1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2023 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* See the file NOTICE for conditions of use and distribution. */
8 /* SPDX-License-Identifier: GPL-2.0-or-later */
13 #if defined(SUPPORT_DANE) && defined(DISABLE_TLS)
14 # error TLS is required for DANE
18 /* Options specific to the smtp transport. This transport also supports LMTP
19 over TCP/IP. The options must be in alphabetic order (note that "_" comes
20 before the lower case letters). Some live in the transport_instance block so as
21 to be publicly visible; these are flagged with opt_public. */
23 #define LOFF(field) OPT_OFF(smtp_transport_options_block, field)
25 optionlist smtp_transport_options[] = {
26 { "*expand_multi_domain", opt_stringptr | opt_hidden | opt_public,
27 OPT_OFF(transport_instance, expand_multi_domain) },
28 { "*expand_retry_include_ip_address", opt_stringptr | opt_hidden,
29 LOFF(expand_retry_include_ip_address) },
31 { "address_retry_include_sender", opt_bool,
32 LOFF(address_retry_include_sender) },
33 { "allow_localhost", opt_bool, LOFF(allow_localhost) },
34 #ifdef EXPERIMENTAL_ARC
35 { "arc_sign", opt_stringptr, LOFF(arc_sign) },
37 { "authenticated_sender", opt_stringptr, LOFF(authenticated_sender) },
38 { "authenticated_sender_force", opt_bool, LOFF(authenticated_sender_force) },
39 { "command_timeout", opt_time, LOFF(command_timeout) },
40 { "connect_timeout", opt_time, LOFF(connect_timeout) },
41 { "connection_max_messages", opt_int | opt_public,
42 OPT_OFF(transport_instance, connection_max_messages) },
44 { "dane_require_tls_ciphers", opt_stringptr, LOFF(dane_require_tls_ciphers) },
46 { "data_timeout", opt_time, LOFF(data_timeout) },
47 { "delay_after_cutoff", opt_bool, LOFF(delay_after_cutoff) },
49 { "dkim_canon", opt_stringptr, LOFF(dkim.dkim_canon) },
50 { "dkim_domain", opt_stringptr, LOFF(dkim.dkim_domain) },
51 { "dkim_hash", opt_stringptr, LOFF(dkim.dkim_hash) },
52 { "dkim_identity", opt_stringptr, LOFF(dkim.dkim_identity) },
53 { "dkim_private_key", opt_stringptr, LOFF(dkim.dkim_private_key) },
54 { "dkim_selector", opt_stringptr, LOFF(dkim.dkim_selector) },
55 { "dkim_sign_headers", opt_stringptr, LOFF(dkim.dkim_sign_headers) },
56 { "dkim_strict", opt_stringptr, LOFF(dkim.dkim_strict) },
57 { "dkim_timestamps", opt_stringptr, LOFF(dkim.dkim_timestamps) },
59 { "dns_qualify_single", opt_bool, LOFF(dns_qualify_single) },
60 { "dns_search_parents", opt_bool, LOFF(dns_search_parents) },
61 { "dnssec_request_domains", opt_stringptr, LOFF(dnssec.request) },
62 { "dnssec_require_domains", opt_stringptr, LOFF(dnssec.require) },
63 { "dscp", opt_stringptr, LOFF(dscp) },
64 { "fallback_hosts", opt_stringptr, LOFF(fallback_hosts) },
65 { "final_timeout", opt_time, LOFF(final_timeout) },
66 { "gethostbyname", opt_bool, LOFF(gethostbyname) },
67 { "helo_data", opt_stringptr, LOFF(helo_data) },
68 #if !defined(DISABLE_TLS) && !defined(DISABLE_TLS_RESUME)
69 { "host_name_extract", opt_stringptr, LOFF(host_name_extract) },
71 { "hosts", opt_stringptr, LOFF(hosts) },
72 { "hosts_avoid_esmtp", opt_stringptr, LOFF(hosts_avoid_esmtp) },
73 { "hosts_avoid_pipelining", opt_stringptr, LOFF(hosts_avoid_pipelining) },
75 { "hosts_avoid_tls", opt_stringptr, LOFF(hosts_avoid_tls) },
77 { "hosts_max_try", opt_int, LOFF(hosts_max_try) },
78 { "hosts_max_try_hardlimit", opt_int, LOFF(hosts_max_try_hardlimit) },
80 { "hosts_nopass_tls", opt_stringptr, LOFF(hosts_nopass_tls) },
81 { "hosts_noproxy_tls", opt_stringptr, LOFF(hosts_noproxy_tls) },
83 { "hosts_override", opt_bool, LOFF(hosts_override) },
84 #ifndef DISABLE_PIPE_CONNECT
85 { "hosts_pipe_connect", opt_stringptr, LOFF(hosts_pipe_connect) },
87 { "hosts_randomize", opt_bool, LOFF(hosts_randomize) },
88 #if !defined(DISABLE_TLS) && !defined(DISABLE_OCSP)
89 { "hosts_request_ocsp", opt_stringptr, LOFF(hosts_request_ocsp) },
91 { "hosts_require_alpn", opt_stringptr, LOFF(hosts_require_alpn) },
92 { "hosts_require_auth", opt_stringptr, LOFF(hosts_require_auth) },
95 { "hosts_require_dane", opt_stringptr, LOFF(hosts_require_dane) },
98 { "hosts_require_ocsp", opt_stringptr, LOFF(hosts_require_ocsp) },
100 { "hosts_require_tls", opt_stringptr, LOFF(hosts_require_tls) },
102 { "hosts_try_auth", opt_stringptr, LOFF(hosts_try_auth) },
103 { "hosts_try_chunking", opt_stringptr, LOFF(hosts_try_chunking) },
105 { "hosts_try_dane", opt_stringptr, LOFF(hosts_try_dane) },
107 { "hosts_try_fastopen", opt_stringptr, LOFF(hosts_try_fastopen) },
109 { "hosts_try_prdr", opt_stringptr, LOFF(hosts_try_prdr) },
112 { "hosts_verify_avoid_tls", opt_stringptr, LOFF(hosts_verify_avoid_tls) },
114 { "interface", opt_stringptr, LOFF(interface) },
115 { "keepalive", opt_bool, LOFF(keepalive) },
116 { "lmtp_ignore_quota", opt_bool, LOFF(lmtp_ignore_quota) },
117 { "max_rcpt", opt_stringptr | opt_public,
118 OPT_OFF(transport_instance, max_addresses) },
119 { "message_linelength_limit", opt_int, LOFF(message_linelength_limit) },
120 { "multi_domain", opt_expand_bool | opt_public,
121 OPT_OFF(transport_instance, multi_domain) },
122 { "port", opt_stringptr, LOFF(port) },
123 { "protocol", opt_stringptr, LOFF(protocol) },
124 { "retry_include_ip_address", opt_expand_bool, LOFF(retry_include_ip_address) },
125 { "serialize_hosts", opt_stringptr, LOFF(serialize_hosts) },
126 { "size_addition", opt_int, LOFF(size_addition) },
128 { "socks_proxy", opt_stringptr, LOFF(socks_proxy) },
131 { "tls_alpn", opt_stringptr, LOFF(tls_alpn) },
132 { "tls_certificate", opt_stringptr, LOFF(tls_certificate) },
133 { "tls_crl", opt_stringptr, LOFF(tls_crl) },
134 { "tls_dh_min_bits", opt_int, LOFF(tls_dh_min_bits) },
135 { "tls_privatekey", opt_stringptr, LOFF(tls_privatekey) },
136 { "tls_require_ciphers", opt_stringptr, LOFF(tls_require_ciphers) },
137 # ifndef DISABLE_TLS_RESUME
138 { "tls_resumption_hosts", opt_stringptr, LOFF(tls_resumption_hosts) },
140 { "tls_sni", opt_stringptr, LOFF(tls_sni) },
141 { "tls_tempfail_tryclear", opt_bool, LOFF(tls_tempfail_tryclear) },
142 { "tls_try_verify_hosts", opt_stringptr, LOFF(tls_try_verify_hosts) },
143 { "tls_verify_cert_hostnames", opt_stringptr, LOFF(tls_verify_cert_hostnames)},
144 { "tls_verify_certificates", opt_stringptr, LOFF(tls_verify_certificates) },
145 { "tls_verify_hosts", opt_stringptr, LOFF(tls_verify_hosts) },
148 { "utf8_downconvert", opt_stringptr, LOFF(utf8_downconvert) },
152 /* Size of the options list. An extern variable has to be used so that its
153 address can appear in the tables drtables.c. */
155 int smtp_transport_options_count = nelem(smtp_transport_options);
161 smtp_transport_options_block smtp_transport_option_defaults = {0};
162 void smtp_transport_init(transport_instance *tblock) {}
163 BOOL smtp_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
164 void smtp_transport_closedown(transport_instance *tblock) {}
166 #else /*!MACRO_PREDEF*/
169 /* Default private options block for the smtp transport. */
171 smtp_transport_options_block smtp_transport_option_defaults = {
172 /* All non-mentioned elements 0/NULL/FALSE */
173 .helo_data = US"$primary_hostname",
174 .protocol = US"smtp",
175 .hosts_try_chunking = US"*",
177 .hosts_try_dane = US"*",
179 .hosts_try_fastopen = US"*",
181 .hosts_try_prdr = US"*",
184 .hosts_request_ocsp = US"*", /* hosts_request_ocsp (except under DANE; tls_client_start()) */
186 .command_timeout = 5*60,
187 .connect_timeout = 5*60,
188 .data_timeout = 5*60,
189 .final_timeout = 10*60,
190 .size_addition = 1024,
192 .hosts_max_try_hardlimit = 50,
193 .message_linelength_limit = 998,
194 .address_retry_include_sender = TRUE,
195 .dns_qualify_single = TRUE,
196 .dnssec = { .request= US"*", .require=NULL },
197 .delay_after_cutoff = TRUE,
199 .retry_include_ip_address = TRUE,
201 .tls_verify_certificates = US"system",
202 .tls_dh_min_bits = EXIM_CLIENT_DH_DEFAULT_MIN_BITS,
203 .tls_tempfail_tryclear = TRUE,
204 .tls_try_verify_hosts = US"*",
205 .tls_verify_cert_hostnames = US"*",
208 .utf8_downconvert = US"-1",
212 { .dkim_hash = US"sha256", },
216 /* some DSN flags for use later */
218 static int rf_list[] = {rf_notify_never, rf_notify_success,
219 rf_notify_failure, rf_notify_delay };
221 static uschar *rf_names[] = { US"NEVER", US"SUCCESS", US"FAILURE", US"DELAY" };
227 static uschar *smtp_command; /* Points to last cmd for error messages */
228 static uschar *mail_command; /* Points to MAIL cmd for error messages */
229 static uschar *data_command = US""; /* Points to DATA cmd for error messages */
230 static BOOL update_waiting; /* TRUE to update the "wait" database */
232 /*XXX move to smtp_context */
233 static BOOL pipelining_active; /* current transaction is in pipe mode */
236 static unsigned ehlo_response(uschar * buf, unsigned checks);
238 /* sync_responses() return codes */
240 #define RESP_BIT_HAD_5XX BIT(1)
241 #define RESP_BIT_HAD_2XX BIT(0)
242 #define RESP_HAD_2_AND_5 (RESP_BIT_HAD_2XX | RESP_BIT_HAD_5XX)
243 #define RESP_NOERROR 0
244 #define RESP_RCPT_TIMEO -1
245 #define RESP_RCPT_ERROR -2
246 #define RESP_MAIL_OR_DATA_ERROR -3
247 #define RESP_EPIPE_EHLO_ERR -4
248 #define RESP_EHLO_ERR_TLS -5
250 /******************************************************************************/
253 smtp_deliver_init(void)
257 const pcre2_code ** re;
258 const uschar * string;
261 { ®ex_AUTH, AUTHS_REGEX },
262 { ®ex_CHUNKING, US"\\n250[\\s\\-]CHUNKING(\\s|\\n|$)" },
263 { ®ex_DSN, US"\\n250[\\s\\-]DSN(\\s|\\n|$)" },
264 { ®ex_IGNOREQUOTA, US"\\n250[\\s\\-]IGNOREQUOTA(\\s|\\n|$)" },
265 { ®ex_PIPELINING, US"\\n250[\\s\\-]PIPELINING(\\s|\\n|$)" },
266 { ®ex_SIZE, US"\\n250[\\s\\-]SIZE(\\s|\\n|$)" },
269 { ®ex_STARTTLS, US"\\n250[\\s\\-]STARTTLS(\\s|\\n|$)" },
272 { ®ex_PRDR, US"\\n250[\\s\\-]PRDR(\\s|\\n|$)" },
275 { ®ex_UTF8, US"\\n250[\\s\\-]SMTPUTF8(\\s|\\n|$)" },
277 #ifndef DISABLE_PIPE_CONNECT
278 { ®ex_EARLY_PIPE, US"\\n250[\\s\\-]" EARLY_PIPE_FEATURE_NAME "(\\s|\\n|$)" },
280 #ifndef DISABLE_ESMTP_LIMITS
281 { ®ex_LIMITS, US"\\n250[\\s\\-]LIMITS\\s" },
285 for (struct list * l = list; l < list + nelem(list); l++)
287 *l->re = regex_must_compile(l->string, MCS_NOFLAGS, TRUE);
291 /*************************************************
292 * Setup entry point *
293 *************************************************/
295 /* This function is called when the transport is about to be used,
296 but before running it in a sub-process. It is used for two things:
298 (1) To set the fallback host list in addresses, when delivering.
299 (2) To pass back the interface, port, protocol, and other options, for use
300 during callout verification.
303 tblock pointer to the transport instance block
304 addrlist list of addresses about to be transported
305 tf if not NULL, pointer to block in which to return options
306 uid the uid that will be set (not used)
307 gid the gid that will be set (not used)
308 errmsg place for error message (not used)
310 Returns: OK always (FAIL, DEFER not used)
314 smtp_transport_setup(transport_instance *tblock, address_item *addrlist,
315 transport_feedback *tf, uid_t uid, gid_t gid, uschar **errmsg)
317 smtp_transport_options_block *ob = SOB tblock->options_block;
319 /* Pass back options if required. This interface is getting very messy. */
323 tf->interface = ob->interface;
325 tf->protocol = ob->protocol;
326 tf->hosts = ob->hosts;
327 tf->hosts_override = ob->hosts_override;
328 tf->hosts_randomize = ob->hosts_randomize;
329 tf->gethostbyname = ob->gethostbyname;
330 tf->qualify_single = ob->dns_qualify_single;
331 tf->search_parents = ob->dns_search_parents;
332 tf->helo_data = ob->helo_data;
335 /* Set the fallback host list for all the addresses that don't have fallback
336 host lists, provided that the local host wasn't present in the original host
339 if (!testflag(addrlist, af_local_host_removed))
340 for (; addrlist; addrlist = addrlist->next)
341 if (!addrlist->fallback_hosts) addrlist->fallback_hosts = ob->fallback_hostlist;
348 /*************************************************
349 * Initialization entry point *
350 *************************************************/
352 /* Called for each instance, after its options have been read, to
353 enable consistency checks to be done, or anything else that needs
356 Argument: pointer to the transport instance block
361 smtp_transport_init(transport_instance *tblock)
363 smtp_transport_options_block * ob = SOB tblock->options_block;
364 int old_pool = store_pool;
366 /* Retry_use_local_part defaults FALSE if unset */
368 if (tblock->retry_use_local_part == TRUE_UNSET)
369 tblock->retry_use_local_part = FALSE;
371 /* Set the default port according to the protocol */
374 ob->port = strcmpic(ob->protocol, US"lmtp") == 0
376 : strcmpic(ob->protocol, US"smtps") == 0
377 ? US"smtps" : US"smtp";
379 /* Set up the setup entry point, to be called before subprocesses for this
382 tblock->setup = smtp_transport_setup;
384 /* Complain if any of the timeouts are zero. */
386 if (ob->command_timeout <= 0 || ob->data_timeout <= 0 ||
387 ob->final_timeout <= 0)
388 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
389 "command, data, or final timeout value is zero for %s transport",
392 /* If hosts_override is set and there are local hosts, set the global
393 flag that stops verify from showing router hosts. */
395 if (ob->hosts_override && ob->hosts) tblock->overrides_hosts = TRUE;
397 /* If there are any fallback hosts listed, build a chain of host items
398 for them, but do not do any lookups at this time. */
400 store_pool = POOL_PERM;
401 host_build_hostlist(&ob->fallback_hostlist, ob->fallback_hosts, FALSE);
402 store_pool = old_pool;
409 /*************************************************
410 * Set delivery info into all active addresses *
411 *************************************************/
413 /* Only addresses whose status is >= PENDING are relevant. A lesser
414 status means that an address is not currently being processed.
417 addrlist points to a chain of addresses
418 errno_value to put in each address's errno field
419 msg to put in each address's message field
420 rc to put in each address's transport_return field
421 pass_message if TRUE, set the "pass message" flag in the address
422 host if set, mark addrs as having used this host
423 smtp_greeting from peer
424 helo_response from peer
425 start points to timestamp of delivery start
427 If errno_value has the special value ERRNO_CONNECTTIMEOUT, ETIMEDOUT is put in
428 the errno field, and RTEF_CTOUT is ORed into the more_errno field, to indicate
429 this particular type of timeout.
435 set_errno(address_item *addrlist, int errno_value, uschar *msg, int rc,
436 BOOL pass_message, host_item * host,
437 #ifdef EXPERIMENTAL_DSN_INFO
438 const uschar * smtp_greeting, const uschar * helo_response,
440 struct timeval * start
444 struct timeval deliver_time;
446 if (errno_value == ERRNO_CONNECTTIMEOUT)
448 errno_value = ETIMEDOUT;
449 orvalue = RTEF_CTOUT;
451 timesince(&deliver_time, start);
453 for (address_item * addr = addrlist; addr; addr = addr->next)
454 if (addr->transport_return >= PENDING)
456 addr->basic_errno = errno_value;
457 addr->more_errno |= orvalue;
458 addr->delivery_time = deliver_time;
462 if (pass_message) setflag(addr, af_pass_message);
464 addr->transport_return = rc;
467 addr->host_used = host;
468 #ifdef EXPERIMENTAL_DSN_INFO
470 {uschar * s = Ustrchr(smtp_greeting, '\n'); if (s) *s = '\0';}
471 addr->smtp_greeting = smtp_greeting;
474 {uschar * s = Ustrchr(helo_response, '\n'); if (s) *s = '\0';}
475 addr->helo_response = helo_response;
482 set_errno_nohost(address_item * addrlist, int errno_value, uschar * msg, int rc,
483 BOOL pass_message, struct timeval * start)
485 set_errno(addrlist, errno_value, msg, rc, pass_message, NULL,
486 #ifdef EXPERIMENTAL_DSN_INFO
493 /*************************************************
494 * Check an SMTP response *
495 *************************************************/
497 /* This function is given an errno code and the SMTP response buffer
498 to analyse, together with the host identification for generating messages. It
499 sets an appropriate message and puts the first digit of the response code into
500 the yield variable. If no response was actually read, a suitable digit is
504 host the current host, to get its name for messages
505 errno_value pointer to the errno value
506 more_errno from the top address for use with ERRNO_FILTER_FAIL
507 buffer the SMTP response buffer
508 yield where to put a one-digit SMTP response code
509 message where to put an error message
510 pass_message set TRUE if message is an SMTP response
512 Returns: TRUE if an SMTP "QUIT" command should be sent, else FALSE
516 check_response(host_item *host, int *errno_value, int more_errno,
517 uschar *buffer, int *yield, uschar **message, BOOL *pass_message)
519 uschar * pl = pipelining_active ? US"pipelined " : US"";
522 *yield = '4'; /* Default setting is to give a temporary error */
526 case ETIMEDOUT: /* Handle response timeout */
527 *message = US string_sprintf("SMTP timeout after %s%s",
529 if (transport_count > 0)
530 *message = US string_sprintf("%s (%d bytes written)", *message,
534 case ERRNO_SMTPFORMAT: /* Handle malformed SMTP response */
535 s = string_printing(buffer);
536 while (isspace(*s)) s++;
538 ? string_sprintf("Malformed SMTP reply (an empty line) "
539 "in response to %s%s", pl, smtp_command)
540 : string_sprintf("Malformed SMTP reply in response to %s%s: %s",
541 pl, smtp_command, s);
544 case ERRNO_TLSFAILURE: /* Handle bad first read; can happen with
546 *message = US"bad first read from TLS conn";
549 case ERRNO_FILTER_FAIL: /* Handle a failed filter process error;
550 can't send QUIT as we mustn't end the DATA. */
551 *message = string_sprintf("transport filter process failed (%d)%s",
553 more_errno == EX_EXECFAILED ? ": unable to execute command" : "");
556 case ERRNO_CHHEADER_FAIL: /* Handle a failed add_headers expansion;
557 can't send QUIT as we mustn't end the DATA. */
559 string_sprintf("failed to expand headers_add or headers_remove: %s",
560 expand_string_message);
563 case ERRNO_WRITEINCOMPLETE: /* failure to write a complete data block */
564 *message = US"failed to write a data block";
568 case ERRNO_UTF8_FWD: /* no advertised SMTPUTF8, for international message */
569 *message = US"utf8 support required but not offered for forwarding";
570 DEBUG(D_deliver|D_transport) debug_printf("%s\n", *message);
575 /* Handle error responses from the remote mailer. */
579 *message = string_sprintf("SMTP error from remote mail server after %s%s: "
580 "%s", pl, smtp_command, s = string_printing(buffer));
581 *pass_message = TRUE;
586 /* No data was read. If there is no errno, this must be the EOF (i.e.
587 connection closed) case, which causes deferral. An explicit connection reset
588 error has the same effect. Otherwise, put the host's identity in the message,
589 leaving the errno value to be interpreted as well. In all cases, we have to
590 assume the connection is now dead. */
592 if (*errno_value == 0 || *errno_value == ECONNRESET)
594 *errno_value = ERRNO_SMTPCLOSED;
595 *message = US string_sprintf("Remote host closed connection "
596 "in response to %s%s", pl, smtp_command);
599 *message = US string_sprintf("%s [%s]", host->name, host->address);
606 /*************************************************
607 * Write error message to logs *
608 *************************************************/
610 /* This writes to the main log and to the message log.
613 host the current host
614 detail the current message (addr_item->message)
615 basic_errno the errno (addr_item->basic_errno)
621 write_logs(const host_item *host, const uschar *suffix, int basic_errno)
623 gstring * message = LOGGING(outgoing_port)
624 ? string_fmt_append(NULL, "H=%s [%s]:%d", host->name, host->address,
625 host->port == PORT_NONE ? 25 : host->port)
626 : string_fmt_append(NULL, "H=%s [%s]", host->name, host->address);
630 message = string_fmt_append(message, ": %s", suffix);
632 message = string_fmt_append(message, ": %s", strerror(basic_errno));
635 message = string_fmt_append(message, " %s", exim_errstr(basic_errno));
637 log_write(0, LOG_MAIN, "%Y", message);
638 deliver_msglog("%s %.*s\n", tod_stamp(tod_log), message->ptr, message->s);
642 msglog_line(host_item * host, uschar * message)
644 deliver_msglog("%s H=%s [%s] %s\n", tod_stamp(tod_log),
645 host->name, host->address, message);
650 #ifndef DISABLE_EVENT
651 /*************************************************
652 * Post-defer action *
653 *************************************************/
655 /* This expands an arbitrary per-transport string.
656 It might, for example, be used to write to the database log.
659 addr the address item containing error information
660 host the current host
667 deferred_event_raise(address_item * addr, host_item * host, uschar * evstr)
669 uschar * action = addr->transport->event_action;
670 const uschar * save_domain, * save_local;
675 save_domain = deliver_domain;
676 save_local = deliver_localpart;
678 /*XXX would ip & port already be set up? */
679 deliver_host_address = string_copy(host->address);
680 deliver_host_port = host->port == PORT_NONE ? 25 : host->port;
681 event_defer_errno = addr->basic_errno;
683 router_name = addr->router->name;
684 transport_name = addr->transport->name;
685 deliver_domain = addr->domain;
686 deliver_localpart = addr->local_part;
688 (void) event_raise(action, evstr,
690 ? addr->basic_errno > 0
691 ? string_sprintf("%s: %s", addr->message, strerror(addr->basic_errno))
692 : string_copy(addr->message)
693 : addr->basic_errno > 0
694 ? string_copy(US strerror(addr->basic_errno))
698 deliver_localpart = save_local;
699 deliver_domain = save_domain;
700 router_name = transport_name = NULL;
704 /*************************************************
705 * Reap SMTP specific responses *
706 *************************************************/
708 smtp_discard_responses(smtp_context * sx, smtp_transport_options_block * ob,
711 uschar flushbuffer[4096];
715 if (!smtp_read_response(sx, flushbuffer, sizeof(flushbuffer),
716 '2', ob->command_timeout)
717 && (errno != 0 || flushbuffer[0] == 0))
724 /* Return boolean success */
727 smtp_reap_banner(smtp_context * sx)
730 #if defined(__linux__) && defined(TCP_QUICKACK)
731 { /* Hack to get QUICKACK disabled; has to be right after 3whs, and has to on->off */
732 int sock = sx->cctx.sock;
733 struct pollfd p = {.fd = sock, .events = POLLOUT};
734 if (poll(&p, 1, 1000) >= 0) /* retval test solely for compiler quitening */
736 (void) setsockopt(sock, IPPROTO_TCP, TCP_QUICKACK, US &on, sizeof(on));
737 (void) setsockopt(sock, IPPROTO_TCP, TCP_QUICKACK, US &off, sizeof(off));
741 good_response = smtp_read_response(sx, sx->buffer, sizeof(sx->buffer),
742 '2', (SOB sx->conn_args.ob)->command_timeout);
743 #ifdef EXPERIMENTAL_DSN_INFO
744 sx->smtp_greeting = string_copy(sx->buffer);
746 return good_response;
750 smtp_reap_ehlo(smtp_context * sx)
752 if (!smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2',
753 (SOB sx->conn_args.ob)->command_timeout))
755 if (errno != 0 || sx->buffer[0] == 0 || sx->lmtp)
757 #ifdef EXPERIMENTAL_DSN_INFO
758 sx->helo_response = string_copy(sx->buffer);
764 #ifdef EXPERIMENTAL_DSN_INFO
765 sx->helo_response = string_copy(sx->buffer);
767 #ifndef DISABLE_EVENT
768 (void) event_raise(sx->conn_args.tblock->event_action,
769 US"smtp:ehlo", sx->buffer, NULL);
775 #if !defined(DISABLE_TLS) && !defined(DISABLE_TLS_RESUME)
777 /* Grab a string differentiating server behind a loadbalancer, for TLS
778 resumption when such servers do not share a session-cache */
781 ehlo_response_lbserver(smtp_context * sx, const uschar * name_extract)
784 uschar * save_item = iterate_item;
786 if (sx->conn_args.have_lbserver)
788 iterate_item = sx->buffer;
789 s = expand_cstring(name_extract);
790 iterate_item = save_item;
791 sx->conn_args.host_lbserver = s && !*s ? NULL : s;
792 sx->conn_args.have_lbserver = TRUE;
798 /******************************************************************************/
800 #ifndef DISABLE_ESMTP_LIMITS
801 /* If TLS, or TLS not offered, called with the EHLO response in the buffer.
