1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2017 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Functions concerned with verifying things. The original code for callout
9 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
13 #include "transports/smtp.h"
15 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
16 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
17 static smtp_outblock ctblock;
18 uschar ctbuffer[8192];
21 /* Structure for caching DNSBL lookups */
23 typedef struct dnsbl_cache_block {
32 /* Anchor for DNSBL cache */
34 static tree_node *dnsbl_cache = NULL;
37 /* Bits for match_type in one_check_dnsbl() */
42 static uschar cutthrough_response(int, char, uschar **, int);
46 /*************************************************
47 * Retrieve a callout cache record *
48 *************************************************/
50 /* If a record exists, check whether it has expired.
53 dbm_file an open hints file
55 type "address" or "domain"
56 positive_expire expire time for positive records
57 negative_expire expire time for negative records
59 Returns: the cache record if a non-expired one exists, else NULL
62 static dbdata_callout_cache *
63 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
64 int positive_expire, int negative_expire)
69 dbdata_callout_cache *cache_record;
71 if (!(cache_record = dbfn_read_with_length(dbm_file, key, &length)))
73 HDEBUG(D_verify) debug_printf("callout cache: no %s record found for %s\n", type, key);
77 /* We treat a record as "negative" if its result field is not positive, or if
78 it is a domain record and the postmaster field is negative. */
80 negative = cache_record->result != ccache_accept ||
81 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
82 expire = negative? negative_expire : positive_expire;
85 if (now - cache_record->time_stamp > expire)
87 HDEBUG(D_verify) debug_printf("callout cache: %s record expired for %s\n", type, key);
91 /* If this is a non-reject domain record, check for the obsolete format version
92 that doesn't have the postmaster and random timestamps, by looking at the
93 length. If so, copy it to a new-style block, replicating the record's
94 timestamp. Then check the additional timestamps. (There's no point wasting
95 effort if connections are rejected.) */
97 if (type[0] == 'd' && cache_record->result != ccache_reject)
99 if (length == sizeof(dbdata_callout_cache_obs))
101 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
102 memcpy(new, cache_record, length);
103 new->postmaster_stamp = new->random_stamp = new->time_stamp;
107 if (now - cache_record->postmaster_stamp > expire)
108 cache_record->postmaster_result = ccache_unknown;
110 if (now - cache_record->random_stamp > expire)
111 cache_record->random_result = ccache_unknown;
114 HDEBUG(D_verify) debug_printf("callout cache: found %s record for %s\n", type, key);
120 /* Check the callout cache.
121 Options * pm_mailfrom may be modified by cache partial results.
123 Return: TRUE if result found
127 cached_callout_lookup(address_item * addr, uschar * address_key,
128 uschar * from_address, int * opt_ptr, uschar ** pm_ptr,
129 int * yield, uschar ** failure_ptr,
130 dbdata_callout_cache * new_domain_record, int * old_domain_res)
132 int options = *opt_ptr;
134 open_db *dbm_file = NULL;
136 /* Open the callout cache database, it it exists, for reading only at this
137 stage, unless caching has been disabled. */
139 if (options & vopt_callout_no_cache)
141 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
143 else if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)))
145 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
149 /* If a cache database is available see if we can avoid the need to do an
150 actual callout by making use of previously-obtained data. */
152 dbdata_callout_cache_address * cache_address_record;
153 dbdata_callout_cache * cache_record = get_callout_cache_record(dbm_file,
154 addr->domain, US"domain",
155 callout_cache_domain_positive_expire, callout_cache_domain_negative_expire);
157 /* If an unexpired cache record was found for this domain, see if the callout
158 process can be short-circuited. */
162 /* In most cases, if an early command (up to and including MAIL FROM:<>)
163 was rejected, there is no point carrying on. The callout fails. However, if
164 we are doing a recipient verification with use_sender or use_postmaster
165 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
166 will be using a non-empty sender. We have to remember this situation so as
167 not to disturb the cached domain value if this whole verification succeeds
168 (we don't want it turning into "accept"). */
170 *old_domain_res = cache_record->result;
172 if ( cache_record->result == ccache_reject
173 || *from_address == 0 && cache_record->result == ccache_reject_mfnull)
175 setflag(addr, af_verify_nsfail);
177 debug_printf("callout cache: domain gave initial rejection, or "
178 "does not accept HELO or MAIL FROM:<>\n");
179 setflag(addr, af_verify_nsfail);
180 addr->user_message = US"(result of an earlier callout reused).";
182 *failure_ptr = US"mail";
183 dbfn_close(dbm_file);
187 /* If a previous check on a "random" local part was accepted, we assume
188 that the server does not do any checking on local parts. There is therefore
189 no point in doing the callout, because it will always be successful. If a
190 random check previously failed, arrange not to do it again, but preserve
191 the data in the new record. If a random check is required but hasn't been
192 done, skip the remaining cache processing. */
194 if (options & vopt_callout_random) switch(cache_record->random_result)
198 debug_printf("callout cache: domain accepts random addresses\n");
199 dbfn_close(dbm_file);
200 return TRUE; /* Default yield is OK */
204 debug_printf("callout cache: domain rejects random addresses\n");
205 *opt_ptr = options & ~vopt_callout_random;
206 new_domain_record->random_result = ccache_reject;
207 new_domain_record->random_stamp = cache_record->random_stamp;
212 debug_printf("callout cache: need to check random address handling "
213 "(not cached or cache expired)\n");
214 dbfn_close(dbm_file);
218 /* If a postmaster check is requested, but there was a previous failure,
219 there is again no point in carrying on. If a postmaster check is required,
220 but has not been done before, we are going to have to do a callout, so skip
221 remaining cache processing. */
225 if (cache_record->postmaster_result == ccache_reject)
227 setflag(addr, af_verify_pmfail);
229 debug_printf("callout cache: domain does not accept "
230 "RCPT TO:<postmaster@domain>\n");
232 *failure_ptr = US"postmaster";
233 setflag(addr, af_verify_pmfail);
234 addr->user_message = US"(result of earlier verification reused).";
235 dbfn_close(dbm_file);
238 if (cache_record->postmaster_result == ccache_unknown)
241 debug_printf("callout cache: need to check RCPT "
242 "TO:<postmaster@domain> (not cached or cache expired)\n");
243 dbfn_close(dbm_file);
247 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
248 postmaster check if the address itself has to be checked. Also ensure
249 that the value in the cache record is preserved (with its old timestamp).
252 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
253 "TO:<postmaster@domain>\n");
255 new_domain_record->postmaster_result = ccache_accept;
256 new_domain_record->postmaster_stamp = cache_record->postmaster_stamp;
260 /* We can't give a result based on information about the domain. See if there
261 is an unexpired cache record for this specific address (combined with the
262 sender address if we are doing a recipient callout with a non-empty sender).
265 if (!(cache_address_record = (dbdata_callout_cache_address *)
266 get_callout_cache_record(dbm_file, address_key, US"address",
267 callout_cache_positive_expire, callout_cache_negative_expire)))
269 dbfn_close(dbm_file);
273 if (cache_address_record->result == ccache_accept)
276 debug_printf("callout cache: address record is positive\n");
281 debug_printf("callout cache: address record is negative\n");
282 addr->user_message = US"Previous (cached) callout verification failure";
283 *failure_ptr = US"recipient";
287 /* Close the cache database while we actually do the callout for real. */
289 dbfn_close(dbm_file);
296 /* Write results to callout cache
299 cache_callout_write(dbdata_callout_cache * dom_rec, const uschar * domain,
300 int done, dbdata_callout_cache_address * addr_rec, uschar * address_key)
303 open_db *dbm_file = NULL;
305 /* If we get here with done == TRUE, a successful callout happened, and yield
306 will be set OK or FAIL according to the response to the RCPT command.
307 Otherwise, we looped through the hosts but couldn't complete the business.
308 However, there may be domain-specific information to cache in both cases.
310 The value of the result field in the new_domain record is ccache_unknown if
311 there was an error before or with MAIL FROM:, and errno was not zero,
312 implying some kind of I/O error. We don't want to write the cache in that case.
313 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
315 if (dom_rec->result != ccache_unknown)
316 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE)))
318 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
322 (void)dbfn_write(dbm_file, domain, dom_rec,
323 (int)sizeof(dbdata_callout_cache));
324 HDEBUG(D_verify) debug_printf("wrote callout cache domain record for %s:\n"
325 " result=%d postmaster=%d random=%d\n",
328 dom_rec->postmaster_result,
329 dom_rec->random_result);
332 /* If a definite result was obtained for the callout, cache it unless caching
335 if (done && addr_rec->result != ccache_unknown)
338 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
341 HDEBUG(D_verify) debug_printf("no callout cache available\n");
345 (void)dbfn_write(dbm_file, address_key, addr_rec,
346 (int)sizeof(dbdata_callout_cache_address));
347 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record for %s\n",
348 addr_rec->result == ccache_accept ? "positive" : "negative",
353 if (dbm_file) dbfn_close(dbm_file);
357 /* Cutthrough-multi. If the existing cached cutthrough connection matches
358 the one we would make for a subsequent recipient, use it. Send the RCPT TO
359 and check the result, nonpipelined as it may be wanted immediately for
360 recipient-verification.
362 It seems simpler to deal with this case separately from the main callout loop.
363 We will need to remember it has sent, or not, so that rcpt-acl tail code
364 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
366 Return: TRUE for a definitive result for the recipient
369 cutthrough_multi(address_item * addr, host_item * host_list,
370 transport_feedback * tf, int * yield)
375 if (addr->transport == cutthrough.addr.transport)
376 for (host = host_list; host; host = host->next)
377 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
380 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
383 deliver_host = host->name;
384 deliver_host_address = host->address;
385 deliver_host_port = host->port;
386 deliver_domain = addr->domain;
387 transport_name = addr->transport->name;
389 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
391 if (!smtp_get_interface(tf->interface, host_af, addr, &interface,
393 !smtp_get_port(tf->port, addr, &port, US"callout"))
394 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
397 if ( ( interface == cutthrough.interface
399 && cutthrough.interface
400 && Ustrcmp(interface, cutthrough.interface) == 0
402 && port == cutthrough.host.port
405 uschar * resp = NULL;
407 /* Match! Send the RCPT TO, set done from the response */
409 smtp_write_command(&ctblock, SCMD_FLUSH, "RCPT TO:<%.1000s>\r\n",
410 transport_rcpt_address(addr,
411 addr->transport->rcpt_include_affixes)) >= 0 &&
412 cutthrough_response(cutthrough.fd, '2', &resp, CUTTHROUGH_DATA_TIMEOUT) == '2';
414 /* This would go horribly wrong if a callout fail was ignored by ACL.
415 We punt by abandoning cutthrough on a reject, like the
420 address_item * na = store_get(sizeof(address_item));
421 *na = cutthrough.addr;
422 cutthrough.addr = *addr;
423 cutthrough.addr.host_used = &cutthrough.host;
424 cutthrough.addr.next = na;
430 cancel_cutthrough_connection(TRUE, US"recipient rejected");
431 if (!resp || errno == ETIMEDOUT)
433 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
438 Ustrcpy(resp, US"connection dropped");
441 string_sprintf("response to \"%s\" was: %s",
442 big_buffer, string_printing(resp));
445 string_sprintf("Callout verification failed:\n%s", resp);
447 /* Hard rejection ends the process */
449 if (resp[0] == '5') /* Address rejected */
457 break; /* host_list */
460 cancel_cutthrough_connection(TRUE, US"incompatible connection");
465 /*************************************************
466 * Do callout verification for an address *
467 *************************************************/
469 /* This function is called from verify_address() when the address has routed to
470 a host list, and a callout has been requested. Callouts are expensive; that is
471 why a cache is used to improve the efficiency.
