1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 - 2021 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Functions concerned with verifying things. The original code for callout
10 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
14 #include "transports/smtp.h"
16 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
17 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
18 static smtp_context ctctx;
19 uschar ctbuffer[8192];
22 static uschar cutthrough_response(client_conn_ctx *, char, uschar **, int);
26 /*************************************************
27 * Retrieve a callout cache record *
28 *************************************************/
30 /* If a record exists, check whether it has expired.
33 dbm_file an open hints file
35 type "address" or "domain"
36 positive_expire expire time for positive records
37 negative_expire expire time for negative records
39 Returns: the cache record if a non-expired one exists, else NULL
42 static dbdata_callout_cache *
43 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
44 int positive_expire, int negative_expire)
49 dbdata_callout_cache *cache_record;
51 if (!(cache_record = dbfn_read_with_length(dbm_file, key, &length)))
53 HDEBUG(D_verify) debug_printf_indent("callout cache: no %s record found for %s\n", type, key);
57 /* We treat a record as "negative" if its result field is not positive, or if
58 it is a domain record and the postmaster field is negative. */
60 negative = cache_record->result != ccache_accept ||
61 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
62 expire = negative? negative_expire : positive_expire;
65 if (now - cache_record->time_stamp > expire)
67 HDEBUG(D_verify) debug_printf_indent("callout cache: %s record expired for %s\n", type, key);
71 /* If this is a non-reject domain record, check for the obsolete format version
72 that doesn't have the postmaster and random timestamps, by looking at the
73 length. If so, copy it to a new-style block, replicating the record's
74 timestamp. Then check the additional timestamps. (There's no point wasting
75 effort if connections are rejected.) */
77 if (type[0] == 'd' && cache_record->result != ccache_reject)
79 if (length == sizeof(dbdata_callout_cache_obs))
81 dbdata_callout_cache * new = store_get(sizeof(dbdata_callout_cache), GET_UNTAINTED);
82 memcpy(new, cache_record, length);
83 new->postmaster_stamp = new->random_stamp = new->time_stamp;
87 if (now - cache_record->postmaster_stamp > expire)
88 cache_record->postmaster_result = ccache_unknown;
90 if (now - cache_record->random_stamp > expire)
91 cache_record->random_result = ccache_unknown;
94 HDEBUG(D_verify) debug_printf_indent("callout cache: found %s record for %s\n", type, key);
100 /* Check the callout cache.
101 Options * pm_mailfrom may be modified by cache partial results.
103 Return: TRUE if result found
107 cached_callout_lookup(address_item * addr, uschar * address_key,
108 uschar * from_address, int * opt_ptr, uschar ** pm_ptr,
109 int * yield, uschar ** failure_ptr,
110 dbdata_callout_cache * new_domain_record, int * old_domain_res)
112 int options = *opt_ptr;
114 open_db *dbm_file = NULL;
116 /* Open the callout cache database, if it exists, for reading only at this
117 stage, unless caching has been disabled. */
119 if (options & vopt_callout_no_cache)
121 HDEBUG(D_verify) debug_printf_indent("callout cache: disabled by no_cache\n");
123 else if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
125 HDEBUG(D_verify) debug_printf_indent("callout cache: not available\n");
129 /* If a cache database is available see if we can avoid the need to do an
130 actual callout by making use of previously-obtained data. */
132 dbdata_callout_cache_address * cache_address_record;
133 dbdata_callout_cache * cache_record = get_callout_cache_record(dbm_file,
134 addr->domain, US"domain",
135 callout_cache_domain_positive_expire, callout_cache_domain_negative_expire);
137 /* If an unexpired cache record was found for this domain, see if the callout
138 process can be short-circuited. */
142 /* In most cases, if an early command (up to and including MAIL FROM:<>)
143 was rejected, there is no point carrying on. The callout fails. However, if
144 we are doing a recipient verification with use_sender or use_postmaster
145 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
146 will be using a non-empty sender. We have to remember this situation so as
147 not to disturb the cached domain value if this whole verification succeeds
148 (we don't want it turning into "accept"). */
150 *old_domain_res = cache_record->result;
152 if ( cache_record->result == ccache_reject
153 || *from_address == 0 && cache_record->result == ccache_reject_mfnull)
156 debug_printf_indent("callout cache: domain gave initial rejection, or "
157 "does not accept HELO or MAIL FROM:<>\n");
158 setflag(addr, af_verify_nsfail);
159 addr->user_message = US"(result of an earlier callout reused).";
161 *failure_ptr = US"mail";
162 dbfn_close(dbm_file);
166 /* If a previous check on a "random" local part was accepted, we assume
167 that the server does not do any checking on local parts. There is therefore
168 no point in doing the callout, because it will always be successful. If a
169 random check previously failed, arrange not to do it again, but preserve
170 the data in the new record. If a random check is required but hasn't been
171 done, skip the remaining cache processing. */
173 if (options & vopt_callout_random) switch(cache_record->random_result)
177 debug_printf_indent("callout cache: domain accepts random addresses\n");
178 *failure_ptr = US"random";
179 dbfn_close(dbm_file);
180 return TRUE; /* Default yield is OK */
184 debug_printf_indent("callout cache: domain rejects random addresses\n");
185 *opt_ptr = options & ~vopt_callout_random;
186 new_domain_record->random_result = ccache_reject;
187 new_domain_record->random_stamp = cache_record->random_stamp;
192 debug_printf_indent("callout cache: need to check random address handling "
193 "(not cached or cache expired)\n");
194 dbfn_close(dbm_file);
198 /* If a postmaster check is requested, but there was a previous failure,
199 there is again no point in carrying on. If a postmaster check is required,
200 but has not been done before, we are going to have to do a callout, so skip
201 remaining cache processing. */
205 if (cache_record->postmaster_result == ccache_reject)
207 setflag(addr, af_verify_pmfail);
209 debug_printf_indent("callout cache: domain does not accept "
210 "RCPT TO:<postmaster@domain>\n");
212 *failure_ptr = US"postmaster";
213 setflag(addr, af_verify_pmfail);
214 addr->user_message = US"(result of earlier verification reused).";
215 dbfn_close(dbm_file);
218 if (cache_record->postmaster_result == ccache_unknown)
221 debug_printf_indent("callout cache: need to check RCPT "
222 "TO:<postmaster@domain> (not cached or cache expired)\n");
223 dbfn_close(dbm_file);
227 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
228 postmaster check if the address itself has to be checked. Also ensure
229 that the value in the cache record is preserved (with its old timestamp).
232 HDEBUG(D_verify) debug_printf_indent("callout cache: domain accepts RCPT "
233 "TO:<postmaster@domain>\n");
235 new_domain_record->postmaster_result = ccache_accept;
236 new_domain_record->postmaster_stamp = cache_record->postmaster_stamp;
240 /* We can't give a result based on information about the domain. See if there
241 is an unexpired cache record for this specific address (combined with the
242 sender address if we are doing a recipient callout with a non-empty sender).
245 if (!(cache_address_record = (dbdata_callout_cache_address *)
246 get_callout_cache_record(dbm_file, address_key, US"address",
247 callout_cache_positive_expire, callout_cache_negative_expire)))
249 dbfn_close(dbm_file);
253 if (cache_address_record->result == ccache_accept)
256 debug_printf_indent("callout cache: address record is positive\n");
261 debug_printf_indent("callout cache: address record is negative\n");
262 addr->user_message = US"Previous (cached) callout verification failure";
263 *failure_ptr = US"recipient";
267 /* Close the cache database while we actually do the callout for real. */
269 dbfn_close(dbm_file);
276 /* Write results to callout cache
279 cache_callout_write(dbdata_callout_cache * dom_rec, const uschar * domain,
280 int done, dbdata_callout_cache_address * addr_rec, uschar * address_key)
283 open_db *dbm_file = NULL;
285 /* If we get here with done == TRUE, a successful callout happened, and yield
286 will be set OK or FAIL according to the response to the RCPT command.
287 Otherwise, we looped through the hosts but couldn't complete the business.
288 However, there may be domain-specific information to cache in both cases.
290 The value of the result field in the new_domain record is ccache_unknown if
291 there was an error before or with MAIL FROM:, and errno was not zero,
292 implying some kind of I/O error. We don't want to write the cache in that case.
293 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
295 if (dom_rec->result != ccache_unknown)
296 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
298 HDEBUG(D_verify) debug_printf_indent("callout cache: not available\n");
302 (void)dbfn_write(dbm_file, domain, dom_rec,
303 (int)sizeof(dbdata_callout_cache));
304 HDEBUG(D_verify) debug_printf_indent("wrote callout cache domain record for %s:\n"
305 " result=%d postmaster=%d random=%d\n",
308 dom_rec->postmaster_result,
309 dom_rec->random_result);
312 /* If a definite result was obtained for the callout, cache it unless caching
315 if (done && addr_rec->result != ccache_unknown)
318 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE);
321 HDEBUG(D_verify) debug_printf_indent("no callout cache available\n");
325 (void)dbfn_write(dbm_file, address_key, addr_rec,
326 (int)sizeof(dbdata_callout_cache_address));
327 HDEBUG(D_verify) debug_printf_indent("wrote %s callout cache address record for %s\n",
328 addr_rec->result == ccache_accept ? "positive" : "negative",
333 if (dbm_file) dbfn_close(dbm_file);
337 /* Cutthrough-multi. If the existing cached cutthrough connection matches
338 the one we would make for a subsequent recipient, use it. Send the RCPT TO
339 and check the result, nonpipelined as it may be wanted immediately for
340 recipient-verification.
342 It seems simpler to deal with this case separately from the main callout loop.
343 We will need to remember it has sent, or not, so that rcpt-acl tail code
344 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
346 Return: TRUE for a definitive result for the recipient
349 cutthrough_multi(address_item * addr, host_item * host_list,
350 transport_feedback * tf, int * yield)
354 if (addr->transport == cutthrough.addr.transport)
355 for (host_item * host = host_list; host; host = host->next)
356 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
359 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
362 deliver_host = host->name;
363 deliver_host_address = host->address;
364 deliver_host_port = host->port;
365 deliver_domain = addr->domain;
366 transport_name = addr->transport->name;
368 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
370 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
372 || !smtp_get_port(tf->port, addr, &port, US"callout")
374 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
377 smtp_port_for_connect(host, port);
379 if ( ( interface == cutthrough.interface
381 && cutthrough.interface
382 && Ustrcmp(interface, cutthrough.interface) == 0
384 && host->port == cutthrough.host.port
387 uschar * resp = NULL;
389 /* Match! Send the RCPT TO, set done from the response */
391 smtp_write_command(&ctctx, SCMD_FLUSH, "RCPT TO:<%.1000s>\r\n",
392 transport_rcpt_address(addr,
393 addr->transport->rcpt_include_affixes)) >= 0
394 && cutthrough_response(&cutthrough.cctx, '2', &resp,
395 CUTTHROUGH_DATA_TIMEOUT) == '2';
397 /* This would go horribly wrong if a callout fail was ignored by ACL.
398 We punt by abandoning cutthrough on a reject, like the
403 address_item * na = store_get(sizeof(address_item), GET_UNTAINTED);
404 *na = cutthrough.addr;
405 cutthrough.addr = *addr;
406 cutthrough.addr.host_used = &cutthrough.host;
407 cutthrough.addr.next = na;
413 cancel_cutthrough_connection(TRUE, US"recipient rejected");
414 if (!resp || errno == ETIMEDOUT)
416 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
421 Ustrcpy(resp, US"connection dropped");
424 string_sprintf("response to \"%s\" was: %s",
425 big_buffer, string_printing(resp));
428 string_sprintf("Callout verification failed:\n%s", resp);
430 /* Hard rejection ends the process */
432 if (resp[0] == '5') /* Address rejected */
440 break; /* host_list */
443 cancel_cutthrough_connection(TRUE, US"incompatible connection");
448 /*************************************************
449 * Do callout verification for an address *
450 *************************************************/
452 /* This function is called from verify_address() when the address has routed to
453 a host list, and a callout has been requested. Callouts are expensive; that is
454 why a cache is used to improve the efficiency.
