src/global/mime_state.c

/*++
/* NAME
/*	mime_state 3
/* SUMMARY
/*	MIME parser state machine
/* SYNOPSIS
/*	#include <mime_state.h>
/*
/*	MIME_STATE *mime_state_alloc(flags, head_out, head_end,
/*					 body_out, body_end,
/*					 err_print, context)
/*	int	flags;
/*	void	(*head_out)(void *ptr, int header_class,
/*				const HEADER_OPTS *header_info,
/*				VSTRING *buf, off_t offset);
/*	void	(*head_end)(void *ptr);
/*	void	(*body_out)(void *ptr, int rec_type,
/*				const char *buf, ssize_t len,
/*				off_t offset);
/*	void	(*body_end)(void *ptr);
/*	void	(*err_print)(void *ptr, int err_flag, const char *text)
/*	void	*context;
/*
/*	int	mime_state_update(state, rec_type, buf, len)
/*	MIME_STATE *state;
/*	int	rec_type;
/*	const char *buf;
/*	ssize_t	len;
/*
/*	MIME_STATE *mime_state_free(state)
/*	MIME_STATE *state;
/*
/*	const char *mime_state_error(error_code)
/*	int	error_code;
/*
/*	typedef struct {
/* .in +4
/*		const int code;		/* internal error code */
/*		const char *dsn;	/* RFC 3463 */
/*		const char *text;	/* descriptive text */
/* .in -4
/*	} MIME_STATE_DETAIL;
/*
/*	const MIME_STATE_DETAIL *mime_state_detail(error_code)
/*	int	error_code;
/* DESCRIPTION
/*	This module implements a one-pass MIME processor with optional
/*	8-bit to quoted-printable conversion.
/*
/*	In order to fend off denial of service attacks, message headers
/*	are truncated at or above var_header_limit bytes, message boundary
/*	strings are truncated at var_mime_bound_len bytes, and the multipart
/*	nesting level is limited to var_mime_maxdepth levels.
/*
/*	mime_state_alloc() creates a MIME state machine. The machine
/*	is delivered in its initial state, expecting content type
/*	text/plain, 7-bit data.
/*
/*	mime_state_update() updates the MIME state machine according
/*	to the input record type and the record content.
/*	The result value is the bit-wise OR of zero or more of the following:
/* .IP MIME_ERR_TRUNC_HEADER
/*	A message header was longer than var_header_limit bytes.
/* .IP MIME_ERR_NESTING
/*	The MIME structure was nested more than var_mime_maxdepth levels.
/* .IP MIME_ERR_8BIT_IN_HEADER
/*	A message header contains 8-bit data. This is always illegal.
/* .IP MIME_ERR_8BIT_IN_7BIT_BODY
/*	A MIME header specifies (or defaults to) 7-bit content, but the
/*	corresponding message body or body parts contain 8-bit content.
/* .IP MIME_ERR_ENCODING_DOMAIN
/*	An entity of type "message" or "multipart" specifies the wrong
/*	content transfer encoding domain, or specifies a transformation
/*	(quoted-printable, base64) instead of a domain (7bit, 8bit,
/*	or binary).
/* .PP
/*	mime_state_free() releases storage for a MIME state machine,
/*	and conveniently returns a null pointer.
/*
/*	mime_state_error() returns a string representation for the
/*	specified error code. When multiple errors are specified it
/*	reports what it deems the most serious one.
/*
/*	mime_state_detail() returns a table entry with error
/*	information for the specified error code. When multiple
/*	errors are specified it reports what it deems the most
/*	serious one.
/*
/*	Arguments:
/* .IP body_out
/*	The output routine for body lines. It receives unmodified input
/*	records, or the result of 8-bit -> 7-bit conversion.
/* .IP body_end
/*	A null pointer, or a pointer to a routine that is called after
/*	the last input record is processed.
/* .IP buf
/*	Buffer with the content of a logical or physical message record.
/* .IP context
/*	Caller context that is passed on to the head_out and body_out
/*	routines.
/* .IP enc_type
/*	The content encoding: MIME_ENC_7BIT or MIME_ENC_8BIT.
/* .IP err_print
/*	Null pointer, or pointer to a function that is called with
/*	arguments: the application context, the error type, and the
/*	offending input. Only one instance per error type is reported.
/* .IP flags
/*	Special processing options. Specify the bit-wise OR of zero or
/*	more of the following:
/* .RS
/* .IP MIME_OPT_DISABLE_MIME
/*	Pay no attention to Content-* message headers, and switch to
/*	message body state at the end of the primary message headers.
/* .IP MIME_OPT_REPORT_TRUNC_HEADER
/*	Report errors that set the MIME_ERR_TRUNC_HEADER error flag
/*	(see above).
/* .IP MIME_OPT_REPORT_8BIT_IN_HEADER
/*	Report errors that set the MIME_ERR_8BIT_IN_HEADER error
/*	flag (see above). This rarely stops legitimate mail.
/* .IP MIME_OPT_REPORT_8BIT_IN_7BIT_BODY
/*	Report errors that set the MIME_ERR_8BIT_IN_7BIT_BODY error
/*	flag (see above). This currently breaks Majordomo mail that is
/*	forwarded for approval, because Majordomo does not propagate
/*	MIME type information from the enclosed message to the message
/*	headers of the request for approval.
/* .IP MIME_OPT_REPORT_ENCODING_DOMAIN
/*	Report errors that set the MIME_ERR_ENCODING_DOMAIN error
/*	flag (see above).
/* .IP MIME_OPT_REPORT_NESTING
/*	Report errors that set the MIME_ERR_NESTING error flag
/*	(see above).
/* .IP MIME_OPT_DOWNGRADE
/*	Transform content that claims to be 8-bit into quoted-printable.
/*	Where appropriate, update Content-Transfer-Encoding: message
/*	headers.
/* .RE
/* .sp
/*	For convenience, MIME_OPT_NONE requests no special processing.
/* .IP header_class
/*	Specifies where a message header is located.
/* .RS
/* .IP MIME_HDR_PRIMARY
/*	In the primary message header section.
/* .IP MIME_HDR_MULTIPART
/*	In the header section after a multipart boundary string.
/* .IP MIME_HDR_NESTED
/*	At the start of a nested (e.g., message/rfc822) message.
/* .RE
/* .sp
/*	For convenience, the macros MIME_HDR_FIRST and MIME_HDR_LAST
/*	specify the range of MIME_HDR_MUMBLE macros.
/* .sp
/*	To find out if something is a MIME header at the beginning
/*	of an RFC 822 message or an attached message, look at the
/*	header_info argument.
/* .IP header_info
/*	Null pointer or information about the message header, see
/*	header_opts(3).
/* .IP head_out
/*	The output routine that is invoked for outputting a message header.
/*	A multi-line header is passed as one chunk of text with embedded
/*	newlines.
/*	It is the responsibility of the output routine to break the text
/*	at embedded newlines, and to break up long text between newlines
/*	into multiple output records.
/*	Note: an output routine is explicitly allowed to modify the text.
/* .IP head_end
/*	A null pointer, or a pointer to a routine that is called after
/*	the last message header in the first header block is processed.
/* .IP len
/*	Length of non-VSTRING input buffer.
/* .IP offset
/*	The offset in bytes from the start of the current block of message
/*	headers or body lines. Line boundaries are counted as one byte.
/* .IP rec_type
/*	The input record type as defined in rec_type(3h). State is
/*	updated for text records (REC_TYPE_NORM or REC_TYPE_CONT).
/*	Some input records are stored internally in order to reconstruct
/*	multi-line input.  Upon receipt of any non-text record type, all
/*	stored input is flushed and the state is set to "body".
/* .IP state
/*	MIME parser state created with mime_state_alloc().
/* BUGS
/*	NOTE: when the end of headers is reached, mime_state_update()
/*	may execute up to three call-backs before returning to the
/*	caller: head_out(), head_end(), and body_out() or body_end().
/*	As long as call-backs return no result, it is up to the
/*	call-back routines to check if a previous call-back experienced
/*	an error.
/*
/*	Different mail user agents treat malformed message boundary
/*	strings in different ways. The Postfix MIME processor cannot
/*	be bug-compatible with everything.
/*
/*	This module will not glue together multipart boundary strings that
/*	span multiple input records.
/*
/*	This module will not glue together RFC 2231 formatted (boundary)
/*	parameter values. RFC 2231 claims compatibility with existing
/*	MIME processors. Splitting boundary strings is not backwards
/*	compatible.
/*
/*	The "8-bit data inside 7-bit body" test is myopic. It is not aware
/*	of any enclosing (message or multipart) encoding information.
/*
/*	If the input ends in data other than a hard line break, this module
/*	will add a hard line break of its own. No line break is added to
/*	empty input.
/*
/*	This code recognizes the obsolete form "headername :" but will
/*	normalize it to the canonical form "headername:". Leaving the
/*	obsolete form alone would cause too much trouble with existing code
/*	that expects only the normalized form.
/* SEE ALSO
/*	msg(3) diagnostics interface
/*	header_opts(3) header information lookup
/*	RFC 822 (ARPA Internet Text Messages)
/*	RFC 2045 (MIME: Format of internet message bodies)
/*	RFC 2046 (MIME: Media types)
/* DIAGNOSTICS
/*	Fatal errors: memory allocation problem.
/* LICENSE
/* .ad
/* .fi
/*	The Secure Mailer license must be distributed with this software.
/* HISTORY
/* .ad
/* .fi
/*	This code was implemented from scratch after reading the RFC
/*	documents. This was a relatively straightforward effort with
/*	few if any surprises. Victor Duchovni of Morgan Stanley shared
/*	his experiences with ambiguities in real-life MIME implementations.
/*	Liviu Daia of the Romanian Academy shared his insights in some
/*	of the darker corners.
/* AUTHOR(S)
/*	Wietse Venema
/*	IBM T.J. Watson Research
/*	P.O. Box 704
/*	Yorktown Heights, NY 10598, USA
/*
/*	Wietse Venema
/*	Google, Inc.
/*	111 8th Avenue
/*	New York, NY 10011, USA
/*--*/

