1 /* 2 * Copyright (c) 1998-2004 Sendmail, Inc. and its suppliers. 3 * All rights reserved. 4 * Copyright (c) 1983, 1995-1997 Eric P. Allman. All rights reserved. 5 * Copyright (c) 1988, 1993 6 * The Regents of the University of California. All rights reserved. 7 * 8 * By using this file, you agree to the terms and conditions set 9 * forth in the LICENSE file which can be found at the top level of 10 * the sendmail distribution. 11 * 12 */ 13 14 #include <sendmail.h> 15 #if MILTER 16 # include <libmilter/mfapi.h> 17 # include <libmilter/mfdef.h> 18 #endif /* MILTER */ 19 20 SM_RCSID("@(#)$Id: srvrsmtp.c,v 8.900 2004/07/08 23:29:33 ca Exp $") 21 22 #include <sys/time.h> 23 #include <sm/fdset.h> 24 25 #if SASL || STARTTLS 26 # include "sfsasl.h" 27 #endif /* SASL || STARTTLS */ 28 #if SASL 29 # define ENC64LEN(l) (((l) + 2) * 4 / 3 + 1) 30 static int saslmechs __P((sasl_conn_t *, char **)); 31 #endif /* SASL */ 32 #if STARTTLS 33 # include <sysexits.h> 34 35 static SSL_CTX *srv_ctx = NULL; /* TLS server context */ 36 static SSL *srv_ssl = NULL; /* per connection context */ 37 38 static bool tls_ok_srv = false; 39 40 extern void tls_set_verify __P((SSL_CTX *, SSL *, bool)); 41 # define TLS_VERIFY_CLIENT() tls_set_verify(srv_ctx, srv_ssl, \ 42 bitset(SRV_VRFY_CLT, features)) 43 #endif /* STARTTLS */ 44 45 /* server features */ 46 #define SRV_NONE 0x0000 /* none... */ 47 #define SRV_OFFER_TLS 0x0001 /* offer STARTTLS */ 48 #define SRV_VRFY_CLT 0x0002 /* request a cert */ 49 #define SRV_OFFER_AUTH 0x0004 /* offer AUTH */ 50 #define SRV_OFFER_ETRN 0x0008 /* offer ETRN */ 51 #define SRV_OFFER_VRFY 0x0010 /* offer VRFY (not yet used) */ 52 #define SRV_OFFER_EXPN 0x0020 /* offer EXPN */ 53 #define SRV_OFFER_VERB 0x0040 /* offer VERB */ 54 #define SRV_OFFER_DSN 0x0080 /* offer DSN */ 55 #if PIPELINING 56 # define SRV_OFFER_PIPE 0x0100 /* offer PIPELINING */ 57 # if _FFR_NO_PIPE 58 # define SRV_NO_PIPE 0x0200 /* disable PIPELINING, sleep if used */ 59 # endif /* _FFR_NO_PIPE */ 60 #endif /* PIPELINING */ 61 #define SRV_REQ_AUTH 0x0400 /* require AUTH */ 62 #define SRV_REQ_SEC 0x0800 /* require security - equiv to AuthOptions=p */ 63 #define SRV_TMP_FAIL 0x1000 /* ruleset caused a temporary failure */ 64 65 static unsigned int srvfeatures __P((ENVELOPE *, char *, unsigned int)); 66 67 #define STOP_ATTACK ((time_t) -1) 68 static time_t checksmtpattack __P((volatile unsigned int *, unsigned int, 69 bool, char *, ENVELOPE *)); 70 static void mail_esmtp_args __P((char *, char *, ENVELOPE *)); 71 static void printvrfyaddr __P((ADDRESS *, bool, bool)); 72 static void rcpt_esmtp_args __P((ADDRESS *, char *, char *, ENVELOPE *)); 73 static char *skipword __P((char *volatile, char *)); 74 static void setup_smtpd_io __P((void)); 75 76 #if SASL 77 # if SASL >= 20000 78 static int reset_saslconn __P((sasl_conn_t **_conn, char *_hostname, 79 char *_remoteip, char *_localip, 80 char *_auth_id, sasl_ssf_t *_ext_ssf)); 81 82 # define RESET_SASLCONN \ 83 result = reset_saslconn(&conn, AuthRealm, remoteip, localip, auth_id, \ 84 &ext_ssf); \ 85 if (result != SASL_OK) \ 86 { \ 87 /* This is pretty fatal */ \ 88 goto doquit; \ 89 } 90 91 # else /* SASL >= 20000 */ 92 static int reset_saslconn __P((sasl_conn_t **_conn, char *_hostname, 93 struct sockaddr_in *_saddr_r, 94 struct sockaddr_in *_saddr_l, 95 sasl_external_properties_t *_ext_ssf)); 96 # define RESET_SASLCONN \ 97 result = reset_saslconn(&conn, AuthRealm, &saddr_r, &saddr_l, &ext_ssf); \ 98 if (result != SASL_OK) \ 99 { \ 100 /* This is pretty fatal */ \ 101 goto doquit; \ 102 } 103 104 # endif /* SASL >= 20000 */ 105 #endif /* SASL */ 106 107 extern ENVELOPE BlankEnvelope; 108 109 #define NBADRCPTS \ 110 do \ 111 { \ 112 char buf[16]; \ 113 (void) sm_snprintf(buf, sizeof buf, "%d", \ 114 BadRcptThrottle > 0 && n_badrcpts > BadRcptThrottle \ 115 ? n_badrcpts - 1 : n_badrcpts); \ 116 macdefine(&e->e_macro, A_TEMP, macid("{nbadrcpts}"), buf); \ 117 } while (0) 118 119 #define SKIP_SPACE(s) while (isascii(*s) && isspace(*s)) \ 120 (s)++ 121 122 /* 123 ** SMTP -- run the SMTP protocol. 124 ** 125 ** Parameters: 126 ** nullserver -- if non-NULL, rejection message for 127 ** (almost) all SMTP commands. 128 ** d_flags -- daemon flags 129 ** e -- the envelope. 130 ** 131 ** Returns: 132 ** never. 133 ** 134 ** Side Effects: 135 ** Reads commands from the input channel and processes them. 136 */ 137 138 /* 139 ** Notice: The smtp server doesn't have a session context like the client 140 ** side has (mci). Therefore some data (session oriented) is allocated 141 ** or assigned to the "wrong" structure (esp. STARTTLS, AUTH). 142 ** This should be fixed in a successor version. 143 */ 144 145 struct cmd 146 { 147 char *cmd_name; /* command name */ 148 int cmd_code; /* internal code, see below */ 149 }; 150 151 /* values for cmd_code */ 152 #define CMDERROR 0 /* bad command */ 153 #define CMDMAIL 1 /* mail -- designate sender */ 154 #define CMDRCPT 2 /* rcpt -- designate recipient */ 155 #define CMDDATA 3 /* data -- send message text */ 156 #define CMDRSET 4 /* rset -- reset state */ 157 #define CMDVRFY 5 /* vrfy -- verify address */ 158 #define CMDEXPN 6 /* expn -- expand address */ 159 #define CMDNOOP 7 /* noop -- do nothing */ 160 #define CMDQUIT 8 /* quit -- close connection and die */ 161 #define CMDHELO 9 /* helo -- be polite */ 162 #define CMDHELP 10 /* help -- give usage info */ 163 #define CMDEHLO 11 /* ehlo -- extended helo (RFC 1425) */ 164 #define CMDETRN 12 /* etrn -- flush queue */ 165 #if SASL 166 # define CMDAUTH 13 /* auth -- SASL authenticate */ 167 #endif /* SASL */ 168 #if STARTTLS 169 # define CMDSTLS 14 /* STARTTLS -- start TLS session */ 170 #endif /* STARTTLS */ 171 /* non-standard commands */ 172 #define CMDVERB 17 /* verb -- go into verbose mode */ 173 /* unimplemented commands from RFC 821 */ 174 #define CMDUNIMPL 19 /* unimplemented rfc821 commands */ 175 /* use this to catch and log "door handle" attempts on your system */ 176 #define CMDLOGBOGUS 23 /* bogus command that should be logged */ 177 /* debugging-only commands, only enabled if SMTPDEBUG is defined */ 178 #define CMDDBGQSHOW 24 /* showq -- show send queue */ 179 #define CMDDBGDEBUG 25 /* debug -- set debug mode */ 180 181 /* 182 ** Note: If you change this list, remember to update 'helpfile' 183 */ 184 185 static struct cmd CmdTab[] = 186 { 187 { "mail", CMDMAIL }, 188 { "rcpt", CMDRCPT }, 189 { "data", CMDDATA }, 190 { "rset", CMDRSET }, 191 { "vrfy", CMDVRFY }, 192 { "expn", CMDEXPN }, 193 { "help", CMDHELP }, 194 { "noop", CMDNOOP }, 195 { "quit", CMDQUIT }, 196 { "helo", CMDHELO }, 197 { "ehlo", CMDEHLO }, 198 { "etrn", CMDETRN }, 199 { "verb", CMDVERB }, 200 { "send", CMDUNIMPL }, 201 { "saml", CMDUNIMPL }, 202 { "soml", CMDUNIMPL }, 203 { "turn", CMDUNIMPL }, 204 #if SASL 205 { "auth", CMDAUTH, }, 206 #endif /* SASL */ 207 #if STARTTLS 208 { "starttls", CMDSTLS, }, 209 #endif /* STARTTLS */ 210 /* remaining commands are here only to trap and log attempts to use them */ 211 { "showq", CMDDBGQSHOW }, 212 { "debug", CMDDBGDEBUG }, 213 { "wiz", CMDLOGBOGUS }, 214 215 { NULL, CMDERROR } 216 }; 217 218 static char *CurSmtpClient; /* who's at the other end of channel */ 219 220 #ifndef MAXBADCOMMANDS 221 # define MAXBADCOMMANDS 25 /* maximum number of bad commands */ 222 #endif /* ! MAXBADCOMMANDS */ 223 #ifndef MAXNOOPCOMMANDS 224 # define MAXNOOPCOMMANDS 20 /* max "noise" commands before slowdown */ 225 #endif /* ! MAXNOOPCOMMANDS */ 226 #ifndef MAXHELOCOMMANDS 227 # define MAXHELOCOMMANDS 3 /* max HELO/EHLO commands before slowdown */ 228 #endif /* ! MAXHELOCOMMANDS */ 229 #ifndef MAXVRFYCOMMANDS 230 # define MAXVRFYCOMMANDS 6 /* max VRFY/EXPN commands before slowdown */ 231 #endif /* ! MAXVRFYCOMMANDS */ 232 #ifndef MAXETRNCOMMANDS 233 # define MAXETRNCOMMANDS 8 /* max ETRN commands before slowdown */ 234 #endif /* ! MAXETRNCOMMANDS */ 235 #ifndef MAXTIMEOUT 236 # define MAXTIMEOUT (4 * 60) /* max timeout for bad commands */ 237 #endif /* ! MAXTIMEOUT */ 238 239 /* 240 ** Maximum shift value to compute timeout for bad commands. 241 ** This introduces an upper limit of 2^MAXSHIFT for the timeout. 242 */ 243 244 #ifndef MAXSHIFT 245 # define MAXSHIFT 8 246 #endif /* ! MAXSHIFT */ 247 #if MAXSHIFT > 31 248 ERROR _MAXSHIFT > 31 is invalid 249 #endif /* MAXSHIFT */ 250 251 252 #if MAXBADCOMMANDS > 0 253 # define STOP_IF_ATTACK(r) do \ 254 { \ 255 if ((r) == STOP_ATTACK) \ 256 goto stopattack; \ 257 } while (0) 258 259 #else /* MAXBADCOMMANDS > 0 */ 260 # define STOP_IF_ATTACK(r) r 261 #endif /* MAXBADCOMMANDS > 0 */ 262 263 264 #if SM_HEAP_CHECK 265 static SM_DEBUG_T DebugLeakSmtp = SM_DEBUG_INITIALIZER("leak_smtp", 266 "@(#)$Debug: leak_smtp - trace memory leaks during SMTP processing $"); 267 #endif /* SM_HEAP_CHECK */ 268 269 typedef struct 270 { 271 bool sm_gotmail; /* mail command received */ 272 unsigned int sm_nrcpts; /* number of successful RCPT commands */ 273 bool sm_discard; 274 #if MILTER 275 bool sm_milterize; 276 bool sm_milterlist; /* any filters in the list? */ 277 #endif /* MILTER */ 278 char *sm_quarmsg; /* carry quarantining across messages */ 279 } SMTP_T; 280 281 static bool smtp_data __P((SMTP_T *, ENVELOPE *)); 282 283 #define MSG_TEMPFAIL "451 4.3.2 Please try again later" 284 285 #if MILTER 286 # define MILTER_ABORT(e) milter_abort((e)) 287 288 # define MILTER_REPLY(str) \ 289 { \ 290 int savelogusrerrs = LogUsrErrs; \ 291 \ 292 switch (state) \ 293 { \ 294 case SMFIR_REPLYCODE: \ 295 if (MilterLogLevel > 3) \ 296 { \ 297 sm_syslog(LOG_INFO, e->e_id, \ 298 "Milter: %s=%s, reject=%s", \ 299 str, addr, response); \ 300 LogUsrErrs = false; \ 301 } \ 302 if (strncmp(response, "421 ", 4) == 0) \ 303 { \ 304 bool tsave = QuickAbort; \ 305 \ 306 QuickAbort = false; \ 307 usrerr(response); \ 308 QuickAbort = tsave; \ 309 e->e_sendqueue = NULL; \ 310 goto doquit; \ 311 } \ 312 else \ 313 usrerr(response); \ 314 break; \ 315 \ 316 case SMFIR_REJECT: \ 317 if (MilterLogLevel > 3) \ 318 { \ 319 sm_syslog(LOG_INFO, e->e_id, \ 320 "Milter: %s=%s, reject=550 5.7.1 Command rejected", \ 321 str, addr); \ 322 LogUsrErrs = false; \ 323 } \ 324 usrerr("550 5.7.1 Command rejected"); \ 325 break; \ 326 \ 327 case SMFIR_DISCARD: \ 328 if (MilterLogLevel > 3) \ 329 sm_syslog(LOG_INFO, e->e_id, \ 330 "Milter: %s=%s, discard", \ 331 str, addr); \ 332 e->e_flags |= EF_DISCARD; \ 333 break; \ 334 \ 335 case SMFIR_TEMPFAIL: \ 336 if (MilterLogLevel > 3) \ 337 { \ 338 sm_syslog(LOG_INFO, e->e_id, \ 339 "Milter: %s=%s, reject=%s", \ 340 str, addr, MSG_TEMPFAIL); \ 341 LogUsrErrs = false; \ 342 } \ 343 usrerr(MSG_TEMPFAIL); \ 344 break; \ 345 } \ 346 LogUsrErrs = savelogusrerrs; \ 347 if (response != NULL) \ 348 sm_free(response); /* XXX */ \ 349 } 350 351 #else /* MILTER */ 352 # define MILTER_ABORT(e) 353 #endif /* MILTER */ 354 355 /* clear all SMTP state (for HELO/EHLO/RSET) */ 356 #define CLEAR_STATE(cmd) \ 357 do \ 358 { \ 359 /* abort milter filters */ \ 360 MILTER_ABORT(e); \ 361 \ 362 if (smtp.sm_nrcpts > 0) \ 363 { \ 364 logundelrcpts(e, cmd, 10, false); \ 365 smtp.sm_nrcpts = 0; \ 366 macdefine(&e->e_macro, A_PERM, \ 367 macid("{nrcpts}"), "0"); \ 368 } \ 369 \ 370 e->e_sendqueue = NULL; \ 371 e->e_flags |= EF_CLRQUEUE; \ 372 \ 373 if (LogLevel > 4 && bitset(EF_LOGSENDER, e->e_flags)) \ 374 logsender(e, NULL); \ 375 e->e_flags &= ~EF_LOGSENDER; \ 376 \ 377 /* clean up a bit */ \ 378 smtp.sm_gotmail = false; \ 379 SuprErrs = true; \ 380 dropenvelope(e, true, false); \ 381 sm_rpool_free(e->e_rpool); \ 382 e = newenvelope(e, CurEnv, sm_rpool_new_x(NULL)); \ 383 CurEnv = e; \ 384 \ 385 /* put back discard bit */ \ 386 if (smtp.sm_discard) \ 387 e->e_flags |= EF_DISCARD; \ 388 \ 389 /* restore connection quarantining */ \ 390 if (smtp.sm_quarmsg == NULL) \ 391 { \ 392 e->e_quarmsg = NULL; \ 393 macdefine(&e->e_macro, A_PERM, \ 394 macid("{quarantine}"), ""); \ 395 } \ 396 else \ 397 { \ 398 e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool, \ 399 smtp.sm_quarmsg); \ 400 macdefine(&e->e_macro, A_PERM, macid("{quarantine}"), \ 401 e->e_quarmsg); \ 402 } \ 403 } while (0) 404 405 /* sleep to flatten out connection load */ 406 #define MIN_DELAY_LOG 15 /* wait before logging this again */ 407 408 /* is it worth setting the process title for 1s? */ 409 #define DELAY_CONN(cmd) \ 410 if (DelayLA > 0 && (CurrentLA = getla()) >= DelayLA) \ 411 { \ 412 time_t dnow; \ 413 \ 414 sm_setproctitle(true, e, \ 415 "%s: %s: delaying %s: load average: %d", \ 416 qid_printname(e), CurSmtpClient, \ 417 cmd, DelayLA); \ 418 if (LogLevel > 8 && (dnow = curtime()) > log_delay) \ 419 { \ 420 sm_syslog(LOG_INFO, e->e_id, \ 421 "delaying=%s, load average=%d >= %d", \ 422 cmd, CurrentLA, DelayLA); \ 423 log_delay = dnow + MIN_DELAY_LOG; \ 424 } \ 425 (void) sleep(1); \ 426 sm_setproctitle(true, e, "%s %s: %.80s", \ 427 qid_printname(e), CurSmtpClient, inp); \ 428 } 429 430 431 void 432 smtp(nullserver, d_flags, e) 433 char *volatile nullserver; 434 BITMAP256 d_flags; 435 register ENVELOPE *volatile e; 436 { 437 register char *volatile p; 438 register struct cmd *volatile c = NULL; 439 char *cmd; 440 auto ADDRESS *vrfyqueue; 441 ADDRESS *a; 442 volatile bool gothello; /* helo command received */ 443 bool vrfy; /* set if this is a vrfy command */ 444 char *volatile protocol; /* sending protocol */ 445 char *volatile sendinghost; /* sending hostname */ 446 char *volatile peerhostname; /* name of SMTP peer or "localhost" */ 447 auto char *delimptr; 448 char *id; 449 volatile unsigned int n_badcmds = 0; /* count of bad commands */ 450 volatile unsigned int n_badrcpts = 0; /* number of rejected RCPT */ 451 volatile unsigned int n_verifies = 0; /* count of VRFY/EXPN */ 452 volatile unsigned int n_etrn = 0; /* count of ETRN */ 453 volatile unsigned int n_noop = 0; /* count of NOOP/VERB/etc */ 454 volatile unsigned int n_helo = 0; /* count of HELO/EHLO */ 455 volatile int save_sevenbitinput; 456 bool ok; 457 #if _FFR_BLOCK_PROXIES 458 volatile bool first; 459 #endif /* _FFR_BLOCK_PROXIES */ 460 volatile bool tempfail = false; 461 volatile time_t wt; /* timeout after too many commands */ 462 volatile time_t previous; /* time after checksmtpattack() */ 463 volatile bool lognullconnection = true; 464 register char *q; 465 SMTP_T smtp; 466 char *addr; 467 char *greetcode = "220"; 468 char *hostname; /* my hostname ($j) */ 469 QUEUE_CHAR *new; 470 int argno; 471 char *args[MAXSMTPARGS]; 472 char inp[MAXLINE]; 473 char cmdbuf[MAXLINE]; 474 #if SASL 475 sasl_conn_t *conn; 476 volatile bool sasl_ok; 477 volatile unsigned int n_auth = 0; /* count of AUTH commands */ 478 bool ismore; 479 int result; 480 volatile int authenticating; 481 char *user; 482 char *in, *out2; 483 # if SASL >= 20000 484 char *auth_id; 485 const char *out; 486 sasl_ssf_t ext_ssf; 487 char localip[60], remoteip[60]; 488 # else /* SASL >= 20000 */ 489 char *out; 490 const char *errstr; 491 sasl_external_properties_t ext_ssf; 492 struct sockaddr_in saddr_l; 493 struct sockaddr_in saddr_r; 494 # endif /* SASL >= 20000 */ 495 sasl_security_properties_t ssp; 496 sasl_ssf_t *ssf; 497 unsigned int inlen, out2len; 498 unsigned int