1 /* $Cambridge: exim/src/src/verify.c,v 1.44 2006/12/11 14:15:59 ph10 Exp $ */
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
7 /* Copyright (c) University of Cambridge 1995 - 2006 */
8 /* See the file NOTICE for conditions of use and distribution. */
10 /* Functions concerned with verifying things. The original code for callout
11 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
17 /* Structure for caching DNSBL lookups */
19 typedef struct dnsbl_cache_block {
27 /* Anchor for DNSBL cache */
29 static tree_node *dnsbl_cache = NULL;
33 /*************************************************
34 * Retrieve a callout cache record *
35 *************************************************/
37 /* If a record exists, check whether it has expired.
40 dbm_file an open hints file
42 type "address" or "domain"
43 positive_expire expire time for positive records
44 negative_expire expire time for negative records
46 Returns: the cache record if a non-expired one exists, else NULL
49 static dbdata_callout_cache *
50 get_callout_cache_record(open_db *dbm_file, uschar *key, uschar *type,
51 int positive_expire, int negative_expire)
56 dbdata_callout_cache *cache_record;
58 cache_record = dbfn_read_with_length(dbm_file, key, &length);
60 if (cache_record == NULL)
62 HDEBUG(D_verify) debug_printf("callout cache: no %s record found\n", type);
66 /* We treat a record as "negative" if its result field is not positive, or if
67 it is a domain record and the postmaster field is negative. */
69 negative = cache_record->result != ccache_accept ||
70 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
71 expire = negative? negative_expire : positive_expire;
74 if (now - cache_record->time_stamp > expire)
76 HDEBUG(D_verify) debug_printf("callout cache: %s record expired\n", type);
80 /* If this is a non-reject domain record, check for the obsolete format version
81 that doesn't have the postmaster and random timestamps, by looking at the
82 length. If so, copy it to a new-style block, replicating the record's
83 timestamp. Then check the additional timestamps. (There's no point wasting
84 effort if connections are rejected.) */
86 if (type[0] == 'd' && cache_record->result != ccache_reject)
88 if (length == sizeof(dbdata_callout_cache_obs))
90 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache));
91 memcpy(new, cache_record, length);
92 new->postmaster_stamp = new->random_stamp = new->time_stamp;
96 if (now - cache_record->postmaster_stamp > expire)
97 cache_record->postmaster_result = ccache_unknown;
99 if (now - cache_record->random_stamp > expire)
100 cache_record->random_result = ccache_unknown;
103 HDEBUG(D_verify) debug_printf("callout cache: found %s record\n", type);
109 /*************************************************
110 * Do callout verification for an address *
111 *************************************************/
113 /* This function is called from verify_address() when the address has routed to
114 a host list, and a callout has been requested. Callouts are expensive; that is
115 why a cache is used to improve the efficiency.
118 addr the address that's been routed
119 host_list the list of hosts to try
120 tf the transport feedback block
122 ifstring "interface" option from transport, or NULL
123 portstring "port" option from transport, or NULL
124 protocolstring "protocol" option from transport, or NULL
125 callout the per-command callout timeout
126 callout_overall the overall callout timeout (if < 0 use 4*callout)
127 callout_connect the callout connection timeout (if < 0 use callout)
128 options the verification options - these bits are used:
129 vopt_is_recipient => this is a recipient address
130 vopt_callout_no_cache => don't use callout cache
131 vopt_callout_fullpm => if postmaster check, do full one
132 vopt_callout_random => do the "random" thing
133 vopt_callout_recipsender => use real sender for recipient
134 vopt_callout_recippmaster => use postmaster for recipient
135 se_mailfrom MAIL FROM address for sender verify; NULL => ""
136 pm_mailfrom if non-NULL, do the postmaster check with this sender
138 Returns: OK/FAIL/DEFER
142 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
143 int callout, int callout_overall, int callout_connect, int options,
144 uschar *se_mailfrom, uschar *pm_mailfrom)
146 BOOL is_recipient = (options & vopt_is_recipient) != 0;
147 BOOL callout_no_cache = (options & vopt_callout_no_cache) != 0;
148 BOOL callout_random = (options & vopt_callout_random) != 0;
151 int old_domain_cache_result = ccache_accept;
154 uschar *from_address;
155 uschar *random_local_part = NULL;
156 uschar *save_deliver_domain = deliver_domain;
157 uschar **failure_ptr = is_recipient?
158 &recipient_verify_failure : &sender_verify_failure;
160 open_db *dbm_file = NULL;
161 dbdata_callout_cache new_domain_record;
162 dbdata_callout_cache_address new_address_record;
164 time_t callout_start_time;
166 new_domain_record.result = ccache_unknown;
167 new_domain_record.postmaster_result = ccache_unknown;
168 new_domain_record.random_result = ccache_unknown;
170 memset(&new_address_record, 0, sizeof(new_address_record));
172 /* For a recipient callout, the key used for the address cache record must
173 include the sender address if we are using the real sender in the callout,
174 because that may influence the result of the callout. */
176 address_key = addr->address;
181 if ((options & vopt_callout_recipsender) != 0)
183 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
184 from_address = sender_address;
186 else if ((options & vopt_callout_recippmaster) != 0)
188 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
189 qualify_domain_sender);
190 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
194 /* For a sender callout, we must adjust the key if the mailfrom address is not
199 from_address = (se_mailfrom == NULL)? US"" : se_mailfrom;
200 if (from_address[0] != 0)
201 address_key = string_sprintf("%s/<%s>", addr->address, from_address);
204 /* Open the callout cache database, it it exists, for reading only at this
205 stage, unless caching has been disabled. */
207 if (callout_no_cache)
209 HDEBUG(D_verify) debug_printf("callout cache: disabled by no_cache\n");
211 else if ((dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE)) == NULL)
213 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
216 /* If a cache database is available see if we can avoid the need to do an
217 actual callout by making use of previously-obtained data. */
219 if (dbm_file != NULL)
221 dbdata_callout_cache_address *cache_address_record;
222 dbdata_callout_cache *cache_record = get_callout_cache_record(dbm_file,
223 addr->domain, US"domain",
224 callout_cache_domain_positive_expire,
225 callout_cache_domain_negative_expire);
227 /* If an unexpired cache record was found for this domain, see if the callout
228 process can be short-circuited. */
230 if (cache_record != NULL)
232 /* In most cases, if an early command (up to and including MAIL FROM:<>)
233 was rejected, there is no point carrying on. The callout fails. However, if
234 we are doing a recipient verification with use_sender or use_postmaster
235 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
236 will be using a non-empty sender. We have to remember this situation so as
237 not to disturb the cached domain value if this whole verification succeeds
238 (we don't want it turning into "accept"). */
240 old_domain_cache_result = cache_record->result;
242 if (cache_record->result == ccache_reject ||
243 (*from_address == 0 && cache_record->result == ccache_reject_mfnull))
245 setflag(addr, af_verify_nsfail);
247 debug_printf("callout cache: domain gave initial rejection, or "
248 "does not accept HELO or MAIL FROM:<>\n");
249 setflag(addr, af_verify_nsfail);
250 addr->user_message = US"(result of an earlier callout reused).";
252 *failure_ptr = US"mail";
256 /* If a previous check on a "random" local part was accepted, we assume
257 that the server does not do any checking on local parts. There is therefore
258 no point in doing the callout, because it will always be successful. If a
259 random check previously failed, arrange not to do it again, but preserve
260 the data in the new record. If a random check is required but hasn't been
261 done, skip the remaining cache processing. */
263 if (callout_random) switch(cache_record->random_result)
267 debug_printf("callout cache: domain accepts random addresses\n");
268 goto END_CALLOUT; /* Default yield is OK */
272 debug_printf("callout cache: domain rejects random addresses\n");
273 callout_random = FALSE;
274 new_domain_record.random_result = ccache_reject;
275 new_domain_record.random_stamp = cache_record->random_stamp;
280 debug_printf("callout cache: need to check random address handling "
281 "(not cached or cache expired)\n");
285 /* If a postmaster check is requested, but there was a previous failure,
286 there is again no point in carrying on. If a postmaster check is required,
287 but has not been done before, we are going to have to do a callout, so skip
288 remaining cache processing. */
290 if (pm_mailfrom != NULL)
292 if (cache_record->postmaster_result == ccache_reject)
294 setflag(addr, af_verify_pmfail);
296 debug_printf("callout cache: domain does not accept "
297 "RCPT TO:<postmaster@domain>\n");
299 *failure_ptr = US"postmaster";
300 setflag(addr, af_verify_pmfail);
301 addr->user_message = US"(result of earlier verification reused).";
304 if (cache_record->postmaster_result == ccache_unknown)
307 debug_printf("callout cache: need to check RCPT "
308 "TO:<postmaster@domain> (not cached or cache expired)\n");
312 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
313 postmaster check if the address itself has to be checked. Also ensure
314 that the value in the cache record is preserved (with its old timestamp).
317 HDEBUG(D_verify) debug_printf("callout cache: domain accepts RCPT "
318 "TO:<postmaster@domain>\n");
320 new_domain_record.postmaster_result = ccache_accept;
321 new_domain_record.postmaster_stamp = cache_record->postmaster_stamp;
325 /* We can't give a result based on information about the domain. See if there
326 is an unexpired cache record for this specific address (combined with the
327 sender address if we are doing a recipient callout with a non-empty sender).
