1 /* $Cambridge: exim/src/src/verify.c,v 1.39 2006/09/25 11:25:37 ph10 Exp $ */
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
7 /* Copyright (c) University of Cambridge 1995 - 2006 */
8 /* See the file NOTICE for conditions of use and distribution. */
10 /* Functions concerned with verifying things. The original code for callout
11 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
17 /* Structure for caching DNSBL lookups */
19 typedef struct dnsbl_cache_block {
27 /* Anchor for DNSBL cache */
29 static tree_node *dnsbl_cache = NULL;
33 /*************************************************
34 * Retrieve a callout cache record *
35 *************************************************/
37 /* If a record exists, check whether it has expired.
40 dbm_file an open hints file
42 type "address" or "domain"
43 positive_expire expire time for positive records
44 negative_expire expire time for negative records
46 Returns: the cache record if a non-expired one exists, else NULL
49 static dbdata_callout_cache *
50 get_callout_cache_record(open_db *dbm_file, uschar *key, uschar *type,
51 int positive_expire, int negative_expire)
56 dbdata_callout_cache *cache_record;
58 cache_record = dbfn_read_with_length(dbm_file, key, &length);
60 if (cache_record == NULL)
62 HDEBUG(D_verify) debug_printf("callout cache: no %s record found\n", type);
66 /* We treat a record as "negative" if its result field is not positive, or if
67 it is a domain record and the postmaster field is negative. */
69 negative = cache_record->result != ccache_accept ||
70 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
71 expire = negative? negative_expire : positive_expire;
74 if (now - cache_record->time_stamp > expire)
76 HDEBUG(D_verify) debug_printf("callout cache: %s record expired\n", type);
80 /* If this is a non-reject domain record, check for the obsolete format version
81 that doesn't have the postmaster and random timestamps, by looking at the
82 length. If so, copy it to a new-style block, replicating the record's
83 timestamp. Then check the additional timestamps. (There's no point wasting
84 effort if connections are rejected.) */
86 if (type[0] == 'd' && cache_record->result != ccache_reject)
88 if (length == sizeof(dbdata_callout_cache_obs))
90 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
91 memcpy(new, cache_record, length);
92 new->postmaster_stamp = new->random_stamp = new->time_stamp;
96 if (now - cache_record->postmaster_stamp > expire)
97 cache_record->postmaster_result = ccache_unknown;
99 if (now - cache_record->random_stamp > expire)
100 cache_record->random_result = ccache_unknown;
103 HDEBUG(D_verify) debug_printf("callout cache: found %s record\n", type);
109 /*************************************************
110 * Do callout verification for an address *
111 *************************************************/
113 /* This function is called from verify_address() when the address has routed to
114 a host list, and a callout has been requested. Callouts are expensive; that is
115 why a cache is used to improve the efficiency.
118 addr the address that's been routed
119 host_list the list of hosts to try
120 tf the transport feedback block
122 ifstring "interface" option from transport, or NULL
123 portstring "port" option from transport, or NULL
124 protocolstring "protocol" option from transport, or NULL
125 callout the per-command callout timeout
126 callout_overall the overall callout timeout (if < 0 use 4*callout)
127 callout_connect the callout connection timeout (if < 0 use callout)
128 options the verification options - these bits are used:
129 vopt_is_recipient => this is a recipient address
130 vopt_callout_no_cache => don't use callout cache
131 vopt_callout_fullpm => if postmaster check, do full one
132 vopt_callout_random => do the "random" thing
133 vopt_callout_recipsender => use real sender for recipient
134 vopt_callout_recippmaster => use postmaster for recipient
135 se_mailfrom MAIL FROM address for sender verify; NULL => ""
136 pm_mailfrom if non-NULL, do the postmaster check with this sender
138 Returns: OK/FAIL/DEFER
142 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
143 int callout, int callout_overall, int callout_connect, int options,
144 uschar *se_mailfrom, uschar *pm_mailfrom)
146 BOOL is_recipient = (options & vopt_is_recipient) != 0;
147 BOOL callout_no_cache = (options & vopt_callout_no_cache) != 0;
148 BOOL callout_random = (options & vopt_callout_random) != 0;
151 int old_domain_cache_result = ccache_accept;
154 uschar *from_address;
155 uschar *random_local_part = NULL;
156 uschar *save_deliver_domain = deliver_domain;
157 uschar **failure_ptr = is_recipient?
158 &recipient_verify_failure : &sender_verify_failure;
160 open_db *dbm_file = NULL;
161 dbdata_callout_cache new_domain_record;
162 dbdata_callout_cache_address new_address_record;
164 time_t callout_start_time;
166 new_domain_record.result = ccache_unknown;
167 new_domain_record.postmaster_result = ccache_unknown;
168 new_domain_record.random_result = ccache_unknown;
170 memset(&new_address_record, 0, sizeof(new_address_record));
172 /* For a recipient callout, the key used for the address cache record must
173 include the sender address if we are using the real sender in the callout,
174 because that may influence the result of the callout. */
176 address_key = addr->address;
181 if ((options & vopt_callout_recipsender) != 0)
183 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
184 from_address = sender_address;
186 else if ((options & vopt_callout_recippmaster) != 0)
188 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
189 qualify_domain_sender);
190 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
194 /* For a sender callout, we must adjust the key if the mailfrom address is not
199 from_address = (se_mailfrom == NULL)? US"" : se_mailfrom;
200 if (from_address[0] != 0)
201 address_key = string_sprintf("%s/<%s>", addr->address, from_address);
204 /* Open the callout cache database, it it exists, for reading only at this
205 stage, unless caching has been disabled. */
207 if (callout_no_cache)
209 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
211 else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
213 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
216 /* If a cache database is available see if we can avoid the need to do an
217 actual callout by making use of previously-obtained data. */
219 if (dbm_file != NULL)
221 dbdata_callout_cache_address *cache_address_record;
222 dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
223 addr->domain, US"domain",
224 callout_cache_domain_positive_expire,
225 callout_cache_domain_negative_expire);
227 /* If an unexpired cache record was found for this domain, see if the callout
228 process can be short-circuited. */
230 if (cache_record != NULL)
232 /* In most cases, if an early command (up to and including MAIL FROM:<>)
233 was rejected, there is no point carrying on. The callout fails. However, if
234 we are doing a recipient verification with use_sender or use_postmaster
235 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
236 will be using a non-empty sender. We have to remember this situation so as
237 not to disturb the cached domain value if this whole verification succeeds
238 (we don't want it turning into "accept"). */
240 old_domain_cache_result = cache_record->result;
242 if (cache_record->result == ccache_reject ||
243 (*from_address == 0 && cache_record->result == ccache_reject_mfnull))
245 setflag(addr, af_verify_nsfail);
247 debug_printf("callout cache: domain gave initial rejection, or "
248 "does not accept HELO or MAIL FROM:<>\n");
249 setflag(addr, af_verify_nsfail);
250 addr->user_message = US"(result of an earlier callout reused).";
252 *failure_ptr = US"mail";
256 /* If a previous check on a "random" local part was accepted, we assume
257 that the server does not do any checking on local parts. There is therefore
258 no point in doing the callout, because it will always be successful. If a
259 random check previously failed, arrange not to do it again, but preserve
260 the data in the new record. If a random check is required but hasn't been
261 done, skip the remaining cache processing. */
263 if (callout_random) switch(cache_record->random_result)
267 debug_printf("callout cache: domain accepts random addresses\n");
268 goto END_CALLOUT; /* Default yield is OK */
272 debug_printf("callout cache: domain rejects random addresses\n");
273 callout_random = FALSE;
274 new_domain_record.random_result = ccache_reject;
275 new_domain_record.random_stamp = cache_record->random_stamp;
280 debug_printf("callout cache: need to check random address handling "
281 "(not cached or cache expired)\n");
285 /* If a postmaster check is requested, but there was a previous failure,
286 there is again no point in carrying on. If a postmaster check is required,
287 but has not been done before, we are going to have to do a callout, so skip
288 remaining cache processing. */
290 if (pm_mailfrom != NULL)
292 if (cache_record->postmaster_result == ccache_reject)
294 setflag(addr, af_verify_pmfail);
296 debug_printf("callout cache: domain does not accept "
297 "RCPT TO:<postmaster@domain>\n");
299 *failure_ptr = US"postmaster";
300 setflag(addr, af_verify_pmfail);
301 addr->user_message = US"(result of earlier verification reused).";
304 if (cache_record->postmaster_result == ccache_unknown)
307 debug_printf("callout cache: need to check RCPT "
308 "TO:<postmaster@domain> (not cached or cache expired)\n");
312 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
313 postmaster check if the address itself has to be checked. Also ensure
314 that the value in the cache record is preserved (with its old timestamp).
317 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
318 "TO:<postmaster@domain>\n");
320 new_domain_record.postmaster_result = ccache_accept;
321 new_domain_record.postmaster_stamp = cache_record->postmaster_stamp;
325 /* We can't give a result based on information about the domain. See if there
326 is an unexpired cache record for this specific address (combined with the
327 sender address if we are doing a recipient callout with a non-empty sender).