457 addr the address that's been routed
458 host_list the list of hosts to try
459 tf the transport feedback block
461 ifstring "interface" option from transport, or NULL
462 portstring "port" option from transport, or NULL
463 protocolstring "protocol" option from transport, or NULL
464 callout the per-command callout timeout
465 callout_overall the overall callout timeout (if < 0 use 4*callout)
466 callout_connect the callout connection timeout (if < 0 use callout)
467 options the verification options - these bits are used:
468 vopt_is_recipient => this is a recipient address
469 vopt_callout_no_cache => don't use callout cache
470 vopt_callout_fullpm => if postmaster check, do full one
471 vopt_callout_random => do the "random" thing
472 vopt_callout_recipsender => use real sender for recipient
473 vopt_callout_recippmaster => use postmaster for recipient
474 vopt_callout_hold => lazy close connection
475 se_mailfrom MAIL FROM address for sender verify; NULL => ""
476 pm_mailfrom if non-NULL, do the postmaster check with this sender
478 Returns: OK/FAIL/DEFER
482 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
483 int callout, int callout_overall, int callout_connect, int options,
484 uschar *se_mailfrom, uschar *pm_mailfrom)
487 int old_domain_cache_result = ccache_accept;
490 uschar *from_address;
491 uschar *random_local_part = NULL;
492 const uschar *save_deliver_domain = deliver_domain;
493 uschar **failure_ptr = options & vopt_is_recipient
494 ? &recipient_verify_failure : &sender_verify_failure;
495 dbdata_callout_cache new_domain_record;
496 dbdata_callout_cache_address new_address_record;
497 time_t callout_start_time;
499 new_domain_record.result = ccache_unknown;
500 new_domain_record.postmaster_result = ccache_unknown;
501 new_domain_record.random_result = ccache_unknown;
503 memset(&new_address_record, 0, sizeof(new_address_record));
505 /* For a recipient callout, the key used for the address cache record must
506 include the sender address if we are using the real sender in the callout,
507 because that may influence the result of the callout. */
509 if (options & vopt_is_recipient)
510 if (options & vopt_callout_recipsender)
512 from_address = sender_address;
513 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
514 if (cutthrough.delivery) options |= vopt_callout_no_cache;
516 else if (options & vopt_callout_recippmaster)
518 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
519 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
520 qualify_domain_sender);
525 address_key = addr->address;
528 /* For a sender callout, we must adjust the key if the mailfrom address is not
533 from_address = se_mailfrom ? se_mailfrom : US"";
534 address_key = *from_address
535 ? string_sprintf("%s/<%s>", addr->address, from_address) : addr->address;
538 if (cached_callout_lookup(addr, address_key, from_address,
539 &options, &pm_mailfrom, &yield, failure_ptr,
540 &new_domain_record, &old_domain_cache_result))
542 cancel_cutthrough_connection(TRUE, US"cache-hit");
546 if (!addr->transport)
548 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
551 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
552 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
553 addr->transport->name, addr->transport->driver_name);
556 smtp_transport_options_block *ob =
557 (smtp_transport_options_block *)addr->transport->options_block;
558 smtp_context * sx = NULL;
560 /* The information wasn't available in the cache, so we have to do a real
561 callout and save the result in the cache for next time, unless no_cache is set,
562 or unless we have a previously cached negative random result. If we are to test
563 with a random local part, ensure that such a local part is available. If not,
564 log the fact, but carry on without randomising. */
566 if (options & vopt_callout_random && callout_random_local_part)
567 if (!(random_local_part = expand_string(callout_random_local_part)))
568 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
569 "callout_random_local_part: %s", expand_string_message);
571 /* Compile regex' used by client-side smtp */
575 /* Default the connect and overall callout timeouts if not set, and record the
576 time we are starting so that we can enforce it. */
578 if (callout_overall < 0) callout_overall = 4 * callout;
579 if (callout_connect < 0) callout_connect = callout;
580 callout_start_time = time(NULL);
582 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
583 output because a callout might take some time. When PIPELINING is active and
584 there are many recipients, the total time for doing lots of callouts can add up
585 and cause the client to time out. So in this case we forgo the PIPELINING
588 if (smtp_out && !f.disable_callout_flush) mac_smtp_fflush();
590 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
591 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
593 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
594 and we are holding a cutthrough conn open, we can just append the rcpt to
595 that conn for verification purposes (and later delivery also). Simplest
596 coding means skipping this whole loop and doing the append separately. */
598 /* Can we re-use an open cutthrough connection? */
599 if ( cutthrough.cctx.sock >= 0
600 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
601 == vopt_callout_recipsender
602 && !random_local_part
605 done = cutthrough_multi(addr, host_list, tf, &yield);
607 /* If we did not use a cached connection, make connections to the hosts
608 and do real callouts. The list of hosts is passed in as an argument. */
610 for (host_item * host = host_list; host && !done; host = host->next)
614 uschar * interface = NULL; /* Outgoing interface to use; NULL => any */
618 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
623 /* Check the overall callout timeout */
625 if (time(NULL) - callout_start_time >= callout_overall)
627 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
631 /* Set IPv4 or IPv6 */
633 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
635 /* Expand and interpret the interface and port strings. The latter will not
636 be used if there is a host-specific port (e.g. from a manualroute router).
637 This has to be delayed till now, because they may expand differently for
638 different hosts. If there's a failure, log it, but carry on with the
641 deliver_host = host->name;
642 deliver_host_address = host->address;
643 deliver_host_port = host->port;
644 deliver_domain = addr->domain;
645 transport_name = addr->transport->name;
647 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
649 || !smtp_get_port(tf->port, addr, &port, US"callout")
651 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
654 if (!sx) sx = store_get(sizeof(*sx), GET_TAINTED); /* tainted buffers */
655 memset(sx, 0, sizeof(*sx));
657 sx->addrlist = sx->first_addr = addr;
658 sx->conn_args.host = host;
659 sx->conn_args.host_af = host_af,
661 sx->conn_args.interface = interface;
662 sx->helo_data = tf->helo_data;
663 sx->conn_args.tblock = addr->transport;
664 sx->conn_args.sock = -1;
667 tls_retry_connection:
668 /* Set the address state so that errors are recorded in it */
670 addr->transport_return = PENDING_DEFER;
671 ob->connect_timeout = callout_connect;
672 ob->command_timeout = callout;
674 /* Get the channel set up ready for a message (MAIL FROM being the next
675 SMTP command to send. If we tried TLS but it failed, try again without
678 yield = smtp_setup_conn(sx, FALSE);
681 && addr->basic_errno == ERRNO_TLSFAILURE
682 && ob->tls_tempfail_tryclear
683 && verify_check_given_host(CUSS &ob->hosts_require_tls, host) != OK
686 log_write(0, LOG_MAIN,
687 "%s: callout unencrypted to %s [%s] (not in hosts_require_tls)",
688 addr->message, host->name, host->address);
689 addr->transport_return = PENDING_DEFER;
690 yield = smtp_setup_conn(sx, TRUE);
695 errno = addr->basic_errno;
696 transport_name = NULL;
697 deliver_host = deliver_host_address = NULL;
698 deliver_domain = save_deliver_domain;
700 /* Failure to accept HELO is cached; this blocks the whole domain for all
701 senders. I/O errors and defer responses are not cached. */
703 if (yield == FAIL && (errno == 0 || errno == ERRNO_SMTPCLOSED))
705 setflag(addr, af_verify_nsfail);
706 new_domain_record.result = ccache_reject;
714 /* If we needed to authenticate, smtp_setup_conn() did that. Copy
715 the AUTH info for logging */
717 addr->authenticator = client_authenticator;
718 addr->auth_id = client_authenticated_id;
720 sx->from_addr = from_address;
721 sx->first_addr = sx->sync_addr = addr;
722 sx->ok = FALSE; /*XXX these 3 last might not be needed for verify? */
723 sx->send_rset = TRUE;
724 sx->completed_addr = FALSE;
726 new_domain_record.result = old_domain_cache_result == ccache_reject_mfnull
727 ? ccache_reject_mfnull : ccache_accept;
729 /* Do the random local part check first. Temporarily replace the recipient
730 with the "random" value */
732 if (random_local_part)
734 uschar * main_address = addr->address;
735 const uschar * rcpt_domain = addr->domain;
738 uschar * errstr = NULL;
739 if ( testflag(addr, af_utf8_downcvt)
740 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
744 addr->message = errstr;
745 errno = ERRNO_EXPANDFAIL;
746 setflag(addr, af_verify_nsfail);
748 rcpt_domain = US""; /*XXX errorhandling! */
752 /* This would be ok for 1st rcpt of a cutthrough (the case handled here;
753 subsequents are done in cutthrough_multi()), but no way to
754 handle a subsequent because of the RSET vaporising the MAIL FROM.
755 So refuse to support any. Most cutthrough use will not involve
756 random_local_part, so no loss. */
757 cancel_cutthrough_connection(TRUE, US"random-recipient");
759 addr->address = string_sprintf("%s@%.1000s",
760 random_local_part, rcpt_domain);
763 /* If accepted, we aren't going to do any further tests below.
764 Otherwise, cache a real negative response, and get back to the right
765 state to send RCPT. Unless there's some problem such as a dropped
766 connection, we expect to succeed, because the commands succeeded above.
767 However, some servers drop the connection after responding to an
768 invalid recipient, so on (any) error we drop and remake the connection.
769 XXX We don't care about that for postmaster_full. Should we?
771 XXX could we add another flag to the context, and have the common
772 code emit the RSET too? Even pipelined after the RCPT...
773 Then the main-verify call could use it if there's to be a subsequent
775 The sync_responses() would need to be taught about it and we'd
776 need another return code filtering out to here.
778 Avoid using a SIZE option on the MAIL for all random-rcpt checks.
781 sx->avoid_option = OPTION_SIZE;
783 /* Remember when we last did a random test */
784 new_domain_record.random_stamp = time(NULL);
786 if (smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0)
787 switch(addr->transport_return)
789 case PENDING_OK: /* random was accepted, unfortunately */
790 new_domain_record.random_result = ccache_accept;
791 yield = OK; /* Only usable verify result we can return */
793 *failure_ptr = US"random";
795 case FAIL: /* rejected: the preferred result */
796 new_domain_record.random_result = ccache_reject;
797 sx->avoid_option = 0;
799 /* Between each check, issue RSET, because some servers accept only
800 one recipient after MAIL FROM:<>.
