1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 - 2021 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Functions concerned with verifying things. The original code for callout
10 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
14 #include "transports/smtp.h"
16 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
17 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
18 static smtp_context ctctx;
19 uschar ctbuffer[8192];
22 static uschar cutthrough_response(client_conn_ctx *, char, uschar **, int);
26 /*************************************************
27 * Retrieve a callout cache record *
28 *************************************************/
30 /* If a record exists, check whether it has expired.
33 dbm_file an open hints file
35 type "address" or "domain"
36 positive_expire expire time for positive records
37 negative_expire expire time for negative records
39 Returns: the cache record if a non-expired one exists, else NULL
42 static dbdata_callout_cache *
43 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
44 int positive_expire, int negative_expire)
49 dbdata_callout_cache *cache_record;
51 if (!(cache_record = dbfn_read_with_length(dbm_file, key, &length)))
53 HDEBUG(D_verify) debug_printf_indent("callout cache: no %s record found for %s\n", type, key);
57 /* We treat a record as "negative" if its result field is not positive, or if
58 it is a domain record and the postmaster field is negative. */
60 negative = cache_record->result != ccache_accept ||
61 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
62 expire = negative? negative_expire : positive_expire;
65 if (now - cache_record->time_stamp > expire)
67 HDEBUG(D_verify) debug_printf_indent("callout cache: %s record expired for %s\n", type, key);
71 /* If this is a non-reject domain record, check for the obsolete format version
72 that doesn't have the postmaster and random timestamps, by looking at the
73 length. If so, copy it to a new-style block, replicating the record's
74 timestamp. Then check the additional timestamps. (There's no point wasting
75 effort if connections are rejected.) */
77 if (type[0] == 'd' && cache_record->result != ccache_reject)
79 if (length == sizeof(dbdata_callout_cache_obs))
81 dbdata_callout_cache * new = store_get(sizeof(dbdata_callout_cache), GET_UNTAINTED);
82 memcpy(new, cache_record, length);
83 new->postmaster_stamp = new->random_stamp = new->time_stamp;
87 if (now - cache_record->postmaster_stamp > expire)
88 cache_record->postmaster_result = ccache_unknown;
90 if (now - cache_record->random_stamp > expire)
91 cache_record->random_result = ccache_unknown;
94 HDEBUG(D_verify) debug_printf_indent("callout cache: found %s record for %s\n", type, key);
100 /* Check the callout cache.
101 Options * pm_mailfrom may be modified by cache partial results.
103 Return: TRUE if result found
107 cached_callout_lookup(address_item * addr, uschar * address_key,
108 uschar * from_address, int * opt_ptr, uschar ** pm_ptr,
109 int * yield, uschar ** failure_ptr,
110 dbdata_callout_cache * new_domain_record, int * old_domain_res)
112 int options = *opt_ptr;
114 open_db *dbm_file = NULL;
116 /* Open the callout cache database, if it exists, for reading only at this
117 stage, unless caching has been disabled. */
119 if (options & vopt_callout_no_cache)
121 HDEBUG(D_verify) debug_printf_indent("callout cache: disabled by no_cache\n");
123 else if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
125 HDEBUG(D_verify) debug_printf_indent("callout cache: not available\n");
129 /* If a cache database is available see if we can avoid the need to do an
130 actual callout by making use of previously-obtained data. */
132 dbdata_callout_cache_address * cache_address_record;
133 dbdata_callout_cache * cache_record = get_callout_cache_record(dbm_file,
134 addr->domain, US"domain",
135 callout_cache_domain_positive_expire, callout_cache_domain_negative_expire);
137 /* If an unexpired cache record was found for this domain, see if the callout
138 process can be short-circuited. */
142 /* In most cases, if an early command (up to and including MAIL FROM:<>)
143 was rejected, there is no point carrying on. The callout fails. However, if
144 we are doing a recipient verification with use_sender or use_postmaster
145 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
146 will be using a non-empty sender. We have to remember this situation so as
147 not to disturb the cached domain value if this whole verification succeeds
148 (we don't want it turning into "accept"). */
150 *old_domain_res = cache_record->result;
152 if ( cache_record->result == ccache_reject
153 || *from_address == 0 && cache_record->result == ccache_reject_mfnull)
156 debug_printf_indent("callout cache: domain gave initial rejection, or "
157 "does not accept HELO or MAIL FROM:<>\n");
158 setflag(addr, af_verify_nsfail);
159 addr->user_message = US"(result of an earlier callout reused).";
161 *failure_ptr = US"mail";
162 dbfn_close(dbm_file);
166 /* If a previous check on a "random" local part was accepted, we assume
167 that the server does not do any checking on local parts. There is therefore
168 no point in doing the callout, because it will always be successful. If a
169 random check previously failed, arrange not to do it again, but preserve
170 the data in the new record. If a random check is required but hasn't been
171 done, skip the remaining cache processing. */
173 if (options & vopt_callout_random) switch(cache_record->random_result)
177 debug_printf_indent("callout cache: domain accepts random addresses\n");
178 *failure_ptr = US"random";
179 dbfn_close(dbm_file);
180 return TRUE; /* Default yield is OK */
184 debug_printf_indent("callout cache: domain rejects random addresses\n");
185 *opt_ptr = options & ~vopt_callout_random;
186 new_domain_record->random_result = ccache_reject;
187 new_domain_record->random_stamp = cache_record->random_stamp;
192 debug_printf_indent("callout cache: need to check random address handling "
193 "(not cached or cache expired)\n");
194 dbfn_close(dbm_file);
198 /* If a postmaster check is requested, but there was a previous failure,
199 there is again no point in carrying on. If a postmaster check is required,
200 but has not been done before, we are going to have to do a callout, so skip
201 remaining cache processing. */
205 if (cache_record->postmaster_result == ccache_reject)
207 setflag(addr, af_verify_pmfail);
209 debug_printf_indent("callout cache: domain does not accept "
210 "RCPT TO:<postmaster@domain>\n");
212 *failure_ptr = US"postmaster";
213 setflag(addr, af_verify_pmfail);
214 addr->user_message = US"(result of earlier verification reused).";
215 dbfn_close(dbm_file);
218 if (cache_record->postmaster_result == ccache_unknown)
221 debug_printf_indent("callout cache: need to check RCPT "
222 "TO:<postmaster@domain> (not cached or cache expired)\n");
223 dbfn_close(dbm_file);
227 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
228 postmaster check if the address itself has to be checked. Also ensure
229 that the value in the cache record is preserved (with its old timestamp).
232 HDEBUG(D_verify) debug_printf_indent("callout cache: domain accepts RCPT "
233 "TO:<postmaster@domain>\n");
235 new_domain_record->postmaster_result = ccache_accept;
236 new_domain_record->postmaster_stamp = cache_record->postmaster_stamp;
240 /* We can't give a result based on information about the domain. See if there
241 is an unexpired cache record for this specific address (combined with the
242 sender address if we are doing a recipient callout with a non-empty sender).
245 if (!(cache_address_record = (dbdata_callout_cache_address *)
246 get_callout_cache_record(dbm_file, address_key, US"address",
247 callout_cache_positive_expire, callout_cache_negative_expire)))
249 dbfn_close(dbm_file);
253 if (cache_address_record->result == ccache_accept)
256 debug_printf_indent("callout cache: address record is positive\n");
261 debug_printf_indent("callout cache: address record is negative\n");
262 addr->user_message = US"Previous (cached) callout verification failure";
263 *failure_ptr = US"recipient";
267 /* Close the cache database while we actually do the callout for real. */
269 dbfn_close(dbm_file);
276 /* Write results to callout cache
279 cache_callout_write(dbdata_callout_cache * dom_rec, const uschar * domain,
280 int done, dbdata_callout_cache_address * addr_rec, uschar * address_key)
283 open_db *dbm_file = NULL;
285 /* If we get here with done == TRUE, a successful callout happened, and yield
286 will be set OK or FAIL according to the response to the RCPT command.
287 Otherwise, we looped through the hosts but couldn't complete the business.
288 However, there may be domain-specific information to cache in both cases.
290 The value of the result field in the new_domain record is ccache_unknown if
291 there was an error before or with MAIL FROM:, and errno was not zero,
292 implying some kind of I/O error. We don't want to write the cache in that case.
293 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
295 if (dom_rec->result != ccache_unknown)
296 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
298 HDEBUG(D_verify) debug_printf_indent("callout cache: not available\n");
302 (void)dbfn_write(dbm_file, domain, dom_rec,
303 (int)sizeof(dbdata_callout_cache));
304 HDEBUG(D_verify) debug_printf_indent("wrote callout cache domain record for %s:\n"
305 " result=%d postmaster=%d random=%d\n",
308 dom_rec->postmaster_result,
309 dom_rec->random_result);
312 /* If a definite result was obtained for the callout, cache it unless caching
315 if (done && addr_rec->result != ccache_unknown)
318 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE);
321 HDEBUG(D_verify) debug_printf_indent("no callout cache available\n");
325 (void)dbfn_write(dbm_file, address_key, addr_rec,
326 (int)sizeof(dbdata_callout_cache_address));
327 HDEBUG(D_verify) debug_printf_indent("wrote %s callout cache address record for %s\n",
328 addr_rec->result == ccache_accept ? "positive" : "negative",
333 if (dbm_file) dbfn_close(dbm_file);
337 /* Cutthrough-multi. If the existing cached cutthrough connection matches
338 the one we would make for a subsequent recipient, use it. Send the RCPT TO
339 and check the result, nonpipelined as it may be wanted immediately for
340 recipient-verification.
342 It seems simpler to deal with this case separately from the main callout loop.
343 We will need to remember it has sent, or not, so that rcpt-acl tail code
344 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
346 Return: TRUE for a definitive result for the recipient
349 cutthrough_multi(address_item * addr, host_item * host_list,
350 transport_feedback * tf, int * yield)
354 if (addr->transport == cutthrough.addr.transport)
355 for (host_item * host = host_list; host; host = host->next)
356 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
359 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
362 deliver_host = host->name;
363 deliver_host_address = host->address;
364 deliver_host_port = host->port;
365 deliver_domain = addr->domain;
366 transport_name = addr->transport->name;
368 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
370 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
372 || !smtp_get_port(tf->port, addr, &port, US"callout")
374 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
377 smtp_port_for_connect(host, port);
379 if ( ( interface == cutthrough.interface
381 && cutthrough.interface
382 && Ustrcmp(interface, cutthrough.interface) == 0
384 && host->port == cutthrough.host.port
387 uschar * resp = NULL;
389 /* Match! Send the RCPT TO, set done from the response */
391 smtp_write_command(&ctctx, SCMD_FLUSH, "RCPT TO:<%.1000s>\r\n",
392 transport_rcpt_address(addr,
393 addr->transport->rcpt_include_affixes)) >= 0
394 && cutthrough_response(&cutthrough.cctx, '2', &resp,
395 CUTTHROUGH_DATA_TIMEOUT) == '2';
397 /* This would go horribly wrong if a callout fail was ignored by ACL.
398 We punt by abandoning cutthrough on a reject, like the
403 address_item * na = store_get(sizeof(address_item), GET_UNTAINTED);
404 *na = cutthrough.addr;
405 cutthrough.addr = *addr;
406 cutthrough.addr.host_used = &cutthrough.host;
407 cutthrough.addr.next = na;
413 cancel_cutthrough_connection(TRUE, US"recipient rejected");
414 if (!resp || errno == ETIMEDOUT)
416 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
421 Ustrcpy(resp, US"connection dropped");
424 string_sprintf("response to \"%s\" was: %s",
425 big_buffer, string_printing(resp));
428 string_sprintf("Callout verification failed:\n%s", resp);
430 /* Hard rejection ends the process */
432 if (resp[0] == '5') /* Address rejected */
440 break; /* host_list */
443 cancel_cutthrough_connection(TRUE, US"incompatible connection");
448 /*************************************************
449 * Do callout verification for an address *
450 *************************************************/
452 /* This function is called from verify_address() when the address has routed to
453 a host list, and a callout has been requested. Callouts are expensive; that is
454 why a cache is used to improve the efficiency.