802 Check it for a LIMITS keyword and parse values into the smtp context structure.
804 We don't bother with peers that we won't talk TLS to, even though they can,
805 just ignore their LIMITS advice (if any) and treat them as if they do not.
806 This saves us dealing with a duplicate set of values. */
809 ehlo_response_limits_read(smtp_context * sx)
813 /* matches up to just after the first space after the keyword */
815 if (regex_match(regex_LIMITS, sx->buffer, -1, &match))
816 for (const uschar * s = sx->buffer + Ustrlen(match); *s; )
818 while (isspace(*s)) s++;
819 if (*s == '\n') break;
821 if (strncmpic(s, US"MAILMAX=", 8) == 0)
823 sx->peer_limit_mail = atoi(CS (s += 8));
824 while (isdigit(*s)) s++;
826 else if (strncmpic(s, US"RCPTMAX=", 8) == 0)
828 sx->peer_limit_rcpt = atoi(CS (s += 8));
829 while (isdigit(*s)) s++;
831 else if (strncmpic(s, US"RCPTDOMAINMAX=", 14) == 0)
833 sx->peer_limit_rcptdom = atoi(CS (s += 14));
834 while (isdigit(*s)) s++;
837 while (*s && !isspace(*s)) s++;
841 /* Apply given values to the current connection */
843 ehlo_limits_apply(smtp_context * sx,
844 unsigned limit_mail, unsigned limit_rcpt, unsigned limit_rcptdom)
846 if (limit_mail && limit_mail < sx->max_mail) sx->max_mail = limit_mail;
847 if (limit_rcpt && limit_rcpt < sx->max_rcpt) sx->max_rcpt = limit_rcpt;
850 DEBUG(D_transport) debug_printf("will treat as !multi_domain\n");
851 sx->single_rcpt_domain = TRUE;
855 /* Apply values from EHLO-resp to the current connection */
857 ehlo_response_limits_apply(smtp_context * sx)
859 ehlo_limits_apply(sx, sx->peer_limit_mail, sx->peer_limit_rcpt,
860 sx->peer_limit_rcptdom);
863 /* Apply values read from cache to the current connection */
865 ehlo_cache_limits_apply(smtp_context * sx)
867 # ifndef DISABLE_PIPE_CONNECT
868 ehlo_limits_apply(sx, sx->ehlo_resp.limit_mail, sx->ehlo_resp.limit_rcpt,
869 sx->ehlo_resp.limit_rcptdom);
872 #endif /*EXPERIMENTAL_ESMTP_LIMITS*/
874 /******************************************************************************/
876 #ifndef DISABLE_PIPE_CONNECT
878 ehlo_cache_key(const smtp_context * sx)
880 host_item * host = sx->conn_args.host;
881 return Ustrchr(host->address, ':')
882 ? string_sprintf("[%s]:%d.EHLO", host->address,
883 host->port == PORT_NONE ? sx->port : host->port)
884 : string_sprintf("%s:%d.EHLO", host->address,
885 host->port == PORT_NONE ? sx->port : host->port);
888 /* Cache EHLO-response info for use by early-pipe.
890 - During a normal flow on EHLO response (either cleartext or under TLS),
891 when we are willing to do PIPECONNECT and it is offered
892 - During an early-pipe flow on receiving the actual EHLO response and noting
893 disparity versus the cached info used, when PIPECONNECT is still being offered
895 We assume that suitable values have been set in the sx.ehlo_resp structure for
896 features and auths; we handle the copy of limits. */
899 write_ehlo_cache_entry(smtp_context * sx)
901 open_db dbblock, * dbm_file;
903 # ifndef DISABLE_ESMTP_LIMITS
904 sx->ehlo_resp.limit_mail = sx->peer_limit_mail;
905 sx->ehlo_resp.limit_rcpt = sx->peer_limit_rcpt;
906 sx->ehlo_resp.limit_rcptdom = sx->peer_limit_rcptdom;
909 if ((dbm_file = dbfn_open(US"misc", O_RDWR, &dbblock, TRUE, TRUE)))
911 uschar * ehlo_resp_key = ehlo_cache_key(sx);
912 dbdata_ehlo_resp er = { .data = sx->ehlo_resp };
915 # ifndef DISABLE_ESMTP_LIMITS
916 if (sx->ehlo_resp.limit_mail || sx->ehlo_resp.limit_rcpt || sx->ehlo_resp.limit_rcptdom)
917 debug_printf("writing clr %04x/%04x cry %04x/%04x lim %05d/%05d/%05d\n",
918 sx->ehlo_resp.cleartext_features, sx->ehlo_resp.cleartext_auths,
919 sx->ehlo_resp.crypted_features, sx->ehlo_resp.crypted_auths,
920 sx->ehlo_resp.limit_mail, sx->ehlo_resp.limit_rcpt,
921 sx->ehlo_resp.limit_rcptdom);
924 debug_printf("writing clr %04x/%04x cry %04x/%04x\n",
925 sx->ehlo_resp.cleartext_features, sx->ehlo_resp.cleartext_auths,
926 sx->ehlo_resp.crypted_features, sx->ehlo_resp.crypted_auths);
928 dbfn_write(dbm_file, ehlo_resp_key, &er, (int)sizeof(er));
929 dbfn_close(dbm_file);
934 invalidate_ehlo_cache_entry(smtp_context * sx)
936 open_db dbblock, * dbm_file;
938 if ( sx->early_pipe_active
939 && (dbm_file = dbfn_open(US"misc", O_RDWR, &dbblock, TRUE, TRUE)))
941 uschar * ehlo_resp_key = ehlo_cache_key(sx);
944 dbdata_ehlo_resp * er;
946 if (!(er = dbfn_read_enforce_length(dbm_file, ehlo_resp_key, sizeof(dbdata_ehlo_resp))))
947 debug_printf("no ehlo-resp record!\n");
949 debug_printf("ehlo-resp record is %d seconds old\n", time(NULL) - er->time_stamp);
952 dbfn_delete(dbm_file, ehlo_resp_key);
953 dbfn_close(dbm_file);
958 read_ehlo_cache_entry(smtp_context * sx)
963 if (!(dbm_file = dbfn_open(US"misc", O_RDONLY, &dbblock, FALSE, TRUE)))
964 { DEBUG(D_transport) debug_printf("ehlo-cache: no misc DB\n"); }
967 uschar * ehlo_resp_key = ehlo_cache_key(sx);
968 dbdata_ehlo_resp * er;
970 if (!(er = dbfn_read_enforce_length(dbm_file, ehlo_resp_key, sizeof(dbdata_ehlo_resp))))
971 { DEBUG(D_transport) debug_printf("no ehlo-resp record\n"); }
972 else if (time(NULL) - er->time_stamp > retry_data_expire)
974 DEBUG(D_transport) debug_printf("ehlo-resp record too old\n");
975 dbfn_close(dbm_file);
976 if ((dbm_file = dbfn_open(US"misc", O_RDWR, &dbblock, TRUE, TRUE)))
977 dbfn_delete(dbm_file, ehlo_resp_key);
982 # ifndef DISABLE_ESMTP_LIMITS
983 if (er->data.limit_mail || er->data.limit_rcpt || er->data.limit_rcptdom)
984 debug_printf("EHLO response bits from cache:"
985 " cleartext 0x%04x/0x%04x crypted 0x%04x/0x%04x lim %05d/%05d/%05d\n",
986 er->data.cleartext_features, er->data.cleartext_auths,
987 er->data.crypted_features, er->data.crypted_auths,
988 er->data.limit_mail, er->data.limit_rcpt, er->data.limit_rcptdom);
991 debug_printf("EHLO response bits from cache:"
992 " cleartext 0x%04x/0x%04x crypted 0x%04x/0x%04x\n",
993 er->data.cleartext_features, er->data.cleartext_auths,
994 er->data.crypted_features, er->data.crypted_auths);
996 sx->ehlo_resp = er->data;
997 # ifndef DISABLE_ESMTP_LIMITS
998 ehlo_cache_limits_apply(sx);
1000 dbfn_close(dbm_file);
1003 dbfn_close(dbm_file);
1010 /* Return an auths bitmap for the set of AUTH methods offered by the server
1011 which match our client-side authenticators. */
1013 static unsigned short
1014 study_ehlo_auths(smtp_context * sx)
1019 unsigned short authbits = 0;
1021 if (!sx->esmtp) return 0;
1022 if (!regex_AUTH) regex_AUTH = regex_must_compile(AUTHS_REGEX, MCS_NOFLAGS, TRUE);
1023 if (!regex_match_and_setup(regex_AUTH, sx->buffer, 0, -1)) return 0;
1024 expand_nmax = -1; /* reset */
1025 names = string_copyn(expand_nstring[1], expand_nlength[1]);
1027 for (au = auths, authnum = 0; au; au = au->next, authnum++) if (au->client)
1029 const uschar * list = names;
1031 for (int sep = ' '; s = string_nextinlist(&list, &sep, NULL, 0); )
1032 if (strcmpic(au->public_name, s) == 0)
1033 { authbits |= BIT(authnum); break; }
1037 debug_printf("server offers %s AUTH, methods '%s', usable-bitmap 0x%04x\n",
1038 tls_out.active.sock >= 0 ? "crypted" : "plaintext", names, authbits);
1040 if (tls_out.active.sock >= 0)
1041 sx->ehlo_resp.crypted_auths = authbits;
1043 sx->ehlo_resp.cleartext_auths = authbits;
1050 /* Wait for and check responses for early-pipelining.
1052 Called from the lower-level smtp_read_response() function
1053 used for general code that assume synchronisation, if context
1054 flags indicate outstanding early-pipelining commands. Also
1055 called fom sync_responses() which handles pipelined commands.
1058 sx smtp connection context
1059 countp number of outstanding responses, adjusted on return
1063 DEFER error on first read of TLS'd conn
1064 FAIL SMTP error in response
1067 smtp_reap_early_pipe(smtp_context * sx, int * countp)
1069 BOOL pending_BANNER = sx->pending_BANNER;
1070 BOOL pending_EHLO = sx->pending_EHLO;
1073 sx->pending_BANNER = FALSE; /* clear early to avoid recursion */
1074 sx->pending_EHLO = FALSE;
1080 DEBUG(D_transport) debug_printf("%s expect banner\n", __FUNCTION__);
1082 if (!smtp_reap_banner(sx))
1084 DEBUG(D_transport) debug_printf("bad banner\n");
1085 if (tls_out.active.sock >= 0) rc = DEFER;
1088 /*XXX EXPERIMENTAL_ESMTP_LIMITS ? */
1090 # ifndef DISABLE_TLS_RESUME
1091 GET_OPTION("host_name_extract");
1092 s = ((smtp_transport_options_block *)sx->conn_args.ob)->host_name_extract;
1093 if (!s) s = HNE_DEFAULT;
1094 ehlo_response_lbserver(sx, s);
1100 unsigned peer_offered;
1101 unsigned short authbits = 0, * ap;
1103 DEBUG(D_transport) debug_printf("%s expect ehlo\n", __FUNCTION__);
1105 if (!smtp_reap_ehlo(sx))
1107 DEBUG(D_transport) debug_printf("bad response for EHLO\n");
1108 if (tls_out.active.sock >= 0) rc = DEFER;
1112 /* Compare the actual EHLO response extensions and AUTH methods to the cached
1113 value we assumed; on difference, dump or rewrite the cache and arrange for a
1116 ap = tls_out.active.sock < 0
1117 ? &sx->ehlo_resp.cleartext_auths : &sx->ehlo_resp.crypted_auths;
1119 peer_offered = ehlo_response(sx->buffer,
1120 (tls_out.active.sock < 0 ? OPTION_TLS : 0)
1121 | OPTION_CHUNKING | OPTION_PRDR | OPTION_DSN | OPTION_PIPE | OPTION_SIZE
1122 | OPTION_UTF8 | OPTION_EARLY_PIPE
1124 # ifndef DISABLE_ESMTP_LIMITS
1125 if (tls_out.active.sock >= 0 || !(peer_offered & OPTION_TLS))
1126 ehlo_response_limits_read(sx);
1128 if ( peer_offered != sx->peer_offered
1129 || (authbits = study_ehlo_auths(sx)) != *ap)
1132 debug_printf("EHLO %s extensions changed, 0x%04x/0x%04x -> 0x%04x/0x%04x\n",
1133 tls_out.active.sock < 0 ? "cleartext" : "crypted",
1134 sx->peer_offered, *ap, peer_offered, authbits);
1135 if (peer_offered & OPTION_EARLY_PIPE)
1137 *(tls_out.active.sock < 0
1138 ? &sx->ehlo_resp.cleartext_features : &sx->ehlo_resp.crypted_features) =
1141 write_ehlo_cache_entry(sx);
1145 invalidate_ehlo_cache_entry(sx);
1146 sx->early_pipe_active = FALSE; /* cancel further early-pipe on this conn */
1149 return OK; /* just carry on */
1151 # ifndef DISABLE_ESMTP_LIMITS
1152 /* If we are handling LIMITS, compare the actual EHLO LIMITS values with the
1153 cached values and invalidate cache if different. OK to carry on with
1154 connect since values are advisory. */
1156 if ( (tls_out.active.sock >= 0 || !(peer_offered & OPTION_TLS))
1157 && ( sx->peer_limit_mail != sx->ehlo_resp.limit_mail
1158 || sx->peer_limit_rcpt != sx->ehlo_resp.limit_rcpt
1159 || sx->peer_limit_rcptdom != sx->ehlo_resp.limit_rcptdom
1164 debug_printf("EHLO LIMITS changed:");
1165 if (sx->peer_limit_mail != sx->ehlo_resp.limit_mail)
1166 debug_printf(" MAILMAX %u -> %u\n", sx->ehlo_resp.limit_mail, sx->peer_limit_mail);
1167 else if (sx->peer_limit_rcpt != sx->ehlo_resp.limit_rcpt)
1168 debug_printf(" RCPTMAX %u -> %u\n", sx->ehlo_resp.limit_rcpt, sx->peer_limit_rcpt);
1170 debug_printf(" RCPTDOMAINMAX %u -> %u\n", sx->ehlo_resp.limit_rcptdom, sx->peer_limit_rcptdom);
1172 invalidate_ehlo_cache_entry(sx);
1180 invalidate_ehlo_cache_entry(sx);
1181 (void) smtp_discard_responses(sx, sx->conn_args.ob, *countp);
1184 #endif /*!DISABLE_PIPE_CONNECT*/
1187 /*************************************************
1188 * Synchronize SMTP responses *
1189 *************************************************/
1191 /* This function is called from smtp_deliver() to receive SMTP responses from
1192 the server, and match them up with the commands to which they relate. When
1193 PIPELINING is not in use, this function is called after every command, and is
1194 therefore somewhat over-engineered, but it is simpler to use a single scheme
1195 that works both with and without PIPELINING instead of having two separate sets
1198 The set of commands that are buffered up with pipelining may start with MAIL
1199 and may end with DATA; in between are RCPT commands that correspond to the
1200 addresses whose status is PENDING_DEFER. All other commands (STARTTLS, AUTH,
1201 etc.) are never buffered.
1203 Errors after MAIL or DATA abort the whole process leaving the response in the
1204 buffer. After MAIL, pending responses are flushed, and the original command is
1205 re-instated in big_buffer for error messages. For RCPT commands, the remote is
1206 permitted to reject some recipient addresses while accepting others. However
1207 certain errors clearly abort the whole process. Set the value in
1208 transport_return to PENDING_OK if the address is accepted. If there is a
1209 subsequent general error, it will get reset accordingly. If not, it will get
1210 converted to OK at the end.
1213 sx smtp connection context
1214 count the number of responses to read
1215 pending_DATA 0 if last command sent was not DATA
1216 +1 if previously had a good recipient
1217 -1 if not previously had a good recipient
1219 Returns: 3 if at least one address had 2xx and one had 5xx
1220 2 if at least one address had 5xx but none had 2xx
1221 1 if at least one host had a 2xx response, but none had 5xx
1222 0 no address had 2xx or 5xx but no errors (all 4xx, or just DATA)
1223 -1 timeout while reading RCPT response
1224 -2 I/O or other non-response error for RCPT
1225 -3 DATA or MAIL failed - errno and buffer set
1226 -4 banner or EHLO failed (early-pipelining)
1227 -5 banner or EHLO failed (early-pipelining, TLS)
1231 sync_responses(smtp_context * sx, int count, int pending_DATA)
1233 address_item * addr = sx->sync_addr;
1234 smtp_transport_options_block * ob = sx->conn_args.ob;
1237 #ifndef DISABLE_PIPE_CONNECT
1239 if ((rc = smtp_reap_early_pipe(sx, &count)) != OK)
1240 return rc == FAIL ? RESP_EPIPE_EHLO_ERR : RESP_EHLO_ERR_TLS;
1243 /* Handle the response for a MAIL command. On error, reinstate the original
1244 command in big_buffer for error message use, and flush any further pending
1245 responses before returning, except after I/O errors and timeouts. */
1247 if (sx->pending_MAIL)
1249 DEBUG(D_transport) debug_printf("%s expect mail\n", __FUNCTION__);
1251 sx->pending_MAIL = sx->RCPT_452 = FALSE;
1252 if (!smtp_read_response(sx, sx->buffer, sizeof(sx->buffer),
1253 '2', ob->command_timeout))
1255 DEBUG(D_transport) debug_printf("bad response for MAIL\n");
1256 Ustrcpy(big_buffer, mail_command); /* Fits, because it came from there! */
1257 if (errno == ERRNO_TLSFAILURE)
1258 return RESP_EHLO_ERR_TLS;
1259 if (errno == 0 && sx->buffer[0] != 0)
1262 if (sx->buffer[0] == '4')
1264 save_errno = ERRNO_MAIL4XX;
1265 addr->more_errno |= ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
1267 count = smtp_discard_responses(sx, ob, count);
1271 if (pending_DATA) count--; /* Number of RCPT responses to come */
1272 while (count-- > 0) /* Mark any pending addrs with the host used */
1274 while (addr->transport_return != PENDING_DEFER) addr = addr->next;
1275 addr->host_used = sx->conn_args.host;
1278 return RESP_MAIL_OR_DATA_ERROR;
1282 if (pending_DATA) count--; /* Number of RCPT responses to come */
1284 /* Read and handle the required number of RCPT responses, matching each one up
1285 with an address by scanning for the next address whose status is PENDING_DEFER.
1290 while (addr->transport_return != PENDING_DEFER)
1291 if (!(addr = addr->next))
1292 return RESP_RCPT_ERROR;
1294 /* The address was accepted */
1295 addr->host_used = sx->conn_args.host;
1297 DEBUG(D_transport) debug_printf("%s expect rcpt for %s\n", __FUNCTION__, addr->address);
1298 if (smtp_read_response(sx, sx->buffer, sizeof(sx->buffer),
1299 '2', ob->command_timeout))
1301 yield |= RESP_BIT_HAD_2XX;
1302 addr->transport_return = PENDING_OK;
1304 /* If af_dr_retry_exists is set, there was a routing delay on this address;
1305 ensure that any address-specific retry record is expunged. We do this both
1306 for the basic key and for the version that also includes the sender. */
1308 if (testflag(addr, af_dr_retry_exists))
1310 uschar *altkey = string_sprintf("%s:<%s>", addr->address_retry_key,
1312 retry_add_item(addr, altkey, rf_delete);
1313 retry_add_item(addr, addr->address_retry_key, rf_delete);
1317 /* Error on first TLS read */
1319 else if (errno == ERRNO_TLSFAILURE)
1320 return RESP_EHLO_ERR_TLS;
1322 /* Timeout while reading the response */
1324 else if (errno == ETIMEDOUT)
1326 uschar *message = string_sprintf("SMTP timeout after RCPT TO:<%s>",
1327 transport_rcpt_address(addr, sx->conn_args.tblock->rcpt_include_affixes));
1328 set_errno_nohost(sx->first_addr, ETIMEDOUT, message, DEFER, FALSE, &sx->delivery_start);
1329 retry_add_item(addr, addr->address_retry_key, 0);
1330 update_waiting = FALSE;
1331 return RESP_RCPT_TIMEO;
1334 /* Handle other errors in obtaining an SMTP response by returning -1. This
1335 will cause all the addresses to be deferred. Restore the SMTP command in
1336 big_buffer for which we are checking the response, so the error message
1339 else if (errno != 0 || sx->buffer[0] == 0)
1341 gstring gs = { .size = big_buffer_size, .ptr = 0, .s = big_buffer }, * g = &gs;
1343 /* Use taint-unchecked routines for writing into big_buffer, trusting
1344 that we'll never expand it. */
1346 g = string_fmt_append_f(g, SVFMT_TAINT_NOCHK, "RCPT TO:<%s>",
1347 transport_rcpt_address(addr, sx->conn_args.tblock->rcpt_include_affixes));
1348 string_from_gstring(g);
1349 return RESP_RCPT_ERROR;
1352 /* Handle SMTP permanent and temporary response codes. */
1357 string_sprintf("SMTP error from remote mail server after RCPT TO:<%s>: "
1358 "%s", transport_rcpt_address(addr, sx->conn_args.tblock->rcpt_include_affixes),
1359 string_printing(sx->buffer));
1360 setflag(addr, af_pass_message);
1362 msglog_line(sx->conn_args.host, addr->message);
1364 /* The response was 5xx */
1366 if (sx->buffer[0] == '5')
1368 addr->transport_return = FAIL;
1369 yield |= RESP_BIT_HAD_5XX;
1372 /* The response was 4xx */
1376 addr->transport_return = DEFER;
1377 addr->basic_errno = ERRNO_RCPT4XX;
1378 addr->more_errno |= ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
1382 #ifndef DISABLE_EVENT
1383 event_defer_errno = addr->more_errno;
1384 msg_event_raise(US"msg:rcpt:host:defer", addr);
1386 /* If a 452 and we've had at least one 2xx or 5xx, set next_addr to the
1387 start point for another MAIL command. */
1389 if (addr->more_errno >> 8 == 52 && yield > 0)
1391 if (!sx->RCPT_452) /* initialised at MAIL-ack above */
1394 debug_printf("%s: seen first 452 too-many-rcpts\n", __FUNCTION__);
1395 sx->RCPT_452 = TRUE;
1396 sx->next_addr = addr;
1398 addr->transport_return = PENDING_DEFER;
1399 addr->basic_errno = 0;
1403 /* Log temporary errors if there are more hosts to be tried.
1404 If not, log this last one in the == line. */
1406 if (sx->conn_args.host->next)
1407 if (LOGGING(outgoing_port))
1408 log_write(0, LOG_MAIN, "H=%s [%s]:%d %s", sx->conn_args.host->name,
1409 sx->conn_args.host->address,
1410 sx->port == PORT_NONE ? 25 : sx->port, addr->message);
1412 log_write(0, LOG_MAIN, "H=%s [%s]: %s", sx->conn_args.host->name,
1413 sx->conn_args.host->address, addr->message);
1415 #ifndef DISABLE_EVENT
1417 msg_event_raise(US"msg:rcpt:defer", addr);
1420 /* Do not put this message on the list of those waiting for specific
1421 hosts, as otherwise it is likely to be tried too often. */
1423 update_waiting = FALSE;
1425 /* Add a retry item for the address so that it doesn't get tried again
1426 too soon. If address_retry_include_sender is true, add the sender address
1427 to the retry key. */
1429 retry_add_item(addr,
1430 ob->address_retry_include_sender
1431 ? string_sprintf("%s:<%s>", addr->address_retry_key, sender_address)
1432 : addr->address_retry_key,
1438 if (count && !(addr = addr->next))
1439 return RESP_RCPT_ERROR;
1440 } /* Loop for next RCPT response */
1442 /* Update where to start at for the next block of responses, unless we
1443 have already handled all the addresses. */
1445 if (addr) sx->sync_addr = addr->next;
1447 /* Handle a response to DATA. If we have not had any good recipients, either
1448 previously or in this block, the response is ignored. */
1450 if (pending_DATA != 0)
1452 DEBUG(D_transport) debug_printf("%s expect data\n", __FUNCTION__);
1453 if (!smtp_read_response(sx, sx->buffer, sizeof(sx->buffer),
1454 '3', ob->command_timeout))
1460 if (errno == ERRNO_TLSFAILURE) /* Error on first TLS read */
1461 return RESP_EHLO_ERR_TLS;
1463 if (pending_DATA > 0 || yield & RESP_BIT_HAD_2XX)
1465 if (errno == 0 && sx->buffer[0] == '4')
1467 errno = ERRNO_DATA4XX;
1468 sx->first_addr->more_errno |= ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
1470 return RESP_MAIL_OR_DATA_ERROR;
1472 (void)check_response(sx->conn_args.host, &errno, 0, sx->buffer, &code, &msg, &pass_message);
1473 DEBUG(D_transport) debug_printf("%s\nerror for DATA ignored: pipelining "
1474 "is in use and there were no good recipients\n", msg);
1478 /* All responses read and handled; MAIL (if present) received 2xx and DATA (if
1479 present) received 3xx. If any RCPTs were handled and yielded anything other
1480 than 4xx, yield will be set non-zero. */
1489 /* Try an authenticator's client entry */
1492 try_authenticator(smtp_context * sx, auth_instance * au)
1494 smtp_transport_options_block * ob = sx->conn_args.ob; /* transport options */
1495 host_item * host = sx->conn_args.host; /* host to deliver to */
1498 /* Set up globals for error messages */
1500 authenticator_name = au->name;
1501 driver_srcfile = au->srcfile;
1502 driver_srcline = au->srcline;
1504 sx->outblock.authenticating = TRUE;
1505 rc = (au->info->clientcode)(au, sx, ob->command_timeout,
1506 sx->buffer, sizeof(sx->buffer));
1507 sx->outblock.authenticating = FALSE;
1508 driver_srcfile = authenticator_name = NULL; driver_srcline = 0;
1509 DEBUG(D_transport) debug_printf("%s authenticator yielded %s\n", au->name, rc_names[rc]);
1511 /* A temporary authentication failure must hold up delivery to
1512 this host. After a permanent authentication failure, we carry on
1513 to try other authentication methods. If all fail hard, try to
1514 deliver the message unauthenticated unless require_auth was set. */
1519 f.smtp_authenticated = TRUE; /* stops the outer loop */
1520 client_authenticator = au->name;
1521 if (au->set_client_id)
1522 client_authenticated_id = expand_string(au->set_client_id);
1525 /* Failure after writing a command */
1530 /* Failure after reading a response */
1534 uschar * logmsg = NULL;
1536 if (errno != 0 || sx->buffer[0] != '5') return FAIL;
1537 #ifndef DISABLE_EVENT
1539 uschar * save_name = sender_host_authenticated;
1540 sender_host_authenticated = au->name;
1541 if ((logmsg = event_raise(sx->conn_args.tblock->event_action, US"auth:fail",
1543 log_write(0, LOG_MAIN, "%s", logmsg);
1544 sender_host_authenticated = save_name;
1548 log_write(0, LOG_MAIN, "%s authenticator failed H=%s [%s] %s",
1549 au->name, host->name, host->address, sx->buffer);
1553 /* Failure by some other means. In effect, the authenticator
1554 decided it wasn't prepared to handle this case. Typically this
1555 is the result of "fail" in an expansion string. Do we need to
1556 log anything here? Feb 2006: a message is now put in the buffer
1557 if logging is required. */
1560 if (*sx->buffer != 0)
1561 log_write(0, LOG_MAIN, "%s authenticator cancelled "
1562 "authentication H=%s [%s] %s", au->name, host->name,
1563 host->address, sx->buffer);
1566 /* Internal problem, message in buffer. */
1569 set_errno_nohost(sx->addrlist, ERRNO_AUTHPROB, string_copy(sx->buffer),
1570 DEFER, FALSE, &sx->delivery_start);
1579 /* Do the client side of smtp-level authentication.