474 addr the address that's been routed
475 host_list the list of hosts to try
476 tf the transport feedback block
478 ifstring "interface" option from transport, or NULL
479 portstring "port" option from transport, or NULL
480 protocolstring "protocol" option from transport, or NULL
481 callout the per-command callout timeout
482 callout_overall the overall callout timeout (if < 0 use 4*callout)
483 callout_connect the callout connection timeout (if < 0 use callout)
484 options the verification options - these bits are used:
485 vopt_is_recipient => this is a recipient address
486 vopt_callout_no_cache => don't use callout cache
487 vopt_callout_fullpm => if postmaster check, do full one
488 vopt_callout_random => do the "random" thing
489 vopt_callout_recipsender => use real sender for recipient
490 vopt_callout_recippmaster => use postmaster for recipient
491 vopt_callout_hold => lazy close connection
492 se_mailfrom MAIL FROM address for sender verify; NULL => ""
493 pm_mailfrom if non-NULL, do the postmaster check with this sender
495 Returns: OK/FAIL/DEFER
499 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
500 int callout, int callout_overall, int callout_connect, int options,
501 uschar *se_mailfrom, uschar *pm_mailfrom)
504 int old_domain_cache_result = ccache_accept;
507 uschar *from_address;
508 uschar *random_local_part = NULL;
509 const uschar *save_deliver_domain = deliver_domain;
510 uschar **failure_ptr = options & vopt_is_recipient
511 ? &recipient_verify_failure : &sender_verify_failure;
512 dbdata_callout_cache new_domain_record;
513 dbdata_callout_cache_address new_address_record;
514 time_t callout_start_time;
516 new_domain_record.result = ccache_unknown;
517 new_domain_record.postmaster_result = ccache_unknown;
518 new_domain_record.random_result = ccache_unknown;
520 memset(&new_address_record, 0, sizeof(new_address_record));
522 /* For a recipient callout, the key used for the address cache record must
523 include the sender address if we are using the real sender in the callout,
524 because that may influence the result of the callout. */
526 if (options & vopt_is_recipient)
527 if (options & vopt_callout_recipsender)
529 from_address = sender_address;
530 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
531 if (cutthrough.delivery) options |= vopt_callout_no_cache;
533 else if (options & vopt_callout_recippmaster)
535 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
536 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
537 qualify_domain_sender);
542 address_key = addr->address;
545 /* For a sender callout, we must adjust the key if the mailfrom address is not
550 from_address = se_mailfrom ? se_mailfrom : US"";
551 address_key = *from_address
552 ? string_sprintf("%s/<%s>", addr->address, from_address) : addr->address;
555 if (cached_callout_lookup(addr, address_key, from_address,
556 &options, &pm_mailfrom, &yield, failure_ptr,
557 &new_domain_record, &old_domain_cache_result))
559 cancel_cutthrough_connection(TRUE, US"cache-hit");
563 if (!addr->transport)
565 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
567 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
568 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
569 addr->transport->name, addr->transport->driver_name);
572 smtp_transport_options_block *ob =
573 (smtp_transport_options_block *)addr->transport->options_block;
576 /* The information wasn't available in the cache, so we have to do a real
577 callout and save the result in the cache for next time, unless no_cache is set,
578 or unless we have a previously cached negative random result. If we are to test
579 with a random local part, ensure that such a local part is available. If not,
580 log the fact, but carry on without randomising. */
582 if (options & vopt_callout_random && callout_random_local_part)
583 if (!(random_local_part = expand_string(callout_random_local_part)))
584 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
585 "callout_random_local_part: %s", expand_string_message);
587 /* Default the connect and overall callout timeouts if not set, and record the
588 time we are starting so that we can enforce it. */
590 if (callout_overall < 0) callout_overall = 4 * callout;
591 if (callout_connect < 0) callout_connect = callout;
592 callout_start_time = time(NULL);
594 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
595 output because a callout might take some time. When PIPELINING is active and
596 there are many recipients, the total time for doing lots of callouts can add up
597 and cause the client to time out. So in this case we forgo the PIPELINING
600 if (smtp_out && !disable_callout_flush) mac_smtp_fflush();
602 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
603 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
605 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
606 and we are holding a cutthrough conn open, we can just append the rcpt to
607 that conn for verification purposes (and later delivery also). Simplest
608 coding means skipping this whole loop and doing the append separately. */
610 /* Can we re-use an open cutthrough connection? */
611 if ( cutthrough.fd >= 0
612 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
613 == vopt_callout_recipsender
614 && !random_local_part
617 done = cutthrough_multi(addr, host_list, tf, &yield);
619 /* If we did not use a cached connection, make connections to the hosts
620 and do real callouts. The list of hosts is passed in as an argument. */
622 for (host = host_list; host && !done; host = host->next)
626 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
631 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
636 /* Check the overall callout timeout */
638 if (time(NULL) - callout_start_time >= callout_overall)
640 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
644 /* Set IPv4 or IPv6 */
646 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
648 /* Expand and interpret the interface and port strings. The latter will not
649 be used if there is a host-specific port (e.g. from a manualroute router).
650 This has to be delayed till now, because they may expand differently for
651 different hosts. If there's a failure, log it, but carry on with the
654 deliver_host = host->name;
655 deliver_host_address = host->address;
656 deliver_host_port = host->port;
657 deliver_domain = addr->domain;
658 transport_name = addr->transport->name;
660 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
662 || !smtp_get_port(tf->port, addr, &port, US"callout")
664 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
669 sx.host_af = host_af,
671 sx.interface = interface;
672 sx.helo_data = tf->helo_data;
673 sx.tblock = addr->transport;
676 tls_retry_connection:
677 /* Set the address state so that errors are recorded in it */
679 addr->transport_return = PENDING_DEFER;
680 ob->connect_timeout = callout_connect;
681 ob->command_timeout = callout;
683 /* Get the channel set up ready for a message (MAIL FROM being the next
684 SMTP command to send. If we tried TLS but it failed, try again without
687 yield = smtp_setup_conn(&sx, FALSE);
690 && addr->basic_errno == ERRNO_TLSFAILURE
691 && ob->tls_tempfail_tryclear
692 && verify_check_given_host(&ob->hosts_require_tls, host) != OK
695 log_write(0, LOG_MAIN,
696 "%s: callout unencrypted to %s [%s] (not in hosts_require_tls)",
697 addr->message, host->name, host->address);
698 addr->transport_return = PENDING_DEFER;
699 yield = smtp_setup_conn(&sx, TRUE);
704 errno = addr->basic_errno;
705 transport_name = NULL;
706 deliver_host = deliver_host_address = NULL;
707 deliver_domain = save_deliver_domain;
709 /* Failure to accept HELO is cached; this blocks the whole domain for all
710 senders. I/O errors and defer responses are not cached. */
712 if (yield == FAIL && (errno == 0 || errno == ERRNO_SMTPCLOSED))
714 setflag(addr, af_verify_nsfail);
715 new_domain_record.result = ccache_reject;
723 /* If we needed to authenticate, smtp_setup_conn() did that. Copy
724 the AUTH info for logging */
726 addr->authenticator = client_authenticator;
727 addr->auth_id = client_authenticated_id;
729 sx.from_addr = from_address;
730 sx.first_addr = sx.sync_addr = addr;
731 sx.ok = FALSE; /*XXX these 3 last might not be needed for verify? */
733 sx.completed_addr = FALSE;
735 new_domain_record.result = old_domain_cache_result == ccache_reject_mfnull
736 ? ccache_reject_mfnull : ccache_accept;
738 /* Do the random local part check first. Temporarily replace the recipient
739 with the "random" value */
741 if (random_local_part)
743 uschar * main_address = addr->address;
744 const uschar * rcpt_domain = addr->domain;
747 uschar * errstr = NULL;
748 if ( testflag(addr, af_utf8_downcvt)
749 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
753 addr->message = errstr;
754 errno = ERRNO_EXPANDFAIL;
755 setflag(addr, af_verify_nsfail);
757 rcpt_domain = US""; /*XXX errorhandling! */
761 /* This would be ok for 1st rcpt of a cutthrough (the case handled here;
762 subsequents are done in cutthrough_multi()), but no way to
763 handle a subsequent because of the RSET vaporising the MAIL FROM.
764 So refuse to support any. Most cutthrough use will not involve
765 random_local_part, so no loss. */
766 cancel_cutthrough_connection(TRUE, US"random-recipient");
768 addr->address = string_sprintf("%s@%.1000s",
769 random_local_part, rcpt_domain);
772 /* If accepted, we aren't going to do any further tests below.
773 Otherwise, cache a real negative response, and get back to the right
774 state to send RCPT. Unless there's some problem such as a dropped
775 connection, we expect to succeed, because the commands succeeded above.
776 However, some servers drop the connection after responding to an
777 invalid recipient, so on (any) error we drop and remake the connection.
778 XXX We don't care about that for postmaster_full. Should we?
780 XXX could we add another flag to the context, and have the common
781 code emit the RSET too? Even pipelined after the RCPT...
782 Then the main-verify call could use it if there's to be a subsequent
784 The sync_responses() would need to be taught about it and we'd
785 need another return code filtering out to here.
787 Avoid using a SIZE option on the MAIL for all randon-rcpt checks.
790 sx.avoid_option = OPTION_SIZE;
792 /* Remember when we last did a random test */
793 new_domain_record.random_stamp = time(NULL);
795 if (smtp_write_mail_and_rcpt_cmds(&sx, &yield) == 0)
796 switch(addr->transport_return)
798 case PENDING_OK: /* random was accepted, unfortunately */
799 new_domain_record.random_result = ccache_accept;
800 yield = OK; /* Only usable verify result we can return */
803 case FAIL: /* rejected: the preferred result */
804 new_domain_record.random_result = ccache_reject;
807 /* Between each check, issue RSET, because some servers accept only
808 one recipient after MAIL FROM:<>.
809 XXX We don't care about that for postmaster_full. Should we? */
812 smtp_write_command(&sx.outblock, SCMD_FLUSH, "RSET\r\n") >= 0 &&
813 smtp_read_response(&sx.inblock, sx.buffer, sizeof(sx.buffer),
818 debug_printf_indent("problem after random/rset/mfrom; reopen conn\n");
819 random_local_part = NULL;
821 tls_close(FALSE, TRUE);
823 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
824 (void)close(sx.inblock.sock);
825 sx.inblock.sock = sx.outblock.sock = -1;
826 #ifndef DISABLE_EVENT
827 (void) event_raise(addr->transport->event_action,
828 US"tcp:close", NULL);
830 addr->address = main_address;
831 addr->transport_return = PENDING_DEFER;
832 sx.first_addr = sx.sync_addr = addr;
835 sx.completed_addr = FALSE;
836 goto tls_retry_connection;
837 case DEFER: /* 4xx response to random */
838 break; /* Just to be clear. ccache_unknown, !done. */
841 /* Re-setup for main verify, or for the error message when failing */
842 addr->address = main_address;
843 addr->transport_return = PENDING_DEFER;
844 sx.first_addr = sx.sync_addr = addr;
847 sx.completed_addr = FALSE;
852 /* Main verify. For rcpt-verify use SIZE if we know it and we're not cacheing;
853 for sndr-verify never use it. */
857 if (!(options & vopt_is_recipient && options & vopt_callout_no_cache))
858 sx.avoid_option = OPTION_SIZE;
861 switch(smtp_write_mail_and_rcpt_cmds(&sx, &yield))
863 case 0: switch(addr->transport_return) /* ok so far */
865 case PENDING_OK: done = TRUE;
866 new_address_record.result = ccache_accept;
868 case FAIL: done = TRUE;
870 *failure_ptr = US"recipient";
871 new_address_record.result = ccache_reject;
877 case -1: /* MAIL response error */
878 *failure_ptr = US"mail";
879 if (errno == 0 && sx.buffer[0] == '5')
881 setflag(addr, af_verify_nsfail);
882 if (from_address[0] == 0)
883 new_domain_record.result = ccache_reject_mfnull;
886 /* non-MAIL read i/o error */
887 /* non-MAIL response timeout */
888 /* internal error; channel still usable */
889 default: break; /* transmit failed */
893 addr->auth_sndr = client_authenticated_sender;
895 deliver_host = deliver_host_address = NULL;
896 deliver_domain = save_deliver_domain;
898 /* Do postmaster check if requested; if a full check is required, we
899 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
901 if (done && pm_mailfrom)
903 /* Could possibly shift before main verify, just above, and be ok
904 for cutthrough. But no way to handle a subsequent rcpt, so just
906 cancel_cutthrough_connection(TRUE, US"postmaster verify");
907 HDEBUG(D_acl|D_v) debug_printf_indent("Cutthrough cancelled by presence of postmaster verify\n");
909 done = smtp_write_command(&sx.outblock, SCMD_FLUSH, "RSET\r\n") >= 0
910 && smtp_read_response(&sx.inblock, sx.buffer,
911 sizeof(sx.buffer), '2', callout);
915 uschar * main_address = addr->address;
917 /*XXX oops, affixes */
918 addr->address = string_sprintf("postmaster@%.1000s", addr->domain);
919 addr->transport_return = PENDING_DEFER;
921 sx.from_addr = pm_mailfrom;
922 sx.first_addr = sx.sync_addr = addr;
925 sx.completed_addr = FALSE;
926 sx.avoid_option = OPTION_SIZE;
928 if( smtp_write_mail_and_rcpt_cmds(&sx, &yield) == 0
929 && addr->transport_return == PENDING_OK
933 done = (options & vopt_callout_fullpm) != 0
934 && smtp_write_command(&sx.outblock, SCMD_FLUSH,
935 "RCPT TO:<postmaster>\r\n") >= 0
936 && smtp_read_response(&sx.inblock, sx.buffer,
937 sizeof(sx.buffer), '2', callout);
939 /* Sort out the cache record */
941 new_domain_record.postmaster_stamp = time(NULL);
944 new_domain_record.postmaster_result = ccache_accept;
945 else if (errno == 0 && sx.buffer[0] == '5')
947 *failure_ptr = US"postmaster";
948 setflag(addr, af_verify_pmfail);
949 new_domain_record.postmaster_result = ccache_reject;
952 addr->address = main_address;
955 /* For any failure of the main check, other than a negative response, we just
956 close the connection and carry on. We can identify a negative response by the
957 fact that errno is zero. For I/O errors it will be non-zero
959 Set up different error texts for logging and for sending back to the caller
960 as an SMTP response. Log in all cases, using a one-line format. For sender
961 callouts, give a full response to the caller, but for recipient callouts,
962 don't give the IP address because this may be an internal host whose identity
963 is not to be widely broadcast. */
969 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
970 sx.send_quit = FALSE;
976 extern int acl_where; /* src/acl.c */
978 addr->message = string_sprintf(
979 "response to \"EHLO\" did not include SMTPUTF8");
980 addr->user_message = acl_where == ACL_WHERE_RCPT
981 ? US"533 no support for internationalised mailbox name"
982 : US"550 mailbox unavailable";
989 sx.send_quit = FALSE;
993 if (*sx.buffer == 0) Ustrcpy(sx.buffer, US"connection dropped");
995 /*XXX test here is ugly; seem to have a split of responsibility for
996 building this message. Need to rationalise. Where is it done
997 before here, and when not?
