1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2023 */
6 /* Copyright (c) University of Cambridge 1995 - 2023 */
7 /* See the file NOTICE for conditions of use and distribution. */
8 /* SPDX-License-Identifier: GPL-2.0-or-later */
10 /* Functions concerned with verifying things. The original code for callout
11 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
15 #include "transports/smtp.h"
17 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
18 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
19 static smtp_context ctctx;
20 uschar ctbuffer[8192];
23 static uschar cutthrough_response(client_conn_ctx *, char, uschar **, int);
27 /*************************************************
28 * Retrieve a callout cache record *
29 *************************************************/
31 /* If a record exists, check whether it has expired.
34 dbm_file an open hints file
36 type "address" or "domain"
37 positive_expire expire time for positive records
38 negative_expire expire time for negative records
40 Returns: the cache record if a non-expired one exists, else NULL
43 static dbdata_callout_cache *
44 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
45 int positive_expire, int negative_expire)
50 dbdata_callout_cache *cache_record;
52 if (!(cache_record = dbfn_read_with_length(dbm_file, key, &length)))
54 HDEBUG(D_verify) debug_printf_indent("callout cache: no %s record found for %s\n", type, key);
58 /* We treat a record as "negative" if its result field is not positive, or if
59 it is a domain record and the postmaster field is negative. */
61 negative = cache_record->result != ccache_accept ||
62 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
63 expire = negative? negative_expire : positive_expire;
66 if (now - cache_record->time_stamp > expire)
68 HDEBUG(D_verify) debug_printf_indent("callout cache: %s record expired for %s\n", type, key);
72 /* If this is a non-reject domain record, check for the obsolete format version
73 that doesn't have the postmaster and random timestamps, by looking at the
74 length. If so, copy it to a new-style block, replicating the record's
75 timestamp. Then check the additional timestamps. (There's no point wasting
76 effort if connections are rejected.) */
78 if (type[0] == 'd' && cache_record->result != ccache_reject)
80 if (length == sizeof(dbdata_callout_cache_obs))
82 dbdata_callout_cache * new = store_get(sizeof(dbdata_callout_cache), GET_UNTAINTED);
83 memcpy(new, cache_record, length);
84 new->postmaster_stamp = new->random_stamp = new->time_stamp;
88 if (now - cache_record->postmaster_stamp > expire)
89 cache_record->postmaster_result = ccache_unknown;
91 if (now - cache_record->random_stamp > expire)
92 cache_record->random_result = ccache_unknown;
95 HDEBUG(D_verify) debug_printf_indent("callout cache: found %s record for %s\n", type, key);
101 /* Check the callout cache.
102 Options * pm_mailfrom may be modified by cache partial results.
104 Return: TRUE if result found
108 cached_callout_lookup(address_item * addr, const uschar * address_key,
109 const uschar * from_address, int * opt_ptr, uschar ** pm_ptr,
110 int * yield, uschar ** failure_ptr,
111 dbdata_callout_cache * new_domain_record, int * old_domain_res)
113 int options = *opt_ptr;
115 open_db *dbm_file = NULL;
117 /* Open the callout cache database, if it exists, for reading only at this
118 stage, unless caching has been disabled. */
120 if (options & vopt_callout_no_cache)
122 HDEBUG(D_verify) debug_printf_indent("callout cache: disabled by no_cache\n");
124 else if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
126 HDEBUG(D_verify) debug_printf_indent("callout cache: not available\n");
130 /* If a cache database is available see if we can avoid the need to do an
131 actual callout by making use of previously-obtained data. */
133 dbdata_callout_cache_address * cache_address_record;
134 dbdata_callout_cache * cache_record = get_callout_cache_record(dbm_file,
135 addr->domain, US"domain",
136 callout_cache_domain_positive_expire, callout_cache_domain_negative_expire);
138 /* If an unexpired cache record was found for this domain, see if the callout
139 process can be short-circuited. */
143 /* In most cases, if an early command (up to and including MAIL FROM:<>)
144 was rejected, there is no point carrying on. The callout fails. However, if
145 we are doing a recipient verification with use_sender or use_postmaster
146 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
147 will be using a non-empty sender. We have to remember this situation so as
148 not to disturb the cached domain value if this whole verification succeeds
149 (we don't want it turning into "accept"). */
151 *old_domain_res = cache_record->result;
153 if ( cache_record->result == ccache_reject
154 || *from_address == 0 && cache_record->result == ccache_reject_mfnull)
157 debug_printf_indent("callout cache: domain gave initial rejection, or "
158 "does not accept HELO or MAIL FROM:<>\n");
159 setflag(addr, af_verify_nsfail);
160 addr->user_message = US"(result of an earlier callout reused).";
162 *failure_ptr = US"mail";
163 dbfn_close(dbm_file);
167 /* If a previous check on a "random" local part was accepted, we assume
168 that the server does not do any checking on local parts. There is therefore
169 no point in doing the callout, because it will always be successful. If a
170 random check previously failed, arrange not to do it again, but preserve
171 the data in the new record. If a random check is required but hasn't been
172 done, skip the remaining cache processing. */
174 if (options & vopt_callout_random) switch(cache_record->random_result)
178 debug_printf_indent("callout cache: domain accepts random addresses\n");
179 *failure_ptr = US"random";
180 dbfn_close(dbm_file);
181 return TRUE; /* Default yield is OK */
185 debug_printf_indent("callout cache: domain rejects random addresses\n");
186 *opt_ptr = options & ~vopt_callout_random;
187 new_domain_record->random_result = ccache_reject;
188 new_domain_record->random_stamp = cache_record->random_stamp;
193 debug_printf_indent("callout cache: need to check random address handling "
194 "(not cached or cache expired)\n");
195 dbfn_close(dbm_file);
199 /* If a postmaster check is requested, but there was a previous failure,
200 there is again no point in carrying on. If a postmaster check is required,
201 but has not been done before, we are going to have to do a callout, so skip
202 remaining cache processing. */
206 if (cache_record->postmaster_result == ccache_reject)
208 setflag(addr, af_verify_pmfail);
210 debug_printf_indent("callout cache: domain does not accept "
211 "RCPT TO:<postmaster@domain>\n");
213 *failure_ptr = US"postmaster";
214 setflag(addr, af_verify_pmfail);
215 addr->user_message = US"(result of earlier verification reused).";
216 dbfn_close(dbm_file);
219 if (cache_record->postmaster_result == ccache_unknown)
222 debug_printf_indent("callout cache: need to check RCPT "
223 "TO:<postmaster@domain> (not cached or cache expired)\n");
224 dbfn_close(dbm_file);
228 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
229 postmaster check if the address itself has to be checked. Also ensure
230 that the value in the cache record is preserved (with its old timestamp).
233 HDEBUG(D_verify) debug_printf_indent("callout cache: domain accepts RCPT "
234 "TO:<postmaster@domain>\n");
236 new_domain_record->postmaster_result = ccache_accept;
237 new_domain_record->postmaster_stamp = cache_record->postmaster_stamp;
241 /* We can't give a result based on information about the domain. See if there
242 is an unexpired cache record for this specific address (combined with the
243 sender address if we are doing a recipient callout with a non-empty sender).
246 if (!(cache_address_record = (dbdata_callout_cache_address *)
247 get_callout_cache_record(dbm_file, address_key, US"address",
248 callout_cache_positive_expire, callout_cache_negative_expire)))
250 dbfn_close(dbm_file);
254 if (cache_address_record->result == ccache_accept)
257 debug_printf_indent("callout cache: address record is positive\n");
262 debug_printf_indent("callout cache: address record is negative\n");
263 addr->user_message = US"Previous (cached) callout verification failure";
264 *failure_ptr = US"recipient";
268 /* Close the cache database while we actually do the callout for real. */
270 dbfn_close(dbm_file);
277 /* Write results to callout cache
280 cache_callout_write(dbdata_callout_cache * dom_rec, const uschar * domain,
281 int done, dbdata_callout_cache_address * addr_rec, const uschar * address_key)
284 open_db * dbm_file = NULL;
286 /* If we get here with done == TRUE, a successful callout happened, and yield
287 will be set OK or FAIL according to the response to the RCPT command.
288 Otherwise, we looped through the hosts but couldn't complete the business.
289 However, there may be domain-specific information to cache in both cases.
291 The value of the result field in the new_domain record is ccache_unknown if
292 there was an error before or with MAIL FROM:, and errno was not zero,
293 implying some kind of I/O error. We don't want to write the cache in that case.
294 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
296 if (dom_rec->result != ccache_unknown)
297 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
299 HDEBUG(D_verify) debug_printf_indent("callout cache: not available\n");
303 (void)dbfn_write(dbm_file, domain, dom_rec,
304 (int)sizeof(dbdata_callout_cache));
305 HDEBUG(D_verify) debug_printf_indent("wrote callout cache domain record for %s:\n"
306 " result=%d postmaster=%d random=%d\n",
309 dom_rec->postmaster_result,
310 dom_rec->random_result);
313 /* If a definite result was obtained for the callout, cache it unless caching
316 if (done && addr_rec->result != ccache_unknown)
319 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE);
322 HDEBUG(D_verify) debug_printf_indent("no callout cache available\n");
326 (void)dbfn_write(dbm_file, address_key, addr_rec,
327 (int)sizeof(dbdata_callout_cache_address));
328 HDEBUG(D_verify) debug_printf_indent("wrote %s callout cache address record for %s\n",
329 addr_rec->result == ccache_accept ? "positive" : "negative",
334 if (dbm_file) dbfn_close(dbm_file);
338 /* Cutthrough-multi. If the existing cached cutthrough connection matches
339 the one we would make for a subsequent recipient, use it. Send the RCPT TO
340 and check the result, nonpipelined as it may be wanted immediately for
341 recipient-verification.
343 It seems simpler to deal with this case separately from the main callout loop.
344 We will need to remember it has sent, or not, so that rcpt-acl tail code
345 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
347 Return: TRUE for a definitive result for the recipient
350 cutthrough_multi(address_item * addr, host_item * host_list,
351 transport_feedback * tf, int * yield)
355 if (addr->transport == cutthrough.addr.transport)
356 for (host_item * host = host_list; host; host = host->next)
357 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
360 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
363 deliver_host = host->name;
364 deliver_host_address = host->address;
365 deliver_host_port = host->port;
366 deliver_domain = addr->domain;
367 transport_name = addr->transport->name;
369 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
371 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
373 || !smtp_get_port(tf->port, addr, &port, US"callout")
375 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
378 smtp_port_for_connect(host, port);
380 if ( ( interface == cutthrough.interface
382 && cutthrough.interface
383 && Ustrcmp(interface, cutthrough.interface) == 0
385 && host->port == cutthrough.host.port
388 uschar * resp = NULL;
390 /* Match! Send the RCPT TO, set done from the response */
392 smtp_write_command(&ctctx, SCMD_FLUSH, "RCPT TO:<%.1000s>\r\n",
393 transport_rcpt_address(addr,
394 addr->transport->rcpt_include_affixes)) >= 0
395 && cutthrough_response(&cutthrough.cctx, '2', &resp,
396 CUTTHROUGH_DATA_TIMEOUT) == '2';
398 /* This would go horribly wrong if a callout fail was ignored by ACL.
399 We punt by abandoning cutthrough on a reject, like the
404 address_item * na = store_get(sizeof(address_item), GET_UNTAINTED);
405 *na = cutthrough.addr;
406 cutthrough.addr = *addr;
407 cutthrough.addr.host_used = &cutthrough.host;
408 cutthrough.addr.next = na;
414 cancel_cutthrough_connection(TRUE, US"recipient rejected");
415 if (!resp || errno == ETIMEDOUT)
417 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
422 Ustrcpy(resp, US"connection dropped");
425 string_sprintf("response to \"%s\" was: %s",
426 big_buffer, string_printing(resp));
429 string_sprintf("Callout verification failed:\n%s", resp);
431 /* Hard rejection ends the process */
433 if (resp[0] == '5') /* Address rejected */
441 break; /* host_list */
444 cancel_cutthrough_connection(TRUE, US"incompatible connection");
451 /* A rcpt callout, or cached record of one, verified the address.