330 cache_address_record = (dbdata_callout_cache_address *)
331 get_callout_cache_record(dbm_file,
332 address_key, US"address",
333 callout_cache_positive_expire,
334 callout_cache_negative_expire);
336 if (cache_address_record != NULL)
338 if (cache_address_record->result == ccache_accept)
341 debug_printf("callout cache: address record is positive\n");
346 debug_printf("callout cache: address record is negative\n");
347 addr->user_message = US"Previous (cached) callout verification failure";
348 *failure_ptr = US"recipient";
354 /* Close the cache database while we actually do the callout for real. */
357 dbfn_close(dbm_file);
361 /* The information wasn't available in the cache, so we have to do a real
362 callout and save the result in the cache for next time, unless no_cache is set,
363 or unless we have a previously cached negative random result. If we are to test
364 with a random local part, ensure that such a local part is available. If not,
365 log the fact, but carry on without randomming. */
367 if (callout_random && callout_random_local_part != NULL)
369 random_local_part = expand_string(callout_random_local_part);
370 if (random_local_part == NULL)
371 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
372 "callout_random_local_part: %s", expand_string_message);
375 /* Default the connect and overall callout timeouts if not set, and record the
376 time we are starting so that we can enforce it. */
378 if (callout_overall < 0) callout_overall = 4 * callout;
379 if (callout_connect < 0) callout_connect = callout;
380 callout_start_time = time(NULL);
382 /* Now make connections to the hosts and do real callouts. The list of hosts
383 is passed in as an argument. */
385 for (host = host_list; host != NULL && !done; host = host->next)
387 smtp_inblock inblock;
388 smtp_outblock outblock;
391 BOOL send_quit = TRUE;
392 uschar *active_hostname = smtp_active_hostname;
393 uschar *helo = US"HELO";
394 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
395 uschar inbuffer[4096];
396 uschar outbuffer[1024];
397 uschar responsebuffer[4096];
399 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
400 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
402 /* Skip this host if we don't have an IP address for it. */
404 if (host->address == NULL)
406 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
411 /* Check the overall callout timeout */
413 if (time(NULL) - callout_start_time >= callout_overall)
415 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
419 /* Set IPv4 or IPv6 */
421 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
423 /* Expand and interpret the interface and port strings. The latter will not
424 be used if there is a host-specific port (e.g. from a manualroute router).
425 This has to be delayed till now, because they may expand differently for
426 different hosts. If there's a failure, log it, but carry on with the
429 deliver_host = host->name;
430 deliver_host_address = host->address;
431 deliver_domain = addr->domain;
433 if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
435 !smtp_get_port(tf->port, addr, &port, US"callout"))
436 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
439 /* Expand the helo_data string to find the host name to use. */
441 if (tf->helo_data != NULL)
443 uschar *s = expand_string(tf->helo_data);
444 if (active_hostname == NULL)
445 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
446 "helo_data value for callout: %s", expand_string_message);
447 else active_hostname = s;
450 deliver_host = deliver_host_address = NULL;
451 deliver_domain = save_deliver_domain;
453 /* Set HELO string according to the protocol */
455 if (Ustrcmp(tf->protocol, "lmtp") == 0) helo = US"LHLO";
457 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", interface, port);
459 /* Set up the buffer for reading SMTP response packets. */
461 inblock.buffer = inbuffer;
462 inblock.buffersize = sizeof(inbuffer);
463 inblock.ptr = inbuffer;
464 inblock.ptrend = inbuffer;
466 /* Set up the buffer for holding SMTP commands while pipelining */
468 outblock.buffer = outbuffer;
469 outblock.buffersize = sizeof(outbuffer);
470 outblock.ptr = outbuffer;
471 outblock.cmd_count = 0;
472 outblock.authenticating = FALSE;
474 /* Connect to the host; on failure, just loop for the next one, but we
475 set the error for the last one. Use the callout_connect timeout. */
477 inblock.sock = outblock.sock =
478 smtp_connect(host, host_af, port, interface, callout_connect, TRUE);
479 if (inblock.sock < 0)
481 addr->message = string_sprintf("could not connect to %s [%s]: %s",
482 host->name, host->address, strerror(errno));
486 /* Wait for initial response, and send HELO. The smtp_write_command()
487 function leaves its command in big_buffer. This is used in error responses.
488 Initialize it in case the connection is rejected. */
490 Ustrcpy(big_buffer, "initial connection");
493 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
495 smtp_write_command(&outblock, FALSE, "%s %s\r\n", helo,
496 active_hostname) >= 0 &&
497 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
500 /* Failure to accept HELO is cached; this blocks the whole domain for all
501 senders. I/O errors and defer responses are not cached. */
505 *failure_ptr = US"mail"; /* At or before MAIL */
506 if (errno == 0 && responsebuffer[0] == '5')
508 setflag(addr, af_verify_nsfail);
509 new_domain_record.result = ccache_reject;
513 /* Send the MAIL command */
516 smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>\r\n",
517 from_address) >= 0 &&
518 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
521 /* If the host does not accept MAIL FROM:<>, arrange to cache this
522 information, but again, don't record anything for an I/O error or a defer. Do
523 not cache rejections of MAIL when a non-empty sender has been used, because
524 that blocks the whole domain for all senders. */
528 *failure_ptr = US"mail"; /* At or before MAIL */
529 if (errno == 0 && responsebuffer[0] == '5')
531 setflag(addr, af_verify_nsfail);
532 if (from_address[0] == 0)
533 new_domain_record.result = ccache_reject_mfnull;
537 /* Otherwise, proceed to check a "random" address (if required), then the
538 given address, and the postmaster address (if required). Between each check,
539 issue RSET, because some servers accept only one recipient after MAIL
542 Before doing this, set the result in the domain cache record to "accept",
543 unless its previous value was ccache_reject_mfnull. In that case, the domain
544 rejects MAIL FROM:<> and we want to continue to remember that. When that is
545 the case, we have got here only in the case of a recipient verification with
546 a non-null sender. */
550 new_domain_record.result =
551 (old_domain_cache_result == ccache_reject_mfnull)?
552 ccache_reject_mfnull: ccache_accept;
554 /* Do the random local part check first */
556 if (random_local_part != NULL)
558 uschar randombuffer[1024];
560 smtp_write_command(&outblock, FALSE,
561 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part,
562 addr->domain) >= 0 &&
563 smtp_read_response(&inblock, randombuffer,
564 sizeof(randombuffer), '2', callout);
566 /* Remember when we last did a random test */
568 new_domain_record.random_stamp = time(NULL);
570 /* If accepted, we aren't going to do any further tests below. */
574 new_domain_record.random_result = ccache_accept;
577 /* Otherwise, cache a real negative response, and get back to the right
578 state to send RCPT. Unless there's some problem such as a dropped
579 connection, we expect to succeed, because the commands succeeded above. */
583 if (randombuffer[0] == '5')
584 new_domain_record.random_result = ccache_reject;
587 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
588 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
591 smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>\r\n",
592 from_address) >= 0 &&
593 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
596 else done = FALSE; /* Some timeout/connection problem */
599 /* If the host is accepting all local parts, as determined by the "random"
600 check, we don't need to waste time doing any further checking. */
602 if (new_domain_record.random_result != ccache_accept && done)
604 /* Get the rcpt_include_affixes flag from the transport if there is one,
605 but assume FALSE if there is not. */
608 smtp_write_command(&outblock, FALSE, "RCPT TO:<%.1000s>\r\n",
609 transport_rcpt_address(addr,
610 (addr->transport == NULL)? FALSE :
611 addr->transport->rcpt_include_affixes)) >= 0 &&
612 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
616 new_address_record.result = ccache_accept;
617 else if (errno == 0 && responsebuffer[0] == '5')
619 *failure_ptr = US"recipient";
620 new_address_record.result = ccache_reject;
623 /* Do postmaster check if requested; if a full check is required, we
624 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
626 if (done && pm_mailfrom != NULL)
629 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
630 smtp_read_response(&inblock, responsebuffer,
631 sizeof(responsebuffer), '2', callout) &&
633 smtp_write_command(&outblock, FALSE,
634 "MAIL FROM:<%s>\r\n", pm_mailfrom) >= 0 &&
635 smtp_read_response(&inblock, responsebuffer,
636 sizeof(responsebuffer), '2', callout) &&
638 /* First try using the current domain */
641 smtp_write_command(&outblock, FALSE,
642 "RCPT TO:<postmaster@%.1000s>\r\n", addr->domain) >= 0 &&
643 smtp_read_response(&inblock, responsebuffer,
644 sizeof(responsebuffer), '2', callout)
649 /* If that doesn't work, and a full check is requested,
650 try without the domain. */
653 (options & vopt_callout_fullpm) != 0 &&
654 smtp_write_command(&outblock, FALSE,
655 "RCPT TO:<postmaster>\r\n") >= 0 &&
656 smtp_read_response(&inblock, responsebuffer,
657 sizeof(responsebuffer), '2', callout)
660 /* Sort out the cache record */
662 new_domain_record.postmaster_stamp = time(NULL);
665 new_domain_record.postmaster_result = ccache_accept;
666 else if (errno == 0 && responsebuffer[0] == '5')
668 *failure_ptr = US"postmaster";
669 setflag(addr, af_verify_pmfail);
670 new_domain_record.postmaster_result = ccache_reject;
673 } /* Random not accepted */
674 } /* MAIL FROM: accepted */
676 /* For any failure of the main check, other than a negative response, we just
677 close the connection and carry on. We can identify a negative response by the
678 fact that errno is zero. For I/O errors it will be non-zero
680 Set up different error texts for logging and for sending back to the caller
681 as an SMTP response. Log in all cases, using a one-line format. For sender
682 callouts, give a full response to the caller, but for recipient callouts,
683 don't give the IP address because this may be an internal host whose identity
684 is not to be widely broadcast. */
688 if (errno == ETIMEDOUT)
690 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
695 if (*responsebuffer == 0) Ustrcpy(responsebuffer, US"connection dropped");
698 string_sprintf("response to \"%s\" from %s [%s] was: %s",
699 big_buffer, host->name, host->address,
700 string_printing(responsebuffer));
702 addr->user_message = is_recipient?
