xref: /openbsd/usr.sbin/smtpd/mta_session.c (revision 91f110e0)
1 /*	$OpenBSD: mta_session.c,v 1.57 2014/03/02 21:19:36 gilles Exp $	*/
2 
3 /*
4  * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
5  * Copyright (c) 2008 Gilles Chehade <gilles@poolp.org>
6  * Copyright (c) 2009 Jacek Masiulaniec <jacekm@dobremiasto.net>
7  * Copyright (c) 2012 Eric Faurot <eric@openbsd.org>
8  *
9  * Permission to use, copy, modify, and distribute this software for any
10  * purpose with or without fee is hereby granted, provided that the above
11  * copyright notice and this permission notice appear in all copies.
12  *
13  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20  */
21 
22 #include <sys/types.h>
23 #include <sys/queue.h>
24 #include <sys/tree.h>
25 #include <sys/socket.h>
26 #include <sys/uio.h>
27 
28 #include <ctype.h>
29 #include <err.h>
30 #include <errno.h>
31 #include <event.h>
32 #include <imsg.h>
33 #include <inttypes.h>
34 #include <netdb.h>
35 #include <openssl/ssl.h>
36 #include <pwd.h>
37 #include <resolv.h>
38 #include <signal.h>
39 #include <stdio.h>
40 #include <stdlib.h>
41 #include <string.h>
42 #include <time.h>
43 #include <unistd.h>
44 
45 #include "smtpd.h"
46 #include "log.h"
47 #include "ssl.h"
48 
49 #define MAX_TRYBEFOREDISABLE	10
50 
51 #define MTA_HIWAT		65535
52 
53 enum mta_state {
54 	MTA_INIT,
55 	MTA_BANNER,
56 	MTA_EHLO,
57 	MTA_HELO,
58 	MTA_LHLO,
59 	MTA_STARTTLS,
60 	MTA_AUTH,
61 	MTA_AUTH_PLAIN,
62 	MTA_AUTH_LOGIN,
63 	MTA_AUTH_LOGIN_USER,
64 	MTA_AUTH_LOGIN_PASS,
65 	MTA_READY,
66 	MTA_MAIL,
67 	MTA_RCPT,
68 	MTA_DATA,
69 	MTA_BODY,
70 	MTA_EOM,
71 	MTA_LMTP_EOM,
72 	MTA_RSET,
73 	MTA_QUIT,
74 };
75 
76 #define MTA_FORCE_ANYSSL	0x0001
77 #define MTA_FORCE_SMTPS		0x0002
78 #define MTA_FORCE_TLS     	0x0004
79 #define MTA_FORCE_PLAIN		0x0008
80 #define MTA_WANT_SECURE		0x0010
81 #define MTA_USE_AUTH		0x0020
82 #define MTA_USE_CERT		0x0040
83 
84 #define MTA_TLS_TRIED		0x0080
85 
86 #define MTA_TLS			0x0100
87 #define MTA_VERIFIED   		0x0200
88 
89 #define MTA_FREE		0x0400
90 #define MTA_LMTP		0x0800
91 #define MTA_WAIT		0x1000
92 #define MTA_HANGON		0x2000
93 
94 #define MTA_EXT_STARTTLS	0x01
95 #define MTA_EXT_PIPELINING	0x02
96 #define MTA_EXT_AUTH		0x04
97 #define MTA_EXT_AUTH_PLAIN     	0x08
98 #define MTA_EXT_AUTH_LOGIN     	0x10
99 
100 struct mta_session {
101 	uint64_t		 id;
102 	struct mta_relay	*relay;
103 	struct mta_route	*route;
104 	char			*helo;
105 
106 	int			 flags;
107 
108 	int			 attempt;
109 	int			 use_smtps;
110 	int			 use_starttls;
111 	int			 use_smtp_tls;
112 	int			 ready;
113 
114 	struct iobuf		 iobuf;
115 	struct io		 io;
116 	int			 ext;
117 
118 	size_t			 msgtried;
119 	size_t			 msgcount;
120 	size_t			 rcptcount;
121 	int			 hangon;
122 
123 	enum mta_state		 state;
124 	struct mta_task		*task;
125 	struct mta_envelope	*currevp;
126 	FILE			*datafp;
127 
128 	size_t			 failures;
129 };
130 
131 static void mta_session_init(void);
132 static void mta_start(int fd, short ev, void *arg);
133 static void mta_io(struct io *, int);
134 static void mta_free(struct mta_session *);
135 static void mta_on_ptr(void *, void *, void *);
136 static void mta_on_timeout(struct runq *, void *);
137 static void mta_connect(struct mta_session *);
138 static void mta_enter_state(struct mta_session *, int);
139 static void mta_flush_task(struct mta_session *, int, const char *, size_t, int);
140 static void mta_error(struct mta_session *, const char *, ...);
141 static void mta_send(struct mta_session *, char *, ...);
142 static ssize_t mta_queue_data(struct mta_session *);
143 static void mta_response(struct mta_session *, char *);
144 static const char * mta_strstate(int);
145 static int mta_check_loop(FILE *);
146 static void mta_start_tls(struct mta_session *);
147 static int mta_verify_certificate(struct mta_session *);
148 static struct mta_session *mta_tree_pop(struct tree *, uint64_t);
149 static const char * dsn_strret(enum dsn_ret);
150 static const char * dsn_strnotify(uint8_t);
151 
152 void mta_hoststat_update(const char *, const char *);
153 void mta_hoststat_reschedule(const char *);
154 void mta_hoststat_cache(const char *, uint64_t);
155 void mta_hoststat_uncache(const char *, uint64_t);
156 
157 static struct tree wait_helo;
158 static struct tree wait_ptr;
159 static struct tree wait_fd;
160 static struct tree wait_ssl_init;
161 static struct tree wait_ssl_verify;
162 
163 static struct runq *hangon;
164 
165 static void
166 mta_session_init(void)
167 {
168 	static int init = 0;
169 
170 	if (!init) {
171 		tree_init(&wait_helo);
172 		tree_init(&wait_ptr);
173 		tree_init(&wait_fd);
174 		tree_init(&wait_ssl_init);
175 		tree_init(&wait_ssl_verify);
176 		runq_init(&hangon, mta_on_timeout);
177 		init = 1;
178 	}
179 }
180 
181 void
182 mta_session(struct mta_relay *relay, struct mta_route *route)
183 {
184 	struct mta_session	*s;
185 	struct timeval		 tv;
186 
187 	mta_session_init();
188 
189 	s = xcalloc(1, sizeof *s, "mta_session");
190 	s->id = generate_uid();
191 	s->relay = relay;
192 	s->route = route;
193 	s->io.sock = -1;
194 
195 	if (relay->flags & RELAY_SSL && relay->flags & RELAY_AUTH)
196 		s->flags |= MTA_USE_AUTH;
197 	if (relay->pki_name)
198 		s->flags |= MTA_USE_CERT;
199 	if (relay->flags & RELAY_LMTP)
200 		s->flags |= MTA_LMTP;
201 	switch (relay->flags & (RELAY_SSL|RELAY_TLS_OPTIONAL)) {
202 		case RELAY_SSL:
203 			s->flags |= MTA_FORCE_ANYSSL;
204 			s->flags |= MTA_WANT_SECURE;
205 			break;
206 		case RELAY_SMTPS:
207 			s->flags |= MTA_FORCE_SMTPS;
208 			s->flags |= MTA_WANT_SECURE;
209 			break;
210 		case RELAY_STARTTLS:
211 			s->flags |= MTA_FORCE_TLS;
212 			s->flags |= MTA_WANT_SECURE;
213 			break;
214 		case RELAY_TLS_OPTIONAL:
215 			/* do not force anything, try tls then smtp */
216 			break;
217 		default:
218 			s->flags |= MTA_FORCE_PLAIN;
219 	}
220 
221 	log_debug("debug: mta: %p: spawned for relay %s", s,
222 	    mta_relay_to_text(relay));
223 	stat_increment("mta.session", 1);
224 
225 	if (route->dst->ptrname || route->dst->lastptrquery) {
226 		/* We want to delay the connection since to always notify
227 		 * the relay asynchronously.