998 Not == 5xx resp to MAIL on main-verify
1000 if (!addr->message) addr->message =
1001 string_sprintf("response to \"%s\" was: %s",
1002 big_buffer, string_printing(sx.buffer));
1004 addr->user_message = options & vopt_is_recipient
1005 ? string_sprintf("Callout verification failed:\n%s", sx.buffer)
1006 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1007 host->address, big_buffer, sx.buffer);
1009 /* Hard rejection ends the process */
1011 if (sx.buffer[0] == '5') /* Address rejected */
1019 /* End the SMTP conversation and close the connection. */
1021 /* Cutthrough - on a successful connect and recipient-verify with
1022 use-sender and we are 1st rcpt and have no cutthrough conn so far
1023 here is where we want to leave the conn open. Ditto for a lazy-close
1026 if ( (cutthrough.delivery || options & vopt_callout_hold)
1030 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1031 == vopt_callout_recipsender
1032 && !random_local_part
1034 && cutthrough.fd < 0
1038 HDEBUG(D_acl|D_v) debug_printf_indent("holding verify callout open for %s\n",
1040 ? "cutthrough delivery" : "potential further verifies and delivery");
1042 cutthrough.callout_hold_only = !cutthrough.delivery;
1043 cutthrough.is_tls = tls_out.active >= 0;
1044 cutthrough.fd = sx.outblock.sock; /* We assume no buffer in use in the outblock */
1045 cutthrough.nrcpt = 1;
1046 cutthrough.transport = addr->transport->name;
1047 cutthrough.interface = interface;
1048 cutthrough.snd_port = sending_port;
1049 cutthrough.peer_options = smtp_peer_options;
1050 cutthrough.host = *host;
1052 int oldpool = store_pool;
1053 store_pool = POOL_PERM;
1054 cutthrough.snd_ip = string_copy(sending_ip_address);
1055 cutthrough.host.name = string_copy(host->name);
1056 cutthrough.host.address = string_copy(host->address);
1057 store_pool = oldpool;
1059 cutthrough.addr = *addr; /* Save the address_item for later logging */
1060 cutthrough.addr.next = NULL;
1061 cutthrough.addr.host_used = &cutthrough.host;
1063 *(cutthrough.addr.parent = store_get(sizeof(address_item))) =
1065 ctblock.buffer = ctbuffer;
1066 ctblock.buffersize = sizeof(ctbuffer);
1067 ctblock.ptr = ctbuffer;
1068 /* ctblock.cmd_count = 0; ctblock.authenticating = FALSE; */
1069 ctblock.sock = cutthrough.fd;
1073 /* Ensure no cutthrough on multiple verifies that were incompatible */
1074 if (options & vopt_callout_recipsender)
1075 cancel_cutthrough_connection(TRUE, US"not usable for cutthrough");
1078 (void) smtp_write_command(&sx.outblock, SCMD_FLUSH, "QUIT\r\n");
1080 /* Wait a short time for response, and discard it */
1081 smtp_read_response(&sx.inblock, sx.buffer, sizeof(sx.buffer),
1085 if (sx.inblock.sock >= 0)
1088 tls_close(FALSE, TRUE);
1090 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1091 (void)close(sx.inblock.sock);
1092 sx.inblock.sock = sx.outblock.sock = -1;
1093 #ifndef DISABLE_EVENT
1094 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
1099 if (!done || yield != OK)
1100 addr->message = string_sprintf("%s [%s] : %s", host->name, host->address,
1102 } /* Loop through all hosts, while !done */
1105 /* If we get here with done == TRUE, a successful callout happened, and yield
1106 will be set OK or FAIL according to the response to the RCPT command.
1107 Otherwise, we looped through the hosts but couldn't complete the business.
1108 However, there may be domain-specific information to cache in both cases. */
1110 if (!(options & vopt_callout_no_cache))
1111 cache_callout_write(&new_domain_record, addr->domain,
1112 done, &new_address_record, address_key);
1114 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1115 temporary error. If there was only one host, and a response was received, leave
1116 it alone if supplying details. Otherwise, give a generic response. */
1120 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
1121 options & vopt_is_recipient ? "recipient" : "sender");
1124 addr->message = host_list->next || !addr->message
1125 ? dullmsg : string_sprintf("%s: %s", dullmsg, addr->message);
1127 addr->user_message = smtp_return_error_details
1128 ? string_sprintf("%s for <%s>.\n"
1129 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1130 "they may be permanently unreachable from this server. In the latter case,\n%s",
1131 dullmsg, addr->address,
1132 options & vopt_is_recipient
1133 ? "the address will never be accepted."
1134 : "you need to change the address or create an MX record for its domain\n"
1135 "if it is supposed to be generally accessible from the Internet.\n"
1136 "Talk to your mail administrator for details.")
1139 /* Force a specific error code */
1141 addr->basic_errno = ERRNO_CALLOUTDEFER;
1144 /* Come here from within the cache-reading code on fast-track exit. */
1147 tls_modify_variables(&tls_in);
1153 /* Called after recipient-acl to get a cutthrough connection open when
1154 one was requested and a recipient-verify wasn't subsequently done.
1157 open_cutthrough_connection( address_item * addr )
1162 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1163 /* We must use a copy of the address for verification, because it might
1167 HDEBUG(D_acl) debug_printf_indent("----------- %s cutthrough setup ------------\n",
1168 rcpt_count > 1 ? "more" : "start");
1169 rc = verify_address(&addr2, NULL,
1170 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1171 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1173 addr->message = addr2.message;
1174 addr->user_message = addr2.user_message;
1175 HDEBUG(D_acl) debug_printf_indent("----------- end cutthrough setup ------------\n");
1181 /* Send given number of bytes from the buffer */
1183 cutthrough_send(int n)
1185 if(cutthrough.fd < 0)
1190 tls_out.active == cutthrough.fd ? tls_write(FALSE, ctblock.buffer, n, FALSE) :
1192 send(cutthrough.fd, ctblock.buffer, n, 0) > 0
1195 transport_count += n;
1196 ctblock.ptr= ctblock.buffer;
1200 HDEBUG(D_transport|D_acl) debug_printf_indent("cutthrough_send failed: %s\n", strerror(errno));
1207 _cutthrough_puts(uschar * cp, int n)
1211 if(ctblock.ptr >= ctblock.buffer+ctblock.buffersize)
1212 if(!cutthrough_send(ctblock.buffersize))
1215 *ctblock.ptr++ = *cp++;
1220 /* Buffered output of counted data block. Return boolean success */
1222 cutthrough_puts(uschar * cp, int n)
1224 if (cutthrough.fd < 0) return TRUE;
1225 if (_cutthrough_puts(cp, n)) return TRUE;
1226 cancel_cutthrough_connection(TRUE, US"transmit failed");
1231 cutthrough_data_puts(uschar * cp, int n)
1233 if (cutthrough.delivery) (void) cutthrough_puts(cp, n);
1239 _cutthrough_flush_send(void)
1241 int n = ctblock.ptr - ctblock.buffer;
1244 if(!cutthrough_send(n))
1250 /* Send out any bufferred output. Return boolean success. */
1252 cutthrough_flush_send(void)
1254 if (_cutthrough_flush_send()) return TRUE;
1255 cancel_cutthrough_connection(TRUE, US"transmit failed");
1261 cutthrough_put_nl(void)
1263 return cutthrough_puts(US"\r\n", 2);
1268 cutthrough_data_put_nl(void)
1270 cutthrough_data_puts(US"\r\n", 2);
1274 /* Get and check response from cutthrough target */
1276 cutthrough_response(int fd, char expect, uschar ** copy, int timeout)
1278 smtp_inblock inblock;
1279 uschar inbuffer[4096];
1280 uschar responsebuffer[4096];
1282 inblock.buffer = inbuffer;
1283 inblock.buffersize = sizeof(inbuffer);
1284 inblock.ptr = inbuffer;
1285 inblock.ptrend = inbuffer;
1287 /* this relies on (inblock.sock == tls_out.active) */
1288 if(!smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer), expect, timeout))
1289 cancel_cutthrough_connection(TRUE, US"target timeout on read");
1294 *copy = cp = string_copy(responsebuffer);
1295 /* Trim the trailing end of line */
1296 cp += Ustrlen(responsebuffer);
1297 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1298 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1301 return responsebuffer[0];
1305 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1307 cutthrough_predata(void)
1309 if(cutthrough.fd < 0 || cutthrough.callout_hold_only)
1312 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> DATA\n");
1313 cutthrough_puts(US"DATA\r\n", 6);
1314 cutthrough_flush_send();
1316 /* Assume nothing buffered. If it was it gets ignored. */
1317 return cutthrough_response(cutthrough.fd, '3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
1321 /* tctx arg only to match write_chunk() */
1323 cutthrough_write_chunk(transport_ctx * tctx, uschar * s, int len)
1326 while(s && (s2 = Ustrchr(s, '\n')))
1328 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1336 /* Buffered send of headers. Return success boolean. */
1337 /* Expands newlines to wire format (CR,NL). */
1338 /* Also sends header-terminating blank line. */
1340 cutthrough_headers_send(void)
1344 if(cutthrough.fd < 0 || cutthrough.callout_hold_only)
1347 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1348 but having a separate buffered-output function (for now)
1350 HDEBUG(D_acl) debug_printf_indent("----------- start cutthrough headers send -----------\n");
1352 tctx.u.fd = cutthrough.fd;
1353 tctx.tblock = cutthrough.addr.transport;
1354 tctx.addr = &cutthrough.addr;
1355 tctx.check_string = US".";
1356 tctx.escape_string = US"..";
1357 /*XXX check under spool_files_wireformat. Might be irrelevant */
1358 tctx.options = topt_use_crlf;
1360 if (!transport_headers_send(&tctx, &cutthrough_write_chunk))
1363 HDEBUG(D_acl) debug_printf_indent("----------- done cutthrough headers send ------------\n");
1369 close_cutthrough_connection(const uschar * why)
1371 int fd = cutthrough.fd;
1374 /* We could be sending this after a bunch of data, but that is ok as
1375 the only way to cancel the transfer in dataphase is to drop the tcp
1376 conn before the final dot.
