733 * printf that automatically handles TLS if needed *
1734 ***************************************************/
1735
1736 /* This function is used by verify_address() as a substitute for all fprintf()
1737 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1738 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1739 that assumes that we always use the smtp_out FILE* when not using TLS or the
1740 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1741 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1742 fprintf().
1743
1744 Arguments:
1745 f the candidate FILE* to write to
1746 format format string
1747 ... optional arguments
1748
1749 Returns:
1750 nothing
1751 */
1752
1753 static void PRINTF_FUNCTION(2,3)
1754 respond_printf(FILE *f, const char *format, ...)
1755 {
1756 va_list ap;
1757
1758 va_start(ap, format);
1759 if (smtp_out && (f == smtp_out))
1760 smtp_vprintf(format, ap);
1761 else
1762 vfprintf(f, format, ap);
1763 va_end(ap);
1764 }
1765
1766
1767
1768 /*************************************************
1769 * Verify an email address *
1770 *************************************************/
1771
1772 /* This function is used both for verification (-bv and at other times) and
1773 address testing (-bt), which is indicated by address_test_mode being set.
1774
1775 Arguments:
1776 vaddr contains the address to verify; the next field in this block
1777 must be NULL
1778 f if not NULL, write the result to this file
1779 options various option bits:
1780 vopt_fake_sender => this sender verify is not for the real
1781 sender (it was verify=sender=xxxx or an address from a
1782 header line) - rewriting must not change sender_address
1783 vopt_is_recipient => this is a recipient address, otherwise
1784 it's a sender address - this affects qualification and
1785 rewriting and messages from callouts
1786 vopt_qualify => qualify an unqualified address; else error
1787 vopt_expn => called from SMTP EXPN command
1788 vopt_success_on_redirect => when a new address is generated
1789 the verification instantly succeeds
1790
1791 These ones are used by do_callout() -- the options variable
1792 is passed to it.
1793
1794 vopt_callout_fullpm => if postmaster check, do full one
1795 vopt_callout_no_cache => don't use callout cache
1796 vopt_callout_random => do the "random" thing
1797 vopt_callout_recipsender => use real sender for recipient
1798 vopt_callout_recippmaster => use postmaster for recipient
1799
1800 callout if > 0, specifies that callout is required, and gives timeout
1801 for individual commands
1802 callout_overall if > 0, gives overall timeout for the callout function;
1803 if < 0, a default is used (see do_callout())
1804 callout_connect the connection timeout for callouts
1805 se_mailfrom when callout is requested to verify a sender, use this
1806 in MAIL FROM; NULL => ""
1807 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1808 thing and use this as the sender address (may be "")
1809
1810 routed if not NULL, set TRUE if routing succeeded, so we can
1811 distinguish between routing failed and callout failed
1812
1813 Returns: OK address verified
1814 FAIL address failed to verify
1815 DEFER can't tell at present
1816 */
1817
1818 int
1819 verify_address(address_item *vaddr, FILE *f, int options, int callout,
1820 int callout_overall, int callout_connect, uschar *se_mailfrom,
1821 uschar *pm_mailfrom, BOOL *routed)
1822 {
1823 BOOL allok = TRUE;
1824 BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
1825 BOOL expn = (options & vopt_expn) != 0;
1826 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1827 int i;
1828 int yield = OK;
1829 int verify_type = expn? v_expn :
1830 address_test_mode? v_none :
1831 options & vopt_is_recipient? v_recipient : v_sender;
1832 address_item *addr_list;
1833 address_item *addr_new = NULL;
1834 address_item *addr_remote = NULL;
1835 address_item *addr_local = NULL;
1836 address_item *addr_succeed = NULL;
1837 uschar **failure_ptr = options & vopt_is_recipient
1838 ? &recipient_verify_failure : &sender_verify_failure;
1839 uschar *ko_prefix, *cr;
1840 uschar *address = vaddr->address;
1841 uschar *save_sender;
1842 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1843
1844 /* Clear, just in case */
1845
1846 *failure_ptr = NULL;
1847
1848 /* Set up a prefix and suffix for error message which allow us to use the same
1849 output statements both in EXPN mode (where an SMTP response is needed) and when
1850 debugging with an output file. */
1851
1852 if (expn)
1853 {
1854 ko_prefix = US"553 ";
1855 cr = US"\r";
1856 }
1857 else ko_prefix = cr = US"";
1858
1859 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1860
1861 if (parse_find_at(address) == NULL)
1862 {
1863 if ((options & vopt_qualify) == 0)
1864 {
1865 if (f != NULL)
1866 respond_printf(f, "%sA domain is required for \"%s\"%s\n",
1867 ko_prefix, address, cr);
1868 *failure_ptr = US"qualify";
1869 return FAIL;
1870 }
1871 address = rewrite_address_qualify(address, options & vopt_is_recipient);
1872 }
1873
1874 DEBUG(D_verify)
1875 {
1876 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1877 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
1878 }
1879
1880 /* Rewrite and report on it. Clear the domain and local part caches - these
1881 may have been set by domains and local part tests during an ACL. */
1882
1883 if (global_rewrite_rules != NULL)
1884 {
1885 uschar *old = address;
1886 address = rewrite_address(address, options & vopt_is_recipient, FALSE,
1887 global_rewrite_rules, rewrite_existflags);
1888 if (address != old)
1889 {
1890 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1891 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1892 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
1893 }
1894 }
1895
1896 /* If this is the real sender address, we must update sender_address at
1897 this point, because it may be referred to in the routers. */
1898
1899 if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
1900 sender_address = address;
1901
1902 /* If the address was rewritten to <> no verification can be done, and we have
1903 to return OK. This rewriting is permitted only for sender addresses; for other
1904 addresses, such rewriting fails. */
1905
1906 if (address[0] == 0) return OK;
1907
1908 /* Flip the legacy TLS-related variables over to the outbound set in case
1909 they're used in the context of a transport used by verification. Reset them
1910 at exit from this routine (so no returns allowed from here on). */
1911
1912 tls_modify_variables(&tls_out);
1913
1914 /* Save a copy of the sender address for re-instating if we change it to <>
1915 while verifying a sender address (a nice bit of self-reference there). */
1916
1917 save_sender = sender_address;
1918
1919 /* Observability variable for router/transport use */
1920
1921 verify_mode = options & vopt_is_recipient ? US"R" : US"S";
1922
1923 /* Update the address structure with the possibly qualified and rewritten
1924 address. Set it up as the starting address on the chain of new addresses. */
1925
1926 vaddr->address = address;
1927 addr_new = vaddr;
1928
1929 /* We need a loop, because an address can generate new addresses. We must also
1930 cope with generated pipes and files at the top level. (See also the code and
1931 comment in deliver.c.) However, it is usually the case that the router for
1932 user's .forward files has its verify flag turned off.