457 addr the address that's been routed
458 host_list the list of hosts to try
459 tf the transport feedback block
461 ifstring "interface" option from transport, or NULL
462 portstring "port" option from transport, or NULL
463 protocolstring "protocol" option from transport, or NULL
464 callout the per-command callout timeout
465 callout_overall the overall callout timeout (if < 0 use 4*callout)
466 callout_connect the callout connection timeout (if < 0 use callout)
467 options the verification options - these bits are used:
468 vopt_is_recipient => this is a recipient address
469 vopt_callout_no_cache => don't use callout cache
470 vopt_callout_fullpm => if postmaster check, do full one
471 vopt_callout_random => do the "random" thing
472 vopt_callout_recipsender => use real sender for recipient
473 vopt_callout_recippmaster => use postmaster for recipient
474 vopt_callout_hold => lazy close connection
475 se_mailfrom MAIL FROM address for sender verify; NULL => ""
476 pm_mailfrom if non-NULL, do the postmaster check with this sender
478 Returns: OK/FAIL/DEFER
482 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
483 int callout, int callout_overall, int callout_connect, int options,
484 uschar *se_mailfrom, uschar *pm_mailfrom)
487 int old_domain_cache_result = ccache_accept;
490 uschar *from_address;
491 uschar *random_local_part = NULL;
492 const uschar *save_deliver_domain = deliver_domain;
493 uschar **failure_ptr = options & vopt_is_recipient
494 ? &recipient_verify_failure : &sender_verify_failure;
495 dbdata_callout_cache new_domain_record;
496 dbdata_callout_cache_address new_address_record;
497 time_t callout_start_time;
499 new_domain_record.result = ccache_unknown;
500 new_domain_record.postmaster_result = ccache_unknown;
501 new_domain_record.random_result = ccache_unknown;
503 memset(&new_address_record, 0, sizeof(new_address_record));
505 /* For a recipient callout, the key used for the address cache record must
506 include the sender address if we are using the real sender in the callout,
507 because that may influence the result of the callout. */
509 if (options & vopt_is_recipient)
510 if (options & vopt_callout_recipsender)
512 from_address = sender_address;
513 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
514 if (cutthrough.delivery) options |= vopt_callout_no_cache;
516 else if (options & vopt_callout_recippmaster)
518 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
519 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
520 qualify_domain_sender);
525 address_key = addr->address;
528 /* For a sender callout, we must adjust the key if the mailfrom address is not
533 from_address = se_mailfrom ? se_mailfrom : US"";
534 address_key = *from_address
535 ? string_sprintf("%s/<%s>", addr->address, from_address) : addr->address;
538 if (cached_callout_lookup(addr, address_key, from_address,
539 &options, &pm_mailfrom, &yield, failure_ptr,
540 &new_domain_record, &old_domain_cache_result))
542 cancel_cutthrough_connection(TRUE, US"cache-hit");
546 if (!addr->transport)
548 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
551 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
552 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
553 addr->transport->name, addr->transport->driver_name);
556 smtp_transport_options_block *ob =
557 (smtp_transport_options_block *)addr->transport->options_block;
558 smtp_context * sx = NULL;
560 /* The information wasn't available in the cache, so we have to do a real
561 callout and save the result in the cache for next time, unless no_cache is set,
562 or unless we have a previously cached negative random result. If we are to test
563 with a random local part, ensure that such a local part is available. If not,
564 log the fact, but carry on without randomising. */
566 if (options & vopt_callout_random && callout_random_local_part)
567 if (!(random_local_part = expand_string(callout_random_local_part)))
568 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
569 "callout_random_local_part: %s", expand_string_message);
571 /* Compile regex' used by client-side smtp */
575 /* Default the connect and overall callout timeouts if not set, and record the
576 time we are starting so that we can enforce it. */
578 if (callout_overall < 0) callout_overall = 4 * callout;
579 if (callout_connect < 0) callout_connect = callout;
580 callout_start_time = time(NULL);
582 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
583 output because a callout might take some time. When PIPELINING is active and
584 there are many recipients, the total time for doing lots of callouts can add up
585 and cause the client to time out. So in this case we forgo the PIPELINING
588 if (smtp_out && !f.disable_callout_flush) mac_smtp_fflush();
590 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
591 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
593 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
594 and we are holding a cutthrough conn open, we can just append the rcpt to
595 that conn for verification purposes (and later delivery also). Simplest
596 coding means skipping this whole loop and doing the append separately. */
598 /* Can we re-use an open cutthrough connection? */
599 if ( cutthrough.cctx.sock >= 0
600 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
601 == vopt_callout_recipsender
602 && !random_local_part
605 done = cutthrough_multi(addr, host_list, tf, &yield);
607 /* If we did not use a cached connection, make connections to the hosts
608 and do real callouts. The list of hosts is passed in as an argument. */
610 for (host_item * host = host_list; host && !done; host = host->next)
614 uschar * interface = NULL; /* Outgoing interface to use; NULL => any */
618 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
623 /* Check the overall callout timeout */
625 if (time(NULL) - callout_start_time >= callout_overall)
627 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
631 /* Set IPv4 or IPv6 */
633 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
635 /* Expand and interpret the interface and port strings. The latter will not
636 be used if there is a host-specific port (e.g. from a manualroute router).
637 This has to be delayed till now, because they may expand differently for
638 different hosts. If there's a failure, log it, but carry on with the
641 deliver_host = host->name;
642 deliver_host_address = host->address;
643 deliver_host_port = host->port;
644 deliver_domain = addr->domain;
645 transport_name = addr->transport->name;
647 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
649 || !smtp_get_port(tf->port, addr, &port, US"callout")
651 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
654 if (!sx) sx = store_get(sizeof(*sx), GET_TAINTED); /* tainted buffers */
655 memset(sx, 0, sizeof(*sx));
657 sx->addrlist = sx->first_addr = addr;
658 sx->conn_args.host = host;
659 sx->conn_args.host_af = host_af,
661 sx->conn_args.interface = interface;
662 sx->helo_data = tf->helo_data;
663 sx->conn_args.tblock = addr->transport;
666 tls_retry_connection:
667 /* Set the address state so that errors are recorded in it */
669 addr->transport_return = PENDING_DEFER;
670 ob->connect_timeout = callout_connect;
671 ob->command_timeout = callout;
673 /* Get the channel set up ready for a message (MAIL FROM being the next
674 SMTP command to send. If we tried TLS but it failed, try again without
677 yield = smtp_setup_conn(sx, FALSE);
680 && addr->basic_errno == ERRNO_TLSFAILURE
681 && ob->tls_tempfail_tryclear
682 && verify_check_given_host(CUSS &ob->hosts_require_tls, host) != OK
685 log_write(0, LOG_MAIN,
686 "%s: callout unencrypted to %s [%s] (not in hosts_require_tls)",
687 addr->message, host->name, host->address);
688 addr->transport_return = PENDING_DEFER;
689 yield = smtp_setup_conn(sx, TRUE);
694 errno = addr->basic_errno;
695 transport_name = NULL;
696 deliver_host = deliver_host_address = NULL;
697 deliver_domain = save_deliver_domain;
699 /* Failure to accept HELO is cached; this blocks the whole domain for all
700 senders. I/O errors and defer responses are not cached. */
702 if (yield == FAIL && (errno == 0 || errno == ERRNO_SMTPCLOSED))
704 setflag(addr, af_verify_nsfail);
705 new_domain_record.result = ccache_reject;
713 /* If we needed to authenticate, smtp_setup_conn() did that. Copy
714 the AUTH info for logging */
716 addr->authenticator = client_authenticator;
717 addr->auth_id = client_authenticated_id;
719 sx->from_addr = from_address;
720 sx->first_addr = sx->sync_addr = addr;
721 sx->ok = FALSE; /*XXX these 3 last might not be needed for verify? */
722 sx->send_rset = TRUE;
723 sx->completed_addr = FALSE;
725 new_domain_record.result = old_domain_cache_result == ccache_reject_mfnull
726 ? ccache_reject_mfnull : ccache_accept;
728 /* Do the random local part check first. Temporarily replace the recipient
729 with the "random" value */
731 if (random_local_part)
733 uschar * main_address = addr->address;
734 const uschar * rcpt_domain = addr->domain;
737 uschar * errstr = NULL;
738 if ( testflag(addr, af_utf8_downcvt)
739 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
743 addr->message = errstr;
744 errno = ERRNO_EXPANDFAIL;
745 setflag(addr, af_verify_nsfail);
747 rcpt_domain = US""; /*XXX errorhandling! */
751 /* This would be ok for 1st rcpt of a cutthrough (the case handled here;
752 subsequents are done in cutthrough_multi()), but no way to
753 handle a subsequent because of the RSET vaporising the MAIL FROM.
754 So refuse to support any. Most cutthrough use will not involve
755 random_local_part, so no loss. */
756 cancel_cutthrough_connection(TRUE, US"random-recipient");
758 addr->address = string_sprintf("%s@%.1000s",
759 random_local_part, rcpt_domain);
762 /* If accepted, we aren't going to do any further tests below.
763 Otherwise, cache a real negative response, and get back to the right
764 state to send RCPT. Unless there's some problem such as a dropped
765 connection, we expect to succeed, because the commands succeeded above.
766 However, some servers drop the connection after responding to an
767 invalid recipient, so on (any) error we drop and remake the connection.
768 XXX We don't care about that for postmaster_full. Should we?
770 XXX could we add another flag to the context, and have the common
771 code emit the RSET too? Even pipelined after the RCPT...
772 Then the main-verify call could use it if there's to be a subsequent
774 The sync_responses() would need to be taught about it and we'd
775 need another return code filtering out to here.
777 Avoid using a SIZE option on the MAIL for all random-rcpt checks.
780 sx->avoid_option = OPTION_SIZE;
782 /* Remember when we last did a random test */
783 new_domain_record.random_stamp = time(NULL);
785 if (smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0)
786 switch(addr->transport_return)
788 case PENDING_OK: /* random was accepted, unfortunately */
789 new_domain_record.random_result = ccache_accept;
790 yield = OK; /* Only usable verify result we can return */
792 *failure_ptr = US"random";
794 case FAIL: /* rejected: the preferred result */
795 new_domain_record.random_result = ccache_reject;
796 sx->avoid_option = 0;
798 /* Between each check, issue RSET, because some servers accept only
799 one recipient after MAIL FROM:<>.