330 cache_address_record = (dbdata_callout_cache_address *)
331 get_callout_cache_record(dbm_file,
332 address_key, US"address",
333 callout_cache_positive_expire,
334 callout_cache_negative_expire);
336 if (cache_address_record != NULL)
338 if (cache_address_record->result == ccache_accept)
341 debug_printf("callout cache: address record is positive\n");
346 debug_printf("callout cache: address record is negative\n");
347 addr->user_message = US"Previous (cached) callout verification failure";
348 *failure_ptr = US"recipient";
354 /* Close the cache database while we actually do the callout for real. */
357 dbfn_close(dbm_file);
361 /* The information wasn't available in the cache, so we have to do a real
362 callout and save the result in the cache for next time, unless no_cache is set,
363 or unless we have a previously cached negative random result. If we are to test
364 with a random local part, ensure that such a local part is available. If not,
365 log the fact, but carry on without randomming. */
367 if (callout_random && callout_random_local_part != NULL)
369 random_local_part = expand_string(callout_random_local_part);
370 if (random_local_part == NULL)
371 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
372 "callout_random_local_part: %s", expand_string_message);
375 /* Default the connect and overall callout timeouts if not set, and record the
376 time we are starting so that we can enforce it. */
378 if (callout_overall < 0) callout_overall = 4 * callout;
379 if (callout_connect < 0) callout_connect = callout;
380 callout_start_time = time(NULL);
382 /* Now make connections to the hosts and do real callouts. The list of hosts
383 is passed in as an argument. */
385 for (host = host_list; host != NULL && !done; host = host->next)
387 smtp_inblock inblock;
388 smtp_outblock outblock;
391 BOOL send_quit = TRUE;
392 uschar *active_hostname = smtp_active_hostname;
393 uschar *helo = US"HELO";
394 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
395 uschar inbuffer[4096];
396 uschar outbuffer[1024];
397 uschar responsebuffer[4096];
399 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
400 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
402 /* Skip this host if we don't have an IP address for it. */
404 if (host->address == NULL)
406 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
411 /* Check the overall callout timeout */
413 if (time(NULL) - callout_start_time >= callout_overall)
415 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
419 /* Set IPv4 or IPv6 */
421 host_af = (Ustrchr(host->address, ':') == NULL)? AF_INET:AF_INET6;
423 /* Expand and interpret the interface and port strings. The latter will not
424 be used if there is a host-specific port (e.g. from a manualroute router).
425 This has to be delayed till now, because they may expand differently for
426 different hosts. If there's a failure, log it, but carry on with the
429 deliver_host = host->name;
430 deliver_host_address = host->address;
431 deliver_domain = addr->domain;
433 if (!smtp_get_interface(tf->interface, host_af, addr, NULL, &interface,
435 !smtp_get_port(tf->port, addr, &port, US"callout"))
436 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
439 /* Expand the helo_data string to find the host name to use. */
441 if (tf->helo_data != NULL)
443 uschar *s = expand_string(tf->helo_data);
445 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: failed to expand transport's "
446 "helo_data value for callout: %s", addr->address,
447 expand_string_message);
448 else active_hostname = s;
451 deliver_host = deliver_host_address = NULL;
452 deliver_domain = save_deliver_domain;
454 /* Set HELO string according to the protocol */
456 if (Ustrcmp(tf->protocol, "lmtp") == 0) helo = US"LHLO";
458 HDEBUG(D_verify) debug_printf("interface=%s port=%d\n", interface, port);
460 /* Set up the buffer for reading SMTP response packets. */
462 inblock.buffer = inbuffer;
463 inblock.buffersize = sizeof(inbuffer);
464 inblock.ptr = inbuffer;
465 inblock.ptrend = inbuffer;
467 /* Set up the buffer for holding SMTP commands while pipelining */
469 outblock.buffer = outbuffer;
470 outblock.buffersize = sizeof(outbuffer);
471 outblock.ptr = outbuffer;
472 outblock.cmd_count = 0;
473 outblock.authenticating = FALSE;
475 /* Connect to the host; on failure, just loop for the next one, but we
476 set the error for the last one. Use the callout_connect timeout. */
478 inblock.sock = outblock.sock =
479 smtp_connect(host, host_af, port, interface, callout_connect, TRUE);
480 if (inblock.sock < 0)
482 addr->message = string_sprintf("could not connect to %s [%s]: %s",
483 host->name, host->address, strerror(errno));
487 /* Wait for initial response, and send HELO. The smtp_write_command()
488 function leaves its command in big_buffer. This is used in error responses.
489 Initialize it in case the connection is rejected. */
491 Ustrcpy(big_buffer, "initial connection");
494 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
496 smtp_write_command(&outblock, FALSE, "%s %s\r\n", helo,
497 active_hostname) >= 0 &&
498 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
501 /* Failure to accept HELO is cached; this blocks the whole domain for all
502 senders. I/O errors and defer responses are not cached. */
506 *failure_ptr = US"mail"; /* At or before MAIL */
507 if (errno == 0 && responsebuffer[0] == '5')
509 setflag(addr, af_verify_nsfail);
510 new_domain_record.result = ccache_reject;
514 /* Send the MAIL command */
517 smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>\r\n",
518 from_address) >= 0 &&
519 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
522 /* If the host does not accept MAIL FROM:<>, arrange to cache this
523 information, but again, don't record anything for an I/O error or a defer. Do
524 not cache rejections of MAIL when a non-empty sender has been used, because
525 that blocks the whole domain for all senders. */
529 *failure_ptr = US"mail"; /* At or before MAIL */
530 if (errno == 0 && responsebuffer[0] == '5')
532 setflag(addr, af_verify_nsfail);
533 if (from_address[0] == 0)
534 new_domain_record.result = ccache_reject_mfnull;
538 /* Otherwise, proceed to check a "random" address (if required), then the
539 given address, and the postmaster address (if required). Between each check,
540 issue RSET, because some servers accept only one recipient after MAIL
543 Before doing this, set the result in the domain cache record to "accept",
544 unless its previous value was ccache_reject_mfnull. In that case, the domain
545 rejects MAIL FROM:<> and we want to continue to remember that. When that is
546 the case, we have got here only in the case of a recipient verification with
547 a non-null sender. */
551 new_domain_record.result =
552 (old_domain_cache_result == ccache_reject_mfnull)?
553 ccache_reject_mfnull: ccache_accept;
555 /* Do the random local part check first */
557 if (random_local_part != NULL)
559 uschar randombuffer[1024];
561 smtp_write_command(&outblock, FALSE,
562 "RCPT TO:<%.1000s@%.1000s>\r\n", random_local_part,
563 addr->domain) >= 0 &&
564 smtp_read_response(&inblock, randombuffer,
565 sizeof(randombuffer), '2', callout);
567 /* Remember when we last did a random test */
569 new_domain_record.random_stamp = time(NULL);
571 /* If accepted, we aren't going to do any further tests below. */
575 new_domain_record.random_result = ccache_accept;
578 /* Otherwise, cache a real negative response, and get back to the right
579 state to send RCPT. Unless there's some problem such as a dropped
580 connection, we expect to succeed, because the commands succeeded above. */
584 if (randombuffer[0] == '5')
585 new_domain_record.random_result = ccache_reject;
588 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
589 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
592 smtp_write_command(&outblock, FALSE, "MAIL FROM:<%s>\r\n",
593 from_address) >= 0 &&
594 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
597 else done = FALSE; /* Some timeout/connection problem */
600 /* If the host is accepting all local parts, as determined by the "random"
601 check, we don't need to waste time doing any further checking. */
603 if (new_domain_record.random_result != ccache_accept && done)
605 /* Get the rcpt_include_affixes flag from the transport if there is one,
606 but assume FALSE if there is not. */
609 smtp_write_command(&outblock, FALSE, "RCPT TO:<%.1000s>\r\n",
610 transport_rcpt_address(addr,
611 (addr->transport == NULL)? FALSE :
612 addr->transport->rcpt_include_affixes)) >= 0 &&
613 smtp_read_response(&inblock, responsebuffer, sizeof(responsebuffer),
617 new_address_record.result = ccache_accept;
618 else if (errno == 0 && responsebuffer[0] == '5')
620 *failure_ptr = US"recipient";
621 new_address_record.result = ccache_reject;
624 /* Do postmaster check if requested; if a full check is required, we
625 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
627 if (done && pm_mailfrom != NULL)
630 smtp_write_command(&outblock, FALSE, "RSET\r\n") >= 0 &&
631 smtp_read_response(&inblock, responsebuffer,
632 sizeof(responsebuffer), '2', callout) &&
634 smtp_write_command(&outblock, FALSE,
635 "MAIL FROM:<%s>\r\n", pm_mailfrom) >= 0 &&
636 smtp_read_response(&inblock, responsebuffer,
637 sizeof(responsebuffer), '2', callout) &&
639 /* First try using the current domain */
642 smtp_write_command(&outblock, FALSE,
643 "RCPT TO:<postmaster@%.1000s>\r\n", addr->domain) >= 0 &&
644 smtp_read_response(&inblock, responsebuffer,
645 sizeof(responsebuffer), '2', callout)
650 /* If that doesn't work, and a full check is requested,
651 try without the domain. */
654 (options & vopt_callout_fullpm) != 0 &&
655 smtp_write_command(&outblock, FALSE,
656 "RCPT TO:<postmaster>\r\n") >= 0 &&
657 smtp_read_response(&inblock, responsebuffer,
658 sizeof(responsebuffer), '2', callout)
661 /* Sort out the cache record */
663 new_domain_record.postmaster_stamp = time(NULL);
666 new_domain_record.postmaster_result = ccache_accept;
667 else if (errno == 0 && responsebuffer[0] == '5')
669 *failure_ptr = US"postmaster";
670 setflag(addr, af_verify_pmfail);
671 new_domain_record.postmaster_result = ccache_reject;
674 } /* Random not accepted */
675 } /* MAIL FROM: accepted */
677 /* For any failure of the main check, other than a negative response, we just
678 close the connection and carry on. We can identify a negative response by the
679 fact that errno is zero. For I/O errors it will be non-zero
681 Set up different error texts for logging and for sending back to the caller
682 as an SMTP response. Log in all cases, using a one-line format. For sender
683 callouts, give a full response to the caller, but for recipient callouts,
684 don't give the IP address because this may be an internal host whose identity
685 is not to be widely broadcast. */
689 if (errno == ETIMEDOUT)
691 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
696 if (*responsebuffer == 0) Ustrcpy(responsebuffer, US"connection dropped");
699 string_sprintf("response to \"%s\" from %s [%s] was: %s",
700 big_buffer, host->name, host->address,
701 string_printing(responsebuffer));
703 addr->user_message = is_recipient?
704 string_sprintf("Callout verification failed:\n%s", responsebuffer)
706 string_sprintf("Called: %s\nSent: %s\nResponse: %s",
707 host->address, big_buffer, responsebuffer);
709 /* Hard rejection ends the process */
711 if (responsebuffer[0] == '5') /* Address rejected */
719 /* End the SMTP conversation and close the connection. */
721 if (send_quit) (void)smtp_write_command(&outblock, FALSE, "QUIT\r\n");
722 (void)close(inblock.sock);
723 } /* Loop through all hosts, while !done */
725 /* If we get here with done == TRUE, a successful callout happened, and yield
726 will be set OK or FAIL according to the response to the RCPT command.
