srvrsmtp.c revision 147078
1/* 2 * Copyright (c) 1998-2005 Sendmail, Inc. and its suppliers. 3 * All rights reserved. 4 * Copyright (c) 1983, 1995-1997 Eric P. Allman. All rights reserved. 5 * Copyright (c) 1988, 1993 6 * The Regents of the University of California. All rights reserved. 7 * 8 * By using this file, you agree to the terms and conditions set 9 * forth in the LICENSE file which can be found at the top level of 10 * the sendmail distribution. 11 * 12 */ 13 14#include <sendmail.h> 15#if MILTER 16# include <libmilter/mfapi.h> 17# include <libmilter/mfdef.h> 18#endif /* MILTER */ 19 20SM_RCSID("@(#)$Id: srvrsmtp.c,v 8.906 2005/03/16 00:36:09 ca Exp $") 21 22#include <sys/time.h> 23#include <sm/fdset.h> 24 25#if SASL || STARTTLS 26# include "sfsasl.h" 27#endif /* SASL || STARTTLS */ 28#if SASL 29# define ENC64LEN(l) (((l) + 2) * 4 / 3 + 1) 30static int saslmechs __P((sasl_conn_t *, char **)); 31#endif /* SASL */ 32#if STARTTLS 33# include <sysexits.h> 34 35static SSL_CTX *srv_ctx = NULL; /* TLS server context */ 36static SSL *srv_ssl = NULL; /* per connection context */ 37 38static bool tls_ok_srv = false; 39 40extern void tls_set_verify __P((SSL_CTX *, SSL *, bool)); 41# define TLS_VERIFY_CLIENT() tls_set_verify(srv_ctx, srv_ssl, \ 42 bitset(SRV_VRFY_CLT, features)) 43#endif /* STARTTLS */ 44 45/* server features */ 46#define SRV_NONE 0x0000 /* none... */ 47#define SRV_OFFER_TLS 0x0001 /* offer STARTTLS */ 48#define SRV_VRFY_CLT 0x0002 /* request a cert */ 49#define SRV_OFFER_AUTH 0x0004 /* offer AUTH */ 50#define SRV_OFFER_ETRN 0x0008 /* offer ETRN */ 51#define SRV_OFFER_VRFY 0x0010 /* offer VRFY (not yet used) */ 52#define SRV_OFFER_EXPN 0x0020 /* offer EXPN */ 53#define SRV_OFFER_VERB 0x0040 /* offer VERB */ 54#define SRV_OFFER_DSN 0x0080 /* offer DSN */ 55#if PIPELINING 56# define SRV_OFFER_PIPE 0x0100 /* offer PIPELINING */ 57# if _FFR_NO_PIPE 58# define SRV_NO_PIPE 0x0200 /* disable PIPELINING, sleep if used */ 59# endif /* _FFR_NO_PIPE */ 60#endif /* PIPELINING */ 61#define SRV_REQ_AUTH 0x0400 /* require AUTH */ 62#define SRV_REQ_SEC 0x0800 /* require security - equiv to AuthOptions=p */ 63#define SRV_TMP_FAIL 0x1000 /* ruleset caused a temporary failure */ 64 65static unsigned int srvfeatures __P((ENVELOPE *, char *, unsigned int)); 66 67#define STOP_ATTACK ((time_t) -1) 68static time_t checksmtpattack __P((volatile unsigned int *, unsigned int, 69 bool, char *, ENVELOPE *)); 70static void mail_esmtp_args __P((char *, char *, ENVELOPE *)); 71static void printvrfyaddr __P((ADDRESS *, bool, bool)); 72static void rcpt_esmtp_args __P((ADDRESS *, char *, char *, ENVELOPE *)); 73static char *skipword __P((char *volatile, char *)); 74static void setup_smtpd_io __P((void)); 75 76#if SASL 77# if SASL >= 20000 78static int reset_saslconn __P((sasl_conn_t **_conn, char *_hostname, 79 char *_remoteip, char *_localip, 80 char *_auth_id, sasl_ssf_t *_ext_ssf)); 81 82# define RESET_SASLCONN \ 83 do \ 84 { \ 85 result = reset_saslconn(&conn, AuthRealm, remoteip, \ 86 localip, auth_id, &ext_ssf); \ 87 if (result != SASL_OK) \ 88 sasl_ok = false; \ 89 } while (0) 90 91# else /* SASL >= 20000 */ 92static int reset_saslconn __P((sasl_conn_t **_conn, char *_hostname, 93 struct sockaddr_in *_saddr_r, 94 struct sockaddr_in *_saddr_l, 95 sasl_external_properties_t *_ext_ssf)); 96# define RESET_SASLCONN \ 97 do \ 98 { \ 99 result = reset_saslconn(&conn, AuthRealm, &saddr_r, \ 100 &saddr_l, &ext_ssf); \ 101 if (result != SASL_OK) \ 102 sasl_ok = false; \ 103 } while (0) 104 105# endif /* SASL >= 20000 */ 106#endif /* SASL */ 107 108extern ENVELOPE BlankEnvelope; 109 110#define NBADRCPTS \ 111 do \ 112 { \ 113 char buf[16]; \ 114 (void) sm_snprintf(buf, sizeof buf, "%d", \ 115 BadRcptThrottle > 0 && n_badrcpts > BadRcptThrottle \ 116 ? n_badrcpts - 1 : n_badrcpts); \ 117 macdefine(&e->e_macro, A_TEMP, macid("{nbadrcpts}"), buf); \ 118 } while (0) 119 120#define SKIP_SPACE(s) while (isascii(*s) && isspace(*s)) \ 121 (s)++ 122 123/* 124** SMTP -- run the SMTP protocol. 125** 126** Parameters: 127** nullserver -- if non-NULL, rejection message for 128** (almost) all SMTP commands. 129** d_flags -- daemon flags 130** e -- the envelope. 131** 132** Returns: 133** never. 134** 135** Side Effects: 136** Reads commands from the input channel and processes them. 137*/ 138 139/* 140** Notice: The smtp server doesn't have a session context like the client 141** side has (mci). Therefore some data (session oriented) is allocated 142** or assigned to the "wrong" structure (esp. STARTTLS, AUTH). 143** This should be fixed in a successor version. 144*/ 145 146struct cmd 147{ 148 char *cmd_name; /* command name */ 149 int cmd_code; /* internal code, see below */ 150}; 151 152/* values for cmd_code */ 153#define CMDERROR 0 /* bad command */ 154#define CMDMAIL 1 /* mail -- designate sender */ 155#define CMDRCPT 2 /* rcpt -- designate recipient */ 156#define CMDDATA 3 /* data -- send message text */ 157#define CMDRSET 4 /* rset -- reset state */ 158#define CMDVRFY 5 /* vrfy -- verify address */ 159#define CMDEXPN 6 /* expn -- expand address */ 160#define CMDNOOP 7 /* noop -- do nothing */ 161#define CMDQUIT 8 /* quit -- close connection and die */ 162#define CMDHELO 9 /* helo -- be polite */ 163#define CMDHELP 10 /* help -- give usage info */ 164#define CMDEHLO 11 /* ehlo -- extended helo (RFC 1425) */ 165#define CMDETRN 12 /* etrn -- flush queue */ 166#if SASL 167# define CMDAUTH 13 /* auth -- SASL authenticate */ 168#endif /* SASL */ 169#if STARTTLS 170# define CMDSTLS 14 /* STARTTLS -- start TLS session */ 171#endif /* STARTTLS */ 172/* non-standard commands */ 173#define CMDVERB 17 /* verb -- go into verbose mode */ 174/* unimplemented commands from RFC 821 */ 175#define CMDUNIMPL 19 /* unimplemented rfc821 commands */ 176/* use this to catch and log "door handle" attempts on your system */ 177#define CMDLOGBOGUS 23 /* bogus command that should be logged */ 178/* debugging-only commands, only enabled if SMTPDEBUG is defined */ 179#define CMDDBGQSHOW 24 /* showq -- show send queue */ 180#define CMDDBGDEBUG 25 /* debug -- set debug mode */ 181 182/* 183** Note: If you change this list, remember to update 'helpfile' 184*/ 185 186static struct cmd CmdTab[] = 187{ 188 { "mail", CMDMAIL }, 189 { "rcpt", CMDRCPT }, 190 { "data", CMDDATA }, 191 { "rset", CMDRSET }, 192 { "vrfy", CMDVRFY }, 193 { "expn", CMDEXPN }, 194 { "help", CMDHELP }, 195 { "noop", CMDNOOP }, 196 { "quit", CMDQUIT }, 197 { "helo", CMDHELO }, 198 { "ehlo", CMDEHLO }, 199 { "etrn", CMDETRN }, 200 { "verb", CMDVERB }, 201 { "send", CMDUNIMPL }, 202 { "saml", CMDUNIMPL }, 203 { "soml", CMDUNIMPL }, 204 { "turn", CMDUNIMPL }, 205#if SASL 206 { "auth", CMDAUTH, }, 207#endif /* SASL */ 208#if STARTTLS 209 { "starttls", CMDSTLS, }, 210#endif /* STARTTLS */ 211 /* remaining commands are here only to trap and log attempts to use them */ 212 { "showq", CMDDBGQSHOW }, 213 { "debug", CMDDBGDEBUG }, 214 { "wiz", CMDLOGBOGUS }, 215 216 { NULL, CMDERROR } 217}; 218 219static char *CurSmtpClient; /* who's at the other end of channel */ 220 221#ifndef MAXBADCOMMANDS 222# define MAXBADCOMMANDS 25 /* maximum number of bad commands */ 223#endif /* ! MAXBADCOMMANDS */ 224#ifndef MAXNOOPCOMMANDS 225# define MAXNOOPCOMMANDS 20 /* max "noise" commands before slowdown */ 226#endif /* ! MAXNOOPCOMMANDS */ 227#ifndef MAXHELOCOMMANDS 228# define MAXHELOCOMMANDS 3 /* max HELO/EHLO commands before slowdown */ 229#endif /* ! MAXHELOCOMMANDS */ 230#ifndef MAXVRFYCOMMANDS 231# define MAXVRFYCOMMANDS 6 /* max VRFY/EXPN commands before slowdown */ 232#endif /* ! MAXVRFYCOMMANDS */ 233#ifndef MAXETRNCOMMANDS 234# define MAXETRNCOMMANDS 8 /* max ETRN commands before slowdown */ 235#endif /* ! MAXETRNCOMMANDS */ 236#ifndef MAXTIMEOUT 237# define MAXTIMEOUT (4 * 60) /* max timeout for bad commands */ 238#endif /* ! MAXTIMEOUT */ 239 240/* 241** Maximum shift value to compute timeout for bad commands. 242** This introduces an upper limit of 2^MAXSHIFT for the timeout. 243*/ 244 245#ifndef MAXSHIFT 246# define MAXSHIFT 8 247#endif /* ! MAXSHIFT */ 248#if MAXSHIFT > 31 249 ERROR _MAXSHIFT > 31 is invalid 250#endif /* MAXSHIFT */ 251 252 253#if MAXBADCOMMANDS > 0 254# define STOP_IF_ATTACK(r) do \ 255 { \ 256 if ((r) == STOP_ATTACK) \ 257 goto stopattack; \ 258 } while (0) 259 260#else /* MAXBADCOMMANDS > 0 */ 261# define STOP_IF_ATTACK(r) r 262#endif /* MAXBADCOMMANDS > 0 */ 263 264 265#if SM_HEAP_CHECK 266static SM_DEBUG_T DebugLeakSmtp = SM_DEBUG_INITIALIZER("leak_smtp", 267 "@(#)$Debug: leak_smtp - trace memory leaks during SMTP processing $"); 268#endif /* SM_HEAP_CHECK */ 269 270typedef struct 271{ 272 bool sm_gotmail; /* mail command received */ 273 unsigned int sm_nrcpts; /* number of successful RCPT commands */ 274 bool sm_discard; 275#if MILTER 276 bool sm_milterize; 277 bool sm_milterlist; /* any filters in the list? */ 278#endif /* MILTER */ 279 char *sm_quarmsg; /* carry quarantining across messages */ 280} SMTP_T; 281 282static bool smtp_data __P((SMTP_T *, ENVELOPE *)); 283 284#define MSG_TEMPFAIL "451 4.3.2 Please try again later" 285 286#if MILTER 287# define MILTER_ABORT(e) milter_abort((e)) 288 289# define MILTER_REPLY(str) \ 290 { \ 291 int savelogusrerrs = LogUsrErrs; \ 292 \ 293 switch (state) \ 294 { \ 295 case SMFIR_REPLYCODE: \ 296 if (MilterLogLevel > 3) \ 297 { \ 298 sm_syslog(LOG_INFO, e->e_id, \ 299 "Milter: %s=%s, reject=%s", \ 300 str, addr, response); \ 301 LogUsrErrs = false; \ 302 } \ 303 if (strncmp(response, "421 ", 4) == 0) \ 304 { \ 305 bool tsave = QuickAbort; \ 306 \ 307 QuickAbort = false; \ 308 usrerr(response); \ 309 QuickAbort = tsave; \ 310 e->e_sendqueue = NULL; \ 311 goto doquit; \ 312 } \ 313 else \ 314 usrerr(response); \ 315 break; \ 316 \ 317 case SMFIR_REJECT: \ 318 if (MilterLogLevel > 3) \ 319 { \ 320 sm_syslog(LOG_INFO, e->e_id, \ 321 "Milter: %s=%s, reject=550 5.7.1 Command rejected", \ 322 str, addr); \ 323 LogUsrErrs = false; \ 324 } \ 325 usrerr("550 5.7.1 Command rejected"); \ 326 break; \ 327 \ 328 case SMFIR_DISCARD: \ 329 if (MilterLogLevel > 3) \ 330 sm_syslog(LOG_INFO, e->e_id, \ 331 "Milter: %s=%s, discard", \ 332 str, addr); \ 333 e->e_flags |= EF_DISCARD; \ 334 break; \ 335 \ 336 case SMFIR_TEMPFAIL: \ 337 if (MilterLogLevel > 3) \ 338 { \ 339 sm_syslog(LOG_INFO, e->e_id, \ 340 "Milter: %s=%s, reject=%s", \ 341 str, addr, MSG_TEMPFAIL); \ 342 LogUsrErrs = false; \ 343 } \ 344 usrerr(MSG_TEMPFAIL); \ 345 break; \ 346 } \ 347 LogUsrErrs = savelogusrerrs; \ 348 if (response != NULL) \ 349 sm_free(response); /* XXX */ \ 350 } 351 352#else /* MILTER */ 353# define MILTER_ABORT(e) 354#endif /* MILTER */ 355 356/* clear all SMTP state (for HELO/EHLO/RSET) */ 357#define CLEAR_STATE(cmd) \ 358do \ 359{ \ 360 /* abort milter filters */ \ 361 MILTER_ABORT(e); \ 362 \ 363 if (smtp.sm_nrcpts > 0) \ 364 { \ 365 logundelrcpts(e, cmd, 10, false); \ 366 smtp.sm_nrcpts = 0; \ 367 macdefine(&e->e_macro, A_PERM, \ 368 macid("{nrcpts}"), "0"); \ 369 } \ 370 \ 371 e->e_sendqueue = NULL; \ 372 e->e_flags |= EF_CLRQUEUE; \ 373 \ 374 if (LogLevel > 4 && bitset(EF_LOGSENDER, e->e_flags)) \ 375 logsender(e, NULL); \ 376 e->e_flags &= ~EF_LOGSENDER; \ 377 \ 378 /* clean up a bit */ \ 379 smtp.sm_gotmail = false; \ 380 SuprErrs = true; \ 381 dropenvelope(e, true, false); \ 382 sm_rpool_free(e->e_rpool); \ 383 e = newenvelope(e, CurEnv, sm_rpool_new_x(NULL)); \ 384 CurEnv = e; \ 385 \ 386 /* put back discard bit */ \ 387 if (smtp.sm_discard) \ 388 e->e_flags |= EF_DISCARD; \ 389 \ 390 /* restore connection quarantining */ \ 391 if (smtp.sm_quarmsg == NULL) \ 392 { \ 393 e->e_quarmsg = NULL; \ 394 macdefine(&e->e_macro, A_PERM, \ 395 macid("{quarantine}"), ""); \ 396 } \ 397 else \ 398 { \ 399 e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool, \ 400 smtp.sm_quarmsg); \ 401 macdefine(&e->e_macro, A_PERM, macid("{quarantine}"), \ 402 e->e_quarmsg); \ 403 } \ 404} while (0) 405 406/* sleep to flatten out connection load */ 407#define MIN_DELAY_LOG 15 /* wait before logging this again */ 408 409/* is it worth setting the process title for 1s? */ 410#define DELAY_CONN(cmd) \ 411 if (DelayLA > 0 && (CurrentLA = getla()) >= DelayLA) \ 412 { \ 413 time_t dnow; \ 414 \ 415 sm_setproctitle(true, e, \ 416 "%s: %s: delaying %s: load average: %d", \ 417 qid_printname(e), CurSmtpClient, \ 418 cmd, DelayLA); \ 419 if (LogLevel > 8 && (dnow = curtime()) > log_delay) \ 420 { \ 421 sm_syslog(LOG_INFO, e->e_id, \ 422 "delaying=%s, load average=%d >= %d", \ 423 cmd, CurrentLA, DelayLA); \ 424 log_delay = dnow + MIN_DELAY_LOG; \ 425 } \ 426 (void) sleep(1); \ 427 sm_setproctitle(true, e, "%s %s: %.80s", \ 428 qid_printname(e), CurSmtpClient, inp); \ 429 } 430 431 432void 433smtp(nullserver, d_flags, e) 434 char *volatile nullserver; 435 BITMAP256 d_flags; 436 register ENVELOPE *volatile e; 437{ 438 register char *volatile p; 439 register struct cmd *volatile c = NULL; 440 char *cmd; 441 auto ADDRESS *vrfyqueue; 442 ADDRESS *a; 443 volatile bool gothello; /* helo command received */ 444 bool vrfy; /* set if this is a vrfy command */ 445 char *volatile protocol; /* sending protocol */ 446 char *volatile sendinghost; /* sending hostname */ 447 char *volatile peerhostname; /* name of SMTP peer or "localhost" */ 448 auto char *delimptr; 449 char *id; 450 volatile unsigned int n_badcmds = 0; /* count of bad commands */ 451 volatile unsigned int n_badrcpts = 0; /* number of rejected RCPT */ 452 volatile unsigned int n_verifies = 0; /* count of VRFY/EXPN */ 453 volatile unsigned int n_etrn = 0; /* count of ETRN */ 454 volatile unsigned int n_noop = 0; /* count of NOOP/VERB/etc */ 455 volatile unsigned int n_helo = 0; /* count of HELO/EHLO */ 456 volatile int save_sevenbitinput; 457 bool ok; 458#if _FFR_BLOCK_PROXIES 459 volatile bool first; 460#endif /* _FFR_BLOCK_PROXIES */ 461 volatile bool tempfail = false; 462 volatile time_t wt; /* timeout after too many commands */ 463 volatile time_t previous; /* time after checksmtpattack() */ 464 volatile bool lognullconnection = true; 465 register char *q; 466 SMTP_T smtp; 467 char *addr; 468 char *greetcode = "220"; 469 char *hostname; /* my hostname ($j) */ 470 QUEUE_CHAR *new; 471 int argno; 472 char *args[MAXSMTPARGS]; 473 char inp[MAXLINE]; 474 char cmdbuf[MAXLINE]; 475#if SASL 476 sasl_conn_t *conn; 477 volatile bool sasl_ok; 478 volatile unsigned int n_auth = 0; /* count of AUTH commands */ 479 bool ismore; 480 int result; 481 volatile int authenticating; 482 char *user; 483 char *in, *out2; 484# if SASL >= 20000 485 char *auth_id; 486 const char *out; 487 sasl_ssf_t ext_ssf; 488 char localip[60], remoteip[60]; 489# else /* SASL >= 20000 */ 490 char *out; 491 const char *errstr; 492 sasl_external_properties_t ext_ssf; 493 struct sockaddr_in saddr_l; 494 struct sockaddr_in saddr_r; 495# endif /* SASL >= 20000 */ 496 sasl_security_properties_t ssp; 497 sasl_ssf_t *ssf; 498 unsigned int inlen, out2len; 499 unsigned int outlen; 500 char *volatile auth_type; 501 char *mechlist; 502 volatile unsigned int n_mechs; 503 unsigned int len; 504#endif /* SASL */ 505 int r; 506#if STARTTLS 507 int fdfl; 508 int rfd, wfd; 509 volatile bool tls_active = false; 510 volatile bool smtps = bitnset(D_SMTPS, d_flags); 511 bool saveQuickAbort; 512 bool saveSuprErrs; 513 time_t tlsstart; 514#endif /* STARTTLS */ 515 volatile unsigned int features; 516#if PIPELINING 517# if _FFR_NO_PIPE 518 int np_log = 0; 519# endif /* _FFR_NO_PIPE */ 520#endif /* PIPELINING */ 521 volatile time_t log_delay = (time_t) 0; 522 523 save_sevenbitinput = SevenBitInput; 524 smtp.sm_nrcpts = 0; 525#if MILTER 526 smtp.sm_milterize = (nullserver == NULL); 527 smtp.sm_milterlist = false; 528#endif /* MILTER */ 529 530 /* setup I/O fd correctly for the SMTP server */ 531 setup_smtpd_io(); 532 533#if SM_HEAP_CHECK 534 if (sm_debug_active(&DebugLeakSmtp, 1)) 535 { 536 sm_heap_newgroup(); 537 sm_dprintf("smtp() heap group #%d\n", sm_heap_group()); 538 } 539#endif /* SM_HEAP_CHECK */ 540 541 /* XXX the rpool should be set when e is initialized in main() */ 542 e->e_rpool = sm_rpool_new_x(NULL); 543 e->e_macro.mac_rpool = e->e_rpool; 544 545 settime(e); 546 sm_getla(); 547 peerhostname = RealHostName; 548 if (peerhostname == NULL) 549 peerhostname = "localhost"; 550 CurHostName = peerhostname; 551 CurSmtpClient = macvalue('_', e); 552 if (CurSmtpClient == NULL) 553 CurSmtpClient = CurHostName; 554 555 /* check_relay may have set discard bit, save for later */ 556 smtp.sm_discard = bitset(EF_DISCARD, e->e_flags); 557 558#if PIPELINING 559 /* auto-flush output when reading input */ 560 (void) sm_io_autoflush(InChannel, OutChannel); 561#endif /* PIPELINING */ 562 563 sm_setproctitle(true, e, "server %s startup", CurSmtpClient); 564 565 /* Set default features for server. */ 566 features = ((bitset(PRIV_NOETRN, PrivacyFlags) || 567 bitnset(D_NOETRN, d_flags)) ? SRV_NONE : SRV_OFFER_ETRN) 568 | (bitnset(D_AUTHREQ, d_flags) ? SRV_REQ_AUTH : SRV_NONE) 569 | (bitset(PRIV_NOEXPN, PrivacyFlags) ? SRV_NONE 570 : (SRV_OFFER_EXPN 571 | (bitset(PRIV_NOVERB, PrivacyFlags) 572 ? SRV_NONE : SRV_OFFER_VERB))) 573 | (bitset(PRIV_NORECEIPTS, PrivacyFlags) ? SRV_NONE 574 : SRV_OFFER_DSN) 575#if SASL 576 | (bitnset(D_NOAUTH, d_flags) ? SRV_NONE : SRV_OFFER_AUTH) 577 | (bitset(SASL_SEC_NOPLAINTEXT, SASLOpts) ? SRV_REQ_SEC 578 : SRV_NONE) 579#endif /* SASL */ 580#if PIPELINING 581 | SRV_OFFER_PIPE 582#endif /* PIPELINING */ 583#if STARTTLS 584 | (bitnset(D_NOTLS, d_flags) ? SRV_NONE : SRV_OFFER_TLS) 585 | (bitset(TLS_I_NO_VRFY, TLS_Srv_Opts) ? SRV_NONE 586 : SRV_VRFY_CLT) 587#endif /* STARTTLS */ 588 ; 589 if (nullserver == NULL) 590 { 591 features = srvfeatures(e, CurSmtpClient, features); 592 if (bitset(SRV_TMP_FAIL, features)) 593 { 594 if (LogLevel > 4) 595 sm_syslog(LOG_ERR, NOQID, 596 "ERROR: srv_features=tempfail, relay=%.100s, access temporarily disabled", 597 CurSmtpClient); 598 nullserver = "450 4.3.0 Please try again later."; 599 } 600 else 601 { 602#if PIPELINING 603# if _FFR_NO_PIPE 604 if (bitset(SRV_NO_PIPE, features)) 605 { 606 /* for consistency */ 607 features &= ~SRV_OFFER_PIPE; 608 } 609# endif /* _FFR_NO_PIPE */ 610#endif /* PIPELINING */ 611#if SASL 612 if (bitset(SRV_REQ_SEC, features)) 613 SASLOpts |= SASL_SEC_NOPLAINTEXT; 614 else 615 SASLOpts &= ~SASL_SEC_NOPLAINTEXT; 616#endif /* SASL */ 617 } 618 } 619 else if (strncmp(nullserver, "421 ", 4) == 0) 620 { 621 message(nullserver); 622 goto doquit; 623 } 624 625 hostname = macvalue('j', e); 626#if SASL 627 if (AuthRealm == NULL) 628 AuthRealm = hostname; 629 sasl_ok = bitset(SRV_OFFER_AUTH, features); 630 n_mechs = 0; 631 authenticating = SASL_NOT_AUTH; 632 633 /* SASL server new connection */ 634 if (sasl_ok) 635 { 636# if SASL >= 20000 637 result = sasl_server_new("smtp", AuthRealm, NULL, NULL, NULL, 638 NULL, 0, &conn); 639# elif SASL > 10505 640 /* use empty realm: only works in SASL > 1.5.5 */ 641 result = sasl_server_new("smtp", AuthRealm, "", NULL, 0, &conn); 642# else /* SASL >= 20000 */ 643 /* use no realm -> realm is set to hostname by SASL lib */ 644 result = sasl_server_new("smtp", AuthRealm, NULL, NULL, 0, 645 &conn); 646# endif /* SASL >= 20000 */ 647 sasl_ok = result == SASL_OK; 648 if (!sasl_ok) 649 { 650 if (LogLevel > 9) 651 sm_syslog(LOG_WARNING, NOQID, 652 "AUTH error: sasl_server_new failed=%d", 653 result); 654 } 655 } 656 if (sasl_ok) 657 { 658 /* 659 ** SASL set properties for sasl 660 ** set local/remote IP 661 ** XXX Cyrus SASL v1 only supports IPv4 662 ** 663 ** XXX where exactly are these used/required? 664 ** Kerberos_v4 665 */ 666 667# if SASL >= 20000 668 localip[0] = remoteip[0] = '\0'; 669# if NETINET || NETINET6 670 in = macvalue(macid("{daemon_family}"), e); 671 if (in != NULL && ( 672# if NETINET6 673 strcmp(in, "inet6") == 0 || 674# endif /* NETINET6 */ 675 strcmp(in, "inet") == 0)) 676 { 677 SOCKADDR_LEN_T addrsize; 678 SOCKADDR saddr_l; 679 SOCKADDR saddr_r; 680 681 addrsize = sizeof(saddr_r); 682 if (getpeername(sm_io_getinfo(InChannel, SM_IO_WHAT_FD, 683 NULL), 684 (struct sockaddr *) &saddr_r, 685 &addrsize) == 0) 686 { 687 if (iptostring(&saddr_r, addrsize, 688 remoteip, sizeof remoteip)) 689 { 690 sasl_setprop(conn, SASL_IPREMOTEPORT, 691 remoteip); 692 } 693 addrsize = sizeof(saddr_l); 694 if (getsockname(sm_io_getinfo(InChannel, 695 SM_IO_WHAT_FD, 696 NULL), 697 (struct sockaddr *) &saddr_l, 698 &addrsize) == 0) 699 { 700 if (iptostring(&saddr_l, addrsize, 701 localip, 702 sizeof localip)) 703 { 704 sasl_setprop(conn, 705 SASL_IPLOCALPORT, 706 localip); 707 } 708 } 709 } 710 } 711# endif /* NETINET || NETINET6 */ 712# else /* SASL >= 20000 */ 713# if NETINET 714 in = macvalue(macid("{daemon_family}"), e); 715 if (in != NULL && strcmp(in, "inet") == 0) 716 { 717 SOCKADDR_LEN_T addrsize; 718 719 addrsize = sizeof(struct sockaddr_in); 720 if (getpeername(sm_io_getinfo(InChannel, SM_IO_WHAT_FD, 721 NULL), 722 (struct sockaddr *)&saddr_r, 723 &addrsize) == 0) 724 { 725 sasl_setprop(conn, SASL_IP_REMOTE, &saddr_r); 726 addrsize = sizeof(struct sockaddr_in); 727 if (getsockname(sm_io_getinfo(InChannel, 728 SM_IO_WHAT_FD, 729 NULL), 730 (struct sockaddr *)&saddr_l, 731 &addrsize) == 0) 732 sasl_setprop(conn, SASL_IP_LOCAL, 733 &saddr_l); 734 } 735 } 736# endif /* NETINET */ 737# endif /* SASL >= 20000 */ 738 739 auth_type = NULL; 740 mechlist = NULL; 741 user = NULL; 742# if 0 743 macdefine(&BlankEnvelope.e_macro, A_PERM, 744 macid("{auth_author}"), NULL); 745# endif /* 0 */ 746 747 /* set properties */ 748 (void) memset(&ssp, '\0', sizeof ssp); 749 750 /* XXX should these be options settable via .cf ? */ 751 /* ssp.min_ssf = 0; is default due to memset() */ 752 { 753 ssp.max_ssf = MaxSLBits; 754 ssp.maxbufsize = MAXOUTLEN; 755 } 756 ssp.security_flags = SASLOpts & SASL_SEC_MASK; 757 sasl_ok = sasl_setprop(conn, SASL_SEC_PROPS, &ssp) == SASL_OK; 758 759 if (sasl_ok) 760 { 761 /* 762 ** external security strength factor; 763 ** currently we have none so zero 764 */ 765 766# if SASL >= 20000 767 ext_ssf = 0; 768 auth_id = NULL; 769 sasl_ok = ((sasl_setprop(conn, SASL_SSF_EXTERNAL, 770 &ext_ssf) == SASL_OK) && 771 (sasl_setprop(conn, SASL_AUTH_EXTERNAL, 772 auth_id) == SASL_OK)); 773# else /* SASL >= 20000 */ 774 ext_ssf.ssf = 0; 775 ext_ssf.auth_id = NULL; 776 sasl_ok = sasl_setprop(conn, SASL_SSF_EXTERNAL, 777 &ext_ssf) == SASL_OK; 778# endif /* SASL >= 20000 */ 779 } 780 if (sasl_ok) 781 n_mechs = saslmechs(conn, &mechlist); 782 } 783#endif /* SASL */ 784 785#if STARTTLS 786#endif /* STARTTLS */ 787 788#if MILTER 789 if (smtp.sm_milterize) 790 { 791 char state; 792 793 /* initialize mail filter connection */ 794 smtp.sm_milterlist = milter_init(e, &state); 795 switch (state) 796 { 797 case SMFIR_REJECT: 798 if (MilterLogLevel > 3) 799 sm_syslog(LOG_INFO, e->e_id, 800 "Milter: initialization failed, rejecting commands"); 801 greetcode = "554"; 802 nullserver = "Command rejected"; 803 smtp.sm_milterize = false; 804 break; 805 806 case SMFIR_TEMPFAIL: 807 if (MilterLogLevel > 3) 808 sm_syslog(LOG_INFO, e->e_id, 809 "Milter: initialization failed, temp failing commands"); 810 tempfail = true; 811 smtp.sm_milterize = false; 812 break; 813 } 814 } 815 816 if (smtp.sm_milterlist && smtp.sm_milterize && 817 !bitset(EF_DISCARD, e->e_flags)) 818 { 819 char state; 820 char *response; 821 822 response = milter_connect(peerhostname, RealHostAddr, 823 e, &state); 824 switch (state) 825 { 826 case SMFIR_REPLYCODE: /* REPLYCODE shouldn't happen */ 827 case SMFIR_REJECT: 828 if (MilterLogLevel > 3) 829 sm_syslog(LOG_INFO, e->e_id, 830 "Milter: connect: host=%s, addr=%s, rejecting commands", 831 peerhostname, 832 anynet_ntoa(&RealHostAddr)); 833 greetcode = "554"; 834 nullserver = "Command rejected"; 835 smtp.sm_milterize = false; 836 break; 837 838 case SMFIR_TEMPFAIL: 839 if (MilterLogLevel > 3) 840 sm_syslog(LOG_INFO, e->e_id, 841 "Milter: connect: host=%s, addr=%s, temp failing commands", 842 peerhostname, 843 anynet_ntoa(&RealHostAddr)); 844 tempfail = true; 845 smtp.sm_milterize = false; 846 break; 847 848 case SMFIR_SHUTDOWN: 849 if (MilterLogLevel > 3) 850 sm_syslog(LOG_INFO, e->e_id, 851 "Milter: connect: host=%s, addr=%s, shutdown", 852 peerhostname, 853 anynet_ntoa(&RealHostAddr)); 854 tempfail = true; 855 smtp.sm_milterize = false; 856 message("421 4.7.0 %s closing connection", 857 MyHostName); 858 859 /* arrange to ignore send list */ 860 e->e_sendqueue = NULL; 861 goto doquit; 862 } 863 if (response != NULL) 864 sm_free(response); /* XXX */ 865 } 866#endif /* MILTER */ 867 868 /* 869 ** Broken proxies and SMTP slammers 870 ** push data without waiting, catch them 871 */ 872 873 if ( 874#if STARTTLS 875 !smtps && 876#endif /* STARTTLS */ 877 *greetcode == '2') 878 { 879 time_t msecs = 0; 880 char **pvp; 881 char pvpbuf[PSBUFSIZE]; 882 883 /* Ask the rulesets how long to pause */ 884 pvp = NULL; 885 r = rscap("greet_pause", peerhostname, 886 anynet_ntoa(&RealHostAddr), e, 887 &pvp, pvpbuf, sizeof(pvpbuf)); 888 if (r == EX_OK && pvp != NULL && pvp[0] != NULL && 889 (pvp[0][0] & 0377) == CANONNET && pvp[1] != NULL) 890 { 891 msecs = strtol(pvp[1], NULL, 10); 892 } 893 894 if (msecs > 0) 895 { 896 int fd; 897 fd_set readfds; 898 struct timeval timeout; 899 900 /* pause for a moment */ 901 timeout.tv_sec = msecs / 1000; 902 timeout.tv_usec = (msecs % 1000) * 1000; 903 904 /* Obey RFC 2821: 4.3.5.2: 220 timeout of 5 minutes */ 905 if (timeout.tv_sec >= 300) 906 { 907 timeout.tv_sec = 300; 908 timeout.tv_usec = 0; 909 } 910 911 /* check if data is on the socket during the pause */ 912 fd = sm_io_getinfo(InChannel, SM_IO_WHAT_FD, NULL); 913 FD_ZERO(&readfds); 914 SM_FD_SET(fd, &readfds); 915 if (select(fd + 1, FDSET_CAST &readfds, 916 NULL, NULL, &timeout) > 0 && 917 FD_ISSET(fd, &readfds)) 918 { 919 greetcode = "554"; 920 nullserver = "Command rejected"; 921 sm_syslog(LOG_INFO, e->e_id, 922 "rejecting commands from %s [%s] due to pre-greeting traffic", 923 peerhostname, 924 anynet_ntoa(&RealHostAddr)); 925 } 926 } 927 } 928 929#if STARTTLS 930 /* If this an smtps connection, start TLS now */ 931 if (smtps) 932 { 933 Errors = 0; 934 goto starttls; 935 } 936 937 greeting: 938 939#endif /* STARTTLS */ 940 941 /* output the first line, inserting "ESMTP" as second word */ 942 if (*greetcode == '5') 943 (void) sm_snprintf(inp, sizeof inp, "%s not accepting messages", 944 hostname); 945 else 946 expand(SmtpGreeting, inp, sizeof inp, e); 947 948 p = strchr(inp, '\n'); 949 if (p != NULL) 950 *p++ = '\0'; 951 id = strchr(inp, ' '); 952 if (id == NULL) 953 id = &inp[strlen(inp)]; 954 if (p == NULL) 955 (void) sm_snprintf(cmdbuf, sizeof cmdbuf, 956 "%s %%.*s ESMTP%%s", greetcode); 957 else 958 (void) sm_snprintf(cmdbuf, sizeof cmdbuf, 959 "%s-%%.*s ESMTP%%s", greetcode); 960 message(cmdbuf, (int) (id - inp), inp, id); 961 962 /* output remaining lines */ 963 while ((id = p) != NULL && (p = strchr(id, '\n')) != NULL) 964 { 965 *p++ = '\0'; 966 if (isascii(*id) && isspace(*id)) 967 id++; 968 (void) sm_strlcpyn(cmdbuf, sizeof cmdbuf, 2, greetcode, "-%s"); 969 message(cmdbuf, id); 970 } 971 if (id != NULL) 972 { 973 if (isascii(*id) && isspace(*id)) 974 id++; 975 (void) sm_strlcpyn(cmdbuf, sizeof cmdbuf, 2, greetcode, " %s"); 976 message(cmdbuf, id); 977 } 978 979 protocol = NULL; 980 sendinghost = macvalue('s', e); 981 982 /* If quarantining by a connect/ehlo action, save between messages */ 983 if (e->e_quarmsg == NULL) 984 smtp.sm_quarmsg = NULL; 985 else 986 smtp.sm_quarmsg = newstr(e->e_quarmsg); 987 988 /* sendinghost's storage must outlive the current envelope */ 989 if (sendinghost != NULL) 990 sendinghost = sm_strdup_x(sendinghost); 991#if _FFR_BLOCK_PROXIES 992 first = true; 993#endif /* _FFR_BLOCK_PROXIES */ 994 gothello = false; 995 smtp.sm_gotmail = false; 996 for (;;) 997 { 998 SM_TRY 999 { 1000 QuickAbort = false; 1001 HoldErrs = false; 1002 SuprErrs = false; 1003 LogUsrErrs = false; 1004 OnlyOneError = true; 1005 e->e_flags &= ~(EF_VRFYONLY|EF_GLOBALERRS); 1006 1007 /* setup for the read */ 1008 e->e_to = NULL; 1009 Errors = 0; 1010 FileName = NULL; 1011 (void) sm_io_flush(smioout, SM_TIME_DEFAULT); 1012 1013 /* read the input line */ 1014 SmtpPhase = "server cmd read"; 1015 sm_setproctitle(true, e, "server %s cmd read", CurSmtpClient); 1016#if SASL 1017 /* 1018 ** XXX SMTP AUTH requires accepting any length, 1019 ** at least for challenge/response 1020 */ 1021#endif /* SASL */ 1022 1023 /* handle errors */ 1024 if (sm_io_error(OutChannel) || 1025 (p = sfgets(inp, sizeof inp, InChannel, 1026 TimeOuts.to_nextcommand, SmtpPhase)) == NULL) 1027 { 1028 char *d; 1029 1030 d = macvalue(macid("{daemon_name}"), e); 1031 if (d == NULL) 1032 d = "stdin"; 1033 /* end of file, just die */ 1034 disconnect(1, e); 1035 1036#if MILTER 1037 /* close out milter filters */ 1038 milter_quit(e); 1039#endif /* MILTER */ 1040 1041 message("421 4.4.1 %s Lost input channel from %s", 1042 MyHostName, CurSmtpClient); 1043 if (LogLevel > (smtp.sm_gotmail ? 1 : 19)) 1044 sm_syslog(LOG_NOTICE, e->e_id, 1045 "lost input channel from %s to %s after %s", 1046 CurSmtpClient, d, 1047 (c == NULL || c->cmd_name == NULL) ? "startup" : c->cmd_name); 1048 /* 1049 ** If have not accepted mail (DATA), do not bounce 1050 ** bad addresses back to sender. 1051 */ 1052 1053 if (bitset(EF_CLRQUEUE, e->e_flags)) 1054 e->e_sendqueue = NULL; 1055 goto doquit; 1056 } 1057 1058#if _FFR_BLOCK_PROXIES 1059 if (first) 1060 { 1061 size_t inplen, cmdlen; 1062 int idx; 1063 char *http_cmd; 1064 static char *http_cmds[] = { "GET", "POST", 1065 "CONNECT", "USER", NULL }; 1066 1067 inplen = strlen(inp); 1068 for (idx = 0; (http_cmd = http_cmds[idx]) != NULL; 1069 idx++) 1070 { 1071 cmdlen = strlen(http_cmd); 1072 if (cmdlen < inplen && 1073 sm_strncasecmp(inp, http_cmd, cmdlen) == 0 && 1074 isascii(inp[cmdlen]) && isspace(inp[cmdlen])) 1075 { 1076 /* Open proxy, drop it */ 1077 message("421 4.7.0 %s Rejecting open proxy %s", 1078 MyHostName, CurSmtpClient); 1079 sm_syslog(LOG_INFO, e->e_id, 1080 "%s: probable open proxy: command=%.40s", 1081 CurSmtpClient, inp); 1082 goto doquit; 1083 } 1084 } 1085 first = false; 1086 } 1087#endif /* _FFR_BLOCK_PROXIES */ 1088 1089 /* clean up end of line */ 1090 fixcrlf(inp, true); 1091 1092#if PIPELINING 1093# if _FFR_NO_PIPE 1094 /* 1095 ** if there is more input and pipelining is disabled: 1096 ** delay ... (and maybe discard the input?) 