1933
1934 If an address generates more than one child, the loop is used only when
1935 full_info is set, and this can only be set locally. Remote enquiries just get
1936 information about the top level address, not anything that it generated. */
1937
1938 while (addr_new)
1939 {
1940 int rc;
1941 address_item *addr = addr_new;
1942
1943 addr_new = addr->next;
1944 addr->next = NULL;
1945
1946 DEBUG(D_verify)
1947 {
1948 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1949 debug_printf("Considering %s\n", addr->address);
1950 }
1951
1952 /* Handle generated pipe, file or reply addresses. We don't get these
1953 when handling EXPN, as it does only one level of expansion. */
1954
1955 if (testflag(addr, af_pfr))
1956 {
1957 allok = FALSE;
1958 if (f != NULL)
1959 {
1960 BOOL allow;
1961
1962 if (addr->address[0] == '>')
1963 {
1964 allow = testflag(addr, af_allow_reply);
1965 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1966 }
1967 else
1968 {
1969 allow = (addr->address[0] == '|')?
1970 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1971 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1972 }
1973
1974 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1975 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1976 "%s\n", addr->message);
1977 else if (allow)
1978 fprintf(f, "\n transport = %s\n", addr->transport->name);
1979 else
1980 fprintf(f, " *** forbidden ***\n");
1981 }
1982 continue;
1983 }
1984
1985 /* Just in case some router parameter refers to it. */
1986
1987 return_path = addr->prop.errors_address
1988 ? addr->prop.errors_address : sender_address;
1989
1990 /* Split the address into domain and local part, handling the %-hack if
1991 necessary, and then route it. While routing a sender address, set
1992 $sender_address to <> because that is what it will be if we were trying to
1993 send a bounce to the sender. */
1994
1995 if (routed) *routed = FALSE;
1996 if ((rc = deliver_split_address(addr)) == OK)
1997 {
1998 if (!(options & vopt_is_recipient)) sender_address = null_sender;
1999 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
2000 &addr_succeed, verify_type);
2001 sender_address = save_sender; /* Put back the real sender */
2002 }
2003
2004 /* If routing an address succeeded, set the flag that remembers, for use when
2005 an ACL cached a sender verify (in case a callout fails). Then if routing set
2006 up a list of hosts or the transport has a host list, and the callout option
2007 is set, and we aren't in a host checking run, do the callout verification,
2008 and set another flag that notes that a callout happened. */
2009
2010 if (rc == OK)
2011 {
2012 if (routed) *routed = TRUE;
2013 if (callout > 0)
2014 {
2015 transport_instance * tp;
2016 host_item * host_list = addr->host_list;
2017
2018 /* Make up some data for use in the case where there is no remote
2019 transport. */
2020
2021 transport_feedback tf = {
2022 NULL, /* interface (=> any) */
2023 US"smtp", /* port */
2024 US"smtp", /* protocol */
2025 NULL, /* hosts */
2026 US"$smtp_active_hostname", /* helo_data */
2027 FALSE, /* hosts_override */
2028 FALSE, /* hosts_randomize */
2029 FALSE, /* gethostbyname */
2030 TRUE, /* qualify_single */
2031 FALSE /* search_parents */
2032 };
2033
2034 /* If verification yielded a remote transport, we want to use that
2035 transport's options, so as to mimic what would happen if we were really
2036 sending a message to this address. */
2037
2038 if ((tp = addr->transport) && !tp->info->local)
2039 {
2040 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
2041
2042 /* If the transport has hosts and the router does not, or if the
2043 transport is configured to override the router's hosts, we must build a
2044 host list of the transport's hosts, and find the IP addresses */
2045
2046 if (tf.hosts && (!host_list || tf.hosts_override))
2047 {
2048 uschar *s;
2049 const uschar *save_deliver_domain = deliver_domain;
2050 uschar *save_deliver_localpart = deliver_localpart;
2051
2052 host_list = NULL; /* Ignore the router's hosts */
2053
2054 deliver_domain = addr->domain;
2055 deliver_localpart = addr->local_part;
2056 s = expand_string(tf.hosts);
2057 deliver_domain = save_deliver_domain;
2058 deliver_localpart = save_deliver_localpart;
2059
2060 if (!s)
2061 {
2062 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
2063 "\"%s\" in %s transport for callout: %s", tf.hosts,
2064 tp->name, expand_string_message);
2065 }
2066 else
2067 {
2068 int flags;
2069 host_item *host, *nexthost;
2070 host_build_hostlist(&host_list, s, tf.hosts_randomize);
2071
2072 /* Just ignore failures to find a host address. If we don't manage
2073 to find any addresses, the callout will defer. Note that more than
2074 one address may be found for a single host, which will result in
2075 additional host items being inserted into the chain. Hence we must
2076 save the next host first. */
2077
2078 flags = HOST_FIND_BY_A;
2079 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
2080 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
2081
2082 for (host = host_list; host; host = nexthost)
2083 {
2084 nexthost = host->next;
2085 if (tf.gethostbyname ||
2086 string_is_ip_address(host->name, NULL) != 0)
2087 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
2088 else
2089 {
2090 dnssec_domains * dnssec_domains = NULL;
2091 if (Ustrcmp(tp->driver_name, "smtp") == 0)
2092 {
2093 smtp_transport_options_block * ob =
2094 (smtp_transport_options_block *) tp->options_block;
2095 dnssec_domains = &ob->dnssec;
2096 }
2097
2098 (void)host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
2099 dnssec_domains, NULL, NULL);
2100 }
2101 }
2102 }
2103 }
2104 }
2105
2106 /* Can only do a callout if we have at least one host! If the callout
2107 fails, it will have set ${sender,recipient}_verify_failure. */
2108
2109 if (host_list)
2110 {
2111 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
2112 if (host_checking && !host_checking_callout)
2113 {
2114 HDEBUG(D_verify)
2115 debug_printf("... callout omitted by default when host testing\n"
2116 "(Use -bhc if you want the callouts to happen.)\n");
2117 }
2118 else
2119 {
2120 #ifdef SUPPORT_TLS
2121 deliver_set_expansions(addr);
2122 #endif
2123 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
2124 callout_connect, options, se_mailfrom, pm_mailfrom);
2125 }
2126 }
2127 else
2128 {
2129 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
2130 "transport provided a host list\n");
2131 }
2132 }
2133 }
2134
2135 /* Otherwise, any failure is a routing failure */
2136
2137 else *failure_ptr = US"route";
2138
2139 /* A router may return REROUTED if it has set up a child address as a result
2140 of a change of domain name (typically from widening). In this case we always
2141 want to continue to verify the new child. */
2142
2143 if (rc == REROUTED) continue;
2144
2145 /* Handle hard failures */
2146
2147 if (rc == FAIL)
2148 {
2149 allok = FALSE;
2150 if (f)
2151 {
2152 address_item *p = addr->parent;
2153
2154 respond_printf(f, "%s%s %s", ko_prefix,
2155 full_info ? addr->address : address,
2156 address_test_mode ? "is undeliverable" : "failed to verify");
2157 if (!expn && admin_user)
2158 {
2159 if (addr->basic_errno > 0)
2160 respond_printf(f, ": %s", strerror(addr->basic_errno));
2161 if (addr->message)
2162 respond_printf(f, ": %s", addr->message);