727 Otherwise, we looped through the hosts but couldn't complete the business.
728 However, there may be domain-specific information to cache in both cases.
730 The value of the result field in the new_domain record is ccache_unknown if
731 there was an error before or with MAIL FROM:, and errno was not zero,
732 implying some kind of I/O error. We don't want to write the cache in that case.
733 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
735 if (!callout_no_cache && new_domain_record.result != ccache_unknown)
737 if ((dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE))
740 HDEBUG(D_verify) debug_printf("callout cache: not available\n");
744 (void)dbfn_write(dbm_file, addr->domain, &new_domain_record,
745 (int)sizeof(dbdata_callout_cache));
746 HDEBUG(D_verify) debug_printf("wrote callout cache domain record:\n"
747 " result=%d postmaster=%d random=%d\n",
748 new_domain_record.result,
749 new_domain_record.postmaster_result,
750 new_domain_record.random_result);
754 /* If a definite result was obtained for the callout, cache it unless caching
759 if (!callout_no_cache && new_address_record.result != ccache_unknown)
761 if (dbm_file == NULL)
762 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE);
763 if (dbm_file == NULL)
765 HDEBUG(D_verify) debug_printf("no callout cache available\n");
769 (void)dbfn_write(dbm_file, address_key, &new_address_record,
770 (int)sizeof(dbdata_callout_cache_address));
771 HDEBUG(D_verify) debug_printf("wrote %s callout cache address record\n",
772 (new_address_record.result == ccache_accept)? "positive" : "negative");
777 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
778 temporary error. If there was only one host, and a response was received, leave
779 it alone if supplying details. Otherwise, give a generic response. */
783 uschar *dullmsg = string_sprintf("Could not complete %s verify callout",
784 is_recipient? "recipient" : "sender");
787 if (host_list->next != NULL || addr->message == NULL) addr->message = dullmsg;
789 addr->user_message = (!smtp_return_error_details)? dullmsg :
790 string_sprintf("%s for <%s>.\n"
791 "The mail server(s) for the domain may be temporarily unreachable, or\n"
792 "they may be permanently unreachable from this server. In the latter case,\n%s",
793 dullmsg, addr->address,
795 "the address will never be accepted."
797 "you need to change the address or create an MX record for its domain\n"
798 "if it is supposed to be generally accessible from the Internet.\n"
799 "Talk to your mail administrator for details.");
801 /* Force a specific error code */
803 addr->basic_errno = ERRNO_CALLOUTDEFER;
806 /* Come here from within the cache-reading code on fast-track exit. */
809 if (dbm_file != NULL) dbfn_close(dbm_file);
815 /*************************************************
816 * Copy error to toplevel address *
817 *************************************************/
819 /* This function is used when a verify fails or defers, to ensure that the
820 failure or defer information is in the original toplevel address. This applies
821 when an address is redirected to a single new address, and the failure or
822 deferral happens to the child address.
825 vaddr the verify address item
826 addr the final address item
829 Returns: the value of YIELD
833 copy_error(address_item *vaddr, address_item *addr, int yield)
837 vaddr->message = addr->message;
838 vaddr->user_message = addr->user_message;
839 vaddr->basic_errno = addr->basic_errno;
840 vaddr->more_errno = addr->more_errno;
841 vaddr->p.address_data = addr->p.address_data;
849 /*************************************************
850 * Verify an email address *
851 *************************************************/
853 /* This function is used both for verification (-bv and at other times) and
854 address testing (-bt), which is indicated by address_test_mode being set.
857 vaddr contains the address to verify; the next field in this block
859 f if not NULL, write the result to this file
860 options various option bits:
861 vopt_fake_sender => this sender verify is not for the real
862 sender (it was verify=sender=xxxx or an address from a
863 header line) - rewriting must not change sender_address
864 vopt_is_recipient => this is a recipient address, otherwise
865 it's a sender address - this affects qualification and
866 rewriting and messages from callouts
867 vopt_qualify => qualify an unqualified address; else error
868 vopt_expn => called from SMTP EXPN command
869 vopt_success_on_redirect => when a new address is generated
870 the verification instantly succeeds
872 These ones are used by do_callout() -- the options variable
875 vopt_callout_fullpm => if postmaster check, do full one
876 vopt_callout_no_cache => don't use callout cache
877 vopt_callout_random => do the "random" thing
878 vopt_callout_recipsender => use real sender for recipient
879 vopt_callout_recippmaster => use postmaster for recipient
881 callout if > 0, specifies that callout is required, and gives timeout
882 for individual commands
883 callout_overall if > 0, gives overall timeout for the callout function;
884 if < 0, a default is used (see do_callout())
885 callout_connect the connection timeout for callouts
886 se_mailfrom when callout is requested to verify a sender, use this
887 in MAIL FROM; NULL => ""
888 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
889 thing and use this as the sender address (may be "")
891 routed if not NULL, set TRUE if routing succeeded, so we can
892 distinguish between routing failed and callout failed
894 Returns: OK address verified
895 FAIL address failed to verify
896 DEFER can't tell at present
900 verify_address(address_item *vaddr, FILE *f, int options, int callout,
901 int callout_overall, int callout_connect, uschar *se_mailfrom,
902 uschar *pm_mailfrom, BOOL *routed)
905 BOOL full_info = (f == NULL)? FALSE : (debug_selector != 0);
906 BOOL is_recipient = (options & vopt_is_recipient) != 0;
907 BOOL expn = (options & vopt_expn) != 0;
908 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
911 int verify_type = expn? v_expn :
912 address_test_mode? v_none :
913 is_recipient? v_recipient : v_sender;
914 address_item *addr_list;
915 address_item *addr_new = NULL;
916 address_item *addr_remote = NULL;
917 address_item *addr_local = NULL;
918 address_item *addr_succeed = NULL;
919 uschar **failure_ptr = is_recipient?
920 &recipient_verify_failure : &sender_verify_failure;
921 uschar *ko_prefix, *cr;
922 uschar *address = vaddr->address;
924 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
926 /* Clear, just in case */
930 /* Set up a prefix and suffix for error message which allow us to use the same
931 output statements both in EXPN mode (where an SMTP response is needed) and when
932 debugging with an output file. */
936 ko_prefix = US"553 ";
939 else ko_prefix = cr = US"";
941 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
943 if (parse_find_at(address) == NULL)
945 if ((options & vopt_qualify) == 0)
948 fprintf(f, "%sA domain is required for \"%s\"%s\n", ko_prefix, address,
950 *failure_ptr = US"qualify";
953 address = rewrite_address_qualify(address, is_recipient);
958 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
959 debug_printf("%s %s\n", address_test_mode? "Testing" : "Verifying", address);
962 /* Rewrite and report on it. Clear the domain and local part caches - these
963 may have been set by domains and local part tests during an ACL. */
965 if (global_rewrite_rules != NULL)
967 uschar *old = address;
968 address = rewrite_address(address, is_recipient, FALSE,
969 global_rewrite_rules, rewrite_existflags);
972 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
973 for (i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
974 if (f != NULL && !expn) fprintf(f, "Address rewritten as: %s\n", address);
978 /* If this is the real sender address, we must update sender_address at
979 this point, because it may be referred to in the routers. */
981 if ((options & (vopt_fake_sender|vopt_is_recipient)) == 0)
982 sender_address = address;
984 /* If the address was rewritten to <> no verification can be done, and we have
985 to return OK. This rewriting is permitted only for sender addresses; for other
986 addresses, such rewriting fails. */
988 if (address[0] == 0) return OK;
990 /* Save a copy of the sender address for re-instating if we change it to <>
991 while verifying a sender address (a nice bit of self-reference there). */
993 save_sender = sender_address;
995 /* Update the address structure with the possibly qualified and rewritten
996 address. Set it up as the starting address on the chain of new addresses. */
998 vaddr->address = address;
1001 /* We need a loop, because an address can generate new addresses. We must also
1002 cope with generated pipes and files at the top level. (See also the code and
1003 comment in deliver.c.) However, it is usually the case that the router for
1004 user's .forward files has its verify flag turned off.
1006 If an address generates more than one child, the loop is used only when
1007 full_info is set, and this can only be set locally. Remote enquiries just get
1008 information about the top level address, not anything that it generated. */
1010 while (addr_new != NULL)
1013 address_item *addr = addr_new;
1015 addr_new = addr->next;
1020 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1021 debug_printf("Considering %s\n", addr->address);
1024 /* Handle generated pipe, file or reply addresses. We don't get these
1025 when handling EXPN, as it does only one level of expansion. */
1027 if (testflag(addr, af_pfr))
1034 if (addr->address[0] == '>')
1036 allow = testflag(addr, af_allow_reply);
1037 fprintf(f, "%s -> mail %s", addr->parent->address, addr->address + 1);
1041 allow = (addr->address[0] == '|')?
1042 testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1043 fprintf(f, "%s -> %s", addr->parent->address, addr->address);
1046 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1047 fprintf(f, "\n*** Error in setting up pipe, file, or autoreply:\n"
1048 "%s\n", addr->message);
1050 fprintf(f, "\n transport = %s\n", addr->transport->name);
1052 fprintf(f, " *** forbidden ***\n");
1057 /* Just in case some router parameter refers to it. */
1059 return_path = (addr->p.errors_address != NULL)?