/* System library. */

#include <sys_defs.h>
#include <stdarg.h>
#include <ctype.h>
#include <string.h>

#ifdef STRCASECMP_IN_STRINGS_H
#include <strings.h>
#endif

/* Utility library. */

#include <mymalloc.h>
#include <msg.h>
#include <vstring.h>

/* Global library. */

#include <rec_type.h>
#include <is_header.h>
#include <header_opts.h>
#include <mail_params.h>
#include <header_token.h>
#include <lex_822.h>
#include <mime_state.h>

/* Application-specific. */

 /*
  * Mime parser stack element for multipart content.
  */
typedef struct MIME_STACK {
    int     def_ctype;			/* default content type */
    int     def_stype;			/* default content subtype */
    char   *boundary;			/* boundary string */
    ssize_t bound_len;			/* boundary length */
    struct MIME_STACK *next;		/* linkage */
} MIME_STACK;

 /*
  * Mime parser state.
  */
#define MIME_MAX_TOKEN		3	/* tokens per attribute */

struct MIME_STATE {

    /*
     * Volatile members.
     */
    int     curr_state;			/* header/body state */
    int     curr_ctype;			/* last or default content type */
    int     curr_stype;			/* last or default content subtype */
    int     curr_encoding;		/* last or default content encoding */
    int     curr_domain;		/* last or default encoding unit */
    VSTRING *output_buffer;		/* headers, quoted-printable body */
    int     prev_rec_type;		/* previous input record type */
    int     nesting_level;		/* safety */
    MIME_STACK *stack;			/* for composite types */
    HEADER_TOKEN token[MIME_MAX_TOKEN];	/* header token array */
    VSTRING *token_buffer;		/* header parser scratch buffer */
    int     err_flags;			/* processing errors */
    off_t   head_offset;		/* offset in header block */
    off_t   body_offset;		/* offset in body block */

    /*
     * Static members.
     */
    int     static_flags;		/* static processing options */
    MIME_STATE_HEAD_OUT head_out;	/* header output routine */
    MIME_STATE_ANY_END head_end;	/* end of primary header routine */
    MIME_STATE_BODY_OUT body_out;	/* body output routine */
    MIME_STATE_ANY_END body_end;	/* end of body output routine */
    MIME_STATE_ERR_PRINT err_print;	/* error report */
    void   *app_context;		/* application context */
};

 /*
  * Content types and subtypes that we care about, either because we have to,
  * or because we want to filter out broken MIME messages.
  */
#define MIME_CTYPE_OTHER	0
#define MIME_CTYPE_TEXT		1
#define MIME_CTYPE_MESSAGE	2
#define MIME_CTYPE_MULTIPART	3