1097 ** XXX this doesn't really work, at least in tests using 1098 ** telnet SM_IO_IS_READABLE only returns 1 if there were 1099 ** more than 2 input lines available. 1100 */ 1101 1102 if (bitset(SRV_NO_PIPE, features) && 1103 sm_io_getinfo(InChannel, SM_IO_IS_READABLE, NULL) > 0) 1104 { 1105 if (++np_log < 3) 1106 sm_syslog(LOG_INFO, NOQID, 1107 "unauthorized PIPELINING, sleeping"); 1108 sleep(1); 1109 } 1110 1111# endif /* _FFR_NO_PIPE */ 1112#endif /* PIPELINING */ 1113 1114#if SASL 1115 if (authenticating == SASL_PROC_AUTH) 1116 { 1117# if 0 1118 if (*inp == '\0') 1119 { 1120 authenticating = SASL_NOT_AUTH; 1121 message("501 5.5.2 missing input"); 1122 RESET_SASLCONN; 1123 continue; 1124 } 1125# endif /* 0 */ 1126 if (*inp == '*' && *(inp + 1) == '\0') 1127 { 1128 authenticating = SASL_NOT_AUTH; 1129 1130 /* rfc 2254 4. */ 1131 message("501 5.0.0 AUTH aborted"); 1132 RESET_SASLCONN; 1133 continue; 1134 } 1135 1136 /* could this be shorter? XXX */ 1137# if SASL >= 20000 1138 in = xalloc(strlen(inp) + 1); 1139 result = sasl_decode64(inp, strlen(inp), in, 1140 strlen(inp), &inlen); 1141# else /* SASL >= 20000 */ 1142 out = xalloc(strlen(inp)); 1143 result = sasl_decode64(inp, strlen(inp), out, &outlen); 1144# endif /* SASL >= 20000 */ 1145 if (result != SASL_OK) 1146 { 1147 authenticating = SASL_NOT_AUTH; 1148 1149 /* rfc 2254 4. */ 1150 message("501 5.5.4 cannot decode AUTH parameter %s", 1151 inp); 1152# if SASL >= 20000 1153 sm_free(in); 1154# endif /* SASL >= 20000 */ 1155 RESET_SASLCONN; 1156 continue; 1157 } 1158 1159# if SASL >= 20000 1160 result = sasl_server_step(conn, in, inlen, 1161 &out, &outlen); 1162 sm_free(in); 1163# else /* SASL >= 20000 */ 1164 result = sasl_server_step(conn, out, outlen, 1165 &out, &outlen, &errstr); 1166# endif /* SASL >= 20000 */ 1167 1168 /* get an OK if we're done */ 1169 if (result == SASL_OK) 1170 { 1171 authenticated: 1172 message("235 2.0.0 OK Authenticated"); 1173 authenticating = SASL_IS_AUTH; 1174 macdefine(&BlankEnvelope.e_macro, A_TEMP, 1175 macid("{auth_type}"), auth_type); 1176 1177# if SASL >= 20000 1178 user = macvalue(macid("{auth_authen}"), e); 1179 1180 /* get security strength (features) */ 1181 result = sasl_getprop(conn, SASL_SSF, 1182 (const void **) &ssf); 1183# else /* SASL >= 20000 */ 1184 result = sasl_getprop(conn, SASL_USERNAME, 1185 (void **)&user); 1186 if (result != SASL_OK) 1187 { 1188 user = ""; 1189 macdefine(&BlankEnvelope.e_macro, 1190 A_PERM, 1191 macid("{auth_authen}"), NULL); 1192 } 1193 else 1194 { 1195 macdefine(&BlankEnvelope.e_macro, 1196 A_TEMP, 1197 macid("{auth_authen}"), 1198 xtextify(user, "<>\")")); 1199 } 1200 1201# if 0 1202 /* get realm? */ 1203 sasl_getprop(conn, SASL_REALM, (void **) &data); 1204# endif /* 0 */ 1205 1206 /* get security strength (features) */ 1207 result = sasl_getprop(conn, SASL_SSF, 1208 (void **) &ssf); 1209# endif /* SASL >= 20000 */ 1210 if (result != SASL_OK) 1211 { 1212 macdefine(&BlankEnvelope.e_macro, 1213 A_PERM, 1214 macid("{auth_ssf}"), "0"); 1215 ssf = NULL; 1216 } 1217 else 1218 { 1219 char pbuf[8]; 1220 1221 (void) sm_snprintf(pbuf, sizeof pbuf, 1222 "%u", *ssf); 1223 macdefine(&BlankEnvelope.e_macro, 1224 A_TEMP, 1225 macid("{auth_ssf}"), pbuf); 1226 if (tTd(95, 8)) 1227 sm_dprintf("AUTH auth_ssf: %u\n", 1228 *ssf); 1229 } 1230 1231 /* 1232 ** Only switch to encrypted connection 1233 ** if a security layer has been negotiated 1234 */ 1235 1236 if (ssf != NULL && *ssf > 0) 1237 { 1238 /* 1239 ** Convert I/O layer to use SASL. 1240 ** If the call fails, the connection 1241 ** is aborted. 1242 */ 1243 1244 if (sfdcsasl(&InChannel, &OutChannel, 1245 conn) == 0) 1246 { 1247 /* restart dialogue */ 1248 n_helo = 0; 1249# if PIPELINING 1250 (void) sm_io_autoflush(InChannel, 1251 OutChannel); 1252# endif /* PIPELINING */ 1253 } 1254 else 1255 syserr("503 5.3.3 SASL TLS failed"); 1256 } 1257 1258 /* NULL pointer ok since it's our function */ 1259 if (LogLevel > 8) 1260 sm_syslog(LOG_INFO, NOQID, 1261 "AUTH=server, relay=%s, authid=%.128s, mech=%.16s, bits=%d", 1262 CurSmtpClient, 1263 shortenstring(user, 128), 1264 auth_type, *ssf); 1265 } 1266 else if (result == SASL_CONTINUE) 1267 { 1268 len = ENC64LEN(outlen); 1269 out2 = xalloc(len); 1270 result = sasl_encode64(out, outlen, out2, len, 1271 &out2len); 1272 if (result != SASL_OK) 1273 { 1274 /* correct code? XXX */ 1275 /* 454 Temp. authentication failure */ 1276 message("454 4.5.4 Internal error: unable to encode64"); 1277 if (LogLevel > 5) 1278 sm_syslog(LOG_WARNING, e->e_id, 1279 "AUTH encode64 error [%d for \"%s\"]", 1280 result, out); 1281 /* start over? */ 1282 authenticating = SASL_NOT_AUTH; 1283 } 1284 else 1285 { 1286 message("334 %s", out2); 1287 if (tTd(95, 2)) 1288 sm_dprintf("AUTH continue: msg='%s' len=%u\n", 1289 out2, out2len); 1290 } 1291# if SASL >= 20000 1292 sm_free(out2); 1293# endif /* SASL >= 20000 */ 1294 } 1295 else 1296 { 1297 /* not SASL_OK or SASL_CONT */ 1298 message("535 5.7.0 authentication failed"); 1299 if (LogLevel > 9) 1300 sm_syslog(LOG_WARNING, e->e_id, 1301 "AUTH failure (%s): %s (%d) %s", 1302 auth_type, 1303 sasl_errstring(result, NULL, 1304 NULL), 1305 result, 1306# if SASL >= 20000 1307 sasl_errdetail(conn)); 1308# else /* SASL >= 20000 */ 1309 errstr == NULL ? "" : errstr); 1310# endif /* SASL >= 20000 */ 1311 RESET_SASLCONN; 1312 authenticating = SASL_NOT_AUTH; 1313 } 1314 } 1315 else 1316 { 1317 /* don't want to do any of this if authenticating */ 1318#endif /* SASL */ 1319 1320 /* echo command to transcript */ 1321 if (e->e_xfp != NULL) 1322 (void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT, 1323 "<<< %s\n", inp); 1324 1325 if (LogLevel > 14) 1326 sm_syslog(LOG_INFO, e->e_id, "<-- %s", inp); 1327 1328 /* break off command */ 1329 for (p = inp; isascii(*p) && isspace(*p); p++) 1330 continue; 1331 cmd = cmdbuf; 1332 while (*p != '\0' && 1333 !(isascii(*p) && isspace(*p)) && 1334 cmd < &cmdbuf[sizeof cmdbuf - 2]) 1335 *cmd++ = *p++; 1336 *cmd = '\0'; 1337 1338 /* throw away leading whitespace */ 1339 SKIP_SPACE(p); 1340 1341 /* decode command */ 1342 for (c = CmdTab; c->cmd_name != NULL; c++) 1343 { 1344 if (sm_strcasecmp(c->cmd_name, cmdbuf) == 0) 1345 break; 1346 } 1347 1348 /* reset errors */ 1349 errno = 0; 1350 1351 /* check whether a "non-null" command has been used */ 1352 switch (c->cmd_code) 1353 { 1354#if SASL 1355 case CMDAUTH: 1356 /* avoid information leak; take first two words? */ 1357 q = "AUTH"; 1358 break; 1359#endif /* SASL */ 1360 1361 case CMDMAIL: 1362 case CMDEXPN: 1363 case CMDVRFY: 1364 case CMDETRN: 1365 lognullconnection = false; 1366 /* FALLTHROUGH */ 1367 default: 1368 q = inp; 1369 break; 1370 } 1371 1372 if (e->e_id == NULL) 1373 sm_setproctitle(true, e, "%s: %.80s", 1374 CurSmtpClient, q); 1375 else 1376 sm_setproctitle(true, e, "%s %s: %.80s", 1377 qid_printname(e), 1378 CurSmtpClient, q); 1379 1380 /* 1381 ** Process command. 1382 ** 1383 ** If we are running as a null server, return 550 1384 ** to almost everything. 1385 */ 1386 1387 if (nullserver != NULL || bitnset(D_ETRNONLY, d_flags)) 1388 { 1389 switch (c->cmd_code) 1390 { 1391 case CMDQUIT: 1392 case CMDHELO: 1393 case CMDEHLO: 1394 case CMDNOOP: 1395 case CMDRSET: 1396 case CMDERROR: 1397 /* process normally */ 1398 break; 1399 1400 case CMDETRN: 1401 if (bitnset(D_ETRNONLY, d_flags) && 1402 nullserver == NULL) 1403 break; 1404 DELAY_CONN("ETRN"); 1405 /* FALLTHROUGH */ 1406 1407 default: 1408#if MAXBADCOMMANDS > 0 1409 /* theoretically this could overflow */ 1410 if (nullserver != NULL && 1411 ++n_badcmds > MAXBADCOMMANDS) 1412 { 1413 message("421 4.7.0 %s Too many bad commands; closing connection", 1414 MyHostName); 1415 1416 /* arrange to ignore send list */ 1417 e->e_sendqueue = NULL; 1418 goto doquit; 1419 } 1420#endif /* MAXBADCOMMANDS > 0 */ 1421 if (nullserver != NULL) 1422 { 1423 if (ISSMTPREPLY(nullserver)) 1424 usrerr(nullserver); 1425 else 1426 usrerr("550 5.0.0 %s", 1427 nullserver); 1428 } 1429 else 1430 usrerr("452 4.4.5 Insufficient disk space; try again later"); 1431 continue; 1432 } 1433 } 1434 1435 switch (c->cmd_code) 1436 { 1437#if SASL 1438 case CMDAUTH: /* sasl */ 1439 DELAY_CONN("AUTH"); 1440 if (!sasl_ok || n_mechs <= 0) 1441 { 1442 message("503 5.3.3 AUTH not available"); 1443 break; 1444 } 1445 if (authenticating == SASL_IS_AUTH) 1446 { 1447 message("503 5.5.0 Already Authenticated"); 1448 break; 1449 } 1450 if (smtp.sm_gotmail) 1451 { 1452 message("503 5.5.0 AUTH not permitted during a mail transaction"); 1453 break; 1454 } 1455 if (tempfail) 1456 { 1457 if (LogLevel > 9) 1458 sm_syslog(LOG_INFO, e->e_id, 1459 "SMTP AUTH command (%.100s) from %s tempfailed (due to previous checks)", 1460 p, CurSmtpClient); 1461 usrerr("454 4.3.0 Please try again later"); 1462 break; 1463 } 1464 1465 ismore = false; 1466 1467 /* crude way to avoid crack attempts */ 1468 STOP_IF_ATTACK(checksmtpattack(&n_auth, n_mechs + 1, 1469 true, "AUTH", e)); 1470 1471 /* make sure mechanism (p) is a valid string */ 1472 for (q = p; *q != '\0' && isascii(*q); q++) 1473 { 1474 if (isspace(*q)) 1475 { 1476 *q = '\0'; 1477 while (*++q != '\0' && 1478 isascii(*q) && isspace(*q)) 1479 continue; 1480 *(q - 1) = '\0'; 1481 ismore = (*q != '\0'); 1482 break; 1483 } 1484 } 1485 1486 if (*p == '\0') 1487 { 1488 message("501 5.5.2 AUTH mechanism must be specified"); 1489 break; 1490 } 1491 1492 /* check whether mechanism is available */ 1493 if (iteminlist(p, mechlist, " ") == NULL) 1494 { 1495 message("504 5.3.3 AUTH mechanism %.32s not available", 1496 p); 1497 break; 1498 } 1499 1500 if (ismore) 1501 { 1502 /* could this be shorter? XXX */ 1503# if SASL >= 20000 1504 in = xalloc(strlen(q) + 1); 1505 result = sasl_decode64(q, strlen(q), in, 1506 strlen(q), &inlen); 1507# else /* SASL >= 20000 */ 1508 in = sm_rpool_malloc(e->e_rpool, strlen(q)); 1509 result = sasl_decode64(q, strlen(q), in, 1510 &inlen); 1511# endif /* SASL >= 20000 */ 1512 if (result != SASL_OK) 1513 { 1514 message("501 5.5.4 cannot BASE64 decode '%s'", 1515 q); 1516 if (LogLevel > 5) 1517 sm_syslog(LOG_WARNING, e->e_id, 1518 "AUTH decode64 error [%d for \"%s\"]", 1519 result, q); 1520 /* start over? */ 1521 authenticating = SASL_NOT_AUTH; 1522# if SASL >= 20000 1523 sm_free(in); 1524# endif /* SASL >= 20000 */ 1525 in = NULL; 1526 inlen = 0; 1527 break; 1528 } 1529 } 1530 else 1531 { 1532 in = NULL; 1533 inlen = 0; 1534 } 1535 1536 /* see if that auth type exists */ 1537# if SASL >= 20000 1538 result = sasl_server_start(conn, p, in, inlen, 1539 &out, &outlen); 1540 if (in != NULL) 1541 sm_free(in); 1542# else /* SASL >= 20000 */ 1543 result = sasl_server_start(conn, p, in, inlen, 1544 &out, &outlen, &errstr); 1545# endif /* SASL >= 20000 */ 1546 1547 if (result != SASL_OK && result != SASL_CONTINUE) 1548 { 1549 message("535 5.7.0 authentication failed"); 1550 if (LogLevel > 9) 1551 sm_syslog(LOG_ERR, e->e_id, 1552 "AUTH failure (%s): %s (%d) %s", 1553 p, 1554 sasl_errstring(result, NULL, 1555 NULL), 1556 result, 1557# if SASL >= 20000 1558 sasl_errdetail(conn)); 1559# else /* SASL >= 20000 */ 1560 errstr); 1561# endif /* SASL >= 20000 */ 1562 RESET_SASLCONN; 1563 break; 1564 } 1565 auth_type = newstr(p); 1566 1567 if (result == SASL_OK) 1568 { 1569 /* ugly, but same code */ 1570 goto authenticated; 1571 /* authenticated by the initial response */ 1572 } 1573 1574 /* len is at least 2 */ 1575 len = ENC64LEN(outlen); 1576 out2 = xalloc(len); 1577 result = sasl_encode64(out, outlen, out2, len, 1578 &out2len); 1579 1580 if (result != SASL_OK) 1581 { 1582 message("454 4.5.4 Temporary authentication failure"); 1583 if (LogLevel > 5) 1584 sm_syslog(LOG_WARNING, e->e_id, 1585 "AUTH encode64 error [%d for \"%s\"]", 1586 result, out); 1587 1588 /* start over? */ 1589 authenticating = SASL_NOT_AUTH; 1590 RESET_SASLCONN; 1591 } 1592 else 1593 { 1594 message("334 %s", out2); 1595 authenticating = SASL_PROC_AUTH; 1596 } 1597# if SASL >= 20000 1598 sm_free(out2); 1599# endif /* SASL >= 20000 */ 1600 break; 1601#endif /* SASL */ 1602 1603#if STARTTLS 1604 case CMDSTLS: /* starttls */ 1605 DELAY_CONN("STARTTLS"); 1606 if (*p != '\0') 1607 { 1608 message("501 5.5.2 Syntax error (no parameters allowed)"); 1609 break; 1610 } 1611 if (!bitset(SRV_OFFER_TLS, features)) 1612 { 1613 message("503 5.5.0 TLS not available"); 1614 break; 1615 } 1616 if (!tls_ok_srv) 1617 { 1618 message("454 4.3.3 TLS not available after start"); 1619 break; 1620 } 1621 if (smtp.sm_gotmail) 1622 { 1623 message("503 5.5.0 TLS not permitted during a mail transaction"); 1624 break; 1625 } 1626 if (tempfail) 1627 { 1628 if (LogLevel > 9) 1629 sm_syslog(LOG_INFO, e->e_id, 1630 "SMTP STARTTLS command (%.100s) from %s tempfailed (due to previous checks)", 1631 p, CurSmtpClient); 1632 usrerr("454 4.7.0 Please try again later"); 1633 break; 1634 } 1635 starttls: 1636# if TLS_NO_RSA 1637 /* 1638 ** XXX do we need a temp key ? 1639 */ 1640# else /* TLS_NO_RSA */ 1641# endif /* TLS_NO_RSA */ 1642 1643# if TLS_VRFY_PER_CTX 1644 /* 1645 ** Note: this sets the verification globally 1646 ** (per SSL_CTX) 1647 ** it's ok since it applies only to one transaction 1648 */ 1649 1650 TLS_VERIFY_CLIENT(); 1651# endif /* TLS_VRFY_PER_CTX */ 1652 1653 if (srv_ssl != NULL) 1654 SSL_clear(srv_ssl); 1655 else if ((srv_ssl = SSL_new(srv_ctx)) == NULL) 1656 { 1657 message("454 4.3.3 TLS not available: error generating SSL handle"); 1658 if (LogLevel > 8) 1659 tlslogerr("server"); 1660 goto tls_done; 1661 } 1662 1663# if !TLS_VRFY_PER_CTX 1664 /* 1665 ** this could be used if it were possible to set 1666 ** verification per SSL (connection) 1667 ** not just per SSL_CTX (global) 1668 */ 1669 1670 TLS_VERIFY_CLIENT(); 1671# endif /* !TLS_VRFY_PER_CTX */ 1672 1673 rfd = sm_io_getinfo(InChannel, SM_IO_WHAT_FD, NULL); 1674 wfd = sm_io_getinfo(OutChannel, SM_IO_WHAT_FD, NULL); 1675 1676 if (rfd < 0 || wfd < 0 || 1677 SSL_set_rfd(srv_ssl, rfd) <= 0 || 1678 SSL_set_wfd(srv_ssl, wfd) <= 0) 1679 { 1680 message("454 4.3.3 TLS not available: error set fd"); 1681 SSL_free(srv_ssl); 1682 srv_ssl = NULL; 1683 goto tls_done; 1684 } 1685 if (!smtps) 1686 message("220 2.0.0 Ready to start TLS"); 1687# if PIPELINING 1688 (void) sm_io_flush(OutChannel, SM_TIME_DEFAULT); 1689# endif /* PIPELINING */ 1690 1691 SSL_set_accept_state(srv_ssl); 1692 1693# define SSL_ACC(s) SSL_accept(s) 1694 1695 tlsstart = curtime(); 1696 fdfl = fcntl(rfd, F_GETFL); 1697 if (fdfl != -1) 1698 fcntl(rfd, F_SETFL, fdfl|O_NONBLOCK); 1699 ssl_retry: 1700 if ((r = SSL_ACC(srv_ssl)) <= 0) 1701 { 1702 int i; 1703 bool timedout; 1704 time_t left; 1705 time_t now = curtime(); 1706 struct timeval tv; 1707 1708 /* what to do in this case? */ 1709 i = SSL_get_error(srv_ssl, r); 1710 1711 /* 1712 ** For SSL_ERROR_WANT_{READ,WRITE}: 1713 ** There is no SSL record available yet 1714 ** or there is only a partial SSL record 1715 ** removed from the network (socket) buffer 1716 ** into the SSL buffer. The SSL_accept will 1717 ** only succeed when a full SSL record is 1718 ** available (assuming a "real" error 1719 ** doesn't happen). To handle when a "real" 1720 ** error does happen the select is set for 1721 ** exceptions too. 1722 ** The connection may be re-negotiated 1723 ** during this time so both read and write 1724 ** "want errors" need to be handled. 