800 XXX We don't care about that for postmaster_full. Should we? */
803 smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0 &&
804 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout)))
808 debug_printf_indent("problem after random/rset/mfrom; reopen conn\n");
809 random_local_part = NULL;
811 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
813 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
814 (void)close(sx->cctx.sock);
816 #ifndef DISABLE_EVENT
817 (void) event_raise(addr->transport->event_action,
818 US"tcp:close", NULL, NULL);
820 addr->address = main_address;
821 addr->transport_return = PENDING_DEFER;
822 sx->first_addr = sx->sync_addr = addr;
824 sx->send_rset = TRUE;
825 sx->completed_addr = FALSE;
826 goto tls_retry_connection;
827 case DEFER: /* 4xx response to random */
828 break; /* Just to be clear. ccache_unknown, !done. */
831 /* Re-setup for main verify, or for the error message when failing */
832 addr->address = main_address;
833 addr->transport_return = PENDING_DEFER;
834 sx->first_addr = sx->sync_addr = addr;
836 sx->send_rset = TRUE;
837 sx->completed_addr = FALSE;
842 /* Main verify. For rcpt-verify use SIZE if we know it and we're not cacheing;
843 for sndr-verify never use it. */
847 if (!(options & vopt_is_recipient && options & vopt_callout_no_cache))
848 sx->avoid_option = OPTION_SIZE;
851 switch(smtp_write_mail_and_rcpt_cmds(sx, &yield))
853 case 0: switch(addr->transport_return) /* ok so far */
855 case PENDING_OK: done = TRUE;
856 new_address_record.result = ccache_accept;
858 case FAIL: done = TRUE;
860 *failure_ptr = US"recipient";
861 new_address_record.result = ccache_reject;
867 case -1: /* MAIL response error */
868 *failure_ptr = US"mail";
869 if (errno == 0 && sx->buffer[0] == '5')
871 setflag(addr, af_verify_nsfail);
872 if (from_address[0] == 0)
873 new_domain_record.result = ccache_reject_mfnull;
876 /* non-MAIL read i/o error */
877 /* non-MAIL response timeout */
878 /* internal error; channel still usable */
879 default: break; /* transmit failed */
883 addr->auth_sndr = client_authenticated_sender;
885 deliver_host = deliver_host_address = NULL;
886 deliver_domain = save_deliver_domain;
888 /* Do postmaster check if requested; if a full check is required, we
889 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
891 if (done && pm_mailfrom)
893 /* Could possibly shift before main verify, just above, and be ok
894 for cutthrough. But no way to handle a subsequent rcpt, so just
896 cancel_cutthrough_connection(TRUE, US"postmaster verify");
897 HDEBUG(D_acl|D_v) debug_printf_indent("Cutthrough cancelled by presence of postmaster verify\n");
899 done = smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0
900 && smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout);
904 uschar * main_address = addr->address;
906 /*XXX oops, affixes */
907 addr->address = string_sprintf("postmaster@%.1000s", addr->domain);
908 addr->transport_return = PENDING_DEFER;
910 sx->from_addr = pm_mailfrom;
911 sx->first_addr = sx->sync_addr = addr;
913 sx->send_rset = TRUE;
914 sx->completed_addr = FALSE;
915 sx->avoid_option = OPTION_SIZE;
917 if( smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0
918 && addr->transport_return == PENDING_OK
922 done = (options & vopt_callout_fullpm) != 0
923 && smtp_write_command(sx, SCMD_FLUSH,
924 "RCPT TO:<postmaster>\r\n") >= 0
925 && smtp_read_response(sx, sx->buffer,
926 sizeof(sx->buffer), '2', callout);
928 /* Sort out the cache record */
930 new_domain_record.postmaster_stamp = time(NULL);
933 new_domain_record.postmaster_result = ccache_accept;
934 else if (errno == 0 && sx->buffer[0] == '5')
936 *failure_ptr = US"postmaster";
937 setflag(addr, af_verify_pmfail);
938 new_domain_record.postmaster_result = ccache_reject;
941 addr->address = main_address;
944 /* For any failure of the main check, other than a negative response, we just
945 close the connection and carry on. We can identify a negative response by the
946 fact that errno is zero. For I/O errors it will be non-zero
948 Set up different error texts for logging and for sending back to the caller
949 as an SMTP response. Log in all cases, using a one-line format. For sender
950 callouts, give a full response to the caller, but for recipient callouts,
951 don't give the IP address because this may be an internal host whose identity
952 is not to be widely broadcast. */
958 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
959 sx->send_quit = FALSE;
965 extern int acl_where; /* src/acl.c */
967 addr->message = US"response to \"EHLO\" did not include SMTPUTF8";
968 addr->user_message = acl_where == ACL_WHERE_RCPT
969 ? US"533 no support for internationalised mailbox name"
970 : US"550 mailbox unavailable";
977 sx->send_quit = FALSE;
981 if (*sx->buffer == 0) Ustrcpy(sx->buffer, US"connection dropped");
983 /*XXX test here is ugly; seem to have a split of responsibility for
984 building this message. Need to rationalise. Where is it done
985 before here, and when not?
986 Not == 5xx resp to MAIL on main-verify
988 if (!addr->message) addr->message =
989 string_sprintf("response to \"%s\" was: %s",
990 big_buffer, string_printing(sx->buffer));
992 /* RFC 5321 section 4.2: the text portion of the response may have only
993 HT, SP, Printable US-ASCII. Deal with awkward chars by cutting the
994 received message off before passing it onward. Newlines are ok; they
995 just become a multiline response (but wrapped in the error code we
998 for (uschar * s = sx->buffer;
999 *s && s < sx->buffer + sizeof(sx->buffer);
1003 if (c != '\t' && c != '\n' && (c < ' ' || c > '~'))
1005 if (s - sx->buffer < sizeof(sx->buffer) - 12)
1006 memcpy(s, "(truncated)", 12);
1012 addr->user_message = options & vopt_is_recipient
1013 ? string_sprintf("Callout verification failed:\n%s", sx->buffer)
1014 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1015 host->address, big_buffer, sx->buffer);
1017 /* Hard rejection ends the process */
1019 if (sx->buffer[0] == '5') /* Address rejected */
1027 /* End the SMTP conversation and close the connection. */
1029 /* Cutthrough - on a successful connect and recipient-verify with
1030 use-sender and we are 1st rcpt and have no cutthrough conn so far
1031 here is where we want to leave the conn open. Ditto for a lazy-close
1034 if (cutthrough.delivery)
1036 if (addr->transport->filter_command)
1038 cutthrough.delivery= FALSE;
1039 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
1041 #ifndef DISABLE_DKIM
1042 if (ob->dkim.dkim_domain)
1044 cutthrough.delivery= FALSE;
1045 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
1048 #ifdef EXPERIMENTAL_ARC
1051 cutthrough.delivery= FALSE;
1052 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of ARC signing\n");
1057 if ( (cutthrough.delivery || options & vopt_callout_hold)
1061 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1062 == vopt_callout_recipsender
1063 && !random_local_part
1065 && cutthrough.cctx.sock < 0
1069 HDEBUG(D_acl|D_v) debug_printf_indent("holding verify callout open for %s\n",
1071 ? "cutthrough delivery" : "potential further verifies and delivery");
1073 cutthrough.callout_hold_only = !cutthrough.delivery;
1074 cutthrough.is_tls = tls_out.active.sock >= 0;
1075 /* We assume no buffer in use in the outblock */
1076 cutthrough.cctx = sx->cctx;
1077 cutthrough.nrcpt = 1;
1078 cutthrough.transport = addr->transport->name;
1079 cutthrough.interface = interface;
1080 cutthrough.snd_port = sending_port;
1081 cutthrough.peer_options = smtp_peer_options;
1082 cutthrough.host = *host;
1084 int oldpool = store_pool;
1085 store_pool = POOL_PERM;
1086 cutthrough.snd_ip = string_copy(sending_ip_address);
1087 cutthrough.host.name = string_copy(host->name);
1088 cutthrough.host.address = string_copy(host->address);
1089 store_pool = oldpool;
1092 /* Save the address_item and parent chain for later logging */
1093 cutthrough.addr = *addr;
1094 cutthrough.addr.next = NULL;
1095 cutthrough.addr.host_used = &cutthrough.host;
1096 for (address_item * caddr = &cutthrough.addr, * parent = addr->parent;
1098 caddr = caddr->parent, parent = parent->parent)
1099 *(caddr->parent = store_get(sizeof(address_item), GET_UNTAINTED)) = *parent;
1101 ctctx.outblock.buffer = ctbuffer;
1102 ctctx.outblock.buffersize = sizeof(ctbuffer);
1103 ctctx.outblock.ptr = ctbuffer;
1104 /* ctctx.outblock.cmd_count = 0; ctctx.outblock.authenticating = FALSE; */
1105 ctctx.outblock.cctx = &cutthrough.cctx;
1109 /* Ensure no cutthrough on multiple verifies that were incompatible */
1110 if (options & vopt_callout_recipsender)
1111 cancel_cutthrough_connection(TRUE, US"not usable for cutthrough");
1113 if (smtp_write_command(sx, SCMD_FLUSH, "QUIT\r\n") != -1)
1114 /* Wait a short time for response, and discard it */
1115 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', 1);
1117 if (sx->cctx.sock >= 0)
1120 if (sx->cctx.tls_ctx)
1122 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1123 sx->cctx.tls_ctx = NULL;
1126 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1127 (void)close(sx->cctx.sock);
1129 smtp_debug_cmd_report();
1130 #ifndef DISABLE_EVENT
1131 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL, NULL);
1136 if (!done || yield != OK)
1137 addr->message = string_sprintf("%s [%s] : %s", host->name, host->address,
1139 } /* Loop through all hosts, while !done */
1142 /* If we get here with done == TRUE, a successful callout happened, and yield
1143 will be set OK or FAIL according to the response to the RCPT command.
1144 Otherwise, we looped through the hosts but couldn't complete the business.
1145 However, there may be domain-specific information to cache in both cases. */
1147 if (!(options & vopt_callout_no_cache))
1148 cache_callout_write(&new_domain_record, addr->domain,
1149 done, &new_address_record, address_key);
1151 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1152 temporary error. If there was only one host, and a response was received, leave
1153 it alone if supplying details. Otherwise, give a generic response. */
1157 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
1158 options & vopt_is_recipient ? "recipient" : "sender");
1161 addr->message = host_list->next || !addr->message
1162 ? dullmsg : string_sprintf("%s: %s", dullmsg, addr->message);
1164 addr->user_message = smtp_return_error_details
1165 ? string_sprintf("%s for <%s>.\n"
1166 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1167 "they may be permanently unreachable from this server. In the latter case,\n%s",
1168 dullmsg, addr->address,
1169 options & vopt_is_recipient
1170 ? "the address will never be accepted."
1171 : "you need to change the address or create an MX record for its domain\n"
1172 "if it is supposed to be generally accessible from the Internet.\n"
1173 "Talk to your mail administrator for details.")
1176 /* Force a specific error code */
1178 addr->basic_errno = ERRNO_CALLOUTDEFER;
1181 /* Come here from within the cache-reading code on fast-track exit. */
1184 tls_modify_variables(&tls_in); /* return variables to inbound values */
1190 /* Called after recipient-acl to get a cutthrough connection open when
1191 one was requested and a recipient-verify wasn't subsequently done.