228 		 */
229 		tv.tv_sec = 0;
230 		tv.tv_usec = 0;
231 		evtimer_set(&s->io.ev, mta_start, s);
232 		evtimer_add(&s->io.ev, &tv);
233 	} else if (waitq_wait(&route->dst->ptrname, mta_on_ptr, s)) {
234 		dns_query_ptr(s->id, s->route->dst->sa);
235 		tree_xset(&wait_ptr, s->id, s);
236 		s->flags |= MTA_WAIT;
237 	}
238 }
239 
240 void
241 mta_session_imsg(struct mproc *p, struct imsg *imsg)
242 {
243 	struct ca_vrfy_resp_msg	*resp_ca_vrfy;
244 	struct ca_cert_resp_msg	*resp_ca_cert;
245 	struct mta_session	*s;
246 	struct mta_host		*h;
247 	struct msg		 m;
248 	uint64_t		 reqid;
249 	const char		*name;
250 	void			*ssl;
251 	int			 dnserror, status;
252 
253 	switch (imsg->hdr.type) {
254 
255 	case IMSG_QUEUE_MESSAGE_FD:
256 		m_msg(&m, imsg);
257 		m_get_id(&m, &reqid);
258 		m_end(&m);
259 
260 		s = mta_tree_pop(&wait_fd, reqid);
261 		if (s == NULL) {
262 			if (imsg->fd != -1)
263 				close(imsg->fd);
264 			return;
265 		}
266 
267 		if (imsg->fd == -1) {
268 			log_debug("debug: mta: failed to obtain msg fd");
269 			mta_flush_task(s, IMSG_DELIVERY_TEMPFAIL,
270 			    "Could not get message fd", 0, 0);
271 			mta_enter_state(s, MTA_READY);
272 			io_reload(&s->io);
273 			return;
274 		}
275 
276 		s->datafp = fdopen(imsg->fd, "r");
277 		if (s->datafp == NULL)
278 			fatal("mta: fdopen");
279 
280 		if (mta_check_loop(s->datafp)) {
281 			log_debug("debug: mta: loop detected");
282 			fclose(s->datafp);
283 			s->datafp = NULL;
284 			mta_flush_task(s, IMSG_DELIVERY_LOOP,
285 			    "Loop detected", 0, 0);
286 			mta_enter_state(s, MTA_READY);
287 		} else {
288 			mta_enter_state(s, MTA_MAIL);
289 		}
290 		io_reload(&s->io);
291 		return;
292 
293 	case IMSG_DNS_PTR:
294 		m_msg(&m, imsg);
295 		m_get_id(&m, &reqid);
296 		m_get_int(&m, &dnserror);
297 		if (dnserror)
298 			name = NULL;
299 		else
300 			m_get_string(&m, &name);
301 		m_end(&m);
302 		s = mta_tree_pop(&wait_ptr, reqid);
303 		if (s == NULL)
304 			return;
305 
306 		h = s->route->dst;
307 		h->lastptrquery = time(NULL);
308 		if (name)
309 			h->ptrname = xstrdup(name, "mta: ptr");
310 		waitq_run(&h->ptrname, h->ptrname);
311 		return;
312 
313 	case IMSG_LKA_SSL_INIT:
314 		resp_ca_cert = imsg->data;
315 		s = mta_tree_pop(&wait_ssl_init, resp_ca_cert->reqid);
316 		if (s == NULL)
317 			return;
318 
319 		if (resp_ca_cert->status == CA_FAIL) {
320 			if (s->relay->pki_name) {
321 				log_info("smtp-out: Disconnecting session %016"PRIx64
322 				    ": CA failure", s->id);
323 				mta_free(s);
324 				return;
325 			}
326 			else {
327 				ssl = ssl_mta_init(NULL, 0, NULL, 0);
328 				if (ssl == NULL)
329 					fatal("mta: ssl_mta_init");
330 				io_start_tls(&s->io, ssl);
331 				return;
332 			}
333 		}
334 
335 		resp_ca_cert = xmemdup(imsg->data, sizeof *resp_ca_cert, "mta:ca_cert");
336 		resp_ca_cert->cert = xstrdup((char *)imsg->data +
337 		    sizeof *resp_ca_cert, "mta:ca_cert");
338 		resp_ca_cert->key = xstrdup((char *)imsg->data +
339 		    sizeof *resp_ca_cert + resp_ca_cert->cert_len,
340 		    "mta:ca_key");
341 		ssl = ssl_mta_init(resp_ca_cert->cert, resp_ca_cert->cert_len,
342 		    resp_ca_cert->key, resp_ca_cert->key_len);
343 		if (ssl == NULL)
344 			fatal("mta: ssl_mta_init");
345 		io_start_tls(&s->io, ssl);
346 
347 		memset(resp_ca_cert->cert, 0, resp_ca_cert->cert_len);
348 		memset(resp_ca_cert->key, 0, resp_ca_cert->key_len);
349 		free(resp_ca_cert->cert);
350 		free(resp_ca_cert->key);
351 		free(resp_ca_cert);
352 		return;
353 
354 	case IMSG_LKA_SSL_VERIFY:
355 		resp_ca_vrfy = imsg->data;
356 		s = mta_tree_pop(&wait_ssl_verify, resp_ca_vrfy->reqid);
357 		if (s == NULL)
358 			return;
359 
360 		if (resp_ca_vrfy->status == CA_OK)
361 			s->flags |= MTA_VERIFIED;
362 		else if (s->relay->flags & F_TLS_VERIFY) {
363 			errno = 0;
364 			mta_error(s, "SSL certificate check failed");
365 			mta_free(s);
366 			return;
367 		}
368 
369 		mta_io(&s->io, IO_TLSVERIFIED);
370 		io_resume(&s->io, IO_PAUSE_IN);
371 		io_reload(&s->io);
372 		return;
373 
374 	case IMSG_LKA_HELO:
375 		m_msg(&m, imsg);
376 		m_get_id(&m, &reqid);
377 		m_get_int(&m, &status);
378 		if (status == LKA_OK)
379 			m_get_string(&m, &name);
380 		m_end(&m);
381 
382 		s = mta_tree_pop(&wait_helo, reqid);
383 		if (s == NULL)
384 			return;
385 
386 		if (status == LKA_OK) {
387 			s->helo = xstrdup(name, "mta_session_imsg");
388 			mta_connect(s);
389 		} else {
390 			mta_source_error(s->relay, s->route,
391 			    "Failed to retrieve helo string");
392 			mta_free(s);
393 		}
394 		return;
395 
396 	default:
397 		errx(1, "mta_session_imsg: unexpected %s imsg",
398 		    imsg_to_str(imsg->hdr.type));
399 	}
400 }
401 
402 static struct mta_session *
403 mta_tree_pop(struct tree *wait, uint64_t reqid)
404 {
405 	struct mta_session *s;
406 
407 	s = tree_xpop(wait, reqid);
408 	if (s->flags & MTA_FREE) {
409 		log_debug("debug: mta: %p: zombie session", s);
410 		mta_free(s);
411 		return (NULL);
412 	}
413 	s->flags &= ~MTA_WAIT;
414 
415 	return (s);
416 }
417 
418 static void
419 mta_free(struct mta_session *s)
420 {
421 	struct mta_relay *relay;
422 	struct mta_route *route;
423 
424 	log_debug("debug: mta: %p: session done", s);
425 
426 	if (s->ready)
