contrib/sendmail-8.14/sendmail/srvrsmtp.c

   1 /*
   2  * Copyright (c) 1998-2007 Sendmail, Inc. and its suppliers.
   3  *      All rights reserved.
   4  * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
   5  * Copyright (c) 1988, 1993
   6  *      The Regents of the University of California.  All rights reserved.
   7  *
   8  * By using this file, you agree to the terms and conditions set
   9  * forth in the LICENSE file which can be found at the top level of
  10  * the sendmail distribution.
  11  *
  12  */
  13
  14 #include <sendmail.h>
  15 #if MILTER
  16 # include <libmilter/mfapi.h>
  17 # include <libmilter/mfdef.h>
  18 #endif /* MILTER */
  19
  20 SM_RCSID("@(#)$Id: srvrsmtp.c,v 8.967 2007/10/01 16:22:14 ca Exp $")
  21
  22 #include <sm/time.h>
  23 #include <sm/fdset.h>
  24
  25 #if SASL || STARTTLS
  26 # include "sfsasl.h"
  27 #endif /* SASL || STARTTLS */
  28 #if SASL
  29 # define ENC64LEN(l)    (((l) + 2) * 4 / 3 + 1)
  30 static int saslmechs __P((sasl_conn_t *, char **));
  31 #endif /* SASL */
  32 #if STARTTLS
  33 # include <sysexits.h>
  34
  35 static SSL_CTX  *srv_ctx = NULL;        /* TLS server context */
  36 static SSL      *srv_ssl = NULL;        /* per connection context */
  37
  38 static bool     tls_ok_srv = false;
  39
  40 # define TLS_VERIFY_CLIENT() tls_set_verify(srv_ctx, srv_ssl, \
  41                                 bitset(SRV_VRFY_CLT, features))
  42 #endif /* STARTTLS */
  43
  44 #if _FFR_DM_ONE
  45 static bool     NotFirstDelivery = false;
  46 #endif /* _FFR_DM_ONE */
  47
  48 /* server features */
  49 #define SRV_NONE        0x0000  /* none... */
  50 #define SRV_OFFER_TLS   0x0001  /* offer STARTTLS */
  51 #define SRV_VRFY_CLT    0x0002  /* request a cert */
  52 #define SRV_OFFER_AUTH  0x0004  /* offer AUTH */
  53 #define SRV_OFFER_ETRN  0x0008  /* offer ETRN */
  54 #define SRV_OFFER_VRFY  0x0010  /* offer VRFY (not yet used) */
  55 #define SRV_OFFER_EXPN  0x0020  /* offer EXPN */
  56 #define SRV_OFFER_VERB  0x0040  /* offer VERB */
  57 #define SRV_OFFER_DSN   0x0080  /* offer DSN */
  58 #if PIPELINING
  59 # define SRV_OFFER_PIPE 0x0100  /* offer PIPELINING */
  60 # if _FFR_NO_PIPE
  61 #  define SRV_NO_PIPE   0x0200  /* disable PIPELINING, sleep if used */
  62 # endif /* _FFR_NO_PIPE */
  63 #endif /* PIPELINING */
  64 #define SRV_REQ_AUTH    0x0400  /* require AUTH */
  65 #define SRV_REQ_SEC     0x0800  /* require security - equiv to AuthOptions=p */
  66 #define SRV_TMP_FAIL    0x1000  /* ruleset caused a temporary failure */
  67
  68 static unsigned int     srvfeatures __P((ENVELOPE *, char *, unsigned int));
  69
  70 #define STOP_ATTACK     ((time_t) -1)
  71 static time_t   checksmtpattack __P((volatile unsigned int *, unsigned int,
  72                                      bool, char *, ENVELOPE *));
  73 static void     printvrfyaddr __P((ADDRESS *, bool, bool));
  74 static char     *skipword __P((char *volatile, char *));
  75 static void     setup_smtpd_io __P((void));
  76
  77 #if SASL
  78 # if SASL >= 20000
  79 static int reset_saslconn __P((sasl_conn_t **_conn, char *_hostname,
  80                                 char *_remoteip, char *_localip,
  81                                 char *_auth_id, sasl_ssf_t *_ext_ssf));
  82
  83 # define RESET_SASLCONN \
  84         do                                                      \
  85         {                                                       \
  86                 result = reset_saslconn(&conn, AuthRealm, remoteip, \
  87                                         localip, auth_id, &ext_ssf); \
  88                 if (result != SASL_OK)                          \
  89                         sasl_ok = false;                        \
  90         } while (0)
  91
  92 # else /* SASL >= 20000 */
  93 static int reset_saslconn __P((sasl_conn_t **_conn, char *_hostname,
  94                                 struct sockaddr_in *_saddr_r,
  95                                 struct sockaddr_in *_saddr_l,
  96                                 sasl_external_properties_t *_ext_ssf));
  97 # define RESET_SASLCONN \
  98         do                                                      \
  99         {                                                       \
 100                 result = reset_saslconn(&conn, AuthRealm, &saddr_r, \
 101                                         &saddr_l, &ext_ssf);    \
 102                 if (result != SASL_OK)                          \
 103                         sasl_ok = false;                        \
 104         } while (0)
 105
 106 # endif /* SASL >= 20000 */
 107 #endif /* SASL */
 108
 109 extern ENVELOPE BlankEnvelope;
 110
 111 #define NBADRCPTS                                               \
 112         do                                                      \
 113         {                                                       \
 114                 char buf[16];                                   \
 115                 (void) sm_snprintf(buf, sizeof(buf), "%d",      \
 116                         BadRcptThrottle > 0 && n_badrcpts > BadRcptThrottle \
 117                                 ? n_badrcpts - 1 : n_badrcpts); \
 118                 macdefine(&e->e_macro, A_TEMP, macid("{nbadrcpts}"), buf); \
 119         } while (0)
 120
 121 #define SKIP_SPACE(s)   while (isascii(*s) && isspace(*s))      \
 122                                 (s)++
 123
 124 /*
 125 **  PARSE_ESMTP_ARGS -- parse EMSTP arguments (for MAIL, RCPT)
 126 **
 127 **      Parameters:
 128 **              e -- the envelope
 129 **              addr_st -- address (RCPT only)
 130 **              p -- read buffer
 131 **              delimptr -- current position in read buffer
 132 **              which -- MAIL/RCPT
 133 **              args -- arguments (output)
 134 **              esmtp_args -- function to process a single ESMTP argument
 135 **
 136 **      Returns:
 137 **              none
 138 */
 139
 140 void
 141 parse_esmtp_args(e, addr_st, p, delimptr, which, args, esmtp_args)
 142         ENVELOPE *e;
 143         ADDRESS *addr_st;
 144         char *p;
 145         char *delimptr;
 146         char *which;
 147         char *args[];
 148         esmtp_args_F esmtp_args;
 149 {
 150         int argno;
 151
 152         argno = 0;
 153         if (args != NULL)
 154                 args[argno++] = p;
 155         p = delimptr;
 156         while (p != NULL && *p != '\0')
 157         {
 158                 char *kp;
 159                 char *vp = NULL;
 160                 char *equal = NULL;
 161
 162                 /* locate the beginning of the keyword */
 163                 SKIP_SPACE(p);
 164                 if (*p == '\0')
 165                         break;
 166                 kp = p;
 167
 168                 /* skip to the value portion */
 169                 while ((isascii(*p) && isalnum(*p)) || *p == '-')
 170                         p++;
 171                 if (*p == '=')
 172                 {
 173                         equal = p;
 174                         *p++ = '\0';
 175                         vp = p;
 176
 177                         /* skip to the end of the value */
 178                         while (*p != '\0' && *p != ' ' &&
 179                                !(isascii(*p) && iscntrl(*p)) &&
 180                                *p != '=')
 181                                 p++;
 182                 }
 183
 184                 if (*p != '\0')
 185                         *p++ = '\0';
 186
 187                 if (tTd(19, 1))
 188                         sm_dprintf("%s: got arg %s=\"%s\"\n", which, kp,
 189                                 vp == NULL ? "<null>" : vp);
 190
 191                 esmtp_args(addr_st, kp, vp, e);
 192                 if (equal != NULL)
 193                         *equal = '=';
 194                 if (args != NULL)
 195                         args[argno] = kp;
 196                 argno++;
 197                 if (argno >= MAXSMTPARGS - 1)
 198                         usrerr("501 5.5.4 Too many parameters");
 199                 if (Errors > 0)
 200                         break;
 201         }
 202         if (args != NULL)
 203                 args[argno] = NULL;
 204 }
 205
 206 /*
 207 **  SMTP -- run the SMTP protocol.
 208 **
 209 **      Parameters:
 210 **              nullserver -- if non-NULL, rejection message for
 211 **                      (almost) all SMTP commands.
 212 **              d_flags -- daemon flags
 213 **              e -- the envelope.
 214 **
 215 **      Returns:
 216 **              never.
 217 **
 218 **      Side Effects:
 219 **              Reads commands from the input channel and processes them.
 220 */
 221
 222 /*
 223 **  Notice: The smtp server doesn't have a session context like the client
 224 **      side has (mci). Therefore some data (session oriented) is allocated
 225 **      or assigned to the "wrong" structure (esp. STARTTLS, AUTH).
 226 **      This should be fixed in a successor version.
 227 */
 228
 229 struct cmd
 230 {
 231         char    *cmd_name;      /* command name */
 232         int     cmd_code;       /* internal code, see below */
 233 };
 234
 235 /* values for cmd_code */
 236 #define CMDERROR        0       /* bad command */
 237 #define CMDMAIL 1       /* mail -- designate sender */
 238 #define CMDRCPT 2       /* rcpt -- designate recipient */
 239 #define CMDDATA 3       /* data -- send message text */
 240 #define CMDRSET 4       /* rset -- reset state */
 241 #define CMDVRFY 5       /* vrfy -- verify address */
 242 #define CMDEXPN 6       /* expn -- expand address */
 243 #define CMDNOOP 7       /* noop -- do nothing */
 244 #define CMDQUIT 8       /* quit -- close connection and die */
 245 #define CMDHELO 9       /* helo -- be polite */
 246 #define CMDHELP 10      /* help -- give usage info */
 247 #define CMDEHLO 11      /* ehlo -- extended helo (RFC 1425) */
 248 #define CMDETRN 12      /* etrn -- flush queue */
 249 #if SASL
 250 # define CMDAUTH        13      /* auth -- SASL authenticate */
 251 #endif /* SASL */
 252 #if STARTTLS
 253 # define CMDSTLS        14      /* STARTTLS -- start TLS session */
 254 #endif /* STARTTLS */
 255 /* non-standard commands */
 256 #define CMDVERB 17      /* verb -- go into verbose mode */
 257 /* unimplemented commands from RFC 821 */
 258 #define CMDUNIMPL       19      /* unimplemented rfc821 commands */
 259 /* use this to catch and log "door handle" attempts on your system */
 260 #define CMDLOGBOGUS     23      /* bogus command that should be logged */
 261 /* debugging-only commands, only enabled if SMTPDEBUG is defined */
 262 #define CMDDBGQSHOW     24      /* showq -- show send queue */
 263 #define CMDDBGDEBUG     25      /* debug -- set debug mode */
 264
 265 /*
 266 **  Note: If you change this list, remember to update 'helpfile'
 267 */
 268
 269 static struct cmd       CmdTab[] =
 270 {
 271         { "mail",       CMDMAIL         },
 272         { "rcpt",       CMDRCPT         },
 273         { "data",       CMDDATA         },
 274         { "rset",       CMDRSET         },
 275         { "vrfy",       CMDVRFY         },
 276         { "expn",       CMDEXPN         },
 277         { "help",       CMDHELP         },
 278         { "noop",       CMDNOOP         },
 279         { "quit",       CMDQUIT         },
 280         { "helo",       CMDHELO         },
 281         { "ehlo",       CMDEHLO         },
 282         { "etrn",       CMDETRN         },
 283         { "verb",       CMDVERB         },
 284         { "send",       CMDUNIMPL       },
 285         { "saml",       CMDUNIMPL       },
 286         { "soml",       CMDUNIMPL       },
 287         { "turn",       CMDUNIMPL       },
 288 #if SASL
 289         { "auth",       CMDAUTH,        },
 290 #endif /* SASL */
 291 #if STARTTLS
 292         { "starttls",   CMDSTLS,        },
 293 #endif /* STARTTLS */
 294     /* remaining commands are here only to trap and log attempts to use them */
 295         { "showq",      CMDDBGQSHOW     },
 296         { "debug",      CMDDBGDEBUG     },
 297         { "wiz",        CMDLOGBOGUS     },
 298
 299         { NULL,         CMDERROR        }
 300 };
 301
 302 static char     *CurSmtpClient;         /* who's at the other end of channel */
 303
 304 #ifndef MAXBADCOMMANDS
 305 # define MAXBADCOMMANDS 25      /* maximum number of bad commands */
 306 #endif /* ! MAXBADCOMMANDS */
 307 #ifndef MAXHELOCOMMANDS
 308 # define MAXHELOCOMMANDS 3      /* max HELO/EHLO commands before slowdown */
 309 #endif /* ! MAXHELOCOMMANDS */
 310 #ifndef MAXVRFYCOMMANDS
 311 # define MAXVRFYCOMMANDS 6      /* max VRFY/EXPN commands before slowdown */
 312 #endif /* ! MAXVRFYCOMMANDS */
 313 #ifndef MAXETRNCOMMANDS
 314 # define MAXETRNCOMMANDS 8      /* max ETRN commands before slowdown */
 315 #endif /* ! MAXETRNCOMMANDS */
 316 #ifndef MAXTIMEOUT
 317 # define MAXTIMEOUT (4 * 60)    /* max timeout for bad commands */
 318 #endif /* ! MAXTIMEOUT */
 319
 320 /*
 321 **  Maximum shift value to compute timeout for bad commands.