#define MIME_STYPE_OTHER	0
#define MIME_STYPE_PLAIN	1
#define MIME_STYPE_RFC822	2
#define MIME_STYPE_PARTIAL	3
#define MIME_STYPE_EXTERN_BODY	4
#define MIME_STYPE_GLOBAL	5

 /*
  * MIME parser states. We steal from the public interface.
  */
#define MIME_STATE_PRIMARY	MIME_HDR_PRIMARY	/* primary headers */
#define MIME_STATE_MULTIPART	MIME_HDR_MULTIPART	/* after --boundary */
#define MIME_STATE_NESTED	MIME_HDR_NESTED	/* message/rfc822 */
#define MIME_STATE_BODY		(MIME_HDR_NESTED + 1)

#define SET_MIME_STATE(ptr, state, ctype, stype, encoding, domain) do { \
	(ptr)->curr_state = (state); \
	(ptr)->curr_ctype = (ctype); \
	(ptr)->curr_stype = (stype); \
	(ptr)->curr_encoding = (encoding); \
	(ptr)->curr_domain = (domain); \
	if ((state) == MIME_STATE_BODY) \
	    (ptr)->body_offset = 0; \
	else \
	    (ptr)->head_offset = 0; \
    } while (0)

#define SET_CURR_STATE(ptr, state) do { \
	(ptr)->curr_state = (state); \
	if ((state) == MIME_STATE_BODY) \
	    (ptr)->body_offset = 0; \
	else \
	    (ptr)->head_offset = 0; \
    } while (0)

 /*
  * MIME encodings and domains. We intentionally use the same codes for
  * encodings and domains, so that we can easily find out whether a content
  * transfer encoding header specifies a domain or whether it specifies
  * domain+encoding, which is illegal for multipart/any and message/any.
  */
typedef struct MIME_ENCODING {
    const char *name;			/* external representation */
    int     encoding;			/* internal representation */
    int     domain;			/* subset of encoding */
} MIME_ENCODING;

#define MIME_ENC_QP		1	/* encoding + domain */
#define MIME_ENC_BASE64		2	/* encoding + domain */
 /* These are defined in mime_state.h as part of the external interface. */
#ifndef MIME_ENC_7BIT
#define MIME_ENC_7BIT		7	/* domain only */
#define MIME_ENC_8BIT		8	/* domain only */
#define MIME_ENC_BINARY		9	/* domain only */
#endif

static const MIME_ENCODING mime_encoding_map[] = {	/* RFC 2045 */
    "7bit", MIME_ENC_7BIT, MIME_ENC_7BIT,	/* domain */
    "8bit", MIME_ENC_8BIT, MIME_ENC_8BIT,	/* domain */
    "binary", MIME_ENC_BINARY, MIME_ENC_BINARY,	/* domain */
    "base64", MIME_ENC_BASE64, MIME_ENC_7BIT,	/* encoding */
    "quoted-printable", MIME_ENC_QP, MIME_ENC_7BIT,	/* encoding */
    0,
};

 /*
  * Silly Little Macros.
  */
#define STR(x)		vstring_str(x)
#define LEN(x)		VSTRING_LEN(x)
#define END(x)		vstring_end(x)
#define CU_CHAR_PTR(x)	((const unsigned char *) (x))

#define REPORT_ERROR_LEN(state, err_type, text, len) do { \
	if ((state->err_flags & err_type) == 0) { \
	    if (state->err_print != 0) \
		state->err_print(state->app_context, err_type, text, len); \
	    state->err_flags |= err_type; \
	} \
    } while (0)

#define REPORT_ERROR(state, err_type, text) do { \
	const char *_text = text; \
	ssize_t _len = strlen(text); \
	REPORT_ERROR_LEN(state, err_type, _text, _len); \
    } while (0)

#define REPORT_ERROR_BUF(state, err_type, buf) \
    REPORT_ERROR_LEN(state, err_type, STR(buf), LEN(buf))


 /*
  * Outputs and state changes are interleaved, so we must maintain separate
  * offsets for header and body segments.
  */
#define HEAD_OUT(ptr, info, len) do { \
	if ((ptr)->head_out) { \
	    (ptr)->head_out((ptr)->app_context, (ptr)->curr_state, \
			    (info), (ptr)->output_buffer, (ptr)->head_offset); \
	    (ptr)->head_offset += (len) + 1; \
	} \
    } while(0)

#define BODY_OUT(ptr, rec_type, text, len) do { \
	if ((ptr)->body_out) { \
	    (ptr)->body_out((ptr)->app_context, (rec_type), \
			    (text), (len), (ptr)->body_offset); \
	    (ptr)->body_offset += (len) + 1; \
	} \
    } while(0)

/* mime_state_push - push boundary onto stack */

static void mime_state_push(MIME_STATE *state, int def_ctype, int def_stype,
			            const char *boundary)
{
    MIME_STACK *stack;

    /*
     * RFC 2046 mandates that a boundary string be up to 70 characters long.
     * Some MTAs, including Postfix, include the fully-qualified MTA name
     * which can be longer, so we are willing to handle boundary strings that
     * exceed the RFC specification. We allow for message headers of up to
     * var_header_limit characters. In order to avoid denial of service, we
     * have to impose a configurable limit on the amount of text that we are
     * willing to store as a boundary string. Despite this truncation way we
     * will still correctly detect all intermediate boundaries and all the
     * message headers that follow those boundaries.
     */
    state->nesting_level += 1;
    stack = (MIME_STACK *) mymalloc(sizeof(*stack));
    stack->def_ctype = def_ctype;
    stack->def_stype = def_stype;
    if ((stack->bound_len = strlen(boundary)) > var_mime_bound_len)
	stack->bound_len = var_mime_bound_len;
    stack->boundary = mystrndup(boundary, stack->bound_len);
    stack->next = state->stack;
    state->stack = stack;
    if (msg_verbose)
	msg_info("PUSH boundary %s", stack->boundary);
}

/* mime_state_pop - pop boundary from stack */

static void mime_state_pop(MIME_STATE *state)
{
    MIME_STACK *stack;

    if ((stack = state->stack) == 0)
	msg_panic("mime_state_pop: there is no stack");
    if (msg_verbose)
	msg_info("POP boundary %s", stack->boundary);
    state->nesting_level -= 1;
    state->stack = stack->next;
    myfree(stack->boundary);
    myfree((void *) stack);
}