1725 ** A select() exception loops back so that 1726 ** a proper SSL error message can be gotten. 1727 */ 1728 1729 left = TimeOuts.to_starttls - (now - tlsstart); 1730 timedout = left <= 0; 1731 if (!timedout) 1732 { 1733 tv.tv_sec = left; 1734 tv.tv_usec = 0; 1735 } 1736 1737 if (!timedout && FD_SETSIZE > 0 && 1738 (rfd >= FD_SETSIZE || 1739 (i == SSL_ERROR_WANT_WRITE && 1740 wfd >= FD_SETSIZE))) 1741 { 1742 if (LogLevel > 5) 1743 { 1744 sm_syslog(LOG_ERR, NOQID, 1745 "STARTTLS=server, error: fd %d/%d too large", 1746 rfd, wfd); 1747 if (LogLevel > 8) 1748 tlslogerr("server"); 1749 } 1750 goto tlsfail; 1751 } 1752 1753 /* XXX what about SSL_pending() ? */ 1754 if (!timedout && i == SSL_ERROR_WANT_READ) 1755 { 1756 fd_set ssl_maskr, ssl_maskx; 1757 1758 FD_ZERO(&ssl_maskr); 1759 FD_SET(rfd, &ssl_maskr); 1760 FD_ZERO(&ssl_maskx); 1761 FD_SET(rfd, &ssl_maskx); 1762 if (select(rfd + 1, &ssl_maskr, NULL, 1763 &ssl_maskx, &tv) > 0) 1764 goto ssl_retry; 1765 } 1766 if (!timedout && i == SSL_ERROR_WANT_WRITE) 1767 { 1768 fd_set ssl_maskw, ssl_maskx; 1769 1770 FD_ZERO(&ssl_maskw); 1771 FD_SET(wfd, &ssl_maskw); 1772 FD_ZERO(&ssl_maskx); 1773 FD_SET(rfd, &ssl_maskx); 1774 if (select(wfd + 1, NULL, &ssl_maskw, 1775 &ssl_maskx, &tv) > 0) 1776 goto ssl_retry; 1777 } 1778 if (LogLevel > 5) 1779 { 1780 sm_syslog(LOG_WARNING, NOQID, 1781 "STARTTLS=server, error: accept failed=%d, SSL_error=%d, timedout=%d, errno=%d", 1782 r, i, (int) timedout, errno); 1783 if (LogLevel > 8) 1784 tlslogerr("server"); 1785 } 1786tlsfail: 1787 tls_ok_srv = false; 1788 SSL_free(srv_ssl); 1789 srv_ssl = NULL; 1790 1791 /* 1792 ** according to the next draft of 1793 ** RFC 2487 the connection should be dropped 1794 */ 1795 1796 /* arrange to ignore any current send list */ 1797 e->e_sendqueue = NULL; 1798 goto doquit; 1799 } 1800 1801 if (fdfl != -1) 1802 fcntl(rfd, F_SETFL, fdfl); 1803 1804 /* ignore return code for now, it's in {verify} */ 1805 (void) tls_get_info(srv_ssl, true, 1806 CurSmtpClient, 1807 &BlankEnvelope.e_macro, 1808 bitset(SRV_VRFY_CLT, features)); 1809 1810 /* 1811 ** call Stls_client to find out whether 1812 ** to accept the connection from the client 1813 */ 1814 1815 saveQuickAbort = QuickAbort; 1816 saveSuprErrs = SuprErrs; 1817 SuprErrs = true; 1818 QuickAbort = false; 1819 if (rscheck("tls_client", 1820 macvalue(macid("{verify}"), e), 1821 "STARTTLS", e, 1822 RSF_RMCOMM|RSF_COUNT, 1823 5, NULL, NOQID) != EX_OK || 1824 Errors > 0) 1825 { 1826 extern char MsgBuf[]; 1827 1828 if (MsgBuf[0] != '\0' && ISSMTPREPLY(MsgBuf)) 1829 nullserver = newstr(MsgBuf); 1830 else 1831 nullserver = "503 5.7.0 Authentication required."; 1832 } 1833 QuickAbort = saveQuickAbort; 1834 SuprErrs = saveSuprErrs; 1835 1836 tls_ok_srv = false; /* don't offer STARTTLS again */ 1837 n_helo = 0; 1838# if SASL 1839 if (sasl_ok) 1840 { 1841 int cipher_bits; 1842 bool verified; 1843 char *s, *v, *c; 1844 1845 s = macvalue(macid("{cipher_bits}"), e); 1846 v = macvalue(macid("{verify}"), e); 1847 c = macvalue(macid("{cert_subject}"), e); 1848 verified = (v != NULL && strcmp(v, "OK") == 0); 1849 if (s != NULL && (cipher_bits = atoi(s)) > 0) 1850 { 1851# if SASL >= 20000 1852 ext_ssf = cipher_bits; 1853 auth_id = verified ? c : NULL; 1854 sasl_ok = ((sasl_setprop(conn, 1855 SASL_SSF_EXTERNAL, 1856 &ext_ssf) == SASL_OK) && 1857 (sasl_setprop(conn, 1858 SASL_AUTH_EXTERNAL, 1859 auth_id) == SASL_OK)); 1860# else /* SASL >= 20000 */ 1861 ext_ssf.ssf = cipher_bits; 1862 ext_ssf.auth_id = verified ? c : NULL; 1863 sasl_ok = sasl_setprop(conn, 1864 SASL_SSF_EXTERNAL, 1865 &ext_ssf) == SASL_OK; 1866# endif /* SASL >= 20000 */ 1867 mechlist = NULL; 1868 if (sasl_ok) 1869 n_mechs = saslmechs(conn, 1870 &mechlist); 1871 } 1872 } 1873# endif /* SASL */ 1874 1875 /* switch to secure connection */ 1876 if (sfdctls(&InChannel, &OutChannel, srv_ssl) == 0) 1877 { 1878 tls_active = true; 1879# if PIPELINING 1880 (void) sm_io_autoflush(InChannel, OutChannel); 1881# endif /* PIPELINING */ 1882 } 1883 else 1884 { 1885 /* 1886 ** XXX this is an internal error 1887 ** how to deal with it? 1888 ** we can't generate an error message 1889 ** since the other side switched to an 1890 ** encrypted layer, but we could not... 1891 ** just "hang up"? 1892 */ 1893 1894 nullserver = "454 4.3.3 TLS not available: can't switch to encrypted layer"; 1895 syserr("STARTTLS: can't switch to encrypted layer"); 1896 } 1897 tls_done: 1898 if (smtps) 1899 { 1900 if (tls_active) 1901 goto greeting; 1902 else 1903 goto doquit; 1904 } 1905 break; 1906#endif /* STARTTLS */ 1907 1908 case CMDHELO: /* hello -- introduce yourself */ 1909 case CMDEHLO: /* extended hello */ 1910 DELAY_CONN("EHLO"); 1911 if (c->cmd_code == CMDEHLO) 1912 { 1913 protocol = "ESMTP"; 1914 SmtpPhase = "server EHLO"; 1915 } 1916 else 1917 { 1918 protocol = "SMTP"; 1919 SmtpPhase = "server HELO"; 1920 } 1921 1922 /* avoid denial-of-service */ 1923 STOP_IF_ATTACK(checksmtpattack(&n_helo, MAXHELOCOMMANDS, 1924 true, "HELO/EHLO", e)); 1925 1926#if 0 1927 /* RFC2821 4.1.4 allows duplicate HELO/EHLO */ 1928 /* check for duplicate HELO/EHLO per RFC 1651 4.2 */ 1929 if (gothello) 1930 { 1931 usrerr("503 %s Duplicate HELO/EHLO", 1932 MyHostName); 1933 break; 1934 } 1935#endif /* 0 */ 1936 1937 /* check for valid domain name (re 1123 5.2.5) */ 1938 if (*p == '\0' && !AllowBogusHELO) 1939 { 1940 usrerr("501 %s requires domain address", 1941 cmdbuf); 1942 break; 1943 } 1944 1945 /* check for long domain name (hides Received: info) */ 1946 if (strlen(p) > MAXNAME) 1947 { 1948 usrerr("501 Invalid domain name"); 1949 if (LogLevel > 9) 1950 sm_syslog(LOG_INFO, CurEnv->e_id, 1951 "invalid domain name (too long) from %s", 1952 CurSmtpClient); 1953 break; 1954 } 1955 1956 ok = true; 1957 for (q = p; *q != '\0'; q++) 1958 { 1959 if (!isascii(*q)) 1960 break; 1961 if (isalnum(*q)) 1962 continue; 1963 if (isspace(*q)) 1964 { 1965 *q = '\0'; 1966 1967 /* only complain if strict check */ 1968 ok = AllowBogusHELO; 1969 1970 /* allow trailing whitespace */ 1971 while (!ok && *++q != '\0' && 1972 isspace(*q)) 1973 ; 1974 if (*q == '\0') 1975 ok = true; 1976 break; 1977 } 1978 if (strchr("[].-_#:", *q) == NULL) 1979 break; 1980 } 1981 1982 if (*q == '\0' && ok) 1983 { 1984 q = "pleased to meet you"; 1985 sendinghost = sm_strdup_x(p); 1986 } 1987 else if (!AllowBogusHELO) 1988 { 1989 usrerr("501 Invalid domain name"); 1990 if (LogLevel > 9) 1991 sm_syslog(LOG_INFO, CurEnv->e_id, 1992 "invalid domain name (%s) from %.100s", 1993 p, CurSmtpClient); 1994 break; 1995 } 1996 else 1997 { 1998 q = "accepting invalid domain name"; 1999 } 2000 2001 if (gothello) 2002 { 2003 CLEAR_STATE(cmdbuf); 2004 } 2005 2006#if MILTER 2007 if (smtp.sm_milterlist && smtp.sm_milterize && 2008 !bitset(EF_DISCARD, e->e_flags)) 2009 { 2010 char state; 2011 char *response; 2012 2013 response = milter_helo(p, e, &state); 2014 switch (state) 2015 { 2016 case SMFIR_REPLYCODE: 2017 if (MilterLogLevel > 3) 2018 sm_syslog(LOG_INFO, e->e_id, 2019 "Milter: helo=%s, reject=%s", 2020 p, response); 2021 nullserver = newstr(response); 2022 smtp.sm_milterize = false; 2023 break; 2024 2025 case SMFIR_REJECT: 2026 if (MilterLogLevel > 3) 2027 sm_syslog(LOG_INFO, e->e_id, 2028 "Milter: helo=%s, reject=Command rejected", 2029 p); 2030 nullserver = "Command rejected"; 2031 smtp.sm_milterize = false; 2032 break; 2033 2034 case SMFIR_TEMPFAIL: 2035 if (MilterLogLevel > 3) 2036 sm_syslog(LOG_INFO, e->e_id, 2037 "Milter: helo=%s, reject=%s", 2038 p, MSG_TEMPFAIL); 2039 tempfail = true; 2040 smtp.sm_milterize = false; 2041 break; 2042 } 2043 if (response != NULL) 2044 sm_free(response); 2045 2046 /* 2047 ** If quarantining by a connect/ehlo action, 2048 ** save between messages 2049 */ 2050 2051 if (smtp.sm_quarmsg == NULL && 2052 e->e_quarmsg != NULL) 2053 smtp.sm_quarmsg = newstr(e->e_quarmsg); 2054 } 2055#endif /* MILTER */ 2056 gothello = true; 2057 2058 /* print HELO response message */ 2059 if (c->cmd_code != CMDEHLO) 2060 { 2061 message("250 %s Hello %s, %s", 2062 MyHostName, CurSmtpClient, q); 2063 break; 2064 } 2065 2066 message("250-%s Hello %s, %s", 2067 MyHostName, CurSmtpClient, q); 2068 2069 /* offer ENHSC even for nullserver */ 2070 if (nullserver != NULL) 2071 { 2072 message("250 ENHANCEDSTATUSCODES"); 2073 break; 2074 } 2075 2076 /* 2077 ** print EHLO features list 2078 ** 2079 ** Note: If you change this list, 2080 ** remember to update 'helpfile' 2081 */ 2082 2083 message("250-ENHANCEDSTATUSCODES"); 2084#if PIPELINING 2085 if (bitset(SRV_OFFER_PIPE, features)) 2086 message("250-PIPELINING"); 2087#endif /* PIPELINING */ 2088 if (bitset(SRV_OFFER_EXPN, features)) 2089 { 2090 message("250-EXPN"); 2091 if (bitset(SRV_OFFER_VERB, features)) 2092 message("250-VERB"); 2093 } 2094#if MIME8TO7 2095 message("250-8BITMIME"); 2096#endif /* MIME8TO7 */ 2097 if (MaxMessageSize > 0) 2098 message("250-SIZE %ld", MaxMessageSize); 2099 else 2100 message("250-SIZE"); 2101#if DSN 2102 if (SendMIMEErrors && bitset(SRV_OFFER_DSN, features)) 2103 message("250-DSN"); 2104#endif /* DSN */ 2105 if (bitset(SRV_OFFER_ETRN, features)) 2106 message("250-ETRN"); 2107#if SASL 2108 if (sasl_ok && mechlist != NULL && *mechlist != '\0') 2109 message("250-AUTH %s", mechlist); 2110#endif /* SASL */ 2111#if STARTTLS 2112 if (tls_ok_srv && 2113 bitset(SRV_OFFER_TLS, features)) 2114 message("250-STARTTLS"); 2115#endif /* STARTTLS */ 2116 if (DeliverByMin > 0) 2117 message("250-DELIVERBY %ld", 2118 (long) DeliverByMin); 2119 else if (DeliverByMin == 0) 2120 message("250-DELIVERBY"); 2121 2122 /* < 0: no deliver-by */ 2123 2124 message("250 HELP"); 2125 break; 2126 2127 case CMDMAIL: /* mail -- designate sender */ 2128 SmtpPhase = "server MAIL"; 2129 DELAY_CONN("MAIL"); 2130 2131 /* check for validity of this command */ 2132 if (!gothello && bitset(PRIV_NEEDMAILHELO, PrivacyFlags)) 2133 { 2134 usrerr("503 5.0.0 Polite people say HELO first"); 2135 break; 2136 } 2137 if (smtp.sm_gotmail) 2138 { 2139 usrerr("503 5.5.0 Sender already specified"); 2140 break; 2141 } 2142#if SASL 2143 if (bitset(SRV_REQ_AUTH, features) && 2144 authenticating != SASL_IS_AUTH) 2145 { 2146 usrerr("530 5.7.0 Authentication required"); 2147 break; 2148 } 2149#endif /* SASL */ 2150 2151 p = skipword(p, "from"); 2152 if (p == NULL) 2153 break; 2154 if (tempfail) 2155 { 2156 if (LogLevel > 9) 2157 sm_syslog(LOG_INFO, e->e_id, 2158 "SMTP MAIL command (%.100s) from %s tempfailed (due to previous checks)", 2159 p, CurSmtpClient); 2160 usrerr(MSG_TEMPFAIL); 2161 break; 2162 } 2163 2164 /* make sure we know who the sending host is */ 2165 if (sendinghost == NULL) 2166 sendinghost = peerhostname; 2167 2168 2169#if SM_HEAP_CHECK 2170 if (sm_debug_active(&DebugLeakSmtp, 1)) 2171 { 2172 sm_heap_newgroup(); 2173 sm_dprintf("smtp() heap group #%d\n", 2174 sm_heap_group()); 2175 } 2176#endif /* SM_HEAP_CHECK */ 2177 2178 if (Errors > 0) 2179 goto undo_no_pm; 2180 if (!gothello) 2181 { 2182 auth_warning(e, "%s didn't use HELO protocol", 2183 CurSmtpClient); 2184 } 2185#ifdef PICKY_HELO_CHECK 2186 if (sm_strcasecmp(sendinghost, peerhostname) != 0 && 2187 (sm_strcasecmp(peerhostname, "localhost") != 0 || 2188 sm_strcasecmp(sendinghost, MyHostName) != 0)) 2189 { 2190 auth_warning(e, "Host %s claimed to be %s", 2191 CurSmtpClient, sendinghost); 2192 } 2193#endif /* PICKY_HELO_CHECK */ 2194 2195 if (protocol == NULL) 2196 protocol = "SMTP"; 2197 macdefine(&e->e_macro, A_PERM, 'r', protocol); 2198 macdefine(&e->e_macro, A_PERM, 's', sendinghost); 2199 2200 if (Errors > 0) 2201 goto undo_no_pm; 2202 smtp.sm_nrcpts = 0; 2203 n_badrcpts = 0; 2204 macdefine(&e->e_macro, A_PERM, macid("{ntries}"), "0"); 2205 macdefine(&e->e_macro, A_PERM, macid("{nrcpts}"), "0"); 2206 macdefine(&e->e_macro, A_PERM, macid("{nbadrcpts}"), 2207 "0"); 2208 e->e_flags |= EF_CLRQUEUE; 2209 sm_setproctitle(true, e, "%s %s: %.80s", 2210 qid_printname(e), 2211 CurSmtpClient, inp); 2212 2213 /* do the processing */ 2214 SM_TRY 2215 { 2216 extern char *FullName; 2217 2218 QuickAbort = true; 2219 SM_FREE_CLR(FullName); 2220 2221 /* must parse sender first */ 2222 delimptr = NULL; 2223 setsender(p, e, &delimptr, ' ', false); 2224 if (delimptr != NULL && *delimptr != '\0') 2225 *delimptr++ = '\0'; 2226 if (Errors > 0) 2227 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2228 2229 /* Successfully set e_from, allow logging */ 2230 e->e_flags |= EF_LOGSENDER; 2231 2232 /* put resulting triple from parseaddr() into macros */ 2233 if (e->e_from.q_mailer != NULL) 2234 macdefine(&e->e_macro, A_PERM, 2235 macid("{mail_mailer}"), 2236 e->e_from.q_mailer->m_name); 2237 else 2238 macdefine(&e->e_macro, A_PERM, 2239 macid("{mail_mailer}"), NULL); 2240 if (e->e_from.q_host != NULL) 2241 macdefine(&e->e_macro, A_PERM, 2242 macid("{mail_host}"), 2243 e->e_from.q_host); 2244 else 2245 macdefine(&e->e_macro, A_PERM, 2246 macid("{mail_host}"), "localhost"); 2247 if (e->e_from.q_user != NULL) 2248 macdefine(&e->e_macro, A_PERM, 2249 macid("{mail_addr}"), 2250 e->e_from.q_user); 2251 else 2252 macdefine(&e->e_macro, A_PERM, 2253 macid("{mail_addr}"), NULL); 2254 if (Errors > 0) 2255 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2256 2257 /* check for possible spoofing */ 2258 if (RealUid != 0 && OpMode == MD_SMTP && 2259 !wordinclass(RealUserName, 't') && 2260 (!bitnset(M_LOCALMAILER, 2261 e->e_from.q_mailer->m_flags) || 2262 strcmp(e->e_from.q_user, RealUserName) != 0)) 2263 { 2264 auth_warning(e, "%s owned process doing -bs", 2265 RealUserName); 2266 } 2267 2268 /* reset to default value */ 2269 SevenBitInput = save_sevenbitinput; 2270 2271 /* now parse ESMTP arguments */ 2272 e->e_msgsize = 0; 2273 addr = p; 2274 argno = 0; 2275 args[argno++] = p; 2276 p = delimptr; 2277 while (p != NULL && *p != '\0') 2278 { 2279 char *kp; 2280 char *vp = NULL; 2281 char *equal = NULL; 2282 2283 /* locate the beginning of the keyword */ 2284 SKIP_SPACE(p); 2285 if (*p == '\0') 2286 break; 2287 kp = p; 2288 2289 /* skip to the value portion */ 2290 while ((isascii(*p) && isalnum(*p)) || *p == '-') 2291 p++; 2292 if (*p == '=') 2293 { 2294 equal = p; 2295 *p++ = '\0'; 2296 vp = p; 2297 2298 /* skip to the end of the value */ 2299 while (*p != '\0' && *p != ' ' && 2300 !