1582 sx smtp connection context
1584 sx->buffer should have the EHLO response from server (gets overwritten)
1587 OK Success, or failed (but not required): global "smtp_authenticated" set
1588 DEFER Failed authentication (and was required)
1589 ERROR Internal problem
1591 FAIL_SEND Failed communications - transmit
1596 smtp_auth(smtp_context * sx)
1598 host_item * host = sx->conn_args.host; /* host to deliver to */
1599 smtp_transport_options_block * ob = sx->conn_args.ob; /* transport options */
1600 int require_auth = verify_check_given_host(CUSS &ob->hosts_require_auth, host);
1601 #ifndef DISABLE_PIPE_CONNECT
1602 unsigned short authbits = tls_out.active.sock >= 0
1603 ? sx->ehlo_resp.crypted_auths : sx->ehlo_resp.cleartext_auths;
1605 uschar * fail_reason = US"server did not advertise AUTH support";
1607 f.smtp_authenticated = FALSE;
1608 client_authenticator = client_authenticated_id = client_authenticated_sender = NULL;
1611 regex_AUTH = regex_must_compile(AUTHS_REGEX, MCS_NOFLAGS, TRUE);
1613 /* Is the server offering AUTH? */
1617 #ifndef DISABLE_PIPE_CONNECT
1618 sx->early_pipe_active ? authbits
1621 regex_match_and_setup(regex_AUTH, sx->buffer, 0, -1)
1624 uschar * names = NULL;
1625 expand_nmax = -1; /* reset */
1627 #ifndef DISABLE_PIPE_CONNECT
1628 if (!sx->early_pipe_active)
1630 names = string_copyn(expand_nstring[1], expand_nlength[1]);
1632 /* Must not do this check until after we have saved the result of the
1633 regex match above as the check could be another RE. */
1635 if ( require_auth == OK
1636 || verify_check_given_host(CUSS &ob->hosts_try_auth, host) == OK)
1638 DEBUG(D_transport) debug_printf("scanning authentication mechanisms\n");
1639 fail_reason = US"no common mechanisms were found";
1641 #ifndef DISABLE_PIPE_CONNECT
1642 if (sx->early_pipe_active)
1644 /* Scan our authenticators (which support use by a client and were offered
1645 by the server (checked at cache-write time)), not suppressed by
1646 client_condition. If one is found, attempt to authenticate by calling its
1647 client function. We are limited to supporting up to 16 authenticator
1648 public-names by the number of bits in a short. */
1654 for (bitnum = 0, au = auths;
1655 !f.smtp_authenticated && au && bitnum < 16;
1656 bitnum++, au = au->next) if (authbits & BIT(bitnum))
1658 if ( au->client_condition
1659 && !expand_check_condition(au->client_condition, au->name,
1660 US"client authenticator"))
1662 DEBUG(D_transport) debug_printf("skipping %s authenticator: %s\n",
1663 au->name, "client_condition is false");
1667 /* Found data for a listed mechanism. Call its client entry. Set
1668 a flag in the outblock so that data is overwritten after sending so
1669 that reflections don't show it. */
1671 fail_reason = US"authentication attempt(s) failed";
1673 if ((rc = try_authenticator(sx, au)) != OK)
1680 /* Scan the configured authenticators looking for one which is configured
1681 for use as a client, which is not suppressed by client_condition, and
1682 whose name matches an authentication mechanism supported by the server.
1683 If one is found, attempt to authenticate by calling its client function.
1686 for (auth_instance * au = auths; !f.smtp_authenticated && au; au = au->next)
1691 || ( au->client_condition
1692 && !expand_check_condition(au->client_condition, au->name,
1693 US"client authenticator")))
1695 DEBUG(D_transport) debug_printf("skipping %s authenticator: %s\n",
1697 (au->client)? "client_condition is false" :
1698 "not configured as a client");
1702 /* Loop to scan supported server mechanisms */
1706 int len = Ustrlen(au->public_name);
1709 while (isspace(*p)) p++;
1711 if (strncmpic(au->public_name, p, len) != 0 ||
1712 (p[len] != 0 && !isspace(p[len])))
1714 while (*p != 0 && !isspace(*p)) p++;
1718 /* Found data for a listed mechanism. Call its client entry. Set
1719 a flag in the outblock so that data is overwritten after sending so
1720 that reflections don't show it. */
1722 fail_reason = US"authentication attempt(s) failed";
1724 if ((rc = try_authenticator(sx, au)) != OK)
1727 break; /* If not authenticated, try next authenticator */
1728 } /* Loop for scanning supported server mechanisms */
1729 } /* Loop for further authenticators */
1733 /* If we haven't authenticated, but are required to, give up. */
1735 if (require_auth == OK && !f.smtp_authenticated)
1737 #ifndef DISABLE_PIPE_CONNECT
1738 invalidate_ehlo_cache_entry(sx);
1740 set_errno_nohost(sx->addrlist, ERRNO_AUTHFAIL,
1741 string_sprintf("authentication required but %s", fail_reason), DEFER,
1742 FALSE, &sx->delivery_start);
1750 /* Construct AUTH appendix string for MAIL TO */
1753 sx context for smtp connection
1754 p point in sx->buffer to build string
1755 addrlist chain of potential addresses to deliver
1757 Globals f.smtp_authenticated
1758 client_authenticated_sender
1759 Return True on error, otherwise buffer has (possibly empty) terminated string
1763 smtp_mail_auth_str(smtp_context * sx, uschar * p, address_item * addrlist)
1765 smtp_transport_options_block * ob = sx->conn_args.ob;
1766 uschar * local_authenticated_sender = authenticated_sender;
1769 debug_printf("smtp_mail_auth_str: as<%s> os<%s> SA<%s>\n",
1770 authenticated_sender, ob->authenticated_sender, f.smtp_authenticated?"Y":"N");
1773 GET_OPTION("authenticated_sender");
1774 if (ob->authenticated_sender)
1776 uschar * new = expand_string(ob->authenticated_sender);
1779 if (!f.expand_string_forcedfail)
1781 uschar *message = string_sprintf("failed to expand "
1782 "authenticated_sender: %s", expand_string_message);
1783 set_errno_nohost(addrlist, ERRNO_EXPANDFAIL, message, DEFER, FALSE, &sx->delivery_start);
1788 local_authenticated_sender = new;
1791 /* Add the authenticated sender address if present */
1793 if ( (f.smtp_authenticated || ob->authenticated_sender_force)
1794 && local_authenticated_sender)
1796 string_format_nt(p, sizeof(sx->buffer) - (p-sx->buffer), " AUTH=%s",
1797 auth_xtextencode(local_authenticated_sender,
1798 Ustrlen(local_authenticated_sender)));
1799 client_authenticated_sender = string_copy(local_authenticated_sender);
1809 typedef struct smtp_compare_s
1811 const uschar * current_sender_address;
1812 struct transport_instance * tblock;
1816 /* Create a unique string that identifies this message, it is based on
1817 sender_address, helo_data and tls_certificate if enabled.
1821 smtp_local_identity(const uschar * sender, struct transport_instance * tblock)
1823 address_item * addr1;
1824 uschar * if1 = US"";
1825 uschar * helo1 = US"";
1827 uschar * tlsc1 = US"";
1829 const uschar * save_sender_address = sender_address;
1830 uschar * local_identity = NULL;
1831 smtp_transport_options_block * ob = SOB tblock->options_block;
1833 sender_address = sender;
1835 addr1 = deliver_make_addr (sender, TRUE);
1836 deliver_set_expansions(addr1);
1839 if1 = expand_string(ob->interface);
1842 helo1 = expand_string(ob->helo_data);
1845 if (ob->tls_certificate)
1846 tlsc1 = expand_string(ob->tls_certificate);
1847 local_identity = string_sprintf ("%s^%s^%s", if1, helo1, tlsc1);
1849 local_identity = string_sprintf ("%s^%s", if1, helo1);
1852 deliver_set_expansions(NULL);
1853 sender_address = save_sender_address;
1855 return local_identity;
1860 /* This routine is a callback that is called from transport_check_waiting.
1861 This function will evaluate the incoming message versus the previous
1862 message. If the incoming message is using a different local identity then
1863 we will veto this new message. */
1866 smtp_are_same_identities(uschar * message_id, smtp_compare_t * s_compare)
1868 uschar * message_local_identity,
1869 * current_local_identity,
1870 * new_sender_address;
1872 current_local_identity =
1873 smtp_local_identity(s_compare->current_sender_address, s_compare->tblock);
1875 if (!(new_sender_address = spool_sender_from_msgid(message_id)))
1879 message_local_identity =
1880 smtp_local_identity(new_sender_address, s_compare->tblock);
1882 return Ustrcmp(current_local_identity, message_local_identity) == 0;
1888 ehlo_response(uschar * buf, unsigned checks)
1890 PCRE2_SIZE bsize = Ustrlen(buf);
1891 pcre2_match_data * md = pcre2_match_data_create(1, pcre_gen_ctx);
1893 /* debug_printf("%s: check for 0x%04x\n", __FUNCTION__, checks); */
1896 if ( checks & OPTION_TLS
1897 && pcre2_match(regex_STARTTLS,
1898 (PCRE2_SPTR)buf, bsize, 0, PCRE_EOPT, md, pcre_gen_mtc_ctx) < 0)
1900 checks &= ~OPTION_TLS;
1902 if ( checks & OPTION_IGNQ
1903 && pcre2_match(regex_IGNOREQUOTA,
1904 (PCRE2_SPTR)buf, bsize, 0, PCRE_EOPT, md, pcre_gen_mtc_ctx) < 0)
1905 checks &= ~OPTION_IGNQ;
1907 if ( checks & OPTION_CHUNKING
1908 && pcre2_match(regex_CHUNKING,
1909 (PCRE2_SPTR)buf, bsize, 0, PCRE_EOPT, md, pcre_gen_mtc_ctx) < 0)
1910 checks &= ~OPTION_CHUNKING;
1912 #ifndef DISABLE_PRDR
1913 if ( checks & OPTION_PRDR
1914 && pcre2_match(regex_PRDR,
1915 (PCRE2_SPTR)buf, bsize, 0, PCRE_EOPT, md, pcre_gen_mtc_ctx) < 0)
1917 checks &= ~OPTION_PRDR;
1920 if ( checks & OPTION_UTF8
1921 && pcre2_match(regex_UTF8,
1922 (PCRE2_SPTR)buf, bsize, 0, PCRE_EOPT, md, pcre_gen_mtc_ctx) < 0)
1924 checks &= ~OPTION_UTF8;
1926 if ( checks & OPTION_DSN
1927 && pcre2_match(regex_DSN,
1928 (PCRE2_SPTR)buf, bsize, 0, PCRE_EOPT, md, pcre_gen_mtc_ctx) < 0)
1929 checks &= ~OPTION_DSN;
1931 if ( checks & OPTION_PIPE
1932 && pcre2_match(regex_PIPELINING,
1933 (PCRE2_SPTR)buf, bsize, 0, PCRE_EOPT, md, pcre_gen_mtc_ctx) < 0)
1934 checks &= ~OPTION_PIPE;
1936 if ( checks & OPTION_SIZE
1937 && pcre2_match(regex_SIZE,
1938 (PCRE2_SPTR)buf, bsize, 0, PCRE_EOPT, md, pcre_gen_mtc_ctx) < 0)
1939 checks &= ~OPTION_SIZE;
1941 #ifndef DISABLE_PIPE_CONNECT
1942 if ( checks & OPTION_EARLY_PIPE
1943 && pcre2_match(regex_EARLY_PIPE,
1944 (PCRE2_SPTR)buf, bsize, 0, PCRE_EOPT, md, pcre_gen_mtc_ctx) < 0)
1946 checks &= ~OPTION_EARLY_PIPE;
1948 /* pcre2_match_data_free(md); gen ctx needs no free */
1949 /* debug_printf("%s: found 0x%04x\n", __FUNCTION__, checks); */
1955 /* Callback for emitting a BDAT data chunk header.
1957 If given a nonzero size, first flush any buffered SMTP commands
1958 then emit the command.
1960 Reap previous SMTP command responses if requested, and always reap
1961 the response from a previous BDAT command.
1964 tctx transport context
1965 chunk_size value for SMTP BDAT command
1967 tc_chunk_last add LAST option to SMTP BDAT command
1968 tc_reap_prev reap response to previous SMTP commands
1972 DEFER TLS error on first read (EHLO-resp); errno set
1976 smtp_chunk_cmd_callback(transport_ctx * tctx, unsigned chunk_size,
1979 smtp_transport_options_block * ob = SOB tctx->tblock->options_block;
1980 smtp_context * sx = tctx->smtp_context;
1984 /* Write SMTP chunk header command. If not reaping responses, note that
1985 there may be more writes (like, the chunk data) done soon. */
1989 #ifndef DISABLE_PIPE_CONNECT
1990 BOOL new_conn = !!(sx->outblock.conn_args);
1992 if((cmd_count = smtp_write_command(sx,
1993 flags & tc_reap_prev ? SCMD_FLUSH : SCMD_MORE,
1994 "BDAT %u%s\r\n", chunk_size, flags & tc_chunk_last ? " LAST" : "")
1995 ) < 0) return ERROR;
1996 if (flags & tc_chunk_last)
1997 data_command = string_copy(big_buffer); /* Save for later error message */
1998 #ifndef DISABLE_PIPE_CONNECT
1999 /* That command write could have been the one that made the connection.
2000 Copy the fd from the client conn ctx (smtp transport specific) to the
2001 generic transport ctx. */
2004 tctx->u.fd = sx->outblock.cctx->sock;
2008 prev_cmd_count = cmd_count += sx->cmd_count;
2010 /* Reap responses for any previous, but not one we just emitted */
2014 if (sx->pending_BDAT)
2017 if (flags & tc_reap_prev && prev_cmd_count > 0)
2019 DEBUG(D_transport) debug_printf("look for %d responses"
2020 " for previous pipelined cmds\n", prev_cmd_count);
2022 switch(sync_responses(sx, prev_cmd_count, 0))
2024 case RESP_BIT_HAD_2XX: /* OK */
2025 case RESP_HAD_2_AND_5: sx->good_RCPT = TRUE; /* OK & progress made */
2026 case RESP_BIT_HAD_5XX: sx->completed_addr = TRUE; /* progress made */
2027 case RESP_NOERROR: break; /* No 2xx or 5xx, but no probs */
2029 case RESP_EHLO_ERR_TLS:errno = ERRNO_TLSFAILURE;
2031 #ifndef DISABLE_PIPE_CONNECT
2032 case RESP_EPIPE_EHLO_ERR: /* non-2xx for pipelined banner or EHLO */
2034 case RESP_RCPT_TIMEO: /* Timeout on RCPT */
2035 default: return ERROR;/* I/O error, or any MAIL/DATA error */
2038 if (!sx->pending_BDAT)
2039 pipelining_active = FALSE;
2042 /* Reap response for an outstanding BDAT */
2044 if (sx->pending_BDAT)
2046 DEBUG(D_transport) debug_printf("look for one response for BDAT\n");
2048 if (!smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2',
2049 ob->command_timeout))
2051 if (errno == 0 && sx->buffer[0] == '4')
2053 errno = ERRNO_DATA4XX; /*XXX does this actually get used? */
2054 sx->addrlist->more_errno |=
2055 ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
2060 sx->pending_BDAT = FALSE;
2061 pipelining_active = FALSE;
2063 else if (chunk_size > 0)
2064 sx->pending_BDAT = TRUE;
2067 sx->cmd_count = cmd_count;
2075 check_force_dane_conn(smtp_context * sx, smtp_transport_options_block * ob)
2078 if( sx->dane_required
2079 || verify_check_given_host(CUSS &ob->hosts_try_dane, sx->conn_args.host) == OK
2081 switch (rc = tlsa_lookup(sx->conn_args.host, &sx->conn_args.tlsa_dnsa, sx->dane_required))
2083 case OK: sx->conn_args.dane = TRUE;
2084 ob->tls_tempfail_tryclear = FALSE; /* force TLS */
2085 ob->tls_sni = sx->conn_args.host->name; /* force SNI */
2087 case FAIL_FORCED: break;
2088 default: set_errno_nohost(sx->addrlist, ERRNO_DNSDEFER,
2089 string_sprintf("DANE error: tlsa lookup %s",
2091 rc, FALSE, &sx->delivery_start);
2092 # ifndef DISABLE_EVENT
2093 (void) event_raise(sx->conn_args.tblock->event_action,
2094 US"dane:fail", sx->dane_required
2095 ? US"dane-required" : US"dnssec-invalid",
2105 /*************************************************
2106 * Make connection for given message *
2107 *************************************************/
2111 sx connection context
2112 suppress_tls if TRUE, don't attempt a TLS connection - this is set for
2113 a second attempt after TLS initialization fails
2115 Returns: OK - the connection was made and the delivery attempted;
2116 fd is set in the conn context, tls_out set up.
2117 DEFER - the connection could not be made, or something failed
2118 while setting up the SMTP session, or there was a
2119 non-message-specific error, such as a timeout.
2120 ERROR - helo_data or add_headers or authenticated_sender is
2121 specified for this transport, and the string failed
2125 smtp_setup_conn(smtp_context * sx, BOOL suppress_tls)
2127 smtp_transport_options_block * ob = sx->conn_args.tblock->options_block;
2128 BOOL pass_message = FALSE;
2129 uschar * message = NULL;
2132 uschar * tls_errstr;
2135 /* Many lines of clearing individual elements of *sx that used to
2136 be here have been replaced by a full memset to zero (de41aff051).
2137 There are two callers, this file and verify.c . Now we only set
2138 up nonzero elements. */
2140 sx->conn_args.ob = ob;
2142 sx->lmtp = strcmpic(ob->protocol, US"lmtp") == 0;
2143 sx->smtps = strcmpic(ob->protocol, US"smtps") == 0;
2144 sx->send_rset = TRUE;
2145 sx->send_quit = TRUE;
2146 sx->setting_up = TRUE;
2148 sx->dsn_all_lasthop = TRUE;
2151 verify_check_given_host(CUSS &ob->hosts_require_dane, sx->conn_args.host) == OK;
2154 if ((sx->max_mail = sx->conn_args.tblock->connection_max_messages) == 0)
2155 sx->max_mail = UNLIMITED_ADDRS;
2156 sx->max_rcpt = expand_max_rcpt(sx->conn_args.tblock->max_addresses);
2157 sx->igquotstr = US"";
2158 if (!sx->helo_data) sx->helo_data = ob->helo_data;
2160 smtp_command = US"initial connection";
2162 /* Set up the buffer for reading SMTP response packets. */
2164 sx->inblock.buffer = sx->inbuffer;
2165 sx->inblock.buffersize = sizeof(sx->inbuffer);
2166 sx->inblock.ptr = sx->inbuffer;
2167 sx->inblock.ptrend = sx->inbuffer;
2169 /* Set up the buffer for holding SMTP commands while pipelining */
2171 sx->outblock.buffer = sx->outbuffer;
2172 sx->outblock.buffersize = sizeof(sx->outbuffer);
2173 sx->outblock.ptr = sx->outbuffer;
2175 /* Reset the parameters of a TLS session. */
2178 tls_out.cipher = NULL; /* the one we may use for this transport */
2179 tls_out.ourcert = NULL;
2180 tls_out.peercert = NULL;
2181 tls_out.peerdn = NULL;
2185 tls_out.ocsp = OCSP_NOT_REQ;
2186 #ifndef DISABLE_TLS_RESUME
2187 tls_out.resumption = 0;
2191 /* Flip the legacy TLS-related variables over to the outbound set in case
2192 they're used in the context of the transport. Don't bother resetting
2193 afterward (when being used by a transport) as we're in a subprocess.
2194 For verify, unflipped once the callout is dealt with */
2196 tls_modify_variables(&tls_out);
2201 set_errno_nohost(sx->addrlist, ERRNO_TLSFAILURE, US"TLS support not available",
2202 DEFER, FALSE, &sx->delivery_start);
2207 /* If we have a proxied TLS connection, check usability for this message */
2209 if (continue_hostname && continue_proxy_cipher)
2212 const uschar * sni = US"";
2214 # ifdef SUPPORT_DANE
2215 /* Check if the message will be DANE-verified; if so force TLS and its SNI */
2217 tls_out.dane_verified = FALSE;
2218 smtp_port_for_connect(sx->conn_args.host, sx->port);
2219 if ( sx->conn_args.host->dnssec == DS_YES
2220 && (rc = check_force_dane_conn(sx, ob)) != OK
2225 /* If the SNI or the DANE status required for the new message differs from the
2226 existing conn drop the connection to force a new one. */
2228 if (ob->tls_sni && !(sni = expand_cstring(ob->tls_sni)))
2229 log_write(0, LOG_MAIN|LOG_PANIC,
2230 "<%s>: failed to expand transport's tls_sni value: %s",
2231 sx->addrlist->address, expand_string_message);
2233 # ifdef SUPPORT_DANE
2234 if ( (continue_proxy_sni ? (Ustrcmp(continue_proxy_sni, sni) == 0) : !*sni)
2235 && continue_proxy_dane == sx->conn_args.dane)
2237 tls_out.sni = US sni;
2238 if ((tls_out.dane_verified = continue_proxy_dane))
2239 sx->conn_args.host->dnssec = DS_YES;
2242 if ((continue_proxy_sni ? (Ustrcmp(continue_proxy_sni, sni) == 0) : !*sni))
2243 tls_out.sni = US sni;
2248 debug_printf("Closing proxied-TLS connection due to SNI mismatch\n");
2250 smtp_debug_cmd(US"QUIT", 0);
2251 write(0, "QUIT\r\n", 6);
2253 continue_hostname = continue_proxy_cipher = NULL;
2254 f.continue_more = FALSE;
2255 continue_sequence = 1; /* Unfortunately, this process cannot affect success log
2256 which is done by delivery proc. Would have to pass this
2257 back through reporting pipe. */
2260 #endif /*!DISABLE_TLS*/
2262 /* Make a connection to the host if this isn't a continued delivery, and handle
2263 the initial interaction and HELO/EHLO/LHLO. Connect timeout errors are handled
2264 specially so they can be identified for retries. */
2266 if (!continue_hostname)
2269 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", sx->conn_args.interface, sx->port);
2271 /* Arrange to report to calling process this is a new connection */
2273 clearflag(sx->first_addr, af_cont_conn);
2274 setflag(sx->first_addr, af_new_conn);
2276 /* Get the actual port the connection will use, into sx->conn_args.host */
2278 smtp_port_for_connect(sx->conn_args.host, sx->port);
2281 /* Do TLSA lookup for DANE */
2283 tls_out.dane_verified = FALSE;
2284 tls_out.tlsa_usage = 0;
2286 if (sx->conn_args.host->dnssec == DS_YES)
2289 if ((rc = check_force_dane_conn(sx, ob)) != OK)
2292 else if (sx->dane_required)
2294 set_errno_nohost(sx->addrlist, ERRNO_DNSDEFER,
2295 string_sprintf("DANE error: %s lookup not DNSSEC", sx->conn_args.host->name),
2296 FAIL, FALSE, &sx->delivery_start);
2297 # ifndef DISABLE_EVENT
2298 (void) event_raise(sx->conn_args.tblock->event_action,
2299 US"dane:fail", US"dane-required", NULL);
2306 /* Make the TCP connection */
2308 sx->cctx.tls_ctx = NULL;
2309 sx->inblock.cctx = sx->outblock.cctx = &sx->cctx;
2310 #ifndef DISABLE_ESMTP_LIMITS
2311 sx->peer_limit_mail = sx->peer_limit_rcpt = sx->peer_limit_rcptdom =
2313 sx->avoid_option = sx->peer_offered = smtp_peer_options = 0;
2314 #ifndef DISABLE_CLIENT_CMD_LOG
2315 client_cmd_log = NULL;
2318 #ifndef DISABLE_PIPE_CONNECT
2319 if ( verify_check_given_host(CUSS &ob->hosts_pipe_connect,
2320 sx->conn_args.host) == OK)
2322 /* We don't find out the local ip address until the connect, so if
2323 the helo string might use it avoid doing early-pipelining. */
2326 || sx->conn_args.interface
2327 || !Ustrstr(sx->helo_data, "$sending_ip_address")
2328 || Ustrstr(sx->helo_data, "def:sending_ip_address")
2331 sx->early_pipe_ok = TRUE;
2332 if ( read_ehlo_cache_entry(sx)
2333 && sx->ehlo_resp.cleartext_features & OPTION_EARLY_PIPE)
2336 debug_printf("Using cached cleartext PIPECONNECT\n");
2337 sx->early_pipe_active = TRUE;
2338 sx->peer_offered = sx->ehlo_resp.cleartext_features;
2341 else DEBUG(D_transport)
2342 debug_printf("helo needs $sending_ip_address; avoid early-pipelining\n");
2345 if (sx->early_pipe_active)
2347 sx->outblock.conn_args = &sx->conn_args;
2348 (void) smtp_boundsock(&sx->conn_args);
2353 blob lazy_conn = {.data = NULL};
2354 /* For TLS-connect, a TFO lazy-connect is useful since the Client Hello
2355 can go on the TCP SYN. */
2357 if ((sx->cctx.sock = smtp_connect(&sx->conn_args,
2358 sx->smtps ? &lazy_conn : NULL)) < 0)
2360 set_errno_nohost(sx->addrlist,
2361 errno == ETIMEDOUT ? ERRNO_CONNECTTIMEOUT : errno,
2362 sx->verify ? US strerror(errno) : NULL,
2363 DEFER, FALSE, &sx->delivery_start);
2364 sx->send_quit = FALSE;
2368 (void) setsockopt(sx->cctx.sock, IPPROTO_TCP, TCP_QUICKACK, US &off,
2372 /* Expand the greeting message while waiting for the initial response. (Makes
2373 sense if helo_data contains ${lookup dnsdb ...} stuff). The expansion is
2374 delayed till here so that $sending_ip_address and $sending_port are set.