452 Set $domain_data and $local_part_data to detainted versions.
455 callout_verified_rcpt(const address_item * addr)
457 address_item a = {.address = addr->address};
458 if (deliver_split_address(&a) != OK) return;
459 deliver_localpart_data = string_copy_taint(a.local_part, GET_UNTAINTED);
460 deliver_domain_data = string_copy_taint(a.domain, GET_UNTAINTED);
464 /*************************************************
465 * Do callout verification for an address *
466 *************************************************/
468 /* This function is called from verify_address() when the address has routed to
469 a host list, and a callout has been requested. Callouts are expensive; that is
470 why a cache is used to improve the efficiency.
473 addr the address that's been routed
474 host_list the list of hosts to try
475 tf the transport feedback block
477 ifstring "interface" option from transport, or NULL
478 portstring "port" option from transport, or NULL
479 protocolstring "protocol" option from transport, or NULL
480 callout the per-command callout timeout
481 callout_overall the overall callout timeout (if < 0 use 4*callout)
482 callout_connect the callout connection timeout (if < 0 use callout)
483 options the verification options - these bits are used:
484 vopt_is_recipient => this is a recipient address
485 vopt_callout_no_cache => don't use callout cache
486 vopt_callout_fullpm => if postmaster check, do full one
487 vopt_callout_random => do the "random" thing
488 vopt_callout_recipsender => use real sender for recipient
489 vopt_callout_recippmaster => use postmaster for recipient
490 vopt_callout_hold => lazy close connection
491 se_mailfrom MAIL FROM address for sender verify; NULL => ""
492 pm_mailfrom if non-NULL, do the postmaster check with this sender
494 Returns: OK/FAIL/DEFER
498 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
499 int callout, int callout_overall, int callout_connect, int options,
500 uschar *se_mailfrom, uschar *pm_mailfrom)
503 int old_domain_cache_result = ccache_accept;
505 const uschar * address_key;
506 const uschar * from_address;
507 uschar * random_local_part = NULL;
508 const uschar * save_deliver_domain = deliver_domain;
509 uschar ** failure_ptr = options & vopt_is_recipient
510 ? &recipient_verify_failure : &sender_verify_failure;
511 dbdata_callout_cache new_domain_record;
512 dbdata_callout_cache_address new_address_record;
513 time_t callout_start_time;
515 new_domain_record.result = ccache_unknown;
516 new_domain_record.postmaster_result = ccache_unknown;
517 new_domain_record.random_result = ccache_unknown;
519 memset(&new_address_record, 0, sizeof(new_address_record));
521 /* For a recipient callout, the key used for the address cache record must
522 include the sender address if we are using the real sender in the callout,
523 because that may influence the result of the callout. */
525 if (options & vopt_is_recipient)
526 if (options & vopt_callout_recipsender)
528 from_address = sender_address;
529 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
530 if (cutthrough.delivery) options |= vopt_callout_no_cache;
532 else if (options & vopt_callout_recippmaster)
534 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
535 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
536 qualify_domain_sender);
541 address_key = addr->address;
544 /* For a sender callout, we must adjust the key if the mailfrom address is not
549 from_address = se_mailfrom ? se_mailfrom : US"";
550 address_key = *from_address
551 ? string_sprintf("%s/<%s>", addr->address, from_address) : addr->address;
554 if (cached_callout_lookup(addr, address_key, from_address,
555 &options, &pm_mailfrom, &yield, failure_ptr,
556 &new_domain_record, &old_domain_cache_result))
558 cancel_cutthrough_connection(TRUE, US"cache-hit");
562 if (!addr->transport)
564 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
567 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
568 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
569 addr->transport->name, addr->transport->driver_name);
572 smtp_transport_options_block *ob =
573 (smtp_transport_options_block *)addr->transport->options_block;
574 smtp_context * sx = NULL;
576 /* The information wasn't available in the cache, so we have to do a real
577 callout and save the result in the cache for next time, unless no_cache is set,
578 or unless we have a previously cached negative random result. If we are to test
579 with a random local part, ensure that such a local part is available. If not,
580 log the fact, but carry on without randomising. */
582 if (options & vopt_callout_random && callout_random_local_part)
583 if (!(random_local_part = expand_string(callout_random_local_part)))
584 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
585 "callout_random_local_part: %s", expand_string_message);
587 /* Compile regex' used by client-side smtp */
591 /* Default the connect and overall callout timeouts if not set, and record the
592 time we are starting so that we can enforce it. */
594 if (callout_overall < 0) callout_overall = 4 * callout;
595 if (callout_connect < 0) callout_connect = callout;
596 callout_start_time = time(NULL);
598 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
599 output because a callout might take some time. When PIPELINING is active and
600 there are many recipients, the total time for doing lots of callouts can add up
601 and cause the client to time out. So in this case we forgo the PIPELINING
604 if (smtp_out && !f.disable_callout_flush) mac_smtp_fflush();
606 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
607 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
609 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
610 and we are holding a cutthrough conn open, we can just append the rcpt to
611 that conn for verification purposes (and later delivery also). Simplest
612 coding means skipping this whole loop and doing the append separately. */
614 /* Can we re-use an open cutthrough connection? */
615 if ( cutthrough.cctx.sock >= 0
616 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
617 == vopt_callout_recipsender
618 && !random_local_part
621 done = cutthrough_multi(addr, host_list, tf, &yield);
623 /* If we did not use a cached connection, make connections to the hosts
624 and do real callouts. The list of hosts is passed in as an argument. */
626 for (host_item * host = host_list; host && !done; host = host->next)
630 uschar * interface = NULL; /* Outgoing interface to use; NULL => any */
634 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
639 /* Check the overall callout timeout */
641 if (time(NULL) - callout_start_time >= callout_overall)
643 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
647 /* Set IPv4 or IPv6 */
649 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
651 /* Expand and interpret the interface and port strings. The latter will not
652 be used if there is a host-specific port (e.g. from a manualroute router).
653 This has to be delayed till now, because they may expand differently for
654 different hosts. If there's a failure, log it, but carry on with the
657 deliver_host = host->name;
658 deliver_host_address = host->address;
659 deliver_host_port = host->port;
660 deliver_domain = addr->domain;
661 transport_name = addr->transport->name;
663 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
665 || !smtp_get_port(tf->port, addr, &port, US"callout")
667 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
670 if (!sx) sx = store_get(sizeof(*sx), GET_TAINTED); /* tainted buffers */
671 memset(sx, 0, sizeof(*sx));
673 sx->addrlist = sx->first_addr = addr;
674 sx->conn_args.host = host;
675 sx->conn_args.host_af = host_af,
677 sx->conn_args.interface = interface;
678 sx->helo_data = tf->helo_data;
679 sx->conn_args.tblock = addr->transport;
680 sx->cctx.sock = sx->conn_args.sock = -1;
683 tls_retry_connection:
684 /* Set the address state so that errors are recorded in it */
686 addr->transport_return = PENDING_DEFER;
687 ob->connect_timeout = callout_connect;
688 ob->command_timeout = callout;
690 /* Get the channel set up ready for a message (MAIL FROM being the next
691 SMTP command to send. If we tried TLS but it failed, try again without
694 yield = smtp_setup_conn(sx, FALSE);
697 && addr->basic_errno == ERRNO_TLSFAILURE
698 && ob->tls_tempfail_tryclear
699 && verify_check_given_host(CUSS &ob->hosts_require_tls, host) != OK
702 log_write(0, LOG_MAIN,
703 "%s: callout unencrypted to %s [%s] (not in hosts_require_tls)",
704 addr->message, host->name, host->address);
705 addr->transport_return = PENDING_DEFER;
706 yield = smtp_setup_conn(sx, TRUE);
711 errno = addr->basic_errno;
713 /* For certain errors we want specifically to log the transport name,
714 for ease of fixing config errors. Slightly ugly doing it here, but we want
715 to not leak that also in the SMTP response. */
720 case EPROTONOSUPPORT:
721 case ESOCKTNOSUPPORT:
729 log_write(0, LOG_MAIN|LOG_PANIC,
730 "%s verify %s (making calloout connection): T=%s %s",
731 options & vopt_is_recipient ? "sender" : "recipient",
732 yield == FAIL ? "fail" : "defer",
733 transport_name, strerror(errno));
736 transport_name = NULL;
737 deliver_host = deliver_host_address = NULL;
738 deliver_domain = save_deliver_domain;
740 /* Failure to accept HELO is cached; this blocks the whole domain for all
741 senders. I/O errors and defer responses are not cached. */
743 if (yield == FAIL && (errno == 0 || errno == ERRNO_SMTPCLOSED))
745 setflag(addr, af_verify_nsfail);
746 new_domain_record.result = ccache_reject;
754 /* If we needed to authenticate, smtp_setup_conn() did that. Copy
755 the AUTH info for logging */
757 addr->authenticator = client_authenticator;
758 addr->auth_id = client_authenticated_id;
760 sx->from_addr = from_address;
761 sx->first_addr = sx->sync_addr = addr;
762 sx->ok = FALSE; /*XXX these 3 last might not be needed for verify? */
763 sx->send_rset = TRUE;
764 sx->completed_addr = FALSE;
766 new_domain_record.result = old_domain_cache_result == ccache_reject_mfnull
767 ? ccache_reject_mfnull : ccache_accept;
769 /* Do the random local part check first. Temporarily replace the recipient
770 with the "random" value */
772 if (random_local_part)
774 const uschar * main_address = addr->address;
775 const uschar * rcpt_domain = addr->domain;
778 uschar * errstr = NULL;
779 if ( testflag(addr, af_utf8_downcvt)
780 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
784 addr->message = errstr;
785 errno = ERRNO_EXPANDFAIL;
786 setflag(addr, af_verify_nsfail);
788 rcpt_domain = US""; /*XXX errorhandling! */
792 /* This would be ok for 1st rcpt of a cutthrough (the case handled here;
793 subsequents are done in cutthrough_multi()), but no way to
794 handle a subsequent because of the RSET vaporising the MAIL FROM.
795 So refuse to support any. Most cutthrough use will not involve
796 random_local_part, so no loss. */
797 cancel_cutthrough_connection(TRUE, US"random-recipient");
799 addr->address = string_sprintf("%s@%.1000s",
800 random_local_part, rcpt_domain);
803 /* If accepted, we aren't going to do any further tests below.
804 Otherwise, cache a real negative response, and get back to the right
805 state to send RCPT. Unless there's some problem such as a dropped
806 connection, we expect to succeed, because the commands succeeded above.
807 However, some servers drop the connection after responding to an
808 invalid recipient, so on (any) error we drop and remake the connection.
809 XXX We don't care about that for postmaster_full. Should we?
811 XXX could we add another flag to the context, and have the common
812 code emit the RSET too? Even pipelined after the RCPT...
813 Then the main-verify call could use it if there's to be a subsequent
815 The sync_responses() would need to be taught about it and we'd
816 need another return code filtering out to here.
818 Avoid using a SIZE option on the MAIL for all random-rcpt checks.
821 sx->avoid_option = OPTION_SIZE;
823 /* Remember when we last did a random test */
824 new_domain_record.random_stamp = time(NULL);
826 if (smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0)
827 switch(addr->transport_return)
829 case PENDING_OK: /* random was accepted, unfortunately */
830 new_domain_record.random_result = ccache_accept;
831 yield = OK; /* Only usable verify result we can return */
833 *failure_ptr = US"random";
835 case FAIL: /* rejected: the preferred result */
836 new_domain_record.random_result = ccache_reject;
837 sx->avoid_option = 0;
839 /* Between each check, issue RSET, because some servers accept only
840 one recipient after MAIL FROM:<>.