703 string_sprintf("Callout verification failed:\n%s", responsebuffer)
705 string_sprintf("Called: %s\nSent: %s\nResponse: %s",
706 host->address, big_buffer, responsebuffer);
708 /* Hard rejection ends the process */
710 if (responsebuffer[0] == '5') /* Address rejected */
718 /* End the SMTP conversation and close the connection. */
720 if (send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
721 (void)close(inblock.sock);
722 } /* Loop through all hosts, while !done */
724 /* If we get here with done == TRUE, a successful callout happened, and yield
725 will be set OK or FAIL according to the response to the RCPT command.
726 Otherwise, we looped through the hosts but couldn't complete the business.
727 However, there may be domain-specific information to cache in both cases.
729 The value of the result field in the new_domain record is ccache_unknown if
730 there was an error before or with MAIL FROM:, and errno was not zero,
731 implying some kind of I/O error. We don't want to write the cache in that case.
732 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
734 if (!callout_no_cache && new_domain_record.result != ccache_unknown)
736 if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
739 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
743 (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
744 (int)sizeof(dbdata_callout_cache));
745 HDEBUG(D_verify) debug_printf("wrote callout cache domain record:\n"
746 " result=%d postmaster=%d random=%d\n",
747 new_domain_record.result,
748 new_domain_record.postmaster_result,
749 new_domain_record.random_result);
753 /* If a definite result was obtained for the callout, cache it unless caching
758 if (!callout_no_cache && new_address_record.result != ccache_unknown)
760 if (dbm_file == NULL)
761 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
762 if (dbm_file == NULL)
764 HDEBUG(D_verify) debug_printf("no callout cache available\n");
768 (void)dbfn_write(dbm_file, address_key, &new_address_record,
769 (int)sizeof(dbdata_callout_cache_address));
770 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record\n",
771 (new_address_record.result == ccache_accept)? "positive" : "negative");
776 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
777 temporary error. If there was only one host, and a response was received, leave
778 it alone if supplying details. Otherwise, give a generic response. */
782 uschar *dullmsg = string_sprintf("Could not complete %s verify callout",
783 is_recipient? "recipient" : "sender");
786 if (host_list->next != NULL || addr->message == NULL) addr->message = dullmsg;
788 addr->user_message = (!smtp_return_error_details)? dullmsg :
789 string_sprintf("%s for <%s>.\n"
790 "The mail server(s) for the domain may be temporarily unreachable, or\n"
791 "they may be permanently unreachable from this server. In the latter case,\n%s",
792 dullmsg, addr->address,
794 "the address will never be accepted."
796 "you need to change the address or create an MX record for its domain\n"
797 "if it is supposed to be generally accessible from the Internet.\n"
798 "Talk to your mail administrator for details.");
800 /* Force a specific error code */
802 addr->basic_errno = ERRNO_CALLOUTDEFER;
805 /* Come here from within the cache-reading code on fast-track exit. */
808 if (dbm_file != NULL) dbfn_close(dbm_file);
814 /*************************************************
815 * Copy error to toplevel address *
816 *************************************************/
818 /* This function is used when a verify fails or defers, to ensure that the
819 failure or defer information is in the original toplevel address. This applies
820 when an address is redirected to a single new address, and the failure or
821 deferral happens to the child address.
824 vaddr the verify address item
825 addr the final address item
828 Returns: the value of YIELD
832 copy_error(address_item *vaddr, address_item *addr, int yield)
836 vaddr->message = addr->message;
837 vaddr->user_message = addr->user_message;
838 vaddr->basic_errno = addr->basic_errno;
839 vaddr->more_errno = addr->more_errno;
840 vaddr->p.address_data = addr->p.address_data;
848 /*************************************************
849 * Verify an email address *
850 *************************************************/
852 /* This function is used both for verification (-bv and at other times) and
853 address testing (-bt), which is indicated by address_test_mode being set.
856 vaddr contains the address to verify; the next field in this block
858 f if not NULL, write the result to this file
859 options various option bits:
860 vopt_fake_sender => this sender verify is not for the real
861 sender (it was verify=sender=xxxx or an address from a
862 header line) - rewriting must not change sender_address
863 vopt_is_recipient => this is a recipient address, otherwise
864 it's a sender address - this affects qualification and
865 rewriting and messages from callouts
866 vopt_qualify => qualify an unqualified address; else error
867 vopt_expn => called from SMTP EXPN command
868 vopt_success_on_redirect => when a new address is generated
869 the verification instantly succeeds
871 These ones are used by do_callout() -- the options variable
874 vopt_callout_fullpm => if postmaster check, do full one
875 vopt_callout_no_cache => don't use callout cache
876 vopt_callout_random => do the "random" thing
877 vopt_callout_recipsender => use real sender for recipient
878 vopt_callout_recippmaster => use postmaster for recipient
880 callout if > 0, specifies that callout is required, and gives timeout
881 for individual commands
882 callout_overall if > 0, gives overall timeout for the callout function;
883 if < 0, a default is used (see do_callout())
884 callout_connect the connection timeout for callouts
885 se_mailfrom when callout is requested to verify a sender, use this
886 in MAIL FROM; NULL => ""
887 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
888 thing and use this as the sender address (may be "")
890 routed if not NULL, set TRUE if routing succeeded, so we can
891 distinguish between routing failed and callout failed
893 Returns: OK address verified
894 FAIL address failed to verify
895 DEFER can't tell at present
899 verify_address(address_item *vaddr, FILE *f, int options, int callout,
900 int callout_overall, int callout_connect, uschar *se_mailfrom,
901 uschar *pm_mailfrom, BOOL *routed)
904 BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
905 BOOL is_recipient = (options & vopt_is_recipient) != 0;
906 BOOL expn = (options & vopt_expn) != 0;
907 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
910 int verify_type = expn? v_expn :
911 address_test_mode? v_none :
912 is_recipient? v_recipient : v_sender;
913 address_item *addr_list;
914 address_item *addr_new = NULL;
915 address_item *addr_remote = NULL;
916 address_item *addr_local = NULL;
917 address_item *addr_succeed = NULL;
918 uschar **failure_ptr = is_recipient?
919 &recipient_verify_failure : &sender_verify_failure;
920 uschar *ko_prefix, *cr;
921 uschar *address = vaddr->address;
923 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
925 /* Clear, just in case */
929 /* Set up a prefix and suffix for error message which allow us to use the same
930 output statements both in EXPN mode (where an SMTP response is needed) and when
931 debugging with an output file. */
935 ko_prefix = US"553 ";
938 else ko_prefix = cr = US"";
940 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
942 if (parse_find_at(address) == NULL)
944 if ((options & vopt_qualify) == 0)
947 fprintf(f, "%sA domain is required for \"%s\"%s\n", ko_prefix, address,
949 *failure_ptr = US"qualify";
952 address = rewrite_address_qualify(address, is_recipient);
957 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
958 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
961 /* Rewrite and report on it. Clear the domain and local part caches - these
962 may have been set by domains and local part tests during an ACL. */
964 if (global_rewrite_rules != NULL)
966 uschar *old = address;
967 address = rewrite_address(address, is_recipient, FALSE,
968 global_rewrite_rules, rewrite_existflags);
971 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
972 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
973 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
977 /* If this is the real sender address, we must update sender_address at
978 this point, because it may be referred to in the routers. */
980 if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
981 sender_address = address;
983 /* If the address was rewritten to <> no verification can be done, and we have
984 to return OK. This rewriting is permitted only for sender addresses; for other
985 addresses, such rewriting fails. */
987 if (address[0] == 0) return OK;
989 /* Save a copy of the sender address for re-instating if we change it to <>
990 while verifying a sender address (a nice bit of self-reference there). */
992 save_sender = sender_address;
994 /* Update the address structure with the possibly qualified and rewritten
995 address. Set it up as the starting address on the chain of new addresses. */
997 vaddr->address = address;
1000 /* We need a loop, because an address can generate new addresses. We must also
1001 cope with generated pipes and files at the top level. (See also the code and
1002 comment in deliver.c.) However, it is usually the case that the router for
1003 user's .forward files has its verify flag turned off.
1005 If an address generates more than one child, the loop is used only when
1006 full_info is set, and this can only be set locally. Remote enquiries just get
1007 information about the top level address, not anything that it generated. */
1009 while (addr_new != NULL)
1012 address_item *addr = addr_new;
1014 addr_new = addr->next;
1019 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1020 debug_printf("Considering %s\n", addr->address);
1023 /* Handle generated pipe, file or reply addresses. We don't get these
1024 when handling EXPN, as it does only one level of expansion. */
1026 if (testflag(addr, af_pfr))
1033 if (addr->address[0] == '>')
1035 allow = testflag(addr, af_allow_reply);
1036 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1040 allow = (addr->address[0] == '|')?
1041 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1042 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1045 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1046 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1047 "%s\n", addr->message);
1049 fprintf(f, "\n transport = %s\n", addr->transport->name);
1051 fprintf(f, " *** forbidden ***\n");
1056 /* Just in case some router parameter refers to it. */
1058 return_path = (addr->p.errors_address != NULL)?