1060 addr->p.errors_address : sender_address;
1062 /* Split the address into domain and local part, handling the %-hack if
1063 necessary, and then route it. While routing a sender address, set
1064 $sender_address to <> because that is what it will be if we were trying to
1065 send a bounce to the sender. */
1067 if (routed != NULL) *routed = FALSE;
1068 if ((rc = deliver_split_address(addr)) == OK)
1070 if (!is_recipient) sender_address = null_sender;
1071 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1072 &addr_succeed, verify_type);
1073 sender_address = save_sender; /* Put back the real sender */
1076 /* If routing an address succeeded, set the flag that remembers, for use when
1077 an ACL cached a sender verify (in case a callout fails). Then if routing set
1078 up a list of hosts or the transport has a host list, and the callout option
1079 is set, and we aren't in a host checking run, do the callout verification,
1080 and set another flag that notes that a callout happened. */
1084 if (routed != NULL) *routed = TRUE;
1087 host_item *host_list = addr->host_list;
1089 /* Make up some data for use in the case where there is no remote
1092 transport_feedback tf = {
1093 NULL, /* interface (=> any) */
1094 US"smtp", /* port */
1095 US"smtp", /* protocol */
1097 US"$smtp_active_hostname", /* helo_data */
1098 FALSE, /* hosts_override */
1099 FALSE, /* hosts_randomize */
1100 FALSE, /* gethostbyname */
1101 TRUE, /* qualify_single */
1102 FALSE /* search_parents */
1105 /* If verification yielded a remote transport, we want to use that
1106 transport's options, so as to mimic what would happen if we were really
1107 sending a message to this address. */
1109 if (addr->transport != NULL && !addr->transport->info->local)
1111 (void)(addr->transport->setup)(addr->transport, addr, &tf, 0, 0, NULL);
1113 /* If the transport has hosts and the router does not, or if the
1114 transport is configured to override the router's hosts, we must build a
1115 host list of the transport's hosts, and find the IP addresses */
1117 if (tf.hosts != NULL && (host_list == NULL || tf.hosts_override))
1120 uschar *save_deliver_domain = deliver_domain;
1121 uschar *save_deliver_localpart = deliver_localpart;
1123 host_list = NULL; /* Ignore the router's hosts */
1125 deliver_domain = addr->domain;
1126 deliver_localpart = addr->local_part;
1127 s = expand_string(tf.hosts);
1128 deliver_domain = save_deliver_domain;
1129 deliver_localpart = save_deliver_localpart;
1133 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1134 "\"%s\" in %s transport for callout: %s", tf.hosts,
1135 addr->transport->name, expand_string_message);
1140 uschar *canonical_name;
1141 host_item *host, *nexthost;
1142 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1144 /* Just ignore failures to find a host address. If we don't manage
1145 to find any addresses, the callout will defer. Note that more than
1146 one address may be found for a single host, which will result in
1147 additional host items being inserted into the chain. Hence we must
1148 save the next host first. */
1150 flags = HOST_FIND_BY_A;
1151 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1152 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1154 for (host = host_list; host != NULL; host = nexthost)
1156 nexthost = host->next;
1157 if (tf.gethostbyname ||
1158 string_is_ip_address(host->name, NULL) != 0)
1159 (void)host_find_byname(host, NULL, flags, &canonical_name, TRUE);
1161 (void)host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1162 &canonical_name, NULL);
1168 /* Can only do a callout if we have at least one host! If the callout
1169 fails, it will have set ${sender,recipient}_verify_failure. */
1171 if (host_list != NULL)
1173 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1174 if (host_checking && !host_checking_callout)
1177 debug_printf("... callout omitted by default when host testing\n"
1178 "(Use -bhc if you want the callouts to happen.)\n");
1182 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
1183 callout_connect, options, se_mailfrom, pm_mailfrom);
1188 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
1189 "transport provided a host list\n");
1194 /* Otherwise, any failure is a routing failure */
1196 else *failure_ptr = US"route";
1198 /* A router may return REROUTED if it has set up a child address as a result
1199 of a change of domain name (typically from widening). In this case we always
1200 want to continue to verify the new child. */
1202 if (rc == REROUTED) continue;
1204 /* Handle hard failures */
1211 address_item *p = addr->parent;
1213 fprintf(f, "%s%s %s", ko_prefix, full_info? addr->address : address,
1214 address_test_mode? "is undeliverable" : "failed to verify");
1215 if (!expn && admin_user)
1217 if (addr->basic_errno > 0)
1218 fprintf(f, ": %s", strerror(addr->basic_errno));
1219 if (addr->message != NULL)
1220 fprintf(f, ": %s", addr->message);
1223 /* Show parents iff doing full info */
1225 if (full_info) while (p != NULL)
1227 fprintf(f, "%s\n <-- %s", cr, p->address);
1230 fprintf(f, "%s\n", cr);
1233 if (!full_info) return copy_error(vaddr, addr, FAIL);
1239 else if (rc == DEFER)
1244 address_item *p = addr->parent;
1245 fprintf(f, "%s%s cannot be resolved at this time", ko_prefix,
1246 full_info? addr->address : address);
1247 if (!expn && admin_user)
1249 if (addr->basic_errno > 0)
1250 fprintf(f, ": %s", strerror(addr->basic_errno));
1251 if (addr->message != NULL)
1252 fprintf(f, ": %s", addr->message);
1253 else if (addr->basic_errno <= 0)
1254 fprintf(f, ": unknown error");
1257 /* Show parents iff doing full info */
1259 if (full_info) while (p != NULL)
1261 fprintf(f, "%s\n <-- %s", cr, p->address);
1264 fprintf(f, "%s\n", cr);
1267 if (!full_info) return copy_error(vaddr, addr, DEFER);
1268 else if (yield == OK) yield = DEFER;
1271 /* If we are handling EXPN, we do not want to continue to route beyond
1272 the top level (whose address is in "address"). */
1276 uschar *ok_prefix = US"250-";
1277 if (addr_new == NULL)
1279 if (addr_local == NULL && addr_remote == NULL)
1280 fprintf(f, "250 mail to <%s> is discarded\r\n", address);
1282 fprintf(f, "250 <%s>\r\n", address);
1284 else while (addr_new != NULL)
1286 address_item *addr2 = addr_new;
1287 addr_new = addr2->next;
1288 if (addr_new == NULL) ok_prefix = US"250 ";
1289 fprintf(f, "%s<%s>\r\n", ok_prefix, addr2->address);
1294 /* Successful routing other than EXPN. */
1298 /* Handle successful routing when short info wanted. Otherwise continue for
1299 other (generated) addresses. Short info is the operational case. Full info
1300 can be requested only when debug_selector != 0 and a file is supplied.
1302 There is a conflict between the use of aliasing as an alternate email
1303 address, and as a sort of mailing list. If an alias turns the incoming
1304 address into just one address (e.g. J.Caesar->jc44) you may well want to
1305 carry on verifying the generated address to ensure it is valid when
1306 checking incoming mail. If aliasing generates multiple addresses, you
1307 probably don't want to do this. Exim therefore treats the generation of
1308 just a single new address as a special case, and continues on to verify the
1309 generated address. */
1311 if (!full_info && /* Stop if short info wanted AND */
1312 (((addr_new == NULL || /* No new address OR */
1313 addr_new->next != NULL || /* More than one new address OR */
1314 testflag(addr_new, af_pfr))) /* New address is pfr */
1316 (addr_new != NULL && /* At least one new address AND */
1317 success_on_redirect))) /* success_on_redirect is set */
1319 if (f != NULL) fprintf(f, "%s %s\n", address,
1320 address_test_mode? "is deliverable" : "verified");
1322 /* If we have carried on to verify a child address, we want the value
1323 of $address_data to be that of the child */
1325 vaddr->p.address_data = addr->p.address_data;
1329 } /* Loop for generated addresses */
1331 /* Display the full results of the successful routing, including any generated
1332 addresses. Control gets here only when full_info is set, which requires f not
1333 to be NULL, and this occurs only when a top-level verify is called with the
1334 debugging switch on.
1336 If there are no local and no remote addresses, and there were no pipes, files,
1337 or autoreplies, and there were no errors or deferments, the message is to be
1338 discarded, usually because of the use of :blackhole: in an alias file. */
1340 if (allok && addr_local == NULL && addr_remote == NULL)
1342 fprintf(f, "mail to %s is discarded\n", address);
1346 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
1348 while (addr_list != NULL)
1350 address_item *addr = addr_list;
1351 address_item *p = addr->parent;
1352 addr_list = addr->next;
1354 fprintf(f, "%s", CS addr->address);
1355 #ifdef EXPERIMENTAL_SRS
1356 if(addr->p.srs_sender)
1357 fprintf(f, " [srs = %s]", addr->p.srs_sender);
1360 /* If the address is a duplicate, show something about it. */
1362 if (!testflag(addr, af_pfr))
1365 if ((tnode = tree_search(tree_duplicates, addr->unique)) != NULL)
1366 fprintf(f, " [duplicate, would not be delivered]");
1367 else tree_add_duplicate(addr->unique, addr);
1370 /* Now show its parents */
1374 fprintf(f, "\n <-- %s", p->address);
1379 /* Show router, and transport */
1381 fprintf(f, "router = %s, ", addr->router->name);
1382 fprintf(f, "transport = %s\n", (addr->transport == NULL)? US"unset" :
1383 addr->transport->name);
1385 /* Show any hosts that are set up by a router unless the transport
1386 is going to override them; fiddle a bit to get a nice format. */
1388 if (addr->host_list != NULL && addr->transport != NULL &&
1389 !addr->transport->overrides_hosts)
1394 for (h = addr->host_list; h != NULL; h = h->next)
1396 int len = Ustrlen(h->name);
1397 if (len > maxlen) maxlen = len;
1398 len = (h->address != NULL)? Ustrlen(h->address) : 7;
1399 if (len > maxaddlen) maxaddlen = len;
1401 for (h = addr->host_list; h != NULL; h = h->next)
1403 int len = Ustrlen(h->name);
1404 fprintf(f, " host %s ", h->name);
1405 while (len++ < maxlen) fprintf(f, " ");
1406 if (h->address != NULL)
1408 fprintf(f, "[%s] ", h->address);
1409 len = Ustrlen(h->address);
1411 else if (!addr->transport->info->local) /* Omit [unknown] for local */
1413 fprintf(f, "[unknown] ");
1417 while (len++ < maxaddlen) fprintf(f," ");
1418 if (h->mx >= 0) fprintf(f, "MX=%d", h->mx);
1419 if (h->port != PORT_NONE) fprintf(f, " port=%d", h->port);
1420 if (h->status == hstatus_unusable) fprintf(f, " ** unusable **");
1427 /* Will be DEFER or FAIL if any one address has, only for full_info (which is
1428 the -bv or -bt case). */
1436 /*************************************************
1437 * Check headers for syntax errors *
1438 *************************************************/
1440 /* This function checks those header lines that contain addresses, and verifies
1441 that all the addresses therein are syntactially correct.