1194 open_cutthrough_connection(address_item * addr)
1199 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1200 /* We must use a copy of the address for verification, because it might
1204 HDEBUG(D_acl) debug_printf_indent("----------- %s cutthrough setup ------------\n",
1205 rcpt_count > 1 ? "more" : "start");
1206 rc = verify_address(&addr2, NULL,
1207 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1208 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1210 addr->message = addr2.message;
1211 addr->user_message = addr2.user_message;
1212 HDEBUG(D_acl) debug_printf_indent("----------- end cutthrough setup ------------\n");
1218 /* Send given number of bytes from the buffer */
1220 cutthrough_send(int n)
1222 if(cutthrough.cctx.sock < 0)
1228 ? tls_write(cutthrough.cctx.tls_ctx, ctctx.outblock.buffer, n, FALSE)
1231 send(cutthrough.cctx.sock, ctctx.outblock.buffer, n, 0) > 0
1234 transport_count += n;
1235 ctctx.outblock.ptr= ctctx.outblock.buffer;
1239 HDEBUG(D_transport|D_acl) debug_printf_indent("cutthrough_send failed: %s\n", strerror(errno));
1246 _cutthrough_puts(uschar * cp, int n)
1250 if(ctctx.outblock.ptr >= ctctx.outblock.buffer+ctctx.outblock.buffersize)
1251 if(!cutthrough_send(ctctx.outblock.buffersize))
1254 *ctctx.outblock.ptr++ = *cp++;
1259 /* Buffered output of counted data block. Return boolean success */
1261 cutthrough_puts(uschar * cp, int n)
1263 if (cutthrough.cctx.sock < 0) return TRUE;
1264 if (_cutthrough_puts(cp, n)) return TRUE;
1265 cancel_cutthrough_connection(TRUE, US"transmit failed");
1270 cutthrough_data_puts(uschar * cp, int n)
1272 if (cutthrough.delivery) (void) cutthrough_puts(cp, n);
1278 _cutthrough_flush_send(void)
1280 int n = ctctx.outblock.ptr - ctctx.outblock.buffer;
1283 if(!cutthrough_send(n))
1289 /* Send out any bufferred output. Return boolean success. */
1291 cutthrough_flush_send(void)
1293 if (_cutthrough_flush_send()) return TRUE;
1294 cancel_cutthrough_connection(TRUE, US"transmit failed");
1300 cutthrough_put_nl(void)
1302 return cutthrough_puts(US"\r\n", 2);
1307 cutthrough_data_put_nl(void)
1309 cutthrough_data_puts(US"\r\n", 2);
1313 /* Get and check response from cutthrough target */
1315 cutthrough_response(client_conn_ctx * cctx, char expect, uschar ** copy, int timeout)
1317 smtp_context sx = {0};
1318 uschar inbuffer[4096];
1319 uschar responsebuffer[4096];
1321 sx.inblock.buffer = inbuffer;
1322 sx.inblock.buffersize = sizeof(inbuffer);
1323 sx.inblock.ptr = inbuffer;
1324 sx.inblock.ptrend = inbuffer;
1325 sx.inblock.cctx = cctx;
1326 if(!smtp_read_response(&sx, responsebuffer, sizeof(responsebuffer), expect, timeout))
1327 cancel_cutthrough_connection(TRUE, US"target timeout on read");
1332 *copy = cp = string_copy(responsebuffer);
1333 /* Trim the trailing end of line */
1334 cp += Ustrlen(responsebuffer);
1335 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1336 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1339 return responsebuffer[0];
1343 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1345 cutthrough_predata(void)
1347 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1350 smtp_debug_cmd(US"DATA", 0);
1351 cutthrough_puts(US"DATA\r\n", 6);
1352 cutthrough_flush_send();
1354 /* Assume nothing buffered. If it was it gets ignored. */
1355 return cutthrough_response(&cutthrough.cctx, '3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
1359 /* tctx arg only to match write_chunk() */
1361 cutthrough_write_chunk(transport_ctx * tctx, uschar * s, int len)
1364 while(s && (s2 = Ustrchr(s, '\n')))
1366 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1374 /* Buffered send of headers. Return success boolean. */
1375 /* Expands newlines to wire format (CR,NL). */
1376 /* Also sends header-terminating blank line. */
1378 cutthrough_headers_send(void)
1382 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1385 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1386 but having a separate buffered-output function (for now)
1388 HDEBUG(D_acl) debug_printf_indent("----------- start cutthrough headers send -----------\n");
1390 tctx.u.fd = cutthrough.cctx.sock;
1391 tctx.tblock = cutthrough.addr.transport;
1392 tctx.addr = &cutthrough.addr;
1393 tctx.check_string = US".";
1394 tctx.escape_string = US"..";
1395 /*XXX check under spool_files_wireformat. Might be irrelevant */
1396 tctx.options = topt_use_crlf;
1398 if (!transport_headers_send(&tctx, &cutthrough_write_chunk))
1401 HDEBUG(D_acl) debug_printf_indent("----------- done cutthrough headers send ------------\n");
1407 close_cutthrough_connection(const uschar * why)
1409 int fd = cutthrough.cctx.sock;
1412 /* We could be sending this after a bunch of data, but that is ok as
1413 the only way to cancel the transfer in dataphase is to drop the tcp
1414 conn before the final dot.
1416 client_conn_ctx tmp_ctx = cutthrough.cctx;
1417 ctctx.outblock.ptr = ctbuffer;
1418 smtp_debug_cmd(US"QUIT", 0);
1419 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1420 _cutthrough_flush_send();
1421 cutthrough.cctx.sock = -1; /* avoid recursion via read timeout */
1422 cutthrough.nrcpt = 0; /* permit re-cutthrough on subsequent message */
1424 /* Wait a short time for response, and discard it */
1425 cutthrough_response(&tmp_ctx, '2', NULL, 1);
1428 if (cutthrough.is_tls)
1430 tls_close(cutthrough.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1431 cutthrough.cctx.tls_ctx = NULL;
1432 cutthrough.is_tls = FALSE;
1435 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1437 smtp_debug_cmd_report();
1438 HDEBUG(D_acl) debug_printf_indent("----------- cutthrough shutdown (%s) ------------\n", why);
1440 ctctx.outblock.ptr = ctbuffer;
1444 cancel_cutthrough_connection(BOOL close_noncutthrough_verifies, const uschar * why)
1446 if (cutthrough.delivery || close_noncutthrough_verifies)
1447 close_cutthrough_connection(why);
1448 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1453 release_cutthrough_connection(const uschar * why)
1455 if (cutthrough.cctx.sock < 0) return;
1456 HDEBUG(D_acl) debug_printf_indent("release cutthrough conn: %s\n", why);
1457 cutthrough.cctx.sock = -1;
1458 cutthrough.cctx.tls_ctx = NULL;
1459 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1465 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1466 Log an OK response as a transmission.
1467 Close the connection.
1468 Return smtp response-class digit.
1471 cutthrough_finaldot(void)
1474 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> .\n");
1476 /* Assume data finshed with new-line */
1477 if( !cutthrough_puts(US".", 1)
1478 || !cutthrough_put_nl()
1479 || !cutthrough_flush_send()
1481 return cutthrough.addr.message;
1483 res = cutthrough_response(&cutthrough.cctx, '2', &cutthrough.addr.message,
1484 CUTTHROUGH_DATA_TIMEOUT);
1485 for (address_item * addr = &cutthrough.addr; addr; addr = addr->next)
1487 addr->message = cutthrough.addr.message;
1491 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1492 close_cutthrough_connection(US"delivered");
1496 delivery_log(LOG_MAIN, addr, 0,
1497 US"tmp-reject from cutthrough after DATA:");
1501 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1502 US"rejected after DATA:");
1509 return cutthrough.addr.message;
1514 /*************************************************
1515 * Copy error to toplevel address *
1516 *************************************************/
1518 /* This function is used when a verify fails or defers, to ensure that the
1519 failure or defer information is in the original toplevel address. This applies
1520 when an address is redirected to a single new address, and the failure or
1521 deferral happens to the child address.
1524 vaddr the verify address item
1525 addr the final address item
1528 Returns: the value of YIELD
1532 copy_error(address_item *vaddr, address_item *addr, int yield)
1536 vaddr->message = addr->message;
1537 vaddr->user_message = addr->user_message;
1538 vaddr->basic_errno = addr->basic_errno;
1539 vaddr->more_errno = addr->more_errno;
1540 vaddr->prop.address_data = addr->prop.address_data;
1541 vaddr->prop.variables = NULL;
1542 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
1543 copyflag(vaddr, addr, af_pass_message);
1551 /**************************************************
1552 * printf that automatically handles TLS if needed *
1553 ***************************************************/
1555 /* This function is used by verify_address() as a substitute for all fprintf()
1556 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1557 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1558 that assumes that we always use the smtp_out FILE* when not using TLS or the
1559 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1560 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1564 f the candidate FILE* to write to
1565 format format string
1566 ... optional arguments
1572 static void PRINTF_FUNCTION(2,3)
1573 respond_printf(FILE *f, const char *format, ...)
1577 va_start(ap, format);
1578 if (smtp_out && (f == smtp_out))
1579 smtp_vprintf(format, FALSE, ap);
1581 vfprintf(f, format, ap);
1587 /*************************************************
1588 * Verify an email address *
1589 *************************************************/
1591 /* This function is used both for verification (-bv and at other times) and
1592 address testing (-bt), which is indicated by address_test_mode being set.
1595 vaddr contains the address to verify; the next field in this block
1597 fp if not NULL, write the result to this file
1598 options various option bits:
1599 vopt_fake_sender => this sender verify is not for the real
1600 sender (it was verify=sender=xxxx or an address from a
1601 header line) - rewriting must not change sender_address
1602 vopt_is_recipient => this is a recipient address, otherwise
1603 it's a sender address - this affects qualification and
1604 rewriting and messages from callouts
1605 vopt_qualify => qualify an unqualified address; else error
1606 vopt_expn => called from SMTP EXPN command
1607 vopt_success_on_redirect => when a new address is generated
1608 the verification instantly succeeds
1610 These ones are used by do_callout() -- the options variable
1613 vopt_callout_fullpm => if postmaster check, do full one
1614 vopt_callout_no_cache => don't use callout cache
1615 vopt_callout_random => do the "random" thing
1616 vopt_callout_recipsender => use real sender for recipient
1617 vopt_callout_recippmaster => use postmaster for recipient
1619 callout if > 0, specifies that callout is required, and gives timeout
1620 for individual commands
1621 callout_overall if > 0, gives overall timeout for the callout function;
1622 if < 0, a default is used (see do_callout())
1623 callout_connect the connection timeout for callouts
1624 se_mailfrom when callout is requested to verify a sender, use this
1625 in MAIL FROM; NULL => ""
1626 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1627 thing and use this as the sender address (may be "")
1629 routed if not NULL, set TRUE if routing succeeded, so we can
1630 distinguish between routing failed and callout failed
1632 Returns: OK address verified
1633 FAIL address failed to verify
1634 DEFER can't tell at present
1638 verify_address(address_item * vaddr, FILE * fp, int options, int callout,
1639 int callout_overall, int callout_connect, uschar * se_mailfrom,
1640 uschar *pm_mailfrom, BOOL *routed)
1643 BOOL full_info = fp ? debug_selector != 0 : FALSE;
1644 BOOL expn = (options & vopt_expn) != 0;
1645 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1648 int verify_type = expn ? v_expn :
1649 f.address_test_mode ? v_none :
1650 options & vopt_is_recipient ? v_recipient : v_sender;
1651 address_item *addr_list;
1652 address_item *addr_new = NULL;
1653 address_item *addr_remote = NULL;
1654 address_item *addr_local = NULL;
1655 address_item *addr_succeed = NULL;
1656 uschar **failure_ptr = options & vopt_is_recipient
1657 ? &recipient_verify_failure : &sender_verify_failure;
1658 uschar *ko_prefix, *cr;
1659 uschar *address = vaddr->address;
1660 uschar *save_sender;
1661 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1663 /* Clear, just in case */
1665 *failure_ptr = NULL;
1667 /* Set up a prefix and suffix for error message which allow us to use the same
1668 output statements both in EXPN mode (where an SMTP response is needed) and when
1669 debugging with an output file. */
1673 ko_prefix = US"553 ";
1676 else ko_prefix = cr = US"";
1678 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1680 if (parse_find_at(address) == NULL)
1682 if (!(options & vopt_qualify))
1685 respond_printf(fp, "%sA domain is required for \"%s\"%s\n",
1686 ko_prefix, address, cr);
1687 *failure_ptr = US"qualify";
1690 /* deconst ok as address was not const */
1691 address = US rewrite_address_qualify(address, options & vopt_is_recipient);
1696 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1697 debug_printf("%s %s\n", f.address_test_mode? "Testing" : "Verifying", address);
1700 /* Rewrite and report on it. Clear the domain and local part caches - these
1701 may have been set by domains and local part tests during an ACL. */
1703 if (global_rewrite_rules)
1705 uschar *old = address;
1706 /* deconst ok as address was not const */
1707 address = US rewrite_address(address, options & vopt_is_recipient, FALSE,
1708 global_rewrite_rules, rewrite_existflags);
1711 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1712 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1713 if (fp && !expn) fprintf(fp, "Address rewritten as: %s\n", address);
1717 /* If this is the real sender address, we must update sender_address at
1718 this point, because it may be referred to in the routers. */
1720 if (!(options & (vopt_fake_sender|vopt_is_recipient)))
1721 sender_address = address;
1723 /* If the address was rewritten to <> no verification can be done, and we have
1724 to return OK. This rewriting is permitted only for sender addresses; for other
1725 addresses, such rewriting fails. */
1727 if (!address[0]) return OK;
1729 /* Flip the legacy TLS-related variables over to the outbound set in case
1730 they're used in the context of a transport used by verification. Reset them
1731 at exit from this routine (so no returns allowed from here on). */
1733 tls_modify_variables(&tls_out);
1735 /* Save a copy of the sender address for re-instating if we change it to <>
1736 while verifying a sender address (a nice bit of self-reference there). */
1738 save_sender = sender_address;
1740 /* Observability variable for router/transport use */
1742 verify_mode = options & vopt_is_recipient ? US"R" : US"S";
1744 /* Update the address structure with the possibly qualified and rewritten
1745 address. Set it up as the starting address on the chain of new addresses. */
1747 vaddr->address = address;
1750 /* We need a loop, because an address can generate new addresses. We must also
1751 cope with generated pipes and files at the top level. (See also the code and
1752 comment in deliver.c.) However, it is usually the case that the router for
1753 user's .forward files has its verify flag turned off.
