1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2015 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Functions for handling an incoming SMTP call. */
14 /* Initialize for TCP wrappers if so configured. It appears that the macro
15 HAVE_IPV6 is used in some versions of the tcpd.h header, so we unset it before
16 including that header, and restore its value afterwards. */
18 #ifdef USE_TCP_WRAPPERS
21 #define EXIM_HAVE_IPV6
27 #define HAVE_IPV6 TRUE
30 int allow_severity = LOG_INFO;
31 int deny_severity = LOG_NOTICE;
32 uschar *tcp_wrappers_name;
36 /* Size of buffer for reading SMTP commands. We used to use 512, as defined
37 by RFC 821. However, RFC 1869 specifies that this must be increased for SMTP
38 commands that accept arguments, and this in particular applies to AUTH, where
39 the data can be quite long. More recently this value was 2048 in Exim;
40 however, RFC 4954 (circa 2007) recommends 12288 bytes to handle AUTH. Clients
41 such as Thunderbird will send an AUTH with an initial-response for GSSAPI.
42 The maximum size of a Kerberos ticket under Windows 2003 is 12000 bytes, and
43 we need room to handle large base64-encoded AUTHs for GSSAPI.
46 #define smtp_cmd_buffer_size 16384
48 /* Size of buffer for reading SMTP incoming packets */
50 #define in_buffer_size 8192
52 /* Structure for SMTP command list */
59 short int is_mail_cmd;
62 /* Codes for identifying commands. We order them so that those that come first
63 are those for which synchronization is always required. Checking this can help
67 /* These commands are required to be synchronized, i.e. to be the last in a
68 block of commands when pipelining. */
70 HELO_CMD, EHLO_CMD, DATA_CMD, /* These are listed in the pipelining */
71 VRFY_CMD, EXPN_CMD, NOOP_CMD, /* RFC as requiring synchronization */
72 ETRN_CMD, /* This by analogy with TURN from the RFC */
73 STARTTLS_CMD, /* Required by the STARTTLS RFC */
74 TLS_AUTH_CMD, /* auto-command at start of SSL */
76 /* This is a dummy to identify the non-sync commands when pipelining */
78 NON_SYNC_CMD_PIPELINING,
80 /* These commands need not be synchronized when pipelining */
82 MAIL_CMD, RCPT_CMD, RSET_CMD,
84 /* This is a dummy to identify the non-sync commands when not pipelining */
86 NON_SYNC_CMD_NON_PIPELINING,
88 /* I have been unable to find a statement about the use of pipelining
89 with AUTH, so to be on the safe side it is here, though I kind of feel
90 it should be up there with the synchronized commands. */
94 /* I'm not sure about these, but I don't think they matter. */
98 #ifdef EXPERIMENTAL_PROXY
99 PROXY_FAIL_IGNORE_CMD,
102 /* These are specials that don't correspond to actual commands */
104 EOF_CMD, OTHER_CMD, BADARG_CMD, BADCHAR_CMD, BADSYN_CMD,
105 TOO_MANY_NONMAIL_CMD };
108 /* This is a convenience macro for adding the identity of an SMTP command
109 to the circular buffer that holds a list of the last n received. */
112 smtp_connection_had[smtp_ch_index++] = n; \
113 if (smtp_ch_index >= SMTP_HBUFF_SIZE) smtp_ch_index = 0
116 /*************************************************
117 * Local static variables *
118 *************************************************/
120 static auth_instance *authenticated_by;
121 static BOOL auth_advertised;
123 static BOOL tls_advertised;
125 static BOOL dsn_advertised;
127 static BOOL helo_required = FALSE;
128 static BOOL helo_verify = FALSE;
129 static BOOL helo_seen;
130 static BOOL helo_accept_junk;
131 static BOOL count_nonmail;
132 static BOOL pipelining_advertised;
133 static BOOL rcpt_smtp_response_same;
134 static BOOL rcpt_in_progress;
135 static int nonmail_command_count;
136 static BOOL smtp_exit_function_called = 0;
137 #ifdef EXPERIMENTAL_INTERNATIONAL
138 static BOOL smtputf8_advertised;
140 static int synprot_error_count;
141 static int unknown_command_count;
142 static int sync_cmd_limit;
143 static int smtp_write_error = 0;
145 static uschar *rcpt_smtp_response;
146 static uschar *smtp_data_buffer;
147 static uschar *smtp_cmd_data;
149 /* We need to know the position of RSET, HELO, EHLO, AUTH, and STARTTLS. Their
150 final fields of all except AUTH are forced TRUE at the start of a new message
151 setup, to allow one of each between messages that is not counted as a nonmail
152 command. (In fact, only one of HELO/EHLO is not counted.) Also, we have to
153 allow a new EHLO after starting up TLS.
155 AUTH is "falsely" labelled as a mail command initially, so that it doesn't get
156 counted. However, the flag is changed when AUTH is received, so that multiple
157 failing AUTHs will eventually hit the limit. After a successful AUTH, another
158 AUTH is already forbidden. After a TLS session is started, AUTH's flag is again
159 forced TRUE, to allow for the re-authentication that can happen at that point.
161 QUIT is also "falsely" labelled as a mail command so that it doesn't up the
162 count of non-mail commands and possibly provoke an error. */
164 static smtp_cmd_list cmd_list[] = {
165 /* name len cmd has_arg is_mail_cmd */
167 { "rset", sizeof("rset")-1, RSET_CMD, FALSE, FALSE }, /* First */
168 { "helo", sizeof("helo")-1, HELO_CMD, TRUE, FALSE },
169 { "ehlo", sizeof("ehlo")-1, EHLO_CMD, TRUE, FALSE },
170 { "auth", sizeof("auth")-1, AUTH_CMD, TRUE, TRUE },
172 { "starttls", sizeof("starttls")-1, STARTTLS_CMD, FALSE, FALSE },
173 { "tls_auth", 0, TLS_AUTH_CMD, FALSE, TRUE },
176 /* If you change anything above here, also fix the definitions below. */
178 { "mail from:", sizeof("mail from:")-1, MAIL_CMD, TRUE, TRUE },
179 { "rcpt to:", sizeof("rcpt to:")-1, RCPT_CMD, TRUE, TRUE },
180 { "data", sizeof("data")-1, DATA_CMD, FALSE, TRUE },
181 { "quit", sizeof("quit")-1, QUIT_CMD, FALSE, TRUE },
182 { "noop", sizeof("noop")-1, NOOP_CMD, TRUE, FALSE },
183 { "etrn", sizeof("etrn")-1, ETRN_CMD, TRUE, FALSE },
184 { "vrfy", sizeof("vrfy")-1, VRFY_CMD, TRUE, FALSE },
185 { "expn", sizeof("expn")-1, EXPN_CMD, TRUE, FALSE },
186 { "help", sizeof("help")-1, HELP_CMD, TRUE, FALSE }
189 static smtp_cmd_list *cmd_list_end =
190 cmd_list + sizeof(cmd_list)/sizeof(smtp_cmd_list);
192 #define CMD_LIST_RSET 0
193 #define CMD_LIST_HELO 1
194 #define CMD_LIST_EHLO 2
195 #define CMD_LIST_AUTH 3
196 #define CMD_LIST_STARTTLS 4
197 #define CMD_LIST_TLS_AUTH 5
199 /* This list of names is used for performing the smtp_no_mail logging action.
200 It must be kept in step with the SCH_xxx enumerations. */
202 static uschar *smtp_names[] =
204 US"NONE", US"AUTH", US"DATA", US"EHLO", US"ETRN", US"EXPN", US"HELO",
205 US"HELP", US"MAIL", US"NOOP", US"QUIT", US"RCPT", US"RSET", US"STARTTLS",
208 static uschar *protocols_local[] = {
209 US"local-smtp", /* HELO */
210 US"local-smtps", /* The rare case EHLO->STARTTLS->HELO */
211 US"local-esmtp", /* EHLO */
212 US"local-esmtps", /* EHLO->STARTTLS->EHLO */
213 US"local-esmtpa", /* EHLO->AUTH */
214 US"local-esmtpsa" /* EHLO->STARTTLS->EHLO->AUTH */
216 static uschar *protocols[] = {
218 US"smtps", /* The rare case EHLO->STARTTLS->HELO */
219 US"esmtp", /* EHLO */
220 US"esmtps", /* EHLO->STARTTLS->EHLO */
221 US"esmtpa", /* EHLO->AUTH */
222 US"esmtpsa" /* EHLO->STARTTLS->EHLO->AUTH */
227 #define pcrpted 1 /* added to pextend or pnormal */
228 #define pauthed 2 /* added to pextend */
230 /* Sanity check and validate optional args to MAIL FROM: envelope */
232 ENV_MAIL_OPT_SIZE, ENV_MAIL_OPT_BODY, ENV_MAIL_OPT_AUTH,
236 ENV_MAIL_OPT_RET, ENV_MAIL_OPT_ENVID,
237 #ifdef EXPERIMENTAL_INTERNATIONAL
243 uschar * name; /* option requested during MAIL cmd */
244 int value; /* enum type */
245 BOOL need_value; /* TRUE requires value (name=value pair format)
246 FALSE is a singleton */
248 static env_mail_type_t env_mail_type_list[] = {
249 { US"SIZE", ENV_MAIL_OPT_SIZE, TRUE },
250 { US"BODY", ENV_MAIL_OPT_BODY, TRUE },
251 { US"AUTH", ENV_MAIL_OPT_AUTH, TRUE },
253 { US"PRDR", ENV_MAIL_OPT_PRDR, FALSE },
255 { US"RET", ENV_MAIL_OPT_RET, TRUE },
256 { US"ENVID", ENV_MAIL_OPT_ENVID, TRUE },
257 #ifdef EXPERIMENTAL_INTERNATIONAL
258 { US"SMTPUTF8",ENV_MAIL_OPT_UTF8, FALSE }, /* rfc6531 */
260 { US"NULL", ENV_MAIL_OPT_NULL, FALSE }
263 /* When reading SMTP from a remote host, we have to use our own versions of the
264 C input-reading functions, in order to be able to flush the SMTP output only
265 when about to read more data from the socket. This is the only way to get
266 optimal performance when the client is using pipelining. Flushing for every
267 command causes a separate packet and reply packet each time; saving all the
268 responses up (when pipelining) combines them into one packet and one response.
270 For simplicity, these functions are used for *all* SMTP input, not only when
271 receiving over a socket. However, after setting up a secure socket (SSL), input
272 is read via the OpenSSL library, and another set of functions is used instead
275 These functions are set in the receive_getc etc. variables and called with the
276 same interface as the C functions. However, since there can only ever be
277 one incoming SMTP call, we just use a single buffer and flags. There is no need
278 to implement a complicated private FILE-like structure.*/
280 static uschar *smtp_inbuffer;
281 static uschar *smtp_inptr;
282 static uschar *smtp_inend;
283 static int smtp_had_eof;
284 static int smtp_had_error;
287 /*************************************************
288 * SMTP version of getc() *
289 *************************************************/
291 /* This gets the next byte from the SMTP input buffer. If the buffer is empty,
292 it flushes the output, and refills the buffer, with a timeout. The signal
293 handler is set appropriately by the calling function. This function is not used
294 after a connection has negotated itself into an TLS/SSL state.
297 Returns: the next character or EOF
303 if (smtp_inptr >= smtp_inend)
307 if (smtp_receive_timeout > 0) alarm(smtp_receive_timeout);
308 rc = read(fileno(smtp_in), smtp_inbuffer, in_buffer_size);
313 /* Must put the error text in fixed store, because this might be during
314 header reading, where it releases unused store above the header. */
317 smtp_had_error = save_errno;
318 smtp_read_error = string_copy_malloc(
319 string_sprintf(" (error: %s)", strerror(save_errno)));
321 else smtp_had_eof = 1;
325 dkim_exim_verify_feed(smtp_inbuffer, rc);
327 smtp_inend = smtp_inbuffer + rc;
328 smtp_inptr = smtp_inbuffer;
330 return *smtp_inptr++;
335 /*************************************************
336 * SMTP version of ungetc() *
337 *************************************************/
339 /* Puts a character back in the input buffer. Only ever
345 Returns: the character
351 *(--smtp_inptr) = ch;
358 /*************************************************
359 * SMTP version of feof() *
360 *************************************************/
362 /* Tests for a previous EOF
365 Returns: non-zero if the eof flag is set
377 /*************************************************
378 * SMTP version of ferror() *
379 *************************************************/
381 /* Tests for a previous read error, and returns with errno
382 restored to what it was when the error was detected.
385 Returns: non-zero if the error flag is set
391 errno = smtp_had_error;
392 return smtp_had_error;
397 /*************************************************
398 * Test for characters in the SMTP buffer *
399 *************************************************/
401 /* Used at the end of a message
410 return smtp_inptr < smtp_inend;
415 /*************************************************
416 * Write formatted string to SMTP channel *
417 *************************************************/
419 /* This is a separate function so that we don't have to repeat everything for
420 TLS support or debugging. It is global so that the daemon and the
421 authentication functions can use it. It does not return any error indication,
422 because major problems such as dropped connections won't show up till an output
423 flush for non-TLS connections. The smtp_fflush() function is available for
424 checking that: for convenience, TLS output errors are remembered here so that
425 they are also picked up later by smtp_fflush().
429 ... optional arguments
435 smtp_printf(const char *format, ...)
439 va_start(ap, format);
440 smtp_vprintf(format, ap);
444 /* This is split off so that verify.c:respond_printf() can, in effect, call
445 smtp_printf(), bearing in mind that in C a vararg function can't directly
446 call another vararg function, only a function which accepts a va_list. */
449 smtp_vprintf(const char *format, va_list ap)
453 yield = string_vformat(big_buffer, big_buffer_size, format, ap);
457 void *reset_point = store_get(0);
458 uschar *msg_copy, *cr, *end;
459 msg_copy = string_copy(big_buffer);
460 end = msg_copy + Ustrlen(msg_copy);
461 while ((cr = Ustrchr(msg_copy, '\r')) != NULL) /* lose CRs */
462 memmove(cr, cr + 1, (end--) - cr);
463 debug_printf("SMTP>> %s", msg_copy);
464 store_reset(reset_point);
469 log_write(0, LOG_MAIN|LOG_PANIC, "string too large in smtp_printf()");
470 smtp_closedown(US"Unexpected error");
471 exim_exit(EXIT_FAILURE);
474 /* If this is the first output for a (non-batch) RCPT command, see if all RCPTs
475 have had the same. Note: this code is also present in smtp_respond(). It would
476 be tidier to have it only in one place, but when it was added, it was easier to
477 do it that way, so as not to have to mess with the code for the RCPT command,
478 which sometimes uses smtp_printf() and sometimes smtp_respond(). */
480 if (rcpt_in_progress)
482 if (rcpt_smtp_response == NULL)
483 rcpt_smtp_response = string_copy(big_buffer);
484 else if (rcpt_smtp_response_same &&
485 Ustrcmp(rcpt_smtp_response, big_buffer) != 0)
486 rcpt_smtp_response_same = FALSE;
487 rcpt_in_progress = FALSE;
490 /* Now write the string */
493 if (tls_in.active >= 0)
495 if (tls_write(TRUE, big_buffer, Ustrlen(big_buffer)) < 0)
496 smtp_write_error = -1;
501 if (fprintf(smtp_out, "%s", big_buffer) < 0) smtp_write_error = -1;
506 /*************************************************
507 * Flush SMTP out and check for error *
508 *************************************************/
510 /* This function isn't currently used within Exim (it detects errors when it
511 tries to read the next SMTP input), but is available for use in local_scan().
512 For non-TLS connections, it flushes the output and checks for errors. For
513 TLS-connections, it checks for a previously-detected TLS write error.
516 Returns: 0 for no error; -1 after an error
522 if (tls_in.active < 0 && fflush(smtp_out) != 0) smtp_write_error = -1;
523 return smtp_write_error;
528 /*************************************************
529 * SMTP command read timeout *
530 *************************************************/
532 /* Signal handler for timing out incoming SMTP commands. This attempts to
535 Argument: signal number (SIGALRM)
540 command_timeout_handler(int sig)
542 sig = sig; /* Keep picky compilers happy */
543 log_write(L_lost_incoming_connection,
544 LOG_MAIN, "SMTP command timeout on%s connection from %s",
545 (tls_in.active >= 0)? " TLS" : "",
546 host_and_ident(FALSE));
547 if (smtp_batched_input)
548 moan_smtp_batch(NULL, "421 SMTP command timeout"); /* Does not return */
549 smtp_notquit_exit(US"command-timeout", US"421",
550 US"%s: SMTP command timeout - closing connection", smtp_active_hostname);
551 exim_exit(EXIT_FAILURE);
556 /*************************************************
558 *************************************************/
560 /* Signal handler for handling SIGTERM. Again, try to finish tidily.
562 Argument: signal number (SIGTERM)
567 command_sigterm_handler(int sig)
569 sig = sig; /* Keep picky compilers happy */
570 log_write(0, LOG_MAIN, "%s closed after SIGTERM", smtp_get_connection_info());
571 if (smtp_batched_input)
572 moan_smtp_batch(NULL, "421 SIGTERM received"); /* Does not return */
573 smtp_notquit_exit(US"signal-exit", US"421",
574 US"%s: Service not available - closing connection", smtp_active_hostname);
575 exim_exit(EXIT_FAILURE);
581 #ifdef EXPERIMENTAL_PROXY
582 /*************************************************
583 * Restore socket timeout to previous value *
584 *************************************************/
585 /* If the previous value was successfully retrieved, restore
586 it before returning control to the non-proxy routines
588 Arguments: fd - File descriptor for input
589 get_ok - Successfully retrieved previous values
590 tvtmp - Time struct with previous values
591 vslen - Length of time struct
595 restore_socket_timeout(int fd, int get_ok, struct timeval tvtmp, socklen_t vslen)
598 setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (char *)&tvtmp, vslen);
601 /*************************************************
602 * Check if host is required proxy host *
603 *************************************************/
604 /* The function determines if inbound host will be a regular smtp host
605 or if it is configured that it must use Proxy Protocol.
612 check_proxy_protocol_host()
615 /* Cannot configure local connection as a proxy inbound */
616 if (sender_host_address == NULL) return proxy_session;
618 rc = verify_check_this_host(&proxy_required_hosts, NULL, NULL,
619 sender_host_address, NULL);
623 debug_printf("Detected proxy protocol configured host\n");
624 proxy_session = TRUE;
626 return proxy_session;
630 /*************************************************
631 * Setup host for proxy protocol *
632 *************************************************/
633 /* The function configures the connection based on a header from the
634 inbound host to use Proxy Protocol. The specification is very exact
635 so exit with an error if do not find the exact required pieces. This
636 includes an incorrect number of spaces separating args.
