1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
8
9 /* Functions concerned with verifying things. The original code for callout
10 caching was contributed by Kevin Fleming (but I hacked it around a bit). */
11
12
13 #include "exim.h"
14 #include "transports/smtp.h"
15
16 #define CUTTHROUGH_CMD_TIMEOUT 30 /* timeout for cutthrough-routing calls */
17 #define CUTTHROUGH_DATA_TIMEOUT 60 /* timeout for cutthrough-routing calls */
18 static smtp_context ctctx;
19 uschar ctbuffer[8192];
20
21
22 static uschar cutthrough_response(client_conn_ctx *, char, uschar **, int);
23
24
25
26 /*************************************************
27 * Retrieve a callout cache record *
28 *************************************************/
29
30 /* If a record exists, check whether it has expired.
31
32 Arguments:
33 dbm_file an open hints file
34 key the record key
35 type "address" or "domain"
36 positive_expire expire time for positive records
37 negative_expire expire time for negative records
38
39 Returns: the cache record if a non-expired one exists, else NULL
40 */
41
42 static dbdata_callout_cache *
get_callout_cache_record(open_db * dbm_file,const uschar * key,uschar * type,int positive_expire,int negative_expire)43 get_callout_cache_record(open_db *dbm_file, const uschar *key, uschar *type,
44 int positive_expire, int negative_expire)
45 {
46 BOOL negative;
47 int length, expire;
48 time_t now;
49 dbdata_callout_cache *cache_record;
50
51 if (!(cache_record = dbfn_read_with_length(dbm_file, key, &length)))
52 {
53 HDEBUG(D_verify) debug_printf_indent("callout cache: no %s record found for %s\n", type, key);
54 return NULL;
55 }
56
57 /* We treat a record as "negative" if its result field is not positive, or if
58 it is a domain record and the postmaster field is negative. */
59
60 negative = cache_record->result != ccache_accept ||
61 (type[0] == 'd' && cache_record->postmaster_result == ccache_reject);
62 expire = negative? negative_expire : positive_expire;
63 now = time(NULL);
64
65 if (now - cache_record->time_stamp > expire)
66 {
67 HDEBUG(D_verify) debug_printf_indent("callout cache: %s record expired for %s\n", type, key);
68 return NULL;
69 }
70
71 /* If this is a non-reject domain record, check for the obsolete format version
72 that doesn't have the postmaster and random timestamps, by looking at the
73 length. If so, copy it to a new-style block, replicating the record's
74 timestamp. Then check the additional timestamps. (There's no point wasting
75 effort if connections are rejected.) */
76
77 if (type[0] == 'd' && cache_record->result != ccache_reject)
78 {
79 if (length == sizeof(dbdata_callout_cache_obs))
80 {
81 dbdata_callout_cache *new = store_get(sizeof(dbdata_callout_cache), FALSE);
82 memcpy(new, cache_record, length);
83 new->postmaster_stamp = new->random_stamp = new->time_stamp;
84 cache_record = new;
85 }
86
87 if (now - cache_record->postmaster_stamp > expire)
88 cache_record->postmaster_result = ccache_unknown;
89
90 if (now - cache_record->random_stamp > expire)
91 cache_record->random_result = ccache_unknown;
92 }
93
94 HDEBUG(D_verify) debug_printf_indent("callout cache: found %s record for %s\n", type, key);
95 return cache_record;
96 }
97
98
99
100 /* Check the callout cache.
101 Options * pm_mailfrom may be modified by cache partial results.
102
103 Return: TRUE if result found
104 */
105
106 static BOOL
cached_callout_lookup(address_item * addr,uschar * address_key,uschar * from_address,int * opt_ptr,uschar ** pm_ptr,int * yield,uschar ** failure_ptr,dbdata_callout_cache * new_domain_record,int * old_domain_res)107 cached_callout_lookup(address_item * addr, uschar * address_key,
108 uschar * from_address, int * opt_ptr, uschar ** pm_ptr,
109 int * yield, uschar ** failure_ptr,
110 dbdata_callout_cache * new_domain_record, int * old_domain_res)
111 {
112 int options = *opt_ptr;
113 open_db dbblock;
114 open_db *dbm_file = NULL;
115
116 /* Open the callout cache database, if it exists, for reading only at this
117 stage, unless caching has been disabled. */
118
119 if (options & vopt_callout_no_cache)
120 {
121 HDEBUG(D_verify) debug_printf_indent("callout cache: disabled by no_cache\n");
122 }
123 else if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
124 {
125 HDEBUG(D_verify) debug_printf_indent("callout cache: not available\n");
126 }
127 else
128 {
129 /* If a cache database is available see if we can avoid the need to do an
130 actual callout by making use of previously-obtained data. */
131
132 dbdata_callout_cache_address * cache_address_record;
133 dbdata_callout_cache * cache_record = get_callout_cache_record(dbm_file,
134 addr->domain, US"domain",
135 callout_cache_domain_positive_expire, callout_cache_domain_negative_expire);
136
137 /* If an unexpired cache record was found for this domain, see if the callout
138 process can be short-circuited. */
139
140 if (cache_record)
141 {
142 /* In most cases, if an early command (up to and including MAIL FROM:<>)
143 was rejected, there is no point carrying on. The callout fails. However, if
144 we are doing a recipient verification with use_sender or use_postmaster
145 set, a previous failure of MAIL FROM:<> doesn't count, because this time we
146 will be using a non-empty sender. We have to remember this situation so as
147 not to disturb the cached domain value if this whole verification succeeds
148 (we don't want it turning into "accept"). */
149
150 *old_domain_res = cache_record->result;
151
152 if ( cache_record->result == ccache_reject
153 || *from_address == 0 && cache_record->result == ccache_reject_mfnull)
154 {
155 HDEBUG(D_verify)
156 debug_printf_indent("callout cache: domain gave initial rejection, or "
157 "does not accept HELO or MAIL FROM:<>\n");
158 setflag(addr, af_verify_nsfail);
159 addr->user_message = US"(result of an earlier callout reused).";
160 *yield = FAIL;
161 *failure_ptr = US"mail";
162 dbfn_close(dbm_file);
163 return TRUE;
164 }
165
166 /* If a previous check on a "random" local part was accepted, we assume
167 that the server does not do any checking on local parts. There is therefore
168 no point in doing the callout, because it will always be successful. If a
169 random check previously failed, arrange not to do it again, but preserve
170 the data in the new record. If a random check is required but hasn't been
171 done, skip the remaining cache processing. */
172
173 if (options & vopt_callout_random) switch(cache_record->random_result)
174 {
175 case ccache_accept:
176 HDEBUG(D_verify)
177 debug_printf_indent("callout cache: domain accepts random addresses\n");
178 *failure_ptr = US"random";
179 dbfn_close(dbm_file);
180 return TRUE; /* Default yield is OK */
181
182 case ccache_reject:
183 HDEBUG(D_verify)
184 debug_printf_indent("callout cache: domain rejects random addresses\n");
185 *opt_ptr = options & ~vopt_callout_random;
186 new_domain_record->random_result = ccache_reject;
187 new_domain_record->random_stamp = cache_record->random_stamp;
188 break;
189
190 default:
191 HDEBUG(D_verify)
192 debug_printf_indent("callout cache: need to check random address handling "
193 "(not cached or cache expired)\n");
194 dbfn_close(dbm_file);
195 return FALSE;
196 }
197
198 /* If a postmaster check is requested, but there was a previous failure,
199 there is again no point in carrying on. If a postmaster check is required,
200 but has not been done before, we are going to have to do a callout, so skip
201 remaining cache processing. */
202
203 if (*pm_ptr)
204 {
205 if (cache_record->postmaster_result == ccache_reject)
206 {
207 setflag(addr, af_verify_pmfail);
208 HDEBUG(D_verify)
209 debug_printf_indent("callout cache: domain does not accept "
210 "RCPT TO:<postmaster@domain>\n");
211 *yield = FAIL;
212 *failure_ptr = US"postmaster";
213 setflag(addr, af_verify_pmfail);
214 addr->user_message = US"(result of earlier verification reused).";
215 dbfn_close(dbm_file);
216 return TRUE;
217 }
218 if (cache_record->postmaster_result == ccache_unknown)
219 {
220 HDEBUG(D_verify)
221 debug_printf_indent("callout cache: need to check RCPT "
222 "TO:<postmaster@domain> (not cached or cache expired)\n");
223 dbfn_close(dbm_file);
224 return FALSE;
225 }
226
227 /* If cache says OK, set pm_mailfrom NULL to prevent a redundant
228 postmaster check if the address itself has to be checked. Also ensure
229 that the value in the cache record is preserved (with its old timestamp).
230 */
231
232 HDEBUG(D_verify) debug_printf_indent("callout cache: domain accepts RCPT "
233 "TO:<postmaster@domain>\n");
234 *pm_ptr = NULL;
235 new_domain_record->postmaster_result = ccache_accept;
236 new_domain_record->postmaster_stamp = cache_record->postmaster_stamp;
237 }
238 }
239
240 /* We can't give a result based on information about the domain. See if there
241 is an unexpired cache record for this specific address (combined with the
242 sender address if we are doing a recipient callout with a non-empty sender).
243 */
244
245 if (!(cache_address_record = (dbdata_callout_cache_address *)
246 get_callout_cache_record(dbm_file, address_key, US"address",
247 callout_cache_positive_expire, callout_cache_negative_expire)))
248 {
249 dbfn_close(dbm_file);
250 return FALSE;
251 }
252
253 if (cache_address_record->result == ccache_accept)
254 {
255 HDEBUG(D_verify)
256 debug_printf_indent("callout cache: address record is positive\n");
257 }
258 else
259 {
260 HDEBUG(D_verify)
261 debug_printf_indent("callout cache: address record is negative\n");
262 addr->user_message = US"Previous (cached) callout verification failure";
263 *failure_ptr = US"recipient";
264 *yield = FAIL;
265 }
266
267 /* Close the cache database while we actually do the callout for real. */
268
269 dbfn_close(dbm_file);
270 return TRUE;
271 }
272 return FALSE;
273 }
274
275
276 /* Write results to callout cache
277 */
278 static void
cache_callout_write(dbdata_callout_cache * dom_rec,const uschar * domain,int done,dbdata_callout_cache_address * addr_rec,uschar * address_key)279 cache_callout_write(dbdata_callout_cache * dom_rec, const uschar * domain,
280 int done, dbdata_callout_cache_address * addr_rec, uschar * address_key)
281 {
282 open_db dbblock;
283 open_db *dbm_file = NULL;
284
285 /* If we get here with done == TRUE, a successful callout happened, and yield
286 will be set OK or FAIL according to the response to the RCPT command.
287 Otherwise, we looped through the hosts but couldn't complete the business.
288 However, there may be domain-specific information to cache in both cases.
289
290 The value of the result field in the new_domain record is ccache_unknown if
291 there was an error before or with MAIL FROM:, and errno was not zero,
292 implying some kind of I/O error. We don't want to write the cache in that case.
293 Otherwise the value is ccache_accept, ccache_reject, or ccache_reject_mfnull. */
294
295 if (dom_rec->result != ccache_unknown)
296 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
297 {
298 HDEBUG(D_verify) debug_printf_indent("callout cache: not available\n");
299 }
300 else
301 {
302 (void)dbfn_write(dbm_file, domain, dom_rec,
303 (int)sizeof(dbdata_callout_cache));
304 HDEBUG(D_verify) debug_printf_indent("wrote callout cache domain record for %s:\n"
305 " result=%d postmaster=%d random=%d\n",
306 domain,
307 dom_rec->result,
308 dom_rec->postmaster_result,
309 dom_rec->random_result);
310 }
311
312 /* If a definite result was obtained for the callout, cache it unless caching
313 is disabled. */
314
315 if (done && addr_rec->result != ccache_unknown)
316 {
317 if (!dbm_file)
318 dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE);
319 if (!dbm_file)
320 {
321 HDEBUG(D_verify) debug_printf_indent("no callout cache available\n");
322 }
323 else
324 {
325 (void)dbfn_write(dbm_file, address_key, addr_rec,
326 (int)sizeof(dbdata_callout_cache_address));
327 HDEBUG(D_verify) debug_printf_indent("wrote %s callout cache address record for %s\n",
328 addr_rec->result == ccache_accept ? "positive" : "negative",
329 address_key);
330 }
331 }
332
333 if (dbm_file) dbfn_close(dbm_file);
334 }
335
336
337 /* Cutthrough-multi. If the existing cached cutthrough connection matches
338 the one we would make for a subsequent recipient, use it. Send the RCPT TO
339 and check the result, nonpipelined as it may be wanted immediately for
340 recipient-verification.
341
342 It seems simpler to deal with this case separately from the main callout loop.
343 We will need to remember it has sent, or not, so that rcpt-acl tail code
344 can do it there for the non-rcpt-verify case. For this we keep an addresscount.
345
346 Return: TRUE for a definitive result for the recipient
347 */
348 static int
cutthrough_multi(address_item * addr,host_item * host_list,transport_feedback * tf,int * yield)349 cutthrough_multi(address_item * addr, host_item * host_list,
350 transport_feedback * tf, int * yield)
351 {
352 BOOL done = FALSE;
353
354 if (addr->transport == cutthrough.addr.transport)
355 for (host_item * host = host_list; host; host = host->next)
356 if (Ustrcmp(host->address, cutthrough.host.address) == 0)
357 {
358 int host_af;
359 uschar *interface = NULL; /* Outgoing interface to use; NULL => any */
360 int port = 25;
361
362 deliver_host = host->name;
363 deliver_host_address = host->address;
364 deliver_host_port = host->port;
365 deliver_domain = addr->domain;
366 transport_name = addr->transport->name;
367
368 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
369
370 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
371 US"callout")
372 || !smtp_get_port(tf->port, addr, &port, US"callout")
373 )
374 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
375 addr->message);
376
377 smtp_port_for_connect(host, port);
378
379 if ( ( interface == cutthrough.interface
380 || ( interface
381 && cutthrough.interface
382 && Ustrcmp(interface, cutthrough.interface) == 0
383 ) )
384 && host->port == cutthrough.host.port
385 )
386 {
387 uschar * resp = NULL;
388
389 /* Match! Send the RCPT TO, set done from the response */
390 done =
391 smtp_write_command(&ctctx, SCMD_FLUSH, "RCPT TO:<%.1000s>\r\n",
392 transport_rcpt_address(addr,
393 addr->transport->rcpt_include_affixes)) >= 0
394 && cutthrough_response(&cutthrough.cctx, '2', &resp,
395 CUTTHROUGH_DATA_TIMEOUT) == '2';
396
397 /* This would go horribly wrong if a callout fail was ignored by ACL.
398 We punt by abandoning cutthrough on a reject, like the
399 first-rcpt does. */
400
401 if (done)
402 {
403 address_item * na = store_get(sizeof(address_item), FALSE);
404 *na = cutthrough.addr;
405 cutthrough.addr = *addr;
406 cutthrough.addr.host_used = &cutthrough.host;
407 cutthrough.addr.next = na;
408
409 cutthrough.nrcpt++;
410 }
411 else
412 {
413 cancel_cutthrough_connection(TRUE, US"recipient rejected");
414 if (!resp || errno == ETIMEDOUT)
415 {
416 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
417 }
418 else if (errno == 0)
419 {
420 if (*resp == 0)
421 Ustrcpy(resp, US"connection dropped");
422
423 addr->message =
424 string_sprintf("response to \"%s\" was: %s",
425 big_buffer, string_printing(resp));
426
427 addr->user_message =
428 string_sprintf("Callout verification failed:\n%s", resp);
429
430 /* Hard rejection ends the process */
431
432 if (resp[0] == '5') /* Address rejected */
433 {
434 *yield = FAIL;
435 done = TRUE;
436 }
437 }
438 }
439 }
440 break; /* host_list */
441 }
442 if (!done)
443 cancel_cutthrough_connection(TRUE, US"incompatible connection");
444 return done;
445 }
446
447
448 /*************************************************
449 * Do callout verification for an address *
450 *************************************************/
451
452 /* This function is called from verify_address() when the address has routed to
453 a host list, and a callout has been requested. Callouts are expensive; that is
454 why a cache is used to improve the efficiency.