2163 }
2164
2165 /* Show parents iff doing full info */
2166
2167 if (full_info) while (p)
2168 {
2169 respond_printf(f, "%s\n <-- %s", cr, p->address);
2170 p = p->parent;
2171 }
2172 respond_printf(f, "%s\n", cr);
2173 }
2174 cancel_cutthrough_connection("routing hard fail");
2175
2176 if (!full_info)
2177 {
2178 yield = copy_error(vaddr, addr, FAIL);
2179 goto out;
2180 }
2181 yield = FAIL;
2182 }
2183
2184 /* Soft failure */
2185
2186 else if (rc == DEFER)
2187 {
2188 allok = FALSE;
2189 if (f)
2190 {
2191 address_item *p = addr->parent;
2192 respond_printf(f, "%s%s cannot be resolved at this time", ko_prefix,
2193 full_info? addr->address : address);
2194 if (!expn && admin_user)
2195 {
2196 if (addr->basic_errno > 0)
2197 respond_printf(f, ": %s", strerror(addr->basic_errno));
2198 if (addr->message)
2199 respond_printf(f, ": %s", addr->message);
2200 else if (addr->basic_errno <= 0)
2201 respond_printf(f, ": unknown error");
2202 }
2203
2204 /* Show parents iff doing full info */
2205
2206 if (full_info) while (p)
2207 {
2208 respond_printf(f, "%s\n <-- %s", cr, p->address);
2209 p = p->parent;
2210 }
2211 respond_printf(f, "%s\n", cr);
2212 }
2213 cancel_cutthrough_connection("routing soft fail");
2214
2215 if (!full_info)
2216 {
2217 yield = copy_error(vaddr, addr, DEFER);
2218 goto out;
2219 }
2220 if (yield == OK) yield = DEFER;
2221 }
2222
2223 /* If we are handling EXPN, we do not want to continue to route beyond
2224 the top level (whose address is in "address"). */
2225
2226 else if (expn)
2227 {
2228 uschar *ok_prefix = US"250-";
2229
2230 if (!addr_new)
2231 if (!addr_local && !addr_remote)
2232 respond_printf(f, "250 mail to <%s> is discarded\r\n", address);
2233 else
2234 respond_printf(f, "250 <%s>\r\n", address);
2235
2236 else do
2237 {
2238 address_item *addr2 = addr_new;
2239 addr_new = addr2->next;
2240 if (!addr_new) ok_prefix = US"250 ";
2241 respond_printf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
2242 } while (addr_new);
2243 yield = OK;
2244 goto out;
2245 }
2246
2247 /* Successful routing other than EXPN. */
2248
2249 else
2250 {
2251 /* Handle successful routing when short info wanted. Otherwise continue for
2252 other (generated) addresses. Short info is the operational case. Full info
2253 can be requested only when debug_selector != 0 and a file is supplied.
2254
2255 There is a conflict between the use of aliasing as an alternate email
2256 address, and as a sort of mailing list. If an alias turns the incoming
2257 address into just one address (e.g. J.Caesar->jc44) you may well want to
2258 carry on verifying the generated address to ensure it is valid when
2259 checking incoming mail. If aliasing generates multiple addresses, you
2260 probably don't want to do this. Exim therefore treats the generation of
2261 just a single new address as a special case, and continues on to verify the
2262 generated address. */
2263
2264 if ( !full_info /* Stop if short info wanted AND */
2265 && ( ( !addr_new /* No new address OR */
2266 || addr_new->next /* More than one new address OR */
2267 || testflag(addr_new, af_pfr) /* New address is pfr */
2268 )
2269 || /* OR */
2270 ( addr_new /* At least one new address AND */
2271 && success_on_redirect /* success_on_redirect is set */
2272 ) )
2273 )
2274 {
2275 if (f) fprintf(f, "%s %s\n",
2276 address, address_test_mode ? "is deliverable" : "verified");
2277
2278 /* If we have carried on to verify a child address, we want the value
2279 of $address_data to be that of the child */
2280
2281 vaddr->prop.address_data = addr->prop.address_data;
2282
2283 /* If stopped because more than one new address, cannot cutthrough */
2284
2285 if (addr_new && addr_new->next)
2286 cancel_cutthrough_connection("multiple addresses from routing");
2287
2288 yield = OK;
2289 goto out;
2290 }
2291 }
2292 } /* Loop for generated addresses */
2293
2294 /* Display the full results of the successful routing, including any generated
2295 addresses. Control gets here only when full_info is set, which requires f not
2296 to be NULL, and this occurs only when a top-level verify is called with the
2297 debugging switch on.
2298
2299 If there are no local and no remote addresses, and there were no pipes, files,
2300 or autoreplies, and there were no errors or deferments, the message is to be
2301 discarded, usually because of the use of :blackhole: in an alias file. */
2302
2303 if (allok && !addr_local && !addr_remote)
2304 {
2305 fprintf(f, "mail to %s is discarded\n", address);
2306 goto out;
2307 }
2308
2309 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2310 while (addr_list)
2311 {
2312 address_item *addr = addr_list;
2313 address_item *p = addr->parent;
2314 transport_instance * tp = addr->transport;
2315
2316 addr_list = addr->next;
2317
2318 fprintf(f, "%s", CS addr->address);
2319 #ifdef EXPERIMENTAL_SRS
2320 if(addr->prop.srs_sender)
2321 fprintf(f, " [srs = %s]", addr->prop.srs_sender);
2322 #endif
2323
2324 /* If the address is a duplicate, show something about it. */
2325
2326 if (!testflag(addr, af_pfr))
2327 {
2328 tree_node *tnode;
2329 if ((tnode = tree_search(tree_duplicates, addr->unique)))
2330 fprintf(f, " [duplicate, would not be delivered]");
2331 else tree_add_duplicate(addr->unique, addr);
2332 }
2333
2334 /* Now show its parents */
2335
2336 for (p = addr->parent; p; p = p->parent)
2337 fprintf(f, "\n <-- %s", p->address);
2338 fprintf(f, "\n ");
2339
2340 /* Show router, and transport */
2341
2342 fprintf(f, "router = %s, transport = %s\n",
2343 addr->router->name, tp ? tp->name : US"unset");
2344
2345 /* Show any hosts that are set up by a router unless the transport
2346 is going to override them; fiddle a bit to get a nice format. */
2347
2348 if (addr->host_list && tp && !tp->overrides_hosts)
2349 {
2350 host_item *h;
2351 int maxlen = 0;
2352 int maxaddlen = 0;
2353 for (h = addr->host_list; h; h = h->next)
2354 { /* get max lengths of host names, addrs */
2355 int len = Ustrlen(h->name);
2356 if (len > maxlen) maxlen = len;
2357 len = h->address ? Ustrlen(h->address) : 7;
2358 if (len > maxaddlen) maxaddlen = len;
2359 }
2360 for (h = addr->host_list; h; h = h->next)
2361 {
2362 fprintf(f, " host %-*s ", maxlen, h->name);
2363
2364 if (h->address)
2365 fprintf(f, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2366 else if (tp->info->local)
2367 fprintf(f, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2368 else
2369 fprintf(f, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2370
2371 if (h->mx >= 0) fprintf(f, " MX=%d", h->mx);
2372 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
2373 if (running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", f);
2374 if (h->status == hstatus_unusable) fputs(" ** unusable **", f);
2375 fputc('\n', f);
2376 }
2377 }
2378 }
2379
2380 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2381 the -bv or -bt case). */
2382
2383 out:
2384 verify_mode = NULL;
2385 tls_modify_variables(&tls_in);
2386
2387 return yield;
2388 }
2389
2390
2391
2392
2393 /*************************************************
2394 * Check headers for syntax errors *
2395 *************************************************/
2396
2397 /* This function checks those header lines that contain addresses, and verifies
2398 that all the addresses therein are syntactially correct.
