X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/4284f0712acb9ba047fc32792472b348181d98d8..f5730918ef684baafbd9e606a1d4eb06914563cc:/src/src/verify.c diff --git a/src/src/verify.c b/src/src/verify.c index 7f1752120..125df8d91 100644 --- a/src/src/verify.c +++ b/src/src/verify.c @@ -2,9 +2,10 @@ * Exim - an Internet mail transport agent * *************************************************/ +/* Copyright (c) The Exim Maintainers 2020 - 2022 */ /* Copyright (c) University of Cambridge 1995 - 2018 */ -/* Copyright (c) The Exim Maintainers 2020 */ /* See the file NOTICE for conditions of use and distribution. */ +/* SPDX-License-Identifier: GPL-2.0-or-later */ /* Functions concerned with verifying things. The original code for callout caching was contributed by Kevin Fleming (but I hacked it around a bit). */ @@ -19,27 +20,6 @@ static smtp_context ctctx; uschar ctbuffer[8192]; -/* Structure for caching DNSBL lookups */ - -typedef struct dnsbl_cache_block { - time_t expiry; - dns_address *rhs; - uschar *text; - int rc; - BOOL text_set; -} dnsbl_cache_block; - - -/* Anchor for DNSBL cache */ - -static tree_node *dnsbl_cache = NULL; - - -/* Bits for match_type in one_check_dnsbl() */ - -#define MT_NOT 1 -#define MT_ALL 2 - static uschar cutthrough_response(client_conn_ctx *, char, uschar **, int); @@ -99,7 +79,7 @@ if (type[0] == 'd' && cache_record->result != ccache_reject) { if (length == sizeof(dbdata_callout_cache_obs)) { - dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache), FALSE); + dbdata_callout_cache * new = store_get(sizeof(dbdata_callout_cache), GET_UNTAINTED); memcpy(new, cache_record, length); new->postmaster_stamp = new->random_stamp = new->time_stamp; cache_record = new; @@ -134,7 +114,7 @@ int options = *opt_ptr; open_db dbblock; open_db *dbm_file = NULL; -/* Open the callout cache database, it it exists, for reading only at this +/* Open the callout cache database, if it exists, for reading only at this stage, unless caching has been disabled. */ if (options & vopt_callout_no_cache) @@ -421,7 +401,7 @@ if (addr->transport == cutthrough.addr.transport) if (done) { - address_item * na = store_get(sizeof(address_item), FALSE); + address_item * na = store_get(sizeof(address_item), GET_UNTAINTED); *na = cutthrough.addr; cutthrough.addr = *addr; cutthrough.addr.host_used = &cutthrough.host; @@ -466,6 +446,21 @@ return done; } + + +/* A rcpt callout, or cached record of one, verified the address. +Set $domain_data and $local_part_data to detainted versions. +*/ +static void +callout_verified_rcpt(const address_item * addr) +{ +address_item a = {.address = addr->address}; +if (deliver_split_address(&a) != OK) return; +deliver_localpart_data = string_copy_taint(a.local_part, GET_UNTAINTED); +deliver_domain_data = string_copy_taint(a.domain, GET_UNTAINTED); +} + + /************************************************* * Do callout verification for an address * *************************************************/ @@ -568,6 +563,7 @@ if (!addr->transport) { HDEBUG(D_verify) debug_printf("cannot callout via null transport\n"); } + else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0) log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp", addr->transport->name, addr->transport->driver_name); @@ -671,16 +667,17 @@ coding means skipping this whole loop and doing the append separately. */ log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address, addr->message); - if (!sx) sx = store_get(sizeof(*sx), TRUE); /* tainted buffers */ + if (!sx) sx = store_get(sizeof(*sx), GET_TAINTED); /* tainted buffers */ memset(sx, 0, sizeof(*sx)); - sx->addrlist = addr; + sx->addrlist = sx->first_addr = addr; sx->conn_args.host = host; sx->conn_args.host_af = host_af, sx->port = port; sx->conn_args.interface = interface; sx->helo_data = tf->helo_data; sx->conn_args.tblock = addr->transport; + sx->conn_args.sock = -1; sx->verify = TRUE; tls_retry_connection: @@ -835,7 +832,7 @@ tls_retry_connection: sx->cctx.sock = -1; #ifndef DISABLE_EVENT (void) event_raise(addr->transport->event_action, - US"tcp:close", NULL); + US"tcp:close", NULL, NULL); #endif addr->address = main_address; addr->transport_return = PENDING_DEFER; @@ -875,12 +872,12 @@ tls_retry_connection: case PENDING_OK: done = TRUE; new_address_record.result = ccache_accept; break; - case FAIL: done = TRUE; + case FAIL: done = TRUE; yield = FAIL; *failure_ptr = US"recipient"; new_address_record.result = ccache_reject; break; - default: break; + default: break; } break; @@ -1059,6 +1056,8 @@ no_conn: HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n"); } #ifndef DISABLE_DKIM + /* DKIM signing needs to add a header after seeing the whole body, so we cannot just copy + body bytes to the outbound as they are received, which is the intent of cutthrough. */ if (ob->dkim.dkim_domain) { cutthrough.delivery= FALSE; @@ -1116,7 +1115,7 @@ no_conn: for (address_item * caddr = &cutthrough.addr, * parent = addr->parent; parent; caddr = caddr->parent, parent = parent->parent) - *(caddr->parent = store_get(sizeof(address_item), FALSE)) = *parent; + *(caddr->parent = store_get(sizeof(address_item), GET_UNTAINTED)) = *parent; ctctx.outblock.buffer = ctbuffer; ctctx.outblock.buffersize = sizeof(ctbuffer); @@ -1146,8 +1145,9 @@ no_conn: HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n"); (void)close(sx->cctx.sock); sx->cctx.sock = -1; + smtp_debug_cmd_report(); #ifndef DISABLE_EVENT - (void) event_raise(addr->transport->event_action, US"tcp:close", NULL); + (void) event_raise(addr->transport->event_action, US"tcp:close", NULL, NULL); #endif } } @@ -1366,7 +1366,7 @@ cutthrough_predata(void) if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only) return FALSE; -HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> DATA\n"); +smtp_debug_cmd(US"DATA", 0); cutthrough_puts(US"DATA\r\n", 6); cutthrough_flush_send(); @@ -1434,7 +1434,7 @@ if(fd >= 0) */ client_conn_ctx tmp_ctx = cutthrough.cctx; ctctx.outblock.ptr = ctbuffer; - HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> QUIT\n"); + smtp_debug_cmd(US"QUIT", 0); _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */ _cutthrough_flush_send(); cutthrough.cctx.sock = -1; /* avoid recursion via read timeout */ @@ -1453,6 +1453,7 @@ if(fd >= 0) #endif HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n"); (void)close(fd); + smtp_debug_cmd_report(); HDEBUG(D_acl) debug_printf_indent("----------- cutthrough shutdown (%s) ------------\n", why); } ctctx.outblock.ptr = ctbuffer; @@ -1705,7 +1706,8 @@ if (parse_find_at(address) == NULL) *failure_ptr = US"qualify"; return FAIL; } - address = rewrite_address_qualify(address, options & vopt_is_recipient); + /* deconst ok as address was not const */ + address = US rewrite_address_qualify(address, options & vopt_is_recipient); } DEBUG(D_verify) @@ -1720,7 +1722,8 @@ may have been set by domains and local part tests during an ACL. */ if (global_rewrite_rules) { uschar *old = address; - address = rewrite_address(address, options & vopt_is_recipient, FALSE, + /* deconst ok as address was not const */ + address = US rewrite_address(address, options & vopt_is_recipient, FALSE, global_rewrite_rules, rewrite_existflags); if (address != old) { @@ -1846,6 +1849,8 @@ while (addr_new) if (rc == OK) { + BOOL local_verify = FALSE; + if (routed) *routed = TRUE; if (callout > 0) { @@ -1872,72 +1877,76 @@ while (addr_new) transport's options, so as to mimic what would happen if we were really sending a message to this address. */ - if ((tp = addr->transport) && !tp->info->local) - { - (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL); + if ((tp = addr->transport)) + if (!tp->info->local) + { + (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL); - /* If the transport has hosts and the router does not, or if the - transport is configured to override the router's hosts, we must build a - host list of the transport's hosts, and find the IP addresses */ + /* If the transport has hosts and the router does not, or if the + transport is configured to override the router's hosts, we must build a + host list of the transport's hosts, and find the IP addresses */ - if (tf.hosts && (!host_list || tf.hosts_override)) - { - uschar *s; - const uschar *save_deliver_domain = deliver_domain; - uschar *save_deliver_localpart = deliver_localpart; - - host_list = NULL; /* Ignore the router's hosts */ - - deliver_domain = addr->domain; - deliver_localpart = addr->local_part; - s = expand_string(tf.hosts); - deliver_domain = save_deliver_domain; - deliver_localpart = save_deliver_localpart; - - if (!s) - { - log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts " - "\"%s\" in %s transport for callout: %s", tf.hosts, - tp->name, expand_string_message); - } - else - { - int flags; - host_build_hostlist(&host_list, s, tf.hosts_randomize); - - /* Just ignore failures to find a host address. If we don't manage - to find any addresses, the callout will defer. Note that more than - one address may be found for a single host, which will result in - additional host items being inserted into the chain. Hence we must - save the next host first. */ - - flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA; - if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE; - if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS; - - for (host_item * host = host_list, * nexthost; host; host = nexthost) - { - nexthost = host->next; - if (tf.gethostbyname || - string_is_ip_address(host->name, NULL) != 0) - (void)host_find_byname(host, NULL, flags, NULL, TRUE); - else + if (tf.hosts && (!host_list || tf.hosts_override)) + { + uschar *s; + const uschar *save_deliver_domain = deliver_domain; + uschar *save_deliver_localpart = deliver_localpart; + + host_list = NULL; /* Ignore the router's hosts */ + + deliver_domain = addr->domain; + deliver_localpart = addr->local_part; + s = expand_string(tf.hosts); + deliver_domain = save_deliver_domain; + deliver_localpart = save_deliver_localpart; + + if (!s) + { + log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts " + "\"%s\" in %s transport for callout: %s", tf.hosts, + tp->name, expand_string_message); + } + else + { + int flags; + host_build_hostlist(&host_list, s, tf.hosts_randomize); + + /* Just ignore failures to find a host address. If we don't manage + to find any addresses, the callout will defer. Note that more than + one address may be found for a single host, which will result in + additional host items being inserted into the chain. Hence we must + save the next host first. */ + + flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA; + if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE; + if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS; + + for (host_item * host = host_list, * nexthost; host; host = nexthost) { - const dnssec_domains * dsp = NULL; - if (Ustrcmp(tp->driver_name, "smtp") == 0) + nexthost = host->next; + if (tf.gethostbyname || + string_is_ip_address(host->name, NULL) != 0) + (void)host_find_byname(host, NULL, flags, NULL, TRUE); + else { - smtp_transport_options_block * ob = - (smtp_transport_options_block *) tp->options_block; - dsp = &ob->dnssec; - } + const dnssec_domains * dsp = NULL; + if (Ustrcmp(tp->driver_name, "smtp") == 0) + { + smtp_transport_options_block * ob = + (smtp_transport_options_block *) tp->options_block; + dsp = &ob->dnssec; + } - (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL, - dsp, NULL, NULL); + (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL, + dsp, NULL, NULL); + } } - } - } - } - } + } + } + } + else if ( options & vopt_quota + && Ustrcmp(tp->driver_name, "appendfile") == 0) + local_verify = TRUE; /* Can only do a callout if we have at least one host! If the callout fails, it will have set ${sender,recipient}_verify_failure. */ @@ -1961,13 +1970,25 @@ while (addr_new) #ifndef DISABLE_TLS deliver_set_expansions(NULL); #endif + if ( options & vopt_is_recipient + && rc == OK + /* set to "random", with OK, for an accepted random */ + && !recipient_verify_failure + ) + callout_verified_rcpt(addr); } } + else if (local_verify) + { + HDEBUG(D_verify) debug_printf("Attempting quota verification\n"); + + deliver_set_expansions(addr); + deliver_local(addr, TRUE); + rc = addr->transport_return; + } else - { HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor " "transport provided a host list, or transport is not smtp\n"); - } } } @@ -2156,10 +2177,6 @@ for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++) addr_list = addr->next; fprintf(fp, "%s", CS addr->address); -#ifdef EXPERIMENTAL_SRS_ALT - if(addr->prop.srs_sender) - fprintf(fp, " [srs = %s]", addr->prop.srs_sender); -#endif /* If the address is a duplicate, show something about it. */ @@ -2882,28 +2899,27 @@ Returns: OK matched */ int -check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error) +check_host(void * arg, const uschar * ss, const uschar ** valueptr, uschar ** error) { -check_host_block *cb = (check_host_block *)arg; +check_host_block * cb = (check_host_block *)arg; int mlen = -1; int maskoffset; -BOOL iplookup = FALSE; -BOOL isquery = FALSE; -BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0; -const uschar *t; +BOOL iplookup = FALSE, isquery = FALSE; +BOOL isiponly = cb->host_name && !cb->host_name[0]; +const uschar * t; uschar * semicolon, * endname, * opts; -uschar **aliases; +uschar ** aliases; /* Optimize for the special case when the pattern is "*". */ -if (*ss == '*' && ss[1] == 0) return OK; +if (*ss == '*' && !ss[1]) return OK; /* If the pattern is empty, it matches only in the case when there is no host - this can occur in ACL checking for SMTP input using the -bs option. In this situation, the host address is the empty string. */ -if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL; -if (*ss == 0) return FAIL; +if (!cb->host_address[0]) return *ss ? FAIL : OK; +if (!*ss) return FAIL; /* If the pattern is precisely "@" then match against the primary host name, provided that host name matching is permitted; if it's "@[]" match against the @@ -2940,7 +2956,7 @@ course slashes may be present in lookups, but not preceded only by digits and dots). */ for (t = ss; isdigit(*t) || *t == '.'; ) t++; -if (*t == 0 || (*t == '/' && t != ss)) +if (!*t || (*t == '/' && t != ss)) { *error = US"malformed IPv4 address or address mask"; return ERROR; @@ -3061,7 +3077,7 @@ digits, full stops, and hyphens (the constituents of domain names). Allow underscores, as they are all too commonly found. Sigh. Also, if allow_utf8_domains is set, allow top-bit characters. */ -for (t = ss; *t != 0; t++) +for (t = ss; *t; t++) if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' && (!allow_utf8_domains || *t < 128)) break; @@ -3069,7 +3085,7 @@ for (t = ss; *t != 0; t++) its IP address and match against that. Note that a multi-homed host will add items to the chain. */ -if (*t == 0) +if (!