1378 ctblock.ptr = ctbuffer;
1379 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> QUIT\n");
1380 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1381 _cutthrough_flush_send();
1382 cutthrough.fd = -1; /* avoid recursion via read timeout */
1384 /* Wait a short time for response, and discard it */
1385 cutthrough_response(fd, '2', NULL, 1);
1388 tls_close(FALSE, TRUE);
1390 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1392 HDEBUG(D_acl) debug_printf_indent("----------- cutthrough shutdown (%s) ------------\n", why);
1394 ctblock.ptr = ctbuffer;
1398 cancel_cutthrough_connection(BOOL close_noncutthrough_verifies, const uschar * why)
1400 if (cutthrough.delivery || close_noncutthrough_verifies)
1401 close_cutthrough_connection(why);
1402 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1407 release_cutthrough_connection(const uschar * why)
1409 if (cutthrough.fd < 0) return;
1410 HDEBUG(D_acl) debug_printf_indent("release cutthrough conn: %s\n", why);
1412 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1418 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1419 Log an OK response as a transmission.
1420 Close the connection.
1421 Return smtp response-class digit.
1424 cutthrough_finaldot(void)
1427 address_item * addr;
1428 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> .\n");
1430 /* Assume data finshed with new-line */
1431 if( !cutthrough_puts(US".", 1)
1432 || !cutthrough_put_nl()
1433 || !cutthrough_flush_send()
1435 return cutthrough.addr.message;
1437 res = cutthrough_response(cutthrough.fd, '2', &cutthrough.addr.message, CUTTHROUGH_DATA_TIMEOUT);
1438 for (addr = &cutthrough.addr; addr; addr = addr->next)
1440 addr->message = cutthrough.addr.message;
1444 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1445 close_cutthrough_connection(US"delivered");
1449 delivery_log(LOG_MAIN, addr, 0,
1450 US"tmp-reject from cutthrough after DATA:");
1454 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1455 US"rejected after DATA:");
1462 return cutthrough.addr.message;
1467 /*************************************************
1468 * Copy error to toplevel address *
1469 *************************************************/
1471 /* This function is used when a verify fails or defers, to ensure that the
1472 failure or defer information is in the original toplevel address. This applies
1473 when an address is redirected to a single new address, and the failure or
1474 deferral happens to the child address.
1477 vaddr the verify address item
1478 addr the final address item
1481 Returns: the value of YIELD
1485 copy_error(address_item *vaddr, address_item *addr, int yield)
1489 vaddr->message = addr->message;
1490 vaddr->user_message = addr->user_message;
1491 vaddr->basic_errno = addr->basic_errno;
1492 vaddr->more_errno = addr->more_errno;
1493 vaddr->prop.address_data = addr->prop.address_data;
1494 copyflag(vaddr, addr, af_pass_message);
1502 /**************************************************
1503 * printf that automatically handles TLS if needed *
1504 ***************************************************/
1506 /* This function is used by verify_address() as a substitute for all fprintf()
1507 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1508 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1509 that assumes that we always use the smtp_out FILE* when not using TLS or the
1510 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1511 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1515 f the candidate FILE* to write to
1516 format format string
1517 ... optional arguments
1523 static void PRINTF_FUNCTION(2,3)
1524 respond_printf(FILE *f, const char *format, ...)
1528 va_start(ap, format);
1529 if (smtp_out && (f == smtp_out))
1530 smtp_vprintf(format, FALSE, ap);
1532 vfprintf(f, format, ap);
1538 /*************************************************
1539 * Verify an email address *
1540 *************************************************/
1542 /* This function is used both for verification (-bv and at other times) and
1543 address testing (-bt), which is indicated by address_test_mode being set.
1546 vaddr contains the address to verify; the next field in this block
1548 f if not NULL, write the result to this file
1549 options various option bits:
1550 vopt_fake_sender => this sender verify is not for the real
1551 sender (it was verify=sender=xxxx or an address from a
1552 header line) - rewriting must not change sender_address
1553 vopt_is_recipient => this is a recipient address, otherwise
1554 it's a sender address - this affects qualification and
1555 rewriting and messages from callouts
1556 vopt_qualify => qualify an unqualified address; else error
1557 vopt_expn => called from SMTP EXPN command
1558 vopt_success_on_redirect => when a new address is generated
1559 the verification instantly succeeds
1561 These ones are used by do_callout() -- the options variable
1564 vopt_callout_fullpm => if postmaster check, do full one
1565 vopt_callout_no_cache => don't use callout cache
1566 vopt_callout_random => do the "random" thing
1567 vopt_callout_recipsender => use real sender for recipient
1568 vopt_callout_recippmaster => use postmaster for recipient
1570 callout if > 0, specifies that callout is required, and gives timeout
1571 for individual commands
1572 callout_overall if > 0, gives overall timeout for the callout function;
1573 if < 0, a default is used (see do_callout())
1574 callout_connect the connection timeout for callouts
1575 se_mailfrom when callout is requested to verify a sender, use this
1576 in MAIL FROM; NULL => ""
1577 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1578 thing and use this as the sender address (may be "")
1580 routed if not NULL, set TRUE if routing succeeded, so we can
1581 distinguish between routing failed and callout failed
1583 Returns: OK address verified
1584 FAIL address failed to verify
1585 DEFER can't tell at present
1589 verify_address(address_item *vaddr, FILE *f, int options, int callout,
1590 int callout_overall, int callout_connect, uschar *se_mailfrom,
1591 uschar *pm_mailfrom, BOOL *routed)
1594 BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
1595 BOOL expn = (options & vopt_expn) != 0;
1596 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1599 int verify_type = expn? v_expn :
1600 address_test_mode? v_none :
1601 options & vopt_is_recipient? v_recipient : v_sender;
1602 address_item *addr_list;
1603 address_item *addr_new = NULL;
1604 address_item *addr_remote = NULL;
1605 address_item *addr_local = NULL;
1606 address_item *addr_succeed = NULL;
1607 uschar **failure_ptr = options & vopt_is_recipient
1608 ? &recipient_verify_failure : &sender_verify_failure;
1609 uschar *ko_prefix, *cr;
1610 uschar *address = vaddr->address;
1611 uschar *save_sender;
1612 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1614 /* Clear, just in case */
1616 *failure_ptr = NULL;
1618 /* Set up a prefix and suffix for error message which allow us to use the same
1619 output statements both in EXPN mode (where an SMTP response is needed) and when
1620 debugging with an output file. */
1624 ko_prefix = US"553 ";
1627 else ko_prefix = cr = US"";
1629 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1631 if (parse_find_at(address) == NULL)
1633 if ((options & vopt_qualify) == 0)
1636 respond_printf(f, "%sA domain is required for \"%s\"%s\n",
1637 ko_prefix, address, cr);
1638 *failure_ptr = US"qualify";
1641 address = rewrite_address_qualify(address, options & vopt_is_recipient);
1646 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1647 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
1650 /* Rewrite and report on it. Clear the domain and local part caches - these
1651 may have been set by domains and local part tests during an ACL. */
1653 if (global_rewrite_rules != NULL)
1655 uschar *old = address;
1656 address = rewrite_address(address, options & vopt_is_recipient, FALSE,
1657 global_rewrite_rules, rewrite_existflags);
1660 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1661 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1662 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
1666 /* If this is the real sender address, we must update sender_address at
1667 this point, because it may be referred to in the routers. */
1669 if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
1670 sender_address = address;
1672 /* If the address was rewritten to <> no verification can be done, and we have
1673 to return OK. This rewriting is permitted only for sender addresses; for other
1674 addresses, such rewriting fails. */
1676 if (address[0] == 0) return OK;
1678 /* Flip the legacy TLS-related variables over to the outbound set in case
1679 they're used in the context of a transport used by verification. Reset them
1680 at exit from this routine (so no returns allowed from here on). */
1682 tls_modify_variables(&tls_out);
1684 /* Save a copy of the sender address for re-instating if we change it to <>
1685 while verifying a sender address (a nice bit of self-reference there). */
1687 save_sender = sender_address;
1689 /* Observability variable for router/transport use */
1691 verify_mode = options & vopt_is_recipient ? US"R" : US"S";
1693 /* Update the address structure with the possibly qualified and rewritten
1694 address. Set it up as the starting address on the chain of new addresses. */
1696 vaddr->address = address;
1699 /* We need a loop, because an address can generate new addresses. We must also
1700 cope with generated pipes and files at the top level. (See also the code and
1701 comment in deliver.c.) However, it is usually the case that the router for
1702 user's .forward files has its verify flag turned off.
1704 If an address generates more than one child, the loop is used only when
1705 full_info is set, and this can only be set locally. Remote enquiries just get
1706 information about the top level address, not anything that it generated. */
1711 address_item *addr = addr_new;
1713 addr_new = addr->next;
1718 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1719 debug_printf("Considering %s\n", addr->address);
1722 /* Handle generated pipe, file or reply addresses. We don't get these
1723 when handling EXPN, as it does only one level of expansion. */
1725 if (testflag(addr, af_pfr))
1732 if (addr->address[0] == '>')
1734 allow = testflag(addr, af_allow_reply);
1735 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1739 allow = (addr->address[0] == '|')?