2399
2400 Arguments:
2401 msgptr where to put an error message
2402
2403 Returns: OK
2404 FAIL
2405 */
2406
2407 int
2408 verify_check_headers(uschar **msgptr)
2409 {
2410 header_line *h;
2411 uschar *colon, *s;
2412 int yield = OK;
2413
2414 for (h = header_list; h != NULL && yield == OK; h = h->next)
2415 {
2416 if (h->type != htype_from &&
2417 h->type != htype_reply_to &&
2418 h->type != htype_sender &&
2419 h->type != htype_to &&
2420 h->type != htype_cc &&
2421 h->type != htype_bcc)
2422 continue;
2423
2424 colon = Ustrchr(h->text, ':');
2425 s = colon + 1;
2426 while (isspace(*s)) s++;
2427
2428 /* Loop for multiple addresses in the header, enabling group syntax. Note
2429 that we have to reset this after the header has been scanned. */
2430
2431 parse_allow_group = TRUE;
2432
2433 while (*s != 0)
2434 {
2435 uschar *ss = parse_find_address_end(s, FALSE);
2436 uschar *recipient, *errmess;
2437 int terminator = *ss;
2438 int start, end, domain;
2439
2440 /* Temporarily terminate the string at this point, and extract the
2441 operative address within, allowing group syntax. */
2442
2443 *ss = 0;
2444 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2445 *ss = terminator;
2446
2447 /* Permit an unqualified address only if the message is local, or if the
2448 sending host is configured to be permitted to send them. */
2449
2450 if (recipient != NULL && domain == 0)
2451 {
2452 if (h->type == htype_from || h->type == htype_sender)
2453 {
2454 if (!allow_unqualified_sender) recipient = NULL;
2455 }
2456 else
2457 {
2458 if (!allow_unqualified_recipient) recipient = NULL;
2459 }
2460 if (recipient == NULL) errmess = US"unqualified address not permitted";
2461 }
2462
2463 /* It's an error if no address could be extracted, except for the special
2464 case of an empty address. */
2465
2466 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
2467 {
2468 uschar *verb = US"is";
2469 uschar *t = ss;
2470 uschar *tt = colon;
2471 int len;
2472
2473 /* Arrange not to include any white space at the end in the
2474 error message or the header name. */
2475
2476 while (t > s && isspace(t[-1])) t--;
2477 while (tt > h->text && isspace(tt[-1])) tt--;
2478
2479 /* Add the address that failed to the error message, since in a
2480 header with very many addresses it is sometimes hard to spot
2481 which one is at fault. However, limit the amount of address to
2482 quote - cases have been seen where, for example, a missing double
2483 quote in a humungous To: header creates an "address" that is longer
2484 than string_sprintf can handle. */
2485
2486 len = t - s;
2487 if (len > 1024)
2488 {
2489 len = 1024;
2490 verb = US"begins";
2491 }
2492
2493 /* deconst cast ok as we're passing a non-const to string_printing() */
2494 *msgptr = US string_printing(
2495 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2496 errmess, tt - h->text, h->text, verb, len, s));
2497
2498 yield = FAIL;
2499 break; /* Out of address loop */
2500 }
2501
2502 /* Advance to the next address */
2503
2504 s = ss + (terminator? 1:0);
2505 while (isspace(*s)) s++;
2506 } /* Next address */
2507
2508 parse_allow_group = FALSE;
2509 parse_found_group = FALSE;
2510 } /* Next header unless yield has been set FALSE */
2511
2512 return yield;
2513 }
2514
2515
2516 /*************************************************
2517 * Check header names for 8-bit characters *
2518 *************************************************/
2519
2520 /* This function checks for invalid charcters in header names. See
2521 RFC 5322, 2.2. and RFC 6532, 3.
2522
2523 Arguments:
2524 msgptr where to put an error message
2525
2526 Returns: OK
2527 FAIL
2528 */
2529
2530 int
2531 verify_check_header_names_ascii(uschar **msgptr)
2532 {
2533 header_line *h;
2534 uschar *colon, *s;
2535
2536 for (h = header_list; h != NULL; h = h->next)
2537 {
2538 colon = Ustrchr(h->text, ':');
2539 for(s = h->text; s < colon; s++)
2540 {
2541 if ((*s < 33) || (*s > 126))
2542 {
2543 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2544 colon - h->text, h->text);
2545 return FAIL;
2546 }
2547 }
2548 }
2549 return OK;
2550 }
2551
2552 /*************************************************
2553 * Check for blind recipients *
2554 *************************************************/
2555
2556 /* This function checks that every (envelope) recipient is mentioned in either
2557 the To: or Cc: header lines, thus detecting blind carbon copies.
2558
2559 There are two ways of scanning that could be used: either scan the header lines
2560 and tick off the recipients, or scan the recipients and check the header lines.