643 setup_proxy_protocol_host()
655 struct { /* TCP/UDP over IPv4, len = 12 */
661 struct { /* TCP/UDP over IPv6, len = 36 */
662 uint8_t src_addr[16];
663 uint8_t dst_addr[16];
667 struct { /* AF_UNIX sockets, len = 216 */
668 uschar src_addr[108];
669 uschar dst_addr[108];
675 /* Temp variables used in PPv2 address:port parsing */
677 char tmpip[INET_ADDRSTRLEN];
678 struct sockaddr_in tmpaddr;
679 char tmpip6[INET6_ADDRSTRLEN];
680 struct sockaddr_in6 tmpaddr6;
684 const char v2sig[12] = "\x0D\x0A\x0D\x0A\x00\x0D\x0A\x51\x55\x49\x54\x0A";
685 uschar *iptype; /* To display debug info */
688 struct timeval tvtmp;
690 vslen = sizeof(struct timeval);
692 fd = fileno(smtp_in);
694 /* Save current socket timeout values */
695 get_ok = getsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (char *)&tvtmp,
698 /* Proxy Protocol host must send header within a short time
699 (default 3 seconds) or it's considered invalid */
700 tv.tv_sec = PROXY_NEGOTIATION_TIMEOUT_SEC;
701 tv.tv_usec = PROXY_NEGOTIATION_TIMEOUT_USEC;
702 setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (char *)&tv,
703 sizeof(struct timeval));
707 /* The inbound host was declared to be a Proxy Protocol host, so
708 don't do a PEEK into the data, actually slurp it up. */
709 ret = recv(fd, &hdr, sizeof(hdr), 0);
711 while (ret == -1 && errno == EINTR);
715 restore_socket_timeout(fd, get_ok, tvtmp, vslen);
716 return (errno == EAGAIN) ? 0 : ERRNO_PROXYFAIL;
720 memcmp(&hdr.v2, v2sig, 12) == 0)
724 /* May 2014: haproxy combined the version and command into one byte to
725 allow two full bytes for the length field in order to proxy SSL
726 connections. SSL Proxy is not supported in this version of Exim, but
727 must still seperate values here. */
728 ver = (hdr.v2.ver_cmd & 0xf0) >> 4;
729 cmd = (hdr.v2.ver_cmd & 0x0f);
733 DEBUG(D_receive) debug_printf("Invalid Proxy Protocol version: %d\n", ver);
736 DEBUG(D_receive) debug_printf("Detected PROXYv2 header\n");
737 /* The v2 header will always be 16 bytes per the spec. */
738 size = 16 + hdr.v2.len;
741 DEBUG(D_receive) debug_printf("Truncated or too large PROXYv2 header (%d/%d)\n",
747 case 0x01: /* PROXY command */
750 case 0x11: /* TCPv4 address type */
752 tmpaddr.sin_addr.s_addr = hdr.v2.addr.ip4.src_addr;
753 inet_ntop(AF_INET, &(tmpaddr.sin_addr), (char *)&tmpip, sizeof(tmpip));
754 if (!string_is_ip_address(US tmpip,NULL))
756 DEBUG(D_receive) debug_printf("Invalid %s source IP\n", iptype);
757 return ERRNO_PROXYFAIL;
759 proxy_host_address = sender_host_address;
760 sender_host_address = string_copy(US tmpip);
761 tmpport = ntohs(hdr.v2.addr.ip4.src_port);
762 proxy_host_port = sender_host_port;
763 sender_host_port = tmpport;
764 /* Save dest ip/port */
765 tmpaddr.sin_addr.s_addr = hdr.v2.addr.ip4.dst_addr;
766 inet_ntop(AF_INET, &(tmpaddr.sin_addr), (char *)&tmpip, sizeof(tmpip));
767 if (!string_is_ip_address(US tmpip,NULL))
769 DEBUG(D_receive) debug_printf("Invalid %s dest port\n", iptype);
770 return ERRNO_PROXYFAIL;
772 proxy_target_address = string_copy(US tmpip);
773 tmpport = ntohs(hdr.v2.addr.ip4.dst_port);
774 proxy_target_port = tmpport;
776 case 0x21: /* TCPv6 address type */
778 memmove(tmpaddr6.sin6_addr.s6_addr, hdr.v2.addr.ip6.src_addr, 16);
779 inet_ntop(AF_INET6, &(tmpaddr6.sin6_addr), (char *)&tmpip6, sizeof(tmpip6));
780 if (!string_is_ip_address(US tmpip6,NULL))
782 DEBUG(D_receive) debug_printf("Invalid %s source IP\n", iptype);
783 return ERRNO_PROXYFAIL;
785 proxy_host_address = sender_host_address;
786 sender_host_address = string_copy(US tmpip6);
787 tmpport = ntohs(hdr.v2.addr.ip6.src_port);
788 proxy_host_port = sender_host_port;
789 sender_host_port = tmpport;
790 /* Save dest ip/port */
791 memmove(tmpaddr6.sin6_addr.s6_addr, hdr.v2.addr.ip6.dst_addr, 16);
792 inet_ntop(AF_INET6, &(tmpaddr6.sin6_addr), (char *)&tmpip6, sizeof(tmpip6));
793 if (!string_is_ip_address(US tmpip6,NULL))
795 DEBUG(D_receive) debug_printf("Invalid %s dest port\n", iptype);
796 return ERRNO_PROXYFAIL;
798 proxy_target_address = string_copy(US tmpip6);
799 tmpport = ntohs(hdr.v2.addr.ip6.dst_port);
800 proxy_target_port = tmpport;
804 debug_printf("Unsupported PROXYv2 connection type: 0x%02x\n",
808 /* Unsupported protocol, keep local connection address */
810 case 0x00: /* LOCAL command */
811 /* Keep local connection address for LOCAL */
815 debug_printf("Unsupported PROXYv2 command: 0x%x\n", cmd);
820 memcmp(hdr.v1.line, "PROXY", 5) == 0)
822 uschar *p = string_copy(hdr.v1.line);
823 uschar *end = memchr(p, '\r', ret - 1);
824 uschar *sp; /* Utility variables follow */
828 if (!end || end[1] != '\n')
830 DEBUG(D_receive) debug_printf("Partial or invalid PROXY header\n");
833 *end = '\0'; /* Terminate the string */
834 size = end + 2 - hdr.v1.line; /* Skip header + CRLF */
835 DEBUG(D_receive) debug_printf("Detected PROXYv1 header\n");
836 /* Step through the string looking for the required fields. Ensure
837 strict adherance to required formatting, exit for any error. */
839 if (!isspace(*(p++)))
841 DEBUG(D_receive) debug_printf("Missing space after PROXY command\n");
844 if (!Ustrncmp(p, CCS"TCP4", 4))
846 else if (!Ustrncmp(p,CCS"TCP6", 4))
848 else if (!Ustrncmp(p,CCS"UNKNOWN", 7))
850 iptype = US"Unknown";
855 DEBUG(D_receive) debug_printf("Invalid TCP type\n");
859 p += Ustrlen(iptype);
860 if (!isspace(*(p++)))
862 DEBUG(D_receive) debug_printf("Missing space after TCP4/6 command\n");
865 /* Find the end of the arg */
866 if ((sp = Ustrchr(p, ' ')) == NULL)
869 debug_printf("Did not find proxied src %s\n", iptype);
873 if(!string_is_ip_address(p,NULL))
876 debug_printf("Proxied src arg is not an %s address\n", iptype);
879 proxy_host_address = sender_host_address;
880 sender_host_address = p;
882 if ((sp = Ustrchr(p, ' ')) == NULL)
885 debug_printf("Did not find proxy dest %s\n", iptype);
889 if(!string_is_ip_address(p,NULL))
892 debug_printf("Proxy dest arg is not an %s address\n", iptype);
895 proxy_target_address = p;
897 if ((sp = Ustrchr(p, ' ')) == NULL)
899 DEBUG(D_receive) debug_printf("Did not find proxied src port\n");
903 tmp_port = strtol(CCS p,&endc,10);
904 if (*endc || tmp_port == 0)
907 debug_printf("Proxied src port '%s' not an integer\n", p);
910 proxy_host_port = sender_host_port;
911 sender_host_port = tmp_port;
913 if ((sp = Ustrchr(p, '\0')) == NULL)
915 DEBUG(D_receive) debug_printf("Did not find proxy dest port\n");
918 tmp_port = strtol(CCS p,&endc,10);
919 if (*endc || tmp_port == 0)
922 debug_printf("Proxy dest port '%s' not an integer\n", p);
925 proxy_target_port = tmp_port;
926 /* Already checked for /r /n above. Good V1 header received. */
932 DEBUG(D_receive) debug_printf("Invalid proxy protocol version negotiation\n");
937 restore_socket_timeout(fd, get_ok, tvtmp, vslen);
938 /* Don't flush any potential buffer contents. Any input should cause a
939 synchronization failure */
943 restore_socket_timeout(fd, get_ok, tvtmp, vslen);
945 debug_printf("Valid %s sender from Proxy Protocol header\n", iptype);
946 return proxy_session;
950 /*************************************************
951 * Read one command line *
952 *************************************************/
954 /* Strictly, SMTP commands coming over the net are supposed to end with CRLF.
955 There are sites that don't do this, and in any case internal SMTP probably
956 should check only for LF. Consequently, we check here for LF only. The line
957 ends up with [CR]LF removed from its end. If we get an overlong line, treat as
958 an unknown command. The command is read into the global smtp_cmd_buffer so that
959 it is available via $smtp_command.
961 The character reading routine sets up a timeout for each block actually read
962 from the input (which may contain more than one command). We set up a special
963 signal handler that closes down the session on a timeout. Control does not
967 check_sync if TRUE, check synchronization rules if global option is TRUE
969 Returns: a code identifying the command (enumerated above)
973 smtp_read_command(BOOL check_sync)
978 BOOL hadnull = FALSE;
980 os_non_restarting_signal(SIGALRM, command_timeout_handler);
982 while ((c = (receive_getc)()) != '\n' && c != EOF)
984 if (ptr >= smtp_cmd_buffer_size)
986 os_non_restarting_signal(SIGALRM, sigalrm_handler);
994 smtp_cmd_buffer[ptr++] = c;
997 receive_linecount++; /* For BSMTP errors */
998 os_non_restarting_signal(SIGALRM, sigalrm_handler);
1000 /* If hit end of file, return pseudo EOF command. Whether we have a
1001 part-line already read doesn't matter, since this is an error state. */
1003 if (c == EOF) return EOF_CMD;
1005 /* Remove any CR and white space at the end of the line, and terminate the
1008 while (ptr > 0 && isspace(smtp_cmd_buffer[ptr-1])) ptr--;
1009 smtp_cmd_buffer[ptr] = 0;
1011 DEBUG(D_receive) debug_printf("SMTP<< %s\n", smtp_cmd_buffer);
1013 /* NULLs are not allowed in SMTP commands */
1015 if (hadnull) return BADCHAR_CMD;
1017 /* Scan command list and return identity, having set the data pointer
1018 to the start of the actual data characters. Check for SMTP synchronization
1021 for (p = cmd_list; p < cmd_list_end; p++)
1023 #ifdef EXPERIMENTAL_PROXY
1024 /* Only allow QUIT command if Proxy Protocol parsing failed */
1025 if (proxy_session && proxy_session_failed)
1027 if (p->cmd != QUIT_CMD)
1031 if (strncmpic(smtp_cmd_buffer, US p->name, p->len) == 0 &&
1032 (smtp_cmd_buffer[p->len-1] == ':' || /* "mail from:" or "rcpt to:" */
1033 smtp_cmd_buffer[p->len] == 0 ||
1034 smtp_cmd_buffer[p->len] == ' '))
1036 if (smtp_inptr < smtp_inend && /* Outstanding input */
1037 p->cmd < sync_cmd_limit && /* Command should sync */
1038 check_sync && /* Local flag set */
1039 smtp_enforce_sync && /* Global flag set */
1040 sender_host_address != NULL && /* Not local input */
1041 !sender_host_notsocket) /* Really is a socket */
1044 /* The variables $smtp_command and $smtp_command_argument point into the
1045 unmodified input buffer. A copy of the latter is taken for actual
1046 processing, so that it can be chopped up into separate parts if necessary,
1047 for example, when processing a MAIL command options such as SIZE that can
1048 follow the sender address. */
1050 smtp_cmd_argument = smtp_cmd_buffer + p->len;
1051 while (isspace(*smtp_cmd_argument)) smtp_cmd_argument++;
1052 Ustrcpy(smtp_data_buffer, smtp_cmd_argument);
1053 smtp_cmd_data = smtp_data_buffer;
1055 /* Count non-mail commands from those hosts that are controlled in this
1056 way. The default is all hosts. We don't waste effort checking the list
1057 until we get a non-mail command, but then cache the result to save checking
1058 again. If there's a DEFER while checking the host, assume it's in the list.
1060 Note that one instance of RSET, EHLO/HELO, and STARTTLS is allowed at the
1061 start of each incoming message by fiddling with the value in the table. */
1063 if (!p->is_mail_cmd)
1065 if (count_nonmail == TRUE_UNSET) count_nonmail =
1066 verify_check_host(&smtp_accept_max_nonmail_hosts) != FAIL;
1067 if (count_nonmail && ++nonmail_command_count > smtp_accept_max_nonmail)
1068 return TOO_MANY_NONMAIL_CMD;
1071 /* If there is data for a command that does not expect it, generate the
1074 return (p->has_arg || *smtp_cmd_data == 0)? p->cmd : BADARG_CMD;
1078 #ifdef EXPERIMENTAL_PROXY
1079 /* Only allow QUIT command if Proxy Protocol parsing failed */
1080 if (proxy_session && proxy_session_failed)
1081 return PROXY_FAIL_IGNORE_CMD;
1084 /* Enforce synchronization for unknown commands */
1086 if (smtp_inptr < smtp_inend && /* Outstanding input */
1087 check_sync && /* Local flag set */
1088 smtp_enforce_sync && /* Global flag set */
1089 sender_host_address != NULL && /* Not local input */
1090 !sender_host_notsocket) /* Really is a socket */
1098 /*************************************************
1099 * Recheck synchronization *
1100 *************************************************/
1102 /* Synchronization checks can never be perfect because a packet may be on its
1103 way but not arrived when the check is done. Such checks can in any case only be
1104 done when TLS is not in use. Normally, the checks happen when commands are
1105 read: Exim ensures that there is no more input in the input buffer. In normal
1106 cases, the response to the command will be fast, and there is no further check.
1108 However, for some commands an ACL is run, and that can include delays. In those
1109 cases, it is useful to do another check on the input just before sending the
1110 response. This also applies at the start of a connection. This function does
1111 that check by means of the select() function, as long as the facility is not
1112 disabled or inappropriate. A failure of select() is ignored.
1114 When there is unwanted input, we read it so that it appears in the log of the
1118 Returns: TRUE if all is well; FALSE if there is input pending
1126 struct timeval tzero;
1128 if (!smtp_enforce_sync || sender_host_address == NULL ||
1129 sender_host_notsocket || tls_in.active >= 0)
1132 fd = fileno(smtp_in);
1137 rc = select(fd + 1, (SELECT_ARG2_TYPE *)&fds, NULL, NULL, &tzero);
1139 if (rc <= 0) return TRUE; /* Not ready to read */
1141 if (rc < 0) return TRUE; /* End of file or error */
1144 rc = smtp_inend - smtp_inptr;
1145 if (rc > 150) rc = 150;
1152 /*************************************************
1153 * Forced closedown of call *
1154 *************************************************/
1156 /* This function is called from log.c when Exim is dying because of a serious
1157 disaster, and also from some other places. If an incoming non-batched SMTP
1158 channel is open, it swallows the rest of the incoming message if in the DATA
1159 phase, sends the reply string, and gives an error to all subsequent commands
1160 except QUIT. The existence of an SMTP call is detected by the non-NULLness of
1164 message SMTP reply string to send, excluding the code
1170 smtp_closedown(uschar *message)
1172 if (smtp_in == NULL || smtp_batched_input) return;
1173 receive_swallow_smtp();
1174 smtp_printf("421 %s\r\n", message);
1178 switch(smtp_read_command(FALSE))
1184 smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
1189 smtp_printf("250 Reset OK\r\n");
1193 smtp_printf("421 %s\r\n", message);
1202 /*************************************************
1203 * Set up connection info for logging *
1204 *************************************************/
1206 /* This function is called when logging information about an SMTP connection.
1207 It sets up appropriate source information, depending on the type of connection.
1208 If sender_fullhost is NULL, we are at a very early stage of the connection;
1209 just use the IP address.
1212 Returns: a string describing the connection
1216 smtp_get_connection_info(void)
1218 uschar *hostname = (sender_fullhost == NULL)?
1219 sender_host_address : sender_fullhost;
1222 return string_sprintf("SMTP connection from %s", hostname);
1224 if (sender_host_unknown || sender_host_notsocket)
1225 return string_sprintf("SMTP connection from %s", sender_ident);
1228 return string_sprintf("SMTP connection from %s (via inetd)", hostname);
1230 if ((log_extra_selector & LX_incoming_interface) != 0 &&
1231 interface_address != NULL)
1232 return string_sprintf("SMTP connection from %s I=[%s]:%d", hostname,
1233 interface_address, interface_port);
1235 return string_sprintf("SMTP connection from %s", hostname);
1241 /* Append TLS-related information to a log line
1244 s String under construction: allocated string to extend, or NULL
1245 sizep Pointer to current allocation size (update on return), or NULL
1246 ptrp Pointer to index for new entries in string (update on return), or NULL
1248 Returns: Allocated string or NULL
1251 s_tlslog(uschar * s, int * sizep, int * ptrp)
1253 int size = sizep ? *sizep : 0;
1254 int ptr = ptrp ? *ptrp : 0;
1256 if ((log_extra_selector & LX_tls_cipher) != 0 && tls_in.cipher != NULL)
1257 s = string_append(s, &size, &ptr, 2, US" X=", tls_in.cipher);
1258 if ((log_extra_selector & LX_tls_certificate_verified) != 0 &&
1259 tls_in.cipher != NULL)
1260 s = string_append(s, &size, &ptr, 2, US" CV=",
1261 tls_in.certificate_verified? "yes":"no");
1262 if ((log_extra_selector & LX_tls_peerdn) != 0 && tls_in.peerdn != NULL)
1263 s = string_append(s, &size, &ptr, 3, US" DN=\"",
1264 string_printing(tls_in.peerdn), US"\"");
1265 if ((log_extra_selector & LX_tls_sni) != 0 && tls_in.sni != NULL)
1266 s = string_append(s, &size, &ptr, 3, US" SNI=\"",
1267 string_printing(tls_in.sni), US"\"");
1272 if (sizep) *sizep = size;
1273 if (ptrp) *ptrp = ptr;
1279 /*************************************************
1280 * Log lack of MAIL if so configured *
1281 *************************************************/
1283 /* This function is called when an SMTP session ends. If the log selector
1284 smtp_no_mail is set, write a log line giving some details of what has happened
1285 in the SMTP session.
1292 smtp_log_no_mail(void)
1297 if (smtp_mailcmd_count > 0 || (log_extra_selector & LX_smtp_no_mail) == 0)
1303 if (sender_host_authenticated != NULL)
1305 s = string_append(s, &size, &ptr, 2, US" A=", sender_host_authenticated);
1306 if (authenticated_id != NULL)
1307 s = string_append(s, &size, &ptr, 2, US":", authenticated_id);
1311 s = s_tlslog(s, &size, &ptr);
1314 sep = (smtp_connection_had[SMTP_HBUFF_SIZE-1] != SCH_NONE)?
1315 US" C=..." : US" C=";
1316 for (i = smtp_ch_index; i < SMTP_HBUFF_SIZE; i++)
1318 if (smtp_connection_had[i] != SCH_NONE)
1320 s = string_append(s, &size, &ptr, 2, sep,
1321 smtp_names[smtp_connection_had[i]]);
1326 for (i = 0; i < smtp_ch_index; i++)
1328 s = string_append(s, &size, &ptr, 2, sep, smtp_names[smtp_connection_had[i]]);
1332 if (s != NULL) s[ptr] = 0; else s = US"";
1333 log_write(0, LOG_MAIN, "no MAIL in SMTP connection from %s D=%s%s",
1334 host_and_ident(FALSE),
1335 readconf_printtime( (int) ((long)time(NULL) - (long)smtp_connection_start)),
1341 /*************************************************
1342 * Check HELO line and set sender_helo_name *
1343 *************************************************/
1345 /* Check the format of a HELO line. The data for HELO/EHLO is supposed to be
1346 the domain name of the sending host, or an ip literal in square brackets. The
1347 arrgument is placed in sender_helo_name, which is in malloc store, because it
1348 must persist over multiple incoming messages. If helo_accept_junk is set, this
1349 host is permitted to send any old junk (needed for some broken hosts).
1350 Otherwise, helo_allow_chars can be used for rogue characters in general
1351 (typically people want to let in underscores).