1755 If an address generates more than one child, the loop is used only when
1756 full_info is set, and this can only be set locally. Remote enquiries just get
1757 information about the top level address, not anything that it generated. */
1762 address_item *addr = addr_new;
1764 addr_new = addr->next;
1769 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1770 debug_printf("Considering %s\n", addr->address);
1773 /* Handle generated pipe, file or reply addresses. We don't get these
1774 when handling EXPN, as it does only one level of expansion. */
1776 if (testflag(addr, af_pfr))
1783 if (addr->address[0] == '>')
1785 allow = testflag(addr, af_allow_reply);
1786 fprintf(fp, "%s -> mail %s", addr->parent->address, addr->address + 1);
1790 allow = addr->address[0] == '|'
1791 ? testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1792 fprintf(fp, "%s -> %s", addr->parent->address, addr->address);
1795 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1796 fprintf(fp, "\n*** Error in setting up pipe, file, or autoreply:\n"
1797 "%s\n", addr->message);
1799 fprintf(fp, "\n transport = %s\n", addr->transport->name);
1801 fprintf(fp, " *** forbidden ***\n");
1806 /* Just in case some router parameter refers to it. */
1808 return_path = addr->prop.errors_address
1809 ? addr->prop.errors_address : sender_address;
1811 /* Split the address into domain and local part, handling the %-hack if
1812 necessary, and then route it. While routing a sender address, set
1813 $sender_address to <> because that is what it will be if we were trying to
1814 send a bounce to the sender. */
1816 if (routed) *routed = FALSE;
1817 if ((rc = deliver_split_address(addr)) == OK)
1819 if (!(options & vopt_is_recipient)) sender_address = null_sender;
1820 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1821 &addr_succeed, verify_type);
1822 sender_address = save_sender; /* Put back the real sender */
1825 /* If routing an address succeeded, set the flag that remembers, for use when
1826 an ACL cached a sender verify (in case a callout fails). Then if routing set
1827 up a list of hosts or the transport has a host list, and the callout option
1828 is set, and we aren't in a host checking run, do the callout verification,
1829 and set another flag that notes that a callout happened. */
1833 BOOL local_verify = FALSE;
1835 if (routed) *routed = TRUE;
1838 transport_instance * tp;
1839 host_item * host_list = addr->host_list;
1841 /* Make up some data for use in the case where there is no remote
1844 transport_feedback tf = {
1845 .interface = NULL, /* interface (=> any) */
1847 .protocol = US"smtp",
1849 .helo_data = US"$smtp_active_hostname",
1850 .hosts_override = FALSE,
1851 .hosts_randomize = FALSE,
1852 .gethostbyname = FALSE,
1853 .qualify_single = TRUE,
1854 .search_parents = FALSE
1857 /* If verification yielded a remote transport, we want to use that
1858 transport's options, so as to mimic what would happen if we were really
1859 sending a message to this address. */
1861 if ((tp = addr->transport))
1862 if (!tp->info->local)
1864 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
1866 /* If the transport has hosts and the router does not, or if the
1867 transport is configured to override the router's hosts, we must build a
1868 host list of the transport's hosts, and find the IP addresses */
1870 if (tf.hosts && (!host_list || tf.hosts_override))
1873 const uschar *save_deliver_domain = deliver_domain;
1874 uschar *save_deliver_localpart = deliver_localpart;
1876 host_list = NULL; /* Ignore the router's hosts */
1878 deliver_domain = addr->domain;
1879 deliver_localpart = addr->local_part;
1880 s = expand_string(tf.hosts);
1881 deliver_domain = save_deliver_domain;
1882 deliver_localpart = save_deliver_localpart;
1886 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1887 "\"%s\" in %s transport for callout: %s", tf.hosts,
1888 tp->name, expand_string_message);
1893 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1895 /* Just ignore failures to find a host address. If we don't manage
1896 to find any addresses, the callout will defer. Note that more than
1897 one address may be found for a single host, which will result in
1898 additional host items being inserted into the chain. Hence we must
1899 save the next host first. */
1901 flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
1902 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1903 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1905 for (host_item * host = host_list, * nexthost; host; host = nexthost)
1907 nexthost = host->next;
1908 if (tf.gethostbyname ||
1909 string_is_ip_address(host->name, NULL) != 0)
1910 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
1913 const dnssec_domains * dsp = NULL;
1914 if (Ustrcmp(tp->driver_name, "smtp") == 0)
1916 smtp_transport_options_block * ob =
1917 (smtp_transport_options_block *) tp->options_block;
1921 (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1928 else if ( options & vopt_quota
1929 && Ustrcmp(tp->driver_name, "appendfile") == 0)
1930 local_verify = TRUE;
1932 /* Can only do a callout if we have at least one host! If the callout
1933 fails, it will have set ${sender,recipient}_verify_failure. */
1937 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1938 if (host_checking && !f.host_checking_callout)
1941 debug_printf("... callout omitted by default when host testing\n"
1942 "(Use -bhc if you want the callouts to happen.)\n");
1947 deliver_set_expansions(addr);
1949 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
1950 callout_connect, options, se_mailfrom, pm_mailfrom);
1952 deliver_set_expansions(NULL);
1956 else if (local_verify)
1958 HDEBUG(D_verify) debug_printf("Attempting quota verification\n");
1960 deliver_set_expansions(addr);
1961 deliver_local(addr, TRUE);
1962 rc = addr->transport_return;
1965 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
1966 "transport provided a host list, or transport is not smtp\n");
1970 /* Otherwise, any failure is a routing failure */
1972 else *failure_ptr = US"route";
1974 /* A router may return REROUTED if it has set up a child address as a result
1975 of a change of domain name (typically from widening). In this case we always
1976 want to continue to verify the new child. */
1978 if (rc == REROUTED) continue;
1980 /* Handle hard failures */
1987 address_item *p = addr->parent;
1989 respond_printf(fp, "%s%s %s", ko_prefix,
1990 full_info ? addr->address : address,
1991 f.address_test_mode ? "is undeliverable" : "failed to verify");
1992 if (!expn && f.admin_user)
1994 if (addr->basic_errno > 0)
1995 respond_printf(fp, ": %s", strerror(addr->basic_errno));
1997 respond_printf(fp, ": %s", addr->message);
2000 /* Show parents iff doing full info */
2002 if (full_info) while (p)
2004 respond_printf(fp, "%s\n <-- %s", cr, p->address);
2007 respond_printf(fp, "%s\n", cr);
2009 cancel_cutthrough_connection(TRUE, US"routing hard fail");
2013 yield = copy_error(vaddr, addr, FAIL);
2021 else if (rc == DEFER)
2026 address_item *p = addr->parent;
2027 respond_printf(fp, "%s%s cannot be resolved at this time", ko_prefix,
2028 full_info? addr->address : address);
2029 if (!expn && f.admin_user)
2031 if (addr->basic_errno > 0)
2032 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2034 respond_printf(fp, ": %s", addr->message);
2035 else if (addr->basic_errno <= 0)
2036 respond_printf(fp, ": unknown error");
2039 /* Show parents iff doing full info */
2041 if (full_info) while (p)
2043 respond_printf(fp, "%s\n <-- %s", cr, p->address);
2046 respond_printf(fp, "%s\n", cr);
2048 cancel_cutthrough_connection(TRUE, US"routing soft fail");
2052 yield = copy_error(vaddr, addr, DEFER);
2055 if (yield == OK) yield = DEFER;
2058 /* If we are handling EXPN, we do not want to continue to route beyond
2059 the top level (whose address is in "address"). */
2063 uschar *ok_prefix = US"250-";
2066 if (!addr_local && !addr_remote)
2067 respond_printf(fp, "250 mail to <%s> is discarded\r\n", address);
2069 respond_printf(fp, "250 <%s>\r\n", address);
2073 address_item *addr2 = addr_new;
2074 addr_new = addr2->next;
2075 if (!addr_new) ok_prefix = US"250 ";
2076 respond_printf(fp, "%s<%s>\r\n", ok_prefix, addr2->address);
2082 /* Successful routing other than EXPN. */
2086 /* Handle successful routing when short info wanted. Otherwise continue for
2087 other (generated) addresses. Short info is the operational case. Full info
2088 can be requested only when debug_selector != 0 and a file is supplied.
2090 There is a conflict between the use of aliasing as an alternate email
2091 address, and as a sort of mailing list. If an alias turns the incoming
2092 address into just one address (e.g. J.Caesar->jc44) you may well want to
2093 carry on verifying the generated address to ensure it is valid when
2094 checking incoming mail. If aliasing generates multiple addresses, you
2095 probably don't want to do this. Exim therefore treats the generation of
2096 just a single new address as a special case, and continues on to verify the
2097 generated address. */
2099 if ( !full_info /* Stop if short info wanted AND */
2100 && ( ( !addr_new /* No new address OR */
2101 || addr_new->next /* More than one new address OR */
2102 || testflag(addr_new, af_pfr) /* New address is pfr */
2105 ( addr_new /* At least one new address AND */
2106 && success_on_redirect /* success_on_redirect is set */
2110 if (fp) fprintf(fp, "%s %s\n",
2111 address, f.address_test_mode ? "is deliverable" : "verified");
2113 /* If we have carried on to verify a child address, we want the value
2114 of $address_data to be that of the child */
2116 vaddr->prop.address_data = addr->prop.address_data;
2117 vaddr->prop.variables = NULL;
2118 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
2120 /* If stopped because more than one new address, cannot cutthrough */
2122 if (addr_new && addr_new->next)
2123 cancel_cutthrough_connection(TRUE, US"multiple addresses from routing");
2129 } /* Loop for generated addresses */
2131 /* Display the full results of the successful routing, including any generated
2132 addresses. Control gets here only when full_info is set, which requires fp not
2133 to be NULL, and this occurs only when a top-level verify is called with the
2134 debugging switch on.