2375 Those will be known even for a TFO lazy-connect, having been set by the bind().
2376 For early-pipe, we are ok if binding to a local interface; otherwise (if
2377 $sending_ip_address is seen in helo_data) we disabled early-pipe above. */
2379 GET_OPTION("helo_data");
2381 if (!(sx->helo_data = expand_string(sx->helo_data)))
2383 log_write(0, LOG_MAIN|LOG_PANIC,
2384 "<%s>: failed to expand transport's helo_data value for callout: %s",
2385 sx->addrlist->address, expand_string_message);
2390 expand_string_message = NULL;
2391 if ((sx->helo_data = string_domain_utf8_to_alabel(sx->helo_data,
2392 &expand_string_message)),
2393 expand_string_message)
2395 log_write(0, LOG_MAIN|LOG_PANIC,
2396 "<%s>: failed to expand transport's helo_data value for callout: %s",
2397 sx->addrlist->address, expand_string_message);
2399 sx->helo_data = NULL;
2403 /* The first thing is to wait for an initial OK response. The dreaded "goto"
2404 is nevertheless a reasonably clean way of programming this kind of logic,
2405 where you want to escape on any error. */
2409 #ifndef DISABLE_PIPE_CONNECT
2410 if (sx->early_pipe_active)
2412 sx->pending_BANNER = TRUE; /* sync_responses() must eventually handle */
2413 sx->outblock.cmd_count = 1;
2418 if (!smtp_reap_banner(sx))
2419 goto RESPONSE_FAILED;
2422 #ifndef DISABLE_EVENT
2425 lookup_dnssec_authenticated = sx->conn_args.host->dnssec==DS_YES ? US"yes"
2426 : sx->conn_args.host->dnssec==DS_NO ? US"no" : NULL;
2427 s = event_raise(sx->conn_args.tblock->event_action, US"smtp:connect", sx->buffer, NULL);
2430 set_errno_nohost(sx->addrlist, ERRNO_EXPANDFAIL,
2431 string_sprintf("deferred by smtp:connect event expansion: %s", s),
2432 DEFER, FALSE, &sx->delivery_start);
2439 /* Now check if the helo_data expansion went well, and sign off cleanly if
2444 message = string_sprintf("failed to expand helo_data: %s",
2445 expand_string_message);
2446 set_errno_nohost(sx->addrlist, ERRNO_EXPANDFAIL, message, DEFER, FALSE, &sx->delivery_start);
2452 /** Debugging without sending a message
2453 sx->addrlist->transport_return = DEFER;
2457 /* Errors that occur after this point follow an SMTP command, which is
2458 left in big_buffer by smtp_write_command() for use in error messages. */
2460 smtp_command = big_buffer;
2462 /* Tell the remote who we are...
2464 February 1998: A convention has evolved that ESMTP-speaking MTAs include the
2465 string "ESMTP" in their greeting lines, so make Exim send EHLO if the
2466 greeting is of this form. The assumption was that the far end supports it
2467 properly... but experience shows that there are some that give 5xx responses,
2468 even though the banner includes "ESMTP" (there's a bloody-minded one that
2469 says "ESMTP not spoken here"). Cope with that case.
2471 September 2000: Time has passed, and it seems reasonable now to always send
2472 EHLO at the start. It is also convenient to make the change while installing
2475 July 2003: Joachim Wieland met a broken server that advertises "PIPELINING"
2476 but times out after sending MAIL FROM, RCPT TO and DATA all together. There
2477 would be no way to send out the mails, so there is now a host list
2478 "hosts_avoid_esmtp" that disables ESMTP for special hosts and solves the
2479 PIPELINING problem as well. Maybe it can also be useful to cure other
2480 problems with broken servers.
2482 Exim originally sent "Helo" at this point and ran for nearly a year that way.
2483 Then somebody tried it with a Microsoft mailer... It seems that all other
2484 mailers use upper case for some reason (the RFC is quite clear about case
2485 independence) so, for peace of mind, I gave in. */
2487 sx->esmtp = verify_check_given_host(CUSS &ob->hosts_avoid_esmtp, sx->conn_args.host) != OK;
2489 /* Alas; be careful, since this goto is not an error-out, so conceivably
2490 we might set data between here and the target which we assume to exist
2491 and be usable. I can see this coming back to bite us. */
2497 smtp_peer_options |= OPTION_TLS;
2498 suppress_tls = FALSE;
2499 ob->tls_tempfail_tryclear = FALSE;
2500 smtp_command = US"SSL-on-connect";
2502 # ifndef DISABLE_TLS_RESUME
2503 /* Having no EHLO response yet, cannot peek there for a servername to detect
2504 an LB. Call this anyway, so that a dummy host_name_extract option value can
2505 force resumption attempts. */
2507 GET_OPTION("host_name_extract");
2508 if (!(s = ob->host_name_extract)) s = US"never-LB";
2509 ehlo_response_lbserver(sx, s);
2517 if (smtp_write_command(sx,
2518 #ifndef DISABLE_PIPE_CONNECT
2519 sx->early_pipe_active ? SCMD_BUFFER :
2522 "%s %s\r\n", sx->lmtp ? "LHLO" : "EHLO", sx->helo_data) < 0)
2524 sx->esmtp_sent = TRUE;
2526 #ifndef DISABLE_PIPE_CONNECT
2527 if (sx->early_pipe_active)
2529 sx->pending_EHLO = TRUE;
2531 /* If we have too many authenticators to handle and might need to AUTH
2532 for this transport, pipeline no further as we will need the
2533 list of auth methods offered. Reap the banner and EHLO. */
2535 if ( (ob->hosts_require_auth || ob->hosts_try_auth)
2536 && f.smtp_in_early_pipe_no_auth)
2538 DEBUG(D_transport) debug_printf("may need to auth, so pipeline no further\n");
2539 if (smtp_write_command(sx, SCMD_FLUSH, NULL) < 0)
2541 if (sync_responses(sx, 2, 0) != RESP_NOERROR)
2544 debug_printf("failed reaping pipelined cmd responses\n");
2545 goto RESPONSE_FAILED;
2547 sx->early_pipe_active = FALSE;
2552 if (!smtp_reap_ehlo(sx))
2553 goto RESPONSE_FAILED;
2557 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
2559 #ifndef DISABLE_PIPE_CONNECT
2560 if (!sx->early_pipe_active)
2565 int n = sizeof(sx->buffer);
2566 uschar * rsp = sx->buffer;
2568 if (sx->esmtp_sent && (n = Ustrlen(sx->buffer) + 1) < sizeof(sx->buffer)/2)
2569 { rsp = sx->buffer + n; n = sizeof(sx->buffer) - n; }
2571 if (smtp_write_command(sx, SCMD_FLUSH, "HELO %s\r\n", sx->helo_data) < 0)
2573 good_response = smtp_read_response(sx, rsp, n, '2', ob->command_timeout);
2574 #ifdef EXPERIMENTAL_DSN_INFO
2575 sx->helo_response = string_copy(rsp);
2579 /* Handle special logging for a closed connection after HELO
2580 when had previously sent EHLO */
2582 if (rsp != sx->buffer && rsp[0] == 0 && (errno == 0 || errno == ECONNRESET))
2584 errno = ERRNO_SMTPCLOSED;
2585 goto EHLOHELO_FAILED;
2587 memmove(sx->buffer, rsp, Ustrlen(rsp));
2588 goto RESPONSE_FAILED;
2592 if (sx->esmtp || sx->lmtp)
2594 #ifndef DISABLE_PIPE_CONNECT
2595 if (!sx->early_pipe_active)
2600 sx->peer_offered = ehlo_response(sx->buffer,
2601 OPTION_TLS /* others checked later */
2602 #ifndef DISABLE_PIPE_CONNECT
2603 | (sx->early_pipe_ok
2605 | OPTION_CHUNKING | OPTION_PRDR | OPTION_DSN | OPTION_PIPE | OPTION_SIZE
2614 #ifndef DISABLE_ESMTP_LIMITS
2615 if (tls_out.active.sock >= 0 || !(sx->peer_offered & OPTION_TLS))
2617 ehlo_response_limits_read(sx);
2618 ehlo_response_limits_apply(sx);
2621 #ifndef DISABLE_PIPE_CONNECT
2622 if (sx->early_pipe_ok)
2624 sx->ehlo_resp.cleartext_features = sx->peer_offered;
2626 if ( (sx->peer_offered & (OPTION_PIPE | OPTION_EARLY_PIPE))
2627 == (OPTION_PIPE | OPTION_EARLY_PIPE))
2629 DEBUG(D_transport) debug_printf("PIPECONNECT usable in future for this IP\n");
2630 sx->ehlo_resp.cleartext_auths = study_ehlo_auths(sx);
2631 write_ehlo_cache_entry(sx);
2635 #ifndef DISABLE_TLS_RESUME
2636 GET_OPTION("host_name_extract");
2637 if (!(s = ob->host_name_extract)) s = HNE_DEFAULT;
2638 ehlo_response_lbserver(sx, s);
2642 /* Set tls_offered if the response to EHLO specifies support for STARTTLS. */
2645 smtp_peer_options |= sx->peer_offered & OPTION_TLS;
2650 /* For continuing deliveries down the same channel, having re-exec'd the socket
2651 is the standard input; for a socket held open from verify it is recorded
2652 in the cutthrough context block. Either way we don't need to redo EHLO here
2653 (but may need to do so for TLS - see below).
2654 Set up the pointer to where subsequent commands will be left, for
2655 error messages. Note that smtp_peer_options will have been
2656 set from the command line if they were set in the process that passed the
2659 /*XXX continue case needs to propagate DSN_INFO, prob. in deliver.c
2660 as the continue goes via transport_pass_socket() and doublefork and exec.
2661 It does not wait. Unclear how we keep separate host's responses
2662 separate - we could match up by host ip+port as a bodge. */
2666 if (cutthrough.cctx.sock >= 0 && cutthrough.callout_hold_only)
2668 sx->cctx = cutthrough.cctx;
2669 sx->conn_args.host->port = sx->port = cutthrough.host.port;
2673 sx->cctx.sock = 0; /* stdin */
2674 sx->cctx.tls_ctx = NULL;
2675 smtp_port_for_connect(sx->conn_args.host, sx->port); /* Record the port that was used */
2677 sx->inblock.cctx = sx->outblock.cctx = &sx->cctx;
2678 smtp_command = big_buffer;
2679 sx->peer_offered = smtp_peer_options;
2680 #ifndef DISABLE_ESMTP_LIMITS
2681 /* Limits passed by cmdline over exec. */
2682 ehlo_limits_apply(sx,
2683 sx->peer_limit_mail = continue_limit_mail,
2684 sx->peer_limit_rcpt = continue_limit_rcpt,
2685 sx->peer_limit_rcptdom = continue_limit_rcptdom);
2687 sx->helo_data = NULL; /* ensure we re-expand ob->helo_data */
2689 /* For a continued connection with TLS being proxied for us, or a
2690 held-open verify connection with TLS, nothing more to do. */
2692 if ( continue_proxy_cipher
2693 || (cutthrough.cctx.sock >= 0 && cutthrough.callout_hold_only
2694 && cutthrough.is_tls)
2697 sx->pipelining_used = pipelining_active = !!(smtp_peer_options & OPTION_PIPE);
2698 HDEBUG(D_transport) debug_printf("continued connection, %s TLS\n",
2699 continue_proxy_cipher ? "proxied" : "verify conn with");
2702 HDEBUG(D_transport) debug_printf("continued connection, no TLS\n");
2705 /* If TLS is available on this connection, whether continued or not, attempt to
2706 start up a TLS session, unless the host is in hosts_avoid_tls. If successful,
2707 send another EHLO - the server may give a different answer in secure mode. We
2708 use a separate buffer for reading the response to STARTTLS so that if it is
2709 negative, the original EHLO data is available for subsequent analysis, should
2710 the client not be required to use TLS. If the response is bad, copy the buffer
2711 for error analysis. */
2714 if ( smtp_peer_options & OPTION_TLS
2716 && verify_check_given_host(CUSS &ob->hosts_avoid_tls, sx->conn_args.host) != OK
2718 || verify_check_given_host(CUSS &ob->hosts_verify_avoid_tls, sx->conn_args.host) != OK
2721 uschar buffer2[4096];
2723 if (smtp_write_command(sx, SCMD_FLUSH, "STARTTLS\r\n") < 0)
2726 #ifndef DISABLE_PIPE_CONNECT
2727 /* If doing early-pipelining reap the banner and EHLO-response but leave
2728 the response for the STARTTLS we just sent alone. On fail, assume wrong
2729 cached capability and retry with the pipelining disabled. */
2731 if (sx->early_pipe_active)
2733 if (sync_responses(sx, 2, 0) != RESP_NOERROR)
2736 debug_printf("failed reaping pipelined cmd responses\n");
2737 close(sx->cctx.sock);
2739 sx->early_pipe_active = FALSE;
2740 goto PIPE_CONNECT_RETRY;
2745 /* If there is an I/O error, transmission of this message is deferred. If
2746 there is a temporary rejection of STARRTLS and tls_tempfail_tryclear is
2747 false, we also defer. However, if there is a temporary rejection of STARTTLS
2748 and tls_tempfail_tryclear is true, or if there is an outright rejection of
2749 STARTTLS, we carry on. This means we will try to send the message in clear,
2750 unless the host is in hosts_require_tls (tested below). */
2752 if (!smtp_read_response(sx, buffer2, sizeof(buffer2), '2', ob->command_timeout))
2756 || (buffer2[0] == '4' && !ob->tls_tempfail_tryclear)
2759 Ustrncpy(sx->buffer, buffer2, sizeof(sx->buffer));
2760 sx->buffer[sizeof(sx->buffer)-1] = '\0';
2761 goto RESPONSE_FAILED;
2765 /* STARTTLS accepted: try to negotiate a TLS session. */
2770 sx->conn_args.sending_ip_address = sending_ip_address;
2771 if (!tls_client_start(&sx->cctx, &sx->conn_args, sx->addrlist, &tls_out, &tls_errstr))
2773 /* TLS negotiation failed; give an error. From outside, this function may
2774 be called again to try in clear on a new connection, if the options permit
2775 it for this host. */
2777 DEBUG(D_tls) debug_printf("TLS session fail: %s\n", tls_errstr);
2779 # ifdef SUPPORT_DANE
2780 if (sx->conn_args.dane)
2782 log_write(0, LOG_MAIN,
2783 "DANE attempt failed; TLS connection to %s [%s]: %s",
2784 sx->conn_args.host->name, sx->conn_args.host->address, tls_errstr);
2785 # ifndef DISABLE_EVENT
2786 (void) event_raise(sx->conn_args.tblock->event_action,
2787 US"dane:fail", US"validation-failure", NULL); /* could do with better detail */
2792 errno = ERRNO_TLSFAILURE;
2793 message = string_sprintf("TLS session: %s", tls_errstr);
2794 sx->send_quit = FALSE;
2797 sx->send_tlsclose = TRUE;
2799 /* TLS session is set up. Check the inblock fill level. If there is
2800 content then as we have not yet done a tls read it must have arrived before
2801 the TLS handshake, in-clear. That violates the sync requirement of the
2802 STARTTLS RFC, so fail. */
2804 if (sx->inblock.ptr != sx->inblock.ptrend)
2808 int i = sx->inblock.ptrend - sx->inblock.ptr;
2809 debug_printf("unused data in input buffer after ack for STARTTLS:\n"
2811 i > 100 ? 100 : i, sx->inblock.ptr, i > 100 ? "..." : "");
2813 tls_errstr = US"synch error before connect";
2814 goto TLS_CONN_FAILED;
2817 smtp_peer_options_wrap = smtp_peer_options;
2818 for (address_item * addr = sx->addrlist; addr; addr = addr->next)
2819 if (addr->transport_return == PENDING_DEFER)
2821 addr->cipher = tls_out.cipher;
2822 addr->ourcert = tls_out.ourcert;
2823 addr->peercert = tls_out.peercert;
2824 addr->peerdn = tls_out.peerdn;
2825 addr->ocsp = tls_out.ocsp;
2826 addr->tlsver = tls_out.ver;
2831 /* if smtps, we'll have smtp_command set to something else; always safe to
2833 smtp_command = big_buffer;
2835 /* If we started TLS, redo the EHLO/LHLO exchange over the secure channel. If
2836 helo_data is null, we are dealing with a connection that was passed from
2837 another process, and so we won't have expanded helo_data above. We have to
2838 expand it here. $sending_ip_address and $sending_port are set up right at the
2839 start of the Exim process (in exim.c). */
2841 if (tls_out.active.sock >= 0)
2843 uschar * greeting_cmd;
2847 GET_OPTION("helo_data");
2848 if (!(sx->helo_data = expand_string(ob->helo_data)))
2850 uschar *message = string_sprintf("failed to expand helo_data: %s",
2851 expand_string_message);
2852 set_errno_nohost(sx->addrlist, ERRNO_EXPANDFAIL, message, DEFER, FALSE, &sx->delivery_start);
2858 #ifndef DISABLE_PIPE_CONNECT
2859 /* For SMTPS there is no cleartext early-pipe; use the crypted permission bit.
2860 We're unlikely to get the group sent and delivered before the server sends its
2861 banner, but it's still worth sending as a group.
2862 For STARTTLS allow for cleartext early-pipe but no crypted early-pipe, but not
2865 if (sx->smtps ? sx->early_pipe_ok : sx->early_pipe_active)
2867 sx->peer_offered = sx->ehlo_resp.crypted_features;
2868 if ((sx->early_pipe_active =
2869 !!(sx->ehlo_resp.crypted_features & OPTION_EARLY_PIPE)))
2870 DEBUG(D_transport) debug_printf("Using cached crypted PIPECONNECT\n");
2873 #ifdef EXPERIMMENTAL_ESMTP_LIMITS
2874 /* As we are about to send another EHLO, forget any LIMITS received so far. */
2875 sx->peer_limit_mail = sx->peer_limit_rcpt = sx->peer_limit_rcptdom = 0;
2876 if ((sx->max_mail = sx->conn_args.tblock->connection_max_message) == 0)
2877 sx->max_mail = UNLIMITED_ADDRS;
2878 sx->max_rcpt = expand_max_rcpt(sx->conn_args.tblock->max_addresses);
2879 sx->single_rcpt_domain = FALSE;
2882 /* For SMTPS we need to wait for the initial OK response. */
2884 #ifndef DISABLE_PIPE_CONNECT
2885 if (sx->early_pipe_active)
2887 sx->pending_BANNER = TRUE;
2888 sx->outblock.cmd_count = 1;
2892 if (!smtp_reap_banner(sx))
2893 goto RESPONSE_FAILED;
2896 greeting_cmd = US"LHLO";
2898 greeting_cmd = US"EHLO";
2901 greeting_cmd = US"HELO";
2903 debug_printf("not sending EHLO (host matches hosts_avoid_esmtp)\n");
2906 if (smtp_write_command(sx,
2907 #ifndef DISABLE_PIPE_CONNECT
2908 sx->early_pipe_active ? SCMD_BUFFER :
2911 "%s %s\r\n", greeting_cmd, sx->helo_data) < 0)
2914 #ifndef DISABLE_PIPE_CONNECT
2915 if (sx->early_pipe_active)
2916 sx->pending_EHLO = TRUE;
2920 if (!smtp_reap_ehlo(sx))
2923 /* The GnuTLS layer in Exim only spots a server-rejection of a client
2924 cert late, under TLS1.3 - which means here; the first time we try to
2925 receive crypted data. Treat it as if it was a connect-time failure.
2926 See also the early-pipe equivalent... which will be hard; every call
2927 to sync_responses will need to check the result.
2928 It would be nicer to have GnuTLS check the cert during the handshake.
2929 Can it do that, with all the flexibility we need? */
2931 tls_errstr = US"error on first read";
2932 goto TLS_CONN_FAILED;
2935 goto RESPONSE_FAILED;
2937 smtp_peer_options = 0;
2941 /* If the host is required to use a secure channel, ensure that we
2945 # ifdef SUPPORT_DANE
2946 || sx->conn_args.dane
2948 || verify_check_given_host(CUSS &ob->hosts_require_tls, sx->conn_args.host) == OK
2951 errno = ERRNO_TLSREQUIRED;
2952 message = string_sprintf("a TLS session is required, but %s",
2953 smtp_peer_options & OPTION_TLS
2954 ? "an attempt to start TLS failed" : "the server did not offer TLS support");
2955 # if defined(SUPPORT_DANE) && !defined(DISABLE_EVENT)
2956 if (sx->conn_args.dane)
2957 (void) event_raise(sx->conn_args.tblock->event_action, US"dane:fail",
2958 smtp_peer_options & OPTION_TLS
2959 ? US"validation-failure" /* could do with better detail */
2960 : US"starttls-not-supported",
2965 #endif /*DISABLE_TLS*/
2967 /* If TLS is active, we have just started it up and re-done the EHLO command,
2968 so its response needs to be analyzed. If TLS is not active and this is a
2969 continued session down a previously-used socket, we haven't just done EHLO, so
2972 if ( !continue_hostname
2974 || tls_out.active.sock >= 0
2978 if (sx->esmtp || sx->lmtp)
2980 #ifndef DISABLE_PIPE_CONNECT
2981 if (!sx->early_pipe_active)
2984 sx->peer_offered = ehlo_response(sx->buffer,
2986 #ifndef DISABLE_PIPE_CONNECT
2987 | (sx->lmtp && ob->lmtp_ignore_quota ? OPTION_IGNQ : 0)
2988 | OPTION_DSN | OPTION_PIPE | OPTION_SIZE
2989 | OPTION_CHUNKING | OPTION_PRDR | OPTION_UTF8
2990 | (tls_out.active.sock >= 0 ? OPTION_EARLY_PIPE : 0) /* not for lmtp */
2994 | (sx->lmtp && ob->lmtp_ignore_quota ? OPTION_IGNQ : 0)
2997 # ifdef SUPPORT_I18N
2998 | (sx->addrlist->prop.utf8_msg ? OPTION_UTF8 : 0)
2999 /*XXX if we hand peercaps on to continued-conn processes,
3000 must not depend on this addr */
3004 | (ob->size_addition >= 0 ? OPTION_SIZE : 0)
3007 #ifndef DISABLE_PIPE_CONNECT
3008 if (tls_out.active.sock >= 0)
3009 sx->ehlo_resp.crypted_features = sx->peer_offered;
3012 #ifndef DISABLE_ESMTP_LIMITS
3013 if (tls_out.active.sock >= 0 || !(sx->peer_offered & OPTION_TLS))
3015 ehlo_response_limits_read(sx);
3016 ehlo_response_limits_apply(sx);
3021 /* Set for IGNOREQUOTA if the response to LHLO specifies support and the
3022 lmtp_ignore_quota option was set. */
3024 sx->igquotstr = sx->peer_offered & OPTION_IGNQ ? US" IGNOREQUOTA" : US"";
3026 /* If the response to EHLO specified support for the SIZE parameter, note
3027 this, provided size_addition is non-negative. */
3029 smtp_peer_options |= sx->peer_offered & OPTION_SIZE;
3031 /* Note whether the server supports PIPELINING. If hosts_avoid_esmtp matched
3032 the current host, esmtp will be false, so PIPELINING can never be used. If
3033 the current host matches hosts_avoid_pipelining, don't do it. */
3035 if ( sx->peer_offered & OPTION_PIPE
3036 && verify_check_given_host(CUSS &ob->hosts_avoid_pipelining, sx->conn_args.host) != OK)
3037 smtp_peer_options |= OPTION_PIPE;
3039 DEBUG(D_transport) debug_printf("%susing PIPELINING\n",
3040 smtp_peer_options & OPTION_PIPE ? "" : "not ");
3042 if ( sx->peer_offered & OPTION_CHUNKING
3043 && verify_check_given_host(CUSS &ob->hosts_try_chunking, sx->conn_args.host) == OK)
3044 smtp_peer_options |= OPTION_CHUNKING;
3046 if (smtp_peer_options & OPTION_CHUNKING)
3047 DEBUG(D_transport) debug_printf("CHUNKING usable\n");
3049 #ifndef DISABLE_PRDR
3050 if ( sx->peer_offered & OPTION_PRDR
3051 && verify_check_given_host(CUSS &ob->hosts_try_prdr, sx->conn_args.host) == OK)
3052 smtp_peer_options |= OPTION_PRDR;
3054 if (smtp_peer_options & OPTION_PRDR)
3055 DEBUG(D_transport) debug_printf("PRDR usable\n");
3058 /* Note if the server supports DSN */
3059 smtp_peer_options |= sx->peer_offered & OPTION_DSN;
3060 DEBUG(D_transport) debug_printf("%susing DSN\n",
3061 sx->peer_offered & OPTION_DSN ? "" : "not ");
3063 #ifndef DISABLE_PIPE_CONNECT
3064 if ( sx->early_pipe_ok
3065 && !sx->early_pipe_active
3066 && tls_out.active.sock >= 0
3067 && smtp_peer_options & OPTION_PIPE
3068 && ( sx->ehlo_resp.cleartext_features | sx->ehlo_resp.crypted_features)
3069 & OPTION_EARLY_PIPE)
3071 DEBUG(D_transport) debug_printf("PIPECONNECT usable in future for this IP\n");
3072 sx->ehlo_resp.crypted_auths = study_ehlo_auths(sx);
3073 write_ehlo_cache_entry(sx);
3077 /* Note if the response to EHLO specifies support for the AUTH extension.