1354 s the data portion of the line (already past any white space)
1356 Returns: TRUE or FALSE
1360 check_helo(uschar *s)
1363 uschar *end = s + Ustrlen(s);
1364 BOOL yield = helo_accept_junk;
1366 /* Discard any previous helo name */
1368 if (sender_helo_name != NULL)
1370 store_free(sender_helo_name);
1371 sender_helo_name = NULL;
1374 /* Skip tests if junk is permitted. */
1378 /* Allow the new standard form for IPv6 address literals, namely,
1379 [IPv6:....], and because someone is bound to use it, allow an equivalent
1380 IPv4 form. Allow plain addresses as well. */
1387 if (strncmpic(s, US"[IPv6:", 6) == 0)
1388 yield = (string_is_ip_address(s+6, NULL) == 6);
1389 else if (strncmpic(s, US"[IPv4:", 6) == 0)
1390 yield = (string_is_ip_address(s+6, NULL) == 4);
1392 yield = (string_is_ip_address(s+1, NULL) != 0);
1397 /* Non-literals must be alpha, dot, hyphen, plus any non-valid chars
1398 that have been configured (usually underscore - sigh). */
1405 if (!isalnum(*s) && *s != '.' && *s != '-' &&
1406 Ustrchr(helo_allow_chars, *s) == NULL)
1416 /* Save argument if OK */
1418 if (yield) sender_helo_name = string_copy_malloc(start);
1426 /*************************************************
1427 * Extract SMTP command option *
1428 *************************************************/
1430 /* This function picks the next option setting off the end of smtp_cmd_data. It
1431 is called for MAIL FROM and RCPT TO commands, to pick off the optional ESMTP
1432 things that can appear there.
1435 name point this at the name
1436 value point this at the data string
1438 Returns: TRUE if found an option
1442 extract_option(uschar **name, uschar **value)
1445 uschar *v = smtp_cmd_data + Ustrlen(smtp_cmd_data) - 1;
1446 while (isspace(*v)) v--;
1448 while (v > smtp_cmd_data && *v != '=' && !isspace(*v)) v--;
1453 while(isalpha(n[-1])) n--;
1454 /* RFC says SP, but TAB seen in wild and other major MTAs accept it */
1455 if (!isspace(n[-1])) return FALSE;
1461 if (v == smtp_cmd_data) return FALSE;
1473 /*************************************************
1474 * Reset for new message *
1475 *************************************************/
1477 /* This function is called whenever the SMTP session is reset from
1478 within either of the setup functions.
1480 Argument: the stacking pool storage reset point
1485 smtp_reset(void *reset_point)
1487 store_reset(reset_point);
1488 recipients_list = NULL;
1489 rcpt_count = rcpt_defer_count = rcpt_fail_count =
1490 raw_recipients_count = recipients_count = recipients_list_max = 0;
1491 cancel_cutthrough_connection("smtp reset");
1492 message_linecount = 0;
1494 acl_added_headers = NULL;
1495 acl_removed_headers = NULL;
1496 queue_only_policy = FALSE;
1497 rcpt_smtp_response = NULL;
1498 rcpt_smtp_response_same = TRUE;
1499 rcpt_in_progress = FALSE;
1500 deliver_freeze = FALSE; /* Can be set by ACL */
1501 freeze_tell = freeze_tell_config; /* Can be set by ACL */
1502 fake_response = OK; /* Can be set by ACL */
1503 #ifdef WITH_CONTENT_SCAN
1504 no_mbox_unspool = FALSE; /* Can be set by ACL */
1506 submission_mode = FALSE; /* Can be set by ACL */
1507 suppress_local_fixups = suppress_local_fixups_default; /* Can be set by ACL */
1508 active_local_from_check = local_from_check; /* Can be set by ACL */
1509 active_local_sender_retain = local_sender_retain; /* Can be set by ACL */
1510 sender_address = NULL;
1511 submission_name = NULL; /* Can be set by ACL */
1512 raw_sender = NULL; /* After SMTP rewrite, before qualifying */
1513 sender_address_unrewritten = NULL; /* Set only after verify rewrite */
1514 sender_verified_list = NULL; /* No senders verified */
1515 memset(sender_address_cache, 0, sizeof(sender_address_cache));
1516 memset(sender_domain_cache, 0, sizeof(sender_domain_cache));
1518 prdr_requested = FALSE;
1520 /* Reset the DSN flags */
1524 authenticated_sender = NULL;
1525 #ifdef EXPERIMENTAL_BRIGHTMAIL
1527 bmi_verdicts = NULL;
1529 #ifndef DISABLE_DKIM
1530 dkim_signers = NULL;
1531 dkim_disable_verify = FALSE;
1532 dkim_collect_input = FALSE;
1534 #ifdef EXPERIMENTAL_SPF
1535 spf_header_comment = NULL;
1536 spf_received = NULL;
1538 spf_smtp_comment = NULL;
1540 #ifdef EXPERIMENTAL_INTERNATIONAL
1541 message_smtputf8 = FALSE;
1543 body_linecount = body_zerocount = 0;
1545 sender_rate = sender_rate_limit = sender_rate_period = NULL;
1546 ratelimiters_mail = NULL; /* Updated by ratelimit ACL condition */
1547 /* Note that ratelimiters_conn persists across resets. */
1549 /* Reset message ACL variables */
1553 /* The message body variables use malloc store. They may be set if this is
1554 not the first message in an SMTP session and the previous message caused them
1555 to be referenced in an ACL. */
1557 if (message_body != NULL)
1559 store_free(message_body);
1560 message_body = NULL;
1563 if (message_body_end != NULL)
1565 store_free(message_body_end);
1566 message_body_end = NULL;
1569 /* Warning log messages are also saved in malloc store. They are saved to avoid
1570 repetition in the same message, but it seems right to repeat them for different
1573 while (acl_warn_logged != NULL)
1575 string_item *this = acl_warn_logged;
1576 acl_warn_logged = acl_warn_logged->next;
1585 /*************************************************
1586 * Initialize for incoming batched SMTP message *
1587 *************************************************/
1589 /* This function is called from smtp_setup_msg() in the case when
1590 smtp_batched_input is true. This happens when -bS is used to pass a whole batch
1591 of messages in one file with SMTP commands between them. All errors must be
1592 reported by sending a message, and only MAIL FROM, RCPT TO, and DATA are
1593 relevant. After an error on a sender, or an invalid recipient, the remainder
1594 of the message is skipped. The value of received_protocol is already set.
1597 Returns: > 0 message successfully started (reached DATA)
1598 = 0 QUIT read or end of file reached
1599 < 0 should not occur
1603 smtp_setup_batch_msg(void)
1606 void *reset_point = store_get(0);
1608 /* Save the line count at the start of each transaction - single commands
1609 like HELO and RSET count as whole transactions. */
1611 bsmtp_transaction_linecount = receive_linecount;
1613 if ((receive_feof)()) return 0; /* Treat EOF as QUIT */
1615 smtp_reset(reset_point); /* Reset for start of message */
1617 /* Deal with SMTP commands. This loop is exited by setting done to a POSITIVE
1618 value. The values are 2 larger than the required yield of the function. */
1623 uschar *recipient = NULL;
1624 int start, end, sender_domain, recipient_domain;
1626 switch(smtp_read_command(FALSE))
1628 /* The HELO/EHLO commands set sender_address_helo if they have
1629 valid data; otherwise they are ignored, except that they do
1630 a reset of the state. */
1635 check_helo(smtp_cmd_data);
1639 smtp_reset(reset_point);
1640 bsmtp_transaction_linecount = receive_linecount;
1644 /* The MAIL FROM command requires an address as an operand. All we
1645 do here is to parse it for syntactic correctness. The form "<>" is
1646 a special case which converts into an empty string. The start/end
1647 pointers in the original are not used further for this address, as
1648 it is the canonical extracted address which is all that is kept. */
1651 smtp_mailcmd_count++; /* Count for no-mail log */
1652 if (sender_address != NULL)
1653 /* The function moan_smtp_batch() does not return. */
1654 moan_smtp_batch(smtp_cmd_buffer, "503 Sender already given");
1656 if (smtp_cmd_data[0] == 0)
1657 /* The function moan_smtp_batch() does not return. */
1658 moan_smtp_batch(smtp_cmd_buffer, "501 MAIL FROM must have an address operand");
1660 /* Reset to start of message */
1662 smtp_reset(reset_point);
1664 /* Apply SMTP rewrite */
1666 raw_sender = ((rewrite_existflags & rewrite_smtp) != 0)?
1667 rewrite_one(smtp_cmd_data, rewrite_smtp|rewrite_smtp_sender, NULL, FALSE,
1668 US"", global_rewrite_rules) : smtp_cmd_data;
1670 /* Extract the address; the TRUE flag allows <> as valid */
1673 parse_extract_address(raw_sender, &errmess, &start, &end, &sender_domain,
1676 if (raw_sender == NULL)
1677 /* The function moan_smtp_batch() does not return. */
1678 moan_smtp_batch(smtp_cmd_buffer, "501 %s", errmess);
1680 sender_address = string_copy(raw_sender);
1682 /* Qualify unqualified sender addresses if permitted to do so. */
1684 if (sender_domain == 0 && sender_address[0] != 0 && sender_address[0] != '@')
1686 if (allow_unqualified_sender)
1688 sender_address = rewrite_address_qualify(sender_address, FALSE);
1689 DEBUG(D_receive) debug_printf("unqualified address %s accepted "
1690 "and rewritten\n", raw_sender);
1692 /* The function moan_smtp_batch() does not return. */
1693 else moan_smtp_batch(smtp_cmd_buffer, "501 sender address must contain "
1699 /* The RCPT TO command requires an address as an operand. All we do
1700 here is to parse it for syntactic correctness. There may be any number
1701 of RCPT TO commands, specifying multiple senders. We build them all into
1702 a data structure that is in argc/argv format. The start/end values
1703 given by parse_extract_address are not used, as we keep only the
1704 extracted address. */
1707 if (sender_address == NULL)
1708 /* The function moan_smtp_batch() does not return. */
1709 moan_smtp_batch(smtp_cmd_buffer, "503 No sender yet given");
1711 if (smtp_cmd_data[0] == 0)
1712 /* The function moan_smtp_batch() does not return. */
1713 moan_smtp_batch(smtp_cmd_buffer, "501 RCPT TO must have an address operand");
1715 /* Check maximum number allowed */
1717 if (recipients_max > 0 && recipients_count + 1 > recipients_max)
1718 /* The function moan_smtp_batch() does not return. */
1719 moan_smtp_batch(smtp_cmd_buffer, "%s too many recipients",
1720 recipients_max_reject? "552": "452");
1722 /* Apply SMTP rewrite, then extract address. Don't allow "<>" as a
1723 recipient address */
1725 recipient = ((rewrite_existflags & rewrite_smtp) != 0)?
1726 rewrite_one(smtp_cmd_data, rewrite_smtp, NULL, FALSE, US"",
1727 global_rewrite_rules) : smtp_cmd_data;
1729 /* rfc821_domains = TRUE; << no longer needed */
1730 recipient = parse_extract_address(recipient, &errmess, &start, &end,
1731 &recipient_domain, FALSE);
1732 /* rfc821_domains = FALSE; << no longer needed */
1734 if (recipient == NULL)
1735 /* The function moan_smtp_batch() does not return. */
1736 moan_smtp_batch(smtp_cmd_buffer, "501 %s", errmess);
1738 /* If the recipient address is unqualified, qualify it if permitted. Then
1739 add it to the list of recipients. */
1741 if (recipient_domain == 0)
1743 if (allow_unqualified_recipient)
1745 DEBUG(D_receive) debug_printf("unqualified address %s accepted\n",
1747 recipient = rewrite_address_qualify(recipient, TRUE);
1749 /* The function moan_smtp_batch() does not return. */
1750 else moan_smtp_batch(smtp_cmd_buffer, "501 recipient address must contain "
1753 receive_add_recipient(recipient, -1);
1757 /* The DATA command is legal only if it follows successful MAIL FROM
1758 and RCPT TO commands. This function is complete when a valid DATA
1759 command is encountered. */
1762 if (sender_address == NULL || recipients_count <= 0)
1764 /* The function moan_smtp_batch() does not return. */
1765 if (sender_address == NULL)
1766 moan_smtp_batch(smtp_cmd_buffer,
1767 "503 MAIL FROM:<sender> command must precede DATA");
1769 moan_smtp_batch(smtp_cmd_buffer,
1770 "503 RCPT TO:<recipient> must precede DATA");
1774 done = 3; /* DATA successfully achieved */
1775 message_ended = END_NOTENDED; /* Indicate in middle of message */
1780 /* The VRFY, EXPN, HELP, ETRN, and NOOP commands are ignored. */
1787 bsmtp_transaction_linecount = receive_linecount;
1798 /* The function moan_smtp_batch() does not return. */
1799 moan_smtp_batch(smtp_cmd_buffer, "501 Unexpected argument data");
1804 /* The function moan_smtp_batch() does not return. */
1805 moan_smtp_batch(smtp_cmd_buffer, "501 Unexpected NULL in SMTP command");
1810 /* The function moan_smtp_batch() does not return. */
1811 moan_smtp_batch(smtp_cmd_buffer, "500 Command unrecognized");
1816 return done - 2; /* Convert yield values */
1822 /*************************************************
1823 * Start an SMTP session *
1824 *************************************************/
1826 /* This function is called at the start of an SMTP session. Thereafter,
1827 smtp_setup_msg() is called to initiate each separate message. This
1828 function does host-specific testing, and outputs the banner line.
1831 Returns: FALSE if the session can not continue; something has
1832 gone wrong, or the connection to the host is blocked
1836 smtp_start_session(void)
1840 uschar *user_msg, *log_msg;
1844 smtp_connection_start = time(NULL);
1845 for (smtp_ch_index = 0; smtp_ch_index < SMTP_HBUFF_SIZE; smtp_ch_index++)
1846 smtp_connection_had[smtp_ch_index] = SCH_NONE;
1849 /* Default values for certain variables */
1851 helo_seen = esmtp = helo_accept_junk = FALSE;
1852 smtp_mailcmd_count = 0;
1853 count_nonmail = TRUE_UNSET;
1854 synprot_error_count = unknown_command_count = nonmail_command_count = 0;
1855 smtp_delay_mail = smtp_rlm_base;
1856 auth_advertised = FALSE;
1857 pipelining_advertised = FALSE;
1858 pipelining_enable = TRUE;
1859 sync_cmd_limit = NON_SYNC_CMD_NON_PIPELINING;
1860 smtp_exit_function_called = FALSE; /* For avoiding loop in not-quit exit */
1862 memset(sender_host_cache, 0, sizeof(sender_host_cache));
1864 /* If receiving by -bs from a trusted user, or testing with -bh, we allow
1865 authentication settings from -oMaa to remain in force. */
1867 if (!host_checking && !sender_host_notsocket) sender_host_authenticated = NULL;
1868 authenticated_by = NULL;
1871 tls_in.cipher = tls_in.peerdn = NULL;
1872 tls_in.ourcert = tls_in.peercert = NULL;
1874 tls_in.ocsp = OCSP_NOT_REQ;
1875 tls_advertised = FALSE;
1877 dsn_advertised = FALSE;
1878 #ifdef EXPERIMENTAL_INTERNATIONAL
1879 smtputf8_advertised = FALSE;
1882 /* Reset ACL connection variables */
1886 /* Allow for trailing 0 in the command and data buffers. */
1888 smtp_cmd_buffer = (uschar *)malloc(2*smtp_cmd_buffer_size + 2);
1889 if (smtp_cmd_buffer == NULL)
1890 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1891 "malloc() failed for SMTP command buffer");
1892 smtp_cmd_buffer[0] = 0;
1893 smtp_data_buffer = smtp_cmd_buffer + smtp_cmd_buffer_size + 1;
1895 /* For batched input, the protocol setting can be overridden from the
1896 command line by a trusted caller. */
1898 if (smtp_batched_input)
1900 if (received_protocol == NULL) received_protocol = US"local-bsmtp";
1903 /* For non-batched SMTP input, the protocol setting is forced here. It will be
1904 reset later if any of EHLO/AUTH/STARTTLS are received. */
1908 (sender_host_address ? protocols : protocols_local) [pnormal];
1910 /* Set up the buffer for inputting using direct read() calls, and arrange to
1911 call the local functions instead of the standard C ones. */
1913 smtp_inbuffer = (uschar *)malloc(in_buffer_size);
1914 if (smtp_inbuffer == NULL)
1915 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "malloc() failed for SMTP input buffer");
1916 receive_getc = smtp_getc;
1917 receive_ungetc = smtp_ungetc;
1918 receive_feof = smtp_feof;
1919 receive_ferror = smtp_ferror;
1920 receive_smtp_buffered = smtp_buffered;
1921 smtp_inptr = smtp_inend = smtp_inbuffer;
1922 smtp_had_eof = smtp_had_error = 0;
1924 /* Set up the message size limit; this may be host-specific */
1926 thismessage_size_limit = expand_string_integer(message_size_limit, TRUE);
1927 if (expand_string_message != NULL)
1929 if (thismessage_size_limit == -1)
1930 log_write(0, LOG_MAIN|LOG_PANIC, "unable to expand message_size_limit: "
1931 "%s", expand_string_message);
1933 log_write(0, LOG_MAIN|LOG_PANIC, "invalid message_size_limit: "
1934 "%s", expand_string_message);
1935 smtp_closedown(US"Temporary local problem - please try later");
1939 /* When a message is input locally via the -bs or -bS options, sender_host_
1940 unknown is set unless -oMa was used to force an IP address, in which case it
1941 is checked like a real remote connection. When -bs is used from inetd, this
1942 flag is not set, causing the sending host to be checked. The code that deals
1943 with IP source routing (if configured) is never required for -bs or -bS and
1944 the flag sender_host_notsocket is used to suppress it.
1946 If smtp_accept_max and smtp_accept_reserve are set, keep some connections in
1947 reserve for certain hosts and/or networks. */
1949 if (!sender_host_unknown)
1952 BOOL reserved_host = FALSE;
1954 /* Look up IP options (source routing info) on the socket if this is not an
1955 -oMa "host", and if any are found, log them and drop the connection.
1957 Linux (and others now, see below) is different to everyone else, so there
1958 has to be some conditional compilation here. Versions of Linux before 2.1.15
1959 used a structure whose name was "options". Somebody finally realized that
1960 this name was silly, and it got changed to "ip_options". I use the
1961 newer name here, but there is a fudge in the script that sets up os.h
1962 to define a macro in older Linux systems.
1964 Sigh. Linux is a fast-moving target. Another generation of Linux uses
1965 glibc 2, which has chosen ip_opts for the structure name. This is now
1966 really a glibc thing rather than a Linux thing, so the condition name
1967 has been changed to reflect this. It is relevant also to GNU/Hurd.
1969 Mac OS 10.x (Darwin) is like the later glibc versions, but without the
1970 setting of the __GLIBC__ macro, so we can't detect it automatically. There's
1971 a special macro defined in the os.h file.