2561 The original proposed patch did the former, but I have chosen to do the latter,
2562 because (a) it requires no memory and (b) will use fewer resources when there
2563 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2564
2565 Arguments: none
2566 Returns: OK if there are no blind recipients
2567 FAIL if there is at least one blind recipient
2568 */
2569
2570 int
2571 verify_check_notblind(void)
2572 {
2573 int i;
2574 for (i = 0; i < recipients_count; i++)
2575 {
2576 header_line *h;
2577 BOOL found = FALSE;
2578 uschar *address = recipients_list[i].address;
2579
2580 for (h = header_list; !found && h != NULL; h = h->next)
2581 {
2582 uschar *colon, *s;
2583
2584 if (h->type != htype_to && h->type != htype_cc) continue;
2585
2586 colon = Ustrchr(h->text, ':');
2587 s = colon + 1;
2588 while (isspace(*s)) s++;
2589
2590 /* Loop for multiple addresses in the header, enabling group syntax. Note
2591 that we have to reset this after the header has been scanned. */
2592
2593 parse_allow_group = TRUE;
2594
2595 while (*s != 0)
2596 {
2597 uschar *ss = parse_find_address_end(s, FALSE);
2598 uschar *recipient,*errmess;
2599 int terminator = *ss;
2600 int start, end, domain;
2601
2602 /* Temporarily terminate the string at this point, and extract the
2603 operative address within, allowing group syntax. */
2604
2605 *ss = 0;
2606 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2607 *ss = terminator;
2608
2609 /* If we found a valid recipient that has a domain, compare it with the
2610 envelope recipient. Local parts are compared case-sensitively, domains
2611 case-insensitively. By comparing from the start with length "domain", we
2612 include the "@" at the end, which ensures that we are comparing the whole
2613 local part of each address. */
2614
2615 if (recipient != NULL && domain != 0)
2616 {
2617 found = Ustrncmp(recipient, address, domain) == 0 &&
2618 strcmpic(recipient + domain, address + domain) == 0;
2619 if (found) break;
2620 }
2621
2622 /* Advance to the next address */
2623
2624 s = ss + (terminator? 1:0);
2625 while (isspace(*s)) s++;
2626 } /* Next address */
2627
2628 parse_allow_group = FALSE;
2629 parse_found_group = FALSE;
2630 } /* Next header (if found is false) */
2631
2632 if (!found) return FAIL;
2633 } /* Next recipient */
2634
2635 return OK;
2636 }
2637
2638
2639
2640 /*************************************************
2641 * Find if verified sender *
2642 *************************************************/
2643
2644 /* Usually, just a single address is verified as the sender of the message.
2645 However, Exim can be made to verify other addresses as well (often related in
2646 some way), and this is useful in some environments. There may therefore be a
2647 chain of such addresses that have previously been tested. This function finds
2648 whether a given address is on the chain.
2649
2650 Arguments: the address to be verified
2651 Returns: pointer to an address item, or NULL
2652 */
2653
2654 address_item *
2655 verify_checked_sender(uschar *sender)
2656 {
2657 address_item *addr;
2658 for (addr = sender_verified_list; addr != NULL; addr = addr->next)
2659 if (Ustrcmp(sender, addr->address) == 0) break;
2660 return addr;
2661 }
2662
2663
2664
2665
2666
2667 /*************************************************
2668 * Get valid header address *
2669 *************************************************/
2670
2671 /* Scan the originator headers of the message, looking for an address that
2672 verifies successfully. RFC 822 says:
2673
2674 o The "Sender" field mailbox should be sent notices of
2675 any problems in transport or delivery of the original
2676 messages. If there is no "Sender" field, then the
2677 "From" field mailbox should be used.
2678
2679 o If the "Reply-To" field exists, then the reply should
2680 go to the addresses indicated in that field and not to
2681 the address(es) indicated in the "From" field.
2682
2683 So we check a Sender field if there is one, else a Reply_to field, else a From
2684 field. As some strange messages may have more than one of these fields,
2685 especially if they are resent- fields, check all of them if there is more than
2686 one.
2687
2688 Arguments:
2689 user_msgptr points to where to put a user error message
2690 log_msgptr points to where to put a log error message
2691 callout timeout for callout check (passed to verify_address())
2692 callout_overall overall callout timeout (ditto)
2693 callout_connect connect callout timeout (ditto)
2694 se_mailfrom mailfrom for verify; NULL => ""
2695 pm_mailfrom sender for pm callout check (passed to verify_address())
2696 options callout options (passed to verify_address())
2697 verrno where to put the address basic_errno
2698
2699 If log_msgptr is set to something without setting user_msgptr, the caller
2700 normally uses log_msgptr for both things.
2701
2702 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2703 FAIL is given if no appropriate headers are found
2704 */
2705
2706 int
2707 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2708 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2709 uschar *pm_mailfrom, int options, int *verrno)
2710 {
2711 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2712 BOOL done = FALSE;
2713 int yield = FAIL;
2714 int i;
2715
2716 for (i = 0; i < 3 && !done; i++)
2717 {
2718 header_line *h;
2719 for (h = header_list; h != NULL && !done; h = h->next)
2720 {
2721 int terminator, new_ok;
2722 uschar *s, *ss, *endname;
2723
2724 if (h->type != header_types[i]) continue;
2725 s = endname = Ustrchr(h->text, ':') + 1;
2726
2727 /* Scan the addresses in the header, enabling group syntax. Note that we
2728 have to reset this after the header has been scanned. */
2729
2730 parse_allow_group = TRUE;
2731
2732 while (*s != 0)
2733 {
2734 address_item *vaddr;
2735
2736 while (isspace(*s) || *s == ',') s++;
2737 if (*s == 0) break; /* End of header */
2738
2739 ss = parse_find_address_end(s, FALSE);
2740
2741 /* The terminator is a comma or end of header, but there may be white
2742 space preceding it (including newline for the last address). Move back
2743 past any white space so we can check against any cached envelope sender
2744 address verifications. */
2745
2746 while (isspace(ss[-1])) ss--;
2747 terminator = *ss;
2748 *ss = 0;
2749
2750 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2751 (int)(endname - h->text), h->text, s);
2752
2753 /* See if we have already verified this address as an envelope sender,
2754 and if so, use the previous answer. */
2755
2756 vaddr = verify_checked_sender(s);
2757
2758 if (vaddr != NULL && /* Previously checked */
2759 (callout <= 0 || /* No callout needed; OR */
2760 vaddr->special_action > 256)) /* Callout was done */
2761 {
2762 new_ok = vaddr->special_action & 255;
2763 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2764 *ss = terminator; /* Restore shortened string */
2765 }
2766
2767 /* Otherwise we run the verification now. We must restore the shortened
2768 string before running the verification, so the headers are correct, in
2769 case there is any rewriting. */
2770
2771 else
2772 {
2773 int start, end, domain;
2774 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2775 &domain, FALSE);
2776
2777 *ss = terminator;
2778
2779 /* If we found an empty address, just carry on with the next one, but
2780 kill the message. */
2781
2782 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2783 {
2784 *log_msgptr = NULL;
2785 s = ss;
2786 continue;
2787 }
2788
2789 /* If verification failed because of a syntax error, fail this
2790 function, and ensure that the failing address gets added to the error
2791 message. */
2792
2793 if (address == NULL)
2794 {