455
456 Arguments:
457 addr the address that's been routed
458 host_list the list of hosts to try
459 tf the transport feedback block
460
461 ifstring "interface" option from transport, or NULL
462 portstring "port" option from transport, or NULL
463 protocolstring "protocol" option from transport, or NULL
464 callout the per-command callout timeout
465 callout_overall the overall callout timeout (if < 0 use 4*callout)
466 callout_connect the callout connection timeout (if < 0 use callout)
467 options the verification options - these bits are used:
468 vopt_is_recipient => this is a recipient address
469 vopt_callout_no_cache => don't use callout cache
470 vopt_callout_fullpm => if postmaster check, do full one
471 vopt_callout_random => do the "random" thing
472 vopt_callout_recipsender => use real sender for recipient
473 vopt_callout_recippmaster => use postmaster for recipient
474 vopt_callout_hold => lazy close connection
475 se_mailfrom MAIL FROM address for sender verify; NULL => ""
476 pm_mailfrom if non-NULL, do the postmaster check with this sender
477
478 Returns: OK/FAIL/DEFER
479 */
480
481 static int
do_callout(address_item * addr,host_item * host_list,transport_feedback * tf,int callout,int callout_overall,int callout_connect,int options,uschar * se_mailfrom,uschar * pm_mailfrom)482 do_callout(address_item *addr, host_item *host_list, transport_feedback *tf,
483 int callout, int callout_overall, int callout_connect, int options,
484 uschar *se_mailfrom, uschar *pm_mailfrom)
485 {
486 int yield = OK;
487 int old_domain_cache_result = ccache_accept;
488 BOOL done = FALSE;
489 uschar *address_key;
490 uschar *from_address;
491 uschar *random_local_part = NULL;
492 const uschar *save_deliver_domain = deliver_domain;
493 uschar **failure_ptr = options & vopt_is_recipient
494 ? &recipient_verify_failure : &sender_verify_failure;
495 dbdata_callout_cache new_domain_record;
496 dbdata_callout_cache_address new_address_record;
497 time_t callout_start_time;
498
499 new_domain_record.result = ccache_unknown;
500 new_domain_record.postmaster_result = ccache_unknown;
501 new_domain_record.random_result = ccache_unknown;
502
503 memset(&new_address_record, 0, sizeof(new_address_record));
504
505 /* For a recipient callout, the key used for the address cache record must
506 include the sender address if we are using the real sender in the callout,
507 because that may influence the result of the callout. */
508
509 if (options & vopt_is_recipient)
510 if (options & vopt_callout_recipsender)
511 {
512 from_address = sender_address;
513 address_key = string_sprintf("%s/<%s>", addr->address, sender_address);
514 if (cutthrough.delivery) options |= vopt_callout_no_cache;
515 }
516 else if (options & vopt_callout_recippmaster)
517 {
518 from_address = string_sprintf("postmaster@%s", qualify_domain_sender);
519 address_key = string_sprintf("%s/<postmaster@%s>", addr->address,
520 qualify_domain_sender);
521 }
522 else
523 {
524 from_address = US"";
525 address_key = addr->address;
526 }
527
528 /* For a sender callout, we must adjust the key if the mailfrom address is not
529 empty. */
530
531 else
532 {
533 from_address = se_mailfrom ? se_mailfrom : US"";
534 address_key = *from_address
535 ? string_sprintf("%s/<%s>", addr->address, from_address) : addr->address;
536 }
537
538 if (cached_callout_lookup(addr, address_key, from_address,
539 &options, &pm_mailfrom, &yield, failure_ptr,
540 &new_domain_record, &old_domain_cache_result))
541 {
542 cancel_cutthrough_connection(TRUE, US"cache-hit");
543 goto END_CALLOUT;
544 }
545
546 if (!addr->transport)
547 {
548 HDEBUG(D_verify) debug_printf("cannot callout via null transport\n");
549 }
550
551 else if (Ustrcmp(addr->transport->driver_name, "smtp") != 0)
552 log_write(0, LOG_MAIN|LOG_PANIC|LOG_CONFIG_FOR, "callout transport '%s': %s is non-smtp",
553 addr->transport->name, addr->transport->driver_name);
554 else
555 {
556 smtp_transport_options_block *ob =
557 (smtp_transport_options_block *)addr->transport->options_block;
558 smtp_context * sx = NULL;
559
560 /* The information wasn't available in the cache, so we have to do a real
561 callout and save the result in the cache for next time, unless no_cache is set,
562 or unless we have a previously cached negative random result. If we are to test
563 with a random local part, ensure that such a local part is available. If not,
564 log the fact, but carry on without randomising. */
565
566 if (options & vopt_callout_random && callout_random_local_part)
567 if (!(random_local_part = expand_string(callout_random_local_part)))
568 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
569 "callout_random_local_part: %s", expand_string_message);
570
571 /* Compile regex' used by client-side smtp */
572
573 smtp_deliver_init();
574
575 /* Default the connect and overall callout timeouts if not set, and record the
576 time we are starting so that we can enforce it. */
577
578 if (callout_overall < 0) callout_overall = 4 * callout;
579 if (callout_connect < 0) callout_connect = callout;
580 callout_start_time = time(NULL);
581
582 /* Before doing a real callout, if this is an SMTP connection, flush the SMTP
583 output because a callout might take some time. When PIPELINING is active and
584 there are many recipients, the total time for doing lots of callouts can add up
585 and cause the client to time out. So in this case we forgo the PIPELINING
586 optimization. */
587
588 if (smtp_out && !f.disable_callout_flush) mac_smtp_fflush();
589
590 clearflag(addr, af_verify_pmfail); /* postmaster callout flag */
591 clearflag(addr, af_verify_nsfail); /* null sender callout flag */
592
593 /* cutthrough-multi: if a nonfirst rcpt has the same routing as the first,
594 and we are holding a cutthrough conn open, we can just append the rcpt to
595 that conn for verification purposes (and later delivery also). Simplest
596 coding means skipping this whole loop and doing the append separately. */
597
598 /* Can we re-use an open cutthrough connection? */
599 if ( cutthrough.cctx.sock >= 0
600 && (options & (vopt_callout_recipsender | vopt_callout_recippmaster))
601 == vopt_callout_recipsender
602 && !random_local_part
603 && !pm_mailfrom
604 )
605 done = cutthrough_multi(addr, host_list, tf, &yield);
606
607 /* If we did not use a cached connection, make connections to the hosts
608 and do real callouts. The list of hosts is passed in as an argument. */
609
610 for (host_item * host = host_list; host && !done; host = host->next)
611 {
612 int host_af;
613 int port = 25;
614 uschar * interface = NULL; /* Outgoing interface to use; NULL => any */
615
616 if (!host->address)
617 {
618 DEBUG(D_verify) debug_printf("no IP address for host name %s: skipping\n",
619 host->name);
620 continue;
621 }
622
623 /* Check the overall callout timeout */
624
625 if (time(NULL) - callout_start_time >= callout_overall)
626 {
627 HDEBUG(D_verify) debug_printf("overall timeout for callout exceeded\n");
628 break;
629 }
630
631 /* Set IPv4 or IPv6 */
632
633 host_af = Ustrchr(host->address, ':') ? AF_INET6 : AF_INET;
634
635 /* Expand and interpret the interface and port strings. The latter will not
636 be used if there is a host-specific port (e.g. from a manualroute router).
637 This has to be delayed till now, because they may expand differently for
638 different hosts. If there's a failure, log it, but carry on with the
639 defaults. */
640
641 deliver_host = host->name;
642 deliver_host_address = host->address;
643 deliver_host_port = host->port;
644 deliver_domain = addr->domain;
645 transport_name = addr->transport->name;
646
647 if ( !smtp_get_interface(tf->interface, host_af, addr, &interface,
648 US"callout")
649 || !smtp_get_port(tf->port, addr, &port, US"callout")
650 )
651 log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address,
652 addr->message);
653
654 if (!sx) sx = store_get(sizeof(*sx), TRUE); /* tainted buffers */
655 memset(sx, 0, sizeof(*sx));
656
657 sx->addrlist = sx->first_addr = addr;
658 sx->conn_args.host = host;
659 sx->conn_args.host_af = host_af,
660 sx->port = port;
661 sx->conn_args.interface = interface;
662 sx->helo_data = tf->helo_data;
663 sx->conn_args.tblock = addr->transport;
664 sx->verify = TRUE;
665
666 tls_retry_connection:
667 /* Set the address state so that errors are recorded in it */
668
669 addr->transport_return = PENDING_DEFER;
670 ob->connect_timeout = callout_connect;
671 ob->command_timeout = callout;
672
673 /* Get the channel set up ready for a message (MAIL FROM being the next
674 SMTP command to send. If we tried TLS but it failed, try again without
675 if permitted */
676
677 yield = smtp_setup_conn(sx, FALSE);
678 #ifndef DISABLE_TLS
679 if ( yield == DEFER
680 && addr->basic_errno == ERRNO_TLSFAILURE
681 && ob->tls_tempfail_tryclear
682 && verify_check_given_host(CUSS &ob->hosts_require_tls, host) != OK
683 )
684 {
685 log_write(0, LOG_MAIN,
686 "%s: callout unencrypted to %s [%s] (not in hosts_require_tls)",
687 addr->message, host->name, host->address);
688 addr->transport_return = PENDING_DEFER;
689 yield = smtp_setup_conn(sx, TRUE);
690 }
691 #endif
692 if (yield != OK)
693 {
694 errno = addr->basic_errno;
695 transport_name = NULL;
696 deliver_host = deliver_host_address = NULL;
697 deliver_domain = save_deliver_domain;
698
699 /* Failure to accept HELO is cached; this blocks the whole domain for all
700 senders. I/O errors and defer responses are not cached. */
701
702 if (yield == FAIL && (errno == 0 || errno == ERRNO_SMTPCLOSED))
703 {
704 setflag(addr, af_verify_nsfail);
705 new_domain_record.result = ccache_reject;
706 done = TRUE;
707 }
708 else
709 done = FALSE;
710 goto no_conn;
711 }
712
713 /* If we needed to authenticate, smtp_setup_conn() did that. Copy
714 the AUTH info for logging */
715
716 addr->authenticator = client_authenticator;
717 addr->auth_id = client_authenticated_id;
718
719 sx->from_addr = from_address;
720 sx->first_addr = sx->sync_addr = addr;
721 sx->ok = FALSE; /*XXX these 3 last might not be needed for verify? */
722 sx->send_rset = TRUE;
723 sx->completed_addr = FALSE;
724
725 new_domain_record.result = old_domain_cache_result == ccache_reject_mfnull
726 ? ccache_reject_mfnull : ccache_accept;
727
728 /* Do the random local part check first. Temporarily replace the recipient
729 with the "random" value */
730
731 if (random_local_part)
732 {
733 uschar * main_address = addr->address;
734 const uschar * rcpt_domain = addr->domain;
735
736 #ifdef SUPPORT_I18N
737 uschar * errstr = NULL;
738 if ( testflag(addr, af_utf8_downcvt)
739 && (rcpt_domain = string_domain_utf8_to_alabel(rcpt_domain,
740 &errstr), errstr)
741 )
742 {
743 addr->message = errstr;
744 errno = ERRNO_EXPANDFAIL;
745 setflag(addr, af_verify_nsfail);
746 done = FALSE;
747 rcpt_domain = US""; /*XXX errorhandling! */
748 }
749 #endif
750
751 /* This would be ok for 1st rcpt of a cutthrough (the case handled here;
752 subsequents are done in cutthrough_multi()), but no way to
753 handle a subsequent because of the RSET vaporising the MAIL FROM.
754 So refuse to support any. Most cutthrough use will not involve
755 random_local_part, so no loss. */
756 cancel_cutthrough_connection(TRUE, US"random-recipient");
757
758 addr->address = string_sprintf("%s@%.1000s",
759 random_local_part, rcpt_domain);
760 done = FALSE;
761
762 /* If accepted, we aren't going to do any further tests below.
763 Otherwise, cache a real negative response, and get back to the right
764 state to send RCPT. Unless there's some problem such as a dropped
765 connection, we expect to succeed, because the commands succeeded above.
766 However, some servers drop the connection after responding to an
767 invalid recipient, so on (any) error we drop and remake the connection.
768 XXX We don't care about that for postmaster_full. Should we?
769
770 XXX could we add another flag to the context, and have the common
771 code emit the RSET too? Even pipelined after the RCPT...
772 Then the main-verify call could use it if there's to be a subsequent
773 postmaster-verify.
774 The sync_responses() would need to be taught about it and we'd
775 need another return code filtering out to here.
776
777 Avoid using a SIZE option on the MAIL for all random-rcpt checks.
778 */
779
780 sx->avoid_option = OPTION_SIZE;
781
782 /* Remember when we last did a random test */
783 new_domain_record.random_stamp = time(NULL);
784
785 if (smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0)
786 switch(addr->transport_return)
787 {
788 case PENDING_OK: /* random was accepted, unfortunately */
789 new_domain_record.random_result = ccache_accept;
790 yield = OK; /* Only usable verify result we can return */
791 done = TRUE;
792 *failure_ptr = US"random";
793 goto no_conn;
794 case FAIL: /* rejected: the preferred result */
795 new_domain_record.random_result = ccache_reject;
796 sx->avoid_option = 0;
797
798 /* Between each check, issue RSET, because some servers accept only
799 one recipient after MAIL FROM:<>.
800 XXX We don't care about that for postmaster_full. Should we? */
801
802 if ((done =
803 smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0 &&
804 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout)))
805 break;
806
807 HDEBUG(D_acl|D_v)
808 debug_printf_indent("problem after random/rset/mfrom; reopen conn\n");
809 random_local_part = NULL;
810 #ifndef DISABLE_TLS
811 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
812 #endif
813 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
814 (void)close(sx->cctx.sock);
815 sx->cctx.sock = -1;
816 #ifndef DISABLE_EVENT
817 (void) event_raise(addr->transport->event_action,
818 US"tcp:close", NULL);
819 #endif
820 addr->address = main_address;
821 addr->transport_return = PENDING_DEFER;
822 sx->first_addr = sx->sync_addr = addr;
823 sx->ok = FALSE;
824 sx->send_rset = TRUE;
825 sx->completed_addr = FALSE;
826 goto tls_retry_connection;
827 case DEFER: /* 4xx response to random */
828 break; /* Just to be clear. ccache_unknown, !done. */
829 }
830
831 /* Re-setup for main verify, or for the error message when failing */
832 addr->address = main_address;
833 addr->transport_return = PENDING_DEFER;
834 sx->first_addr = sx->sync_addr = addr;
835 sx->ok = FALSE;
836 sx->send_rset = TRUE;
837 sx->completed_addr = FALSE;
838 }
839 else
840 done = TRUE;
841
842 /* Main verify. For rcpt-verify use SIZE if we know it and we're not cacheing;
843 for sndr-verify never use it. */
844
845 if (done)
846 {
847 if (!(options & vopt_is_recipient && options & vopt_callout_no_cache))
848 sx->avoid_option = OPTION_SIZE;
849
850 done = FALSE;
851 switch(smtp_write_mail_and_rcpt_cmds(sx, &yield))
852 {
853 case 0: switch(addr->transport_return) /* ok so far */
854 {
855 case PENDING_OK: done = TRUE;
856 new_address_record.result = ccache_accept;
857 break;
858 case FAIL: done = TRUE;
859 yield = FAIL;
860 *failure_ptr = US"recipient";
861 new_address_record.result = ccache_reject;
862 break;
863 default: break;
864 }
865 break;
866
867 case -1: /* MAIL response error */
868 *failure_ptr = US"mail";
869 if (errno == 0 && sx->buffer[0] == '5')
870 {
871 setflag(addr, af_verify_nsfail);
872 if (from_address[0] == 0)
873 new_domain_record.result = ccache_reject_mfnull;
874 }
875 break;
876 /* non-MAIL read i/o error */
877 /* non-MAIL response timeout */
878 /* internal error; channel still usable */
879 default: break; /* transmit failed */
880 }
881 }
882
883 addr->auth_sndr = client_authenticated_sender;
884
885 deliver_host = deliver_host_address = NULL;
886 deliver_domain = save_deliver_domain;
887
888 /* Do postmaster check if requested; if a full check is required, we
889 check for RCPT TO:<postmaster> (no domain) in accordance with RFC 821. */
890
891 if (done && pm_mailfrom)
892 {
893 /* Could possibly shift before main verify, just above, and be ok
894 for cutthrough. But no way to handle a subsequent rcpt, so just
895 refuse any */
896 cancel_cutthrough_connection(TRUE, US"postmaster verify");
897 HDEBUG(D_acl|D_v) debug_printf_indent("Cutthrough cancelled by presence of postmaster verify\n");
898
899 done = smtp_write_command(sx, SCMD_FLUSH, "RSET\r\n") >= 0
900 && smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', callout);
901
902 if (done)
903 {
904 uschar * main_address = addr->address;
905
906 /*XXX oops, affixes */
907 addr->address = string_sprintf("postmaster@%.1000s", addr->domain);
908 addr->transport_return = PENDING_DEFER;
909
910 sx->from_addr = pm_mailfrom;
911 sx->first_addr = sx->sync_addr = addr;
912 sx->ok = FALSE;
913 sx->send_rset = TRUE;
914 sx->completed_addr = FALSE;
915 sx->avoid_option = OPTION_SIZE;
916
917 if( smtp_write_mail_and_rcpt_cmds(sx, &yield) == 0
918 && addr->transport_return == PENDING_OK
919 )
920 done = TRUE;
921 else
922 done = (options & vopt_callout_fullpm) != 0
923 && smtp_write_command(sx, SCMD_FLUSH,
924 "RCPT TO:<postmaster>\r\n") >= 0
925 && smtp_read_response(sx, sx->buffer,
926 sizeof(sx->buffer), '2', callout);
927
928 /* Sort out the cache record */
929
930 new_domain_record.postmaster_stamp = time(NULL);
931
932 if (done)
933 new_domain_record.postmaster_result = ccache_accept;
934 else if (errno == 0 && sx->buffer[0] == '5')
935 {
936 *failure_ptr = US"postmaster";
937 setflag(addr, af_verify_pmfail);
938 new_domain_record.postmaster_result = ccache_reject;
939 }
940
941 addr->address = main_address;
942 }
943 }
944 /* For any failure of the main check, other than a negative response, we just
945 close the connection and carry on. We can identify a negative response by the
946 fact that errno is zero. For I/O errors it will be non-zero
947
948 Set up different error texts for logging and for sending back to the caller
949 as an SMTP response. Log in all cases, using a one-line format. For sender
950 callouts, give a full response to the caller, but for recipient callouts,
951 don't give the IP address because this may be an internal host whose identity
952 is not to be widely broadcast. */
953
954 no_conn:
955 switch(errno)
956 {
957 case ETIMEDOUT:
958 HDEBUG(D_verify) debug_printf("SMTP timeout\n");
959 sx->send_quit = FALSE;
960 break;
961
962 #ifdef SUPPORT_I18N
963 case ERRNO_UTF8_FWD:
964 {
965 extern int acl_where; /* src/acl.c */
966 errno = 0;
967 addr->message = US"response to \"EHLO\" did not include SMTPUTF8";
968 addr->user_message = acl_where == ACL_WHERE_RCPT
969 ? US"533 no support for internationalised mailbox name"
970 : US"550 mailbox unavailable";
971 yield = FAIL;
972 done = TRUE;
973 }
974 break;
975 #endif
976 case ECONNREFUSED:
977 sx->send_quit = FALSE;
978 break;
979
980 case 0:
981 if (*sx->buffer == 0) Ustrcpy(sx->buffer, US"connection dropped");
982
983 /*XXX test here is ugly; seem to have a split of responsibility for
984 building this message. Need to rationalise. Where is it done
985 before here, and when not?