427 		s->relay->nconn_ready -= 1;
428 
429 	if (s->flags & MTA_HANGON) {
430 		log_debug("debug: mta: %p: cancelling hangon timer", s);
431 		runq_cancel(hangon, NULL, s);
432 	}
433 
434 	io_clear(&s->io);
435 	iobuf_clear(&s->iobuf);
436 
437 	if (s->task)
438 		fatalx("current task should have been deleted already");
439 	if (s->datafp)
440 		fclose(s->datafp);
441 	if (s->helo)
442 		free(s->helo);
443 
444 	relay = s->relay;
445 	route = s->route;
446 	free(s);
447 	stat_decrement("mta.session", 1);
448 	mta_route_collect(relay, route);
449 }
450 
451 static void
452 mta_on_timeout(struct runq *runq, void *arg)
453 {
454 	struct mta_session *s = arg;
455 
456 	log_debug("mta: timeout for session hangon");
457 
458 	s->flags &= ~MTA_HANGON;
459 	s->hangon++;
460 
461 	mta_enter_state(s, MTA_READY);
462 	io_reload(&s->io);
463 }
464 
465 static void
466 mta_on_ptr(void *tag, void *arg, void *data)
467 {
468 	struct mta_session *s = arg;
469 
470 	mta_connect(s);
471 }
472 
473 static void
474 mta_start(int fd, short ev, void *arg)
475 {
476 	struct mta_session *s = arg;
477 
478 	mta_connect(s);
479 }
480 
481 static void
482 mta_connect(struct mta_session *s)
483 {
484 	struct sockaddr_storage	 ss;
485 	struct sockaddr		*sa;
486 	int			 portno;
487 	const char		*schema = "smtp+tls://";
488 
489 	if (s->helo == NULL) {
490 		if (s->relay->helotable && s->route->src->sa) {
491 			m_create(p_lka, IMSG_LKA_HELO, 0, 0, -1);
492 			m_add_id(p_lka, s->id);
493 			m_add_string(p_lka, s->relay->helotable);
494 			m_add_sockaddr(p_lka, s->route->src->sa);
495 			m_close(p_lka);
496 			tree_xset(&wait_helo, s->id, s);
497 			s->flags |= MTA_WAIT;
498 			return;
499 		}
500 		else if (s->relay->heloname)
501 			s->helo = xstrdup(s->relay->heloname, "mta_connect");
502 		else
503 			s->helo = xstrdup(env->sc_hostname, "mta_connect");
504 	}
505 
506 	io_clear(&s->io);
507 	iobuf_clear(&s->iobuf);
508 
509 	s->use_smtps = s->use_starttls = s->use_smtp_tls = 0;
510 
511 	switch (s->attempt) {
512 	case 0:
513 		if (s->flags & MTA_FORCE_SMTPS)
514 			s->use_smtps = 1;	/* smtps */
515 		else if (s->flags & (MTA_FORCE_TLS|MTA_FORCE_ANYSSL))
516 			s->use_starttls = 1;	/* tls, tls+smtps */
517 		else if (!(s->flags & MTA_FORCE_PLAIN))
518 			s->use_smtp_tls = 1;
519 		break;
520 	case 1:
521 		if (s->flags & MTA_FORCE_ANYSSL) {
522 			s->use_smtps = 1;	/* tls+smtps */
523 			break;
524 		}
525 	default:
526 		mta_free(s);
527 		return;
528 	}
529 	portno = s->use_smtps ? 465 : 25;
530 
531 	/* Override with relay-specified port */
532 	if (s->relay->port)
533 		portno = s->relay->port;
534 
535 	memmove(&ss, s->route->dst->sa, s->route->dst->sa->sa_len);
536 	sa = (struct sockaddr *)&ss;
537 
538 	if (sa->sa_family == AF_INET)
539 		((struct sockaddr_in *)sa)->sin_port = htons(portno);
540 	else if (sa->sa_family == AF_INET6)
541 		((struct sockaddr_in6 *)sa)->sin6_port = htons(portno);
542 
543 	s->attempt += 1;
544 
545 	if (s->use_smtp_tls)
546 		schema = "smtp+tls://";
547 	else if (s->use_starttls)
548 		schema = "tls://";
549 	else if (s->use_smtps)
550 		schema = "smtps://";
551 	else if (s->flags & MTA_LMTP)
552 		schema = "lmtp://";
553 	else
554 		schema = "smtp://";
555 
556 	log_info("smtp-out: Connecting to %s%s:%d (%s) on session"
557 	    " %016"PRIx64"...", schema, sa_to_text(s->route->dst->sa),
558 	    portno, s->route->dst->ptrname, s->id);
559 
560 	mta_enter_state(s, MTA_INIT);
561 	iobuf_xinit(&s->iobuf, 0, 0, "mta_connect");
562 	io_init(&s->io, -1, s, mta_io, &s->iobuf);
563 	io_set_timeout(&s->io, 300000);
564 	if (io_connect(&s->io, sa, s->route->src->sa) == -1) {
565 		/*
566 		 * This error is most likely a "no route",
567 		 * so there is no need to try again.
568 		 */
569 		log_debug("debug: mta: io_connect failed: %s", s->io.error);
570 		if (errno == EADDRNOTAVAIL)
571 			mta_source_error(s->relay, s->route, s->io.error);
572 		else
573 			mta_error(s, "Connection failed: %s", s->io.error);
574 		mta_free(s);
575 	}
576 }
577 
578 static void
579 mta_enter_state(struct mta_session *s, int newstate)
580 {
581 	struct mta_envelope	 *e;
582 	size_t			 envid_sz;
583 	int			 oldstate;
584 	ssize_t			 q;
585 	char			 ibuf[SMTPD_MAXLINESIZE];
586 	char			 obuf[SMTPD_MAXLINESIZE];
587 	int			 offset;
588 
589     again:
590 	oldstate = s->state;
591 
592 	log_trace(TRACE_MTA, "mta: %p: %s -> %s", s,
593 	    mta_strstate(oldstate),
594 	    mta_strstate(newstate));
595 
596 	s->state = newstate;
597 
598 	/* don't try this at home! */
599 #define mta_enter_state(_s, _st) do { newstate = _st; goto again; } while (0)
600 
601 	switch (s->state) {
602 	case MTA_INIT:
603 	case MTA_BANNER:
604 		break;
605 
606 	case MTA_EHLO:
607 		s->ext = 0;
608 		mta_send(s, "EHLO %s", s->helo);
609 		break;
610 
611 	case MTA_HELO:
612 		s->ext = 0;
613 		mta_send(s, "HELO %s", s->helo);
614 		break;
615 
616 	case MTA_LHLO:
617 		s->ext = 0;
618 		mta_send(s, "LHLO %s", s->helo);
619 		break;
620 
621 	case MTA_STARTTLS:
622 		if (s->flags & MTA_TLS) /* already started */
623 			mta_enter_state(s, MTA_AUTH);
624 		else if ((s->ext & MTA_EXT_STARTTLS) == 0) {
625 			if (s->flags & MTA_FORCE_TLS || s->flags & MTA_WANT_SECURE) {
626 				mta_error(s, "TLS required but not supported by remote host");