2136 If there are no local and no remote addresses, and there were no pipes, files,
2137 or autoreplies, and there were no errors or deferments, the message is to be
2138 discarded, usually because of the use of :blackhole: in an alias file. */
2140 if (allok && !addr_local && !addr_remote)
2142 fprintf(fp, "mail to %s is discarded\n", address);
2146 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2149 address_item *addr = addr_list;
2150 transport_instance * tp = addr->transport;
2152 addr_list = addr->next;
2154 fprintf(fp, "%s", CS addr->address);
2156 /* If the address is a duplicate, show something about it. */
2158 if (!testflag(addr, af_pfr))
2161 if ((tnode = tree_search(tree_duplicates, addr->unique)))
2162 fprintf(fp, " [duplicate, would not be delivered]");
2163 else tree_add_duplicate(addr->unique, addr);
2166 /* Now show its parents */
2168 for (address_item * p = addr->parent; p; p = p->parent)
2169 fprintf(fp, "\n <-- %s", p->address);
2172 /* Show router, and transport */
2174 fprintf(fp, "router = %s, transport = %s\n",
2175 addr->router->name, tp ? tp->name : US"unset");
2177 /* Show any hosts that are set up by a router unless the transport
2178 is going to override them; fiddle a bit to get a nice format. */
2180 if (addr->host_list && tp && !tp->overrides_hosts)
2184 for (host_item * h = addr->host_list; h; h = h->next)
2185 { /* get max lengths of host names, addrs */
2186 int len = Ustrlen(h->name);
2187 if (len > maxlen) maxlen = len;
2188 len = h->address ? Ustrlen(h->address) : 7;
2189 if (len > maxaddlen) maxaddlen = len;
2191 for (host_item * h = addr->host_list; h; h = h->next)
2193 fprintf(fp, " host %-*s ", maxlen, h->name);
2196 fprintf(fp, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2197 else if (tp->info->local)
2198 fprintf(fp, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2200 fprintf(fp, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2202 if (h->mx >= 0) fprintf(fp, " MX=%d", h->mx);
2203 if (h->port != PORT_NONE) fprintf(fp, " port=%d", h->port);
2204 if (f.running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", fp);
2205 if (h->status == hstatus_unusable) fputs(" ** unusable **", fp);
2211 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2212 the -bv or -bt case). */
2216 tls_modify_variables(&tls_in); /* return variables to inbound values */
2224 /*************************************************
2225 * Check headers for syntax errors *
2226 *************************************************/
2228 /* This function checks those header lines that contain addresses, and verifies
2229 that all the addresses therein are 5322-syntactially correct.
2232 msgptr where to put an error message
2239 verify_check_headers(uschar **msgptr)
2244 for (header_line * h = header_list; h && yield == OK; h = h->next)
2246 if (h->type != htype_from &&
2247 h->type != htype_reply_to &&
2248 h->type != htype_sender &&
2249 h->type != htype_to &&
2250 h->type != htype_cc &&
2251 h->type != htype_bcc)
2254 colon = Ustrchr(h->text, ':');
2256 Uskip_whitespace(&s);
2258 /* Loop for multiple addresses in the header, enabling group syntax. Note
2259 that we have to reset this after the header has been scanned. */
2261 f.parse_allow_group = TRUE;
2265 uschar *ss = parse_find_address_end(s, FALSE);
2266 uschar *recipient, *errmess;
2267 int terminator = *ss;
2268 int start, end, domain;
2270 /* Temporarily terminate the string at this point, and extract the
2271 operative address within, allowing group syntax. */
2274 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2277 /* Permit an unqualified address only if the message is local, or if the
2278 sending host is configured to be permitted to send them. */
2280 if (recipient && !domain)
2282 if (h->type == htype_from || h->type == htype_sender)
2284 if (!f.allow_unqualified_sender) recipient = NULL;
2288 if (!f.allow_unqualified_recipient) recipient = NULL;
2290 if (!recipient) errmess = US"unqualified address not permitted";
2293 /* It's an error if no address could be extracted, except for the special
2294 case of an empty address. */
2296 if (!recipient && Ustrcmp(errmess, "empty address") != 0)
2298 uschar *verb = US"is";
2303 /* Arrange not to include any white space at the end in the
2304 error message or the header name. */
2306 while (t > s && isspace(t[-1])) t--;
2307 while (tt > h->text && isspace(tt[-1])) tt--;
2309 /* Add the address that failed to the error message, since in a
2310 header with very many addresses it is sometimes hard to spot
2311 which one is at fault. However, limit the amount of address to
2312 quote - cases have been seen where, for example, a missing double
2313 quote in a humungous To: header creates an "address" that is longer
2314 than string_sprintf can handle. */
2323 /* deconst cast ok as we're passing a non-const to string_printing() */
2324 *msgptr = US string_printing(
2325 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2326 errmess, (int)(tt - h->text), h->text, verb, len, s));
2329 break; /* Out of address loop */
2332 /* Advance to the next address */
2334 s = ss + (terminator ? 1 : 0);
2335 Uskip_whitespace(&s);
2336 } /* Next address */
2338 f.parse_allow_group = FALSE;
2339 f.parse_found_group = FALSE;
2340 } /* Next header unless yield has been set FALSE */
2346 /*************************************************
2347 * Check header names for 8-bit characters *
2348 *************************************************/
2350 /* This function checks for invalid characters in header names. See
2351 RFC 5322, 2.2. and RFC 6532, 3.
2354 msgptr where to put an error message
2361 verify_check_header_names_ascii(uschar **msgptr)
2365 for (header_line * h = header_list; h; h = h->next)
2367 colon = Ustrchr(h->text, ':');
2368 for(uschar * s = h->text; s < colon; s++)
2369 if ((*s < 33) || (*s > 126))
2371 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2372 (int)(colon - h->text), h->text);
2379 /*************************************************
2380 * Check for blind recipients *
2381 *************************************************/
2383 /* This function checks that every (envelope) recipient is mentioned in either
2384 the To: or Cc: header lines, thus detecting blind carbon copies.
2386 There are two ways of scanning that could be used: either scan the header lines
2387 and tick off the recipients, or scan the recipients and check the header lines.
2388 The original proposed patch did the former, but I have chosen to do the latter,
2389 because (a) it requires no memory and (b) will use fewer resources when there
2390 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2392 Arguments: case_sensitive true if case sensitive matching should be used
2393 Returns: OK if there are no blind recipients
2394 FAIL if there is at least one blind recipient
2398 verify_check_notblind(BOOL case_sensitive)
2400 for (int i = 0; i < recipients_count; i++)
2403 uschar *address = recipients_list[i].address;
2405 for (header_line * h = header_list; !found && h; h = h->next)
2409 if (h->type != htype_to && h->type != htype_cc) continue;
2411 colon = Ustrchr(h->text, ':');
2413 Uskip_whitespace(&s);
2415 /* Loop for multiple addresses in the header, enabling group syntax. Note
2416 that we have to reset this after the header has been scanned. */
2418 f.parse_allow_group = TRUE;
2422 uschar * ss = parse_find_address_end(s, FALSE);
2423 uschar * recipient, * errmess;
2424 int terminator = *ss;
2425 int start, end, domain;
2427 /* Temporarily terminate the string at this point, and extract the
2428 operative address within, allowing group syntax. */
2431 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2434 /* If we found a valid recipient that has a domain, compare it with the
2435 envelope recipient. Local parts are compared with case-sensitivity
2436 according to the routine arg, domains case-insensitively.
2437 By comparing from the start with length "domain", we include the "@" at
2438 the end, which ensures that we are comparing the whole local part of each
2441 if (recipient && domain != 0)
2442 if ((found = (case_sensitive
2443 ? Ustrncmp(recipient, address, domain) == 0
2444 : strncmpic(recipient, address, domain) == 0)
2445 && strcmpic(recipient + domain, address + domain) == 0))
2448 /* Advance to the next address */
2450 s = ss + (terminator ? 1:0);
2451 Uskip_whitespace(&s);
2452 } /* Next address */
2454 f.parse_allow_group = FALSE;
2455 f.parse_found_group = FALSE;
2456 } /* Next header (if found is false) */
2458 if (!found) return FAIL;
2459 } /* Next recipient */
2466 /*************************************************
2467 * Find if verified sender *
2468 *************************************************/
2470 /* Usually, just a single address is verified as the sender of the message.
2471 However, Exim can be made to verify other addresses as well (often related in
2472 some way), and this is useful in some environments. There may therefore be a
2473 chain of such addresses that have previously been tested. This function finds
2474 whether a given address is on the chain.
2476 Arguments: the address to be verified
2477 Returns: pointer to an address item, or NULL
2481 verify_checked_sender(uschar *sender)
2483 for (address_item * addr = sender_verified_list; addr; addr = addr->next)
2484 if (Ustrcmp(sender, addr->address) == 0) return addr;
2492 /*************************************************
2493 * Get valid header address *
2494 *************************************************/
2496 /* Scan the originator headers of the message, looking for an address that
2497 verifies successfully. RFC 822 says:
2499 o The "Sender" field mailbox should be sent notices of
2500 any problems in transport or delivery of the original
2501 messages. If there is no "Sender" field, then the
2502 "From" field mailbox should be used.
2504 o If the "Reply-To" field exists, then the reply should
2505 go to the addresses indicated in that field and not to
2506 the address(es) indicated in the "From" field.
2508 So we check a Sender field if there is one, else a Reply_to field, else a From
2509 field. As some strange messages may have more than one of these fields,
2510 especially if they are resent- fields, check all of them if there is more than
2514 user_msgptr points to where to put a user error message
2515 log_msgptr points to where to put a log error message
2516 callout timeout for callout check (passed to verify_address())
2517 callout_overall overall callout timeout (ditto)
2518 callout_connect connect callout timeout (ditto)
2519 se_mailfrom mailfrom for verify; NULL => ""
2520 pm_mailfrom sender for pm callout check (passed to verify_address())
2521 options callout options (passed to verify_address())
2522 verrno where to put the address basic_errno
2524 If log_msgptr is set to something without setting user_msgptr, the caller
2525 normally uses log_msgptr for both things.
2527 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2528 FAIL is given if no appropriate headers are found
2532 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2533 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2534 uschar *pm_mailfrom, int options, int *verrno)
2536 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2540 for (int i = 0; i < 3 && !done; i++)
2541 for (header_line * h = header_list; h != NULL && !done; h = h->next)
2543 int terminator, new_ok;
2544 uschar *s, *ss, *endname;
2546 if (h->type != header_types[i]) continue;
2547 s = endname = Ustrchr(h->text, ':') + 1;
2549 /* Scan the addresses in the header, enabling group syntax. Note that we
2550 have to reset this after the header has been scanned. */
2552 f.parse_allow_group = TRUE;
2556 address_item *vaddr;
2558 while (isspace(*s) || *s == ',') s++;
2559 if (*s == 0) break; /* End of header */
2561 ss = parse_find_address_end(s, FALSE);
2563 /* The terminator is a comma or end of header, but there may be white
2564 space preceding it (including newline for the last address). Move back
2565 past any white space so we can check against any cached envelope sender
2566 address verifications. */
2568 while (isspace(ss[-1])) ss--;
2572 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2573 (int)(endname - h->text), h->text, s);
2575 /* See if we have already verified this address as an envelope sender,
2576 and if so, use the previous answer. */
2578 vaddr = verify_checked_sender(s);
2580 if (vaddr != NULL && /* Previously checked */
2581 (callout <= 0 || /* No callout needed; OR */
2582 vaddr->special_action > 256)) /* Callout was done */
2584 new_ok = vaddr->special_action & 255;
2585 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2586 *ss = terminator; /* Restore shortened string */
2589 /* Otherwise we run the verification now. We must restore the shortened
2590 string before running the verification, so the headers are correct, in
2591 case there is any rewriting. */
2595 int start, end, domain;
2596 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2601 /* If we found an empty address, just carry on with the next one, but
2602 kill the message. */
2604 if (!address && Ustrcmp(*log_msgptr, "empty address") == 0)
2611 /* If verification failed because of a syntax error, fail this
2612 function, and ensure that the failing address gets added to the error
2618 while (ss > s && isspace(ss[-1])) ss--;
2619 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2620 "scanning for sender: %s in \"%.*s\"",
2621 (int)(endname - h->text), h->text, *log_msgptr, (int)(ss - s), s);
2627 /* Else go ahead with the sender verification. But it isn't *the*
2628 sender of the message, so set vopt_fake_sender to stop sender_address
2629 being replaced after rewriting or qualification. */
2633 vaddr = deliver_make_addr(address, FALSE);
2634 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2635 callout, callout_overall, callout_connect, se_mailfrom,
2640 /* We now have the result, either newly found, or cached. If we are
2641 giving out error details, set a specific user error. This means that the
2642 last of these will be returned to the user if all three fail. We do not
2643 set a log message - the generic one below will be used. */
2647 *verrno = vaddr->basic_errno;
2648 if (smtp_return_error_details)
2649 *user_msgptr = string_sprintf("Rejected after DATA: "
2650 "could not verify \"%.*s\" header address\n%s: %s",
2651 (int)(endname - h->text), h->text, vaddr->address, vaddr->message);
2654 /* Success or defer */
2663 if (new_ok == DEFER) yield = DEFER;
2665 /* Move on to any more addresses in the header */
2668 } /* Next address */
2670 f.parse_allow_group = FALSE;
2671 f.parse_found_group = FALSE;
2672 } /* Next header, unless done */
2673 /* Next header type unless done */
2675 if (yield == FAIL && *log_msgptr == NULL)
2676 *log_msgptr = US"there is no valid sender in any header line";
2678 if (yield == DEFER && *log_msgptr == NULL)
2679 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2687 /*************************************************
2688 * Get RFC 1413 identification *
2689 *************************************************/
2691 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2692 the timeout is set to zero, then the query is not done. There may also be lists
2693 of hosts and nets which are exempt. To guard against malefactors sending
2694 non-printing characters which could, for example, disrupt a message's headers,
2695 make sure the string consists of printing characters only.