/* mime_state_alloc - create MIME state machine */

MIME_STATE *mime_state_alloc(int flags,
			             MIME_STATE_HEAD_OUT head_out,
			             MIME_STATE_ANY_END head_end,
			             MIME_STATE_BODY_OUT body_out,
			             MIME_STATE_ANY_END body_end,
			             MIME_STATE_ERR_PRINT err_print,
			             void *context)
{
    MIME_STATE *state;

    state = (MIME_STATE *) mymalloc(sizeof(*state));

    /* Volatile members. */
    state->err_flags = 0;
    state->body_offset = 0;			/* XXX */
    SET_MIME_STATE(state, MIME_STATE_PRIMARY,
		   MIME_CTYPE_TEXT, MIME_STYPE_PLAIN,
		   MIME_ENC_7BIT, MIME_ENC_7BIT);
    state->output_buffer = vstring_alloc(100);
    state->prev_rec_type = 0;
    state->stack = 0;
    state->token_buffer = vstring_alloc(1);
    state->nesting_level = -1;			/* BC Fix 20170512 */

    /* Static members. */
    state->static_flags = flags;
    state->head_out = head_out;
    state->head_end = head_end;
    state->body_out = body_out;
    state->body_end = body_end;
    state->err_print = err_print;
    state->app_context = context;
    return (state);
}

/* mime_state_free - destroy MIME state machine */

MIME_STATE *mime_state_free(MIME_STATE *state)
{
    vstring_free(state->output_buffer);
    while (state->stack)
	mime_state_pop(state);
    if (state->token_buffer)
	vstring_free(state->token_buffer);
    myfree((void *) state);
    return (0);
}

/* mime_state_content_type - process content-type header */

static void mime_state_content_type(MIME_STATE *state,
				            const HEADER_OPTS *header_info)
{
    const char *cp;
    ssize_t tok_count;
    int     def_ctype;
    int     def_stype;

#define TOKEN_MATCH(tok, text) \
    ((tok).type == HEADER_TOK_TOKEN && strcasecmp((tok).u.value, (text)) == 0)

#define RFC2045_TSPECIALS	"()<>@,;:\\\"/[]?="

#define PARSE_CONTENT_TYPE_HEADER(state, ptr) \
    header_token(state->token, MIME_MAX_TOKEN, \
	state->token_buffer, ptr, RFC2045_TSPECIALS, ';')

    cp = STR(state->output_buffer) + strlen(header_info->name) + 1;
    if ((tok_count = PARSE_CONTENT_TYPE_HEADER(state, &cp)) > 0) {

	/*
	 * text/whatever. Right now we don't really care if it is plain or
	 * not, but we may want to recognize subtypes later, and then this
	 * code can serve as an example.
	 */
	if (TOKEN_MATCH(state->token[0], "text")) {
	    state->curr_ctype = MIME_CTYPE_TEXT;
	    if (tok_count >= 3
		&& state->token[1].type == '/'
		&& TOKEN_MATCH(state->token[2], "plain"))
		state->curr_stype = MIME_STYPE_PLAIN;
	    else
		state->curr_stype = MIME_STYPE_OTHER;
	    return;
	}

	/*
	 * message/whatever body parts start with another block of message
	 * headers that we may want to look at. The partial and external-body
	 * subtypes cannot be subjected to 8-bit -> 7-bit conversion, so we
	 * must properly recognize them.
	 */
	if (TOKEN_MATCH(state->token[0], "message")) {
	    state->curr_ctype = MIME_CTYPE_MESSAGE;
	    state->curr_stype = MIME_STYPE_OTHER;
	    if (tok_count >= 3
		&& state->token[1].type == '/') {
		if (TOKEN_MATCH(state->token[2], "rfc822"))
		    state->curr_stype = MIME_STYPE_RFC822;
		else if (TOKEN_MATCH(state->token[2], "partial"))
		    state->curr_stype = MIME_STYPE_PARTIAL;
		else if (TOKEN_MATCH(state->token[2], "external-body"))
		    state->curr_stype = MIME_STYPE_EXTERN_BODY;
		else if (TOKEN_MATCH(state->token[2], "global"))
		    state->curr_stype = MIME_STYPE_GLOBAL;
	    }
	    return;
	}

	/*
	 * multipart/digest has default content type message/rfc822,
	 * multipart/whatever has default content type text/plain.
	 */
	if (TOKEN_MATCH(state->token[0], "multipart")) {
	    state->curr_ctype = MIME_CTYPE_MULTIPART;
	    if (tok_count >= 3
		&& state->token[1].type == '/'
		&& TOKEN_MATCH(state->token[2], "digest")) {
		def_ctype = MIME_CTYPE_MESSAGE;
		def_stype = MIME_STYPE_RFC822;
	    } else {
		def_ctype = MIME_CTYPE_TEXT;
		def_stype = MIME_STYPE_PLAIN;
	    }

	    /*
	     * Yes, this is supposed to capture multiple boundary strings,
	     * which are illegal and which could be used to hide content in
	     * an implementation dependent manner. The code below allows us
	     * to find embedded message headers as long as the sender uses
	     * only one of these same-level boundary strings.
	     *
	     * Yes, this is supposed to ignore the boundary value type.
	     */
	    while ((tok_count = PARSE_CONTENT_TYPE_HEADER(state, &cp)) >= 0) {
		if (tok_count >= 3
		    && TOKEN_MATCH(state->token[0], "boundary")
		    && state->token[1].type == '=') {
		    if (state->nesting_level > var_mime_maxdepth) {
			if (state->static_flags & MIME_OPT_REPORT_NESTING)
			    REPORT_ERROR_BUF(state, MIME_ERR_NESTING,
					     state->output_buffer);
		    } else {
			mime_state_push(state, def_ctype, def_stype,
					state->token[2].u.value);
		    }
		}
	    }
	}
	return;
    }

    /*
     * other/whatever.
     */
    else {
	state->curr_ctype = MIME_CTYPE_OTHER;
	return;
    }
}

/* mime_state_content_encoding - process content-transfer-encoding header */

static void mime_state_content_encoding(MIME_STATE *state,
				             const HEADER_OPTS *header_info)
{
    const char *cp;
    const MIME_ENCODING *cmp;