986 Not == 5xx resp to MAIL on main-verify
987 */
988 if (!addr->message) addr->message =
989 string_sprintf("response to \"%s\" was: %s",
990 big_buffer, string_printing(sx->buffer));
991
992 /* RFC 5321 section 4.2: the text portion of the response may have only
993 HT, SP, Printable US-ASCII. Deal with awkward chars by cutting the
994 received message off before passing it onward. Newlines are ok; they
995 just become a multiline response (but wrapped in the error code we
996 produce). */
997
998 for (uschar * s = sx->buffer;
999 *s && s < sx->buffer + sizeof(sx->buffer);
1000 s++)
1001 {
1002 uschar c = *s;
1003 if (c != '\t' && c != '\n' && (c < ' ' || c > '~'))
1004 {
1005 if (s - sx->buffer < sizeof(sx->buffer) - 12)
1006 memcpy(s, "(truncated)", 12);
1007 else
1008 *s = '\0';
1009 break;
1010 }
1011 }
1012 addr->user_message = options & vopt_is_recipient
1013 ? string_sprintf("Callout verification failed:\n%s", sx->buffer)
1014 : string_sprintf("Called: %s\nSent: %s\nResponse: %s",
1015 host->address, big_buffer, sx->buffer);
1016
1017 /* Hard rejection ends the process */
1018
1019 if (sx->buffer[0] == '5') /* Address rejected */
1020 {
1021 yield = FAIL;
1022 done = TRUE;
1023 }
1024 break;
1025 }
1026
1027 /* End the SMTP conversation and close the connection. */
1028
1029 /* Cutthrough - on a successful connect and recipient-verify with
1030 use-sender and we are 1st rcpt and have no cutthrough conn so far
1031 here is where we want to leave the conn open. Ditto for a lazy-close
1032 verify. */
1033
1034 if (cutthrough.delivery)
1035 {
1036 if (addr->transport->filter_command)
1037 {
1038 cutthrough.delivery= FALSE;
1039 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of transport filter\n");
1040 }
1041 #ifndef DISABLE_DKIM
1042 if (ob->dkim.dkim_domain)
1043 {
1044 cutthrough.delivery= FALSE;
1045 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of DKIM signing\n");
1046 }
1047 #endif
1048 #ifdef EXPERIMENTAL_ARC
1049 if (ob->arc_sign)
1050 {
1051 cutthrough.delivery= FALSE;
1052 HDEBUG(D_acl|D_v) debug_printf("Cutthrough cancelled by presence of ARC signing\n");
1053 }
1054 #endif
1055 }
1056
1057 if ( (cutthrough.delivery || options & vopt_callout_hold)
1058 && rcpt_count == 1
1059 && done
1060 && yield == OK
1061 && (options & (vopt_callout_recipsender|vopt_callout_recippmaster|vopt_success_on_redirect))
1062 == vopt_callout_recipsender
1063 && !random_local_part
1064 && !pm_mailfrom
1065 && cutthrough.cctx.sock < 0
1066 && !sx->lmtp
1067 )
1068 {
1069 HDEBUG(D_acl|D_v) debug_printf_indent("holding verify callout open for %s\n",
1070 cutthrough.delivery
1071 ? "cutthrough delivery" : "potential further verifies and delivery");
1072
1073 cutthrough.callout_hold_only = !cutthrough.delivery;
1074 cutthrough.is_tls = tls_out.active.sock >= 0;
1075 /* We assume no buffer in use in the outblock */
1076 cutthrough.cctx = sx->cctx;
1077 cutthrough.nrcpt = 1;
1078 cutthrough.transport = addr->transport->name;
1079 cutthrough.interface = interface;
1080 cutthrough.snd_port = sending_port;
1081 cutthrough.peer_options = smtp_peer_options;
1082 cutthrough.host = *host;
1083 {
1084 int oldpool = store_pool;
1085 store_pool = POOL_PERM;
1086 cutthrough.snd_ip = string_copy(sending_ip_address);
1087 cutthrough.host.name = string_copy(host->name);
1088 cutthrough.host.address = string_copy(host->address);
1089 store_pool = oldpool;
1090 }
1091
1092 /* Save the address_item and parent chain for later logging */
1093 cutthrough.addr = *addr;
1094 cutthrough.addr.next = NULL;
1095 cutthrough.addr.host_used = &cutthrough.host;
1096 for (address_item * caddr = &cutthrough.addr, * parent = addr->parent;
1097 parent;
1098 caddr = caddr->parent, parent = parent->parent)
1099 *(caddr->parent = store_get(sizeof(address_item), FALSE)) = *parent;
1100
1101 ctctx.outblock.buffer = ctbuffer;
1102 ctctx.outblock.buffersize = sizeof(ctbuffer);
1103 ctctx.outblock.ptr = ctbuffer;
1104 /* ctctx.outblock.cmd_count = 0; ctctx.outblock.authenticating = FALSE; */
1105 ctctx.outblock.cctx = &cutthrough.cctx;
1106 }
1107 else
1108 {
1109 /* Ensure no cutthrough on multiple verifies that were incompatible */
1110 if (options & vopt_callout_recipsender)
1111 cancel_cutthrough_connection(TRUE, US"not usable for cutthrough");
1112 if (sx->send_quit)
1113 if (smtp_write_command(sx, SCMD_FLUSH, "QUIT\r\n") != -1)
1114 /* Wait a short time for response, and discard it */
1115 smtp_read_response(sx, sx->buffer, sizeof(sx->buffer), '2', 1);
1116
1117 if (sx->cctx.sock >= 0)
1118 {
1119 #ifndef DISABLE_TLS
1120 if (sx->cctx.tls_ctx)
1121 {
1122 tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1123 sx->cctx.tls_ctx = NULL;
1124 }
1125 #endif
1126 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1127 (void)close(sx->cctx.sock);
1128 sx->cctx.sock = -1;
1129 #ifndef DISABLE_EVENT
1130 (void) event_raise(addr->transport->event_action, US"tcp:close", NULL);
1131 #endif
1132 }
1133 }
1134
1135 if (!done || yield != OK)
1136 addr->message = string_sprintf("%s [%s] : %s", host->name, host->address,
1137 addr->message);
1138 } /* Loop through all hosts, while !done */
1139 }
1140
1141 /* If we get here with done == TRUE, a successful callout happened, and yield
1142 will be set OK or FAIL according to the response to the RCPT command.
1143 Otherwise, we looped through the hosts but couldn't complete the business.
1144 However, there may be domain-specific information to cache in both cases. */
1145
1146 if (!(options & vopt_callout_no_cache))
1147 cache_callout_write(&new_domain_record, addr->domain,
1148 done, &new_address_record, address_key);
1149
1150 /* Failure to connect to any host, or any response other than 2xx or 5xx is a
1151 temporary error. If there was only one host, and a response was received, leave
1152 it alone if supplying details. Otherwise, give a generic response. */
1153
1154 if (!done)
1155 {
1156 uschar * dullmsg = string_sprintf("Could not complete %s verify callout",
1157 options & vopt_is_recipient ? "recipient" : "sender");
1158 yield = DEFER;
1159
1160 addr->message = host_list->next || !addr->message
1161 ? dullmsg : string_sprintf("%s: %s", dullmsg, addr->message);
1162
1163 addr->user_message = smtp_return_error_details
1164 ? string_sprintf("%s for <%s>.\n"
1165 "The mail server(s) for the domain may be temporarily unreachable, or\n"
1166 "they may be permanently unreachable from this server. In the latter case,\n%s",
1167 dullmsg, addr->address,
1168 options & vopt_is_recipient
1169 ? "the address will never be accepted."
1170 : "you need to change the address or create an MX record for its domain\n"
1171 "if it is supposed to be generally accessible from the Internet.\n"
1172 "Talk to your mail administrator for details.")
1173 : dullmsg;
1174
1175 /* Force a specific error code */
1176
1177 addr->basic_errno = ERRNO_CALLOUTDEFER;
1178 }
1179
1180 /* Come here from within the cache-reading code on fast-track exit. */
1181
1182 END_CALLOUT:
1183 tls_modify_variables(&tls_in); /* return variables to inbound values */
1184 return yield;
1185 }
1186
1187
1188
1189 /* Called after recipient-acl to get a cutthrough connection open when
1190 one was requested and a recipient-verify wasn't subsequently done.
1191 */
1192 int
open_cutthrough_connection(address_item * addr)1193 open_cutthrough_connection(address_item * addr)
1194 {
1195 address_item addr2;
1196 int rc;
1197
1198 /* Use a recipient-verify-callout to set up the cutthrough connection. */
1199 /* We must use a copy of the address for verification, because it might
1200 get rewritten. */
1201
1202 addr2 = *addr;
1203 HDEBUG(D_acl) debug_printf_indent("----------- %s cutthrough setup ------------\n",
1204 rcpt_count > 1 ? "more" : "start");
1205 rc = verify_address(&addr2, NULL,
1206 vopt_is_recipient | vopt_callout_recipsender | vopt_callout_no_cache,
1207 CUTTHROUGH_CMD_TIMEOUT, -1, -1,
1208 NULL, NULL, NULL);
1209 addr->message = addr2.message;
1210 addr->user_message = addr2.user_message;
1211 HDEBUG(D_acl) debug_printf_indent("----------- end cutthrough setup ------------\n");
1212 return rc;
1213 }
1214
1215
1216
1217 /* Send given number of bytes from the buffer */
1218 static BOOL
cutthrough_send(int n)1219 cutthrough_send(int n)
1220 {
1221 if(cutthrough.cctx.sock < 0)
1222 return TRUE;
1223
1224 if(
1225 #ifndef DISABLE_TLS
1226 cutthrough.is_tls
1227 ? tls_write(cutthrough.cctx.tls_ctx, ctctx.outblock.buffer, n, FALSE)
1228 :
1229 #endif
1230 send(cutthrough.cctx.sock, ctctx.outblock.buffer, n, 0) > 0
1231 )
1232 {
1233 transport_count += n;
1234 ctctx.outblock.ptr= ctctx.outblock.buffer;
1235 return TRUE;
1236 }
1237
1238 HDEBUG(D_transport|D_acl) debug_printf_indent("cutthrough_send failed: %s\n", strerror(errno));
1239 return FALSE;
1240 }
1241
1242
1243
1244 static BOOL
_cutthrough_puts(uschar * cp,int n)1245 _cutthrough_puts(uschar * cp, int n)
1246 {
1247 while(n--)
1248 {
1249 if(ctctx.outblock.ptr >= ctctx.outblock.buffer+ctctx.outblock.buffersize)
1250 if(!cutthrough_send(ctctx.outblock.buffersize))
1251 return FALSE;
1252
1253 *ctctx.outblock.ptr++ = *cp++;
1254 }
1255 return TRUE;
1256 }
1257
1258 /* Buffered output of counted data block. Return boolean success */
1259 static BOOL
cutthrough_puts(uschar * cp,int n)1260 cutthrough_puts(uschar * cp, int n)
1261 {
1262 if (cutthrough.cctx.sock < 0) return TRUE;
1263 if (_cutthrough_puts(cp, n)) return TRUE;
1264 cancel_cutthrough_connection(TRUE, US"transmit failed");
1265 return FALSE;
1266 }
1267
1268 void
cutthrough_data_puts(uschar * cp,int n)1269 cutthrough_data_puts(uschar * cp, int n)
1270 {
1271 if (cutthrough.delivery) (void) cutthrough_puts(cp, n);
1272 return;
1273 }
1274
1275
1276 static BOOL
_cutthrough_flush_send(void)1277 _cutthrough_flush_send(void)
1278 {
1279 int n = ctctx.outblock.ptr - ctctx.outblock.buffer;
1280
1281 if(n>0)
1282 if(!cutthrough_send(n))
1283 return FALSE;
1284 return TRUE;
1285 }
1286
1287
1288 /* Send out any bufferred output. Return boolean success. */
1289 BOOL
cutthrough_flush_send(void)1290 cutthrough_flush_send(void)
1291 {
1292 if (_cutthrough_flush_send()) return TRUE;
1293 cancel_cutthrough_connection(TRUE, US"transmit failed");
1294 return FALSE;
1295 }
1296
1297
1298 static BOOL
cutthrough_put_nl(void)1299 cutthrough_put_nl(void)
1300 {
1301 return cutthrough_puts(US"\r\n", 2);
1302 }
1303
1304
1305 void
cutthrough_data_put_nl(void)1306 cutthrough_data_put_nl(void)
1307 {
1308 cutthrough_data_puts(US"\r\n", 2);
1309 }
1310
1311
1312 /* Get and check response from cutthrough target */
1313 static uschar
cutthrough_response(client_conn_ctx * cctx,char expect,uschar ** copy,int timeout)1314 cutthrough_response(client_conn_ctx * cctx, char expect, uschar ** copy, int timeout)
1315 {
1316 smtp_context sx = {0};
1317 uschar inbuffer[4096];
1318 uschar responsebuffer[4096];
1319
1320 sx.inblock.buffer = inbuffer;
1321 sx.inblock.buffersize = sizeof(inbuffer);
1322 sx.inblock.ptr = inbuffer;
1323 sx.inblock.ptrend = inbuffer;
1324 sx.inblock.cctx = cctx;
1325 if(!smtp_read_response(&sx, responsebuffer, sizeof(responsebuffer), expect, timeout))
1326 cancel_cutthrough_connection(TRUE, US"target timeout on read");
1327
1328 if(copy)
1329 {
1330 uschar * cp;
1331 *copy = cp = string_copy(responsebuffer);
1332 /* Trim the trailing end of line */
1333 cp += Ustrlen(responsebuffer);
1334 if(cp > *copy && cp[-1] == '\n') *--cp = '\0';
1335 if(cp > *copy && cp[-1] == '\r') *--cp = '\0';
1336 }
1337
1338 return responsebuffer[0];
1339 }
1340
1341
1342 /* Negotiate dataphase with the cutthrough target, returning success boolean */
1343 BOOL
cutthrough_predata(void)1344 cutthrough_predata(void)
1345 {
1346 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1347 return FALSE;
1348
1349 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> DATA\n");
1350 cutthrough_puts(US"DATA\r\n", 6);
1351 cutthrough_flush_send();
1352
1353 /* Assume nothing buffered. If it was it gets ignored. */
1354 return cutthrough_response(&cutthrough.cctx, '3', NULL, CUTTHROUGH_DATA_TIMEOUT) == '3';
1355 }
1356
1357
1358 /* tctx arg only to match write_chunk() */
1359 static BOOL
cutthrough_write_chunk(transport_ctx * tctx,uschar * s,int len)1360 cutthrough_write_chunk(transport_ctx * tctx, uschar * s, int len)
1361 {
1362 uschar * s2;
1363 while(s && (s2 = Ustrchr(s, '\n')))
1364 {
1365 if(!cutthrough_puts(s, s2-s) || !cutthrough_put_nl())
1366 return FALSE;
1367 s = s2+1;
1368 }
1369 return TRUE;
1370 }
1371
1372
1373 /* Buffered send of headers. Return success boolean. */
1374 /* Expands newlines to wire format (CR,NL). */
1375 /* Also sends header-terminating blank line. */
1376 BOOL
cutthrough_headers_send(void)1377 cutthrough_headers_send(void)
1378 {
1379 transport_ctx tctx;
1380
1381 if(cutthrough.cctx.sock < 0 || cutthrough.callout_hold_only)
1382 return FALSE;
1383
1384 /* We share a routine with the mainline transport to handle header add/remove/rewrites,
1385 but having a separate buffered-output function (for now)
1386 */
1387 HDEBUG(D_acl) debug_printf_indent("----------- start cutthrough headers send -----------\n");
1388
1389 tctx.u.fd = cutthrough.cctx.sock;
1390 tctx.tblock = cutthrough.addr.transport;
1391 tctx.addr = &cutthrough.addr;
1392 tctx.check_string = US".";
1393 tctx.escape_string = US"..";
1394 /*XXX check under spool_files_wireformat. Might be irrelevant */
1395 tctx.options = topt_use_crlf;
1396
1397 if (!transport_headers_send(&tctx, &cutthrough_write_chunk))
1398 return FALSE;
1399
1400 HDEBUG(D_acl) debug_printf_indent("----------- done cutthrough headers send ------------\n");
1401 return TRUE;
1402 }
1403
1404
1405 static void
close_cutthrough_connection(const uschar * why)1406 close_cutthrough_connection(const uschar * why)
1407 {
1408 int fd = cutthrough.cctx.sock;
1409 if(fd >= 0)
1410 {
1411 /* We could be sending this after a bunch of data, but that is ok as
1412 the only way to cancel the transfer in dataphase is to drop the tcp
1413 conn before the final dot.