841 XXX We don't care about that for postmaster_full. Should we? */
844 smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0 &&
845 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout)))
849 debug_printf_indent("problem after random/rset/mfrom; reopen conn\n");
850 random_local_part = NULL;
852 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
854 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
855 (void)close(sx->cctx.sock);
857 #ifndef DISABLE_EVENT
858 (void) event_raise(addr->transport->event_action,
859 US"tcp:close", NULL, NULL);
861 addr->address = main_address;
862 addr->transport_return = PENDING_DEFER;
863 sx->first_addr = sx->sync_addr = addr;
865 sx->send_rset = TRUE;
866 sx->completed_addr = FALSE;
867 goto tls_retry_connection;
868 case DEFER: /* 4xx response to random */
869 break; /* Just to be clear. ccache_unknown, !done. */
872 /* Re-setup for main verify, or for the error message when failing */
873 addr->address = main_address;
874 addr->transport_return = PENDING_DEFER;
875 sx->first_addr = sx->sync_addr = addr;
877 sx->send_rset = TRUE;
878 sx->completed_addr = FALSE;
883 /* Main verify. For rcpt-verify use SIZE if we know it and we're not cacheing;
884 for sndr-verify never use it. */
888 if (!(options & vopt_is_recipient && options & vopt_callout_no_cache))
889 sx->avoid_option = OPTION_SIZE;
892 switch(smtp_write_mail_and_rcpt_cmds(sx, &yield))
894 case 0: switch(addr->transport_return) /* ok so far */
896 case PENDING_OK: done = TRUE;
897 new_address_record.result = ccache_accept;
899 case FAIL: done = TRUE;
901 *failure_ptr = US"recipient";
902 new_address_record.result = ccache_reject;
908 case -1: /* MAIL response error */
909 *failure_ptr = US"mail";
910 if (errno == 0 && sx->buffer[0] == '5')
912 setflag(addr, af_verify_nsfail);
913 if (from_address[0] == 0)
914 new_domain_record.result = ccache_reject_mfnull;
917 /* non-MAIL read i/o error */
918 /* non-MAIL response timeout */
919 /* internal error; channel still usable */
920 default: break; /* transmit failed */
924 addr->auth_sndr = client_authenticated_sender;
926 deliver_host = deliver_host_address = NULL;
927 deliver_domain = save_deliver_domain;
929 /* Do postmaster check if requested; if a full check is required, we
930 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
932 if (done && pm_mailfrom)
934 /* Could possibly shift before main verify, just above, and be ok
935 for cutthrough. But no way to handle a subsequent rcpt, so just
937 cancel_cutthrough_connection(TRUE, US"postmaster verify");
938 HDEBUG(D_acl|D_v) debug_printf_indent("Cutthrough cancelled by presence of postmaster verify\n");
940 done = smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0
941 && smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout);
945 const uschar * main_address = addr->address;
947 /*XXX oops, affixes */
948 addr->address = string_sprintf("postmaster@%.1000s", addr->domain);
949 addr->transport_return = PENDING_DEFER;
951 sx->from_addr = pm_mailfrom;
952 sx->first_addr = sx->sync_addr = addr;
954 sx->send_rset = TRUE;
955 sx->completed_addr = FALSE;
956 sx->avoid_option = OPTION_SIZE;
958 if( smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0
959 && addr->transport_return == PENDING_OK
963 done = (options & vopt_callout_fullpm) != 0
964 && smtp_write_command(sx, SCMD_FLUSH,
965 "RCPT TO:<postmaster>\r\n") >= 0
966 && smtp_read_response(sx, sx->buffer,
967 sizeof(sx->buffer), '2', callout);
969 /* Sort out the cache record */
971 new_domain_record.postmaster_stamp = time(NULL);
974 new_domain_record.postmaster_result = ccache_accept;
975 else if (errno == 0 && sx->buffer[0] == '5')
977 *failure_ptr = US"postmaster";
978 setflag(addr, af_verify_pmfail);
979 new_domain_record.postmaster_result = ccache_reject;
982 addr->address = main_address;
985 /* For any failure of the main check, other than a negative response, we just
986 close the connection and carry on. We can identify a negative response by the
987 fact that errno is zero. For I/O errors it will be non-zero
989 Set up different error texts for logging and for sending back to the caller
990 as an SMTP response. Log in all cases, using a one-line format. For sender
991 callouts, give a full response to the caller, but for recipient callouts,
992 don't give the IP address because this may be an internal host whose identity
993 is not to be widely broadcast. */
999 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
1000 sx->send_quit = FALSE;
1004 case ERRNO_UTF8_FWD:
1006 extern int acl_where; /* src/acl.c */
1008 addr->message = US"response to \"EHLO\" did not include SMTPUTF8";
1009 addr->user_message = acl_where == ACL_WHERE_RCPT
1010 ? US"533 no support for internationalised mailbox name"
1011 : US"550 mailbox unavailable";
1018 sx->send_quit = FALSE;
1022 if (*sx->buffer == 0) Ustrcpy(sx->buffer, US"connection dropped");
1024 /*XXX test here is ugly; seem to have a split of responsibility for
1025 building this message. Need to rationalise. Where is it done
1026 before here, and when not?
1027 Not == 5xx resp to MAIL on main-verify
1029 if (!addr->message) addr->message =
1030 string_sprintf("response to \"%s\" was: %s",
1031 big_buffer, string_printing(sx->buffer));
1033 /* RFC 5321 section 4.2: the text portion of the response may have only
1034 HT, SP, Printable US-ASCII. Deal with awkward chars by cutting the
1035 received message off before passing it onward. Newlines are ok; they
1036 just become a multiline response (but wrapped in the error code we
1039 for (uschar * s = sx->buffer;
1040 *s && s < sx->buffer + sizeof(sx->buffer);
1044 if (c != '\t' && c != '\n' && (c < ' ' || c > '~'))
1046 if (s - sx->buffer < sizeof(sx->buffer) - 12)
1047 memcpy(s, "(truncated)", 12);
1053 addr->user_message = options & vopt_is_recipient
1054 ? string_sprintf("Callout verification failed:\n%s", sx->buffer)
1055 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1056 host->address, big_buffer, sx->buffer);
1058 /* Hard rejection ends the process */
1060 if (sx->buffer[0] == '5') /* Address rejected */
1068 /* End the SMTP conversation and close the connection. */
1070 /* Cutthrough - on a successful connect and recipient-verify with
1071 use-sender and we are 1st rcpt and have no cutthrough conn so far
1072 here is where we want to leave the conn open. Ditto for a lazy-close
1075 if (cutthrough.delivery)
1077 if (addr->transport->filter_command)
1079 cutthrough.delivery= FALSE;
1080 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
1082 #ifndef DISABLE_DKIM
1083 /* DKIM signing needs to add a header after seeing the whole body, so we cannot just copy
1084 body bytes to the outbound as they are received, which is the intent of cutthrough. */
1085 if (ob->dkim.dkim_domain)
1087 cutthrough.delivery= FALSE;
1088 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
1091 #ifdef EXPERIMENTAL_ARC
1094 cutthrough.delivery= FALSE;
1095 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of ARC signing\n");
1100 if ( (cutthrough.delivery || options & vopt_callout_hold)
1104 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1105 == vopt_callout_recipsender
1106 && !random_local_part
1108 && cutthrough.cctx.sock < 0
1112 HDEBUG(D_acl|D_v) debug_printf_indent("holding verify callout open for %s\n",
1114 ? "cutthrough delivery" : "potential further verifies and delivery");
1116 cutthrough.callout_hold_only = !cutthrough.delivery;
1117 cutthrough.is_tls = tls_out.active.sock >= 0;
1118 /* We assume no buffer in use in the outblock */
1119 cutthrough.cctx = sx->cctx;
1120 cutthrough.nrcpt = 1;
1121 cutthrough.transport = addr->transport->name;
1122 cutthrough.interface = interface;
1123 cutthrough.snd_port = sending_port;
1124 cutthrough.peer_options = smtp_peer_options;
1125 cutthrough.host = *host;
1127 int oldpool = store_pool;
1128 store_pool = POOL_PERM;
1129 cutthrough.snd_ip = string_copy(sending_ip_address);
1130 cutthrough.host.name = string_copy(host->name);
1131 cutthrough.host.address = string_copy(host->address);
1132 store_pool = oldpool;
1135 /* Save the address_item and parent chain for later logging */
1136 cutthrough.addr = *addr;
1137 cutthrough.addr.next = NULL;
1138 cutthrough.addr.host_used = &cutthrough.host;
1139 for (address_item * caddr = &cutthrough.addr, * parent = addr->parent;
1141 caddr = caddr->parent, parent = parent->parent)
1142 *(caddr->parent = store_get(sizeof(address_item), GET_UNTAINTED)) = *parent;
1144 ctctx.outblock.buffer = ctbuffer;
1145 ctctx.outblock.buffersize = sizeof(ctbuffer);
1146 ctctx.outblock.ptr = ctbuffer;
1147 /* ctctx.outblock.cmd_count = 0; ctctx.outblock.authenticating = FALSE; */
1148 ctctx.outblock.cctx = &cutthrough.cctx;
1152 /* Ensure no cutthrough on multiple verifies that were incompatible */
1153 if (options & vopt_callout_recipsender)
1154 cancel_cutthrough_connection(TRUE, US"not usable for cutthrough");
1155 if (sx->send_quit && sx->cctx.sock >= 0)
1156 if (smtp_write_command(sx, SCMD_FLUSH, "QUIT\r\n") != -1)
1157 /* Wait a short time for response, and discard it */
1158 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', 1);
1160 if (sx->cctx.sock >= 0)
1163 if (sx->cctx.tls_ctx)
1165 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1166 sx->cctx.tls_ctx = NULL;
1169 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1170 (void)close(sx->cctx.sock);
1172 smtp_debug_cmd_report();
1173 #ifndef DISABLE_EVENT
1174 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL, NULL);
1179 if (!done || yield != OK)
1180 addr->message = string_sprintf("%s [%s] : %s", host->name, host->address,
1182 } /* Loop through all hosts, while !done */
1185 /* If we get here with done == TRUE, a successful callout happened, and yield
1186 will be set OK or FAIL according to the response to the RCPT command.
1187 Otherwise, we looped through the hosts but couldn't complete the business.
1188 However, there may be domain-specific information to cache in both cases. */
1190 if (!(options & vopt_callout_no_cache))
1191 cache_callout_write(&new_domain_record, addr->domain,
1192 done, &new_address_record, address_key);
1194 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1195 temporary error. If there was only one host, and a response was received, leave
1196 it alone if supplying details. Otherwise, give a generic response. */
1200 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
1201 options & vopt_is_recipient ? "recipient" : "sender");
1204 addr->message = host_list->next || !addr->message
1205 ? dullmsg : string_sprintf("%s: %s", dullmsg, addr->message);
1207 addr->user_message = smtp_return_error_details
1208 ? string_sprintf("%s for <%s>.\n"
1209 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1210 "they may be permanently unreachable from this server. In the latter case,\n%s",
1211 dullmsg, addr->address,
1212 options & vopt_is_recipient
1213 ? "the address will never be accepted."
1214 : "you need to change the address or create an MX record for its domain\n"
1215 "if it is supposed to be generally accessible from the Internet.\n"
1216 "Talk to your mail administrator for details.")
1219 /* Force a specific error code */
1221 addr->basic_errno = ERRNO_CALLOUTDEFER;
1224 /* Come here from within the cache-reading code on fast-track exit. */
1227 tls_modify_variables(&tls_in); /* return variables to inbound values */
1233 /* Called after recipient-acl to get a cutthrough connection open when
1234 one was requested and a recipient-verify wasn't subsequently done.