2795 new_ok = FAIL;
2796 while (ss > s && isspace(ss[-1])) ss--;
2797 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2798 "scanning for sender: %s in \"%.*s\"",
2799 endname - h->text, h->text, *log_msgptr, ss - s, s);
2800 yield = FAIL;
2801 done = TRUE;
2802 break;
2803 }
2804
2805 /* Else go ahead with the sender verification. But it isn't *the*
2806 sender of the message, so set vopt_fake_sender to stop sender_address
2807 being replaced after rewriting or qualification. */
2808
2809 else
2810 {
2811 vaddr = deliver_make_addr(address, FALSE);
2812 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2813 callout, callout_overall, callout_connect, se_mailfrom,
2814 pm_mailfrom, NULL);
2815 }
2816 }
2817
2818 /* We now have the result, either newly found, or cached. If we are
2819 giving out error details, set a specific user error. This means that the
2820 last of these will be returned to the user if all three fail. We do not
2821 set a log message - the generic one below will be used. */
2822
2823 if (new_ok != OK)
2824 {
2825 *verrno = vaddr->basic_errno;
2826 if (smtp_return_error_details)
2827 {
2828 *user_msgptr = string_sprintf("Rejected after DATA: "
2829 "could not verify \"%.*s\" header address\n%s: %s",
2830 endname - h->text, h->text, vaddr->address, vaddr->message);
2831 }
2832 }
2833
2834 /* Success or defer */
2835
2836 if (new_ok == OK)
2837 {
2838 yield = OK;
2839 done = TRUE;
2840 break;
2841 }
2842
2843 if (new_ok == DEFER) yield = DEFER;
2844
2845 /* Move on to any more addresses in the header */
2846
2847 s = ss;
2848 } /* Next address */
2849
2850 parse_allow_group = FALSE;
2851 parse_found_group = FALSE;
2852 } /* Next header, unless done */
2853 } /* Next header type unless done */
2854
2855 if (yield == FAIL && *log_msgptr == NULL)
2856 *log_msgptr = US"there is no valid sender in any header line";
2857
2858 if (yield == DEFER && *log_msgptr == NULL)
2859 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2860
2861 return yield;
2862 }
2863
2864
2865
2866
2867 /*************************************************
2868 * Get RFC 1413 identification *
2869 *************************************************/
2870
2871 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2872 the timeout is set to zero, then the query is not done. There may also be lists
2873 of hosts and nets which are exempt. To guard against malefactors sending
2874 non-printing characters which could, for example, disrupt a message's headers,
2875 make sure the string consists of printing characters only.
2876
2877 Argument:
2878 port the port to connect to; usually this is IDENT_PORT (113), but when
2879 running in the test harness with -bh a different value is used.
2880
2881 Returns: nothing
2882
2883 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2884 */
2885
2886 void
2887 verify_get_ident(int port)
2888 {
2889 int sock, host_af, qlen;
2890 int received_sender_port, received_interface_port, n;
2891 uschar *p;
2892 uschar buffer[2048];
2893
2894 /* Default is no ident. Check whether we want to do an ident check for this
2895 host. */
2896
2897 sender_ident = NULL;
2898 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2899 return;
2900
2901 DEBUG(D_ident) debug_printf("doing ident callback\n");
2902
2903 /* Set up a connection to the ident port of the remote host. Bind the local end
2904 to the incoming interface address. If the sender host address is an IPv6
2905 address, the incoming interface address will also be IPv6. */
2906
2907 host_af = (Ustrchr(sender_host_address, ':') == NULL)? AF_INET : AF_INET6;
2908 sock = ip_socket(SOCK_STREAM, host_af);
2909 if (sock < 0) return;
2910
2911 if (ip_bind(sock, host_af, interface_address, 0) < 0)
2912 {
2913 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2914 strerror(errno));
2915 goto END_OFF;
2916 }
2917
2918 if (ip_connect(sock, host_af, sender_host_address, port, rfc1413_query_timeout)
2919 < 0)
2920 {
2921 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
2922 {
2923 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2924 sender_host_address);
2925 }
2926 else
2927 {
2928 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2929 sender_host_address, strerror(errno));
2930 }
2931 goto END_OFF;
2932 }
2933
2934 /* Construct and send the query. */
2935
2936 sprintf(CS buffer, "%d , %d\r\n", sender_host_port, interface_port);
2937 qlen = Ustrlen(buffer);
2938 if (send(sock, buffer, qlen, 0) < 0)
2939 {
2940 DEBUG(D_ident) debug_printf("ident send failed: %s\n", strerror(errno));
2941 goto END_OFF;
2942 }
2943
2944 /* Read a response line. We put it into the rest of the buffer, using several
2945 recv() calls if necessary. */
2946
2947 p = buffer + qlen;
2948
2949 for (;;)
2950 {
2951 uschar *pp;
2952 int count;
2953 int size = sizeof(buffer) - (p - buffer);
2954
2955 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2956 count = ip_recv(sock, p, size, rfc1413_query_timeout);
2957 if (count <= 0) goto END_OFF; /* Read error or EOF */
2958
2959 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2960 generous, and accept a plain \n terminator as well. The only illegal
2961 character is 0. */
2962
2963 for (pp = p; pp < p + count; pp++)
2964 {
2965 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2966 if (*pp == '\n')
2967 {
2968 if (pp[-1] == '\r') pp--;
2969 *pp = 0;
2970 goto GOT_DATA; /* Break out of both loops */
2971 }
2972 }
2973
2974 /* Reached the end of the data without finding \n. Let the loop continue to
2975 read some more, if there is room. */
2976
2977 p = pp;
2978 }
2979
2980 GOT_DATA:
2981
2982 /* We have received a line of data. Check it carefully. It must start with the
2983 same two port numbers that we sent, followed by data as defined by the RFC. For
2984 example,
2985
2986 12345 , 25 : USERID : UNIX :root
2987
2988 However, the amount of white space may be different to what we sent. In the
2989 "osname" field there may be several sub-fields, comma separated. The data we
2990 actually want to save follows the third colon. Some systems put leading spaces
2991 in it - we discard those. */
2992
2993 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2994 &received_interface_port, &n) != 2 ||
2995 received_sender_port != sender_host_port ||
2996 received_interface_port != interface_port)
2997 goto END_OFF;
2998
2999 p = buffer + qlen + n;
3000 while(isspace(*p)) p++;
3001 if (*p++ != ':') goto END_OFF;
3002 while(isspace(*p)) p++;
3003 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
3004 p += 6;
3005 while(isspace(*p)) p++;
3006 if (*p++ != ':') goto END_OFF;
3007 while (*p != 0 && *p != ':') p++;
3008 if (*p++ == 0) goto END_OFF;
3009 while(isspace(*p)) p++;
3010 if (*p == 0) goto END_OFF;
3011
3012 /* The rest of the line is the data we want. We turn it into printing
3013 characters when we save it, so that it cannot mess up the format of any logging
3014 or Received: lines into which it gets inserted. We keep a maximum of 127
3015 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
3016
3017 sender_ident = US string_printing(string_copyn(p, 127));
3018 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
3019
3020 END_OFF:
3021 (void)close(sock);
3022 return;
3023 }
3024
3025
3026
3027
3028 /*************************************************
3029 * Match host to a single host-list item *
3030 *************************************************/
3031
3032 /* This function compares a host (name or address) against a single item
3033 from a host list. The host name gets looked up if it is needed and is not
3034 already known. The function is called from verify_check_this_host() via
3035 match_check_list(), which is why most of its arguments are in a single block.