801 XXX We don't care about that for postmaster_full. Should we? */
804 smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0 &&
805 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout)))
809 debug_printf_indent("problem after random/rset/mfrom; reopen conn\n");
810 random_local_part = NULL;
812 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
814 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
815 (void)close(sx->cctx.sock);
817 #ifndef DISABLE_EVENT
818 (void) event_raise(addr->transport->event_action,
819 US"tcp:close", NULL, NULL);
821 addr->address = main_address;
822 addr->transport_return = PENDING_DEFER;
823 sx->first_addr = sx->sync_addr = addr;
825 sx->send_rset = TRUE;
826 sx->completed_addr = FALSE;
827 goto tls_retry_connection;
828 case DEFER: /* 4xx response to random */
829 break; /* Just to be clear. ccache_unknown, !done. */
832 /* Re-setup for main verify, or for the error message when failing */
833 addr->address = main_address;
834 addr->transport_return = PENDING_DEFER;
835 sx->first_addr = sx->sync_addr = addr;
837 sx->send_rset = TRUE;
838 sx->completed_addr = FALSE;
843 /* Main verify. For rcpt-verify use SIZE if we know it and we're not cacheing;
844 for sndr-verify never use it. */
848 if (!(options & vopt_is_recipient && options & vopt_callout_no_cache))
849 sx->avoid_option = OPTION_SIZE;
852 switch(smtp_write_mail_and_rcpt_cmds(sx, &yield))
854 case 0: switch(addr->transport_return) /* ok so far */
856 case PENDING_OK: done = TRUE;
857 new_address_record.result = ccache_accept;
859 case FAIL: done = TRUE;
861 *failure_ptr = US"recipient";
862 new_address_record.result = ccache_reject;
868 case -1: /* MAIL response error */
869 *failure_ptr = US"mail";
870 if (errno == 0 && sx->buffer[0] == '5')
872 setflag(addr, af_verify_nsfail);
873 if (from_address[0] == 0)
874 new_domain_record.result = ccache_reject_mfnull;
877 /* non-MAIL read i/o error */
878 /* non-MAIL response timeout */
879 /* internal error; channel still usable */
880 default: break; /* transmit failed */
884 addr->auth_sndr = client_authenticated_sender;
886 deliver_host = deliver_host_address = NULL;
887 deliver_domain = save_deliver_domain;
889 /* Do postmaster check if requested; if a full check is required, we
890 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
892 if (done && pm_mailfrom)
894 /* Could possibly shift before main verify, just above, and be ok
895 for cutthrough. But no way to handle a subsequent rcpt, so just
897 cancel_cutthrough_connection(TRUE, US"postmaster verify");
898 HDEBUG(D_acl|D_v) debug_printf_indent("Cutthrough cancelled by presence of postmaster verify\n");
900 done = smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0
901 && smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout);
905 uschar * main_address = addr->address;
907 /*XXX oops, affixes */
908 addr->address = string_sprintf("postmaster@%.1000s", addr->domain);
909 addr->transport_return = PENDING_DEFER;
911 sx->from_addr = pm_mailfrom;
912 sx->first_addr = sx->sync_addr = addr;
914 sx->send_rset = TRUE;
915 sx->completed_addr = FALSE;
916 sx->avoid_option = OPTION_SIZE;
918 if( smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0
919 && addr->transport_return == PENDING_OK
923 done = (options & vopt_callout_fullpm) != 0
924 && smtp_write_command(sx, SCMD_FLUSH,
925 "RCPT TO:<postmaster>\r\n") >= 0
926 && smtp_read_response(sx, sx->buffer,
927 sizeof(sx->buffer), '2', callout);
929 /* Sort out the cache record */
931 new_domain_record.postmaster_stamp = time(NULL);
934 new_domain_record.postmaster_result = ccache_accept;
935 else if (errno == 0 && sx->buffer[0] == '5')
937 *failure_ptr = US"postmaster";
938 setflag(addr, af_verify_pmfail);
939 new_domain_record.postmaster_result = ccache_reject;
942 addr->address = main_address;
945 /* For any failure of the main check, other than a negative response, we just
946 close the connection and carry on. We can identify a negative response by the
947 fact that errno is zero. For I/O errors it will be non-zero
949 Set up different error texts for logging and for sending back to the caller
950 as an SMTP response. Log in all cases, using a one-line format. For sender
951 callouts, give a full response to the caller, but for recipient callouts,
952 don't give the IP address because this may be an internal host whose identity
953 is not to be widely broadcast. */
959 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
960 sx->send_quit = FALSE;
966 extern int acl_where; /* src/acl.c */
968 addr->message = US"response to \"EHLO\" did not include SMTPUTF8";
969 addr->user_message = acl_where == ACL_WHERE_RCPT
970 ? US"533 no support for internationalised mailbox name"
971 : US"550 mailbox unavailable";
978 sx->send_quit = FALSE;
982 if (*sx->buffer == 0) Ustrcpy(sx->buffer, US"connection dropped");
984 /*XXX test here is ugly; seem to have a split of responsibility for
985 building this message. Need to rationalise. Where is it done
986 before here, and when not?
987 Not == 5xx resp to MAIL on main-verify
989 if (!addr->message) addr->message =
990 string_sprintf("response to \"%s\" was: %s",
991 big_buffer, string_printing(sx->buffer));
993 /* RFC 5321 section 4.2: the text portion of the response may have only
994 HT, SP, Printable US-ASCII. Deal with awkward chars by cutting the
995 received message off before passing it onward. Newlines are ok; they
996 just become a multiline response (but wrapped in the error code we
999 for (uschar * s = sx->buffer;
1000 *s && s < sx->buffer + sizeof(sx->buffer);
1004 if (c != '\t' && c != '\n' && (c < ' ' || c > '~'))
1006 if (s - sx->buffer < sizeof(sx->buffer) - 12)
1007 memcpy(s, "(truncated)", 12);
1013 addr->user_message = options & vopt_is_recipient
1014 ? string_sprintf("Callout verification failed:\n%s", sx->buffer)
1015 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1016 host->address, big_buffer, sx->buffer);
1018 /* Hard rejection ends the process */
1020 if (sx->buffer[0] == '5') /* Address rejected */
1028 /* End the SMTP conversation and close the connection. */
1030 /* Cutthrough - on a successful connect and recipient-verify with
1031 use-sender and we are 1st rcpt and have no cutthrough conn so far
1032 here is where we want to leave the conn open. Ditto for a lazy-close
1035 if (cutthrough.delivery)
1037 if (addr->transport->filter_command)
1039 cutthrough.delivery= FALSE;
1040 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
1042 #ifndef DISABLE_DKIM
1043 if (ob->dkim.dkim_domain)
1045 cutthrough.delivery= FALSE;
1046 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
1049 #ifdef EXPERIMENTAL_ARC
1052 cutthrough.delivery= FALSE;
1053 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of ARC signing\n");
1058 if ( (cutthrough.delivery || options & vopt_callout_hold)
1062 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1063 == vopt_callout_recipsender
1064 && !random_local_part
1066 && cutthrough.cctx.sock < 0
1070 HDEBUG(D_acl|D_v) debug_printf_indent("holding verify callout open for %s\n",
1072 ? "cutthrough delivery" : "potential further verifies and delivery");
1074 cutthrough.callout_hold_only = !cutthrough.delivery;
1075 cutthrough.is_tls = tls_out.active.sock >= 0;
1076 /* We assume no buffer in use in the outblock */
1077 cutthrough.cctx = sx->cctx;
1078 cutthrough.nrcpt = 1;
1079 cutthrough.transport = addr->transport->name;
1080 cutthrough.interface = interface;
1081 cutthrough.snd_port = sending_port;
1082 cutthrough.peer_options = smtp_peer_options;
1083 cutthrough.host = *host;
1085 int oldpool = store_pool;
1086 store_pool = POOL_PERM;
1087 cutthrough.snd_ip = string_copy(sending_ip_address);
1088 cutthrough.host.name = string_copy(host->name);
1089 cutthrough.host.address = string_copy(host->address);
1090 store_pool = oldpool;
1093 /* Save the address_item and parent chain for later logging */
1094 cutthrough.addr = *addr;
1095 cutthrough.addr.next = NULL;
1096 cutthrough.addr.host_used = &cutthrough.host;
1097 for (address_item * caddr = &cutthrough.addr, * parent = addr->parent;
1099 caddr = caddr->parent, parent = parent->parent)
1100 *(caddr->parent = store_get(sizeof(address_item), GET_UNTAINTED)) = *parent;
1102 ctctx.outblock.buffer = ctbuffer;
1103 ctctx.outblock.buffersize = sizeof(ctbuffer);
1104 ctctx.outblock.ptr = ctbuffer;
1105 /* ctctx.outblock.cmd_count = 0; ctctx.outblock.authenticating = FALSE; */
1106 ctctx.outblock.cctx = &cutthrough.cctx;
1110 /* Ensure no cutthrough on multiple verifies that were incompatible */
1111 if (options & vopt_callout_recipsender)
1112 cancel_cutthrough_connection(TRUE, US"not usable for cutthrough");
1114 if (smtp_write_command(sx, SCMD_FLUSH, "QUIT\r\n") != -1)
1115 /* Wait a short time for response, and discard it */
1116 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', 1);
1118 if (sx->cctx.sock >= 0)
1121 if (sx->cctx.tls_ctx)
1123 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1124 sx->cctx.tls_ctx = NULL;
1127 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1128 (void)close(sx->cctx.sock);
1130 smtp_debug_cmd_report();
1131 #ifndef DISABLE_EVENT
1132 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL, NULL);
1137 if (!done || yield != OK)
1138 addr->message = string_sprintf("%s [%s] : %s", host->name, host->address,
1140 } /* Loop through all hosts, while !done */
1143 /* If we get here with done == TRUE, a successful callout happened, and yield
1144 will be set OK or FAIL according to the response to the RCPT command.
1145 Otherwise, we looped through the hosts but couldn't complete the business.
1146 However, there may be domain-specific information to cache in both cases. */
1148 if (!(options & vopt_callout_no_cache))
1149 cache_callout_write(&new_domain_record, addr->domain,
1150 done, &new_address_record, address_key);
1152 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1153 temporary error. If there was only one host, and a response was received, leave
1154 it alone if supplying details. Otherwise, give a generic response. */
1158 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
1159 options & vopt_is_recipient ? "recipient" : "sender");
1162 addr->message = host_list->next || !addr->message
1163 ? dullmsg : string_sprintf("%s: %s", dullmsg, addr->message);
1165 addr->user_message = smtp_return_error_details
1166 ? string_sprintf("%s for <%s>.\n"
1167 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1168 "they may be permanently unreachable from this server. In the latter case,\n%s",
1169 dullmsg, addr->address,
1170 options & vopt_is_recipient
1171 ? "the address will never be accepted."
1172 : "you need to change the address or create an MX record for its domain\n"
1173 "if it is supposed to be generally accessible from the Internet.\n"
1174 "Talk to your mail administrator for details.")
1177 /* Force a specific error code */
1179 addr->basic_errno = ERRNO_CALLOUTDEFER;
1182 /* Come here from within the cache-reading code on fast-track exit. */
1185 tls_modify_variables(&tls_in); /* return variables to inbound values */
1191 /* Called after recipient-acl to get a cutthrough connection open when
1192 one was requested and a recipient-verify wasn't subsequently done.