 322 **  This introduces an upper limit of 2^MAXSHIFT for the timeout.
 323 */
 324
 325 #ifndef MAXSHIFT
 326 # define MAXSHIFT 8
 327 #endif /* ! MAXSHIFT */
 328 #if MAXSHIFT > 31
 329  ERROR _MAXSHIFT > 31 is invalid
 330 #endif /* MAXSHIFT */
 331
 332
 333 #if MAXBADCOMMANDS > 0
 334 # define STOP_IF_ATTACK(r)      do              \
 335         {                                       \
 336                 if ((r) == STOP_ATTACK)         \
 337                         goto stopattack;        \
 338         } while (0)
 339
 340 #else /* MAXBADCOMMANDS > 0 */
 341 # define STOP_IF_ATTACK(r)      r
 342 #endif /* MAXBADCOMMANDS > 0 */
 343
 344
 345 #if SM_HEAP_CHECK
 346 static SM_DEBUG_T DebugLeakSmtp = SM_DEBUG_INITIALIZER("leak_smtp",
 347         "@(#)$Debug: leak_smtp - trace memory leaks during SMTP processing $");
 348 #endif /* SM_HEAP_CHECK */
 349
 350 typedef struct
 351 {
 352         bool            sm_gotmail;     /* mail command received */
 353         unsigned int    sm_nrcpts;      /* number of successful RCPT commands */
 354         bool            sm_discard;
 355 #if MILTER
 356         bool            sm_milterize;
 357         bool            sm_milterlist;  /* any filters in the list? */
 358         milters_T       sm_milters;
 359
 360         /* e_nrcpts from envelope before recipient() call */
 361         unsigned int    sm_e_nrcpts_orig;
 362 #endif /* MILTER */
 363         char            *sm_quarmsg;    /* carry quarantining across messages */
 364 } SMTP_T;
 365
 366 static bool     smtp_data __P((SMTP_T *, ENVELOPE *));
 367
 368 #define MSG_TEMPFAIL "451 4.3.2 Please try again later"
 369
 370 #if MILTER
 371 # define MILTER_ABORT(e)        milter_abort((e))
 372
 373 # define MILTER_REPLY(str)                                              \
 374         {                                                               \
 375                 int savelogusrerrs = LogUsrErrs;                        \
 376                                                                         \
 377                 milter_cmd_fail = true;                                 \
 378                 switch (state)                                          \
 379                 {                                                       \
 380                   case SMFIR_SHUTDOWN:                                  \
 381                         if (MilterLogLevel > 3)                         \
 382                         {                                               \
 383                                 sm_syslog(LOG_INFO, e->e_id,            \
 384                                           "Milter: %s=%s, reject=421, errormode=4",     \
 385                                           str, addr);                   \
 386                                 LogUsrErrs = false;                     \
 387                         }                                               \
 388                         {                                               \
 389                                 bool tsave = QuickAbort;                \
 390                                                                         \
 391                                 QuickAbort = false;                     \
 392                                 usrerr("421 4.3.0 closing connection"); \
 393                                 QuickAbort = tsave;                     \
 394                                 e->e_sendqueue = NULL;                  \
 395                                 goto doquit;                            \
 396                         }                                               \
 397                         break;                                          \
 398                   case SMFIR_REPLYCODE:                                 \
 399                         if (MilterLogLevel > 3)                         \
 400                         {                                               \
 401                                 sm_syslog(LOG_INFO, e->e_id,            \
 402                                           "Milter: %s=%s, reject=%s",   \
 403                                           str, addr, response);         \
 404                                 LogUsrErrs = false;                     \
 405                         }                                               \
 406                         if (strncmp(response, "421 ", 4) == 0           \
 407                             || strncmp(response, "421-", 4) == 0)       \
 408                         {                                               \
 409                                 bool tsave = QuickAbort;                \
 410                                                                         \
 411                                 QuickAbort = false;                     \
 412                                 usrerr(response);                       \
 413                                 QuickAbort = tsave;                     \
 414                                 e->e_sendqueue = NULL;                  \
 415                                 goto doquit;                            \
 416                         }                                               \
 417                         else                                            \
 418                                 usrerr(response);                       \
 419                         break;                                          \
 420                                                                         \
 421                   case SMFIR_REJECT:                                    \
 422                         if (MilterLogLevel > 3)                         \
 423                         {                                               \
 424                                 sm_syslog(LOG_INFO, e->e_id,            \
 425                                           "Milter: %s=%s, reject=550 5.7.1 Command rejected", \
 426                                           str, addr);                   \
 427                                 LogUsrErrs = false;                     \
 428                         }                                               \
 429                         usrerr("550 5.7.1 Command rejected");           \
 430                         break;                                          \
 431                                                                         \
 432                   case SMFIR_DISCARD:                                   \
 433                         if (MilterLogLevel > 3)                         \
 434                                 sm_syslog(LOG_INFO, e->e_id,            \
 435                                           "Milter: %s=%s, discard",     \
 436                                           str, addr);                   \
 437                         e->e_flags |= EF_DISCARD;                       \
 438                         milter_cmd_fail = false;                        \
 439                         break;                                          \
 440                                                                         \
 441                   case SMFIR_TEMPFAIL:                                  \
 442                         if (MilterLogLevel > 3)                         \
 443                         {                                               \
 444                                 sm_syslog(LOG_INFO, e->e_id,            \
 445                                           "Milter: %s=%s, reject=%s",   \
 446                                           str, addr, MSG_TEMPFAIL);     \
 447                                 LogUsrErrs = false;                     \
 448                         }                                               \
 449                         usrerr(MSG_TEMPFAIL);                           \
 450                         break;                                          \
 451                   default:                                              \
 452                         milter_cmd_fail = false;                        \
 453                         break;                                          \
 454                 }                                                       \
 455                 LogUsrErrs = savelogusrerrs;                            \
 456                 if (response != NULL)                                   \
 457                         sm_free(response); /* XXX */                    \
 458         }
 459
 460 #else /* MILTER */
 461 # define MILTER_ABORT(e)
 462 #endif /* MILTER */
 463
 464 /* clear all SMTP state (for HELO/EHLO/RSET) */
 465 #define CLEAR_STATE(cmd)                                        \
 466 do                                                              \
 467 {                                                               \
 468         /* abort milter filters */                              \
 469         MILTER_ABORT(e);                                        \
 470                                                                 \
 471         if (smtp.sm_nrcpts > 0)                                 \
 472         {                                                       \
 473                 logundelrcpts(e, cmd, 10, false);               \
 474                 smtp.sm_nrcpts = 0;                             \
 475                 macdefine(&e->e_macro, A_PERM,                  \
 476                           macid("{nrcpts}"), "0");              \
 477         }                                                       \
 478                                                                 \
 479         e->e_sendqueue = NULL;                                  \
 480         e->e_flags |= EF_CLRQUEUE;                              \
 481                                                                 \
 482         if (LogLevel > 4 && bitset(EF_LOGSENDER, e->e_flags))   \
 483                 logsender(e, NULL);                             \
 484         e->e_flags &= ~EF_LOGSENDER;                            \
 485                                                                 \
 486         /* clean up a bit */                                    \
 487         smtp.sm_gotmail = false;                                \
 488         SuprErrs = true;                                        \
 489         dropenvelope(e, true, false);                           \
 490         sm_rpool_free(e->e_rpool);                              \
 491         e = newenvelope(e, CurEnv, sm_rpool_new_x(NULL));       \
 492         CurEnv = e;                                             \
 493         e->e_features = features;                               \
 494                                                                 \
 495         /* put back discard bit */                              \
 496         if (smtp.sm_discard)                                    \
 497                 e->e_flags |= EF_DISCARD;                       \
 498                                                                 \
 499         /* restore connection quarantining */                   \
 500         if (smtp.sm_quarmsg == NULL)                            \
 501         {                                                       \
 502                 e->e_quarmsg = NULL;                            \
 503                 macdefine(&e->e_macro, A_PERM,                  \
 504                         macid("{quarantine}"), "");             \
 505         }                                                       \
 506         else                                                    \
 507         {                                                       \
 508                 e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool,    \
 509                                                 smtp.sm_quarmsg);       \
 510                 macdefine(&e->e_macro, A_PERM, macid("{quarantine}"),   \
 511                           e->e_quarmsg);                        \
 512         }                                                       \
 513 } while (0)
 514
 515 /* sleep to flatten out connection load */
 516 #define MIN_DELAY_LOG   15      /* wait before logging this again */
 517
 518 /* is it worth setting the process title for 1s? */
 519 #define DELAY_CONN(cmd)                                         \
 520         if (DelayLA > 0 && (CurrentLA = getla()) >= DelayLA)    \
 521         {                                                       \
 522                 time_t dnow;                                    \
 523                                                                 \
 524                 sm_setproctitle(true, e,                        \
 525                                 "%s: %s: delaying %s: load average: %d", \
 526                                 qid_printname(e), CurSmtpClient,        \
 527                                 cmd, DelayLA);  \
 528                 if (LogLevel > 8 && (dnow = curtime()) > log_delay)     \
 529                 {                                               \
 530                         sm_syslog(LOG_INFO, e->e_id,            \
 531                                   "delaying=%s, load average=%d >= %d", \
 532                                   cmd, CurrentLA, DelayLA);             \
 533                         log_delay = dnow + MIN_DELAY_LOG;       \
 534                 }                                               \
 535                 (void) sleep(1);                                \
 536                 sm_setproctitle(true, e, "%s %s: %.80s",        \
 537                                 qid_printname(e), CurSmtpClient, inp);  \
 538         }
 539
 540 static bool SevenBitInput_Saved;        /* saved version of SevenBitInput */
 541
 542 void
 543 smtp(nullserver, d_flags, e)
 544         char *volatile nullserver;
 545         BITMAP256 d_flags;
 546         register ENVELOPE *volatile e;
 547 {
 548         register char *volatile p;
 549         register struct cmd *volatile c = NULL;
 550         char *cmd;
 551         auto ADDRESS *vrfyqueue;
 552         ADDRESS *a;
 553         volatile bool gothello;         /* helo command received */
 554         bool vrfy;                      /* set if this is a vrfy command */
 555         char *volatile protocol;        /* sending protocol */
 556         char *volatile sendinghost;     /* sending hostname */