(isascii(*p) && iscntrl(*p)) && 2301 *p != '=') 2302 p++; 2303 } 2304 2305 if (*p != '\0') 2306 *p++ = '\0'; 2307 2308 if (tTd(19, 1)) 2309 sm_dprintf("MAIL: got arg %s=\"%s\"\n", kp, 2310 vp == NULL ? "<null>" : vp); 2311 2312 mail_esmtp_args(kp, vp, e); 2313 if (equal != NULL) 2314 *equal = '='; 2315 args[argno++] = kp; 2316 if (argno >= MAXSMTPARGS - 1) 2317 usrerr("501 5.5.4 Too many parameters"); 2318 if (Errors > 0) 2319 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2320 } 2321 args[argno] = NULL; 2322 if (Errors > 0) 2323 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2324 2325#if SASL 2326# if _FFR_AUTH_PASSING 2327 /* set the default AUTH= if the sender didn't */ 2328 if (e->e_auth_param == NULL) 2329 { 2330 /* XXX only do this for an MSA? */ 2331 e->e_auth_param = macvalue(macid("{auth_authen}"), 2332 e); 2333 if (e->e_auth_param == NULL) 2334 e->e_auth_param = "<>"; 2335 2336 /* 2337 ** XXX should we invoke Strust_auth now? 2338 ** authorizing as the client that just 2339 ** authenticated, so we'll trust implicitly 2340 */ 2341 } 2342# endif /* _FFR_AUTH_PASSING */ 2343#endif /* SASL */ 2344 2345 /* do config file checking of the sender */ 2346 macdefine(&e->e_macro, A_PERM, 2347 macid("{addr_type}"), "e s"); 2348#if _FFR_MAIL_MACRO 2349 /* make the "real" sender address available */ 2350 macdefine(&e->e_macro, A_TEMP, macid("{mail_from}"), 2351 e->e_from.q_paddr); 2352#endif /* _FFR_MAIL_MACRO */ 2353 if (rscheck("check_mail", addr, 2354 NULL, e, RSF_RMCOMM|RSF_COUNT, 3, 2355 NULL, e->e_id) != EX_OK || 2356 Errors > 0) 2357 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2358 macdefine(&e->e_macro, A_PERM, 2359 macid("{addr_type}"), NULL); 2360 2361 if (MaxMessageSize > 0 && 2362 (e->e_msgsize > MaxMessageSize || 2363 e->e_msgsize < 0)) 2364 { 2365 usrerr("552 5.2.3 Message size exceeds fixed maximum message size (%ld)", 2366 MaxMessageSize); 2367 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2368 } 2369 2370 /* 2371 ** XXX always check whether there is at least one fs 2372 ** with enough space? 2373 ** However, this may not help much: the queue group 2374 ** selection may later on select a FS that hasn't 2375 ** enough space. 2376 */ 2377 2378 if ((NumFileSys == 1 || NumQueue == 1) && 2379 !enoughdiskspace(e->e_msgsize, e) 2380#if _FFR_ANY_FREE_FS 2381 && !filesys_free(e->e_msgsize) 2382#endif /* _FFR_ANY_FREE_FS */ 2383 ) 2384 { 2385 /* 2386 ** We perform this test again when the 2387 ** queue directory is selected, in collect. 2388 */ 2389 2390 usrerr("452 4.4.5 Insufficient disk space; try again later"); 2391 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2392 } 2393 if (Errors > 0) 2394 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2395 2396 LogUsrErrs = true; 2397#if MILTER 2398 if (smtp.sm_milterlist && smtp.sm_milterize && 2399 !bitset(EF_DISCARD, e->e_flags)) 2400 { 2401 char state; 2402 char *response; 2403 2404 response = milter_envfrom(args, e, &state); 2405 MILTER_REPLY("from"); 2406 } 2407#endif /* MILTER */ 2408 if (Errors > 0) 2409 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2410 2411 message("250 2.1.0 Sender ok"); 2412 smtp.sm_gotmail = true; 2413 } 2414 SM_EXCEPT(exc, "[!F]*") 2415 { 2416 /* 2417 ** An error occurred while processing a MAIL command. 2418 ** Jump to the common error handling code. 2419 */ 2420 2421 sm_exc_free(exc); 2422 goto undo_no_pm; 2423 } 2424 SM_END_TRY 2425 break; 2426 2427 undo_no_pm: 2428 e->e_flags &= ~EF_PM_NOTIFY; 2429 undo: 2430 break; 2431 2432 case CMDRCPT: /* rcpt -- designate recipient */ 2433 DELAY_CONN("RCPT"); 2434 if (BadRcptThrottle > 0 && 2435 n_badrcpts >= BadRcptThrottle) 2436 { 2437 if (LogLevel > 5 && 2438 n_badrcpts == BadRcptThrottle) 2439 { 2440 sm_syslog(LOG_INFO, e->e_id, 2441 "%s: Possible SMTP RCPT flood, throttling.", 2442 CurSmtpClient); 2443 2444 /* To avoid duplicated message */ 2445 n_badrcpts++; 2446 } 2447 NBADRCPTS; 2448 2449 /* 2450 ** Don't use exponential backoff for now. 2451 ** Some servers will open more connections 2452 ** and actually overload the receiver even 2453 ** more. 2454 */ 2455 2456 (void) sleep(1); 2457 } 2458 if (!smtp.sm_gotmail) 2459 { 2460 usrerr("503 5.0.0 Need MAIL before RCPT"); 2461 break; 2462 } 2463 SmtpPhase = "server RCPT"; 2464 SM_TRY 2465 { 2466 QuickAbort = true; 2467 LogUsrErrs = true; 2468 2469 /* limit flooding of our machine */ 2470 if (MaxRcptPerMsg > 0 && 2471 smtp.sm_nrcpts >= MaxRcptPerMsg) 2472 { 2473 /* sleep(1); / * slow down? */ 2474 usrerr("452 4.5.3 Too many recipients"); 2475 goto rcpt_done; 2476 } 2477 2478 if (e->e_sendmode != SM_DELIVER) 2479 e->e_flags |= EF_VRFYONLY; 2480 2481#if MILTER 2482 /* 2483 ** If the filter will be deleting recipients, 2484 ** don't expand them at RCPT time (in the call 2485 ** to recipient()). If they are expanded, it 2486 ** is impossible for removefromlist() to figure 2487 ** out the expanded members of the original 2488 ** recipient and mark them as QS_DONTSEND. 2489 */ 2490 2491 if (milter_can_delrcpts()) 2492 e->e_flags |= EF_VRFYONLY; 2493#endif /* MILTER */ 2494 2495 p = skipword(p, "to"); 2496 if (p == NULL) 2497 goto rcpt_done; 2498 macdefine(&e->e_macro, A_PERM, 2499 macid("{addr_type}"), "e r"); 2500 a = parseaddr(p, NULLADDR, RF_COPYALL, ' ', &delimptr, 2501 e, true); 2502 macdefine(&e->e_macro, A_PERM, 2503 macid("{addr_type}"), NULL); 2504 if (Errors > 0) 2505 goto rcpt_done; 2506 if (a == NULL) 2507 { 2508 usrerr("501 5.0.0 Missing recipient"); 2509 goto rcpt_done; 2510 } 2511 2512 if (delimptr != NULL && *delimptr != '\0') 2513 *delimptr++ = '\0'; 2514 2515 /* put resulting triple from parseaddr() into macros */ 2516 if (a->q_mailer != NULL) 2517 macdefine(&e->e_macro, A_PERM, 2518 macid("{rcpt_mailer}"), 2519 a->q_mailer->m_name); 2520 else 2521 macdefine(&e->e_macro, A_PERM, 2522 macid("{rcpt_mailer}"), NULL); 2523 if (a->q_host != NULL) 2524 macdefine(&e->e_macro, A_PERM, 2525 macid("{rcpt_host}"), a->q_host); 2526 else 2527 macdefine(&e->e_macro, A_PERM, 2528 macid("{rcpt_host}"), "localhost"); 2529 if (a->q_user != NULL) 2530 macdefine(&e->e_macro, A_PERM, 2531 macid("{rcpt_addr}"), a->q_user); 2532 else 2533 macdefine(&e->e_macro, A_PERM, 2534 macid("{rcpt_addr}"), NULL); 2535 if (Errors > 0) 2536 goto rcpt_done; 2537 2538 /* now parse ESMTP arguments */ 2539 addr = p; 2540 argno = 0; 2541 args[argno++] = p; 2542 p = delimptr; 2543 while (p != NULL && *p != '\0') 2544 { 2545 char *kp; 2546 char *vp = NULL; 2547 char *equal = NULL; 2548 2549 /* locate the beginning of the keyword */ 2550 SKIP_SPACE(p); 2551 if (*p == '\0') 2552 break; 2553 kp = p; 2554 2555 /* skip to the value portion */ 2556 while ((isascii(*p) && isalnum(*p)) || *p == '-') 2557 p++; 2558 if (*p == '=') 2559 { 2560 equal = p; 2561 *p++ = '\0'; 2562 vp = p; 2563 2564 /* skip to the end of the value */ 2565 while (*p != '\0' && *p != ' ' && 2566 !(isascii(*p) && iscntrl(*p)) && 2567 *p != '=') 2568 p++; 2569 } 2570 2571 if (*p != '\0') 2572 *p++ = '\0'; 2573 2574 if (tTd(19, 1)) 2575 sm_dprintf("RCPT: got arg %s=\"%s\"\n", kp, 2576 vp == NULL ? "<null>" : vp); 2577 2578 rcpt_esmtp_args(a, kp, vp, e); 2579 if (equal != NULL) 2580 *equal = '='; 2581 args[argno++] = kp; 2582 if (argno >= MAXSMTPARGS - 1) 2583 usrerr("501 5.5.4 Too many parameters"); 2584 if (Errors > 0) 2585 break; 2586 } 2587 args[argno] = NULL; 2588 if (Errors > 0) 2589 goto rcpt_done; 2590 2591 /* do config file checking of the recipient */ 2592 macdefine(&e->e_macro, A_PERM, 2593 macid("{addr_type}"), "e r"); 2594 if (rscheck("check_rcpt", addr, 2595 NULL, e, RSF_RMCOMM|RSF_COUNT, 3, 2596 NULL, e->e_id) != EX_OK || 2597 Errors > 0) 2598 goto rcpt_done; 2599 macdefine(&e->e_macro, A_PERM, 2600 macid("{addr_type}"), NULL); 2601 2602 /* If discarding, don't bother to verify user */ 2603 if (bitset(EF_DISCARD, e->e_flags)) 2604 a->q_state = QS_VERIFIED; 2605 2606#if MILTER 2607 if (smtp.sm_milterlist && smtp.sm_milterize && 2608 !bitset(EF_DISCARD, e->e_flags)) 2609 { 2610 char state; 2611 char *response; 2612 2613 response = milter_envrcpt(args, e, &state); 2614 MILTER_REPLY("to"); 2615 } 2616#endif /* MILTER */ 2617 2618 macdefine(&e->e_macro, A_PERM, 2619 macid("{rcpt_mailer}"), NULL); 2620 macdefine(&e->e_macro, A_PERM, 2621 macid("{rcpt_host}"), NULL); 2622 macdefine(&e->e_macro, A_PERM, 2623 macid("{rcpt_addr}"), NULL); 2624 macdefine(&e->e_macro, A_PERM, 2625 macid("{dsn_notify}"), NULL); 2626 if (Errors > 0) 2627 goto rcpt_done; 2628 2629 /* save in recipient list after ESMTP mods */ 2630 a = recipient(a, &e->e_sendqueue, 0, e); 2631 if (Errors > 0) 2632 goto rcpt_done; 2633 2634 /* no errors during parsing, but might be a duplicate */ 2635 e->e_to = a->q_paddr; 2636 if (!QS_IS_BADADDR(a->q_state)) 2637 { 2638 if (smtp.sm_nrcpts == 0) 2639 initsys(e); 2640 message("250 2.1.5 Recipient ok%s", 2641 QS_IS_QUEUEUP(a->q_state) ? 2642 " (will queue)" : ""); 2643 smtp.sm_nrcpts++; 2644 } 2645 else 2646 { 2647 /* punt -- should keep message in ADDRESS.... */ 2648 usrerr("550 5.1.1 Addressee unknown"); 2649 } 2650 rcpt_done: 2651 if (Errors > 0) 2652 { 2653 ++n_badrcpts; 2654 NBADRCPTS; 2655 } 2656 } 2657 SM_EXCEPT(exc, "[!F]*") 2658 { 2659 /* An exception occurred while processing RCPT */ 2660 e->e_flags &= ~(EF_FATALERRS|EF_PM_NOTIFY); 2661 ++n_badrcpts; 2662 NBADRCPTS; 2663 } 2664 SM_END_TRY 2665 break; 2666 2667 case CMDDATA: /* data -- text of mail */ 2668 DELAY_CONN("DATA"); 2669 if (!smtp_data(&smtp, e)) 2670 goto doquit; 2671 break; 2672 2673 case CMDRSET: /* rset -- reset state */ 2674 if (tTd(94, 100)) 2675 message("451 4.0.0 Test failure"); 2676 else 2677 message("250 2.0.0 Reset state"); 2678 CLEAR_STATE(cmdbuf); 2679 break; 2680 2681 case CMDVRFY: /* vrfy -- verify address */ 2682 case CMDEXPN: /* expn -- expand address */ 2683 vrfy = c->cmd_code == CMDVRFY; 2684 DELAY_CONN(vrfy ? "VRFY" : "EXPN"); 2685 if (tempfail) 2686 { 2687 if (LogLevel > 9) 2688 sm_syslog(LOG_INFO, e->e_id, 2689 "SMTP %s command (%.100s) from %s tempfailed (due to previous checks)", 2690 vrfy ? "VRFY" : "EXPN", 2691 p, CurSmtpClient); 2692 2693 /* RFC 821 doesn't allow 4xy reply code */ 2694 usrerr("550 5.7.1 Please try again later"); 2695 break; 2696 } 2697 wt = checksmtpattack(&n_verifies, MAXVRFYCOMMANDS, 2698 false, vrfy ? "VRFY" : "EXPN", e); 2699 STOP_IF_ATTACK(wt); 2700 previous = curtime(); 2701 if ((vrfy && bitset(PRIV_NOVRFY, PrivacyFlags)) || 2702 (!vrfy && !bitset(SRV_OFFER_EXPN, features))) 2703 { 2704 if (vrfy) 2705 message("252 2.5.2 Cannot VRFY user; try RCPT to attempt delivery (or try finger)"); 2706 else 2707 message("502 5.7.0 Sorry, we do not allow this operation"); 2708 if (LogLevel > 5) 2709 sm_syslog(LOG_INFO, e->e_id, 2710 "%s: %s [rejected]", 2711 CurSmtpClient, 2712 shortenstring(inp, MAXSHORTSTR)); 2713 break; 2714 } 2715 else if (!gothello && 2716 bitset(vrfy ? PRIV_NEEDVRFYHELO : PRIV_NEEDEXPNHELO, 2717 PrivacyFlags)) 2718 { 2719 usrerr("503 5.0.0 I demand that you introduce yourself first"); 2720 break; 2721 } 2722 if (Errors > 0) 2723 break; 2724 if (LogLevel > 5) 2725 sm_syslog(LOG_INFO, e->e_id, "%s: %s", 2726 CurSmtpClient, 2727 shortenstring(inp, MAXSHORTSTR)); 2728 SM_TRY 2729 { 2730 QuickAbort = true; 2731 vrfyqueue = NULL; 2732 if (vrfy) 2733 e->e_flags |= EF_VRFYONLY; 2734 while (*p != '\0' && isascii(*p) && isspace(*p)) 2735 p++; 2736 if (*p == '\0') 2737 { 2738 usrerr("501 5.5.2 Argument required"); 2739 } 2740 else 2741 { 2742 /* do config file checking of the address */ 2743 if (rscheck(vrfy ? "check_vrfy" : "check_expn", 2744 p, NULL, e, RSF_RMCOMM, 2745 3, NULL, NOQID) != EX_OK || 2746 Errors > 0) 2747 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2748 (void) sendtolist(p, NULLADDR, &vrfyqueue, 0, e); 2749 } 2750 if (wt > 0) 2751 { 2752 time_t t; 2753 2754 t = wt - (curtime() - previous); 2755 if (t > 0) 2756 (void) sleep(t); 2757 } 2758 if (Errors > 0) 2759 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2760 if (vrfyqueue == NULL) 2761 { 2762 usrerr("554 5.5.2 Nothing to %s", vrfy ? "VRFY" : "EXPN"); 2763 } 2764 while (vrfyqueue != NULL) 2765 { 2766 if (!QS_IS_UNDELIVERED(vrfyqueue->q_state)) 2767 { 2768 vrfyqueue = vrfyqueue->q_next; 2769 continue; 2770 } 2771 2772 /* see if there is more in the vrfy list */ 2773 a = vrfyqueue; 2774 while ((a = a->q_next) != NULL && 2775 (!QS_IS_UNDELIVERED(a->q_state))) 2776 continue; 2777 printvrfyaddr(vrfyqueue, a == NULL, vrfy); 2778 vrfyqueue = a; 2779 } 2780 } 2781 SM_EXCEPT(exc, "[!F]*") 2782 { 2783 /* 2784 ** An exception occurred while processing VRFY/EXPN 2785 */ 2786 2787 sm_exc_free(exc); 2788 goto undo; 2789 } 2790 SM_END_TRY 2791 break; 2792 2793 case CMDETRN: /* etrn -- force queue flush */ 2794 DELAY_CONN("ETRN"); 2795 2796 /* Don't leak queue information via debug flags */ 2797 if (!bitset(SRV_OFFER_ETRN, features) || UseMSP || 2798 (RealUid != 0 && RealUid != TrustedUid && 2799 OpMode == MD_SMTP)) 2800 { 2801 /* different message for MSA ? */ 2802 message("502 5.7.0 Sorry, we do not allow this operation"); 2803 if (LogLevel > 5) 2804 sm_syslog(LOG_INFO, e->e_id, 2805 "%s: %s [rejected]", 2806 CurSmtpClient, 2807 shortenstring(inp, MAXSHORTSTR)); 2808 break; 2809 } 2810 if (tempfail) 2811 { 2812 if (LogLevel > 9) 2813 sm_syslog(LOG_INFO, e->e_id, 2814 "SMTP ETRN command (%.100s) from %s tempfailed (due to previous checks)", 2815 p, CurSmtpClient); 2816 usrerr(MSG_TEMPFAIL); 2817 break; 2818 } 2819 2820 if (strlen(p) <= 0) 2821 { 2822 usrerr("500 5.5.2 Parameter required"); 2823 break; 2824 } 2825 2826 /* crude way to avoid denial-of-service attacks */ 2827 STOP_IF_ATTACK(checksmtpattack(&n_etrn, MAXETRNCOMMANDS, 2828 true, "ETRN", e)); 2829 2830 /* 2831 ** Do config file checking of the parameter. 2832 ** Even though we have srv_features now, we still 2833 ** need this ruleset because the former is called 2834 ** when the connection has been established, while 2835 ** this ruleset is called when the command is 2836 ** actually issued and therefore has all information 2837 ** available to make a decision. 2838 */ 2839 2840 if (rscheck("check_etrn", p, NULL, e, 2841 RSF_RMCOMM, 3, NULL, NOQID) != EX_OK || 2842 Errors > 0) 2843 break; 2844 2845 if (LogLevel > 5) 2846 sm_syslog(LOG_INFO, e->e_id, 2847 "%s: ETRN %s", CurSmtpClient, 2848 shortenstring(p, MAXSHORTSTR)); 2849 2850 id = p; 2851 if (*id == '#') 2852 { 2853 int i, qgrp; 2854 2855 id++; 2856 qgrp = name2qid(id); 2857 if (!ISVALIDQGRP(qgrp)) 2858 { 2859 usrerr("459 4.5.4 Queue %s unknown", 2860 id); 2861 break; 2862 } 2863 for (i = 0; i < NumQueue && Queue[i] != NULL; 2864 i++) 2865 Queue[i]->qg_nextrun = (time_t) -1; 2866 Queue[qgrp]->qg_nextrun = 0; 2867 ok = run_work_group(Queue[qgrp]->qg_wgrp, 2868 RWG_FORK|RWG_FORCE); 2869 if (ok && Errors == 0) 2870 message("250 2.0.0 Queuing for queue group %s started", id); 2871 break; 2872 } 2873 2874 if (*id == '@') 2875 id++; 2876 else 2877 *--id = '@'; 2878 2879 new = (QUEUE_CHAR *) sm_malloc(sizeof(QUEUE_CHAR)); 2880 if (new == NULL) 2881 { 2882 syserr("500 5.5.0 ETRN out of memory"); 2883 break; 2884 } 2885 new->queue_match = id; 2886 new->queue_negate = false; 2887 new->queue_next = NULL; 2888 QueueLimitRecipient = new; 2889 ok = runqueue(true, false, false, true); 2890 sm_free(QueueLimitRecipient); /* XXX */ 2891 QueueLimitRecipient = NULL; 2892 if (ok && Errors == 0) 2893 message("250 2.0.0 Queuing for node %s started", p); 2894 break; 2895 2896 case CMDHELP: /* help -- give user info */ 2897 DELAY_CONN("HELP"); 2898 help(p, e); 2899 break; 2900 2901 case CMDNOOP: /* noop -- do nothing */ 2902 DELAY_CONN("NOOP"); 2903 STOP_IF_ATTACK(checksmtpattack(&n_noop, MAXNOOPCOMMANDS, 2904 true, "NOOP", e)); 2905 message("250 2.0.0 OK"); 2906 break; 2907 2908 case CMDQUIT: /* quit -- leave mail */ 2909 message("221 2.0.0 %s closing connection", MyHostName); 2910#if PIPELINING 2911 (void) sm_io_flush(OutChannel, SM_TIME_DEFAULT); 2912#endif /* PIPELINING */ 2913 2914 if (smtp.sm_nrcpts > 0) 2915 logundelrcpts(e, "aborted by sender", 9, false); 2916 2917 /* arrange to ignore any current send list */ 2918 e->e_sendqueue = NULL; 2919 2920#if STARTTLS 2921 /* shutdown TLS connection */ 2922 if (tls_active) 2923 { 2924 (void) endtls(srv_ssl, "server"); 2925 tls_active = false; 2926 } 2927#endif /* STARTTLS */ 2928#if SASL 2929 if (authenticating == SASL_IS_AUTH) 2930 { 2931 sasl_dispose(&conn); 2932 authenticating = SASL_NOT_AUTH; 2933 /* XXX sasl_done(); this is a child */ 2934 } 2935#endif /* SASL */ 2936 2937doquit: 2938 /* avoid future 050 messages */ 2939 disconnect(1, e); 2940 2941#if MILTER 2942 /* close out milter filters */ 2943 milter_quit(e); 2944#endif /* MILTER */ 2945 2946 if (LogLevel > 4 && bitset(EF_LOGSENDER, e->e_flags)) 2947 logsender(e, NULL); 2948 e->e_flags &= ~EF_LOGSENDER; 2949 2950 if (lognullconnection && LogLevel > 5 && 2951 nullserver == NULL) 2952 { 2953 char *d; 2954 2955 d = macvalue(macid("{daemon_name}"), e); 2956 if (d == NULL) 2957 d = "stdin"; 2958 2959 /* 2960 ** even though this id is "bogus", it makes 2961 ** it simpler to "grep" related events, e.g., 2962 ** timeouts for the same connection. 