1195 open_cutthrough_connection(address_item * addr)
1200 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1201 /* We must use a copy of the address for verification, because it might
1205 HDEBUG(D_acl) debug_printf_indent("----------- %s cutthrough setup ------------\n",
1206 rcpt_count > 1 ? "more" : "start");
1207 rc = verify_address(&addr2, NULL,
1208 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1209 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1211 addr->message = addr2.message;
1212 addr->user_message = addr2.user_message;
1213 HDEBUG(D_acl) debug_printf_indent("----------- end cutthrough setup ------------\n");
1219 /* Send given number of bytes from the buffer */
1221 cutthrough_send(int n)
1223 if(cutthrough.cctx.sock < 0)
1229 ? tls_write(cutthrough.cctx.tls_ctx, ctctx.outblock.buffer, n, FALSE)
1232 send(cutthrough.cctx.sock, ctctx.outblock.buffer, n, 0) > 0
1235 transport_count += n;
1236 ctctx.outblock.ptr= ctctx.outblock.buffer;
1240 HDEBUG(D_transport|D_acl) debug_printf_indent("cutthrough_send failed: %s\n", strerror(errno));
1247 _cutthrough_puts(uschar * cp, int n)
1251 if(ctctx.outblock.ptr >= ctctx.outblock.buffer+ctctx.outblock.buffersize)
1252 if(!cutthrough_send(ctctx.outblock.buffersize))
1255 *ctctx.outblock.ptr++ = *cp++;
1260 /* Buffered output of counted data block. Return boolean success */
1262 cutthrough_puts(uschar * cp, int n)
1264 if (cutthrough.cctx.sock < 0) return TRUE;
1265 if (_cutthrough_puts(cp, n)) return TRUE;
1266 cancel_cutthrough_connection(TRUE, US"transmit failed");
1271 cutthrough_data_puts(uschar * cp, int n)
1273 if (cutthrough.delivery) (void) cutthrough_puts(cp, n);
1279 _cutthrough_flush_send(void)
1281 int n = ctctx.outblock.ptr - ctctx.outblock.buffer;
1284 if(!cutthrough_send(n))
1290 /* Send out any bufferred output. Return boolean success. */
1292 cutthrough_flush_send(void)
1294 if (_cutthrough_flush_send()) return TRUE;
1295 cancel_cutthrough_connection(TRUE, US"transmit failed");
1301 cutthrough_put_nl(void)
1303 return cutthrough_puts(US"\r\n", 2);
1308 cutthrough_data_put_nl(void)
1310 cutthrough_data_puts(US"\r\n", 2);
1314 /* Get and check response from cutthrough target */
1316 cutthrough_response(client_conn_ctx * cctx, char expect, uschar ** copy, int timeout)
1318 smtp_context sx = {0};
1319 uschar inbuffer[4096];
1320 uschar responsebuffer[4096];
1322 sx.inblock.buffer = inbuffer;
1323 sx.inblock.buffersize = sizeof(inbuffer);
1324 sx.inblock.ptr = inbuffer;
1325 sx.inblock.ptrend = inbuffer;
1326 sx.inblock.cctx = cctx;
1327 if(!smtp_read_response(&sx, responsebuffer, sizeof(responsebuffer), expect, timeout))
1328 cancel_cutthrough_connection(TRUE, US"target timeout on read");
1333 *copy = cp = string_copy(responsebuffer);
1334 /* Trim the trailing end of line */
1335 cp += Ustrlen(responsebuffer);
1336 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1337 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1340 return responsebuffer[0];
1344 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1346 cutthrough_predata(void)
1348 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1351 smtp_debug_cmd(US"DATA", 0);
1352 cutthrough_puts(US"DATA\r\n", 6);
1353 cutthrough_flush_send();
1355 /* Assume nothing buffered. If it was it gets ignored. */
1356 return cutthrough_response(&cutthrough.cctx, '3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
1360 /* tctx arg only to match write_chunk() */
1362 cutthrough_write_chunk(transport_ctx * tctx, uschar * s, int len)
1365 while(s && (s2 = Ustrchr(s, '\n')))
1367 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1375 /* Buffered send of headers. Return success boolean. */
1376 /* Expands newlines to wire format (CR,NL). */
1377 /* Also sends header-terminating blank line. */
1379 cutthrough_headers_send(void)
1383 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1386 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1387 but having a separate buffered-output function (for now)
1389 HDEBUG(D_acl) debug_printf_indent("----------- start cutthrough headers send -----------\n");
1391 tctx.u.fd = cutthrough.cctx.sock;
1392 tctx.tblock = cutthrough.addr.transport;
1393 tctx.addr = &cutthrough.addr;
1394 tctx.check_string = US".";
1395 tctx.escape_string = US"..";
1396 /*XXX check under spool_files_wireformat. Might be irrelevant */
1397 tctx.options = topt_use_crlf;
1399 if (!transport_headers_send(&tctx, &cutthrough_write_chunk))
1402 HDEBUG(D_acl) debug_printf_indent("----------- done cutthrough headers send ------------\n");
1408 close_cutthrough_connection(const uschar * why)
1410 int fd = cutthrough.cctx.sock;
1413 /* We could be sending this after a bunch of data, but that is ok as
1414 the only way to cancel the transfer in dataphase is to drop the tcp
1415 conn before the final dot.
1417 client_conn_ctx tmp_ctx = cutthrough.cctx;
1418 ctctx.outblock.ptr = ctbuffer;
1419 smtp_debug_cmd(US"QUIT", 0);
1420 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1421 _cutthrough_flush_send();
1422 cutthrough.cctx.sock = -1; /* avoid recursion via read timeout */
1423 cutthrough.nrcpt = 0; /* permit re-cutthrough on subsequent message */
1425 /* Wait a short time for response, and discard it */
1426 cutthrough_response(&tmp_ctx, '2', NULL, 1);
1429 if (cutthrough.is_tls)
1431 tls_close(cutthrough.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1432 cutthrough.cctx.tls_ctx = NULL;
1433 cutthrough.is_tls = FALSE;
1436 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1438 smtp_debug_cmd_report();
1439 HDEBUG(D_acl) debug_printf_indent("----------- cutthrough shutdown (%s) ------------\n", why);
1441 ctctx.outblock.ptr = ctbuffer;
1445 cancel_cutthrough_connection(BOOL close_noncutthrough_verifies, const uschar * why)
1447 if (cutthrough.delivery || close_noncutthrough_verifies)
1448 close_cutthrough_connection(why);
1449 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1454 release_cutthrough_connection(const uschar * why)
1456 if (cutthrough.cctx.sock < 0) return;
1457 HDEBUG(D_acl) debug_printf_indent("release cutthrough conn: %s\n", why);
1458 cutthrough.cctx.sock = -1;
1459 cutthrough.cctx.tls_ctx = NULL;
1460 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1466 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1467 Log an OK response as a transmission.
1468 Close the connection.
1469 Return smtp response-class digit.
1472 cutthrough_finaldot(void)
1475 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> .\n");
1477 /* Assume data finshed with new-line */
1478 if( !cutthrough_puts(US".", 1)
1479 || !cutthrough_put_nl()
1480 || !cutthrough_flush_send()
1482 return cutthrough.addr.message;
1484 res = cutthrough_response(&cutthrough.cctx, '2', &cutthrough.addr.message,
1485 CUTTHROUGH_DATA_TIMEOUT);
1486 for (address_item * addr = &cutthrough.addr; addr; addr = addr->next)
1488 addr->message = cutthrough.addr.message;
1492 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1493 close_cutthrough_connection(US"delivered");
1497 delivery_log(LOG_MAIN, addr, 0,
1498 US"tmp-reject from cutthrough after DATA:");
1502 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1503 US"rejected after DATA:");
1510 return cutthrough.addr.message;
1515 /*************************************************
1516 * Copy error to toplevel address *
1517 *************************************************/
1519 /* This function is used when a verify fails or defers, to ensure that the
1520 failure or defer information is in the original toplevel address. This applies
1521 when an address is redirected to a single new address, and the failure or
1522 deferral happens to the child address.
1525 vaddr the verify address item
1526 addr the final address item
1529 Returns: the value of YIELD
1533 copy_error(address_item *vaddr, address_item *addr, int yield)
1537 vaddr->message = addr->message;
1538 vaddr->user_message = addr->user_message;
1539 vaddr->basic_errno = addr->basic_errno;
1540 vaddr->more_errno = addr->more_errno;
1541 vaddr->prop.address_data = addr->prop.address_data;
1542 vaddr->prop.variables = NULL;
1543 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
1544 copyflag(vaddr, addr, af_pass_message);
1552 /**************************************************
1553 * printf that automatically handles TLS if needed *
1554 ***************************************************/
1556 /* This function is used by verify_address() as a substitute for all fprintf()
1557 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1558 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1559 that assumes that we always use the smtp_out FILE* when not using TLS or the
1560 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1561 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1565 f the candidate FILE* to write to
1566 format format string
1567 ... optional arguments
1573 static void PRINTF_FUNCTION(2,3)
1574 respond_printf(FILE *f, const char *format, ...)
1578 va_start(ap, format);
1579 if (smtp_out && (f == smtp_out))
1580 smtp_vprintf(format, FALSE, ap);
1582 vfprintf(f, format, ap);
1588 /*************************************************
1589 * Verify an email address *
1590 *************************************************/
1592 /* This function is used both for verification (-bv and at other times) and
1593 address testing (-bt), which is indicated by address_test_mode being set.
1596 vaddr contains the address to verify; the next field in this block
1598 fp if not NULL, write the result to this file
1599 options various option bits:
1600 vopt_fake_sender => this sender verify is not for the real
1601 sender (it was verify=sender=xxxx or an address from a
1602 header line) - rewriting must not change sender_address
1603 vopt_is_recipient => this is a recipient address, otherwise
1604 it's a sender address - this affects qualification and
1605 rewriting and messages from callouts
1606 vopt_qualify => qualify an unqualified address; else error
1607 vopt_expn => called from SMTP EXPN command
1608 vopt_success_on_redirect => when a new address is generated
1609 the verification instantly succeeds
1611 These ones are used by do_callout() -- the options variable
1614 vopt_callout_fullpm => if postmaster check, do full one
1615 vopt_callout_no_cache => don't use callout cache
1616 vopt_callout_random => do the "random" thing
1617 vopt_callout_recipsender => use real sender for recipient
1618 vopt_callout_recippmaster => use postmaster for recipient
1620 callout if > 0, specifies that callout is required, and gives timeout
1621 for individual commands
1622 callout_overall if > 0, gives overall timeout for the callout function;
1623 if < 0, a default is used (see do_callout())
1624 callout_connect the connection timeout for callouts
1625 se_mailfrom when callout is requested to verify a sender, use this
1626 in MAIL FROM; NULL => ""
1627 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1628 thing and use this as the sender address (may be "")
1630 routed if not NULL, set TRUE if routing succeeded, so we can
1631 distinguish between routing failed and callout failed
1633 Returns: OK address verified
1634 FAIL address failed to verify
1635 DEFER can't tell at present
1639 verify_address(address_item * vaddr, FILE * fp, int options, int callout,
1640 int callout_overall, int callout_connect, uschar * se_mailfrom,
1641 uschar *pm_mailfrom, BOOL *routed)
1644 BOOL full_info = fp ? debug_selector != 0 : FALSE;
1645 BOOL expn = (options & vopt_expn) != 0;
1646 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1649 int verify_type = expn ? v_expn :
1650 f.address_test_mode ? v_none :
1651 options & vopt_is_recipient ? v_recipient : v_sender;
1652 address_item *addr_list;
1653 address_item *addr_new = NULL;
1654 address_item *addr_remote = NULL;
1655 address_item *addr_local = NULL;
1656 address_item *addr_succeed = NULL;
1657 uschar **failure_ptr = options & vopt_is_recipient
1658 ? &recipient_verify_failure : &sender_verify_failure;
1659 uschar *ko_prefix, *cr;
1660 uschar *address = vaddr->address;
1661 uschar *save_sender;
1662 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1664 /* Clear, just in case */
1666 *failure_ptr = NULL;
1668 /* Set up a prefix and suffix for error message which allow us to use the same
1669 output statements both in EXPN mode (where an SMTP response is needed) and when
1670 debugging with an output file. */
1674 ko_prefix = US"553 ";
1677 else ko_prefix = cr = US"";
1679 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1681 if (parse_find_at(address) == NULL)
1683 if (!(options & vopt_qualify))
1686 respond_printf(fp, "%sA domain is required for \"%s\"%s\n",
1687 ko_prefix, address, cr);
1688 *failure_ptr = US"qualify";
1691 /* deconst ok as address was not const */
1692 address = US rewrite_address_qualify(address, options & vopt_is_recipient);
1697 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1698 debug_printf("%s %s\n", f.address_test_mode? "Testing" : "Verifying", address);
1701 /* Rewrite and report on it. Clear the domain and local part caches - these
1702 may have been set by domains and local part tests during an ACL. */
1704 if (global_rewrite_rules)
1706 uschar *old = address;
1707 /* deconst ok as address was not const */
1708 address = US rewrite_address(address, options & vopt_is_recipient, FALSE,
1709 global_rewrite_rules, rewrite_existflags);
1712 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1713 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1714 if (fp && !expn) fprintf(fp, "Address rewritten as: %s\n", address);
1718 /* If this is the real sender address, we must update sender_address at
1719 this point, because it may be referred to in the routers. */
1721 if (!(options & (vopt_fake_sender|vopt_is_recipient)))
1722 sender_address = address;
1724 /* If the address was rewritten to <> no verification can be done, and we have
1725 to return OK. This rewriting is permitted only for sender addresses; for other
1726 addresses, such rewriting fails. */
1728 if (!address[0]) return OK;
1730 /* Flip the legacy TLS-related variables over to the outbound set in case
1731 they're used in the context of a transport used by verification. Reset them
1732 at exit from this routine (so no returns allowed from here on). */
1734 tls_modify_variables(&tls_out);
1736 /* Save a copy of the sender address for re-instating if we change it to <>
1737 while verifying a sender address (a nice bit of self-reference there). */
1739 save_sender = sender_address;
1741 /* Observability variable for router/transport use */
1743 verify_mode = options & vopt_is_recipient ? US"R" : US"S";
1745 /* Update the address structure with the possibly qualified and rewritten
1746 address. Set it up as the starting address on the chain of new addresses. */
1748 vaddr->address = address;
1751 /* We need a loop, because an address can generate new addresses. We must also
1752 cope with generated pipes and files at the top level. (See also the code and
1753 comment in deliver.c.) However, it is usually the case that the router for
1754 user's .forward files has its verify flag turned off.