3036
3037 Arguments:
3038 arg the argument block (see below)
3039 ss the host-list item
3040 valueptr where to pass back looked up data, or NULL
3041 error for error message when returning ERROR
3042
3043 The block contains:
3044 host_name (a) the host name, or
3045 (b) NULL, implying use sender_host_name and
3046 sender_host_aliases, looking them up if required, or
3047 (c) the empty string, meaning that only IP address matches
3048 are permitted
3049 host_address the host address
3050 host_ipv4 the IPv4 address taken from an IPv6 one
3051
3052 Returns: OK matched
3053 FAIL did not match
3054 DEFER lookup deferred
3055 ERROR (a) failed to find the host name or IP address, or
3056 (b) unknown lookup type specified, or
3057 (c) host name encountered when only IP addresses are
3058 being matched
3059 */
3060
3061 int
3062 check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
3063 {
3064 check_host_block *cb = (check_host_block *)arg;
3065 int mlen = -1;
3066 int maskoffset;
3067 BOOL iplookup = FALSE;
3068 BOOL isquery = FALSE;
3069 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
3070 const uschar *t;
3071 uschar *semicolon;
3072 uschar **aliases;
3073
3074 /* Optimize for the special case when the pattern is "*". */
3075
3076 if (*ss == '*' && ss[1] == 0) return OK;
3077
3078 /* If the pattern is empty, it matches only in the case when there is no host -
3079 this can occur in ACL checking for SMTP input using the -bs option. In this
3080 situation, the host address is the empty string. */
3081
3082 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
3083 if (*ss == 0) return FAIL;
3084
3085 /* If the pattern is precisely "@" then match against the primary host name,
3086 provided that host name matching is permitted; if it's "@[]" match against the
3087 local host's IP addresses. */
3088
3089 if (*ss == '@')
3090 {
3091 if (ss[1] == 0)
3092 {
3093 if (isiponly) return ERROR;
3094 ss = primary_hostname;
3095 }
3096 else if (Ustrcmp(ss, "@[]") == 0)
3097 {
3098 ip_address_item *ip;
3099 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
3100 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
3101 return FAIL;
3102 }
3103 }
3104
3105 /* If the pattern is an IP address, optionally followed by a bitmask count, do
3106 a (possibly masked) comparision with the current IP address. */
3107
3108 if (string_is_ip_address(ss, &maskoffset) != 0)
3109 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
3110
3111 /* The pattern is not an IP address. A common error that people make is to omit
3112 one component of an IPv4 address, either by accident, or believing that, for
3113 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
3114 which it isn't. (Those applications that do accept 1.2.3 as an IP address
3115 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
3116 ancient specification.) To aid in debugging these cases, we give a specific
3117 error if the pattern contains only digits and dots or contains a slash preceded
3118 only by digits and dots (a slash at the start indicates a file name and of
3119 course slashes may be present in lookups, but not preceded only by digits and
3120 dots). */
3121
3122 for (t = ss; isdigit(*t) || *t == '.'; t++);
3123 if (*t == 0 || (*t == '/' && t != ss))
3124 {
3125 *error = US"malformed IPv4 address or address mask";
3126 return ERROR;
3127 }
3128
3129 /* See if there is a semicolon in the pattern */
3130
3131 semicolon = Ustrchr(ss, ';');
3132
3133 /* If we are doing an IP address only match, then all lookups must be IP
3134 address lookups, even if there is no "net-". */
3135
3136 if (isiponly)
3137 {
3138 iplookup = semicolon != NULL;
3139 }
3140
3141 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
3142 a lookup on a masked IP network, in textual form. We obey this code even if we
3143 have already set iplookup, so as to skip over the "net-" prefix and to set the
3144 mask length. The net- stuff really only applies to single-key lookups where the
3145 key is implicit. For query-style lookups the key is specified in the query.
3146 From release 4.30, the use of net- for query style is no longer needed, but we
3147 retain it for backward compatibility. */
3148
3149 if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
3150 {
3151 mlen = 0;
3152 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
3153 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
3154 iplookup = (*t++ == '-');
3155 }
3156 else t = ss;
3157
3158 /* Do the IP address lookup if that is indeed what we have */
3159
3160 if (iplookup)
3161 {
3162 int insize;
3163 int search_type;
3164 int incoming[4];
3165 void *handle;
3166 uschar *filename, *key, *result;
3167 uschar buffer[64];
3168
3169 /* Find the search type */
3170
3171 search_type = search_findtype(t, semicolon - t);
3172
3173 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3174 search_error_message);
3175
3176 /* Adjust parameters for the type of lookup. For a query-style lookup, there
3177 is no file name, and the "key" is just the query. For query-style with a file
3178 name, we have to fish the file off the start of the query. For a single-key
3179 lookup, the key is the current IP address, masked appropriately, and
3180 reconverted to text form, with the mask appended. For IPv6 addresses, specify
3181 dot separators instead of colons, except when the lookup type is "iplsearch".