#define PARSE_CONTENT_ENCODING_HEADER(state, ptr) \
    header_token(state->token, 1, state->token_buffer, ptr, (char *) 0, 0)

    /*
     * Do content-transfer-encoding header. Never set the encoding domain to
     * something other than 7bit, 8bit or binary, even if we don't recognize
     * the input.
     */
    cp = STR(state->output_buffer) + strlen(header_info->name) + 1;
    if (PARSE_CONTENT_ENCODING_HEADER(state, &cp) > 0
	&& state->token[0].type == HEADER_TOK_TOKEN) {
	for (cmp = mime_encoding_map; cmp->name != 0; cmp++) {
	    if (strcasecmp(state->token[0].u.value, cmp->name) == 0) {
		state->curr_encoding = cmp->encoding;
		state->curr_domain = cmp->domain;
		break;
	    }
	}
    }
}

/* mime_state_enc_name - encoding to printable form */

static const char *mime_state_enc_name(int encoding)
{
    const MIME_ENCODING *cmp;

    for (cmp = mime_encoding_map; cmp->name != 0; cmp++)
	if (encoding == cmp->encoding)
	    return (cmp->name);
    return ("unknown");
}

/* mime_state_downgrade - convert 8-bit data to quoted-printable */

static void mime_state_downgrade(MIME_STATE *state, int rec_type,
				         const char *text, ssize_t len)
{
    static char hexchars[] = "0123456789ABCDEF";
    const unsigned char *cp;
    int     ch;

#define QP_ENCODE(buffer, ch) { \
	VSTRING_ADDCH(buffer, '='); \
	VSTRING_ADDCH(buffer, hexchars[(ch >> 4) & 0xff]); \
	VSTRING_ADDCH(buffer, hexchars[ch & 0xf]); \
    }

    /*
     * Insert a soft line break when the output reaches a critical length
     * before we reach a hard line break.
     */
    for (cp = CU_CHAR_PTR(text); cp < CU_CHAR_PTR(text + len); cp++) {
	/* Critical length before hard line break. */
	if (LEN(state->output_buffer) > 72) {
	    VSTRING_ADDCH(state->output_buffer, '=');
	    VSTRING_TERMINATE(state->output_buffer);
	    BODY_OUT(state, REC_TYPE_NORM,
		     STR(state->output_buffer),
		     LEN(state->output_buffer));
	    VSTRING_RESET(state->output_buffer);
	}
	/* Append the next character. */
	ch = *cp;
	if ((ch < 32 && ch != '\t') || ch == '=' || ch > 126) {
	    QP_ENCODE(state->output_buffer, ch);
	} else {
	    VSTRING_ADDCH(state->output_buffer, ch);
	}
    }

    /*
     * Flush output after a hard line break (i.e. the end of a REC_TYPE_NORM
     * record). Fix trailing whitespace as per the RFC: in the worst case,
     * the output length will grow from 73 characters to 75 characters.
     */
    if (rec_type == REC_TYPE_NORM) {
	if (LEN(state->output_buffer) > 0
	    && ((ch = END(state->output_buffer)[-1]) == ' ' || ch == '\t')) {
	    vstring_truncate(state->output_buffer,
			     LEN(state->output_buffer) - 1);
	    QP_ENCODE(state->output_buffer, ch);
	}
	VSTRING_TERMINATE(state->output_buffer);
	BODY_OUT(state, REC_TYPE_NORM,
		 STR(state->output_buffer),
		 LEN(state->output_buffer));
	VSTRING_RESET(state->output_buffer);
    }
}

/* mime_state_update - update MIME state machine */

int     mime_state_update(MIME_STATE *state, int rec_type,
			          const char *text, ssize_t len)
{
    int     input_is_text = (rec_type == REC_TYPE_NORM
			     || rec_type == REC_TYPE_CONT);
    MIME_STACK *sp;
    const HEADER_OPTS *header_info;
    const unsigned char *cp;

#define SAVE_PREV_REC_TYPE_AND_RETURN_ERR_FLAGS(state, rec_type) do { \
	state->prev_rec_type = rec_type; \
	return (state->err_flags); \
    } while (0)

    /*
     * Be sure to flush any partial output line that might still be buffered
     * up before taking any other "end of input" actions.
     */
    if (!input_is_text && state->prev_rec_type == REC_TYPE_CONT)
	mime_state_update(state, REC_TYPE_NORM, "", 0);

    /*
     * This message state machine is kept simple for the sake of robustness.
     * Standards evolve over time, and we want to be able to correctly
     * process messages that are not yet defined. This state machine knows
     * about headers and bodies, understands that multipart/whatever has
     * multiple body parts with a header and body, and that message/whatever
     * has message headers at the start of a body part.
     */
    switch (state->curr_state) {

	/*
	 * First, deal with header information that we have accumulated from
	 * previous input records. Discard text that does not fit in a header
	 * buffer. Our limit is quite generous; Sendmail will refuse mail
	 * with only 32kbyte in all the message headers combined.
	 */
    case MIME_STATE_PRIMARY:
    case MIME_STATE_MULTIPART:
    case MIME_STATE_NESTED:
	if (LEN(state->output_buffer) > 0) {
	    if (input_is_text) {
		if (state->prev_rec_type == REC_TYPE_CONT) {
		    if (LEN(state->output_buffer) < var_header_limit) {
			vstring_strncat(state->output_buffer, text, len);
		    } else {
			if (state->static_flags & MIME_OPT_REPORT_TRUNC_HEADER)
			    REPORT_ERROR_BUF(state, MIME_ERR_TRUNC_HEADER,
					     state->output_buffer);
		    }
		    SAVE_PREV_REC_TYPE_AND_RETURN_ERR_FLAGS(state, rec_type);
		}
		if (IS_SPACE_TAB(*text)) {
		    if (LEN(state->output_buffer) < var_header_limit) {
			vstring_strcat(state->output_buffer, "\n");
			vstring_strncat(state->output_buffer, text, len);
		    } else {
			if (state->static_flags & MIME_OPT_REPORT_TRUNC_HEADER)
			    REPORT_ERROR_BUF(state, MIME_ERR_TRUNC_HEADER,
					     state->output_buffer);
		    }
		    SAVE_PREV_REC_TYPE_AND_RETURN_ERR_FLAGS(state, rec_type);
		}
	    }