3078 If it has, check that this host is one we want to authenticate to, and do
3079 the business. The host name and address must be available when the
3080 authenticator's client driver is running. */
3082 switch (yield = smtp_auth(sx))
3084 default: goto SEND_QUIT;
3086 case FAIL_SEND: goto SEND_FAILED;
3087 case FAIL: goto RESPONSE_FAILED;
3091 sx->pipelining_used = pipelining_active = !!(smtp_peer_options & OPTION_PIPE);
3093 /* The setting up of the SMTP call is now complete. Any subsequent errors are
3094 message-specific. */
3096 sx->setting_up = FALSE;
3099 if (sx->addrlist->prop.utf8_msg)
3103 /* If the transport sets a downconversion mode it overrides any set by ACL
3106 GET_OPTION("utf8_downconvert");
3107 if ((s = ob->utf8_downconvert))
3109 if (!(s = expand_string(s)))
3111 message = string_sprintf("failed to expand utf8_downconvert: %s",
3112 expand_string_message);
3113 set_errno_nohost(sx->addrlist, ERRNO_EXPANDFAIL, message, DEFER, FALSE, &sx->delivery_start);
3119 case '1': sx->addrlist->prop.utf8_downcvt = TRUE;
3120 sx->addrlist->prop.utf8_downcvt_maybe = FALSE;
3122 case '0': sx->addrlist->prop.utf8_downcvt = FALSE;
3123 sx->addrlist->prop.utf8_downcvt_maybe = FALSE;
3125 case '-': if (s[1] == '1')
3127 sx->addrlist->prop.utf8_downcvt = FALSE;
3128 sx->addrlist->prop.utf8_downcvt_maybe = TRUE;
3134 sx->utf8_needed = !sx->addrlist->prop.utf8_downcvt
3135 && !sx->addrlist->prop.utf8_downcvt_maybe;
3136 DEBUG(D_transport) if (!sx->utf8_needed)
3137 debug_printf("utf8: %s downconvert\n",
3138 sx->addrlist->prop.utf8_downcvt ? "mandatory" : "optional");
3141 /* If this is an international message we need the host to speak SMTPUTF8 */
3142 if (sx->utf8_needed && !(sx->peer_offered & OPTION_UTF8))
3144 errno = ERRNO_UTF8_FWD;
3145 goto RESPONSE_FAILED;
3147 #endif /*SUPPORT_I18N*/
3156 if (errno == ECONNREFUSED) /* first-read error on a TFO conn */
3158 /* There is a testing facility for simulating a connection timeout, as I
3159 can't think of any other way of doing this. It converts a connection
3160 refused into a timeout if the timeout is set to 999999. This is done for
3161 a 3whs connection in ip_connect(), but a TFO connection does not error
3162 there - instead it gets ECONNREFUSED on the first data read. Tracking
3163 that a TFO really was done is too hard, or we would set a
3164 sx->pending_conn_done bit and test that in smtp_reap_banner() and
3165 smtp_reap_ehlo(). That would let us also add the conn-timeout to the
3168 if (f.running_in_test_harness && ob->connect_timeout == 999999)
3170 set_errno_nohost(sx->addrlist,
3171 errno == ETIMEDOUT ? ERRNO_CONNECTTIMEOUT : errno,
3172 sx->verify ? US strerror(errno) : NULL,
3173 DEFER, FALSE, &sx->delivery_start);
3174 sx->send_quit = FALSE;
3178 /* really an error on an SMTP read */
3180 sx->send_quit = check_response(sx->conn_args.host, &errno, sx->addrlist->more_errno,
3181 sx->buffer, &code, &message, &pass_message);
3187 message = US string_sprintf("smtp send to %s [%s] failed: %s",
3188 sx->conn_args.host->name, sx->conn_args.host->address, strerror(errno));
3189 sx->send_quit = FALSE;
3195 message = string_sprintf("Remote host closed connection in response to %s"
3196 " (EHLO response was: %s)", smtp_command, sx->buffer);
3197 sx->send_quit = FALSE;
3201 /* This label is jumped to directly when a TLS negotiation has failed,
3202 or was not done for a host for which it is required. Values will be set
3203 in message and errno, and setting_up will always be true. Treat as
3204 a temporary error. */
3208 code = '4', yield = DEFER;
3212 /* The failure happened while setting up the call; see if the failure was
3213 a 5xx response (this will either be on connection, or following HELO - a 5xx
3214 after EHLO causes it to try HELO). If so, and there are no more hosts to try,
3215 fail all addresses, as this host is never going to accept them. For other
3216 errors during setting up (timeouts or whatever), defer all addresses, and
3217 yield DEFER, so that the host is not tried again for a while.
3219 XXX This peeking for another host feels like a layering violation. We want
3220 to note the host as unusable, but down here we shouldn't know if this was
3221 the last host to try for the addr(list). Perhaps the upper layer should be
3222 the one to do set_errno() ? The problem is that currently the addr is where
3223 errno etc. are stashed, but until we run out of hosts to try the errors are
3224 host-specific. Maybe we should enhance the host_item definition? */
3227 sx->ok = FALSE; /* For when reached by GOTO */
3228 set_errno(sx->addrlist, errno, message,
3229 sx->conn_args.host->next
3233 || errno == ERRNO_UTF8_FWD
3237 errno == ECONNREFUSED ? NULL : sx->conn_args.host,
3238 #ifdef EXPERIMENTAL_DSN_INFO
3239 sx->smtp_greeting, sx->helo_response,
3241 &sx->delivery_start);
3248 (void)smtp_write_command(sx, SCMD_FLUSH, "QUIT\r\n");
3251 if (sx->cctx.tls_ctx)
3253 if (sx->send_tlsclose)
3255 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
3256 sx->send_tlsclose = FALSE;
3258 sx->cctx.tls_ctx = NULL;
3262 /* Close the socket, and return the appropriate value, first setting
3263 works because the NULL setting is passed back to the calling process, and
3264 remote_max_parallel is forced to 1 when delivering over an existing connection,
3267 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
3270 shutdown(sx->cctx.sock, SHUT_WR);
3271 if (fcntl(sx->cctx.sock, F_SETFL, O_NONBLOCK) == 0)
3272 for (int i = 16; read(sx->cctx.sock, sx->inbuffer, sizeof(sx->inbuffer)) > 0 && i > 0;)
3273 i--; /* drain socket */
3274 sx->send_quit = FALSE;
3276 (void)close(sx->cctx.sock);
3279 #ifndef DISABLE_EVENT
3280 (void) event_raise(sx->conn_args.tblock->event_action, US"tcp:close", NULL, NULL);
3283 smtp_debug_cmd_report();
3284 continue_transport = NULL;
3285 continue_hostname = NULL;
3292 /* Create the string of options that will be appended to the MAIL FROM:
3293 in the connection context buffer */
3296 build_mailcmd_options(smtp_context * sx, address_item * addrlist)
3298 uschar * p = sx->buffer;
3299 address_item * addr;
3304 /* If we know the receiving MTA supports the SIZE qualification, and we know it,
3305 send it, adding something to the message size to allow for imprecision
3306 and things that get added en route. Exim keeps the number of lines
3307 in a message, so we can give an accurate value for the original message, but we
3308 need some additional to handle added headers. (Double "." characters don't get
3309 included in the count.) */
3311 if ( message_size > 0
3312 && sx->peer_offered & OPTION_SIZE && !(sx->avoid_option & OPTION_SIZE))
3314 /*XXX problem here under spool_files_wireformat?
3315 Or just forget about lines? Or inflate by a fixed proportion? */
3317 sprintf(CS p, " SIZE=%d", message_size+message_linecount+(SOB sx->conn_args.ob)->size_addition);
3321 #ifndef DISABLE_PRDR
3322 /* If it supports Per-Recipient Data Responses, and we have more than one recipient,
3325 sx->prdr_active = FALSE;
3326 if (smtp_peer_options & OPTION_PRDR)
3327 for (address_item * addr = addrlist; addr; addr = addr->next)
3328 if (addr->transport_return == PENDING_DEFER)
3330 for (addr = addr->next; addr; addr = addr->next)
3331 if (addr->transport_return == PENDING_DEFER)
3332 { /* at least two recipients to send */
3333 sx->prdr_active = TRUE;
3334 sprintf(CS p, " PRDR"); p += 5;
3342 /* If it supports internationalised messages, and this meesage need that,
3345 if ( sx->peer_offered & OPTION_UTF8
3346 && addrlist->prop.utf8_msg
3347 && !addrlist->prop.utf8_downcvt
3349 Ustrcpy(p, US" SMTPUTF8"), p += 9;
3352 /* check if all addresses have DSN-lasthop flag; do not send RET and ENVID if so */
3353 for (sx->dsn_all_lasthop = TRUE, addr = addrlist, address_count = 0;
3354 addr && address_count < sx->max_rcpt; /*XXX maybe also || sx->single_rcpt_domain ? */
3355 addr = addr->next) if (addr->transport_return == PENDING_DEFER)
3358 if (!(addr->dsn_flags & rf_dsnlasthop))
3360 sx->dsn_all_lasthop = FALSE;
3365 /* Add any DSN flags to the mail command */
3367 if (sx->peer_offered & OPTION_DSN && !sx->dsn_all_lasthop)
3369 if (dsn_ret == dsn_ret_hdrs)
3370 { Ustrcpy(p, US" RET=HDRS"); p += 9; }
3371 else if (dsn_ret == dsn_ret_full)
3372 { Ustrcpy(p, US" RET=FULL"); p += 9; }
3376 string_format(p, sizeof(sx->buffer) - (p-sx->buffer), " ENVID=%s", dsn_envid);
3381 /* If an authenticated_sender override has been specified for this transport
3382 instance, expand it. If the expansion is forced to fail, and there was already
3383 an authenticated_sender for this message, the original value will be used.
3384 Other expansion failures are serious. An empty result is ignored, but there is
3385 otherwise no check - this feature is expected to be used with LMTP and other
3386 cases where non-standard addresses (e.g. without domains) might be required. */
3388 return smtp_mail_auth_str(sx, p, addrlist) ? ERROR : OK;
3393 build_rcptcmd_options(smtp_context * sx, const address_item * addr)
3395 uschar * p = sx->buffer;
3398 /* Add any DSN flags to the rcpt command */
3400 if (sx->peer_offered & OPTION_DSN && !(addr->dsn_flags & rf_dsnlasthop))
3402 if (addr->dsn_flags & rf_dsnflags)
3406 Ustrcpy(p, US" NOTIFY=");
3408 for (int i = 0; i < nelem(rf_list); i++) if (addr->dsn_flags & rf_list[i])
3410 if (!first) *p++ = ',';
3412 Ustrcpy(p, rf_names[i]);
3417 if (addr->dsn_orcpt)
3419 string_format(p, sizeof(sx->buffer) - (p-sx->buffer), " ORCPT=%s",
3428 /* Send MAIL FROM and RCPT TO commands.
3429 See sw_mrc_t definition for return codes.
3433 smtp_write_mail_and_rcpt_cmds(smtp_context * sx, int * yield)
3435 address_item * addr;
3436 #ifndef DISABLE_ESMTP_LIMITS
3437 address_item * restart_addr = NULL;
3439 int address_count, pipe_limit;
3442 if (build_mailcmd_options(sx, sx->first_addr) != OK)
3445 return sw_mrc_bad_internal;
3448 /* From here until we send the DATA command, we can make use of PIPELINING
3449 if the server host supports it. The code has to be able to check the responses
3450 at any point, for when the buffer fills up, so we write it totally generally.
3451 When PIPELINING is off, each command written reports that it has flushed the
3454 sx->pending_MAIL = TRUE; /* The block starts with MAIL */
3457 const uschar * s = sx->from_addr;
3459 uschar * errstr = NULL;
3461 /* If we must downconvert, do the from-address here. Remember we had to
3462 for the to-addresses (done below), and also (ugly) for re-doing when building
3463 the delivery log line. */
3465 if ( sx->addrlist->prop.utf8_msg
3466 && (sx->addrlist->prop.utf8_downcvt || !(sx->peer_offered & OPTION_UTF8))
3469 if (s = string_address_utf8_to_alabel(s, &errstr), errstr)
3471 set_errno_nohost(sx->addrlist, ERRNO_EXPANDFAIL, errstr, DEFER, FALSE, &sx->delivery_start);
3473 return sw_mrc_bad_internal;
3475 setflag(sx->addrlist, af_utf8_downcvt);
3479 rc = smtp_write_command(sx, pipelining_active ? SCMD_BUFFER : SCMD_FLUSH,
3480 "MAIL FROM:<%s>%s\r\n", s, sx->buffer);
3483 mail_command = string_copy(big_buffer); /* Save for later error message */
3487 case -1: /* Transmission error */
3488 return sw_mrc_bad_mail;
3490 case +1: /* Cmd was sent */
3491 if (!smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2',
3492 (SOB sx->conn_args.ob)->command_timeout))
3494 if (errno == 0 && sx->buffer[0] == '4')
3496 errno = ERRNO_MAIL4XX;
3497 sx->addrlist->more_errno |= ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
3499 return sw_mrc_bad_mail;
3501 sx->pending_MAIL = FALSE;
3504 /* otherwise zero: command queued for pipeline */
3507 /* Pass over all the relevant recipient addresses for this host, which are the
3508 ones that have status PENDING_DEFER. If we are using PIPELINING, we can send
3509 several before we have to read the responses for those seen so far. This
3510 checking is done by a subroutine because it also needs to be done at the end.
3511 Send only up to max_rcpt addresses at a time, leaving next_addr pointing to
3512 the next one if not all are sent.
3514 In the MUA wrapper situation, we want to flush the PIPELINING buffer for the
3515 last address because we want to abort if any recipients have any kind of
3516 problem, temporary or permanent. We know that all recipient addresses will have
3517 the PENDING_DEFER status, because only one attempt is ever made, and we know
3518 that max_rcpt will be large, so all addresses will be done at once.
3520 For verify we flush the pipeline after any (the only) rcpt address. */
3522 for (addr = sx->first_addr, address_count = 0, pipe_limit = 100;
3523 addr && address_count < sx->max_rcpt;
3524 addr = addr->next) if (addr->transport_return == PENDING_DEFER)
3528 const uschar * rcpt_addr;
3530 #ifndef DISABLE_ESMTP_LIMITS
3531 if ( sx->single_rcpt_domain /* restriction on domains */
3532 && address_count > 0 /* not first being sent */
3533 && Ustrcmp(addr->domain, sx->first_addr->domain) != 0 /* dom diff from first */
3536 DEBUG(D_transport) debug_printf("skipping different domain %s\n", addr->domain);
3538 /* Ensure the smtp-response reaper does not think the address had a RCPT
3539 command sent for it. Reset to PENDING_DEFER in smtp_deliver(), where we
3540 goto SEND_MESSAGE. */
3542 addr->transport_return = SKIP;
3543 if (!restart_addr) restart_addr = addr; /* note restart point */
3544 continue; /* skip this one */
3548 addr->dsn_aware = sx->peer_offered & OPTION_DSN
3549 ? dsn_support_yes : dsn_support_no;
3552 if (pipe_limit-- <= 0)
3553 { no_flush = FALSE; pipe_limit = 100; }
3555 no_flush = pipelining_active && !sx->verify
3556 && (!mua_wrapper || addr->next && address_count < sx->max_rcpt);
3558 build_rcptcmd_options(sx, addr);
3560 /* Now send the RCPT command, and process outstanding responses when
3561 necessary. After a timeout on RCPT, we just end the function, leaving the
3562 yield as OK, because this error can often mean that there is a problem with
3563 just one address, so we don't want to delay the host. */
3565 rcpt_addr = transport_rcpt_address(addr, sx->conn_args.tblock->rcpt_include_affixes);
3568 if ( testflag(sx->addrlist, af_utf8_downcvt)
3569 && !(rcpt_addr = string_address_utf8_to_alabel(rcpt_addr, NULL))
3572 /*XXX could we use a per-address errstr here? Not fail the whole send? */
3573 errno = ERRNO_EXPANDFAIL;
3574 return sw_mrc_tx_fail; /*XXX too harsh? */
3578 cmds_sent = smtp_write_command(sx, no_flush ? SCMD_BUFFER : SCMD_FLUSH,
3579 "RCPT TO:<%s>%s%s\r\n", rcpt_addr, sx->igquotstr, sx->buffer);
3581 if (cmds_sent < 0) return sw_mrc_tx_fail;
3584 switch(sync_responses(sx, cmds_sent, 0))
3586 case RESP_HAD_2_AND_5: sx->ok = TRUE; /* OK & progress made */
3587 case RESP_BIT_HAD_5XX: sx->completed_addr = TRUE; /* progress made */
3590 case RESP_BIT_HAD_2XX: sx->ok = TRUE; /* OK, but if LMTP, */
3591 if (!sx->lmtp) /* can't tell about progress yet */
3592 sx->completed_addr = TRUE;
3593 case RESP_NOERROR: /* No 2xx or 5xx, but no probs */
3594 /* If any RCPT got a 452 response then next_addr has been updated
3595 for restarting with a new MAIL on the same connection. Send no more
3596 RCPTs for this MAIL. */
3600 DEBUG(D_transport) debug_printf("seen 452 too-many-rcpts\n");
3601 sx->RCPT_452 = FALSE;
3602 /* sx->next_addr has been reset for fast_retry */
3607 case RESP_RCPT_TIMEO: return sw_mrc_nonmail_read_timeo;
3608 case RESP_RCPT_ERROR: return sw_mrc_bad_read;
3609 default: return sw_mrc_bad_mail; /* any MAIL error */
3611 #ifndef DISABLE_PIPE_CONNECT
3612 case RESP_EPIPE_EHLO_ERR: return sw_mrc_bad_mail; /* non-2xx for pipelined banner or EHLO */
3613 case RESP_EHLO_ERR_TLS: return sw_mrc_bad_mail; /* TLS first-read error */
3617 } /* Loop for next address */
3619 #ifndef DISABLE_ESMTP_LIMITS
3620 sx->next_addr = restart_addr ? restart_addr : addr;
3622 sx->next_addr = addr;
3629 /*****************************************************
3630 * Proxy TLS connection for another transport process *
3631 ******************************************************/
3633 Close the unused end of the pipe, fork once more, then use the given buffer
3634 as a staging area, and select on both the given fd and the TLS'd client-fd for
3635 data to read (per the coding in ip_recv() and fd_ready() this is legitimate).
3636 Do blocking full-size writes, and reads under a timeout. Once both input
3637 channels are closed, exit the process.
3641 buf space to use for buffering
3642 bufsiz size of buffer
3643 pfd pipe filedescriptor array; [0] is comms to proxied process
3644 timeout per-read timeout, seconds
3645 host hostname of remote
3651 smtp_proxy_tls(void * ct_ctx, uschar * buf, size_t bsize, int * pfd,
3652 int timeout, const uschar * host)
3654 struct pollfd p[2] = {{.fd = tls_out.active.sock, .events = POLLIN},
3655 {.fd = pfd[0], .events = POLLIN}};
3657 BOOL send_tls_shutdown = TRUE;
3660 if ((rc = exim_fork(US"tls-proxy")))
3661 _exit(rc < 0 ? EXIT_FAILURE : EXIT_SUCCESS);
3663 set_process_info("proxying TLS connection for continued transport to %s\n", host);
3667 time_t time_left = timeout;
3668 time_t time_start = time(NULL);
3673 rc = poll(p, 2, time_left * 1000);
3675 if (rc < 0 && errno == EINTR)
3676 if ((time_left -= time(NULL) - time_start) > 0) continue;
3680 DEBUG(D_transport) if (rc == 0) debug_printf("%s: timed out\n", __FUNCTION__);
3684 /* For errors where not readable, bomb out */
3686 if (p[0].revents & POLLERR || p[1].revents & POLLERR)
3688 DEBUG(D_transport) debug_printf("select: exceptional cond on %s fd\n",
3689 p[0].revents & POLLERR ? "tls" : "proxy");
3690 if (!(p[0].revents & POLLIN || p[1].events & POLLIN))
3692 DEBUG(D_transport) debug_printf("- but also readable; no exit yet\n");
3695 while (rc < 0 || !(p[0].revents & POLLIN || p[1].revents & POLLIN));
3697 /* handle inbound data */
3698 if (p[0].revents & POLLIN)
3699 if ((rc = tls_read(ct_ctx, buf, bsize)) <= 0) /* Expect -1 for EOF; */
3700 { /* that reaps the TLS Close Notify record */
3702 shutdown(pfd[0], SHUT_WR);
3706 for (int nbytes = 0; rc - nbytes > 0; nbytes += i)
3707 if ((i = write(pfd[0], buf + nbytes, rc - nbytes)) < 0) goto done;
3709 /* Handle outbound data. We cannot combine payload and the TLS-close
3710 due to the limitations of the (pipe) channel feeding us. Maybe use a unix-domain
3712 if (p[1].revents & POLLIN)
3713 if ((rc = read(pfd[0], buf, bsize)) <= 0)
3717 # ifdef EXIM_TCP_CORK /* Use _CORK to get TLS Close Notify in FIN segment */
3718 (void) setsockopt(tls_out.active.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
3720 tls_shutdown_wr(ct_ctx);
3721 send_tls_shutdown = FALSE;
3722 shutdown(tls_out.active.sock, SHUT_WR);
3725 for (int nbytes = 0; rc - nbytes > 0; nbytes += i)
3726 if ((i = tls_write(ct_ctx, buf + nbytes, rc - nbytes, FALSE)) < 0)
3729 while (p[0].fd >= 0 || p[1].fd >= 0);
3732 if (send_tls_shutdown) tls_close(ct_ctx, TLS_SHUTDOWN_NOWAIT);
3734 testharness_pause_ms(100); /* let logging complete */
3735 exim_exit(EXIT_SUCCESS);
3740 /*************************************************
3741 * Deliver address list to given host *
3742 *************************************************/
3744 /* If continue_hostname is not null, we get here only when continuing to
3745 deliver down an existing channel. The channel was passed as the standard
3746 input. TLS is never active on a passed channel; the previous process either
3747 closes it down before passing the connection on, or inserts a TLS-proxy
3748 process and passes on a cleartext conection.
3750 Otherwise, we have to make a connection to the remote host, and do the
3751 initial protocol exchange.
3753 When running as an MUA wrapper, if the sender or any recipient is rejected,
3754 temporarily or permanently, we force failure for all recipients.
3757 addrlist chain of potential addresses to deliver; only those whose
3758 transport_return field is set to PENDING_DEFER are currently
3759 being processed; others should be skipped - they have either
3760 been delivered to an earlier host or IP address, or been
3761 failed by one of them.
3762 host host to deliver to
3763 host_af AF_INET or AF_INET6
3764 defport default TCP/IP port to use if host does not specify, in host
3766 interface interface to bind to, or NULL
3767 tblock transport instance block
3768 message_defer set TRUE if yield is OK, but all addresses were deferred
3769 because of a non-recipient, non-host failure, that is, a
3770 4xx response to MAIL FROM, DATA, or ".". This is a defer
3771 that is specific to the message.
3772 suppress_tls if TRUE, don't attempt a TLS connection - this is set for
3773 a second attempt after TLS initialization fails
3775 Returns: OK - the connection was made and the delivery attempted;
3776 the result for each address is in its data block.
3777 DEFER - the connection could not be made, or something failed
3778 while setting up the SMTP session, or there was a
3779 non-message-specific error, such as a timeout.
3780 ERROR - a filter command is specified for this transport,
3781 and there was a problem setting it up; OR helo_data
3782 or add_headers or authenticated_sender is specified
3783 for this transport, and the string failed to expand
3785 For all non-OK returns the first addr of the list carries the
3786 time taken for the attempt.