*t) { int rc; host_item h; @@ -3100,8 +3116,8 @@ outgoing hosts, the name is always given explicitly. If it is NULL, it means we must use sender_host_name and its aliases, looking them up if necessary. */ if (cb->host_name) /* Explicit host name given */ - return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE, - valueptr); + return match_check_string(cb->host_name, ss, -1, + MCS_PARTIAL | MCS_CASELESS | MCS_AT_SPECIAL | cb->flags, valueptr); /* Host name not given; in principle we need the sender host name and its aliases. However, for query-style lookups, we do not need the name if the @@ -3130,7 +3146,9 @@ if ((semicolon = Ustrchr(ss, ';'))) if (isquery) { - switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr)) + switch(match_check_string(US"", ss, -1, + MCS_PARTIAL| MCS_CASELESS| MCS_AT_SPECIAL | (cb->flags & MCS_CACHEABLE), + valueptr)) { case OK: return OK; case DEFER: return DEFER; @@ -3156,7 +3174,9 @@ if (!sender_host_name) /* Match on the sender host name, using the general matching function */ -switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE, valueptr)) +switch(match_check_string(sender_host_name, ss, -1, + MCS_PARTIAL| MCS_CASELESS| MCS_AT_SPECIAL | (cb->flags & MCS_CACHEABLE), + valueptr)) { case OK: return OK; case DEFER: return DEFER; @@ -3166,7 +3186,9 @@ switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE, valueptr)) aliases = sender_host_aliases; while (*aliases) - switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr)) + switch(match_check_string(*aliases++, ss, -1, + MCS_PARTIAL| MCS_CASELESS| MCS_AT_SPECIAL | (cb->flags & MCS_CACHEABLE), + valueptr)) { case OK: return OK; case DEFER: return DEFER; @@ -3242,8 +3264,8 @@ rc = match_check_list( check_host, /* function for testing */ &cb, /* argument for function */ MCL_HOST, /* type of check */ - (host_address == sender_host_address)? - US"host" : host_address, /* text for debugging */ + host_address == sender_host_address + ? US"host" : host_address, /* text for debugging */ valueptr); /* where to pass back data */ deliver_host_address = save_host_address; return rc; @@ -3352,573 +3374,246 @@ same format string, "%s.%s" */ -/************************************************* -* Perform a single dnsbl lookup * -*************************************************/ +/**************************************************** + Verify a local user account for quota sufficiency +****************************************************/ -/* This function is called from verify_check_dnsbl() below. It is also called -recursively from within itself when domain and domain_txt are different -pointers, in order to get the TXT record from the alternate domain. +/* The real work, done via a re-exec for privs, calls +down to the transport for the quota check. -Arguments: - domain the outer dnsbl domain - domain_txt alternate domain to lookup TXT record on success; when the - same domain is to be used, domain_txt == domain (that is, - the pointers must be identical, not just the text) - keydomain the current keydomain (for debug message) - prepend subdomain to lookup (like keydomain, but - reversed if IP address) - iplist the list of matching IP addresses, or NULL for "any" - bitmask true if bitmask matching is wanted - match_type condition for 'succeed' result - 0 => Any RR in iplist (=) - 1 => No RR in iplist (!=) - 2 => All RRs in iplist (==) - 3 => Some RRs not in iplist (!==) - the two bits are defined as MT_NOT and MT_ALL - defer_return what to return for a defer - -Returns: OK if lookup succeeded - FAIL if not -*/ +Route and transport (in recipient-verify mode) the +given recipient. -static int -one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain, - uschar *prepend, uschar *iplist, BOOL bitmask, int match_type, - int defer_return) -{ -dns_answer * dnsa = store_get_dns_answer(); -dns_scan dnss; -tree_node *t; -dnsbl_cache_block *cb; -int old_pool = store_pool; -uschar * query; -int qlen; - -/* Construct the specific query domainname */ - -query = string_sprintf("%s.%s", prepend, domain); -if ((qlen = Ustrlen(query)) >= 256) - { - log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long " - "(ignored): %s...", query); - return FAIL; - } - -/* Look for this query in the cache. */ +A routing result indicating any transport type other than appendfile +results in a fail. -if ( (t = tree_search(dnsbl_cache, query)) - && (cb = t->data.ptr)->expiry > time(NULL) - ) - -/* Previous lookup was cached */ - - { - HDEBUG(D_dnsbl) debug_printf("dnslists: using result of previous lookup\n"); - } +Return, on stdout, a result string containing: +- highlevel result code (OK, DEFER, FAIL) +- errno +- where string +- message string +*/ -/* If not cached from a previous lookup, we must do a DNS lookup, and -cache the result in permanent memory. */ +void +verify_quota(uschar * address) +{ +address_item vaddr = {.address = address}; +BOOL routed; +uschar * msg = US"\0"; +int rc, len = 1; -else +if ((rc = verify_address(&vaddr, NULL, vopt_is_recipient | vopt_quota, + 1, 0, 0, NULL, NULL, &routed)) != OK) { - uint ttl = 3600; /* max TTL for positive cache entries */ - - store_pool = POOL_PERM; - - if (t) - { - HDEBUG(D_dnsbl) debug_printf("cached data found but past valid time; "); - } - - else - { /* Set up a tree entry to cache the lookup */ - t = store_get(sizeof(tree_node) + qlen + 1 + 1, is_tainted(query)); - Ustrcpy(t->name, query); - t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block), FALSE); - (void)tree_insertnode(&dnsbl_cache, t); - } - - /* Do the DNS lookup . */ - - HDEBUG(D_dnsbl) debug_printf("new DNS lookup for %s\n", query); - cb->rc = dns_basic_lookup(dnsa, query, T_A); - cb->text_set = FALSE; - cb->text = NULL; - cb->rhs = NULL; - - /* If the lookup succeeded, cache the RHS address. The code allows for - more than one address - this was for complete generality and the possible - use of A6 records. However, A6 records are no longer supported. Leave the code - here, just in case. - - Quite apart from one A6 RR generating multiple addresses, there are DNS - lists that return more than one A record, so we must handle multiple - addresses generated in that way as well. - - Mark the cache entry with the "now" plus the minimum of the address TTLs, - or the RFC 2308 negative-cache value from the SOA if none were found. */ - - switch (cb->rc) + uschar * where = recipient_verify_failure; + msg = acl_verify_message ? acl_verify_message : vaddr.message; + if (!msg) msg = US""; + if (rc == DEFER && vaddr.basic_errno == ERRNO_EXIMQUOTA) { - case DNS_SUCCEED: - { - dns_address ** addrp = &cb->rhs; - dns_address * da; - for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr; - rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) - if (rr->type == T_A && (da = dns_address_from_rr(dnsa, rr))) - { - *addrp = da; - while (da->next) da = da->next; - addrp = &da->next; - if (ttl > rr->ttl) ttl = rr->ttl; - } - - if (cb->rhs) - { - cb->expiry = time(NULL) + ttl; - break; - } - - /* If we didn't find any A records, change the return code. This can - happen when there is a CNAME record but there are no A records for what - it points to. */ - - cb->rc = DNS_NODATA; - } - /*FALLTHROUGH*/ - - case DNS_NOMATCH: - case DNS_NODATA: - { - /* Although there already is a neg-cache layer maintained by - dns_basic_lookup(), we have a dnslist cache entry allocated and - tree-inserted. So we may as well use it. */ - - time_t soa_negttl = dns_expire_from_soa(dnsa, T_A); - cb->expiry = soa_negttl ? soa_negttl : time(NULL) + ttl; - break; - } - - default: - cb->expiry = time(NULL) + ttl; - break; + rc = FAIL; /* DEFER -> FAIL */ + where = US"quota"; + vaddr.basic_errno = 0; } + else if (!where) where = US""; - store_pool = old_pool; - HDEBUG(D_dnsbl) debug_printf("dnslists: wrote cache entry, ttl=%d\n", - (int)(cb->expiry - time(NULL))); + len = 5 + Ustrlen(msg) + 1 + Ustrlen(where); + msg = string_sprintf("%c%c%c%c%c%s%c%s", (uschar)rc, + (vaddr.basic_errno >> 24) & 0xff, (vaddr.basic_errno >> 16) & 0xff, + (vaddr.basic_errno >> 8) & 0xff, vaddr.basic_errno & 0xff, + where, '\0', msg); } -/* We now have the result of the DNS lookup, either newly done, or cached -from a previous call. If the lookup succeeded, check against the address -list if there is one. This may be a positive equality list (introduced by -"="), a negative equality list (introduced by "!="), a positive bitmask -list (introduced by "&"), or a negative bitmask list (introduced by "!&").*/ - -if (cb->rc == DNS_SUCCEED) - { - dns_address * da = NULL; - uschar *addlist = cb->rhs->address; - - /* For A and AAAA records, there may be multiple addresses from multiple - records. For A6 records (currently not expected to be used) there may be - multiple addresses from a single record. */ - - for (da = cb->rhs->next; da; da = da->next) - addlist = string_sprintf("%s, %s", addlist, da->address); - - HDEBUG(D_dnsbl) debug_printf("DNS lookup for %s succeeded (yielding %s)\n", - query, addlist); - - /* Address list check; this can be either for equality, or via a bitmask. - In the latter case, all the bits must match. */ - - if (iplist) - { - for (da = cb->rhs; da; da = da->next) - { - int ipsep = ','; - const uschar *ptr = iplist; - uschar *res; - - /* Handle exact matching */ - - if (!bitmask) - { - while ((res = string_nextinlist(&ptr, &ipsep, NULL, 0))) - if (Ustrcmp(CS da->address, res) == 0) - break; - } - - /* Handle bitmask matching */ - - else - { - int address[4]; - int mask = 0; - - /* At present, all known DNS blocking lists use A records, with - IPv4 addresses on the RHS encoding the information they return. I - wonder if this will linger on as the last vestige of IPv4 when IPv6 - is ubiquitous? Anyway, for now we use paranoia code to completely - ignore IPv6 addresses. The default mask is 0, which always matches. - We change this only for IPv4 addresses in the list. */ - - if (host_aton(da->address, address) == 1) mask = address[0]; - - /* Scan the returned addresses, skipping any that are IPv6 */ - - while ((res = string_nextinlist(&ptr, &ipsep, NULL, 0))) - { - if (host_aton(res, address) != 1) continue; - if ((address[0] & mask) == address[0]) break; - } - } - - /* If either - - (a) An IP address in an any ('=') list matched, or - (b) No IP address in an all ('==') list matched - - then we're done searching. */ - - if (((match_type & MT_ALL) != 0) == (res == NULL)) break; - } - - /* If da == NULL, either - - (a) No IP address in an any ('=') list matched, or - (b) An IP address in an all ('==') list didn't match - - so behave as if the DNSBL lookup had not succeeded, i.e. the host is not on - the list. */ - - if ((match_type == MT_NOT || match_type == MT_ALL) != (da == NULL)) - { - HDEBUG(D_dnsbl) - { - uschar *res = NULL; - switch(match_type) - { - case 0: - res = US"was no match"; break; - case MT_NOT: - res = US"was an exclude match"; break; - case MT_ALL: - res = US"was an IP address that did not match"; break; - case MT_NOT|MT_ALL: - res = US"were no IP addresses that did not match"; break; - } - debug_printf("=> but we are not accepting this block class because\n"); - debug_printf("=> there %s for %s%c%s\n", - res, - ((match_type & MT_ALL) == 0)? "" : "=", - bitmask? '&' : '=', iplist); - } - return FAIL; - } - } - - /* Either there was no IP list, or the record matched, implying that the - domain is on the list. We now want to find a corresponding TXT record. If an - alternate domain is specified for the TXT record, call this function - recursively to look that up; this has the side effect of re-checking that - there is indeed an A record at the alternate domain. */ +DEBUG(D_verify) debug_printf_indent("verify_quota: len %d\n", len); +write(1, msg, len); +return; +} - if (domain_txt != domain) - return one_check_dnsbl(domain_txt, domain_txt, keydomain, prepend, NULL, - FALSE, match_type, defer_return); - /* If there is no alternate domain, look up a TXT record in the main domain - if it has not previously been cached. */ +/******************************************************************************/ - if (!cb->text_set) - { - cb->text_set = TRUE; - if (dns_basic_lookup(dnsa, query, T_TXT) == DNS_SUCCEED) - for (dns_record * rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS); rr; - rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) - if (rr->type == T_TXT) - { - int len = (rr->data)[0]; - if (len > 511) len = 127; - store_pool = POOL_PERM; - cb->text = string_sprintf("%.*s", len, CUS (rr->data+1)); - store_pool = old_pool; - break; - } - } - - dnslist_value = addlist; - dnslist_text = cb->text; - return OK; - } +/* Quota cache lookup. We use the callout hints db also for the quota cache. +Return TRUE if a nonexpired record was found, having filled in the yield +argument. +*/ -/* There was a problem with the DNS lookup */ +static BOOL +cached_quota_lookup(const uschar * rcpt, int * yield, + int pos_cache, int neg_cache) +{ +open_db dbblock, *dbm_file = NULL; +dbdata_callout_cache_address * cache_address_record; -if (cb->rc != DNS_NOMATCH && cb->rc != DNS_NODATA) +if (!pos_cache && !neg_cache) + return FALSE; +if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE))) { - log_write(L_dnslist_defer, LOG_MAIN, - "DNS list lookup defer (probably timeout) for %s: %s", query, - (defer_return == OK)? US"assumed in list" : - (defer_return == FAIL)? US"assumed not in list" : - US"returned DEFER"); - return defer_return; + HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n"); + return FALSE; } - -/* No entry was found in the DNS; continue for next domain */ - -HDEBUG(D_dnsbl) +if (!(cache_address_record = (dbdata_callout_cache_address *) + get_callout_cache_record(dbm_file, rcpt, US"address", + pos_cache, neg_cache))) { - debug_printf("DNS lookup for %s failed\n", query); - debug_printf("=> that means %s is not listed at %s\n", - keydomain, domain); + dbfn_close(dbm_file); + return FALSE; } - -return FAIL; +if (cache_address_record->result == ccache_accept) + *yield = OK; +dbfn_close(dbm_file); +return TRUE; } +/* Quota cache write */ +static void +cache_quota_write(const uschar * rcpt, int yield, int pos_cache, int neg_cache) +{ +open_db dbblock, *dbm_file = NULL; +dbdata_callout_cache_address cache_address_record; +if (!pos_cache && !neg_cache) + return; +if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE))) + { + HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n"); + return; + } -/************************************************* -* Check host against DNS black lists * -*************************************************/ - -/* This function runs checks against a list of DNS black lists, until one -matches. Each item on the list can be of the form - - domain=ip-address/key - -The domain is the right-most domain that is used for the query, for example, -blackholes.mail-abuse.org. If the IP address is present, there is a match only -if the DNS lookup returns a matching IP address. Several addresses may be -given, comma-separated, for example: x.y.z=127.0.0.1,127.0.0.2. - -If no key is given, what is looked up in the domain is the inverted IP address -of the current client host. If a key is given, it is