1756 If an address generates more than one child, the loop is used only when
1757 full_info is set, and this can only be set locally. Remote enquiries just get
1758 information about the top level address, not anything that it generated. */
1763 address_item *addr = addr_new;
1765 addr_new = addr->next;
1770 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1771 debug_printf("Considering %s\n", addr->address);
1774 /* Handle generated pipe, file or reply addresses. We don't get these
1775 when handling EXPN, as it does only one level of expansion. */
1777 if (testflag(addr, af_pfr))
1784 if (addr->address[0] == '>')
1786 allow = testflag(addr, af_allow_reply);
1787 fprintf(fp, "%s -> mail %s", addr->parent->address, addr->address + 1);
1791 allow = addr->address[0] == '|'
1792 ? testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1793 fprintf(fp, "%s -> %s", addr->parent->address, addr->address);
1796 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1797 fprintf(fp, "\n*** Error in setting up pipe, file, or autoreply:\n"
1798 "%s\n", addr->message);
1800 fprintf(fp, "\n transport = %s\n", addr->transport->name);
1802 fprintf(fp, " *** forbidden ***\n");
1807 /* Just in case some router parameter refers to it. */
1809 return_path = addr->prop.errors_address
1810 ? addr->prop.errors_address : sender_address;
1812 /* Split the address into domain and local part, handling the %-hack if
1813 necessary, and then route it. While routing a sender address, set
1814 $sender_address to <> because that is what it will be if we were trying to
1815 send a bounce to the sender. */
1817 if (routed) *routed = FALSE;
1818 if ((rc = deliver_split_address(addr)) == OK)
1820 if (!(options & vopt_is_recipient)) sender_address = null_sender;
1821 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1822 &addr_succeed, verify_type);
1823 sender_address = save_sender; /* Put back the real sender */
1826 /* If routing an address succeeded, set the flag that remembers, for use when
1827 an ACL cached a sender verify (in case a callout fails). Then if routing set
1828 up a list of hosts or the transport has a host list, and the callout option
1829 is set, and we aren't in a host checking run, do the callout verification,
1830 and set another flag that notes that a callout happened. */
1834 BOOL local_verify = FALSE;
1836 if (routed) *routed = TRUE;
1839 transport_instance * tp;
1840 host_item * host_list = addr->host_list;
1842 /* Make up some data for use in the case where there is no remote
1845 transport_feedback tf = {
1846 .interface = NULL, /* interface (=> any) */
1848 .protocol = US"smtp",
1850 .helo_data = US"$smtp_active_hostname",
1851 .hosts_override = FALSE,
1852 .hosts_randomize = FALSE,
1853 .gethostbyname = FALSE,
1854 .qualify_single = TRUE,
1855 .search_parents = FALSE
1858 /* If verification yielded a remote transport, we want to use that
1859 transport's options, so as to mimic what would happen if we were really
1860 sending a message to this address. */
1862 if ((tp = addr->transport))
1863 if (!tp->info->local)
1865 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
1867 /* If the transport has hosts and the router does not, or if the
1868 transport is configured to override the router's hosts, we must build a
1869 host list of the transport's hosts, and find the IP addresses */
1871 if (tf.hosts && (!host_list || tf.hosts_override))
1874 const uschar *save_deliver_domain = deliver_domain;
1875 uschar *save_deliver_localpart = deliver_localpart;
1877 host_list = NULL; /* Ignore the router's hosts */
1879 deliver_domain = addr->domain;
1880 deliver_localpart = addr->local_part;
1881 s = expand_string(tf.hosts);
1882 deliver_domain = save_deliver_domain;
1883 deliver_localpart = save_deliver_localpart;
1887 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1888 "\"%s\" in %s transport for callout: %s", tf.hosts,
1889 tp->name, expand_string_message);
1894 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1896 /* Just ignore failures to find a host address. If we don't manage
1897 to find any addresses, the callout will defer. Note that more than
1898 one address may be found for a single host, which will result in
1899 additional host items being inserted into the chain. Hence we must
1900 save the next host first. */
1902 flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
1903 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1904 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1906 for (host_item * host = host_list, * nexthost; host; host = nexthost)
1908 nexthost = host->next;
1909 if (tf.gethostbyname ||
1910 string_is_ip_address(host->name, NULL) != 0)
1911 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
1914 const dnssec_domains * dsp = NULL;
1915 if (Ustrcmp(tp->driver_name, "smtp") == 0)
1917 smtp_transport_options_block * ob =
1918 (smtp_transport_options_block *) tp->options_block;
1922 (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1929 else if ( options & vopt_quota
1930 && Ustrcmp(tp->driver_name, "appendfile") == 0)
1931 local_verify = TRUE;
1933 /* Can only do a callout if we have at least one host! If the callout
1934 fails, it will have set ${sender,recipient}_verify_failure. */
1938 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1939 if (host_checking && !f.host_checking_callout)
1942 debug_printf("... callout omitted by default when host testing\n"
1943 "(Use -bhc if you want the callouts to happen.)\n");
1948 deliver_set_expansions(addr);
1950 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
1951 callout_connect, options, se_mailfrom, pm_mailfrom);
1953 deliver_set_expansions(NULL);
1957 else if (local_verify)
1959 HDEBUG(D_verify) debug_printf("Attempting quota verification\n");
1961 deliver_set_expansions(addr);
1962 deliver_local(addr, TRUE);
1963 rc = addr->transport_return;
1966 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
1967 "transport provided a host list, or transport is not smtp\n");
1971 /* Otherwise, any failure is a routing failure */
1973 else *failure_ptr = US"route";
1975 /* A router may return REROUTED if it has set up a child address as a result
1976 of a change of domain name (typically from widening). In this case we always
1977 want to continue to verify the new child. */
1979 if (rc == REROUTED) continue;
1981 /* Handle hard failures */
1988 address_item *p = addr->parent;
1990 respond_printf(fp, "%s%s %s", ko_prefix,
1991 full_info ? addr->address : address,
1992 f.address_test_mode ? "is undeliverable" : "failed to verify");
1993 if (!expn && f.admin_user)
1995 if (addr->basic_errno > 0)
1996 respond_printf(fp, ": %s", strerror(addr->basic_errno));
1998 respond_printf(fp, ": %s", addr->message);
2001 /* Show parents iff doing full info */
2003 if (full_info) while (p)
2005 respond_printf(fp, "%s\n <-- %s", cr, p->address);
2008 respond_printf(fp, "%s\n", cr);
2010 cancel_cutthrough_connection(TRUE, US"routing hard fail");
2014 yield = copy_error(vaddr, addr, FAIL);
2022 else if (rc == DEFER)
2027 address_item *p = addr->parent;
2028 respond_printf(fp, "%s%s cannot be resolved at this time", ko_prefix,
2029 full_info? addr->address : address);
2030 if (!expn && f.admin_user)
2032 if (addr->basic_errno > 0)
2033 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2035 respond_printf(fp, ": %s", addr->message);
2036 else if (addr->basic_errno <= 0)
2037 respond_printf(fp, ": unknown error");
2040 /* Show parents iff doing full info */
2042 if (full_info) while (p)
2044 respond_printf(fp, "%s\n <-- %s", cr, p->address);
2047 respond_printf(fp, "%s\n", cr);
2049 cancel_cutthrough_connection(TRUE, US"routing soft fail");
2053 yield = copy_error(vaddr, addr, DEFER);
2056 if (yield == OK) yield = DEFER;
2059 /* If we are handling EXPN, we do not want to continue to route beyond
2060 the top level (whose address is in "address"). */
2064 uschar *ok_prefix = US"250-";
2067 if (!addr_local && !addr_remote)
2068 respond_printf(fp, "250 mail to <%s> is discarded\r\n", address);
2070 respond_printf(fp, "250 <%s>\r\n", address);
2074 address_item *addr2 = addr_new;
2075 addr_new = addr2->next;
2076 if (!addr_new) ok_prefix = US"250 ";
2077 respond_printf(fp, "%s<%s>\r\n", ok_prefix, addr2->address);
2083 /* Successful routing other than EXPN. */
2087 /* Handle successful routing when short info wanted. Otherwise continue for
2088 other (generated) addresses. Short info is the operational case. Full info
2089 can be requested only when debug_selector != 0 and a file is supplied.
2091 There is a conflict between the use of aliasing as an alternate email
2092 address, and as a sort of mailing list. If an alias turns the incoming
2093 address into just one address (e.g. J.Caesar->jc44) you may well want to
2094 carry on verifying the generated address to ensure it is valid when
2095 checking incoming mail. If aliasing generates multiple addresses, you
2096 probably don't want to do this. Exim therefore treats the generation of
2097 just a single new address as a special case, and continues on to verify the
2098 generated address. */
2100 if ( !full_info /* Stop if short info wanted AND */
2101 && ( ( !addr_new /* No new address OR */
2102 || addr_new->next /* More than one new address OR */
2103 || testflag(addr_new, af_pfr) /* New address is pfr */
2106 ( addr_new /* At least one new address AND */
2107 && success_on_redirect /* success_on_redirect is set */
2111 if (fp) fprintf(fp, "%s %s\n",
2112 address, f.address_test_mode ? "is deliverable" : "verified");
2114 /* If we have carried on to verify a child address, we want the value
2115 of $address_data to be that of the child */
2117 vaddr->prop.address_data = addr->prop.address_data;
2118 vaddr->prop.variables = NULL;
2119 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
2121 /* If stopped because more than one new address, cannot cutthrough */
2123 if (addr_new && addr_new->next)
2124 cancel_cutthrough_connection(TRUE, US"multiple addresses from routing");
2130 } /* Loop for generated addresses */
2132 /* Display the full results of the successful routing, including any generated
2133 addresses. Control gets here only when full_info is set, which requires fp not
2134 to be NULL, and this occurs only when a top-level verify is called with the
2135 debugging switch on.