1237 open_cutthrough_connection(address_item * addr)
1242 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1243 /* We must use a copy of the address for verification, because it might
1247 HDEBUG(D_acl) debug_printf_indent("----------- %s cutthrough setup ------------\n",
1248 rcpt_count > 1 ? "more" : "start");
1249 rc = verify_address(&addr2, NULL,
1250 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1251 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1253 addr->message = addr2.message;
1254 addr->user_message = addr2.user_message;
1255 HDEBUG(D_acl) debug_printf_indent("----------- end cutthrough setup ------------\n");
1261 /* Send given number of bytes from the buffer */
1263 cutthrough_send(int n)
1265 if(cutthrough.cctx.sock < 0)
1271 ? tls_write(cutthrough.cctx.tls_ctx, ctctx.outblock.buffer, n, FALSE)
1274 send(cutthrough.cctx.sock, ctctx.outblock.buffer, n, 0) > 0
1277 transport_count += n;
1278 ctctx.outblock.ptr= ctctx.outblock.buffer;
1282 HDEBUG(D_transport|D_acl) debug_printf_indent("cutthrough_send failed: %s\n", strerror(errno));
1289 _cutthrough_puts(const uschar * cp, int n)
1293 if(ctctx.outblock.ptr >= ctctx.outblock.buffer+ctctx.outblock.buffersize)
1294 if(!cutthrough_send(ctctx.outblock.buffersize))
1297 *ctctx.outblock.ptr++ = *cp++;
1302 /* Buffered output of counted data block. Return boolean success */
1304 cutthrough_puts(const uschar * cp, int n)
1306 if (cutthrough.cctx.sock < 0) return TRUE;
1307 if (_cutthrough_puts(cp, n)) return TRUE;
1308 cancel_cutthrough_connection(TRUE, US"transmit failed");
1313 cutthrough_data_puts(uschar * cp, int n)
1315 if (cutthrough.delivery) (void) cutthrough_puts(cp, n);
1321 _cutthrough_flush_send(void)
1323 int n = ctctx.outblock.ptr - ctctx.outblock.buffer;
1326 if(!cutthrough_send(n))
1332 /* Send out any bufferred output. Return boolean success. */
1334 cutthrough_flush_send(void)
1336 if (_cutthrough_flush_send()) return TRUE;
1337 cancel_cutthrough_connection(TRUE, US"transmit failed");
1343 cutthrough_put_nl(void)
1345 return cutthrough_puts(US"\r\n", 2);
1350 cutthrough_data_put_nl(void)
1352 cutthrough_data_puts(US"\r\n", 2);
1356 /* Get and check response from cutthrough target.
1361 - cutthrough conn close
1364 cutthrough_response(client_conn_ctx * cctx, char expect, uschar ** copy, int timeout)
1366 smtp_context sx = {0};
1367 uschar inbuffer[4096];
1368 uschar responsebuffer[4096];
1370 sx.inblock.buffer = inbuffer;
1371 sx.inblock.buffersize = sizeof(inbuffer);
1372 sx.inblock.ptr = inbuffer;
1373 sx.inblock.ptrend = inbuffer;
1374 sx.inblock.cctx = cctx;
1375 if(!smtp_read_response(&sx, responsebuffer, sizeof(responsebuffer), expect, timeout))
1376 cancel_cutthrough_connection(TRUE, US"unexpected response to smtp command");
1381 *copy = cp = string_copy(responsebuffer);
1382 /* Trim the trailing end of line */
1383 cp += Ustrlen(responsebuffer);
1384 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1385 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1388 return responsebuffer[0];
1392 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1394 cutthrough_predata(void)
1396 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1399 smtp_debug_cmd(US"DATA", 0);
1400 cutthrough_puts(US"DATA\r\n", 6);
1401 cutthrough_flush_send();
1403 /* Assume nothing buffered. If it was it gets ignored. */
1404 return cutthrough_response(&cutthrough.cctx, '3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
1408 /* tctx arg only to match write_chunk() */
1410 cutthrough_write_chunk(transport_ctx * tctx, const uschar * s, int len)
1413 while(s && (s2 = Ustrchr(s, '\n')))
1415 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1423 /* Buffered send of headers. Return success boolean. */
1424 /* Expands newlines to wire format (CR,NL). */
1425 /* Also sends header-terminating blank line. */
1427 cutthrough_headers_send(void)
1431 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1434 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1435 but having a separate buffered-output function (for now)
1437 HDEBUG(D_acl) debug_printf_indent("----------- start cutthrough headers send -----------\n");
1439 tctx.u.fd = cutthrough.cctx.sock;
1440 tctx.tblock = cutthrough.addr.transport;
1441 tctx.addr = &cutthrough.addr;
1442 tctx.check_string = US".";
1443 tctx.escape_string = US"..";
1444 /*XXX check under spool_files_wireformat. Might be irrelevant */
1445 tctx.options = topt_use_crlf;
1447 if (!transport_headers_send(&tctx, &cutthrough_write_chunk))
1450 HDEBUG(D_acl) debug_printf_indent("----------- done cutthrough headers send ------------\n");
1456 close_cutthrough_connection(const uschar * why)
1458 int fd = cutthrough.cctx.sock;
1461 /* We could be sending this after a bunch of data, but that is ok as
1462 the only way to cancel the transfer in dataphase is to drop the tcp
1463 conn before the final dot.
1465 client_conn_ctx tmp_ctx = cutthrough.cctx;
1466 ctctx.outblock.ptr = ctbuffer;
1467 smtp_debug_cmd(US"QUIT", 0);
1468 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1469 _cutthrough_flush_send();
1470 cutthrough.cctx.sock = -1; /* avoid recursion via read timeout */
1471 cutthrough.nrcpt = 0; /* permit re-cutthrough on subsequent message */
1473 /* Wait a short time for response, and discard it */
1474 cutthrough_response(&tmp_ctx, '2', NULL, 1);
1477 if (cutthrough.is_tls)
1479 tls_close(cutthrough.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1480 cutthrough.cctx.tls_ctx = NULL;
1481 cutthrough.is_tls = FALSE;
1484 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1486 smtp_debug_cmd_report();
1487 HDEBUG(D_acl) debug_printf_indent("----------- cutthrough shutdown (%s) ------------\n", why);
1489 ctctx.outblock.ptr = ctbuffer;
1493 cancel_cutthrough_connection(BOOL close_noncutthrough_verifies, const uschar * why)
1495 if (cutthrough.delivery || close_noncutthrough_verifies)
1496 close_cutthrough_connection(why);
1497 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1502 release_cutthrough_connection(const uschar * why)
1504 if (cutthrough.cctx.sock < 0) return;
1505 HDEBUG(D_acl) debug_printf_indent("release cutthrough conn: %s\n", why);
1506 cutthrough.cctx.sock = -1;
1507 cutthrough.cctx.tls_ctx = NULL;
1508 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1514 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1515 Log an OK response as a transmission.
1516 Close the connection.
1517 Return smtp response-class digit.
1520 cutthrough_finaldot(void)
1523 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> .\n");
1525 /* Assume data finshed with new-line */
1526 if( !cutthrough_puts(US".", 1)
1527 || !cutthrough_put_nl()
1528 || !cutthrough_flush_send()
1530 return cutthrough.addr.message;
1532 res = cutthrough_response(&cutthrough.cctx, '2', &cutthrough.addr.message,
1533 CUTTHROUGH_DATA_TIMEOUT);
1534 for (address_item * addr = &cutthrough.addr; addr; addr = addr->next)
1536 addr->message = cutthrough.addr.message;
1540 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1541 close_cutthrough_connection(US"delivered");
1545 delivery_log(LOG_MAIN, addr, 0,
1546 US"tmp-reject from cutthrough after DATA:");
1550 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1551 US"rejected after DATA:");
1558 return cutthrough.addr.message;
1563 /*************************************************
1564 * Copy error to toplevel address *
1565 *************************************************/
1567 /* This function is used when a verify fails or defers, to ensure that the
1568 failure or defer information is in the original toplevel address. This applies
1569 when an address is redirected to a single new address, and the failure or
1570 deferral happens to the child address.
1573 vaddr the verify address item
1574 addr the final address item
1577 Returns: the value of YIELD
1581 copy_error(address_item *vaddr, address_item *addr, int yield)
1585 vaddr->message = addr->message;
1586 vaddr->user_message = addr->user_message;
1587 vaddr->basic_errno = addr->basic_errno;
1588 vaddr->more_errno = addr->more_errno;
1589 vaddr->prop.address_data = addr->prop.address_data;
1590 vaddr->prop.variables = NULL;
1591 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
1592 copyflag(vaddr, addr, af_pass_message);
1600 /**************************************************
1601 * printf that automatically handles TLS if needed *
1602 ***************************************************/
1604 /* This function is used by verify_address() as a substitute for all fprintf()
1605 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1606 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1607 that assumes that we always use the smtp_out FILE* when not using TLS or the
1608 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1609 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1613 f the candidate FILE* to write to
1614 format format string
1615 ... optional arguments
1621 static void PRINTF_FUNCTION(2,3)
1622 respond_printf(FILE *f, const char *format, ...)
1626 va_start(ap, format);
1627 if (smtp_out && (f == smtp_out))
1628 smtp_vprintf(format, FALSE, ap);
1630 vfprintf(f, format, ap);
1636 /*************************************************
1637 * Verify an email address *
1638 *************************************************/
1640 /* This function is used both for verification (-bv and at other times) and
1641 address testing (-bt), which is indicated by address_test_mode being set.
1644 vaddr contains the address to verify; the next field in this block
1646 fp if not NULL, write the result to this file
1647 options various option bits:
1648 vopt_fake_sender => this sender verify is not for the real
1649 sender (it was verify=sender=xxxx or an address from a
1650 header line) - rewriting must not change sender_address
1651 vopt_is_recipient => this is a recipient address, otherwise
1652 it's a sender address - this affects qualification and
1653 rewriting and messages from callouts
1654 vopt_qualify => qualify an unqualified address; else error
1655 vopt_expn => called from SMTP EXPN command
1656 vopt_success_on_redirect => when a new address is generated
1657 the verification instantly succeeds
1659 These ones are used by do_callout() -- the options variable
1662 vopt_callout_fullpm => if postmaster check, do full one
1663 vopt_callout_no_cache => don't use callout cache
1664 vopt_callout_random => do the "random" thing
1665 vopt_callout_recipsender => use real sender for recipient
1666 vopt_callout_recippmaster => use postmaster for recipient
1668 callout if > 0, specifies that callout is required, and gives timeout
1669 for individual commands
1670 callout_overall if > 0, gives overall timeout for the callout function;
1671 if < 0, a default is used (see do_callout())
1672 callout_connect the connection timeout for callouts
1673 se_mailfrom when callout is requested to verify a sender, use this
1674 in MAIL FROM; NULL => ""
1675 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1676 thing and use this as the sender address (may be "")
1678 routed if not NULL, set TRUE if routing succeeded, so we can
1679 distinguish between routing failed and callout failed
1681 Returns: OK address verified
1682 FAIL address failed to verify
1683 DEFER can't tell at present
1687 verify_address(address_item * vaddr, FILE * fp, int options, int callout,
1688 int callout_overall, int callout_connect, uschar * se_mailfrom,
1689 uschar *pm_mailfrom, BOOL *routed)
1692 BOOL full_info = fp ? debug_selector != 0 : FALSE;
1693 BOOL expn = (options & vopt_expn) != 0;
1694 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1697 int verify_type = expn ? v_expn :
1698 f.address_test_mode ? v_none :
1699 options & vopt_is_recipient ? v_recipient : v_sender;
1700 address_item * addr_list;
1701 address_item * addr_new = NULL;
1702 address_item * addr_remote = NULL;
1703 address_item * addr_local = NULL;
1704 address_item * addr_succeed = NULL;
1705 uschar ** failure_ptr = options & vopt_is_recipient
1706 ? &recipient_verify_failure : &sender_verify_failure;
1707 uschar * ko_prefix, * cr;
1708 const uschar * address = vaddr->address;
1709 const uschar * save_sender;
1710 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1712 /* Clear, just in case */
1714 *failure_ptr = NULL;
1716 /* Set up a prefix and suffix for error message which allow us to use the same
1717 output statements both in EXPN mode (where an SMTP response is needed) and when
1718 debugging with an output file. */
1722 ko_prefix = US"553 ";
1725 else ko_prefix = cr = US"";
1727 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1729 if (parse_find_at(address) == NULL)
1731 if (!(options & vopt_qualify))
1734 respond_printf(fp, "%sA domain is required for \"%s\"%s\n",
1735 ko_prefix, address, cr);
1736 *failure_ptr = US"qualify";
1739 /* deconst ok as address was not const */
1740 address = US rewrite_address_qualify(address, options & vopt_is_recipient);
1745 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1746 debug_printf("%s %s\n", f.address_test_mode? "Testing" : "Verifying", address);
1749 /* Rewrite and report on it. Clear the domain and local part caches - these
1750 may have been set by domains and local part tests during an ACL. */
1752 if (global_rewrite_rules)
1754 const uschar * old = address;
1755 address = rewrite_address(address, options & vopt_is_recipient, FALSE,
1756 global_rewrite_rules, rewrite_existflags);
1759 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1760 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1761 if (fp && !expn) fprintf(fp, "Address rewritten as: %s\n", address);
1765 /* If this is the real sender address, we must update sender_address at
1766 this point, because it may be referred to in the routers. */
1768 if (!(options & (vopt_fake_sender|vopt_is_recipient)))
1769 sender_address = address;
1771 /* If the address was rewritten to <> no verification can be done, and we have
1772 to return OK. This rewriting is permitted only for sender addresses; for other
1773 addresses, such rewriting fails. */
1775 if (!address[0]) return OK;
1777 /* Flip the legacy TLS-related variables over to the outbound set in case
1778 they're used in the context of a transport used by verification. Reset them
1779 at exit from this routine (so no returns allowed from here on). */
1781 tls_modify_variables(&tls_out);
1783 /* Save a copy of the sender address for re-instating if we change it to <>
1784 while verifying a sender address (a nice bit of self-reference there). */
1786 save_sender = sender_address;
1788 /* Observability variable for router/transport use */
1790 verify_mode = options & vopt_is_recipient ? US"R" : US"S";
1792 /* Update the address structure with the possibly qualified and rewritten
1793 address. Set it up as the starting address on the chain of new addresses. */
1795 vaddr->address = address;
1798 /* We need a loop, because an address can generate new addresses. We must also
1799 cope with generated pipes and files at the top level. (See also the code and
1800 comment in deliver.c.) However, it is usually the case that the router for
1801 user's .forward files has its verify flag turned off.