	    /*
	     * The input is (the beginning of) another message header, or is
	     * not a message header, or is not even a text record. With no
	     * more input to append to this saved header, do output
	     * processing and reset the saved header buffer. Hold on to the
	     * content transfer encoding header if we have to do a 8->7
	     * transformation, because the proper information depends on the
	     * content type header: message and multipart require a domain,
	     * leaf entities have either a transformation or a domain.
	     */
	    if (LEN(state->output_buffer) > 0) {
		header_info = header_opts_find(STR(state->output_buffer));
		if (!(state->static_flags & MIME_OPT_DISABLE_MIME)
		    && header_info != 0) {
		    if (header_info->type == HDR_CONTENT_TYPE)
			mime_state_content_type(state, header_info);
		    if (header_info->type == HDR_CONTENT_TRANSFER_ENCODING)
			mime_state_content_encoding(state, header_info);
		}
		if ((state->static_flags & MIME_OPT_REPORT_8BIT_IN_HEADER) != 0
		    && (state->err_flags & MIME_ERR_8BIT_IN_HEADER) == 0) {
		    for (cp = CU_CHAR_PTR(STR(state->output_buffer));
			 cp < CU_CHAR_PTR(END(state->output_buffer)); cp++)
			if (*cp & 0200) {
			    REPORT_ERROR_BUF(state, MIME_ERR_8BIT_IN_HEADER,
					     state->output_buffer);
			    break;
			}
		}
		/* Output routine is explicitly allowed to change the data. */
		if (header_info == 0
		    || header_info->type != HDR_CONTENT_TRANSFER_ENCODING
		    || (state->static_flags & MIME_OPT_DOWNGRADE) == 0
		    || state->curr_domain == MIME_ENC_7BIT)
		    HEAD_OUT(state, header_info, len);
		state->prev_rec_type = 0;
		VSTRING_RESET(state->output_buffer);
	    }
	}

	/*
	 * With past header information moved out of the way, proceed with a
	 * clean slate.
	 */
	if (input_is_text) {
	    ssize_t header_len;

	    /*
	     * See if this input is (the beginning of) a message header.
	     *
	     * Normalize obsolete "name space colon" syntax to "name colon".
	     * Things would be too confusing otherwise.
	     *
	     * Don't assume that the input is null terminated.
	     */
	    if ((header_len = is_header_buf(text, len)) > 0) {
		vstring_strncpy(state->output_buffer, text, header_len);
		for (text += header_len, len -= header_len;
		     len > 0 && IS_SPACE_TAB(*text);
		     text++, len--)
		     /* void */ ;
		vstring_strncat(state->output_buffer, text, len);
		SAVE_PREV_REC_TYPE_AND_RETURN_ERR_FLAGS(state, rec_type);
	    }
	}

	/*
	 * This input terminates a block of message headers. When converting
	 * 8-bit to 7-bit mail, this is the right place to emit the correct
	 * content-transfer-encoding header. With message or multipart we
	 * specify 7bit, with leaf entities we specify quoted-printable.
	 *
	 * We're not going to convert non-text data into base 64. If they send
	 * arbitrary binary data as 8-bit text, then the data is already
	 * broken beyond recovery, because the Postfix SMTP server sanitizes
	 * record boundaries, treating broken record boundaries as CRLF.
	 *
	 * Clear the output buffer, we will need it for storage of the
	 * conversion result.
	 */
	if ((state->static_flags & MIME_OPT_DOWNGRADE)
	    && state->curr_domain != MIME_ENC_7BIT) {
	    if ((state->curr_ctype == MIME_CTYPE_MESSAGE
		 && state->curr_stype != MIME_STYPE_GLOBAL)
		|| state->curr_ctype == MIME_CTYPE_MULTIPART)
		cp = CU_CHAR_PTR("7bit");
	    else
		cp = CU_CHAR_PTR("quoted-printable");
	    vstring_sprintf(state->output_buffer,
			    "Content-Transfer-Encoding: %s", cp);
	    HEAD_OUT(state, (HEADER_OPTS *) 0, len);
	    VSTRING_RESET(state->output_buffer);
	}

	/*
	 * This input terminates a block of message headers. Call the
	 * optional header end routine at the end of the first header block.
	 */
	if (state->curr_state == MIME_STATE_PRIMARY && state->head_end)
	    state->head_end(state->app_context);

	/*
	 * This is the right place to check if the sender specified an
	 * appropriate identity encoding (7bit, 8bit, binary) for multipart
	 * and for message.
	 */
	if (state->static_flags & MIME_OPT_REPORT_ENCODING_DOMAIN) {
	    if (state->curr_ctype == MIME_CTYPE_MESSAGE) {
		if (state->curr_stype == MIME_STYPE_PARTIAL
		    || state->curr_stype == MIME_STYPE_EXTERN_BODY) {
		    if (state->curr_domain != MIME_ENC_7BIT)
			REPORT_ERROR(state, MIME_ERR_ENCODING_DOMAIN,
				 mime_state_enc_name(state->curr_encoding));
		}
		/* EAI: message/global allows non-identity encoding. */
		else if (state->curr_stype == MIME_STYPE_RFC822) {
		    if (state->curr_encoding != state->curr_domain)
			REPORT_ERROR(state, MIME_ERR_ENCODING_DOMAIN,
				 mime_state_enc_name(state->curr_encoding));
		}
	    } else if (state->curr_ctype == MIME_CTYPE_MULTIPART) {
		if (state->curr_encoding != state->curr_domain)
		    REPORT_ERROR(state, MIME_ERR_ENCODING_DOMAIN,
				 mime_state_enc_name(state->curr_encoding));
	    }
	}