 557         char *volatile peerhostname;    /* name of SMTP peer or "localhost" */
 558         auto char *delimptr;
 559         char *id;
 560         volatile unsigned int n_badcmds = 0;    /* count of bad commands */
 561         volatile unsigned int n_badrcpts = 0;   /* number of rejected RCPT */
 562         volatile unsigned int n_verifies = 0;   /* count of VRFY/EXPN */
 563         volatile unsigned int n_etrn = 0;       /* count of ETRN */
 564         volatile unsigned int n_noop = 0;       /* count of NOOP/VERB/etc */
 565         volatile unsigned int n_helo = 0;       /* count of HELO/EHLO */
 566         bool ok;
 567         volatile bool first;
 568         volatile bool tempfail = false;
 569         volatile time_t wt;             /* timeout after too many commands */
 570         volatile time_t previous;       /* time after checksmtpattack() */
 571         volatile bool lognullconnection = true;
 572         register char *q;
 573         SMTP_T smtp;
 574         char *addr;
 575         char *greetcode = "220";
 576         char *hostname;                 /* my hostname ($j) */
 577         QUEUE_CHAR *new;
 578         char *args[MAXSMTPARGS];
 579         char inp[MAXINPLINE];
 580 #if MAXINPLINE < MAXLINE
 581  ERROR _MAXINPLINE must NOT be less than _MAXLINE: MAXINPLINE < MAXLINE
 582 #endif /* MAXINPLINE < MAXLINE */
 583         char cmdbuf[MAXLINE];
 584 #if SASL
 585         sasl_conn_t *conn;
 586         volatile bool sasl_ok;
 587         volatile unsigned int n_auth = 0;       /* count of AUTH commands */
 588         bool ismore;
 589         int result;
 590         volatile int authenticating;
 591         char *user;
 592         char *in, *out2;
 593 # if SASL >= 20000
 594         char *auth_id = NULL;
 595         const char *out;
 596         sasl_ssf_t ext_ssf;
 597         char localip[60], remoteip[60];
 598 # else /* SASL >= 20000 */
 599         char *out;
 600         const char *errstr;
 601         sasl_external_properties_t ext_ssf;
 602         struct sockaddr_in saddr_l;
 603         struct sockaddr_in saddr_r;
 604 # endif /* SASL >= 20000 */
 605         sasl_security_properties_t ssp;
 606         sasl_ssf_t *ssf;
 607         unsigned int inlen, out2len;
 608         unsigned int outlen;
 609         char *volatile auth_type;
 610         char *mechlist;
 611         volatile unsigned int n_mechs;
 612         unsigned int len;
 613 #else /* SASL */
 614 #endif /* SASL */
 615         int r;
 616 #if STARTTLS
 617         int rfd, wfd;
 618         volatile bool tls_active = false;
 619         volatile bool smtps = bitnset(D_SMTPS, d_flags);
 620         bool saveQuickAbort;
 621         bool saveSuprErrs;
 622         time_t tlsstart;
 623 #endif /* STARTTLS */
 624         volatile unsigned int features;
 625 #if PIPELINING
 626 # if _FFR_NO_PIPE
 627         int np_log = 0;
 628 # endif /* _FFR_NO_PIPE */
 629 #endif /* PIPELINING */
 630         volatile time_t log_delay = (time_t) 0;
 631 #if MILTER
 632         volatile bool milter_cmd_done, milter_cmd_safe;
 633         volatile bool milter_rcpt_added, milter_cmd_fail;
 634         ADDRESS addr_st;
 635 # define p_addr_st      &addr_st
 636 #else /* MILTER */
 637 # define p_addr_st      NULL
 638 #endif /* MILTER */
 639         size_t inplen;
 640
 641         SevenBitInput_Saved = SevenBitInput;
 642         smtp.sm_nrcpts = 0;
 643 #if MILTER
 644         smtp.sm_milterize = (nullserver == NULL);
 645         smtp.sm_milterlist = false;
 646         addr = NULL;
 647 #endif /* MILTER */
 648
 649         /* setup I/O fd correctly for the SMTP server */
 650         setup_smtpd_io();
 651
 652 #if SM_HEAP_CHECK
 653         if (sm_debug_active(&DebugLeakSmtp, 1))
 654         {
 655                 sm_heap_newgroup();
 656                 sm_dprintf("smtp() heap group #%d\n", sm_heap_group());
 657         }
 658 #endif /* SM_HEAP_CHECK */
 659
 660         /* XXX the rpool should be set when e is initialized in main() */
 661         e->e_rpool = sm_rpool_new_x(NULL);
 662         e->e_macro.mac_rpool = e->e_rpool;
 663
 664         settime(e);
 665         sm_getla();
 666         peerhostname = RealHostName;
 667         if (peerhostname == NULL)
 668                 peerhostname = "localhost";
 669         CurHostName = peerhostname;
 670         CurSmtpClient = macvalue('_', e);
 671         if (CurSmtpClient == NULL)
 672                 CurSmtpClient = CurHostName;
 673
 674         /* check_relay may have set discard bit, save for later */
 675         smtp.sm_discard = bitset(EF_DISCARD, e->e_flags);
 676
 677 #if PIPELINING
 678         /* auto-flush output when reading input */
 679         (void) sm_io_autoflush(InChannel, OutChannel);
 680 #endif /* PIPELINING */
 681
 682         sm_setproctitle(true, e, "server %s startup", CurSmtpClient);
 683
 684         /* Set default features for server. */
 685         features = ((bitset(PRIV_NOETRN, PrivacyFlags) ||
 686                      bitnset(D_NOETRN, d_flags)) ? SRV_NONE : SRV_OFFER_ETRN)
 687                 | (bitnset(D_AUTHREQ, d_flags) ? SRV_REQ_AUTH : SRV_NONE)
 688                 | (bitset(PRIV_NOEXPN, PrivacyFlags) ? SRV_NONE
 689                         : (SRV_OFFER_EXPN
 690                           | (bitset(PRIV_NOVERB, PrivacyFlags)
 691                              ? SRV_NONE : SRV_OFFER_VERB)))
 692                 | ((bitset(PRIV_NORECEIPTS, PrivacyFlags) || !SendMIMEErrors)
 693                          ? SRV_NONE : SRV_OFFER_DSN)
 694 #if SASL
 695                 | (bitnset(D_NOAUTH, d_flags) ? SRV_NONE : SRV_OFFER_AUTH)
 696                 | (bitset(SASL_SEC_NOPLAINTEXT, SASLOpts) ? SRV_REQ_SEC
 697                                                           : SRV_NONE)
 698 #endif /* SASL */
 699 #if PIPELINING
 700                 | SRV_OFFER_PIPE
 701 #endif /* PIPELINING */
 702 #if STARTTLS
 703                 | (bitnset(D_NOTLS, d_flags) ? SRV_NONE : SRV_OFFER_TLS)
 704                 | (bitset(TLS_I_NO_VRFY, TLS_Srv_Opts) ? SRV_NONE
 705                                                        : SRV_VRFY_CLT)
 706 #endif /* STARTTLS */
 707                 ;
 708         if (nullserver == NULL)
 709         {
 710                 features = srvfeatures(e, CurSmtpClient, features);
 711                 if (bitset(SRV_TMP_FAIL, features))
 712                 {
 713                         if (LogLevel > 4)
 714                                 sm_syslog(LOG_ERR, NOQID,
 715                                           "ERROR: srv_features=tempfail, relay=%.100s, access temporarily disabled",
 716                                           CurSmtpClient);
 717                         nullserver = "450 4.3.0 Please try again later.";
 718                 }
 719                 else
 720                 {
 721 #if PIPELINING
 722 # if _FFR_NO_PIPE
 723                         if (bitset(SRV_NO_PIPE, features))
 724                         {
 725                                 /* for consistency */
 726                                 features &= ~SRV_OFFER_PIPE;
 727                         }
 728 # endif /* _FFR_NO_PIPE */
 729 #endif /* PIPELINING */
 730 #if SASL
 731                         if (bitset(SRV_REQ_SEC, features))
 732                                 SASLOpts |= SASL_SEC_NOPLAINTEXT;
 733                         else
 734                                 SASLOpts &= ~SASL_SEC_NOPLAINTEXT;
 735 #endif /* SASL */
 736                 }
 737         }
 738         else if (strncmp(nullserver, "421 ", 4) == 0)
 739         {
 740                 message(nullserver);
 741                 goto doquit;
 742         }
 743
 744         e->e_features = features;
 745         hostname = macvalue('j', e);
 746 #if SASL
 747         if (AuthRealm == NULL)
 748                 AuthRealm = hostname;
 749         sasl_ok = bitset(SRV_OFFER_AUTH, features);
 750         n_mechs = 0;
 751         authenticating = SASL_NOT_AUTH;
 752
 753         /* SASL server new connection */
 754         if (sasl_ok)
 755         {
 756 # if SASL >= 20000
 757                 result = sasl_server_new("smtp", AuthRealm, NULL, NULL, NULL,
 758                                          NULL, 0, &conn);
 759 # elif SASL > 10505
 760                 /* use empty realm: only works in SASL > 1.5.5 */
 761                 result = sasl_server_new("smtp", AuthRealm, "", NULL, 0, &conn);
 762 # else /* SASL >= 20000 */
 763                 /* use no realm -> realm is set to hostname by SASL lib */
 764                 result = sasl_server_new("smtp", AuthRealm, NULL, NULL, 0,
 765                                          &conn);
 766 # endif /* SASL >= 20000 */
 767                 sasl_ok = result == SASL_OK;
 768                 if (!sasl_ok)
 769                 {
 770                         if (LogLevel > 9)
 771                                 sm_syslog(LOG_WARNING, NOQID,
 772                                           "AUTH error: sasl_server_new failed=%d",
 773                                           result);
 774                 }
 775         }
 776         if (sasl_ok)
 777         {
 778                 /*
 779                 **  SASL set properties for sasl
 780                 **  set local/remote IP
 781                 **  XXX Cyrus SASL v1 only supports IPv4
 782                 **
 783                 **  XXX where exactly are these used/required?
 784                 **  Kerberos_v4
 785                 */
 786
 787 # if SASL >= 20000
 788                 localip[0] = remoteip[0] = '\0';
 789 #  if NETINET || NETINET6
 790                 in = macvalue(macid("{daemon_family}"), e);
 791                 if (in != NULL && (
 792 #   if NETINET6
 793                     strcmp(in, "inet6") == 0 ||
 794 #   endif /* NETINET6 */
 795                     strcmp(in, "inet") == 0))
 796                 {
 797                         SOCKADDR_LEN_T addrsize;
 798                         SOCKADDR saddr_l;
 799                         SOCKADDR saddr_r;
 800
 801                         addrsize = sizeof(saddr_r);
 802                         if (getpeername(sm_io_getinfo(InChannel, SM_IO_WHAT_FD,
 803                                                       NULL),
 804                                         (struct sockaddr *) &saddr_r,
 805                                         &addrsize) == 0)
 806                         {
 807                                 if (iptostring(&saddr_r, addrsize,
 808                                                remoteip, sizeof(remoteip)))
 809                                 {
 810                                         sasl_setprop(conn, SASL_IPREMOTEPORT,
 811                                                      remoteip);
 812                                 }
 813                                 addrsize = sizeof(saddr_l);
 814                                 if (getsockname(sm_io_getinfo(InChannel,
 815                                                               SM_IO_WHAT_FD,
 816                                                               NULL),
 817                                                 (struct sockaddr *) &saddr_l,
 818                                                 &addrsize) == 0)
 819                                 {
 820                                         if (iptostring(&saddr_l, addrsize,
 821                                                        localip,
 822                                                        sizeof(localip)))
 823                                         {
 824                                                 sasl_setprop(conn,
 825                                                              SASL_IPLOCALPORT,
 826                                                              localip);
 827                                         }
 828                                 }
 829                         }
 830                 }
 831 #  endif /* NETINET || NETINET6 */
 832 # else /* SASL >= 20000 */
 833 #  if NETINET
 834                 in = macvalue(macid("{daemon_family}"), e);
 835                 if (in != NULL && strcmp(in, "inet") == 0)
 836                 {
 837                         SOCKADDR_LEN_T addrsize;
 838
 839                         addrsize = sizeof(struct sockaddr_in);
 840                         if (getpeername(sm_io_getinfo(InChannel, SM_IO_WHAT_FD,
 841                                                       NULL),
 842                                         (struct sockaddr *)&saddr_r,
 843                                         &addrsize) == 0)
 844                         {
 845                                 sasl_setprop(conn, SASL_IP_REMOTE, &saddr_r);
 846                                 addrsize = sizeof(struct sockaddr_in);
 847                                 if (getsockname(sm_io_getinfo(InChannel,
 848                                                               SM_IO_WHAT_FD,
 849                                                               NULL),
 850                                                 (struct sockaddr *)&saddr_l,
 851                                                 &addrsize) == 0)
 852                                         sasl_setprop(conn, SASL_IP_LOCAL,
 853                                                      &saddr_l);
 854                         }
 855                 }
 856 #  endif /* NETINET */
 857 # endif /* SASL >= 20000 */
 858
 859                 auth_type = NULL;
 860                 mechlist = NULL;
 861                 user = NULL;
 862 # if 0
 863                 macdefine(&BlankEnvelope.e_macro, A_PERM,
 864                         macid("{auth_author}"), NULL);
 865 # endif /* 0 */
 866
 867                 /* set properties */
 868                 (void) memset(&ssp, '\0', sizeof(ssp));
 869
 870                 /* XXX should these be options settable via .cf ? */
 871                 /* ssp.min_ssf = 0; is default due to memset() */
 872                 {
 873                         ssp.max_ssf = MaxSLBits;
 874                         ssp.maxbufsize = MAXOUTLEN;
 875                 }
 876                 ssp.security_flags = SASLOpts & SASL_SEC_MASK;
 877                 sasl_ok = sasl_setprop(conn, SASL_SEC_PROPS, &ssp) == SASL_OK;
 878
 879                 if (sasl_ok)
 880                 {
 881                         /*
 882                         **  external security strength factor;
 883                         **      currently we have none so zero