1803 If an address generates more than one child, the loop is used only when
1804 full_info is set, and this can only be set locally. Remote enquiries just get
1805 information about the top level address, not anything that it generated. */
1810 address_item *addr = addr_new;
1812 addr_new = addr->next;
1817 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1818 debug_printf("Considering %s\n", addr->address);
1821 /* Handle generated pipe, file or reply addresses. We don't get these
1822 when handling EXPN, as it does only one level of expansion. */
1824 if (testflag(addr, af_pfr))
1831 if (addr->address[0] == '>')
1833 allow = testflag(addr, af_allow_reply);
1834 fprintf(fp, "%s -> mail %s", addr->parent->address, addr->address + 1);
1838 allow = addr->address[0] == '|'
1839 ? testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1840 fprintf(fp, "%s -> %s", addr->parent->address, addr->address);
1843 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1844 fprintf(fp, "\n*** Error in setting up pipe, file, or autoreply:\n"
1845 "%s\n", addr->message);
1847 fprintf(fp, "\n transport = %s\n", addr->transport->name);
1849 fprintf(fp, " *** forbidden ***\n");
1854 /* Just in case some router parameter refers to it. */
1856 return_path = addr->prop.errors_address
1857 ? addr->prop.errors_address : sender_address;
1859 /* Split the address into domain and local part, handling the %-hack if
1860 necessary, and then route it. While routing a sender address, set
1861 $sender_address to <> because that is what it will be if we were trying to
1862 send a bounce to the sender. */
1864 if (routed) *routed = FALSE;
1865 if ((rc = deliver_split_address(addr)) == OK)
1867 if (!(options & vopt_is_recipient)) sender_address = null_sender;
1868 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1869 &addr_succeed, verify_type);
1870 sender_address = save_sender; /* Put back the real sender */
1873 /* If routing an address succeeded, set the flag that remembers, for use when
1874 an ACL cached a sender verify (in case a callout fails). Then if routing set
1875 up a list of hosts or the transport has a host list, and the callout option
1876 is set, and we aren't in a host checking run, do the callout verification,
1877 and set another flag that notes that a callout happened. */
1881 BOOL local_verify = FALSE;
1883 if (routed) *routed = TRUE;
1886 transport_instance * tp;
1887 host_item * host_list = addr->host_list;
1889 /* Make up some data for use in the case where there is no remote
1892 transport_feedback tf = {
1893 .interface = NULL, /* interface (=> any) */
1895 .protocol = US"smtp",
1897 .helo_data = US"$smtp_active_hostname",
1898 .hosts_override = FALSE,
1899 .hosts_randomize = FALSE,
1900 .gethostbyname = FALSE,
1901 .qualify_single = TRUE,
1902 .search_parents = FALSE
1905 /* If verification yielded a remote transport, we want to use that
1906 transport's options, so as to mimic what would happen if we were really
1907 sending a message to this address. */
1909 if ((tp = addr->transport))
1910 if (!tp->info->local)
1912 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
1914 /* If the transport has hosts and the router does not, or if the
1915 transport is configured to override the router's hosts, we must build a
1916 host list of the transport's hosts, and find the IP addresses */
1918 if (tf.hosts && (!host_list || tf.hosts_override))
1921 const uschar * save_deliver_domain = deliver_domain;
1922 const uschar * save_deliver_localpart = deliver_localpart;
1924 host_list = NULL; /* Ignore the router's hosts */
1926 deliver_domain = addr->domain;
1927 deliver_localpart = addr->local_part;
1928 s = expand_string(tf.hosts);
1929 deliver_domain = save_deliver_domain;
1930 deliver_localpart = save_deliver_localpart;
1934 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1935 "\"%s\" in %s transport for callout: %s", tf.hosts,
1936 tp->name, expand_string_message);
1941 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1943 /* Just ignore failures to find a host address. If we don't manage
1944 to find any addresses, the callout will defer. Note that more than
1945 one address may be found for a single host, which will result in
1946 additional host items being inserted into the chain. Hence we must
1947 save the next host first. */
1949 flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
1950 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1951 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1953 for (host_item * host = host_list, * nexthost; host; host = nexthost)
1955 nexthost = host->next;
1956 if (tf.gethostbyname ||
1957 string_is_ip_address(host->name, NULL) != 0)
1958 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
1961 const dnssec_domains * dsp = NULL;
1962 if (Ustrcmp(tp->driver_name, "smtp") == 0)
1964 smtp_transport_options_block * ob =
1965 (smtp_transport_options_block *) tp->options_block;
1969 (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1976 else if ( options & vopt_quota
1977 && Ustrcmp(tp->driver_name, "appendfile") == 0)
1978 local_verify = TRUE;
1980 /* Can only do a callout if we have at least one host! If the callout
1981 fails, it will have set ${sender,recipient}_verify_failure. */
1985 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1986 if (host_checking && !f.host_checking_callout)
1989 debug_printf("... callout omitted by default when host testing\n"
1990 "(Use -bhc if you want the callouts to happen.)\n");
1995 deliver_set_expansions(addr);
1997 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
1998 callout_connect, options, se_mailfrom, pm_mailfrom);
2000 deliver_set_expansions(NULL);
2002 if ( options & vopt_is_recipient
2004 /* set to "random", with OK, for an accepted random */
2005 && !recipient_verify_failure
2007 callout_verified_rcpt(addr);
2010 else if (local_verify)
2012 HDEBUG(D_verify) debug_printf("Attempting quota verification\n");
2014 deliver_set_expansions(addr);
2015 deliver_local(addr, TRUE);
2016 rc = addr->transport_return;
2019 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
2020 "transport provided a host list, or transport is not smtp\n");
2024 /* Otherwise, any failure is a routing failure */
2026 else *failure_ptr = US"route";
2028 /* A router may return REROUTED if it has set up a child address as a result
2029 of a change of domain name (typically from widening). In this case we always
2030 want to continue to verify the new child. */
2032 if (rc == REROUTED) continue;
2034 /* Handle hard failures */
2041 address_item *p = addr->parent;
2043 respond_printf(fp, "%s%s %s", ko_prefix,
2044 full_info ? addr->address : address,
2045 f.address_test_mode ? "is undeliverable" : "failed to verify");
2046 if (!expn && f.admin_user)
2048 if (addr->basic_errno > 0)
2049 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2051 respond_printf(fp, ": %s", addr->message);
2054 /* Show parents iff doing full info */
2056 if (full_info) while (p)
2058 respond_printf(fp, "%s\n <-- %s", cr, p->address);
2061 respond_printf(fp, "%s\n", cr);
2063 cancel_cutthrough_connection(TRUE, US"routing hard fail");
2067 yield = copy_error(vaddr, addr, FAIL);
2075 else if (rc == DEFER)
2080 address_item *p = addr->parent;
2081 respond_printf(fp, "%s%s cannot be resolved at this time", ko_prefix,
2082 full_info? addr->address : address);
2083 if (!expn && f.admin_user)
2085 if (addr->basic_errno > 0)
2086 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2088 respond_printf(fp, ": %s", addr->message);
2089 else if (addr->basic_errno <= 0)
2090 respond_printf(fp, ": unknown error");
2093 /* Show parents iff doing full info */
2095 if (full_info) while (p)
2097 respond_printf(fp, "%s\n <-- %s", cr, p->address);
2100 respond_printf(fp, "%s\n", cr);
2102 cancel_cutthrough_connection(TRUE, US"routing soft fail");
2106 yield = copy_error(vaddr, addr, DEFER);
2109 if (yield == OK) yield = DEFER;
2112 /* If we are handling EXPN, we do not want to continue to route beyond
2113 the top level (whose address is in "address"). */
2117 uschar *ok_prefix = US"250-";
2120 if (!addr_local && !addr_remote)
2121 respond_printf(fp, "250 mail to <%s> is discarded\r\n", address);
2123 respond_printf(fp, "250 <%s>\r\n", address);
2127 address_item *addr2 = addr_new;
2128 addr_new = addr2->next;
2129 if (!addr_new) ok_prefix = US"250 ";
2130 respond_printf(fp, "%s<%s>\r\n", ok_prefix, addr2->address);
2136 /* Successful routing other than EXPN. */
2140 /* Handle successful routing when short info wanted. Otherwise continue for
2141 other (generated) addresses. Short info is the operational case. Full info
2142 can be requested only when debug_selector != 0 and a file is supplied.
2144 There is a conflict between the use of aliasing as an alternate email
2145 address, and as a sort of mailing list. If an alias turns the incoming
2146 address into just one address (e.g. J.Caesar->jc44) you may well want to
2147 carry on verifying the generated address to ensure it is valid when
2148 checking incoming mail. If aliasing generates multiple addresses, you
2149 probably don't want to do this. Exim therefore treats the generation of
2150 just a single new address as a special case, and continues on to verify the
2151 generated address. */
2153 if ( !full_info /* Stop if short info wanted AND */
2154 && ( ( !addr_new /* No new address OR */
2155 || addr_new->next /* More than one new address OR */
2156 || testflag(addr_new, af_pfr) /* New address is pfr */
2159 ( addr_new /* At least one new address AND */
2160 && success_on_redirect /* success_on_redirect is set */
2164 if (fp) fprintf(fp, "%s %s\n",
2165 address, f.address_test_mode ? "is deliverable" : "verified");
2167 /* If we have carried on to verify a child address, we want the value
2168 of $address_data to be that of the child */
2170 vaddr->prop.address_data = addr->prop.address_data;
2171 vaddr->prop.variables = NULL;
2172 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
2174 /* If stopped because more than one new address, cannot cutthrough */
2176 if (addr_new && addr_new->next)
2177 cancel_cutthrough_connection(TRUE, US"multiple addresses from routing");
2183 } /* Loop for generated addresses */
2185 /* Display the full results of the successful routing, including any generated
2186 addresses. Control gets here only when full_info is set, which requires fp not
2187 to be NULL, and this occurs only when a top-level verify is called with the
2188 debugging switch on.