1740 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1741 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1744 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1745 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1746 "%s\n", addr->message);
1748 fprintf(f, "\n transport = %s\n", addr->transport->name);
1750 fprintf(f, " *** forbidden ***\n");
1755 /* Just in case some router parameter refers to it. */
1757 return_path = addr->prop.errors_address
1758 ? addr->prop.errors_address : sender_address;
1760 /* Split the address into domain and local part, handling the %-hack if
1761 necessary, and then route it. While routing a sender address, set
1762 $sender_address to <> because that is what it will be if we were trying to
1763 send a bounce to the sender. */
1765 if (routed) *routed = FALSE;
1766 if ((rc = deliver_split_address(addr)) == OK)
1768 if (!(options & vopt_is_recipient)) sender_address = null_sender;
1769 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1770 &addr_succeed, verify_type);
1771 sender_address = save_sender; /* Put back the real sender */
1774 /* If routing an address succeeded, set the flag that remembers, for use when
1775 an ACL cached a sender verify (in case a callout fails). Then if routing set
1776 up a list of hosts or the transport has a host list, and the callout option
1777 is set, and we aren't in a host checking run, do the callout verification,
1778 and set another flag that notes that a callout happened. */
1782 if (routed) *routed = TRUE;
1785 transport_instance * tp;
1786 host_item * host_list = addr->host_list;
1788 /* Make up some data for use in the case where there is no remote
1791 transport_feedback tf = {
1792 .interface = NULL, /* interface (=> any) */
1794 .protocol = US"smtp",
1796 .helo_data = US"$smtp_active_hostname",
1797 .hosts_override = FALSE,
1798 .hosts_randomize = FALSE,
1799 .gethostbyname = FALSE,
1800 .qualify_single = TRUE,
1801 .search_parents = FALSE
1804 /* If verification yielded a remote transport, we want to use that
1805 transport's options, so as to mimic what would happen if we were really
1806 sending a message to this address. */
1808 if ((tp = addr->transport) && !tp->info->local)
1810 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
1812 /* If the transport has hosts and the router does not, or if the
1813 transport is configured to override the router's hosts, we must build a
1814 host list of the transport's hosts, and find the IP addresses */
1816 if (tf.hosts && (!host_list || tf.hosts_override))
1819 const uschar *save_deliver_domain = deliver_domain;
1820 uschar *save_deliver_localpart = deliver_localpart;
1822 host_list = NULL; /* Ignore the router's hosts */
1824 deliver_domain = addr->domain;
1825 deliver_localpart = addr->local_part;
1826 s = expand_string(tf.hosts);
1827 deliver_domain = save_deliver_domain;
1828 deliver_localpart = save_deliver_localpart;
1832 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1833 "\"%s\" in %s transport for callout: %s", tf.hosts,
1834 tp->name, expand_string_message);
1839 host_item *host, *nexthost;
1840 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1842 /* Just ignore failures to find a host address. If we don't manage
1843 to find any addresses, the callout will defer. Note that more than
1844 one address may be found for a single host, which will result in
1845 additional host items being inserted into the chain. Hence we must
1846 save the next host first. */
1848 flags = HOST_FIND_BY_A;
1849 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1850 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1852 for (host = host_list; host; host = nexthost)
1854 nexthost = host->next;
1855 if (tf.gethostbyname ||
1856 string_is_ip_address(host->name, NULL) != 0)
1857 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
1860 dnssec_domains * dnssec_domains = NULL;
1861 if (Ustrcmp(tp->driver_name, "smtp") == 0)
1863 smtp_transport_options_block * ob =
1864 (smtp_transport_options_block *) tp->options_block;
1865 dnssec_domains = &ob->dnssec;
1868 (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1869 dnssec_domains, NULL, NULL);
1876 /* Can only do a callout if we have at least one host! If the callout
1877 fails, it will have set ${sender,recipient}_verify_failure. */
1881 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1882 if (host_checking && !host_checking_callout)
1885 debug_printf("... callout omitted by default when host testing\n"
1886 "(Use -bhc if you want the callouts to happen.)\n");
1891 deliver_set_expansions(addr);
1893 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
1894 callout_connect, options, se_mailfrom, pm_mailfrom);
1899 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
1900 "transport provided a host list\n");
1905 /* Otherwise, any failure is a routing failure */
1907 else *failure_ptr = US"route";
1909 /* A router may return REROUTED if it has set up a child address as a result
1910 of a change of domain name (typically from widening). In this case we always
1911 want to continue to verify the new child. */
1913 if (rc == REROUTED) continue;
1915 /* Handle hard failures */
1922 address_item *p = addr->parent;
1924 respond_printf(f, "%s%s %s", ko_prefix,
1925 full_info ? addr->address : address,
1926 address_test_mode ? "is undeliverable" : "failed to verify");
1927 if (!expn && admin_user)
1929 if (addr->basic_errno > 0)
1930 respond_printf(f, ": %s", strerror(addr->basic_errno));
1932 respond_printf(f, ": %s", addr->message);
1935 /* Show parents iff doing full info */
1937 if (full_info) while (p)
1939 respond_printf(f, "%s\n <-- %s", cr, p->address);
1942 respond_printf(f, "%s\n", cr);
1944 cancel_cutthrough_connection(TRUE, US"routing hard fail");
1948 yield = copy_error(vaddr, addr, FAIL);
1956 else if (rc == DEFER)
1961 address_item *p = addr->parent;
1962 respond_printf(f, "%s%s cannot be resolved at this time", ko_prefix,
1963 full_info? addr->address : address);
1964 if (!expn && admin_user)
1966 if (addr->basic_errno > 0)
1967 respond_printf(f, ": %s", strerror(addr->basic_errno));
1969 respond_printf(f, ": %s", addr->message);
1970 else if (addr->basic_errno <= 0)
1971 respond_printf(f, ": unknown error");
1974 /* Show parents iff doing full info */
1976 if (full_info) while (p)
1978 respond_printf(f, "%s\n <-- %s", cr, p->address);
1981 respond_printf(f, "%s\n", cr);
1983 cancel_cutthrough_connection(TRUE, US"routing soft fail");
1987 yield = copy_error(vaddr, addr, DEFER);
1990 if (yield == OK) yield = DEFER;
1993 /* If we are handling EXPN, we do not want to continue to route beyond
1994 the top level (whose address is in "address"). */
1998 uschar *ok_prefix = US"250-";
2001 if (!addr_local && !addr_remote)
2002 respond_printf(f, "250 mail to <%s> is discarded\r\n", address);
2004 respond_printf(f, "250 <%s>\r\n", address);
2008 address_item *addr2 = addr_new;
2009 addr_new = addr2->next;
2010 if (!addr_new) ok_prefix = US"250 ";
2011 respond_printf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
2017 /* Successful routing other than EXPN. */
2021 /* Handle successful routing when short info wanted. Otherwise continue for
2022 other (generated) addresses. Short info is the operational case. Full info
2023 can be requested only when debug_selector != 0 and a file is supplied.
2025 There is a conflict between the use of aliasing as an alternate email
2026 address, and as a sort of mailing list. If an alias turns the incoming
2027 address into just one address (e.g. J.Caesar->jc44) you may well want to
2028 carry on verifying the generated address to ensure it is valid when
2029 checking incoming mail. If aliasing generates multiple addresses, you
2030 probably don't want to do this. Exim therefore treats the generation of
2031 just a single new address as a special case, and continues on to verify the
2032 generated address. */
2034 if ( !full_info /* Stop if short info wanted AND */
2035 && ( ( !addr_new /* No new address OR */
2036 || addr_new->next /* More than one new address OR */
2037 || testflag(addr_new, af_pfr) /* New address is pfr */
2040 ( addr_new /* At least one new address AND */
2041 && success_on_redirect /* success_on_redirect is set */
2045 if (f) fprintf(f, "%s %s\n",
2046 address, address_test_mode ? "is deliverable" : "verified");
2048 /* If we have carried on to verify a child address, we want the value
2049 of $address_data to be that of the child */
2051 vaddr->prop.address_data = addr->prop.address_data;
2053 /* If stopped because more than one new address, cannot cutthrough */
2055 if (addr_new && addr_new->next)
2056 cancel_cutthrough_connection(TRUE, US"multiple addresses from routing");
2062 } /* Loop for generated addresses */
2064 /* Display the full results of the successful routing, including any generated
2065 addresses. Control gets here only when full_info is set, which requires f not
2066 to be NULL, and this occurs only when a top-level verify is called with the
2067 debugging switch on.
2069 If there are no local and no remote addresses, and there were no pipes, files,
2070 or autoreplies, and there were no errors or deferments, the message is to be
2071 discarded, usually because of the use of :blackhole: in an alias file. */
2073 if (allok && !addr_local && !addr_remote)
2075 fprintf(f, "mail to %s is discarded\n", address);
2079 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2082 address_item *addr = addr_list;
2083 address_item *p = addr->parent;
2084 transport_instance * tp = addr->transport;
2086 addr_list = addr->next;
2088 fprintf(f, "%s", CS addr->address);
2089 #ifdef EXPERIMENTAL_SRS
2090 if(addr->prop.srs_sender)
2091 fprintf(f, " [srs = %s]", addr->prop.srs_sender);
2094 /* If the address is a duplicate, show something about it. */
2096 if (!testflag(addr, af_pfr))
2099 if ((tnode = tree_search(tree_duplicates, addr->unique)))
2100 fprintf(f, " [duplicate, would not be delivered]");
2101 else tree_add_duplicate(addr->unique, addr);
2104 /* Now show its parents */
2106 for (p = addr->parent; p; p = p->parent)
2107 fprintf(f, "\n <-- %s", p->address);
2110 /* Show router, and transport */
2112 fprintf(f, "router = %s, transport = %s\n",
2113 addr->router->name, tp ? tp->name : US"unset");
2115 /* Show any hosts that are set up by a router unless the transport
2116 is going to override them; fiddle a bit to get a nice format. */
2118 if (addr->host_list && tp && !tp->overrides_hosts)
2123 for (h = addr->host_list; h; h = h->next)
2124 { /* get max lengths of host names, addrs */
2125 int len = Ustrlen(h->name);
2126 if (len > maxlen) maxlen = len;
2127 len = h->address ? Ustrlen(h->address) : 7;
2128 if (len > maxaddlen) maxaddlen = len;
2130 for (h = addr->host_list; h; h = h->next)
2132 fprintf(f, " host %-*s ", maxlen, h->name);
2135 fprintf(f, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2136 else if (tp->info->local)
2137 fprintf(f, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2139 fprintf(f, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2141 if (h->mx >= 0) fprintf(f, " MX=%d", h->mx);
2142 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
2143 if (running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", f);
2144 if (h->status == hstatus_unusable) fputs(" ** unusable **", f);
2150 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2151 the -bv or -bt case). */
2155 tls_modify_variables(&tls_in);
2163 /*************************************************
2164 * Check headers for syntax errors *
2165 *************************************************/
2167 /* This function checks those header lines that contain addresses, and verifies
2168 that all the addresses therein are syntactially correct.
2171 msgptr where to put an error message
2178 verify_check_headers(uschar **msgptr)
2184 for (h = header_list; h != NULL && yield == OK; h = h->next)
2186 if (h->type != htype_from &&
2187 h->type != htype_reply_to &&
2188 h->type != htype_sender &&
2189 h->type != htype_to &&
2190 h->type != htype_cc &&
2191 h->type != htype_bcc)
2194 colon = Ustrchr(h->text, ':');
2196 while (isspace(*s)) s++;
2198 /* Loop for multiple addresses in the header, enabling group syntax. Note
2199 that we have to reset this after the header has been scanned. */
2201 parse_allow_group = TRUE;
2205 uschar *ss = parse_find_address_end(s, FALSE);
2206 uschar *recipient, *errmess;
2207 int terminator = *ss;
2208 int start, end, domain;
2210 /* Temporarily terminate the string at this point, and extract the
2211 operative address within, allowing group syntax. */
2214 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2217 /* Permit an unqualified address only if the message is local, or if the
2218 sending host is configured to be permitted to send them. */
2220 if (recipient != NULL && domain == 0)
2222 if (h->type == htype_from || h->type == htype_sender)
2224 if (!allow_unqualified_sender) recipient = NULL;
2228 if (!allow_unqualified_recipient) recipient = NULL;
2230 if (recipient == NULL) errmess = US"unqualified address not permitted";
2233 /* It's an error if no address could be extracted, except for the special
2234 case of an empty address. */
2236 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
2238 uschar *verb = US"is";
2243 /* Arrange not to include any white space at the end in the
2244 error message or the header name. */
2246 while (t > s && isspace(t[-1])) t--;
2247 while (tt > h->text && isspace(tt[-1])) tt--;
2249 /* Add the address that failed to the error message, since in a
2250 header with very many addresses it is sometimes hard to spot
2251 which one is at fault. However, limit the amount of address to
2252 quote - cases have been seen where, for example, a missing double
2253 quote in a humungous To: header creates an "address" that is longer
2254 than string_sprintf can handle. */
2263 /* deconst cast ok as we're passing a non-const to string_printing() */
2264 *msgptr = US string_printing(
2265 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2266 errmess, tt - h->text, h->text, verb, len, s));
2269 break; /* Out of address loop */
2272 /* Advance to the next address */
2274 s = ss + (terminator? 1:0);
2275 while (isspace(*s)) s++;
2276 } /* Next address */
2278 parse_allow_group = FALSE;
2279 parse_found_group = FALSE;
2280 } /* Next header unless yield has been set FALSE */
2286 /*************************************************
2287 * Check header names for 8-bit characters *
2288 *************************************************/
2290 /* This function checks for invalid characters in header names. See
2291 RFC 5322, 2.2. and RFC 6532, 3.
2294 msgptr where to put an error message
2301 verify_check_header_names_ascii(uschar **msgptr)
2306 for (h = header_list; h; h = h->next)
2308 colon = Ustrchr(h->text, ':');
2309 for(s = h->text; s < colon; s++)
2310 if ((*s < 33) || (*s > 126))
2312 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2313 colon - h->text, h->text);
2320 /*************************************************
2321 * Check for blind recipients *
2322 *************************************************/
2324 /* This function checks that every (envelope) recipient is mentioned in either
2325 the To: or Cc: header lines, thus detecting blind carbon copies.
2327 There are two ways of scanning that could be used: either scan the header lines
2328 and tick off the recipients, or scan the recipients and check the header lines.
2329 The original proposed patch did the former, but I have chosen to do the latter,
2330 because (a) it requires no memory and (b) will use fewer resources when there
2331 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2334 Returns: OK if there are no blind recipients
2335 FAIL if there is at least one blind recipient
2339 verify_check_notblind(void)
2342 for (i = 0; i < recipients_count; i++)
2346 uschar *address = recipients_list[i].address;
2348 for (h = header_list; !found && h != NULL; h = h->next)
2352 if (h->type != htype_to && h->type != htype_cc) continue;
2354 colon = Ustrchr(h->text, ':');
2356 while (isspace(*s)) s++;
2358 /* Loop for multiple addresses in the header, enabling group syntax. Note
2359 that we have to reset this after the header has been scanned. */
2361 parse_allow_group = TRUE;
2365 uschar *ss = parse_find_address_end(s, FALSE);
2366 uschar *recipient,*errmess;
2367 int terminator = *ss;
2368 int start, end, domain;
2370 /* Temporarily terminate the string at this point, and extract the
2371 operative address within, allowing group syntax. */
2374 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2377 /* If we found a valid recipient that has a domain, compare it with the
2378 envelope recipient. Local parts are compared case-sensitively, domains
2379 case-insensitively. By comparing from the start with length "domain", we
2380 include the "@" at the end, which ensures that we are comparing the whole
2381 local part of each address. */
2383 if (recipient != NULL && domain != 0)
2385 found = Ustrncmp(recipient, address, domain) == 0 &&
2386 strcmpic(recipient + domain, address + domain) == 0;
2390 /* Advance to the next address */
2392 s = ss + (terminator? 1:0);
2393 while (isspace(*s)) s++;
2394 } /* Next address */
2396 parse_allow_group = FALSE;
2397 parse_found_group = FALSE;
2398 } /* Next header (if found is false) */
2400 if (!found) return FAIL;
2401 } /* Next recipient */
2408 /*************************************************
2409 * Find if verified sender *
2410 *************************************************/
2412 /* Usually, just a single address is verified as the sender of the message.