1973 Some DGUX versions on older hardware appear not to support IP options at
1974 all, so there is now a general macro which can be set to cut out this
1977 How to do this properly in IPv6 is not yet known. */
1979 #if !HAVE_IPV6 && !defined(NO_IP_OPTIONS)
1981 #ifdef GLIBC_IP_OPTIONS
1982 #if (!defined __GLIBC__) || (__GLIBC__ < 2)
1987 #elif defined DARWIN_IP_OPTIONS
1993 if (!host_checking && !sender_host_notsocket)
1996 EXIM_SOCKLEN_T optlen = sizeof(struct ip_options) + MAX_IPOPTLEN;
1997 struct ip_options *ipopt = store_get(optlen);
1999 struct ip_opts ipoptblock;
2000 struct ip_opts *ipopt = &ipoptblock;
2001 EXIM_SOCKLEN_T optlen = sizeof(ipoptblock);
2003 struct ipoption ipoptblock;
2004 struct ipoption *ipopt = &ipoptblock;
2005 EXIM_SOCKLEN_T optlen = sizeof(ipoptblock);
2008 /* Occasional genuine failures of getsockopt() have been seen - for
2009 example, "reset by peer". Therefore, just log and give up on this
2010 call, unless the error is ENOPROTOOPT. This error is given by systems
2011 that have the interfaces but not the mechanism - e.g. GNU/Hurd at the time
2012 of writing. So for that error, carry on - we just can't do an IP options
2015 DEBUG(D_receive) debug_printf("checking for IP options\n");
2017 if (getsockopt(fileno(smtp_out), IPPROTO_IP, IP_OPTIONS, (uschar *)(ipopt),
2020 if (errno != ENOPROTOOPT)
2022 log_write(0, LOG_MAIN, "getsockopt() failed from %s: %s",
2023 host_and_ident(FALSE), strerror(errno));
2024 smtp_printf("451 SMTP service not available\r\n");
2029 /* Deal with any IP options that are set. On the systems I have looked at,
2030 the value of MAX_IPOPTLEN has been 40, meaning that there should never be
2031 more logging data than will fit in big_buffer. Nevertheless, after somebody
2032 questioned this code, I've added in some paranoid checking. */
2034 else if (optlen > 0)
2036 uschar *p = big_buffer;
2037 uschar *pend = big_buffer + big_buffer_size;
2038 uschar *opt, *adptr;
2040 struct in_addr addr;
2043 uschar *optstart = (uschar *)(ipopt->__data);
2045 uschar *optstart = (uschar *)(ipopt->ip_opts);
2047 uschar *optstart = (uschar *)(ipopt->ipopt_list);
2050 DEBUG(D_receive) debug_printf("IP options exist\n");
2052 Ustrcpy(p, "IP options on incoming call:");
2055 for (opt = optstart; opt != NULL &&
2056 opt < (uschar *)(ipopt) + optlen;)
2070 if (!string_format(p, pend-p, " %s [@%s",
2071 (*opt == IPOPT_SSRR)? "SSRR" : "LSRR",
2073 inet_ntoa(*((struct in_addr *)(&(ipopt->faddr))))))
2075 inet_ntoa(ipopt->ip_dst)))
2077 inet_ntoa(ipopt->ipopt_dst)))
2085 optcount = (opt[1] - 3) / sizeof(struct in_addr);
2087 while (optcount-- > 0)
2089 memcpy(&addr, adptr, sizeof(addr));
2090 if (!string_format(p, pend - p - 1, "%s%s",
2091 (optcount == 0)? ":" : "@", inet_ntoa(addr)))
2097 adptr += sizeof(struct in_addr);
2106 if (pend - p < 4 + 3*opt[1]) { opt = NULL; break; }
2109 for (i = 0; i < opt[1]; i++)
2111 sprintf(CS p, "%2.2x ", opt[i]);
2122 log_write(0, LOG_MAIN, "%s", big_buffer);
2124 /* Refuse any call with IP options. This is what tcpwrappers 7.5 does. */
2126 log_write(0, LOG_MAIN|LOG_REJECT,
2127 "connection from %s refused (IP options)", host_and_ident(FALSE));
2129 smtp_printf("554 SMTP service not available\r\n");
2133 /* Length of options = 0 => there are no options */
2135 else DEBUG(D_receive) debug_printf("no IP options found\n");
2137 #endif /* HAVE_IPV6 && !defined(NO_IP_OPTIONS) */
2139 /* Set keep-alive in socket options. The option is on by default. This
2140 setting is an attempt to get rid of some hanging connections that stick in
2141 read() when the remote end (usually a dialup) goes away. */
2143 if (smtp_accept_keepalive && !sender_host_notsocket)
2144 ip_keepalive(fileno(smtp_out), sender_host_address, FALSE);
2146 /* If the current host matches host_lookup, set the name by doing a
2147 reverse lookup. On failure, sender_host_name will be NULL and
2148 host_lookup_failed will be TRUE. This may or may not be serious - optional
2151 if (verify_check_host(&host_lookup) == OK)
2153 (void)host_name_lookup();
2154 host_build_sender_fullhost();
2157 /* Delay this until we have the full name, if it is looked up. */
2159 set_process_info("handling incoming connection from %s",
2160 host_and_ident(FALSE));
2162 /* Expand smtp_receive_timeout, if needed */
2164 if (smtp_receive_timeout_s)
2167 if ( !(exp = expand_string(smtp_receive_timeout_s))
2169 || (smtp_receive_timeout = readconf_readtime(exp, 0, FALSE)) < 0
2171 log_write(0, LOG_MAIN|LOG_PANIC,
2172 "bad value for smtp_receive_timeout: '%s'", exp ? exp : US"");
2175 /* Start up TLS if tls_on_connect is set. This is for supporting the legacy
2176 smtps port for use with older style SSL MTAs. */
2179 if (tls_in.on_connect && tls_server_start(tls_require_ciphers) != OK)
2183 /* Test for explicit connection rejection */
2185 if (verify_check_host(&host_reject_connection) == OK)
2187 log_write(L_connection_reject, LOG_MAIN|LOG_REJECT, "refused connection "
2188 "from %s (host_reject_connection)", host_and_ident(FALSE));
2189 smtp_printf("554 SMTP service not available\r\n");
2193 /* Test with TCP Wrappers if so configured. There is a problem in that
2194 hosts_ctl() returns 0 (deny) under a number of system failure circumstances,
2195 such as disks dying. In these cases, it is desirable to reject with a 4xx
2196 error instead of a 5xx error. There isn't a "right" way to detect such
2197 problems. The following kludge is used: errno is zeroed before calling
2198 hosts_ctl(). If the result is "reject", a 5xx error is given only if the
2199 value of errno is 0 or ENOENT (which happens if /etc/hosts.{allow,deny} does
2202 #ifdef USE_TCP_WRAPPERS
2204 tcp_wrappers_name = expand_string(tcp_wrappers_daemon_name);
2205 if (tcp_wrappers_name == NULL)
2207 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Expansion of \"%s\" "
2208 "(tcp_wrappers_name) failed: %s", string_printing(tcp_wrappers_name),
2209 expand_string_message);
2211 if (!hosts_ctl(tcp_wrappers_name,
2212 (sender_host_name == NULL)? STRING_UNKNOWN : CS sender_host_name,
2213 (sender_host_address == NULL)? STRING_UNKNOWN : CS sender_host_address,
2214 (sender_ident == NULL)? STRING_UNKNOWN : CS sender_ident))
2216 if (errno == 0 || errno == ENOENT)
2218 HDEBUG(D_receive) debug_printf("tcp wrappers rejection\n");
2219 log_write(L_connection_reject,
2220 LOG_MAIN|LOG_REJECT, "refused connection from %s "
2221 "(tcp wrappers)", host_and_ident(FALSE));
2222 smtp_printf("554 SMTP service not available\r\n");
2226 int save_errno = errno;
2227 HDEBUG(D_receive) debug_printf("tcp wrappers rejected with unexpected "
2228 "errno value %d\n", save_errno);
2229 log_write(L_connection_reject,
2230 LOG_MAIN|LOG_REJECT, "temporarily refused connection from %s "
2231 "(tcp wrappers errno=%d)", host_and_ident(FALSE), save_errno);
2232 smtp_printf("451 Temporary local problem - please try later\r\n");
2238 /* Check for reserved slots. The value of smtp_accept_count has already been
2239 incremented to include this process. */
2241 if (smtp_accept_max > 0 &&
2242 smtp_accept_count > smtp_accept_max - smtp_accept_reserve)
2244 if ((rc = verify_check_host(&smtp_reserve_hosts)) != OK)
2246 log_write(L_connection_reject,
2247 LOG_MAIN, "temporarily refused connection from %s: not in "
2248 "reserve list: connected=%d max=%d reserve=%d%s",
2249 host_and_ident(FALSE), smtp_accept_count - 1, smtp_accept_max,
2250 smtp_accept_reserve, (rc == DEFER)? " (lookup deferred)" : "");
2251 smtp_printf("421 %s: Too many concurrent SMTP connections; "
2252 "please try again later\r\n", smtp_active_hostname);
2255 reserved_host = TRUE;
2258 /* If a load level above which only messages from reserved hosts are
2259 accepted is set, check the load. For incoming calls via the daemon, the
2260 check is done in the superior process if there are no reserved hosts, to
2261 save a fork. In all cases, the load average will already be available
2262 in a global variable at this point. */
2264 if (smtp_load_reserve >= 0 &&
2265 load_average > smtp_load_reserve &&
2267 verify_check_host(&smtp_reserve_hosts) != OK)
2269 log_write(L_connection_reject,
2270 LOG_MAIN, "temporarily refused connection from %s: not in "
2271 "reserve list and load average = %.2f", host_and_ident(FALSE),
2272 (double)load_average/1000.0);
2273 smtp_printf("421 %s: Too much load; please try again later\r\n",
2274 smtp_active_hostname);
2278 /* Determine whether unqualified senders or recipients are permitted
2279 for this host. Unfortunately, we have to do this every time, in order to
2280 set the flags so that they can be inspected when considering qualifying
2281 addresses in the headers. For a site that permits no qualification, this
2282 won't take long, however. */
2284 allow_unqualified_sender =
2285 verify_check_host(&sender_unqualified_hosts) == OK;
2287 allow_unqualified_recipient =
2288 verify_check_host(&recipient_unqualified_hosts) == OK;
2290 /* Determine whether HELO/EHLO is required for this host. The requirement
2291 can be hard or soft. */
2293 helo_required = verify_check_host(&helo_verify_hosts) == OK;
2295 helo_verify = verify_check_host(&helo_try_verify_hosts) == OK;
2297 /* Determine whether this hosts is permitted to send syntactic junk
2298 after a HELO or EHLO command. */
2300 helo_accept_junk = verify_check_host(&helo_accept_junk_hosts) == OK;
2303 /* For batch SMTP input we are now done. */
2305 if (smtp_batched_input) return TRUE;
2307 #ifdef EXPERIMENTAL_PROXY
2308 /* If valid Proxy Protocol source is connecting, set up session.
2309 * Failure will not allow any SMTP function other than QUIT. */
2310 proxy_session = FALSE;
2311 proxy_session_failed = FALSE;
2312 if (check_proxy_protocol_host())
2314 if (setup_proxy_protocol_host() == FALSE)
2316 proxy_session_failed = TRUE;
2318 debug_printf("Failure to extract proxied host, only QUIT allowed\n");
2322 sender_host_name = NULL;
2323 (void)host_name_lookup();
2324 host_build_sender_fullhost();
2329 /* Run the ACL if it exists */
2332 if (acl_smtp_connect != NULL)
2335 rc = acl_check(ACL_WHERE_CONNECT, NULL, acl_smtp_connect, &user_msg,
2339 (void)smtp_handle_acl_fail(ACL_WHERE_CONNECT, rc, user_msg, log_msg);
2344 /* Output the initial message for a two-way SMTP connection. It may contain
2345 newlines, which then cause a multi-line response to be given. */
2347 code = US"220"; /* Default status code */
2348 esc = US""; /* Default extended status code */
2349 esclen = 0; /* Length of esc */
2351 if (user_msg == NULL)
2353 s = expand_string(smtp_banner);
2355 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Expansion of \"%s\" (smtp_banner) "
2356 "failed: %s", smtp_banner, expand_string_message);
2362 smtp_message_code(&code, &codelen, &s, NULL);
2366 esclen = codelen - 4;
2370 /* Remove any terminating newlines; might as well remove trailing space too */
2373 while (p > s && isspace(p[-1])) p--;
2376 /* It seems that CC:Mail is braindead, and assumes that the greeting message
2377 is all contained in a single IP packet. The original code wrote out the
2378 greeting using several calls to fprint/fputc, and on busy servers this could
2379 cause it to be split over more than one packet - which caused CC:Mail to fall
2380 over when it got the second part of the greeting after sending its first
2381 command. Sigh. To try to avoid this, build the complete greeting message
2382 first, and output it in one fell swoop. This gives a better chance of it
2383 ending up as a single packet. */
2385 ss = store_get(size);
2389 do /* At least once, in case we have an empty string */
2392 uschar *linebreak = Ustrchr(p, '\n');
2393 ss = string_cat(ss, &size, &ptr, code, 3);
2394 if (linebreak == NULL)
2397 ss = string_cat(ss, &size, &ptr, US" ", 1);
2401 len = linebreak - p;
2402 ss = string_cat(ss, &size, &ptr, US"-", 1);
2404 ss = string_cat(ss, &size, &ptr, esc, esclen);
2405 ss = string_cat(ss, &size, &ptr, p, len);
2406 ss = string_cat(ss, &size, &ptr, US"\r\n", 2);
2408 if (linebreak != NULL) p++;
2412 ss[ptr] = 0; /* string_cat leaves room for this */
2414 /* Before we write the banner, check that there is no input pending, unless
2415 this synchronisation check is disabled. */
2419 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP protocol "
2420 "synchronization error (input sent without waiting for greeting): "
2421 "rejected connection from %s input=\"%s\"", host_and_ident(TRUE),
2422 string_printing(smtp_inptr));
2423 smtp_printf("554 SMTP synchronization error\r\n");
2427 /* Now output the banner */
2429 smtp_printf("%s", ss);
2437 /*************************************************
2438 * Handle SMTP syntax and protocol errors *
2439 *************************************************/
2441 /* Write to the log for SMTP syntax errors in incoming commands, if configured
2442 to do so. Then transmit the error response. The return value depends on the
2443 number of syntax and protocol errors in this SMTP session.
2446 type error type, given as a log flag bit
2447 code response code; <= 0 means don't send a response
2448 data data to reflect in the response (can be NULL)
2449 errmess the error message
2451 Returns: -1 limit of syntax/protocol errors NOT exceeded
2452 +1 limit of syntax/protocol errors IS exceeded
2454 These values fit in with the values of the "done" variable in the main
2455 processing loop in smtp_setup_msg(). */
2458 synprot_error(int type, int code, uschar *data, uschar *errmess)
2462 log_write(type, LOG_MAIN, "SMTP %s error in \"%s\" %s %s",
2463 (type == L_smtp_syntax_error)? "syntax" : "protocol",
2464 string_printing(smtp_cmd_buffer), host_and_ident(TRUE), errmess);
2466 if (++synprot_error_count > smtp_max_synprot_errors)
2469 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP call from %s dropped: too many "
2470 "syntax or protocol errors (last command was \"%s\")",
2471 host_and_ident(FALSE), string_printing(smtp_cmd_buffer));
2476 smtp_printf("%d%c%s%s%s\r\n", code, (yield == 1)? '-' : ' ',
2477 (data == NULL)? US"" : data, (data == NULL)? US"" : US": ", errmess);
2479 smtp_printf("%d Too many syntax or protocol errors\r\n", code);
2488 /*************************************************
2489 * Log incomplete transactions *
2490 *************************************************/
2492 /* This function is called after a transaction has been aborted by RSET, QUIT,
2493 connection drops or other errors. It logs the envelope information received
2494 so far in order to preserve address verification attempts.
2496 Argument: string to indicate what aborted the transaction
2501 incomplete_transaction_log(uschar *what)
2503 if (sender_address == NULL || /* No transaction in progress */
2504 (log_write_selector & L_smtp_incomplete_transaction) == 0 /* Not logging */
2507 /* Build list of recipients for logging */
2509 if (recipients_count > 0)
2512 raw_recipients = store_get(recipients_count * sizeof(uschar *));
2513 for (i = 0; i < recipients_count; i++)
2514 raw_recipients[i] = recipients_list[i].address;
2515 raw_recipients_count = recipients_count;
2518 log_write(L_smtp_incomplete_transaction, LOG_MAIN|LOG_SENDER|LOG_RECIPIENTS,
2519 "%s incomplete transaction (%s)", host_and_ident(TRUE), what);
2525 /*************************************************
2526 * Send SMTP response, possibly multiline *
2527 *************************************************/
2529 /* There are, it seems, broken clients out there that cannot handle multiline
2530 responses. If no_multiline_responses is TRUE (it can be set from an ACL), we
2531 output nothing for non-final calls, and only the first line for anything else.
2534 code SMTP code, may involve extended status codes
2535 codelen length of smtp code; if > 4 there's an ESC
2536 final FALSE if the last line isn't the final line
2537 msg message text, possibly containing newlines
2543 smtp_respond(uschar* code, int codelen, BOOL final, uschar *msg)
2548 if (!final && no_multiline_responses) return;
2553 esclen = codelen - 4;
2556 /* If this is the first output for a (non-batch) RCPT command, see if all RCPTs
2557 have had the same. Note: this code is also present in smtp_printf(). It would
2558 be tidier to have it only in one place, but when it was added, it was easier to
2559 do it that way, so as not to have to mess with the code for the RCPT command,
2560 which sometimes uses smtp_printf() and sometimes smtp_respond(). */
2562 if (rcpt_in_progress)
2564 if (rcpt_smtp_response == NULL)
2565 rcpt_smtp_response = string_copy(msg);
2566 else if (rcpt_smtp_response_same &&
2567 Ustrcmp(rcpt_smtp_response, msg) != 0)
2568 rcpt_smtp_response_same = FALSE;
2569 rcpt_in_progress = FALSE;
2572 /* Not output the message, splitting it up into multiple lines if necessary. */
2576 uschar *nl = Ustrchr(msg, '\n');
2579 smtp_printf("%.3s%c%.*s%s\r\n", code, final? ' ':'-', esclen, esc, msg);
2582 else if (nl[1] == 0 || no_multiline_responses)
2584 smtp_printf("%.3s%c%.*s%.*s\r\n", code, final? ' ':'-', esclen, esc,
2585 (int)(nl - msg), msg);
2590 smtp_printf("%.3s-%.*s%.*s\r\n", code, esclen, esc, (int)(nl - msg), msg);
2592 while (isspace(*msg)) msg++;
2600 /*************************************************
2601 * Parse user SMTP message *
2602 *************************************************/
2604 /* This function allows for user messages overriding the response code details
2605 by providing a suitable response code string at the start of the message
2606 user_msg. Check the message for starting with a response code and optionally an
2607 extended status code. If found, check that the first digit is valid, and if so,
2608 change the code pointer and length to use the replacement. An invalid code
2609 causes a panic log; in this case, if the log messages is the same as the user
2610 message, we must also adjust the value of the log message to show the code that
2611 is actually going to be used (the original one).
2613 This function is global because it is called from receive.c as well as within
2616 Note that the code length returned includes the terminating whitespace
2617 character, which is always included in the regex match.
2620 code SMTP code, may involve extended status codes
2621 codelen length of smtp code; if > 4 there's an ESC
2623 log_msg optional log message, to be adjusted with the new SMTP code
2629 smtp_message_code(uschar **code, int *codelen, uschar **msg, uschar **log_msg)
2634 if (msg == NULL || *msg == NULL) return;
2636 n = pcre_exec(regex_smtp_code, NULL, CS *msg, Ustrlen(*msg), 0,
2637 PCRE_EOPT, ovector, sizeof(ovector)/sizeof(int));
2640 if ((*msg)[0] != (*code)[0])
2642 log_write(0, LOG_MAIN|LOG_PANIC, "configured error code starts with "
2643 "incorrect digit (expected %c) in \"%s\"", (*code)[0], *msg);
2644 if (log_msg != NULL && *log_msg == *msg)
2645 *log_msg = string_sprintf("%s %s", *code, *log_msg + ovector[1]);
2650 *codelen = ovector[1]; /* Includes final space */
2652 *msg += ovector[1]; /* Chop the code off the message */
2659 /*************************************************
2660 * Handle an ACL failure *
2661 *************************************************/
2663 /* This function is called when acl_check() fails. As well as calls from within
2664 this module, it is called from receive.c for an ACL after DATA. It sorts out
2665 logging the incident, and sets up the error response. A message containing
2666 newlines is turned into a multiline SMTP response, but for logging, only the
2669 There's a table of default permanent failure response codes to use in
2670 globals.c, along with the table of names. VFRY is special. Despite RFC1123 it
2671 defaults disabled in Exim. However, discussion in connection with RFC 821bis
2672 (aka RFC 2821) has concluded that the response should be 252 in the disabled
2673 state, because there are broken clients that try VRFY before RCPT. A 5xx
2674 response should be given only when the address is positively known to be
2675 undeliverable. Sigh. Also, for ETRN, 458 is given on refusal, and for AUTH,
2678 From Exim 4.63, it is possible to override the response code details by
2679 providing a suitable response code string at the start of the message provided
2680 in user_msg. The code's first digit is checked for validity.