used to construct the -domain for the lookup. For example: - - dsn.rfc-ignorant.org/$sender_address_domain - -After finding a match in the DNS, the domain is placed in $dnslist_domain, and -then we check for a TXT record for an error message, and if found, save its -value in $dnslist_text. We also cache everything in a tree, to optimize -multiple lookups. +cache_address_record.result = yield == OK ? ccache_accept : ccache_reject; -The TXT record is normally looked up in the same domain as the A record, but -when many lists are combined in a single DNS domain, this will not be a very -specific message. It is possible to specify a different domain for looking up -TXT records; this is given before the main domain, comma-separated. For -example: +(void)dbfn_write(dbm_file, rcpt, &cache_address_record, + (int)sizeof(dbdata_callout_cache_address)); +HDEBUG(D_verify) debug_printf_indent("wrote %s quota cache record for %s\n", + yield == OK ? "positive" : "negative", rcpt); - dnslists = http.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.2 : \ - socks.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.3 +dbfn_close(dbm_file); +return; +} -The caching ensures that only one lookup in dnsbl.sorbs.net is done. -Note: an address for testing RBL is 192.203.178.39 -Note: an address for testing DUL is 192.203.178.4 -Note: a domain for testing RFCI is example.tld.dsn.rfc-ignorant.org +/* To evaluate a local user's quota, starting in ACL, we need to +fork & exec to regain privileges, to that we can change to the user's +identity for access to their files. Arguments: - where the acl type - listptr the domain/address/data list - log_msgptr log message on error - -Returns: OK successful lookup (i.e. the address is on the list), or - lookup deferred after +include_unknown - FAIL name not found, or no data found for the given type, or - lookup deferred after +exclude_unknown (default) - DEFER lookup failure, if +defer_unknown was set + rcpt Recipient account + pos_cache Number of seconds to cache a positive result (delivery + to be accepted). Zero to disable caching. + neg_cache Number of seconds to cache a negative result. Zero to disable. + msg Pointer to result string pointer + +Return: OK/DEFER/FAIL code */ int -verify_check_dnsbl(int where, const uschar ** listptr, uschar ** log_msgptr) +verify_quota_call(const uschar * rcpt, int pos_cache, int neg_cache, + uschar ** msg) { -int sep = 0; -int defer_return = FAIL; -const uschar *list = *listptr; -uschar *domain; -uschar revadd[128]; /* Long enough for IPv6 address */ - -/* Indicate that the inverted IP address is not yet set up */ - -revadd[0] = 0; - -/* In case this is the first time the DNS resolver is being used. */ - -dns_init(FALSE, FALSE, FALSE); /*XXX dnssec? */ +int pfd[2], pid, save_errno, yield = FAIL; +void (*oldsignal)(int); +const uschar * where = US"socketpair"; -/* Loop through all the domains supplied, until something matches */ +*msg = NULL; -while ((domain = string_nextinlist(&list, &sep, NULL, 0))) +if (cached_quota_lookup(rcpt, &yield, pos_cache, neg_cache)) { - int rc; - BOOL bitmask = FALSE; - int match_type = 0; - uschar *domain_txt; - uschar *comma; - uschar *iplist; - uschar *key; - - HDEBUG(D_dnsbl) debug_printf("dnslists check: %s\n", domain); - - /* Deal with special values that change the behaviour on defer */ - - if (domain[0] == '+') + HDEBUG(D_verify) debug_printf_indent("quota cache: address record is %s\n", + yield == OK ? "positive" : "negative"); + if (yield != OK) { - if (strcmpic(domain, US"+include_unknown") == 0) defer_return = OK; - else if (strcmpic(domain, US"+exclude_unknown") == 0) defer_return = FAIL; - else if (strcmpic(domain, US"+defer_unknown") == 0) defer_return = DEFER; - else - log_write(0, LOG_MAIN|LOG_PANIC, "unknown item in dnslist (ignored): %s", - domain); - continue; + recipient_verify_failure = US"quota"; + acl_verify_message = *msg = + US"Previous (cached) quota verification failure"; } + return yield; + } - /* See if there's explicit data to be looked up */ - - if ((key = Ustrchr(domain, '/'))) *key++ = 0; - - /* See if there's a list of addresses supplied after the domain name. This is - introduced by an = or a & character; if preceded by = we require all matches - and if preceded by ! we invert the result. */ - - if (!