 884                         */
 885
 886 # if SASL >= 20000
 887                         ext_ssf = 0;
 888                         auth_id = NULL;
 889                         sasl_ok = ((sasl_setprop(conn, SASL_SSF_EXTERNAL,
 890                                                  &ext_ssf) == SASL_OK) &&
 891                                    (sasl_setprop(conn, SASL_AUTH_EXTERNAL,
 892                                                  auth_id) == SASL_OK));
 893 # else /* SASL >= 20000 */
 894                         ext_ssf.ssf = 0;
 895                         ext_ssf.auth_id = NULL;
 896                         sasl_ok = sasl_setprop(conn, SASL_SSF_EXTERNAL,
 897                                                &ext_ssf) == SASL_OK;
 898 # endif /* SASL >= 20000 */
 899                 }
 900                 if (sasl_ok)
 901                         n_mechs = saslmechs(conn, &mechlist);
 902         }
 903 #endif /* SASL */
 904
 905 #if STARTTLS
 906 #endif /* STARTTLS */
 907
 908 #if MILTER
 909         if (smtp.sm_milterize)
 910         {
 911                 char state;
 912
 913                 /* initialize mail filter connection */
 914                 smtp.sm_milterlist = milter_init(e, &state, &smtp.sm_milters);
 915                 switch (state)
 916                 {
 917                   case SMFIR_REJECT:
 918                         if (MilterLogLevel > 3)
 919                                 sm_syslog(LOG_INFO, e->e_id,
 920                                           "Milter: initialization failed, rejecting commands");
 921                         greetcode = "554";
 922                         nullserver = "Command rejected";
 923                         smtp.sm_milterize = false;
 924                         break;
 925
 926                   case SMFIR_TEMPFAIL:
 927                         if (MilterLogLevel > 3)
 928                                 sm_syslog(LOG_INFO, e->e_id,
 929                                           "Milter: initialization failed, temp failing commands");
 930                         tempfail = true;
 931                         smtp.sm_milterize = false;
 932                         break;
 933
 934                   case SMFIR_SHUTDOWN:
 935                         if (MilterLogLevel > 3)
 936                                 sm_syslog(LOG_INFO, e->e_id,
 937                                           "Milter: initialization failed, closing connection");
 938                         tempfail = true;
 939                         smtp.sm_milterize = false;
 940                         message("421 4.7.0 %s closing connection",
 941                                         MyHostName);
 942
 943                         /* arrange to ignore send list */
 944                         e->e_sendqueue = NULL;
 945                         goto doquit;
 946                 }
 947         }
 948
 949         if (smtp.sm_milterlist && smtp.sm_milterize &&
 950             !bitset(EF_DISCARD, e->e_flags))
 951         {
 952                 char state;
 953                 char *response;
 954
 955                 q = macvalue(macid("{client_name}"), e);
 956                 SM_ASSERT(q != NULL || OpMode == MD_SMTP);
 957                 if (q == NULL)
 958                         q = "localhost";
 959                 response = milter_connect(q, RealHostAddr, e, &state);
 960                 switch (state)
 961                 {
 962                   case SMFIR_REPLYCODE: /* REPLYCODE shouldn't happen */
 963                   case SMFIR_REJECT:
 964                         if (MilterLogLevel > 3)
 965                                 sm_syslog(LOG_INFO, e->e_id,
 966                                           "Milter: connect: host=%s, addr=%s, rejecting commands",
 967                                           peerhostname,
 968                                           anynet_ntoa(&RealHostAddr));
 969                         greetcode = "554";
 970                         nullserver = "Command rejected";
 971                         smtp.sm_milterize = false;
 972                         break;
 973
 974                   case SMFIR_TEMPFAIL:
 975                         if (MilterLogLevel > 3)
 976                                 sm_syslog(LOG_INFO, e->e_id,
 977                                           "Milter: connect: host=%s, addr=%s, temp failing commands",
 978                                           peerhostname,
 979                                           anynet_ntoa(&RealHostAddr));
 980                         tempfail = true;
 981                         smtp.sm_milterize = false;
 982                         break;
 983
 984                   case SMFIR_SHUTDOWN:
 985                         if (MilterLogLevel > 3)
 986                                 sm_syslog(LOG_INFO, e->e_id,
 987                                           "Milter: connect: host=%s, addr=%s, shutdown",
 988                                           peerhostname,
 989                                           anynet_ntoa(&RealHostAddr));
 990                         tempfail = true;
 991                         smtp.sm_milterize = false;
 992                         message("421 4.7.0 %s closing connection",
 993                                         MyHostName);
 994
 995                         /* arrange to ignore send list */
 996                         e->e_sendqueue = NULL;
 997                         goto doquit;
 998                 }
 999                 if (response != NULL)
1000                         sm_free(response); /* XXX */
1001         }
1002 #endif /* MILTER */
1003
1004         /*
1005         **  Broken proxies and SMTP slammers
1006         **  push data without waiting, catch them
1007         */
1008
1009         if (
1010 #if STARTTLS
1011             !smtps &&
1012 #endif /* STARTTLS */
1013             *greetcode == '2' && nullserver == NULL)
1014         {
1015                 time_t msecs = 0;
1016                 char **pvp;
1017                 char pvpbuf[PSBUFSIZE];
1018
1019                 /* Ask the rulesets how long to pause */
1020                 pvp = NULL;
1021                 r = rscap("greet_pause", peerhostname,
1022                           anynet_ntoa(&RealHostAddr), e,
1023                           &pvp, pvpbuf, sizeof(pvpbuf));
1024                 if (r == EX_OK && pvp != NULL && pvp[0] != NULL &&
1025                     (pvp[0][0] & 0377) == CANONNET && pvp[1] != NULL)
1026                 {
1027                         msecs = strtol(pvp[1], NULL, 10);
1028                 }
1029
1030                 if (msecs > 0)
1031                 {
1032                         int fd;
1033                         fd_set readfds;
1034                         struct timeval timeout;
1035                         struct timeval bp, ep, tp; /* {begin,end,total}pause */
1036                         int eoftest;
1037
1038                         /* pause for a moment */
1039                         timeout.tv_sec = msecs / 1000;
1040                         timeout.tv_usec = (msecs % 1000) * 1000;
1041
1042                         /* Obey RFC 2821: 4.3.5.2: 220 timeout of 5 minutes */
1043                         if (timeout.tv_sec >= 300)
1044                         {
1045                                 timeout.tv_sec = 300;
1046                                 timeout.tv_usec = 0;
1047                         }
1048
1049                         /* check if data is on the socket during the pause */
1050                         fd = sm_io_getinfo(InChannel, SM_IO_WHAT_FD, NULL);
1051                         FD_ZERO(&readfds);
1052                         SM_FD_SET(fd, &readfds);
1053                         gettimeofday(&bp, NULL);
1054                         if (select(fd + 1, FDSET_CAST &readfds,
1055                             NULL, NULL, &timeout) > 0 &&
1056                             FD_ISSET(fd, &readfds) &&
1057                             (eoftest = sm_io_getc(InChannel, SM_TIME_DEFAULT))
1058                             != SM_IO_EOF)
1059                         {
1060                                 sm_io_ungetc(InChannel, SM_TIME_DEFAULT,
1061                                              eoftest);
1062                                 gettimeofday(&ep, NULL);
1063                                 timersub(&ep, &bp, &tp);
1064                                 greetcode = "554";
1065                                 nullserver = "Command rejected";
1066                                 sm_syslog(LOG_INFO, e->e_id,
1067                                           "rejecting commands from %s [%s] due to pre-greeting traffic after %d seconds",
1068                                           peerhostname,
1069                                           anynet_ntoa(&RealHostAddr),
1070                                           (int) tp.tv_sec +
1071                                                 (tp.tv_usec >= 500000 ? 1 : 0)
1072                                          );
1073                         }
1074                 }
1075         }
1076
1077 #if STARTTLS
1078         /* If this an smtps connection, start TLS now */
1079         if (smtps)
1080         {
1081                 Errors = 0;
1082                 goto starttls;
1083         }
1084
1085   greeting:
1086
1087 #endif /* STARTTLS */
1088
1089         /* output the first line, inserting "ESMTP" as second word */
1090         if (*greetcode == '5')
1091                 (void) sm_snprintf(inp, sizeof(inp),
1092                                 "%s not accepting messages", hostname);
1093         else
1094                 expand(SmtpGreeting, inp, sizeof(inp), e);
1095
1096         p = strchr(inp, '\n');
1097         if (p != NULL)
1098                 *p++ = '\0';
1099         id = strchr(inp, ' ');
1100         if (id == NULL)
1101                 id = &inp[strlen(inp)];
1102         if (p == NULL)
1103                 (void) sm_snprintf(cmdbuf, sizeof(cmdbuf),
1104                          "%s %%.*s ESMTP%%s", greetcode);
1105         else
1106                 (void) sm_snprintf(cmdbuf, sizeof(cmdbuf),
1107                          "%s-%%.*s ESMTP%%s", greetcode);
1108         message(cmdbuf, (int) (id - inp), inp, id);
1109
1110         /* output remaining lines */
1111         while ((id = p) != NULL && (p = strchr(id, '\n')) != NULL)
1112         {
1113                 *p++ = '\0';
1114                 if (isascii(*id) && isspace(*id))
1115                         id++;
1116                 (void) sm_strlcpyn(cmdbuf, sizeof(cmdbuf), 2, greetcode, "-%s");
1117                 message(cmdbuf, id);
1118         }
1119         if (id != NULL)
1120         {
1121                 if (isascii(*id) && isspace(*id))
1122                         id++;
1123                 (void) sm_strlcpyn(cmdbuf, sizeof(cmdbuf), 2, greetcode, " %s");
1124                 message(cmdbuf, id);
1125         }
1126
1127         protocol = NULL;
1128         sendinghost = macvalue('s', e);
1129
1130         /* If quarantining by a connect/ehlo action, save between messages */
1131         if (e->e_quarmsg == NULL)
1132                 smtp.sm_quarmsg = NULL;
1133         else
1134                 smtp.sm_quarmsg = newstr(e->e_quarmsg);
1135
1136         /* sendinghost's storage must outlive the current envelope */
1137         if (sendinghost != NULL)
1138                 sendinghost = sm_strdup_x(sendinghost);
1139         first = true;
1140         gothello = false;
1141         smtp.sm_gotmail = false;
1142         for (;;)
1143         {
1144             SM_TRY
1145             {
1146                 QuickAbort = false;
1147                 HoldErrs = false;
1148                 SuprErrs = false;
1149                 LogUsrErrs = false;
1150                 OnlyOneError = true;
1151                 e->e_flags &= ~(EF_VRFYONLY|EF_GLOBALERRS);
1152 #if MILTER
1153                 milter_cmd_fail = false;
1154 #endif /* MILTER */
1155
1156                 /* setup for the read */
1157                 e->e_to = NULL;
1158                 Errors = 0;
1159                 FileName = NULL;
1160                 (void) sm_io_flush(smioout, SM_TIME_DEFAULT);
1161
1162                 /* read the input line */
1163                 SmtpPhase = "server cmd read";
1164                 sm_setproctitle(true, e, "server %s cmd read", CurSmtpClient);
1165
1166                 /* handle errors */
1167                 if (sm_io_error(OutChannel) ||
1168                     (p = sfgets(inp, sizeof(inp), InChannel,
1169                                 TimeOuts.to_nextcommand, SmtpPhase)) == NULL)
1170                 {
1171                         char *d;
1172
1173                         d = macvalue(macid("{daemon_name}"), e);
1174                         if (d == NULL)
1175                                 d = "stdin";
1176                         /* end of file, just die */
1177                         disconnect(1, e);
1178
1179 #if MILTER
1180                         /* close out milter filters */
1181                         milter_quit(e);
1182 #endif /* MILTER */
1183
1184                         message("421 4.4.1 %s Lost input channel from %s",
1185                                 MyHostName, CurSmtpClient);
1186                         if (LogLevel > (smtp.sm_gotmail ? 1 : 19))
1187                                 sm_syslog(LOG_NOTICE, e->e_id,
1188                                           "lost input channel from %s to %s after %s",
1189                                           CurSmtpClient, d,
1190                                           (c == NULL || c->cmd_name == NULL) ? "startup" : c->cmd_name);
1191                         /*
1192                         **  If have not accepted mail (DATA), do not bounce
1193                         **  bad addresses back to sender.
1194                         */
1195
1196                         if (bitset(EF_CLRQUEUE, e->e_flags))
1197                                 e->e_sendqueue = NULL;
1198                         goto doquit;
1199                 }
1200
1201                 /* also used by "proxy" check below */
1202                 inplen = strlen(inp);
1203 #if SASL
1204                 /*
1205                 **  SMTP AUTH requires accepting any length,
1206                 **  at least for challenge/response. However, not imposing
1207                 **  a limit is a bad idea (denial of service).