2137 If there are no local and no remote addresses, and there were no pipes, files,
2138 or autoreplies, and there were no errors or deferments, the message is to be
2139 discarded, usually because of the use of :blackhole: in an alias file. */
2141 if (allok && !addr_local && !addr_remote)
2143 fprintf(fp, "mail to %s is discarded\n", address);
2147 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2150 address_item *addr = addr_list;
2151 transport_instance * tp = addr->transport;
2153 addr_list = addr->next;
2155 fprintf(fp, "%s", CS addr->address);
2157 /* If the address is a duplicate, show something about it. */
2159 if (!testflag(addr, af_pfr))
2162 if ((tnode = tree_search(tree_duplicates, addr->unique)))
2163 fprintf(fp, " [duplicate, would not be delivered]");
2164 else tree_add_duplicate(addr->unique, addr);
2167 /* Now show its parents */
2169 for (address_item * p = addr->parent; p; p = p->parent)
2170 fprintf(fp, "\n <-- %s", p->address);
2173 /* Show router, and transport */
2175 fprintf(fp, "router = %s, transport = %s\n",
2176 addr->router->name, tp ? tp->name : US"unset");
2178 /* Show any hosts that are set up by a router unless the transport
2179 is going to override them; fiddle a bit to get a nice format. */
2181 if (addr->host_list && tp && !tp->overrides_hosts)
2185 for (host_item * h = addr->host_list; h; h = h->next)
2186 { /* get max lengths of host names, addrs */
2187 int len = Ustrlen(h->name);
2188 if (len > maxlen) maxlen = len;
2189 len = h->address ? Ustrlen(h->address) : 7;
2190 if (len > maxaddlen) maxaddlen = len;
2192 for (host_item * h = addr->host_list; h; h = h->next)
2194 fprintf(fp, " host %-*s ", maxlen, h->name);
2197 fprintf(fp, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2198 else if (tp->info->local)
2199 fprintf(fp, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2201 fprintf(fp, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2203 if (h->mx >= 0) fprintf(fp, " MX=%d", h->mx);
2204 if (h->port != PORT_NONE) fprintf(fp, " port=%d", h->port);
2205 if (f.running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", fp);
2206 if (h->status == hstatus_unusable) fputs(" ** unusable **", fp);
2212 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2213 the -bv or -bt case). */
2217 tls_modify_variables(&tls_in); /* return variables to inbound values */
2225 /*************************************************
2226 * Check headers for syntax errors *
2227 *************************************************/
2229 /* This function checks those header lines that contain addresses, and verifies
2230 that all the addresses therein are 5322-syntactially correct.
2233 msgptr where to put an error message
2240 verify_check_headers(uschar **msgptr)
2245 for (header_line * h = header_list; h && yield == OK; h = h->next)
2247 if (h->type != htype_from &&
2248 h->type != htype_reply_to &&
2249 h->type != htype_sender &&
2250 h->type != htype_to &&
2251 h->type != htype_cc &&
2252 h->type != htype_bcc)
2255 colon = Ustrchr(h->text, ':');
2257 Uskip_whitespace(&s);
2259 /* Loop for multiple addresses in the header, enabling group syntax. Note
2260 that we have to reset this after the header has been scanned. */
2262 f.parse_allow_group = TRUE;
2266 uschar *ss = parse_find_address_end(s, FALSE);
2267 uschar *recipient, *errmess;
2268 int terminator = *ss;
2269 int start, end, domain;
2271 /* Temporarily terminate the string at this point, and extract the
2272 operative address within, allowing group syntax. */
2275 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2278 /* Permit an unqualified address only if the message is local, or if the
2279 sending host is configured to be permitted to send them. */
2281 if (recipient && !domain)
2283 if (h->type == htype_from || h->type == htype_sender)
2285 if (!f.allow_unqualified_sender) recipient = NULL;
2289 if (!f.allow_unqualified_recipient) recipient = NULL;
2291 if (!recipient) errmess = US"unqualified address not permitted";
2294 /* It's an error if no address could be extracted, except for the special
2295 case of an empty address. */
2297 if (!recipient && Ustrcmp(errmess, "empty address") != 0)
2299 uschar *verb = US"is";
2304 /* Arrange not to include any white space at the end in the
2305 error message or the header name. */
2307 while (t > s && isspace(t[-1])) t--;
2308 while (tt > h->text && isspace(tt[-1])) tt--;
2310 /* Add the address that failed to the error message, since in a
2311 header with very many addresses it is sometimes hard to spot
2312 which one is at fault. However, limit the amount of address to
2313 quote - cases have been seen where, for example, a missing double
2314 quote in a humungous To: header creates an "address" that is longer
2315 than string_sprintf can handle. */
2324 /* deconst cast ok as we're passing a non-const to string_printing() */
2325 *msgptr = US string_printing(
2326 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2327 errmess, (int)(tt - h->text), h->text, verb, len, s));
2330 break; /* Out of address loop */
2333 /* Advance to the next address */
2335 s = ss + (terminator ? 1 : 0);
2336 Uskip_whitespace(&s);
2337 } /* Next address */
2339 f.parse_allow_group = FALSE;
2340 f.parse_found_group = FALSE;
2341 } /* Next header unless yield has been set FALSE */
2347 /*************************************************
2348 * Check header names for 8-bit characters *
2349 *************************************************/
2351 /* This function checks for invalid characters in header names. See
2352 RFC 5322, 2.2. and RFC 6532, 3.
2355 msgptr where to put an error message
2362 verify_check_header_names_ascii(uschar **msgptr)
2366 for (header_line * h = header_list; h; h = h->next)
2368 colon = Ustrchr(h->text, ':');
2369 for(uschar * s = h->text; s < colon; s++)
2370 if ((*s < 33) || (*s > 126))
2372 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2373 (int)(colon - h->text), h->text);
2380 /*************************************************
2381 * Check for blind recipients *
2382 *************************************************/
2384 /* This function checks that every (envelope) recipient is mentioned in either
2385 the To: or Cc: header lines, thus detecting blind carbon copies.
2387 There are two ways of scanning that could be used: either scan the header lines
2388 and tick off the recipients, or scan the recipients and check the header lines.
2389 The original proposed patch did the former, but I have chosen to do the latter,
2390 because (a) it requires no memory and (b) will use fewer resources when there
2391 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2393 Arguments: case_sensitive true if case sensitive matching should be used
2394 Returns: OK if there are no blind recipients
2395 FAIL if there is at least one blind recipient
2399 verify_check_notblind(BOOL case_sensitive)
2401 for (int i = 0; i < recipients_count; i++)
2404 uschar *address = recipients_list[i].address;
2406 for (header_line * h = header_list; !found && h; h = h->next)
2410 if (h->type != htype_to && h->type != htype_cc) continue;
2412 colon = Ustrchr(h->text, ':');
2414 Uskip_whitespace(&s);
2416 /* Loop for multiple addresses in the header, enabling group syntax. Note
2417 that we have to reset this after the header has been scanned. */
2419 f.parse_allow_group = TRUE;
2423 uschar * ss = parse_find_address_end(s, FALSE);
2424 uschar * recipient, * errmess;
2425 int terminator = *ss;
2426 int start, end, domain;
2428 /* Temporarily terminate the string at this point, and extract the
2429 operative address within, allowing group syntax. */
2432 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2435 /* If we found a valid recipient that has a domain, compare it with the
2436 envelope recipient. Local parts are compared with case-sensitivity
2437 according to the routine arg, domains case-insensitively.
2438 By comparing from the start with length "domain", we include the "@" at
2439 the end, which ensures that we are comparing the whole local part of each
2442 if (recipient && domain != 0)
2443 if ((found = (case_sensitive
2444 ? Ustrncmp(recipient, address, domain) == 0
2445 : strncmpic(recipient, address, domain) == 0)
2446 && strcmpic(recipient + domain, address + domain) == 0))
2449 /* Advance to the next address */
2451 s = ss + (terminator ? 1:0);
2452 Uskip_whitespace(&s);
2453 } /* Next address */
2455 f.parse_allow_group = FALSE;
2456 f.parse_found_group = FALSE;
2457 } /* Next header (if found is false) */
2459 if (!found) return FAIL;
2460 } /* Next recipient */
2467 /*************************************************
2468 * Find if verified sender *
2469 *************************************************/
2471 /* Usually, just a single address is verified as the sender of the message.
2472 However, Exim can be made to verify other addresses as well (often related in
2473 some way), and this is useful in some environments. There may therefore be a
2474 chain of such addresses that have previously been tested. This function finds
2475 whether a given address is on the chain.
2477 Arguments: the address to be verified
2478 Returns: pointer to an address item, or NULL
2482 verify_checked_sender(uschar *sender)
2484 for (address_item * addr = sender_verified_list; addr; addr = addr->next)
2485 if (Ustrcmp(sender, addr->address) == 0) return addr;
2493 /*************************************************
2494 * Get valid header address *
2495 *************************************************/
2497 /* Scan the originator headers of the message, looking for an address that
2498 verifies successfully. RFC 822 says:
2500 o The "Sender" field mailbox should be sent notices of
2501 any problems in transport or delivery of the original
2502 messages. If there is no "Sender" field, then the
2503 "From" field mailbox should be used.
2505 o If the "Reply-To" field exists, then the reply should
2506 go to the addresses indicated in that field and not to
2507 the address(es) indicated in the "From" field.
2509 So we check a Sender field if there is one, else a Reply_to field, else a From
2510 field. As some strange messages may have more than one of these fields,
2511 especially if they are resent- fields, check all of them if there is more than
2515 user_msgptr points to where to put a user error message
2516 log_msgptr points to where to put a log error message
2517 callout timeout for callout check (passed to verify_address())
2518 callout_overall overall callout timeout (ditto)
2519 callout_connect connect callout timeout (ditto)
2520 se_mailfrom mailfrom for verify; NULL => ""
2521 pm_mailfrom sender for pm callout check (passed to verify_address())
2522 options callout options (passed to verify_address())
2523 verrno where to put the address basic_errno
2525 If log_msgptr is set to something without setting user_msgptr, the caller
2526 normally uses log_msgptr for both things.
2528 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2529 FAIL is given if no appropriate headers are found
2533 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2534 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2535 uschar *pm_mailfrom, int options, int *verrno)
2537 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2541 for (int i = 0; i < 3 && !done; i++)
2542 for (header_line * h = header_list; h != NULL && !done; h = h->next)
2544 int terminator, new_ok;
2545 uschar *s, *ss, *endname;
2547 if (h->type != header_types[i]) continue;
2548 s = endname = Ustrchr(h->text, ':') + 1;
2550 /* Scan the addresses in the header, enabling group syntax. Note that we
2551 have to reset this after the header has been scanned. */
2553 f.parse_allow_group = TRUE;
2557 address_item *vaddr;
2559 while (isspace(*s) || *s == ',') s++;
2560 if (*s == 0) break; /* End of header */
2562 ss = parse_find_address_end(s, FALSE);
2564 /* The terminator is a comma or end of header, but there may be white
2565 space preceding it (including newline for the last address). Move back
2566 past any white space so we can check against any cached envelope sender
2567 address verifications. */
2569 while (isspace(ss[-1])) ss--;
2573 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2574 (int)(endname - h->text), h->text, s);
2576 /* See if we have already verified this address as an envelope sender,
2577 and if so, use the previous answer. */
2579 vaddr = verify_checked_sender(s);
2581 if (vaddr != NULL && /* Previously checked */
2582 (callout <= 0 || /* No callout needed; OR */
2583 vaddr->special_action > 256)) /* Callout was done */
2585 new_ok = vaddr->special_action & 255;
2586 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2587 *ss = terminator; /* Restore shortened string */
2590 /* Otherwise we run the verification now. We must restore the shortened
2591 string before running the verification, so the headers are correct, in
2592 case there is any rewriting. */
2596 int start, end, domain;
2597 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2602 /* If we found an empty address, just carry on with the next one, but
2603 kill the message. */
2605 if (!address && Ustrcmp(*log_msgptr, "empty address") == 0)
2612 /* If verification failed because of a syntax error, fail this
2613 function, and ensure that the failing address gets added to the error
2619 while (ss > s && isspace(ss[-1])) ss--;
2620 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2621 "scanning for sender: %s in \"%.*s\"",
2622 (int)(endname - h->text), h->text, *log_msgptr, (int)(ss - s), s);
2628 /* Else go ahead with the sender verification. But it isn't *the*
2629 sender of the message, so set vopt_fake_sender to stop sender_address
2630 being replaced after rewriting or qualification. */
2634 vaddr = deliver_make_addr(address, FALSE);
2635 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2636 callout, callout_overall, callout_connect, se_mailfrom,
2641 /* We now have the result, either newly found, or cached. If we are
2642 giving out error details, set a specific user error. This means that the
2643 last of these will be returned to the user if all three fail. We do not
2644 set a log message - the generic one below will be used. */
2648 *verrno = vaddr->basic_errno;
2649 if (smtp_return_error_details)
2650 *user_msgptr = string_sprintf("Rejected after DATA: "
2651 "could not verify \"%.*s\" header address\n%s: %s",
2652 (int)(endname - h->text), h->text, vaddr->address, vaddr->message);
2655 /* Success or defer */
2664 if (new_ok == DEFER) yield = DEFER;
2666 /* Move on to any more addresses in the header */
2669 } /* Next address */
2671 f.parse_allow_group = FALSE;
2672 f.parse_found_group = FALSE;
2673 } /* Next header, unless done */
2674 /* Next header type unless done */
2676 if (yield == FAIL && *log_msgptr == NULL)
2677 *log_msgptr = US"there is no valid sender in any header line";
2679 if (yield == DEFER && *log_msgptr == NULL)
2680 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2688 /*************************************************
2689 * Get RFC 1413 identification *
2690 *************************************************/
2692 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2693 the timeout is set to zero, then the query is not done. There may also be lists
2694 of hosts and nets which are exempt. To guard against malefactors sending
2695 non-printing characters which could, for example, disrupt a message's headers,
2696 make sure the string consists of printing characters only.