2190 If there are no local and no remote addresses, and there were no pipes, files,
2191 or autoreplies, and there were no errors or deferments, the message is to be
2192 discarded, usually because of the use of :blackhole: in an alias file. */
2194 if (allok && !addr_local && !addr_remote)
2196 fprintf(fp, "mail to %s is discarded\n", address);
2200 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2203 address_item *addr = addr_list;
2204 transport_instance * tp = addr->transport;
2206 addr_list = addr->next;
2208 fprintf(fp, "%s", CS addr->address);
2210 /* If the address is a duplicate, show something about it. */
2212 if (!testflag(addr, af_pfr))
2215 if ((tnode = tree_search(tree_duplicates, addr->unique)))
2216 fprintf(fp, " [duplicate, would not be delivered]");
2217 else tree_add_duplicate(addr->unique, addr);
2220 /* Now show its parents */
2222 for (address_item * p = addr->parent; p; p = p->parent)
2223 fprintf(fp, "\n <-- %s", p->address);
2226 /* Show router, and transport */
2228 fprintf(fp, "router = %s, transport = %s\n",
2229 addr->router->name, tp ? tp->name : US"unset");
2231 /* Show any hosts that are set up by a router unless the transport
2232 is going to override them; fiddle a bit to get a nice format. */
2234 if (addr->host_list && tp && !tp->overrides_hosts)
2238 for (host_item * h = addr->host_list; h; h = h->next)
2239 { /* get max lengths of host names, addrs */
2240 int len = Ustrlen(h->name);
2241 if (len > maxlen) maxlen = len;
2242 len = h->address ? Ustrlen(h->address) : 7;
2243 if (len > maxaddlen) maxaddlen = len;
2245 for (host_item * h = addr->host_list; h; h = h->next)
2247 fprintf(fp, " host %-*s ", maxlen, h->name);
2250 fprintf(fp, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2251 else if (tp->info->local)
2252 fprintf(fp, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2254 fprintf(fp, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2256 if (h->mx >= 0) fprintf(fp, " MX=%d", h->mx);
2257 if (h->port != PORT_NONE) fprintf(fp, " port=%d", h->port);
2258 if (f.running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", fp);
2259 if (h->status == hstatus_unusable) fputs(" ** unusable **", fp);
2265 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2266 the -bv or -bt case). */
2270 tls_modify_variables(&tls_in); /* return variables to inbound values */
2278 /*************************************************
2279 * Check headers for syntax errors *
2280 *************************************************/
2282 /* This function checks those header lines that contain addresses, and verifies
2283 that all the addresses therein are 5322-syntactially correct.
2286 msgptr where to put an error message
2293 verify_check_headers(uschar **msgptr)
2298 for (header_line * h = header_list; h && yield == OK; h = h->next)
2300 if (h->type != htype_from &&
2301 h->type != htype_reply_to &&
2302 h->type != htype_sender &&
2303 h->type != htype_to &&
2304 h->type != htype_cc &&
2305 h->type != htype_bcc)
2308 colon = Ustrchr(h->text, ':');
2310 Uskip_whitespace(&s);
2312 /* Loop for multiple addresses in the header, enabling group syntax. Note
2313 that we have to reset this after the header has been scanned. */
2315 f.parse_allow_group = TRUE;
2319 uschar *ss = parse_find_address_end(s, FALSE);
2320 uschar *recipient, *errmess;
2321 int terminator = *ss;
2322 int start, end, domain;
2324 /* Temporarily terminate the string at this point, and extract the
2325 operative address within, allowing group syntax. */
2328 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2331 /* Permit an unqualified address only if the message is local, or if the
2332 sending host is configured to be permitted to send them. */
2334 if (recipient && !domain)
2336 if (h->type == htype_from || h->type == htype_sender)
2338 if (!f.allow_unqualified_sender) recipient = NULL;
2342 if (!f.allow_unqualified_recipient) recipient = NULL;
2344 if (!recipient) errmess = US"unqualified address not permitted";
2347 /* It's an error if no address could be extracted, except for the special
2348 case of an empty address. */
2350 if (!recipient && Ustrcmp(errmess, "empty address") != 0)
2352 uschar *verb = US"is";
2357 /* Arrange not to include any white space at the end in the
2358 error message or the header name. */
2360 while (t > s && isspace(t[-1])) t--;
2361 while (tt > h->text && isspace(tt[-1])) tt--;
2363 /* Add the address that failed to the error message, since in a
2364 header with very many addresses it is sometimes hard to spot
2365 which one is at fault. However, limit the amount of address to
2366 quote - cases have been seen where, for example, a missing double
2367 quote in a humungous To: header creates an "address" that is longer
2368 than string_sprintf can handle. */
2377 /* deconst cast ok as we're passing a non-const to string_printing() */
2378 *msgptr = US string_printing(
2379 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2380 errmess, (int)(tt - h->text), h->text, verb, len, s));
2383 break; /* Out of address loop */
2386 /* Advance to the next address */
2388 s = ss + (terminator ? 1 : 0);
2389 Uskip_whitespace(&s);
2390 } /* Next address */
2392 f.parse_allow_group = FALSE;
2393 f.parse_found_group = FALSE;
2394 } /* Next header unless yield has been set FALSE */
2400 /*************************************************
2401 * Check header names for 8-bit characters *
2402 *************************************************/
2404 /* This function checks for invalid characters in header names. See
2405 RFC 5322, 2.2. and RFC 6532, 3.
2408 msgptr where to put an error message
2415 verify_check_header_names_ascii(uschar **msgptr)
2419 for (header_line * h = header_list; h; h = h->next)
2421 colon = Ustrchr(h->text, ':');
2422 for(uschar * s = h->text; s < colon; s++)
2423 if ((*s < 33) || (*s > 126))
2425 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2426 (int)(colon - h->text), h->text);
2433 /*************************************************
2434 * Check for blind recipients *
2435 *************************************************/
2437 /* This function checks that every (envelope) recipient is mentioned in either
2438 the To: or Cc: header lines, thus detecting blind carbon copies.
2440 There are two ways of scanning that could be used: either scan the header lines
2441 and tick off the recipients, or scan the recipients and check the header lines.
2442 The original proposed patch did the former, but I have chosen to do the latter,
2443 because (a) it requires no memory and (b) will use fewer resources when there
2444 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2446 Arguments: case_sensitive true if case sensitive matching should be used
2447 Returns: OK if there are no blind recipients
2448 FAIL if there is at least one blind recipient
2452 verify_check_notblind(BOOL case_sensitive)
2454 for (int i = 0; i < recipients_count; i++)
2457 const uschar * address = recipients_list[i].address;
2459 for (header_line * h = header_list; !found && h; h = h->next)
2461 uschar * colon, * s;
2463 if (h->type != htype_to && h->type != htype_cc) continue;
2465 colon = Ustrchr(h->text, ':');
2467 Uskip_whitespace(&s);
2469 /* Loop for multiple addresses in the header, enabling group syntax. Note
2470 that we have to reset this after the header has been scanned. */
2472 f.parse_allow_group = TRUE;
2476 uschar * ss = parse_find_address_end(s, FALSE);
2477 uschar * recipient, * errmess;
2478 int terminator = *ss;
2479 int start, end, domain;
2481 /* Temporarily terminate the string at this point, and extract the
2482 operative address within, allowing group syntax. */
2485 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2488 /* If we found a valid recipient that has a domain, compare it with the
2489 envelope recipient. Local parts are compared with case-sensitivity
2490 according to the routine arg, domains case-insensitively.
2491 By comparing from the start with length "domain", we include the "@" at
2492 the end, which ensures that we are comparing the whole local part of each
2495 if (recipient && domain != 0)
2496 if ((found = (case_sensitive
2497 ? Ustrncmp(recipient, address, domain) == 0
2498 : strncmpic(recipient, address, domain) == 0)
2499 && strcmpic(recipient + domain, address + domain) == 0))
2502 /* Advance to the next address */
2504 s = ss + (terminator ? 1:0);
2505 Uskip_whitespace(&s);
2506 } /* Next address */
2508 f.parse_allow_group = FALSE;
2509 f.parse_found_group = FALSE;
2510 } /* Next header (if found is false) */
2512 if (!found) return FAIL;
2513 } /* Next recipient */
2520 /*************************************************
2521 * Find if verified sender *
2522 *************************************************/
2524 /* Usually, just a single address is verified as the sender of the message.
2525 However, Exim can be made to verify other addresses as well (often related in
2526 some way), and this is useful in some environments. There may therefore be a
2527 chain of such addresses that have previously been tested. This function finds
2528 whether a given address is on the chain.
2530 Arguments: the address to be verified
2531 Returns: pointer to an address item, or NULL
2535 verify_checked_sender(const uschar * sender)
2537 for (address_item * addr = sender_verified_list; addr; addr = addr->next)
2538 if (Ustrcmp(sender, addr->address) == 0) return addr;
2546 /*************************************************
2547 * Get valid header address *
2548 *************************************************/
2550 /* Scan the originator headers of the message, looking for an address that
2551 verifies successfully. RFC 822 says:
2553 o The "Sender" field mailbox should be sent notices of
2554 any problems in transport or delivery of the original
2555 messages. If there is no "Sender" field, then the
2556 "From" field mailbox should be used.
2558 o If the "Reply-To" field exists, then the reply should
2559 go to the addresses indicated in that field and not to
2560 the address(es) indicated in the "From" field.
2562 So we check a Sender field if there is one, else a Reply_to field, else a From
2563 field. As some strange messages may have more than one of these fields,
2564 especially if they are resent- fields, check all of them if there is more than
2568 user_msgptr points to where to put a user error message
2569 log_msgptr points to where to put a log error message
2570 callout timeout for callout check (passed to verify_address())
2571 callout_overall overall callout timeout (ditto)
2572 callout_connect connect callout timeout (ditto)
2573 se_mailfrom mailfrom for verify; NULL => ""
2574 pm_mailfrom sender for pm callout check (passed to verify_address())
2575 options callout options (passed to verify_address())
2576 verrno where to put the address basic_errno
2578 If log_msgptr is set to something without setting user_msgptr, the caller
2579 normally uses log_msgptr for both things.
2581 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2582 FAIL is given if no appropriate headers are found
2586 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2587 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2588 uschar *pm_mailfrom, int options, int *verrno)
2590 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2594 for (int i = 0; i < 3 && !done; i++)
2595 for (header_line * h = header_list; h != NULL && !done; h = h->next)
2597 int terminator, new_ok;
2598 uschar *s, *ss, *endname;
2600 if (h->type != header_types[i]) continue;
2601 s = endname = Ustrchr(h->text, ':') + 1;
2603 /* Scan the addresses in the header, enabling group syntax. Note that we
2604 have to reset this after the header has been scanned. */
2606 f.parse_allow_group = TRUE;
2610 address_item *vaddr;
2612 while (isspace(*s) || *s == ',') s++;
2613 if (*s == 0) break; /* End of header */
2615 ss = parse_find_address_end(s, FALSE);
2617 /* The terminator is a comma or end of header, but there may be white
2618 space preceding it (including newline for the last address). Move back
2619 past any white space so we can check against any cached envelope sender
2620 address verifications. */
2622 while (isspace(ss[-1])) ss--;
2626 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2627 (int)(endname - h->text), h->text, s);
2629 /* See if we have already verified this address as an envelope sender,
2630 and if so, use the previous answer. */
2632 vaddr = verify_checked_sender(s);
2634 if (vaddr != NULL && /* Previously checked */
2635 (callout <= 0 || /* No callout needed; OR */
2636 vaddr->special_action > 256)) /* Callout was done */
2638 new_ok = vaddr->special_action & 255;
2639 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2640 *ss = terminator; /* Restore shortened string */
2643 /* Otherwise we run the verification now. We must restore the shortened
2644 string before running the verification, so the headers are correct, in
2645 case there is any rewriting. */
2649 int start, end, domain;
2650 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2655 /* If we found an empty address, just carry on with the next one, but
2656 kill the message. */
2658 if (!address && Ustrcmp(*log_msgptr, "empty address") == 0)
2665 /* If verification failed because of a syntax error, fail this
2666 function, and ensure that the failing address gets added to the error
2672 while (ss > s && isspace(ss[-1])) ss--;
2673 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2674 "scanning for sender: %s in \"%.*s\"",
2675 (int)(endname - h->text), h->text, *log_msgptr, (int)(ss - s), s);
2681 /* Else go ahead with the sender verification. But it isn't *the*
2682 sender of the message, so set vopt_fake_sender to stop sender_address
2683 being replaced after rewriting or qualification. */
2687 vaddr = deliver_make_addr(address, FALSE);
2688 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2689 callout, callout_overall, callout_connect, se_mailfrom,
2694 /* We now have the result, either newly found, or cached. If we are
2695 giving out error details, set a specific user error. This means that the
2696 last of these will be returned to the user if all three fail. We do not
2697 set a log message - the generic one below will be used. */
2701 *verrno = vaddr->basic_errno;
2702 if (smtp_return_error_details)
2703 *user_msgptr = string_sprintf("Rejected after DATA: "
2704 "could not verify \"%.*s\" header address\n%s: %s",
2705 (int)(endname - h->text), h->text, vaddr->address, vaddr->message);
2708 /* Success or defer */
2717 if (new_ok == DEFER) yield = DEFER;
2719 /* Move on to any more addresses in the header */
2722 } /* Next address */
2724 f.parse_allow_group = FALSE;
2725 f.parse_found_group = FALSE;
2726 } /* Next header, unless done */
2727 /* Next header type unless done */
2729 if (yield == FAIL && *log_msgptr == NULL)
2730 *log_msgptr = US"there is no valid sender in any header line";
2732 if (yield == DEFER && *log_msgptr == NULL)
2733 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2741 /*************************************************
2742 * Get RFC 1413 identification *
2743 *************************************************/
2745 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2746 the timeout is set to zero, then the query is not done. There may also be lists
2747 of hosts and nets which are exempt. To guard against malefactors sending
2748 non-printing characters which could, for example, disrupt a message's headers,
2749 make sure the string consists of printing characters only.