1208                 */
1209
1210                 if (authenticating != SASL_PROC_AUTH
1211                     && sm_strncasecmp(inp, "AUTH ", 5) != 0
1212                     && inplen > MAXLINE)
1213                 {
1214                         message("421 4.7.0 %s Command too long, possible attack %s",
1215                                 MyHostName, CurSmtpClient);
1216                         sm_syslog(LOG_INFO, e->e_id,
1217                                   "%s: SMTP violation, input too long: %lu",
1218                                   CurSmtpClient, (unsigned long) inplen);
1219                         goto doquit;
1220                 }
1221 #endif /* SASL */
1222
1223                 if (first)
1224                 {
1225                         size_t cmdlen;
1226                         int idx;
1227                         char *http_cmd;
1228                         static char *http_cmds[] = { "GET", "POST",
1229                                                      "CONNECT", "USER", NULL };
1230
1231                         for (idx = 0; (http_cmd = http_cmds[idx]) != NULL;
1232                              idx++)
1233                         {
1234                                 cmdlen = strlen(http_cmd);
1235                                 if (cmdlen < inplen &&
1236                                     sm_strncasecmp(inp, http_cmd, cmdlen) == 0 &&
1237                                     isascii(inp[cmdlen]) && isspace(inp[cmdlen]))
1238                                 {
1239                                         /* Open proxy, drop it */
1240                                         message("421 4.7.0 %s Rejecting open proxy %s",
1241                                                 MyHostName, CurSmtpClient);
1242                                         sm_syslog(LOG_INFO, e->e_id,
1243                                                   "%s: probable open proxy: command=%.40s",
1244                                                   CurSmtpClient, inp);
1245                                         goto doquit;
1246                                 }
1247                         }
1248                         first = false;
1249                 }
1250
1251                 /* clean up end of line */
1252                 fixcrlf(inp, true);
1253
1254 #if PIPELINING
1255 # if _FFR_NO_PIPE
1256                 /*
1257                 **  if there is more input and pipelining is disabled:
1258                 **      delay ... (and maybe discard the input?)
1259                 **  XXX this doesn't really work, at least in tests using
1260                 **  telnet SM_IO_IS_READABLE only returns 1 if there were
1261                 **  more than 2 input lines available.
1262                 */
1263
1264                 if (bitset(SRV_NO_PIPE, features) &&
1265                     sm_io_getinfo(InChannel, SM_IO_IS_READABLE, NULL) > 0)
1266                 {
1267                         if (++np_log < 3)
1268                                 sm_syslog(LOG_INFO, NOQID,
1269                                           "unauthorized PIPELINING, sleeping");
1270                         sleep(1);
1271                 }
1272
1273 # endif /* _FFR_NO_PIPE */
1274 #endif /* PIPELINING */
1275
1276 #if SASL
1277                 if (authenticating == SASL_PROC_AUTH)
1278                 {
1279 # if 0
1280                         if (*inp == '\0')
1281                         {
1282                                 authenticating = SASL_NOT_AUTH;
1283                                 message("501 5.5.2 missing input");
1284                                 RESET_SASLCONN;
1285                                 continue;
1286                         }
1287 # endif /* 0 */
1288                         if (*inp == '*' && *(inp + 1) == '\0')
1289                         {
1290                                 authenticating = SASL_NOT_AUTH;
1291
1292                                 /* RFC 2554 4. */
1293                                 message("501 5.0.0 AUTH aborted");
1294                                 RESET_SASLCONN;
1295                                 continue;
1296                         }
1297
1298                         /* could this be shorter? XXX */
1299 # if SASL >= 20000
1300                         in = xalloc(strlen(inp) + 1);
1301                         result = sasl_decode64(inp, strlen(inp), in,
1302                                                strlen(inp), &inlen);
1303 # else /* SASL >= 20000 */
1304                         out = xalloc(strlen(inp));
1305                         result = sasl_decode64(inp, strlen(inp), out, &outlen);
1306 # endif /* SASL >= 20000 */
1307                         if (result != SASL_OK)
1308                         {
1309                                 authenticating = SASL_NOT_AUTH;
1310
1311                                 /* RFC 2554 4. */
1312                                 message("501 5.5.4 cannot decode AUTH parameter %s",
1313                                         inp);
1314 # if SASL >= 20000
1315                                 sm_free(in);
1316 # endif /* SASL >= 20000 */
1317                                 RESET_SASLCONN;
1318                                 continue;
1319                         }
1320
1321 # if SASL >= 20000
1322                         result = sasl_server_step(conn, in, inlen,
1323                                                   &out, &outlen);
1324                         sm_free(in);
1325 # else /* SASL >= 20000 */
1326                         result = sasl_server_step(conn, out, outlen,
1327                                                   &out, &outlen, &errstr);
1328 # endif /* SASL >= 20000 */
1329
1330                         /* get an OK if we're done */
1331                         if (result == SASL_OK)
1332                         {
1333   authenticated:
1334                                 message("235 2.0.0 OK Authenticated");
1335                                 authenticating = SASL_IS_AUTH;
1336                                 macdefine(&BlankEnvelope.e_macro, A_TEMP,
1337                                         macid("{auth_type}"), auth_type);
1338
1339 # if SASL >= 20000
1340                                 user = macvalue(macid("{auth_authen}"), e);
1341
1342                                 /* get security strength (features) */
1343                                 result = sasl_getprop(conn, SASL_SSF,
1344                                                       (const void **) &ssf);
1345 # else /* SASL >= 20000 */
1346                                 result = sasl_getprop(conn, SASL_USERNAME,
1347                                                       (void **)&user);
1348                                 if (result != SASL_OK)
1349                                 {
1350                                         user = "";
1351                                         macdefine(&BlankEnvelope.e_macro,
1352                                                   A_PERM,
1353                                                   macid("{auth_authen}"), NULL);
1354                                 }
1355                                 else
1356                                 {
1357                                         macdefine(&BlankEnvelope.e_macro,
1358                                                   A_TEMP,
1359                                                   macid("{auth_authen}"),
1360                                                   xtextify(user, "<>\")"));
1361                                 }
1362
1363 # if 0
1364                                 /* get realm? */
1365                                 sasl_getprop(conn, SASL_REALM, (void **) &data);
1366 # endif /* 0 */
1367
1368                                 /* get security strength (features) */
1369                                 result = sasl_getprop(conn, SASL_SSF,
1370                                                       (void **) &ssf);
1371 # endif /* SASL >= 20000 */
1372                                 if (result != SASL_OK)
1373                                 {
1374                                         macdefine(&BlankEnvelope.e_macro,
1375                                                   A_PERM,
1376                                                   macid("{auth_ssf}"), "0");
1377                                         ssf = NULL;
1378                                 }
1379                                 else
1380                                 {
1381                                         char pbuf[8];
1382
1383                                         (void) sm_snprintf(pbuf, sizeof(pbuf),
1384                                                            "%u", *ssf);
1385                                         macdefine(&BlankEnvelope.e_macro,
1386                                                   A_TEMP,
1387                                                   macid("{auth_ssf}"), pbuf);
1388                                         if (tTd(95, 8))
1389                                                 sm_dprintf("AUTH auth_ssf: %u\n",
1390                                                            *ssf);
1391                                 }
1392
1393                                 /*
1394                                 **  Only switch to encrypted connection
1395                                 **  if a security layer has been negotiated
1396                                 */
1397
1398                                 if (ssf != NULL && *ssf > 0)
1399                                 {
1400                                         int tmo;
1401
1402                                         /*
1403                                         **  Convert I/O layer to use SASL.
1404                                         **  If the call fails, the connection
1405                                         **  is aborted.
1406                                         */
1407
1408                                         tmo = TimeOuts.to_datablock * 1000;
1409                                         if (sfdcsasl(&InChannel, &OutChannel,
1410                                                      conn, tmo) == 0)
1411                                         {
1412                                                 /* restart dialogue */
1413                                                 n_helo = 0;
1414 # if PIPELINING
1415                                                 (void) sm_io_autoflush(InChannel,
1416                                                                        OutChannel);
1417 # endif /* PIPELINING */
1418                                         }
1419                                         else
1420                                                 syserr("503 5.3.3 SASL TLS failed");
1421                                 }
1422
1423                                 /* NULL pointer ok since it's our function */
1424                                 if (LogLevel > 8)
1425                                         sm_syslog(LOG_INFO, NOQID,
1426                                                   "AUTH=server, relay=%s, authid=%.128s, mech=%.16s, bits=%d",
1427                                                   CurSmtpClient,
1428                                                   shortenstring(user, 128),
1429                                                   auth_type, *ssf);
1430                         }
1431                         else if (result == SASL_CONTINUE)
1432                         {
1433                                 len = ENC64LEN(outlen);
1434                                 out2 = xalloc(len);
1435                                 result = sasl_encode64(out, outlen, out2, len,
1436                                                        &out2len);
1437                                 if (result != SASL_OK)
1438                                 {
1439                                         /* correct code? XXX */
1440                                         /* 454 Temp. authentication failure */
1441                                         message("454 4.5.4 Internal error: unable to encode64");
1442                                         if (LogLevel > 5)
1443                                                 sm_syslog(LOG_WARNING, e->e_id,
1444                                                           "AUTH encode64 error [%d for \"%s\"]",
1445                                                           result, out);
1446                                         /* start over? */
1447                                         authenticating = SASL_NOT_AUTH;
1448                                 }
1449                                 else
1450                                 {
1451                                         message("334 %s", out2);
1452                                         if (tTd(95, 2))
1453                                                 sm_dprintf("AUTH continue: msg='%s' len=%u\n",
1454                                                            out2, out2len);
1455                                 }
1456 # if SASL >= 20000
1457                                 sm_free(out2);
1458 # endif /* SASL >= 20000 */
1459                         }
1460                         else
1461                         {
1462                                 /* not SASL_OK or SASL_CONT */
1463                                 message("535 5.7.0 authentication failed");
1464                                 if (LogLevel > 9)
1465                                         sm_syslog(LOG_WARNING, e->e_id,
1466                                                   "AUTH failure (%s): %s (%d) %s",
1467                                                   auth_type,
1468                                                   sasl_errstring(result, NULL,
1469                                                                  NULL),
1470                                                   result,
1471 # if SASL >= 20000
1472                                                   sasl_errdetail(conn));
1473 # else /* SASL >= 20000 */
1474                                                   errstr == NULL ? "" : errstr);
1475 # endif /* SASL >= 20000 */
1476                                 RESET_SASLCONN;
1477                                 authenticating = SASL_NOT_AUTH;
1478                         }
1479                 }
1480                 else
1481                 {
1482                         /* don't want to do any of this if authenticating */
1483 #endif /* SASL */
1484
1485                 /* echo command to transcript */
1486                 if (e->e_xfp != NULL)
1487                         (void) sm_io_fprintf(e->e_xfp, SM_TIME_DEFAULT,
1488                                              "<<< %s\n", inp);
1489
1490                 if (LogLevel > 14)
1491                         sm_syslog(LOG_INFO, e->e_id, "<-- %s", inp);
1492
1493                 /* break off command */
1494                 for (p = inp; isascii(*p) && isspace(*p); p++)
1495                         continue;
1496                 cmd = cmdbuf;
1497                 while (*p != '\0' &&
1498                        !(isascii(*p) && isspace(*p)) &&
1499                        cmd < &cmdbuf[sizeof(cmdbuf) - 2])
1500                         *cmd++ = *p++;
1501                 *cmd = '\0';
1502
1503                 /* throw away leading whitespace */
1504                 SKIP_SPACE(p);
1505
1506                 /* decode command */
1507                 for (c = CmdTab; c->cmd_name != NULL; c++)
1508                 {
1509                         if (sm_strcasecmp(c->cmd_name, cmdbuf) == 0)
1510                                 break;
1511                 }
1512
1513                 /* reset errors */
1514                 errno = 0;
1515
1516                 /* check whether a "non-null" command has been used */
1517                 switch (c->cmd_code)
1518                 {
1519 #if SASL
1520                   case CMDAUTH:
1521                         /* avoid information leak; take first two words? */
1522                         q = "AUTH";
1523                         break;
1524 #endif /* SASL */
1525
1526                   case CMDMAIL:
1527                   case CMDEXPN:
1528                   case CMDVRFY:
1529                   case CMDETRN:
1530                         lognullconnection = false;
1531                         /* FALLTHROUGH */
1532                   default:
1533                         q = inp;
1534                         break;
1535                 }
1536
1537                 if (e->e_id == NULL)
1538                         sm_setproctitle(true, e, "%s: %.80s",
1539                                         CurSmtpClient, q);
1540                 else
1541                         sm_setproctitle(true, e, "%s %s: %.80s",
1542                                         qid_printname(e),
1543                                         CurSmtpClient, q);
1544
1545                 /*
1546                 **  Process command.