627 				mta_connect(s);
628 			}
629 			else
630 				/* server doesn't support starttls, do not use it */
631 				mta_enter_state(s, MTA_AUTH);
632 		}
633 		else
634 			mta_send(s, "STARTTLS");
635 		break;
636 
637 	case MTA_AUTH:
638 		if (s->relay->secret && s->flags & MTA_TLS) {
639 			if (s->ext & MTA_EXT_AUTH) {
640 				if (s->ext & MTA_EXT_AUTH_PLAIN) {
641 					mta_enter_state(s, MTA_AUTH_PLAIN);
642 					break;
643 				}
644 				if (s->ext & MTA_EXT_AUTH_LOGIN) {
645 					mta_enter_state(s, MTA_AUTH_LOGIN);
646 					break;
647 				}
648 				log_debug("debug: mta: %p: no supported AUTH method on session", s);
649 				mta_error(s, "no supported AUTH method");
650 			}
651 			else {
652 				log_debug("debug: mta: %p: AUTH not advertised on session", s);
653 				mta_error(s, "AUTH not advertised");
654 			}
655 		}
656 		else if (s->relay->secret) {
657 			log_debug("debug: mta: %p: not using AUTH on non-TLS "
658 			    "session", s);
659 			mta_error(s, "Refuse to AUTH over unsecure channel");
660 			mta_connect(s);
661 		} else {
662 			mta_enter_state(s, MTA_READY);
663 		}
664 		break;
665 
666 	case MTA_AUTH_PLAIN:
667 		mta_send(s, "AUTH PLAIN %s", s->relay->secret);
668 		break;
669 
670 	case MTA_AUTH_LOGIN:
671 		mta_send(s, "AUTH LOGIN");
672 		break;
673 
674 	case MTA_AUTH_LOGIN_USER:
675 		memset(ibuf, 0, sizeof ibuf);
676 		if (base64_decode(s->relay->secret, (unsigned char *)ibuf,
677 				  sizeof(ibuf)-1) == -1) {
678 			log_debug("debug: mta: %p: credentials too large on session", s);
679 			mta_error(s, "Credentials too large");
680 			break;
681 		}
682 
683 		memset(obuf, 0, sizeof obuf);
684 		base64_encode((unsigned char *)ibuf + 1, strlen(ibuf + 1), obuf, sizeof obuf);
685 		mta_send(s, "%s", obuf);
686 
687 		memset(ibuf, 0, sizeof ibuf);
688 		memset(obuf, 0, sizeof obuf);
689 		break;
690 
691 	case MTA_AUTH_LOGIN_PASS:
692 		memset(ibuf, 0, sizeof ibuf);
693 		if (base64_decode(s->relay->secret, (unsigned char *)ibuf,
694 				  sizeof(ibuf)-1) == -1) {
695 			log_debug("debug: mta: %p: credentials too large on session", s);
696 			mta_error(s, "Credentials too large");
697 			break;
698 		}
699 
700 		offset = strlen(ibuf+1)+2;
701 		memset(obuf, 0, sizeof obuf);
702 		base64_encode((unsigned char *)ibuf + offset, strlen(ibuf + offset), obuf, sizeof obuf);
703 		mta_send(s, "%s", obuf);
704 
705 		memset(ibuf, 0, sizeof ibuf);
706 		memset(obuf, 0, sizeof obuf);
707 		break;
708 
709 	case MTA_READY:
710 		/* Ready to send a new mail */
711 		if (s->ready == 0) {
712 			s->ready = 1;
713 			s->relay->nconn_ready += 1;
714 			mta_route_ok(s->relay, s->route);
715 		}
716 
717 		if (s->msgtried >= MAX_TRYBEFOREDISABLE) {
718 			log_info("smtp-out: Remote host seems to reject all mails on session %016"PRIx64,
719 			    s->id);
720 			mta_route_down(s->relay, s->route);
721 			mta_enter_state(s, MTA_QUIT);
722 			break;
723 		}
724 
725 		if (s->msgcount >= s->relay->limits->max_mail_per_session) {
726 			log_debug("debug: mta: "
727 			    "%p: cannot send more message to relay %s", s,
728 			    mta_relay_to_text(s->relay));
729 			mta_enter_state(s, MTA_QUIT);
730 			break;
731 		}
732 
733 		s->task = mta_route_next_task(s->relay, s->route);
734 		if (s->task == NULL) {
735 			log_debug("debug: mta: %p: no task for relay %s",
736 			    s, mta_relay_to_text(s->relay));
737 
738 			if (s->relay->nconn > 1 ||
739 			    s->hangon >= s->relay->limits->sessdelay_keepalive) {
740 				mta_enter_state(s, MTA_QUIT);
741 				break;
742 			}
743 
744 			log_debug("mta: debug: last connection: hanging on for %llds",
745 			    (long long)(s->relay->limits->sessdelay_keepalive -
746 			    s->hangon));
747 			s->flags |= MTA_HANGON;
748 			runq_schedule(hangon, time(NULL) + 1, NULL, s);
749 			break;
750 		}
751 
752 		log_debug("debug: mta: %p: handling next task for relay %s", s,
753 			    mta_relay_to_text(s->relay));
754 
755 		stat_increment("mta.task.running", 1);
756 
757 		m_create(p_queue, IMSG_QUEUE_MESSAGE_FD, 0, 0, -1);
758 		m_add_id(p_queue, s->id);
759 		m_add_msgid(p_queue, s->task->msgid);
760 		m_close(p_queue);
761 
762 		tree_xset(&wait_fd, s->id, s);
763 		s->flags |= MTA_WAIT;
764 		break;
765 
766 	case MTA_MAIL:
767 		s->currevp = TAILQ_FIRST(&s->task->envelopes);
768 
769 		e = s->currevp;
770 		s->hangon = 0;
771 		s->msgtried++;
772 		envid_sz = strlen(e->dsn_envid);
773 		if (s->ext & MTA_EXT_DSN) {
774 			mta_send(s, "MAIL FROM:<%s>%s%s%s%s",
775 			    s->task->sender,
776 			    e->dsn_ret ? " RET=" : "",
777 			    e->dsn_ret ? dsn_strret(e->dsn_ret) : "",
778 			    envid_sz ? " ENVID=" : "",
779 			    envid_sz ? e->dsn_envid : "");
780 		} else
781 			mta_send(s, "MAIL FROM:<%s>", s->task->sender);
782 		break;
783 
784 	case MTA_RCPT:
785 		if (s->currevp == NULL)
786 			s->currevp = TAILQ_FIRST(&s->task->envelopes);
787 
788 		e = s->currevp;
789 		if (s->ext & MTA_EXT_DSN) {
790 			mta_send(s, "RCPT TO:<%s>%s%s%s%s",
791 			    e->dest,
792 			    e->dsn_notify ? " NOTIFY=" : "",
793 			    e->dsn_notify ? dsn_strnotify(e->dsn_notify) : "",
794 			    e->dsn_orcpt ? " ORCPT=" : "",
795 			    e->dsn_orcpt ? e->dsn_orcpt : "");
796 		} else