2752 port the port to connect to; usually this is IDENT_PORT (113), but when
2753 running in the test harness with -bh a different value is used.
2757 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2761 verify_get_ident(int port)
2763 client_conn_ctx ident_conn_ctx = {0};
2765 int received_sender_port, received_interface_port, n;
2768 uschar buffer[2048];
2770 /* Default is no ident. Check whether we want to do an ident check for this
2773 sender_ident = NULL;
2774 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2777 DEBUG(D_ident) debug_printf("doing ident callback\n");
2779 /* Set up a connection to the ident port of the remote host. Bind the local end
2780 to the incoming interface address. If the sender host address is an IPv6
2781 address, the incoming interface address will also be IPv6. */
2783 host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
2784 if ((ident_conn_ctx.sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
2786 if (ip_bind(ident_conn_ctx.sock, host_af, interface_address, 0) < 0)
2788 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2793 /* Construct and send the query. */
2795 qlen = snprintf(CS buffer, sizeof(buffer), "%d , %d\r\n",
2796 sender_host_port, interface_port);
2797 early_data.data = buffer;
2798 early_data.len = qlen;
2800 /*XXX we trust that the query is idempotent */
2801 if (ip_connect(ident_conn_ctx.sock, host_af, sender_host_address, port,
2802 rfc1413_query_timeout, &early_data) < 0)
2804 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
2805 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2806 sender_host_address);
2808 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2809 sender_host_address, strerror(errno));
2813 /* Read a response line. We put it into the rest of the buffer, using several
2814 recv() calls if necessary. */
2822 int size = sizeof(buffer) - (p - buffer);
2824 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2825 count = ip_recv(&ident_conn_ctx, p, size, time(NULL) + rfc1413_query_timeout);
2826 if (count <= 0) goto END_OFF; /* Read error or EOF */
2828 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2829 generous, and accept a plain \n terminator as well. The only illegal
2832 for (pp = p; pp < p + count; pp++)
2834 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2837 if (pp[-1] == '\r') pp--;
2839 goto GOT_DATA; /* Break out of both loops */
2843 /* Reached the end of the data without finding \n. Let the loop continue to
2844 read some more, if there is room. */
2851 /* We have received a line of data. Check it carefully. It must start with the
2852 same two port numbers that we sent, followed by data as defined by the RFC. For
2855 12345 , 25 : USERID : UNIX :root
2857 However, the amount of white space may be different to what we sent. In the
2858 "osname" field there may be several sub-fields, comma separated. The data we
2859 actually want to save follows the third colon. Some systems put leading spaces
2860 in it - we discard those. */
2862 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2863 &received_interface_port, &n) != 2 ||
2864 received_sender_port != sender_host_port ||
2865 received_interface_port != interface_port)
2868 p = buffer + qlen + n;
2869 while(isspace(*p)) p++;
2870 if (*p++ != ':') goto END_OFF;
2871 while(isspace(*p)) p++;
2872 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2874 while(isspace(*p)) p++;
2875 if (*p++ != ':') goto END_OFF;
2876 while (*p != 0 && *p != ':') p++;
2877 if (*p++ == 0) goto END_OFF;
2878 while(isspace(*p)) p++;
2879 if (*p == 0) goto END_OFF;
2881 /* The rest of the line is the data we want. We turn it into printing
2882 characters when we save it, so that it cannot mess up the format of any logging
2883 or Received: lines into which it gets inserted. We keep a maximum of 127
2884 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
2886 sender_ident = US string_printing(string_copyn(p, 127));
2887 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2890 (void)close(ident_conn_ctx.sock);
2897 /*************************************************
2898 * Match host to a single host-list item *
2899 *************************************************/
2901 /* This function compares a host (name or address) against a single item
2902 from a host list. The host name gets looked up if it is needed and is not
2903 already known. The function is called from verify_check_this_host() via
2904 match_check_list(), which is why most of its arguments are in a single block.
2907 arg the argument block (see below)
2908 ss the host-list item
2909 valueptr where to pass back looked up data, or NULL
2910 error for error message when returning ERROR
2913 host_name (a) the host name, or
2914 (b) NULL, implying use sender_host_name and
2915 sender_host_aliases, looking them up if required, or
2916 (c) the empty string, meaning that only IP address matches
2918 host_address the host address
2919 host_ipv4 the IPv4 address taken from an IPv6 one
2923 DEFER lookup deferred
2924 ERROR (a) failed to find the host name or IP address, or
2925 (b) unknown lookup type specified, or
2926 (c) host name encountered when only IP addresses are
2931 check_host(void * arg, const uschar * ss, const uschar ** valueptr, uschar ** error)
2933 check_host_block * cb = (check_host_block *)arg;
2936 BOOL iplookup = FALSE, isquery = FALSE;
2937 BOOL isiponly = cb->host_name && !cb->host_name[0];
2939 uschar * semicolon, * endname, * opts;
2942 /* Optimize for the special case when the pattern is "*". */
2944 if (*ss == '*' && !ss[1]) return OK;
2946 /* If the pattern is empty, it matches only in the case when there is no host -
2947 this can occur in ACL checking for SMTP input using the -bs option. In this
2948 situation, the host address is the empty string. */
2950 if (!cb->host_address[0]) return *ss ? FAIL : OK;
2951 if (!*ss) return FAIL;
2953 /* If the pattern is precisely "@" then match against the primary host name,
2954 provided that host name matching is permitted; if it's "@[]" match against the
2955 local host's IP addresses. */
2960 if (isiponly) return ERROR;
2961 ss = primary_hostname;
2963 else if (Ustrcmp(ss, "@[]") == 0)
2965 for (ip_address_item * ip = host_find_interfaces(); ip; ip = ip->next)
2966 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2970 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2971 a (possibly masked) comparison with the current IP address. */
2973 if (string_is_ip_address(ss, &maskoffset) != 0)
2974 return host_is_in_net(cb->host_address, ss, maskoffset) ? OK : FAIL;
2976 /* The pattern is not an IP address. A common error that people make is to omit
2977 one component of an IPv4 address, either by accident, or believing that, for
2978 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2979 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2980 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2981 ancient specification.) To aid in debugging these cases, we give a specific
2982 error if the pattern contains only digits and dots or contains a slash preceded
2983 only by digits and dots (a slash at the start indicates a file name and of
2984 course slashes may be present in lookups, but not preceded only by digits and
2985 dots). Then the equivalent for IPv6 (roughly). */
2987 if (Ustrchr(ss, ':'))
2989 for (t = ss; isxdigit(*t) || *t == ':' || *t == '.'; ) t++;
2990 if (!*t || (*t == '/' || *t == '%') && t != ss)
2992 *error = string_sprintf("malformed IPv6 address or address mask: %.*s", (int)(t - ss), ss);
2998 for (t = ss; isdigit(*t) || *t == '.'; ) t++;
2999 if (!*t || (*t == '/' && t != ss))
3001 *error = string_sprintf("malformed IPv4 address or address mask: %.*s", (int)(t - ss), ss);
3006 /* See if there is a semicolon in the pattern, separating a searchtype
3007 prefix. If there is one then check for comma-sep options. */
3009 if ((semicolon = Ustrchr(ss, ';')))
3010 if ((opts = Ustrchr(ss, ',')) && opts < semicolon)
3013 opts = string_copyn(opts, semicolon - opts);
3017 endname = semicolon;
3023 /* If we are doing an IP address only match, then all lookups must be IP
3024 address lookups, even if there is no "net-". */
3027 iplookup = semicolon != NULL;
3029 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
3030 a lookup on a masked IP network, in textual form. We obey this code even if we
3031 have already set iplookup, so as to skip over the "net-" prefix and to set the
3032 mask length. The net- stuff really only applies to single-key lookups where the
3033 key is implicit. For query-style lookups the key is specified in the query.
3034 From release 4.30, the use of net- for query style is no longer needed, but we
3035 retain it for backward compatibility. */
3037 if (Ustrncmp(ss, "net", 3) == 0 && semicolon)
3040 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
3041 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
3042 iplookup = *t++ == '-';
3047 /* Do the IP address lookup if that is indeed what we have */
3055 uschar *filename, *key, *result;
3058 /* Find the search type */
3060 search_type = search_findtype(t, endname - t);
3062 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
3063 search_error_message);
3065 /* Adjust parameters for the type of lookup. For a query-style lookup, there
3066 is no file name, and the "key" is just the query. For query-style with a file
3067 name, we have to fish the file off the start of the query. For a single-key
3068 lookup, the key is the current IP address, masked appropriately, and
3069 reconverted to text form, with the mask appended. For IPv6 addresses, specify
3070 dot separators instead of colons, except when the lookup type is "iplsearch".