2699 port the port to connect to; usually this is IDENT_PORT (113), but when
2700 running in the test harness with -bh a different value is used.
2704 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2708 verify_get_ident(int port)
2710 client_conn_ctx ident_conn_ctx = {0};
2712 int received_sender_port, received_interface_port, n;
2715 uschar buffer[2048];
2717 /* Default is no ident. Check whether we want to do an ident check for this
2720 sender_ident = NULL;
2721 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2724 DEBUG(D_ident) debug_printf("doing ident callback\n");
2726 /* Set up a connection to the ident port of the remote host. Bind the local end
2727 to the incoming interface address. If the sender host address is an IPv6
2728 address, the incoming interface address will also be IPv6. */
2730 host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
2731 if ((ident_conn_ctx.sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
2733 if (ip_bind(ident_conn_ctx.sock, host_af, interface_address, 0) < 0)
2735 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2740 /* Construct and send the query. */
2742 qlen = snprintf(CS buffer, sizeof(buffer), "%d , %d\r\n",
2743 sender_host_port, interface_port);
2744 early_data.data = buffer;
2745 early_data.len = qlen;
2747 /*XXX we trust that the query is idempotent */
2748 if (ip_connect(ident_conn_ctx.sock, host_af, sender_host_address, port,
2749 rfc1413_query_timeout, &early_data) < 0)
2751 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
2752 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2753 sender_host_address);
2755 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2756 sender_host_address, strerror(errno));
2760 /* Read a response line. We put it into the rest of the buffer, using several
2761 recv() calls if necessary. */
2769 int size = sizeof(buffer) - (p - buffer);
2771 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2772 count = ip_recv(&ident_conn_ctx, p, size, time(NULL) + rfc1413_query_timeout);
2773 if (count <= 0) goto END_OFF; /* Read error or EOF */
2775 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2776 generous, and accept a plain \n terminator as well. The only illegal
2779 for (pp = p; pp < p + count; pp++)
2781 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2784 if (pp[-1] == '\r') pp--;
2786 goto GOT_DATA; /* Break out of both loops */
2790 /* Reached the end of the data without finding \n. Let the loop continue to
2791 read some more, if there is room. */
2798 /* We have received a line of data. Check it carefully. It must start with the
2799 same two port numbers that we sent, followed by data as defined by the RFC. For
2802 12345 , 25 : USERID : UNIX :root
2804 However, the amount of white space may be different to what we sent. In the
2805 "osname" field there may be several sub-fields, comma separated. The data we
2806 actually want to save follows the third colon. Some systems put leading spaces
2807 in it - we discard those. */
2809 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2810 &received_interface_port, &n) != 2 ||
2811 received_sender_port != sender_host_port ||
2812 received_interface_port != interface_port)
2815 p = buffer + qlen + n;
2816 while(isspace(*p)) p++;
2817 if (*p++ != ':') goto END_OFF;
2818 while(isspace(*p)) p++;
2819 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2821 while(isspace(*p)) p++;
2822 if (*p++ != ':') goto END_OFF;
2823 while (*p != 0 && *p != ':') p++;
2824 if (*p++ == 0) goto END_OFF;
2825 while(isspace(*p)) p++;
2826 if (*p == 0) goto END_OFF;
2828 /* The rest of the line is the data we want. We turn it into printing
2829 characters when we save it, so that it cannot mess up the format of any logging
2830 or Received: lines into which it gets inserted. We keep a maximum of 127
2831 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
2833 sender_ident = US string_printing(string_copyn(p, 127));
2834 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2837 (void)close(ident_conn_ctx.sock);
2844 /*************************************************
2845 * Match host to a single host-list item *
2846 *************************************************/
2848 /* This function compares a host (name or address) against a single item
2849 from a host list. The host name gets looked up if it is needed and is not
2850 already known. The function is called from verify_check_this_host() via
2851 match_check_list(), which is why most of its arguments are in a single block.
2854 arg the argument block (see below)
2855 ss the host-list item
2856 valueptr where to pass back looked up data, or NULL
2857 error for error message when returning ERROR
2860 host_name (a) the host name, or
2861 (b) NULL, implying use sender_host_name and
2862 sender_host_aliases, looking them up if required, or
2863 (c) the empty string, meaning that only IP address matches
2865 host_address the host address
2866 host_ipv4 the IPv4 address taken from an IPv6 one
2870 DEFER lookup deferred
2871 ERROR (a) failed to find the host name or IP address, or
2872 (b) unknown lookup type specified, or
2873 (c) host name encountered when only IP addresses are
2878 check_host(void * arg, const uschar * ss, const uschar ** valueptr, uschar ** error)
2880 check_host_block * cb = (check_host_block *)arg;
2883 BOOL iplookup = FALSE, isquery = FALSE;
2884 BOOL isiponly = cb->host_name && !cb->host_name[0];
2886 uschar * semicolon, * endname, * opts;
2889 /* Optimize for the special case when the pattern is "*". */
2891 if (*ss == '*' && !ss[1]) return OK;
2893 /* If the pattern is empty, it matches only in the case when there is no host -
2894 this can occur in ACL checking for SMTP input using the -bs option. In this
2895 situation, the host address is the empty string. */
2897 if (!cb->host_address[0]) return *ss ? FAIL : OK;
2898 if (!*ss) return FAIL;
2900 /* If the pattern is precisely "@" then match against the primary host name,
2901 provided that host name matching is permitted; if it's "@[]" match against the
2902 local host's IP addresses. */
2907 if (isiponly) return ERROR;
2908 ss = primary_hostname;
2910 else if (Ustrcmp(ss, "@[]") == 0)
2912 for (ip_address_item * ip = host_find_interfaces(); ip; ip = ip->next)
2913 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2917 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2918 a (possibly masked) comparison with the current IP address. */
2920 if (string_is_ip_address(ss, &maskoffset) != 0)
2921 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2923 /* The pattern is not an IP address. A common error that people make is to omit
2924 one component of an IPv4 address, either by accident, or believing that, for
2925 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2926 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2927 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2928 ancient specification.) To aid in debugging these cases, we give a specific
2929 error if the pattern contains only digits and dots or contains a slash preceded
2930 only by digits and dots (a slash at the start indicates a file name and of
2931 course slashes may be present in lookups, but not preceded only by digits and
2934 for (t = ss; isdigit(*t) || *t == '.'; ) t++;
2935 if (!*t || (*t == '/' && t != ss))
2937 *error = US"malformed IPv4 address or address mask";
2941 /* See if there is a semicolon in the pattern, separating a searchtype
2942 prefix. If there is one then check for comma-sep options. */
2944 if ((semicolon = Ustrchr(ss, ';')))
2945 if ((opts = Ustrchr(ss, ',')) && opts < semicolon)
2948 opts = string_copyn(opts, semicolon - opts);
2952 endname = semicolon;
2956 /* If we are doing an IP address only match, then all lookups must be IP
2957 address lookups, even if there is no "net-". */
2960 iplookup = semicolon != NULL;
2962 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
2963 a lookup on a masked IP network, in textual form. We obey this code even if we
2964 have already set iplookup, so as to skip over the "net-" prefix and to set the
2965 mask length. The net- stuff really only applies to single-key lookups where the
2966 key is implicit. For query-style lookups the key is specified in the query.
2967 From release 4.30, the use of net- for query style is no longer needed, but we
2968 retain it for backward compatibility. */
2970 if (Ustrncmp(ss, "net", 3) == 0 && semicolon)
2973 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2974 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2975 iplookup = *t++ == '-';
2980 /* Do the IP address lookup if that is indeed what we have */
2988 uschar *filename, *key, *result;
2991 /* Find the search type */
2993 search_type = search_findtype(t, endname - t);
2995 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2996 search_error_message);
2998 /* Adjust parameters for the type of lookup. For a query-style lookup, there
2999 is no file name, and the "key" is just the query. For query-style with a file
3000 name, we have to fish the file off the start of the query. For a single-key
3001 lookup, the key is the current IP address, masked appropriately, and
3002 reconverted to text form, with the mask appended. For IPv6 addresses, specify
3003 dot separators instead of colons, except when the lookup type is "iplsearch".
