Implemented control=allow_auth_unadvertised.

[exim.git] / src / src / smtp_in.c

diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c
index cc6486a401d8905ee308979dcf821be323ebf808..9df0f592ad20513d5039bfb80b1a6cf6d3cea797 100644 (file)
--- a/src/src/smtp_in.c
+++ b/src/src/smtp_in.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/smtp_in.c,v 1.31 2006/02/13 12:02:59 ph10 Exp $ */
+/* $Cambridge: exim/src/src/smtp_in.c,v 1.34 2006/03/02 12:25:48 ph10 Exp $ */
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
@@ -626,6 +626,8 @@ for (;;)
 
 /* This function is called when logging information about an SMTP connection.
 It sets up appropriate source information, depending on the type of connection.
+If sender_fullhost is NULL, we are at a very early stage of the connection;
+just use the IP address.
 
 Argument:    none
 Returns:     a string describing the connection
@@ -634,21 +636,24 @@ Returns:     a string describing the connection
 uschar *
 smtp_get_connection_info(void)
 {
+uschar *hostname = (sender_fullhost == NULL)?
+  sender_host_address : sender_fullhost;
+
 if (host_checking)
-  return string_sprintf("SMTP connection from %s", sender_fullhost);
+  return string_sprintf("SMTP connection from %s", hostname);
 
 if (sender_host_unknown || sender_host_notsocket)
   return string_sprintf("SMTP connection from %s", sender_ident);
 
 if (is_inetd)
-  return string_sprintf("SMTP connection from %s (via inetd)", sender_fullhost);
+  return string_sprintf("SMTP connection from %s (via inetd)", hostname);
 
 if ((log_extra_selector & LX_incoming_interface) != 0 &&
      interface_address != NULL)
-  return string_sprintf("SMTP connection from %s I=[%s]:%d", sender_fullhost,
+  return string_sprintf("SMTP connection from %s I=[%s]:%d", hostname,
     interface_address, interface_port);
 
-return string_sprintf("SMTP connection from %s", sender_fullhost);
+return string_sprintf("SMTP connection from %s", hostname);
 }
 
 
@@ -1840,19 +1845,21 @@ if (where == ACL_WHERE_RCPT || where == ACL_WHERE_DATA || where == ACL_WHERE_MIM
 
 /* If there's been a sender verification failure with a specific message, and
 we have not sent a response about it yet, do so now, as a preliminary line for
-failures, but not defers. However, log it in both cases. */
+failures, but not defers. However, always log it for defer, and log it for fail
+unless the sender_verify_fail log selector has been turned off. */
 
 if (sender_verified_failed != NULL &&
     !testflag(sender_verified_failed, af_sverify_told))
   {
   setflag(sender_verified_failed, af_sverify_told);
 
-  log_write(0, LOG_MAIN|LOG_REJECT, "%s sender verify %s for <%s>%s",
-    host_and_ident(TRUE),
-    ((sender_verified_failed->special_action & 255) == DEFER)? "defer" : "fail",
-    sender_verified_failed->address,
-    (sender_verified_failed->message == NULL)? US"" :
-    string_sprintf(": %s", sender_verified_failed->message));
+  if (rc != FAIL || (log_extra_selector & LX_sender_verify_fail) != 0)
+    log_write(0, LOG_MAIN|LOG_REJECT, "%s sender verify %s for <%s>%s",
+      host_and_ident(TRUE),
+      ((sender_verified_failed->special_action & 255) == DEFER)? "defer":"fail",
+      sender_verified_failed->address,
+      (sender_verified_failed->message == NULL)? US"" :
+      string_sprintf(": %s", sender_verified_failed->message));
 
   if (rc == FAIL && sender_verified_failed->user_message != NULL)
     smtp_respond(code, FALSE, string_sprintf(
@@ -2140,10 +2147,14 @@ while (done <= 0)
   switch(smtp_read_command(TRUE))
     {
     /* The AUTH command is not permitted to occur inside a transaction, and may
-    occur successfully only once per connection, and then only when we've
-    advertised it. Actually, that isn't quite true. When TLS is started, all
-    previous information about a connection must be discarded, so a new AUTH is
-    permitted at that time.
+    occur successfully only once per connection. Actually, that isn't quite
+    true. When TLS is started, all previous information about a connection must
+    be discarded, so a new AUTH is permitted at that time.
+
+    AUTH may only be used when it has been advertised. However, it seems that
+    there are clients that send AUTH when it hasn't been advertised, some of
+    them even doing this after HELO. And there are MTAs that accept this. Sigh.
+    So there's a get-out that allows this to happen.
 
     AUTH is initially labelled as a "nonmail command" so that one occurrence
     doesn't get counted. We change the label here so that multiple failing
@@ -2153,7 +2164,7 @@ while (done <= 0)
     authentication_failed = TRUE;
     cmd_list[CMD_LIST_AUTH].is_mail_cmd = FALSE;
 
-    if (!auth_advertised)
+    if (!auth_advertised && !allow_auth_unadvertised)
       {
       done = synprot_error(L_smtp_protocol_error, 503, NULL,
         US"AUTH command used when not advertised");
@@ -2208,12 +2219,13 @@ while (done <= 0)
       }
 
     /* Search for an authentication mechanism which is configured for use
-    as a server and which has been advertised. */
+    as a server and which has been advertised (unless, sigh, allow_auth_
+    unadvertised is set). */
 
     for (au = auths; au != NULL; au = au->next)
       {
       if (strcmpic(s, au->public_name) == 0 && au->server &&
-          au->advertised) break;
+          (au->advertised || allow_auth_unadvertised)) break;
       }
 
     if (au == NULL)