1059 addr->p.errors_address : sender_address;
1061 /* Split the address into domain and local part, handling the %-hack if
1062 necessary, and then route it. While routing a sender address, set
1063 $sender_address to <> because that is what it will be if we were trying to
1064 send a bounce to the sender. */
1066 if (routed != NULL) *routed = FALSE;
1067 if ((rc = deliver_split_address(addr)) == OK)
1069 if (!is_recipient) sender_address = null_sender;
1070 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1071 &addr_succeed, verify_type);
1072 sender_address = save_sender; /* Put back the real sender */
1075 /* If routing an address succeeded, set the flag that remembers, for use when
1076 an ACL cached a sender verify (in case a callout fails). Then if routing set
1077 up a list of hosts or the transport has a host list, and the callout option
1078 is set, and we aren't in a host checking run, do the callout verification,
1079 and set another flag that notes that a callout happened. */
1083 if (routed != NULL) *routed = TRUE;
1086 host_item *host_list = addr->host_list;
1088 /* Make up some data for use in the case where there is no remote
1091 transport_feedback tf = {
1092 NULL, /* interface (=> any) */
1093 US"smtp", /* port */
1094 US"smtp", /* protocol */
1096 US"$smtp_active_hostname", /* helo_data */
1097 FALSE, /* hosts_override */
1098 FALSE, /* hosts_randomize */
1099 FALSE, /* gethostbyname */
1100 TRUE, /* qualify_single */
1101 FALSE /* search_parents */
1104 /* If verification yielded a remote transport, we want to use that
1105 transport's options, so as to mimic what would happen if we were really
1106 sending a message to this address. */
1108 if (addr->transport != NULL && !addr->transport->info->local)
1110 (void)(addr->transport->setup)(addr->transport, addr, &tf, 0, 0, NULL);
1112 /* If the transport has hosts and the router does not, or if the
1113 transport is configured to override the router's hosts, we must build a
1114 host list of the transport's hosts, and find the IP addresses */
1116 if (tf.hosts != NULL && (host_list == NULL || tf.hosts_override))
1119 uschar *save_deliver_domain = deliver_domain;
1120 uschar *save_deliver_localpart = deliver_localpart;
1122 host_list = NULL; /* Ignore the router's hosts */
1124 deliver_domain = addr->domain;
1125 deliver_localpart = addr->local_part;
1126 s = expand_string(tf.hosts);
1127 deliver_domain = save_deliver_domain;
1128 deliver_localpart = save_deliver_localpart;
1132 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1133 "\"%s\" in %s transport for callout: %s", tf.hosts,
1134 addr->transport->name, expand_string_message);
1138 uschar *canonical_name;
1139 host_item *host, *nexthost;
1140 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1142 /* Just ignore failures to find a host address. If we don't manage
1143 to find any addresses, the callout will defer. Note that more than
1144 one address may be found for a single host, which will result in
1145 additional host items being inserted into the chain. Hence we must
1146 save the next host first. */
1148 for (host = host_list; host != NULL; host = nexthost)
1150 nexthost = host->next;
1151 if (tf.gethostbyname ||
1152 string_is_ip_address(host->name, NULL) != 0)
1153 (void)host_find_byname(host, NULL, &canonical_name, TRUE);
1156 int flags = HOST_FIND_BY_A;
1157 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1158 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1159 (void)host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1160 &canonical_name, NULL);
1167 /* Can only do a callout if we have at least one host! If the callout
1168 fails, it will have set ${sender,recipient}_verify_failure. */
1170 if (host_list != NULL)
1172 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1173 if (host_checking && !host_checking_callout)
1176 debug_printf("... callout omitted by default when host testing\n"
1177 "(Use -bhc if you want the callouts to happen.)\n");
1181 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
1182 callout_connect, options, se_mailfrom, pm_mailfrom);
1187 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
1188 "transport provided a host list\n");
1193 /* Otherwise, any failure is a routing failure */
1195 else *failure_ptr = US"route";
1197 /* A router may return REROUTED if it has set up a child address as a result
1198 of a change of domain name (typically from widening). In this case we always
1199 want to continue to verify the new child. */
1201 if (rc == REROUTED) continue;
1203 /* Handle hard failures */
1210 fprintf(f, "%s%s %s", ko_prefix, address,
1211 address_test_mode? "is undeliverable" : "failed to verify");
1212 if (!expn && admin_user)
1214 if (addr->basic_errno > 0)
1215 fprintf(f, ": %s", strerror(addr->basic_errno));
1216 if (addr->message != NULL)
1217 fprintf(f, ":\n %s", addr->message);
1219 fprintf(f, "%s\n", cr);
1222 if (!full_info) return copy_error(vaddr, addr, FAIL);
1228 else if (rc == DEFER)
1233 fprintf(f, "%s%s cannot be resolved at this time", ko_prefix, address);
1234 if (!expn && admin_user)
1236 if (addr->basic_errno > 0)
1237 fprintf(f, ":\n %s", strerror(addr->basic_errno));
1238 if (addr->message != NULL)
1239 fprintf(f, ":\n %s", addr->message);
1240 else if (addr->basic_errno <= 0)
1241 fprintf(f, ":\n unknown error");
1244 fprintf(f, "%s\n", cr);
1246 if (!full_info) return copy_error(vaddr, addr, DEFER);
1247 else if (yield == OK) yield = DEFER;
1250 /* If we are handling EXPN, we do not want to continue to route beyond
1255 uschar *ok_prefix = US"250-";
1256 if (addr_new == NULL)
1258 if (addr_local == NULL && addr_remote == NULL)
1259 fprintf(f, "250 mail to <%s> is discarded\r\n", address);
1261 fprintf(f, "250 <%s>\r\n", address);
1263 else while (addr_new != NULL)
1265 address_item *addr2 = addr_new;
1266 addr_new = addr2->next;
1267 if (addr_new == NULL) ok_prefix = US"250 ";
1268 fprintf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
1273 /* Successful routing other than EXPN. */
1277 /* Handle successful routing when short info wanted. Otherwise continue for
1278 other (generated) addresses. Short info is the operational case. Full info
1279 can be requested only when debug_selector != 0 and a file is supplied.
1281 There is a conflict between the use of aliasing as an alternate email
1282 address, and as a sort of mailing list. If an alias turns the incoming
1283 address into just one address (e.g. J.Caesar->jc44) you may well want to
1284 carry on verifying the generated address to ensure it is valid when
1285 checking incoming mail. If aliasing generates multiple addresses, you
1286 probably don't want to do this. Exim therefore treats the generation of
1287 just a single new address as a special case, and continues on to verify the
1288 generated address. */
1290 if (!full_info && /* Stop if short info wanted AND */
1291 (((addr_new == NULL || /* No new address OR */
1292 addr_new->next != NULL || /* More than one new address OR */
1293 testflag(addr_new, af_pfr))) /* New address is pfr */
1295 (addr_new != NULL && /* At least one new address AND */
1296 success_on_redirect))) /* success_on_redirect is set */
1298 if (f != NULL) fprintf(f, "%s %s\n", address,
1299 address_test_mode? "is deliverable" : "verified");
1301 /* If we have carried on to verify a child address, we want the value
1302 of $address_data to be that of the child */
1304 vaddr->p.address_data = addr->p.address_data;
1308 } /* Loop for generated addresses */
1310 /* Display the full results of the successful routing, including any generated
1311 addresses. Control gets here only when full_info is set, which requires f not
1312 to be NULL, and this occurs only when a top-level verify is called with the
1313 debugging switch on.
1315 If there are no local and no remote addresses, and there were no pipes, files,
1316 or autoreplies, and there were no errors or deferments, the message is to be
1317 discarded, usually because of the use of :blackhole: in an alias file. */
1319 if (allok && addr_local == NULL && addr_remote == NULL)
1321 fprintf(f, "mail to %s is discarded\n", address);
1325 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
1327 while (addr_list != NULL)
1329 address_item *addr = addr_list;
1330 address_item *p = addr->parent;
1331 addr_list = addr->next;
1333 fprintf(f, "%s", CS addr->address);
1334 #ifdef EXPERIMENTAL_SRS
1335 if(addr->p.srs_sender)
1336 fprintf(f, " [srs = %s]", addr->p.srs_sender);
1339 /* If the address is a duplicate, show something about it. */
1341 if (!testflag(addr, af_pfr))
1344 if ((tnode = tree_search(tree_duplicates, addr->unique)) != NULL)
1345 fprintf(f, " [duplicate, would not be delivered]");
1346 else tree_add_duplicate(addr->unique, addr);
1349 /* Now show its parents */
1353 fprintf(f, "\n <-- %s", p->address);
1358 /* Show router, and transport */
1360 fprintf(f, "router = %s, ", addr->router->name);
1361 fprintf(f, "transport = %s\n", (addr->transport == NULL)? US"unset" :
1362 addr->transport->name);
1364 /* Show any hosts that are set up by a router unless the transport
1365 is going to override them; fiddle a bit to get a nice format. */
1367 if (addr->host_list != NULL && addr->transport != NULL &&
1368 !addr->transport->overrides_hosts)
1373 for (h = addr->host_list; h != NULL; h = h->next)
1375 int len = Ustrlen(h->name);
1376 if (len > maxlen) maxlen = len;
1377 len = (h->address != NULL)? Ustrlen(h->address) : 7;
1378 if (len > maxaddlen) maxaddlen = len;
1380 for (h = addr->host_list; h != NULL; h = h->next)
1382 int len = Ustrlen(h->name);
1383 fprintf(f, " host %s ", h->name);
1384 while (len++ < maxlen) fprintf(f, " ");
1385 if (h->address != NULL)
1387 fprintf(f, "[%s] ", h->address);
1388 len = Ustrlen(h->address);
1390 else if (!addr->transport->info->local) /* Omit [unknown] for local */
1392 fprintf(f, "[unknown] ");
1396 while (len++ < maxaddlen) fprintf(f," ");
1397 if (h->mx >= 0) fprintf(f, "MX=%d", h->mx);
1398 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
1399 if (h->status == hstatus_unusable) fprintf(f, " ** unusable **");
1406 /* Will be DEFER or FAIL if any one address has, only for full_info (which is
1407 the -bv or -bt case). */
1415 /*************************************************
1416 * Check headers for syntax errors *
1417 *************************************************/
1419 /* This function checks those header lines that contain addresses, and verifies
1420 that all the addresses therein are syntactially correct.