3006 if (mac_islookup(search_type, lookup_absfilequery))
3008 filename = semicolon + 1;
3010 while (*key != 0 && !isspace(*key)) key++;
3011 filename = string_copyn(filename, key - filename);
3012 while (isspace(*key)) key++;
3014 else if (mac_islookup(search_type, lookup_querystyle))
3017 key = semicolon + 1;
3019 else /* Single-key style */
3021 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
3023 insize = host_aton(cb->host_address, incoming);
3024 host_mask(insize, incoming, mlen);
3025 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
3027 filename = semicolon + 1;
3030 /* Now do the actual lookup; note that there is no search_close() because
3031 of the caching arrangements. */
3033 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3034 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3036 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL, opts);
3037 if (valueptr) *valueptr = result;
3038 return result ? OK : f.search_find_defer ? DEFER: FAIL;
3041 /* The pattern is not an IP address or network reference of any kind. That is,
3042 it is a host name pattern. If this is an IP only match, there's an error in the
3047 *error = US"cannot match host name in match_ip list";
3051 /* Check the characters of the pattern to see if they comprise only letters,
3052 digits, full stops, and hyphens (the constituents of domain names). Allow
3053 underscores, as they are all too commonly found. Sigh. Also, if
3054 allow_utf8_domains is set, allow top-bit characters. */
3056 for (t = ss; *t != 0; t++)
3057 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3058 (!allow_utf8_domains || *t < 128)) break;
3060 /* If the pattern is a complete domain name, with no fancy characters, look up
3061 its IP address and match against that. Note that a multi-homed host will add
3062 items to the chain. */
3073 /* Using byname rather than bydns here means we cannot determine dnssec
3074 status. On the other hand it is unclear how that could be either
3075 propagated up or enforced. */
3077 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3078 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3080 for (host_item * hh = &h; hh; hh = hh->next)
3081 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3084 if (rc == HOST_FIND_AGAIN) return DEFER;
3085 *error = string_sprintf("failed to find IP address for %s", ss);
3089 /* Almost all subsequent comparisons require the host name, and can be done
3090 using the general string matching function. When this function is called for
3091 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3092 must use sender_host_name and its aliases, looking them up if necessary. */
3094 if (cb->host_name) /* Explicit host name given */
3095 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3098 /* Host name not given; in principle we need the sender host name and its
3099 aliases. However, for query-style lookups, we do not need the name if the
3100 query does not contain $sender_host_name. From release 4.23, a reference to
3101 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3104 if ((semicolon = Ustrchr(ss, ';')))
3106 const uschar * affix, * opts;
3107 int partial, affixlen, starflags, id;
3110 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags,
3114 if (id < 0) /* Unknown lookup type */
3116 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3117 search_error_message, ss);
3120 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3125 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3128 case DEFER: return DEFER;
3129 default: return FAIL;
3133 /* Not a query-style lookup; must ensure the host name is present, and then we
3134 do a check on the name and all its aliases. */
3136 if (!sender_host_name)
3138 HDEBUG(D_host_lookup)
3139 debug_printf("sender host name required, to match against %s\n", ss);
3140 if (host_lookup_failed || host_name_lookup() != OK)
3142 *error = string_sprintf("failed to find host name for %s",
3143 sender_host_address);;
3146 host_build_sender_fullhost();
3149 /* Match on the sender host name, using the general matching function */
3151 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE, valueptr))
3154 case DEFER: return DEFER;
3157 /* If there are aliases, try matching on them. */
3159 aliases = sender_host_aliases;
3161 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3164 case DEFER: return DEFER;
3172 /*************************************************
3173 * Check a specific host matches a host list *
3174 *************************************************/
3176 /* This function is passed a host list containing items in a number of
3177 different formats and the identity of a host. Its job is to determine whether
3178 the given host is in the set of hosts defined by the list. The host name is
3179 passed as a pointer so that it can be looked up if needed and not already
3180 known. This is commonly the case when called from verify_check_host() to check
3181 an incoming connection. When called from elsewhere the host name should usually
3184 This function is now just a front end to match_check_list(), which runs common
3185 code for scanning a list. We pass it the check_host() function to perform a
3189 listptr pointer to the host list
3190 cache_bits pointer to cache for named lists, or NULL
3191 host_name the host name or NULL, implying use sender_host_name and
3192 sender_host_aliases, looking them up if required
3193 host_address the IP address
3194 valueptr if not NULL, data from a lookup is passed back here
3196 Returns: OK if the host is in the defined set
3197 FAIL if the host is not in the defined set,
3198 DEFER if a data lookup deferred (not a host lookup)
3200 If the host name was needed in order to make a comparison, and could not be
3201 determined from the IP address, the result is FAIL unless the item
3202 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3205 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3206 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3209 unsigned int *local_cache_bits = cache_bits;
3210 const uschar *save_host_address = deliver_host_address;
3211 check_host_block cb = { .host_name = host_name, .host_address = host_address };
3213 if (valueptr) *valueptr = NULL;
3215 /* If the host address starts off ::ffff: it is an IPv6 address in
3216 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3219 cb.host_ipv4 = Ustrncmp(host_address, "::ffff:", 7) == 0
3220 ? host_address + 7 : host_address;
3222 /* During the running of the check, put the IP address into $host_address. In
3223 the case of calls from the smtp transport, it will already be there. However,
3224 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3225 the safe side, any existing setting is preserved, though as I write this
3226 (November 2004) I can't see any cases where it is actually needed. */
3228 deliver_host_address = host_address;
3229 rc = match_check_list(
3230 listptr, /* the list */
3231 0, /* separator character */
3232 &hostlist_anchor, /* anchor pointer */
3233 &local_cache_bits, /* cache pointer */
3234 check_host, /* function for testing */
3235 &cb, /* argument for function */
3236 MCL_HOST, /* type of check */
3237 (host_address == sender_host_address)?
3238 US"host" : host_address, /* text for debugging */
3239 valueptr); /* where to pass back data */
3240 deliver_host_address = save_host_address;
3247 /*************************************************
3248 * Check the given host item matches a list *
3249 *************************************************/
3251 verify_check_given_host(const uschar **listptr, const host_item *host)
3253 return verify_check_this_host(listptr, NULL, host->name, host->address, NULL);
3256 /*************************************************
3257 * Check the remote host matches a list *
3258 *************************************************/
3260 /* This is a front end to verify_check_this_host(), created because checking
3261 the remote host is a common occurrence. With luck, a good compiler will spot
3262 the tail recursion and optimize it. If there's no host address, this is
3263 command-line SMTP input - check against an empty string for the address.
3266 listptr pointer to the host list
3268 Returns: the yield of verify_check_this_host(),
3269 i.e. OK, FAIL, or DEFER
3273 verify_check_host(uschar **listptr)
3275 return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
3276 sender_host_address ? sender_host_address : US"", NULL);
3283 /*************************************************
3284 * Invert an IP address *
3285 *************************************************/
3287 /* Originally just used for DNS xBL lists, now also used for the
3288 reverse_ip expansion operator.
3291 buffer where to put the answer
3292 address the address to invert
3296 invert_address(uschar *buffer, uschar *address)
3299 uschar *bptr = buffer;
3301 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3302 to the IPv4 part only. */
3304 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3306 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3309 if (host_aton(address, bin) == 1)
3312 for (int i = 0; i < 4; i++)
3314 sprintf(CS bptr, "%d.", x & 255);
3315 while (*bptr) bptr++;
3320 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3321 in any DNS black lists, and the format in which they will be looked up is
3322 unknown. This is just a guess. */
3326 for (int j = 3; j >= 0; j--)
3329 for (int i = 0; i < 8; i++)
3331 sprintf(CS bptr, "%x.", x & 15);
3332 while (*bptr) bptr++;
3338 /* Remove trailing period -- this is needed so that both arbitrary
3339 dnsbl keydomains and inverted addresses may be combined with the
3340 same format string, "%s.%s" */
3347 /****************************************************
3348 Verify a local user account for quota sufficiency
3349 ****************************************************/
3351 /* The real work, done via a re-exec for privs, calls
3352 down to the transport for the quota check.
3354 Route and transport (in recipient-verify mode) the
3357 A routing result indicating any transport type other than appendfile
3360 Return, on stdout, a result string containing:
3361 - highlevel result code (OK, DEFER, FAIL)
3368 verify_quota(uschar * address)
3370 address_item vaddr = {.address = address};
3372 uschar * msg = US"\0";
3375 if ((rc = verify_address(&vaddr, NULL, vopt_is_recipient | vopt_quota,
3376 1, 0, 0, NULL, NULL, &routed)) != OK)
3378 uschar * where = recipient_verify_failure;
3379 msg = acl_verify_message ? acl_verify_message : vaddr.message;
3380 if (!msg) msg = US"";
3381 if (rc == DEFER && vaddr.basic_errno == ERRNO_EXIMQUOTA)
3383 rc = FAIL; /* DEFER -> FAIL */
3385 vaddr.basic_errno = 0;
3387 else if (!where) where = US"";
3389 len = 5 + Ustrlen(msg) + 1 + Ustrlen(where);
3390 msg = string_sprintf("%c%c%c%c%c%s%c%s", (uschar)rc,
3391 (vaddr.basic_errno >> 24) & 0xff, (vaddr.basic_errno >> 16) & 0xff,
3392 (vaddr.basic_errno >> 8) & 0xff, vaddr.basic_errno & 0xff,
3396 DEBUG(D_verify) debug_printf_indent("verify_quota: len %d\n", len);
3402 /******************************************************************************/
3404 /* Quota cache lookup. We use the callout hints db also for the quota cache.
3405 Return TRUE if a nonexpired record was found, having filled in the yield
3410 cached_quota_lookup(const uschar * rcpt, int * yield,
3411 int pos_cache, int neg_cache)
3413 open_db dbblock, *dbm_file = NULL;
3414 dbdata_callout_cache_address * cache_address_record;
3416 if (!pos_cache && !neg_cache)
3418 if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
3420 HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n");
3423 if (!(cache_address_record = (dbdata_callout_cache_address *)
3424 get_callout_cache_record(dbm_file, rcpt, US"address",
3425 pos_cache, neg_cache)))
3427 dbfn_close(dbm_file);
3430 if (cache_address_record->result == ccache_accept)
3432 dbfn_close(dbm_file);
3436 /* Quota cache write */
3439 cache_quota_write(const uschar * rcpt, int yield, int pos_cache, int neg_cache)
3441 open_db dbblock, *dbm_file = NULL;
3442 dbdata_callout_cache_address cache_address_record;
3444 if (!pos_cache && !neg_cache)
3446 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
3448 HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n");
3452 cache_address_record.result = yield == OK ? ccache_accept : ccache_reject;
3454 (void)dbfn_write(dbm_file, rcpt, &cache_address_record,
3455 (int)sizeof(dbdata_callout_cache_address));
3456 HDEBUG(D_verify) debug_printf_indent("wrote %s quota cache record for %s\n",
3457 yield == OK ? "positive" : "negative", rcpt);
3459 dbfn_close(dbm_file);
3464 /* To evaluate a local user's quota, starting in ACL, we need to
3465 fork & exec to regain privileges, to that we can change to the user's
3466 identity for access to their files.
3469 rcpt Recipient account
3470 pos_cache Number of seconds to cache a positive result (delivery
3471 to be accepted). Zero to disable caching.
3472 neg_cache Number of seconds to cache a negative result. Zero to disable.
3473 msg Pointer to result string pointer
3475 Return: OK/DEFER/FAIL code
3479 verify_quota_call(const uschar * rcpt, int pos_cache, int neg_cache,
3482 int pfd[2], pid, save_errno, yield = FAIL;
3483 void (*oldsignal)(int);
3484 const uschar * where = US"socketpair";
3488 if (cached_quota_lookup(rcpt, &yield, pos_cache, neg_cache))
3490 HDEBUG(D_verify) debug_printf_indent("quota cache: address record is %s\n",
3491 yield == OK ? "positive" : "negative");
3494 recipient_verify_failure = US"quota";
3495 acl_verify_message = *msg =
3496 US"Previous (cached) quota verification failure";
3505 oldsignal = signal(SIGCHLD, SIG_DFL);
3506 if ((pid = exim_fork(US"quota-verify")) < 0)
3509 close(pfd[pipe_write]);
3510 close(pfd[pipe_read]);
3515 if (pid == 0) /* child */
3517 close(pfd[pipe_read]);
3518 force_fd(pfd[pipe_write], 1); /* stdout to pipe */
3519 close(pfd[pipe_write]);
3521 if (debug_fd > 0) force_fd(debug_fd, 2);
3523 child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 3,
3524 US"-MCq", string_sprintf("%d", message_size), rcpt);
3529 close(pfd[pipe_write]);
3533 DEBUG(D_verify) debug_printf_indent(" fork: %s\n", strerror(save_errno));
3538 int n = read(pfd[pipe_read], buf, sizeof(buf));
3541 waitpid(pid, &status, 0);
3546 if (n > 0) yield = buf[0];
3548 save_errno = (buf[1] << 24) | (buf[2] << 16) | (buf[3] << 8) | buf[4];
3549 if ((recipient_verify_failure = n > 5
3550 ? string_copyn_taint(buf+5, n-5, GET_UNTAINTED) : NULL))
3553 s = buf + 5 + Ustrlen(recipient_verify_failure) + 1;
3555 acl_verify_message = *msg =
3556 m > 0 ? string_copyn_taint(s, m, GET_UNTAINTED) : NULL;
3559 DEBUG(D_verify) debug_printf_indent("verify call response:"
3560 " len %d yield %s errno '%s' where '%s' msg '%s'\n",
3561 n, rc_names[yield], strerror(save_errno), recipient_verify_failure, *msg);
3564 || save_errno == 0 && Ustrcmp(recipient_verify_failure, "quota") == 0)
3565 cache_quota_write(rcpt, yield, pos_cache, neg_cache);
3566 else DEBUG(D_verify)
3567 debug_printf_indent("result not cacheable\n");
3572 debug_printf_indent("verify call response: waitpid status 0x%04x\n", status);
3576 close(pfd[pipe_read]);
3577 signal(SIGCHLD, oldsignal);
3582 DEBUG(D_verify) debug_printf_indent("verify_quota_call fail in %s\n", where);
3589 /* End of verify.c */