1547                 **
1548                 **      If we are running as a null server, return 550
1549                 **      to almost everything.
1550                 */
1551
1552                 if (nullserver != NULL || bitnset(D_ETRNONLY, d_flags))
1553                 {
1554                         switch (c->cmd_code)
1555                         {
1556                           case CMDQUIT:
1557                           case CMDHELO:
1558                           case CMDEHLO:
1559                           case CMDNOOP:
1560                           case CMDRSET:
1561                           case CMDERROR:
1562                                 /* process normally */
1563                                 break;
1564
1565                           case CMDETRN:
1566                                 if (bitnset(D_ETRNONLY, d_flags) &&
1567                                     nullserver == NULL)
1568                                         break;
1569                                 DELAY_CONN("ETRN");
1570                                 /* FALLTHROUGH */
1571
1572                           default:
1573 #if MAXBADCOMMANDS > 0
1574                                 /* theoretically this could overflow */
1575                                 if (nullserver != NULL &&
1576                                     ++n_badcmds > MAXBADCOMMANDS)
1577                                 {
1578                                         message("421 4.7.0 %s Too many bad commands; closing connection",
1579                                                 MyHostName);
1580
1581                                         /* arrange to ignore send list */
1582                                         e->e_sendqueue = NULL;
1583                                         goto doquit;
1584                                 }
1585 #endif /* MAXBADCOMMANDS > 0 */
1586                                 if (nullserver != NULL)
1587                                 {
1588                                         if (ISSMTPREPLY(nullserver))
1589                                                 usrerr(nullserver);
1590                                         else
1591                                                 usrerr("550 5.0.0 %s",
1592                                                        nullserver);
1593                                 }
1594                                 else
1595                                         usrerr("452 4.4.5 Insufficient disk space; try again later");
1596                                 continue;
1597                         }
1598                 }
1599
1600                 switch (c->cmd_code)
1601                 {
1602 #if SASL
1603                   case CMDAUTH: /* sasl */
1604                         DELAY_CONN("AUTH");
1605                         if (!sasl_ok || n_mechs <= 0)
1606                         {
1607                                 message("503 5.3.3 AUTH not available");
1608                                 break;
1609                         }
1610                         if (authenticating == SASL_IS_AUTH)
1611                         {
1612                                 message("503 5.5.0 Already Authenticated");
1613                                 break;
1614                         }
1615                         if (smtp.sm_gotmail)
1616                         {
1617                                 message("503 5.5.0 AUTH not permitted during a mail transaction");
1618                                 break;
1619                         }
1620                         if (tempfail)
1621                         {
1622                                 if (LogLevel > 9)
1623                                         sm_syslog(LOG_INFO, e->e_id,
1624                                                   "SMTP AUTH command (%.100s) from %s tempfailed (due to previous checks)",
1625                                                   p, CurSmtpClient);
1626                                 usrerr("454 4.3.0 Please try again later");
1627                                 break;
1628                         }
1629
1630                         ismore = false;
1631
1632                         /* crude way to avoid crack attempts */
1633                         STOP_IF_ATTACK(checksmtpattack(&n_auth, n_mechs + 1,
1634                                                         true, "AUTH", e));
1635
1636                         /* make sure mechanism (p) is a valid string */
1637                         for (q = p; *q != '\0' && isascii(*q); q++)
1638                         {
1639                                 if (isspace(*q))
1640                                 {
1641                                         *q = '\0';
1642                                         while (*++q != '\0' &&
1643                                                isascii(*q) && isspace(*q))
1644                                                 continue;
1645                                         *(q - 1) = '\0';
1646                                         ismore = (*q != '\0');
1647                                         break;
1648                                 }
1649                         }
1650
1651                         if (*p == '\0')
1652                         {
1653                                 message("501 5.5.2 AUTH mechanism must be specified");
1654                                 break;
1655                         }
1656
1657                         /* check whether mechanism is available */
1658                         if (iteminlist(p, mechlist, " ") == NULL)
1659                         {
1660                                 message("504 5.3.3 AUTH mechanism %.32s not available",
1661                                         p);
1662                                 break;
1663                         }
1664
1665                         /*
1666                         **  RFC 2554 4.
1667                         **  Unlike a zero-length client answer to a
1668                         **  334 reply, a zero- length initial response
1669                         **  is sent as a single equals sign ("=").
1670                         */
1671
1672                         if (ismore && *q == '=' && *(q + 1) == '\0')
1673                         {
1674                                 /* will be free()d, don't use in=""; */
1675                                 in = xalloc(1);
1676                                 *in = '\0';
1677                                 inlen = 0;
1678                         }
1679                         else if (ismore)
1680                         {
1681                                 /* could this be shorter? XXX */
1682 # if SASL >= 20000
1683                                 in = xalloc(strlen(q) + 1);
1684                                 result = sasl_decode64(q, strlen(q), in,
1685                                                        strlen(q), &inlen);
1686 # else /* SASL >= 20000 */
1687                                 in = sm_rpool_malloc(e->e_rpool, strlen(q));
1688                                 result = sasl_decode64(q, strlen(q), in,
1689                                                        &inlen);
1690 # endif /* SASL >= 20000 */
1691                                 if (result != SASL_OK)
1692                                 {
1693                                         message("501 5.5.4 cannot BASE64 decode '%s'",
1694                                                 q);
1695                                         if (LogLevel > 5)
1696                                                 sm_syslog(LOG_WARNING, e->e_id,
1697                                                           "AUTH decode64 error [%d for \"%s\"]",
1698                                                           result, q);
1699                                         /* start over? */
1700                                         authenticating = SASL_NOT_AUTH;
1701 # if SASL >= 20000
1702                                         sm_free(in);
1703 # endif /* SASL >= 20000 */
1704                                         in = NULL;
1705                                         inlen = 0;
1706                                         break;
1707                                 }
1708                         }
1709                         else
1710                         {
1711                                 in = NULL;
1712                                 inlen = 0;
1713                         }
1714
1715                         /* see if that auth type exists */
1716 # if SASL >= 20000
1717                         result = sasl_server_start(conn, p, in, inlen,
1718                                                    &out, &outlen);
1719                         if (in != NULL)
1720                                 sm_free(in);
1721 # else /* SASL >= 20000 */
1722                         result = sasl_server_start(conn, p, in, inlen,
1723                                                    &out, &outlen, &errstr);
1724 # endif /* SASL >= 20000 */
1725
1726                         if (result != SASL_OK && result != SASL_CONTINUE)
1727                         {
1728                                 message("535 5.7.0 authentication failed");
1729                                 if (LogLevel > 9)
1730                                         sm_syslog(LOG_ERR, e->e_id,
1731                                                   "AUTH failure (%s): %s (%d) %s",
1732                                                   p,
1733                                                   sasl_errstring(result, NULL,
1734                                                                  NULL),
1735                                                   result,
1736 # if SASL >= 20000
1737                                                   sasl_errdetail(conn));
1738 # else /* SASL >= 20000 */
1739                                                   errstr);
1740 # endif /* SASL >= 20000 */
1741                                 RESET_SASLCONN;
1742                                 break;
1743                         }
1744                         auth_type = newstr(p);
1745
1746                         if (result == SASL_OK)
1747                         {
1748                                 /* ugly, but same code */
1749                                 goto authenticated;
1750                                 /* authenticated by the initial response */
1751                         }
1752
1753                         /* len is at least 2 */
1754                         len = ENC64LEN(outlen);
1755                         out2 = xalloc(len);
1756                         result = sasl_encode64(out, outlen, out2, len,
1757                                                &out2len);
1758
1759                         if (result != SASL_OK)
1760                         {
1761                                 message("454 4.5.4 Temporary authentication failure");
1762                                 if (LogLevel > 5)
1763                                         sm_syslog(LOG_WARNING, e->e_id,
1764                                                   "AUTH encode64 error [%d for \"%s\"]",
1765                                                   result, out);
1766
1767                                 /* start over? */
1768                                 authenticating = SASL_NOT_AUTH;
1769                                 RESET_SASLCONN;
1770                         }
1771                         else
1772                         {
1773                                 message("334 %s", out2);
1774                                 authenticating = SASL_PROC_AUTH;
1775                         }
1776 # if SASL >= 20000
1777                         sm_free(out2);
1778 # endif /* SASL >= 20000 */
1779                         break;
1780 #endif /* SASL */
1781
1782 #if STARTTLS
1783                   case CMDSTLS: /* starttls */
1784                         DELAY_CONN("STARTTLS");
1785                         if (*p != '\0')
1786                         {
1787                                 message("501 5.5.2 Syntax error (no parameters allowed)");
1788                                 break;
1789                         }
1790                         if (!bitset(SRV_OFFER_TLS, features))
1791                         {
1792                                 message("503 5.5.0 TLS not available");
1793                                 break;
1794                         }
1795                         if (!tls_ok_srv)
1796                         {
1797                                 message("454 4.3.3 TLS not available after start");
1798                                 break;
1799                         }
1800                         if (smtp.sm_gotmail)
1801                         {
1802                                 message("503 5.5.0 TLS not permitted during a mail transaction");
1803                                 break;
1804                         }
1805                         if (tempfail)
1806                         {
1807                                 if (LogLevel > 9)
1808                                         sm_syslog(LOG_INFO, e->e_id,
1809                                                   "SMTP STARTTLS command (%.100s) from %s tempfailed (due to previous checks)",
1810                                                   p, CurSmtpClient);
1811                                 usrerr("454 4.7.0 Please try again later");
1812                                 break;
1813                         }
1814   starttls:
1815 # if TLS_NO_RSA
1816                         /*
1817                         **  XXX do we need a temp key ?