1423 msgptr where to put an error message
1430 verify_check_headers(uschar **msgptr)
1435 for (h = header_list; h != NULL; h = h->next)
1437 if (h->type != htype_from &&
1438 h->type != htype_reply_to &&
1439 h->type != htype_sender &&
1440 h->type != htype_to &&
1441 h->type != htype_cc &&
1442 h->type != htype_bcc)
1445 colon = Ustrchr(h->text, ':');
1447 while (isspace(*s)) s++;
1449 parse_allow_group = TRUE; /* Allow group syntax */
1451 /* Loop for multiple addresses in the header */
1455 uschar *ss = parse_find_address_end(s, FALSE);
1456 uschar *recipient, *errmess;
1457 int terminator = *ss;
1458 int start, end, domain;
1460 /* Temporarily terminate the string at this point, and extract the
1461 operative address within. */
1464 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
1467 /* Permit an unqualified address only if the message is local, or if the
1468 sending host is configured to be permitted to send them. */
1470 if (recipient != NULL && domain == 0)
1472 if (h->type == htype_from || h->type == htype_sender)
1474 if (!allow_unqualified_sender) recipient = NULL;
1478 if (!allow_unqualified_recipient) recipient = NULL;
1480 if (recipient == NULL) errmess = US"unqualified address not permitted";
1483 /* It's an error if no address could be extracted, except for the special
1484 case of an empty address. */
1486 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
1488 uschar *verb = US"is";
1493 /* Arrange not to include any white space at the end in the
1494 error message or the header name. */
1496 while (t > s && isspace(t[-1])) t--;
1497 while (tt > h->text && isspace(tt[-1])) tt--;
1499 /* Add the address that failed to the error message, since in a
1500 header with very many addresses it is sometimes hard to spot
1501 which one is at fault. However, limit the amount of address to
1502 quote - cases have been seen where, for example, a missing double
1503 quote in a humungous To: header creates an "address" that is longer
1504 than string_sprintf can handle. */
1513 *msgptr = string_printing(
1514 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
1515 errmess, tt - h->text, h->text, verb, len, s));
1520 /* Advance to the next address */
1522 s = ss + (terminator? 1:0);
1523 while (isspace(*s)) s++;
1524 } /* Next address */
1532 /*************************************************
1533 * Check for blind recipients *
1534 *************************************************/
1536 /* This function checks that every (envelope) recipient is mentioned in either
1537 the To: or Cc: header lines, thus detecting blind carbon copies.
1539 There are two ways of scanning that could be used: either scan the header lines
1540 and tick off the recipients, or scan the recipients and check the header lines.
1541 The original proposed patch did the former, but I have chosen to do the latter,
1542 because (a) it requires no memory and (b) will use fewer resources when there
1543 are many addresses in To: and/or Cc: and only one or two envelope recipients.
1546 Returns: OK if there are no blind recipients
1547 FAIL if there is at least one blind recipient
1551 verify_check_notblind(void)
1554 for (i = 0; i < recipients_count; i++)
1558 uschar *address = recipients_list[i].address;
1560 for (h = header_list; !found && h != NULL; h = h->next)
1564 if (h->type != htype_to && h->type != htype_cc) continue;
1566 colon = Ustrchr(h->text, ':');
1568 while (isspace(*s)) s++;
1570 parse_allow_group = TRUE; /* Allow group syntax */
1572 /* Loop for multiple addresses in the header */
1576 uschar *ss = parse_find_address_end(s, FALSE);
1577 uschar *recipient,*errmess;
1578 int terminator = *ss;
1579 int start, end, domain;
1581 /* Temporarily terminate the string at this point, and extract the
1582 operative address within. */
1585 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
1588 /* If we found a valid recipient that has a domain, compare it with the
1589 envelope recipient. Local parts are compared case-sensitively, domains
1590 case-insensitively. By comparing from the start with length "domain", we
1591 include the "@" at the end, which ensures that we are comparing the whole
1592 local part of each address. */
1594 if (recipient != NULL && domain != 0)
1596 found = Ustrncmp(recipient, address, domain) == 0 &&
1597 strcmpic(recipient + domain, address + domain) == 0;
1601 /* Advance to the next address */
1603 s = ss + (terminator? 1:0);
1604 while (isspace(*s)) s++;
1605 } /* Next address */
1606 } /* Next header (if found is false) */
1608 if (!found) return FAIL;
1609 } /* Next recipient */
1616 /*************************************************
1617 * Find if verified sender *
1618 *************************************************/
1620 /* Usually, just a single address is verified as the sender of the message.
1621 However, Exim can be made to verify other addresses as well (often related in
1622 some way), and this is useful in some environments. There may therefore be a
1623 chain of such addresses that have previously been tested. This function finds
1624 whether a given address is on the chain.
1626 Arguments: the address to be verified
1627 Returns: pointer to an address item, or NULL
1631 verify_checked_sender(uschar *sender)
1634 for (addr = sender_verified_list; addr != NULL; addr = addr->next)
1635 if (Ustrcmp(sender, addr->address) == 0) break;
1643 /*************************************************
1644 * Get valid header address *
1645 *************************************************/
1647 /* Scan the originator headers of the message, looking for an address that
1648 verifies successfully. RFC 822 says:
1650 o The "Sender" field mailbox should be sent notices of
1651 any problems in transport or delivery of the original
1652 messages. If there is no "Sender" field, then the
1653 "From" field mailbox should be used.
1655 o If the "Reply-To" field exists, then the reply should
1656 go to the addresses indicated in that field and not to
1657 the address(es) indicated in the "From" field.
1659 So we check a Sender field if there is one, else a Reply_to field, else a From
1660 field. As some strange messages may have more than one of these fields,
1661 especially if they are resent- fields, check all of them if there is more than
1665 user_msgptr points to where to put a user error message
1666 log_msgptr points to where to put a log error message
1667 callout timeout for callout check (passed to verify_address())
1668 callout_overall overall callout timeout (ditto)
1669 callout_connect connect callout timeout (ditto)
1670 se_mailfrom mailfrom for verify; NULL => ""
1671 pm_mailfrom sender for pm callout check (passed to verify_address())
1672 options callout options (passed to verify_address())
1673 verrno where to put the address basic_errno
1675 If log_msgptr is set to something without setting user_msgptr, the caller
1676 normally uses log_msgptr for both things.
1678 Returns: result of the verification attempt: OK, FAIL, or DEFER;
1679 FAIL is given if no appropriate headers are found
1683 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
1684 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
1685 uschar *pm_mailfrom, int options, int *verrno)
1687 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
1691 for (i = 0; i < 3; i++)
1694 for (h = header_list; h != NULL; h = h->next)
1696 int terminator, new_ok;
1697 uschar *s, *ss, *endname;
1699 if (h->type != header_types[i]) continue;
1700 s = endname = Ustrchr(h->text, ':') + 1;
1704 address_item *vaddr;
1706 while (isspace(*s) || *s == ',') s++;
1707 if (*s == 0) break; /* End of header */
1709 ss = parse_find_address_end(s, FALSE);
1711 /* The terminator is a comma or end of header, but there may be white
1712 space preceding it (including newline for the last address). Move back
1713 past any white space so we can check against any cached envelope sender
1714 address verifications. */
1716 while (isspace(ss[-1])) ss--;
1720 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
1721 (int)(endname - h->text), h->text, s);
1723 /* See if we have already verified this address as an envelope sender,
1724 and if so, use the previous answer. */
1726 vaddr = verify_checked_sender(s);
1728 if (vaddr != NULL && /* Previously checked */
1729 (callout <= 0 || /* No callout needed; OR */
1730 vaddr->special_action > 256)) /* Callout was done */
1732 new_ok = vaddr->special_action & 255;
1733 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
1734 *ss = terminator; /* Restore shortened string */
1737 /* Otherwise we run the verification now. We must restore the shortened
1738 string before running the verification, so the headers are correct, in
1739 case there is any rewriting. */
1743 int start, end, domain;
1744 uschar *address = parse_extract_address(s, log_msgptr, &start,
1745 &end, &domain, FALSE);
1749 /* If verification failed because of a syntax error, fail this
1750 function, and ensure that the failing address gets added to the error
1753 if (address == NULL)
1756 if (*log_msgptr != NULL)
1758 while (ss > s && isspace(ss[-1])) ss--;
1759 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
1760 "scanning for sender: %s in \"%.*s\"",
1761 endname - h->text, h->text, *log_msgptr, ss - s, s);
1766 /* Else go ahead with the sender verification. But it isn't *the*
1767 sender of the message, so set vopt_fake_sender to stop sender_address
1768 being replaced after rewriting or qualification. */
1772 vaddr = deliver_make_addr(address, FALSE);
1773 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
1774 callout, callout_overall, callout_connect, se_mailfrom,
1779 /* We now have the result, either newly found, or cached. If we are
1780 giving out error details, set a specific user error. This means that the
1781 last of these will be returned to the user if all three fail. We do not
1782 set a log message - the generic one below will be used. */
1786 *verrno = vaddr->basic_errno;
1787 if (smtp_return_error_details)
1789 *user_msgptr = string_sprintf("Rejected after DATA: "
1790 "could not verify \"%.*s\" header address\n%s: %s",
1791 endname - h->text, h->text, vaddr->address, vaddr->message);
1795 /* Success or defer */
1797 if (new_ok == OK) return OK;
1798 if (new_ok == DEFER) yield = DEFER;
1800 /* Move on to any more addresses in the header */
1807 if (yield == FAIL && *log_msgptr == NULL)
1808 *log_msgptr = US"there is no valid sender in any header line";
1810 if (yield == DEFER && *log_msgptr == NULL)
1811 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
1819 /*************************************************
1820 * Get RFC 1413 identification *
1821 *************************************************/
1823 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
1824 the timeout is set to zero, then the query is not done. There may also be lists
1825 of hosts and nets which are exempt. To guard against malefactors sending
1826 non-printing characters which could, for example, disrupt a message's headers,
1827 make sure the string consists of printing characters only.