2413 However, Exim can be made to verify other addresses as well (often related in
2414 some way), and this is useful in some environments. There may therefore be a
2415 chain of such addresses that have previously been tested. This function finds
2416 whether a given address is on the chain.
2418 Arguments: the address to be verified
2419 Returns: pointer to an address item, or NULL
2423 verify_checked_sender(uschar *sender)
2426 for (addr = sender_verified_list; addr != NULL; addr = addr->next)
2427 if (Ustrcmp(sender, addr->address) == 0) break;
2435 /*************************************************
2436 * Get valid header address *
2437 *************************************************/
2439 /* Scan the originator headers of the message, looking for an address that
2440 verifies successfully. RFC 822 says:
2442 o The "Sender" field mailbox should be sent notices of
2443 any problems in transport or delivery of the original
2444 messages. If there is no "Sender" field, then the
2445 "From" field mailbox should be used.
2447 o If the "Reply-To" field exists, then the reply should
2448 go to the addresses indicated in that field and not to
2449 the address(es) indicated in the "From" field.
2451 So we check a Sender field if there is one, else a Reply_to field, else a From
2452 field. As some strange messages may have more than one of these fields,
2453 especially if they are resent- fields, check all of them if there is more than
2457 user_msgptr points to where to put a user error message
2458 log_msgptr points to where to put a log error message
2459 callout timeout for callout check (passed to verify_address())
2460 callout_overall overall callout timeout (ditto)
2461 callout_connect connect callout timeout (ditto)
2462 se_mailfrom mailfrom for verify; NULL => ""
2463 pm_mailfrom sender for pm callout check (passed to verify_address())
2464 options callout options (passed to verify_address())
2465 verrno where to put the address basic_errno
2467 If log_msgptr is set to something without setting user_msgptr, the caller
2468 normally uses log_msgptr for both things.
2470 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2471 FAIL is given if no appropriate headers are found
2475 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2476 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2477 uschar *pm_mailfrom, int options, int *verrno)
2479 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2484 for (i = 0; i < 3 && !done; i++)
2487 for (h = header_list; h != NULL && !done; h = h->next)
2489 int terminator, new_ok;
2490 uschar *s, *ss, *endname;
2492 if (h->type != header_types[i]) continue;
2493 s = endname = Ustrchr(h->text, ':') + 1;
2495 /* Scan the addresses in the header, enabling group syntax. Note that we
2496 have to reset this after the header has been scanned. */
2498 parse_allow_group = TRUE;
2502 address_item *vaddr;
2504 while (isspace(*s) || *s == ',') s++;
2505 if (*s == 0) break; /* End of header */
2507 ss = parse_find_address_end(s, FALSE);
2509 /* The terminator is a comma or end of header, but there may be white
2510 space preceding it (including newline for the last address). Move back
2511 past any white space so we can check against any cached envelope sender
2512 address verifications. */
2514 while (isspace(ss[-1])) ss--;
2518 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2519 (int)(endname - h->text), h->text, s);
2521 /* See if we have already verified this address as an envelope sender,
2522 and if so, use the previous answer. */
2524 vaddr = verify_checked_sender(s);
2526 if (vaddr != NULL && /* Previously checked */
2527 (callout <= 0 || /* No callout needed; OR */
2528 vaddr->special_action > 256)) /* Callout was done */
2530 new_ok = vaddr->special_action & 255;
2531 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2532 *ss = terminator; /* Restore shortened string */
2535 /* Otherwise we run the verification now. We must restore the shortened
2536 string before running the verification, so the headers are correct, in
2537 case there is any rewriting. */
2541 int start, end, domain;
2542 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2547 /* If we found an empty address, just carry on with the next one, but
2548 kill the message. */
2550 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
2557 /* If verification failed because of a syntax error, fail this
2558 function, and ensure that the failing address gets added to the error
2561 if (address == NULL)
2564 while (ss > s && isspace(ss[-1])) ss--;
2565 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2566 "scanning for sender: %s in \"%.*s\"",
2567 endname - h->text, h->text, *log_msgptr, ss - s, s);
2573 /* Else go ahead with the sender verification. But it isn't *the*
2574 sender of the message, so set vopt_fake_sender to stop sender_address
2575 being replaced after rewriting or qualification. */
2579 vaddr = deliver_make_addr(address, FALSE);
2580 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2581 callout, callout_overall, callout_connect, se_mailfrom,
2586 /* We now have the result, either newly found, or cached. If we are
2587 giving out error details, set a specific user error. This means that the
2588 last of these will be returned to the user if all three fail. We do not
2589 set a log message - the generic one below will be used. */
2593 *verrno = vaddr->basic_errno;
2594 if (smtp_return_error_details)
2596 *user_msgptr = string_sprintf("Rejected after DATA: "
2597 "could not verify \"%.*s\" header address\n%s: %s",
2598 endname - h->text, h->text, vaddr->address, vaddr->message);
2602 /* Success or defer */
2611 if (new_ok == DEFER) yield = DEFER;
2613 /* Move on to any more addresses in the header */
2616 } /* Next address */
2618 parse_allow_group = FALSE;
2619 parse_found_group = FALSE;
2620 } /* Next header, unless done */
2621 } /* Next header type unless done */
2623 if (yield == FAIL && *log_msgptr == NULL)
2624 *log_msgptr = US"there is no valid sender in any header line";
2626 if (yield == DEFER && *log_msgptr == NULL)
2627 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2635 /*************************************************
2636 * Get RFC 1413 identification *
2637 *************************************************/
2639 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2640 the timeout is set to zero, then the query is not done. There may also be lists
2641 of hosts and nets which are exempt. To guard against malefactors sending
2642 non-printing characters which could, for example, disrupt a message's headers,
2643 make sure the string consists of printing characters only.
2646 port the port to connect to; usually this is IDENT_PORT (113), but when
2647 running in the test harness with -bh a different value is used.
2651 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2655 verify_get_ident(int port)
2657 int sock, host_af, qlen;
2658 int received_sender_port, received_interface_port, n;
2661 uschar buffer[2048];
2663 /* Default is no ident. Check whether we want to do an ident check for this
2666 sender_ident = NULL;
2667 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2670 DEBUG(D_ident) debug_printf("doing ident callback\n");
2672 /* Set up a connection to the ident port of the remote host. Bind the local end
2673 to the incoming interface address. If the sender host address is an IPv6
2674 address, the incoming interface address will also be IPv6. */
2676 host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
2677 if ((sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
2679 if (ip_bind(sock, host_af, interface_address, 0) < 0)
2681 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2686 /* Construct and send the query. */
2688 qlen = snprintf(CS buffer, sizeof(buffer), "%d , %d\r\n",
2689 sender_host_port, interface_port);
2690 early_data.data = buffer;
2691 early_data.len = qlen;
2693 if (ip_connect(sock, host_af, sender_host_address, port,
2694 rfc1413_query_timeout, &early_data) < 0)
2696 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
2697 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2698 sender_host_address);
2700 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2701 sender_host_address, strerror(errno));
2705 /* Read a response line. We put it into the rest of the buffer, using several
2706 recv() calls if necessary. */
2714 int size = sizeof(buffer) - (p - buffer);
2716 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2717 count = ip_recv(sock, p, size, rfc1413_query_timeout);
2718 if (count <= 0) goto END_OFF; /* Read error or EOF */
2720 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2721 generous, and accept a plain \n terminator as well. The only illegal
2724 for (pp = p; pp < p + count; pp++)
2726 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2729 if (pp[-1] == '\r') pp--;
2731 goto GOT_DATA; /* Break out of both loops */
2735 /* Reached the end of the data without finding \n. Let the loop continue to
2736 read some more, if there is room. */
2743 /* We have received a line of data. Check it carefully. It must start with the
2744 same two port numbers that we sent, followed by data as defined by the RFC. For
2747 12345 , 25 : USERID : UNIX :root
2749 However, the amount of white space may be different to what we sent. In the
2750 "osname" field there may be several sub-fields, comma separated. The data we
2751 actually want to save follows the third colon. Some systems put leading spaces
2752 in it - we discard those. */
2754 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2755 &received_interface_port, &n) != 2 ||
2756 received_sender_port != sender_host_port ||
2757 received_interface_port != interface_port)
2760 p = buffer + qlen + n;
2761 while(isspace(*p)) p++;
2762 if (*p++ != ':') goto END_OFF;
2763 while(isspace(*p)) p++;
2764 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2766 while(isspace(*p)) p++;
2767 if (*p++ != ':') goto END_OFF;
2768 while (*p != 0 && *p != ':') p++;
2769 if (*p++ == 0) goto END_OFF;
2770 while(isspace(*p)) p++;
2771 if (*p == 0) goto END_OFF;
2773 /* The rest of the line is the data we want. We turn it into printing
2774 characters when we save it, so that it cannot mess up the format of any logging
2775 or Received: lines into which it gets inserted. We keep a maximum of 127
2776 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
2778 sender_ident = US string_printing(string_copyn(p, 127));
2779 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2789 /*************************************************
2790 * Match host to a single host-list item *
2791 *************************************************/
2793 /* This function compares a host (name or address) against a single item
2794 from a host list. The host name gets looked up if it is needed and is not
2795 already known. The function is called from verify_check_this_host() via
2796 match_check_list(), which is why most of its arguments are in a single block.
2799 arg the argument block (see below)
2800 ss the host-list item
2801 valueptr where to pass back looked up data, or NULL
2802 error for error message when returning ERROR
2805 host_name (a) the host name, or
2806 (b) NULL, implying use sender_host_name and
2807 sender_host_aliases, looking them up if required, or
2808 (c) the empty string, meaning that only IP address matches
2810 host_address the host address
2811 host_ipv4 the IPv4 address taken from an IPv6 one
2815 DEFER lookup deferred
2816 ERROR (a) failed to find the host name or IP address, or
2817 (b) unknown lookup type specified, or
2818 (c) host name encountered when only IP addresses are
2823 check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
2825 check_host_block *cb = (check_host_block *)arg;
2828 BOOL iplookup = FALSE;
2829 BOOL isquery = FALSE;
2830 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
2835 /* Optimize for the special case when the pattern is "*". */
2837 if (*ss == '*' && ss[1] == 0) return OK;
2839 /* If the pattern is empty, it matches only in the case when there is no host -
2840 this can occur in ACL checking for SMTP input using the -bs option. In this
2841 situation, the host address is the empty string. */
2843 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2844 if (*ss == 0) return FAIL;
2846 /* If the pattern is precisely "@" then match against the primary host name,
2847 provided that host name matching is permitted; if it's "@[]" match against the
2848 local host's IP addresses. */
2854 if (isiponly) return ERROR;
2855 ss = primary_hostname;
2857 else if (Ustrcmp(ss, "@[]") == 0)
2859 ip_address_item *ip;
2860 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
2861 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2866 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2867 a (possibly masked) comparison with the current IP address. */
2869 if (string_is_ip_address(ss, &maskoffset) != 0)
2870 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2872 /* The pattern is not an IP address. A common error that people make is to omit
2873 one component of an IPv4 address, either by accident, or believing that, for
2874 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2875 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2876 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2877 ancient specification.) To aid in debugging these cases, we give a specific
2878 error if the pattern contains only digits and dots or contains a slash preceded
2879 only by digits and dots (a slash at the start indicates a file name and of
2880 course slashes may be present in lookups, but not preceded only by digits and
2883 for (t = ss; isdigit(*t) || *t == '.'; t++);
2884 if (*t == 0 || (*t == '/' && t != ss))
2886 *error = US"malformed IPv4 address or address mask";
2890 /* See if there is a semicolon in the pattern */
2892 semicolon = Ustrchr(ss, ';');
2894 /* If we are doing an IP address only match, then all lookups must be IP
2895 address lookups, even if there is no "net-". */
2899 iplookup = semicolon != NULL;
2902 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
2903 a lookup on a masked IP network, in textual form. We obey this code even if we
2904 have already set iplookup, so as to skip over the "net-" prefix and to set the
2905 mask length. The net- stuff really only applies to single-key lookups where the
2906 key is implicit. For query-style lookups the key is specified in the query.