2963 */ 2964 2965 sm_syslog(LOG_INFO, e->e_id, 2966 "%s did not issue MAIL/EXPN/VRFY/ETRN during connection to %s", 2967 CurSmtpClient, d); 2968 } 2969 if (tTd(93, 100)) 2970 { 2971 /* return to handle next connection */ 2972 return; 2973 } 2974 finis(true, true, ExitStat); 2975 /* NOTREACHED */ 2976 2977 case CMDVERB: /* set verbose mode */ 2978 DELAY_CONN("VERB"); 2979 if (!bitset(SRV_OFFER_EXPN, features) || 2980 !bitset(SRV_OFFER_VERB, features)) 2981 { 2982 /* this would give out the same info */ 2983 message("502 5.7.0 Verbose unavailable"); 2984 break; 2985 } 2986 STOP_IF_ATTACK(checksmtpattack(&n_noop, MAXNOOPCOMMANDS, 2987 true, "VERB", e)); 2988 Verbose = 1; 2989 set_delivery_mode(SM_DELIVER, e); 2990 message("250 2.0.0 Verbose mode"); 2991 break; 2992 2993#if SMTPDEBUG 2994 case CMDDBGQSHOW: /* show queues */ 2995 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, 2996 "Send Queue="); 2997 printaddr(smioout, e->e_sendqueue, true); 2998 break; 2999 3000 case CMDDBGDEBUG: /* set debug mode */ 3001 tTsetup(tTdvect, sizeof tTdvect, "0-99.1"); 3002 tTflag(p); 3003 message("200 2.0.0 Debug set"); 3004 break; 3005 3006#else /* SMTPDEBUG */ 3007 case CMDDBGQSHOW: /* show queues */ 3008 case CMDDBGDEBUG: /* set debug mode */ 3009#endif /* SMTPDEBUG */ 3010 case CMDLOGBOGUS: /* bogus command */ 3011 DELAY_CONN("Bogus"); 3012 if (LogLevel > 0) 3013 sm_syslog(LOG_CRIT, e->e_id, 3014 "\"%s\" command from %s (%.100s)", 3015 c->cmd_name, CurSmtpClient, 3016 anynet_ntoa(&RealHostAddr)); 3017 /* FALLTHROUGH */ 3018 3019 case CMDERROR: /* unknown command */ 3020#if MAXBADCOMMANDS > 0 3021 if (++n_badcmds > MAXBADCOMMANDS) 3022 { 3023 stopattack: 3024 message("421 4.7.0 %s Too many bad commands; closing connection", 3025 MyHostName); 3026 3027 /* arrange to ignore any current send list */ 3028 e->e_sendqueue = NULL; 3029 goto doquit; 3030 } 3031#endif /* MAXBADCOMMANDS > 0 */ 3032 3033#if MILTER && SMFI_VERSION > 2 3034 if (smtp.sm_milterlist && smtp.sm_milterize && 3035 !bitset(EF_DISCARD, e->e_flags)) 3036 { 3037 char state; 3038 char *response; 3039 3040 if (MilterLogLevel > 9) 3041 sm_syslog(LOG_INFO, e->e_id, 3042 "Sending \"%s\" to Milter", inp); 3043 response = milter_unknown(inp, e, &state); 3044 MILTER_REPLY("unknown"); 3045 if (state == SMFIR_REPLYCODE || 3046 state == SMFIR_REJECT || 3047 state == SMFIR_TEMPFAIL) 3048 { 3049 /* MILTER_REPLY already gave an error */ 3050 break; 3051 } 3052 } 3053#endif /* MILTER && SMFI_VERSION > 2 */ 3054 3055 usrerr("500 5.5.1 Command unrecognized: \"%s\"", 3056 shortenstring(inp, MAXSHORTSTR)); 3057 break; 3058 3059 case CMDUNIMPL: 3060 DELAY_CONN("Unimpl"); 3061 usrerr("502 5.5.1 Command not implemented: \"%s\"", 3062 shortenstring(inp, MAXSHORTSTR)); 3063 break; 3064 3065 default: 3066 DELAY_CONN("default"); 3067 errno = 0; 3068 syserr("500 5.5.0 smtp: unknown code %d", c->cmd_code); 3069 break; 3070 } 3071#if SASL 3072 } 3073#endif /* SASL */ 3074 } 3075 SM_EXCEPT(exc, "[!F]*") 3076 { 3077 /* 3078 ** The only possible exception is "E:mta.quickabort". 3079 ** There is nothing to do except fall through and loop. 3080 */ 3081 } 3082 SM_END_TRY 3083 } 3084} 3085/* 3086** SMTP_DATA -- implement the SMTP DATA command. 3087** 3088** Parameters: 3089** smtp -- status of SMTP connection. 3090** e -- envelope. 3091** 3092** Returns: 3093** true iff SMTP session can continue. 3094** 3095** Side Effects: 3096** possibly sends message. 3097*/ 3098 3099static bool 3100smtp_data(smtp, e) 3101 SMTP_T *smtp; 3102 ENVELOPE *e; 3103{ 3104#if MILTER 3105 bool milteraccept; 3106#endif /* MILTER */ 3107 bool aborting; 3108 bool doublequeue; 3109 ADDRESS *a; 3110 ENVELOPE *ee; 3111 char *id; 3112 char *oldid; 3113 char buf[32]; 3114 3115 SmtpPhase = "server DATA"; 3116 if (!smtp->sm_gotmail) 3117 { 3118 usrerr("503 5.0.0 Need MAIL command"); 3119 return true; 3120 } 3121 else if (smtp->sm_nrcpts <= 0) 3122 { 3123 usrerr("503 5.0.0 Need RCPT (recipient)"); 3124 return true; 3125 } 3126 (void) sm_snprintf(buf, sizeof buf, "%u", smtp->sm_nrcpts); 3127 if (rscheck("check_data", buf, NULL, e, 3128 RSF_RMCOMM|RSF_UNSTRUCTURED|RSF_COUNT, 3, NULL, 3129 e->e_id) != EX_OK) 3130 return true; 3131 3132#if MILTER && SMFI_VERSION > 3 3133 if (smtp->sm_milterlist && smtp->sm_milterize && 3134 !bitset(EF_DISCARD, e->e_flags)) 3135 { 3136 char state; 3137 char *response; 3138 int savelogusrerrs = LogUsrErrs; 3139 3140 response = milter_data_cmd(e, &state); 3141 switch (state) 3142 { 3143 case SMFIR_REPLYCODE: 3144 if (MilterLogLevel > 3) 3145 { 3146 sm_syslog(LOG_INFO, e->e_id, 3147 "Milter: cmd=data, reject=%s", 3148 response); 3149 LogUsrErrs = false; 3150 } 3151 usrerr(response); 3152 if (strncmp(response, "421 ", 4) == 0) 3153 { 3154 e->e_sendqueue = NULL; 3155 return false; 3156 } 3157 return true; 3158 3159 case SMFIR_REJECT: 3160 if (MilterLogLevel > 3) 3161 { 3162 sm_syslog(LOG_INFO, e->e_id, 3163 "Milter: cmd=data, reject=550 5.7.1 Command rejected"); 3164 LogUsrErrs = false; 3165 } 3166 usrerr("550 5.7.1 Command rejected"); 3167 return true; 3168 3169 case SMFIR_DISCARD: 3170 if (MilterLogLevel > 3) 3171 sm_syslog(LOG_INFO, e->e_id, 3172 "Milter: cmd=data, discard"); 3173 e->e_flags |= EF_DISCARD; 3174 break; 3175 3176 case SMFIR_TEMPFAIL: 3177 if (MilterLogLevel > 3) 3178 { 3179 sm_syslog(LOG_INFO, e->e_id, 3180 "Milter: cmd=data, reject=%s", 3181 MSG_TEMPFAIL); 3182 LogUsrErrs = false; 3183 } 3184 usrerr(MSG_TEMPFAIL); 3185 return true; 3186 } 3187 LogUsrErrs = savelogusrerrs; 3188 if (response != NULL) 3189 sm_free(response); /* XXX */ 3190 } 3191#endif /* MILTER && SMFI_VERSION > 3 */ 3192 3193 /* put back discard bit */ 3194 if (smtp->sm_discard) 3195 e->e_flags |= EF_DISCARD; 3196 3197 /* check to see if we need to re-expand aliases */ 3198 /* also reset QS_BADADDR on already-diagnosted addrs */ 3199 doublequeue = false; 3200 for (a = e->e_sendqueue; a != NULL; a = a->q_next) 3201 { 3202 if (QS_IS_VERIFIED(a->q_state) && 3203 !bitset(EF_DISCARD, e->e_flags)) 3204 { 3205 /* need to re-expand aliases */ 3206 doublequeue = true; 3207 } 3208 if (QS_IS_BADADDR(a->q_state)) 3209 { 3210 /* make this "go away" */ 3211 a->q_state = QS_DONTSEND; 3212 } 3213 } 3214 3215 /* collect the text of the message */ 3216 SmtpPhase = "collect"; 3217 buffer_errors(); 3218 3219 collect(InChannel, true, NULL, e, true); 3220 3221 /* redefine message size */ 3222 (void) sm_snprintf(buf, sizeof buf, "%ld", e->e_msgsize); 3223 macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"), buf); 3224 3225#if _FFR_CHECK_EOM 3226 /* rscheck() will set Errors or EF_DISCARD if it trips */ 3227 (void) rscheck("check_eom", buf, NULL, e, RSF_UNSTRUCTURED|RSF_COUNT, 3228 3, NULL, e->e_id); 3229#endif /* _FFR_CHECK_EOM */ 3230 3231#if MILTER 3232 milteraccept = true; 3233 if (smtp->sm_milterlist && smtp->sm_milterize && 3234 Errors <= 0 && 3235 !bitset(EF_DISCARD, e->e_flags)) 3236 { 3237 char state; 3238 char *response; 3239 3240 response = milter_data(e, &state); 3241 switch (state) 3242 { 3243 case SMFIR_REPLYCODE: 3244 if (MilterLogLevel > 3) 3245 sm_syslog(LOG_INFO, e->e_id, 3246 "Milter: data, reject=%s", 3247 response); 3248 milteraccept = false; 3249 usrerr(response); 3250 break; 3251 3252 case SMFIR_REJECT: 3253 milteraccept = false; 3254 if (MilterLogLevel > 3) 3255 sm_syslog(LOG_INFO, e->e_id, 3256 "Milter: data, reject=554 5.7.1 Command rejected"); 3257 usrerr("554 5.7.1 Command rejected"); 3258 break; 3259 3260 case SMFIR_DISCARD: 3261 if (MilterLogLevel > 3) 3262 sm_syslog(LOG_INFO, e->e_id, 3263 "Milter: data, discard"); 3264 milteraccept = false; 3265 e->e_flags |= EF_DISCARD; 3266 break; 3267 3268 case SMFIR_TEMPFAIL: 3269 if (MilterLogLevel > 3) 3270 sm_syslog(LOG_INFO, e->e_id, 3271 "Milter: data, reject=%s", 3272 MSG_TEMPFAIL); 3273 milteraccept = false; 3274 usrerr(MSG_TEMPFAIL); 3275 break; 3276 } 3277 if (response != NULL) 3278 sm_free(response); 3279 } 3280 3281 /* Milter may have changed message size */ 3282 (void) sm_snprintf(buf, sizeof buf, "%ld", e->e_msgsize); 3283 macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"), buf); 3284 3285 /* abort message filters that didn't get the body & log msg is OK */ 3286 if (smtp->sm_milterlist && smtp->sm_milterize) 3287 { 3288 milter_abort(e); 3289 if (milteraccept && MilterLogLevel > 9) 3290 sm_syslog(LOG_INFO, e->e_id, "Milter accept: message"); 3291 } 3292 3293 /* 3294 ** If SuperSafe is SAFE_REALLY_POSTMILTER, and we don't have milter or 3295 ** milter accepted message, sync it now 3296 ** 3297 ** XXX This is almost a copy of the code in collect(): put it into 3298 ** a function that is called from both places? 3299 */ 3300 3301 if (milteraccept && SuperSafe == SAFE_REALLY_POSTMILTER) 3302 { 3303 int afd; 3304 SM_FILE_T *volatile df; 3305 char *dfname; 3306 3307 df = e->e_dfp; 3308 dfname = queuename(e, DATAFL_LETTER); 3309 if (sm_io_setinfo(df, SM_BF_COMMIT, NULL) < 0 3310 && errno != EINVAL) 3311 { 3312 int save_errno; 3313 3314 save_errno = errno; 3315 if (save_errno == EEXIST) 3316 { 3317 struct stat st; 3318 int dfd; 3319 3320 if (stat(dfname, &st) < 0) 3321 st.st_size = -1; 3322 errno = EEXIST; 3323 syserr("@collect: bfcommit(%s): already on disk, size=%ld", 3324 dfname, (long) st.st_size); 3325 dfd = sm_io_getinfo(df, SM_IO_WHAT_FD, NULL); 3326 if (dfd >= 0) 3327 dumpfd(dfd, true, true); 3328 } 3329 errno = save_errno; 3330 dferror(df, "bfcommit", e); 3331 flush_errors(true); 3332 finis(save_errno != EEXIST, true, ExitStat); 3333 } 3334 else if ((afd = sm_io_getinfo(df, SM_IO_WHAT_FD, NULL)) < 0) 3335 { 3336 dferror(df, "sm_io_getinfo", e); 3337 flush_errors(true); 3338 finis(true, true, ExitStat); 3339 /* NOTREACHED */ 3340 } 3341 else if (fsync(afd) < 0) 3342 { 3343 dferror(df, "fsync", e); 3344 flush_errors(true); 3345 finis(true, true, ExitStat); 3346 /* NOTREACHED */ 3347 } 3348 else if (sm_io_close(df, SM_TIME_DEFAULT) < 0) 3349 { 3350 dferror(df, "sm_io_close", e); 3351 flush_errors(true); 3352 finis(true, true, ExitStat); 3353 /* NOTREACHED */ 3354 } 3355 3356 /* Now reopen the df file */ 3357 e->e_dfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, dfname, 3358 SM_IO_RDONLY, NULL); 3359 if (e->e_dfp == NULL) 3360 { 3361 /* we haven't acked receipt yet, so just chuck this */ 3362 syserr("@Cannot reopen %s", dfname); 3363 finis(true, true, ExitStat); 3364 /* NOTREACHED */ 3365 } 3366 } 3367#endif /* MILTER */ 3368 3369 /* Check if quarantining stats should be updated */ 3370 if (e->e_quarmsg != NULL) 3371 markstats(e, NULL, STATS_QUARANTINE); 3372 3373 /* 3374 ** If a header/body check (header checks or milter) 3375 ** set EF_DISCARD, don't queueup the message -- 3376 ** that would lose the EF_DISCARD bit and deliver 3377 ** the message. 3378 */ 3379 3380 if (bitset(EF_DISCARD, e->e_flags)) 3381 doublequeue = false; 3382 3383 aborting = Errors > 0; 3384 if (!(aborting || bitset(EF_DISCARD, e->e_flags)) && 3385 (QueueMode == QM_QUARANTINE || e->e_quarmsg == NULL) && 3386 !split_by_recipient(e)) 3387 aborting = bitset(EF_FATALERRS, e->e_flags); 3388 3389 if (aborting) 3390 { 3391 /* Log who the mail would have gone to */ 3392 logundelrcpts(e, e->e_message, 8, false); 3393 flush_errors(true); 3394 buffer_errors(); 3395 goto abortmessage; 3396 } 3397 3398 /* from now on, we have to operate silently */ 3399 buffer_errors(); 3400 3401#if 0 3402 /* 3403 ** Clear message, it may contain an error from the SMTP dialogue. 3404 ** This error must not show up in the queue. 3405 ** Some error message should show up, e.g., alias database 3406 ** not available, but others shouldn't, e.g., from check_rcpt. 3407 */ 3408 3409 e->e_message = NULL; 3410#endif /* 0 */ 3411 3412 /* 3413 ** Arrange to send to everyone. 3414 ** If sending to multiple people, mail back 3415 ** errors rather than reporting directly. 3416 ** In any case, don't mail back errors for 3417 ** anything that has happened up to 3418 ** now (the other end will do this). 3419 ** Truncate our transcript -- the mail has gotten 3420 ** to us successfully, and if we have 3421 ** to mail this back, it will be easier 3422 ** on the reader. 3423 ** Then send to everyone. 3424 ** Finally give a reply code. If an error has 3425 ** already been given, don't mail a 3426 ** message back. 3427 ** We goose error returns by clearing error bit. 3428 */ 3429 3430 SmtpPhase = "delivery"; 3431 (void) sm_io_setinfo(e->e_xfp, SM_BF_TRUNCATE, NULL); 3432 id = e->e_id; 3433 3434#if NAMED_BIND 3435 _res.retry = TimeOuts.res_retry[RES_TO_FIRST]; 3436 _res.retrans = TimeOuts.res_retrans[RES_TO_FIRST]; 3437#endif /* NAMED_BIND */ 3438 3439 for (ee = e; ee != NULL; ee = ee->e_sibling) 3440 { 3441 /* make sure we actually do delivery */ 3442 ee->e_flags &= ~EF_CLRQUEUE; 3443 3444 /* from now on, operate silently */ 3445 ee->e_errormode = EM_MAIL; 3446 3447 if (doublequeue) 3448 { 3449 /* make sure it is in the queue */ 3450 queueup(ee, false, true); 3451 } 3452 else 3453 { 3454 /* send to all recipients */ 3455 sendall(ee, SM_DEFAULT); 3456 } 3457 ee->e_to = NULL; 3458 } 3459 3460 /* put back id for SMTP logging in putoutmsg() */ 3461 oldid = CurEnv->e_id; 3462 CurEnv->e_id = id; 3463 3464 /* issue success message */ 3465 message("250 2.0.0 %s Message accepted for delivery", id); 3466 CurEnv->e_id = oldid; 3467 3468 /* if we just queued, poke it */ 3469 if (doublequeue) 3470 { 3471 bool anything_to_send = false; 3472 3473 sm_getla(); 3474 for (ee = e; ee != NULL; ee = ee->e_sibling) 3475 { 3476 if (WILL_BE_QUEUED(ee->e_sendmode)) 3477 continue; 3478 if (shouldqueue(ee->e_msgpriority, ee->e_ctime)) 3479 { 3480 ee->e_sendmode = SM_QUEUE; 3481 continue; 3482 } 3483 else if (QueueMode != QM_QUARANTINE && 3484 ee->e_quarmsg != NULL) 3485 { 3486 ee->e_sendmode = SM_QUEUE; 3487 continue; 3488 } 3489 anything_to_send = true; 3490 3491 /* close all the queue files */ 3492 closexscript(ee); 3493 if (ee->e_dfp != NULL) 3494 { 3495 (void) sm_io_close(ee->e_dfp, SM_TIME_DEFAULT); 3496 ee->e_dfp = NULL; 3497 } 3498 unlockqueue(ee); 3499 } 3500 if (anything_to_send) 3501 { 3502#if PIPELINING 3503 /* 3504 ** XXX if we don't do this, we get 250 twice 3505 ** because it is also flushed in the child. 