797 			mta_send(s, "RCPT TO:<%s>", e->dest);
798 
799 		s->rcptcount++;
800 		break;
801 
802 	case MTA_DATA:
803 		fseek(s->datafp, 0, SEEK_SET);
804 		mta_send(s, "DATA");
805 		break;
806 
807 	case MTA_BODY:
808 		if (s->datafp == NULL) {
809 			log_trace(TRACE_MTA, "mta: %p: end-of-file", s);
810 			mta_enter_state(s, MTA_EOM);
811 			break;
812 		}
813 
814 		if ((q = mta_queue_data(s)) == -1) {
815 			s->flags |= MTA_FREE;
816 			break;
817 		}
818 		if (q == 0) {
819 			mta_enter_state(s, MTA_BODY);
820 			break;
821 		}
822 
823 		log_trace(TRACE_MTA, "mta: %p: >>> [...%zi bytes...]", s, q);
824 		break;
825 
826 	case MTA_EOM:
827 		mta_send(s, ".");
828 		break;
829 
830 	case MTA_LMTP_EOM:
831 		/* LMTP reports status of each delivery, so enable read */
832 		io_set_read(&s->io);
833 		break;
834 
835 	case MTA_RSET:
836 		if (s->datafp) {
837 			fclose(s->datafp);
838 			s->datafp = NULL;
839 		}
840 		mta_send(s, "RSET");
841 		break;
842 
843 	case MTA_QUIT:
844 		mta_send(s, "QUIT");
845 		break;
846 
847 	default:
848 		fatalx("mta_enter_state: unknown state");
849 	}
850 #undef mta_enter_state
851 }
852 
853 /*
854  * Handle a response to an SMTP command
855  */
856 static void
857 mta_response(struct mta_session *s, char *line)
858 {
859 	struct mta_envelope	*e;
860 	struct sockaddr_storage	 ss;
861 	struct sockaddr		*sa;
862 	const char		*domain;
863 	socklen_t		 sa_len;
864 	char			 buf[SMTPD_MAXLINESIZE];
865 	int			 delivery;
866 
867 	switch (s->state) {
868 
869 	case MTA_BANNER:
870 		if (s->flags & MTA_LMTP)
871 			mta_enter_state(s, MTA_LHLO);
872 		else
873 			mta_enter_state(s, MTA_EHLO);
874 		break;
875 
876 	case MTA_EHLO:
877 		if (line[0] != '2') {
878 			/* rejected at ehlo state */
879 			if ((s->flags & MTA_USE_AUTH) ||
880 			    (s->flags & MTA_WANT_SECURE)) {
881 				mta_error(s, "EHLO rejected: %s", line);
882 				s->flags |= MTA_FREE;
883 				return;
884 			}
885 			mta_enter_state(s, MTA_HELO);
886 			return;
887 		}
888 		if (!(s->flags & MTA_FORCE_PLAIN))
889 			mta_enter_state(s, MTA_STARTTLS);
890 		else
891 			mta_enter_state(s, MTA_READY);
892 		break;
893 
894 	case MTA_HELO:
895 		if (line[0] != '2') {
896 			mta_error(s, "HELO rejected: %s", line);
897 			s->flags |= MTA_FREE;
898 			return;
899 		}
900 		mta_enter_state(s, MTA_READY);
901 		break;
902 
903 	case MTA_LHLO:
904 		if (line[0] != '2') {
905 			mta_error(s, "LHLO rejected: %s", line);
906 			s->flags |= MTA_FREE;
907 			return;
908 		}
909 		mta_enter_state(s, MTA_READY);
910 		break;
911 
912 	case MTA_STARTTLS:
913 		if (line[0] != '2') {
914 			if (!(s->flags & MTA_WANT_SECURE)) {
915 				mta_enter_state(s, MTA_AUTH);
916 				return;
917 			}
918 			/* XXX mark that the MX doesn't support STARTTLS */
919 			mta_error(s, "STARTTLS rejected: %s", line);
920 			s->flags |= MTA_FREE;
921 			return;
922 		}
923 
924 		mta_start_tls(s);
925 		break;
926 
927 	case MTA_AUTH_PLAIN:
928 		if (line[0] != '2') {
929 			mta_error(s, "AUTH rejected: %s", line);
930 			s->flags |= MTA_FREE;
931 			return;
932 		}
933 		mta_enter_state(s, MTA_READY);
934 		break;
935 
936 	case MTA_AUTH_LOGIN:
937 		if (strncmp(line, "334 ", 4) != 0) {
938 			mta_error(s, "AUTH rejected: %s", line);
939 			s->flags |= MTA_FREE;
940 			return;
941 		}
942 		mta_enter_state(s, MTA_AUTH_LOGIN_USER);
943 		break;
944 
945 	case MTA_AUTH_LOGIN_USER:
946 		if (strncmp(line, "334 ", 4) != 0) {
947 			mta_error(s, "AUTH rejected: %s", line);
948 			s->flags |= MTA_FREE;
949 			return;
950 		}
951 		mta_enter_state(s, MTA_AUTH_LOGIN_PASS);
952 		break;
953 
954 	case MTA_AUTH_LOGIN_PASS:
955 		if (line[0] != '2') {
956 			mta_error(s, "AUTH rejected: %s", line);
957 			s->flags |= MTA_FREE;
958 			return;
959 		}
960 		mta_enter_state(s, MTA_READY);
961 		break;
962 
963 	case MTA_MAIL:
964 		if (line[0] != '2') {
965 			if (line[0] == '5')
966 				delivery = IMSG_DELIVERY_PERMFAIL;
967 			else
968 				delivery = IMSG_DELIVERY_TEMPFAIL;
969 			mta_flush_task(s, delivery, line, 0, 0);
970 			mta_enter_state(s, MTA_RSET);
971 			return;
972 		}
973 		mta_enter_state(s, MTA_RCPT);
974 		break;
975 
976 	case MTA_RCPT:
977 		e = s->currevp;
978 
979 		/* remove envelope from hosttat cache if there */
980 		if ((domain = strchr(e->dest, '@')) != NULL) {
981 			domain++;
982 			mta_hoststat_uncache(domain, e->id);
983 		}
984 
985 		s->currevp = TAILQ_NEXT(s->currevp, entry);
986 		if (line[0] == '2') {
987 			s->failures = 0;
988 			/*
989 			 * this host is up, reschedule envelopes that
990 			 * were cached for reschedule.
991 			 */
992 			if (domain)
993 				mta_hoststat_reschedule(domain);
994 		}
995 		else {
996 			if (line[0] == '5')
997 				delivery = IMSG_DELIVERY_PERMFAIL;
998 			else
999 				delivery = IMSG_DELIVERY_TEMPFAIL;
1000 			s->failures++;
1001 
1002 			/* remove failed envelope from task list */
1003 			TAILQ_REMOVE(&s->task->envelopes, e, entry);
1004 			stat_decrement("mta.envelope", 1);
1005 
1006 			/* log right away */
1007 			snprintf(buf, sizeof(buf), "%s",
1008 			    mta_host_to_text(s->route->dst));
1009 
1010 			e->session = s->id;
1011 			/* XXX */
1012 			/*
1013 			 * getsockname() can only fail with ENOBUFS here
1014 			 * best effort, don't log source ...