2698 port the port to connect to; usually this is IDENT_PORT (113), but when
2699 running in the test harness with -bh a different value is used.
2703 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2707 verify_get_ident(int port)
2709 client_conn_ctx ident_conn_ctx = {0};
2711 int received_sender_port, received_interface_port, n;
2714 uschar buffer[2048];
2716 /* Default is no ident. Check whether we want to do an ident check for this
2719 sender_ident = NULL;
2720 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2723 DEBUG(D_ident) debug_printf("doing ident callback\n");
2725 /* Set up a connection to the ident port of the remote host. Bind the local end
2726 to the incoming interface address. If the sender host address is an IPv6
2727 address, the incoming interface address will also be IPv6. */
2729 host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
2730 if ((ident_conn_ctx.sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
2732 if (ip_bind(ident_conn_ctx.sock, host_af, interface_address, 0) < 0)
2734 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2739 /* Construct and send the query. */
2741 qlen = snprintf(CS buffer, sizeof(buffer), "%d , %d\r\n",
2742 sender_host_port, interface_port);
2743 early_data.data = buffer;
2744 early_data.len = qlen;
2746 /*XXX we trust that the query is idempotent */
2747 if (ip_connect(ident_conn_ctx.sock, host_af, sender_host_address, port,
2748 rfc1413_query_timeout, &early_data) < 0)
2750 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
2751 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2752 sender_host_address);
2754 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2755 sender_host_address, strerror(errno));
2759 /* Read a response line. We put it into the rest of the buffer, using several
2760 recv() calls if necessary. */
2768 int size = sizeof(buffer) - (p - buffer);
2770 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2771 count = ip_recv(&ident_conn_ctx, p, size, time(NULL) + rfc1413_query_timeout);
2772 if (count <= 0) goto END_OFF; /* Read error or EOF */
2774 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2775 generous, and accept a plain \n terminator as well. The only illegal
2778 for (pp = p; pp < p + count; pp++)
2780 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2783 if (pp[-1] == '\r') pp--;
2785 goto GOT_DATA; /* Break out of both loops */
2789 /* Reached the end of the data without finding \n. Let the loop continue to
2790 read some more, if there is room. */
2797 /* We have received a line of data. Check it carefully. It must start with the
2798 same two port numbers that we sent, followed by data as defined by the RFC. For
2801 12345 , 25 : USERID : UNIX :root
2803 However, the amount of white space may be different to what we sent. In the
2804 "osname" field there may be several sub-fields, comma separated. The data we
2805 actually want to save follows the third colon. Some systems put leading spaces
2806 in it - we discard those. */
2808 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2809 &received_interface_port, &n) != 2 ||
2810 received_sender_port != sender_host_port ||
2811 received_interface_port != interface_port)
2814 p = buffer + qlen + n;
2815 while(isspace(*p)) p++;
2816 if (*p++ != ':') goto END_OFF;
2817 while(isspace(*p)) p++;
2818 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2820 while(isspace(*p)) p++;
2821 if (*p++ != ':') goto END_OFF;
2822 while (*p != 0 && *p != ':') p++;
2823 if (*p++ == 0) goto END_OFF;
2824 while(isspace(*p)) p++;
2825 if (*p == 0) goto END_OFF;
2827 /* The rest of the line is the data we want. We turn it into printing
2828 characters when we save it, so that it cannot mess up the format of any logging
2829 or Received: lines into which it gets inserted. We keep a maximum of 127
2830 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
2832 sender_ident = US string_printing(string_copyn(p, 127));
2833 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2836 (void)close(ident_conn_ctx.sock);
2843 /*************************************************
2844 * Match host to a single host-list item *
2845 *************************************************/
2847 /* This function compares a host (name or address) against a single item
2848 from a host list. The host name gets looked up if it is needed and is not
2849 already known. The function is called from verify_check_this_host() via
2850 match_check_list(), which is why most of its arguments are in a single block.
2853 arg the argument block (see below)
2854 ss the host-list item
2855 valueptr where to pass back looked up data, or NULL
2856 error for error message when returning ERROR
2859 host_name (a) the host name, or
2860 (b) NULL, implying use sender_host_name and
2861 sender_host_aliases, looking them up if required, or
2862 (c) the empty string, meaning that only IP address matches
2864 host_address the host address
2865 host_ipv4 the IPv4 address taken from an IPv6 one
2869 DEFER lookup deferred
2870 ERROR (a) failed to find the host name or IP address, or
2871 (b) unknown lookup type specified, or
2872 (c) host name encountered when only IP addresses are
2877 check_host(void * arg, const uschar * ss, const uschar ** valueptr, uschar ** error)
2879 check_host_block * cb = (check_host_block *)arg;
2882 BOOL iplookup = FALSE, isquery = FALSE;
2883 BOOL isiponly = cb->host_name && !cb->host_name[0];
2885 uschar * semicolon, * endname, * opts;
2888 /* Optimize for the special case when the pattern is "*". */
2890 if (*ss == '*' && !ss[1]) return OK;
2892 /* If the pattern is empty, it matches only in the case when there is no host -
2893 this can occur in ACL checking for SMTP input using the -bs option. In this
2894 situation, the host address is the empty string. */
2896 if (!cb->host_address[0]) return *ss ? FAIL : OK;
2897 if (!*ss) return FAIL;
2899 /* If the pattern is precisely "@" then match against the primary host name,
2900 provided that host name matching is permitted; if it's "@[]" match against the
2901 local host's IP addresses. */
2906 if (isiponly) return ERROR;
2907 ss = primary_hostname;
2909 else if (Ustrcmp(ss, "@[]") == 0)
2911 for (ip_address_item * ip = host_find_interfaces(); ip; ip = ip->next)
2912 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2916 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2917 a (possibly masked) comparison with the current IP address. */
2919 if (string_is_ip_address(ss, &maskoffset) != 0)
2920 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2922 /* The pattern is not an IP address. A common error that people make is to omit
2923 one component of an IPv4 address, either by accident, or believing that, for
2924 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2925 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2926 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2927 ancient specification.) To aid in debugging these cases, we give a specific
2928 error if the pattern contains only digits and dots or contains a slash preceded
2929 only by digits and dots (a slash at the start indicates a file name and of
2930 course slashes may be present in lookups, but not preceded only by digits and
2933 for (t = ss; isdigit(*t) || *t == '.'; ) t++;
2934 if (!*t || (*t == '/' && t != ss))
2936 *error = US"malformed IPv4 address or address mask";
2940 /* See if there is a semicolon in the pattern, separating a searchtype
2941 prefix. If there is one then check for comma-sep options. */
2943 if ((semicolon = Ustrchr(ss, ';')))
2944 if ((opts = Ustrchr(ss, ',')) && opts < semicolon)
2947 opts = string_copyn(opts, semicolon - opts);
2951 endname = semicolon;
2955 /* If we are doing an IP address only match, then all lookups must be IP
2956 address lookups, even if there is no "net-". */
2959 iplookup = semicolon != NULL;
2961 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
2962 a lookup on a masked IP network, in textual form. We obey this code even if we
2963 have already set iplookup, so as to skip over the "net-" prefix and to set the
2964 mask length. The net- stuff really only applies to single-key lookups where the
2965 key is implicit. For query-style lookups the key is specified in the query.
2966 From release 4.30, the use of net- for query style is no longer needed, but we
2967 retain it for backward compatibility. */
2969 if (Ustrncmp(ss, "net", 3) == 0 && semicolon)
2972 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2973 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2974 iplookup = *t++ == '-';
2979 /* Do the IP address lookup if that is indeed what we have */
2987 uschar *filename, *key, *result;
2990 /* Find the search type */
2992 search_type = search_findtype(t, endname - t);
2994 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2995 search_error_message);
2997 /* Adjust parameters for the type of lookup. For a query-style lookup, there
2998 is no file name, and the "key" is just the query. For query-style with a file
2999 name, we have to fish the file off the start of the query. For a single-key
3000 lookup, the key is the current IP address, masked appropriately, and
3001 reconverted to text form, with the mask appended. For IPv6 addresses, specify
3002 dot separators instead of colons, except when the lookup type is "iplsearch".