3790 smtp_deliver(address_item *addrlist, host_item *host, int host_af, int defport,
3791 uschar *interface, transport_instance *tblock,
3792 BOOL *message_defer, BOOL suppress_tls)
3794 smtp_transport_options_block * ob = SOB tblock->options_block;
3799 uschar *message = NULL;
3800 uschar new_message_id[MESSAGE_ID_LENGTH + 1];
3801 smtp_context * sx = store_get(sizeof(*sx), GET_TAINTED); /* tainted, for the data buffers */
3802 BOOL pass_message = FALSE;
3803 #ifndef DISABLE_ESMTP_LIMITS
3804 BOOL mail_limit = FALSE;
3809 BOOL tcw_done = FALSE, tcw = FALSE;
3811 *message_defer = FALSE;
3813 memset(sx, 0, sizeof(*sx));
3814 sx->addrlist = addrlist;
3815 sx->conn_args.host = host;
3816 sx->conn_args.host_af = host_af;
3818 sx->conn_args.interface = interface;
3819 sx->helo_data = NULL;
3820 sx->conn_args.tblock = tblock;
3821 sx->conn_args.sock = -1;
3822 gettimeofday(&sx->delivery_start, NULL);
3823 sx->sync_addr = sx->first_addr = addrlist;
3830 /* Get the channel set up ready for a message, MAIL FROM being the next
3831 SMTP command to send. */
3833 if ((rc = smtp_setup_conn(sx, suppress_tls)) != OK)
3835 timesince(&addrlist->delivery_time, &sx->delivery_start);
3841 /* If the connection used DANE, ignore for now any addresses with incompatible
3842 domains. The SNI has to be the domain. Arrange a whole new TCP conn later,
3843 just in case only TLS isn't enough. */
3845 if (sx->conn_args.dane)
3847 const uschar * dane_domain = sx->first_addr->domain;
3849 for (address_item * a = sx->first_addr->next; a; a = a->next)
3850 if ( a->transport_return == PENDING_DEFER
3851 && Ustrcmp(dane_domain, a->domain) != 0)
3853 DEBUG(D_transport) debug_printf("DANE: holding %s for later\n", a->domain);
3855 a->transport_return = DANE;
3860 /* If there is a filter command specified for this transport, we can now
3861 set it up. This cannot be done until the identity of the host is known. */
3863 if (tblock->filter_command)
3865 transport_filter_timeout = tblock->filter_timeout;
3867 /* On failure, copy the error to all addresses, abandon the SMTP call, and
3870 if (!transport_set_up_command(&transport_filter_argv,
3871 tblock->filter_command, TSUC_EXPAND_ARGS, DEFER, addrlist,
3872 string_sprintf("%.50s transport filter", tblock->name), NULL))
3874 set_errno_nohost(addrlist->next, addrlist->basic_errno, addrlist->message, DEFER,
3875 FALSE, &sx->delivery_start);
3880 if ( transport_filter_argv
3881 && *transport_filter_argv
3882 && **transport_filter_argv
3883 && smtp_peer_options & OPTION_CHUNKING
3884 #ifndef DISABLE_DKIM
3885 /* When dkim signing, chunking is handled even with a transport-filter */
3886 && !(ob->dkim.dkim_private_key && ob->dkim.dkim_domain && ob->dkim.dkim_selector)
3887 && !ob->dkim.force_bodyhash
3891 smtp_peer_options &= ~OPTION_CHUNKING;
3892 DEBUG(D_transport) debug_printf("CHUNKING not usable due to transport filter\n");
3896 /* For messages that have more than the maximum number of envelope recipients,
3897 we want to send several transactions down the same SMTP connection. (See
3898 comments in deliver.c as to how this reconciles, heuristically, with
3899 remote_max_parallel.) This optimization was added to Exim after the following
3900 code was already working. The simplest way to put it in without disturbing the
3901 code was to use a goto to jump back to this point when there is another
3902 transaction to handle. */
3905 sx->from_addr = return_path;
3906 sx->sync_addr = sx->first_addr;
3908 sx->send_rset = TRUE;
3909 sx->completed_addr = FALSE;
3912 /* If we are a continued-connection-after-verify the MAIL and RCPT
3913 commands were already sent; do not re-send but do mark the addrs as
3914 having been accepted up to RCPT stage. A traditional cont-conn
3915 always has a sequence number greater than one. */
3917 if (continue_hostname && continue_sequence == 1)
3919 /* sx->pending_MAIL = FALSE; */
3921 /* sx->next_addr = NULL; */
3923 for (address_item * addr = addrlist; addr; addr = addr->next)
3924 addr->transport_return = PENDING_OK;
3928 /* Initiate a message transfer. */
3930 switch(smtp_write_mail_and_rcpt_cmds(sx, &yield))
3932 case sw_mrc_ok: break;
3933 case sw_mrc_bad_mail: goto RESPONSE_FAILED;
3934 case sw_mrc_bad_read: goto RESPONSE_FAILED;
3935 case sw_mrc_nonmail_read_timeo: goto END_OFF;
3936 case sw_mrc_bad_internal: goto SEND_QUIT;
3937 default: goto SEND_FAILED;
3940 /* If we are an MUA wrapper, abort if any RCPTs were rejected, either
3941 permanently or temporarily. We should have flushed and synced after the last
3949 for (a = sx->first_addr, cnt = 0; a && cnt < sx->max_rcpt; a = a->next, cnt++)
3950 if (a->transport_return != PENDING_OK)
3952 /*XXX could we find a better errno than 0 here? */
3953 set_errno_nohost(addrlist, 0, a->message, FAIL,
3954 testflag(a, af_pass_message), &sx->delivery_start);
3961 /* If ok is TRUE, we know we have got at least one good recipient, and must now
3962 send DATA, but if it is FALSE (in the normal, non-wrapper case), we may still
3963 have a good recipient buffered up if we are pipelining. We don't want to waste
3964 time sending DATA needlessly, so we only send it if either ok is TRUE or if we
3965 are pipelining. The responses are all handled by sync_responses().
3966 If using CHUNKING, do not send a BDAT until we know how big a chunk we want
3969 if ( !(smtp_peer_options & OPTION_CHUNKING)
3970 && (sx->ok || (pipelining_active && !mua_wrapper)))
3972 int count = smtp_write_command(sx, SCMD_FLUSH, "DATA\r\n");
3974 if (count < 0) goto SEND_FAILED;
3976 switch(sync_responses(sx, count, sx->ok ? +1 : -1))
3978 case RESP_HAD_2_AND_5: sx->ok = TRUE; /* OK & progress made */
3979 case RESP_BIT_HAD_5XX: sx->completed_addr = TRUE; /* progress made */
3982 case RESP_BIT_HAD_2XX: sx->ok = TRUE; /* OK, but if LMTP, */
3983 if (!sx->lmtp) /* can't tell about progress yet */
3984 sx->completed_addr = TRUE;
3985 case RESP_NOERROR: break; /* No 2xx or 5xx, but no probs */
3987 case RESP_RCPT_TIMEO: goto END_OFF;
3989 #ifndef DISABLE_PIPE_CONNECT
3990 case -5: /* TLS first-read error */
3991 case -4: HDEBUG(D_transport)
3992 debug_printf("failed reaping pipelined cmd responses\n");
3994 default: goto RESPONSE_FAILED; /* I/O error, or any MAIL/DATA error */
3996 pipelining_active = FALSE;
3997 data_command = string_copy(big_buffer); /* Save for later error message */
4000 /* If there were no good recipients (but otherwise there have been no
4001 problems), just set ok TRUE, since we have handled address-specific errors
4002 already. Otherwise, it's OK to send the message. Use the check/escape mechanism
4003 for handling the SMTP dot-handling protocol, flagging to apply to headers as
4004 well as body. Set the appropriate timeout value to be used for each chunk.
4005 (Haven't been able to make it work using select() for writing yet.) */
4008 && (!(smtp_peer_options & OPTION_CHUNKING) || !pipelining_active))
4010 /* Save the first address of the next batch. */
4011 sx->first_addr = sx->next_addr;
4017 transport_ctx tctx = {
4018 .u = {.fd = sx->cctx.sock}, /*XXX will this need TLS info? */
4021 .check_string = US".",
4022 .escape_string = US"..", /* Escaping strings */
4024 topt_use_crlf | topt_escape_headers
4025 | (tblock->body_only ? topt_no_headers : 0)
4026 | (tblock->headers_only ? topt_no_body : 0)
4027 | (tblock->return_path_add ? topt_add_return_path : 0)
4028 | (tblock->delivery_date_add ? topt_add_delivery_date : 0)
4029 | (tblock->envelope_to_add ? topt_add_envelope_to : 0)
4032 /* If using CHUNKING we need a callback from the generic transport
4033 support to us, for the sending of BDAT smtp commands and the reaping
4034 of responses. The callback needs a whole bunch of state so set up
4035 a transport-context structure to be passed around. */
4037 if (smtp_peer_options & OPTION_CHUNKING)
4039 tctx.check_string = tctx.escape_string = NULL;
4040 tctx.options |= topt_use_bdat;
4041 tctx.chunk_cb = smtp_chunk_cmd_callback;
4042 sx->pending_BDAT = FALSE;
4043 sx->good_RCPT = sx->ok;
4045 tctx.smtp_context = sx;
4048 tctx.options |= topt_end_dot;
4050 /* Save the first address of the next batch. */
4051 sx->first_addr = sx->next_addr;
4053 /* Responses from CHUNKING commands go in buffer. Otherwise,
4054 there has not been a response. */
4058 sigalrm_seen = FALSE;
4059 transport_write_timeout = ob->data_timeout;
4060 smtp_command = US"sending data block"; /* For error messages */
4061 DEBUG(D_transport|D_v)
4062 if (smtp_peer_options & OPTION_CHUNKING)
4063 debug_printf(" will write message using CHUNKING\n");
4065 debug_printf(" SMTP>> (writing message)\n");
4066 transport_count = 0;
4068 #ifndef DISABLE_DKIM
4070 # ifdef MEASURE_TIMING
4072 gettimeofday(&t0, NULL);
4074 dkim_exim_sign_init();
4075 # ifdef EXPERIMENTAL_ARC
4077 uschar * s = ob->arc_sign;
4080 if (!(ob->dkim.arc_signspec = s = expand_string(s)))
4082 if (!f.expand_string_forcedfail)
4084 message = US"failed to expand arc_sign";
4091 /* Ask dkim code to hash the body for ARC */
4092 (void) arc_ams_setup_sign_bodyhash();
4093 ob->dkim.force_bodyhash = TRUE;
4098 # ifdef MEASURE_TIMING
4099 report_time_since(&t0, US"dkim_exim_sign_init (delta)");
4104 /* See if we can pipeline QUIT. Reasons not to are
4105 - pipelining not active
4106 - not ok to send quit
4107 - errors in amtp transation responses
4108 - more addrs to send for this message or this host
4109 - this message was being retried
4110 - more messages for this host
4111 If we can, we want the message-write to not flush (the tail end of) its data out. */
4113 if ( sx->pipelining_used
4114 && (sx->ok && sx->completed_addr || smtp_peer_options & OPTION_CHUNKING)
4116 && !(sx->first_addr || f.continue_more)
4117 && f.deliver_firsttime
4120 smtp_compare_t t_compare =
4121 {.tblock = tblock, .current_sender_address = sender_address};
4126 ( tls_out.active.sock < 0 && !continue_proxy_cipher
4127 || verify_check_given_host(CUSS &ob->hosts_nopass_tls, host) != OK
4131 transport_check_waiting(tblock->name, host->name,
4132 tblock->connection_max_messages, new_message_id,
4133 (oicf)smtp_are_same_identities, (void*)&t_compare);
4136 HDEBUG(D_transport) debug_printf("will pipeline QUIT\n");
4137 tctx.options |= topt_no_flush;
4141 #ifndef DISABLE_DKIM
4142 sx->ok = dkim_transport_write_message(&tctx, &ob->dkim, CUSS &message);
4144 sx->ok = transport_write_message(&tctx, 0);
4147 /* transport_write_message() uses write() because it is called from other
4148 places to write to non-sockets. This means that under some OS (e.g. Solaris)
4149 it can exit with "Broken pipe" as its error. This really means that the
4150 socket got closed at the far end. */
4152 transport_write_timeout = 0; /* for subsequent transports */
4154 /* Failure can either be some kind of I/O disaster (including timeout),
4155 or the failure of a transport filter or the expansion of added headers.
4156 Or, when CHUNKING, it can be a protocol-detected failure. */
4159 if (message) goto SEND_FAILED;
4160 else goto RESPONSE_FAILED;
4162 /* We used to send the terminating "." explicitly here, but because of
4163 buffering effects at both ends of TCP/IP connections, you don't gain
4164 anything by keeping it separate, so it might as well go in the final
4165 data buffer for efficiency. This is now done by setting the topt_end_dot
4168 smtp_command = US"end of data";
4170 /* If we can pipeline a QUIT with the data them send it now. If a new message
4171 for this host appeared in the queue while data was being sent, we will not see
4172 it and it will have to wait for a queue run. If there was one but another
4173 thread took it, we might attempt to send it - but locking of spoolfiles will
4174 detect that. Use _MORE to get QUIT in FIN segment. */
4176 if (tcw_done && !tcw)
4178 /*XXX jgh 2021/03/10 google et. al screwup. G, at least, sends TCP FIN in response to TLS
4179 close-notify. Under TLS 1.3, violating RFC.
4180 However, TLS 1.2 does not have half-close semantics. */
4182 if ( sx->cctx.tls_ctx
4183 #if 0 && !defined(DISABLE_TLS)
4184 && Ustrcmp(tls_out.ver, "TLS1.3") != 0
4186 || !f.deliver_firsttime
4188 { /* Send QUIT now and not later */
4189 (void)smtp_write_command(sx, SCMD_FLUSH, "QUIT\r\n");
4190 sx->send_quit = FALSE;
4193 { /* add QUIT to the output buffer */
4194 (void)smtp_write_command(sx, SCMD_MORE, "QUIT\r\n");
4195 sx->send_quit = FALSE; /* avoid sending it later */
4198 if (sx->cctx.tls_ctx && sx->send_tlsclose) /* need to send TLS Close Notify */
4200 # ifdef EXIM_TCP_CORK /* Use _CORK to get Close Notify in FIN segment */
4201 (void) setsockopt(sx->cctx.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
4203 tls_shutdown_wr(sx->cctx.tls_ctx);
4204 sx->send_tlsclose = FALSE; /* avoid later repeat */
4207 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(shutdown)>>\n");
4208 shutdown(sx->cctx.sock, SHUT_WR); /* flush output buffer, with TCP FIN */
4212 if (smtp_peer_options & OPTION_CHUNKING && sx->cmd_count > 1)
4214 /* Reap any outstanding MAIL & RCPT commands, but not a DATA-go-ahead */
4215 switch(sync_responses(sx, sx->cmd_count-1, 0))
4217 case RESP_HAD_2_AND_5: sx->ok = TRUE; /* OK & progress made */
4218 case RESP_BIT_HAD_5XX: sx->completed_addr = TRUE; /* progress made */
4221 case RESP_BIT_HAD_2XX: sx->ok = TRUE; /* OK, but if LMTP, */
4222 if (!sx->lmtp) /* can't tell about progress yet */
4223 sx->completed_addr = TRUE;
4224 case RESP_NOERROR: break; /* No 2xx or 5xx, but no probs */
4226 case RESP_RCPT_TIMEO: goto END_OFF; /* Timeout on RCPT */
4228 #ifndef DISABLE_PIPE_CONNECT
4229 case RESP_EHLO_ERR_TLS: /* TLS first-read error */
4230 case RESP_EPIPE_EHLO_ERR: HDEBUG(D_transport)
4231 debug_printf("failed reaping pipelined cmd responses\n");
4233 default: goto RESPONSE_FAILED; /* I/O error, or any MAIL/DATA error */
4237 #ifndef DISABLE_PRDR
4238 /* For PRDR we optionally get a partial-responses warning followed by the
4239 individual responses, before going on with the overall response. If we don't
4240 get the warning then deal with per non-PRDR. */
4244 sx->ok = smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '3', ob->final_timeout);
4245 if (!sx->ok && errno == 0) switch(sx->buffer[0])
4247 case '2': sx->prdr_active = FALSE;
4250 case '4': errno = ERRNO_DATA4XX;
4251 addrlist->more_errno |=
4252 ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
4259 /* For non-PRDR SMTP, we now read a single response that applies to the
4260 whole message. If it is OK, then all the addresses have been delivered. */
4264 sx->ok = smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2',
4266 if (!sx->ok && errno == 0 && sx->buffer[0] == '4')
4268 errno = ERRNO_DATA4XX;
4269 addrlist->more_errno |= ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
4273 /* For LMTP, we get back a response for every RCPT command that we sent;
4274 some may be accepted and some rejected. For those that get a response, their
4275 status is fixed; any that are accepted have been handed over, even if later
4276 responses crash - at least, that's how I read RFC 2033.
4278 If all went well, mark the recipient addresses as completed, record which
4279 host/IPaddress they were delivered to, and cut out RSET when sending another
4280 message down the same channel. Write the completed addresses to the journal
4281 now so that they are recorded in case there is a crash of hardware or
4282 software before the spool gets updated. Also record the final SMTP
4283 confirmation if needed (for SMTP only). */
4288 struct timeval delivery_time;
4290 uschar * conf = NULL;
4292 timesince(&delivery_time, &sx->delivery_start);
4293 sx->send_rset = FALSE;
4294 pipelining_active = FALSE;
4296 /* Set up confirmation if needed - applies only to SMTP */
4299 #ifdef DISABLE_EVENT
4300 LOGGING(smtp_confirmation) &&
4305 const uschar * s = string_printing(sx->buffer);
4306 /* deconst cast ok here as string_printing was checked to have alloc'n'copied */
4307 conf = s == sx->buffer ? US string_copy(s) : US s;
4310 /* Process all transported addresses - for LMTP or PRDR, read a status for
4311 each one. We used to drop out at first_addr, until someone returned a 452
4312 followed by a 250... and we screwed up the accepted addresses. */
4314 for (address_item * addr = addrlist; addr; addr = addr->next)
4316 if (addr->transport_return != PENDING_OK) continue;
4318 /* LMTP - if the response fails badly (e.g. timeout), use it for all the
4319 remaining addresses. Otherwise, it's a return code for just the one
4320 address. For temporary errors, add a retry item for the address so that
4321 it doesn't get tried again too soon. */
4323 #ifndef DISABLE_PRDR
4324 if (sx->lmtp || sx->prdr_active)
4329 if (!smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2',
4332 if (errno != 0 || sx->buffer[0] == 0) goto RESPONSE_FAILED;
4333 addr->message = string_sprintf(
4334 #ifndef DISABLE_PRDR
4335 "%s error after %s: %s", sx->prdr_active ? "PRDR":"LMTP",
4337 "LMTP error after %s: %s",
4339 data_command, string_printing(sx->buffer));
4340 setflag(addr, af_pass_message); /* Allow message to go to user */
4341 if (sx->buffer[0] == '5')
4342 addr->transport_return = FAIL;
4345 errno = ERRNO_DATA4XX;
4346 addr->more_errno |= ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
4347 addr->transport_return = DEFER;
4348 #ifndef DISABLE_PRDR
4349 if (!sx->prdr_active)
4351 retry_add_item(addr, addr->address_retry_key, 0);
4355 sx->completed_addr = TRUE; /* NOW we can set this flag */
4356 if (LOGGING(smtp_confirmation))
4358 const uschar *s = string_printing(sx->buffer);
4359 /* deconst cast ok here as string_printing was checked to have alloc'n'copied */
4360 conf = (s == sx->buffer) ? US string_copy(s) : US s;
4364 /* SMTP, or success return from LMTP for this address. Pass back the
4365 actual host that was used. */
4367 addr->transport_return = OK;
4368 addr->host_used = host;
4369 addr->delivery_time = delivery_time;
4370 addr->special_action = flag;
4371 addr->message = conf;
4373 if (tcp_out_fastopen)
4375 setflag(addr, af_tcp_fastopen_conn);
4376 if (tcp_out_fastopen >= TFO_USED_NODATA) setflag(addr, af_tcp_fastopen);
4377 if (tcp_out_fastopen >= TFO_USED_DATA) setflag(addr, af_tcp_fastopen_data);
4379 if (sx->pipelining_used) setflag(addr, af_pipelining);
4380 #ifndef DISABLE_PIPE_CONNECT
4381 if (sx->early_pipe_active) setflag(addr, af_early_pipe);
4383 #ifndef DISABLE_PRDR
4384 if (sx->prdr_active) setflag(addr, af_prdr_used);
4386 if (smtp_peer_options & OPTION_CHUNKING) setflag(addr, af_chunking_used);
4389 #ifndef DISABLE_PRDR
4390 if (!sx->prdr_active)
4393 /* Update the journal. For homonymic addresses, use the base address plus
4394 the transport name. See lots of comments in deliver.c about the reasons
4395 for the complications when homonyms are involved. Just carry on after
4396 write error, as it may prove possible to update the spool file later. */
4398 if (testflag(addr, af_homonym))
4399 sprintf(CS sx->buffer, "%.500s/%s\n", addr->unique + 3, tblock->name);
4401 sprintf(CS sx->buffer, "%.500s\n", addr->unique);
4403 DEBUG(D_deliver) debug_printf("S:journalling %s", sx->buffer);
4404 len = Ustrlen(CS sx->buffer);
4405 if (write(journal_fd, sx->buffer, len) != len)
4406 log_write(0, LOG_MAIN|LOG_PANIC, "failed to write journal for "
4407 "%s: %s", sx->buffer, strerror(errno));
4411 #ifndef DISABLE_PRDR
4412 if (sx->prdr_active)
4414 const uschar * overall_message;
4416 /* PRDR - get the final, overall response. For any non-success
4417 upgrade all the address statuses. */
4419 sx->ok = smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2',
4423 if(errno == 0 && sx->buffer[0] == '4')
4425 errno = ERRNO_DATA4XX;
4426 addrlist->more_errno |= ((sx->buffer[1] - '0')*10 + sx->buffer[2] - '0') << 8;
4428 for (address_item * addr = addrlist; addr != sx->first_addr; addr = addr->next)
4429 if (sx->buffer[0] == '5' || addr->transport_return == OK)
4430 addr->transport_return = PENDING_OK; /* allow set_errno action */
4431 goto RESPONSE_FAILED;
4434 /* Append the overall response to the individual PRDR response for logging
4435 and update the journal, or setup retry. */
4437 overall_message = string_printing(sx->buffer);
4438 for (address_item * addr = addrlist; addr != sx->first_addr; addr = addr->next)
4439 if (addr->transport_return == OK)
4440 addr->message = string_sprintf("%s\\n%s", addr->message, overall_message);
4442 for (address_item * addr = addrlist; addr != sx->first_addr; addr = addr->next)
4443 if (addr->transport_return == OK)
4445 if (testflag(addr, af_homonym))
4446 sprintf(CS sx->buffer, "%.500s/%s\n", addr->unique + 3, tblock->name);
4448 sprintf(CS sx->buffer, "%.500s\n", addr->unique);
4450 DEBUG(D_deliver) debug_printf("journalling(PRDR) %s\n", sx->buffer);
4451 len = Ustrlen(CS sx->buffer);
4452 if (write(journal_fd, sx->buffer, len) != len)
4453 log_write(0, LOG_MAIN|LOG_PANIC, "failed to write journal for "
4454 "%s: %s", sx->buffer, strerror(errno));
4456 else if (addr->transport_return == DEFER)
4457 /*XXX magic value -2 ? maybe host+message ? */
4458 retry_add_item(addr, addr->address_retry_key, -2);
4462 /* Ensure the journal file is pushed out to disk. */
4464 if (EXIMfsync(journal_fd) < 0)
4465 log_write(0, LOG_MAIN|LOG_PANIC, "failed to fsync journal: %s",
4471 /* Handle general (not specific to one address) failures here. The value of ok
4472 is used to skip over this code on the falling through case. A timeout causes a
4473 deferral. Other errors may defer or fail according to the response code, and
4474 may set up a special errno value, e.g. after connection chopped, which is
4475 assumed if errno == 0 and there is no text in the buffer. If control reaches
4476 here during the setting up phase (i.e. before MAIL FROM) then always defer, as
4477 the problem is not related to this specific message. */
4482 uschar * set_message;
4488 /* Clear send_quit flag if needed. Do not set. */
4489 sx->send_quit &= check_response(host, &save_errno, addrlist->more_errno,
4490 sx->buffer, &code, &message, &pass_message);
4498 message = string_sprintf("smtp send to %s [%s] failed: %s",
4499 host->name, host->address, message ? message : US strerror(save_errno));
4500 sx->send_quit = FALSE;
4508 sx->ok = FALSE; /* For when reached by GOTO */
4509 set_message = message;
4511 /* We want to handle timeouts after MAIL or "." and loss of connection after
4512 "." specially. They can indicate a problem with the sender address or with
4513 the contents of the message rather than a real error on the connection. These
4514 cases are treated in the same way as a 4xx response. This next bit of code
4515 does the classification. */
4522 message_error = TRUE;
4526 message_error = Ustrncmp(smtp_command,"MAIL",4) == 0 ||
4527 Ustrncmp(smtp_command,"end ",4) == 0;
4530 case ERRNO_SMTPCLOSED:
4531 /* If the peer closed the TCP connection after end-of-data, but before
4532 we could send QUIT, do TLS close, etc - call it a message error.
4533 Otherwise, if all the recipients have been dealt with, call a close no
4534 error at all; each address_item should have a suitable result already
4535 (2xx: PENDING_OK, 4xx: DEFER, 5xx: FAIL) */
4537 if (!(message_error = Ustrncmp(smtp_command,"end ",4) == 0))
4539 address_item * addr;
4540 for (addr = sx->addrlist; addr; addr = addr->next)
4541 if (addr->transport_return == PENDING_DEFER)
4543 if (!addr) /* all rcpts fates determined */
4545 log_write(0, LOG_MAIN, "peer close after all rcpt responses;"
4546 " converting i/o-error to no-error");
4553 #ifndef DISABLE_DKIM
4555 /* DKIM signing failure: avoid thinking we pipelined quit,
4556 just abandon the message and close the socket. */
4558 message_error = FALSE;
4559 # ifndef DISABLE_TLS
4560 if (sx->cctx.tls_ctx)
4562 tls_close(sx->cctx.tls_ctx,
4563 sx->send_tlsclose ? TLS_SHUTDOWN_WAIT : TLS_SHUTDOWN_WONLY);
4564 sx->cctx.tls_ctx = NULL;
4570 message_error = FALSE;
4574 /* Handle the cases that are treated as message errors (as opposed to
4575 host-errors). These are:
4577 (a) negative response or timeout after MAIL
4578 (b) negative response after DATA
4579 (c) negative response or timeout or dropped connection after "."
4580 (d) utf8 support required and not offered
4582 It won't be a negative response or timeout after RCPT, as that is dealt
4583 with separately above. The action in all cases is to set an appropriate
4584 error code for all the addresses, but to leave yield set to OK because the
4585 host itself has not failed. Of course, it might in practice have failed
4586 when we've had a timeout, but if so, we'll discover that at the next
4587 delivery attempt. For a temporary error, set the message_defer flag, and
4588 write to the logs for information if this is not the last host. The error
4589 for the last host will be logged as part of the address's log line. */
4593 if (mua_wrapper) code = '5'; /* Force hard failure in wrapper mode */
4595 /* If there's an errno, the message contains just the identity of
4600 else /* Anything other than 5 is treated as temporary */
4604 message = US string_sprintf("%s: %s", message, strerror(save_errno));
4606 write_logs(host, message, sx->first_addr ? sx->first_addr->basic_errno : 0);
4608 *message_defer = TRUE;
4611 DEBUG(D_transport) if (sx->cctx.sock >= 0)
4614 if (ioctl(sx->cctx.sock, TIOCOUTQ, &n) == 0)
4615 debug_printf("%d bytes remain in socket output buffer\n", n);
4619 /* Otherwise, we have an I/O error or a timeout other than after MAIL or
4620 ".", or some other transportation error. We defer all addresses and yield
4621 DEFER, except for the case of failed add_headers expansion, or a transport
4622 filter failure, when the yield should be ERROR, to stop it trying other
4627 #ifndef DISABLE_PIPE_CONNECT
4628 /* If we were early-pipelinng and the actual EHLO response did not match
4629 the cached value we assumed, we could have detected it and passed a
4630 custom errno through to here. It would be nice to RSET and retry right
4631 away, but to reliably do that we eould need an extra synch point before
4632 we committed to data and that would discard half the gained roundrips.