1414 */
1415 client_conn_ctx tmp_ctx = cutthrough.cctx;
1416 ctctx.outblock.ptr = ctbuffer;
1417 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> QUIT\n");
1418 _cutthrough_puts(US"QUIT\r\n", 6); /* avoid recursion */
1419 _cutthrough_flush_send();
1420 cutthrough.cctx.sock = -1; /* avoid recursion via read timeout */
1421 cutthrough.nrcpt = 0; /* permit re-cutthrough on subsequent message */
1422
1423 /* Wait a short time for response, and discard it */
1424 cutthrough_response(&tmp_ctx, '2', NULL, 1);
1425
1426 #ifndef DISABLE_TLS
1427 if (cutthrough.is_tls)
1428 {
1429 tls_close(cutthrough.cctx.tls_ctx, TLS_SHUTDOWN_NOWAIT);
1430 cutthrough.cctx.tls_ctx = NULL;
1431 cutthrough.is_tls = FALSE;
1432 }
1433 #endif
1434 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP(close)>>\n");
1435 (void)close(fd);
1436 HDEBUG(D_acl) debug_printf_indent("----------- cutthrough shutdown (%s) ------------\n", why);
1437 }
1438 ctctx.outblock.ptr = ctbuffer;
1439 }
1440
1441 void
cancel_cutthrough_connection(BOOL close_noncutthrough_verifies,const uschar * why)1442 cancel_cutthrough_connection(BOOL close_noncutthrough_verifies, const uschar * why)
1443 {
1444 if (cutthrough.delivery || close_noncutthrough_verifies)
1445 close_cutthrough_connection(why);
1446 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1447 }
1448
1449
1450 void
release_cutthrough_connection(const uschar * why)1451 release_cutthrough_connection(const uschar * why)
1452 {
1453 if (cutthrough.cctx.sock < 0) return;
1454 HDEBUG(D_acl) debug_printf_indent("release cutthrough conn: %s\n", why);
1455 cutthrough.cctx.sock = -1;
1456 cutthrough.cctx.tls_ctx = NULL;
1457 cutthrough.delivery = cutthrough.callout_hold_only = FALSE;
1458 }
1459
1460
1461
1462
1463 /* Have senders final-dot. Send one to cutthrough target, and grab the response.
1464 Log an OK response as a transmission.
1465 Close the connection.
1466 Return smtp response-class digit.
1467 */
1468 uschar *
cutthrough_finaldot(void)1469 cutthrough_finaldot(void)
1470 {
1471 uschar res;
1472 HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SMTP>> .\n");
1473
1474 /* Assume data finshed with new-line */
1475 if( !cutthrough_puts(US".", 1)
1476 || !cutthrough_put_nl()
1477 || !cutthrough_flush_send()
1478 )
1479 return cutthrough.addr.message;
1480
1481 res = cutthrough_response(&cutthrough.cctx, '2', &cutthrough.addr.message,
1482 CUTTHROUGH_DATA_TIMEOUT);
1483 for (address_item * addr = &cutthrough.addr; addr; addr = addr->next)
1484 {
1485 addr->message = cutthrough.addr.message;
1486 switch(res)
1487 {
1488 case '2':
1489 delivery_log(LOG_MAIN, addr, (int)'>', NULL);
1490 close_cutthrough_connection(US"delivered");
1491 break;
1492
1493 case '4':
1494 delivery_log(LOG_MAIN, addr, 0,
1495 US"tmp-reject from cutthrough after DATA:");
1496 break;
1497
1498 case '5':
1499 delivery_log(LOG_MAIN|LOG_REJECT, addr, 0,
1500 US"rejected after DATA:");
1501 break;
1502
1503 default:
1504 break;
1505 }
1506 }
1507 return cutthrough.addr.message;
1508 }
1509
1510
1511
1512 /*************************************************
1513 * Copy error to toplevel address *
1514 *************************************************/
1515
1516 /* This function is used when a verify fails or defers, to ensure that the
1517 failure or defer information is in the original toplevel address. This applies
1518 when an address is redirected to a single new address, and the failure or
1519 deferral happens to the child address.
1520
1521 Arguments:
1522 vaddr the verify address item
1523 addr the final address item
1524 yield FAIL or DEFER
1525
1526 Returns: the value of YIELD
1527 */
1528
1529 static int
copy_error(address_item * vaddr,address_item * addr,int yield)1530 copy_error(address_item *vaddr, address_item *addr, int yield)
1531 {
1532 if (addr != vaddr)
1533 {
1534 vaddr->message = addr->message;
1535 vaddr->user_message = addr->user_message;
1536 vaddr->basic_errno = addr->basic_errno;
1537 vaddr->more_errno = addr->more_errno;
1538 vaddr->prop.address_data = addr->prop.address_data;
1539 vaddr->prop.variables = NULL;
1540 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
1541 copyflag(vaddr, addr, af_pass_message);
1542 }
1543 return yield;
1544 }
1545
1546
1547
1548
1549 /**************************************************
1550 * printf that automatically handles TLS if needed *
1551 ***************************************************/
1552
1553 /* This function is used by verify_address() as a substitute for all fprintf()
1554 calls; a direct fprintf() will not produce output in a TLS SMTP session, such
1555 as a response to an EXPN command. smtp_in.c makes smtp_printf available but
1556 that assumes that we always use the smtp_out FILE* when not using TLS or the
1557 ssl buffer when we are. Instead we take a FILE* parameter and check to see if
1558 that is smtp_out; if so, smtp_printf() with TLS support, otherwise regular
1559 fprintf().
1560
1561 Arguments:
1562 f the candidate FILE* to write to
1563 format format string
1564 ... optional arguments
1565
1566 Returns:
1567 nothing
1568 */
1569
1570 static void PRINTF_FUNCTION(2,3)
respond_printf(FILE * f,const char * format,...)1571 respond_printf(FILE *f, const char *format, ...)
1572 {
1573 va_list ap;
1574
1575 va_start(ap, format);
1576 if (smtp_out && (f == smtp_out))
1577 smtp_vprintf(format, FALSE, ap);
1578 else
1579 vfprintf(f, format, ap);
1580 va_end(ap);
1581 }
1582
1583
1584
1585 /*************************************************
1586 * Verify an email address *
1587 *************************************************/
1588
1589 /* This function is used both for verification (-bv and at other times) and
1590 address testing (-bt), which is indicated by address_test_mode being set.
1591
1592 Arguments:
1593 vaddr contains the address to verify; the next field in this block
1594 must be NULL
1595 fp if not NULL, write the result to this file
1596 options various option bits:
1597 vopt_fake_sender => this sender verify is not for the real
1598 sender (it was verify=sender=xxxx or an address from a
1599 header line) - rewriting must not change sender_address
1600 vopt_is_recipient => this is a recipient address, otherwise
1601 it's a sender address - this affects qualification and
1602 rewriting and messages from callouts
1603 vopt_qualify => qualify an unqualified address; else error
1604 vopt_expn => called from SMTP EXPN command
1605 vopt_success_on_redirect => when a new address is generated
1606 the verification instantly succeeds
1607
1608 These ones are used by do_callout() -- the options variable
1609 is passed to it.
1610
1611 vopt_callout_fullpm => if postmaster check, do full one
1612 vopt_callout_no_cache => don't use callout cache
1613 vopt_callout_random => do the "random" thing
1614 vopt_callout_recipsender => use real sender for recipient
1615 vopt_callout_recippmaster => use postmaster for recipient
1616
1617 callout if > 0, specifies that callout is required, and gives timeout
1618 for individual commands
1619 callout_overall if > 0, gives overall timeout for the callout function;
1620 if < 0, a default is used (see do_callout())
1621 callout_connect the connection timeout for callouts
1622 se_mailfrom when callout is requested to verify a sender, use this
1623 in MAIL FROM; NULL => ""
1624 pm_mailfrom when callout is requested, if non-NULL, do the postmaster
1625 thing and use this as the sender address (may be "")
1626
1627 routed if not NULL, set TRUE if routing succeeded, so we can
1628 distinguish between routing failed and callout failed
1629
1630 Returns: OK address verified
1631 FAIL address failed to verify
1632 DEFER can't tell at present
1633 */
1634
1635 int
verify_address(address_item * vaddr,FILE * fp,int options,int callout,int callout_overall,int callout_connect,uschar * se_mailfrom,uschar * pm_mailfrom,BOOL * routed)1636 verify_address(address_item * vaddr, FILE * fp, int options, int callout,
1637 int callout_overall, int callout_connect, uschar * se_mailfrom,
1638 uschar *pm_mailfrom, BOOL *routed)
1639 {
1640 BOOL allok = TRUE;
1641 BOOL full_info = fp ? debug_selector != 0 : FALSE;
1642 BOOL expn = (options & vopt_expn) != 0;
1643 BOOL success_on_redirect = (options & vopt_success_on_redirect) != 0;
1644 int i;
1645 int yield = OK;
1646 int verify_type = expn ? v_expn :
1647 f.address_test_mode ? v_none :
1648 options & vopt_is_recipient ? v_recipient : v_sender;
1649 address_item *addr_list;
1650 address_item *addr_new = NULL;
1651 address_item *addr_remote = NULL;
1652 address_item *addr_local = NULL;
1653 address_item *addr_succeed = NULL;
1654 uschar **failure_ptr = options & vopt_is_recipient
1655 ? &recipient_verify_failure : &sender_verify_failure;
1656 uschar *ko_prefix, *cr;
1657 uschar *address = vaddr->address;
1658 uschar *save_sender;
1659 uschar null_sender[] = { 0 }; /* Ensure writeable memory */
1660
1661 /* Clear, just in case */
1662
1663 *failure_ptr = NULL;
1664
1665 /* Set up a prefix and suffix for error message which allow us to use the same
1666 output statements both in EXPN mode (where an SMTP response is needed) and when
1667 debugging with an output file. */
1668
1669 if (expn)
1670 {
1671 ko_prefix = US"553 ";
1672 cr = US"\r";
1673 }
1674 else ko_prefix = cr = US"";
1675
1676 /* Add qualify domain if permitted; otherwise an unqualified address fails. */
1677
1678 if (parse_find_at(address) == NULL)
1679 {
1680 if (!(options & vopt_qualify))
1681 {
1682 if (fp)
1683 respond_printf(fp, "%sA domain is required for \"%s\"%s\n",
1684 ko_prefix, address, cr);
1685 *failure_ptr = US"qualify";
1686 return FAIL;
1687 }
1688 /* deconst ok as address was not const */
1689 address = US rewrite_address_qualify(address, options & vopt_is_recipient);
1690 }
1691
1692 DEBUG(D_verify)
1693 {
1694 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1695 debug_printf("%s %s\n", f.address_test_mode? "Testing" : "Verifying", address);
1696 }
1697
1698 /* Rewrite and report on it. Clear the domain and local part caches - these
1699 may have been set by domains and local part tests during an ACL. */
1700
1701 if (global_rewrite_rules)
1702 {
1703 uschar *old = address;
1704 /* deconst ok as address was not const */
1705 address = US rewrite_address(address, options & vopt_is_recipient, FALSE,
1706 global_rewrite_rules, rewrite_existflags);
1707 if (address != old)
1708 {
1709 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->localpart_cache[i] = 0;
1710 for (int i = 0; i < (MAX_NAMED_LIST * 2)/32; i++) vaddr->domain_cache[i] = 0;
1711 if (fp && !expn) fprintf(fp, "Address rewritten as: %s\n", address);
1712 }
1713 }
1714
1715 /* If this is the real sender address, we must update sender_address at
1716 this point, because it may be referred to in the routers. */
1717
1718 if (!(options & (vopt_fake_sender|vopt_is_recipient)))
1719 sender_address = address;
1720
1721 /* If the address was rewritten to <> no verification can be done, and we have
1722 to return OK. This rewriting is permitted only for sender addresses; for other
1723 addresses, such rewriting fails. */
1724
1725 if (!address[0]) return OK;
1726
1727 /* Flip the legacy TLS-related variables over to the outbound set in case
1728 they're used in the context of a transport used by verification. Reset them
1729 at exit from this routine (so no returns allowed from here on). */
1730
1731 tls_modify_variables(&tls_out);
1732
1733 /* Save a copy of the sender address for re-instating if we change it to <>
1734 while verifying a sender address (a nice bit of self-reference there). */
1735
1736 save_sender = sender_address;
1737
1738 /* Observability variable for router/transport use */
1739
1740 verify_mode = options & vopt_is_recipient ? US"R" : US"S";
1741
1742 /* Update the address structure with the possibly qualified and rewritten
1743 address. Set it up as the starting address on the chain of new addresses. */
1744
1745 vaddr->address = address;
1746 addr_new = vaddr;
1747
1748 /* We need a loop, because an address can generate new addresses. We must also
1749 cope with generated pipes and files at the top level. (See also the code and
1750 comment in deliver.c.) However, it is usually the case that the router for
1751 user's .forward files has its verify flag turned off.