1818                         */
1819 # else /* TLS_NO_RSA */
1820 # endif /* TLS_NO_RSA */
1821
1822 # if TLS_VRFY_PER_CTX
1823                         /*
1824                         **  Note: this sets the verification globally
1825                         **  (per SSL_CTX)
1826                         **  it's ok since it applies only to one transaction
1827                         */
1828
1829                         TLS_VERIFY_CLIENT();
1830 # endif /* TLS_VRFY_PER_CTX */
1831
1832                         if (srv_ssl != NULL)
1833                                 SSL_clear(srv_ssl);
1834                         else if ((srv_ssl = SSL_new(srv_ctx)) == NULL)
1835                         {
1836                                 message("454 4.3.3 TLS not available: error generating SSL handle");
1837                                 if (LogLevel > 8)
1838                                         tlslogerr("server");
1839                                 goto tls_done;
1840                         }
1841
1842 # if !TLS_VRFY_PER_CTX
1843                         /*
1844                         **  this could be used if it were possible to set
1845                         **  verification per SSL (connection)
1846                         **  not just per SSL_CTX (global)
1847                         */
1848
1849                         TLS_VERIFY_CLIENT();
1850 # endif /* !TLS_VRFY_PER_CTX */
1851
1852                         rfd = sm_io_getinfo(InChannel, SM_IO_WHAT_FD, NULL);
1853                         wfd = sm_io_getinfo(OutChannel, SM_IO_WHAT_FD, NULL);
1854
1855                         if (rfd < 0 || wfd < 0 ||
1856                             SSL_set_rfd(srv_ssl, rfd) <= 0 ||
1857                             SSL_set_wfd(srv_ssl, wfd) <= 0)
1858                         {
1859                                 message("454 4.3.3 TLS not available: error set fd");
1860                                 SSL_free(srv_ssl);
1861                                 srv_ssl = NULL;
1862                                 goto tls_done;
1863                         }
1864                         if (!smtps)
1865                                 message("220 2.0.0 Ready to start TLS");
1866 # if PIPELINING
1867                         (void) sm_io_flush(OutChannel, SM_TIME_DEFAULT);
1868 # endif /* PIPELINING */
1869
1870                         SSL_set_accept_state(srv_ssl);
1871
1872 #  define SSL_ACC(s)    SSL_accept(s)
1873
1874                         tlsstart = curtime();
1875   ssl_retry:
1876                         if ((r = SSL_ACC(srv_ssl)) <= 0)
1877                         {
1878                                 int i, ssl_err;
1879
1880                                 ssl_err = SSL_get_error(srv_ssl, r);
1881                                 i = tls_retry(srv_ssl, rfd, wfd, tlsstart,
1882                                                 TimeOuts.to_starttls, ssl_err,
1883                                                 "server");
1884                                 if (i > 0)
1885                                         goto ssl_retry;
1886
1887                                 if (LogLevel > 5)
1888                                 {
1889                                         sm_syslog(LOG_WARNING, NOQID,
1890                                                   "STARTTLS=server, error: accept failed=%d, SSL_error=%d, errno=%d, retry=%d",
1891                                                   r, ssl_err, errno, i);
1892                                         if (LogLevel > 8)
1893                                                 tlslogerr("server");
1894                                 }
1895                                 tls_ok_srv = false;
1896                                 SSL_free(srv_ssl);
1897                                 srv_ssl = NULL;
1898
1899                                 /*
1900                                 **  according to the next draft of
1901                                 **  RFC 2487 the connection should be dropped
1902                                 */
1903
1904                                 /* arrange to ignore any current send list */
1905                                 e->e_sendqueue = NULL;
1906                                 goto doquit;
1907                         }
1908
1909                         /* ignore return code for now, it's in {verify} */
1910                         (void) tls_get_info(srv_ssl, true,
1911                                             CurSmtpClient,
1912                                             &BlankEnvelope.e_macro,
1913                                             bitset(SRV_VRFY_CLT, features));
1914
1915                         /*
1916                         **  call Stls_client to find out whether
1917                         **  to accept the connection from the client
1918                         */
1919
1920                         saveQuickAbort = QuickAbort;
1921                         saveSuprErrs = SuprErrs;
1922                         SuprErrs = true;
1923                         QuickAbort = false;
1924                         if (rscheck("tls_client",
1925                                      macvalue(macid("{verify}"), e),
1926                                      "STARTTLS", e,
1927                                      RSF_RMCOMM|RSF_COUNT,
1928                                      5, NULL, NOQID, NULL) != EX_OK ||
1929                             Errors > 0)
1930                         {
1931                                 extern char MsgBuf[];
1932
1933                                 if (MsgBuf[0] != '\0' && ISSMTPREPLY(MsgBuf))
1934                                         nullserver = newstr(MsgBuf);
1935                                 else
1936                                         nullserver = "503 5.7.0 Authentication required.";
1937                         }
1938                         QuickAbort = saveQuickAbort;
1939                         SuprErrs = saveSuprErrs;
1940
1941                         tls_ok_srv = false;     /* don't offer STARTTLS again */
1942                         n_helo = 0;
1943 # if SASL
1944                         if (sasl_ok)
1945                         {
1946                                 int cipher_bits;
1947                                 bool verified;
1948                                 char *s, *v, *c;
1949
1950                                 s = macvalue(macid("{cipher_bits}"), e);
1951                                 v = macvalue(macid("{verify}"), e);
1952                                 c = macvalue(macid("{cert_subject}"), e);
1953                                 verified = (v != NULL && strcmp(v, "OK") == 0);
1954                                 if (s != NULL && (cipher_bits = atoi(s)) > 0)
1955                                 {
1956 #  if SASL >= 20000
1957                                         ext_ssf = cipher_bits;
1958                                         auth_id = verified ? c : NULL;
1959                                         sasl_ok = ((sasl_setprop(conn,
1960                                                         SASL_SSF_EXTERNAL,
1961                                                         &ext_ssf) == SASL_OK) &&
1962                                                    (sasl_setprop(conn,
1963                                                         SASL_AUTH_EXTERNAL,
1964                                                         auth_id) == SASL_OK));
1965 #  else /* SASL >= 20000 */
1966                                         ext_ssf.ssf = cipher_bits;
1967                                         ext_ssf.auth_id = verified ? c : NULL;
1968                                         sasl_ok = sasl_setprop(conn,
1969                                                         SASL_SSF_EXTERNAL,
1970                                                         &ext_ssf) == SASL_OK;
1971 #  endif /* SASL >= 20000 */
1972                                         mechlist = NULL;
1973                                         if (sasl_ok)
1974                                                 n_mechs = saslmechs(conn,
1975                                                                     &mechlist);
1976                                 }
1977                         }
1978 # endif /* SASL */
1979
1980                         /* switch to secure connection */
1981                         if (sfdctls(&InChannel, &OutChannel, srv_ssl) == 0)
1982                         {
1983                                 tls_active = true;
1984 # if PIPELINING
1985                                 (void) sm_io_autoflush(InChannel, OutChannel);
1986 # endif /* PIPELINING */
1987                         }
1988                         else
1989                         {
1990                                 /*
1991                                 **  XXX this is an internal error
1992                                 **  how to deal with it?
1993                                 **  we can't generate an error message
1994                                 **  since the other side switched to an
1995                                 **  encrypted layer, but we could not...
1996                                 **  just "hang up"?
1997                                 */
1998
1999                                 nullserver = "454 4.3.3 TLS not available: can't switch to encrypted layer";
2000                                 syserr("STARTTLS: can't switch to encrypted layer");
2001                         }
2002                   tls_done:
2003                         if (smtps)
2004                         {
2005                                 if (tls_active)
2006                                         goto greeting;
2007                                 else
2008                                         goto doquit;
2009                         }
2010                         break;
2011 #endif /* STARTTLS */
2012
2013                   case CMDHELO:         /* hello -- introduce yourself */
2014                   case CMDEHLO:         /* extended hello */
2015                         DELAY_CONN("EHLO");
2016                         if (c->cmd_code == CMDEHLO)
2017                         {
2018                                 protocol = "ESMTP";
2019                                 SmtpPhase = "server EHLO";
2020                         }
2021                         else
2022                         {
2023                                 protocol = "SMTP";
2024                                 SmtpPhase = "server HELO";
2025                         }
2026
2027                         /* avoid denial-of-service */
2028                         STOP_IF_ATTACK(checksmtpattack(&n_helo, MAXHELOCOMMANDS,
2029                                                         true, "HELO/EHLO", e));
2030
2031 #if 0
2032                         /* RFC2821 4.1.4 allows duplicate HELO/EHLO */
2033                         /* check for duplicate HELO/EHLO per RFC 1651 4.2 */
2034                         if (gothello)
2035                         {
2036                                 usrerr("503 %s Duplicate HELO/EHLO",
2037                                        MyHostName);
2038                                 break;
2039                         }
2040 #endif /* 0 */
2041
2042                         /* check for valid domain name (re 1123 5.2.5) */
2043                         if (*p == '\0' && !AllowBogusHELO)
2044                         {
2045                                 usrerr("501 %s requires domain address",
2046                                         cmdbuf);
2047                                 break;
2048                         }
2049
2050                         /* check for long domain name (hides Received: info) */
2051                         if (strlen(p) > MAXNAME)
2052                         {
2053                                 usrerr("501 Invalid domain name");
2054                                 if (LogLevel > 9)
2055                                         sm_syslog(LOG_INFO, CurEnv->e_id,
2056                                                   "invalid domain name (too long) from %s",
2057                                                   CurSmtpClient);
2058                                 break;
2059                         }
2060
2061                         ok = true;
2062                         for (q = p; *q != '\0'; q++)
2063                         {
2064                                 if (!isascii(*q))
2065                                         break;
2066                                 if (isalnum(*q))
2067                                         continue;
2068                                 if (isspace(*q))
2069                                 {
2070                                         *q = '\0';
2071
2072                                         /* only complain if strict check */
2073                                         ok = AllowBogusHELO;
2074
2075                                         /* allow trailing whitespace */
2076                                         while (!ok && *++q != '\0' &&
2077                                                isspace(*q))
2078                                                 ;
2079                                         if (*q == '\0')
2080                                                 ok = true;
2081                                         break;
2082                                 }
2083                                 if (strchr("[].-_#:", *q) == NULL)
2084                                         break;
2085                         }
2086
2087                         if (*q == '\0' && ok)
2088                         {
2089                                 q = "pleased to meet you";
2090                                 sendinghost = sm_strdup_x(p);
2091                         }
2092                         else if (!AllowBogusHELO)
2093                         {
2094                                 usrerr("501 Invalid domain name");
2095                                 if (LogLevel > 9)
2096                                         sm_syslog(LOG_INFO, CurEnv->e_id,
2097                                                   "invalid domain name (%s) from %.100s",
2098                                                   p, CurSmtpClient);
2099                                 break;
2100                         }
2101                         else
2102                         {
2103                                 q = "accepting invalid domain name";
2104                         }
2105
2106                         if (gothello || smtp.sm_gotmail)
2107                                 CLEAR_STATE(cmdbuf);
2108
2109 #if MILTER
2110                         if (smtp.sm_milterlist && smtp.sm_milterize &&
2111                             !bitset(EF_DISCARD, e->e_flags))
2112                         {
2113                                 char state;
2114                                 char *response;
2115
2116                                 response = milter_helo(p, e, &state);
2117                                 switch (state)
2118                                 {
2119                                   case SMFIR_REJECT:
2120                                         if (MilterLogLevel > 3)
2121                                                 sm_syslog(LOG_INFO, e->e_id,
2122                                                           "Milter: helo=%s, reject=Command rejected",
2123                                                           p);
2124                                         nullserver = "Command rejected";
2125                                         smtp.sm_milterize = false;
2126                                         break;
2127
2128                                   case SMFIR_TEMPFAIL:
2129                                         if (MilterLogLevel > 3)
2130                                                 sm_syslog(LOG_INFO, e->e_id,
2131                                                           "Milter: helo=%s, reject=%s",
2132                                                           p, MSG_TEMPFAIL);
2133                                         tempfail = true;
2134                                         smtp.sm_milterize = false;
2135                                         break;
2136
2137                                   case SMFIR_REPLYCODE:
2138                                         if (MilterLogLevel > 3)
2139                                                 sm_syslog(LOG_INFO, e->e_id,
2140                                                           "Milter: helo=%s, reject=%s",
2141                                                           p, response);
2142                                         if (strncmp(response, "421 ", 4) != 0
2143                                             && strncmp(response, "421-", 4) != 0)
2144                                         {
2145                                                 nullserver = newstr(response);
2146                                                 smtp.sm_milterize = false;
2147                                                 break;
2148                                         }
2149                                         /* FALLTHROUGH */
2150
2151                                   case SMFIR_SHUTDOWN:
2152                                         if (MilterLogLevel > 3 &&
2153                                             response == NULL)
2154                                                 sm_syslog(LOG_INFO, e->e_id,
2155                                                           "Milter: helo=%s, reject=421 4.7.0 %s closing connection",
2156                                                           p, MyHostName);
2157                                         tempfail = true;
2158                                         smtp.sm_milterize = false;
2159                                         if (response != NULL)
2160                                                 usrerr(response);
2161                                         else
2162                                                 message("421 4.7.0 %s closing connection",
2163                                                         MyHostName);
2164                                         /* arrange to ignore send list */
2165                                         e->e_sendqueue = NULL;
2166                                         lognullconnection = false;