4633 Or we could summarily drop the TCP connection. but that is also ugly.
4634 Instead, we ignore the possibility (having freshened the cache) and rely
4635 on the server telling us with a nonmessage error if we have tried to
4636 do something it no longer supports. */
4639 yield = (save_errno == ERRNO_CHHEADER_FAIL ||
4640 save_errno == ERRNO_FILTER_FAIL) ? ERROR : DEFER;
4644 set_errno(addrlist, save_errno, set_message, set_rc, pass_message, host,
4645 #ifdef EXPERIMENTAL_DSN_INFO
4646 sx->smtp_greeting, sx->helo_response,
4648 &sx->delivery_start);
4651 /* If all has gone well, send_quit will be set TRUE, implying we can end the
4652 SMTP session tidily. However, if there were too many addresses to send in one
4653 message (indicated by first_addr being non-NULL) we want to carry on with the
4654 rest of them. Also, it is desirable to send more than one message down the SMTP
4655 connection if there are several waiting, provided we haven't already sent so
4656 many as to hit the configured limit. The function transport_check_waiting looks
4657 for a waiting message and returns its id. Then transport_pass_socket tries to
4658 set up a continued delivery by passing the socket on to another process. The
4659 variable send_rset is FALSE if a message has just been successfully transferred.
4661 If we are already sending down a continued channel, there may be further
4662 addresses not yet delivered that are aimed at the same host, but which have not
4663 been passed in this run of the transport. In this case, continue_more will be
4664 true, and all we should do is send RSET if necessary, and return, leaving the
4667 However, if no address was disposed of, i.e. all addresses got 4xx errors, we
4668 do not want to continue with other messages down the same channel, because that
4669 can lead to looping between two or more messages, all with the same,
4670 temporarily failing address(es). [The retry information isn't updated yet, so
4671 new processes keep on trying.] We probably also don't want to try more of this
4672 message's addresses either.
4674 If we have started a TLS session, we have to end it before passing the
4675 connection to a new process. However, not all servers can handle this (Exim
4676 can), so we do not pass such a connection on if the host matches
4677 hosts_nopass_tls. */
4682 debug_printf("ok=%d send_quit=%d send_rset=%d continue_more=%d "
4683 "yield=%d first_address is %sNULL\n", sx->ok, sx->send_quit,
4684 sx->send_rset, f.continue_more, yield, sx->first_addr ? "not " : "");
4686 if (sx->completed_addr && sx->ok && sx->send_quit)
4687 #ifndef DISABLE_ESMTP_LIMITS
4688 if (mail_limit = continue_sequence >= sx->max_mail)
4691 debug_printf("reached limit %u for MAILs per conn\n", sx->max_mail);
4696 smtp_compare_t t_compare =
4697 {.tblock = tblock, .current_sender_address = sender_address};
4699 if ( sx->first_addr /* more addrs for this message */
4700 || f.continue_more /* more addrs for continued-host */
4701 || tcw_done && tcw /* more messages for host */
4704 ( tls_out.active.sock < 0 && !continue_proxy_cipher
4705 || verify_check_given_host(CUSS &ob->hosts_nopass_tls, host) != OK
4709 transport_check_waiting(tblock->name, host->name,
4710 sx->max_mail, new_message_id,
4711 (oicf)smtp_are_same_identities, (void*)&t_compare)
4718 if (! (sx->ok = smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0))
4720 msg = US string_sprintf("smtp send to %s [%s] failed: %s", host->name,
4721 host->address, strerror(errno));
4722 sx->send_quit = FALSE;
4724 else if (! (sx->ok = smtp_read_response(sx, sx->buffer, sizeof(sx->buffer),
4725 '2', ob->command_timeout)))
4728 sx->send_quit = check_response(host, &errno, 0, sx->buffer, &code, &msg,
4732 DEBUG(D_transport) debug_printf("H=%s [%s] %s\n",
4733 host->name, host->address, msg);
4737 /* Either RSET was not needed, or it succeeded */
4744 int socket_fd = sx->cctx.sock;
4746 if (sx->first_addr) /* More addresses still to be sent */
4747 { /* for this message */
4748 #ifndef DISABLE_ESMTP_LIMITS
4749 /* Any that we marked as skipped, reset to do now */
4750 for (address_item * a = sx->first_addr; a; a = a->next)
4751 if (a->transport_return == SKIP)
4752 a->transport_return = PENDING_DEFER;
4754 continue_sequence++; /* for consistency */
4755 clearflag(sx->first_addr, af_new_conn);
4756 setflag(sx->first_addr, af_cont_conn); /* Causes * in logging */
4757 pipelining_active = sx->pipelining_used; /* was cleared at DATA */
4761 /* Unless caller said it already has more messages listed for this host,
4762 pass the connection on to a new Exim process (below, the call to
4763 transport_pass_socket). If the caller has more ready, just return with
4764 the connection still open. */
4767 if (tls_out.active.sock >= 0)
4768 if ( f.continue_more
4769 || verify_check_given_host(CUSS &ob->hosts_noproxy_tls, host) == OK)
4771 /* Before passing the socket on, or returning to caller with it still
4772 open, we must shut down TLS. Not all MTAs allow for the continuation
4773 of the SMTP session when TLS is shut down. We test for this by sending
4774 a new EHLO. If we don't get a good response, we don't attempt to pass
4776 NB: TLS close is *required* per RFC 9266 when tls-exporter info has
4777 been used, which we do under TLSv1.3 for the gsasl SCRAM*PLUS methods.
4778 But we were always doing it anyway. */
4780 tls_close(sx->cctx.tls_ctx,
4781 sx->send_tlsclose ? TLS_SHUTDOWN_WAIT : TLS_SHUTDOWN_WONLY);
4782 sx->send_tlsclose = FALSE;
4783 sx->cctx.tls_ctx = NULL;
4784 tls_out.active.sock = -1;
4785 smtp_peer_options = smtp_peer_options_wrap;
4787 && smtp_write_command(sx, SCMD_FLUSH, "EHLO %s\r\n", sx->helo_data)
4789 && smtp_read_response(sx, sx->buffer, sizeof(sx->buffer),
4790 '2', ob->command_timeout);
4792 if (sx->ok && f.continue_more)
4793 goto TIDYUP; /* More addresses for another run */
4797 /* Set up a pipe for proxying TLS for the new transport process */
4799 smtp_peer_options |= OPTION_TLS;
4800 if ((sx->ok = socketpair(AF_UNIX, SOCK_STREAM, 0, pfd) == 0))
4803 set_errno(sx->first_addr, errno, US"internal allocation problem",
4805 # ifdef EXPERIMENTAL_DSN_INFO
4806 sx->smtp_greeting, sx->helo_response,
4808 &sx->delivery_start);
4812 if (f.continue_more)
4813 goto TIDYUP; /* More addresses for another run */
4815 /* If the socket is successfully passed, we mustn't send QUIT (or
4816 indeed anything!) from here. */
4818 /*XXX DSN_INFO: assume likely to do new HELO; but for greet we'll want to
4819 propagate it from the initial
4821 if (sx->ok && transport_pass_socket(tblock->name, host->name,
4822 host->address, new_message_id, socket_fd
4823 #ifndef DISABLE_ESMTP_LIMITS
4824 , sx->peer_limit_mail, sx->peer_limit_rcpt, sx->peer_limit_rcptdom
4828 sx->send_quit = FALSE;
4830 /* We have passed the client socket to a fresh transport process.
4831 If TLS is still active, we need to proxy it for the transport we
4832 just passed the baton to. Fork a child to to do it, and return to
4833 get logging done asap. Which way to place the work makes assumptions
4834 about post-fork prioritisation which may not hold on all platforms. */
4836 if (tls_out.active.sock >= 0)
4838 int pid = exim_fork(US"tls-proxy-interproc");
4839 if (pid == 0) /* child; fork again to disconnect totally */
4841 /* does not return */
4842 smtp_proxy_tls(sx->cctx.tls_ctx, sx->buffer, sizeof(sx->buffer), pfd,
4843 ob->command_timeout, host->name);
4846 if (pid > 0) /* parent */
4849 /* tidy the inter-proc to disconn the proxy proc */
4850 waitpid(pid, NULL, 0);
4851 tls_close(sx->cctx.tls_ctx, TLS_NO_SHUTDOWN);
4852 sx->cctx.tls_ctx = NULL;
4853 (void)close(sx->cctx.sock);
4855 continue_transport = NULL;
4856 continue_hostname = NULL;
4859 log_write(0, LOG_PANIC_DIE, "fork failed");
4865 /* If RSET failed and there are addresses left, they get deferred. */
4867 set_errno(sx->first_addr, errno, msg, DEFER, FALSE, host,
4868 #ifdef EXPERIMENTAL_DSN_INFO
4869 sx->smtp_greeting, sx->helo_response,
4871 &sx->delivery_start);
4875 /* End off tidily with QUIT unless the connection has died or the socket has
4876 been passed to another process. */
4880 { /* Use _MORE to get QUIT in FIN segment */
4881 (void)smtp_write_command(sx, SCMD_MORE, "QUIT\r\n");
4883 if (sx->cctx.tls_ctx && sx->send_tlsclose)
4885 # ifdef EXIM_TCP_CORK /* Use _CORK to get TLS Close Notify in FIN segment */
4886 (void) setsockopt(sx->cctx.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
4888 tls_shutdown_wr(sx->cctx.tls_ctx);
4889 sx->send_tlsclose = FALSE;
4896 /* Close the socket, and return the appropriate value, first setting
4897 works because the NULL setting is passed back to the calling process, and
4898 remote_max_parallel is forced to 1 when delivering over an existing connection,
4900 If all went well and continue_more is set, we shouldn't actually get here if
4901 there are further addresses, as the return above will be taken. However,
4902 writing RSET might have failed, or there may be other addresses whose hosts are
4903 specified in the transports, and therefore not visible at top level, in which
4904 case continue_more won't get set. */
4908 /* This flushes data queued in the socket, being the QUIT and any TLS Close,
4909 sending them along with the client FIN flag. Us (we hope) sending FIN first
4910 means we (client) take the TIME_WAIT state, so the server (which likely has a
4911 higher connection rate) does not have to. */
4913 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(shutdown)>>\n");
4914 shutdown(sx->cctx.sock, SHUT_WR);
4917 if (sx->send_quit || tcw_done && !tcw)
4919 /* Wait for (we hope) ack of our QUIT, and a server FIN. Discard any data
4920 received, then discard the socket. Any packet received after then, or receive
4921 data still in the socket, will get a RST - hence the pause/drain. */
4923 /* Reap the response to QUIT, timing out after one second */
4924 (void) smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', 1);
4926 if (sx->cctx.tls_ctx)
4930 /* Reap the TLS Close Notify from the server, timing out after one second */
4931 sigalrm_seen = FALSE;
4934 n = tls_read(sx->cctx.tls_ctx, sx->inbuffer, sizeof(sx->inbuffer));
4935 while (!sigalrm_seen && n > 0);
4938 if (sx->send_tlsclose)
4940 # ifdef EXIM_TCP_CORK
4941 (void) setsockopt(sx->cctx.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
4943 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WAIT);
4946 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WONLY);
4947 sx->cctx.tls_ctx = NULL;
4951 /* Drain any trailing data from the socket before close, to avoid sending a RST */
4953 if ( poll_one_fd(sx->cctx.sock, POLLIN, 20) != 0 /* 20ms */
4954 && fcntl(sx->cctx.sock, F_SETFL, O_NONBLOCK) == 0)
4955 for (int i = 16, n; /* drain socket */
4956 (n = read(sx->cctx.sock, sx->inbuffer, sizeof(sx->inbuffer))) > 0 && i > 0;
4957 i--) HDEBUG(D_transport|D_acl|D_v)
4960 debug_printf_indent(" SMTP(drain %d bytes)<< %.*s\n", n, m, sx->inbuffer);
4961 for (m = 0; m < n; m++)
4962 debug_printf("0x%02x\n", sx->inbuffer[m]);
4965 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
4966 (void)close(sx->cctx.sock);
4968 continue_transport = NULL;
4969 continue_hostname = NULL;
4970 smtp_debug_cmd_report();
4972 #ifndef DISABLE_EVENT
4973 (void) event_raise(tblock->event_action, US"tcp:close", NULL, NULL);
4979 sx->first_addr = NULL;
4980 for (address_item * a = sx->addrlist->next; a; a = a->next)
4981 if (a->transport_return == DANE)
4983 a->transport_return = PENDING_DEFER;
4984 if (!sx->first_addr)
4986 /* Remember the new start-point in the addrlist, for smtp_setup_conn()
4987 to get the domain string for SNI */
4990 clearflag(a, af_cont_conn);
4991 setflag(a, af_new_conn); /* clear * from logging */
4992 DEBUG(D_transport) debug_printf("DANE: go-around for %s\n", a->domain);
4995 continue_sequence = 1; /* for consistency */
5000 #ifndef DISABLE_ESMTP_LIMITS
5001 if (mail_limit && sx->first_addr)
5003 /* Reset the sequence count since we closed the connection. This is flagged
5004 on the pipe back to the delivery process so that a non-continued-conn delivery
5007 continue_sequence = 1; /* for consistency */
5008 clearflag(sx->first_addr, af_cont_conn);
5009 setflag(sx->first_addr, af_new_conn); /* clear * from logging */
5018 if (dane_held) for (address_item * a = sx->addrlist->next; a; a = a->next)
5019 if (a->transport_return == DANE)
5020 a->transport_return = PENDING_DEFER;
5028 /*************************************************
5029 * Closedown entry point *
5030 *************************************************/
5032 /* This function is called when exim is passed an open smtp channel
5033 from another incarnation, but the message which it has been asked
5034 to deliver no longer exists. The channel is on stdin.
5036 We might do fancy things like looking for another message to send down
5037 the channel, but if the one we sought has gone, it has probably been
5038 delivered by some other process that itself will seek further messages,
5039 so just close down our connection.
5041 Argument: pointer to the transport instance block
5046 smtp_transport_closedown(transport_instance *tblock)
5048 smtp_transport_options_block * ob = SOB tblock->options_block;
5049 client_conn_ctx cctx;
5050 smtp_context sx = {0};
5052 uschar inbuffer[4096];
5053 uschar outbuffer[16];
5055 /*XXX really we need an active-smtp-client ctx, rather than assuming stdout */
5056 cctx.sock = fileno(stdin);
5057 cctx.tls_ctx = cctx.sock == tls_out.active.sock ? tls_out.active.tls_ctx : NULL;
5059 sx.inblock.cctx = &cctx;
5060 sx.inblock.buffer = inbuffer;
5061 sx.inblock.buffersize = sizeof(inbuffer);
5062 sx.inblock.ptr = inbuffer;
5063 sx.inblock.ptrend = inbuffer;
5065 sx.outblock.cctx = &cctx;
5066 sx.outblock.buffersize = sizeof(outbuffer);
5067 sx.outblock.buffer = outbuffer;
5068 sx.outblock.ptr = outbuffer;
5069 sx.outblock.cmd_count = 0;
5070 sx.outblock.authenticating = FALSE;
5072 (void)smtp_write_command(&sx, SCMD_FLUSH, "QUIT\r\n");
5073 (void)smtp_read_response(&sx, buffer, sizeof(buffer), '2', ob->command_timeout);
5074 (void)close(cctx.sock);
5079 /*************************************************
5080 * Prepare addresses for delivery *
5081 *************************************************/
5083 /* This function is called to flush out error settings from previous delivery
5084 attempts to other hosts. It also records whether we got here via an MX record
5085 or not in the more_errno field of the address. We are interested only in
5086 addresses that are still marked DEFER - others may have got delivered to a
5087 previously considered IP address. Set their status to PENDING_DEFER to indicate
5088 which ones are relevant this time.
5091 addrlist the list of addresses
5092 host the host we are delivering to
5094 Returns: the first address for this delivery
5097 static address_item *
5098 prepare_addresses(address_item * addrlist, host_item * host)
5100 address_item * first_addr = NULL;
5101 for (address_item * addr = addrlist; addr; addr = addr->next)
5102 if (addr->transport_return == DEFER)
5104 if (!first_addr) first_addr = addr;
5105 addr->transport_return = PENDING_DEFER;
5106 addr->basic_errno = 0;
5107 addr->more_errno = host->mx >= 0 ? 'M' : 'A';
5108 addr->message = NULL;
5110 addr->cipher = NULL;
5111 addr->ourcert = NULL;
5112 addr->peercert = NULL;
5113 addr->peerdn = NULL;
5114 addr->ocsp = OCSP_NOT_REQ;
5115 addr->tlsver = NULL;
5117 #ifdef EXPERIMENTAL_DSN_INFO
5118 addr->smtp_greeting = NULL;
5119 addr->helo_response = NULL;
5127 /*************************************************
5128 * Main entry point *
5129 *************************************************/
5131 /* See local README for interface details. As this is a remote transport, it is
5132 given a chain of addresses to be delivered in one connection, if possible. It
5133 always returns TRUE, indicating that each address has its own independent
5134 status set, except if there is a setting up problem, in which case it returns
5138 smtp_transport_entry(
5139 transport_instance * tblock, /* data for this instantiation */
5140 address_item * addrlist) /* addresses we are working on */
5143 int hosts_defer = 0, hosts_fail = 0, hosts_looked_up = 0;
5144 int hosts_retry = 0, hosts_serial = 0, hosts_total = 0, total_hosts_tried = 0;
5145 BOOL expired = TRUE;
5146 uschar * expanded_hosts = NULL, * pistring;
5147 uschar * tid = string_sprintf("%s transport", tblock->name);
5148 smtp_transport_options_block * ob = SOB tblock->options_block;
5149 host_item * hostlist = addrlist->host_list, * host = NULL;
5153 debug_printf("%s transport entered\n", tblock->name);
5154 for (address_item * addr = addrlist; addr; addr = addr->next)
5155 debug_printf(" %s\n", addr->address);
5158 debug_printf("hostlist:\n");
5159 for (host_item * host = hostlist; host; host = host->next)
5160 debug_printf(" '%s' IP %s port %d\n", host->name, host->address, host->port);
5162 if (continue_hostname)
5163 debug_printf("already connected to %s [%s] (on fd %d)\n",
5164 continue_hostname, continue_host_address,
5165 cutthrough.cctx.sock >= 0 ? cutthrough.cctx.sock : 0);
5168 /* Check the restrictions on line length */
5170 if (max_received_linelength > ob->message_linelength_limit)
5173 gettimeofday(&now, NULL);
5175 for (address_item * addr = addrlist; addr; addr = addr->next)
5176 if (addr->transport_return == DEFER)
5177 addr->transport_return = PENDING_DEFER;
5179 set_errno_nohost(addrlist, ERRNO_SMTPFORMAT,
5180 US"message has lines too long for transport", FAIL, TRUE, &now);
5184 /* Set the flag requesting that these hosts be added to the waiting
5185 database if the delivery fails temporarily or if we are running with
5186 queue_smtp or a 2-stage queue run. This gets unset for certain
5187 kinds of error, typically those that are specific to the message. */
5189 update_waiting = TRUE;
5191 /* If a host list is not defined for the addresses - they must all have the
5192 same one in order to be passed to a single transport - or if the transport has
5193 a host list with hosts_override set, use the host list supplied with the
5194 transport. It is an error for this not to exist. */
5196 if (!hostlist || (ob->hosts_override && ob->hosts))
5200 addrlist->message = string_sprintf("%s transport called with no hosts set",
5202 addrlist->transport_return = PANIC;
5203 return FALSE; /* Only top address has status */
5206 DEBUG(D_transport) debug_printf("using the transport's hosts: %s\n",
5209 /* If the transport's host list contains no '$' characters, and we are not
5210 randomizing, it is fixed and therefore a chain of hosts can be built once
5211 and for all, and remembered for subsequent use by other calls to this
5212 transport. If, on the other hand, the host list does contain '$', or we are
5213 randomizing its order, we have to rebuild it each time. In the fixed case,
5214 as the hosts string will never be used again, it doesn't matter that we
5215 replace all the : characters with zeros. */
5219 uschar *s = ob->hosts;
5221 if (Ustrchr(s, '$'))
5223 if (!(expanded_hosts = expand_string(s)))
5225 addrlist->message = string_sprintf("failed to expand list of hosts "
5226 "\"%s\" in %s transport: %s", s, tblock->name, expand_string_message);
5227 addrlist->transport_return = f.search_find_defer ? DEFER : PANIC;
5228 return FALSE; /* Only top address has status */
5230 DEBUG(D_transport) debug_printf("expanded list of hosts \"%s\" to "
5231 "\"%s\"\n", s, expanded_hosts);
5235 if (ob->hosts_randomize) s = expanded_hosts = string_copy(s);
5239 log_write(0, LOG_MAIN|LOG_PANIC,
5240 "attempt to use tainted host list '%s' from '%s' in transport %s",
5241 s, ob->hosts, tblock->name);
5242 /* Avoid leaking info to an attacker */
5243 addrlist->message = US"internal configuration error";
5244 addrlist->transport_return = PANIC;
5248 host_build_hostlist(&hostlist, s, ob->hosts_randomize);
5250 /* Check that the expansion yielded something useful. */
5254 string_sprintf("%s transport has empty hosts setting", tblock->name);
5255 addrlist->transport_return = PANIC;
5256 return FALSE; /* Only top address has status */
5259 /* If there was no expansion of hosts, save the host list for
5262 if (!expanded_hosts) ob->hostlist = hostlist;
5265 /* This is not the first time this transport has been run in this delivery;
5266 the host list was built previously. */
5269 hostlist = ob->hostlist;
5272 /* The host list was supplied with the address. If hosts_randomize is set, we
5273 must sort it into a random order if it did not come from MX records and has not
5274 already been randomized (but don't bother if continuing down an existing
5277 else if (ob->hosts_randomize && hostlist->mx == MX_NONE && !continue_hostname)
5279 host_item *newlist = NULL;
5282 host_item *h = hostlist;
5283 hostlist = hostlist->next;
5285 h->sort_key = random_number(100);
5292 else if (h->sort_key < newlist->sort_key)
5299 host_item *hh = newlist;
5302 if (h->sort_key < hh->next->sort_key) break;
5310 hostlist = addrlist->host_list = newlist;
5313 /* Sort out the default port. */
5315 if (!smtp_get_port(ob->port, addrlist, &defport, tid)) return FALSE;
5317 /* For each host-plus-IP-address on the list:
5319 . If this is a continued delivery and the host isn't the one with the
5320 current connection, skip.
5322 . If the status is unusable (i.e. previously failed or retry checked), skip.
5324 . If no IP address set, get the address, either by turning the name into
5325 an address, calling gethostbyname if gethostbyname is on, or by calling
5326 the DNS. The DNS may yield multiple addresses, in which case insert the
5327 extra ones into the list.
5329 . Get the retry data if not previously obtained for this address and set the
5330 field which remembers the state of this address. Skip if the retry time is
5331 not reached. If not, remember whether retry data was found. The retry string
5332 contains both the name and the IP address.
5334 . Scan the list of addresses and mark those whose status is DEFER as
5335 PENDING_DEFER. These are the only ones that will be processed in this cycle
5338 . Make a delivery attempt - addresses marked PENDING_DEFER will be tried.
5339 Some addresses may be successfully delivered, others may fail, and yet
5340 others may get temporary errors and so get marked DEFER.
5342 . The return from the delivery attempt is OK if a connection was made and a
5343 valid SMTP dialogue was completed. Otherwise it is DEFER.
5345 . If OK, add a "remove" retry item for this host/IPaddress, if any.
5347 . If fail to connect, or other defer state, add a retry item.
5349 . If there are any addresses whose status is still DEFER, carry on to the
5350 next host/IPaddress, unless we have tried the number of hosts given
5351 by hosts_max_try or hosts_max_try_hardlimit; otherwise return. Note that
5352 there is some fancy logic for hosts_max_try that means its limit can be
5353 overstepped in some circumstances.
5355 If we get to the end of the list, all hosts have deferred at least one address,
5356 or not reached their retry times. If delay_after_cutoff is unset, it requests a
5357 delivery attempt to those hosts whose last try was before the arrival time of
5358 the current message. To cope with this, we have to go round the loop a second
5359 time. After that, set the status and error data for any addresses that haven't
5360 had it set already. */
5362 for (int cutoff_retry = 0;
5363 expired && cutoff_retry < (ob->delay_after_cutoff ? 1 : 2);
5366 host_item *nexthost = NULL;
5367 int unexpired_hosts_tried = 0;
5368 BOOL continue_host_tried = FALSE;
5370 retry_non_continued:
5371 for (host = hostlist;
5373 && unexpired_hosts_tried < ob->hosts_max_try
5374 && total_hosts_tried < ob->hosts_max_try_hardlimit;
5378 BOOL host_is_expired = FALSE, message_defer = FALSE, some_deferred = FALSE;
5379 address_item * first_addr = NULL;
5380 uschar * interface = NULL;
5381 uschar * retry_host_key = NULL, * retry_message_key = NULL;
5382 uschar * serialize_key = NULL;
5384 /* Deal slightly better with a possible Linux kernel bug that results
5385 in intermittent TFO-conn fails deep into the TCP flow. Bug 2907 tracks.
5386 Hack: Clear TFO option for any further hosts on this tpt run. */
5388 if (total_hosts_tried > 0)
5390 DEBUG(D_transport|D_acl|D_v)
5391 debug_printf("Clearing TFO as not first host for message\n");
5392 ob->hosts_try_fastopen = US"";
5395 /* Default next host is next host. :-) But this can vary if the
5396 hosts_max_try limit is hit (see below). It may also be reset if a host
5397 address is looked up here (in case the host was multihomed). */
5399 nexthost = host->next;
5401 /* If the address hasn't yet been obtained from the host name, look it up
5402 now, unless the host is already marked as unusable. If it is marked as
5403 unusable, it means that the router was unable to find its IP address (in
5404 the DNS or wherever) OR we are in the 2nd time round the cutoff loop, and
5405 the lookup failed last time. We don't get this far if *all* MX records
5406 point to non-existent hosts; that is treated as a hard error.
5408 We can just skip this host entirely. When the hosts came from the router,
5409 the address will timeout based on the other host(s); when the address is
5410 looked up below, there is an explicit retry record added.