1752
1753 If an address generates more than one child, the loop is used only when
1754 full_info is set, and this can only be set locally. Remote enquiries just get
1755 information about the top level address, not anything that it generated. */
1756
1757 while (addr_new)
1758 {
1759 int rc;
1760 address_item *addr = addr_new;
1761
1762 addr_new = addr->next;
1763 addr->next = NULL;
1764
1765 DEBUG(D_verify)
1766 {
1767 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1768 debug_printf("Considering %s\n", addr->address);
1769 }
1770
1771 /* Handle generated pipe, file or reply addresses. We don't get these
1772 when handling EXPN, as it does only one level of expansion. */
1773
1774 if (testflag(addr, af_pfr))
1775 {
1776 allok = FALSE;
1777 if (fp)
1778 {
1779 BOOL allow;
1780
1781 if (addr->address[0] == '>')
1782 {
1783 allow = testflag(addr, af_allow_reply);
1784 fprintf(fp, "%s -> mail %s", addr->parent->address, addr->address + 1);
1785 }
1786 else
1787 {
1788 allow = addr->address[0] == '|'
1789 ? testflag(addr, af_allow_pipe) : testflag(addr, af_allow_file);
1790 fprintf(fp, "%s -> %s", addr->parent->address, addr->address);
1791 }
1792
1793 if (addr->basic_errno == ERRNO_BADTRANSPORT)
1794 fprintf(fp, "\n*** Error in setting up pipe, file, or autoreply:\n"
1795 "%s\n", addr->message);
1796 else if (allow)
1797 fprintf(fp, "\n transport = %s\n", addr->transport->name);
1798 else
1799 fprintf(fp, " *** forbidden ***\n");
1800 }
1801 continue;
1802 }
1803
1804 /* Just in case some router parameter refers to it. */
1805
1806 return_path = addr->prop.errors_address
1807 ? addr->prop.errors_address : sender_address;
1808
1809 /* Split the address into domain and local part, handling the %-hack if
1810 necessary, and then route it. While routing a sender address, set
1811 $sender_address to <> because that is what it will be if we were trying to
1812 send a bounce to the sender. */
1813
1814 if (routed) *routed = FALSE;
1815 if ((rc = deliver_split_address(addr)) == OK)
1816 {
1817 if (!(options & vopt_is_recipient)) sender_address = null_sender;
1818 rc = route_address(addr, &addr_local, &addr_remote, &addr_new,
1819 &addr_succeed, verify_type);
1820 sender_address = save_sender; /* Put back the real sender */
1821 }
1822
1823 /* If routing an address succeeded, set the flag that remembers, for use when
1824 an ACL cached a sender verify (in case a callout fails). Then if routing set
1825 up a list of hosts or the transport has a host list, and the callout option
1826 is set, and we aren't in a host checking run, do the callout verification,
1827 and set another flag that notes that a callout happened. */
1828
1829 if (rc == OK)
1830 {
1831 BOOL local_verify = FALSE;
1832
1833 if (routed) *routed = TRUE;
1834 if (callout > 0)
1835 {
1836 transport_instance * tp;
1837 host_item * host_list = addr->host_list;
1838
1839 /* Make up some data for use in the case where there is no remote
1840 transport. */
1841
1842 transport_feedback tf = {
1843 .interface = NULL, /* interface (=> any) */
1844 .port = US"smtp",
1845 .protocol = US"smtp",
1846 .hosts = NULL,
1847 .helo_data = US"$smtp_active_hostname",
1848 .hosts_override = FALSE,
1849 .hosts_randomize = FALSE,
1850 .gethostbyname = FALSE,
1851 .qualify_single = TRUE,
1852 .search_parents = FALSE
1853 };
1854
1855 /* If verification yielded a remote transport, we want to use that
1856 transport's options, so as to mimic what would happen if we were really
1857 sending a message to this address. */
1858
1859 if ((tp = addr->transport))
1860 if (!tp->info->local)
1861 {
1862 (void)(tp->setup)(tp, addr, &tf, 0, 0, NULL);
1863
1864 /* If the transport has hosts and the router does not, or if the
1865 transport is configured to override the router's hosts, we must build a
1866 host list of the transport's hosts, and find the IP addresses */
1867
1868 if (tf.hosts && (!host_list || tf.hosts_override))
1869 {
1870 uschar *s;
1871 const uschar *save_deliver_domain = deliver_domain;
1872 uschar *save_deliver_localpart = deliver_localpart;
1873
1874 host_list = NULL; /* Ignore the router's hosts */
1875
1876 deliver_domain = addr->domain;
1877 deliver_localpart = addr->local_part;
1878 s = expand_string(tf.hosts);
1879 deliver_domain = save_deliver_domain;
1880 deliver_localpart = save_deliver_localpart;
1881
1882 if (!s)
1883 {
1884 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand list of hosts "
1885 "\"%s\" in %s transport for callout: %s", tf.hosts,
1886 tp->name, expand_string_message);
1887 }
1888 else
1889 {
1890 int flags;
1891 host_build_hostlist(&host_list, s, tf.hosts_randomize);
1892
1893 /* Just ignore failures to find a host address. If we don't manage
1894 to find any addresses, the callout will defer. Note that more than
1895 one address may be found for a single host, which will result in
1896 additional host items being inserted into the chain. Hence we must
1897 save the next host first. */
1898
1899 flags = HOST_FIND_BY_A | HOST_FIND_BY_AAAA;
1900 if (tf.qualify_single) flags |= HOST_FIND_QUALIFY_SINGLE;
1901 if (tf.search_parents) flags |= HOST_FIND_SEARCH_PARENTS;
1902
1903 for (host_item * host = host_list, * nexthost; host; host = nexthost)
1904 {
1905 nexthost = host->next;
1906 if (tf.gethostbyname ||
1907 string_is_ip_address(host->name, NULL) != 0)
1908 (void)host_find_byname(host, NULL, flags, NULL, TRUE);
1909 else
1910 {
1911 const dnssec_domains * dsp = NULL;
1912 if (Ustrcmp(tp->driver_name, "smtp") == 0)
1913 {
1914 smtp_transport_options_block * ob =
1915 (smtp_transport_options_block *) tp->options_block;
1916 dsp = &ob->dnssec;
1917 }
1918
1919 (void) host_find_bydns(host, NULL, flags, NULL, NULL, NULL,
1920 dsp, NULL, NULL);
1921 }
1922 }
1923 }
1924 }
1925 }
1926 else if ( options & vopt_quota
1927 && Ustrcmp(tp->driver_name, "appendfile") == 0)
1928 local_verify = TRUE;
1929
1930 /* Can only do a callout if we have at least one host! If the callout
1931 fails, it will have set ${sender,recipient}_verify_failure. */
1932
1933 if (host_list)
1934 {
1935 HDEBUG(D_verify) debug_printf("Attempting full verification using callout\n");
1936 if (host_checking && !f.host_checking_callout)
1937 {
1938 HDEBUG(D_verify)
1939 debug_printf("... callout omitted by default when host testing\n"
1940 "(Use -bhc if you want the callouts to happen.)\n");
1941 }
1942 else
1943 {
1944 #ifndef DISABLE_TLS
1945 deliver_set_expansions(addr);
1946 #endif
1947 rc = do_callout(addr, host_list, &tf, callout, callout_overall,
1948 callout_connect, options, se_mailfrom, pm_mailfrom);
1949 #ifndef DISABLE_TLS
1950 deliver_set_expansions(NULL);
1951 #endif
1952 }
1953 }
1954 else if (local_verify)
1955 {
1956 HDEBUG(D_verify) debug_printf("Attempting quota verification\n");
1957
1958 deliver_set_expansions(addr);
1959 deliver_local(addr, TRUE);
1960 rc = addr->transport_return;
1961 }
1962 else
1963 HDEBUG(D_verify) debug_printf("Cannot do callout: neither router nor "
1964 "transport provided a host list, or transport is not smtp\n");
1965 }
1966 }
1967
1968 /* Otherwise, any failure is a routing failure */
1969
1970 else *failure_ptr = US"route";
1971
1972 /* A router may return REROUTED if it has set up a child address as a result
1973 of a change of domain name (typically from widening). In this case we always
1974 want to continue to verify the new child. */
1975
1976 if (rc == REROUTED) continue;
1977
1978 /* Handle hard failures */
1979
1980 if (rc == FAIL)
1981 {
1982 allok = FALSE;
1983 if (fp)
1984 {
1985 address_item *p = addr->parent;
1986
1987 respond_printf(fp, "%s%s %s", ko_prefix,
1988 full_info ? addr->address : address,
1989 f.address_test_mode ? "is undeliverable" : "failed to verify");
1990 if (!expn && f.admin_user)
1991 {
1992 if (addr->basic_errno > 0)
1993 respond_printf(fp, ": %s", strerror(addr->basic_errno));
1994 if (addr->message)
1995 respond_printf(fp, ": %s", addr->message);
1996 }
1997
1998 /* Show parents iff doing full info */
1999
2000 if (full_info) while (p)
2001 {
2002 respond_printf(fp, "%s\n <-- %s", cr, p->address);
2003 p = p->parent;
2004 }
2005 respond_printf(fp, "%s\n", cr);
2006 }
2007 cancel_cutthrough_connection(TRUE, US"routing hard fail");
2008
2009 if (!full_info)
2010 {
2011 yield = copy_error(vaddr, addr, FAIL);
2012 goto out;
2013 }
2014 yield = FAIL;
2015 }
2016
2017 /* Soft failure */
2018
2019 else if (rc == DEFER)
2020 {
2021 allok = FALSE;
2022 if (fp)
2023 {
2024 address_item *p = addr->parent;
2025 respond_printf(fp, "%s%s cannot be resolved at this time", ko_prefix,
2026 full_info? addr->address : address);
2027 if (!expn && f.admin_user)
2028 {
2029 if (addr->basic_errno > 0)
2030 respond_printf(fp, ": %s", strerror(addr->basic_errno));
2031 if (addr->message)
2032 respond_printf(fp, ": %s", addr->message);
2033 else if (addr->basic_errno <= 0)
2034 respond_printf(fp, ": unknown error");
2035 }
2036
2037 /* Show parents iff doing full info */
2038
2039 if (full_info) while (p)
2040 {
2041 respond_printf(fp, "%s\n <-- %s", cr, p->address);
2042 p = p->parent;
2043 }
2044 respond_printf(fp, "%s\n", cr);
2045 }
2046 cancel_cutthrough_connection(TRUE, US"routing soft fail");
2047
2048 if (!full_info)
2049 {
2050 yield = copy_error(vaddr, addr, DEFER);
2051 goto out;
2052 }
2053 if (yield == OK) yield = DEFER;
2054 }
2055
2056 /* If we are handling EXPN, we do not want to continue to route beyond
2057 the top level (whose address is in "address"). */
2058
2059 else if (expn)
2060 {
2061 uschar *ok_prefix = US"250-";
2062
2063 if (!addr_new)
2064 if (!addr_local && !addr_remote)
2065 respond_printf(fp, "250 mail to <%s> is discarded\r\n", address);
2066 else
2067 respond_printf(fp, "250 <%s>\r\n", address);
2068
2069 else do
2070 {
2071 address_item *addr2 = addr_new;
2072 addr_new = addr2->next;
2073 if (!addr_new) ok_prefix = US"250 ";
2074 respond_printf(fp, "%s<%s>\r\n", ok_prefix, addr2->address);
2075 } while (addr_new);
2076 yield = OK;
2077 goto out;
2078 }
2079
2080 /* Successful routing other than EXPN. */
2081
2082 else
2083 {
2084 /* Handle successful routing when short info wanted. Otherwise continue for
2085 other (generated) addresses. Short info is the operational case. Full info
2086 can be requested only when debug_selector != 0 and a file is supplied.
2087
2088 There is a conflict between the use of aliasing as an alternate email
2089 address, and as a sort of mailing list. If an alias turns the incoming
2090 address into just one address (e.g. J.Caesar->jc44) you may well want to
2091 carry on verifying the generated address to ensure it is valid when
2092 checking incoming mail. If aliasing generates multiple addresses, you
2093 probably don't want to do this. Exim therefore treats the generation of
2094 just a single new address as a special case, and continues on to verify the
2095 generated address. */
2096
2097 if ( !full_info /* Stop if short info wanted AND */
2098 && ( ( !addr_new /* No new address OR */
2099 || addr_new->next /* More than one new address OR */
2100 || testflag(addr_new, af_pfr) /* New address is pfr */
2101 )
2102 || /* OR */
2103 ( addr_new /* At least one new address AND */
2104 && success_on_redirect /* success_on_redirect is set */
2105 ) )
2106 )
2107 {
2108 if (fp) fprintf(fp, "%s %s\n",
2109 address, f.address_test_mode ? "is deliverable" : "verified");
2110
2111 /* If we have carried on to verify a child address, we want the value
2112 of $address_data to be that of the child */
2113
2114 vaddr->prop.address_data = addr->prop.address_data;
2115 vaddr->prop.variables = NULL;
2116 tree_dup((tree_node **)&vaddr->prop.variables, addr->prop.variables);
2117
2118 /* If stopped because more than one new address, cannot cutthrough */
2119
2120 if (addr_new && addr_new->next)
2121 cancel_cutthrough_connection(TRUE, US"multiple addresses from routing");
2122
2123 yield = OK;
2124 goto out;
2125 }
2126 }
2127 } /* Loop for generated addresses */
2128
2129 /* Display the full results of the successful routing, including any generated
2130 addresses. Control gets here only when full_info is set, which requires fp not
2131 to be NULL, and this occurs only when a top-level verify is called with the
2132 debugging switch on.
2133
2134 If there are no local and no remote addresses, and there were no pipes, files,
2135 or autoreplies, and there were no errors or deferments, the message is to be
2136 discarded, usually because of the use of :blackhole: in an alias file. */
2137
2138 if (allok && !addr_local && !addr_remote)
2139 {
2140 fprintf(fp, "mail to %s is discarded\n", address);
2141 goto out;
2142 }
2143
2144 for (addr_list = addr_local, i = 0; i < 2; addr_list = addr_remote, i++)
2145 while (addr_list)
2146 {
2147 address_item *addr = addr_list;
2148 transport_instance * tp = addr->transport;
2149
2150 addr_list = addr->next;
2151
2152 fprintf(fp, "%s", CS addr->address);
2153 #ifdef EXPERIMENTAL_SRS_ALT
2154 if(addr->prop.srs_sender)
2155 fprintf(fp, " [srs = %s]", addr->prop.srs_sender);
2156 #endif
2157
2158 /* If the address is a duplicate, show something about it. */
2159
2160 if (!testflag(addr, af_pfr))
2161 {
2162 tree_node *tnode;
2163 if ((tnode = tree_search(tree_duplicates, addr->unique)))
2164 fprintf(fp, " [duplicate, would not be delivered]");
2165 else tree_add_duplicate(addr->unique, addr);
2166 }
2167
2168 /* Now show its parents */
2169
2170 for (address_item * p = addr->parent; p; p = p->parent)
2171 fprintf(fp, "\n <-- %s", p->address);
2172 fprintf(fp, "\n ");
2173
2174 /* Show router, and transport */
2175
2176 fprintf(fp, "router = %s, transport = %s\n",
2177 addr->router->name, tp ? tp->name : US"unset");
2178
2179 /* Show any hosts that are set up by a router unless the transport
2180 is going to override them; fiddle a bit to get a nice format. */
2181
2182 if (addr->host_list && tp && !tp->overrides_hosts)
2183 {
2184 int maxlen = 0;
2185 int maxaddlen = 0;
2186 for (host_item * h = addr->host_list; h; h = h->next)
2187 { /* get max lengths of host names, addrs */
2188 int len = Ustrlen(h->name);
2189 if (len > maxlen) maxlen = len;
2190 len = h->address ? Ustrlen(h->address) : 7;
2191 if (len > maxaddlen) maxaddlen = len;
2192 }
2193 for (host_item * h = addr->host_list; h; h = h->next)
2194 {
2195 fprintf(fp, " host %-*s ", maxlen, h->name);
2196
2197 if (h->address)
2198 fprintf(fp, "[%s%-*c", h->address, maxaddlen+1 - Ustrlen(h->address), ']');
2199 else if (tp->info->local)
2200 fprintf(fp, " %-*s ", maxaddlen, ""); /* Omit [unknown] for local */
2201 else
2202 fprintf(fp, "[%s%-*c", "unknown", maxaddlen+1 - 7, ']');
2203
2204 if (h->mx >= 0) fprintf(fp, " MX=%d", h->mx);
2205 if (h->port != PORT_NONE) fprintf(fp, " port=%d", h->port);
2206 if (f.running_in_test_harness && h->dnssec == DS_YES) fputs(" AD", fp);
2207 if (h->status == hstatus_unusable) fputs(" ** unusable **", fp);
2208 fputc('\n', fp);
2209 }
2210 }
2211 }
2212
2213 /* Yield will be DEFER or FAIL if any one address has, only for full_info (which is
2214 the -bv or -bt case). */
2215
2216 out:
2217 verify_mode = NULL;
2218 tls_modify_variables(&tls_in); /* return variables to inbound values */
2219
2220 return yield;
2221 }
2222
2223
2224
2225
2226 /*************************************************
2227 * Check headers for syntax errors *
2228 *************************************************/
2229
2230 /* This function checks those header lines that contain addresses, and verifies
2231 that all the addresses therein are 5322-syntactially correct.