2907 From release 4.30, the use of net- for query style is no longer needed, but we
2908 retain it for backward compatibility. */
2910 if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
2913 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2914 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2915 iplookup = (*t++ == '-');
2919 /* Do the IP address lookup if that is indeed what we have */
2927 uschar *filename, *key, *result;
2930 /* Find the search type */
2932 search_type = search_findtype(t, semicolon - t);
2934 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2935 search_error_message);
2937 /* Adjust parameters for the type of lookup. For a query-style lookup, there
2938 is no file name, and the "key" is just the query. For query-style with a file
2939 name, we have to fish the file off the start of the query. For a single-key
2940 lookup, the key is the current IP address, masked appropriately, and
2941 reconverted to text form, with the mask appended. For IPv6 addresses, specify
2942 dot separators instead of colons, except when the lookup type is "iplsearch".
2945 if (mac_islookup(search_type, lookup_absfilequery))
2947 filename = semicolon + 1;
2949 while (*key != 0 && !isspace(*key)) key++;
2950 filename = string_copyn(filename, key - filename);
2951 while (isspace(*key)) key++;
2953 else if (mac_islookup(search_type, lookup_querystyle))
2956 key = semicolon + 1;
2958 else /* Single-key style */
2960 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
2962 insize = host_aton(cb->host_address, incoming);
2963 host_mask(insize, incoming, mlen);
2964 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
2966 filename = semicolon + 1;
2969 /* Now do the actual lookup; note that there is no search_close() because
2970 of the caching arrangements. */
2972 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
2973 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
2975 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
2976 if (valueptr != NULL) *valueptr = result;
2977 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
2980 /* The pattern is not an IP address or network reference of any kind. That is,
2981 it is a host name pattern. If this is an IP only match, there's an error in the
2986 *error = US"cannot match host name in match_ip list";
2990 /* Check the characters of the pattern to see if they comprise only letters,
2991 digits, full stops, and hyphens (the constituents of domain names). Allow
2992 underscores, as they are all too commonly found. Sigh. Also, if
2993 allow_utf8_domains is set, allow top-bit characters. */
2995 for (t = ss; *t != 0; t++)
2996 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
2997 (!allow_utf8_domains || *t < 128)) break;
2999 /* If the pattern is a complete domain name, with no fancy characters, look up
3000 its IP address and match against that. Note that a multi-homed host will add
3001 items to the chain. */
3012 /* Using byname rather than bydns here means we cannot determine dnssec
3013 status. On the other hand it is unclear how that could be either
3014 propagated up or enforced. */
3016 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3017 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3020 for (hh = &h; hh != NULL; hh = hh->next)
3022 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3026 if (rc == HOST_FIND_AGAIN) return DEFER;
3027 *error = string_sprintf("failed to find IP address for %s", ss);
3031 /* Almost all subsequent comparisons require the host name, and can be done
3032 using the general string matching function. When this function is called for
3033 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3034 must use sender_host_name and its aliases, looking them up if necessary. */
3036 if (cb->host_name != NULL) /* Explicit host name given */
3037 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3040 /* Host name not given; in principle we need the sender host name and its
3041 aliases. However, for query-style lookups, we do not need the name if the
3042 query does not contain $sender_host_name. From release 4.23, a reference to
3043 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3046 if ((semicolon = Ustrchr(ss, ';')) != NULL)
3048 const uschar *affix;
3049 int partial, affixlen, starflags, id;
3052 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
3055 if (id < 0) /* Unknown lookup type */
3057 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3058 search_error_message, ss);
3061 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3066 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3069 case DEFER: return DEFER;
3070 default: return FAIL;
3074 /* Not a query-style lookup; must ensure the host name is present, and then we
3075 do a check on the name and all its aliases. */
3077 if (sender_host_name == NULL)
3079 HDEBUG(D_host_lookup)
3080 debug_printf("sender host name required, to match against %s\n", ss);
3081 if (host_lookup_failed || host_name_lookup() != OK)
3083 *error = string_sprintf("failed to find host name for %s",
3084 sender_host_address);;
3087 host_build_sender_fullhost();
3090 /* Match on the sender host name, using the general matching function */
3092 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
3096 case DEFER: return DEFER;
3099 /* If there are aliases, try matching on them. */
3101 aliases = sender_host_aliases;
3102 while (*aliases != NULL)
3104 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3107 case DEFER: return DEFER;
3116 /*************************************************
3117 * Check a specific host matches a host list *
3118 *************************************************/
3120 /* This function is passed a host list containing items in a number of
3121 different formats and the identity of a host. Its job is to determine whether
3122 the given host is in the set of hosts defined by the list. The host name is
3123 passed as a pointer so that it can be looked up if needed and not already
3124 known. This is commonly the case when called from verify_check_host() to check
3125 an incoming connection. When called from elsewhere the host name should usually
3128 This function is now just a front end to match_check_list(), which runs common
3129 code for scanning a list. We pass it the check_host() function to perform a
3133 listptr pointer to the host list
3134 cache_bits pointer to cache for named lists, or NULL
3135 host_name the host name or NULL, implying use sender_host_name and
3136 sender_host_aliases, looking them up if required
3137 host_address the IP address
3138 valueptr if not NULL, data from a lookup is passed back here
3140 Returns: OK if the host is in the defined set
3141 FAIL if the host is not in the defined set,
3142 DEFER if a data lookup deferred (not a host lookup)
3144 If the host name was needed in order to make a comparison, and could not be
3145 determined from the IP address, the result is FAIL unless the item
3146 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3149 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3150 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3153 unsigned int *local_cache_bits = cache_bits;
3154 const uschar *save_host_address = deliver_host_address;
3155 check_host_block cb = { .host_name = host_name, .host_address = host_address };
3157 if (valueptr) *valueptr = NULL;
3159 /* If the host address starts off ::ffff: it is an IPv6 address in
3160 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3163 cb.host_ipv4 = Ustrncmp(host_address, "::ffff:", 7) == 0
3164 ? host_address + 7 : host_address;
3166 /* During the running of the check, put the IP address into $host_address. In
3167 the case of calls from the smtp transport, it will already be there. However,
3168 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3169 the safe side, any existing setting is preserved, though as I write this
3170 (November 2004) I can't see any cases where it is actually needed. */
3172 deliver_host_address = host_address;
3173 rc = match_check_list(
3174 listptr, /* the list */
3175 0, /* separator character */
3176 &hostlist_anchor, /* anchor pointer */
3177 &local_cache_bits, /* cache pointer */
3178 check_host, /* function for testing */
3179 &cb, /* argument for function */
3180 MCL_HOST, /* type of check */
3181 (host_address == sender_host_address)?
3182 US"host" : host_address, /* text for debugging */
3183 valueptr); /* where to pass back data */
3184 deliver_host_address = save_host_address;
3191 /*************************************************
3192 * Check the given host item matches a list *
3193 *************************************************/
3195 verify_check_given_host(uschar **listptr, host_item *host)
3197 return verify_check_this_host(CUSS listptr, NULL, host->name, host->address, NULL);
3200 /*************************************************
3201 * Check the remote host matches a list *
3202 *************************************************/
3204 /* This is a front end to verify_check_this_host(), created because checking
3205 the remote host is a common occurrence. With luck, a good compiler will spot
3206 the tail recursion and optimize it. If there's no host address, this is
3207 command-line SMTP input - check against an empty string for the address.
3210 listptr pointer to the host list
3212 Returns: the yield of verify_check_this_host(),
3213 i.e. OK, FAIL, or DEFER
3217 verify_check_host(uschar **listptr)
3219 return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
3220 (sender_host_address == NULL)? US"" : sender_host_address, NULL);
3227 /*************************************************
3228 * Invert an IP address *
3229 *************************************************/
3231 /* Originally just used for DNS xBL lists, now also used for the
3232 reverse_ip expansion operator.
3235 buffer where to put the answer
3236 address the address to invert
3240 invert_address(uschar *buffer, uschar *address)
3243 uschar *bptr = buffer;
3245 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3246 to the IPv4 part only. */
3248 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3250 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3253 if (host_aton(address, bin) == 1)
3257 for (i = 0; i < 4; i++)
3259 sprintf(CS bptr, "%d.", x & 255);
3260 while (*bptr) bptr++;
3265 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3266 in any DNS black lists, and the format in which they will be looked up is
3267 unknown. This is just a guess. */
3273 for (j = 3; j >= 0; j--)
3276 for (i = 0; i < 8; i++)
3278 sprintf(CS bptr, "%x.", x & 15);
3279 while (*bptr) bptr++;
3286 /* Remove trailing period -- this is needed so that both arbitrary
3287 dnsbl keydomains and inverted addresses may be combined with the
3288 same format string, "%s.%s" */
3295 /*************************************************
3296 * Perform a single dnsbl lookup *
3297 *************************************************/
3299 /* This function is called from verify_check_dnsbl() below. It is also called
3300 recursively from within itself when domain and domain_txt are different
3301 pointers, in order to get the TXT record from the alternate domain.
3304 domain the outer dnsbl domain
3305 domain_txt alternate domain to lookup TXT record on success; when the
3306 same domain is to be used, domain_txt == domain (that is,
3307 the pointers must be identical, not just the text)
3308 keydomain the current keydomain (for debug message)
3309 prepend subdomain to lookup (like keydomain, but
3310 reversed if IP address)
3311 iplist the list of matching IP addresses, or NULL for "any"
3312 bitmask true if bitmask matching is wanted
3313 match_type condition for 'succeed' result
3314 0 => Any RR in iplist (=)
3315 1 => No RR in iplist (!=)
3316 2 => All RRs in iplist (==)
3317 3 => Some RRs not in iplist (!==)
3318 the two bits are defined as MT_NOT and MT_ALL
3319 defer_return what to return for a defer
3321 Returns: OK if lookup succeeded
3326 one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain,
3327 uschar *prepend, uschar *iplist, BOOL bitmask, int match_type,
3333 dnsbl_cache_block *cb;
3334 int old_pool = store_pool;
3335 uschar query[256]; /* DNS domain max length */
3337 /* Construct the specific query domainname */
3339 if (!string_format(query, sizeof(query), "%s.%s", prepend, domain))
3341 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
3342 "(ignored): %s...", query);
3346 /* Look for this query in the cache. */
3348 if ( (t = tree_search(dnsbl_cache, query))
3349 && (cb = t->data.ptr)->expiry > time(NULL)
3352 /* Previous lookup was cached */
3355 HDEBUG(D_dnsbl) debug_printf("using result of previous DNS lookup\n");
3358 /* If not cached from a previous lookup, we must do a DNS lookup, and
3359 cache the result in permanent memory. */
3365 store_pool = POOL_PERM;
3369 HDEBUG(D_dnsbl) debug_printf("cached data found but past valid time; ");
3373 { /* Set up a tree entry to cache the lookup */
3374 t = store_get(sizeof(tree_node) + Ustrlen(query));
3375 Ustrcpy(t->name, query);
3376 t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block));
3377 (void)tree_insertnode(&dnsbl_cache, t);
3380 /* Do the DNS lookup . */
3382 HDEBUG(D_dnsbl) debug_printf("new DNS lookup for %s\n", query);
3383 cb->rc = dns_basic_lookup(&dnsa, query, T_A);
3384 cb->text_set = FALSE;
3388 /* If the lookup succeeded, cache the RHS address. The code allows for
3389 more than one address - this was for complete generality and the possible
3390 use of A6 records. However, A6 records have been reduced to experimental
3391 status (August 2001) and may die out. So they may never get used at all,
3392 let alone in dnsbl records. However, leave the code here, just in case.
3394 Quite apart from one A6 RR generating multiple addresses, there are DNS
3395 lists that return more than one A record, so we must handle multiple
3396 addresses generated in that way as well.