3506 */ 3507 3508 (void) sm_io_flush(OutChannel, SM_TIME_DEFAULT); 3509#endif /* PIPELINING */ 3510 (void) doworklist(e, true, true); 3511 } 3512 } 3513 3514 abortmessage: 3515 if (LogLevel > 4 && bitset(EF_LOGSENDER, e->e_flags)) 3516 logsender(e, NULL); 3517 e->e_flags &= ~EF_LOGSENDER; 3518 3519 /* clean up a bit */ 3520 smtp->sm_gotmail = false; 3521 3522 /* 3523 ** Call dropenvelope if and only if the envelope is *not* 3524 ** being processed by the child process forked by doworklist(). 3525 */ 3526 3527 if (aborting || bitset(EF_DISCARD, e->e_flags)) 3528 dropenvelope(e, true, false); 3529 else 3530 { 3531 for (ee = e; ee != NULL; ee = ee->e_sibling) 3532 { 3533 if (!doublequeue && 3534 QueueMode != QM_QUARANTINE && 3535 ee->e_quarmsg != NULL) 3536 { 3537 dropenvelope(ee, true, false); 3538 continue; 3539 } 3540 if (WILL_BE_QUEUED(ee->e_sendmode)) 3541 dropenvelope(ee, true, false); 3542 } 3543 } 3544 sm_rpool_free(e->e_rpool); 3545 3546 /* 3547 ** At this point, e == &MainEnvelope, but if we did splitting, 3548 ** then CurEnv may point to an envelope structure that was just 3549 ** freed with the rpool. So reset CurEnv *before* calling 3550 ** newenvelope. 3551 */ 3552 3553 CurEnv = e; 3554 newenvelope(e, e, sm_rpool_new_x(NULL)); 3555 e->e_flags = BlankEnvelope.e_flags; 3556 3557 /* restore connection quarantining */ 3558 if (smtp->sm_quarmsg == NULL) 3559 { 3560 e->e_quarmsg = NULL; 3561 macdefine(&e->e_macro, A_PERM, macid("{quarantine}"), ""); 3562 } 3563 else 3564 { 3565 e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool, smtp->sm_quarmsg); 3566 macdefine(&e->e_macro, A_PERM, 3567 macid("{quarantine}"), e->e_quarmsg); 3568 } 3569 return true; 3570} 3571/* 3572** LOGUNDELRCPTS -- log undelivered (or all) recipients. 3573** 3574** Parameters: 3575** e -- envelope. 3576** msg -- message for Stat= 3577** level -- log level. 3578** all -- log all recipients. 3579** 3580** Returns: 3581** none. 3582** 3583** Side Effects: 3584** logs undelivered (or all) recipients 3585*/ 3586 3587void 3588logundelrcpts(e, msg, level, all) 3589 ENVELOPE *e; 3590 char *msg; 3591 int level; 3592 bool all; 3593{ 3594 ADDRESS *a; 3595 3596 if (LogLevel <= level || msg == NULL || *msg == '\0') 3597 return; 3598 3599 /* Clear $h so relay= doesn't get mislogged by logdelivery() */ 3600 macdefine(&e->e_macro, A_PERM, 'h', NULL); 3601 3602 /* Log who the mail would have gone to */ 3603 for (a = e->e_sendqueue; a != NULL; a = a->q_next) 3604 { 3605 if (!QS_IS_UNDELIVERED(a->q_state) && !all) 3606 continue; 3607 e->e_to = a->q_paddr; 3608 logdelivery(NULL, NULL, a->q_status, msg, NULL, 3609 (time_t) 0, e); 3610 } 3611 e->e_to = NULL; 3612} 3613/* 3614** CHECKSMTPATTACK -- check for denial-of-service attack by repetition 3615** 3616** Parameters: 3617** pcounter -- pointer to a counter for this command. 3618** maxcount -- maximum value for this counter before we 3619** slow down. 3620** waitnow -- sleep now (in this routine)? 3621** cname -- command name for logging. 3622** e -- the current envelope. 3623** 3624** Returns: 3625** time to wait, 3626** STOP_ATTACK if twice as many commands as allowed and 3627** MaxChildren > 0. 3628** 3629** Side Effects: 3630** Slows down if we seem to be under attack. 3631*/ 3632 3633static time_t 3634checksmtpattack(pcounter, maxcount, waitnow, cname, e) 3635 volatile unsigned int *pcounter; 3636 unsigned int maxcount; 3637 bool waitnow; 3638 char *cname; 3639 ENVELOPE *e; 3640{ 3641 if (maxcount <= 0) /* no limit */ 3642 return (time_t) 0; 3643 3644 if (++(*pcounter) >= maxcount) 3645 { 3646 unsigned int shift; 3647 time_t s; 3648 3649 if (*pcounter == maxcount && LogLevel > 5) 3650 { 3651 sm_syslog(LOG_INFO, e->e_id, 3652 "%s: possible SMTP attack: command=%.40s, count=%u", 3653 CurSmtpClient, cname, *pcounter); 3654 } 3655 shift = *pcounter - maxcount; 3656 s = 1 << shift; 3657 if (shift > MAXSHIFT || s >= MAXTIMEOUT || s <= 0) 3658 s = MAXTIMEOUT; 3659 3660#define IS_ATTACK(s) ((MaxChildren > 0 && *pcounter >= maxcount * 2) \ 3661 ? STOP_ATTACK : (time_t) s) 3662 3663 /* sleep at least 1 second before returning */ 3664 (void) sleep(*pcounter / maxcount); 3665 s -= *pcounter / maxcount; 3666 if (s >= MAXTIMEOUT || s < 0) 3667 s = MAXTIMEOUT; 3668 if (waitnow && s > 0) 3669 { 3670 (void) sleep(s); 3671 return IS_ATTACK(0); 3672 } 3673 return IS_ATTACK(s); 3674 } 3675 return (time_t) 0; 3676} 3677/* 3678** SETUP_SMTPD_IO -- setup I/O fd correctly for the SMTP server 3679** 3680** Parameters: 3681** none. 3682** 3683** Returns: 3684** nothing. 3685** 3686** Side Effects: 3687** may change I/O fd. 3688*/ 3689 3690static void 3691setup_smtpd_io() 3692{ 3693 int inchfd, outchfd, outfd; 3694 3695 inchfd = sm_io_getinfo(InChannel, SM_IO_WHAT_FD, NULL); 3696 outchfd = sm_io_getinfo(OutChannel, SM_IO_WHAT_FD, NULL); 3697 outfd = sm_io_getinfo(smioout, SM_IO_WHAT_FD, NULL); 3698 if (outchfd != outfd) 3699 { 3700 /* arrange for debugging output to go to remote host */ 3701 (void) dup2(outchfd, outfd); 3702 } 3703 3704 /* 3705 ** if InChannel and OutChannel are stdin/stdout 3706 ** and connected to ttys 3707 ** and fcntl(STDIN, F_SETFL, O_NONBLOCKING) also changes STDOUT, 3708 ** then "chain" them together. 3709 */ 3710 3711 if (inchfd == STDIN_FILENO && outchfd == STDOUT_FILENO && 3712 isatty(inchfd) && isatty(outchfd)) 3713 { 3714 int inmode, outmode; 3715 3716 inmode = fcntl(inchfd, F_GETFL, 0); 3717 if (inmode == -1) 3718 { 3719 if (LogLevel > 11) 3720 sm_syslog(LOG_INFO, NOQID, 3721 "fcntl(inchfd, F_GETFL) failed: %s", 3722 sm_errstring(errno)); 3723 return; 3724 } 3725 outmode = fcntl(outchfd, F_GETFL, 0); 3726 if (outmode == -1) 3727 { 3728 if (LogLevel > 11) 3729 sm_syslog(LOG_INFO, NOQID, 3730 "fcntl(outchfd, F_GETFL) failed: %s", 3731 sm_errstring(errno)); 3732 return; 3733 } 3734 if (bitset(O_NONBLOCK, inmode) || 3735 bitset(O_NONBLOCK, outmode) || 3736 fcntl(inchfd, F_SETFL, inmode | O_NONBLOCK) == -1) 3737 return; 3738 outmode = fcntl(outchfd, F_GETFL, 0); 3739 if (outmode != -1 && bitset(O_NONBLOCK, outmode)) 3740 { 3741 /* changing InChannel also changes OutChannel */ 3742 sm_io_automode(OutChannel, InChannel); 3743 if (tTd(97, 4) && LogLevel > 9) 3744 sm_syslog(LOG_INFO, NOQID, 3745 "set automode for I (%d)/O (%d) in SMTP server", 3746 inchfd, outchfd); 3747 } 3748 3749 /* undo change of inchfd */ 3750 (void) fcntl(inchfd, F_SETFL, inmode); 3751 } 3752} 3753/* 3754** SKIPWORD -- skip a fixed word. 3755** 3756** Parameters: 3757** p -- place to start looking. 3758** w -- word to skip. 3759** 3760** Returns: 3761** p following w. 3762** NULL on error. 3763** 3764** Side Effects: 3765** clobbers the p data area. 3766*/ 3767 3768static char * 3769skipword(p, w) 3770 register char *volatile p; 3771 char *w; 3772{ 3773 register char *q; 3774 char *firstp = p; 3775 3776 /* find beginning of word */ 3777 SKIP_SPACE(p); 3778 q = p; 3779 3780 /* find end of word */ 3781 while (*p != '\0' && *p != ':' && !(isascii(*p) && isspace(*p))) 3782 p++; 3783 while (isascii(*p) && isspace(*p)) 3784 *p++ = '\0'; 3785 if (*p != ':') 3786 { 3787 syntax: 3788 usrerr("501 5.5.2 Syntax error in parameters scanning \"%s\"", 3789 shortenstring(firstp, MAXSHORTSTR)); 3790 return NULL; 3791 } 3792 *p++ = '\0'; 3793 SKIP_SPACE(p); 3794 3795 if (*p == '\0') 3796 goto syntax; 3797 3798 /* see if the input word matches desired word */ 3799 if (sm_strcasecmp(q, w)) 3800 goto syntax; 3801 3802 return p; 3803} 3804/* 3805** MAIL_ESMTP_ARGS -- process ESMTP arguments from MAIL line 3806** 3807** Parameters: 3808** kp -- the parameter key. 3809** vp -- the value of that parameter. 3810** e -- the envelope. 3811** 3812** Returns: 3813** none. 3814*/ 3815 3816static void 3817mail_esmtp_args(kp, vp, e) 3818 char *kp; 3819 char *vp; 3820 ENVELOPE *e; 3821{ 3822 if (sm_strcasecmp(kp, "size") == 0) 3823 { 3824 if (vp == NULL) 3825 { 3826 usrerr("501 5.5.2 SIZE requires a value"); 3827 /* NOTREACHED */ 3828 } 3829 macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"), vp); 3830 errno = 0; 3831 e->e_msgsize = strtol(vp, (char **) NULL, 10); 3832 if (e->e_msgsize == LONG_MAX && errno == ERANGE) 3833 { 3834 usrerr("552 5.2.3 Message size exceeds maximum value"); 3835 /* NOTREACHED */ 3836 } 3837 if (e->e_msgsize < 0) 3838 { 3839 usrerr("552 5.2.3 Message size invalid"); 3840 /* NOTREACHED */ 3841 } 3842 } 3843 else if (sm_strcasecmp(kp, "body") == 0) 3844 { 3845 if (vp == NULL) 3846 { 3847 usrerr("501 5.5.2 BODY requires a value"); 3848 /* NOTREACHED */ 3849 } 3850 else if (sm_strcasecmp(vp, "8bitmime") == 0) 3851 { 3852 SevenBitInput = false; 3853 } 3854 else if (sm_strcasecmp(vp, "7bit") == 0) 3855 { 3856 SevenBitInput = true; 3857 } 3858 else 3859 { 3860 usrerr("501 5.5.4 Unknown BODY type %s", vp); 3861 /* NOTREACHED */ 3862 } 3863 e->e_bodytype = sm_rpool_strdup_x(e->e_rpool, vp); 3864 } 3865 else if (sm_strcasecmp(kp, "envid") == 0) 3866 { 3867 if (bitset(PRIV_NORECEIPTS, PrivacyFlags)) 3868 { 3869 usrerr("504 5.7.0 Sorry, ENVID not supported, we do not allow DSN"); 3870 /* NOTREACHED */ 3871 } 3872 if (vp == NULL) 3873 { 3874 usrerr("501 5.5.2 ENVID requires a value"); 3875 /* NOTREACHED */ 3876 } 3877 if (!xtextok(vp)) 3878 { 3879 usrerr("501 5.5.4 Syntax error in ENVID parameter value"); 3880 /* NOTREACHED */ 3881 } 3882 if (e->e_envid != NULL) 3883 { 3884 usrerr("501 5.5.0 Duplicate ENVID parameter"); 3885 /* NOTREACHED */ 3886 } 3887 e->e_envid = sm_rpool_strdup_x(e->e_rpool, vp); 3888 macdefine(&e->e_macro, A_PERM, 3889 macid("{dsn_envid}"), e->e_envid); 3890 } 3891 else if (sm_strcasecmp(kp, "ret") == 0) 3892 { 3893 if (bitset(PRIV_NORECEIPTS, PrivacyFlags)) 3894 { 3895 usrerr("504 5.7.0 Sorry, RET not supported, we do not allow DSN"); 3896 /* NOTREACHED */ 3897 } 3898 if (vp == NULL) 3899 { 3900 usrerr("501 5.5.2 RET requires a value"); 3901 /* NOTREACHED */ 3902 } 3903 if (bitset(EF_RET_PARAM, e->e_flags)) 3904 { 3905 usrerr("501 5.5.0 Duplicate RET parameter"); 3906 /* NOTREACHED */ 3907 } 3908 e->e_flags |= EF_RET_PARAM; 3909 if (sm_strcasecmp(vp, "hdrs") == 0) 3910 e->e_flags |= EF_NO_BODY_RETN; 3911 else if (sm_strcasecmp(vp, "full") != 0) 3912 { 3913 usrerr("501 5.5.2 Bad argument \"%s\" to RET", vp); 3914 /* NOTREACHED */ 3915 } 3916 macdefine(&e->e_macro, A_TEMP, macid("{dsn_ret}"), vp); 3917 } 3918#if SASL 3919 else if (sm_strcasecmp(kp, "auth") == 0) 3920 { 3921 int len; 3922 char *q; 3923 char *auth_param; /* the value of the AUTH=x */ 3924 bool saveQuickAbort = QuickAbort; 3925 bool saveSuprErrs = SuprErrs; 3926 bool saveExitStat = ExitStat; 3927 3928 if (vp == NULL) 3929 { 3930 usrerr("501 5.5.2 AUTH= requires a value"); 3931 /* NOTREACHED */ 3932 } 3933 if (e->e_auth_param != NULL) 3934 { 3935 usrerr("501 5.5.0 Duplicate AUTH parameter"); 3936 /* NOTREACHED */ 3937 } 3938 if ((q = strchr(vp, ' ')) != NULL) 3939 len = q - vp + 1; 3940 else 3941 len = strlen(vp) + 1; 3942 auth_param = xalloc(len); 3943 (void) sm_strlcpy(auth_param, vp, len); 3944 if (!xtextok(auth_param)) 3945 { 3946 usrerr("501 5.5.4 Syntax error in AUTH parameter value"); 3947 /* just a warning? */ 3948 /* NOTREACHED */ 3949 } 3950 3951 /* XXX define this always or only if trusted? */ 3952 macdefine(&e->e_macro, A_TEMP, macid("{auth_author}"), 3953 auth_param); 3954 3955 /* 3956 ** call Strust_auth to find out whether 3957 ** auth_param is acceptable (trusted) 3958 ** we shouldn't trust it if not authenticated 3959 ** (required by RFC, leave it to ruleset?) 3960 */ 3961 3962 SuprErrs = true; 3963 QuickAbort = false; 3964 if (strcmp(auth_param, "<>") != 0 && 3965 (rscheck("trust_auth", auth_param, NULL, e, RSF_RMCOMM, 3966 9, NULL, NOQID) != EX_OK || Errors > 0)) 3967 { 3968 if (tTd(95, 8)) 3969 { 3970 q = e->e_auth_param; 3971 sm_dprintf("auth=\"%.100s\" not trusted user=\"%.100s\"\n", 3972 auth_param, (q == NULL) ? "" : q); 3973 } 3974 3975 /* not trusted */ 3976 e->e_auth_param = "<>"; 3977# if _FFR_AUTH_PASSING 3978 macdefine(&BlankEnvelope.e_macro, A_PERM, 3979 macid("{auth_author}"), NULL); 3980# endif /* _FFR_AUTH_PASSING */ 3981 } 3982 else 3983 { 3984 if (tTd(95, 8)) 3985 sm_dprintf("auth=\"%.100s\" trusted\n", auth_param); 3986 e->e_auth_param = sm_rpool_strdup_x(e->e_rpool, 3987 auth_param); 3988 } 3989 sm_free(auth_param); /* XXX */ 3990 3991 /* reset values */ 3992 Errors = 0; 3993 QuickAbort = saveQuickAbort; 3994 SuprErrs = saveSuprErrs; 3995 ExitStat = saveExitStat; 3996 } 3997#endif /* SASL */ 3998#define PRTCHAR(c) ((isascii(c) && isprint(c)) ? (c) : '?') 3999 4000 /* 4001 ** "by" is only accepted if DeliverByMin >= 0. 4002 ** We maybe could add this to the list of server_features. 4003 */ 4004 4005 else if (sm_strcasecmp(kp, "by") == 0 && DeliverByMin >= 0) 4006 { 4007 char *s; 4008 4009 if (vp == NULL) 4010 { 4011 usrerr("501 5.5.2 BY= requires a value"); 4012 /* NOTREACHED */ 4013 } 4014 errno = 0; 4015 e->e_deliver_by = strtol(vp, &s, 10); 4016 if (e->e_deliver_by == LONG_MIN || 4017 e->e_deliver_by == LONG_MAX || 4018 e->e_deliver_by > 999999999l || 4019 e->e_deliver_by < -999999999l) 4020 { 4021 usrerr("501 5.5.2 BY=%s out of range", vp); 4022 /* NOTREACHED */ 4023 } 4024 if (s == NULL || *s != ';') 4025 { 4026 usrerr("501 5.5.2 BY= missing ';'"); 4027 /* NOTREACHED */ 4028 } 4029 e->e_dlvr_flag = 0; 4030 ++s; /* XXX: spaces allowed? */ 4031 SKIP_SPACE(s); 4032 switch (tolower(*s)) 4033 { 4034 case 'n': 4035 e->e_dlvr_flag = DLVR_NOTIFY; 4036 break; 4037 case 'r': 4038 e->e_dlvr_flag = DLVR_RETURN; 4039 if (e->e_deliver_by <= 0) 4040 { 4041 usrerr("501 5.5.4 mode R requires BY time > 0"); 4042 /* NOTREACHED */ 4043 } 4044 if (DeliverByMin > 0 && e->e_deliver_by > 0 && 4045 e->e_deliver_by < DeliverByMin) 4046 { 4047 usrerr("555 5.5.2 time %ld less than %ld", 4048 e->e_deliver_by, (long) DeliverByMin); 4049 /* NOTREACHED */ 4050 } 4051 break; 4052 default: 4053 usrerr("501 5.5.2 illegal by-mode '%c'", PRTCHAR(*s)); 4054 /* NOTREACHED */ 4055 } 4056 ++s; /* XXX: spaces allowed? */ 4057 SKIP_SPACE(s); 4058 switch (tolower(*s)) 4059 { 4060 case 't': 4061 e->e_dlvr_flag |= DLVR_TRACE; 4062 break; 4063 case '\0': 4064 break; 4065 default: 4066 usrerr("501 5.5.2 illegal by-trace '%c'", PRTCHAR(*s)); 4067 /* NOTREACHED */ 4068 } 4069 4070 /* XXX: check whether more characters follow? */ 4071 } 4072 else 4073 { 4074 usrerr("555 5.5.4 %s parameter unrecognized", kp); 4075 /* NOTREACHED */ 4076 } 4077} 4078/* 4079** RCPT_ESMTP_ARGS -- process ESMTP arguments from RCPT line 4080** 4081** Parameters: 4082** a -- the address corresponding to the To: parameter. 