1015 			 */
1016 			sa_len = sizeof(ss);
1017 			sa = (struct sockaddr *)&ss;
1018 			if (getsockname(s->io.sock, sa, &sa_len) < 0)
1019 				mta_delivery_log(e, NULL, buf, delivery, line);
1020 			else
1021 				mta_delivery_log(e, sa_to_text(sa),
1022 				    buf, delivery, line);
1023 
1024 			if (domain)
1025 				mta_hoststat_update(domain, e->status);
1026 			mta_delivery_notify(e);
1027 
1028 			if (s->relay->limits->max_failures_per_session &&
1029 			    s->failures == s->relay->limits->max_failures_per_session) {
1030 					mta_flush_task(s, IMSG_DELIVERY_TEMPFAIL,
1031 					    "Too many consecutive errors, closing connection", 0, 1);
1032 					mta_enter_state(s, MTA_QUIT);
1033 					break;
1034 				}
1035 
1036 			/*
1037 			 * if no more envelopes, flush failed queue
1038 			 */
1039 			if (TAILQ_EMPTY(&s->task->envelopes)) {
1040 				mta_flush_task(s, IMSG_DELIVERY_OK,
1041 				    "No envelope", 0, 0);
1042 				mta_enter_state(s, MTA_RSET);
1043 				break;
1044 			}
1045 		}
1046 
1047 		if (s->currevp == NULL)
1048 			mta_enter_state(s, MTA_DATA);
1049 		else
1050 			mta_enter_state(s, MTA_RCPT);
1051 		break;
1052 
1053 	case MTA_DATA:
1054 		if (line[0] == '2' || line[0] == '3') {
1055 			mta_enter_state(s, MTA_BODY);
1056 			break;
1057 		}
1058 		if (line[0] == '5')
1059 			delivery = IMSG_DELIVERY_PERMFAIL;
1060 		else
1061 			delivery = IMSG_DELIVERY_TEMPFAIL;
1062 		mta_flush_task(s, delivery, line, 0, 0);
1063 		mta_enter_state(s, MTA_RSET);
1064 		break;
1065 
1066 	case MTA_LMTP_EOM:
1067 	case MTA_EOM:
1068 		if (line[0] == '2') {
1069 			delivery = IMSG_DELIVERY_OK;
1070 			s->msgtried = 0;
1071 			s->msgcount++;
1072 		}
1073 		else if (line[0] == '5')
1074 			delivery = IMSG_DELIVERY_PERMFAIL;
1075 		else
1076 			delivery = IMSG_DELIVERY_TEMPFAIL;
1077 		mta_flush_task(s, delivery, line, (s->flags & MTA_LMTP) ? 1 : 0, 0);
1078 		if (s->task) {
1079 			s->rcptcount--;
1080 			mta_enter_state(s, MTA_LMTP_EOM);
1081 		} else {
1082 			s->rcptcount = 0;
1083 			if (s->relay->limits->sessdelay_transaction) {
1084 				log_debug("debug: mta: waiting for %llds before next transaction",
1085 				    (long long int)s->relay->limits->sessdelay_transaction);
1086 				s->hangon = s->relay->limits->sessdelay_transaction -1;
1087 				s->flags |= MTA_HANGON;
1088 				runq_schedule(hangon, time(NULL)
1089 				    + s->relay->limits->sessdelay_transaction,
1090 				    NULL, s);
1091 			}
1092 			else
1093 				mta_enter_state(s, MTA_READY);
1094 		}
1095 		break;
1096 
1097 	case MTA_RSET:
1098 		s->rcptcount = 0;
1099 		if (s->relay->limits->sessdelay_transaction) {
1100 			log_debug("debug: mta: waiting for %llds after reset",
1101 			    (long long int)s->relay->limits->sessdelay_transaction);
1102 			s->hangon = s->relay->limits->sessdelay_transaction -1;
1103 			s->flags |= MTA_HANGON;
1104 			runq_schedule(hangon, time(NULL)
1105 			    + s->relay->limits->sessdelay_transaction,
1106 			    NULL, s);
1107 		}
1108 		else
1109 			mta_enter_state(s, MTA_READY);
1110 		break;
1111 
1112 	default:
1113 		fatalx("mta_response() bad state");
1114 	}
1115 }
1116 
1117 static void
1118 mta_io(struct io *io, int evt)
1119 {
1120 	struct mta_session	*s = io->arg;
1121 	char			*line, *msg, *p;
1122 	size_t			 len;
1123 	const char		*error;
1124 	int			 cont;
1125 	X509			*x;
1126 
1127 	log_trace(TRACE_IO, "mta: %p: %s %s", s, io_strevent(evt),
1128 	    io_strio(io));
1129 
1130 	switch (evt) {
1131 
1132 	case IO_CONNECTED:
1133 		log_info("smtp-out: Connected on session %016"PRIx64, s->id);
1134 
1135 		if (s->use_smtps) {
1136 			io_set_write(io);
1137 			mta_start_tls(s);
1138 		}
1139 		else {
1140 			mta_enter_state(s, MTA_BANNER);
1141 			io_set_read(io);
1142 		}
1143 		break;
1144 
1145 	case IO_TLSREADY:
1146 		log_info("smtp-out: Started TLS on session %016"PRIx64": %s",
1147 		    s->id, ssl_to_text(s->io.ssl));
1148 		s->flags |= MTA_TLS;
1149 
1150 		if (mta_verify_certificate(s)) {
1151 			io_pause(&s->io, IO_PAUSE_IN);
1152 			break;
1153 		}
1154 
1155 	case IO_TLSVERIFIED:
1156 		x = SSL_get_peer_certificate(s->io.ssl);
1157 		if (x) {
1158 			log_info("smtp-out: Server certificate verification %s "
1159 			    "on session %016"PRIx64,
1160 			    (s->flags & MTA_VERIFIED) ? "succeeded" : "failed",
1161 			    s->id);
1162 			X509_free(x);
1163 		}
1164 
1165 		if (s->use_smtps) {
1166 			mta_enter_state(s, MTA_BANNER);
1167 			io_set_read(io);
1168 		}
1169 		else
1170 			mta_enter_state(s, MTA_EHLO);
1171 		break;
1172 
1173 	case IO_DATAIN:
1174 	    nextline:
1175 		line = iobuf_getline(&s->iobuf, &len);
1176 		if (line == NULL) {
1177 			if (iobuf_len(&s->iobuf) >= SMTPD_MAXLINESIZE) {
1178 				mta_error(s, "Input too long");
1179 				mta_free(s);
1180 				return;
1181 			}
1182 			iobuf_normalize(&s->iobuf);
1183 			break;
1184 		}
1185 
1186 		log_trace(TRACE_MTA, "mta: %p: <<< %s", s, line);
1187 
1188 		if ((error = parse_smtp_response(line, len, &msg, &cont))) {
1189 			mta_error(s, "Bad response: %s", error);
1190 			mta_free(s);
1191 			return;
1192 		}
1193 
1194 		/* read extensions */
1195 		if (s->state == MTA_EHLO) {
1196 			if (strcmp(msg, "STARTTLS") == 0)
1197 				s->ext |= MTA_EXT_STARTTLS;
1198 			else if (strncmp(msg, "AUTH ", 5) == 0) {
1199                                 s->ext |= MTA_EXT_AUTH;
1200                                 if ((p = strstr(msg, " PLAIN")) &&
1201 				    (*(p+6) == '\0' || *(p+6) == ' '))
1202                                         s->ext |= MTA_EXT_AUTH_PLAIN;
1203                                 if ((p = strstr(msg, " LOGIN")) &&
1204 				    (*(p+6) == '\0' || *(p+6) == ' '))
1205                                         s->ext |= MTA_EXT_AUTH_LOGIN;
1206 			}
1207 			else if (strcmp(msg, "PIPELINING") == 0)
1208 				s->ext |= MTA_EXT_PIPELINING;
1209 			else if (strcmp(msg, "DSN") == 0)
1210 				s->ext |= MTA_EXT_DSN;
1211 		}
1212 
1213 		if (cont)
1214 			goto nextline;
1215 
1216 		if (s->state == MTA_QUIT) {
1217 			log_info("smtp-out: Closing session %016"PRIx64
1218 			    ": %zu message%s sent.", s->id, s->msgcount,
1219 			    (s->msgcount > 1) ? "s" : "");
1220 			mta_free(s);
1221 			return;
1222 		}
1223 		io_set_write(io);
1224 		mta_response(s, line);
1225 		if (s->flags & MTA_FREE) {
1226 			mta_free(s);
1227 			return;
1228 		}
1229 
1230 		iobuf_normalize(&s->iobuf);
1231 
1232 		if (iobuf_len(&s->iobuf)) {
1233 			log_debug("debug: mta: remaining data in input buffer");
1234 			mta_error(s, "Remote host sent too much data");
1235 			if (s->flags & MTA_WAIT)
1236 				s->flags |= MTA_FREE;
1237 			else
1238 				mta_free(s);
1239 		}
1240 		break;
1241 
1242 	case IO_LOWAT:
1243 		if (s->state == MTA_BODY) {
1244 			mta_enter_state(s, MTA_BODY);
1245 			if (s->flags & MTA_FREE) {
1246 				mta_free(s);
1247 				return;
1248 			}
1249 		}
1250 
1251 		if (iobuf_queued(&s->iobuf) == 0)
1252 			io_set_read(io);
1253 		break;
1254 
1255 	case IO_TIMEOUT:
1256 		log_debug("debug: mta: %p: connection timeout", s);
1257 		mta_error(s, "Connection timeout");
1258 		if (!s->ready)
1259 			mta_connect(s);
1260 		else
1261 			mta_free(s);
1262 		break;
1263 
1264 	case IO_ERROR:
1265 		log_debug("debug: mta: %p: IO error: %s", s, io->error);
1266 		mta_error(s, "IO Error: %s", io->error);
1267 		if (!s->ready)
1268 			mta_connect(s);
1269 		else
1270 			mta_free(s);
1271 		break;
1272 
1273 	case IO_DISCONNECTED:
1274 		log_debug("debug: mta: %p: disconnected in state %s",
1275 		    s, mta_strstate(s->state));
1276 		mta_error(s, "Connection closed unexpectedly");
1277 		if (!s->ready)
1278 			mta_connect(s);
1279 		else
1280 			mta_free(s);
1281 		break;
1282 
1283 	default:
1284 		fatalx("mta_io() bad event");
1285 	}
1286 }
1287 
1288 static void
1289 mta_send(struct mta_session *s, char *fmt, ...)