outlen; 499 char *volatile auth_type; 500 char *mechlist; 501 volatile unsigned int n_mechs; 502 unsigned int len; 503 #endif /* SASL */ 504 int r; 505 #if STARTTLS 506 int fdfl; 507 int rfd, wfd; 508 volatile bool tls_active = false; 509 volatile bool smtps = bitnset(D_SMTPS, d_flags); 510 bool saveQuickAbort; 511 bool saveSuprErrs; 512 time_t tlsstart; 513 #endif /* STARTTLS */ 514 volatile unsigned int features; 515 #if PIPELINING 516 # if _FFR_NO_PIPE 517 int np_log = 0; 518 # endif /* _FFR_NO_PIPE */ 519 #endif /* PIPELINING */ 520 volatile time_t log_delay = (time_t) 0; 521 522 save_sevenbitinput = SevenBitInput; 523 smtp.sm_nrcpts = 0; 524 #if MILTER 525 smtp.sm_milterize = (nullserver == NULL); 526 smtp.sm_milterlist = false; 527 #endif /* MILTER */ 528 529 /* setup I/O fd correctly for the SMTP server */ 530 setup_smtpd_io(); 531 532 #if SM_HEAP_CHECK 533 if (sm_debug_active(&DebugLeakSmtp, 1)) 534 { 535 sm_heap_newgroup(); 536 sm_dprintf("smtp() heap group #%d\n", sm_heap_group()); 537 } 538 #endif /* SM_HEAP_CHECK */ 539 540 /* XXX the rpool should be set when e is initialized in main() */ 541 e->e_rpool = sm_rpool_new_x(NULL); 542 e->e_macro.mac_rpool = e->e_rpool; 543 544 settime(e); 545 sm_getla(); 546 peerhostname = RealHostName; 547 if (peerhostname == NULL) 548 peerhostname = "localhost"; 549 CurHostName = peerhostname; 550 CurSmtpClient = macvalue('_', e); 551 if (CurSmtpClient == NULL) 552 CurSmtpClient = CurHostName; 553 554 /* check_relay may have set discard bit, save for later */ 555 smtp.sm_discard = bitset(EF_DISCARD, e->e_flags); 556 557 #if PIPELINING 558 /* auto-flush output when reading input */ 559 (void) sm_io_autoflush(InChannel, OutChannel); 560 #endif /* PIPELINING */ 561 562 sm_setproctitle(true, e, "server %s startup", CurSmtpClient); 563 564 /* Set default features for server. */ 565 features = ((bitset(PRIV_NOETRN, PrivacyFlags) || 566 bitnset(D_NOETRN, d_flags)) ? SRV_NONE : SRV_OFFER_ETRN) 567 | (bitnset(D_AUTHREQ, d_flags) ? SRV_REQ_AUTH : SRV_NONE) 568 | (bitset(PRIV_NOEXPN, PrivacyFlags) ? SRV_NONE 569 : (SRV_OFFER_EXPN 570 | (bitset(PRIV_NOVERB, PrivacyFlags) 571 ? SRV_NONE : SRV_OFFER_VERB))) 572 | (bitset(PRIV_NORECEIPTS, PrivacyFlags) ? SRV_NONE 573 : SRV_OFFER_DSN) 574 #if SASL 575 | (bitnset(D_NOAUTH, d_flags) ? SRV_NONE : SRV_OFFER_AUTH) 576 | (bitset(SASL_SEC_NOPLAINTEXT, SASLOpts) ? SRV_REQ_SEC 577 : SRV_NONE) 578 #endif /* SASL */ 579 #if PIPELINING 580 | SRV_OFFER_PIPE 581 #endif /* PIPELINING */ 582 #if STARTTLS 583 | (bitnset(D_NOTLS, d_flags) ? SRV_NONE : SRV_OFFER_TLS) 584 | (bitset(TLS_I_NO_VRFY, TLS_Srv_Opts) ? SRV_NONE 585 : SRV_VRFY_CLT) 586 #endif /* STARTTLS */ 587 ; 588 if (nullserver == NULL) 589 { 590 features = srvfeatures(e, CurSmtpClient, features); 591 if (bitset(SRV_TMP_FAIL, features)) 592 { 593 if (LogLevel > 4) 594 sm_syslog(LOG_ERR, NOQID, 595 "ERROR: srv_features=tempfail, relay=%.100s, access temporarily disabled", 596 CurSmtpClient); 597 nullserver = "450 4.3.0 Please try again later."; 598 } 599 else 600 { 601 #if PIPELINING 602 # if _FFR_NO_PIPE 603 if (bitset(SRV_NO_PIPE, features)) 604 { 605 /* for consistency */ 606 features &= ~SRV_OFFER_PIPE; 607 } 608 # endif /* _FFR_NO_PIPE */ 609 #endif /* PIPELINING */ 610 #if SASL 611 if (bitset(SRV_REQ_SEC, features)) 612 SASLOpts |= SASL_SEC_NOPLAINTEXT; 613 else 614 SASLOpts &= ~SASL_SEC_NOPLAINTEXT; 615 #endif /* SASL */ 616 } 617 } 618 else if (strncmp(nullserver, "421 ", 4) == 0) 619 { 620 message(nullserver); 621 goto doquit; 622 } 623 624 hostname = macvalue('j', e); 625 #if SASL 626 if (AuthRealm == NULL) 627 AuthRealm = hostname; 628 sasl_ok = bitset(SRV_OFFER_AUTH, features); 629 n_mechs = 0; 630 authenticating = SASL_NOT_AUTH; 631 632 /* SASL server new connection */ 633 if (sasl_ok) 634 { 635 # if SASL >= 20000 636 result = sasl_server_new("smtp", AuthRealm, NULL, NULL, NULL, 637 NULL, 0, &conn); 638 # elif SASL > 10505 639 /* use empty realm: only works in SASL > 1.5.5 */ 640 result = sasl_server_new("smtp", AuthRealm, "", NULL, 0, &conn); 641 # else /* SASL >= 20000 */ 642 /* use no realm -> realm is set to hostname by SASL lib */ 643 result = sasl_server_new("smtp", AuthRealm, NULL, NULL, 0, 644 &conn); 645 # endif /* SASL >= 20000 */ 646 sasl_ok = result == SASL_OK; 647 if (!sasl_ok) 648 { 649 if (LogLevel > 9) 650 sm_syslog(LOG_WARNING, NOQID, 651 "AUTH error: sasl_server_new failed=%d", 652 result); 653 } 654 } 655 if (sasl_ok) 656 { 657 /* 658 ** SASL set properties for sasl 659 ** set local/remote IP 660 ** XXX Cyrus SASL v1 only supports IPv4 661 ** 662 ** XXX where exactly are these used/required? 663 ** Kerberos_v4 664 */ 665 666 # if SASL >= 20000 667 # if NETINET || NETINET6 668 in = macvalue(macid("{daemon_family}"), e); 669 if (in != NULL && ( 670 # if NETINET6 671 strcmp(in, "inet6") == 0 || 672 # endif /* NETINET6 */ 673 strcmp(in, "inet") == 0)) 674 { 675 SOCKADDR_LEN_T addrsize; 676 SOCKADDR saddr_l; 677 SOCKADDR saddr_r; 678 679 addrsize = sizeof(saddr_r); 680 if (getpeername(sm_io_getinfo(InChannel, SM_IO_WHAT_FD, 681 NULL), 682 (struct sockaddr *) &saddr_r, 683 &addrsize) == 0) 684 { 685 if (iptostring(&saddr_r, addrsize, 686 remoteip, sizeof remoteip)) 687 { 688 sasl_setprop(conn, SASL_IPREMOTEPORT, 689 remoteip); 690 } 691 addrsize = sizeof(saddr_l); 692 if (getsockname(sm_io_getinfo(InChannel, 693 SM_IO_WHAT_FD, 694 NULL), 695 (struct sockaddr *) &saddr_l, 696 &addrsize) == 0) 697 { 698 if (iptostring(&saddr_l, addrsize, 699 localip, 700 sizeof localip)) 701 { 702 sasl_setprop(conn, 703 SASL_IPLOCALPORT, 704 localip); 705 } 706 } 707 } 708 } 709 # endif /* NETINET || NETINET6 */ 710 # else /* SASL >= 20000 */ 711 # if NETINET 712 in = macvalue(macid("{daemon_family}"), e); 713 if (in != NULL && strcmp(in, "inet") == 0) 714 { 715 SOCKADDR_LEN_T addrsize; 716 717 addrsize = sizeof(struct sockaddr_in); 718 if (getpeername(sm_io_getinfo(InChannel, SM_IO_WHAT_FD, 719 NULL), 720 (struct sockaddr *)&saddr_r, 721 &addrsize) == 0) 722 { 723 sasl_setprop(conn, SASL_IP_REMOTE, &saddr_r); 724 addrsize = sizeof(struct sockaddr_in); 725 if (getsockname(sm_io_getinfo(InChannel, 726 SM_IO_WHAT_FD, 727 NULL), 728 (struct sockaddr *)&saddr_l, 729 &addrsize) == 0) 730 sasl_setprop(conn, SASL_IP_LOCAL, 731 &saddr_l); 732 } 733 } 734 # endif /* NETINET */ 735 # endif /* SASL >= 20000 */ 736 737 auth_type = NULL; 738 mechlist = NULL; 739 user = NULL; 740 # if 0 741 macdefine(&BlankEnvelope.e_macro, A_PERM, 742 macid("{auth_author}"), NULL); 743 # endif /* 0 */ 744 745 /* set properties */ 746 (void) memset(&ssp, '\0', sizeof ssp); 747 748 /* XXX should these be options settable via .cf ? */ 749 /* ssp.min_ssf = 0; is default due to memset() */ 750 # if STARTTLS 751 # endif /* STARTTLS */ 752 { 753 ssp.max_ssf = MaxSLBits; 754 ssp.maxbufsize = MAXOUTLEN; 755 } 756 ssp.security_flags = SASLOpts & SASL_SEC_MASK; 757 sasl_ok = sasl_setprop(conn, SASL_SEC_PROPS, &ssp) == SASL_OK; 758 759 if (sasl_ok) 760 { 761 /* 762 ** external security strength factor; 763 ** currently we have none so zero 764 */ 765 766 # if SASL >= 20000 767 ext_ssf = 0; 768 auth_id = NULL; 769 sasl_ok = ((sasl_setprop(conn, SASL_SSF_EXTERNAL, 770 &ext_ssf) == SASL_OK) && 771 (sasl_setprop(conn, SASL_AUTH_EXTERNAL, 772 auth_id) == SASL_OK)); 773 # else /* SASL >= 20000 */ 774 ext_ssf.ssf = 0; 775 ext_ssf.auth_id = NULL; 776 sasl_ok = sasl_setprop(conn, SASL_SSF_EXTERNAL, 777 &ext_ssf) == SASL_OK; 778 # endif /* SASL >= 20000 */ 779 } 780 if (sasl_ok) 781 n_mechs = saslmechs(conn, &mechlist); 782 } 783 #endif /* SASL */ 784 785 #if STARTTLS 786 #endif /* STARTTLS */ 787 788 #if MILTER 789 if (smtp.sm_milterize) 790 { 791 char state; 792 793 /* initialize mail filter connection */ 794 smtp.sm_milterlist = milter_init(e, &state); 795 switch (state) 796 { 797 case SMFIR_REJECT: 798 if (MilterLogLevel > 3) 799 sm_syslog(LOG_INFO, e->e_id, 800 "Milter: initialization failed, rejecting commands"); 801 greetcode = "554"; 802 nullserver = "Command rejected"; 803 smtp.sm_milterize = false; 804 break; 805 806 case SMFIR_TEMPFAIL: 807 if (MilterLogLevel > 3) 808 sm_syslog(LOG_INFO, e->e_id, 809 "Milter: initialization failed, temp failing commands"); 810 tempfail = true; 811 smtp.sm_milterize = false; 812 break; 813 } 814 } 815 816 if (smtp.sm_milterlist && smtp.sm_milterize && 817 !bitset(EF_DISCARD, e->e_flags)) 818 { 819 char state; 820 char *response; 821 822 response = milter_connect(peerhostname, RealHostAddr, 823 e, &state); 824 switch (state) 825 { 826 case SMFIR_REPLYCODE: /* REPLYCODE shouldn't happen */ 827 case SMFIR_REJECT: 828 if (MilterLogLevel > 3) 829 sm_syslog(LOG_INFO, e->e_id, 830 "Milter: connect: host=%s, addr=%s, rejecting commands", 831 peerhostname, 832 anynet_ntoa(&RealHostAddr)); 833 greetcode = "554"; 834 nullserver = "Command rejected"; 835 smtp.sm_milterize = false; 836 break; 837 838 case SMFIR_TEMPFAIL: 839 if (MilterLogLevel > 3) 840 sm_syslog(LOG_INFO, e->e_id, 841 "Milter: connect: host=%s, addr=%s, temp failing commands", 842 peerhostname, 843 anynet_ntoa(&RealHostAddr)); 844 tempfail = true; 845 smtp.sm_milterize = false; 846 break; 847 848 case SMFIR_SHUTDOWN: 849 if (MilterLogLevel > 3) 850 sm_syslog(LOG_INFO, e->e_id, 851 "Milter: connect: host=%s, addr=%s, shutdown", 852 peerhostname, 853 anynet_ntoa(&RealHostAddr)); 854 tempfail = true; 855 smtp.sm_milterize = false; 856 message("421 4.7.0 %s closing connection", 857 MyHostName); 858 859 /* arrange to ignore send list */ 860 e->e_sendqueue = NULL; 861 goto doquit; 862 } 863 if (response != NULL) 864 sm_free(response); /* XXX */ 865 } 866 #endif /* MILTER */ 867 868 /* 869 ** Broken proxies and SMTP slammers 870 ** push data without waiting, catch them 871 */ 872 873 if ( 874 #if STARTTLS 875 !smtps && 876 #endif /* STARTTLS */ 877 *greetcode == '2') 878 { 879 time_t msecs = 0; 880 char **pvp; 881 char pvpbuf[PSBUFSIZE]; 882 883 /* Ask the rulesets how long to pause */ 884 pvp = NULL; 885 r = rscap("greet_pause", peerhostname, 886 anynet_ntoa(&RealHostAddr), e, 887 &pvp, pvpbuf, sizeof(pvpbuf)); 888 if (r == EX_OK && pvp != NULL && pvp[0] != NULL && 889 (pvp[0][0] & 0377) == CANONNET && pvp[1] != NULL) 890 { 891 msecs = strtol(pvp[1], NULL, 10); 892 } 893 894 if (msecs > 0) 895 { 896 int fd; 897 fd_set readfds; 898 struct timeval timeout; 899 900 /* pause for a moment */ 901 timeout.tv_sec = msecs / 1000; 902 timeout.tv_usec = (msecs % 1000) * 1000; 903 904 /* Obey RFC 2821: 4.3.5.2: 220 timeout of 5 minutes */ 905 if (timeout.tv_sec >= 300) 906 { 907 timeout.tv_sec = 300; 908 timeout.tv_usec = 0; 909 } 910 911 /* check if data is on the socket during the pause */ 912 fd = sm_io_getinfo(InChannel, SM_IO_WHAT_FD, NULL); 913 FD_ZERO(&readfds); 914 SM_FD_SET(fd, &readfds); 915 if (select(fd + 1, FDSET_CAST &readfds, 916 NULL, NULL, &timeout) > 0 && 917 FD_ISSET(fd, &readfds)) 918 { 919 greetcode = "554"; 920 nullserver = "Command rejected"; 921 sm_syslog(LOG_INFO, e->e_id, 922 "rejecting commands from %s [%s] due to pre-greeting traffic", 923 peerhostname, 924 anynet_ntoa(&RealHostAddr)); 925 } 926 } 927 } 928 929 #if STARTTLS 930 /* If this an smtps connection, start TLS now */ 931 if (smtps) 932 { 933 Errors = 0; 934 goto starttls; 935 } 936 937 greeting: 938 939 #endif /* STARTTLS */ 940 941 /* output the first line, inserting "ESMTP" as second word */ 942 if (*greetcode == '5') 943 (void) sm_snprintf(inp, sizeof inp, "%s not accepting messages", 944 hostname); 945 else 946 expand(SmtpGreeting, inp, sizeof inp, e); 947 948 p = strchr(inp, '\n'); 949 if (p != NULL) 950 *p++ = '\0'; 951 id = strchr(inp, ' '); 952 if (id == NULL) 953 id = &inp[strlen(inp)]; 954 if (p == NULL) 955 (void) sm_snprintf(cmdbuf, sizeof cmdbuf, 956 "%s %%.*s ESMTP%%s", greetcode); 957 else 958 (void) sm_snprintf(cmdbuf, sizeof cmdbuf, 959 "%s-%%.*s ESMTP%%s", greetcode); 960 message(cmdbuf, (int) (id - inp), inp, id); 961 962 /* output remaining lines */ 963 while ((id = p) != NULL && (p = strchr(id, '\n')) != NULL) 964 { 965 *p++ = '\0'; 966 if (isascii(*id) && isspace(*id)) 967 id++; 968 (void) sm_strlcpyn(cmdbuf, sizeof cmdbuf, 2, greetcode, "-%s"); 969 message(cmdbuf, id); 970 } 971 if (id != NULL) 972 { 973 if (isascii(*id) && isspace(*id)) 974 id++; 975 (void) sm_strlcpyn(cmdbuf, sizeof cmdbuf, 2, greetcode, " %s"); 976 message(cmdbuf, id); 977 } 978 979 protocol = NULL; 980 sendinghost = macvalue('s', e); 981 982 /* If quarantining by a connect/ehlo action, save between messages */ 983 if (e->e_quarmsg == NULL) 984 smtp.sm_quarmsg = NULL; 985 else 986 smtp.sm_quarmsg = newstr(e->e_quarmsg); 987 988 /* sendinghost's storage must outlive the current envelope */ 989 if (sendinghost != NULL) 990 sendinghost = sm_strdup_x(sendinghost); 991 #if _FFR_BLOCK_PROXIES 992 first = true; 993 #endif /* _FFR_BLOCK_PROXIES */ 994 gothello = false; 995 smtp.sm_gotmail = false; 996 for (;;) 997 { 998 SM_TRY 999 { 1000 QuickAbort = false; 1001 HoldErrs = false; 1002 SuprErrs = false; 1003 LogUsrErrs = false; 1004 OnlyOneError = true; 1005 e->e_flags &= ~(EF_VRFYONLY|EF_GLOBALERRS); 1006 1007 /* setup for the read */ 1008 e->e_to = NULL; 1009 Errors = 0; 1010 FileName = NULL; 1011 (void) sm_io_flush(smioout, SM_TIME_DEFAULT); 1012 1013 /* read the input line */ 1014 SmtpPhase = "server cmd read"; 1015 sm_setproctitle(true, e, "server %s cmd read", CurSmtpClient); 1016 #if SASL 1017 /* 1018 ** XXX SMTP AUTH requires accepting any length, 1019 ** at least for challenge/response 1020 */ 1021 #endif /* SASL */ 1022 1023 /* handle errors */ 1024 if (sm_io_error(OutChannel) || 1025 (p = sfgets(inp, sizeof inp, InChannel, 1026 TimeOuts.to_nextcommand, SmtpPhase)) == NULL) 1027 { 1028 char *d; 1029 1030 d = macvalue(macid("{daemon_name}"), e); 1031 if (d == NULL) 1032 d = "stdin"; 1033 /* end of file, just die */ 1034 disconnect(1, e); 1035 1036 #if MILTER 1037 /* close out milter filters */ 1038 milter_quit(e); 1039 #endif /* MILTER */ 1040 1041 message("421 4.4.1 %s Lost input channel from %s", 1042 MyHostName, CurSmtpClient); 1043 if (LogLevel > (smtp.sm_gotmail ? 1 : 19)) 1044 sm_syslog(LOG_NOTICE, e->e_id, 1045 "lost input channel from %s to %s after %s", 1046 CurSmtpClient, d, 1047 (c == NULL || c->cmd_name == NULL) ? "startup" : c->cmd_name); 1048 /* 1049 ** If have not accepted mail (DATA), do not bounce 1050 ** bad addresses back to sender. 1051 */ 1052 1053 if (bitset(EF_CLRQUEUE, e->e_flags)) 1054 e->e_sendqueue = NULL; 1055 goto doquit; 1056 } 1057 1058 #if _FFR_BLOCK_PROXIES 1059 if (first) 1060 { 1061 size_t inplen, cmdlen; 1062 int idx; 1063 char *http_cmd; 1064 static char *http_cmds[] = { "GET", "POST", 1065 "CONNECT", "USER", NULL }; 1066 1067 inplen = strlen(inp); 1068 for (idx = 0; (http_cmd = http_cmds[idx]) != NULL; 1069 idx++) 1070 { 1071 cmdlen = strlen(http_cmd); 1072 if (cmdlen < inplen && 1073 sm_strncasecmp(inp, http_cmd, cmdlen) == 0 && 1074 isascii(inp[cmdlen]) && isspace(inp[cmdlen])) 1075 { 1076 /* Open proxy, drop it */ 1077 message("421 4.7.0 %s Rejecting open proxy %s", 1078 MyHostName, CurSmtpClient); 1079 sm_syslog(LOG_INFO, e->e_id, 1080 "%s: probable open proxy: command=%.40s", 1081 CurSmtpClient, inp); 1082 goto doquit; 1083 } 1084 } 1085 first = false; 1086 } 1087 #endif /* _FFR_BLOCK_PROXIES */ 1088 1089 /* clean up end of line */ 1090 fixcrlf(inp, true); 1091 1092 #if PIPELINING 1093 # if _FFR_NO_PIPE 1094 /* 1095 ** if there is more input and pipelining is disabled: 1096 ** delay ... (and maybe discard the input?) 