3182 */
3183
3184 if (mac_islookup(search_type, lookup_absfilequery))
3185 {
3186 filename = semicolon + 1;
3187 key = filename;
3188 while (*key != 0 && !isspace(*key)) key++;
3189 filename = string_copyn(filename, key - filename);
3190 while (isspace(*key)) key++;
3191 }
3192 else if (mac_islookup(search_type, lookup_querystyle))
3193 {
3194 filename = NULL;
3195 key = semicolon + 1;
3196 }
3197 else /* Single-key style */
3198 {
3199 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
3200 ':' : '.';
3201 insize = host_aton(cb->host_address, incoming);
3202 host_mask(insize, incoming, mlen);
3203 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
3204 key = buffer;
3205 filename = semicolon + 1;
3206 }
3207
3208 /* Now do the actual lookup; note that there is no search_close() because
3209 of the caching arrangements. */
3210
3211 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3212 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3213
3214 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
3215 if (valueptr != NULL) *valueptr = result;
3216 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
3217 }
3218
3219 /* The pattern is not an IP address or network reference of any kind. That is,
3220 it is a host name pattern. If this is an IP only match, there's an error in the
3221 host list. */
3222
3223 if (isiponly)
3224 {
3225 *error = US"cannot match host name in match_ip list";
3226 return ERROR;
3227 }
3228
3229 /* Check the characters of the pattern to see if they comprise only letters,
3230 digits, full stops, and hyphens (the constituents of domain names). Allow
3231 underscores, as they are all too commonly found. Sigh. Also, if
3232 allow_utf8_domains is set, allow top-bit characters. */
3233
3234 for (t = ss; *t != 0; t++)
3235 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3236 (!allow_utf8_domains || *t < 128)) break;
3237
3238 /* If the pattern is a complete domain name, with no fancy characters, look up
3239 its IP address and match against that. Note that a multi-homed host will add
3240 items to the chain. */
3241
3242 if (*t == 0)
3243 {
3244 int rc;
3245 host_item h;
3246 h.next = NULL;
3247 h.name = ss;
3248 h.address = NULL;
3249 h.mx = MX_NONE;
3250
3251 /* Using byname rather than bydns here means we cannot determine dnssec
3252 status. On the other hand it is unclear how that could be either
3253 propagated up or enforced. */
3254
3255 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3256 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3257 {
3258 host_item *hh;
3259 for (hh = &h; hh != NULL; hh = hh->next)
3260 {
3261 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3262 }
3263 return FAIL;
3264 }
3265 if (rc == HOST_FIND_AGAIN) return DEFER;
3266 *error = string_sprintf("failed to find IP address for %s", ss);
3267 return ERROR;
3268 }
3269
3270 /* Almost all subsequent comparisons require the host name, and can be done
3271 using the general string matching function. When this function is called for
3272 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3273 must use sender_host_name and its aliases, looking them up if necessary. */
3274
3275 if (cb->host_name != NULL) /* Explicit host name given */
3276 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3277 valueptr);
3278
3279 /* Host name not given; in principle we need the sender host name and its
3280 aliases. However, for query-style lookups, we do not need the name if the
3281 query does not contain $sender_host_name. From release 4.23, a reference to
3282 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3283 on spec. */
3284
3285 if ((semicolon = Ustrchr(ss, ';')) != NULL)
3286 {
3287 const uschar *affix;
3288 int partial, affixlen, starflags, id;
3289
3290 *semicolon = 0;
3291 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
3292 *semicolon=';';
3293
3294 if (id < 0) /* Unknown lookup type */
3295 {
3296 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3297 search_error_message, ss);
3298 return DEFER;
3299 }
3300 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3301 }
3302
3303 if (isquery)
3304 {
3305 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3306 {
3307 case OK: return OK;
3308 case DEFER: return DEFER;
3309 default: return FAIL;
3310 }
3311 }
3312
3313 /* Not a query-style lookup; must ensure the host name is present, and then we
3314 do a check on the name and all its aliases. */
3315
3316 if (sender_host_name == NULL)
3317 {
3318 HDEBUG(D_host_lookup)
3319 debug_printf("sender host name required, to match against %s\n", ss);
3320 if (host_lookup_failed || host_name_lookup() != OK)
3321 {
3322 *error = string_sprintf("failed to find host name for %s",
3323 sender_host_address);;
3324 return ERROR;
3325 }
3326 host_build_sender_fullhost();
3327 }
3328
3329 /* Match on the sender host name, using the general matching function */
3330
3331 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
3332 valueptr))
3333 {
3334 case OK: return OK;
3335 case DEFER: return DEFER;
3336 }
3337
3338 /* If there are aliases, try matching on them. */
3339
3340 aliases = sender_host_aliases;
3341 while (*aliases != NULL)
3342 {
3343 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3344 {
3345 case OK: return OK;
3346 case DEFER: return DEFER;
3347 }
3348 }
3349 return FAIL;
3350 }
3351
3352
3353
3354
3355 /*************************************************
3356 * Check a specific host matches a host list *
3357 *************************************************/
3358
3359 /* This function is passed a host list containing items in a number of
3360 different formats and the identity of a host. Its job is to determine whether
3361 the given host is in the set of hosts defined by the list. The host name is
3362 passed as a pointer so that it can be looked up if needed and not already
3363 known. This is commonly the case when called from verify_check_host() to check
3364 an incoming connection. When called from elsewhere the host name should usually
3365 be set.
3366
3367 This function is now just a front end to match_check_list(), which runs common
3368 code for scanning a list. We pass it the check_host() function to perform a
3369 single test.
3370
3371 Arguments:
3372 listptr pointer to the host list
3373 cache_bits pointer to cache for named lists, or NULL
3374 host_name the host name or NULL, implying use sender_host_name and
3375 sender_host_aliases, looking them up if required
3376 host_address the IP address
3377 valueptr if not NULL, data from a lookup is passed back here
3378
3379 Returns: OK if the host is in the defined set
3380 FAIL if the host is not in the defined set,
3381 DEFER if a data lookup deferred (not a host lookup)
3382
3383 If the host name was needed in order to make a comparison, and could not be
3384 determined from the IP address, the result is FAIL unless the item
3385 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3386
3387 int
3388 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3389 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3390 {
3391 int rc;
3392 unsigned int *local_cache_bits = cache_bits;
3393 const uschar *save_host_address = deliver_host_address;
3394 check_host_block cb;
3395 cb.host_name = host_name;
3396 cb.host_address = host_address;
3397
3398 if (valueptr != NULL) *valueptr = NULL;
3399
3400 /* If the host address starts off ::ffff: it is an IPv6 address in
3401 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3402 addresses. */
3403
3404 cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
3405 host_address + 7 : host_address;
3406
3407 /* During the running of the check, put the IP address into $host_address. In
3408 the case of calls from the smtp transport, it will already be there. However,
3409 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3410 the safe side, any existing setting is preserved, though as I write this
3411 (November 2004) I can't see any cases where it is actually needed. */
3412
3413 deliver_host_address = host_address;
3414 rc = match_check_list(
3415 listptr, /* the list */
3416 0, /* separator character */
3417 &hostlist_anchor, /* anchor pointer */
3418 &local_cache_bits, /* cache pointer */
3419 check_host, /* function for testing */
3420 &cb, /* argument for function */
3421 MCL_HOST, /* type of check */
3422 (host_address == sender_host_address)?
3423 US"host" : host_address, /* text for debugging */
3424 valueptr); /* where to pass back data */
3425 deliver_host_address = save_host_address;
3426 return rc;
3427 }
3428
3429
3430
3431
3432 /*************************************************
3433 * Check the given host item matches a list *
3434 *************************************************/
3435 int
3436 verify_check_given_host(uschar **listptr, host_item *host)
3437 {
3438 return verify_check_this_host(CUSS listptr, NULL, host->name, host->address, NULL);
3439 }
3440
3441 /*************************************************
3442 * Check the remote host matches a list *
3443 *************************************************/
3444
3445 /* This is a front end to verify_check_this_host(), created because checking
3446 the remote host is a common occurrence. With luck, a good compiler will spot
3447 the tail recursion and optimize it. If there's no host address, this is