1290 {
1291 	va_list  ap;
1292 	char	*p;
1293 	int	 len;
1294 
1295 	va_start(ap, fmt);
1296 	if ((len = vasprintf(&p, fmt, ap)) == -1)
1297 		fatal("mta: vasprintf");
1298 	va_end(ap);
1299 
1300 	log_trace(TRACE_MTA, "mta: %p: >>> %s", s, p);
1301 
1302 	iobuf_xfqueue(&s->iobuf, "mta_send", "%s\r\n", p);
1303 
1304 	free(p);
1305 }
1306 
1307 /*
1308  * Queue some data into the input buffer
1309  */
1310 static ssize_t
1311 mta_queue_data(struct mta_session *s)
1312 {
1313 	char	*ln;
1314 	size_t	 len, q;
1315 
1316 	q = iobuf_queued(&s->iobuf);
1317 
1318 	while (iobuf_queued(&s->iobuf) < MTA_HIWAT) {
1319 		if ((ln = fgetln(s->datafp, &len)) == NULL)
1320 			break;
1321 		if (ln[len - 1] == '\n')
1322 			ln[len - 1] = '\0';
1323 		iobuf_xfqueue(&s->iobuf, "mta_queue_data", "%s%s\r\n",
1324 		    *ln == '.' ? "." : "", ln);
1325 	}
1326 
1327 	if (ferror(s->datafp)) {
1328 		mta_flush_task(s, IMSG_DELIVERY_TEMPFAIL,
1329 		    "Error reading content file", 0, 0);
1330 		return (-1);
1331 	}
1332 
1333 	if (feof(s->datafp)) {
1334 		fclose(s->datafp);
1335 		s->datafp = NULL;
1336 	}
1337 
1338 	return (iobuf_queued(&s->iobuf) - q);
1339 }
1340 
1341 static void
1342 mta_flush_task(struct mta_session *s, int delivery, const char *error, size_t count,
1343 	int cache)
1344 {
1345 	struct mta_envelope	*e;
1346 	char			 relay[SMTPD_MAXLINESIZE];
1347 	size_t			 n;
1348 	struct sockaddr_storage	 ss;
1349 	struct sockaddr		*sa;
1350 	socklen_t		 sa_len;
1351 	const char		*domain;
1352 
1353 	snprintf(relay, sizeof relay, "%s", mta_host_to_text(s->route->dst));
1354 	n = 0;
1355 	while ((e = TAILQ_FIRST(&s->task->envelopes))) {
1356 
1357 		if (count && n == count) {
1358 			stat_decrement("mta.envelope", n);
1359 			return;
1360 		}
1361 
1362 		TAILQ_REMOVE(&s->task->envelopes, e, entry);
1363 
1364 		/* we're about to log, associate session to envelope */
1365 		e->session = s->id;
1366 		e->ext = s->ext;
1367 
1368 		/* XXX */
1369 		/*
1370 		 * getsockname() can only fail with ENOBUFS here
1371 		 * best effort, don't log source ...
1372 		 */
1373 		sa = (struct sockaddr *)&ss;
1374 		sa_len = sizeof(ss);
1375 		if (getsockname(s->io.sock, sa, &sa_len) < 0)
1376 			mta_delivery_log(e, NULL, relay, delivery, error);
1377 		else
1378 			mta_delivery_log(e, sa_to_text(sa),
1379 			    relay, delivery, error);
1380 
1381 		mta_delivery_notify(e);
1382 
1383 		domain = strchr(e->dest, '@');
1384 		if (domain) {
1385 			domain++;
1386 			mta_hoststat_update(domain, error);
1387 			if (cache)
1388 				mta_hoststat_cache(domain, e->id);
1389 		}
1390 
1391 		n++;
1392 	}
1393 
1394 	free(s->task->sender);
1395 	free(s->task);
1396 	s->task = NULL;
1397 
1398 	if (s->datafp) {
1399 		fclose(s->datafp);
1400 		s->datafp = NULL;
1401 	}
1402 
1403 	stat_decrement("mta.envelope", n);
1404 	stat_decrement("mta.task.running", 1);
1405 	stat_decrement("mta.task", 1);
1406 }
1407 
1408 static void
1409 mta_error(struct mta_session *s, const char *fmt, ...)
1410 {
1411 	va_list  ap;
1412 	char	*error;
1413 	int	 len;
1414 
1415 	va_start(ap, fmt);
1416 	if ((len = vasprintf(&error, fmt, ap)) == -1)
1417 		fatal("mta: vasprintf");
1418 	va_end(ap);
1419 
1420 	if (s->msgcount)
1421 		log_info("smtp-out: Error on session %016"PRIx64
1422 		    " after %zu message%s sent: %s", s->id, s->msgcount,
1423 		    (s->msgcount > 1) ? "s" : "", error);
1424 	else
1425 		log_info("smtp-out: Error on session %016"PRIx64 ": %s",
1426 		    s->id, error);
1427 	/*
1428 	 * If not connected yet, and the error is not local, just ignore it
1429 	 * and try to reconnect.