1097 ** XXX this doesn't really work, at least in tests using 1098 ** telnet SM_IO_IS_READABLE only returns 1 if there were 1099 ** more than 2 input lines available. 1100 */ 1101 1102 if (bitset(SRV_NO_PIPE, features) && 1103 sm_io_getinfo(InChannel, SM_IO_IS_READABLE, NULL) > 0) 1104 { 1105 if (++np_log < 3) 1106 sm_syslog(LOG_INFO, NOQID, 1107 "unauthorized PIPELINING, sleeping"); 1108 sleep(1); 1109 } 1110 1111 # endif /* _FFR_NO_PIPE */ 1112 #endif /* PIPELINING */ 1113 1114 #if SASL 1115 if (authenticating == SASL_PROC_AUTH) 1116 { 1117 # if 0 1118 if (*inp == '\0') 1119 { 1120 authenticating = SASL_NOT_AUTH; 1121 message("501 5.5.2 missing input"); 1122 RESET_SASLCONN; 1123 continue; 1124 } 1125 # endif /* 0 */ 1126 if (*inp == '*' && *(inp + 1) == '\0') 1127 { 1128 authenticating = SASL_NOT_AUTH; 1129 1130 /* rfc 2254 4. */ 1131 message("501 5.0.0 AUTH aborted"); 1132 RESET_SASLCONN; 1133 continue; 1134 } 1135 1136 /* could this be shorter? XXX */ 1137 # if SASL >= 20000 1138 in = xalloc(strlen(inp) + 1); 1139 result = sasl_decode64(inp, strlen(inp), in, 1140 strlen(inp), &inlen); 1141 # else /* SASL >= 20000 */ 1142 out = xalloc(strlen(inp)); 1143 result = sasl_decode64(inp, strlen(inp), out, &outlen); 1144 # endif /* SASL >= 20000 */ 1145 if (result != SASL_OK) 1146 { 1147 authenticating = SASL_NOT_AUTH; 1148 1149 /* rfc 2254 4. */ 1150 message("501 5.5.4 cannot decode AUTH parameter %s", 1151 inp); 1152 # if SASL >= 20000 1153 sm_free(in); 1154 # endif /* SASL >= 20000 */ 1155 RESET_SASLCONN; 1156 continue; 1157 } 1158 1159 # if SASL >= 20000 1160 result = sasl_server_step(conn, in, inlen, 1161 &out, &outlen); 1162 sm_free(in); 1163 # else /* SASL >= 20000 */ 1164 result = sasl_server_step(conn, out, outlen, 1165 &out, &outlen, &errstr); 1166 # endif /* SASL >= 20000 */ 1167 1168 /* get an OK if we're done */ 1169 if (result == SASL_OK) 1170 { 1171 authenticated: 1172 message("235 2.0.0 OK Authenticated"); 1173 authenticating = SASL_IS_AUTH; 1174 macdefine(&BlankEnvelope.e_macro, A_TEMP, 1175 macid("{auth_type}"), auth_type); 1176 1177 # if SASL >= 20000 1178 user = macvalue(macid("{auth_authen}"), e); 1179 1180 /* get security strength (features) */ 1181 result = sasl_getprop(conn, SASL_SSF, 1182 (const void **) &ssf); 1183 # else /* SASL >= 20000 */ 1184 result = sasl_getprop(conn, SASL_USERNAME, 1185 (void **)&user); 1186 if (result != SASL_OK) 1187 { 1188 user = ""; 1189 macdefine(&BlankEnvelope.e_macro, 1190 A_PERM, 1191 macid("{auth_authen}"), NULL); 1192 } 1193 else 1194 { 1195 macdefine(&BlankEnvelope.e_macro, 1196 A_TEMP, 1197 macid("{auth_authen}"), 1198 xtextify(user, "<>\")")); 1199 } 1200 1201 # if 0 1202 /* get realm? */ 1203 sasl_getprop(conn, SASL_REALM, (void **) &data); 1204 # endif /* 0 */ 1205 1206 /* get security strength (features) */ 1207 result = sasl_getprop(conn, SASL_SSF, 1208 (void **) &ssf); 1209 # endif /* SASL >= 20000 */ 1210 if (result != SASL_OK) 1211 { 1212 macdefine(&BlankEnvelope.e_macro, 1213 A_PERM, 1214 macid("{auth_ssf}"), "0"); 1215 ssf = NULL; 1216 } 1217 else 1218 { 1219 char pbuf[8]; 1220 1221 (void) sm_snprintf(pbuf, sizeof pbuf, 1222 "%u", *ssf); 1223 macdefine(&BlankEnvelope.e_macro, 1224 A_TEMP, 1225 macid("{auth_ssf}"), pbuf); 1226 if (tTd(95, 8)) 1227 sm_dprintf("AUTH auth_ssf: %u\n", 1228 *ssf); 1229 } 1230 1231 /* 1232 ** Only switch to encrypted connection 1233 ** if a security layer has been negotiated 1234 */ 1235 1236 if (ssf != NULL && *ssf > 0) 1237 { 1238 /* 1239 ** Convert I/O layer to use SASL. 1240 ** If the call fails, the connection 1241 ** is aborted. 1242 */ 1243 1244 if (sfdcsasl(&InChannel, &OutChannel, 1245 conn) == 0) 1246 { 1247 /* restart dialogue */ 1248 n_helo = 0; 1249 # if PIPELINING 1250 (void) sm_io_autoflush(InChannel, 1251 OutChannel); 1252 # endif /* PIPELINING */ 1253 } 1254 else 1255 syserr("503 5.3.3 SASL TLS failed"); 1256 } 1257 1258 /* NULL pointer ok since it's our function */ 1259 if (LogLevel > 8) 1260 sm_syslog(LOG_INFO, NOQID, 1261 "AUTH=server, relay=%s, authid=%.128s, mech=%.16s, bits=%d", 1262 CurSmtpClient, 1263 shortenstring(user, 128), 1264 auth_type, *ssf); 1265 } 1266 else if (result == SASL_CONTINUE) 1267 { 1268 len = ENC64LEN(outlen); 1269 out2 = xalloc(len); 1270 result = sasl_encode64(out, outlen, out2, len, 1271 &out2len); 1272 if (result != SASL_OK) 1273 { 1274 /* correct code? XXX */ 1275 /* 454 Temp. authentication failure */ 1276 message("454 4.5.4 Internal error: unable to encode64"); 1277 if (LogLevel > 5) 1278 sm_syslog(LOG_WARNING, e->e_id, 1279 "AUTH encode64 error [%d for \"%s\"]", 1280 result, out); 1281 /* start over? */ 1282 authenticating = SASL_NOT_AUTH; 1283 } 1284 else 1285 { 1286 message("334 %s", out2); 1287 if (tTd(95, 2)) 1288 sm_dprintf("AUTH continue: msg='%s' len=%u\n", 1289 out2, out2len); 1290 } 1291 # if SASL >= 20000 1292 sm_free(out2); 1293 # endif /* SASL >= 20000 */ 1294 } 1295 else 1296 { 1297 /* not SASL_OK or SASL_CONT */ 1298 message("535 5.7.0 authentication failed"); 1299 if (LogLevel > 9) 1300 sm_syslog(LOG_WARNING, e->e_id, 1301 "AUTH failure (%s): %s (%d) %s", 1302 auth_type, 1303 sasl_errstring(result, NULL, 1304 NULL), 1305 result, 1306 # if SASL >= 20000 1307 sasl_errdetail(conn)); 1308 # else /* SASL >= 20000 */ 1309 errstr == NULL ? "" : errstr); 1310 # endif /* SASL >= 20000 */ 1311 RESET_SASLCONN; 1312 authenticating = SASL_NOT_AUTH; 1313 } 1314 } 1315 else 1316 { 1317 /* don't want to do any of this if authenticating */ 1318 #endif /* SASL */ 1319 1320 /* echo command to transcript */ 1321 if (e->e_xfp != NULL) 1322 (void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT, 1323 "<<< %s\n", inp); 1324 1325 if (LogLevel > 14) 1326 sm_syslog(LOG_INFO, e->e_id, "<-- %s", inp); 1327 1328 /* break off command */ 1329 for (p = inp; isascii(*p) && isspace(*p); p++) 1330 continue; 1331 cmd = cmdbuf; 1332 while (*p != '\0' && 1333 !(isascii(*p) && isspace(*p)) && 1334 cmd < &cmdbuf[sizeof cmdbuf - 2]) 1335 *cmd++ = *p++; 1336 *cmd = '\0'; 1337 1338 /* throw away leading whitespace */ 1339 SKIP_SPACE(p); 1340 1341 /* decode command */ 1342 for (c = CmdTab; c->cmd_name != NULL; c++) 1343 { 1344 if (sm_strcasecmp(c->cmd_name, cmdbuf) == 0) 1345 break; 1346 } 1347 1348 /* reset errors */ 1349 errno = 0; 1350 1351 /* check whether a "non-null" command has been used */ 1352 switch (c->cmd_code) 1353 { 1354 #if SASL 1355 case CMDAUTH: 1356 /* avoid information leak; take first two words? */ 1357 q = "AUTH"; 1358 break; 1359 #endif /* SASL */ 1360 1361 case CMDMAIL: 1362 case CMDEXPN: 1363 case CMDVRFY: 1364 case CMDETRN: 1365 lognullconnection = false; 1366 /* FALLTHROUGH */ 1367 default: 1368 q = inp; 1369 break; 1370 } 1371 1372 if (e->e_id == NULL) 1373 sm_setproctitle(true, e, "%s: %.80s", 1374 CurSmtpClient, q); 1375 else 1376 sm_setproctitle(true, e, "%s %s: %.80s", 1377 qid_printname(e), 1378 CurSmtpClient, q); 1379 1380 /* 1381 ** Process command. 1382 ** 1383 ** If we are running as a null server, return 550 1384 ** to almost everything. 1385 */ 1386 1387 if (nullserver != NULL || bitnset(D_ETRNONLY, d_flags)) 1388 { 1389 switch (c->cmd_code) 1390 { 1391 case CMDQUIT: 1392 case CMDHELO: 1393 case CMDEHLO: 1394 case CMDNOOP: 1395 case CMDRSET: 1396 case CMDERROR: 1397 /* process normally */ 1398 break; 1399 1400 case CMDETRN: 1401 if (bitnset(D_ETRNONLY, d_flags) && 1402 nullserver == NULL) 1403 break; 1404 DELAY_CONN("ETRN"); 1405 /* FALLTHROUGH */ 1406 1407 default: 1408 #if MAXBADCOMMANDS > 0 1409 /* theoretically this could overflow */ 1410 if (nullserver != NULL && 1411 ++n_badcmds > MAXBADCOMMANDS) 1412 { 1413 message("421 4.7.0 %s Too many bad commands; closing connection", 1414 MyHostName); 1415 1416 /* arrange to ignore send list */ 1417 e->e_sendqueue = NULL; 1418 goto doquit; 1419 } 1420 #endif /* MAXBADCOMMANDS > 0 */ 1421 if (nullserver != NULL) 1422 { 1423 if (ISSMTPREPLY(nullserver)) 1424 usrerr(nullserver); 1425 else 1426 usrerr("550 5.0.0 %s", 1427 nullserver); 1428 } 1429 else 1430 usrerr("452 4.4.5 Insufficient disk space; try again later"); 1431 continue; 1432 } 1433 } 1434 1435 switch (c->cmd_code) 1436 { 1437 #if SASL 1438 case CMDAUTH: /* sasl */ 1439 DELAY_CONN("AUTH"); 1440 if (!sasl_ok || n_mechs <= 0) 1441 { 1442 message("503 5.3.3 AUTH not available"); 1443 break; 1444 } 1445 if (authenticating == SASL_IS_AUTH) 1446 { 1447 message("503 5.5.0 Already Authenticated"); 1448 break; 1449 } 1450 if (smtp.sm_gotmail) 1451 { 1452 message("503 5.5.0 AUTH not permitted during a mail transaction"); 1453 break; 1454 } 1455 if (tempfail) 1456 { 1457 if (LogLevel > 9) 1458 sm_syslog(LOG_INFO, e->e_id, 1459 "SMTP AUTH command (%.100s) from %s tempfailed (due to previous checks)", 1460 p, CurSmtpClient); 1461 usrerr("454 4.3.0 Please try again later"); 1462 break; 1463 } 1464 1465 ismore = false; 1466 1467 /* crude way to avoid crack attempts */ 1468 STOP_IF_ATTACK(checksmtpattack(&n_auth, n_mechs + 1, 1469 true, "AUTH", e)); 1470 1471 /* make sure mechanism (p) is a valid string */ 1472 for (q = p; *q != '\0' && isascii(*q); q++) 1473 { 1474 if (isspace(*q)) 1475 { 1476 *q = '\0'; 1477 while (*++q != '\0' && 1478 isascii(*q) && isspace(*q)) 1479 continue; 1480 *(q - 1) = '\0'; 1481 ismore = (*q != '\0'); 1482 break; 1483 } 1484 } 1485 1486 if (*p == '\0') 1487 { 1488 message("501 5.5.2 AUTH mechanism must be specified"); 1489 break; 1490 } 1491 1492 /* check whether mechanism is available */ 1493 if (iteminlist(p, mechlist, " ") == NULL) 1494 { 1495 message("504 5.3.3 AUTH mechanism %.32s not available", 1496 p); 1497 break; 1498 } 1499 1500 if (ismore) 1501 { 1502 /* could this be shorter? XXX */ 1503 # if SASL >= 20000 1504 in = xalloc(strlen(q) + 1); 1505 result = sasl_decode64(q, strlen(q), in, 1506 strlen(q), &inlen); 1507 # else /* SASL >= 20000 */ 1508 in = sm_rpool_malloc(e->e_rpool, strlen(q)); 1509 result = sasl_decode64(q, strlen(q), in, 1510 &inlen); 1511 # endif /* SASL >= 20000 */ 1512 if (result != SASL_OK) 1513 { 1514 message("501 5.5.4 cannot BASE64 decode '%s'", 1515 q); 1516 if (LogLevel > 5) 1517 sm_syslog(LOG_WARNING, e->e_id, 1518 "AUTH decode64 error [%d for \"%s\"]", 1519 result, q); 1520 /* start over? */ 1521 authenticating = SASL_NOT_AUTH; 1522 # if SASL >= 20000 1523 sm_free(in); 1524 # endif /* SASL >= 20000 */ 1525 in = NULL; 1526 inlen = 0; 1527 break; 1528 } 1529 } 1530 else 1531 { 1532 in = NULL; 1533 inlen = 0; 1534 } 1535 1536 /* see if that auth type exists */ 1537 # if SASL >= 20000 1538 result = sasl_server_start(conn, p, in, inlen, 1539 &out, &outlen); 1540 if (in != NULL) 1541 sm_free(in); 1542 # else /* SASL >= 20000 */ 1543 result = sasl_server_start(conn, p, in, inlen, 1544 &out, &outlen, &errstr); 1545 # endif /* SASL >= 20000 */ 1546 1547 if (result != SASL_OK && result != SASL_CONTINUE) 1548 { 1549 message("535 5.7.0 authentication failed"); 1550 if (LogLevel > 9) 1551 sm_syslog(LOG_ERR, e->e_id, 1552 "AUTH failure (%s): %s (%d) %s", 1553 p, 1554 sasl_errstring(result, NULL, 1555 NULL), 1556 result, 1557 # if SASL >= 20000 1558 sasl_errdetail(conn)); 1559 # else /* SASL >= 20000 */ 1560 errstr); 1561 # endif /* SASL >= 20000 */ 1562 RESET_SASLCONN; 1563 break; 1564 } 1565 auth_type = newstr(p); 1566 1567 if (result == SASL_OK) 1568 { 1569 /* ugly, but same code */ 1570 goto authenticated; 1571 /* authenticated by the initial response */ 1572 } 1573 1574 /* len is at least 2 */ 1575 len = ENC64LEN(outlen); 1576 out2 = xalloc(len); 1577 result = sasl_encode64(out, outlen, out2, len, 1578 &out2len); 1579 1580 if (result != SASL_OK) 1581 { 1582 message("454 4.5.4 Temporary authentication failure"); 1583 if (LogLevel > 5) 1584 sm_syslog(LOG_WARNING, e->e_id, 1585 "AUTH encode64 error [%d for \"%s\"]", 1586 result, out); 1587 1588 /* start over? */ 1589 authenticating = SASL_NOT_AUTH; 1590 RESET_SASLCONN; 1591 } 1592 else 1593 { 1594 message("334 %s", out2); 1595 authenticating = SASL_PROC_AUTH; 1596 } 1597 # if SASL >= 20000 1598 sm_free(out2); 1599 # endif /* SASL >= 20000 */ 1600 break; 1601 #endif /* SASL */ 1602 1603 #if STARTTLS 1604 case CMDSTLS: /* starttls */ 1605 DELAY_CONN("STARTTLS"); 1606 if (*p != '\0') 1607 { 1608 message("501 5.5.2 Syntax error (no parameters allowed)"); 1609 break; 1610 } 1611 if (!bitset(SRV_OFFER_TLS, features)) 1612 { 1613 message("503 5.5.0 TLS not available"); 1614 break; 1615 } 1616 if (!tls_ok_srv) 1617 { 1618 message("454 4.3.3 TLS not available after start"); 1619 break; 1620 } 1621 if (smtp.sm_gotmail) 1622 { 1623 message("503 5.5.0 TLS not permitted during a mail transaction"); 1624 break; 1625 } 1626 if (tempfail) 1627 { 1628 if (LogLevel > 9) 1629 sm_syslog(LOG_INFO, e->e_id, 1630 "SMTP STARTTLS command (%.100s) from %s tempfailed (due to previous checks)", 1631 p, CurSmtpClient); 1632 usrerr("454 4.7.0 Please try again later"); 1633 break; 1634 } 1635 starttls: 1636 # if TLS_NO_RSA 1637 /* 1638 ** XXX do we need a temp key ? 1639 */ 1640 # else /* TLS_NO_RSA */ 1641 # endif /* TLS_NO_RSA */ 1642 1643 # if TLS_VRFY_PER_CTX 1644 /* 1645 ** Note: this sets the verification globally 1646 ** (per SSL_CTX) 1647 ** it's ok since it applies only to one transaction 1648 */ 1649 1650 TLS_VERIFY_CLIENT(); 1651 # endif /* TLS_VRFY_PER_CTX */ 1652 1653 if (srv_ssl != NULL) 1654 SSL_clear(srv_ssl); 1655 else if ((srv_ssl = SSL_new(srv_ctx)) == NULL) 1656 { 1657 message("454 4.3.3 TLS not available: error generating SSL handle"); 1658 if (LogLevel > 8) 1659 tlslogerr("server"); 1660 goto tls_done; 1661 } 1662 1663 # if !TLS_VRFY_PER_CTX 1664 /* 1665 ** this could be used if it were possible to set 1666 ** verification per SSL (connection) 1667 ** not just per SSL_CTX (global) 1668 */ 1669 1670 TLS_VERIFY_CLIENT(); 1671 # endif /* !TLS_VRFY_PER_CTX */ 1672 1673 rfd = sm_io_getinfo(InChannel, SM_IO_WHAT_FD, NULL); 1674 wfd = sm_io_getinfo(OutChannel, SM_IO_WHAT_FD, NULL); 1675 1676 if (rfd < 0 || wfd < 0 || 1677 SSL_set_rfd(srv_ssl, rfd) <= 0 || 1678 SSL_set_wfd(srv_ssl, wfd) <= 0) 1679 { 1680 message("454 4.3.3 TLS not available: error set fd"); 1681 SSL_free(srv_ssl); 1682 srv_ssl = NULL; 1683 goto tls_done; 1684 } 1685 if (!smtps) 1686 message("220 2.0.0 Ready to start TLS"); 1687 # if PIPELINING 1688 (void) sm_io_flush(OutChannel, SM_TIME_DEFAULT); 1689 # endif /* PIPELINING */ 1690 1691 SSL_set_accept_state(srv_ssl); 1692 1693 # define SSL_ACC(s) SSL_accept(s) 1694 1695 tlsstart = curtime(); 1696 fdfl = fcntl(rfd, F_GETFL); 1697 if (fdfl != -1) 1698 fcntl(rfd, F_SETFL, fdfl|O_NONBLOCK); 1699 ssl_retry: 1700 if ((r = SSL_ACC(srv_ssl)) <= 0) 1701 { 1702 int i; 1703 bool timedout; 1704 time_t left; 1705 time_t now = curtime(); 1706 struct timeval tv; 1707 1708 /* what to do in this case? */ 1709 i = SSL_get_error(srv_ssl, r); 1710 1711 /* 1712 ** For SSL_ERROR_WANT_{READ,WRITE}: 1713 ** There is no SSL record available yet 1714 ** or there is only a partial SSL record 1715 ** removed from the network (socket) buffer 1716 ** into the SSL buffer. The SSL_accept will 1717 ** only succeed when a full SSL record is 1718 ** available (assuming a "real" error 1719 ** doesn't happen). To handle when a "real" 1720 ** error does happen the select is set for 1721 ** exceptions too. 1722 ** The connection may be re-negotiated 1723 ** during this time so both read and write 1724 ** "want errors" need to be handled. 