2683 where where the ACL was called from
2685 user_msg a message that can be included in an SMTP response
2686 log_msg a message for logging
2688 Returns: 0 in most cases
2689 2 if the failure code was FAIL_DROP, in which case the
2690 SMTP connection should be dropped (this value fits with the
2691 "done" variable in smtp_setup_msg() below)
2695 smtp_handle_acl_fail(int where, int rc, uschar *user_msg, uschar *log_msg)
2697 BOOL drop = rc == FAIL_DROP;
2701 uschar *sender_info = US"";
2703 #ifdef WITH_CONTENT_SCAN
2704 (where == ACL_WHERE_MIME)? US"during MIME ACL checks" :
2706 (where == ACL_WHERE_PREDATA)? US"DATA" :
2707 (where == ACL_WHERE_DATA)? US"after DATA" :
2708 #ifndef DISABLE_PRDR
2709 (where == ACL_WHERE_PRDR)? US"after DATA PRDR" :
2711 (smtp_cmd_data == NULL)?
2712 string_sprintf("%s in \"connect\" ACL", acl_wherenames[where]) :
2713 string_sprintf("%s %s", acl_wherenames[where], smtp_cmd_data);
2715 if (drop) rc = FAIL;
2717 /* Set the default SMTP code, and allow a user message to change it. */
2719 smtp_code = (rc != FAIL)? US"451" : acl_wherecodes[where];
2720 smtp_message_code(&smtp_code, &codelen, &user_msg, &log_msg);
2722 /* We used to have sender_address here; however, there was a bug that was not
2723 updating sender_address after a rewrite during a verify. When this bug was
2724 fixed, sender_address at this point became the rewritten address. I'm not sure
2725 this is what should be logged, so I've changed to logging the unrewritten
2726 address to retain backward compatibility. */
2728 #ifndef WITH_CONTENT_SCAN
2729 if (where == ACL_WHERE_RCPT || where == ACL_WHERE_DATA)
2731 if (where == ACL_WHERE_RCPT || where == ACL_WHERE_DATA || where == ACL_WHERE_MIME)
2734 sender_info = string_sprintf("F=<%s>%s%s%s%s ",
2735 sender_address_unrewritten ? sender_address_unrewritten : sender_address,
2736 sender_host_authenticated ? US" A=" : US"",
2737 sender_host_authenticated ? sender_host_authenticated : US"",
2738 sender_host_authenticated && authenticated_id ? US":" : US"",
2739 sender_host_authenticated && authenticated_id ? authenticated_id : US""
2743 /* If there's been a sender verification failure with a specific message, and
2744 we have not sent a response about it yet, do so now, as a preliminary line for
2745 failures, but not defers. However, always log it for defer, and log it for fail
2746 unless the sender_verify_fail log selector has been turned off. */
2748 if (sender_verified_failed != NULL &&
2749 !testflag(sender_verified_failed, af_sverify_told))
2751 BOOL save_rcpt_in_progress = rcpt_in_progress;
2752 rcpt_in_progress = FALSE; /* So as not to treat these as the error */
2754 setflag(sender_verified_failed, af_sverify_told);
2756 if (rc != FAIL || (log_extra_selector & LX_sender_verify_fail) != 0)
2757 log_write(0, LOG_MAIN|LOG_REJECT, "%s sender verify %s for <%s>%s",
2758 host_and_ident(TRUE),
2759 ((sender_verified_failed->special_action & 255) == DEFER)? "defer":"fail",
2760 sender_verified_failed->address,
2761 (sender_verified_failed->message == NULL)? US"" :
2762 string_sprintf(": %s", sender_verified_failed->message));
2764 if (rc == FAIL && sender_verified_failed->user_message != NULL)
2765 smtp_respond(smtp_code, codelen, FALSE, string_sprintf(
2766 testflag(sender_verified_failed, af_verify_pmfail)?
2767 "Postmaster verification failed while checking <%s>\n%s\n"
2768 "Several RFCs state that you are required to have a postmaster\n"
2769 "mailbox for each mail domain. This host does not accept mail\n"
2770 "from domains whose servers reject the postmaster address."
2772 testflag(sender_verified_failed, af_verify_nsfail)?
2773 "Callback setup failed while verifying <%s>\n%s\n"
2774 "The initial connection, or a HELO or MAIL FROM:<> command was\n"
2775 "rejected. Refusing MAIL FROM:<> does not help fight spam, disregards\n"
2776 "RFC requirements, and stops you from receiving standard bounce\n"
2777 "messages. This host does not accept mail from domains whose servers\n"
2780 "Verification failed for <%s>\n%s",
2781 sender_verified_failed->address,
2782 sender_verified_failed->user_message));
2784 rcpt_in_progress = save_rcpt_in_progress;
2787 /* Sort out text for logging */
2789 log_msg = (log_msg == NULL)? US"" : string_sprintf(": %s", log_msg);
2790 lognl = Ustrchr(log_msg, '\n');
2791 if (lognl != NULL) *lognl = 0;
2793 /* Send permanent failure response to the command, but the code used isn't
2794 always a 5xx one - see comments at the start of this function. If the original
2795 rc was FAIL_DROP we drop the connection and yield 2. */
2797 if (rc == FAIL) smtp_respond(smtp_code, codelen, TRUE, (user_msg == NULL)?
2798 US"Administrative prohibition" : user_msg);
2800 /* Send temporary failure response to the command. Don't give any details,
2801 unless acl_temp_details is set. This is TRUE for a callout defer, a "defer"
2802 verb, and for a header verify when smtp_return_error_details is set.
2804 This conditional logic is all somewhat of a mess because of the odd
2805 interactions between temp_details and return_error_details. One day it should
2806 be re-implemented in a tidier fashion. */
2810 if (acl_temp_details && user_msg != NULL)
2812 if (smtp_return_error_details &&
2813 sender_verified_failed != NULL &&
2814 sender_verified_failed->message != NULL)
2816 smtp_respond(smtp_code, codelen, FALSE, sender_verified_failed->message);
2818 smtp_respond(smtp_code, codelen, TRUE, user_msg);
2821 smtp_respond(smtp_code, codelen, TRUE,
2822 US"Temporary local problem - please try later");
2825 /* Log the incident to the logs that are specified by log_reject_target
2826 (default main, reject). This can be empty to suppress logging of rejections. If
2827 the connection is not forcibly to be dropped, return 0. Otherwise, log why it
2828 is closing if required and return 2. */
2830 if (log_reject_target != 0)
2833 uschar * s = s_tlslog(NULL, NULL, NULL);
2838 log_write(0, log_reject_target, "%s%s %s%srejected %s%s",
2839 host_and_ident(TRUE), s,
2840 sender_info, (rc == FAIL)? US"" : US"temporarily ", what, log_msg);
2843 if (!drop) return 0;
2845 log_write(L_smtp_connection, LOG_MAIN, "%s closed by DROP in ACL",
2846 smtp_get_connection_info());
2848 /* Run the not-quit ACL, but without any custom messages. This should not be a
2849 problem, because we get here only if some other ACL has issued "drop", and
2850 in that case, *its* custom messages will have been used above. */
2852 smtp_notquit_exit(US"acl-drop", NULL, NULL);
2859 /*************************************************
2860 * Handle SMTP exit when QUIT is not given *
2861 *************************************************/
2863 /* This function provides a logging/statistics hook for when an SMTP connection
2864 is dropped on the floor or the other end goes away. It's a global function
2865 because it's called from receive.c as well as this module. As well as running
2866 the NOTQUIT ACL, if there is one, this function also outputs a final SMTP
2867 response, either with a custom message from the ACL, or using a default. There
2868 is one case, however, when no message is output - after "drop". In that case,
2869 the ACL that obeyed "drop" has already supplied the custom message, and NULL is
2870 passed to this function.
2872 In case things go wrong while processing this function, causing an error that
2873 may re-enter this funtion, there is a recursion check.
2876 reason What $smtp_notquit_reason will be set to in the ACL;
2877 if NULL, the ACL is not run
2878 code The error code to return as part of the response
2879 defaultrespond The default message if there's no user_msg
2885 smtp_notquit_exit(uschar *reason, uschar *code, uschar *defaultrespond, ...)
2888 uschar *user_msg = NULL;
2889 uschar *log_msg = NULL;
2891 /* Check for recursive acll */
2893 if (smtp_exit_function_called)
2895 log_write(0, LOG_PANIC, "smtp_notquit_exit() called more than once (%s)",
2899 smtp_exit_function_called = TRUE;
2901 /* Call the not-QUIT ACL, if there is one, unless no reason is given. */
2903 if (acl_smtp_notquit != NULL && reason != NULL)
2905 smtp_notquit_reason = reason;
2906 rc = acl_check(ACL_WHERE_NOTQUIT, NULL, acl_smtp_notquit, &user_msg,
2909 log_write(0, LOG_MAIN|LOG_PANIC, "ACL for not-QUIT returned ERROR: %s",
2913 /* Write an SMTP response if we are expected to give one. As the default
2914 responses are all internal, they should always fit in the buffer, but code a
2915 warning, just in case. Note that string_vformat() still leaves a complete
2916 string, even if it is incomplete. */
2918 if (code != NULL && defaultrespond != NULL)
2920 if (user_msg == NULL)
2924 va_start(ap, defaultrespond);
2925 if (!string_vformat(buffer, sizeof(buffer), CS defaultrespond, ap))
2926 log_write(0, LOG_MAIN|LOG_PANIC, "string too large in smtp_notquit_exit()");
2927 smtp_printf("%s %s\r\n", code, buffer);
2931 smtp_respond(code, 3, TRUE, user_msg);
2939 /*************************************************
2940 * Verify HELO argument *
2941 *************************************************/
2943 /* This function is called if helo_verify_hosts or helo_try_verify_hosts is
2944 matched. It is also called from ACL processing if verify = helo is used and
2945 verification was not previously tried (i.e. helo_try_verify_hosts was not
2946 matched). The result of its processing is to set helo_verified and
2947 helo_verify_failed. These variables should both be FALSE for this function to
2950 Note that EHLO/HELO is legitimately allowed to quote an address literal. Allow
2951 for IPv6 ::ffff: literals.
2954 Returns: TRUE if testing was completed;
2955 FALSE on a temporary failure
2959 smtp_verify_helo(void)
2963 HDEBUG(D_receive) debug_printf("verifying EHLO/HELO argument \"%s\"\n",
2966 if (sender_helo_name == NULL)
2968 HDEBUG(D_receive) debug_printf("no EHLO/HELO command was issued\n");
2971 /* Deal with the case of -bs without an IP address */
2973 else if (sender_host_address == NULL)
2975 HDEBUG(D_receive) debug_printf("no client IP address: assume success\n");
2976 helo_verified = TRUE;
2979 /* Deal with the more common case when there is a sending IP address */
2981 else if (sender_helo_name[0] == '[')
2983 helo_verified = Ustrncmp(sender_helo_name+1, sender_host_address,
2984 Ustrlen(sender_host_address)) == 0;
2989 if (strncmpic(sender_host_address, US"::ffff:", 7) == 0)
2990 helo_verified = Ustrncmp(sender_helo_name + 1,
2991 sender_host_address + 7, Ustrlen(sender_host_address) - 7) == 0;
2996 { if (helo_verified) debug_printf("matched host address\n"); }
2999 /* Do a reverse lookup if one hasn't already given a positive or negative
3000 response. If that fails, or the name doesn't match, try checking with a forward
3005 if (sender_host_name == NULL && !host_lookup_failed)
3006 yield = host_name_lookup() != DEFER;
3008 /* If a host name is known, check it and all its aliases. */
3010 if (sender_host_name)
3011 if ((helo_verified = strcmpic(sender_host_name, sender_helo_name) == 0))
3013 sender_helo_dnssec = sender_host_dnssec;
3014 HDEBUG(D_receive) debug_printf("matched host name\n");
3018 uschar **aliases = sender_host_aliases;
3020 if ((helo_verified = strcmpic(*aliases++, sender_helo_name) == 0))
3022 sender_helo_dnssec = sender_host_dnssec;
3026 HDEBUG(D_receive) if (helo_verified)
3027 debug_printf("matched alias %s\n", *(--aliases));
3030 /* Final attempt: try a forward lookup of the helo name */
3039 h.name = sender_helo_name;
3046 HDEBUG(D_receive) debug_printf("getting IP address for %s\n",
3048 rc = host_find_bydns(&h, NULL, HOST_FIND_BY_A,
3049 NULL, NULL, NULL, &d, NULL, NULL);
3050 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3051 for (hh = &h; hh; hh = hh->next)
3052 if (Ustrcmp(hh->address, sender_host_address) == 0)
3054 helo_verified = TRUE;
3055 if (h.dnssec == DS_YES) sender_helo_dnssec = TRUE;
3058 debug_printf("IP address for %s matches calling address\n"
3059 "Forward DNS security status: %sverified\n",
3060 sender_helo_name, sender_helo_dnssec ? "" : "un");
3067 if (!helo_verified) helo_verify_failed = TRUE; /* We've tried ... */
3074 /*************************************************
3075 * Send user response message *
3076 *************************************************/
3078 /* This function is passed a default response code and a user message. It calls
3079 smtp_message_code() to check and possibly modify the response code, and then
3080 calls smtp_respond() to transmit the response. I put this into a function
3081 just to avoid a lot of repetition.
3084 code the response code
3085 user_msg the user message
3091 smtp_user_msg(uschar *code, uschar *user_msg)
3094 smtp_message_code(&code, &len, &user_msg, NULL);
3095 smtp_respond(code, len, TRUE, user_msg);
3101 smtp_in_auth(auth_instance *au, uschar ** s, uschar ** ss)
3103 const uschar *set_id = NULL;
3106 /* Run the checking code, passing the remainder of the command line as
3107 data. Initials the $auth<n> variables as empty. Initialize $0 empty and set
3108 it as the only set numerical variable. The authenticator may set $auth<n>
3109 and also set other numeric variables. The $auth<n> variables are preferred
3110 nowadays; the numerical variables remain for backwards compatibility.
3112 Afterwards, have a go at expanding the set_id string, even if
3113 authentication failed - for bad passwords it can be useful to log the
3114 userid. On success, require set_id to expand and exist, and put it in
3115 authenticated_id. Save this in permanent store, as the working store gets
3116 reset at HELO, RSET, etc. */
3118 for (i = 0; i < AUTH_VARS; i++) auth_vars[i] = NULL;
3120 expand_nlength[0] = 0; /* $0 contains nothing */
3122 rc = (au->info->servercode)(au, smtp_cmd_data);
3123 if (au->set_id) set_id = expand_string(au->set_id);
3124 expand_nmax = -1; /* Reset numeric variables */
3125 for (i = 0; i < AUTH_VARS; i++) auth_vars[i] = NULL; /* Reset $auth<n> */
3127 /* The value of authenticated_id is stored in the spool file and printed in
3128 log lines. It must not contain binary zeros or newline characters. In
3129 normal use, it never will, but when playing around or testing, this error
3130 can (did) happen. To guard against this, ensure that the id contains only
3131 printing characters. */
3133 if (set_id) set_id = string_printing(set_id);
3135 /* For the non-OK cases, set up additional logging data if set_id
3139 set_id = set_id && *set_id
3140 ? string_sprintf(" (set_id=%s)", set_id) : US"";
3142 /* Switch on the result */
3147 if (!au->set_id || set_id) /* Complete success */
3149 if (set_id) authenticated_id = string_copy_malloc(set_id);
3150 sender_host_authenticated = au->name;
3151 authentication_failed = FALSE;
3152 authenticated_fail_id = NULL; /* Impossible to already be set? */
3155 (sender_host_address ? protocols : protocols_local)
3156 [pextend + pauthed + (tls_in.active >= 0 ? pcrpted:0)];
3157 *s = *ss = US"235 Authentication succeeded";
3158 authenticated_by = au;
3162 /* Authentication succeeded, but we failed to expand the set_id string.
3163 Treat this as a temporary error. */
3165 auth_defer_msg = expand_string_message;
3169 if (set_id) authenticated_fail_id = string_copy_malloc(set_id);
3170 *s = string_sprintf("435 Unable to authenticate at present%s",
3171 auth_defer_user_msg);
3172 *ss = string_sprintf("435 Unable to authenticate at present%s: %s",
3173 set_id, auth_defer_msg);
3177 *s = *ss = US"501 Invalid base64 data";
3181 *s = *ss = US"501 Authentication cancelled";
3185 *s = *ss = US"553 Initial data not expected";
3189 if (set_id) authenticated_fail_id = string_copy_malloc(set_id);
3190 *s = US"535 Incorrect authentication data";
3191 *ss = string_sprintf("535 Incorrect authentication data%s", set_id);
3195 if (set_id) authenticated_fail_id = string_copy_malloc(set_id);
3196 *s = US"435 Internal error";
3197 *ss = string_sprintf("435 Internal error%s: return %d from authentication "
3198 "check", set_id, rc);
3207 /*************************************************
3208 * Initialize for SMTP incoming message *
3209 *************************************************/
3211 /* This function conducts the initial dialogue at the start of an incoming SMTP
3212 message, and builds a list of recipients. However, if the incoming message
3213 is part of a batch (-bS option) a separate function is called since it would
3214 be messy having tests splattered about all over this function. This function
3215 therefore handles the case where interaction is occurring. The input and output
3216 files are set up in smtp_in and smtp_out.
3218 The global recipients_list is set to point to a vector of recipient_item
3219 blocks, whose number is given by recipients_count. This is extended by the
3220 receive_add_recipient() function. The global variable sender_address is set to
3221 the sender's address. The yield is +1 if a message has been successfully
3222 started, 0 if a QUIT command was encountered or the connection was refused from
3223 the particular host, or -1 if the connection was lost.
3227 Returns: > 0 message successfully started (reached DATA)
3228 = 0 QUIT read or end of file reached or call refused
3233 smtp_setup_msg(void)
3236 BOOL toomany = FALSE;
3237 BOOL discarded = FALSE;
3238 BOOL last_was_rej_mail = FALSE;
3239 BOOL last_was_rcpt = FALSE;
3240 void *reset_point = store_get(0);
3242 DEBUG(D_receive) debug_printf("smtp_setup_msg entered\n");
3244 /* Reset for start of new message. We allow one RSET not to be counted as a
3245 nonmail command, for those MTAs that insist on sending it between every
3246 message. Ditto for EHLO/HELO and for STARTTLS, to allow for going in and out of
3247 TLS between messages (an Exim client may do this if it has messages queued up
3248 for the host). Note: we do NOT reset AUTH at this point. */
3250 smtp_reset(reset_point);
3251 message_ended = END_NOTSTARTED;
3253 cmd_list[CMD_LIST_RSET].is_mail_cmd = TRUE;
3254 cmd_list[CMD_LIST_HELO].is_mail_cmd = TRUE;
3255 cmd_list[CMD_LIST_EHLO].is_mail_cmd = TRUE;
3257 cmd_list[CMD_LIST_STARTTLS].is_mail_cmd = TRUE;
3258 cmd_list[CMD_LIST_TLS_AUTH].is_mail_cmd = TRUE;
3261 /* Set the local signal handler for SIGTERM - it tries to end off tidily */
3263 os_non_restarting_signal(SIGTERM, command_sigterm_handler);
3265 /* Batched SMTP is handled in a different function. */
3267 if (smtp_batched_input) return smtp_setup_batch_msg();
3269 /* Deal with SMTP commands. This loop is exited by setting done to a POSITIVE
3270 value. The values are 2 larger than the required yield of the function. */
3274 const uschar **argv;
3275 uschar *etrn_command;
3276 uschar *etrn_serialize_key;
3278 uschar *log_msg, *smtp_code;
3279 uschar *user_msg = NULL;
3280 uschar *recipient = NULL;
3281 uschar *hello = NULL;
3283 BOOL was_rej_mail = FALSE;
3284 BOOL was_rcpt = FALSE;
3285 void (*oldsignal)(int);
3287 int start, end, sender_domain, recipient_domain;
3291 uschar *orcpt = NULL;
3294 #if defined(SUPPORT_TLS) && defined(AUTH_TLS)
3295 /* Check once per STARTTLS or SSL-on-connect for a TLS AUTH */
3296 if ( tls_in.active >= 0
3298 && tls_in.certificate_verified
3299 && cmd_list[CMD_LIST_TLS_AUTH].is_mail_cmd
3302 cmd_list[CMD_LIST_TLS_AUTH].is_mail_cmd = FALSE;
3305 rc = acl_check(ACL_WHERE_AUTH, NULL, acl_smtp_auth, &user_msg, &log_msg);
3308 done = smtp_handle_acl_fail(ACL_WHERE_AUTH, rc, user_msg, log_msg);
3313 for (au = auths; au; au = au->next)
3314 if (strcmpic(US"tls", au->driver_name) == 0)
3316 smtp_cmd_data = NULL;
3318 if ((c = smtp_in_auth(au, &s, &ss)) != OK)
3319 log_write(0, LOG_MAIN|LOG_REJECT, "%s authenticator failed for %s: %s",
3320 au->name, host_and_ident(FALSE), ss);
3322 DEBUG(D_auth) debug_printf("tls auth succeeded\n");
3329 switch(smtp_read_command(TRUE))
3331 /* The AUTH command is not permitted to occur inside a transaction, and may
3332 occur successfully only once per connection. Actually, that isn't quite
3333 true. When TLS is started, all previous information about a connection must
3334 be discarded, so a new AUTH is permitted at that time.