1444 msgptr where to put an error message
1451 verify_check_headers(uschar **msgptr)
1457 for (h = header_list; h != NULL && yield == OK; h = h->next)
1459 if (h->type != htype_from &&
1460 h->type != htype_reply_to &&
1461 h->type != htype_sender &&
1462 h->type != htype_to &&
1463 h->type != htype_cc &&
1464 h->type != htype_bcc)
1467 colon = Ustrchr(h->text, ':');
1469 while (isspace(*s)) s++;
1471 /* Loop for multiple addresses in the header, enabling group syntax. Note
1472 that we have to reset this after the header has been scanned. */
1474 parse_allow_group = TRUE;
1478 uschar *ss = parse_find_address_end(s, FALSE);
1479 uschar *recipient, *errmess;
1480 int terminator = *ss;
1481 int start, end, domain;
1483 /* Temporarily terminate the string at this point, and extract the
1484 operative address within, allowing group syntax. */
1487 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
1490 /* Permit an unqualified address only if the message is local, or if the
1491 sending host is configured to be permitted to send them. */
1493 if (recipient != NULL && domain == 0)
1495 if (h->type == htype_from || h->type == htype_sender)
1497 if (!allow_unqualified_sender) recipient = NULL;
1501 if (!allow_unqualified_recipient) recipient = NULL;
1503 if (recipient == NULL) errmess = US"unqualified address not permitted";
1506 /* It's an error if no address could be extracted, except for the special
1507 case of an empty address. */
1509 if (recipient == NULL && Ustrcmp(errmess, "empty address") != 0)
1511 uschar *verb = US"is";
1516 /* Arrange not to include any white space at the end in the
1517 error message or the header name. */
1519 while (t > s && isspace(t[-1])) t--;
1520 while (tt > h->text && isspace(tt[-1])) tt--;
1522 /* Add the address that failed to the error message, since in a
1523 header with very many addresses it is sometimes hard to spot
1524 which one is at fault. However, limit the amount of address to
1525 quote - cases have been seen where, for example, a missing double
1526 quote in a humungous To: header creates an "address" that is longer
1527 than string_sprintf can handle. */
1536 *msgptr = string_printing(
1537 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
1538 errmess, tt - h->text, h->text, verb, len, s));
1541 break; /* Out of address loop */
1544 /* Advance to the next address */
1546 s = ss + (terminator? 1:0);
1547 while (isspace(*s)) s++;
1548 } /* Next address */
1550 parse_allow_group = FALSE;
1551 parse_found_group = FALSE;
1552 } /* Next header unless yield has been set FALSE */
1559 /*************************************************
1560 * Check for blind recipients *
1561 *************************************************/
1563 /* This function checks that every (envelope) recipient is mentioned in either
1564 the To: or Cc: header lines, thus detecting blind carbon copies.
1566 There are two ways of scanning that could be used: either scan the header lines
1567 and tick off the recipients, or scan the recipients and check the header lines.
1568 The original proposed patch did the former, but I have chosen to do the latter,
1569 because (a) it requires no memory and (b) will use fewer resources when there
1570 are many addresses in To: and/or Cc: and only one or two envelope recipients.
1573 Returns: OK if there are no blind recipients
1574 FAIL if there is at least one blind recipient
1578 verify_check_notblind(void)
1581 for (i = 0; i < recipients_count; i++)
1585 uschar *address = recipients_list[i].address;
1587 for (h = header_list; !found && h != NULL; h = h->next)
1591 if (h->type != htype_to && h->type != htype_cc) continue;
1593 colon = Ustrchr(h->text, ':');
1595 while (isspace(*s)) s++;
1597 /* Loop for multiple addresses in the header, enabling group syntax. Note
1598 that we have to reset this after the header has been scanned. */
1600 parse_allow_group = TRUE;
1604 uschar *ss = parse_find_address_end(s, FALSE);
1605 uschar *recipient,*errmess;
1606 int terminator = *ss;
1607 int start, end, domain;
1609 /* Temporarily terminate the string at this point, and extract the
1610 operative address within, allowing group syntax. */
1613 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
1616 /* If we found a valid recipient that has a domain, compare it with the
1617 envelope recipient. Local parts are compared case-sensitively, domains
1618 case-insensitively. By comparing from the start with length "domain", we
1619 include the "@" at the end, which ensures that we are comparing the whole
1620 local part of each address. */
1622 if (recipient != NULL && domain != 0)
1624 found = Ustrncmp(recipient, address, domain) == 0 &&
1625 strcmpic(recipient + domain, address + domain) == 0;
1629 /* Advance to the next address */
1631 s = ss + (terminator? 1:0);
1632 while (isspace(*s)) s++;
1633 } /* Next address */
1635 parse_allow_group = FALSE;
1636 parse_found_group = FALSE;
1637 } /* Next header (if found is false) */
1639 if (!found) return FAIL;
1640 } /* Next recipient */
1647 /*************************************************
1648 * Find if verified sender *
1649 *************************************************/
1651 /* Usually, just a single address is verified as the sender of the message.
1652 However, Exim can be made to verify other addresses as well (often related in
1653 some way), and this is useful in some environments. There may therefore be a
1654 chain of such addresses that have previously been tested. This function finds
1655 whether a given address is on the chain.
1657 Arguments: the address to be verified
1658 Returns: pointer to an address item, or NULL
1662 verify_checked_sender(uschar *sender)
1665 for (addr = sender_verified_list; addr != NULL; addr = addr->next)
1666 if (Ustrcmp(sender, addr->address) == 0) break;
1674 /*************************************************
1675 * Get valid header address *
1676 *************************************************/
1678 /* Scan the originator headers of the message, looking for an address that
1679 verifies successfully. RFC 822 says:
1681 o The "Sender" field mailbox should be sent notices of
1682 any problems in transport or delivery of the original
1683 messages. If there is no "Sender" field, then the
1684 "From" field mailbox should be used.
1686 o If the "Reply-To" field exists, then the reply should
1687 go to the addresses indicated in that field and not to
1688 the address(es) indicated in the "From" field.
1690 So we check a Sender field if there is one, else a Reply_to field, else a From
1691 field. As some strange messages may have more than one of these fields,
1692 especially if they are resent- fields, check all of them if there is more than
1696 user_msgptr points to where to put a user error message
1697 log_msgptr points to where to put a log error message
1698 callout timeout for callout check (passed to verify_address())
1699 callout_overall overall callout timeout (ditto)
1700 callout_connect connect callout timeout (ditto)
1701 se_mailfrom mailfrom for verify; NULL => ""
1702 pm_mailfrom sender for pm callout check (passed to verify_address())
1703 options callout options (passed to verify_address())
1704 verrno where to put the address basic_errno
1706 If log_msgptr is set to something without setting user_msgptr, the caller
1707 normally uses log_msgptr for both things.
1709 Returns: result of the verification attempt: OK, FAIL, or DEFER;
1710 FAIL is given if no appropriate headers are found
1714 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
1715 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
1716 uschar *pm_mailfrom, int options, int *verrno)
1718 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
1723 for (i = 0; i < 3 && !done; i++)
1726 for (h = header_list; h != NULL && !done; h = h->next)
1728 int terminator, new_ok;
1729 uschar *s, *ss, *endname;
1731 if (h->type != header_types[i]) continue;
1732 s = endname = Ustrchr(h->text, ':') + 1;
1734 /* Scan the addresses in the header, enabling group syntax. Note that we
1735 have to reset this after the header has been scanned. */
1737 parse_allow_group = TRUE;
1741 address_item *vaddr;
1743 while (isspace(*s) || *s == ',') s++;
1744 if (*s == 0) break; /* End of header */
1746 ss = parse_find_address_end(s, FALSE);
1748 /* The terminator is a comma or end of header, but there may be white
1749 space preceding it (including newline for the last address). Move back
1750 past any white space so we can check against any cached envelope sender
1751 address verifications. */
1753 while (isspace(ss[-1])) ss--;
1757 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
1758 (int)(endname - h->text), h->text, s);
1760 /* See if we have already verified this address as an envelope sender,
1761 and if so, use the previous answer. */
1763 vaddr = verify_checked_sender(s);
1765 if (vaddr != NULL && /* Previously checked */
1766 (callout <= 0 || /* No callout needed; OR */
1767 vaddr->special_action > 256)) /* Callout was done */
1769 new_ok = vaddr->special_action & 255;
1770 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
1771 *ss = terminator; /* Restore shortened string */
1774 /* Otherwise we run the verification now. We must restore the shortened
1775 string before running the verification, so the headers are correct, in
1776 case there is any rewriting. */
1780 int start, end, domain;
1781 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
1786 /* If we found an empty address, just carry on with the next one, but
1787 kill the message. */
1789 if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0)
1796 /* If verification failed because of a syntax error, fail this
1797 function, and ensure that the failing address gets added to the error
1800 if (address == NULL)
1803 while (ss > s && isspace(ss[-1])) ss--;
1804 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
1805 "scanning for sender: %s in \"%.*s\"",
1806 endname - h->text, h->text, *log_msgptr, ss - s, s);
1812 /* Else go ahead with the sender verification. But it isn't *the*
1813 sender of the message, so set vopt_fake_sender to stop sender_address
1814 being replaced after rewriting or qualification. */
1818 vaddr = deliver_make_addr(address, FALSE);
1819 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
1820 callout, callout_overall, callout_connect, se_mailfrom,
1825 /* We now have the result, either newly found, or cached. If we are
1826 giving out error details, set a specific user error. This means that the
1827 last of these will be returned to the user if all three fail. We do not
1828 set a log message - the generic one below will be used. */
1832 *verrno = vaddr->basic_errno;
1833 if (smtp_return_error_details)
1835 *user_msgptr = string_sprintf("Rejected after DATA: "
1836 "could not verify \"%.*s\" header address\n%s: %s",
1837 endname - h->text, h->text, vaddr->address, vaddr->message);
1841 /* Success or defer */
1850 if (new_ok == DEFER) yield = DEFER;
1852 /* Move on to any more addresses in the header */
1855 } /* Next address */
1857 parse_allow_group = FALSE;
1858 parse_found_group = FALSE;
1859 } /* Next header, unless done */
1860 } /* Next header type unless done */
1862 if (yield == FAIL && *log_msgptr == NULL)
1863 *log_msgptr = US"there is no valid sender in any header line";
1865 if (yield == DEFER && *log_msgptr == NULL)
1866 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
1874 /*************************************************
1875 * Get RFC 1413 identification *
1876 *************************************************/
1878 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
1879 the timeout is set to zero, then the query is not done. There may also be lists
1880 of hosts and nets which are exempt. To guard against malefactors sending
1881 non-printing characters which could, for example, disrupt a message's headers,
1882 make sure the string consists of printing characters only.