1430 	 */
1431 	if (s->state == MTA_INIT &&
1432 	    (errno == ETIMEDOUT || errno == ECONNREFUSED)) {
1433 		log_debug("debug: mta: not reporting route error yet");
1434 		free(error);
1435 		return;
1436 	}
1437 
1438 	mta_route_error(s->relay, s->route);
1439 
1440 	if (s->task)
1441 		mta_flush_task(s, IMSG_DELIVERY_TEMPFAIL, error, 0, 0);
1442 
1443 	free(error);
1444 }
1445 
1446 static int
1447 mta_check_loop(FILE *fp)
1448 {
1449 	char	*buf, *lbuf;
1450 	size_t	 len;
1451 	uint32_t rcvcount = 0;
1452 	int	 ret = 0;
1453 
1454 	lbuf = NULL;
1455 	while ((buf = fgetln(fp, &len))) {
1456 		if (buf[len - 1] == '\n')
1457 			buf[len - 1] = '\0';
1458 		else {
1459 			/* EOF without EOL, copy and add the NUL */
1460 			lbuf = xmalloc(len + 1, "mta_check_loop");
1461 			memcpy(lbuf, buf, len);
1462 			lbuf[len] = '\0';
1463 			buf = lbuf;
1464 		}
1465 
1466 		if (strchr(buf, ':') == NULL && !isspace((unsigned char)*buf))
1467 			break;
1468 
1469 		if (strncasecmp("Received: ", buf, 10) == 0) {
1470 			rcvcount++;
1471 			if (rcvcount == MAX_HOPS_COUNT) {
1472 				ret = 1;
1473 				break;
1474 			}
1475 		}
1476 		if (lbuf) {
1477 			free(lbuf);
1478 			lbuf  = NULL;
1479 		}
1480 	}
1481 	if (lbuf)
1482 		free(lbuf);
1483 
1484 	fseek(fp, SEEK_SET, 0);
1485 	return ret;
1486 }
1487 
1488 static void
1489 mta_start_tls(struct mta_session *s)
1490 {
1491 	struct ca_cert_req_msg	req_ca_cert;
1492 	const char	       *certname;
1493 
1494 	if (s->relay->pki_name)
1495 		certname = s->relay->pki_name;
1496 	else
1497 		certname = s->helo;
1498 
1499 	req_ca_cert.reqid = s->id;
1500 	strlcpy(req_ca_cert.name, certname, sizeof req_ca_cert.name);
1501 	m_compose(p_lka, IMSG_LKA_SSL_INIT, 0, 0, -1,
1502 	    &req_ca_cert, sizeof(req_ca_cert));
1503 	tree_xset(&wait_ssl_init, s->id, s);
1504 	s->flags |= MTA_WAIT;
1505 	return;
1506 }
1507 
1508 static int
1509 mta_verify_certificate(struct mta_session *s)
1510 {
1511 	struct ca_vrfy_req_msg	req_ca_vrfy;
1512 	struct iovec		iov[2];
1513 	X509		       *x;
1514 	STACK_OF(X509)	       *xchain;
1515 	int			i;
1516 	const char	       *pkiname;
1517 
1518 	x = SSL_get_peer_certificate(s->io.ssl);
1519 	if (x == NULL)
1520 		return 0;
1521 	xchain = SSL_get_peer_cert_chain(s->io.ssl);
1522 
1523 	/*
1524 	 * Client provided a certificate and possibly a certificate chain.
1525 	 * SMTP can't verify because it does not have the information that
1526 	 * it needs, instead it will pass the certificate and chain to the
1527 	 * lookup process and wait for a reply.
1528 	 *
1529 	 */
1530 
1531 	tree_xset(&wait_ssl_verify, s->id, s);
1532 	s->flags |= MTA_WAIT;
1533 
1534 	/* Send the client certificate */
1535 	memset(&req_ca_vrfy, 0, sizeof req_ca_vrfy);
1536 	if (s->relay->pki_name)
1537 		pkiname = s->relay->pki_name;
1538 	else
1539 		pkiname = s->helo;
1540 	if (strlcpy(req_ca_vrfy.pkiname, pkiname, sizeof req_ca_vrfy.pkiname)
1541 	    >= sizeof req_ca_vrfy.pkiname)
1542 		return 0;
1543 
1544 	req_ca_vrfy.reqid = s->id;
1545 	req_ca_vrfy.cert_len = i2d_X509(x, &req_ca_vrfy.cert);
1546 	if (xchain)
1547 		req_ca_vrfy.n_chain = sk_X509_num(xchain);
1548 	iov[0].iov_base = &req_ca_vrfy;
1549 	iov[0].iov_len = sizeof(req_ca_vrfy);
1550 	iov[1].iov_base = req_ca_vrfy.cert;
1551 	iov[1].iov_len = req_ca_vrfy.cert_len;
1552 	m_composev(p_lka, IMSG_LKA_SSL_VERIFY_CERT, 0, 0, -1,
1553 	    iov, nitems(iov));
1554 	free(req_ca_vrfy.cert);
1555 	X509_free(x);
1556 
1557 	if (xchain) {
1558 		/* Send the chain, one cert at a time */
1559 		for (i = 0; i < sk_X509_num(xchain); ++i) {
1560 			memset(&req_ca_vrfy, 0, sizeof req_ca_vrfy);
1561 			req_ca_vrfy.reqid = s->id;
1562 			x = sk_X509_value(xchain, i);
1563 			req_ca_vrfy.cert_len = i2d_X509(x, &req_ca_vrfy.cert);
1564 			iov[0].iov_base = &req_ca_vrfy;
1565 			iov[0].iov_len  = sizeof(req_ca_vrfy);
1566 			iov[1].iov_base = req_ca_vrfy.cert;
1567 			iov[1].iov_len  = req_ca_vrfy.cert_len;
1568 			m_composev(p_lka, IMSG_LKA_SSL_VERIFY_CHAIN, 0, 0, -1,
1569 			    iov, nitems(iov));
1570 			free(req_ca_vrfy.cert);
1571 		}
1572 	}
1573 
1574 	/* Tell lookup process that it can start verifying, we're done */
1575 	memset(&req_ca_vrfy, 0, sizeof req_ca_vrfy);
1576 	req_ca_vrfy.reqid = s->id;
1577 	m_compose(p_lka, IMSG_LKA_SSL_VERIFY, 0, 0, -1,
1578 	    &req_ca_vrfy, sizeof req_ca_vrfy);
1579 
1580 	return 1;
1581 }
1582 
1583 static const char *
1584 dsn_strret(enum dsn_ret ret)
1585 {
1586 	if (ret == DSN_RETHDRS)
1587 		return "HDRS";
1588 	else if (ret == DSN_RETFULL)
1589 		return "FULL";
1590 	else {
1591 		log_debug("mta: invalid ret %d", ret);
1592 		return "???";
1593 	}
1594 }
1595 
1596 static const char *
1597 dsn_strnotify(uint8_t arg)
1598 {
1599 	static char	buf[32];
1600 	size_t		sz;
1601 
1602 	if (arg & DSN_SUCCESS)
1603 		strlcat(buf, "SUCCESS,", sizeof(buf));
1604 
1605 	if (arg & DSN_FAILURE)
1606 		strlcat(buf, "FAILURE,", sizeof(buf));
1607 
1608 	if (arg & DSN_DELAY)
1609 		strlcat(buf, "DELAY,", sizeof(buf));
1610 
1611 	if (arg & DSN_NEVER)
1612 		strlcat(buf, "NEVER,", sizeof(buf));
1613 
1614 	/* trim trailing comma */
1615 	sz = strlen(buf);
1616 	if (sz)
1617 		buf[sz - 1] = '\0';
1618 
1619 	return (buf);
1620 }
1621 
1622 #define CASE(x) case x : return #x
1623 
1624 static const char *
1625 mta_strstate(int state)
1626 {
1627 	switch (state) {
1628 	CASE(MTA_INIT);
1629 	CASE(MTA_BANNER);
1630 	CASE(MTA_EHLO);
1631 	CASE(MTA_HELO);
1632 	CASE(MTA_STARTTLS);
1633 	CASE(MTA_AUTH);
1634 	CASE(MTA_AUTH_PLAIN);
1635 	CASE(MTA_AUTH_LOGIN);
1636 	CASE(MTA_AUTH_LOGIN_USER);
1637 	CASE(MTA_AUTH_LOGIN_PASS);
1638 	CASE(MTA_READY);
1639 	CASE(MTA_MAIL);
1640 	CASE(MTA_RCPT);
1641 	CASE(MTA_DATA);
1642 	CASE(MTA_BODY);
1643 	CASE(MTA_EOM);
1644 	CASE(MTA_LMTP_EOM);
1645 	CASE(MTA_RSET);
1646 	CASE(MTA_QUIT);
1647 	default:
1648 		return "MTA_???";
1649 	}
1650 }
1651