(iplist = Ustrchr(domain, '='))) - { - bitmask = TRUE; - iplist = Ustrchr(domain, '&'); - } - - if (iplist) /* Found either = or & */ - { - if (iplist > domain && iplist[-1] == '!') /* Handle preceding ! */ - { - match_type |= MT_NOT; - iplist[-1] = 0; - } - - *iplist++ = 0; /* Terminate domain, move on */ +if (pipe(pfd) != 0) + goto fail; - /* If we found = (bitmask == FALSE), check for == or =& */ +where = US"fork"; +oldsignal = signal(SIGCHLD, SIG_DFL); +if ((pid = exim_fork(US"quota-verify")) < 0) + { + save_errno = errno; + close(pfd[pipe_write]); + close(pfd[pipe_read]); + errno = save_errno; + goto fail; + } - if (!bitmask && (*iplist == '=' || *iplist == '&')) - { - bitmask = *iplist++ == '&'; - match_type |= MT_ALL; - } - } +if (pid == 0) /* child */ + { + close(pfd[pipe_read]); + force_fd(pfd[pipe_write], 1); /* stdout to pipe */ + close(pfd[pipe_write]); + dup2(1, 0); + if (debug_fd > 0) force_fd(debug_fd, 2); + + child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 3, + US"-MCq", string_sprintf("%d", message_size), rcpt); + /*NOTREACHED*/ + } +save_errno = errno; +close(pfd[pipe_write]); - /* If there is a comma in the domain, it indicates that a second domain for - looking up TXT records is provided, before the main domain. Otherwise we must - set domain_txt == domain. */ +if (pid < 0) + { + DEBUG(D_verify) debug_printf_indent(" fork: %s\n", strerror(save_errno)); + } +else + { + uschar buf[128]; + int n = read(pfd[pipe_read], buf, sizeof(buf)); + int status; - domain_txt = domain; - if ((comma = Ustrchr(domain, ','))) + waitpid(pid, &status, 0); + if (status == 0) { - *comma++ = 0; - domain = comma; - } - - /* Check that what we have left is a sensible domain name. There is no reason - why these domains should in fact use the same syntax as hosts and email - domains, but in practice they seem to. However, there is little point in - actually causing an error here, because that would no doubt hold up incoming - mail. Instead, I'll just log it. */ + uschar * s; - for (uschar * s = domain; *s; s++) - if (!isalnum(*s) && *s != '-' && *s != '.' && *s != '_') + if (n > 0) yield = buf[0]; + if (n > 4) + save_errno = (buf[1] << 24) | (buf[2] << 16) | (buf[3] << 8) | buf[4]; + if ((recipient_verify_failure = n > 5 + ? string_copyn_taint(buf+5, n-5, GET_UNTAINTED) : NULL)) { - log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains " - "strange characters - is this right?", domain); - break; - } - - /* Check the alternate domain if present */ - - if (domain_txt != domain) for (uschar * s = domain_txt; *s; s++) - if (!isalnum(*s) && *s != '-' && *s != '.' && *s != '_') - { - log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains " - "strange characters - is this right?", domain_txt); - break; + int m; + s = buf + 5 + Ustrlen(recipient_verify_failure) + 1; + m = n - (s - buf); + acl_verify_message = *msg = + m > 0 ? string_copyn_taint(s, m, GET_UNTAINTED) : NULL; } - /* If there is no key string, construct the query by adding the domain name - onto the inverted host address, and perform a single DNS lookup. */ + DEBUG(D_verify) debug_printf_indent("verify call response:" + " len %d yield %s errno '%s' where '%s' msg '%s'\n", + n, rc_names[yield], strerror(save_errno), recipient_verify_failure, *msg); - if (!key) - { - if (where == ACL_WHERE_NOTSMTP_START || where == ACL_WHERE_NOTSMTP) - { - *log_msgptr = string_sprintf - ("cannot test auto-keyed dnslists condition in %s ACL", - acl_wherenames[where]); - return ERROR; - } - if (!sender_host_address) return FAIL; /* can never match */ - if (revadd[0] == 0) invert_address(revadd, sender_host_address); - rc = one_check_dnsbl(domain, domain_txt, sender_host_address, revadd, - iplist, bitmask, match_type, defer_return); - if (rc == OK) - { - dnslist_domain = string_copy(domain_txt); - dnslist_matched = string_copy(sender_host_address); - HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n", - sender_host_address, dnslist_domain); - } - if (rc != FAIL) return rc; /* OK or DEFER */ + if ( yield == OK + || save_errno == 0 && Ustrcmp(recipient_verify_failure, "quota") == 0) + cache_quota_write(rcpt, yield, pos_cache, neg_cache); + else DEBUG(D_verify) + debug_printf_indent("result not cacheable\n"); } - - /* If there is a key string, it can be a list of domains or IP addresses to - be concatenated with the main domain. */ - else { - int keysep = 0; - BOOL defer = FALSE; - uschar *keydomain; - uschar keyrevadd[128]; - - while ((keydomain = string_nextinlist(CUSS &key, &keysep, NULL, 0))) - { - uschar *prepend = keydomain; - - if (string_is_ip_address(keydomain, NULL) != 0) - { - invert_address(keyrevadd, keydomain); - prepend = keyrevadd; - } - - rc = one_check_dnsbl(domain, domain_txt, keydomain, prepend, iplist, - bitmask, match_type, defer_return); - if (rc == OK) - { - dnslist_domain = string_copy(domain_txt); - dnslist_matched = string_copy(keydomain); - HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n", - keydomain, dnslist_domain); - return OK; - } - - /* If the lookup deferred, remember this fact. We keep trying the rest - of the list to see if we get a useful result, and if we don't, we return - DEFER at the end. */ - - if (rc == DEFER) defer = TRUE; - } /* continue with next keystring domain/address */ - - if (defer) return DEFER; + DEBUG(D_verify) + debug_printf_indent("verify call response: waitpid status 0x%04x\n", status); } - } /* continue with next dnsdb outer domain */ + } -return FAIL; +close(pfd[pipe_read]); +signal(SIGCHLD, oldsignal); +errno = save_errno; +return yield; + +fail: +DEBUG(D_verify) debug_printf_indent("verify_quota_call fail in %s\n", where); +return yield; } + /* vi: aw ai sw=2 */ /* End of verify.c */