3336 AUTH may only be used when it has been advertised. However, it seems that
3337 there are clients that send AUTH when it hasn't been advertised, some of
3338 them even doing this after HELO. And there are MTAs that accept this. Sigh.
3339 So there's a get-out that allows this to happen.
3341 AUTH is initially labelled as a "nonmail command" so that one occurrence
3342 doesn't get counted. We change the label here so that multiple failing
3343 AUTHS will eventually hit the nonmail threshold. */
3347 authentication_failed = TRUE;
3348 cmd_list[CMD_LIST_AUTH].is_mail_cmd = FALSE;
3350 if (!auth_advertised && !allow_auth_unadvertised)
3352 done = synprot_error(L_smtp_protocol_error, 503, NULL,
3353 US"AUTH command used when not advertised");
3356 if (sender_host_authenticated)
3358 done = synprot_error(L_smtp_protocol_error, 503, NULL,
3359 US"already authenticated");
3364 done = synprot_error(L_smtp_protocol_error, 503, NULL,
3365 US"not permitted in mail transaction");
3373 rc = acl_check(ACL_WHERE_AUTH, NULL, acl_smtp_auth, &user_msg, &log_msg);
3376 done = smtp_handle_acl_fail(ACL_WHERE_AUTH, rc, user_msg, log_msg);
3381 /* Find the name of the requested authentication mechanism. */
3384 while ((c = *smtp_cmd_data) != 0 && !isspace(c))
3386 if (!isalnum(c) && c != '-' && c != '_')
3388 done = synprot_error(L_smtp_syntax_error, 501, NULL,
3389 US"invalid character in authentication mechanism name");
3395 /* If not at the end of the line, we must be at white space. Terminate the
3396 name and move the pointer on to any data that may be present. */
3398 if (*smtp_cmd_data != 0)
3400 *smtp_cmd_data++ = 0;
3401 while (isspace(*smtp_cmd_data)) smtp_cmd_data++;
3404 /* Search for an authentication mechanism which is configured for use
3405 as a server and which has been advertised (unless, sigh, allow_auth_
3406 unadvertised is set). */
3408 for (au = auths; au; au = au->next)
3409 if (strcmpic(s, au->public_name) == 0 && au->server &&
3410 (au->advertised || allow_auth_unadvertised))
3415 c = smtp_in_auth(au, &s, &ss);
3417 smtp_printf("%s\r\n", s);
3419 log_write(0, LOG_MAIN|LOG_REJECT, "%s authenticator failed for %s: %s",
3420 au->name, host_and_ident(FALSE), ss);
3423 done = synprot_error(L_smtp_protocol_error, 504, NULL,
3424 string_sprintf("%s authentication mechanism not supported", s));
3426 break; /* AUTH_CMD */
3428 /* The HELO/EHLO commands are permitted to appear in the middle of a
3429 session as well as at the beginning. They have the effect of a reset in
3430 addition to their other functions. Their absence at the start cannot be
3431 taken to be an error.
3435 If the EHLO command is not acceptable to the SMTP server, 501, 500,
3436 or 502 failure replies MUST be returned as appropriate. The SMTP
3437 server MUST stay in the same state after transmitting these replies
3438 that it was in before the EHLO was received.
3440 Therefore, we do not do the reset until after checking the command for
3441 acceptability. This change was made for Exim release 4.11. Previously
3442 it did the reset first. */
3455 HELO_EHLO: /* Common code for HELO and EHLO */
3456 cmd_list[CMD_LIST_HELO].is_mail_cmd = FALSE;
3457 cmd_list[CMD_LIST_EHLO].is_mail_cmd = FALSE;
3459 /* Reject the HELO if its argument was invalid or non-existent. A
3460 successful check causes the argument to be saved in malloc store. */
3462 if (!check_helo(smtp_cmd_data))
3464 smtp_printf("501 Syntactically invalid %s argument(s)\r\n", hello);
3466 log_write(0, LOG_MAIN|LOG_REJECT, "rejected %s from %s: syntactically "
3467 "invalid argument(s): %s", hello, host_and_ident(FALSE),
3468 (*smtp_cmd_argument == 0)? US"(no argument given)" :
3469 string_printing(smtp_cmd_argument));
3471 if (++synprot_error_count > smtp_max_synprot_errors)
3473 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP call from %s dropped: too many "
3474 "syntax or protocol errors (last command was \"%s\")",
3475 host_and_ident(FALSE), string_printing(smtp_cmd_buffer));
3482 /* If sender_host_unknown is true, we have got here via the -bs interface,
3483 not called from inetd. Otherwise, we are running an IP connection and the
3484 host address will be set. If the helo name is the primary name of this
3485 host and we haven't done a reverse lookup, force one now. If helo_required
3486 is set, ensure that the HELO name matches the actual host. If helo_verify
3487 is set, do the same check, but softly. */
3489 if (!sender_host_unknown)
3491 BOOL old_helo_verified = helo_verified;
3492 uschar *p = smtp_cmd_data;
3494 while (*p != 0 && !isspace(*p)) { *p = tolower(*p); p++; }
3497 /* Force a reverse lookup if HELO quoted something in helo_lookup_domains
3498 because otherwise the log can be confusing. */
3500 if (sender_host_name == NULL &&
3501 (deliver_domain = sender_helo_name, /* set $domain */
3502 match_isinlist(sender_helo_name, CUSS &helo_lookup_domains, 0,
3503 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL)) == OK)
3504 (void)host_name_lookup();
3506 /* Rebuild the fullhost info to include the HELO name (and the real name
3507 if it was looked up.) */
3509 host_build_sender_fullhost(); /* Rebuild */
3510 set_process_info("handling%s incoming connection from %s",
3511 (tls_in.active >= 0)? " TLS" : "", host_and_ident(FALSE));
3513 /* Verify if configured. This doesn't give much security, but it does
3514 make some people happy to be able to do it. If helo_required is set,
3515 (host matches helo_verify_hosts) failure forces rejection. If helo_verify
3516 is set (host matches helo_try_verify_hosts), it does not. This is perhaps
3517 now obsolescent, since the verification can now be requested selectively
3520 helo_verified = helo_verify_failed = sender_helo_dnssec = FALSE;
3521 if (helo_required || helo_verify)
3523 BOOL tempfail = !smtp_verify_helo();
3528 smtp_printf("%d %s argument does not match calling host\r\n",
3529 tempfail? 451 : 550, hello);
3530 log_write(0, LOG_MAIN|LOG_REJECT, "%srejected \"%s %s\" from %s",
3531 tempfail? "temporarily " : "",
3532 hello, sender_helo_name, host_and_ident(FALSE));
3533 helo_verified = old_helo_verified;
3534 break; /* End of HELO/EHLO processing */
3536 HDEBUG(D_all) debug_printf("%s verification failed but host is in "
3537 "helo_try_verify_hosts\n", hello);
3542 #ifdef EXPERIMENTAL_SPF
3543 /* set up SPF context */
3544 spf_init(sender_helo_name, sender_host_address);
3547 /* Apply an ACL check if one is defined; afterwards, recheck
3548 synchronization in case the client started sending in a delay. */
3550 if (acl_smtp_helo != NULL)
3552 rc = acl_check(ACL_WHERE_HELO, NULL, acl_smtp_helo, &user_msg, &log_msg);
3555 done = smtp_handle_acl_fail(ACL_WHERE_HELO, rc, user_msg, log_msg);
3556 sender_helo_name = NULL;
3557 host_build_sender_fullhost(); /* Rebuild */
3560 else if (!check_sync()) goto SYNC_FAILURE;
3563 /* Generate an OK reply. The default string includes the ident if present,
3564 and also the IP address if present. Reflecting back the ident is intended
3565 as a deterrent to mail forgers. For maximum efficiency, and also because
3566 some broken systems expect each response to be in a single packet, arrange
3567 that the entire reply is sent in one write(). */
3569 auth_advertised = FALSE;
3570 pipelining_advertised = FALSE;
3572 tls_advertised = FALSE;
3574 dsn_advertised = FALSE;
3575 #ifdef EXPERIMENTAL_INTERNATIONAL
3576 smtputf8_advertised = FALSE;
3579 smtp_code = US"250 "; /* Default response code plus space*/
3580 if (user_msg == NULL)
3582 s = string_sprintf("%.3s %s Hello %s%s%s",
3584 smtp_active_hostname,
3585 (sender_ident == NULL)? US"" : sender_ident,
3586 (sender_ident == NULL)? US"" : US" at ",
3587 (sender_host_name == NULL)? sender_helo_name : sender_host_name);
3592 if (sender_host_address != NULL)
3594 s = string_cat(s, &size, &ptr, US" [", 2);
3595 s = string_cat(s, &size, &ptr, sender_host_address,
3596 Ustrlen(sender_host_address));
3597 s = string_cat(s, &size, &ptr, US"]", 1);
3601 /* A user-supplied EHLO greeting may not contain more than one line. Note
3602 that the code returned by smtp_message_code() includes the terminating
3603 whitespace character. */
3609 smtp_message_code(&smtp_code, &codelen, &user_msg, NULL);
3610 s = string_sprintf("%.*s%s", codelen, smtp_code, user_msg);
3611 if ((ss = strpbrk(CS s, "\r\n")) != NULL)
3613 log_write(0, LOG_MAIN|LOG_PANIC, "EHLO/HELO response must not contain "
3614 "newlines: message truncated: %s", string_printing(s));
3621 s = string_cat(s, &size, &ptr, US"\r\n", 2);
3623 /* If we received EHLO, we must create a multiline response which includes
3624 the functions supported. */
3630 /* I'm not entirely happy with this, as an MTA is supposed to check
3631 that it has enough room to accept a message of maximum size before
3632 it sends this. However, there seems little point in not sending it.
3633 The actual size check happens later at MAIL FROM time. By postponing it
3634 till then, VRFY and EXPN can be used after EHLO when space is short. */
3636 if (thismessage_size_limit > 0)
3638 sprintf(CS big_buffer, "%.3s-SIZE %d\r\n", smtp_code,
3639 thismessage_size_limit);
3640 s = string_cat(s, &size, &ptr, big_buffer, Ustrlen(big_buffer));
3644 s = string_cat(s, &size, &ptr, smtp_code, 3);
3645 s = string_cat(s, &size, &ptr, US"-SIZE\r\n", 7);
3648 /* Exim does not do protocol conversion or data conversion. It is 8-bit
3649 clean; if it has an 8-bit character in its hand, it just sends it. It
3650 cannot therefore specify 8BITMIME and remain consistent with the RFCs.
3651 However, some users want this option simply in order to stop MUAs
3652 mangling messages that contain top-bit-set characters. It is therefore
3653 provided as an option. */
3655 if (accept_8bitmime)
3657 s = string_cat(s, &size, &ptr, smtp_code, 3);
3658 s = string_cat(s, &size, &ptr, US"-8BITMIME\r\n", 11);
3661 /* Advertise DSN support if configured to do so. */
3662 if (verify_check_host(&dsn_advertise_hosts) != FAIL)
3664 s = string_cat(s, &size, &ptr, smtp_code, 3);
3665 s = string_cat(s, &size, &ptr, US"-DSN\r\n", 6);
3666 dsn_advertised = TRUE;
3669 /* Advertise ETRN if there's an ACL checking whether a host is
3670 permitted to issue it; a check is made when any host actually tries. */
3672 if (acl_smtp_etrn != NULL)
3674 s = string_cat(s, &size, &ptr, smtp_code, 3);
3675 s = string_cat(s, &size, &ptr, US"-ETRN\r\n", 7);
3678 /* Advertise EXPN if there's an ACL checking whether a host is
3679 permitted to issue it; a check is made when any host actually tries. */
3681 if (acl_smtp_expn != NULL)
3683 s = string_cat(s, &size, &ptr, smtp_code, 3);
3684 s = string_cat(s, &size, &ptr, US"-EXPN\r\n", 7);
3687 /* Exim is quite happy with pipelining, so let the other end know that
3688 it is safe to use it, unless advertising is disabled. */
3690 if (pipelining_enable &&
3691 verify_check_host(&pipelining_advertise_hosts) == OK)
3693 s = string_cat(s, &size, &ptr, smtp_code, 3);
3694 s = string_cat(s, &size, &ptr, US"-PIPELINING\r\n", 13);
3695 sync_cmd_limit = NON_SYNC_CMD_PIPELINING;
3696 pipelining_advertised = TRUE;
3700 /* If any server authentication mechanisms are configured, advertise
3701 them if the current host is in auth_advertise_hosts. The problem with
3702 advertising always is that some clients then require users to
3703 authenticate (and aren't configurable otherwise) even though it may not
3704 be necessary (e.g. if the host is in host_accept_relay).
3706 RFC 2222 states that SASL mechanism names contain only upper case
3707 letters, so output the names in upper case, though we actually recognize
3708 them in either case in the AUTH command. */
3711 #if defined(SUPPORT_TLS) && defined(AUTH_TLS)
3712 && !sender_host_authenticated
3714 && verify_check_host(&auth_advertise_hosts) == OK
3719 for (au = auths; au; au = au->next)
3720 if (au->server && (au->advertise_condition == NULL ||
3721 expand_check_condition(au->advertise_condition, au->name,
3722 US"authenticator")))
3727 s = string_cat(s, &size, &ptr, smtp_code, 3);
3728 s = string_cat(s, &size, &ptr, US"-AUTH", 5);
3730 auth_advertised = TRUE;
3733 s = string_cat(s, &size, &ptr, US" ", 1);
3734 s = string_cat(s, &size, &ptr, au->public_name,
3735 Ustrlen(au->public_name));
3736 while (++saveptr < ptr) s[saveptr] = toupper(s[saveptr]);
3737 au->advertised = TRUE;
3740 au->advertised = FALSE;
3742 if (!first) s = string_cat(s, &size, &ptr, US"\r\n", 2);
3745 /* Advertise TLS (Transport Level Security) aka SSL (Secure Socket Layer)
3746 if it has been included in the binary, and the host matches
3747 tls_advertise_hosts. We must *not* advertise if we are already in a
3748 secure connection. */
3751 if (tls_in.active < 0 &&
3752 verify_check_host(&tls_advertise_hosts) != FAIL)
3754 s = string_cat(s, &size, &ptr, smtp_code, 3);
3755 s = string_cat(s, &size, &ptr, US"-STARTTLS\r\n", 11);
3756 tls_advertised = TRUE;
3760 #ifndef DISABLE_PRDR
3761 /* Per Recipient Data Response, draft by Eric A. Hall extending RFC */
3764 s = string_cat(s, &size, &ptr, smtp_code, 3);
3765 s = string_cat(s, &size, &ptr, US"-PRDR\r\n", 7);
3769 #ifdef EXPERIMENTAL_INTERNATIONAL
3770 if ( accept_8bitmime
3771 && verify_check_host(&smtputf8_advertise_hosts) != FAIL)
3773 s = string_cat(s, &size, &ptr, smtp_code, 3);
3774 s = string_cat(s, &size, &ptr, US"-SMTPUTF8\r\n", 11);
3775 smtputf8_advertised = TRUE;
3779 /* Finish off the multiline reply with one that is always available. */
3781 s = string_cat(s, &size, &ptr, smtp_code, 3);
3782 s = string_cat(s, &size, &ptr, US" HELP\r\n", 7);
3785 /* Terminate the string (for debug), write it, and note that HELO/EHLO
3791 if (tls_in.active >= 0) (void)tls_write(TRUE, s, ptr); else
3795 int i = fwrite(s, 1, ptr, smtp_out); i = i; /* compiler quietening */
3800 while ((cr = Ustrchr(s, '\r')) != NULL) /* lose CRs */
3801 memmove(cr, cr + 1, (ptr--) - (cr - s));
3802 debug_printf("SMTP>> %s", s);
3806 /* Reset the protocol and the state, abandoning any previous message. */
3808 (sender_host_address ? protocols : protocols_local)
3810 ? pextend + (sender_host_authenticated ? pauthed : 0)
3812 + (tls_in.active >= 0 ? pcrpted : 0)
3814 smtp_reset(reset_point);
3816 break; /* HELO/EHLO */
3819 /* The MAIL command requires an address as an operand. All we do
3820 here is to parse it for syntactic correctness. The form "<>" is
3821 a special case which converts into an empty string. The start/end
3822 pointers in the original are not used further for this address, as
3823 it is the canonical extracted address which is all that is kept. */
3827 smtp_mailcmd_count++; /* Count for limit and ratelimit */
3828 was_rej_mail = TRUE; /* Reset if accepted */
3829 env_mail_type_t * mail_args; /* Sanity check & validate args */
3831 if (helo_required && !helo_seen)
3833 smtp_printf("503 HELO or EHLO required\r\n");
3834 log_write(0, LOG_MAIN|LOG_REJECT, "rejected MAIL from %s: no "
3835 "HELO/EHLO given", host_and_ident(FALSE));
3839 if (sender_address != NULL)
3841 done = synprot_error(L_smtp_protocol_error, 503, NULL,
3842 US"sender already given");
3846 if (smtp_cmd_data[0] == 0)
3848 done = synprot_error(L_smtp_protocol_error, 501, NULL,
3849 US"MAIL must have an address operand");
3853 /* Check to see if the limit for messages per connection would be
3854 exceeded by accepting further messages. */
3856 if (smtp_accept_max_per_connection > 0 &&
3857 smtp_mailcmd_count > smtp_accept_max_per_connection)
3859 smtp_printf("421 too many messages in this connection\r\n");
3860 log_write(0, LOG_MAIN|LOG_REJECT, "rejected MAIL command %s: too many "
3861 "messages in one connection", host_and_ident(TRUE));
3865 /* Reset for start of message - even if this is going to fail, we
3866 obviously need to throw away any previous data. */
3868 smtp_reset(reset_point);
3870 sender_data = recipient_data = NULL;
3872 /* Loop, checking for ESMTP additions to the MAIL FROM command. */
3876 uschar *name, *value, *end;
3877 unsigned long int size;
3878 BOOL arg_error = FALSE;
3880 if (!extract_option(&name, &value)) break;
3882 for (mail_args = env_mail_type_list;
3883 (char *)mail_args < (char *)env_mail_type_list + sizeof(env_mail_type_list);
3886 if (strcmpic(name, mail_args->name) == 0)
3888 if (mail_args->need_value && strcmpic(value, US"") == 0)
3891 switch(mail_args->value)
3893 /* Handle SIZE= by reading the value. We don't do the check till later,
3894 in order to be able to log the sender address on failure. */
3895 case ENV_MAIL_OPT_SIZE:
3896 if (((size = Ustrtoul(value, &end, 10)), *end == 0))
3898 if ((size == ULONG_MAX && errno == ERANGE) || size > INT_MAX)
3900 message_size = (int)size;
3906 /* If this session was initiated with EHLO and accept_8bitmime is set,
3907 Exim will have indicated that it supports the BODY=8BITMIME option. In
3908 fact, it does not support this according to the RFCs, in that it does not
3909 take any special action for forwarding messages containing 8-bit
3910 characters. That is why accept_8bitmime is not the default setting, but
3911 some sites want the action that is provided. We recognize both "8BITMIME"
3912 and "7BIT" as body types, but take no action. */
3913 case ENV_MAIL_OPT_BODY:
3914 if (accept_8bitmime) {
3915 if (strcmpic(value, US"8BITMIME") == 0)
3917 else if (strcmpic(value, US"7BIT") == 0)
3922 done = synprot_error(L_smtp_syntax_error, 501, NULL,
3923 US"invalid data for BODY");
3926 DEBUG(D_receive) debug_printf("8BITMIME: %d\n", body_8bitmime);
3932 /* Handle the two DSN options, but only if configured to do so (which
3933 will have caused "DSN" to be given in the EHLO response). The code itself
3934 is included only if configured in at build time. */
3936 case ENV_MAIL_OPT_RET:
3939 /* Check if RET has already been set */
3942 synprot_error(L_smtp_syntax_error, 501, NULL,
3943 US"RET can be specified once only");
3946 dsn_ret = strcmpic(value, US"HDRS") == 0
3948 : strcmpic(value, US"FULL") == 0
3951 DEBUG(D_receive) debug_printf("DSN_RET: %d\n", dsn_ret);
3952 /* Check for invalid invalid value, and exit with error */
3955 synprot_error(L_smtp_syntax_error, 501, NULL,
3956 US"Value for RET is invalid");
3961 case ENV_MAIL_OPT_ENVID:
3964 /* Check if the dsn envid has been already set */
3965 if (dsn_envid != NULL)
3967 synprot_error(L_smtp_syntax_error, 501, NULL,
3968 US"ENVID can be specified once only");
3971 dsn_envid = string_copy(value);
3972 DEBUG(D_receive) debug_printf("DSN_ENVID: %s\n", dsn_envid);
3976 /* Handle the AUTH extension. If the value given is not "<>" and either
3977 the ACL says "yes" or there is no ACL but the sending host is
3978 authenticated, we set it up as the authenticated sender. However, if the
3979 authenticator set a condition to be tested, we ignore AUTH on MAIL unless
3980 the condition is met. The value of AUTH is an xtext, which means that +,
3981 = and cntrl chars are coded in hex; however "<>" is unaffected by this
3983 case ENV_MAIL_OPT_AUTH:
3984 if (Ustrcmp(value, "<>") != 0)
3989 if (auth_xtextdecode(value, &authenticated_sender) < 0)
3991 /* Put back terminator overrides for error message */
3994 done = synprot_error(L_smtp_syntax_error, 501, NULL,
3995 US"invalid data for AUTH");
3998 if (acl_smtp_mailauth == NULL)
4000 ignore_msg = US"client not authenticated";
4001 rc = (sender_host_authenticated != NULL)? OK : FAIL;
4005 ignore_msg = US"rejected by ACL";
4006 rc = acl_check(ACL_WHERE_MAILAUTH, NULL, acl_smtp_mailauth,
4007 &user_msg, &log_msg);
4013 if (authenticated_by == NULL ||
4014 authenticated_by->mail_auth_condition == NULL ||
4015 expand_check_condition(authenticated_by->mail_auth_condition,
4016 authenticated_by->name, US"authenticator"))
4017 break; /* Accept the AUTH */
4019 ignore_msg = US"server_mail_auth_condition failed";
4020 if (authenticated_id != NULL)
4021 ignore_msg = string_sprintf("%s: authenticated ID=\"%s\"",
4022 ignore_msg, authenticated_id);
4027 authenticated_sender = NULL;
4028 log_write(0, LOG_MAIN, "ignoring AUTH=%s from %s (%s)",
4029 value, host_and_ident(TRUE), ignore_msg);
4032 /* Should only get DEFER or ERROR here. Put back terminator
4033 overrides for error message */
4038 (void)smtp_handle_acl_fail(ACL_WHERE_MAILAUTH, rc, user_msg,
4045 #ifndef DISABLE_PRDR
4046 case ENV_MAIL_OPT_PRDR:
4048 prdr_requested = TRUE;
4052 #ifdef EXPERIMENTAL_INTERNATIONAL
4053 case ENV_MAIL_OPT_UTF8:
4054 if (smtputf8_advertised)
4056 DEBUG(D_receive) debug_printf("smtputf8 requested\n");
4057 message_smtputf8 = allow_utf8_domains = TRUE;
4058 received_protocol = string_sprintf("utf8%s", received_protocol);
4062 /* Unknown option. Stick back the terminator characters and break
4063 the loop. Do the name-terminator second as extract_option sets
4064 value==name when it found no equal-sign.