1885 port the port to connect to; usually this is IDENT_PORT (113), but when
1886 running in the test harness with -bh a different value is used.
1890 Side effect: any received ident value is put in sender_ident (NULL otherwise)
1894 verify_get_ident(int port)
1896 int sock, host_af, qlen;
1897 int received_sender_port, received_interface_port, n;
1899 uschar buffer[2048];
1901 /* Default is no ident. Check whether we want to do an ident check for this
1904 sender_ident = NULL;
1905 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
1908 DEBUG(D_ident) debug_printf("doing ident callback\n");
1910 /* Set up a connection to the ident port of the remote host. Bind the local end
1911 to the incoming interface address. If the sender host address is an IPv6
1912 address, the incoming interface address will also be IPv6. */
1914 host_af = (Ustrchr(sender_host_address, ':') == NULL)? AF_INET : AF_INET6;
1915 sock = ip_socket(SOCK_STREAM, host_af);
1916 if (sock < 0) return;
1918 if (ip_bind(sock, host_af, interface_address, 0) < 0)
1920 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
1925 if (ip_connect(sock, host_af, sender_host_address, port, rfc1413_query_timeout)
1928 if (errno == ETIMEDOUT && (log_extra_selector & LX_ident_timeout) != 0)
1930 log_write(0, LOG_MAIN, "ident connection to %s timed out",
1931 sender_host_address);
1935 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
1936 sender_host_address, strerror(errno));
1941 /* Construct and send the query. */
1943 sprintf(CS buffer, "%d , %d\r\n", sender_host_port, interface_port);
1944 qlen = Ustrlen(buffer);
1945 if (send(sock, buffer, qlen, 0) < 0)
1947 DEBUG(D_ident) debug_printf("ident send failed: %s\n", strerror(errno));
1951 /* Read a response line. We put it into the rest of the buffer, using several
1952 recv() calls if necessary. */
1960 int size = sizeof(buffer) - (p - buffer);
1962 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
1963 count = ip_recv(sock, p, size, rfc1413_query_timeout);
1964 if (count <= 0) goto END_OFF; /* Read error or EOF */
1966 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
1967 generous, and accept a plain \n terminator as well. The only illegal
1970 for (pp = p; pp < p + count; pp++)
1972 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
1975 if (pp[-1] == '\r') pp--;
1977 goto GOT_DATA; /* Break out of both loops */
1981 /* Reached the end of the data without finding \n. Let the loop continue to
1982 read some more, if there is room. */
1989 /* We have received a line of data. Check it carefully. It must start with the
1990 same two port numbers that we sent, followed by data as defined by the RFC. For
1993 12345 , 25 : USERID : UNIX :root
1995 However, the amount of white space may be different to what we sent. In the
1996 "osname" field there may be several sub-fields, comma separated. The data we
1997 actually want to save follows the third colon. Some systems put leading spaces
1998 in it - we discard those. */
2000 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2001 &received_interface_port, &n) != 2 ||
2002 received_sender_port != sender_host_port ||
2003 received_interface_port != interface_port)
2006 p = buffer + qlen + n;
2007 while(isspace(*p)) p++;
2008 if (*p++ != ':') goto END_OFF;
2009 while(isspace(*p)) p++;
2010 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2012 while(isspace(*p)) p++;
2013 if (*p++ != ':') goto END_OFF;
2014 while (*p != 0 && *p != ':') p++;
2015 if (*p++ == 0) goto END_OFF;
2016 while(isspace(*p)) p++;
2017 if (*p == 0) goto END_OFF;
2019 /* The rest of the line is the data we want. We turn it into printing
2020 characters when we save it, so that it cannot mess up the format of any logging
2021 or Received: lines into which it gets inserted. We keep a maximum of 127
2024 sender_ident = string_printing(string_copyn(p, 127));
2025 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2035 /*************************************************
2036 * Match host to a single host-list item *
2037 *************************************************/
2039 /* This function compares a host (name or address) against a single item
2040 from a host list. The host name gets looked up if it is needed and is not
2041 already known. The function is called from verify_check_this_host() via
2042 match_check_list(), which is why most of its arguments are in a single block.
2045 arg the argument block (see below)
2046 ss the host-list item
2047 valueptr where to pass back looked up data, or NULL
2048 error for error message when returning ERROR
2051 host_name (a) the host name, or
2052 (b) NULL, implying use sender_host_name and
2053 sender_host_aliases, looking them up if required, or
2054 (c) the empty string, meaning that only IP address matches
2056 host_address the host address
2057 host_ipv4 the IPv4 address taken from an IPv6 one
2061 DEFER lookup deferred
2062 ERROR (a) failed to find the host name or IP address, or
2063 (b) unknown lookup type specified, or
2064 (c) host name encountered when only IP addresses are
2069 check_host(void *arg, uschar *ss, uschar **valueptr, uschar **error)
2071 check_host_block *cb = (check_host_block *)arg;
2074 BOOL iplookup = FALSE;
2075 BOOL isquery = FALSE;
2076 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
2081 /* Optimize for the special case when the pattern is "*". */
2083 if (*ss == '*' && ss[1] == 0) return OK;
2085 /* If the pattern is empty, it matches only in the case when there is no host -
2086 this can occur in ACL checking for SMTP input using the -bs option. In this
2087 situation, the host address is the empty string. */
2089 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2090 if (*ss == 0) return FAIL;
2092 /* If the pattern is precisely "@" then match against the primary host name,
2093 provided that host name matching is permitted; if it's "@[]" match against the
2094 local host's IP addresses. */
2100 if (isiponly) return ERROR;
2101 ss = primary_hostname;
2103 else if (Ustrcmp(ss, "@[]") == 0)
2105 ip_address_item *ip;
2106 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
2107 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2112 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2113 a (possibly masked) comparision with the current IP address. */
2115 if (string_is_ip_address(ss, &maskoffset) != 0)
2116 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2118 /* The pattern is not an IP address. A common error that people make is to omit
2119 one component of an IPv4 address, either by accident, or believing that, for
2120 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2121 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2122 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2123 ancient specification.) To aid in debugging these cases, we give a specific
2124 error if the pattern contains only digits and dots or contains a slash preceded
2125 only by digits and dots (a slash at the start indicates a file name and of
2126 course slashes may be present in lookups, but not preceded only by digits and
2129 for (t = ss; isdigit(*t) || *t == '.'; t++);
2130 if (*t == 0 || (*t == '/' && t != ss))
2132 *error = US"malformed IPv4 address or address mask";
2136 /* See if there is a semicolon in the pattern */
2138 semicolon = Ustrchr(ss, ';');
2140 /* If we are doing an IP address only match, then all lookups must be IP
2141 address lookups, even if there is no "net-". */
2145 iplookup = semicolon != NULL;
2148 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
2149 a lookup on a masked IP network, in textual form. We obey this code even if we
2150 have already set iplookup, so as to skip over the "net-" prefix and to set the
2151 mask length. The net- stuff really only applies to single-key lookups where the
2152 key is implicit. For query-style lookups the key is specified in the query.