3398 Mark the cache entry with the "now" plus the minimum of the address TTLs,
3399 or some suitably far-future time if none were found. */
3401 if (cb->rc == DNS_SUCCEED)
3404 dns_address **addrp = &(cb->rhs);
3405 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
3407 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
3409 if (rr->type == T_A)
3411 dns_address *da = dns_address_from_rr(&dnsa, rr);
3415 while (da->next != NULL) da = da->next;
3416 addrp = &(da->next);
3417 if (ttl > rr->ttl) ttl = rr->ttl;
3422 /* If we didn't find any A records, change the return code. This can
3423 happen when there is a CNAME record but there are no A records for what
3426 if (cb->rhs == NULL) cb->rc = DNS_NODATA;
3429 cb->expiry = time(NULL)+ttl;
3430 store_pool = old_pool;
3433 /* We now have the result of the DNS lookup, either newly done, or cached
3434 from a previous call. If the lookup succeeded, check against the address
3435 list if there is one. This may be a positive equality list (introduced by
3436 "="), a negative equality list (introduced by "!="), a positive bitmask
3437 list (introduced by "&"), or a negative bitmask list (introduced by "!&").*/
3439 if (cb->rc == DNS_SUCCEED)
3441 dns_address *da = NULL;
3442 uschar *addlist = cb->rhs->address;
3444 /* For A and AAAA records, there may be multiple addresses from multiple
3445 records. For A6 records (currently not expected to be used) there may be
3446 multiple addresses from a single record. */
3448 for (da = cb->rhs->next; da != NULL; da = da->next)
3449 addlist = string_sprintf("%s, %s", addlist, da->address);
3451 HDEBUG(D_dnsbl) debug_printf("DNS lookup for %s succeeded (yielding %s)\n",
3454 /* Address list check; this can be either for equality, or via a bitmask.
3455 In the latter case, all the bits must match. */
3459 for (da = cb->rhs; da != NULL; da = da->next)
3463 const uschar *ptr = iplist;
3466 /* Handle exact matching */
3470 while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip))) != NULL)
3472 if (Ustrcmp(CS da->address, ip) == 0) break;
3476 /* Handle bitmask matching */
3483 /* At present, all known DNS blocking lists use A records, with
3484 IPv4 addresses on the RHS encoding the information they return. I
3485 wonder if this will linger on as the last vestige of IPv4 when IPv6
3486 is ubiquitous? Anyway, for now we use paranoia code to completely
3487 ignore IPv6 addresses. The default mask is 0, which always matches.
3488 We change this only for IPv4 addresses in the list. */
3490 if (host_aton(da->address, address) == 1) mask = address[0];
3492 /* Scan the returned addresses, skipping any that are IPv6 */
3494 while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip))) != NULL)
3496 if (host_aton(ip, address) != 1) continue;
3497 if ((address[0] & mask) == address[0]) break;
3503 (a) An IP address in an any ('=') list matched, or
3504 (b) No IP address in an all ('==') list matched
3506 then we're done searching. */
3508 if (((match_type & MT_ALL) != 0) == (res == NULL)) break;
3511 /* If da == NULL, either
3513 (a) No IP address in an any ('=') list matched, or
3514 (b) An IP address in an all ('==') list didn't match
3516 so behave as if the DNSBL lookup had not succeeded, i.e. the host is not on
3519 if ((match_type == MT_NOT || match_type == MT_ALL) != (da == NULL))
3527 res = US"was no match";
3530 res = US"was an exclude match";
3533 res = US"was an IP address that did not match";
3536 res = US"were no IP addresses that did not match";
3539 debug_printf("=> but we are not accepting this block class because\n");
3540 debug_printf("=> there %s for %s%c%s\n",
3542 ((match_type & MT_ALL) == 0)? "" : "=",
3543 bitmask? '&' : '=', iplist);
3549 /* Either there was no IP list, or the record matched, implying that the
3550 domain is on the list. We now want to find a corresponding TXT record. If an
3551 alternate domain is specified for the TXT record, call this function
3552 recursively to look that up; this has the side effect of re-checking that
3553 there is indeed an A record at the alternate domain. */
3555 if (domain_txt != domain)
3556 return one_check_dnsbl(domain_txt, domain_txt, keydomain, prepend, NULL,
3557 FALSE, match_type, defer_return);
3559 /* If there is no alternate domain, look up a TXT record in the main domain
3560 if it has not previously been cached. */
3564 cb->text_set = TRUE;
3565 if (dns_basic_lookup(&dnsa, query, T_TXT) == DNS_SUCCEED)
3568 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
3570 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
3571 if (rr->type == T_TXT) break;
3574 int len = (rr->data)[0];
3575 if (len > 511) len = 127;
3576 store_pool = POOL_PERM;
3577 cb->text = string_sprintf("%.*s", len, (const uschar *)(rr->data+1));
3578 store_pool = old_pool;
3583 dnslist_value = addlist;
3584 dnslist_text = cb->text;
3588 /* There was a problem with the DNS lookup */
3590 if (cb->rc != DNS_NOMATCH && cb->rc != DNS_NODATA)
3592 log_write(L_dnslist_defer, LOG_MAIN,
3593 "DNS list lookup defer (probably timeout) for %s: %s", query,
3594 (defer_return == OK)? US"assumed in list" :
3595 (defer_return == FAIL)? US"assumed not in list" :
3596 US"returned DEFER");
3597 return defer_return;
3600 /* No entry was found in the DNS; continue for next domain */
3604 debug_printf("DNS lookup for %s failed\n", query);
3605 debug_printf("=> that means %s is not listed at %s\n",
3615 /*************************************************
3616 * Check host against DNS black lists *
3617 *************************************************/
3619 /* This function runs checks against a list of DNS black lists, until one
3620 matches. Each item on the list can be of the form
3622 domain=ip-address/key
3624 The domain is the right-most domain that is used for the query, for example,
3625 blackholes.mail-abuse.org. If the IP address is present, there is a match only
3626 if the DNS lookup returns a matching IP address. Several addresses may be
3627 given, comma-separated, for example: x.y.z=127.0.0.1,127.0.0.2.
3629 If no key is given, what is looked up in the domain is the inverted IP address
3630 of the current client host. If a key is given, it is used to construct the
3631 domain for the lookup. For example:
3633 dsn.rfc-ignorant.org/$sender_address_domain
3635 After finding a match in the DNS, the domain is placed in $dnslist_domain, and
3636 then we check for a TXT record for an error message, and if found, save its
3637 value in $dnslist_text. We also cache everything in a tree, to optimize
3640 The TXT record is normally looked up in the same domain as the A record, but
3641 when many lists are combined in a single DNS domain, this will not be a very
3642 specific message. It is possible to specify a different domain for looking up
3643 TXT records; this is given before the main domain, comma-separated. For
3646 dnslists = http.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.2 : \
3647 socks.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.3
3649 The caching ensures that only one lookup in dnsbl.sorbs.net is done.
3651 Note: an address for testing RBL is 192.203.178.39
3652 Note: an address for testing DUL is 192.203.178.4
3653 Note: a domain for testing RFCI is example.tld.dsn.rfc-ignorant.org
3657 listptr the domain/address/data list
3658 log_msgptr log message on error
3660 Returns: OK successful lookup (i.e. the address is on the list), or
3661 lookup deferred after +include_unknown
3662 FAIL name not found, or no data found for the given type, or
3663 lookup deferred after +exclude_unknown (default)
3664 DEFER lookup failure, if +defer_unknown was set
3668 verify_check_dnsbl(int where, const uschar ** listptr, uschar ** log_msgptr)
3671 int defer_return = FAIL;
3672 const uschar *list = *listptr;
3675 uschar buffer[1024];
3676 uschar revadd[128]; /* Long enough for IPv6 address */
3678 /* Indicate that the inverted IP address is not yet set up */
3682 /* In case this is the first time the DNS resolver is being used. */
3684 dns_init(FALSE, FALSE, FALSE); /*XXX dnssec? */
3686 /* Loop through all the domains supplied, until something matches */
3688 while ((domain = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
3691 BOOL bitmask = FALSE;
3698 HDEBUG(D_dnsbl) debug_printf("DNS list check: %s\n", domain);
3700 /* Deal with special values that change the behaviour on defer */
3702 if (domain[0] == '+')
3704 if (strcmpic(domain, US"+include_unknown") == 0) defer_return = OK;
3705 else if (strcmpic(domain, US"+exclude_unknown") == 0) defer_return = FAIL;
3706 else if (strcmpic(domain, US"+defer_unknown") == 0) defer_return = DEFER;
3708 log_write(0, LOG_MAIN|LOG_PANIC, "unknown item in dnslist (ignored): %s",
3713 /* See if there's explicit data to be looked up */
3715 if ((key = Ustrchr(domain, '/'))) *key++ = 0;
3717 /* See if there's a list of addresses supplied after the domain name. This is
3718 introduced by an = or a & character; if preceded by = we require all matches
3719 and if preceded by ! we invert the result. */
3721 if (!(iplist = Ustrchr(domain, '=')))
3724 iplist = Ustrchr(domain, '&');
3727 if (iplist) /* Found either = or & */
3729 if (iplist > domain && iplist[-1] == '!') /* Handle preceding ! */
3731 match_type |= MT_NOT;
3735 *iplist++ = 0; /* Terminate domain, move on */
3737 /* If we found = (bitmask == FALSE), check for == or =& */
3739 if (!bitmask && (*iplist == '=' || *iplist == '&'))
3741 bitmask = *iplist++ == '&';
3742 match_type |= MT_ALL;
3747 /* If there is a comma in the domain, it indicates that a second domain for
3748 looking up TXT records is provided, before the main domain. Otherwise we must
3749 set domain_txt == domain. */
3751 domain_txt = domain;
3752 comma = Ustrchr(domain, ',');
3759 /* Check that what we have left is a sensible domain name. There is no reason
3760 why these domains should in fact use the same syntax as hosts and email
3761 domains, but in practice they seem to. However, there is little point in
3762 actually causing an error here, because that would no doubt hold up incoming
3763 mail. Instead, I'll just log it. */
3765 for (s = domain; *s != 0; s++)
3767 if (!isalnum(*s) && *s != '-' && *s != '.' && *s != '_')
3769 log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains "
3770 "strange characters - is this right?", domain);
3775 /* Check the alternate domain if present */
3777 if (domain_txt != domain) for (s = domain_txt; *s != 0; s++)
3779 if (!isalnum(*s) && *s != '-' && *s != '.' && *s != '_')
3781 log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains "
3782 "strange characters - is this right?", domain_txt);
3787 /* If there is no key string, construct the query by adding the domain name
3788 onto the inverted host address, and perform a single DNS lookup. */
3792 if (where == ACL_WHERE_NOTSMTP_START || where == ACL_WHERE_NOTSMTP)
3794 *log_msgptr = string_sprintf
3795 ("cannot test auto-keyed dnslists condition in %s ACL",
3796 acl_wherenames[where]);
3799 if (sender_host_address == NULL) return FAIL; /* can never match */
3800 if (revadd[0] == 0) invert_address(revadd, sender_host_address);
3801 rc = one_check_dnsbl(domain, domain_txt, sender_host_address, revadd,
3802 iplist, bitmask, match_type, defer_return);
3805 dnslist_domain = string_copy(domain_txt);
3806 dnslist_matched = string_copy(sender_host_address);
3807 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
3808 sender_host_address, dnslist_domain);
3810 if (rc != FAIL) return rc; /* OK or DEFER */
3813 /* If there is a key string, it can be a list of domains or IP addresses to
3814 be concatenated with the main domain. */
3821 uschar keybuffer[256];
3822 uschar keyrevadd[128];
3824 while ((keydomain = string_nextinlist(CUSS &key, &keysep, keybuffer,
3825 sizeof(keybuffer))) != NULL)
3827 uschar *prepend = keydomain;
3829 if (string_is_ip_address(keydomain, NULL) != 0)
3831 invert_address(keyrevadd, keydomain);
3832 prepend = keyrevadd;
3835 rc = one_check_dnsbl(domain, domain_txt, keydomain, prepend, iplist,
3836 bitmask, match_type, defer_return);
3840 dnslist_domain = string_copy(domain_txt);
3841 dnslist_matched = string_copy(keydomain);
3842 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
3843 keydomain, dnslist_domain);
3847 /* If the lookup deferred, remember this fact. We keep trying the rest
3848 of the list to see if we get a useful result, and if we don't, we return
3849 DEFER at the end. */
3851 if (rc == DEFER) defer = TRUE;
3852 } /* continue with next keystring domain/address */
3854 if (defer) return DEFER;
3856 } /* continue with next dnsdb outer domain */
3863 /* End of verify.c */