1830 port the port to connect to; usually this is IDENT_PORT (113), but when
1831 running in the test harness with -bh a different value is used.
1835 Side effect: any received ident value is put in sender_ident (NULL otherwise)
1839 verify_get_ident(int port)
1841 int sock, host_af, qlen;
1842 int received_sender_port, received_interface_port, n;
1844 uschar buffer[2048];
1846 /* Default is no ident. Check whether we want to do an ident check for this
1849 sender_ident = NULL;
1850 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
1853 DEBUG(D_ident) debug_printf("doing ident callback\n");
1855 /* Set up a connection to the ident port of the remote host. Bind the local end
1856 to the incoming interface address. If the sender host address is an IPv6
1857 address, the incoming interface address will also be IPv6. */
1859 host_af = (Ustrchr(sender_host_address, ':') == NULL)? AF_INET : AF_INET6;
1860 sock = ip_socket(SOCK_STREAM, host_af);
1861 if (sock < 0) return;
1863 if (ip_bind(sock, host_af, interface_address, 0) < 0)
1865 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
1870 if (ip_connect(sock, host_af, sender_host_address, port, rfc1413_query_timeout)
1873 if (errno == ETIMEDOUT && (log_extra_selector & LX_ident_timeout) != 0)
1875 log_write(0, LOG_MAIN, "ident connection to %s timed out",
1876 sender_host_address);
1880 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
1881 sender_host_address, strerror(errno));
1886 /* Construct and send the query. */
1888 sprintf(CS buffer, "%d , %d\r\n", sender_host_port, interface_port);
1889 qlen = Ustrlen(buffer);
1890 if (send(sock, buffer, qlen, 0) < 0)
1892 DEBUG(D_ident) debug_printf("ident send failed: %s\n", strerror(errno));
1896 /* Read a response line. We put it into the rest of the buffer, using several
1897 recv() calls if necessary. */
1905 int size = sizeof(buffer) - (p - buffer);
1907 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
1908 count = ip_recv(sock, p, size, rfc1413_query_timeout);
1909 if (count <= 0) goto END_OFF; /* Read error or EOF */
1911 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
1912 generous, and accept a plain \n terminator as well. The only illegal
1915 for (pp = p; pp < p + count; pp++)
1917 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
1920 if (pp[-1] == '\r') pp--;
1922 goto GOT_DATA; /* Break out of both loops */
1926 /* Reached the end of the data without finding \n. Let the loop continue to
1927 read some more, if there is room. */
1934 /* We have received a line of data. Check it carefully. It must start with the
1935 same two port numbers that we sent, followed by data as defined by the RFC. For
1938 12345 , 25 : USERID : UNIX :root
1940 However, the amount of white space may be different to what we sent. In the
1941 "osname" field there may be several sub-fields, comma separated. The data we
1942 actually want to save follows the third colon. Some systems put leading spaces
1943 in it - we discard those. */
1945 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
1946 &received_interface_port, &n) != 2 ||
1947 received_sender_port != sender_host_port ||
1948 received_interface_port != interface_port)
1951 p = buffer + qlen + n;
1952 while(isspace(*p)) p++;
1953 if (*p++ != ':') goto END_OFF;
1954 while(isspace(*p)) p++;
1955 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
1957 while(isspace(*p)) p++;
1958 if (*p++ != ':') goto END_OFF;
1959 while (*p != 0 && *p != ':') p++;
1960 if (*p++ == 0) goto END_OFF;
1961 while(isspace(*p)) p++;
1962 if (*p == 0) goto END_OFF;
1964 /* The rest of the line is the data we want. We turn it into printing
1965 characters when we save it, so that it cannot mess up the format of any logging
1966 or Received: lines into which it gets inserted. We keep a maximum of 127
1969 sender_ident = string_printing(string_copyn(p, 127));
1970 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
1980 /*************************************************
1981 * Match host to a single host-list item *
1982 *************************************************/
1984 /* This function compares a host (name or address) against a single item
1985 from a host list. The host name gets looked up if it is needed and is not
1986 already known. The function is called from verify_check_this_host() via
1987 match_check_list(), which is why most of its arguments are in a single block.
1990 arg the argument block (see below)
1991 ss the host-list item
1992 valueptr where to pass back looked up data, or NULL
1993 error for error message when returning ERROR
1996 host_name (a) the host name, or
1997 (b) NULL, implying use sender_host_name and
1998 sender_host_aliases, looking them up if required, or
1999 (c) the empty string, meaning that only IP address matches
2001 host_address the host address
2002 host_ipv4 the IPv4 address taken from an IPv6 one
2006 DEFER lookup deferred
2007 ERROR (a) failed to find the host name or IP address, or
2008 (b) unknown lookup type specified, or
2009 (c) host name encountered when only IP addresses are
2014 check_host(void *arg, uschar *ss, uschar **valueptr, uschar **error)
2016 check_host_block *cb = (check_host_block *)arg;
2019 BOOL iplookup = FALSE;
2020 BOOL isquery = FALSE;
2021 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
2026 /* Optimize for the special case when the pattern is "*". */
2028 if (*ss == '*' && ss[1] == 0) return OK;
2030 /* If the pattern is empty, it matches only in the case when there is no host -
2031 this can occur in ACL checking for SMTP input using the -bs option. In this
2032 situation, the host address is the empty string. */
2034 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2035 if (*ss == 0) return FAIL;
2037 /* If the pattern is precisely "@" then match against the primary host name,
2038 provided that host name matching is permitted; if it's "@[]" match against the
2039 local host's IP addresses. */
2045 if (isiponly) return ERROR;
2046 ss = primary_hostname;
2048 else if (Ustrcmp(ss, "@[]") == 0)
2050 ip_address_item *ip;
2051 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
2052 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2057 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2058 a (possibly masked) comparision with the current IP address. */
2060 if (string_is_ip_address(ss, &maskoffset) != 0)
2061 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2063 /* The pattern is not an IP address. A common error that people make is to omit
2064 one component of an IPv4 address, either by accident, or believing that, for
2065 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2066 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2067 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2068 ancient specification.) To aid in debugging these cases, we give a specific
2069 error if the pattern contains only digits and dots or contains a slash preceded
2070 only by digits and dots (a slash at the start indicates a file name and of
2071 course slashes may be present in lookups, but not preceded only by digits and
2074 for (t = ss; isdigit(*t) || *t == '.'; t++);
2075 if (*t == 0 || (*t == '/' && t != ss))
2077 *error = US"malformed IPv4 address or address mask";
2081 /* See if there is a semicolon in the pattern */
2083 semicolon = Ustrchr(ss, ';');
2085 /* If we are doing an IP address only match, then all lookups must be IP
2086 address lookups, even if there is no "net-". */
2090 iplookup = semicolon != NULL;
2093 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
2094 a lookup on a masked IP network, in textual form. We obey this code even if we
2095 have already set iplookup, so as to skip over the "net-" prefix and to set the
2096 mask length. The net- stuff really only applies to single-key lookups where the
2097 key is implicit. For query-style lookups the key is specified in the query.