4065 An error for a malformed address will occur. */
4072 /* Break out of for loop if switch() had bad argument or
4073 when start of the email address is reached */
4074 if (arg_error) break;
4077 /* If we have passed the threshold for rate limiting, apply the current
4078 delay, and update it for next time, provided this is a limited host. */
4080 if (smtp_mailcmd_count > smtp_rlm_threshold &&
4081 verify_check_host(&smtp_ratelimit_hosts) == OK)
4083 DEBUG(D_receive) debug_printf("rate limit MAIL: delay %.3g sec\n",
4084 smtp_delay_mail/1000.0);
4085 millisleep((int)smtp_delay_mail);
4086 smtp_delay_mail *= smtp_rlm_factor;
4087 if (smtp_delay_mail > (double)smtp_rlm_limit)
4088 smtp_delay_mail = (double)smtp_rlm_limit;
4091 /* Now extract the address, first applying any SMTP-time rewriting. The
4092 TRUE flag allows "<>" as a sender address. */
4094 raw_sender = rewrite_existflags & rewrite_smtp
4095 ? rewrite_one(smtp_cmd_data, rewrite_smtp, NULL, FALSE, US"",
4096 global_rewrite_rules)
4099 /* rfc821_domains = TRUE; << no longer needed */
4101 parse_extract_address(raw_sender, &errmess, &start, &end, &sender_domain,
4103 /* rfc821_domains = FALSE; << no longer needed */
4105 if (raw_sender == NULL)
4107 done = synprot_error(L_smtp_syntax_error, 501, smtp_cmd_data, errmess);
4111 sender_address = raw_sender;
4113 /* If there is a configured size limit for mail, check that this message
4114 doesn't exceed it. The check is postponed to this point so that the sender
4117 if (thismessage_size_limit > 0 && message_size > thismessage_size_limit)
4119 smtp_printf("552 Message size exceeds maximum permitted\r\n");
4120 log_write(L_size_reject,
4121 LOG_MAIN|LOG_REJECT, "rejected MAIL FROM:<%s> %s: "
4122 "message too big: size%s=%d max=%d",
4124 host_and_ident(TRUE),
4125 (message_size == INT_MAX)? ">" : "",
4127 thismessage_size_limit);
4128 sender_address = NULL;
4132 /* Check there is enough space on the disk unless configured not to.
4133 When smtp_check_spool_space is set, the check is for thismessage_size_limit
4134 plus the current message - i.e. we accept the message only if it won't
4135 reduce the space below the threshold. Add 5000 to the size to allow for
4136 overheads such as the Received: line and storing of recipients, etc.
4137 By putting the check here, even when SIZE is not given, it allow VRFY
4138 and EXPN etc. to be used when space is short. */
4140 if (!receive_check_fs(
4141 (smtp_check_spool_space && message_size >= 0)?
4142 message_size + 5000 : 0))
4144 smtp_printf("452 Space shortage, please try later\r\n");
4145 sender_address = NULL;
4149 /* If sender_address is unqualified, reject it, unless this is a locally
4150 generated message, or the sending host or net is permitted to send
4151 unqualified addresses - typically local machines behaving as MUAs -
4152 in which case just qualify the address. The flag is set above at the start
4153 of the SMTP connection. */
4155 if (sender_domain == 0 && sender_address[0] != 0)
4157 if (allow_unqualified_sender)
4159 sender_domain = Ustrlen(sender_address) + 1;
4160 sender_address = rewrite_address_qualify(sender_address, FALSE);
4161 DEBUG(D_receive) debug_printf("unqualified address %s accepted\n",
4166 smtp_printf("501 %s: sender address must contain a domain\r\n",
4168 log_write(L_smtp_syntax_error,
4169 LOG_MAIN|LOG_REJECT,
4170 "unqualified sender rejected: <%s> %s%s",
4172 host_and_ident(TRUE),
4174 sender_address = NULL;
4179 /* Apply an ACL check if one is defined, before responding. Afterwards,
4180 when pipelining is not advertised, do another sync check in case the ACL
4181 delayed and the client started sending in the meantime. */
4185 rc = acl_check(ACL_WHERE_MAIL, NULL, acl_smtp_mail, &user_msg, &log_msg);
4186 if (rc == OK && !pipelining_advertised && !check_sync())
4192 if (rc == OK || rc == DISCARD)
4195 smtp_printf("%s%s%s", US"250 OK",
4196 #ifndef DISABLE_PRDR
4197 prdr_requested ? US", PRDR Requested" : US"",
4204 #ifndef DISABLE_PRDR
4206 user_msg = string_sprintf("%s%s", user_msg, US", PRDR Requested");
4208 smtp_user_msg(US"250", user_msg);
4210 smtp_delay_rcpt = smtp_rlr_base;
4211 recipients_discarded = (rc == DISCARD);
4212 was_rej_mail = FALSE;
4216 done = smtp_handle_acl_fail(ACL_WHERE_MAIL, rc, user_msg, log_msg);
4217 sender_address = NULL;
4222 /* The RCPT command requires an address as an operand. There may be any
4223 number of RCPT commands, specifying multiple recipients. We build them all
4224 into a data structure. The start/end values given by parse_extract_address
4225 are not used, as we keep only the extracted address. */
4230 was_rcpt = rcpt_in_progress = TRUE;
4232 /* There must be a sender address; if the sender was rejected and
4233 pipelining was advertised, we assume the client was pipelining, and do not
4234 count this as a protocol error. Reset was_rej_mail so that further RCPTs
4235 get the same treatment. */
4237 if (sender_address == NULL)
4239 if (pipelining_advertised && last_was_rej_mail)
4241 smtp_printf("503 sender not yet given\r\n");
4242 was_rej_mail = TRUE;
4246 done = synprot_error(L_smtp_protocol_error, 503, NULL,
4247 US"sender not yet given");
4248 was_rcpt = FALSE; /* Not a valid RCPT */
4254 /* Check for an operand */
4256 if (smtp_cmd_data[0] == 0)
4258 done = synprot_error(L_smtp_syntax_error, 501, NULL,
4259 US"RCPT must have an address operand");
4264 /* Set the DSN flags orcpt and dsn_flags from the session*/
4270 uschar *name, *value;
4272 if (!extract_option(&name, &value))
4275 if (dsn_advertised && strcmpic(name, US"ORCPT") == 0)
4277 /* Check whether orcpt has been already set */
4280 synprot_error(L_smtp_syntax_error, 501, NULL,
4281 US"ORCPT can be specified once only");
4284 orcpt = string_copy(value);
4285 DEBUG(D_receive) debug_printf("DSN orcpt: %s\n", orcpt);
4288 else if (dsn_advertised && strcmpic(name, US"NOTIFY") == 0)
4290 /* Check if the notify flags have been already set */
4293 synprot_error(L_smtp_syntax_error, 501, NULL,
4294 US"NOTIFY can be specified once only");
4297 if (strcmpic(value, US"NEVER") == 0)
4298 flags |= rf_notify_never;
4305 while (*pp != 0 && *pp != ',') pp++;
4306 if (*pp == ',') *pp++ = 0;
4307 if (strcmpic(p, US"SUCCESS") == 0)
4309 DEBUG(D_receive) debug_printf("DSN: Setting notify success\n");
4310 flags |= rf_notify_success;
4312 else if (strcmpic(p, US"FAILURE") == 0)
4314 DEBUG(D_receive) debug_printf("DSN: Setting notify failure\n");
4315 flags |= rf_notify_failure;
4317 else if (strcmpic(p, US"DELAY") == 0)
4319 DEBUG(D_receive) debug_printf("DSN: Setting notify delay\n");
4320 flags |= rf_notify_delay;
4324 /* Catch any strange values */
4325 synprot_error(L_smtp_syntax_error, 501, NULL,
4326 US"Invalid value for NOTIFY parameter");
4331 DEBUG(D_receive) debug_printf("DSN Flags: %x\n", flags);
4335 /* Unknown option. Stick back the terminator characters and break
4336 the loop. An error for a malformed address will occur. */
4340 DEBUG(D_receive) debug_printf("Invalid RCPT option: %s : %s\n", name, value);
4347 /* Apply SMTP rewriting then extract the working address. Don't allow "<>"
4348 as a recipient address */
4350 recipient = ((rewrite_existflags & rewrite_smtp) != 0)?
4351 rewrite_one(smtp_cmd_data, rewrite_smtp, NULL, FALSE, US"",
4352 global_rewrite_rules) : smtp_cmd_data;
4354 /* rfc821_domains = TRUE; << no longer needed */
4355 recipient = parse_extract_address(recipient, &errmess, &start, &end,
4356 &recipient_domain, FALSE);
4357 /* rfc821_domains = FALSE; << no longer needed */
4359 if (recipient == NULL)
4361 done = synprot_error(L_smtp_syntax_error, 501, smtp_cmd_data, errmess);
4366 /* If the recipient address is unqualified, reject it, unless this is a
4367 locally generated message. However, unqualified addresses are permitted
4368 from a configured list of hosts and nets - typically when behaving as
4369 MUAs rather than MTAs. Sad that SMTP is used for both types of traffic,
4370 really. The flag is set at the start of the SMTP connection.
4372 RFC 1123 talks about supporting "the reserved mailbox postmaster"; I always
4373 assumed this meant "reserved local part", but the revision of RFC 821 and
4374 friends now makes it absolutely clear that it means *mailbox*. Consequently
4375 we must always qualify this address, regardless. */
4377 if (recipient_domain == 0)
4379 if (allow_unqualified_recipient ||
4380 strcmpic(recipient, US"postmaster") == 0)
4382 DEBUG(D_receive) debug_printf("unqualified address %s accepted\n",
4384 recipient_domain = Ustrlen(recipient) + 1;
4385 recipient = rewrite_address_qualify(recipient, TRUE);
4390 smtp_printf("501 %s: recipient address must contain a domain\r\n",
4392 log_write(L_smtp_syntax_error,
4393 LOG_MAIN|LOG_REJECT, "unqualified recipient rejected: "
4394 "<%s> %s%s", recipient, host_and_ident(TRUE),
4400 /* Check maximum allowed */
4402 if (rcpt_count > recipients_max && recipients_max > 0)
4404 if (recipients_max_reject)
4407 smtp_printf("552 too many recipients\r\n");
4409 log_write(0, LOG_MAIN|LOG_REJECT, "too many recipients: message "
4410 "rejected: sender=<%s> %s", sender_address, host_and_ident(TRUE));
4415 smtp_printf("452 too many recipients\r\n");
4417 log_write(0, LOG_MAIN|LOG_REJECT, "too many recipients: excess "
4418 "temporarily rejected: sender=<%s> %s", sender_address,
4419 host_and_ident(TRUE));
4426 /* If we have passed the threshold for rate limiting, apply the current
4427 delay, and update it for next time, provided this is a limited host. */
4429 if (rcpt_count > smtp_rlr_threshold &&
4430 verify_check_host(&smtp_ratelimit_hosts) == OK)
4432 DEBUG(D_receive) debug_printf("rate limit RCPT: delay %.3g sec\n",
4433 smtp_delay_rcpt/1000.0);
4434 millisleep((int)smtp_delay_rcpt);
4435 smtp_delay_rcpt *= smtp_rlr_factor;
4436 if (smtp_delay_rcpt > (double)smtp_rlr_limit)
4437 smtp_delay_rcpt = (double)smtp_rlr_limit;
4440 /* If the MAIL ACL discarded all the recipients, we bypass ACL checking
4441 for them. Otherwise, check the access control list for this recipient. As
4442 there may be a delay in this, re-check for a synchronization error
4443 afterwards, unless pipelining was advertised. */
4445 if (recipients_discarded) rc = DISCARD; else
4447 rc = acl_check(ACL_WHERE_RCPT, recipient, acl_smtp_rcpt, &user_msg,
4449 if (rc == OK && !pipelining_advertised && !check_sync())
4453 /* The ACL was happy */
4457 if (user_msg == NULL) smtp_printf("250 Accepted\r\n");
4458 else smtp_user_msg(US"250", user_msg);
4459 receive_add_recipient(recipient, -1);
4461 /* Set the dsn flags in the recipients_list */
4462 recipients_list[recipients_count-1].orcpt = orcpt;
4463 recipients_list[recipients_count-1].dsn_flags = flags;
4465 DEBUG(D_receive) debug_printf("DSN: orcpt: %s flags: %d\n",
4466 recipients_list[recipients_count-1].orcpt,
4467 recipients_list[recipients_count-1].dsn_flags);
4470 /* The recipient was discarded */
4472 else if (rc == DISCARD)
4474 if (user_msg == NULL) smtp_printf("250 Accepted\r\n");
4475 else smtp_user_msg(US"250", user_msg);
4478 log_write(0, LOG_MAIN|LOG_REJECT, "%s F=<%s> RCPT %s: "
4479 "discarded by %s ACL%s%s", host_and_ident(TRUE),
4480 sender_address_unrewritten? sender_address_unrewritten : sender_address,
4481 smtp_cmd_argument, recipients_discarded? "MAIL" : "RCPT",
4482 log_msg ? US": " : US"", log_msg ? log_msg : US"");
4485 /* Either the ACL failed the address, or it was deferred. */
4489 if (rc == FAIL) rcpt_fail_count++; else rcpt_defer_count++;
4490 done = smtp_handle_acl_fail(ACL_WHERE_RCPT, rc, user_msg, log_msg);
4495 /* The DATA command is legal only if it follows successful MAIL FROM
4496 and RCPT TO commands. However, if pipelining is advertised, a bad DATA is
4497 not counted as a protocol error if it follows RCPT (which must have been
4498 rejected if there are no recipients.) This function is complete when a
4499 valid DATA command is encountered.
4501 Note concerning the code used: RFC 2821 says this:
4503 - If there was no MAIL, or no RCPT, command, or all such commands
4504 were rejected, the server MAY return a "command out of sequence"
4505 (503) or "no valid recipients" (554) reply in response to the
4508 The example in the pipelining RFC 2920 uses 554, but I use 503 here
4509 because it is the same whether pipelining is in use or not.