1725 ** A select() exception loops back so that 1726 ** a proper SSL error message can be gotten. 1727 */ 1728 1729 left = TimeOuts.to_starttls - (now - tlsstart); 1730 timedout = left <= 0; 1731 if (!timedout) 1732 { 1733 tv.tv_sec = left; 1734 tv.tv_usec = 0; 1735 } 1736 1737 if (!timedout && FD_SETSIZE > 0 && 1738 (rfd >= FD_SETSIZE || 1739 (i == SSL_ERROR_WANT_WRITE && 1740 wfd >= FD_SETSIZE))) 1741 { 1742 if (LogLevel > 5) 1743 { 1744 sm_syslog(LOG_ERR, NOQID, 1745 "STARTTLS=server, error: fd %d/%d too large", 1746 rfd, wfd); 1747 if (LogLevel > 8) 1748 tlslogerr("server"); 1749 } 1750 goto tlsfail; 1751 } 1752 1753 /* XXX what about SSL_pending() ? */ 1754 if (!timedout && i == SSL_ERROR_WANT_READ) 1755 { 1756 fd_set ssl_maskr, ssl_maskx; 1757 1758 FD_ZERO(&ssl_maskr); 1759 FD_SET(rfd, &ssl_maskr); 1760 FD_ZERO(&ssl_maskx); 1761 FD_SET(rfd, &ssl_maskx); 1762 if (select(rfd + 1, &ssl_maskr, NULL, 1763 &ssl_maskx, &tv) > 0) 1764 goto ssl_retry; 1765 } 1766 if (!timedout && i == SSL_ERROR_WANT_WRITE) 1767 { 1768 fd_set ssl_maskw, ssl_maskx; 1769 1770 FD_ZERO(&ssl_maskw); 1771 FD_SET(wfd, &ssl_maskw); 1772 FD_ZERO(&ssl_maskx); 1773 FD_SET(rfd, &ssl_maskx); 1774 if (select(wfd + 1, NULL, &ssl_maskw, 1775 &ssl_maskx, &tv) > 0) 1776 goto ssl_retry; 1777 } 1778 if (LogLevel > 5) 1779 { 1780 sm_syslog(LOG_WARNING, NOQID, 1781 "STARTTLS=server, error: accept failed=%d, SSL_error=%d, timedout=%d, errno=%d", 1782 r, i, (int) timedout, errno); 1783 if (LogLevel > 8) 1784 tlslogerr("server"); 1785 } 1786 tlsfail: 1787 tls_ok_srv = false; 1788 SSL_free(srv_ssl); 1789 srv_ssl = NULL; 1790 1791 /* 1792 ** according to the next draft of 1793 ** RFC 2487 the connection should be dropped 1794 */ 1795 1796 /* arrange to ignore any current send list */ 1797 e->e_sendqueue = NULL; 1798 goto doquit; 1799 } 1800 1801 if (fdfl != -1) 1802 fcntl(rfd, F_SETFL, fdfl); 1803 1804 /* ignore return code for now, it's in {verify} */ 1805 (void) tls_get_info(srv_ssl, true, 1806 CurSmtpClient, 1807 &BlankEnvelope.e_macro, 1808 bitset(SRV_VRFY_CLT, features)); 1809 1810 /* 1811 ** call Stls_client to find out whether 1812 ** to accept the connection from the client 1813 */ 1814 1815 saveQuickAbort = QuickAbort; 1816 saveSuprErrs = SuprErrs; 1817 SuprErrs = true; 1818 QuickAbort = false; 1819 if (rscheck("tls_client", 1820 macvalue(macid("{verify}"), e), 1821 "STARTTLS", e, 1822 RSF_RMCOMM|RSF_COUNT, 1823 5, NULL, NOQID) != EX_OK || 1824 Errors > 0) 1825 { 1826 extern char MsgBuf[]; 1827 1828 if (MsgBuf[0] != '\0' && ISSMTPREPLY(MsgBuf)) 1829 nullserver = newstr(MsgBuf); 1830 else 1831 nullserver = "503 5.7.0 Authentication required."; 1832 } 1833 QuickAbort = saveQuickAbort; 1834 SuprErrs = saveSuprErrs; 1835 1836 tls_ok_srv = false; /* don't offer STARTTLS again */ 1837 n_helo = 0; 1838 # if SASL 1839 if (sasl_ok) 1840 { 1841 int cipher_bits; 1842 bool verified; 1843 char *s, *v, *c; 1844 1845 s = macvalue(macid("{cipher_bits}"), e); 1846 v = macvalue(macid("{verify}"), e); 1847 c = macvalue(macid("{cert_subject}"), e); 1848 verified = (v != NULL && strcmp(v, "OK") == 0); 1849 if (s != NULL && (cipher_bits = atoi(s)) > 0) 1850 { 1851 # if SASL >= 20000 1852 ext_ssf = cipher_bits; 1853 auth_id = verified ? c : NULL; 1854 sasl_ok = ((sasl_setprop(conn, 1855 SASL_SSF_EXTERNAL, 1856 &ext_ssf) == SASL_OK) && 1857 (sasl_setprop(conn, 1858 SASL_AUTH_EXTERNAL, 1859 auth_id) == SASL_OK)); 1860 # else /* SASL >= 20000 */ 1861 ext_ssf.ssf = cipher_bits; 1862 ext_ssf.auth_id = verified ? c : NULL; 1863 sasl_ok = sasl_setprop(conn, 1864 SASL_SSF_EXTERNAL, 1865 &ext_ssf) == SASL_OK; 1866 # endif /* SASL >= 20000 */ 1867 mechlist = NULL; 1868 if (sasl_ok) 1869 n_mechs = saslmechs(conn, 1870 &mechlist); 1871 } 1872 } 1873 # endif /* SASL */ 1874 1875 /* switch to secure connection */ 1876 if (sfdctls(&InChannel, &OutChannel, srv_ssl) == 0) 1877 { 1878 tls_active = true; 1879 # if PIPELINING 1880 (void) sm_io_autoflush(InChannel, OutChannel); 1881 # endif /* PIPELINING */ 1882 } 1883 else 1884 { 1885 /* 1886 ** XXX this is an internal error 1887 ** how to deal with it? 1888 ** we can't generate an error message 1889 ** since the other side switched to an 1890 ** encrypted layer, but we could not... 1891 ** just "hang up"? 1892 */ 1893 1894 nullserver = "454 4.3.3 TLS not available: can't switch to encrypted layer"; 1895 syserr("STARTTLS: can't switch to encrypted layer"); 1896 } 1897 tls_done: 1898 if (smtps) 1899 { 1900 if (tls_active) 1901 goto greeting; 1902 else 1903 goto doquit; 1904 } 1905 break; 1906 #endif /* STARTTLS */ 1907 1908 case CMDHELO: /* hello -- introduce yourself */ 1909 case CMDEHLO: /* extended hello */ 1910 DELAY_CONN("EHLO"); 1911 if (c->cmd_code == CMDEHLO) 1912 { 1913 protocol = "ESMTP"; 1914 SmtpPhase = "server EHLO"; 1915 } 1916 else 1917 { 1918 protocol = "SMTP"; 1919 SmtpPhase = "server HELO"; 1920 } 1921 1922 /* avoid denial-of-service */ 1923 STOP_IF_ATTACK(checksmtpattack(&n_helo, MAXHELOCOMMANDS, 1924 true, "HELO/EHLO", e)); 1925 1926 #if 0 1927 /* RFC2821 4.1.4 allows duplicate HELO/EHLO */ 1928 /* check for duplicate HELO/EHLO per RFC 1651 4.2 */ 1929 if (gothello) 1930 { 1931 usrerr("503 %s Duplicate HELO/EHLO", 1932 MyHostName); 1933 break; 1934 } 1935 #endif /* 0 */ 1936 1937 /* check for valid domain name (re 1123 5.2.5) */ 1938 if (*p == '\0' && !AllowBogusHELO) 1939 { 1940 usrerr("501 %s requires domain address", 1941 cmdbuf); 1942 break; 1943 } 1944 1945 /* check for long domain name (hides Received: info) */ 1946 if (strlen(p) > MAXNAME) 1947 { 1948 usrerr("501 Invalid domain name"); 1949 if (LogLevel > 9) 1950 sm_syslog(LOG_INFO, CurEnv->e_id, 1951 "invalid domain name (too long) from %s", 1952 CurSmtpClient); 1953 break; 1954 } 1955 1956 ok = true; 1957 for (q = p; *q != '\0'; q++) 1958 { 1959 if (!isascii(*q)) 1960 break; 1961 if (isalnum(*q)) 1962 continue; 1963 if (isspace(*q)) 1964 { 1965 *q = '\0'; 1966 1967 /* only complain if strict check */ 1968 ok = AllowBogusHELO; 1969 break; 1970 } 1971 if (strchr("[].-_#:", *q) == NULL) 1972 break; 1973 } 1974 1975 if (*q == '\0' && ok) 1976 { 1977 q = "pleased to meet you"; 1978 sendinghost = sm_strdup_x(p); 1979 } 1980 else if (!AllowBogusHELO) 1981 { 1982 usrerr("501 Invalid domain name"); 1983 if (LogLevel > 9) 1984 sm_syslog(LOG_INFO, CurEnv->e_id, 1985 "invalid domain name (%s) from %.100s", 1986 p, CurSmtpClient); 1987 break; 1988 } 1989 else 1990 { 1991 q = "accepting invalid domain name"; 1992 } 1993 1994 if (gothello) 1995 { 1996 CLEAR_STATE(cmdbuf); 1997 } 1998 1999 #if MILTER 2000 if (smtp.sm_milterlist && smtp.sm_milterize && 2001 !bitset(EF_DISCARD, e->e_flags)) 2002 { 2003 char state; 2004 char *response; 2005 2006 response = milter_helo(p, e, &state); 2007 switch (state) 2008 { 2009 case SMFIR_REPLYCODE: 2010 if (MilterLogLevel > 3) 2011 sm_syslog(LOG_INFO, e->e_id, 2012 "Milter: helo=%s, reject=%s", 2013 p, response); 2014 nullserver = newstr(response); 2015 smtp.sm_milterize = false; 2016 break; 2017 2018 case SMFIR_REJECT: 2019 if (MilterLogLevel > 3) 2020 sm_syslog(LOG_INFO, e->e_id, 2021 "Milter: helo=%s, reject=Command rejected", 2022 p); 2023 nullserver = "Command rejected"; 2024 smtp.sm_milterize = false; 2025 break; 2026 2027 case SMFIR_TEMPFAIL: 2028 if (MilterLogLevel > 3) 2029 sm_syslog(LOG_INFO, e->e_id, 2030 "Milter: helo=%s, reject=%s", 2031 p, MSG_TEMPFAIL); 2032 tempfail = true; 2033 smtp.sm_milterize = false; 2034 break; 2035 } 2036 if (response != NULL) 2037 sm_free(response); 2038 2039 /* 2040 ** If quarantining by a connect/ehlo action, 2041 ** save between messages 2042 */ 2043 2044 if (smtp.sm_quarmsg == NULL && 2045 e->e_quarmsg != NULL) 2046 smtp.sm_quarmsg = newstr(e->e_quarmsg); 2047 } 2048 #endif /* MILTER */ 2049 gothello = true; 2050 2051 /* print HELO response message */ 2052 if (c->cmd_code != CMDEHLO) 2053 { 2054 message("250 %s Hello %s, %s", 2055 MyHostName, CurSmtpClient, q); 2056 break; 2057 } 2058 2059 message("250-%s Hello %s, %s", 2060 MyHostName, CurSmtpClient, q); 2061 2062 /* offer ENHSC even for nullserver */ 2063 if (nullserver != NULL) 2064 { 2065 message("250 ENHANCEDSTATUSCODES"); 2066 break; 2067 } 2068 2069 /* 2070 ** print EHLO features list 2071 ** 2072 ** Note: If you change this list, 2073 ** remember to update 'helpfile' 2074 */ 2075 2076 message("250-ENHANCEDSTATUSCODES"); 2077 #if PIPELINING 2078 if (bitset(SRV_OFFER_PIPE, features)) 2079 message("250-PIPELINING"); 2080 #endif /* PIPELINING */ 2081 if (bitset(SRV_OFFER_EXPN, features)) 2082 { 2083 message("250-EXPN"); 2084 if (bitset(SRV_OFFER_VERB, features)) 2085 message("250-VERB"); 2086 } 2087 #if MIME8TO7 2088 message("250-8BITMIME"); 2089 #endif /* MIME8TO7 */ 2090 if (MaxMessageSize > 0) 2091 message("250-SIZE %ld", MaxMessageSize); 2092 else 2093 message("250-SIZE"); 2094 #if DSN 2095 if (SendMIMEErrors && bitset(SRV_OFFER_DSN, features)) 2096 message("250-DSN"); 2097 #endif /* DSN */ 2098 if (bitset(SRV_OFFER_ETRN, features)) 2099 message("250-ETRN"); 2100 #if SASL 2101 if (sasl_ok && mechlist != NULL && *mechlist != '\0') 2102 message("250-AUTH %s", mechlist); 2103 #endif /* SASL */ 2104 #if STARTTLS 2105 if (tls_ok_srv && 2106 bitset(SRV_OFFER_TLS, features)) 2107 message("250-STARTTLS"); 2108 #endif /* STARTTLS */ 2109 if (DeliverByMin > 0) 2110 message("250-DELIVERBY %ld", 2111 (long) DeliverByMin); 2112 else if (DeliverByMin == 0) 2113 message("250-DELIVERBY"); 2114 2115 /* < 0: no deliver-by */ 2116 2117 message("250 HELP"); 2118 break; 2119 2120 case CMDMAIL: /* mail -- designate sender */ 2121 SmtpPhase = "server MAIL"; 2122 DELAY_CONN("MAIL"); 2123 2124 /* check for validity of this command */ 2125 if (!gothello && bitset(PRIV_NEEDMAILHELO, PrivacyFlags)) 2126 { 2127 usrerr("503 5.0.0 Polite people say HELO first"); 2128 break; 2129 } 2130 if (smtp.sm_gotmail) 2131 { 2132 usrerr("503 5.5.0 Sender already specified"); 2133 break; 2134 } 2135 #if SASL 2136 if (bitset(SRV_REQ_AUTH, features) && 2137 authenticating != SASL_IS_AUTH) 2138 { 2139 usrerr("530 5.7.0 Authentication required"); 2140 break; 2141 } 2142 #endif /* SASL */ 2143 2144 p = skipword(p, "from"); 2145 if (p == NULL) 2146 break; 2147 if (tempfail) 2148 { 2149 if (LogLevel > 9) 2150 sm_syslog(LOG_INFO, e->e_id, 2151 "SMTP MAIL command (%.100s) from %s tempfailed (due to previous checks)", 2152 p, CurSmtpClient); 2153 usrerr(MSG_TEMPFAIL); 2154 break; 2155 } 2156 2157 /* make sure we know who the sending host is */ 2158 if (sendinghost == NULL) 2159 sendinghost = peerhostname; 2160 2161 2162 #if SM_HEAP_CHECK 2163 if (sm_debug_active(&DebugLeakSmtp, 1)) 2164 { 2165 sm_heap_newgroup(); 2166 sm_dprintf("smtp() heap group #%d\n", 2167 sm_heap_group()); 2168 } 2169 #endif /* SM_HEAP_CHECK */ 2170 2171 if (Errors > 0) 2172 goto undo_no_pm; 2173 if (!gothello) 2174 { 2175 auth_warning(e, "%s didn't use HELO protocol", 2176 CurSmtpClient); 2177 } 2178 #ifdef PICKY_HELO_CHECK 2179 if (sm_strcasecmp(sendinghost, peerhostname) != 0 && 2180 (sm_strcasecmp(peerhostname, "localhost") != 0 || 2181 sm_strcasecmp(sendinghost, MyHostName) != 0)) 2182 { 2183 auth_warning(e, "Host %s claimed to be %s", 2184 CurSmtpClient, sendinghost); 2185 } 2186 #endif /* PICKY_HELO_CHECK */ 2187 2188 if (protocol == NULL) 2189 protocol = "SMTP"; 2190 macdefine(&e->e_macro, A_PERM, 'r', protocol); 2191 macdefine(&e->e_macro, A_PERM, 's', sendinghost); 2192 2193 if (Errors > 0) 2194 goto undo_no_pm; 2195 smtp.sm_nrcpts = 0; 2196 n_badrcpts = 0; 2197 macdefine(&e->e_macro, A_PERM, macid("{ntries}"), "0"); 2198 macdefine(&e->e_macro, A_PERM, macid("{nrcpts}"), "0"); 2199 macdefine(&e->e_macro, A_PERM, macid("{nbadrcpts}"), 2200 "0"); 2201 e->e_flags |= EF_CLRQUEUE; 2202 sm_setproctitle(true, e, "%s %s: %.80s", 2203 qid_printname(e), 2204 CurSmtpClient, inp); 2205 2206 /* do the processing */ 2207 SM_TRY 2208 { 2209 extern char *FullName; 2210 2211 QuickAbort = true; 2212 SM_FREE_CLR(FullName); 2213 2214 /* must parse sender first */ 2215 delimptr = NULL; 2216 setsender(p, e, &delimptr, ' ', false); 2217 if (delimptr != NULL && *delimptr != '\0') 2218 *delimptr++ = '\0'; 2219 if (Errors > 0) 2220 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2221 2222 /* Successfully set e_from, allow logging */ 2223 e->e_flags |= EF_LOGSENDER; 2224 2225 /* put resulting triple from parseaddr() into macros */ 2226 if (e->e_from.q_mailer != NULL) 2227 macdefine(&e->e_macro, A_PERM, 2228 macid("{mail_mailer}"), 2229 e->e_from.q_mailer->m_name); 2230 else 2231 macdefine(&e->e_macro, A_PERM, 2232 macid("{mail_mailer}"), NULL); 2233 if (e->e_from.q_host != NULL) 2234 macdefine(&e->e_macro, A_PERM, 2235 macid("{mail_host}"), 2236 e->e_from.q_host); 2237 else 2238 macdefine(&e->e_macro, A_PERM, 2239 macid("{mail_host}"), "localhost"); 2240 if (e->e_from.q_user != NULL) 2241 macdefine(&e->e_macro, A_PERM, 2242 macid("{mail_addr}"), 2243 e->e_from.q_user); 2244 else 2245 macdefine(&e->e_macro, A_PERM, 2246 macid("{mail_addr}"), NULL); 2247 if (Errors > 0) 2248 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2249 2250 /* check for possible spoofing */ 2251 if (RealUid != 0 && OpMode == MD_SMTP && 2252 !wordinclass(RealUserName, 't') && 2253 (!bitnset(M_LOCALMAILER, 2254 e->e_from.q_mailer->m_flags) || 2255 strcmp(e->e_from.q_user, RealUserName) != 0)) 2256 { 2257 auth_warning(e, "%s owned process doing -bs", 2258 RealUserName); 2259 } 2260 2261 /* reset to default value */ 2262 SevenBitInput = save_sevenbitinput; 2263 2264 /* now parse ESMTP arguments */ 2265 e->e_msgsize = 0; 2266 addr = p; 2267 argno = 0; 2268 args[argno++] = p; 2269 p = delimptr; 2270 while (p != NULL && *p != '\0') 2271 { 2272 char *kp; 2273 char *vp = NULL; 2274 char *equal = NULL; 2275 2276 /* locate the beginning of the keyword */ 2277 SKIP_SPACE(p); 2278 if (*p == '\0') 2279 break; 2280 kp = p; 2281 2282 /* skip to the value portion */ 2283 while ((isascii(*p) && isalnum(*p)) || *p == '-') 2284 p++; 2285 if (*p == '=') 2286 { 2287 equal = p; 2288 *p++ = '\0'; 2289 vp = p; 2290 2291 /* skip to the end of the value */ 2292 while (*p != '\0' && *p != ' ' && 2293 !