2232
2233 Arguments:
2234 msgptr where to put an error message
2235
2236 Returns: OK
2237 FAIL
2238 */
2239
2240 int
verify_check_headers(uschar ** msgptr)2241 verify_check_headers(uschar **msgptr)
2242 {
2243 uschar *colon, *s;
2244 int yield = OK;
2245
2246 for (header_line * h = header_list; h && yield == OK; h = h->next)
2247 {
2248 if (h->type != htype_from &&
2249 h->type != htype_reply_to &&
2250 h->type != htype_sender &&
2251 h->type != htype_to &&
2252 h->type != htype_cc &&
2253 h->type != htype_bcc)
2254 continue;
2255
2256 colon = Ustrchr(h->text, ':');
2257 s = colon + 1;
2258 Uskip_whitespace(&s);
2259
2260 /* Loop for multiple addresses in the header, enabling group syntax. Note
2261 that we have to reset this after the header has been scanned. */
2262
2263 f.parse_allow_group = TRUE;
2264
2265 while (*s)
2266 {
2267 uschar *ss = parse_find_address_end(s, FALSE);
2268 uschar *recipient, *errmess;
2269 int terminator = *ss;
2270 int start, end, domain;
2271
2272 /* Temporarily terminate the string at this point, and extract the
2273 operative address within, allowing group syntax. */
2274
2275 *ss = 0;
2276 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2277 *ss = terminator;
2278
2279 /* Permit an unqualified address only if the message is local, or if the
2280 sending host is configured to be permitted to send them. */
2281
2282 if (recipient && !domain)
2283 {
2284 if (h->type == htype_from || h->type == htype_sender)
2285 {
2286 if (!f.allow_unqualified_sender) recipient = NULL;
2287 }
2288 else
2289 {
2290 if (!f.allow_unqualified_recipient) recipient = NULL;
2291 }
2292 if (!recipient) errmess = US"unqualified address not permitted";
2293 }
2294
2295 /* It's an error if no address could be extracted, except for the special
2296 case of an empty address. */
2297
2298 if (!recipient && Ustrcmp(errmess, "empty address") != 0)
2299 {
2300 uschar *verb = US"is";
2301 uschar *t = ss;
2302 uschar *tt = colon;
2303 int len;
2304
2305 /* Arrange not to include any white space at the end in the
2306 error message or the header name. */
2307
2308 while (t > s && isspace(t[-1])) t--;
2309 while (tt > h->text && isspace(tt[-1])) tt--;
2310
2311 /* Add the address that failed to the error message, since in a
2312 header with very many addresses it is sometimes hard to spot
2313 which one is at fault. However, limit the amount of address to
2314 quote - cases have been seen where, for example, a missing double
2315 quote in a humungous To: header creates an "address" that is longer
2316 than string_sprintf can handle. */
2317
2318 len = t - s;
2319 if (len > 1024)
2320 {
2321 len = 1024;
2322 verb = US"begins";
2323 }
2324
2325 /* deconst cast ok as we're passing a non-const to string_printing() */
2326 *msgptr = US string_printing(
2327 string_sprintf("%s: failing address in \"%.*s:\" header %s: %.*s",
2328 errmess, (int)(tt - h->text), h->text, verb, len, s));
2329
2330 yield = FAIL;
2331 break; /* Out of address loop */
2332 }
2333
2334 /* Advance to the next address */
2335
2336 s = ss + (terminator ? 1 : 0);
2337 Uskip_whitespace(&s);
2338 } /* Next address */
2339
2340 f.parse_allow_group = FALSE;
2341 f.parse_found_group = FALSE;
2342 } /* Next header unless yield has been set FALSE */
2343
2344 return yield;
2345 }
2346
2347
2348 /*************************************************
2349 * Check header names for 8-bit characters *
2350 *************************************************/
2351
2352 /* This function checks for invalid characters in header names. See
2353 RFC 5322, 2.2. and RFC 6532, 3.
2354
2355 Arguments:
2356 msgptr where to put an error message
2357
2358 Returns: OK
2359 FAIL
2360 */
2361
2362 int
verify_check_header_names_ascii(uschar ** msgptr)2363 verify_check_header_names_ascii(uschar **msgptr)
2364 {
2365 uschar *colon;
2366
2367 for (header_line * h = header_list; h; h = h->next)
2368 {
2369 colon = Ustrchr(h->text, ':');
2370 for(uschar * s = h->text; s < colon; s++)
2371 if ((*s < 33) || (*s > 126))
2372 {
2373 *msgptr = string_sprintf("Invalid character in header \"%.*s\" found",
2374 (int)(colon - h->text), h->text);
2375 return FAIL;
2376 }
2377 }
2378 return OK;
2379 }
2380
2381 /*************************************************
2382 * Check for blind recipients *
2383 *************************************************/
2384
2385 /* This function checks that every (envelope) recipient is mentioned in either
2386 the To: or Cc: header lines, thus detecting blind carbon copies.
2387
2388 There are two ways of scanning that could be used: either scan the header lines
2389 and tick off the recipients, or scan the recipients and check the header lines.
2390 The original proposed patch did the former, but I have chosen to do the latter,
2391 because (a) it requires no memory and (b) will use fewer resources when there
2392 are many addresses in To: and/or Cc: and only one or two envelope recipients.
2393
2394 Arguments: case_sensitive true if case sensitive matching should be used
2395 Returns: OK if there are no blind recipients
2396 FAIL if there is at least one blind recipient
2397 */
2398
2399 int
verify_check_notblind(BOOL case_sensitive)2400 verify_check_notblind(BOOL case_sensitive)
2401 {
2402 for (int i = 0; i < recipients_count; i++)
2403 {
2404 BOOL found = FALSE;
2405 uschar *address = recipients_list[i].address;
2406
2407 for (header_line * h = header_list; !found && h; h = h->next)
2408 {
2409 uschar *colon, *s;
2410
2411 if (h->type != htype_to && h->type != htype_cc) continue;
2412
2413 colon = Ustrchr(h->text, ':');
2414 s = colon + 1;
2415 Uskip_whitespace(&s);
2416
2417 /* Loop for multiple addresses in the header, enabling group syntax. Note
2418 that we have to reset this after the header has been scanned. */
2419
2420 f.parse_allow_group = TRUE;
2421
2422 while (*s)
2423 {
2424 uschar * ss = parse_find_address_end(s, FALSE);
2425 uschar * recipient, * errmess;
2426 int terminator = *ss;
2427 int start, end, domain;
2428
2429 /* Temporarily terminate the string at this point, and extract the
2430 operative address within, allowing group syntax. */
2431
2432 *ss = 0;
2433 recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
2434 *ss = terminator;
2435
2436 /* If we found a valid recipient that has a domain, compare it with the
2437 envelope recipient. Local parts are compared with case-sensitivity
2438 according to the routine arg, domains case-insensitively.
2439 By comparing from the start with length "domain", we include the "@" at
2440 the end, which ensures that we are comparing the whole local part of each
2441 address. */
2442
2443 if (recipient && domain != 0)
2444 if ((found = (case_sensitive
2445 ? Ustrncmp(recipient, address, domain) == 0
2446 : strncmpic(recipient, address, domain) == 0)
2447 && strcmpic(recipient + domain, address + domain) == 0))
2448 break;
2449
2450 /* Advance to the next address */
2451
2452 s = ss + (terminator ? 1:0);
2453 Uskip_whitespace(&s);
2454 } /* Next address */
2455
2456 f.parse_allow_group = FALSE;
2457 f.parse_found_group = FALSE;
2458 } /* Next header (if found is false) */
2459
2460 if (!found) return FAIL;
2461 } /* Next recipient */
2462
2463 return OK;
2464 }
2465
2466
2467
2468 /*************************************************
2469 * Find if verified sender *
2470 *************************************************/
2471
2472 /* Usually, just a single address is verified as the sender of the message.
2473 However, Exim can be made to verify other addresses as well (often related in
2474 some way), and this is useful in some environments. There may therefore be a
2475 chain of such addresses that have previously been tested. This function finds
2476 whether a given address is on the chain.
2477
2478 Arguments: the address to be verified
2479 Returns: pointer to an address item, or NULL
2480 */
2481
2482 address_item *
verify_checked_sender(uschar * sender)2483 verify_checked_sender(uschar *sender)
2484 {
2485 for (address_item * addr = sender_verified_list; addr; addr = addr->next)
2486 if (Ustrcmp(sender, addr->address) == 0) return addr;
2487 return NULL;
2488 }
2489
2490
2491
2492
2493
2494 /*************************************************
2495 * Get valid header address *
2496 *************************************************/
2497
2498 /* Scan the originator headers of the message, looking for an address that
2499 verifies successfully. RFC 822 says:
2500
2501 o The "Sender" field mailbox should be sent notices of
2502 any problems in transport or delivery of the original
2503 messages. If there is no "Sender" field, then the
2504 "From" field mailbox should be used.
2505
2506 o If the "Reply-To" field exists, then the reply should
2507 go to the addresses indicated in that field and not to
2508 the address(es) indicated in the "From" field.
2509
2510 So we check a Sender field if there is one, else a Reply_to field, else a From
2511 field. As some strange messages may have more than one of these fields,
2512 especially if they are resent- fields, check all of them if there is more than
2513 one.
2514
2515 Arguments:
2516 user_msgptr points to where to put a user error message
2517 log_msgptr points to where to put a log error message
2518 callout timeout for callout check (passed to verify_address())
2519 callout_overall overall callout timeout (ditto)
2520 callout_connect connect callout timeout (ditto)
2521 se_mailfrom mailfrom for verify; NULL => ""
2522 pm_mailfrom sender for pm callout check (passed to verify_address())
2523 options callout options (passed to verify_address())
2524 verrno where to put the address basic_errno
2525
2526 If log_msgptr is set to something without setting user_msgptr, the caller
2527 normally uses log_msgptr for both things.
2528
2529 Returns: result of the verification attempt: OK, FAIL, or DEFER;
2530 FAIL is given if no appropriate headers are found
2531 */
2532
2533 int
verify_check_header_address(uschar ** user_msgptr,uschar ** log_msgptr,int callout,int callout_overall,int callout_connect,uschar * se_mailfrom,uschar * pm_mailfrom,int options,int * verrno)2534 verify_check_header_address(uschar **user_msgptr, uschar **log_msgptr,
2535 int callout, int callout_overall, int callout_connect, uschar *se_mailfrom,
2536 uschar *pm_mailfrom, int options, int *verrno)
2537 {
2538 static int header_types[] = { htype_sender, htype_reply_to, htype_from };
2539 BOOL done = FALSE;
2540 int yield = FAIL;
2541
2542 for (int i = 0; i < 3 && !done; i++)
2543 for (header_line * h = header_list; h != NULL && !done; h = h->next)
2544 {
2545 int terminator, new_ok;
2546 uschar *s, *ss, *endname;
2547
2548 if (h->type != header_types[i]) continue;
2549 s = endname = Ustrchr(h->text, ':') + 1;
2550
2551 /* Scan the addresses in the header, enabling group syntax. Note that we
2552 have to reset this after the header has been scanned. */
2553
2554 f.parse_allow_group = TRUE;
2555
2556 while (*s != 0)
2557 {
2558 address_item *vaddr;
2559
2560 while (isspace(*s) || *s == ',') s++;
2561 if (*s == 0) break; /* End of header */
2562
2563 ss = parse_find_address_end(s, FALSE);
2564
2565 /* The terminator is a comma or end of header, but there may be white
2566 space preceding it (including newline for the last address). Move back
2567 past any white space so we can check against any cached envelope sender
2568 address verifications. */
2569
2570 while (isspace(ss[-1])) ss--;
2571 terminator = *ss;
2572 *ss = 0;
2573
2574 HDEBUG(D_verify) debug_printf("verifying %.*s header address %s\n",
2575 (int)(endname - h->text), h->text, s);
2576
2577 /* See if we have already verified this address as an envelope sender,
2578 and if so, use the previous answer. */
2579
2580 vaddr = verify_checked_sender(s);
2581
2582 if (vaddr != NULL && /* Previously checked */
2583 (callout <= 0 || /* No callout needed; OR */
2584 vaddr->special_action > 256)) /* Callout was done */
2585 {
2586 new_ok = vaddr->special_action & 255;
2587 HDEBUG(D_verify) debug_printf("previously checked as envelope sender\n");
2588 *ss = terminator; /* Restore shortened string */
2589 }
2590
2591 /* Otherwise we run the verification now. We must restore the shortened
2592 string before running the verification, so the headers are correct, in
2593 case there is any rewriting. */
2594
2595 else
2596 {
2597 int start, end, domain;
2598 uschar *address = parse_extract_address(s, log_msgptr, &start, &end,
2599 &domain, FALSE);
2600
2601 *ss = terminator;
2602
2603 /* If we found an empty address, just carry on with the next one, but
2604 kill the message. */
2605
2606 if (!address && Ustrcmp(*log_msgptr, "empty address") == 0)
2607 {
2608 *log_msgptr = NULL;
2609 s = ss;
2610 continue;
2611 }
2612
2613 /* If verification failed because of a syntax error, fail this
2614 function, and ensure that the failing address gets added to the error
2615 message. */
2616
2617 if (!address)
2618 {
2619 new_ok = FAIL;
2620 while (ss > s && isspace(ss[-1])) ss--;
2621 *log_msgptr = string_sprintf("syntax error in '%.*s' header when "
2622 "scanning for sender: %s in \"%.*s\"",
2623 (int)(endname - h->text), h->text, *log_msgptr, (int)(ss - s), s);
2624 yield = FAIL;
2625 done = TRUE;
2626 break;
2627 }
2628
2629 /* Else go ahead with the sender verification. But it isn't *the*
2630 sender of the message, so set vopt_fake_sender to stop sender_address
2631 being replaced after rewriting or qualification. */
2632
2633 else
2634 {
2635 vaddr = deliver_make_addr(address, FALSE);
2636 new_ok = verify_address(vaddr, NULL, options | vopt_fake_sender,
2637 callout, callout_overall, callout_connect, se_mailfrom,
2638 pm_mailfrom, NULL);
2639 }
2640 }
2641
2642 /* We now have the result, either newly found, or cached. If we are
2643 giving out error details, set a specific user error. This means that the
2644 last of these will be returned to the user if all three fail. We do not
2645 set a log message - the generic one below will be used. */
2646
2647 if (new_ok != OK)
2648 {
2649 *verrno = vaddr->basic_errno;
2650 if (smtp_return_error_details)
2651 *user_msgptr = string_sprintf("Rejected after DATA: "
2652 "could not verify \"%.*s\" header address\n%s: %s",
2653 (int)(endname - h->text), h->text, vaddr->address, vaddr->message);
2654 }
2655
2656 /* Success or defer */
2657
2658 if (new_ok == OK)
2659 {
2660 yield = OK;
2661 done = TRUE;
2662 break;
2663 }
2664
2665 if (new_ok == DEFER) yield = DEFER;
2666
2667 /* Move on to any more addresses in the header */
2668
2669 s = ss;
2670 } /* Next address */
2671
2672 f.parse_allow_group = FALSE;
2673 f.parse_found_group = FALSE;
2674 } /* Next header, unless done */
2675 /* Next header type unless done */
2676
2677 if (yield == FAIL && *log_msgptr == NULL)
2678 *log_msgptr = US"there is no valid sender in any header line";
2679
2680 if (yield == DEFER && *log_msgptr == NULL)
2681 *log_msgptr = US"all attempts to verify a sender in a header line deferred";
2682
2683 return yield;
2684 }
2685
2686
2687
2688
2689 /*************************************************
2690 * Get RFC 1413 identification *
2691 *************************************************/
2692
2693 /* Attempt to get an id from the sending machine via the RFC 1413 protocol. If
2694 the timeout is set to zero, then the query is not done. There may also be lists
2695 of hosts and nets which are exempt. To guard against malefactors sending
2696 non-printing characters which could, for example, disrupt a message's headers,
2697 make sure the string consists of printing characters only.
2698
2699 Argument:
2700 port the port to connect to; usually this is IDENT_PORT (113), but when
2701 running in the test harness with -bh a different value is used.