5412 Note that we mustn't skip unusable hosts if the address is not unset; they
5413 may be needed as expired hosts on the 2nd time round the cutoff loop. */
5417 int new_port, flags;
5419 if (host->status >= hstatus_unusable)
5421 DEBUG(D_transport) debug_printf("%s has no address and is unusable - skipping\n",
5426 DEBUG(D_transport) debug_printf("getting address for %s\n", host->name);
5428 /* The host name is permitted to have an attached port. Find it, and
5429 strip it from the name. Just remember it for now. */
5431 new_port = host_item_get_port(host);
5433 /* Count hosts looked up */
5437 /* Find by name if so configured, or if it's an IP address. We don't
5438 just copy the IP address, because we need the test-for-local to happen. */
5440 flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
5441 if (ob->dns_qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
5442 if (ob->dns_search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
5444 if (ob->gethostbyname || string_is_ip_address(host->name, NULL) != 0)
5445 rc = host_find_byname(host, NULL, flags, NULL, TRUE);
5447 rc = host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
5448 &ob->dnssec, /* domains for request/require */
5451 /* Update the host (and any additional blocks, resulting from
5452 multihoming) with a host-specific port, if any. */
5454 for (host_item * hh = host; hh != nexthost; hh = hh->next) hh->port = new_port;
5456 /* Failure to find the host at this time (usually DNS temporary failure)
5457 is really a kind of routing failure rather than a transport failure.
5458 Therefore we add a retry item of the routing kind, not to stop us trying
5459 to look this name up here again, but to ensure the address gets timed
5460 out if the failures go on long enough. A complete failure at this point
5461 commonly points to a configuration error, but the best action is still
5462 to carry on for the next host. */
5464 if (rc == HOST_FIND_AGAIN || rc == HOST_FIND_SECURITY || rc == HOST_FIND_FAILED)
5466 retry_add_item(addrlist, string_sprintf("R:%s", host->name), 0);
5468 if (rc == HOST_FIND_AGAIN) hosts_defer++; else hosts_fail++;
5469 DEBUG(D_transport) debug_printf("rc = %s for %s\n", (rc == HOST_FIND_AGAIN)?
5470 "HOST_FIND_AGAIN" : "HOST_FIND_FAILED", host->name);
5471 host->status = hstatus_unusable;
5473 for (address_item * addr = addrlist; addr; addr = addr->next)
5475 if (addr->transport_return != DEFER) continue;
5476 addr->basic_errno = ERRNO_UNKNOWNHOST;
5477 addr->message = string_sprintf(
5478 rc == HOST_FIND_SECURITY
5479 ? "lookup of IP address for %s was insecure"
5480 : "failed to lookup IP address for %s",
5486 /* If the host is actually the local host, we may have a problem, or
5487 there may be some cunning configuration going on. In the problem case,
5488 log things and give up. The default transport status is already DEFER. */
5490 if (rc == HOST_FOUND_LOCAL && !ob->allow_localhost)
5492 for (address_item * addr = addrlist; addr; addr = addr->next)
5494 addr->basic_errno = ERRNO_HOST_IS_LOCAL;
5495 addr->message = string_sprintf("%s transport found host %s to be "
5496 "local", tblock->name, host->name);
5500 } /* End of block for IP address lookup */
5502 /* If this is a continued delivery, we are interested only in the host
5503 which matches the name of the existing open channel. The check is put
5504 here after the local host lookup, in case the name gets expanded as a
5505 result of the lookup. Set expired FALSE, to save the outer loop executing
5508 if (continue_hostname)
5509 if ( Ustrcmp(continue_hostname, host->name) != 0
5510 || Ustrcmp(continue_host_address, host->address) != 0
5514 continue; /* With next host */
5517 continue_host_tried = TRUE;
5519 /* Reset the default next host in case a multihomed host whose addresses
5520 are not looked up till just above added to the host list. */
5522 nexthost = host->next;
5524 /* If queue_smtp is set (-odqs or the first part of a 2-stage run), or the
5525 domain is in queue_smtp_domains, we don't actually want to attempt any
5526 deliveries. When doing a queue run, queue_smtp_domains is always unset. If
5527 there is a lookup defer in queue_smtp_domains, proceed as if the domain
5528 were not in it. We don't want to hold up all SMTP deliveries! Except when
5529 doing a two-stage queue run, don't do this if forcing. */
5531 if ( (!f.deliver_force || f.queue_2stage)
5533 || match_isinlist(addrlist->domain,
5534 CUSS &queue_smtp_domains, 0,
5535 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK)
5538 DEBUG(D_transport) debug_printf("first-pass routing only\n");
5540 for (address_item * addr = addrlist; addr; addr = addr->next)
5541 if (addr->transport_return == DEFER)
5542 addr->message = US"first-pass only routing due to -odqs, "
5543 "queue_smtp_domains or control=queue";
5544 continue; /* With next host */
5547 /* Count hosts being considered - purely for an intelligent comment
5548 if none are usable. */
5552 /* Set $host and $host address now in case they are needed for the
5553 interface expansion or the serialize_hosts check; they remain set if an
5554 actual delivery happens. */
5556 deliver_host = host->name;
5557 deliver_host_address = host->address;
5558 lookup_dnssec_authenticated = host->dnssec == DS_YES ? US"yes"
5559 : host->dnssec == DS_NO ? US"no"
5562 /* Set up a string for adding to the retry key if the port number is not
5563 the standard SMTP port. A host may have its own port setting that overrides
5566 pistring = string_sprintf(":%d", host->port == PORT_NONE
5567 ? defport : host->port);
5568 if (Ustrcmp(pistring, ":25") == 0) pistring = US"";
5570 /* Select IPv4 or IPv6, and choose an outgoing interface. If the interface
5571 string is set, even if constant (as different transports can have different
5572 constant settings), we must add it to the key that is used for retries,
5573 because connections to the same host from a different interface should be
5574 treated separately. */
5576 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
5579 GET_OPTION("interface");
5580 if ((s = ob->interface) && *s)
5582 if (!smtp_get_interface(s, host_af, addrlist, &interface, tid))
5584 pistring = string_sprintf("%s/%s", pistring, interface);
5588 /* The first time round the outer loop, check the status of the host by
5589 inspecting the retry data. The second time round, we are interested only
5590 in expired hosts that haven't been tried since this message arrived. */
5592 if (cutoff_retry == 0)
5595 /* Ensure the status of the address is set by checking retry data if
5596 necessary. There may be host-specific retry data (applicable to all
5597 messages) and also data for retries of a specific message at this host.
5598 If either of these retry records are actually read, the keys used are
5599 returned to save recomputing them later. */
5601 if (exp_bool(addrlist, US"transport", tblock->name, D_transport,
5602 US"retry_include_ip_address", ob->retry_include_ip_address,
5603 ob->expand_retry_include_ip_address, &incl_ip) != OK)
5604 continue; /* with next host */
5606 host_is_expired = retry_check_address(addrlist->domain, host, pistring,
5607 incl_ip, &retry_host_key, &retry_message_key);
5609 DEBUG(D_transport) debug_printf("%s [%s]%s retry-status = %s\n", host->name,
5610 host->address ? host->address : US"", pistring,
5611 host->status == hstatus_usable ? "usable"
5612 : host->status == hstatus_unusable ? "unusable"
5613 : host->status == hstatus_unusable_expired ? "unusable (expired)" : "?");
5615 /* Skip this address if not usable at this time, noting if it wasn't
5616 actually expired, both locally and in the address. */
5618 switch (host->status)
5620 case hstatus_unusable:
5622 setflag(addrlist, af_retry_skipped);
5625 case hstatus_unusable_expired:
5628 case hwhy_retry: hosts_retry++; break;
5629 case hwhy_failed: hosts_fail++; break;
5631 case hwhy_deferred: hosts_defer++; break;
5634 /* If there was a retry message key, implying that previously there
5635 was a message-specific defer, we don't want to update the list of
5636 messages waiting for these hosts. */
5638 if (retry_message_key) update_waiting = FALSE;
5639 continue; /* With the next host or IP address */
5643 /* Second time round the loop: if the address is set but expired, and
5644 the message is newer than the last try, let it through. */
5649 || host->status != hstatus_unusable_expired
5650 || host->last_try > received_time.tv_sec)
5652 DEBUG(D_transport) debug_printf("trying expired host %s [%s]%s\n",
5653 host->name, host->address, pistring);
5654 host_is_expired = TRUE;
5657 /* Setting "expired=FALSE" doesn't actually mean not all hosts are expired;
5658 it remains TRUE only if all hosts are expired and none are actually tried.
5663 /* If this host is listed as one to which access must be serialized,
5664 see if another Exim process has a connection to it, and if so, skip
5665 this host. If not, update the database to record our connection to it
5666 and remember this for later deletion. Do not do any of this if we are
5667 sending the message down a pre-existing connection. */
5669 if ( !continue_hostname
5670 && verify_check_given_host(CUSS &ob->serialize_hosts, host) == OK)
5672 serialize_key = string_sprintf("host-serialize-%s", host->name);
5673 if (!enq_start(serialize_key, 1))
5676 debug_printf("skipping host %s because another Exim process "
5677 "is connected to it\n", host->name);
5683 /* OK, we have an IP address that is not waiting for its retry time to
5684 arrive (it might be expired) OR (second time round the loop) we have an
5685 expired host that hasn't been tried since the message arrived. Have a go
5686 at delivering the message to it. First prepare the addresses by flushing
5687 out the result of previous attempts, and finding the first address that
5688 is still to be delivered. */
5690 if (!(first_addr = prepare_addresses(addrlist, host)))
5692 /* Obscure situation; at least one case (bug 3059, fixed) where
5693 a previous host try returned DEFER, but having moved all
5694 recipients away from DEFER (the waiting-to-be-done state). */
5695 DEBUG(D_transport) debug_printf("no pending recipients\n");
5699 DEBUG(D_transport) debug_printf("delivering %s to %s [%s] (%s%s)\n",
5700 message_id, host->name, host->address, addrlist->address,
5701 addrlist->next ? ", ..." : "");
5703 set_process_info("delivering %s to %s [%s]%s (%s%s)",
5704 message_id, host->name, host->address, pistring, addrlist->address,
5705 addrlist->next ? ", ..." : "");
5707 /* This is not for real; don't do the delivery. If there are
5708 any remaining hosts, list them. */
5713 gettimeofday(&now, NULL);
5714 set_errno_nohost(addrlist, 0, NULL, OK, FALSE, &now);
5715 for (address_item * addr = addrlist; addr; addr = addr->next)
5717 addr->host_used = host;
5718 addr->special_action = '*';
5719 addr->message = US"delivery bypassed by -N option";
5723 debug_printf("*** delivery by %s transport bypassed by -N option\n"
5724 "*** host and remaining hosts:\n", tblock->name);
5725 for (host_item * host2 = host; host2; host2 = host2->next)
5726 debug_printf(" %s [%s]\n", host2->name,
5727 host2->address ? host2->address : US"unset");
5732 /* This is for real. If the host is expired, we don't count it for
5733 hosts_max_retry. This ensures that all hosts must expire before an address
5734 is timed out, unless hosts_max_try_hardlimit (which protects against
5735 lunatic DNS configurations) is reached.
5737 If the host is not expired and we are about to hit the hosts_max_retry
5738 limit, check to see if there is a subsequent hosts with a different MX
5739 value. If so, make that the next host, and don't count this one. This is a
5740 heuristic to make sure that different MXs do get tried. With a normal kind
5741 of retry rule, they would get tried anyway when the earlier hosts were
5742 delayed, but if the domain has a "retry every time" type of rule - as is
5743 often used for the the very large ISPs, that won't happen. */
5748 /* Make a copy of the host if it is local to this invocation
5749 of the transport. */
5753 thost = store_get(sizeof(host_item), GET_UNTAINTED);
5755 thost->name = string_copy(host->name);
5756 thost->address = string_copy(host->address);
5761 if (!host_is_expired && ++unexpired_hosts_tried >= ob->hosts_max_try)
5764 debug_printf("hosts_max_try limit reached with this host\n");
5765 for (host_item * h = host; h; h = h->next) if (h->mx != host->mx)
5768 unexpired_hosts_tried--;
5769 DEBUG(D_transport) debug_printf("however, a higher MX host exists "
5770 "and will be tried\n");
5775 /* Attempt the delivery. */
5777 total_hosts_tried++;
5778 rc = smtp_deliver(addrlist, thost, host_af, defport, interface, tblock,
5779 &message_defer, FALSE);
5782 OK => connection made, each address contains its result;
5783 message_defer is set for message-specific defers (when all
5784 recipients are marked defer)
5785 DEFER => there was a non-message-specific delivery problem;
5786 ERROR => there was a problem setting up the arguments for a filter,
5787 or there was a problem with expanding added headers
5790 /* If the result is not OK, there was a non-message-specific problem.
5791 If the result is DEFER, we need to write to the logs saying what happened
5792 for this particular host, except in the case of authentication and TLS
5793 failures, where the log has already been written. If all hosts defer a
5794 general message is written at the end. */
5796 if (rc == DEFER && first_addr->basic_errno != ERRNO_AUTHFAIL
5797 && first_addr->basic_errno != ERRNO_TLSFAILURE)
5798 write_logs(host, first_addr->message, first_addr->basic_errno);
5800 #ifndef DISABLE_EVENT
5802 deferred_event_raise(first_addr, host, US"msg:host:defer");
5805 /* If STARTTLS was accepted, but there was a failure in setting up the
5806 TLS session (usually a certificate screwup), and the host is not in
5807 hosts_require_tls, and tls_tempfail_tryclear is true, try again, with
5808 TLS forcibly turned off. We have to start from scratch with a new SMTP
5809 connection. That's why the retry is done from here, not from within
5810 smtp_deliver(). [Rejections of STARTTLS itself don't screw up the
5811 session, so the in-clear transmission after those errors, if permitted,
5812 happens inside smtp_deliver().] */
5816 && first_addr->basic_errno == ERRNO_TLSFAILURE
5817 && ob->tls_tempfail_tryclear
5818 && verify_check_given_host(CUSS &ob->hosts_require_tls, host) != OK
5821 log_write(0, LOG_MAIN,
5822 "%s: delivering unencrypted to H=%s [%s] (not in hosts_require_tls)",
5823 first_addr->message, host->name, host->address);
5824 first_addr = prepare_addresses(addrlist, host);
5825 rc = smtp_deliver(addrlist, thost, host_af, defport, interface, tblock,
5826 &message_defer, TRUE);
5827 if (rc == DEFER && first_addr->basic_errno != ERRNO_AUTHFAIL)
5828 write_logs(host, first_addr->message, first_addr->basic_errno);
5829 # ifndef DISABLE_EVENT
5831 deferred_event_raise(first_addr, host, US"msg:host:defer");
5834 #endif /*DISABLE_TLS*/
5836 #ifndef DISABLE_EVENT
5837 /* If the last host gave a defer raise a per-message event */
5840 && unexpired_hosts_tried < ob->hosts_max_try
5841 && total_hosts_tried < ob->hosts_max_try_hardlimit
5843 && (message_defer || rc == DEFER)
5845 deferred_event_raise(first_addr, host, US"msg:defer");
5849 /* Delivery attempt finished */
5851 set_process_info("delivering %s: just tried %s [%s]%s for %s%s: result %s",
5852 message_id, host->name, host->address, pistring, addrlist->address,
5853 addrlist->next ? " (& others)" : "", rc_to_string(rc));
5855 /* Release serialization if set up */
5857 if (serialize_key) enq_end(serialize_key);
5859 /* If the result is DEFER, or if a host retry record is known to exist, we
5860 need to add an item to the retry chain for updating the retry database
5861 at the end of delivery. We only need to add the item to the top address,
5862 of course. Also, if DEFER, we mark the IP address unusable so as to skip it
5863 for any other delivery attempts using the same address. (It is copied into
5864 the unusable tree at the outer level, so even if different address blocks
5865 contain the same address, it still won't get tried again.) */
5867 if (rc == DEFER || retry_host_key)
5869 int delete_flag = rc != DEFER ? rf_delete : 0;
5870 if (!retry_host_key)
5873 if (exp_bool(addrlist, US"transport", tblock->name, D_transport,
5874 US"retry_include_ip_address", ob->retry_include_ip_address,
5875 ob->expand_retry_include_ip_address, &incl_ip) != OK)
5876 incl_ip = TRUE; /* error; use most-specific retry record */
5878 retry_host_key = incl_ip
5879 ? string_sprintf("T:%S:%s%s", host->name, host->address, pistring)
5880 : string_sprintf("T:%S%s", host->name, pistring);
5883 /* If a delivery of another message over an existing SMTP connection
5884 yields DEFER, we do NOT set up retry data for the host. This covers the
5885 case when there are delays in routing the addresses in the second message
5886 that are so long that the server times out. This is alleviated by not
5887 routing addresses that previously had routing defers when handling an
5888 existing connection, but even so, this case may occur (e.g. if a
5889 previously happily routed address starts giving routing defers). If the
5890 host is genuinely down, another non-continued message delivery will
5891 notice it soon enough. */
5893 if (delete_flag != 0 || !continue_hostname)
5894 retry_add_item(first_addr, retry_host_key, rf_host | delete_flag);
5896 /* We may have tried an expired host, if its retry time has come; ensure
5897 the status reflects the expiry for the benefit of any other addresses. */
5901 host->status = host_is_expired
5902 ? hstatus_unusable_expired : hstatus_unusable;
5903 host->why = hwhy_deferred;
5907 /* If message_defer is set (host was OK, but every recipient got deferred
5908 because of some message-specific problem), or if that had happened
5909 previously so that a message retry key exists, add an appropriate item
5910 to the retry chain. Note that if there was a message defer but now there is
5911 a host defer, the message defer record gets deleted. That seems perfectly
5912 reasonable. Also, stop the message from being remembered as waiting
5913 for specific hosts. */
5915 if (message_defer || retry_message_key)
5917 int delete_flag = message_defer ? 0 : rf_delete;
5918 if (!retry_message_key)
5921 if (exp_bool(addrlist, US"transport", tblock->name, D_transport,
5922 US"retry_include_ip_address", ob->retry_include_ip_address,
5923 ob->expand_retry_include_ip_address, &incl_ip) != OK)
5924 incl_ip = TRUE; /* error; use most-specific retry record */
5926 retry_message_key = incl_ip
5927 ? string_sprintf("T:%S:%s%s:%s", host->name, host->address, pistring,
5929 : string_sprintf("T:%S%s:%s", host->name, pistring, message_id);
5931 retry_add_item(addrlist, retry_message_key,
5932 rf_message | rf_host | delete_flag);
5933 update_waiting = FALSE;
5936 /* Any return other than DEFER (that is, OK or ERROR) means that the
5937 addresses have got their final statuses filled in for this host. In the OK
5938 case, see if any of them are deferred. */
5941 for (address_item * addr = addrlist; addr; addr = addr->next)
5942 if (addr->transport_return == DEFER)
5943 { some_deferred = TRUE; break; }
5945 /* If no addresses deferred or the result was ERROR, return. We do this for
5946 ERROR because a failing filter set-up or add_headers expansion is likely to
5947 fail for any host we try. */
5949 if (rc == ERROR || (rc == OK && !some_deferred))
5952 /* If the result was DEFER or some individual addresses deferred, let
5953 the loop run to try other hosts with the deferred addresses, except for the
5954 case when we were trying to deliver down an existing channel and failed.
5955 Don't try any other hosts in this case. */
5957 if (continue_hostname) break;
5959 /* If the whole delivery, or some individual addresses, were deferred and
5960 there are more hosts that could be tried, do not count this host towards
5961 the hosts_max_try limit if the age of the message is greater than the
5962 maximum retry time for this host. This means we may try try all hosts,
5963 ignoring the limit, when messages have been around for some time. This is
5964 important because if we don't try all hosts, the address will never time
5965 out. NOTE: this does not apply to hosts_max_try_hardlimit. */
5967 if ((rc == DEFER || some_deferred) && nexthost)
5970 retry_config * retry = retry_find_config(host->name, NULL, 0, 0);
5972 if (retry && retry->rules)
5974 retry_rule *last_rule;
5975 for (last_rule = retry->rules;
5977 last_rule = last_rule->next);
5978 timedout = time(NULL) - received_time.tv_sec > last_rule->timeout;
5980 else timedout = TRUE; /* No rule => timed out */
5984 unexpired_hosts_tried--;
5985 DEBUG(D_transport) debug_printf("temporary delivery error(s) override "
5986 "hosts_max_try (message older than host's retry time)\n");
5992 if (unexpired_hosts_tried >= ob->hosts_max_try)
5993 debug_printf("reached transport hosts_max_try limit %d\n",
5995 if (total_hosts_tried >= ob->hosts_max_try_hardlimit)
5996 debug_printf("reached transport hosts_max_try_hardlimit limit %d\n",
5997 ob->hosts_max_try_hardlimit);
6000 testharness_pause_ms(500); /* let server debug out */
6001 } /* End of loop for trying multiple hosts. */
6003 /* If we failed to find a matching host in the list, for an already-open
6004 connection, just close it and start over with the list. This can happen
6005 for routing that changes from run to run, or big multi-IP sites with
6008 if (continue_hostname && !continue_host_tried)
6010 int fd = cutthrough.cctx.sock >= 0 ? cutthrough.cctx.sock : 0;
6012 DEBUG(D_transport) debug_printf("no hosts match already-open connection\n");
6014 /* A TLS conn could be open for a cutthrough, but not for a plain continued-
6016 /*XXX doublecheck that! */
6018 if (cutthrough.cctx.sock >= 0 && cutthrough.is_tls)
6020 (void) tls_write(cutthrough.cctx.tls_ctx, US"QUIT\r\n", 6, FALSE);
6021 tls_close(cutthrough.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
6022 cutthrough.cctx.tls_ctx = NULL;
6023 cutthrough.is_tls = FALSE;
6027 (void) write(fd, US"QUIT\r\n", 6);
6030 cutthrough.cctx.sock = -1;
6031 continue_hostname = NULL;
6032 goto retry_non_continued;
6035 /* This is the end of the loop that repeats iff expired is TRUE and
6036 ob->delay_after_cutoff is FALSE. The second time round we will
6037 try those hosts that haven't been tried since the message arrived. */
6041 debug_printf("all IP addresses skipped or deferred at least one address\n");
6042 if (expired && !ob->delay_after_cutoff && cutoff_retry == 0)
6043 debug_printf("retrying IP addresses not tried since message arrived\n");
6048 /* Get here if all IP addresses are skipped or defer at least one address. In
6049 MUA wrapper mode, this will happen only for connection or other non-message-
6050 specific failures. Force the delivery status for all addresses to FAIL. */
6054 for (address_item * addr = addrlist; addr; addr = addr->next)
6055 addr->transport_return = FAIL;
6059 /* In the normal, non-wrapper case, add a standard message to each deferred
6060 address if there hasn't been an error, that is, if it hasn't actually been
6061 tried this time. The variable "expired" will be FALSE if any deliveries were
6062 actually tried, or if there was at least one host that was not expired. That
6063 is, it is TRUE only if no deliveries were tried and all hosts were expired. If
6064 a delivery has been tried, an error code will be set, and the failing of the
6065 message is handled by the retry code later.
6067 If queue_smtp is set, or this transport was called to send a subsequent message
6068 down an existing TCP/IP connection, and something caused the host not to be
6069 found, we end up here, but can detect these cases and handle them specially. */
6071 for (address_item * addr = addrlist; addr; addr = addr->next)
6073 /* If host is not NULL, it means that we stopped processing the host list
6074 because of hosts_max_try or hosts_max_try_hardlimit. In the former case, this
6075 means we need to behave as if some hosts were skipped because their retry
6076 time had not come. Specifically, this prevents the address from timing out.
6077 However, if we have hit hosts_max_try_hardlimit, we want to behave as if all
6078 hosts were tried. */
6081 if (total_hosts_tried >= ob->hosts_max_try_hardlimit)
6084 debug_printf("hosts_max_try_hardlimit reached: behave as if all "
6085 "hosts were tried\n");
6090 debug_printf("hosts_max_try limit caused some hosts to be skipped\n");
6091 setflag(addr, af_retry_skipped);
6094 if (f.queue_smtp) /* no deliveries attempted */
6096 addr->transport_return = DEFER;
6097 addr->basic_errno = 0;
6098 addr->message = US"SMTP delivery explicitly queued";
6101 else if ( addr->transport_return == DEFER
6102 && (addr->basic_errno == ERRNO_UNKNOWNERROR || addr->basic_errno == 0)
6106 addr->basic_errno = ERRNO_HRETRY;
6107 if (continue_hostname)
6108 addr->message = US"no host found for existing SMTP connection";
6111 setflag(addr, af_pass_message); /* This is not a security risk */
6112 addr->message = string_sprintf(
6113 "all hosts%s have been failing for a long time %s",
6114 addr->domain ? string_sprintf(" for '%s'", addr->domain) : US"",
6115 ob->delay_after_cutoff
6116 ? US"(and retry time not reached)"
6117 : US"and were last tried after this message arrived");
6119 /* If we are already using fallback hosts, or there are no fallback hosts
6120 defined, convert the result to FAIL to cause a bounce. */
6122 if (addr->host_list == addr->fallback_hosts || !addr->fallback_hosts)
6123 addr->transport_return = FAIL;
6128 if (hosts_retry == hosts_total)
6129 s = "retry time not reached for any host%s";
6130 else if (hosts_fail == hosts_total)
6131 s = "all host address lookups%s failed permanently";
6132 else if (hosts_defer == hosts_total)
6133 s = "all host address lookups%s failed temporarily";
6134 else if (hosts_serial == hosts_total)
6135 s = "connection limit reached for all hosts%s";
6136 else if (hosts_fail+hosts_defer == hosts_total)
6137 s = "all host address lookups%s failed";
6139 s = "some host address lookups failed and retry time "
6140 "not reached for other hosts or connection limit reached%s";
6142 addr->message = string_sprintf(s,
6143 addr->domain ? string_sprintf(" for '%s'", addr->domain) : US"");
6148 /* Update the database which keeps information about which messages are waiting
6149 for which hosts to become available. For some message-specific errors, the
6150 update_waiting flag is turned off because we don't want follow-on deliveries in
6151 those cases. If this transport instance is explicitly limited to one message
6152 per connection then follow-on deliveries are not possible and there's no need
6153 to create/update the per-transport wait-<transport_name> database. */
6155 if (update_waiting && tblock->connection_max_messages != 1)
6156 transport_update_waiting(hostlist, tblock->name);
6160 DEBUG(D_transport) debug_printf("Leaving %s transport\n", tblock->name);
6162 return TRUE; /* Each address has its status */
6165 #endif /*!MACRO_PREDEF*/
6168 /* End of transport/smtp.c */