2098 From release 4.30, the use of net- for query style is no longer needed, but we
2099 retain it for backward compatibility. */
2101 if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
2104 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2105 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2106 iplookup = (*t++ == '-');
2110 /* Do the IP address lookup if that is indeed what we have */
2118 uschar *filename, *key, *result;
2121 /* Find the search type */
2123 search_type = search_findtype(t, semicolon - t);
2125 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2126 search_error_message);
2128 /* Adjust parameters for the type of lookup. For a query-style lookup, there
2129 is no file name, and the "key" is just the query. For query-style with a file
2130 name, we have to fish the file off the start of the query. For a single-key
2131 lookup, the key is the current IP address, masked appropriately, and
2132 reconverted to text form, with the mask appended. For IPv6 addresses, specify
2133 dot separators instead of colons. */
2135 if (mac_islookup(search_type, lookup_absfilequery))
2137 filename = semicolon + 1;
2139 while (*key != 0 && !isspace(*key)) key++;
2140 filename = string_copyn(filename, key - filename);
2141 while (isspace(*key)) key++;
2143 else if (mac_islookup(search_type, lookup_querystyle))
2146 key = semicolon + 1;
2150 insize = host_aton(cb->host_address, incoming);
2151 host_mask(insize, incoming, mlen);
2152 (void)host_nmtoa(insize, incoming, mlen, buffer, '.');
2154 filename = semicolon + 1;
2157 /* Now do the actual lookup; note that there is no search_close() because
2158 of the caching arrangements. */
2160 handle = search_open(filename, search_type, 0, NULL, NULL);
2161 if (handle == NULL) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2162 search_error_message);
2163 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
2164 if (valueptr != NULL) *valueptr = result;
2165 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
2168 /* The pattern is not an IP address or network reference of any kind. That is,
2169 it is a host name pattern. If this is an IP only match, there's an error in the
2174 *error = US"cannot match host name in match_ip list";
2178 /* Check the characters of the pattern to see if they comprise only letters,
2179 digits, full stops, and hyphens (the constituents of domain names). Allow
2180 underscores, as they are all too commonly found. Sigh. Also, if
2181 allow_utf8_domains is set, allow top-bit characters. */
2183 for (t = ss; *t != 0; t++)
2184 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
2185 (!allow_utf8_domains || *t < 128)) break;
2187 /* If the pattern is a complete domain name, with no fancy characters, look up
2188 its IP address and match against that. Note that a multi-homed host will add
2189 items to the chain. */
2200 rc = host_find_byname(&h, NULL, NULL, FALSE);
2201 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
2204 for (hh = &h; hh != NULL; hh = hh->next)
2206 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
2210 if (rc == HOST_FIND_AGAIN) return DEFER;
2211 *error = string_sprintf("failed to find IP address for %s", ss);
2215 /* Almost all subsequent comparisons require the host name, and can be done
2216 using the general string matching function. When this function is called for
2217 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
2218 must use sender_host_name and its aliases, looking them up if necessary. */
2220 if (cb->host_name != NULL) /* Explicit host name given */
2221 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
2224 /* Host name not given; in principle we need the sender host name and its
2225 aliases. However, for query-style lookups, we do not need the name if the
2226 query does not contain $sender_host_name. From release 4.23, a reference to
2227 $sender_host_name causes it to be looked up, so we don't need to do the lookup
2230 if ((semicolon = Ustrchr(ss, ';')) != NULL)
2233 int partial, affixlen, starflags, id;
2236 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
2239 if (id < 0) /* Unknown lookup type */
2241 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
2242 search_error_message, ss);
2245 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
2250 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
2253 case DEFER: return DEFER;
2254 default: return FAIL;
2258 /* Not a query-style lookup; must ensure the host name is present, and then we
2259 do a check on the name and all its aliases. */
2261 if (sender_host_name == NULL)
2263 HDEBUG(D_host_lookup)
2264 debug_printf("sender host name required, to match against %s\n", ss);
2265 if (host_lookup_failed || host_name_lookup() != OK)
2267 *error = string_sprintf("failed to find host name for %s",
2268 sender_host_address);;
2271 host_build_sender_fullhost();
2274 /* Match on the sender host name, using the general matching function */
2276 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
2280 case DEFER: return DEFER;
2283 /* If there are aliases, try matching on them. */
2285 aliases = sender_host_aliases;
2286 while (*aliases != NULL)
2288 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
2291 case DEFER: return DEFER;
2300 /*************************************************
2301 * Check a specific host matches a host list *
2302 *************************************************/
2304 /* This function is passed a host list containing items in a number of
2305 different formats and the identity of a host. Its job is to determine whether
2306 the given host is in the set of hosts defined by the list. The host name is
2307 passed as a pointer so that it can be looked up if needed and not already
2308 known. This is commonly the case when called from verify_check_host() to check
2309 an incoming connection. When called from elsewhere the host name should usually
2312 This function is now just a front end to match_check_list(), which runs common
2313 code for scanning a list. We pass it the check_host() function to perform a
2317 listptr pointer to the host list
2318 cache_bits pointer to cache for named lists, or NULL
2319 host_name the host name or NULL, implying use sender_host_name and
2320 sender_host_aliases, looking them up if required
2321 host_address the IP address
2322 valueptr if not NULL, data from a lookup is passed back here
2324 Returns: OK if the host is in the defined set
2325 FAIL if the host is not in the defined set,
2326 DEFER if a data lookup deferred (not a host lookup)
2328 If the host name was needed in order to make a comparison, and could not be
2329 determined from the IP address, the result is FAIL unless the item
2330 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
2333 verify_check_this_host(uschar **listptr, unsigned int *cache_bits,
2334 uschar *host_name, uschar *host_address, uschar **valueptr)
2337 unsigned int *local_cache_bits = cache_bits;
2338 uschar *save_host_address = deliver_host_address;
2339 check_host_block cb;
2340 cb.host_name = host_name;
2341 cb.host_address = host_address;
2343 if (valueptr != NULL) *valueptr = NULL;
2345 /* If the host address starts off ::ffff: it is an IPv6 address in
2346 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
2349 cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
2350 host_address + 7 : host_address;
2352 /* During the running of the check, put the IP address into $host_address. In
2353 the case of calls from the smtp transport, it will already be there. However,
2354 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
2355 the safe side, any existing setting is preserved, though as I write this
2356 (November 2004) I can't see any cases where it is actually needed. */
2358 deliver_host_address = host_address;
2359 rc = match_check_list(
2360 listptr, /* the list */
2361 0, /* separator character */
2362 &hostlist_anchor, /* anchor pointer */
2363 &local_cache_bits, /* cache pointer */
2364 check_host, /* function for testing */
2365 &cb, /* argument for function */
2366 MCL_HOST, /* type of check */
2367 (host_address == sender_host_address)?
2368 US"host" : host_address, /* text for debugging */
2369 valueptr); /* where to pass back data */
2370 deliver_host_address = save_host_address;
2377 /*************************************************
2378 * Check the remote host matches a list *
2379 *************************************************/
2381 /* This is a front end to verify_check_this_host(), created because checking
2382 the remote host is a common occurrence. With luck, a good compiler will spot
2383 the tail recursion and optimize it. If there's no host address, this is
2384 command-line SMTP input - check against an empty string for the address.
2387 listptr pointer to the host list
2389 Returns: the yield of verify_check_this_host(),
2390 i.e. OK, FAIL, or DEFER
2394 verify_check_host(uschar **listptr)
2396 return verify_check_this_host(listptr, sender_host_cache, NULL,
2397 (sender_host_address == NULL)? US"" : sender_host_address, NULL);
2404 /*************************************************
2405 * Invert an IP address for a DNS black list *
2406 *************************************************/
2410 buffer where to put the answer
2411 address the address to invert
2415 invert_address(uschar *buffer, uschar *address)
2418 uschar *bptr = buffer;
2420 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
2421 to the IPv4 part only. */
2423 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
2425 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
2428 if (host_aton(address, bin) == 1)
2432 for (i = 0; i < 4; i++)
2434 sprintf(CS bptr, "%d.", x & 255);
2435 while (*bptr) bptr++;
2440 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
2441 in any DNS black lists, and the format in which they will be looked up is
2442 unknown. This is just a guess. */
2448 for (j = 3; j >= 0; j--)
2451 for (i = 0; i < 8; i++)
2453 sprintf(CS bptr, "%x.", x & 15);
2454 while (*bptr) bptr++;
2464 /*************************************************
2465 * Perform a single dnsbl lookup *
2466 *************************************************/
2468 /* This function is called from verify_check_dnsbl() below.
2471 domain the outer dnsbl domain (for debug message)
2472 keydomain the current keydomain (for debug message)
2473 query the domain to be looked up
2474 iplist the list of matching IP addresses
2475 bitmask true if bitmask matching is wanted
2476 invert_result true if result to be inverted
2477 defer_return what to return for a defer
2479 Returns: OK if lookup succeeded
2484 one_check_dnsbl(uschar *domain, uschar *keydomain, uschar *query,
2485 uschar *iplist, BOOL bitmask, BOOL invert_result, int defer_return)
2490 dnsbl_cache_block *cb;
2491 int old_pool = store_pool;
2493 /* Look for this query in the cache. */
2495 t = tree_search(dnsbl_cache, query);
2497 /* If not cached from a previous lookup, we must do a DNS lookup, and
2498 cache the result in permanent memory. */
2502 store_pool = POOL_PERM;
2504 /* Set up a tree entry to cache the lookup */
2506 t = store_get(sizeof(tree_node) + Ustrlen(query));
2507 Ustrcpy(t->name, query);
2508 t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block));
2509 (void)tree_insertnode(&dnsbl_cache, t);
2511 /* Do the DNS loopup . */
2513 HDEBUG(D_dnsbl) debug_printf("new DNS lookup for %s\n", query);
2514 cb->rc = dns_basic_lookup(&dnsa, query, T_A);
2515 cb->text_set = FALSE;
2519 /* If the lookup succeeded, cache the RHS address. The code allows for
2520 more than one address - this was for complete generality and the possible
2521 use of A6 records. However, A6 records have been reduced to experimental
2522 status (August 2001) and may die out. So they may never get used at all,
2523 let alone in dnsbl records. However, leave the code here, just in case.