4511 If all the RCPT commands that precede DATA provoked the same error message
4512 (often indicating some kind of system error), it is helpful to include it
4513 with the DATA rejection (an idea suggested by Tony Finch). */
4517 if (!discarded && recipients_count <= 0)
4519 if (rcpt_smtp_response_same && rcpt_smtp_response != NULL)
4521 uschar *code = US"503";
4522 int len = Ustrlen(rcpt_smtp_response);
4523 smtp_respond(code, 3, FALSE, US"All RCPT commands were rejected with "
4525 /* Responses from smtp_printf() will have \r\n on the end */
4526 if (len > 2 && rcpt_smtp_response[len-2] == '\r')
4527 rcpt_smtp_response[len-2] = 0;
4528 smtp_respond(code, 3, FALSE, rcpt_smtp_response);
4530 if (pipelining_advertised && last_was_rcpt)
4531 smtp_printf("503 Valid RCPT command must precede DATA\r\n");
4533 done = synprot_error(L_smtp_protocol_error, 503, NULL,
4534 US"valid RCPT command must precede DATA");
4538 if (toomany && recipients_max_reject)
4540 sender_address = NULL; /* This will allow a new MAIL without RSET */
4541 sender_address_unrewritten = NULL;
4542 smtp_printf("554 Too many recipients\r\n");
4546 /* If there is an ACL, re-check the synchronization afterwards, since the
4547 ACL may have delayed. To handle cutthrough delivery enforce a dummy call
4548 to get the DATA command sent. */
4550 if (acl_smtp_predata == NULL && cutthrough.fd < 0) rc = OK; else
4552 uschar * acl= acl_smtp_predata ? acl_smtp_predata : US"accept";
4553 enable_dollar_recipients = TRUE;
4554 rc = acl_check(ACL_WHERE_PREDATA, NULL, acl, &user_msg,
4556 enable_dollar_recipients = FALSE;
4557 if (rc == OK && !check_sync()) goto SYNC_FAILURE;
4564 if (user_msg == NULL)
4565 smtp_printf("%s Enter message, ending with \".\" on a line by itself\r\n", code);
4566 else smtp_user_msg(code, user_msg);
4568 message_ended = END_NOTENDED; /* Indicate in middle of data */
4571 /* Either the ACL failed the address, or it was deferred. */
4574 done = smtp_handle_acl_fail(ACL_WHERE_PREDATA, rc, user_msg, log_msg);
4580 rc = acl_check(ACL_WHERE_VRFY, NULL, acl_smtp_vrfy, &user_msg, &log_msg);
4582 done = smtp_handle_acl_fail(ACL_WHERE_VRFY, rc, user_msg, log_msg);
4588 /* rfc821_domains = TRUE; << no longer needed */
4589 address = parse_extract_address(smtp_cmd_data, &errmess, &start, &end,
4590 &recipient_domain, FALSE);
4591 /* rfc821_domains = FALSE; << no longer needed */
4593 if (address == NULL)
4594 s = string_sprintf("501 %s", errmess);
4597 address_item *addr = deliver_make_addr(address, FALSE);
4598 switch(verify_address(addr, NULL, vopt_is_recipient | vopt_qualify, -1,
4599 -1, -1, NULL, NULL, NULL))
4602 s = string_sprintf("250 <%s> is deliverable", address);
4606 s = (addr->user_message != NULL)?
4607 string_sprintf("451 <%s> %s", address, addr->user_message) :
4608 string_sprintf("451 Cannot resolve <%s> at this time", address);
4612 s = (addr->user_message != NULL)?
4613 string_sprintf("550 <%s> %s", address, addr->user_message) :
4614 string_sprintf("550 <%s> is not deliverable", address);
4615 log_write(0, LOG_MAIN, "VRFY failed for %s %s",
4616 smtp_cmd_argument, host_and_ident(TRUE));
4621 smtp_printf("%s\r\n", s);
4628 rc = acl_check(ACL_WHERE_EXPN, NULL, acl_smtp_expn, &user_msg, &log_msg);
4630 done = smtp_handle_acl_fail(ACL_WHERE_EXPN, rc, user_msg, log_msg);
4633 BOOL save_log_testing_mode = log_testing_mode;
4634 address_test_mode = log_testing_mode = TRUE;
4635 (void) verify_address(deliver_make_addr(smtp_cmd_data, FALSE),
4636 smtp_out, vopt_is_recipient | vopt_qualify | vopt_expn, -1, -1, -1,
4638 address_test_mode = FALSE;
4639 log_testing_mode = save_log_testing_mode; /* true for -bh */
4648 if (!tls_advertised)
4650 done = synprot_error(L_smtp_protocol_error, 503, NULL,
4651 US"STARTTLS command used when not advertised");
4655 /* Apply an ACL check if one is defined */
4657 if (acl_smtp_starttls != NULL)
4659 rc = acl_check(ACL_WHERE_STARTTLS, NULL, acl_smtp_starttls, &user_msg,
4663 done = smtp_handle_acl_fail(ACL_WHERE_STARTTLS, rc, user_msg, log_msg);
4668 /* RFC 2487 is not clear on when this command may be sent, though it
4669 does state that all information previously obtained from the client
4670 must be discarded if a TLS session is started. It seems reasonble to
4671 do an implied RSET when STARTTLS is received. */
4673 incomplete_transaction_log(US"STARTTLS");
4674 smtp_reset(reset_point);
4676 cmd_list[CMD_LIST_STARTTLS].is_mail_cmd = FALSE;
4678 /* There's an attack where more data is read in past the STARTTLS command
4679 before TLS is negotiated, then assumed to be part of the secure session
4680 when used afterwards; we use segregated input buffers, so are not
4681 vulnerable, but we want to note when it happens and, for sheer paranoia,
4682 ensure that the buffer is "wiped".
4683 Pipelining sync checks will normally have protected us too, unless disabled
4684 by configuration. */
4686 if (receive_smtp_buffered())
4689 debug_printf("Non-empty input buffer after STARTTLS; naive attack?");
4690 if (tls_in.active < 0)
4691 smtp_inend = smtp_inptr = smtp_inbuffer;
4692 /* and if TLS is already active, tls_server_start() should fail */
4695 /* There is nothing we value in the input buffer and if TLS is succesfully
4696 negotiated, we won't use this buffer again; if TLS fails, we'll just read
4697 fresh content into it. The buffer contains arbitrary content from an
4698 untrusted remote source; eg: NOOP <shellcode>\r\nSTARTTLS\r\n
4699 It seems safest to just wipe away the content rather than leave it as a
4700 target to jump to. */
4702 memset(smtp_inbuffer, 0, in_buffer_size);
4704 /* Attempt to start up a TLS session, and if successful, discard all
4705 knowledge that was obtained previously. At least, that's what the RFC says,
4706 and that's what happens by default. However, in order to work round YAEB,
4707 there is an option to remember the esmtp state. Sigh.
4709 We must allow for an extra EHLO command and an extra AUTH command after
4710 STARTTLS that don't add to the nonmail command count. */
4712 if ((rc = tls_server_start(tls_require_ciphers)) == OK)
4714 if (!tls_remember_esmtp)
4715 helo_seen = esmtp = auth_advertised = pipelining_advertised = FALSE;
4716 cmd_list[CMD_LIST_EHLO].is_mail_cmd = TRUE;
4717 cmd_list[CMD_LIST_AUTH].is_mail_cmd = TRUE;
4718 cmd_list[CMD_LIST_TLS_AUTH].is_mail_cmd = TRUE;
4719 if (sender_helo_name != NULL)
4721 store_free(sender_helo_name);
4722 sender_helo_name = NULL;
4723 host_build_sender_fullhost(); /* Rebuild */
4724 set_process_info("handling incoming TLS connection from %s",
4725 host_and_ident(FALSE));
4728 (sender_host_address ? protocols : protocols_local)
4730 ? pextend + (sender_host_authenticated ? pauthed : 0)
4732 + (tls_in.active >= 0 ? pcrpted : 0)
4735 sender_host_authenticated = NULL;
4736 authenticated_id = NULL;
4737 sync_cmd_limit = NON_SYNC_CMD_NON_PIPELINING;
4738 DEBUG(D_tls) debug_printf("TLS active\n");
4739 break; /* Successful STARTTLS */
4742 /* Some local configuration problem was discovered before actually trying
4743 to do a TLS handshake; give a temporary error. */
4745 else if (rc == DEFER)
4747 smtp_printf("454 TLS currently unavailable\r\n");
4751 /* Hard failure. Reject everything except QUIT or closed connection. One
4752 cause for failure is a nested STARTTLS, in which case tls_in.active remains
4753 set, but we must still reject all incoming commands. */
4755 DEBUG(D_tls) debug_printf("TLS failed to start\n");
4758 switch(smtp_read_command(FALSE))
4761 log_write(L_smtp_connection, LOG_MAIN, "%s closed by EOF",
4762 smtp_get_connection_info());
4763 smtp_notquit_exit(US"tls-failed", NULL, NULL);
4767 /* It is perhaps arguable as to which exit ACL should be called here,
4768 but as it is probably a situation that almost never arises, it
4769 probably doesn't matter. We choose to call the real QUIT ACL, which in
4770 some sense is perhaps "right". */
4774 if (acl_smtp_quit != NULL)
4776 rc = acl_check(ACL_WHERE_QUIT, NULL, acl_smtp_quit, &user_msg,
4779 log_write(0, LOG_MAIN|LOG_PANIC, "ACL for QUIT returned ERROR: %s",
4782 if (user_msg == NULL)
4783 smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
4785 smtp_respond(US"221", 3, TRUE, user_msg);
4786 log_write(L_smtp_connection, LOG_MAIN, "%s closed by QUIT",
4787 smtp_get_connection_info());
4792 smtp_printf("554 Security failure\r\n");
4796 tls_close(TRUE, TRUE);
4801 /* The ACL for QUIT is provided for gathering statistical information or
4802 similar; it does not affect the response code, but it can supply a custom
4807 incomplete_transaction_log(US"QUIT");
4808 if (acl_smtp_quit != NULL)
4810 rc = acl_check(ACL_WHERE_QUIT, NULL, acl_smtp_quit, &user_msg, &log_msg);
4812 log_write(0, LOG_MAIN|LOG_PANIC, "ACL for QUIT returned ERROR: %s",
4815 if (user_msg == NULL)
4816 smtp_printf("221 %s closing connection\r\n", smtp_active_hostname);
4818 smtp_respond(US"221", 3, TRUE, user_msg);
4821 tls_close(TRUE, TRUE);
4825 log_write(L_smtp_connection, LOG_MAIN, "%s closed by QUIT",
4826 smtp_get_connection_info());
4832 incomplete_transaction_log(US"RSET");
4833 smtp_reset(reset_point);
4835 smtp_printf("250 Reset OK\r\n");
4836 cmd_list[CMD_LIST_RSET].is_mail_cmd = FALSE;
4842 smtp_printf("250 OK\r\n");
4846 /* Show ETRN/EXPN/VRFY if there's an ACL for checking hosts; if actually
4847 used, a check will be done for permitted hosts. Show STARTTLS only if not
4848 already in a TLS session and if it would be advertised in the EHLO
4853 smtp_printf("214-Commands supported:\r\n");
4857 Ustrcat(buffer, " AUTH");
4859 if (tls_in.active < 0 &&
4860 verify_check_host(&tls_advertise_hosts) != FAIL)
4861 Ustrcat(buffer, " STARTTLS");
4863 Ustrcat(buffer, " HELO EHLO MAIL RCPT DATA");
4864 Ustrcat(buffer, " NOOP QUIT RSET HELP");
4865 if (acl_smtp_etrn != NULL) Ustrcat(buffer, " ETRN");
4866 if (acl_smtp_expn != NULL) Ustrcat(buffer, " EXPN");
4867 if (acl_smtp_vrfy != NULL) Ustrcat(buffer, " VRFY");
4868 smtp_printf("214%s\r\n", buffer);
4874 incomplete_transaction_log(US"connection lost");
4875 smtp_notquit_exit(US"connection-lost", US"421",
4876 US"%s lost input connection", smtp_active_hostname);
4878 /* Don't log by default unless in the middle of a message, as some mailers
4879 just drop the call rather than sending QUIT, and it clutters up the logs.
4882 if (sender_address != NULL || recipients_count > 0)
4883 log_write(L_lost_incoming_connection,
4885 "unexpected %s while reading SMTP command from %s%s",
4886 sender_host_unknown? "EOF" : "disconnection",
4887 host_and_ident(FALSE), smtp_read_error);
4889 else log_write(L_smtp_connection, LOG_MAIN, "%s lost%s",
4890 smtp_get_connection_info(), smtp_read_error);
4898 if (sender_address != NULL)
4900 done = synprot_error(L_smtp_protocol_error, 503, NULL,
4901 US"ETRN is not permitted inside a transaction");
4905 log_write(L_etrn, LOG_MAIN, "ETRN %s received from %s", smtp_cmd_argument,
4906 host_and_ident(FALSE));
4908 rc = acl_check(ACL_WHERE_ETRN, NULL, acl_smtp_etrn, &user_msg, &log_msg);
4911 done = smtp_handle_acl_fail(ACL_WHERE_ETRN, rc, user_msg, log_msg);
4915 /* Compute the serialization key for this command. */
4917 etrn_serialize_key = string_sprintf("etrn-%s\n", smtp_cmd_data);
4919 /* If a command has been specified for running as a result of ETRN, we
4920 permit any argument to ETRN. If not, only the # standard form is permitted,
4921 since that is strictly the only kind of ETRN that can be implemented
4922 according to the RFC. */
4924 if (smtp_etrn_command != NULL)
4928 etrn_command = smtp_etrn_command;
4929 deliver_domain = smtp_cmd_data;
4930 rc = transport_set_up_command(&argv, smtp_etrn_command, TRUE, 0, NULL,
4931 US"ETRN processing", &error);
4932 deliver_domain = NULL;
4935 log_write(0, LOG_MAIN|LOG_PANIC, "failed to set up ETRN command: %s",
4937 smtp_printf("458 Internal failure\r\n");
4942 /* Else set up to call Exim with the -R option. */
4946 if (*smtp_cmd_data++ != '#')
4948 done = synprot_error(L_smtp_syntax_error, 501, NULL,
4949 US"argument must begin with #");
4952 etrn_command = US"exim -R";
4953 argv = CUSS child_exec_exim(CEE_RETURN_ARGV, TRUE, NULL, TRUE, 2, US"-R",
4957 /* If we are host-testing, don't actually do anything. */
4963 debug_printf("ETRN command is: %s\n", etrn_command);
4964 debug_printf("ETRN command execution skipped\n");
4966 if (user_msg == NULL) smtp_printf("250 OK\r\n");
4967 else smtp_user_msg(US"250", user_msg);
4972 /* If ETRN queue runs are to be serialized, check the database to
4973 ensure one isn't already running. */
4975 if (smtp_etrn_serialize && !enq_start(etrn_serialize_key))
4977 smtp_printf("458 Already processing %s\r\n", smtp_cmd_data);
4981 /* Fork a child process and run the command. We don't want to have to
4982 wait for the process at any point, so set SIGCHLD to SIG_IGN before
4983 forking. It should be set that way anyway for external incoming SMTP,
4984 but we save and restore to be tidy. If serialization is required, we
4985 actually run the command in yet another process, so we can wait for it
4986 to complete and then remove the serialization lock. */
4988 oldsignal = signal(SIGCHLD, SIG_IGN);
4990 if ((pid = fork()) == 0)
4992 smtp_input = FALSE; /* This process is not associated with the */
4993 (void)fclose(smtp_in); /* SMTP call any more. */
4994 (void)fclose(smtp_out);
4996 signal(SIGCHLD, SIG_DFL); /* Want to catch child */
4998 /* If not serializing, do the exec right away. Otherwise, fork down
4999 into another process. */
5001 if (!smtp_etrn_serialize || (pid = fork()) == 0)
5003 DEBUG(D_exec) debug_print_argv(argv);
5004 exim_nullstd(); /* Ensure std{in,out,err} exist */
5005 execv(CS argv[0], (char *const *)argv);
5006 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "exec of \"%s\" (ETRN) failed: %s",
5007 etrn_command, strerror(errno));
5008 _exit(EXIT_FAILURE); /* paranoia */
5011 /* Obey this if smtp_serialize and the 2nd fork yielded non-zero. That
5012 is, we are in the first subprocess, after forking again. All we can do
5013 for a failing fork is to log it. Otherwise, wait for the 2nd process to
5014 complete, before removing the serialization. */
5017 log_write(0, LOG_MAIN|LOG_PANIC, "2nd fork for serialized ETRN "
5018 "failed: %s", strerror(errno));
5022 DEBUG(D_any) debug_printf("waiting for serialized ETRN process %d\n",
5024 (void)wait(&status);
5025 DEBUG(D_any) debug_printf("serialized ETRN process %d ended\n",
5029 enq_end(etrn_serialize_key);
5030 _exit(EXIT_SUCCESS);
5033 /* Back in the top level SMTP process. Check that we started a subprocess
5034 and restore the signal state. */
5038 log_write(0, LOG_MAIN|LOG_PANIC, "fork of process for ETRN failed: %s",
5040 smtp_printf("458 Unable to fork process\r\n");
5041 if (smtp_etrn_serialize) enq_end(etrn_serialize_key);
5045 if (user_msg == NULL) smtp_printf("250 OK\r\n");
5046 else smtp_user_msg(US"250", user_msg);
5049 signal(SIGCHLD, oldsignal);
5054 done = synprot_error(L_smtp_syntax_error, 501, NULL,
5055 US"unexpected argument data");
5059 /* This currently happens only for NULLs, but could be extended. */
5062 done = synprot_error(L_smtp_syntax_error, 0, NULL, /* Just logs */
5063 US"NULL character(s) present (shown as '?')");
5064 smtp_printf("501 NULL characters are not allowed in SMTP commands\r\n");
5070 if (smtp_inend >= smtp_inbuffer + in_buffer_size)
5071 smtp_inend = smtp_inbuffer + in_buffer_size - 1;
5072 c = smtp_inend - smtp_inptr;
5073 if (c > 150) c = 150;
5075 incomplete_transaction_log(US"sync failure");
5076 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP protocol synchronization error "
5077 "(next input sent too soon: pipelining was%s advertised): "
5078 "rejected \"%s\" %s next input=\"%s\"",
5079 pipelining_advertised? "" : " not",
5080 smtp_cmd_buffer, host_and_ident(TRUE),
5081 string_printing(smtp_inptr));
5082 smtp_notquit_exit(US"synchronization-error", US"554",
5083 US"SMTP synchronization error");
5084 done = 1; /* Pretend eof - drops connection */
5088 case TOO_MANY_NONMAIL_CMD:
5089 s = smtp_cmd_buffer;
5090 while (*s != 0 && !isspace(*s)) s++;
5091 incomplete_transaction_log(US"too many non-mail commands");
5092 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP call from %s dropped: too many "
5093 "nonmail commands (last was \"%.*s\")", host_and_ident(FALSE),
5094 (int)(s - smtp_cmd_buffer), smtp_cmd_buffer);
5095 smtp_notquit_exit(US"bad-commands", US"554", US"Too many nonmail commands");
5096 done = 1; /* Pretend eof - drops connection */
5099 #ifdef EXPERIMENTAL_PROXY
5100 case PROXY_FAIL_IGNORE_CMD:
5101 smtp_printf("503 Command refused, required Proxy negotiation failed\r\n");
5106 if (unknown_command_count++ >= smtp_max_unknown_commands)
5108 log_write(L_smtp_syntax_error, LOG_MAIN,
5109 "SMTP syntax error in \"%s\" %s %s",
5110 string_printing(smtp_cmd_buffer), host_and_ident(TRUE),
5111 US"unrecognized command");
5112 incomplete_transaction_log(US"unrecognized command");
5113 smtp_notquit_exit(US"bad-commands", US"500",
5114 US"Too many unrecognized commands");
5116 log_write(0, LOG_MAIN|LOG_REJECT, "SMTP call from %s dropped: too many "
5117 "unrecognized commands (last was \"%s\")", host_and_ident(FALSE),
5118 string_printing(smtp_cmd_buffer));
5121 done = synprot_error(L_smtp_syntax_error, 500, NULL,
5122 US"unrecognized command");
5126 /* This label is used by goto's inside loops that want to break out to
5127 the end of the command-processing loop. */
5130 last_was_rej_mail = was_rej_mail; /* Remember some last commands for */
5131 last_was_rcpt = was_rcpt; /* protocol error handling */
5135 return done - 2; /* Convert yield values */
5140 /* End of smtp_in.c */