4083** kp -- the parameter key. 4084** vp -- the value of that parameter. 4085** e -- the envelope. 4086** 4087** Returns: 4088** none. 4089*/ 4090 4091static void 4092rcpt_esmtp_args(a, kp, vp, e) 4093 ADDRESS *a; 4094 char *kp; 4095 char *vp; 4096 ENVELOPE *e; 4097{ 4098 if (sm_strcasecmp(kp, "notify") == 0) 4099 { 4100 char *p; 4101 4102 if (bitset(PRIV_NORECEIPTS, PrivacyFlags)) 4103 { 4104 usrerr("504 5.7.0 Sorry, NOTIFY not supported, we do not allow DSN"); 4105 /* NOTREACHED */ 4106 } 4107 if (vp == NULL) 4108 { 4109 usrerr("501 5.5.2 NOTIFY requires a value"); 4110 /* NOTREACHED */ 4111 } 4112 a->q_flags &= ~(QPINGONSUCCESS|QPINGONFAILURE|QPINGONDELAY); 4113 a->q_flags |= QHASNOTIFY; 4114 macdefine(&e->e_macro, A_TEMP, macid("{dsn_notify}"), vp); 4115 4116 if (sm_strcasecmp(vp, "never") == 0) 4117 return; 4118 for (p = vp; p != NULL; vp = p) 4119 { 4120 char *s; 4121 4122 s = p = strchr(p, ','); 4123 if (p != NULL) 4124 *p++ = '\0'; 4125 if (sm_strcasecmp(vp, "success") == 0) 4126 a->q_flags |= QPINGONSUCCESS; 4127 else if (sm_strcasecmp(vp, "failure") == 0) 4128 a->q_flags |= QPINGONFAILURE; 4129 else if (sm_strcasecmp(vp, "delay") == 0) 4130 a->q_flags |= QPINGONDELAY; 4131 else 4132 { 4133 usrerr("501 5.5.4 Bad argument \"%s\" to NOTIFY", 4134 vp); 4135 /* NOTREACHED */ 4136 } 4137 if (s != NULL) 4138 *s = ','; 4139 } 4140 } 4141 else if (sm_strcasecmp(kp, "orcpt") == 0) 4142 { 4143 if (bitset(PRIV_NORECEIPTS, PrivacyFlags)) 4144 { 4145 usrerr("504 5.7.0 Sorry, ORCPT not supported, we do not allow DSN"); 4146 /* NOTREACHED */ 4147 } 4148 if (vp == NULL) 4149 { 4150 usrerr("501 5.5.2 ORCPT requires a value"); 4151 /* NOTREACHED */ 4152 } 4153 if (strchr(vp, ';') == NULL || !xtextok(vp)) 4154 { 4155 usrerr("501 5.5.4 Syntax error in ORCPT parameter value"); 4156 /* NOTREACHED */ 4157 } 4158 if (a->q_orcpt != NULL) 4159 { 4160 usrerr("501 5.5.0 Duplicate ORCPT parameter"); 4161 /* NOTREACHED */ 4162 } 4163 a->q_orcpt = sm_rpool_strdup_x(e->e_rpool, vp); 4164 } 4165 else 4166 { 4167 usrerr("555 5.5.4 %s parameter unrecognized", kp); 4168 /* NOTREACHED */ 4169 } 4170} 4171/* 4172** PRINTVRFYADDR -- print an entry in the verify queue 4173** 4174** Parameters: 4175** a -- the address to print. 4176** last -- set if this is the last one. 4177** vrfy -- set if this is a VRFY command. 4178** 4179** Returns: 4180** none. 4181** 4182** Side Effects: 4183** Prints the appropriate 250 codes. 4184*/ 4185#define OFFF (3 + 1 + 5 + 1) /* offset in fmt: SMTP reply + enh. code */ 4186 4187static void 4188printvrfyaddr(a, last, vrfy) 4189 register ADDRESS *a; 4190 bool last; 4191 bool vrfy; 4192{ 4193 char fmtbuf[30]; 4194 4195 if (vrfy && a->q_mailer != NULL && 4196 !bitnset(M_VRFY250, a->q_mailer->m_flags)) 4197 (void) sm_strlcpy(fmtbuf, "252", sizeof fmtbuf); 4198 else 4199 (void) sm_strlcpy(fmtbuf, "250", sizeof fmtbuf); 4200 fmtbuf[3] = last ? ' ' : '-'; 4201 (void) sm_strlcpy(&fmtbuf[4], "2.1.5 ", sizeof fmtbuf - 4); 4202 if (a->q_fullname == NULL) 4203 { 4204 if ((a->q_mailer == NULL || 4205 a->q_mailer->m_addrtype == NULL || 4206 sm_strcasecmp(a->q_mailer->m_addrtype, "rfc822") == 0) && 4207 strchr(a->q_user, '@') == NULL) 4208 (void) sm_strlcpy(&fmtbuf[OFFF], "<%s@%s>", 4209 sizeof fmtbuf - OFFF); 4210 else 4211 (void) sm_strlcpy(&fmtbuf[OFFF], "<%s>", 4212 sizeof fmtbuf - OFFF); 4213 message(fmtbuf, a->q_user, MyHostName); 4214 } 4215 else 4216 { 4217 if ((a->q_mailer == NULL || 4218 a->q_mailer->m_addrtype == NULL || 4219 sm_strcasecmp(a->q_mailer->m_addrtype, "rfc822") == 0) && 4220 strchr(a->q_user, '@') == NULL) 4221 (void) sm_strlcpy(&fmtbuf[OFFF], "%s <%s@%s>", 4222 sizeof fmtbuf - OFFF); 4223 else 4224 (void) sm_strlcpy(&fmtbuf[OFFF], "%s <%s>", 4225 sizeof fmtbuf - OFFF); 4226 message(fmtbuf, a->q_fullname, a->q_user, MyHostName); 4227 } 4228} 4229 4230#if SASL 4231/* 4232** SASLMECHS -- get list of possible AUTH mechanisms 4233** 4234** Parameters: 4235** conn -- SASL connection info. 4236** mechlist -- output parameter for list of mechanisms. 4237** 4238** Returns: 4239** number of mechs. 4240*/ 4241 4242static int 4243saslmechs(conn, mechlist) 4244 sasl_conn_t *conn; 4245 char **mechlist; 4246{ 4247 int len, num, result; 4248 4249 /* "user" is currently unused */ 4250# if SASL >= 20000 4251 result = sasl_listmech(conn, NULL, 4252 "", " ", "", (const char **) mechlist, 4253 (unsigned int *)&len, &num); 4254# else /* SASL >= 20000 */ 4255 result = sasl_listmech(conn, "user", /* XXX */ 4256 "", " ", "", mechlist, 4257 (unsigned int *)&len, (unsigned int *)&num); 4258# endif /* SASL >= 20000 */ 4259 if (result != SASL_OK) 4260 { 4261 if (LogLevel > 9) 4262 sm_syslog(LOG_WARNING, NOQID, 4263 "AUTH error: listmech=%d, num=%d", 4264 result, num); 4265 num = 0; 4266 } 4267 if (num > 0) 4268 { 4269 if (LogLevel > 11) 4270 sm_syslog(LOG_INFO, NOQID, 4271 "AUTH: available mech=%s, allowed mech=%s", 4272 *mechlist, AuthMechanisms); 4273 *mechlist = intersect(AuthMechanisms, *mechlist, NULL); 4274 } 4275 else 4276 { 4277 *mechlist = NULL; /* be paranoid... */ 4278 if (result == SASL_OK && LogLevel > 9) 4279 sm_syslog(LOG_WARNING, NOQID, 4280 "AUTH warning: no mechanisms"); 4281 } 4282 return num; 4283} 4284 4285# if SASL >= 20000 4286/* 4287** PROXY_POLICY -- define proxy policy for AUTH 4288** 4289** Parameters: 4290** conn -- unused. 4291** context -- unused. 4292** requested_user -- authorization identity. 4293** rlen -- authorization identity length. 4294** auth_identity -- authentication identity. 4295** alen -- authentication identity length. 4296** def_realm -- default user realm. 4297** urlen -- user realm length. 4298** propctx -- unused. 4299** 4300** Returns: 4301** ok? 4302** 4303** Side Effects: 4304** sets {auth_authen} macro. 4305*/ 4306 4307int 4308proxy_policy(conn, context, requested_user, rlen, auth_identity, alen, 4309 def_realm, urlen, propctx) 4310 sasl_conn_t *conn; 4311 void *context; 4312 const char *requested_user; 4313 unsigned rlen; 4314 const char *auth_identity; 4315 unsigned alen; 4316 const char *def_realm; 4317 unsigned urlen; 4318 struct propctx *propctx; 4319{ 4320 if (auth_identity == NULL) 4321 return SASL_FAIL; 4322 4323 macdefine(&BlankEnvelope.e_macro, A_TEMP, 4324 macid("{auth_authen}"), (char *) auth_identity); 4325 4326 return SASL_OK; 4327} 4328# else /* SASL >= 20000 */ 4329 4330/* 4331** PROXY_POLICY -- define proxy policy for AUTH 4332** 4333** Parameters: 4334** context -- unused. 4335** auth_identity -- authentication identity. 4336** requested_user -- authorization identity. 4337** user -- allowed user (output). 4338** errstr -- possible error string (output). 4339** 4340** Returns: 4341** ok? 4342*/ 4343 4344int 4345proxy_policy(context, auth_identity, requested_user, user, errstr) 4346 void *context; 4347 const char *auth_identity; 4348 const char *requested_user; 4349 const char **user; 4350 const char **errstr; 4351{ 4352 if (user == NULL || auth_identity == NULL) 4353 return SASL_FAIL; 4354 *user = newstr(auth_identity); 4355 return SASL_OK; 4356} 4357# endif /* SASL >= 20000 */ 4358#endif /* SASL */ 4359 4360#if STARTTLS 4361/* 4362** INITSRVTLS -- initialize server side TLS 4363** 4364** Parameters: 4365** tls_ok -- should tls initialization be done? 4366** 4367** Returns: 4368** succeeded? 4369** 4370** Side Effects: 4371** sets tls_ok_srv which is a static variable in this module. 4372** Do NOT remove assignments to it! 4373*/ 4374 4375bool 4376initsrvtls(tls_ok) 4377 bool tls_ok; 4378{ 4379 if (!tls_ok) 4380 return false; 4381 4382 /* do NOT remove assignment */ 4383 tls_ok_srv = inittls(&srv_ctx, TLS_Srv_Opts, true, SrvCertFile, 4384 SrvKeyFile, CACertPath, CACertFile, DHParams); 4385 return tls_ok_srv; 4386} 4387#endif /* STARTTLS */ 4388/* 4389** SRVFEATURES -- get features for SMTP server 4390** 4391** Parameters: 4392** e -- envelope (should be session context). 4393** clientname -- name of client. 4394** features -- default features for this invocation. 4395** 4396** Returns: 4397** server features. 4398*/ 4399 4400/* table with options: it uses just one character, how about strings? */ 4401static struct 4402{ 4403 char srvf_opt; 4404 unsigned int srvf_flag; 4405} srv_feat_table[] = 4406{ 4407 { 'A', SRV_OFFER_AUTH }, 4408 { 'B', SRV_OFFER_VERB }, 4409 { 'C', SRV_REQ_SEC }, 4410 { 'D', SRV_OFFER_DSN }, 4411 { 'E', SRV_OFFER_ETRN }, 4412 { 'L', SRV_REQ_AUTH }, 4413#if PIPELINING 4414# if _FFR_NO_PIPE 4415 { 'N', SRV_NO_PIPE }, 4416# endif /* _FFR_NO_PIPE */ 4417 { 'P', SRV_OFFER_PIPE }, 4418#endif /* PIPELINING */ 4419 { 'R', SRV_VRFY_CLT }, /* same as V; not documented */ 4420 { 'S', SRV_OFFER_TLS }, 4421/* { 'T', SRV_TMP_FAIL }, */ 4422 { 'V', SRV_VRFY_CLT }, 4423 { 'X', SRV_OFFER_EXPN }, 4424/* { 'Y', SRV_OFFER_VRFY }, */ 4425 { '\0', SRV_NONE } 4426}; 4427 4428static unsigned int 4429srvfeatures(e, clientname, features) 4430 ENVELOPE *e; 4431 char *clientname; 4432 unsigned int features; 4433{ 4434 int r, i, j; 4435 char **pvp, c, opt; 4436 char pvpbuf[PSBUFSIZE]; 4437 4438 pvp = NULL; 4439 r = rscap("srv_features", clientname, "", e, &pvp, pvpbuf, 4440 sizeof(pvpbuf)); 4441 if (r != EX_OK) 4442 return features; 4443 if (pvp == NULL || pvp[0] == NULL || (pvp[0][0] & 0377) != CANONNET) 4444 return features; 4445 if (pvp[1] != NULL && sm_strncasecmp(pvp[1], "temp", 4) == 0) 4446 return SRV_TMP_FAIL; 4447 4448 /* 4449 ** General rule (see sendmail.h, d_flags): 4450 ** lower case: required/offered, upper case: Not required/available 4451 ** 4452 ** Since we can change some features per daemon, we have both 4453 ** cases here: turn on/off a feature. 4454 */ 4455 4456 for (i = 1; pvp[i] != NULL; i++) 4457 { 4458 c = pvp[i][0]; 4459 j = 0; 4460 for (;;) 4461 { 4462 if ((opt = srv_feat_table[j].srvf_opt) == '\0') 4463 { 4464 if (LogLevel > 9) 4465 sm_syslog(LOG_WARNING, e->e_id, 4466 "srvfeatures: unknown feature %s", 4467 pvp[i]); 4468 break; 4469 } 4470 if (c == opt) 4471 { 4472 features &= ~(srv_feat_table[j].srvf_flag); 4473 break; 4474 } 4475 if (c == tolower(opt)) 4476 { 4477 features |= srv_feat_table[j].srvf_flag; 4478 break; 4479 } 4480 ++j; 4481 } 4482 } 4483 return features; 4484} 4485 4486/* 4487** HELP -- implement the HELP command. 4488** 4489** Parameters: 4490** topic -- the topic we want help for. 4491** e -- envelope. 4492** 4493** Returns: 4494** none. 4495** 4496** Side Effects: 4497** outputs the help file to message output. 4498*/ 4499#define HELPVSTR "#vers " 4500#define HELPVERSION 2 4501 4502void 4503help(topic, e) 4504 char *topic; 4505 ENVELOPE *e; 4506{ 4507 register SM_FILE_T *hf; 4508 register char *p; 4509 int len; 4510 bool noinfo; 4511 bool first = true; 4512 long sff = SFF_OPENASROOT|SFF_REGONLY; 4513 char buf[MAXLINE]; 4514 char inp[MAXLINE]; 4515 static int foundvers = -1; 4516 extern char Version[]; 4517 4518 if (DontLockReadFiles) 4519 sff |= SFF_NOLOCK; 4520 if (!bitnset(DBS_HELPFILEINUNSAFEDIRPATH, DontBlameSendmail)) 4521 sff |= SFF_SAFEDIRPATH; 4522 4523 if (HelpFile == NULL || 4524 (hf = safefopen(HelpFile, O_RDONLY, 0444, sff)) == NULL) 4525 { 4526 /* no help */ 4527 errno = 0; 4528 message("502 5.3.0 Sendmail %s -- HELP not implemented", 4529 Version); 4530 return; 4531 } 4532 4533 if (topic == NULL || *topic == '\0') 4534 { 4535 topic = "smtp"; 4536 noinfo = false; 4537 } 4538 else 4539 { 4540 makelower(topic); 4541 noinfo = true; 4542 } 4543 4544 len = strlen(topic); 4545 4546 while (sm_io_fgets(hf, SM_TIME_DEFAULT, buf, sizeof buf) != NULL) 4547 { 4548 if (buf[0] == '#') 4549 { 4550 if (foundvers < 0 && 4551 strncmp(buf, HELPVSTR, strlen(HELPVSTR)) == 0) 4552 { 4553 int h; 4554 4555 if (sm_io_sscanf(buf + strlen(HELPVSTR), "%d", 4556 &h) == 1) 4557 foundvers = h; 4558 } 4559 continue; 4560 } 4561 if (strncmp(buf, topic, len) == 0) 4562 { 4563 if (first) 4564 { 4565 first = false; 4566 4567 /* print version if no/old vers# in file */ 4568 if (foundvers < 2 && !noinfo) 4569 message("214-2.0.0 This is Sendmail version %s", Version); 4570 } 4571 p = strpbrk(buf, " \t"); 4572 if (p == NULL) 4573 p = buf + strlen(buf) - 1; 4574 else 4575 p++; 4576 fixcrlf(p, true); 4577 if (foundvers >= 2) 4578 { 4579 translate_dollars(p); 4580 expand(p, inp, sizeof inp, e); 4581 p = inp; 4582 } 4583 message("214-2.0.0 %s", p); 4584 noinfo = false; 4585 } 4586 } 4587 4588 if (noinfo) 4589 message("504 5.3.0 HELP topic \"%.10s\" unknown", topic); 4590 else 4591 message("214 2.0.0 End of HELP info"); 4592 4593 if (foundvers != 0 && foundvers < HELPVERSION) 4594 { 4595 if (LogLevel > 1) 4596 sm_syslog(LOG_WARNING, e->e_id, 4597 "%s too old (require version %d)", 4598 HelpFile, HELPVERSION); 4599 4600 /* avoid log next time */ 4601 foundvers = 0; 4602 } 4603 4604 (void) sm_io_close(hf, SM_TIME_DEFAULT); 4605} 4606 4607#if SASL 4608/* 4609** RESET_SASLCONN -- reset SASL connection data 4610** 4611** Parameters: 4612** conn -- SASL connection context 4613** hostname -- host name 4614** various connection data 4615** 4616** Returns: 4617** SASL result 4618*/ 4619 4620static int 4621reset_saslconn(sasl_conn_t **conn, char *hostname, 4622# if SASL >= 20000 4623 char *remoteip, char *localip, 4624 char *auth_id, sasl_ssf_t * ext_ssf) 4625# else /* SASL >= 20000 */ 4626 struct sockaddr_in *saddr_r, struct sockaddr_in *saddr_l, 4627 sasl_external_properties_t * ext_ssf) 4628# endif /* SASL >= 20000 */ 4629{ 4630 int result; 4631 4632 sasl_dispose(conn); 4633# if SASL >= 20000 4634 result = sasl_server_new("smtp", hostname, NULL, NULL, NULL, 4635 NULL, 0, conn); 4636# elif SASL > 10505 4637 /* use empty realm: only works in SASL > 1.5.5 */ 4638 result = sasl_server_new("smtp", hostname, "", NULL, 0, conn); 4639# else /* SASL >= 20000 */ 4640 /* use no realm -> realm is set to hostname by SASL lib */ 4641 result = sasl_server_new("smtp", hostname, NULL, NULL, 0, 4642 conn); 4643# endif /* SASL >= 20000 */ 4644 if (result != SASL_OK) 4645 return result; 4646 4647# if SASL >= 20000 4648# if NETINET || NETINET6 4649 if (remoteip != NULL && *remoteip != '\0') 4650 result = sasl_setprop(*conn, SASL_IPREMOTEPORT, remoteip); 4651 if (result != SASL_OK) 4652 return result; 4653 4654 if (localip != NULL && *localip != '\0') 4655 result = sasl_setprop(*conn, SASL_IPLOCALPORT, localip); 4656 if (result != SASL_OK) 4657 return result; 4658# endif /* NETINET || NETINET6 */ 4659 4660 result = sasl_setprop(*conn, SASL_SSF_EXTERNAL, ext_ssf); 4661 if (result != SASL_OK) 4662 return result; 4663 4664 result = sasl_setprop(*conn, SASL_AUTH_EXTERNAL, auth_id); 4665 if (result != SASL_OK) 4666 return result; 4667# else /* SASL >= 20000 */ 4668# if NETINET 4669 if (saddr_r != NULL) 4670 result = sasl_setprop(*conn, SASL_IP_REMOTE, saddr_r); 4671 if (result != SASL_OK) 4672 return result; 4673 4674 if (saddr_l != NULL) 4675 result = sasl_setprop(*conn, SASL_IP_LOCAL, saddr_l); 4676 if (result != SASL_OK) 4677 return result; 4678# endif /* NETINET */ 4679 4680 result = sasl_setprop(*conn, SASL_SSF_EXTERNAL, ext_ssf); 4681 if (result != SASL_OK) 4682 return result; 4683# endif /* SASL >= 20000 */ 4684 return SASL_OK; 4685} 4686#endif /* SASL */ 4687