2702
2703 Returns: nothing
2704
2705 Side effect: any received ident value is put in sender_ident (NULL otherwise)
2706 */
2707
2708 void
verify_get_ident(int port)2709 verify_get_ident(int port)
2710 {
2711 client_conn_ctx ident_conn_ctx = {0};
2712 int host_af, qlen;
2713 int received_sender_port, received_interface_port, n;
2714 uschar *p;
2715 blob early_data;
2716 uschar buffer[2048];
2717
2718 /* Default is no ident. Check whether we want to do an ident check for this
2719 host. */
2720
2721 sender_ident = NULL;
2722 if (rfc1413_query_timeout <= 0 || verify_check_host(&rfc1413_hosts) != OK)
2723 return;
2724
2725 DEBUG(D_ident) debug_printf("doing ident callback\n");
2726
2727 /* Set up a connection to the ident port of the remote host. Bind the local end
2728 to the incoming interface address. If the sender host address is an IPv6
2729 address, the incoming interface address will also be IPv6. */
2730
2731 host_af = Ustrchr(sender_host_address, ':') == NULL ? AF_INET : AF_INET6;
2732 if ((ident_conn_ctx.sock = ip_socket(SOCK_STREAM, host_af)) < 0) return;
2733
2734 if (ip_bind(ident_conn_ctx.sock, host_af, interface_address, 0) < 0)
2735 {
2736 DEBUG(D_ident) debug_printf("bind socket for ident failed: %s\n",
2737 strerror(errno));
2738 goto END_OFF;
2739 }
2740
2741 /* Construct and send the query. */
2742
2743 qlen = snprintf(CS buffer, sizeof(buffer), "%d , %d\r\n",
2744 sender_host_port, interface_port);
2745 early_data.data = buffer;
2746 early_data.len = qlen;
2747
2748 /*XXX we trust that the query is idempotent */
2749 if (ip_connect(ident_conn_ctx.sock, host_af, sender_host_address, port,
2750 rfc1413_query_timeout, &early_data) < 0)
2751 {
2752 if (errno == ETIMEDOUT && LOGGING(ident_timeout))
2753 log_write(0, LOG_MAIN, "ident connection to %s timed out",
2754 sender_host_address);
2755 else
2756 DEBUG(D_ident) debug_printf("ident connection to %s failed: %s\n",
2757 sender_host_address, strerror(errno));
2758 goto END_OFF;
2759 }
2760
2761 /* Read a response line. We put it into the rest of the buffer, using several
2762 recv() calls if necessary. */
2763
2764 p = buffer + qlen;
2765
2766 for (;;)
2767 {
2768 uschar *pp;
2769 int count;
2770 int size = sizeof(buffer) - (p - buffer);
2771
2772 if (size <= 0) goto END_OFF; /* Buffer filled without seeing \n. */
2773 count = ip_recv(&ident_conn_ctx, p, size, time(NULL) + rfc1413_query_timeout);
2774 if (count <= 0) goto END_OFF; /* Read error or EOF */
2775
2776 /* Scan what we just read, to see if we have reached the terminating \r\n. Be
2777 generous, and accept a plain \n terminator as well. The only illegal
2778 character is 0. */
2779
2780 for (pp = p; pp < p + count; pp++)
2781 {
2782 if (*pp == 0) goto END_OFF; /* Zero octet not allowed */
2783 if (*pp == '\n')
2784 {
2785 if (pp[-1] == '\r') pp--;
2786 *pp = 0;
2787 goto GOT_DATA; /* Break out of both loops */
2788 }
2789 }
2790
2791 /* Reached the end of the data without finding \n. Let the loop continue to
2792 read some more, if there is room. */
2793
2794 p = pp;
2795 }
2796
2797 GOT_DATA:
2798
2799 /* We have received a line of data. Check it carefully. It must start with the
2800 same two port numbers that we sent, followed by data as defined by the RFC. For
2801 example,
2802
2803 12345 , 25 : USERID : UNIX :root
2804
2805 However, the amount of white space may be different to what we sent. In the
2806 "osname" field there may be several sub-fields, comma separated. The data we
2807 actually want to save follows the third colon. Some systems put leading spaces
2808 in it - we discard those. */
2809
2810 if (sscanf(CS buffer + qlen, "%d , %d%n", &received_sender_port,
2811 &received_interface_port, &n) != 2 ||
2812 received_sender_port != sender_host_port ||
2813 received_interface_port != interface_port)
2814 goto END_OFF;
2815
2816 p = buffer + qlen + n;
2817 while(isspace(*p)) p++;
2818 if (*p++ != ':') goto END_OFF;
2819 while(isspace(*p)) p++;
2820 if (Ustrncmp(p, "USERID", 6) != 0) goto END_OFF;
2821 p += 6;
2822 while(isspace(*p)) p++;
2823 if (*p++ != ':') goto END_OFF;
2824 while (*p != 0 && *p != ':') p++;
2825 if (*p++ == 0) goto END_OFF;
2826 while(isspace(*p)) p++;
2827 if (*p == 0) goto END_OFF;
2828
2829 /* The rest of the line is the data we want. We turn it into printing
2830 characters when we save it, so that it cannot mess up the format of any logging
2831 or Received: lines into which it gets inserted. We keep a maximum of 127
2832 characters. The deconst cast is ok as we fed a nonconst to string_printing() */
2833
2834 sender_ident = US string_printing(string_copyn(p, 127));
2835 DEBUG(D_ident) debug_printf("sender_ident = %s\n", sender_ident);
2836
2837 END_OFF:
2838 (void)close(ident_conn_ctx.sock);
2839 return;
2840 }
2841
2842
2843
2844
2845 /*************************************************
2846 * Match host to a single host-list item *
2847 *************************************************/
2848
2849 /* This function compares a host (name or address) against a single item
2850 from a host list. The host name gets looked up if it is needed and is not
2851 already known. The function is called from verify_check_this_host() via
2852 match_check_list(), which is why most of its arguments are in a single block.
2853
2854 Arguments:
2855 arg the argument block (see below)
2856 ss the host-list item
2857 valueptr where to pass back looked up data, or NULL
2858 error for error message when returning ERROR
2859
2860 The block contains:
2861 host_name (a) the host name, or
2862 (b) NULL, implying use sender_host_name and
2863 sender_host_aliases, looking them up if required, or
2864 (c) the empty string, meaning that only IP address matches
2865 are permitted
2866 host_address the host address
2867 host_ipv4 the IPv4 address taken from an IPv6 one
2868
2869 Returns: OK matched
2870 FAIL did not match
2871 DEFER lookup deferred
2872 ERROR (a) failed to find the host name or IP address, or
2873 (b) unknown lookup type specified, or
2874 (c) host name encountered when only IP addresses are
2875 being matched
2876 */
2877
2878 int
check_host(void * arg,const uschar * ss,const uschar ** valueptr,uschar ** error)2879 check_host(void *arg, const uschar *ss, const uschar **valueptr, uschar **error)
2880 {
2881 check_host_block *cb = (check_host_block *)arg;
2882 int mlen = -1;
2883 int maskoffset;
2884 BOOL iplookup = FALSE;
2885 BOOL isquery = FALSE;
2886 BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0;
2887 const uschar *t;
2888 uschar * semicolon, * endname, * opts;
2889 uschar **aliases;
2890
2891 /* Optimize for the special case when the pattern is "*". */
2892
2893 if (*ss == '*' && ss[1] == 0) return OK;
2894
2895 /* If the pattern is empty, it matches only in the case when there is no host -
2896 this can occur in ACL checking for SMTP input using the -bs option. In this
2897 situation, the host address is the empty string. */
2898
2899 if (cb->host_address[0] == 0) return (*ss == 0)? OK : FAIL;
2900 if (*ss == 0) return FAIL;
2901
2902 /* If the pattern is precisely "@" then match against the primary host name,
2903 provided that host name matching is permitted; if it's "@[]" match against the
2904 local host's IP addresses. */
2905
2906 if (*ss == '@')
2907 if (ss[1] == 0)
2908 {
2909 if (isiponly) return ERROR;
2910 ss = primary_hostname;
2911 }
2912 else if (Ustrcmp(ss, "@[]") == 0)
2913 {
2914 for (ip_address_item * ip = host_find_interfaces(); ip; ip = ip->next)
2915 if (Ustrcmp(ip->address, cb->host_address) == 0) return OK;
2916 return FAIL;
2917 }
2918
2919 /* If the pattern is an IP address, optionally followed by a bitmask count, do
2920 a (possibly masked) comparison with the current IP address. */
2921
2922 if (string_is_ip_address(ss, &maskoffset) != 0)
2923 return (host_is_in_net(cb->host_address, ss, maskoffset)? OK : FAIL);
2924
2925 /* The pattern is not an IP address. A common error that people make is to omit
2926 one component of an IPv4 address, either by accident, or believing that, for
2927 example, 1.2.3/24 is the same as 1.2.3.0/24, or 1.2.3 is the same as 1.2.3.0,
2928 which it isn't. (Those applications that do accept 1.2.3 as an IP address
2929 interpret it as 1.2.0.3 because the final component becomes 16-bit - this is an
2930 ancient specification.) To aid in debugging these cases, we give a specific
2931 error if the pattern contains only digits and dots or contains a slash preceded
2932 only by digits and dots (a slash at the start indicates a file name and of
2933 course slashes may be present in lookups, but not preceded only by digits and
2934 dots). */
2935
2936 for (t = ss; isdigit(*t) || *t == '.'; ) t++;
2937 if (*t == 0 || (*t == '/' && t != ss))
2938 {
2939 *error = US"malformed IPv4 address or address mask";
2940 return ERROR;
2941 }
2942
2943 /* See if there is a semicolon in the pattern, separating a searchtype
2944 prefix. If there is one then check for comma-sep options. */
2945
2946 if ((semicolon = Ustrchr(ss, ';')))
2947 if ((opts = Ustrchr(ss, ',')) && opts < semicolon)
2948 {
2949 endname = opts++;
2950 opts = string_copyn(opts, semicolon - opts);
2951 }
2952 else
2953 {
2954 endname = semicolon;
2955 opts = NULL;
2956 }
2957
2958 /* If we are doing an IP address only match, then all lookups must be IP
2959 address lookups, even if there is no "net-". */
2960
2961 if (isiponly)
2962 iplookup = semicolon != NULL;
2963
2964 /* Otherwise, if the item is of the form net[n]-lookup;<file|query> then it is
2965 a lookup on a masked IP network, in textual form. We obey this code even if we
2966 have already set iplookup, so as to skip over the "net-" prefix and to set the
2967 mask length. The net- stuff really only applies to single-key lookups where the
2968 key is implicit. For query-style lookups the key is specified in the query.
2969 From release 4.30, the use of net- for query style is no longer needed, but we
2970 retain it for backward compatibility. */
2971
2972 if (Ustrncmp(ss, "net", 3) == 0 && semicolon)
2973 {
2974 mlen = 0;
2975 for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0';
2976 if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */
2977 iplookup = *t++ == '-';
2978 }
2979 else
2980 t = ss;
2981
2982 /* Do the IP address lookup if that is indeed what we have */
2983
2984 if (iplookup)
2985 {
2986 int insize;
2987 int search_type;
2988 int incoming[4];
2989 void *handle;
2990 uschar *filename, *key, *result;
2991 uschar buffer[64];
2992
2993 /* Find the search type */
2994
2995 search_type = search_findtype(t, endname - t);
2996
2997 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
2998 search_error_message);
2999
3000 /* Adjust parameters for the type of lookup. For a query-style lookup, there
3001 is no file name, and the "key" is just the query. For query-style with a file
3002 name, we have to fish the file off the start of the query. For a single-key
3003 lookup, the key is the current IP address, masked appropriately, and
3004 reconverted to text form, with the mask appended. For IPv6 addresses, specify
3005 dot separators instead of colons, except when the lookup type is "iplsearch".
3006 */
3007
3008 if (mac_islookup(search_type, lookup_absfilequery))
3009 {
3010 filename = semicolon + 1;
3011 key = filename;
3012 while (*key != 0 && !isspace(*key)) key++;
3013 filename = string_copyn(filename, key - filename);
3014 while (isspace(*key)) key++;
3015 }
3016 else if (mac_islookup(search_type, lookup_querystyle))
3017 {
3018 filename = NULL;
3019 key = semicolon + 1;
3020 }
3021 else /* Single-key style */
3022 {
3023 int sep = (Ustrcmp(lookup_list[search_type]->name, "iplsearch") == 0)?
3024 ':' : '.';
3025 insize = host_aton(cb->host_address, incoming);
3026 host_mask(insize, incoming, mlen);
3027 (void)host_nmtoa(insize, incoming, mlen, buffer, sep);
3028 key = buffer;
3029 filename = semicolon + 1;
3030 }
3031
3032 /* Now do the actual lookup; note that there is no search_close() because
3033 of the caching arrangements. */
3034
3035 if (!(handle = search_open(filename, search_type, 0, NULL, NULL)))
3036 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message);
3037
3038 result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL, opts);
3039 if (valueptr) *valueptr = result;
3040 return result ? OK : f.search_find_defer ? DEFER: FAIL;
3041 }
3042
3043 /* The pattern is not an IP address or network reference of any kind. That is,
3044 it is a host name pattern. If this is an IP only match, there's an error in the
3045 host list. */
3046
3047 if (isiponly)
3048 {
3049 *error = US"cannot match host name in match_ip list";
3050 return ERROR;
3051 }
3052
3053 /* Check the characters of the pattern to see if they comprise only letters,
3054 digits, full stops, and hyphens (the constituents of domain names). Allow
3055 underscores, as they are all too commonly found. Sigh. Also, if
3056 allow_utf8_domains is set, allow top-bit characters. */
3057
3058 for (t = ss; *t != 0; t++)
3059 if (!isalnum(*t) && *t != '.' && *t != '-' && *t != '_' &&
3060 (!allow_utf8_domains || *t < 128)) break;
3061
3062 /* If the pattern is a complete domain name, with no fancy characters, look up
3063 its IP address and match against that. Note that a multi-homed host will add
3064 items to the chain. */
3065
3066 if (*t == 0)
3067 {
3068 int rc;
3069 host_item h;
3070 h.next = NULL;
3071 h.name = ss;
3072 h.address = NULL;
3073 h.mx = MX_NONE;
3074
3075 /* Using byname rather than bydns here means we cannot determine dnssec
3076 status. On the other hand it is unclear how that could be either
3077 propagated up or enforced. */
3078
3079 rc = host_find_byname(&h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, FALSE);
3080 if (rc == HOST_FOUND || rc == HOST_FOUND_LOCAL)
3081 {
3082 for (host_item * hh = &h; hh; hh = hh->next)
3083 if (host_is_in_net(hh->address, cb->host_address, 0)) return OK;
3084 return FAIL;
3085 }
3086 if (rc == HOST_FIND_AGAIN) return DEFER;
3087 *error = string_sprintf("failed to find IP address for %s", ss);
3088 return ERROR;
3089 }
3090
3091 /* Almost all subsequent comparisons require the host name, and can be done
3092 using the general string matching function. When this function is called for
3093 outgoing hosts, the name is always given explicitly. If it is NULL, it means we
3094 must use sender_host_name and its aliases, looking them up if necessary. */
3095
3096 if (cb->host_name) /* Explicit host name given */
3097 return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE,
3098 valueptr);
3099
3100 /* Host name not given; in principle we need the sender host name and its
3101 aliases. However, for query-style lookups, we do not need the name if the
3102 query does not contain $sender_host_name. From release 4.23, a reference to
3103 $sender_host_name causes it to be looked up, so we don't need to do the lookup
3104 on spec. */
3105
3106 if ((semicolon = Ustrchr(ss, ';')))
3107 {
3108 const uschar * affix, * opts;
3109 int partial, affixlen, starflags, id;
3110
3111 *semicolon = 0;
3112 id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags,
3113 &opts);
3114 *semicolon=';';
3115
3116 if (id < 0) /* Unknown lookup type */
3117 {
3118 log_write(0, LOG_MAIN|LOG_PANIC, "%s in host list item \"%s\"",
3119 search_error_message, ss);
3120 return DEFER;
3121 }
3122 isquery = mac_islookup(id, lookup_querystyle|lookup_absfilequery);
3123 }
3124
3125 if (isquery)
3126 {
3127 switch(match_check_string(US"", ss, -1, TRUE, TRUE, TRUE, valueptr))
3128 {
3129 case OK: return OK;
3130 case DEFER: return DEFER;
3131 default: return FAIL;
3132 }
3133 }
3134
3135 /* Not a query-style lookup; must ensure the host name is present, and then we
3136 do a check on the name and all its aliases. */
3137
3138 if (!sender_host_name)
3139 {
3140 HDEBUG(D_host_lookup)
3141 debug_printf("sender host name required, to match against %s\n", ss);
3142 if (host_lookup_failed || host_name_lookup() != OK)
3143 {
3144 *error = string_sprintf("failed to find host name for %s",
3145 sender_host_address);;
3146 return ERROR;
3147 }
3148 host_build_sender_fullhost();
3149 }
3150
3151 /* Match on the sender host name, using the general matching function */
3152
3153 switch(match_check_string(sender_host_name, ss, -1, TRUE, TRUE, TRUE, valueptr))
3154 {
3155 case OK: return OK;
3156 case DEFER: return DEFER;
3157 }
3158
3159 /* If there are aliases, try matching on them. */
3160
3161 aliases = sender_host_aliases;
3162 while (*aliases)
3163 switch(match_check_string(*aliases++, ss, -1, TRUE, TRUE, TRUE, valueptr))
3164 {
3165 case OK: return OK;
3166 case DEFER: return DEFER;
3167 }
3168 return FAIL;
3169 }
3170
3171
3172
3173
3174 /*************************************************
3175 * Check a specific host matches a host list *
3176 *************************************************/
3177
3178 /* This function is passed a host list containing items in a number of
3179 different formats and the identity of a host. Its job is to determine whether
3180 the given host is in the set of hosts defined by the list. The host name is
3181 passed as a pointer so that it can be looked up if needed and not already
3182 known. This is commonly the case when called from verify_check_host() to check
3183 an incoming connection. When called from elsewhere the host name should usually
3184 be set.