3073 if (mac_islookup(search_type, lookup_absfilequery))
3075 filename = semicolon + 1;
3077 while (*key != 0 && !isspace(*key)) key++;
3078 filename = string_copyn(filename, key - filename);
3079 while (isspace(*key)) key++;
3081 else if (mac_islookup(search_type, lookup_querystyle))
3084 key = semicolon + 1;
3086 else /* Single-key style */
3088 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
3090 insize = host_aton(cb->host_address, incoming);
3091 host_mask(insize, incoming, mlen);
3092 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
3094 filename = semicolon + 1;
3097 /* Now do the actual lookup; note that there is no search_close() because
3098 of the caching arrangements. */
3100 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3101 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3103 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL, opts);
3104 if (valueptr) *valueptr = result;
3105 return result ? OK : f.search_find_defer ? DEFER: FAIL;
3108 /* The pattern is not an IP address or network reference of any kind. That is,
3109 it is a host name pattern. If this is an IP only match, there's an error in the
3114 *error = US"cannot match host name in match_ip list";
3118 /* Check the characters of the pattern to see if they comprise only letters,
3119 digits, full stops, and hyphens (the constituents of domain names). Allow
3120 underscores, as they are all too commonly found. Sigh. Also, if
3121 allow_utf8_domains is set, allow top-bit characters. */
3123 for (t = ss; *t; t++)
3124 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3125 (!allow_utf8_domains || *t < 128)) break;
3127 /* If the pattern is a complete domain name, with no fancy characters, look up
3128 its IP address and match against that. Note that a multi-homed host will add
3129 items to the chain. */
3140 /* Using byname rather than bydns here means we cannot determine dnssec
3141 status. On the other hand it is unclear how that could be either
3142 propagated up or enforced. */
3144 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3145 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3147 for (host_item * hh = &h; hh; hh = hh->next)
3148 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3151 if (rc == HOST_FIND_AGAIN) return DEFER;
3152 *error = string_sprintf("failed to find IP address for %s", ss);
3156 /* Almost all subsequent comparisons require the host name, and can be done
3157 using the general string matching function. When this function is called for
3158 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3159 must use sender_host_name and its aliases, looking them up if necessary. */
3161 if (cb->host_name) /* Explicit host name given */
3162 return match_check_string(cb->host_name, ss, -1,
3163 MCS_PARTIAL | MCS_CASELESS | MCS_AT_SPECIAL | cb->flags, valueptr);
3165 /* Host name not given; in principle we need the sender host name and its
3166 aliases. However, for query-style lookups, we do not need the name if the
3167 query does not contain $sender_host_name. From release 4.23, a reference to
3168 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3171 if ((semicolon = Ustrchr(ss, ';')))
3173 const uschar * affix, * opts;
3174 int partial, affixlen, starflags, id;
3177 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags,
3181 if (id < 0) /* Unknown lookup type */
3183 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3184 search_error_message, ss);
3187 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3192 switch(match_check_string(US"", ss, -1,
3193 MCS_PARTIAL| MCS_CASELESS| MCS_AT_SPECIAL | (cb->flags & MCS_CACHEABLE),
3197 case DEFER: return DEFER;
3198 default: return FAIL;
3202 /* Not a query-style lookup; must ensure the host name is present, and then we
3203 do a check on the name and all its aliases. */
3205 if (!sender_host_name)
3207 HDEBUG(D_host_lookup)
3208 debug_printf("sender host name required, to match against %s\n", ss);
3209 if (host_lookup_failed || host_name_lookup() != OK)
3211 *error = string_sprintf("failed to find host name for %s",
3212 sender_host_address);;
3215 host_build_sender_fullhost();
3218 /* Match on the sender host name, using the general matching function */
3220 switch(match_check_string(sender_host_name, ss, -1,
3221 MCS_PARTIAL| MCS_CASELESS| MCS_AT_SPECIAL | (cb->flags & MCS_CACHEABLE),
3225 case DEFER: return DEFER;
3228 /* If there are aliases, try matching on them. */
3230 aliases = sender_host_aliases;
3232 switch(match_check_string(*aliases++, ss, -1,
3233 MCS_PARTIAL| MCS_CASELESS| MCS_AT_SPECIAL | (cb->flags & MCS_CACHEABLE),
3237 case DEFER: return DEFER;
3245 /*************************************************
3246 * Check a specific host matches a host list *
3247 *************************************************/
3249 /* This function is passed a host list containing items in a number of
3250 different formats and the identity of a host. Its job is to determine whether
3251 the given host is in the set of hosts defined by the list. The host name is
3252 passed as a pointer so that it can be looked up if needed and not already
3253 known. This is commonly the case when called from verify_check_host() to check
3254 an incoming connection. When called from elsewhere the host name should usually
3257 This function is now just a front end to match_check_list(), which runs common
3258 code for scanning a list. We pass it the check_host() function to perform a
3262 listptr pointer to the host list
3263 cache_bits pointer to cache for named lists, or NULL
3264 host_name the host name or NULL, implying use sender_host_name and
3265 sender_host_aliases, looking them up if required
3266 host_address the IP address
3267 valueptr if not NULL, data from a lookup is passed back here
3269 Returns: OK if the host is in the defined set
3270 FAIL if the host is not in the defined set,
3271 DEFER if a data lookup deferred (not a host lookup)
3273 If the host name was needed in order to make a comparison, and could not be
3274 determined from the IP address, the result is FAIL unless the item
3275 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3278 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3279 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3282 unsigned int *local_cache_bits = cache_bits;
3283 const uschar *save_host_address = deliver_host_address;
3284 check_host_block cb = { .host_name = host_name, .host_address = host_address };
3286 if (valueptr) *valueptr = NULL;
3288 /* If the host address starts off ::ffff: it is an IPv6 address in
3289 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3292 cb.host_ipv4 = Ustrncmp(host_address, "::ffff:", 7) == 0
3293 ? host_address + 7 : host_address;
3295 /* During the running of the check, put the IP address into $host_address. In
3296 the case of calls from the smtp transport, it will already be there. However,
3297 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3298 the safe side, any existing setting is preserved, though as I write this
3299 (November 2004) I can't see any cases where it is actually needed. */
3301 deliver_host_address = host_address;
3302 rc = match_check_list(
3303 listptr, /* the list */
3304 0, /* separator character */
3305 &hostlist_anchor, /* anchor pointer */
3306 &local_cache_bits, /* cache pointer */
3307 check_host, /* function for testing */
3308 &cb, /* argument for function */
3309 MCL_HOST, /* type of check */
3310 host_address == sender_host_address
3311 ? US"host" : host_address, /* text for debugging */
3312 valueptr); /* where to pass back data */
3313 deliver_host_address = save_host_address;
3320 /*************************************************
3321 * Check the given host item matches a list *
3322 *************************************************/
3324 verify_check_given_host(const uschar **listptr, const host_item *host)
3326 return verify_check_this_host(listptr, NULL, host->name, host->address, NULL);
3329 /*************************************************
3330 * Check the remote host matches a list *
3331 *************************************************/
3333 /* This is a front end to verify_check_this_host(), created because checking
3334 the remote host is a common occurrence. With luck, a good compiler will spot
3335 the tail recursion and optimize it. If there's no host address, this is
3336 command-line SMTP input - check against an empty string for the address.
3339 listptr pointer to the host list
3341 Returns: the yield of verify_check_this_host(),
3342 i.e. OK, FAIL, or DEFER
3346 verify_check_host(uschar **listptr)
3348 return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
3349 sender_host_address ? sender_host_address : US"", NULL);
3356 /*************************************************
3357 * Invert an IP address *
3358 *************************************************/
3360 /* Originally just used for DNS xBL lists, now also used for the
3361 reverse_ip expansion operator.
3364 buffer where to put the answer
3365 address the address to invert
3369 invert_address(uschar *buffer, uschar *address)
3372 uschar *bptr = buffer;
3374 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3375 to the IPv4 part only. */
3377 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3379 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3382 if (host_aton(address, bin) == 1)
3385 for (int i = 0; i < 4; i++)
3387 sprintf(CS bptr, "%d.", x & 255);
3388 while (*bptr) bptr++;
3393 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3394 in any DNS black lists, and the format in which they will be looked up is
3395 unknown. This is just a guess. */
3399 for (int j = 3; j >= 0; j--)
3402 for (int i = 0; i < 8; i++)
3404 sprintf(CS bptr, "%x.", x & 15);
3405 while (*bptr) bptr++;
3411 /* Remove trailing period -- this is needed so that both arbitrary
3412 dnsbl keydomains and inverted addresses may be combined with the
3413 same format string, "%s.%s" */
3420 /****************************************************
3421 Verify a local user account for quota sufficiency
3422 ****************************************************/
3424 /* The real work, done via a re-exec for privs, calls
3425 down to the transport for the quota check.
3427 Route and transport (in recipient-verify mode) the
3430 A routing result indicating any transport type other than appendfile
3433 Return, on stdout, a result string containing:
3434 - highlevel result code (OK, DEFER, FAIL)
3441 verify_quota(uschar * address)
3443 address_item vaddr = {.address = address};
3445 uschar * msg = US"\0";
3448 if ((rc = verify_address(&vaddr, NULL, vopt_is_recipient | vopt_quota,
3449 1, 0, 0, NULL, NULL, &routed)) != OK)
3451 uschar * where = recipient_verify_failure;
3452 msg = acl_verify_message ? acl_verify_message : vaddr.message;
3453 if (!msg) msg = US"";
3454 if (rc == DEFER && vaddr.basic_errno == ERRNO_EXIMQUOTA)
3456 rc = FAIL; /* DEFER -> FAIL */
3458 vaddr.basic_errno = 0;
3460 else if (!where) where = US"";
3462 len = 5 + Ustrlen(msg) + 1 + Ustrlen(where);
3463 msg = string_sprintf("%c%c%c%c%c%s%c%s", (uschar)rc,
3464 (vaddr.basic_errno >> 24) & 0xff, (vaddr.basic_errno >> 16) & 0xff,
3465 (vaddr.basic_errno >> 8) & 0xff, vaddr.basic_errno & 0xff,
3469 DEBUG(D_verify) debug_printf_indent("verify_quota: len %d\n", len);
3475 /******************************************************************************/
3477 /* Quota cache lookup. We use the callout hints db also for the quota cache.
3478 Return TRUE if a nonexpired record was found, having filled in the yield
3483 cached_quota_lookup(const uschar * rcpt, int * yield,
3484 int pos_cache, int neg_cache)
3486 open_db dbblock, *dbm_file = NULL;
3487 dbdata_callout_cache_address * cache_address_record;
3489 if (!pos_cache && !neg_cache)
3491 if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
3493 HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n");
3496 if (!(cache_address_record = (dbdata_callout_cache_address *)
3497 get_callout_cache_record(dbm_file, rcpt, US"address",
3498 pos_cache, neg_cache)))
3500 dbfn_close(dbm_file);
3503 if (cache_address_record->result == ccache_accept)
3505 dbfn_close(dbm_file);
3509 /* Quota cache write */
3512 cache_quota_write(const uschar * rcpt, int yield, int pos_cache, int neg_cache)
3514 open_db dbblock, *dbm_file = NULL;
3515 dbdata_callout_cache_address cache_address_record;
3517 if (!pos_cache && !neg_cache)
3519 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
3521 HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n");
3525 cache_address_record.result = yield == OK ? ccache_accept : ccache_reject;
3527 (void)dbfn_write(dbm_file, rcpt, &cache_address_record,
3528 (int)sizeof(dbdata_callout_cache_address));
3529 HDEBUG(D_verify) debug_printf_indent("wrote %s quota cache record for %s\n",
3530 yield == OK ? "positive" : "negative", rcpt);
3532 dbfn_close(dbm_file);
3537 /* To evaluate a local user's quota, starting in ACL, we need to
3538 fork & exec to regain privileges, to that we can change to the user's
3539 identity for access to their files.
3542 rcpt Recipient account
3543 pos_cache Number of seconds to cache a positive result (delivery
3544 to be accepted). Zero to disable caching.
3545 neg_cache Number of seconds to cache a negative result. Zero to disable.
3546 msg Pointer to result string pointer
3548 Return: OK/DEFER/FAIL code
3552 verify_quota_call(const uschar * rcpt, int pos_cache, int neg_cache,
3555 int pfd[2], pid, save_errno, yield = FAIL;
3556 void (*oldsignal)(int);
3557 const uschar * where = US"socketpair";
3561 if (cached_quota_lookup(rcpt, &yield, pos_cache, neg_cache))
3563 HDEBUG(D_verify) debug_printf_indent("quota cache: address record is %s\n",
3564 yield == OK ? "positive" : "negative");
3567 recipient_verify_failure = US"quota";
3568 acl_verify_message = *msg =
3569 US"Previous (cached) quota verification failure";
3578 oldsignal = signal(SIGCHLD, SIG_DFL);
3579 if ((pid = exim_fork(US"quota-verify")) < 0)
3582 close(pfd[pipe_write]);
3583 close(pfd[pipe_read]);
3588 if (pid == 0) /* child */
3590 close(pfd[pipe_read]);
3591 force_fd(pfd[pipe_write], 1); /* stdout to pipe */
3592 close(pfd[pipe_write]);
3594 if (debug_fd > 0) force_fd(debug_fd, 2);
3596 child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 3,
3597 US"-MCq", string_sprintf("%d", message_size), rcpt);
3602 close(pfd[pipe_write]);
3606 DEBUG(D_verify) debug_printf_indent(" fork: %s\n", strerror(save_errno));
3611 int n = read(pfd[pipe_read], buf, sizeof(buf));
3614 waitpid(pid, &status, 0);
3619 if (n > 0) yield = buf[0];
3621 save_errno = (buf[1] << 24) | (buf[2] << 16) | (buf[3] << 8) | buf[4];
3622 if ((recipient_verify_failure = n > 5
3623 ? string_copyn_taint(buf+5, n-5, GET_UNTAINTED) : NULL))
3626 s = buf + 5 + Ustrlen(recipient_verify_failure) + 1;
3628 acl_verify_message = *msg =
3629 m > 0 ? string_copyn_taint(s, m, GET_UNTAINTED) : NULL;
3632 DEBUG(D_verify) debug_printf_indent("verify call response:"
3633 " len %d yield %s errno '%s' where '%s' msg '%s'\n",
3634 n, rc_names[yield], strerror(save_errno), recipient_verify_failure, *msg);
3637 || save_errno == 0 && Ustrcmp(recipient_verify_failure, "quota") == 0)
3638 cache_quota_write(rcpt, yield, pos_cache, neg_cache);
3639 else DEBUG(D_verify)
3640 debug_printf_indent("result not cacheable\n");
3645 debug_printf_indent("verify call response: waitpid status 0x%04x\n", status);
3649 close(pfd[pipe_read]);
3650 signal(SIGCHLD, oldsignal);
3655 DEBUG(D_verify) debug_printf_indent("verify_quota_call fail in %s\n", where);
3662 /* End of verify.c */