	/*
	 * Find out if the next body starts with its own message headers. In
	 * aggressive mode, examine headers of partial and external-body
	 * messages. Otherwise, treat such headers as part of the "body". Set
	 * the proper encoding information for the multipart prolog.
	 *
	 * XXX We parse headers inside message/* content even when the encoding
	 * is invalid (encoding != domain). With base64 we won't recognize
	 * any headers, and with quoted-printable we won't recognize MIME
	 * boundary strings, but the MIME processor will still resynchronize
	 * when it runs into the higher-level boundary string at the end of
	 * the message/* content. Although we will treat some headers as body
	 * text, we will still do a better job than if we were treating the
	 * entire message/* content as body text.
	 *
	 * XXX This changes state to MIME_STATE_NESTED and then outputs a body
	 * line, so that the body offset is not properly reset.
	 *
	 * Don't assume that the input is null terminated.
	 */
	if (input_is_text) {
	    if (len == 0) {
		state->body_offset = 0;		/* XXX */
		if (state->curr_ctype == MIME_CTYPE_MESSAGE) {
		    if (state->curr_stype == MIME_STYPE_RFC822)
			SET_MIME_STATE(state, MIME_STATE_NESTED,
				       MIME_CTYPE_TEXT, MIME_STYPE_PLAIN,
				       MIME_ENC_7BIT, MIME_ENC_7BIT);
		    else if (state->curr_stype == MIME_STYPE_GLOBAL
			 && ((state->static_flags & MIME_OPT_DOWNGRADE) == 0
			     || state->curr_domain == MIME_ENC_7BIT))
			/* XXX EAI: inspect encoded message/global. */
			SET_MIME_STATE(state, MIME_STATE_NESTED,
				       MIME_CTYPE_TEXT, MIME_STYPE_PLAIN,
				       MIME_ENC_7BIT, MIME_ENC_7BIT);
		    else
			SET_CURR_STATE(state, MIME_STATE_BODY);
		} else if (state->curr_ctype == MIME_CTYPE_MULTIPART) {
		    SET_MIME_STATE(state, MIME_STATE_BODY,
				   MIME_CTYPE_OTHER, MIME_STYPE_OTHER,
				   MIME_ENC_7BIT, MIME_ENC_7BIT);
		} else {
		    SET_CURR_STATE(state, MIME_STATE_BODY);
		}
	    }

	    /*
	     * Invalid input. Force output of one blank line and jump to the
	     * body state, leaving all other state alone.
	     *
	     * We don't break legitimate mail by inserting a blank line
	     * separator between primary headers and a non-empty body. Many
	     * MTA's don't even record the presence or absence of this
	     * separator, nor does the Milter protocol pass it on to Milter
	     * applications.
	     *
	     * XXX We don't insert a blank line separator into attachments, to
	     * avoid breaking digital signatures. Postfix shall not do a
	     * worse mail delivery job than MTAs that can't even parse MIME.
	     * We switch to body state anyway, to avoid treating body text as
	     * header text, and mis-interpreting or truncating it. The code
	     * below for initial From_ lines is for educational purposes.
	     *
	     * Sites concerned about MIME evasion can use a MIME normalizer.
	     * Postfix has a different mission.
	     */
	    else {
		if (msg_verbose)
		    msg_info("garbage in %s header",
		    state->curr_state == MIME_STATE_MULTIPART ? "multipart" :
		       state->curr_state == MIME_STATE_PRIMARY ? "primary" :
			 state->curr_state == MIME_STATE_NESTED ? "nested" :
			     "other");
		switch (state->curr_state) {
		case MIME_STATE_PRIMARY:
		    BODY_OUT(state, REC_TYPE_NORM, "", 0);
		    SET_CURR_STATE(state, MIME_STATE_BODY);
		    break;
#if 0
		case MIME_STATE_NESTED:
		    if (state->body_offset <= 1
			&& rec_type == REC_TYPE_NORM
			&& len > 7
			&& (strncmp(text + (*text == '>'), "From ", 5) == 0
			    || strncmp(text, "=46rom ", 7) == 0))
			break;
		    /* FALLTHROUGH */
#endif
		default:
		    SET_CURR_STATE(state, MIME_STATE_BODY);
		    break;
		}
	    }
	}

	/*
	 * This input is not text. Go to body state, unconditionally.
	 */
	else {
	    SET_CURR_STATE(state, MIME_STATE_BODY);
	}
	/* FALLTHROUGH */

	/*
	 * Body text. Look for message boundaries, and recover from missing
	 * boundary strings. Missing boundaries can happen in aggressive mode
	 * with text/rfc822-headers or with message/partial. Ignore non-space
	 * cruft after --boundary or --boundary--, because some MUAs do, and
	 * because only perverse software would take advantage of this to
	 * escape detection. We have to ignore trailing cruft anyway, because
	 * our saved copy of the boundary string may have been truncated for
	 * safety reasons.
	 *
	 * Optionally look for 8-bit data in content that was announced as, or
	 * that defaults to, 7-bit. Unfortunately, we cannot turn this on by
	 * default. Majordomo sends requests for approval that do not
	 * propagate the MIME information from the enclosed message to the
	 * message headers of the approval request.
	 *
	 * Set the proper state information after processing a message boundary
	 * string.
	 *
	 * Don't look for boundary strings at the start of a continued record.
	 *
	 * Don't assume that the input is null terminated.
	 */
    case MIME_STATE_BODY:
	if (input_is_text) {
	    if ((state->static_flags & MIME_OPT_REPORT_8BIT_IN_7BIT_BODY) != 0
		&& state->curr_encoding == MIME_ENC_7BIT
		&& (state->err_flags & MIME_ERR_8BIT_IN_7BIT_BODY) == 0) {
		for (cp = CU_CHAR_PTR(text); cp < CU_CHAR_PTR(text + len); cp++)
		    if (*cp & 0200) {
			REPORT_ERROR_LEN(state, MIME_ERR_8BIT_IN_7BIT_BODY,
					 text, len);
			break;
		    }
	    }
	    if (state->stack && state->prev_rec_type != REC_TYPE_CONT
		&& len > 2 && text[0] == '-' && text[1] == '-') {
		for (sp = state->stack; sp != 0; sp = sp->next) {
		    if (len >= 2 + sp->bound_len &&
		      strncmp(text + 2, sp->boundary, sp->bound_len) == 0) {
			while (sp != state->stack)
			    mime_state_pop(state);
			if (len >= 4 + sp->bound_len &&
			  strncmp(text + 2 + sp->bound_len, "--", 2) == 0) {
			    mime_state_pop(state);
			    SET_MIME_STATE(state, MIME_STATE_BODY,
					 MIME_CTYPE_OTHER, MIME_STYPE_OTHER,
					   MIME_ENC_7BIT, MIME_ENC_7BIT);
			} else {
			    SET_MIME_STATE(state, MIME_STATE_MULTIPART,
					   sp->def_ctype, sp->def_stype,
					   MIME_ENC_7BIT, MIME_ENC_7BIT);
			}
			break;
		    }
		}
	    }
	    /* Put last for consistency with header output routine. */
	    if ((state->static_flags & MIME_OPT_DOWNGRADE)
		&& state->curr_domain != MIME_ENC_7BIT)
		mime_state_downgrade(state, rec_type, text, len);
	    else
		BODY_OUT(state, rec_type, text, len);
	}