3005 if (mac_islookup(search_type, lookup_absfilequery))
3007 filename = semicolon + 1;
3009 while (*key != 0 && !isspace(*key)) key++;
3010 filename = string_copyn(filename, key - filename);
3011 while (isspace(*key)) key++;
3013 else if (mac_islookup(search_type, lookup_querystyle))
3016 key = semicolon + 1;
3018 else /* Single-key style */
3020 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
3022 insize = host_aton(cb->host_address, incoming);
3023 host_mask(insize, incoming, mlen);
3024 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
3026 filename = semicolon + 1;
3029 /* Now do the actual lookup; note that there is no search_close() because
3030 of the caching arrangements. */
3032 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3033 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3035 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL, opts);
3036 if (valueptr) *valueptr = result;
3037 return result ? OK : f.search_find_defer ? DEFER: FAIL;
3040 /* The pattern is not an IP address or network reference of any kind. That is,
3041 it is a host name pattern. If this is an IP only match, there's an error in the
3046 *error = US"cannot match host name in match_ip list";
3050 /* Check the characters of the pattern to see if they comprise only letters,
3051 digits, full stops, and hyphens (the constituents of domain names). Allow
3052 underscores, as they are all too commonly found. Sigh. Also, if
3053 allow_utf8_domains is set, allow top-bit characters. */
3055 for (t = ss; *t != 0; t++)
3056 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3057 (!allow_utf8_domains || *t < 128)) break;
3059 /* If the pattern is a complete domain name, with no fancy characters, look up
3060 its IP address and match against that. Note that a multi-homed host will add
3061 items to the chain. */
3072 /* Using byname rather than bydns here means we cannot determine dnssec
3073 status. On the other hand it is unclear how that could be either
3074 propagated up or enforced. */
3076 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3077 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3079 for (host_item * hh = &h; hh; hh = hh->next)
3080 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3083 if (rc == HOST_FIND_AGAIN) return DEFER;
3084 *error = string_sprintf("failed to find IP address for %s", ss);
3088 /* Almost all subsequent comparisons require the host name, and can be done
3089 using the general string matching function. When this function is called for
3090 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3091 must use sender_host_name and its aliases, looking them up if necessary. */
3093 if (cb->host_name) /* Explicit host name given */
3094 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3097 /* Host name not given; in principle we need the sender host name and its
3098 aliases. However, for query-style lookups, we do not need the name if the
3099 query does not contain $sender_host_name. From release 4.23, a reference to
3100 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3103 if ((semicolon = Ustrchr(ss, ';')))
3105 const uschar * affix, * opts;
3106 int partial, affixlen, starflags, id;
3109 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags,
3113 if (id < 0) /* Unknown lookup type */
3115 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3116 search_error_message, ss);
3119 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3124 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3127 case DEFER: return DEFER;
3128 default: return FAIL;
3132 /* Not a query-style lookup; must ensure the host name is present, and then we
3133 do a check on the name and all its aliases. */
3135 if (!sender_host_name)
3137 HDEBUG(D_host_lookup)
3138 debug_printf("sender host name required, to match against %s\n", ss);
3139 if (host_lookup_failed || host_name_lookup() != OK)
3141 *error = string_sprintf("failed to find host name for %s",
3142 sender_host_address);;
3145 host_build_sender_fullhost();
3148 /* Match on the sender host name, using the general matching function */
3150 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE, valueptr))
3153 case DEFER: return DEFER;
3156 /* If there are aliases, try matching on them. */
3158 aliases = sender_host_aliases;
3160 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3163 case DEFER: return DEFER;
3171 /*************************************************
3172 * Check a specific host matches a host list *
3173 *************************************************/
3175 /* This function is passed a host list containing items in a number of
3176 different formats and the identity of a host. Its job is to determine whether
3177 the given host is in the set of hosts defined by the list. The host name is
3178 passed as a pointer so that it can be looked up if needed and not already
3179 known. This is commonly the case when called from verify_check_host() to check
3180 an incoming connection. When called from elsewhere the host name should usually
3183 This function is now just a front end to match_check_list(), which runs common
3184 code for scanning a list. We pass it the check_host() function to perform a
3188 listptr pointer to the host list
3189 cache_bits pointer to cache for named lists, or NULL
3190 host_name the host name or NULL, implying use sender_host_name and
3191 sender_host_aliases, looking them up if required
3192 host_address the IP address
3193 valueptr if not NULL, data from a lookup is passed back here
3195 Returns: OK if the host is in the defined set
3196 FAIL if the host is not in the defined set,
3197 DEFER if a data lookup deferred (not a host lookup)
3199 If the host name was needed in order to make a comparison, and could not be
3200 determined from the IP address, the result is FAIL unless the item
3201 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3204 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3205 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3208 unsigned int *local_cache_bits = cache_bits;
3209 const uschar *save_host_address = deliver_host_address;
3210 check_host_block cb = { .host_name = host_name, .host_address = host_address };
3212 if (valueptr) *valueptr = NULL;
3214 /* If the host address starts off ::ffff: it is an IPv6 address in
3215 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3218 cb.host_ipv4 = Ustrncmp(host_address, "::ffff:", 7) == 0
3219 ? host_address + 7 : host_address;
3221 /* During the running of the check, put the IP address into $host_address. In
3222 the case of calls from the smtp transport, it will already be there. However,
3223 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3224 the safe side, any existing setting is preserved, though as I write this
3225 (November 2004) I can't see any cases where it is actually needed. */
3227 deliver_host_address = host_address;
3228 rc = match_check_list(
3229 listptr, /* the list */
3230 0, /* separator character */
3231 &hostlist_anchor, /* anchor pointer */
3232 &local_cache_bits, /* cache pointer */
3233 check_host, /* function for testing */
3234 &cb, /* argument for function */
3235 MCL_HOST, /* type of check */
3236 (host_address == sender_host_address)?
3237 US"host" : host_address, /* text for debugging */
3238 valueptr); /* where to pass back data */
3239 deliver_host_address = save_host_address;
3246 /*************************************************
3247 * Check the given host item matches a list *
3248 *************************************************/
3250 verify_check_given_host(const uschar **listptr, const host_item *host)
3252 return verify_check_this_host(listptr, NULL, host->name, host->address, NULL);
3255 /*************************************************
3256 * Check the remote host matches a list *
3257 *************************************************/
3259 /* This is a front end to verify_check_this_host(), created because checking
3260 the remote host is a common occurrence. With luck, a good compiler will spot
3261 the tail recursion and optimize it. If there's no host address, this is
3262 command-line SMTP input - check against an empty string for the address.
3265 listptr pointer to the host list
3267 Returns: the yield of verify_check_this_host(),
3268 i.e. OK, FAIL, or DEFER
3272 verify_check_host(uschar **listptr)
3274 return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
3275 sender_host_address ? sender_host_address : US"", NULL);
3282 /*************************************************
3283 * Invert an IP address *
3284 *************************************************/
3286 /* Originally just used for DNS xBL lists, now also used for the
3287 reverse_ip expansion operator.
3290 buffer where to put the answer
3291 address the address to invert
3295 invert_address(uschar *buffer, uschar *address)
3298 uschar *bptr = buffer;
3300 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3301 to the IPv4 part only. */
3303 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3305 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3308 if (host_aton(address, bin) == 1)
3311 for (int i = 0; i < 4; i++)
3313 sprintf(CS bptr, "%d.", x & 255);
3314 while (*bptr) bptr++;
3319 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3320 in any DNS black lists, and the format in which they will be looked up is
3321 unknown. This is just a guess. */
3325 for (int j = 3; j >= 0; j--)
3328 for (int i = 0; i < 8; i++)
3330 sprintf(CS bptr, "%x.", x & 15);
3331 while (*bptr) bptr++;
3337 /* Remove trailing period -- this is needed so that both arbitrary
3338 dnsbl keydomains and inverted addresses may be combined with the
3339 same format string, "%s.%s" */
3346 /****************************************************
3347 Verify a local user account for quota sufficiency
3348 ****************************************************/
3350 /* The real work, done via a re-exec for privs, calls
3351 down to the transport for the quota check.
3353 Route and transport (in recipient-verify mode) the
3356 A routing result indicating any transport type other than appendfile
3359 Return, on stdout, a result string containing:
3360 - highlevel result code (OK, DEFER, FAIL)
3367 verify_quota(uschar * address)
3369 address_item vaddr = {.address = address};
3371 uschar * msg = US"\0";
3374 if ((rc = verify_address(&vaddr, NULL, vopt_is_recipient | vopt_quota,
3375 1, 0, 0, NULL, NULL, &routed)) != OK)
3377 uschar * where = recipient_verify_failure;
3378 msg = acl_verify_message ? acl_verify_message : vaddr.message;
3379 if (!msg) msg = US"";
3380 if (rc == DEFER && vaddr.basic_errno == ERRNO_EXIMQUOTA)
3382 rc = FAIL; /* DEFER -> FAIL */
3384 vaddr.basic_errno = 0;
3386 else if (!where) where = US"";
3388 len = 5 + Ustrlen(msg) + 1 + Ustrlen(where);
3389 msg = string_sprintf("%c%c%c%c%c%s%c%s", (uschar)rc,
3390 (vaddr.basic_errno >> 24) & 0xff, (vaddr.basic_errno >> 16) & 0xff,
3391 (vaddr.basic_errno >> 8) & 0xff, vaddr.basic_errno & 0xff,
3395 DEBUG(D_verify) debug_printf_indent("verify_quota: len %d\n", len);
3401 /******************************************************************************/
3403 /* Quota cache lookup. We use the callout hints db also for the quota cache.
3404 Return TRUE if a nonexpired record was found, having filled in the yield
3409 cached_quota_lookup(const uschar * rcpt, int * yield,
3410 int pos_cache, int neg_cache)
3412 open_db dbblock, *dbm_file = NULL;
3413 dbdata_callout_cache_address * cache_address_record;
3415 if (!pos_cache && !neg_cache)
3417 if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
3419 HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n");
3422 if (!(cache_address_record = (dbdata_callout_cache_address *)
3423 get_callout_cache_record(dbm_file, rcpt, US"address",
3424 pos_cache, neg_cache)))
3426 dbfn_close(dbm_file);
3429 if (cache_address_record->result == ccache_accept)
3431 dbfn_close(dbm_file);
3435 /* Quota cache write */
3438 cache_quota_write(const uschar * rcpt, int yield, int pos_cache, int neg_cache)
3440 open_db dbblock, *dbm_file = NULL;
3441 dbdata_callout_cache_address cache_address_record;
3443 if (!pos_cache && !neg_cache)
3445 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
3447 HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n");
3451 cache_address_record.result = yield == OK ? ccache_accept : ccache_reject;
3453 (void)dbfn_write(dbm_file, rcpt, &cache_address_record,
3454 (int)sizeof(dbdata_callout_cache_address));
3455 HDEBUG(D_verify) debug_printf_indent("wrote %s quota cache record for %s\n",
3456 yield == OK ? "positive" : "negative", rcpt);
3458 dbfn_close(dbm_file);
3463 /* To evaluate a local user's quota, starting in ACL, we need to
3464 fork & exec to regain privileges, to that we can change to the user's
3465 identity for access to their files.
3468 rcpt Recipient account
3469 pos_cache Number of seconds to cache a positive result (delivery
3470 to be accepted). Zero to disable caching.
3471 neg_cache Number of seconds to cache a negative result. Zero to disable.
3472 msg Pointer to result string pointer
3474 Return: OK/DEFER/FAIL code
3478 verify_quota_call(const uschar * rcpt, int pos_cache, int neg_cache,
3481 int pfd[2], pid, save_errno, yield = FAIL;
3482 void (*oldsignal)(int);
3483 const uschar * where = US"socketpair";
3487 if (cached_quota_lookup(rcpt, &yield, pos_cache, neg_cache))
3489 HDEBUG(D_verify) debug_printf_indent("quota cache: address record is %s\n",
3490 yield == OK ? "positive" : "negative");
3493 recipient_verify_failure = US"quota";
3494 acl_verify_message = *msg =
3495 US"Previous (cached) quota verification failure";
3504 oldsignal = signal(SIGCHLD, SIG_DFL);
3505 if ((pid = exim_fork(US"quota-verify")) < 0)
3508 close(pfd[pipe_write]);
3509 close(pfd[pipe_read]);
3514 if (pid == 0) /* child */
3516 close(pfd[pipe_read]);
3517 force_fd(pfd[pipe_write], 1); /* stdout to pipe */
3518 close(pfd[pipe_write]);
3520 if (debug_fd > 0) force_fd(debug_fd, 2);
3522 child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 3,
3523 US"-MCq", string_sprintf("%d", message_size), rcpt);
3528 close(pfd[pipe_write]);
3532 DEBUG(D_verify) debug_printf_indent(" fork: %s\n", strerror(save_errno));
3537 int n = read(pfd[pipe_read], buf, sizeof(buf));
3540 waitpid(pid, &status, 0);
3545 if (n > 0) yield = buf[0];
3547 save_errno = (buf[1] << 24) | (buf[2] << 16) | (buf[3] << 8) | buf[4];
3548 if ((recipient_verify_failure = n > 5
3549 ? string_copyn_taint(buf+5, n-5, FALSE) : NULL))
3552 s = buf + 5 + Ustrlen(recipient_verify_failure) + 1;
3554 acl_verify_message = *msg =
3555 m > 0 ? string_copyn_taint(s, m, FALSE) : NULL;
3558 DEBUG(D_verify) debug_printf_indent("verify call response:"
3559 " len %d yield %s errno '%s' where '%s' msg '%s'\n",
3560 n, rc_names[yield], strerror(save_errno), recipient_verify_failure, *msg);
3563 || save_errno == 0 && Ustrcmp(recipient_verify_failure, "quota") == 0)
3564 cache_quota_write(rcpt, yield, pos_cache, neg_cache);
3565 else DEBUG(D_verify)
3566 debug_printf_indent("result not cacheable\n");
3571 debug_printf_indent("verify call response: waitpid status 0x%04x\n", status);
3575 close(pfd[pipe_read]);
3576 signal(SIGCHLD, oldsignal);
3581 DEBUG(D_verify) debug_printf_indent("verify_quota_call fail in %s\n", where);
3588 /* End of verify.c */