2153 From release 4.30, the use of net- for query style is no longer needed, but we
2154 retain it for backward compatibility. */
2156 if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL)
2159 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2160 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2161 iplookup = (*t++ == '-');
2165 /* Do the IP address lookup if that is indeed what we have */
2173 uschar *filename, *key, *result;
2176 /* Find the search type */
2178 search_type = search_findtype(t, semicolon - t);
2180 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2181 search_error_message);
2183 /* Adjust parameters for the type of lookup. For a query-style lookup, there
2184 is no file name, and the "key" is just the query. For query-style with a file
2185 name, we have to fish the file off the start of the query. For a single-key
2186 lookup, the key is the current IP address, masked appropriately, and
2187 reconverted to text form, with the mask appended. For IPv6 addresses, specify
2188 dot separators instead of colons. */
2190 if (mac_islookup(search_type, lookup_absfilequery))
2192 filename = semicolon + 1;
2194 while (*key != 0 && !isspace(*key)) key++;
2195 filename = string_copyn(filename, key - filename);
2196 while (isspace(*key)) key++;
2198 else if (mac_islookup(search_type, lookup_querystyle))
2201 key = semicolon + 1;
2205 insize = host_aton(cb->host_address, incoming);
2206 host_mask(insize, incoming, mlen);
2207 (void)host_nmtoa(insize, incoming, mlen, buffer, '.');
2209 filename = semicolon + 1;
2212 /* Now do the actual lookup; note that there is no search_close() because
2213 of the caching arrangements. */
2215 handle = search_open(filename, search_type, 0, NULL, NULL);
2216 if (handle == NULL) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2217 search_error_message);
2218 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL);
2219 if (valueptr != NULL) *valueptr = result;
2220 return (result != NULL)? OK : search_find_defer? DEFER: FAIL;
2223 /* The pattern is not an IP address or network reference of any kind. That is,
2224 it is a host name pattern. If this is an IP only match, there's an error in the
2229 *error = US"cannot match host name in match_ip list";
2233 /* Check the characters of the pattern to see if they comprise only letters,
2234 digits, full stops, and hyphens (the constituents of domain names). Allow
2235 underscores, as they are all too commonly found. Sigh. Also, if
2236 allow_utf8_domains is set, allow top-bit characters. */
2238 for (t = ss; *t != 0; t++)
2239 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
2240 (!allow_utf8_domains || *t < 128)) break;
2242 /* If the pattern is a complete domain name, with no fancy characters, look up
2243 its IP address and match against that. Note that a multi-homed host will add
2244 items to the chain. */
2255 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
2256 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
2259 for (hh = &h; hh != NULL; hh = hh->next)
2261 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
2265 if (rc == HOST_FIND_AGAIN) return DEFER;
2266 *error = string_sprintf("failed to find IP address for %s", ss);
2270 /* Almost all subsequent comparisons require the host name, and can be done
2271 using the general string matching function. When this function is called for
2272 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
2273 must use sender_host_name and its aliases, looking them up if necessary. */
2275 if (cb->host_name != NULL) /* Explicit host name given */
2276 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
2279 /* Host name not given; in principle we need the sender host name and its
2280 aliases. However, for query-style lookups, we do not need the name if the
2281 query does not contain $sender_host_name. From release 4.23, a reference to
2282 $sender_host_name causes it to be looked up, so we don't need to do the lookup
2285 if ((semicolon = Ustrchr(ss, ';')) != NULL)
2288 int partial, affixlen, starflags, id;
2291 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags);
2294 if (id < 0) /* Unknown lookup type */
2296 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
2297 search_error_message, ss);
2300 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
2305 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
2308 case DEFER: return DEFER;
2309 default: return FAIL;
2313 /* Not a query-style lookup; must ensure the host name is present, and then we
2314 do a check on the name and all its aliases. */
2316 if (sender_host_name == NULL)
2318 HDEBUG(D_host_lookup)
2319 debug_printf("sender host name required, to match against %s\n", ss);
2320 if (host_lookup_failed || host_name_lookup() != OK)
2322 *error = string_sprintf("failed to find host name for %s",
2323 sender_host_address);;
2326 host_build_sender_fullhost();
2329 /* Match on the sender host name, using the general matching function */
2331 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE,
2335 case DEFER: return DEFER;
2338 /* If there are aliases, try matching on them. */
2340 aliases = sender_host_aliases;
2341 while (*aliases != NULL)
2343 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
2346 case DEFER: return DEFER;
2355 /*************************************************
2356 * Check a specific host matches a host list *
2357 *************************************************/
2359 /* This function is passed a host list containing items in a number of
2360 different formats and the identity of a host. Its job is to determine whether
2361 the given host is in the set of hosts defined by the list. The host name is
2362 passed as a pointer so that it can be looked up if needed and not already
2363 known. This is commonly the case when called from verify_check_host() to check
2364 an incoming connection. When called from elsewhere the host name should usually
2367 This function is now just a front end to match_check_list(), which runs common
2368 code for scanning a list. We pass it the check_host() function to perform a
2372 listptr pointer to the host list
2373 cache_bits pointer to cache for named lists, or NULL
2374 host_name the host name or NULL, implying use sender_host_name and
2375 sender_host_aliases, looking them up if required
2376 host_address the IP address
2377 valueptr if not NULL, data from a lookup is passed back here
2379 Returns: OK if the host is in the defined set
2380 FAIL if the host is not in the defined set,
2381 DEFER if a data lookup deferred (not a host lookup)
2383 If the host name was needed in order to make a comparison, and could not be
2384 determined from the IP address, the result is FAIL unless the item
2385 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
2388 verify_check_this_host(uschar **listptr, unsigned int *cache_bits,
2389 uschar *host_name, uschar *host_address, uschar **valueptr)
2392 unsigned int *local_cache_bits = cache_bits;
2393 uschar *save_host_address = deliver_host_address;
2394 check_host_block cb;
2395 cb.host_name = host_name;
2396 cb.host_address = host_address;
2398 if (valueptr != NULL) *valueptr = NULL;
2400 /* If the host address starts off ::ffff: it is an IPv6 address in
2401 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
2404 cb.host_ipv4 = (Ustrncmp(host_address, "::ffff:", 7) == 0)?
2405 host_address + 7 : host_address;
2407 /* During the running of the check, put the IP address into $host_address. In
2408 the case of calls from the smtp transport, it will already be there. However,
2409 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
2410 the safe side, any existing setting is preserved, though as I write this
2411 (November 2004) I can't see any cases where it is actually needed. */
2413 deliver_host_address = host_address;
2414 rc = match_check_list(
2415 listptr, /* the list */
2416 0, /* separator character */
2417 &hostlist_anchor, /* anchor pointer */
2418 &local_cache_bits, /* cache pointer */
2419 check_host, /* function for testing */
2420 &cb, /* argument for function */
2421 MCL_HOST, /* type of check */
2422 (host_address == sender_host_address)?
2423 US"host" : host_address, /* text for debugging */
2424 valueptr); /* where to pass back data */
2425 deliver_host_address = save_host_address;
2432 /*************************************************
2433 * Check the remote host matches a list *
2434 *************************************************/
2436 /* This is a front end to verify_check_this_host(), created because checking
2437 the remote host is a common occurrence. With luck, a good compiler will spot
2438 the tail recursion and optimize it. If there's no host address, this is
2439 command-line SMTP input - check against an empty string for the address.
2442 listptr pointer to the host list
2444 Returns: the yield of verify_check_this_host(),
2445 i.e. OK, FAIL, or DEFER
2449 verify_check_host(uschar **listptr)
2451 return verify_check_this_host(listptr, sender_host_cache, NULL,
2452 (sender_host_address == NULL)? US"" : sender_host_address, NULL);
2459 /*************************************************
2460 * Invert an IP address for a DNS black list *
2461 *************************************************/
2465 buffer where to put the answer
2466 address the address to invert
2470 invert_address(uschar *buffer, uschar *address)
2473 uschar *bptr = buffer;
2475 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
2476 to the IPv4 part only. */
2478 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
2480 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
2483 if (host_aton(address, bin) == 1)
2487 for (i = 0; i < 4; i++)
2489 sprintf(CS bptr, "%d.", x & 255);
2490 while (*bptr) bptr++;
2495 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
2496 in any DNS black lists, and the format in which they will be looked up is
2497 unknown. This is just a guess. */
2503 for (j = 3; j >= 0; j--)
2506 for (i = 0; i < 8; i++)
2508 sprintf(CS bptr, "%x.", x & 15);
2509 while (*bptr) bptr++;
2516 /* Remove trailing period -- this is needed so that both arbitrary
2517 dnsbl keydomains and inverted addresses may be combined with the
2518 same format string, "%s.%s" */
2525 /*************************************************
2526 * Perform a single dnsbl lookup *
2527 *************************************************/
2529 /* This function is called from verify_check_dnsbl() below. It is also called
2530 recursively from within itself when domain and domain_txt are different
2531 pointers, in order to get the TXT record from the alternate domain.
2534 domain the outer dnsbl domain
2535 domain_txt alternate domain to lookup TXT record on success; when the
2536 same domain is to be used, domain_txt == domain (that is,
2537 the pointers must be identical, not just the text)
2538 keydomain the current keydomain (for debug message)
2539 prepend subdomain to lookup (like keydomain, but
2540 reversed if IP address)
2541 iplist the list of matching IP addresses, or NULL for "any"
2542 bitmask true if bitmask matching is wanted
2543 invert_result true if result to be inverted
2544 defer_return what to return for a defer
2546 Returns: OK if lookup succeeded
2551 one_check_dnsbl(uschar *domain, uschar *domain_txt, uschar *keydomain,
2552 uschar *prepend, uschar *iplist, BOOL bitmask, BOOL invert_result,
2558 dnsbl_cache_block *cb;
2559 int old_pool = store_pool;
2560 uschar query[256]; /* DNS domain max length */
2562 /* Construct the specific query domainname */
2564 if (!string_format(query, sizeof(query), "%s.%s", prepend, domain))
2566 log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long "
2567 "(ignored): %s...", query);
2571 /* Look for this query in the cache. */
2573 t = tree_search(dnsbl_cache, query);
2575 /* If not cached from a previous lookup, we must do a DNS lookup, and
2576 cache the result in permanent memory. */
2580 store_pool = POOL_PERM;
2582 /* Set up a tree entry to cache the lookup */
2584 t = store_get(sizeof(tree_node) + Ustrlen(query));
2585 Ustrcpy(t->name, query);
2586 t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block));
2587 (void)tree_insertnode(&dnsbl_cache, t);
2589 /* Do the DNS loopup . */
2591 HDEBUG(D_dnsbl) debug_printf("new DNS lookup for %s\n", query);
2592 cb->rc = dns_basic_lookup(&dnsa, query, T_A);
2593 cb->text_set = FALSE;
2597 /* If the lookup succeeded, cache the RHS address. The code allows for
2598 more than one address - this was for complete generality and the possible
2599 use of A6 records. However, A6 records have been reduced to experimental
2600 status (August 2001) and may die out. So they may never get used at all,
2601 let alone in dnsbl records. However, leave the code here, just in case.
2603 Quite apart from one A6 RR generating multiple addresses, there are DNS
2604 lists that return more than one A record, so we must handle multiple
2605 addresses generated in that way as well. */
2607 if (cb->rc == DNS_SUCCEED)
2610 dns_address **addrp = &(cb->rhs);
2611 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2613 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2615 if (rr->type == T_A)
2617 dns_address *da = dns_address_from_rr(&dnsa, rr);
2621 while (da->next != NULL) da = da->next;
2622 addrp = &(da->next);
2627 /* If we didn't find any A records, change the return code. This can
2628 happen when there is a CNAME record but there are no A records for what
2631 if (cb->rhs == NULL) cb->rc = DNS_NODATA;
2634 store_pool = old_pool;
2637 /* Previous lookup was cached */
2641 HDEBUG(D_dnsbl) debug_printf("using result of previous DNS lookup\n");
2645 /* We now have the result of the DNS lookup, either newly done, or cached
2646 from a previous call. If the lookup succeeded, check against the address
2647 list if there is one. This may be a positive equality list (introduced by
2648 "="), a negative equality list (introduced by "!="), a positive bitmask
2649 list (introduced by "&"), or a negative bitmask list (introduced by "!&").*/
2651 if (cb->rc == DNS_SUCCEED)
2653 dns_address *da = NULL;
2654 uschar *addlist = cb->rhs->address;
2656 /* For A and AAAA records, there may be multiple addresses from multiple
2657 records. For A6 records (currently not expected to be used) there may be
2658 multiple addresses from a single record. */
2660 for (da = cb->rhs->next; da != NULL; da = da->next)
2661 addlist = string_sprintf("%s, %s", addlist, da->address);
2663 HDEBUG(D_dnsbl) debug_printf("DNS lookup for %s succeeded (yielding %s)\n",
2666 /* Address list check; this can be either for equality, or via a bitmask.