(isascii(*p) && iscntrl(*p)) && 2294 *p != '=') 2295 p++; 2296 } 2297 2298 if (*p != '\0') 2299 *p++ = '\0'; 2300 2301 if (tTd(19, 1)) 2302 sm_dprintf("MAIL: got arg %s=\"%s\"\n", kp, 2303 vp == NULL ? "<null>" : vp); 2304 2305 mail_esmtp_args(kp, vp, e); 2306 if (equal != NULL) 2307 *equal = '='; 2308 args[argno++] = kp; 2309 if (argno >= MAXSMTPARGS - 1) 2310 usrerr("501 5.5.4 Too many parameters"); 2311 if (Errors > 0) 2312 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2313 } 2314 args[argno] = NULL; 2315 if (Errors > 0) 2316 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2317 2318 #if SASL 2319 # if _FFR_AUTH_PASSING 2320 /* set the default AUTH= if the sender didn't */ 2321 if (e->e_auth_param == NULL) 2322 { 2323 /* XXX only do this for an MSA? */ 2324 e->e_auth_param = macvalue(macid("{auth_authen}"), 2325 e); 2326 if (e->e_auth_param == NULL) 2327 e->e_auth_param = "<>"; 2328 2329 /* 2330 ** XXX should we invoke Strust_auth now? 2331 ** authorizing as the client that just 2332 ** authenticated, so we'll trust implicitly 2333 */ 2334 } 2335 # endif /* _FFR_AUTH_PASSING */ 2336 #endif /* SASL */ 2337 2338 /* do config file checking of the sender */ 2339 macdefine(&e->e_macro, A_PERM, 2340 macid("{addr_type}"), "e s"); 2341 #if _FFR_MAIL_MACRO 2342 /* make the "real" sender address available */ 2343 macdefine(&e->e_macro, A_TEMP, macid("{mail_from}"), 2344 e->e_from.q_paddr); 2345 #endif /* _FFR_MAIL_MACRO */ 2346 if (rscheck("check_mail", addr, 2347 NULL, e, RSF_RMCOMM|RSF_COUNT, 3, 2348 NULL, e->e_id) != EX_OK || 2349 Errors > 0) 2350 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2351 macdefine(&e->e_macro, A_PERM, 2352 macid("{addr_type}"), NULL); 2353 2354 if (MaxMessageSize > 0 && 2355 (e->e_msgsize > MaxMessageSize || 2356 e->e_msgsize < 0)) 2357 { 2358 usrerr("552 5.2.3 Message size exceeds fixed maximum message size (%ld)", 2359 MaxMessageSize); 2360 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2361 } 2362 2363 /* 2364 ** XXX always check whether there is at least one fs 2365 ** with enough space? 2366 ** However, this may not help much: the queue group 2367 ** selection may later on select a FS that hasn't 2368 ** enough space. 2369 */ 2370 2371 if ((NumFileSys == 1 || NumQueue == 1) && 2372 !enoughdiskspace(e->e_msgsize, e) 2373 #if _FFR_ANY_FREE_FS 2374 && !filesys_free(e->e_msgsize) 2375 #endif /* _FFR_ANY_FREE_FS */ 2376 ) 2377 { 2378 /* 2379 ** We perform this test again when the 2380 ** queue directory is selected, in collect. 2381 */ 2382 2383 usrerr("452 4.4.5 Insufficient disk space; try again later"); 2384 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2385 } 2386 if (Errors > 0) 2387 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2388 2389 LogUsrErrs = true; 2390 #if MILTER 2391 if (smtp.sm_milterlist && smtp.sm_milterize && 2392 !bitset(EF_DISCARD, e->e_flags)) 2393 { 2394 char state; 2395 char *response; 2396 2397 response = milter_envfrom(args, e, &state); 2398 MILTER_REPLY("from"); 2399 } 2400 #endif /* MILTER */ 2401 if (Errors > 0) 2402 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2403 2404 message("250 2.1.0 Sender ok"); 2405 smtp.sm_gotmail = true; 2406 } 2407 SM_EXCEPT(exc, "[!F]*") 2408 { 2409 /* 2410 ** An error occurred while processing a MAIL command. 2411 ** Jump to the common error handling code. 2412 */ 2413 2414 sm_exc_free(exc); 2415 goto undo_no_pm; 2416 } 2417 SM_END_TRY 2418 break; 2419 2420 undo_no_pm: 2421 e->e_flags &= ~EF_PM_NOTIFY; 2422 undo: 2423 break; 2424 2425 case CMDRCPT: /* rcpt -- designate recipient */ 2426 DELAY_CONN("RCPT"); 2427 if (BadRcptThrottle > 0 && 2428 n_badrcpts >= BadRcptThrottle) 2429 { 2430 if (LogLevel > 5 && 2431 n_badrcpts == BadRcptThrottle) 2432 { 2433 sm_syslog(LOG_INFO, e->e_id, 2434 "%s: Possible SMTP RCPT flood, throttling.", 2435 CurSmtpClient); 2436 2437 /* To avoid duplicated message */ 2438 n_badrcpts++; 2439 } 2440 NBADRCPTS; 2441 2442 /* 2443 ** Don't use exponential backoff for now. 2444 ** Some servers will open more connections 2445 ** and actually overload the receiver even 2446 ** more. 2447 */ 2448 2449 (void) sleep(1); 2450 } 2451 if (!smtp.sm_gotmail) 2452 { 2453 usrerr("503 5.0.0 Need MAIL before RCPT"); 2454 break; 2455 } 2456 SmtpPhase = "server RCPT"; 2457 SM_TRY 2458 { 2459 QuickAbort = true; 2460 LogUsrErrs = true; 2461 2462 /* limit flooding of our machine */ 2463 if (MaxRcptPerMsg > 0 && 2464 smtp.sm_nrcpts >= MaxRcptPerMsg) 2465 { 2466 /* sleep(1); / * slow down? */ 2467 usrerr("452 4.5.3 Too many recipients"); 2468 goto rcpt_done; 2469 } 2470 2471 if (e->e_sendmode != SM_DELIVER) 2472 e->e_flags |= EF_VRFYONLY; 2473 2474 #if MILTER 2475 /* 2476 ** If the filter will be deleting recipients, 2477 ** don't expand them at RCPT time (in the call 2478 ** to recipient()). If they are expanded, it 2479 ** is impossible for removefromlist() to figure 2480 ** out the expanded members of the original 2481 ** recipient and mark them as QS_DONTSEND. 2482 */ 2483 2484 if (milter_can_delrcpts()) 2485 e->e_flags |= EF_VRFYONLY; 2486 #endif /* MILTER */ 2487 2488 p = skipword(p, "to"); 2489 if (p == NULL) 2490 goto rcpt_done; 2491 macdefine(&e->e_macro, A_PERM, 2492 macid("{addr_type}"), "e r"); 2493 a = parseaddr(p, NULLADDR, RF_COPYALL, ' ', &delimptr, 2494 e, true); 2495 macdefine(&e->e_macro, A_PERM, 2496 macid("{addr_type}"), NULL); 2497 if (Errors > 0) 2498 goto rcpt_done; 2499 if (a == NULL) 2500 { 2501 usrerr("501 5.0.0 Missing recipient"); 2502 goto rcpt_done; 2503 } 2504 2505 if (delimptr != NULL && *delimptr != '\0') 2506 *delimptr++ = '\0'; 2507 2508 /* put resulting triple from parseaddr() into macros */ 2509 if (a->q_mailer != NULL) 2510 macdefine(&e->e_macro, A_PERM, 2511 macid("{rcpt_mailer}"), 2512 a->q_mailer->m_name); 2513 else 2514 macdefine(&e->e_macro, A_PERM, 2515 macid("{rcpt_mailer}"), NULL); 2516 if (a->q_host != NULL) 2517 macdefine(&e->e_macro, A_PERM, 2518 macid("{rcpt_host}"), a->q_host); 2519 else 2520 macdefine(&e->e_macro, A_PERM, 2521 macid("{rcpt_host}"), "localhost"); 2522 if (a->q_user != NULL) 2523 macdefine(&e->e_macro, A_PERM, 2524 macid("{rcpt_addr}"), a->q_user); 2525 else 2526 macdefine(&e->e_macro, A_PERM, 2527 macid("{rcpt_addr}"), NULL); 2528 if (Errors > 0) 2529 goto rcpt_done; 2530 2531 /* now parse ESMTP arguments */ 2532 addr = p; 2533 argno = 0; 2534 args[argno++] = p; 2535 p = delimptr; 2536 while (p != NULL && *p != '\0') 2537 { 2538 char *kp; 2539 char *vp = NULL; 2540 char *equal = NULL; 2541 2542 /* locate the beginning of the keyword */ 2543 SKIP_SPACE(p); 2544 if (*p == '\0') 2545 break; 2546 kp = p; 2547 2548 /* skip to the value portion */ 2549 while ((isascii(*p) && isalnum(*p)) || *p == '-') 2550 p++; 2551 if (*p == '=') 2552 { 2553 equal = p; 2554 *p++ = '\0'; 2555 vp = p; 2556 2557 /* skip to the end of the value */ 2558 while (*p != '\0' && *p != ' ' && 2559 !(isascii(*p) && iscntrl(*p)) && 2560 *p != '=') 2561 p++; 2562 } 2563 2564 if (*p != '\0') 2565 *p++ = '\0'; 2566 2567 if (tTd(19, 1)) 2568 sm_dprintf("RCPT: got arg %s=\"%s\"\n", kp, 2569 vp == NULL ? "<null>" : vp); 2570 2571 rcpt_esmtp_args(a, kp, vp, e); 2572 if (equal != NULL) 2573 *equal = '='; 2574 args[argno++] = kp; 2575 if (argno >= MAXSMTPARGS - 1) 2576 usrerr("501 5.5.4 Too many parameters"); 2577 if (Errors > 0) 2578 break; 2579 } 2580 args[argno] = NULL; 2581 if (Errors > 0) 2582 goto rcpt_done; 2583 2584 /* do config file checking of the recipient */ 2585 macdefine(&e->e_macro, A_PERM, 2586 macid("{addr_type}"), "e r"); 2587 if (rscheck("check_rcpt", addr, 2588 NULL, e, RSF_RMCOMM|RSF_COUNT, 3, 2589 NULL, e->e_id) != EX_OK || 2590 Errors > 0) 2591 goto rcpt_done; 2592 macdefine(&e->e_macro, A_PERM, 2593 macid("{addr_type}"), NULL); 2594 2595 /* If discarding, don't bother to verify user */ 2596 if (bitset(EF_DISCARD, e->e_flags)) 2597 a->q_state = QS_VERIFIED; 2598 2599 #if MILTER 2600 if (smtp.sm_milterlist && smtp.sm_milterize && 2601 !bitset(EF_DISCARD, e->e_flags)) 2602 { 2603 char state; 2604 char *response; 2605 2606 response = milter_envrcpt(args, e, &state); 2607 MILTER_REPLY("to"); 2608 } 2609 #endif /* MILTER */ 2610 2611 macdefine(&e->e_macro, A_PERM, 2612 macid("{rcpt_mailer}"), NULL); 2613 macdefine(&e->e_macro, A_PERM, 2614 macid("{rcpt_host}"), NULL); 2615 macdefine(&e->e_macro, A_PERM, 2616 macid("{rcpt_addr}"), NULL); 2617 macdefine(&e->e_macro, A_PERM, 2618 macid("{dsn_notify}"), NULL); 2619 if (Errors > 0) 2620 goto rcpt_done; 2621 2622 /* save in recipient list after ESMTP mods */ 2623 a = recipient(a, &e->e_sendqueue, 0, e); 2624 if (Errors > 0) 2625 goto rcpt_done; 2626 2627 /* no errors during parsing, but might be a duplicate */ 2628 e->e_to = a->q_paddr; 2629 if (!QS_IS_BADADDR(a->q_state)) 2630 { 2631 if (smtp.sm_nrcpts == 0) 2632 initsys(e); 2633 message("250 2.1.5 Recipient ok%s", 2634 QS_IS_QUEUEUP(a->q_state) ? 2635 " (will queue)" : ""); 2636 smtp.sm_nrcpts++; 2637 } 2638 else 2639 { 2640 /* punt -- should keep message in ADDRESS.... */ 2641 usrerr("550 5.1.1 Addressee unknown"); 2642 } 2643 rcpt_done: 2644 if (Errors > 0) 2645 { 2646 ++n_badrcpts; 2647 NBADRCPTS; 2648 } 2649 } 2650 SM_EXCEPT(exc, "[!F]*") 2651 { 2652 /* An exception occurred while processing RCPT */ 2653 e->e_flags &= ~(EF_FATALERRS|EF_PM_NOTIFY); 2654 ++n_badrcpts; 2655 NBADRCPTS; 2656 } 2657 SM_END_TRY 2658 break; 2659 2660 case CMDDATA: /* data -- text of mail */ 2661 DELAY_CONN("DATA"); 2662 if (!smtp_data(&smtp, e)) 2663 goto doquit; 2664 break; 2665 2666 case CMDRSET: /* rset -- reset state */ 2667 if (tTd(94, 100)) 2668 message("451 4.0.0 Test failure"); 2669 else 2670 message("250 2.0.0 Reset state"); 2671 CLEAR_STATE(cmdbuf); 2672 break; 2673 2674 case CMDVRFY: /* vrfy -- verify address */ 2675 case CMDEXPN: /* expn -- expand address */ 2676 vrfy = c->cmd_code == CMDVRFY; 2677 DELAY_CONN(vrfy ? "VRFY" : "EXPN"); 2678 if (tempfail) 2679 { 2680 if (LogLevel > 9) 2681 sm_syslog(LOG_INFO, e->e_id, 2682 "SMTP %s command (%.100s) from %s tempfailed (due to previous checks)", 2683 vrfy ? "VRFY" : "EXPN", 2684 p, CurSmtpClient); 2685 2686 /* RFC 821 doesn't allow 4xy reply code */ 2687 usrerr("550 5.7.1 Please try again later"); 2688 break; 2689 } 2690 wt = checksmtpattack(&n_verifies, MAXVRFYCOMMANDS, 2691 false, vrfy ? "VRFY" : "EXPN", e); 2692 STOP_IF_ATTACK(wt); 2693 previous = curtime(); 2694 if ((vrfy && bitset(PRIV_NOVRFY, PrivacyFlags)) || 2695 (!vrfy && !bitset(SRV_OFFER_EXPN, features))) 2696 { 2697 if (vrfy) 2698 message("252 2.5.2 Cannot VRFY user; try RCPT to attempt delivery (or try finger)"); 2699 else 2700 message("502 5.7.0 Sorry, we do not allow this operation"); 2701 if (LogLevel > 5) 2702 sm_syslog(LOG_INFO, e->e_id, 2703 "%s: %s [rejected]", 2704 CurSmtpClient, 2705 shortenstring(inp, MAXSHORTSTR)); 2706 break; 2707 } 2708 else if (!gothello && 2709 bitset(vrfy ? PRIV_NEEDVRFYHELO : PRIV_NEEDEXPNHELO, 2710 PrivacyFlags)) 2711 { 2712 usrerr("503 5.0.0 I demand that you introduce yourself first"); 2713 break; 2714 } 2715 if (Errors > 0) 2716 break; 2717 if (LogLevel > 5) 2718 sm_syslog(LOG_INFO, e->e_id, "%s: %s", 2719 CurSmtpClient, 2720 shortenstring(inp, MAXSHORTSTR)); 2721 SM_TRY 2722 { 2723 QuickAbort = true; 2724 vrfyqueue = NULL; 2725 if (vrfy) 2726 e->e_flags |= EF_VRFYONLY; 2727 while (*p != '\0' && isascii(*p) && isspace(*p)) 2728 p++; 2729 if (*p == '\0') 2730 { 2731 usrerr("501 5.5.2 Argument required"); 2732 } 2733 else 2734 { 2735 /* do config file checking of the address */ 2736 if (rscheck(vrfy ? "check_vrfy" : "check_expn", 2737 p, NULL, e, RSF_RMCOMM, 2738 3, NULL, NOQID) != EX_OK || 2739 Errors > 0) 2740 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2741 (void) sendtolist(p, NULLADDR, &vrfyqueue, 0, e); 2742 } 2743 if (wt > 0) 2744 { 2745 time_t t; 2746 2747 t = wt - (curtime() - previous); 2748 if (t > 0) 2749 (void) sleep(t); 2750 } 2751 if (Errors > 0) 2752 sm_exc_raisenew_x(&EtypeQuickAbort, 1); 2753 if (vrfyqueue == NULL) 2754 { 2755 usrerr("554 5.5.2 Nothing to %s", vrfy ? "VRFY" : "EXPN"); 2756 } 2757 while (vrfyqueue != NULL) 2758 { 2759 if (!QS_IS_UNDELIVERED(vrfyqueue->q_state)) 2760 { 2761 vrfyqueue = vrfyqueue->q_next; 2762 continue; 2763 } 2764 2765 /* see if there is more in the vrfy list */ 2766 a = vrfyqueue; 2767 while ((a = a->q_next) != NULL && 2768 (!QS_IS_UNDELIVERED(a->q_state))) 2769 continue; 2770 printvrfyaddr(vrfyqueue, a == NULL, vrfy); 2771 vrfyqueue = a; 2772 } 2773 } 2774 SM_EXCEPT(exc, "[!F]*") 2775 { 2776 /* 2777 ** An exception occurred while processing VRFY/EXPN 2778 */ 2779 2780 sm_exc_free(exc); 2781 goto undo; 2782 } 2783 SM_END_TRY 2784 break; 2785 2786 case CMDETRN: /* etrn -- force queue flush */ 2787 DELAY_CONN("ETRN"); 2788 2789 /* Don't leak queue information via debug flags */ 2790 if (!bitset(SRV_OFFER_ETRN, features) || UseMSP || 2791 (RealUid != 0 && RealUid != TrustedUid && 2792 OpMode == MD_SMTP)) 2793 { 2794 /* different message for MSA ? */ 2795 message("502 5.7.0 Sorry, we do not allow this operation"); 2796 if (LogLevel > 5) 2797 sm_syslog(LOG_INFO, e->e_id, 2798 "%s: %s [rejected]", 2799 CurSmtpClient, 2800 shortenstring(inp, MAXSHORTSTR)); 2801 break; 2802 } 2803 if (tempfail) 2804 { 2805 if (LogLevel > 9) 2806 sm_syslog(LOG_INFO, e->e_id, 2807 "SMTP ETRN command (%.100s) from %s tempfailed (due to previous checks)", 2808 p, CurSmtpClient); 2809 usrerr(MSG_TEMPFAIL); 2810 break; 2811 } 2812 2813 if (strlen(p) <= 0) 2814 { 2815 usrerr("500 5.5.2 Parameter required"); 2816 break; 2817 } 2818 2819 /* crude way to avoid denial-of-service attacks */ 2820 STOP_IF_ATTACK(checksmtpattack(&n_etrn, MAXETRNCOMMANDS, 2821 true, "ETRN", e)); 2822 2823 /* 2824 ** Do config file checking of the parameter. 2825 ** Even though we have srv_features now, we still 2826 ** need this ruleset because the former is called 2827 ** when the connection has been established, while 2828 ** this ruleset is called when the command is 2829 ** actually issued and therefore has all information 2830 ** available to make a decision. 2831 */ 2832 2833 if (rscheck("check_etrn", p, NULL, e, 2834 RSF_RMCOMM, 3, NULL, NOQID) != EX_OK || 2835 Errors > 0) 2836 break; 2837 2838 if (LogLevel > 5) 2839 sm_syslog(LOG_INFO, e->e_id, 2840 "%s: ETRN %s", CurSmtpClient, 2841 shortenstring(p, MAXSHORTSTR)); 2842 2843 id = p; 2844 if (*id == '#') 2845 { 2846 int i, qgrp; 2847 2848 id++; 2849 qgrp = name2qid(id); 2850 if (!ISVALIDQGRP(qgrp)) 2851 { 2852 usrerr("459 4.5.4 Queue %s unknown", 2853 id); 2854 break; 2855 } 2856 for (i = 0; i < NumQueue && Queue[i] != NULL; 2857 i++) 2858 Queue[i]->qg_nextrun = (time_t) -1; 2859 Queue[qgrp]->qg_nextrun = 0; 2860 ok = run_work_group(Queue[qgrp]->qg_wgrp, 2861 RWG_FORK|RWG_FORCE); 2862 if (ok && Errors == 0) 2863 message("250 2.0.0 Queuing for queue group %s started", id); 2864 break; 2865 } 2866 2867 if (*id == '@') 2868 id++; 2869 else 2870 *--id = '@'; 2871 2872 new = (QUEUE_CHAR *) sm_malloc(sizeof(QUEUE_CHAR)); 2873 if (new == NULL) 2874 { 2875 syserr("500 5.5.0 ETRN out of memory"); 2876 break; 2877 } 2878 new->queue_match = id; 2879 new->queue_negate = false; 2880 new->queue_next = NULL; 2881 QueueLimitRecipient = new; 2882 ok = runqueue(true, false, false, true); 2883 sm_free(QueueLimitRecipient); /* XXX */ 2884 QueueLimitRecipient = NULL; 2885 if (ok && Errors == 0) 2886 message("250 2.0.0 Queuing for node %s started", p); 2887 break; 2888 2889 case CMDHELP: /* help -- give user info */ 2890 DELAY_CONN("HELP"); 2891 help(p, e); 2892 break; 2893 2894 case CMDNOOP: /* noop -- do nothing */ 2895 DELAY_CONN("NOOP"); 2896 STOP_IF_ATTACK(checksmtpattack(&n_noop, MAXNOOPCOMMANDS, 2897 true, "NOOP", e)); 2898 message("250 2.0.0 OK"); 2899 break; 2900 2901 case CMDQUIT: /* quit -- leave mail */ 2902 message("221 2.0.0 %s closing connection", MyHostName); 2903 #if PIPELINING 2904 (void) sm_io_flush(OutChannel, SM_TIME_DEFAULT); 2905 #endif /* PIPELINING */ 2906 2907 if (smtp.sm_nrcpts > 0) 2908 logundelrcpts(e, "aborted by sender", 9, false); 2909 2910 /* arrange to ignore any current send list */ 2911 e->e_sendqueue = NULL; 2912 2913 #if STARTTLS 2914 /* shutdown TLS connection */ 2915 if (tls_active) 2916 { 2917 (void) endtls(srv_ssl, "server"); 2918 tls_active = false; 2919 } 2920 #endif /* STARTTLS */ 2921 #if SASL 2922 if (authenticating == SASL_IS_AUTH) 2923 { 2924 sasl_dispose(&conn); 2925 authenticating = SASL_NOT_AUTH; 2926 /* XXX sasl_done(); this is a child */ 2927 } 2928 #endif /* SASL */ 2929 2930 doquit: 2931 /* avoid future 050 messages */ 2932 disconnect(1, e); 2933 2934 #if MILTER 2935 /* close out milter filters */ 2936 milter_quit(e); 2937 #endif /* MILTER */ 2938 2939 if (LogLevel > 4 && bitset(EF_LOGSENDER, e->e_flags)) 2940 logsender(e, NULL); 2941 e->e_flags &= ~EF_LOGSENDER; 2942 2943 if (lognullconnection && LogLevel > 5 && 2944 nullserver == NULL) 2945 { 2946 char *d; 2947 2948 d = macvalue(macid("{daemon_name}"), e); 2949 if (d == NULL) 2950 d = "stdin"; 2951 2952 /* 2953 ** even though this id is "bogus", it makes 2954 ** it simpler to "grep" related events, e.g., 2955 ** timeouts for the same connection. 