2525 Quite apart from one A6 RR generating multiple addresses, there are DNS
2526 lists that return more than one A record, so we must handle multiple
2527 addresses generated in that way as well. */
2529 if (cb->rc == DNS_SUCCEED)
2532 dns_address **addrp = &(cb->rhs);
2533 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2535 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2537 if (rr->type == T_A)
2539 dns_address *da = dns_address_from_rr(&dnsa, rr);
2543 while (da->next != NULL) da = da->next;
2544 addrp = &(da->next);
2549 /* If we didn't find any A records, change the return code. This can
2550 happen when there is a CNAME record but there are no A records for what
2553 if (cb->rhs == NULL) cb->rc = DNS_NODATA;
2556 store_pool = old_pool;
2559 /* Previous lookup was cached */
2563 HDEBUG(D_dnsbl) debug_printf("using result of previous DNS lookup\n");
2567 /* We now have the result of the DNS lookup, either newly done, or cached
2568 from a previous call. If the lookup succeeded, check against the address
2569 list if there is one. This may be a positive equality list (introduced by
2570 "="), a negative equality list (introduced by "!="), a positive bitmask
2571 list (introduced by "&"), or a negative bitmask list (introduced by "!&").*/
2573 if (cb->rc == DNS_SUCCEED)
2575 dns_address *da = NULL;
2576 uschar *addlist = cb->rhs->address;
2578 /* For A and AAAA records, there may be multiple addresses from multiple
2579 records. For A6 records (currently not expected to be used) there may be
2580 multiple addresses from a single record. */
2582 for (da = cb->rhs->next; da != NULL; da = da->next)
2583 addlist = string_sprintf("%s, %s", addlist, da->address);
2585 HDEBUG(D_dnsbl) debug_printf("DNS lookup for %s succeeded (yielding %s)\n",
2588 /* Address list check; this can be either for equality, or via a bitmask.
2589 In the latter case, all the bits must match. */
2595 uschar *ptr = iplist;
2597 while (string_nextinlist(&ptr, &ipsep, ip, sizeof(ip)) != NULL)
2599 /* Handle exact matching */
2602 for (da = cb->rhs; da != NULL; da = da->next)
2604 if (Ustrcmp(CS da->address, ip) == 0) break;
2607 /* Handle bitmask matching */
2613 /* At present, all known DNS blocking lists use A records, with
2614 IPv4 addresses on the RHS encoding the information they return. I
2615 wonder if this will linger on as the last vestige of IPv4 when IPv6
2616 is ubiquitous? Anyway, for now we use paranoia code to completely
2617 ignore IPv6 addresses. The default mask is 0, which always matches.
2618 We change this only for IPv4 addresses in the list. */
2620 if (host_aton(ip, address) == 1) mask = address[0];
2622 /* Scan the returned addresses, skipping any that are IPv6 */
2624 for (da = cb->rhs; da != NULL; da = da->next)
2626 if (host_aton(da->address, address) != 1) continue;
2627 if ((address[0] & mask) == mask) break;
2631 /* Break out if a match has been found */
2633 if (da != NULL) break;
2638 (a) No IP address in a positive list matched, or
2639 (b) An IP address in a negative list did match
2641 then behave as if the DNSBL lookup had not succeeded, i.e. the host is
2644 if (invert_result != (da == NULL))
2648 debug_printf("=> but we are not accepting this block class because\n");
2649 debug_printf("=> there was %s match for %c%s\n",
2650 invert_result? "an exclude":"no", bitmask? '&' : '=', iplist);
2656 /* Either there was no IP list, or the record matched. Look up a TXT record
2657 if it hasn't previously been done. */
2661 cb->text_set = TRUE;
2662 if (dns_basic_lookup(&dnsa, query, T_TXT) == DNS_SUCCEED)
2665 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2667 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2668 if (rr->type == T_TXT) break;
2671 int len = (rr->data)[0];
2672 if (len > 511) len = 127;
2673 store_pool = POOL_PERM;
2674 cb->text = string_sprintf("%.*s", len, (const uschar *)(rr->data+1));
2675 store_pool = old_pool;
2680 dnslist_value = addlist;
2681 dnslist_text = cb->text;
2685 /* There was a problem with the DNS lookup */
2687 if (cb->rc != DNS_NOMATCH && cb->rc != DNS_NODATA)
2689 log_write(L_dnslist_defer, LOG_MAIN,
2690 "DNS list lookup defer (probably timeout) for %s: %s", query,
2691 (defer_return == OK)? US"assumed in list" :
2692 (defer_return == FAIL)? US"assumed not in list" :
2693 US"returned DEFER");
2694 return defer_return;
2697 /* No entry was found in the DNS; continue for next domain */
2701 debug_printf("DNS lookup for %s failed\n", query);
2702 debug_printf("=> that means %s is not listed at %s\n",
2712 /*************************************************
2713 * Check host against DNS black lists *
2714 *************************************************/
2716 /* This function runs checks against a list of DNS black lists, until one
2717 matches. Each item on the list can be of the form
2719 domain=ip-address/key
2721 The domain is the right-most domain that is used for the query, for example,
2722 blackholes.mail-abuse.org. If the IP address is present, there is a match only
2723 if the DNS lookup returns a matching IP address. Several addresses may be
2724 given, comma-separated, for example: x.y.z=127.0.0.1,127.0.0.2.
2726 If no key is given, what is looked up in the domain is the inverted IP address
2727 of the current client host. If a key is given, it is used to construct the
2728 domain for the lookup. For example,
2730 dsn.rfc-ignorant.org/$sender_address_domain
2732 After finding a match in the DNS, the domain is placed in $dnslist_domain, and
2733 then we check for a TXT record for an error message, and if found, save its
2734 value in $dnslist_text. We also cache everything in a tree, to optimize
2737 Note: an address for testing RBL is 192.203.178.39
2738 Note: an address for testing DUL is 192.203.178.4
2739 Note: a domain for testing RFCI is example.tld.dsn.rfc-ignorant.org
2742 listptr the domain/address/data list
2744 Returns: OK successful lookup (i.e. the address is on the list), or
2745 lookup deferred after +include_unknown
2746 FAIL name not found, or no data found for the given type, or
2747 lookup deferred after +exclude_unknown (default)
2748 DEFER lookup failure, if +defer_unknown was set
2752 verify_check_dnsbl(uschar **listptr)
2755 int defer_return = FAIL;
2756 BOOL invert_result = FALSE;
2757 uschar *list = *listptr;
2760 uschar buffer[1024];
2761 uschar query[256]; /* DNS domain max length */
2762 uschar revadd[128]; /* Long enough for IPv6 address */
2764 /* Indicate that the inverted IP address is not yet set up */
2768 /* In case this is the first time the DNS resolver is being used. */
2770 dns_init(FALSE, FALSE);
2772 /* Loop through all the domains supplied, until something matches */
2774 while ((domain = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
2778 BOOL bitmask = FALSE;
2782 HDEBUG(D_dnsbl) debug_printf("DNS list check: %s\n", domain);
2784 /* Deal with special values that change the behaviour on defer */
2786 if (domain[0] == '+')
2788 if (strcmpic(domain, US"+include_unknown") == 0) defer_return = OK;
2789 else if (strcmpic(domain, US"+exclude_unknown") == 0) defer_return = FAIL;
2790 else if (strcmpic(domain, US"+defer_unknown") == 0) defer_return = DEFER;
2792 log_write(0, LOG_MAIN|LOG_PANIC, "unknown item in dnslist (ignored): %s",
2797 /* See if there's explicit data to be looked up */
2799 key = Ustrchr(domain, '/');
2800 if (key != NULL) *key++ = 0;
2802 /* See if there's a list of addresses supplied after the domain name. This is
2803 introduced by an = or a & character; if preceded by ! we invert the result.
2806 iplist = Ustrchr(domain, '=');
2810 iplist = Ustrchr(domain, '&');
2815 if (iplist > domain && iplist[-1] == '!')
2817 invert_result = TRUE;
2823 /* Check that what we have left is a sensible domain name. There is no reason
2824 why these domains should in fact use the same syntax as hosts and email
2825 domains, but in practice they seem to. However, there is little point in
2826 actually causing an error here, because that would no doubt hold up incoming
2827 mail. Instead, I'll just log it. */
2829 for (s = domain; *s != 0; s++)
2831 if (!isalnum(*s) && *s != '-' && *s != '.')
2833 log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains "
2834 "strange characters - is this right?", domain);
2839 /* If there is no key string, construct the query by adding the domain name
2840 onto the inverted host address, and perform a single DNS lookup. */
2844 if (sender_host_address == NULL) return FAIL; /* can never match */
2845 if (revadd[0] == 0) invert_address(revadd, sender_host_address);
2846 frc = string_format(query, sizeof(query), "%s%s", revadd, domain);
2850 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
2851 "(ignored): %s...", query);
2855 rc = one_check_dnsbl(domain, sender_host_address, query, iplist, bitmask,
2856 invert_result, defer_return);
2860 dnslist_domain = string_copy(domain);
2861 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
2862 sender_host_address, domain);
2865 if (rc != FAIL) return rc; /* OK or DEFER */
2868 /* If there is a key string, it can be a list of domains or IP addresses to
2869 be concatenated with the main domain. */
2876 uschar keybuffer[256];
2878 while ((keydomain = string_nextinlist(&key, &keysep, keybuffer,
2879 sizeof(keybuffer))) != NULL)
2881 if (string_is_ip_address(keydomain, NULL) != 0)
2883 uschar keyrevadd[128];
2884 invert_address(keyrevadd, keydomain);
2885 frc = string_format(query, sizeof(query), "%s%s", keyrevadd, domain);
2889 frc = string_format(query, sizeof(query), "%s.%s", keydomain, domain);
2894 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
2895 "(ignored): %s...", query);
2899 rc = one_check_dnsbl(domain, keydomain, query, iplist, bitmask,
2900 invert_result, defer_return);
2904 dnslist_domain = string_copy(domain);
2905 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
2910 /* If the lookup deferred, remember this fact. We keep trying the rest
2911 of the list to see if we get a useful result, and if we don't, we return
2912 DEFER at the end. */
2914 if (rc == DEFER) defer = TRUE;
2915 } /* continue with next keystring domain/address */
2917 if (defer) return DEFER;
2919 } /* continue with next dnsdb outer domain */
2924 /* End of verify.c */