2667 In the latter case, all the bits must match. */
2673 uschar *ptr = iplist;
2675 while (string_nextinlist(&ptr, &ipsep, ip, sizeof(ip)) != NULL)
2677 /* Handle exact matching */
2680 for (da = cb->rhs; da != NULL; da = da->next)
2682 if (Ustrcmp(CS da->address, ip) == 0) break;
2685 /* Handle bitmask matching */
2691 /* At present, all known DNS blocking lists use A records, with
2692 IPv4 addresses on the RHS encoding the information they return. I
2693 wonder if this will linger on as the last vestige of IPv4 when IPv6
2694 is ubiquitous? Anyway, for now we use paranoia code to completely
2695 ignore IPv6 addresses. The default mask is 0, which always matches.
2696 We change this only for IPv4 addresses in the list. */
2698 if (host_aton(ip, address) == 1) mask = address[0];
2700 /* Scan the returned addresses, skipping any that are IPv6 */
2702 for (da = cb->rhs; da != NULL; da = da->next)
2704 if (host_aton(da->address, address) != 1) continue;
2705 if ((address[0] & mask) == mask) break;
2709 /* Break out if a match has been found */
2711 if (da != NULL) break;
2716 (a) No IP address in a positive list matched, or
2717 (b) An IP address in a negative list did match
2719 then behave as if the DNSBL lookup had not succeeded, i.e. the host is
2722 if (invert_result != (da == NULL))
2726 debug_printf("=> but we are not accepting this block class because\n");
2727 debug_printf("=> there was %s match for %c%s\n",
2728 invert_result? "an exclude":"no", bitmask? '&' : '=', iplist);
2734 /* Either there was no IP list, or the record matched, implying that the
2735 domain is on the list. We now want to find a corresponding TXT record. If an
2736 alternate domain is specified for the TXT record, call this function
2737 recursively to look that up; this has the side effect of re-checking that
2738 there is indeed an A record at the alternate domain. */
2740 if (domain_txt != domain)
2741 return one_check_dnsbl(domain_txt, domain_txt, keydomain, prepend, NULL,
2742 FALSE, invert_result, defer_return);
2744 /* If there is no alternate domain, look up a TXT record in the main domain
2745 if it has not previously been cached. */
2749 cb->text_set = TRUE;
2750 if (dns_basic_lookup(&dnsa, query, T_TXT) == DNS_SUCCEED)
2753 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
2755 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
2756 if (rr->type == T_TXT) break;
2759 int len = (rr->data)[0];
2760 if (len > 511) len = 127;
2761 store_pool = POOL_PERM;
2762 cb->text = string_sprintf("%.*s", len, (const uschar *)(rr->data+1));
2763 store_pool = old_pool;
2768 dnslist_value = addlist;
2769 dnslist_text = cb->text;
2773 /* There was a problem with the DNS lookup */
2775 if (cb->rc != DNS_NOMATCH && cb->rc != DNS_NODATA)
2777 log_write(L_dnslist_defer, LOG_MAIN,
2778 "DNS list lookup defer (probably timeout) for %s: %s", query,
2779 (defer_return == OK)? US"assumed in list" :
2780 (defer_return == FAIL)? US"assumed not in list" :
2781 US"returned DEFER");
2782 return defer_return;
2785 /* No entry was found in the DNS; continue for next domain */
2789 debug_printf("DNS lookup for %s failed\n", query);
2790 debug_printf("=> that means %s is not listed at %s\n",
2800 /*************************************************
2801 * Check host against DNS black lists *
2802 *************************************************/
2804 /* This function runs checks against a list of DNS black lists, until one
2805 matches. Each item on the list can be of the form
2807 domain=ip-address/key
2809 The domain is the right-most domain that is used for the query, for example,
2810 blackholes.mail-abuse.org. If the IP address is present, there is a match only
2811 if the DNS lookup returns a matching IP address. Several addresses may be
2812 given, comma-separated, for example: x.y.z=127.0.0.1,127.0.0.2.
2814 If no key is given, what is looked up in the domain is the inverted IP address
2815 of the current client host. If a key is given, it is used to construct the
2816 domain for the lookup. For example:
2818 dsn.rfc-ignorant.org/$sender_address_domain
2820 After finding a match in the DNS, the domain is placed in $dnslist_domain, and
2821 then we check for a TXT record for an error message, and if found, save its
2822 value in $dnslist_text. We also cache everything in a tree, to optimize
2825 The TXT record is normally looked up in the same domain as the A record, but
2826 when many lists are combined in a single DNS domain, this will not be a very
2827 specific message. It is possible to specify a different domain for looking up
2828 TXT records; this is given before the main domain, comma-separated. For
2831 dnslists = http.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.2 : \
2832 socks.dnsbl.sorbs.net,dnsbl.sorbs.net=127.0.0.3
2834 The caching ensures that only one lookup in dnsbl.sorbs.net is done.
2836 Note: an address for testing RBL is 192.203.178.39
2837 Note: an address for testing DUL is 192.203.178.4
2838 Note: a domain for testing RFCI is example.tld.dsn.rfc-ignorant.org
2841 listptr the domain/address/data list
2843 Returns: OK successful lookup (i.e. the address is on the list), or
2844 lookup deferred after +include_unknown
2845 FAIL name not found, or no data found for the given type, or
2846 lookup deferred after +exclude_unknown (default)
2847 DEFER lookup failure, if +defer_unknown was set
2851 verify_check_dnsbl(uschar **listptr)
2854 int defer_return = FAIL;
2855 BOOL invert_result = FALSE;
2856 uschar *list = *listptr;
2859 uschar buffer[1024];
2860 uschar revadd[128]; /* Long enough for IPv6 address */
2862 /* Indicate that the inverted IP address is not yet set up */
2866 /* In case this is the first time the DNS resolver is being used. */
2868 dns_init(FALSE, FALSE);
2870 /* Loop through all the domains supplied, until something matches */
2872 while ((domain = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
2875 BOOL bitmask = FALSE;
2881 HDEBUG(D_dnsbl) debug_printf("DNS list check: %s\n", domain);
2883 /* Deal with special values that change the behaviour on defer */
2885 if (domain[0] == '+')
2887 if (strcmpic(domain, US"+include_unknown") == 0) defer_return = OK;
2888 else if (strcmpic(domain, US"+exclude_unknown") == 0) defer_return = FAIL;
2889 else if (strcmpic(domain, US"+defer_unknown") == 0) defer_return = DEFER;
2891 log_write(0, LOG_MAIN|LOG_PANIC, "unknown item in dnslist (ignored): %s",
2896 /* See if there's explicit data to be looked up */
2898 key = Ustrchr(domain, '/');
2899 if (key != NULL) *key++ = 0;
2901 /* See if there's a list of addresses supplied after the domain name. This is
2902 introduced by an = or a & character; if preceded by ! we invert the result.
2905 iplist = Ustrchr(domain, '=');
2909 iplist = Ustrchr(domain, '&');
2914 if (iplist > domain && iplist[-1] == '!')
2916 invert_result = TRUE;
2922 /* If there is a comma in the domain, it indicates that a second domain for
2923 looking up TXT records is provided, before the main domain. Otherwise we must
2924 set domain_txt == domain. */
2926 domain_txt = domain;
2927 comma = Ustrchr(domain, ',');
2934 /* Check that what we have left is a sensible domain name. There is no reason
2935 why these domains should in fact use the same syntax as hosts and email
2936 domains, but in practice they seem to. However, there is little point in
2937 actually causing an error here, because that would no doubt hold up incoming
2938 mail. Instead, I'll just log it. */
2940 for (s = domain; *s != 0; s++)
2942 if (!isalnum(*s) && *s != '-' && *s != '.')
2944 log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains "
2945 "strange characters - is this right?", domain);
2950 /* Check the alternate domain if present */
2952 if (domain_txt != domain) for (s = domain_txt; *s != 0; s++)
2954 if (!isalnum(*s) && *s != '-' && *s != '.')
2956 log_write(0, LOG_MAIN, "dnslists domain \"%s\" contains "
2957 "strange characters - is this right?", domain_txt);
2962 /* If there is no key string, construct the query by adding the domain name
2963 onto the inverted host address, and perform a single DNS lookup. */
2967 if (sender_host_address == NULL) return FAIL; /* can never match */
2968 if (revadd[0] == 0) invert_address(revadd, sender_host_address);
2969 rc = one_check_dnsbl(domain, domain_txt, sender_host_address, revadd,
2970 iplist, bitmask, invert_result, defer_return);
2973 dnslist_domain = string_copy(domain_txt);
2974 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
2975 sender_host_address, dnslist_domain);
2977 if (rc != FAIL) return rc; /* OK or DEFER */
2980 /* If there is a key string, it can be a list of domains or IP addresses to
2981 be concatenated with the main domain. */
2988 uschar keybuffer[256];
2989 uschar keyrevadd[128];
2991 while ((keydomain = string_nextinlist(&key, &keysep, keybuffer,
2992 sizeof(keybuffer))) != NULL)
2994 uschar *prepend = keydomain;
2996 if (string_is_ip_address(keydomain, NULL) != 0)
2998 invert_address(keyrevadd, keydomain);
2999 prepend = keyrevadd;
3002 rc = one_check_dnsbl(domain, domain_txt, keydomain, prepend, iplist,
3003 bitmask, invert_result, defer_return);
3007 dnslist_domain = string_copy(domain_txt);
3008 HDEBUG(D_dnsbl) debug_printf("=> that means %s is listed at %s\n",
3009 keydomain, dnslist_domain);
3013 /* If the lookup deferred, remember this fact. We keep trying the rest
3014 of the list to see if we get a useful result, and if we don't, we return
3015 DEFER at the end. */
3017 if (rc == DEFER) defer = TRUE;
3018 } /* continue with next keystring domain/address */
3020 if (defer) return DEFER;
3022 } /* continue with next dnsdb outer domain */
3027 /* End of verify.c */