2956 */ 2957 2958 sm_syslog(LOG_INFO, e->e_id, 2959 "%s did not issue MAIL/EXPN/VRFY/ETRN during connection to %s", 2960 CurSmtpClient, d); 2961 } 2962 if (tTd(93, 100)) 2963 { 2964 /* return to handle next connection */ 2965 return; 2966 } 2967 finis(true, true, ExitStat); 2968 /* NOTREACHED */ 2969 2970 case CMDVERB: /* set verbose mode */ 2971 DELAY_CONN("VERB"); 2972 if (!bitset(SRV_OFFER_EXPN, features) || 2973 !bitset(SRV_OFFER_VERB, features)) 2974 { 2975 /* this would give out the same info */ 2976 message("502 5.7.0 Verbose unavailable"); 2977 break; 2978 } 2979 STOP_IF_ATTACK(checksmtpattack(&n_noop, MAXNOOPCOMMANDS, 2980 true, "VERB", e)); 2981 Verbose = 1; 2982 set_delivery_mode(SM_DELIVER, e); 2983 message("250 2.0.0 Verbose mode"); 2984 break; 2985 2986 #if SMTPDEBUG 2987 case CMDDBGQSHOW: /* show queues */ 2988 (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT, 2989 "Send Queue="); 2990 printaddr(smioout, e->e_sendqueue, true); 2991 break; 2992 2993 case CMDDBGDEBUG: /* set debug mode */ 2994 tTsetup(tTdvect, sizeof tTdvect, "0-99.1"); 2995 tTflag(p); 2996 message("200 2.0.0 Debug set"); 2997 break; 2998 2999 #else /* SMTPDEBUG */ 3000 case CMDDBGQSHOW: /* show queues */ 3001 case CMDDBGDEBUG: /* set debug mode */ 3002 #endif /* SMTPDEBUG */ 3003 case CMDLOGBOGUS: /* bogus command */ 3004 DELAY_CONN("Bogus"); 3005 if (LogLevel > 0) 3006 sm_syslog(LOG_CRIT, e->e_id, 3007 "\"%s\" command from %s (%.100s)", 3008 c->cmd_name, CurSmtpClient, 3009 anynet_ntoa(&RealHostAddr)); 3010 /* FALLTHROUGH */ 3011 3012 case CMDERROR: /* unknown command */ 3013 #if MAXBADCOMMANDS > 0 3014 if (++n_badcmds > MAXBADCOMMANDS) 3015 { 3016 stopattack: 3017 message("421 4.7.0 %s Too many bad commands; closing connection", 3018 MyHostName); 3019 3020 /* arrange to ignore any current send list */ 3021 e->e_sendqueue = NULL; 3022 goto doquit; 3023 } 3024 #endif /* MAXBADCOMMANDS > 0 */ 3025 3026 #if MILTER && SMFI_VERSION > 2 3027 if (smtp.sm_milterlist && smtp.sm_milterize && 3028 !bitset(EF_DISCARD, e->e_flags)) 3029 { 3030 char state; 3031 char *response; 3032 3033 if (MilterLogLevel > 9) 3034 sm_syslog(LOG_INFO, e->e_id, 3035 "Sending \"%s\" to Milter", inp); 3036 response = milter_unknown(inp, e, &state); 3037 MILTER_REPLY("unknown"); 3038 if (state == SMFIR_REPLYCODE || 3039 state == SMFIR_REJECT || 3040 state == SMFIR_TEMPFAIL) 3041 { 3042 /* MILTER_REPLY already gave an error */ 3043 break; 3044 } 3045 } 3046 #endif /* MILTER && SMFI_VERSION > 2 */ 3047 3048 usrerr("500 5.5.1 Command unrecognized: \"%s\"", 3049 shortenstring(inp, MAXSHORTSTR)); 3050 break; 3051 3052 case CMDUNIMPL: 3053 DELAY_CONN("Unimpl"); 3054 usrerr("502 5.5.1 Command not implemented: \"%s\"", 3055 shortenstring(inp, MAXSHORTSTR)); 3056 break; 3057 3058 default: 3059 DELAY_CONN("default"); 3060 errno = 0; 3061 syserr("500 5.5.0 smtp: unknown code %d", c->cmd_code); 3062 break; 3063 } 3064 #if SASL 3065 } 3066 #endif /* SASL */ 3067 } 3068 SM_EXCEPT(exc, "[!F]*") 3069 { 3070 /* 3071 ** The only possible exception is "E:mta.quickabort". 3072 ** There is nothing to do except fall through and loop. 3073 */ 3074 } 3075 SM_END_TRY 3076 } 3077 } 3078 /* 3079 ** SMTP_DATA -- implement the SMTP DATA command. 3080 ** 3081 ** Parameters: 3082 ** smtp -- status of SMTP connection. 3083 ** e -- envelope. 3084 ** 3085 ** Returns: 3086 ** true iff SMTP session can continue. 3087 ** 3088 ** Side Effects: 3089 ** possibly sends message. 3090 */ 3091 3092 static bool 3093 smtp_data(smtp, e) 3094 SMTP_T *smtp; 3095 ENVELOPE *e; 3096 { 3097 #if MILTER 3098 bool milteraccept; 3099 #endif /* MILTER */ 3100 bool aborting; 3101 bool doublequeue; 3102 ADDRESS *a; 3103 ENVELOPE *ee; 3104 char *id; 3105 char *oldid; 3106 char buf[32]; 3107 3108 SmtpPhase = "server DATA"; 3109 if (!smtp->sm_gotmail) 3110 { 3111 usrerr("503 5.0.0 Need MAIL command"); 3112 return true; 3113 } 3114 else if (smtp->sm_nrcpts <= 0) 3115 { 3116 usrerr("503 5.0.0 Need RCPT (recipient)"); 3117 return true; 3118 } 3119 (void) sm_snprintf(buf, sizeof buf, "%u", smtp->sm_nrcpts); 3120 if (rscheck("check_data", buf, NULL, e, 3121 RSF_RMCOMM|RSF_UNSTRUCTURED|RSF_COUNT, 3, NULL, 3122 e->e_id) != EX_OK) 3123 return true; 3124 3125 #if MILTER && SMFI_VERSION > 3 3126 if (smtp->sm_milterlist && smtp->sm_milterize && 3127 !bitset(EF_DISCARD, e->e_flags)) 3128 { 3129 char state; 3130 char *response; 3131 int savelogusrerrs = LogUsrErrs; 3132 3133 response = milter_data_cmd(e, &state); 3134 switch (state) 3135 { 3136 case SMFIR_REPLYCODE: 3137 if (MilterLogLevel > 3) 3138 { 3139 sm_syslog(LOG_INFO, e->e_id, 3140 "Milter: cmd=data, reject=%s", 3141 response); 3142 LogUsrErrs = false; 3143 } 3144 usrerr(response); 3145 if (strncmp(response, "421 ", 4) == 0) 3146 { 3147 e->e_sendqueue = NULL; 3148 return false; 3149 } 3150 return true; 3151 3152 case SMFIR_REJECT: 3153 if (MilterLogLevel > 3) 3154 { 3155 sm_syslog(LOG_INFO, e->e_id, 3156 "Milter: cmd=data, reject=550 5.7.1 Command rejected"); 3157 LogUsrErrs = false; 3158 } 3159 usrerr("550 5.7.1 Command rejected"); 3160 return true; 3161 3162 case SMFIR_DISCARD: 3163 if (MilterLogLevel > 3) 3164 sm_syslog(LOG_INFO, e->e_id, 3165 "Milter: cmd=data, discard"); 3166 e->e_flags |= EF_DISCARD; 3167 break; 3168 3169 case SMFIR_TEMPFAIL: 3170 if (MilterLogLevel > 3) 3171 { 3172 sm_syslog(LOG_INFO, e->e_id, 3173 "Milter: cmd=data, reject=%s", 3174 MSG_TEMPFAIL); 3175 LogUsrErrs = false; 3176 } 3177 usrerr(MSG_TEMPFAIL); 3178 return true; 3179 } 3180 LogUsrErrs = savelogusrerrs; 3181 if (response != NULL) 3182 sm_free(response); /* XXX */ 3183 } 3184 #endif /* MILTER && SMFI_VERSION > 3 */ 3185 3186 /* put back discard bit */ 3187 if (smtp->sm_discard) 3188 e->e_flags |= EF_DISCARD; 3189 3190 /* check to see if we need to re-expand aliases */ 3191 /* also reset QS_BADADDR on already-diagnosted addrs */ 3192 doublequeue = false; 3193 for (a = e->e_sendqueue; a != NULL; a = a->q_next) 3194 { 3195 if (QS_IS_VERIFIED(a->q_state) && 3196 !bitset(EF_DISCARD, e->e_flags)) 3197 { 3198 /* need to re-expand aliases */ 3199 doublequeue = true; 3200 } 3201 if (QS_IS_BADADDR(a->q_state)) 3202 { 3203 /* make this "go away" */ 3204 a->q_state = QS_DONTSEND; 3205 } 3206 } 3207 3208 /* collect the text of the message */ 3209 SmtpPhase = "collect"; 3210 buffer_errors(); 3211 3212 collect(InChannel, true, NULL, e, true); 3213 3214 /* redefine message size */ 3215 (void) sm_snprintf(buf, sizeof buf, "%ld", e->e_msgsize); 3216 macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"), buf); 3217 3218 #if _FFR_CHECK_EOM 3219 /* rscheck() will set Errors or EF_DISCARD if it trips */ 3220 (void) rscheck("check_eom", buf, NULL, e, RSF_UNSTRUCTURED|RSF_COUNT, 3221 3, NULL, e->e_id); 3222 #endif /* _FFR_CHECK_EOM */ 3223 3224 #if MILTER 3225 milteraccept = true; 3226 if (smtp->sm_milterlist && smtp->sm_milterize && 3227 Errors <= 0 && 3228 !bitset(EF_DISCARD, e->e_flags)) 3229 { 3230 char state; 3231 char *response; 3232 3233 response = milter_data(e, &state); 3234 switch (state) 3235 { 3236 case SMFIR_REPLYCODE: 3237 if (MilterLogLevel > 3) 3238 sm_syslog(LOG_INFO, e->e_id, 3239 "Milter: data, reject=%s", 3240 response); 3241 milteraccept = false; 3242 usrerr(response); 3243 break; 3244 3245 case SMFIR_REJECT: 3246 milteraccept = false; 3247 if (MilterLogLevel > 3) 3248 sm_syslog(LOG_INFO, e->e_id, 3249 "Milter: data, reject=554 5.7.1 Command rejected"); 3250 usrerr("554 5.7.1 Command rejected"); 3251 break; 3252 3253 case SMFIR_DISCARD: 3254 if (MilterLogLevel > 3) 3255 sm_syslog(LOG_INFO, e->e_id, 3256 "Milter: data, discard"); 3257 milteraccept = false; 3258 e->e_flags |= EF_DISCARD; 3259 break; 3260 3261 case SMFIR_TEMPFAIL: 3262 if (MilterLogLevel > 3) 3263 sm_syslog(LOG_INFO, e->e_id, 3264 "Milter: data, reject=%s", 3265 MSG_TEMPFAIL); 3266 milteraccept = false; 3267 usrerr(MSG_TEMPFAIL); 3268 break; 3269 } 3270 if (response != NULL) 3271 sm_free(response); 3272 } 3273 3274 /* Milter may have changed message size */ 3275 (void) sm_snprintf(buf, sizeof buf, "%ld", e->e_msgsize); 3276 macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"), buf); 3277 3278 /* abort message filters that didn't get the body & log msg is OK */ 3279 if (smtp->sm_milterlist && smtp->sm_milterize) 3280 { 3281 milter_abort(e); 3282 if (milteraccept && MilterLogLevel > 9) 3283 sm_syslog(LOG_INFO, e->e_id, "Milter accept: message"); 3284 } 3285 3286 /* 3287 ** If SuperSafe is SAFE_REALLY_POSTMILTER, and we don't have milter or 3288 ** milter accepted message, sync it now 3289 ** 3290 ** XXX This is almost a copy of the code in collect(): put it into 3291 ** a function that is called from both places? 3292 */ 3293 3294 if (milteraccept && SuperSafe == SAFE_REALLY_POSTMILTER) 3295 { 3296 int afd; 3297 SM_FILE_T *volatile df; 3298 char *dfname; 3299 3300 df = e->e_dfp; 3301 dfname = queuename(e, DATAFL_LETTER); 3302 if (sm_io_setinfo(df, SM_BF_COMMIT, NULL) < 0 3303 && errno != EINVAL) 3304 { 3305 int save_errno; 3306 3307 save_errno = errno; 3308 if (save_errno == EEXIST) 3309 { 3310 struct stat st; 3311 int dfd; 3312 3313 if (stat(dfname, &st) < 0) 3314 st.st_size = -1; 3315 errno = EEXIST; 3316 syserr("@collect: bfcommit(%s): already on disk, size=%ld", 3317 dfname, (long) st.st_size); 3318 dfd = sm_io_getinfo(df, SM_IO_WHAT_FD, NULL); 3319 if (dfd >= 0) 3320 dumpfd(dfd, true, true); 3321 } 3322 errno = save_errno; 3323 dferror(df, "bfcommit", e); 3324 flush_errors(true); 3325 finis(save_errno != EEXIST, true, ExitStat); 3326 } 3327 else if ((afd = sm_io_getinfo(df, SM_IO_WHAT_FD, NULL)) < 0) 3328 { 3329 dferror(df, "sm_io_getinfo", e); 3330 flush_errors(true); 3331 finis(true, true, ExitStat); 3332 /* NOTREACHED */ 3333 } 3334 else if (fsync(afd) < 0) 3335 { 3336 dferror(df, "fsync", e); 3337 flush_errors(true); 3338 finis(true, true, ExitStat); 3339 /* NOTREACHED */ 3340 } 3341 else if (sm_io_close(df, SM_TIME_DEFAULT) < 0) 3342 { 3343 dferror(df, "sm_io_close", e); 3344 flush_errors(true); 3345 finis(true, true, ExitStat); 3346 /* NOTREACHED */ 3347 } 3348 3349 /* Now reopen the df file */ 3350 e->e_dfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, dfname, 3351 SM_IO_RDONLY, NULL); 3352 if (e->e_dfp == NULL) 3353 { 3354 /* we haven't acked receipt yet, so just chuck this */ 3355 syserr("@Cannot reopen %s", dfname); 3356 finis(true, true, ExitStat); 3357 /* NOTREACHED */ 3358 } 3359 } 3360 #endif /* MILTER */ 3361 3362 /* Check if quarantining stats should be updated */ 3363 if (e->e_quarmsg != NULL) 3364 markstats(e, NULL, STATS_QUARANTINE); 3365 3366 /* 3367 ** If a header/body check (header checks or milter) 3368 ** set EF_DISCARD, don't queueup the message -- 3369 ** that would lose the EF_DISCARD bit and deliver 3370 ** the message. 3371 */ 3372 3373 if (bitset(EF_DISCARD, e->e_flags)) 3374 doublequeue = false; 3375 3376 aborting = Errors > 0; 3377 if (!(aborting || bitset(EF_DISCARD, e->e_flags)) && 3378 (QueueMode == QM_QUARANTINE || e->e_quarmsg == NULL) && 3379 !split_by_recipient(e)) 3380 aborting = bitset(EF_FATALERRS, e->e_flags); 3381 3382 if (aborting) 3383 { 3384 /* Log who the mail would have gone to */ 3385 logundelrcpts(e, e->e_message, 8, false); 3386 flush_errors(true); 3387 buffer_errors(); 3388 goto abortmessage; 3389 } 3390 3391 /* from now on, we have to operate silently */ 3392 buffer_errors(); 3393 3394 #if 0 3395 /* 3396 ** Clear message, it may contain an error from the SMTP dialogue. 3397 ** This error must not show up in the queue. 3398 ** Some error message should show up, e.g., alias database 3399 ** not available, but others shouldn't, e.g., from check_rcpt. 3400 */ 3401 3402 e->e_message = NULL; 3403 #endif /* 0 */ 3404 3405 /* 3406 ** Arrange to send to everyone. 3407 ** If sending to multiple people, mail back 3408 ** errors rather than reporting directly. 3409 ** In any case, don't mail back errors for 3410 ** anything that has happened up to 3411 ** now (the other end will do this). 3412 ** Truncate our transcript -- the mail has gotten 3413 ** to us successfully, and if we have 3414 ** to mail this back, it will be easier 3415 ** on the reader. 3416 ** Then send to everyone. 3417 ** Finally give a reply code. If an error has 3418 ** already been given, don't mail a 3419 ** message back. 3420 ** We goose error returns by clearing error bit. 3421 */ 3422 3423 SmtpPhase = "delivery"; 3424 (void) sm_io_setinfo(e->e_xfp, SM_BF_TRUNCATE, NULL); 3425 id = e->e_id; 3426 3427 #if NAMED_BIND 3428 _res.retry = TimeOuts.res_retry[RES_TO_FIRST]; 3429 _res.retrans = TimeOuts.res_retrans[RES_TO_FIRST]; 3430 #endif /* NAMED_BIND */ 3431 3432 for (ee = e; ee != NULL; ee = ee->e_sibling) 3433 { 3434 /* make sure we actually do delivery */ 3435 ee->e_flags &= ~EF_CLRQUEUE; 3436 3437 /* from now on, operate silently */ 3438 ee->e_errormode = EM_MAIL; 3439 3440 if (doublequeue) 3441 { 3442 /* make sure it is in the queue */ 3443 queueup(ee, false, true); 3444 } 3445 else 3446 { 3447 /* send to all recipients */ 3448 sendall(ee, SM_DEFAULT); 3449 } 3450 ee->e_to = NULL; 3451 } 3452 3453 /* put back id for SMTP logging in putoutmsg() */ 3454 oldid = CurEnv->e_id; 3455 CurEnv->e_id = id; 3456 3457 /* issue success message */ 3458 message("250 2.0.0 %s Message accepted for delivery", id); 3459 CurEnv->e_id = oldid; 3460 3461 /* if we just queued, poke it */ 3462 if (doublequeue) 3463 { 3464 bool anything_to_send = false; 3465 3466 sm_getla(); 3467 for (ee = e; ee != NULL; ee = ee->e_sibling) 3468 { 3469 if (WILL_BE_QUEUED(ee->e_sendmode)) 3470 continue; 3471 if (shouldqueue(ee->e_msgpriority, ee->e_ctime)) 3472 { 3473 ee->e_sendmode = SM_QUEUE; 3474 continue; 3475 } 3476 else if (QueueMode != QM_QUARANTINE && 3477 ee->e_quarmsg != NULL) 3478 { 3479 ee->e_sendmode = SM_QUEUE; 3480 continue; 3481 } 3482 anything_to_send = true; 3483 3484 /* close all the queue files */ 3485 closexscript(ee); 3486 if (ee->e_dfp != NULL) 3487 { 3488 (void) sm_io_close(ee->e_dfp, SM_TIME_DEFAULT); 3489 ee->e_dfp = NULL; 3490 } 3491 unlockqueue(ee); 3492 } 3493 if (anything_to_send) 3494 { 3495 #if PIPELINING 3496 /* 3497 ** XXX if we don't do this, we get 250 twice 3498 ** because it is also flushed in the child. 