3185
3186 This function is now just a front end to match_check_list(), which runs common
3187 code for scanning a list. We pass it the check_host() function to perform a
3188 single test.
3189
3190 Arguments:
3191 listptr pointer to the host list
3192 cache_bits pointer to cache for named lists, or NULL
3193 host_name the host name or NULL, implying use sender_host_name and
3194 sender_host_aliases, looking them up if required
3195 host_address the IP address
3196 valueptr if not NULL, data from a lookup is passed back here
3197
3198 Returns: OK if the host is in the defined set
3199 FAIL if the host is not in the defined set,
3200 DEFER if a data lookup deferred (not a host lookup)
3201
3202 If the host name was needed in order to make a comparison, and could not be
3203 determined from the IP address, the result is FAIL unless the item
3204 "+allow_unknown" was met earlier in the list, in which case OK is returned. */
3205
3206 int
verify_check_this_host(const uschar ** listptr,unsigned int * cache_bits,const uschar * host_name,const uschar * host_address,const uschar ** valueptr)3207 verify_check_this_host(const uschar **listptr, unsigned int *cache_bits,
3208 const uschar *host_name, const uschar *host_address, const uschar **valueptr)
3209 {
3210 int rc;
3211 unsigned int *local_cache_bits = cache_bits;
3212 const uschar *save_host_address = deliver_host_address;
3213 check_host_block cb = { .host_name = host_name, .host_address = host_address };
3214
3215 if (valueptr) *valueptr = NULL;
3216
3217 /* If the host address starts off ::ffff: it is an IPv6 address in
3218 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3219 addresses. */
3220
3221 cb.host_ipv4 = Ustrncmp(host_address, "::ffff:", 7) == 0
3222 ? host_address + 7 : host_address;
3223
3224 /* During the running of the check, put the IP address into $host_address. In
3225 the case of calls from the smtp transport, it will already be there. However,
3226 in other calls (e.g. when testing ignore_target_hosts), it won't. Just to be on
3227 the safe side, any existing setting is preserved, though as I write this
3228 (November 2004) I can't see any cases where it is actually needed. */
3229
3230 deliver_host_address = host_address;
3231 rc = match_check_list(
3232 listptr, /* the list */
3233 0, /* separator character */
3234 &hostlist_anchor, /* anchor pointer */
3235 &local_cache_bits, /* cache pointer */
3236 check_host, /* function for testing */
3237 &cb, /* argument for function */
3238 MCL_HOST, /* type of check */
3239 (host_address == sender_host_address)?
3240 US"host" : host_address, /* text for debugging */
3241 valueptr); /* where to pass back data */
3242 deliver_host_address = save_host_address;
3243 return rc;
3244 }
3245
3246
3247
3248
3249 /*************************************************
3250 * Check the given host item matches a list *
3251 *************************************************/
3252 int
verify_check_given_host(const uschar ** listptr,const host_item * host)3253 verify_check_given_host(const uschar **listptr, const host_item *host)
3254 {
3255 return verify_check_this_host(listptr, NULL, host->name, host->address, NULL);
3256 }
3257
3258 /*************************************************
3259 * Check the remote host matches a list *
3260 *************************************************/
3261
3262 /* This is a front end to verify_check_this_host(), created because checking
3263 the remote host is a common occurrence. With luck, a good compiler will spot
3264 the tail recursion and optimize it. If there's no host address, this is
3265 command-line SMTP input - check against an empty string for the address.
3266
3267 Arguments:
3268 listptr pointer to the host list
3269
3270 Returns: the yield of verify_check_this_host(),
3271 i.e. OK, FAIL, or DEFER
3272 */
3273
3274 int
verify_check_host(uschar ** listptr)3275 verify_check_host(uschar **listptr)
3276 {
3277 return verify_check_this_host(CUSS listptr, sender_host_cache, NULL,
3278 sender_host_address ? sender_host_address : US"", NULL);
3279 }
3280
3281
3282
3283
3284
3285 /*************************************************
3286 * Invert an IP address *
3287 *************************************************/
3288
3289 /* Originally just used for DNS xBL lists, now also used for the
3290 reverse_ip expansion operator.
3291
3292 Arguments:
3293 buffer where to put the answer
3294 address the address to invert
3295 */
3296
3297 void
invert_address(uschar * buffer,uschar * address)3298 invert_address(uschar *buffer, uschar *address)
3299 {
3300 int bin[4];
3301 uschar *bptr = buffer;
3302
3303 /* If this is an IPv4 address mapped into IPv6 format, adjust the pointer
3304 to the IPv4 part only. */
3305
3306 if (Ustrncmp(address, "::ffff:", 7) == 0) address += 7;
3307
3308 /* Handle IPv4 address: when HAVE_IPV6 is false, the result of host_aton() is
3309 always 1. */
3310
3311 if (host_aton(address, bin) == 1)
3312 {
3313 int x = bin[0];
3314 for (int i = 0; i < 4; i++)
3315 {
3316 sprintf(CS bptr, "%d.", x & 255);
3317 while (*bptr) bptr++;
3318 x >>= 8;
3319 }
3320 }
3321
3322 /* Handle IPv6 address. Actually, as far as I know, there are no IPv6 addresses
3323 in any DNS black lists, and the format in which they will be looked up is
3324 unknown. This is just a guess. */
3325
3326 #if HAVE_IPV6
3327 else
3328 for (int j = 3; j >= 0; j--)
3329 {
3330 int x = bin[j];
3331 for (int i = 0; i < 8; i++)
3332 {
3333 sprintf(CS bptr, "%x.", x & 15);
3334 while (*bptr) bptr++;
3335 x >>= 4;
3336 }
3337 }
3338 #endif
3339
3340 /* Remove trailing period -- this is needed so that both arbitrary
3341 dnsbl keydomains and inverted addresses may be combined with the
3342 same format string, "%s.%s" */
3343
3344 *(--bptr) = 0;
3345 }
3346
3347
3348
3349 /****************************************************
3350 Verify a local user account for quota sufficiency
3351 ****************************************************/
3352
3353 /* The real work, done via a re-exec for privs, calls
3354 down to the transport for the quota check.
3355
3356 Route and transport (in recipient-verify mode) the
3357 given recipient.
3358
3359 A routing result indicating any transport type other than appendfile
3360 results in a fail.
3361
3362 Return, on stdout, a result string containing:
3363 - highlevel result code (OK, DEFER, FAIL)
3364 - errno
3365 - where string
3366 - message string
3367 */
3368
3369 void
verify_quota(uschar * address)3370 verify_quota(uschar * address)
3371 {
3372 address_item vaddr = {.address = address};
3373 BOOL routed;
3374 uschar * msg = US"\0";
3375 int rc, len = 1;
3376
3377 if ((rc = verify_address(&vaddr, NULL, vopt_is_recipient | vopt_quota,
3378 1, 0, 0, NULL, NULL, &routed)) != OK)
3379 {
3380 uschar * where = recipient_verify_failure;
3381 msg = acl_verify_message ? acl_verify_message : vaddr.message;
3382 if (!msg) msg = US"";
3383 if (rc == DEFER && vaddr.basic_errno == ERRNO_EXIMQUOTA)
3384 {
3385 rc = FAIL; /* DEFER -> FAIL */
3386 where = US"quota";
3387 vaddr.basic_errno = 0;
3388 }
3389 else if (!where) where = US"";
3390
3391 len = 5 + Ustrlen(msg) + 1 + Ustrlen(where);
3392 msg = string_sprintf("%c%c%c%c%c%s%c%s", (uschar)rc,
3393 (vaddr.basic_errno >> 24) & 0xff, (vaddr.basic_errno >> 16) & 0xff,
3394 (vaddr.basic_errno >> 8) & 0xff, vaddr.basic_errno & 0xff,
3395 where, '\0', msg);
3396 }
3397
3398 DEBUG(D_verify) debug_printf_indent("verify_quota: len %d\n", len);
3399 write(1, msg, len);
3400 return;
3401 }
3402
3403
3404 /******************************************************************************/
3405
3406 /* Quota cache lookup. We use the callout hints db also for the quota cache.
3407 Return TRUE if a nonexpired record was found, having filled in the yield
3408 argument.
3409 */
3410
3411 static BOOL
cached_quota_lookup(const uschar * rcpt,int * yield,int pos_cache,int neg_cache)3412 cached_quota_lookup(const uschar * rcpt, int * yield,
3413 int pos_cache, int neg_cache)
3414 {
3415 open_db dbblock, *dbm_file = NULL;
3416 dbdata_callout_cache_address * cache_address_record;
3417
3418 if (!pos_cache && !neg_cache)
3419 return FALSE;
3420 if (!(dbm_file = dbfn_open(US"callout", O_RDWR, &dbblock, FALSE, TRUE)))
3421 {
3422 HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n");
3423 return FALSE;
3424 }
3425 if (!(cache_address_record = (dbdata_callout_cache_address *)
3426 get_callout_cache_record(dbm_file, rcpt, US"address",
3427 pos_cache, neg_cache)))
3428 {
3429 dbfn_close(dbm_file);
3430 return FALSE;
3431 }
3432 if (cache_address_record->result == ccache_accept)
3433 *yield = OK;
3434 dbfn_close(dbm_file);
3435 return TRUE;
3436 }
3437
3438 /* Quota cache write */
3439
3440 static void
cache_quota_write(const uschar * rcpt,int yield,int pos_cache,int neg_cache)3441 cache_quota_write(const uschar * rcpt, int yield, int pos_cache, int neg_cache)
3442 {
3443 open_db dbblock, *dbm_file = NULL;
3444 dbdata_callout_cache_address cache_address_record;
3445
3446 if (!pos_cache && !neg_cache)
3447 return;
3448 if (!(dbm_file = dbfn_open(US"callout", O_RDWR|O_CREAT, &dbblock, FALSE, TRUE)))
3449 {
3450 HDEBUG(D_verify) debug_printf_indent("quota cache: not available\n");
3451 return;
3452 }
3453
3454 cache_address_record.result = yield == OK ? ccache_accept : ccache_reject;
3455
3456 (void)dbfn_write(dbm_file, rcpt, &cache_address_record,
3457 (int)sizeof(dbdata_callout_cache_address));
3458 HDEBUG(D_verify) debug_printf_indent("wrote %s quota cache record for %s\n",
3459 yield == OK ? "positive" : "negative", rcpt);
3460
3461 dbfn_close(dbm_file);
3462 return;
3463 }
3464
3465
3466 /* To evaluate a local user's quota, starting in ACL, we need to
3467 fork & exec to regain privileges, to that we can change to the user's
3468 identity for access to their files.
3469
3470 Arguments:
3471 rcpt Recipient account
3472 pos_cache Number of seconds to cache a positive result (delivery
3473 to be accepted). Zero to disable caching.
3474 neg_cache Number of seconds to cache a negative result. Zero to disable.
3475 msg Pointer to result string pointer
3476
3477 Return: OK/DEFER/FAIL code
3478 */
3479
3480 int
verify_quota_call(const uschar * rcpt,int pos_cache,int neg_cache,uschar ** msg)3481 verify_quota_call(const uschar * rcpt, int pos_cache, int neg_cache,
3482 uschar ** msg)
3483 {
3484 int pfd[2], pid, save_errno, yield = FAIL;
3485 void (*oldsignal)(int);
3486 const uschar * where = US"socketpair";
3487
3488 *msg = NULL;
3489
3490 if (cached_quota_lookup(rcpt, &yield, pos_cache, neg_cache))
3491 {
3492 HDEBUG(D_verify) debug_printf_indent("quota cache: address record is %s\n",
3493 yield == OK ? "positive" : "negative");
3494 if (yield != OK)
3495 {
3496 recipient_verify_failure = US"quota";
3497 acl_verify_message = *msg =
3498 US"Previous (cached) quota verification failure";
3499 }
3500 return yield;
3501 }
3502
3503 if (pipe(pfd) != 0)
3504 goto fail;
3505
3506 where = US"fork";
3507 oldsignal = signal(SIGCHLD, SIG_DFL);
3508 if ((pid = exim_fork(US"quota-verify")) < 0)
3509 {
3510 save_errno = errno;
3511 close(pfd[pipe_write]);
3512 close(pfd[pipe_read]);
3513 errno = save_errno;
3514 goto fail;
3515 }
3516
3517 if (pid == 0) /* child */
3518 {
3519 close(pfd[pipe_read]);
3520 force_fd(pfd[pipe_write], 1); /* stdout to pipe */
3521 close(pfd[pipe_write]);
3522 dup2(1, 0);
3523 if (debug_fd > 0) force_fd(debug_fd, 2);
3524
3525 child_exec_exim(CEE_EXEC_EXIT, FALSE, NULL, FALSE, 3,
3526 US"-MCq", string_sprintf("%d", message_size), rcpt);
3527 /*NOTREACHED*/
3528 }
3529
3530 save_errno = errno;
3531 close(pfd[pipe_write]);
3532
3533 if (pid < 0)
3534 {
3535 DEBUG(D_verify) debug_printf_indent(" fork: %s\n", strerror(save_errno));
3536 }
3537 else
3538 {
3539 uschar buf[128];
3540 int n = read(pfd[pipe_read], buf, sizeof(buf));
3541 int status;
3542
3543 waitpid(pid, &status, 0);
3544 if (status == 0)
3545 {
3546 uschar * s;
3547
3548 if (n > 0) yield = buf[0];
3549 if (n > 4)
3550 save_errno = (buf[1] << 24) | (buf[2] << 16) | (buf[3] << 8) | buf[4];
3551 if ((recipient_verify_failure = n > 5
3552 ? string_copyn_taint(buf+5, n-5, FALSE) : NULL))
3553 {
3554 int m;
3555 s = buf + 5 + Ustrlen(recipient_verify_failure) + 1;
3556 m = n - (s - buf);
3557 acl_verify_message = *msg =
3558 m > 0 ? string_copyn_taint(s, m, FALSE) : NULL;
3559 }
3560
3561 DEBUG(D_verify) debug_printf_indent("verify call response:"
3562 " len %d yield %s errno '%s' where '%s' msg '%s'\n",
3563 n, rc_names[yield], strerror(save_errno), recipient_verify_failure, *msg);
3564
3565 if ( yield == OK
3566 || save_errno == 0 && Ustrcmp(recipient_verify_failure, "quota") == 0)
3567 cache_quota_write(rcpt, yield, pos_cache, neg_cache);
3568 else DEBUG(D_verify)
3569 debug_printf_indent("result not cacheable\n");
3570 }
3571 else
3572 {
3573 DEBUG(D_verify)
3574 debug_printf_indent("verify call response: waitpid status 0x%04x\n", status);
3575 }
3576 }
3577
3578 close(pfd[pipe_read]);
3579 errno = save_errno;
3580
3581 fail:
3582
3583 return yield;
3584 }
3585
3586
3587 /* vi: aw ai sw=2
3588 */
3589 /* End of verify.c */
3590