	/*
	 * The input is not a text record. Inform the application that this
	 * is the last opportunity to send any pending output.
	 */
	else {
	    if (state->body_end)
		state->body_end(state->app_context);
	}
	SAVE_PREV_REC_TYPE_AND_RETURN_ERR_FLAGS(state, rec_type);

	/*
	 * Oops. This can't happen.
	 */
    default:
	msg_panic("mime_state_update: unknown state: %d", state->curr_state);
    }
}

 /*
  * Mime error to (DSN, text) mapping. Order matters; more serious errors
  * must precede less serious errors, because the error-to-text conversion
  * can report only one error.
  */
static const MIME_STATE_DETAIL mime_err_detail[] = {
    MIME_ERR_NESTING, "5.6.0", "MIME nesting exceeds safety limit",
    MIME_ERR_TRUNC_HEADER, "5.6.0", "message header length exceeds safety limit",
    MIME_ERR_8BIT_IN_HEADER, "5.6.0", "improper use of 8-bit data in message header",
    MIME_ERR_8BIT_IN_7BIT_BODY, "5.6.0", "improper use of 8-bit data in message body",
    MIME_ERR_ENCODING_DOMAIN, "5.6.0", "invalid message/* or multipart/* encoding domain",
    0,
};

/* mime_state_error - error code to string */

const char *mime_state_error(int error_code)
{
    const MIME_STATE_DETAIL *mp;

    if (error_code == 0)
	msg_panic("mime_state_error: there is no error");
    for (mp = mime_err_detail; mp->code; mp++)
	if (mp->code & error_code)
	    return (mp->text);
    msg_panic("mime_state_error: unknown error code %d", error_code);
}

/* mime_state_detail - error code to table entry with assorted data */

const MIME_STATE_DETAIL *mime_state_detail(int error_code)
{
    const MIME_STATE_DETAIL *mp;

    if (error_code == 0)
	msg_panic("mime_state_detail: there is no error");
    for (mp = mime_err_detail; mp->code; mp++)
	if (mp->code & error_code)
	    return (mp);
    msg_panic("mime_state_detail: unknown error code %d", error_code);
}

#ifdef TEST

#include <stdlib.h>
#include <stringops.h>
#include <vstream.h>
#include <msg_vstream.h>
#include <rec_streamlf.h>

 /*
  * Stress test the REC_TYPE_CONT/NORM handling, but don't break header
  * labels.
  */
/*#define REC_LEN	40*/

#define REC_LEN	1024

static void head_out(void *context, int class, const HEADER_OPTS *unused_info,
		             VSTRING *buf, off_t offset)
{
    VSTREAM *stream = (VSTREAM *) context;

    vstream_fprintf(stream, "%s %ld\t|%s\n",
		    class == MIME_HDR_PRIMARY ? "MAIN" :
		    class == MIME_HDR_MULTIPART ? "MULT" :
		    class == MIME_HDR_NESTED ? "NEST" :
		    "ERROR", (long) offset, STR(buf));
}

static void head_end(void *context)
{
    VSTREAM *stream = (VSTREAM *) context;

    vstream_fprintf(stream, "HEADER END\n");
}

static void body_out(void *context, int rec_type, const char *buf, ssize_t len,
		             off_t offset)
{
    VSTREAM *stream = (VSTREAM *) context;

    vstream_fprintf(stream, "BODY %c %ld\t|", rec_type, (long) offset);
    vstream_fwrite(stream, buf, len);
    if (rec_type == REC_TYPE_NORM)
	VSTREAM_PUTC('\n', stream);
}

static void body_end(void *context)
{
    VSTREAM *stream = (VSTREAM *) context;

    vstream_fprintf(stream, "BODY END\n");
}

static void err_print(void *unused_context, int err_flag,
		              const char *text, ssize_t len)
{
    msg_warn("%s: %.*s", mime_state_error(err_flag),
	     len < 100 ? (int) len : 100, text);
}

int     var_header_limit = 2000;
int     var_mime_maxdepth = 20;
int     var_mime_bound_len = 2000;
char   *var_drop_hdrs = DEF_DROP_HDRS;

int     main(int unused_argc, char **argv)
{
    int     rec_type;
    int     last = 0;
    VSTRING *buf;
    MIME_STATE *state;
    int     err;

    /*
     * Initialize.
     */
#define MIME_OPTIONS \
	    (MIME_OPT_REPORT_8BIT_IN_7BIT_BODY \
	    | MIME_OPT_REPORT_8BIT_IN_HEADER \
	    | MIME_OPT_REPORT_ENCODING_DOMAIN \
	    | MIME_OPT_REPORT_TRUNC_HEADER \
	    | MIME_OPT_REPORT_NESTING \
	    | MIME_OPT_DOWNGRADE)

    msg_vstream_init(basename(argv[0]), VSTREAM_OUT);
    msg_verbose = 1;
    buf = vstring_alloc(10);
    state = mime_state_alloc(MIME_OPTIONS,
			     head_out, head_end,
			     body_out, body_end,
			     err_print,
			     (void *) VSTREAM_OUT);

    /*
     * Main loop.
     */
    do {
	rec_type = rec_streamlf_get(VSTREAM_IN, buf, REC_LEN);
	VSTRING_TERMINATE(buf);
	err = mime_state_update(state, last = rec_type, STR(buf), LEN(buf));
	vstream_fflush(VSTREAM_OUT);
    } while (rec_type > 0);

    /*
     * Error reporting.
     */
    if (err & MIME_ERR_TRUNC_HEADER)
	msg_warn("message header length exceeds safety limit");
    if (err & MIME_ERR_NESTING)
	msg_warn("MIME nesting exceeds safety limit");
    if (err & MIME_ERR_8BIT_IN_HEADER)
	msg_warn("improper use of 8-bit data in message header");
    if (err & MIME_ERR_8BIT_IN_7BIT_BODY)
	msg_warn("improper use of 8-bit data in message body");
    if (err & MIME_ERR_ENCODING_DOMAIN)
	msg_warn("improper message/* or multipart/* encoding domain");

    /*
     * Cleanup.
     */
    mime_state_free(state);
    vstring_free(buf);
    exit(0);
}

#endif