3499 */ 3500 3501 (void) sm_io_flush(OutChannel, SM_TIME_DEFAULT); 3502 #endif /* PIPELINING */ 3503 (void) doworklist(e, true, true); 3504 } 3505 } 3506 3507 abortmessage: 3508 if (LogLevel > 4 && bitset(EF_LOGSENDER, e->e_flags)) 3509 logsender(e, NULL); 3510 e->e_flags &= ~EF_LOGSENDER; 3511 3512 /* clean up a bit */ 3513 smtp->sm_gotmail = false; 3514 3515 /* 3516 ** Call dropenvelope if and only if the envelope is *not* 3517 ** being processed by the child process forked by doworklist(). 3518 */ 3519 3520 if (aborting || bitset(EF_DISCARD, e->e_flags)) 3521 dropenvelope(e, true, false); 3522 else 3523 { 3524 for (ee = e; ee != NULL; ee = ee->e_sibling) 3525 { 3526 if (!doublequeue && 3527 QueueMode != QM_QUARANTINE && 3528 ee->e_quarmsg != NULL) 3529 { 3530 dropenvelope(ee, true, false); 3531 continue; 3532 } 3533 if (WILL_BE_QUEUED(ee->e_sendmode)) 3534 dropenvelope(ee, true, false); 3535 } 3536 } 3537 sm_rpool_free(e->e_rpool); 3538 3539 /* 3540 ** At this point, e == &MainEnvelope, but if we did splitting, 3541 ** then CurEnv may point to an envelope structure that was just 3542 ** freed with the rpool. So reset CurEnv *before* calling 3543 ** newenvelope. 3544 */ 3545 3546 CurEnv = e; 3547 newenvelope(e, e, sm_rpool_new_x(NULL)); 3548 e->e_flags = BlankEnvelope.e_flags; 3549 3550 /* restore connection quarantining */ 3551 if (smtp->sm_quarmsg == NULL) 3552 { 3553 e->e_quarmsg = NULL; 3554 macdefine(&e->e_macro, A_PERM, macid("{quarantine}"), ""); 3555 } 3556 else 3557 { 3558 e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool, smtp->sm_quarmsg); 3559 macdefine(&e->e_macro, A_PERM, 3560 macid("{quarantine}"), e->e_quarmsg); 3561 } 3562 return true; 3563 } 3564 /* 3565 ** LOGUNDELRCPTS -- log undelivered (or all) recipients. 3566 ** 3567 ** Parameters: 3568 ** e -- envelope. 3569 ** msg -- message for Stat= 3570 ** level -- log level. 3571 ** all -- log all recipients. 3572 ** 3573 ** Returns: 3574 ** none. 3575 ** 3576 ** Side Effects: 3577 ** logs undelivered (or all) recipients 3578 */ 3579 3580 void 3581 logundelrcpts(e, msg, level, all) 3582 ENVELOPE *e; 3583 char *msg; 3584 int level; 3585 bool all; 3586 { 3587 ADDRESS *a; 3588 3589 if (LogLevel <= level || msg == NULL || *msg == '\0') 3590 return; 3591 3592 /* Clear $h so relay= doesn't get mislogged by logdelivery() */ 3593 macdefine(&e->e_macro, A_PERM, 'h', NULL); 3594 3595 /* Log who the mail would have gone to */ 3596 for (a = e->e_sendqueue; a != NULL; a = a->q_next) 3597 { 3598 if (!QS_IS_UNDELIVERED(a->q_state) && !all) 3599 continue; 3600 e->e_to = a->q_paddr; 3601 logdelivery(NULL, NULL, a->q_status, msg, NULL, 3602 (time_t) 0, e); 3603 } 3604 e->e_to = NULL; 3605 } 3606 /* 3607 ** CHECKSMTPATTACK -- check for denial-of-service attack by repetition 3608 ** 3609 ** Parameters: 3610 ** pcounter -- pointer to a counter for this command. 3611 ** maxcount -- maximum value for this counter before we 3612 ** slow down. 3613 ** waitnow -- sleep now (in this routine)? 3614 ** cname -- command name for logging. 3615 ** e -- the current envelope. 3616 ** 3617 ** Returns: 3618 ** time to wait, 3619 ** STOP_ATTACK if twice as many commands as allowed and 3620 ** MaxChildren > 0. 3621 ** 3622 ** Side Effects: 3623 ** Slows down if we seem to be under attack. 3624 */ 3625 3626 static time_t 3627 checksmtpattack(pcounter, maxcount, waitnow, cname, e) 3628 volatile unsigned int *pcounter; 3629 unsigned int maxcount; 3630 bool waitnow; 3631 char *cname; 3632 ENVELOPE *e; 3633 { 3634 if (maxcount <= 0) /* no limit */ 3635 return (time_t) 0; 3636 3637 if (++(*pcounter) >= maxcount) 3638 { 3639 unsigned int shift; 3640 time_t s; 3641 3642 if (*pcounter == maxcount && LogLevel > 5) 3643 { 3644 sm_syslog(LOG_INFO, e->e_id, 3645 "%s: possible SMTP attack: command=%.40s, count=%u", 3646 CurSmtpClient, cname, *pcounter); 3647 } 3648 shift = *pcounter - maxcount; 3649 s = 1 << shift; 3650 if (shift > MAXSHIFT || s >= MAXTIMEOUT || s <= 0) 3651 s = MAXTIMEOUT; 3652 3653 #define IS_ATTACK(s) ((MaxChildren > 0 && *pcounter >= maxcount * 2) \ 3654 ? STOP_ATTACK : (time_t) s) 3655 3656 /* sleep at least 1 second before returning */ 3657 (void) sleep(*pcounter / maxcount); 3658 s -= *pcounter / maxcount; 3659 if (s >= MAXTIMEOUT || s < 0) 3660 s = MAXTIMEOUT; 3661 if (waitnow && s > 0) 3662 { 3663 (void) sleep(s); 3664 return IS_ATTACK(0); 3665 } 3666 return IS_ATTACK(s); 3667 } 3668 return (time_t) 0; 3669 } 3670 /* 3671 ** SETUP_SMTPD_IO -- setup I/O fd correctly for the SMTP server 3672 ** 3673 ** Parameters: 3674 ** none. 3675 ** 3676 ** Returns: 3677 ** nothing. 3678 ** 3679 ** Side Effects: 3680 ** may change I/O fd. 3681 */ 3682 3683 static void 3684 setup_smtpd_io() 3685 { 3686 int inchfd, outchfd, outfd; 3687 3688 inchfd = sm_io_getinfo(InChannel, SM_IO_WHAT_FD, NULL); 3689 outchfd = sm_io_getinfo(OutChannel, SM_IO_WHAT_FD, NULL); 3690 outfd = sm_io_getinfo(smioout, SM_IO_WHAT_FD, NULL); 3691 if (outchfd != outfd) 3692 { 3693 /* arrange for debugging output to go to remote host */ 3694 (void) dup2(outchfd, outfd); 3695 } 3696 3697 /* 3698 ** if InChannel and OutChannel are stdin/stdout 3699 ** and connected to ttys 3700 ** and fcntl(STDIN, F_SETFL, O_NONBLOCKING) also changes STDOUT, 3701 ** then "chain" them together. 3702 */ 3703 3704 if (inchfd == STDIN_FILENO && outchfd == STDOUT_FILENO && 3705 isatty(inchfd) && isatty(outchfd)) 3706 { 3707 int inmode, outmode; 3708 3709 inmode = fcntl(inchfd, F_GETFL, 0); 3710 if (inmode == -1) 3711 { 3712 if (LogLevel > 11) 3713 sm_syslog(LOG_INFO, NOQID, 3714 "fcntl(inchfd, F_GETFL) failed: %s", 3715 sm_errstring(errno)); 3716 return; 3717 } 3718 outmode = fcntl(outchfd, F_GETFL, 0); 3719 if (outmode == -1) 3720 { 3721 if (LogLevel > 11) 3722 sm_syslog(LOG_INFO, NOQID, 3723 "fcntl(outchfd, F_GETFL) failed: %s", 3724 sm_errstring(errno)); 3725 return; 3726 } 3727 if (bitset(O_NONBLOCK, inmode) || 3728 bitset(O_NONBLOCK, outmode) || 3729 fcntl(inchfd, F_SETFL, inmode | O_NONBLOCK) == -1) 3730 return; 3731 outmode = fcntl(outchfd, F_GETFL, 0); 3732 if (outmode != -1 && bitset(O_NONBLOCK, outmode)) 3733 { 3734 /* changing InChannel also changes OutChannel */ 3735 sm_io_automode(OutChannel, InChannel); 3736 if (tTd(97, 4) && LogLevel > 9) 3737 sm_syslog(LOG_INFO, NOQID, 3738 "set automode for I (%d)/O (%d) in SMTP server", 3739 inchfd, outchfd); 3740 } 3741 3742 /* undo change of inchfd */ 3743 (void) fcntl(inchfd, F_SETFL, inmode); 3744 } 3745 } 3746 /* 3747 ** SKIPWORD -- skip a fixed word. 3748 ** 3749 ** Parameters: 3750 ** p -- place to start looking. 3751 ** w -- word to skip. 3752 ** 3753 ** Returns: 3754 ** p following w. 3755 ** NULL on error. 3756 ** 3757 ** Side Effects: 3758 ** clobbers the p data area. 3759 */ 3760 3761 static char * 3762 skipword(p, w) 3763 register char *volatile p; 3764 char *w; 3765 { 3766 register char *q; 3767 char *firstp = p; 3768 3769 /* find beginning of word */ 3770 SKIP_SPACE(p); 3771 q = p; 3772 3773 /* find end of word */ 3774 while (*p != '\0' && *p != ':' && !(isascii(*p) && isspace(*p))) 3775 p++; 3776 while (isascii(*p) && isspace(*p)) 3777 *p++ = '\0'; 3778 if (*p != ':') 3779 { 3780 syntax: 3781 usrerr("501 5.5.2 Syntax error in parameters scanning \"%s\"", 3782 shortenstring(firstp, MAXSHORTSTR)); 3783 return NULL; 3784 } 3785 *p++ = '\0'; 3786 SKIP_SPACE(p); 3787 3788 if (*p == '\0') 3789 goto syntax; 3790 3791 /* see if the input word matches desired word */ 3792 if (sm_strcasecmp(q, w)) 3793 goto syntax; 3794 3795 return p; 3796 } 3797 /* 3798 ** MAIL_ESMTP_ARGS -- process ESMTP arguments from MAIL line 3799 ** 3800 ** Parameters: 3801 ** kp -- the parameter key. 3802 ** vp -- the value of that parameter. 3803 ** e -- the envelope. 3804 ** 3805 ** Returns: 3806 ** none. 3807 */ 3808 3809 static void 3810 mail_esmtp_args(kp, vp, e) 3811 char *kp; 3812 char *vp; 3813 ENVELOPE *e; 3814 { 3815 if (sm_strcasecmp(kp, "size") == 0) 3816 { 3817 if (vp == NULL) 3818 { 3819 usrerr("501 5.5.2 SIZE requires a value"); 3820 /* NOTREACHED */ 3821 } 3822 macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"), vp); 3823 errno = 0; 3824 e->e_msgsize = strtol(vp, (char **) NULL, 10); 3825 if (e->e_msgsize == LONG_MAX && errno == ERANGE) 3826 { 3827 usrerr("552 5.2.3 Message size exceeds maximum value"); 3828 /* NOTREACHED */ 3829 } 3830 if (e->e_msgsize < 0) 3831 { 3832 usrerr("552 5.2.3 Message size invalid"); 3833 /* NOTREACHED */ 3834 } 3835 } 3836 else if (sm_strcasecmp(kp, "body") == 0) 3837 { 3838 if (vp == NULL) 3839 { 3840 usrerr("501 5.5.2 BODY requires a value"); 3841 /* NOTREACHED */ 3842 } 3843 else if (sm_strcasecmp(vp, "8bitmime") == 0) 3844 { 3845 SevenBitInput = false; 3846 } 3847 else if (sm_strcasecmp(vp, "7bit") == 0) 3848 { 3849 SevenBitInput = true; 3850 } 3851 else 3852 { 3853 usrerr("501 5.5.4 Unknown BODY type %s", vp); 3854 /* NOTREACHED */ 3855 } 3856 e->e_bodytype = sm_rpool_strdup_x(e->e_rpool, vp); 3857 } 3858 else if (sm_strcasecmp(kp, "envid") == 0) 3859 { 3860 if (bitset(PRIV_NORECEIPTS, PrivacyFlags)) 3861 { 3862 usrerr("504 5.7.0 Sorry, ENVID not supported, we do not allow DSN"); 3863 /* NOTREACHED */ 3864 } 3865 if (vp == NULL) 3866 { 3867 usrerr("501 5.5.2 ENVID requires a value"); 3868 /* NOTREACHED */ 3869 } 3870 if (!xtextok(vp)) 3871 { 3872 usrerr("501 5.5.4 Syntax error in ENVID parameter value"); 3873 /* NOTREACHED */ 3874 } 3875 if (e->e_envid != NULL) 3876 { 3877 usrerr("501 5.5.0 Duplicate ENVID parameter"); 3878 /* NOTREACHED */ 3879 } 3880 e->e_envid = sm_rpool_strdup_x(e->e_rpool, vp); 3881 macdefine(&e->e_macro, A_PERM, 3882 macid("{dsn_envid}"), e->e_envid); 3883 } 3884 else if (sm_strcasecmp(kp, "ret") == 0) 3885 { 3886 if (bitset(PRIV_NORECEIPTS, PrivacyFlags)) 3887 { 3888 usrerr("504 5.7.0 Sorry, RET not supported, we do not allow DSN"); 3889 /* NOTREACHED */ 3890 } 3891 if (vp == NULL) 3892 { 3893 usrerr("501 5.5.2 RET requires a value"); 3894 /* NOTREACHED */ 3895 } 3896 if (bitset(EF_RET_PARAM, e->e_flags)) 3897 { 3898 usrerr("501 5.5.0 Duplicate RET parameter"); 3899 /* NOTREACHED */ 3900 } 3901 e->e_flags |= EF_RET_PARAM; 3902 if (sm_strcasecmp(vp, "hdrs") == 0) 3903 e->e_flags |= EF_NO_BODY_RETN; 3904 else if (sm_strcasecmp(vp, "full") != 0) 3905 { 3906 usrerr("501 5.5.2 Bad argument \"%s\" to RET", vp); 3907 /* NOTREACHED */ 3908 } 3909 macdefine(&e->e_macro, A_TEMP, macid("{dsn_ret}"), vp); 3910 } 3911 #if SASL 3912 else if (sm_strcasecmp(kp, "auth") == 0) 3913 { 3914 int len; 3915 char *q; 3916 char *auth_param; /* the value of the AUTH=x */ 3917 bool saveQuickAbort = QuickAbort; 3918 bool saveSuprErrs = SuprErrs; 3919 bool saveExitStat = ExitStat; 3920 3921 if (vp == NULL) 3922 { 3923 usrerr("501 5.5.2 AUTH= requires a value"); 3924 /* NOTREACHED */ 3925 } 3926 if (e->e_auth_param != NULL) 3927 { 3928 usrerr("501 5.5.0 Duplicate AUTH parameter"); 3929 /* NOTREACHED */ 3930 } 3931 if ((q = strchr(vp, ' ')) != NULL) 3932 len = q - vp + 1; 3933 else 3934 len = strlen(vp) + 1; 3935 auth_param = xalloc(len); 3936 (void) sm_strlcpy(auth_param, vp, len); 3937 if (!xtextok(auth_param)) 3938 { 3939 usrerr("501 5.5.4 Syntax error in AUTH parameter value"); 3940 /* just a warning? */ 3941 /* NOTREACHED */ 3942 } 3943 3944 /* XXX define this always or only if trusted? */ 3945 macdefine(&e->e_macro, A_TEMP, macid("{auth_author}"), 3946 auth_param); 3947 3948 /* 3949 ** call Strust_auth to find out whether 3950 ** auth_param is acceptable (trusted) 3951 ** we shouldn't trust it if not authenticated 3952 ** (required by RFC, leave it to ruleset?) 3953 */ 3954 3955 SuprErrs = true; 3956 QuickAbort = false; 3957 if (strcmp(auth_param, "<>") != 0 && 3958 (rscheck("trust_auth", auth_param, NULL, e, RSF_RMCOMM, 3959 9, NULL, NOQID) != EX_OK || Errors > 0)) 3960 { 3961 if (tTd(95, 8)) 3962 { 3963 q = e->e_auth_param; 3964 sm_dprintf("auth=\"%.100s\" not trusted user=\"%.100s\"\n", 3965 auth_param, (q == NULL) ? "" : q); 3966 } 3967 3968 /* not trusted */ 3969 e->e_auth_param = "<>"; 3970 # if _FFR_AUTH_PASSING 3971 macdefine(&BlankEnvelope.e_macro, A_PERM, 3972 macid("{auth_author}"), NULL); 3973 # endif /* _FFR_AUTH_PASSING */ 3974 } 3975 else 3976 { 3977 if (tTd(95, 8)) 3978 sm_dprintf("auth=\"%.100s\" trusted\n", auth_param); 3979 e->e_auth_param = sm_rpool_strdup_x(e->e_rpool, 3980 auth_param); 3981 } 3982 sm_free(auth_param); /* XXX */ 3983 3984 /* reset values */ 3985 Errors = 0; 3986 QuickAbort = saveQuickAbort; 3987 SuprErrs = saveSuprErrs; 3988 ExitStat = saveExitStat; 3989 } 3990 #endif /* SASL */ 3991 #define PRTCHAR(c) ((isascii(c) && isprint(c)) ? (c) : '?') 3992 3993 /* 3994 ** "by" is only accepted if DeliverByMin >= 0. 3995 ** We maybe could add this to the list of server_features. 3996 */ 3997 3998 else if (sm_strcasecmp(kp, "by") == 0 && DeliverByMin >= 0) 3999 { 4000 char *s; 4001 4002 if (vp == NULL) 4003 { 4004 usrerr("501 5.5.2 BY= requires a value"); 4005 /* NOTREACHED */ 4006 } 4007 errno = 0; 4008 e->e_deliver_by = strtol(vp, &s, 10); 4009 if (e->e_deliver_by == LONG_MIN || 4010 e->e_deliver_by == LONG_MAX || 4011 e->e_deliver_by > 999999999l || 4012 e->e_deliver_by < -999999999l) 4013 { 4014 usrerr("501 5.5.2 BY=%s out of range", vp); 4015 /* NOTREACHED */ 4016 } 4017 if (s == NULL || *s != ';') 4018 { 4019 usrerr("501 5.5.2 BY= missing ';'"); 4020 /* NOTREACHED */ 4021 } 4022 e->e_dlvr_flag = 0; 4023 ++s; /* XXX: spaces allowed? */ 4024 SKIP_SPACE(s); 4025 switch (tolower(*s)) 4026 { 4027 case 'n': 4028 e->e_dlvr_flag = DLVR_NOTIFY; 4029 break; 4030 case 'r': 4031 e->e_dlvr_flag = DLVR_RETURN; 4032 if (e->e_deliver_by <= 0) 4033 { 4034 usrerr("501 5.5.4 mode R requires BY time > 0"); 4035 /* NOTREACHED */ 4036 } 4037 if (DeliverByMin > 0 && e->e_deliver_by > 0 && 4038 e->e_deliver_by < DeliverByMin) 4039 { 4040 usrerr("555 5.5.2 time %ld less than %ld", 4041 e->e_deliver_by, (long) DeliverByMin); 4042 /* NOTREACHED */ 4043 } 4044 break; 4045 default: 4046 usrerr("501 5.5.2 illegal by-mode '%c'", PRTCHAR(*s)); 4047 /* NOTREACHED */ 4048 } 4049 ++s; /* XXX: spaces allowed? */ 4050 SKIP_SPACE(s); 4051 switch (tolower(*s)) 4052 { 4053 case 't': 4054 e->e_dlvr_flag |= DLVR_TRACE; 4055 break; 4056 case '\0': 4057 break; 4058 default: 4059 usrerr("501 5.5.2 illegal by-trace '%c'", PRTCHAR(*s)); 4060 /* NOTREACHED */ 4061 } 4062 4063 /* XXX: check whether more characters follow? */ 4064 } 4065 else 4066 { 4067 usrerr("555 5.5.4 %s parameter unrecognized", kp); 4068 /* NOTREACHED */ 4069 } 4070 } 4071 /* 4072 ** RCPT_ESMTP_ARGS -- process ESMTP arguments from RCPT line 4073 ** 4074 ** Parameters: 4075 ** a -- the address corresponding to the To: parameter. 4076 ** kp -- the parameter key. 4077 ** vp -- the value of that parameter. 4078 ** e -- the envelope. 4079 ** 4080 ** Returns: 4081 ** none. 4082 */ 4083 4084 static void 4085 rcpt_esmtp_args(a, kp, vp, e) 4086 ADDRESS *a; 4087 char *kp; 4088 char *vp; 4089 ENVELOPE *e; 4090 { 4091 if (sm_strcasecmp(kp, "notify") == 0) 4092 { 4093 char *p; 4094 4095 if (bitset(PRIV_NORECEIPTS, PrivacyFlags)) 4096 { 4097 usrerr("504 5.7.0 Sorry, NOTIFY not supported, we do not allow DSN"); 4098 /* NOTREACHED */ 4099 } 4100 if (vp == NULL) 4101 { 4102 usrerr("501 5.5.2 NOTIFY requires a value"); 4103 /* NOTREACHED */ 4104 } 4105 a->q_flags &= ~(QPINGONSUCCESS|QPINGONFAILURE|QPINGONDELAY); 4106 a->q_flags |= QHASNOTIFY; 4107 macdefine(&e->e_macro, A_TEMP, macid("{dsn_notify}"), vp); 4108 4109 if (sm_strcasecmp(vp, "never") == 0) 4110 return; 4111 for (p = vp; p != NULL; vp = p) 4112 { 4113 p = strchr(p, ','); 4114 if (p != NULL) 4115 *p++ = '\0'; 4116 if (sm_strcasecmp(vp, "success") == 0) 4117 a->q_flags |= QPINGONSUCCESS; 4118 else if (sm_strcasecmp(vp, "failure") == 0) 4119 a->q_flags |= QPINGONFAILURE; 4120 else if (sm_strcasecmp(vp, "delay") == 0) 4121 a->q_flags |= QPINGONDELAY; 4122 else 4123 { 4124 usrerr("501 5.5.4 Bad argument \"%s\" to NOTIFY", 4125 vp); 4126 /* NOTREACHED */ 4127 } 4128 } 4129 } 4130 else if (sm_strcasecmp(kp, "orcpt") == 0) 4131 { 4132 if (bitset(PRIV_NORECEIPTS, PrivacyFlags)) 4133 { 4134 usrerr("504 5.7.0 Sorry, ORCPT not supported, we do not allow DSN"); 4135 /* NOTREACHED */ 4136 } 4137 if (vp == NULL) 4138 { 4139 usrerr("501 5.5.2 ORCPT requires a value"); 4140 /* NOTREACHED */ 4141 } 4142 if (strchr(vp, ';') == NULL || !xtextok(vp)) 4143 { 4144 usrerr("501 5.5.4 Syntax error in ORCPT parameter value"); 4145 /* NOTREACHED */ 4146 } 4147 if (a->q_orcpt != NULL) 4148 { 4149 usrerr("501 5.5.0 Duplicate ORCPT parameter"); 4150 /* NOTREACHED */ 4151 } 4152 a->q_orcpt = sm_rpool_strdup_x(e->e_rpool, vp); 4153 } 4154 else 4155 { 4156 usrerr("555 5.5.4 %s parameter unrecognized", kp); 4157 /* NOTREACHED */ 4158 } 4159 } 4160 /* 4161 ** PRINTVRFYADDR -- print an entry in the verify queue 4162 ** 4163 ** Parameters: 4164 ** a -- the address to print. 4165 ** last -- set if this is the last one. 4166 ** vrfy -- set if this is a VRFY command. 4167 ** 4168 ** Returns: 4169 ** none. 4170 ** 4171 ** Side Effects: 4172 ** Prints the appropriate 250 codes. 4173 */ 4174 #define OFFF (3 + 1 + 5 + 1) /* offset in fmt: SMTP reply + enh. code */ 4175 4176 static void 4177 printvrfyaddr(a, last, vrfy) 4178 register ADDRESS *a; 4179 bool last; 4180 bool vrfy; 4181 { 4182 char fmtbuf[30]; 4183 4184 if (vrfy && a->q_mailer != NULL && 4185 !bitnset(M_VRFY250, a->q_mailer->m_flags)) 4186 (void) sm_strlcpy(fmtbuf, "252", sizeof fmtbuf); 4187 else 4188 (void) sm_strlcpy(fmtbuf, "250", sizeof fmtbuf); 4189 fmtbuf[3] = last ? ' ' : '-'; 4190 (void) sm_strlcpy(&fmtbuf[4], "2.1.5 ", sizeof fmtbuf - 4); 4191 if (a->q_fullname == NULL) 4192 { 4193 if ((a->q_mailer == NULL || 4194 a->q_mailer->m_addrtype == NULL || 4195 sm_strcasecmp(a->q_mailer->m_addrtype, "rfc822") == 0) && 4196 strchr(a->q_user, '@') == NULL) 4197 (void) sm_strlcpy(&fmtbuf[OFFF], "<%s@%s>", 4198 sizeof fmtbuf - OFFF); 4199 else 4200 (void) sm_strlcpy(&fmtbuf[OFFF], "<%s>", 4201 sizeof fmtbuf - OFFF); 4202 message(fmtbuf, a->q_user, MyHostName); 4203 } 4204 else 4205 { 4206 if ((a->q_mailer == NULL || 4207 a->q_mailer->m_addrtype == NULL || 4208 sm_strcasecmp(a->q_mailer->m_addrtype, "rfc822") == 0) && 4209 strchr(a->q_user, '@') == NULL) 4210 (void) sm_strlcpy(&fmtbuf[OFFF], "%s <%s@%s>", 4211 sizeof fmtbuf - OFFF); 4212 else 4213 (void) sm_strlcpy(&fmtbuf[OFFF], "%s <%s>", 4214 sizeof fmtbuf - OFFF); 4215 message(fmtbuf, a->q_fullname, a->q_user, MyHostName); 4216 } 4217 } 4218 4219 #if SASL 4220 /* 4221 ** SASLMECHS -- get list of possible AUTH mechanisms 4222 ** 4223 ** Parameters: 4224 ** conn -- SASL connection info. 4225 ** mechlist -- output parameter for list of mechanisms. 4226 ** 4227 ** Returns: 4228 ** number of mechs. 4229 */ 4230 4231 static int 4232 saslmechs(conn, mechlist) 4233 sasl_conn_t *conn; 4234 char **mechlist; 4235 { 4236 int len, num, result; 4237 4238 /* "user" is currently unused */ 4239 # if SASL >= 20000 4240 result = sasl_listmech(conn, NULL, 4241 "", " ", "", (const char **) mechlist, 4242 (unsigned int *)&len, &num); 4243 # else /* SASL >= 20000 */ 4244 result = sasl_listmech(conn, "user", /* XXX */ 4245 "", " ", "", mechlist, 4246 (unsigned int *)&len, (unsigned int *)&num); 4247 # endif /* SASL >= 20000 */ 4248 if (result != SASL_OK) 4249 { 4250 if (LogLevel > 9) 4251 sm_syslog(LOG_WARNING, NOQID, 4252 "AUTH error: listmech=%d, num=%d", 4253 result, num); 4254 num = 0; 4255 } 4256 if (num > 0) 4257 { 4258 if (LogLevel > 11) 4259 sm_syslog(LOG_INFO, NOQID, 4260 "AUTH: available mech=%s, allowed mech=%s", 4261 *mechlist, AuthMechanisms); 4262 *mechlist = intersect(AuthMechanisms, *mechlist, NULL); 4263 } 4264 else 4265 { 4266 *mechlist = NULL; /* be paranoid... */ 4267 if (result == SASL_OK && LogLevel > 9) 4268 sm_syslog(LOG_WARNING, NOQID, 4269 "AUTH warning: no mechanisms"); 4270 } 4271 return num; 4272 } 4273 4274 # if SASL >= 20000 4275 /* 4276 ** PROXY_POLICY -- define proxy policy for AUTH 4277 ** 4278 ** Parameters: 4279 ** conn -- unused. 4280 ** context -- unused. 4281 ** requested_user -- authorization identity. 4282 ** rlen -- authorization identity length. 4283 ** auth_identity -- authentication identity. 4284 ** alen -- authentication identity length. 4285 ** def_realm -- default user realm. 4286 ** urlen -- user realm length. 4287 ** propctx -- unused. 4288 ** 4289 ** Returns: 4290 ** ok? 4291 ** 4292 ** Side Effects: 4293 ** sets {auth_authen} macro. 4294 */ 4295 4296 int 4297 proxy_policy(conn, context, requested_user, rlen, auth_identity, alen, 4298 def_realm, urlen, propctx) 4299 sasl_conn_t *conn; 4300 void *context; 4301 const char *requested_user; 4302 unsigned rlen; 4303 const char *auth_identity; 4304 unsigned alen; 4305 const char *def_realm; 4306 unsigned urlen; 4307 struct propctx *propctx; 4308 { 4309 if (auth_identity == NULL) 4310 return SASL_FAIL; 4311 4312 macdefine(&BlankEnvelope.e_macro, A_TEMP, 4313 macid("{auth_authen}"), (char *) auth_identity); 4314 4315 return SASL_OK; 4316 } 4317 # else /* SASL >= 20000 */ 4318 4319 /* 4320 ** PROXY_POLICY -- define proxy policy for AUTH 4321 ** 4322 ** Parameters: 4323 ** context -- unused. 4324 ** auth_identity -- authentication identity. 4325 ** requested_user -- authorization identity. 4326 ** user -- allowed user (output). 4327 ** errstr -- possible error string (output). 4328 ** 4329 ** Returns: 4330 ** ok? 4331 */ 4332 4333 int 4334 proxy_policy(context, auth_identity, requested_user, user, errstr) 4335 void *context; 4336 const char *auth_identity; 4337 const char *requested_user; 4338 const char **user; 4339 const char **errstr; 4340 { 4341 if (user == NULL || auth_identity == NULL) 4342 return SASL_FAIL; 4343 *user = newstr(auth_identity); 4344 return SASL_OK; 4345 } 4346 # endif /* SASL >= 20000 */ 4347 #endif /* SASL */ 4348 4349 #if STARTTLS 4350 /* 4351 ** INITSRVTLS -- initialize server side TLS 4352 ** 4353 ** Parameters: 4354 ** tls_ok -- should tls initialization be done? 4355 ** 4356 ** Returns: 4357 ** succeeded? 4358 ** 4359 ** Side Effects: 4360 ** sets tls_ok_srv which is a static variable in this module. 4361 ** Do NOT remove assignments to it! 4362 */ 4363 4364 bool 4365 initsrvtls(tls_ok) 4366 bool tls_ok; 4367 { 4368 if (!tls_ok) 4369 return false; 4370 4371 /* do NOT remove assignment */ 4372 tls_ok_srv = inittls(&srv_ctx, TLS_Srv_Opts, true, SrvCertFile, 4373 SrvKeyFile, CACertPath, CACertFile, DHParams); 4374 return tls_ok_srv; 4375 } 4376 #endif /* STARTTLS */ 4377 /* 4378 ** SRVFEATURES -- get features for SMTP server 4379 ** 4380 ** Parameters: 4381 ** e -- envelope (should be session context). 4382 ** clientname -- name of client. 4383 ** features -- default features for this invocation. 4384 ** 4385 ** Returns: 4386 ** server features. 4387 */ 4388 4389 /* table with options: it uses just one character, how about strings? */ 4390 static struct 4391 { 4392 char srvf_opt; 4393 unsigned int srvf_flag; 4394 } srv_feat_table[] = 4395 { 4396 { 'A', SRV_OFFER_AUTH }, 4397 { 'B', SRV_OFFER_VERB }, 4398 { 'C', SRV_REQ_SEC }, 4399 { 'D', SRV_OFFER_DSN }, 4400 { 'E', SRV_OFFER_ETRN }, 4401 { 'L', SRV_REQ_AUTH }, 4402 #if PIPELINING 4403 # if _FFR_NO_PIPE 4404 { 'N', SRV_NO_PIPE }, 4405 # endif /* _FFR_NO_PIPE */ 4406 { 'P', SRV_OFFER_PIPE }, 4407 #endif /* PIPELINING */ 4408 { 'R', SRV_VRFY_CLT }, /* same as V; not documented */ 4409 { 'S', SRV_OFFER_TLS }, 4410 /* { 'T', SRV_TMP_FAIL }, */ 4411 { 'V', SRV_VRFY_CLT }, 4412 { 'X', SRV_OFFER_EXPN }, 4413 /* { 'Y', SRV_OFFER_VRFY }, */ 4414 { '\0', SRV_NONE } 4415 }; 4416 4417 static unsigned int 4418 srvfeatures(e, clientname, features) 4419 ENVELOPE *e; 4420 char *clientname; 4421 unsigned int features; 4422 { 4423 int r, i, j; 4424 char **pvp, c, opt; 4425 char pvpbuf[PSBUFSIZE]; 4426 4427 pvp = NULL; 4428 r = rscap("srv_features", clientname, "", e, &pvp, pvpbuf, 4429 sizeof(pvpbuf)); 4430 if (r != EX_OK) 4431 return features; 4432 if (pvp == NULL || pvp[0] == NULL || (pvp[0][0] & 0377) != CANONNET) 4433 return features; 4434 if (pvp[1] != NULL && sm_strncasecmp(pvp[1], "temp", 4) == 0) 4435 return SRV_TMP_FAIL; 4436 4437 /* 4438 ** General rule (see sendmail.h, d_flags): 4439 ** lower case: required/offered, upper case: Not required/available 4440 ** 4441 ** Since we can change some features per daemon, we have both 4442 ** cases here: turn on/off a feature. 4443 */ 4444 4445 for (i = 1; pvp[i] != NULL; i++) 4446 { 4447 c = pvp[i][0]; 4448 j = 0; 4449 for (;;) 4450 { 4451 if ((opt = srv_feat_table[j].srvf_opt) == '\0') 4452 { 4453 if (LogLevel > 9) 4454 sm_syslog(LOG_WARNING, e->e_id, 4455 "srvfeatures: unknown feature %s", 4456 pvp[i]); 4457 break; 4458 } 4459 if (c == opt) 4460 { 4461 features &= ~(srv_feat_table[j].srvf_flag); 4462 break; 4463 } 4464 if (c == tolower(opt)) 4465 { 4466 features |= srv_feat_table[j].srvf_flag; 4467 break; 4468 } 4469 ++j; 4470 } 4471 } 4472 return features; 4473 } 4474 4475 /* 4476 ** HELP -- implement the HELP command. 4477 ** 4478 ** Parameters: 4479 ** topic -- the topic we want help for. 4480 ** e -- envelope. 4481 ** 4482 ** Returns: 4483 ** none. 4484 ** 4485 ** Side Effects: 4486 ** outputs the help file to message output. 4487 */ 4488 #define HELPVSTR "#vers " 4489 #define HELPVERSION 2 4490 4491 void 4492 help(topic, e) 4493 char *topic; 4494 ENVELOPE *e; 4495 { 4496 register SM_FILE_T *hf; 4497 register char *p; 4498 int len; 4499 bool noinfo; 4500 bool first = true; 4501 long sff = SFF_OPENASROOT|SFF_REGONLY; 4502 char buf[MAXLINE]; 4503 char inp[MAXLINE]; 4504 static int foundvers = -1; 4505 extern char Version[]; 4506 4507 if (DontLockReadFiles) 4508 sff |= SFF_NOLOCK; 4509 if (!bitnset(DBS_HELPFILEINUNSAFEDIRPATH, DontBlameSendmail)) 4510 sff |= SFF_SAFEDIRPATH; 4511 4512 if (HelpFile == NULL || 4513 (hf = safefopen(HelpFile, O_RDONLY, 0444, sff)) == NULL) 4514 { 4515 /* no help */ 4516 errno = 0; 4517 message("502 5.3.0 Sendmail %s -- HELP not implemented", 4518 Version); 4519 return; 4520 } 4521 4522 if (topic == NULL || *topic == '\0') 4523 { 4524 topic = "smtp"; 4525 noinfo = false; 4526 } 4527 else 4528 { 4529 makelower(topic); 4530 noinfo = true; 4531 } 4532 4533 len = strlen(topic); 4534 4535 while (sm_io_fgets(hf, SM_TIME_DEFAULT, buf, sizeof buf) != NULL) 4536 { 4537 if (buf[0] == '#') 4538 { 4539 if (foundvers < 0 && 4540 strncmp(buf, HELPVSTR, strlen(HELPVSTR)) == 0) 4541 { 4542 int h; 4543 4544 if (sm_io_sscanf(buf + strlen(HELPVSTR), "%d", 4545 &h) == 1) 4546 foundvers = h; 4547 } 4548 continue; 4549 } 4550 if (strncmp(buf, topic, len) == 0) 4551 { 4552 if (first) 4553 { 4554 first = false; 4555 4556 /* print version if no/old vers# in file */ 4557 if (foundvers < 2 && !noinfo) 4558 message("214-2.0.0 This is Sendmail version %s", Version); 4559 } 4560 p = strpbrk(buf, " \t"); 4561 if (p == NULL) 4562 p = buf + strlen(buf) - 1; 4563 else 4564 p++; 4565 fixcrlf(p, true); 4566 if (foundvers >= 2) 4567 { 4568 translate_dollars(p); 4569 expand(p, inp, sizeof inp, e); 4570 p = inp; 4571 } 4572 message("214-2.0.0 %s", p); 4573 noinfo = false; 4574 } 4575 } 4576 4577 if (noinfo) 4578 message("504 5.3.0 HELP topic \"%.10s\" unknown", topic); 4579 else 4580 message("214 2.0.0 End of HELP info"); 4581 4582 if (foundvers != 0 && foundvers < HELPVERSION) 4583 { 4584 if (LogLevel > 1) 4585 sm_syslog(LOG_WARNING, e->e_id, 4586 "%s too old (require version %d)", 4587 HelpFile, HELPVERSION); 4588 4589 /* avoid log next time */ 4590 foundvers = 0; 4591 } 4592 4593 (void) sm_io_close(hf, SM_TIME_DEFAULT); 4594 } 4595 4596 #if SASL 4597 /* 4598 ** RESET_SASLCONN -- reset SASL connection data 4599 ** 4600 ** Parameters: 4601 ** conn -- SASL connection context 4602 ** hostname -- host name 4603 ** various connection data 4604 ** 4605 ** Returns: 4606 ** SASL result 4607 */ 4608 4609 static int 4610 reset_saslconn(sasl_conn_t ** conn, char *hostname, 4611 # if SASL >= 20000 4612 char *remoteip, char *localip, 4613 char *auth_id, sasl_ssf_t * ext_ssf) 4614 # else /* SASL >= 20000 */ 4615 struct sockaddr_in * saddr_r, struct sockaddr_in * saddr_l, 4616 sasl_external_properties_t * ext_ssf) 4617 # endif /* SASL >= 20000 */ 4618 { 4619 int result; 4620 4621 sasl_dispose(conn); 4622 # if SASL >= 20000 4623 result = sasl_server_new("smtp", hostname, NULL, NULL, NULL, 4624 NULL, 0, conn); 4625 # elif SASL > 10505 4626 /* use empty realm: only works in SASL > 1.5.5 */ 4627 result = sasl_server_new("smtp", hostname, "", NULL, 0, conn); 4628 # else /* SASL >= 20000 */ 4629 /* use no realm -> realm is set to hostname by SASL lib */ 4630 result = sasl_server_new("smtp", hostname, NULL, NULL, 0, 4631 conn); 4632 # endif /* SASL >= 20000 */ 4633 if (result != SASL_OK) 4634 return result; 4635 4636 # if SASL >= 20000 4637 # if NETINET || NETINET6 4638 if (remoteip != NULL) 4639 result = sasl_setprop(*conn, SASL_IPREMOTEPORT, remoteip); 4640 if (result != SASL_OK) 4641 return result; 4642 4643 if (localip != NULL) 4644 result = sasl_setprop(*conn, SASL_IPLOCALPORT, localip); 4645 if (result != SASL_OK) 4646 return result; 4647 # endif /* NETINET || NETINET6 */ 4648 4649 result = sasl_setprop(*conn, SASL_SSF_EXTERNAL, ext_ssf); 4650 if (result != SASL_OK) 4651 return result; 4652 4653 result = sasl_setprop(*conn, SASL_AUTH_EXTERNAL, auth_id); 4654 if (result != SASL_OK) 4655 return result; 4656 # else /* SASL >= 20000 */ 4657 # if NETINET 4658 if (saddr_r != NULL) 4659 result = sasl_setprop(*conn, SASL_IP_REMOTE, saddr_r); 4660 if (result != SASL_OK) 4661 return result; 4662 4663 if (saddr_l != NULL) 4664 result = sasl_setprop(*conn, SASL_IP_LOCAL, saddr_l); 4665 if (result != SASL_OK) 4666 return result; 4667 # endif /* NETINET */ 4668 4669 result = sasl_setprop(*conn, SASL_SSF_EXTERNAL, ext_ssf); 4670 if (result != SASL_OK) 4671 return result; 4672 # endif /* SASL >= 20000 */ 4673 return SASL_OK; 4674 } 4675 #endif /* SASL */ 4676