2167                                         goto doquit;
2168                                 }
2169                                 if (response != NULL)
2170                                         sm_free(response);
2171
2172                                 /*
2173                                 **  If quarantining by a connect/ehlo action,
2174                                 **  save between messages
2175                                 */
2176
2177                                 if (smtp.sm_quarmsg == NULL &&
2178                                     e->e_quarmsg != NULL)
2179                                         smtp.sm_quarmsg = newstr(e->e_quarmsg);
2180                         }
2181 #endif /* MILTER */
2182                         gothello = true;
2183
2184                         /* print HELO response message */
2185                         if (c->cmd_code != CMDEHLO)
2186                         {
2187                                 message("250 %s Hello %s, %s",
2188                                         MyHostName, CurSmtpClient, q);
2189                                 break;
2190                         }
2191
2192                         message("250-%s Hello %s, %s",
2193                                 MyHostName, CurSmtpClient, q);
2194
2195                         /* offer ENHSC even for nullserver */
2196                         if (nullserver != NULL)
2197                         {
2198                                 message("250 ENHANCEDSTATUSCODES");
2199                                 break;
2200                         }
2201
2202                         /*
2203                         **  print EHLO features list
2204                         **
2205                         **  Note: If you change this list,
2206                         **        remember to update 'helpfile'
2207                         */
2208
2209                         message("250-ENHANCEDSTATUSCODES");
2210 #if PIPELINING
2211                         if (bitset(SRV_OFFER_PIPE, features))
2212                                 message("250-PIPELINING");
2213 #endif /* PIPELINING */
2214                         if (bitset(SRV_OFFER_EXPN, features))
2215                         {
2216                                 message("250-EXPN");
2217                                 if (bitset(SRV_OFFER_VERB, features))
2218                                         message("250-VERB");
2219                         }
2220 #if MIME8TO7
2221                         message("250-8BITMIME");
2222 #endif /* MIME8TO7 */
2223                         if (MaxMessageSize > 0)
2224                                 message("250-SIZE %ld", MaxMessageSize);
2225                         else
2226                                 message("250-SIZE");
2227 #if DSN
2228                         if (SendMIMEErrors && bitset(SRV_OFFER_DSN, features))
2229                                 message("250-DSN");
2230 #endif /* DSN */
2231                         if (bitset(SRV_OFFER_ETRN, features))
2232                                 message("250-ETRN");
2233 #if SASL
2234                         if (sasl_ok && mechlist != NULL && *mechlist != '\0')
2235                                 message("250-AUTH %s", mechlist);
2236 #endif /* SASL */
2237 #if STARTTLS
2238                         if (tls_ok_srv &&
2239                             bitset(SRV_OFFER_TLS, features))
2240                                 message("250-STARTTLS");
2241 #endif /* STARTTLS */
2242                         if (DeliverByMin > 0)
2243                                 message("250-DELIVERBY %ld",
2244                                         (long) DeliverByMin);
2245                         else if (DeliverByMin == 0)
2246                                 message("250-DELIVERBY");
2247
2248                         /* < 0: no deliver-by */
2249
2250                         message("250 HELP");
2251                         break;
2252
2253                   case CMDMAIL:         /* mail -- designate sender */
2254                         SmtpPhase = "server MAIL";
2255                         DELAY_CONN("MAIL");
2256
2257                         /* check for validity of this command */
2258                         if (!gothello && bitset(PRIV_NEEDMAILHELO, PrivacyFlags))
2259                         {
2260                                 usrerr("503 5.0.0 Polite people say HELO first");
2261                                 break;
2262                         }
2263                         if (smtp.sm_gotmail)
2264                         {
2265                                 usrerr("503 5.5.0 Sender already specified");
2266                                 break;
2267                         }
2268 #if SASL
2269                         if (bitset(SRV_REQ_AUTH, features) &&
2270                             authenticating != SASL_IS_AUTH)
2271                         {
2272                                 usrerr("530 5.7.0 Authentication required");
2273                                 break;
2274                         }
2275 #endif /* SASL */
2276
2277                         p = skipword(p, "from");
2278                         if (p == NULL)
2279                                 break;
2280                         if (tempfail)
2281                         {
2282                                 if (LogLevel > 9)
2283                                         sm_syslog(LOG_INFO, e->e_id,
2284                                                   "SMTP MAIL command (%.100s) from %s tempfailed (due to previous checks)",
2285                                                   p, CurSmtpClient);
2286                                 usrerr(MSG_TEMPFAIL);
2287                                 break;
2288                         }
2289
2290                         /* make sure we know who the sending host is */
2291                         if (sendinghost == NULL)
2292                                 sendinghost = peerhostname;
2293
2294
2295 #if SM_HEAP_CHECK
2296                         if (sm_debug_active(&DebugLeakSmtp, 1))
2297                         {
2298                                 sm_heap_newgroup();
2299                                 sm_dprintf("smtp() heap group #%d\n",
2300                                         sm_heap_group());
2301                         }
2302 #endif /* SM_HEAP_CHECK */
2303
2304                         if (Errors > 0)
2305                                 goto undo_no_pm;
2306                         if (!gothello)
2307                         {
2308                                 auth_warning(e, "%s didn't use HELO protocol",
2309                                              CurSmtpClient);
2310                         }
2311 #ifdef PICKY_HELO_CHECK
2312                         if (sm_strcasecmp(sendinghost, peerhostname) != 0 &&
2313                             (sm_strcasecmp(peerhostname, "localhost") != 0 ||
2314                              sm_strcasecmp(sendinghost, MyHostName) != 0))
2315                         {
2316                                 auth_warning(e, "Host %s claimed to be %s",
2317                                              CurSmtpClient, sendinghost);
2318                         }
2319 #endif /* PICKY_HELO_CHECK */
2320
2321                         if (protocol == NULL)
2322                                 protocol = "SMTP";
2323                         macdefine(&e->e_macro, A_PERM, 'r', protocol);
2324                         macdefine(&e->e_macro, A_PERM, 's', sendinghost);
2325
2326                         if (Errors > 0)
2327                                 goto undo_no_pm;
2328                         smtp.sm_nrcpts = 0;
2329                         n_badrcpts = 0;
2330                         macdefine(&e->e_macro, A_PERM, macid("{ntries}"), "0");
2331                         macdefine(&e->e_macro, A_PERM, macid("{nrcpts}"), "0");
2332                         macdefine(&e->e_macro, A_PERM, macid("{nbadrcpts}"),
2333                                 "0");
2334                         e->e_flags |= EF_CLRQUEUE;
2335                         sm_setproctitle(true, e, "%s %s: %.80s",
2336                                         qid_printname(e),
2337                                         CurSmtpClient, inp);
2338
2339                         /* do the processing */
2340                     SM_TRY
2341                     {
2342                         extern char *FullName;
2343
2344                         QuickAbort = true;
2345                         SM_FREE_CLR(FullName);
2346
2347                         /* must parse sender first */
2348                         delimptr = NULL;
2349                         setsender(p, e, &delimptr, ' ', false);
2350                         if (delimptr != NULL && *delimptr != '\0')
2351                                 *delimptr++ = '\0';
2352                         if (Errors > 0)
2353                                 sm_exc_raisenew_x(&EtypeQuickAbort, 1);
2354
2355                         /* Successfully set e_from, allow logging */
2356                         e->e_flags |= EF_LOGSENDER;
2357
2358                         /* put resulting triple from parseaddr() into macros */
2359                         if (e->e_from.q_mailer != NULL)
2360                                  macdefine(&e->e_macro, A_PERM,
2361                                         macid("{mail_mailer}"),
2362                                         e->e_from.q_mailer->m_name);
2363                         else
2364                                  macdefine(&e->e_macro, A_PERM,
2365                                         macid("{mail_mailer}"), NULL);
2366                         if (e->e_from.q_host != NULL)
2367                                 macdefine(&e->e_macro, A_PERM,
2368                                         macid("{mail_host}"),
2369                                         e->e_from.q_host);
2370                         else
2371                                 macdefine(&e->e_macro, A_PERM,
2372                                         macid("{mail_host}"), "localhost");
2373                         if (e->e_from.q_user != NULL)
2374                                 macdefine(&e->e_macro, A_PERM,
2375                                         macid("{mail_addr}"),
2376                                         e->e_from.q_user);
2377                         else
2378                                 macdefine(&e->e_macro, A_PERM,
2379                                         macid("{mail_addr}"), NULL);
2380                         if (Errors > 0)
2381                                 sm_exc_raisenew_x(&EtypeQuickAbort, 1);
2382
2383                         /* check for possible spoofing */
2384                         if (RealUid != 0 && OpMode == MD_SMTP &&
2385                             !wordinclass(RealUserName, 't') &&
2386                             (!bitnset(M_LOCALMAILER,
2387                                       e->e_from.q_mailer->m_flags) ||
2388                              strcmp(e->e_from.q_user, RealUserName) != 0))
2389                         {
2390                                 auth_warning(e, "%s owned process doing -bs",
2391                                         RealUserName);
2392                         }
2393
2394                         /* reset to default value */
2395                         SevenBitInput = SevenBitInput_Saved;
2396
2397                         /* now parse ESMTP arguments */
2398                         e->e_msgsize = 0;
2399                         addr = p;
2400                         parse_esmtp_args(e, NULL, p, delimptr, "MAIL", args,
2401                                         mail_esmtp_args);
2402                         if (Errors > 0)
2403                                 sm_exc_raisenew_x(&EtypeQuickAbort, 1);
2404
2405 #if SASL
2406 # if _FFR_AUTH_PASSING
2407                         /* set the default AUTH= if the sender didn't */
2408                         if (e->e_auth_param == NULL)
2409                         {
2410                                 /* XXX only do this for an MSA? */
2411                                 e->e_auth_param = macvalue(macid("{auth_authen}"),
2412                                                            e);
2413                                 if (e->e_auth_param == NULL)
2414                                         e->e_auth_param = "<>";
2415
2416                                 /*
2417                                 **  XXX should we invoke Strust_auth now?
2418                                 **  authorizing as the client that just
2419                                 **  authenticated, so we'll trust implicitly
2420                                 */
2421                         }
2422 # endif /* _FFR_AUTH_PASSING */
2423 #endif /* SASL */
2424
2425                         /* do config file checking of the sender */
2426                         macdefine(&e->e_macro, A_PERM,
2427                                 macid("{addr_type}"), "e s");
2428 #if _FFR_MAIL_MACRO
2429                         /* make the "real" sender address available */
2430                         macdefine(&e->e_macro, A_TEMP, macid("{mail_from}"),
2431                                   e->e_from.q_paddr);
2432 #endif /* _FFR_MAIL_MACRO */
2433                         if (rscheck("check_mail", addr,
2434                                     NULL, e, RSF_RMCOMM|RSF_COUNT, 3,
2435                                     NULL, e->e_id, NULL) != EX_OK ||
2436                             Errors > 0)
2437                                 sm_exc_raisenew_x(&EtypeQuickAbort, 1);
2438                         macdefine(&e->e_macro, A_PERM,
2439                                   macid("{addr_type}"), NULL);
2440
2441                         if (MaxMessageSize > 0 &&
2442                             (e->e_msgsize > MaxMessageSize ||
2443                              e->e_msgsize < 0))
2444                         {
2445                                 usrerr("552 5.2.3 Message size exceeds fixed maximum message size (%ld)",
2446                                         MaxMessageSize);
2447                                 sm_exc_raisenew_x(&EtypeQuickAbort, 1);
2448                         }
2449
2450                         /*
2451                         **  XXX always check whether there is at least one fs
2452                         **  with enough space?
2453                         **  However, this may not help much: the queue group
2454                         **  selection may later on select a FS that hasn't
2455                         **  enough space.
2456                         */
2457
2458                         if ((NumFileSys == 1 || NumQueue == 1) &&
2459                             !enoughdiskspace(e->e_msgsize, e)
2460 #if _FFR_ANY_FREE_FS
2461                             && !filesys_free(e->e_msgsize)
2462 #endif /* _FFR_ANY_FREE_FS */
2463                            )
2464                         {
2465                                 /*
2466                                 **  We perform this test again when the
2467                                 **  queue directory is selected, in collect.
2468                                 */
2469
2470                                 usrerr("452 4.4.5 Insufficient disk space; try again later");
2471                                 sm_exc_raisenew_x(&EtypeQuickAbort, 1);
2472                         }
2473                         if (Errors > 0)
2474                                 sm_exc_raisenew_x(&EtypeQuickAbort, 1);
2475
2476                         LogUsrErrs = true;
2477 #if MILTER
2478                         if (smtp.sm_milterlist && smtp.sm_milterize &&
2479                             !bitset(EF_DISCARD, e->e_flags))
2480                         {
2481                                 char state;
2482                                 char *response;
2483
2484                                 response = milter_envfrom(args, e, &state);
2485                                 MILTER_REPLY("from");
2486                         }
2487 #endif /* MILTER */
2488                         if (Errors > 0)
2489                                 sm_exc_raisenew_x(&EtypeQuickAbort, 1);
2490
2491                         message("250 2.1.0 Sender ok");
2492                         smtp.sm_gotmail = true;
2493                     }
2494                     SM_EXCEPT(exc, "[!F]*")
2495                     {
2496                         /*
2497                         **  An error occurred while processing a MAIL command.
2498                         **  Jump to the common error handling code.
2499                         */
2500
2501                         sm_exc_free(exc);
2502                         goto undo_no_pm;
2503                     }
2504                     SM_END_TRY
2505                         break;
2506
2507                   undo_no_pm:
2508                         e->e_flags &= ~EF_PM_NOTIFY;
2509                   undo:
2510                         break;
2511
2512                   case CMDRCPT:         /* rcpt -- designate recipient */
2513                         DELAY_CONN("RCPT");
2514                         macdefine(&e->e_macro, A_PERM,
2515                                 macid("{rcpt_mailer}"), NULL);
2516                         macdefine(&e->e_macro, A_PERM,
2517                                 macid("{rcpt_host}"), NULL);
2518                         macdefine(&e->e_macro, A_PERM,
2519                                 macid("{rcpt_addr}"), NULL);
2520 #if MILTER
2521                         (void) memset(&addr_st, '\0', sizeof(addr_st));
2522                         a = NULL;
2523                         milter_rcpt_added = false;
2524                         smtp.sm_e_nrcpts_orig = e->e_nrcpts;
2525 #endif
2526                         if (BadRcptThrottle > 0 &&
2527                             n_badrcpts >= BadRcptThrottle)
2528                         {
2529                                 if (LogLevel > 5 &&
2530                                     n_badrcpts == BadRcptThrottle)
2531                                 {
2532                                         sm_syslog(LOG_INFO, e->e_id,
2533                                                   "%s: Possible SMTP RCPT flood, throttling.",
2534                                                   CurSmtpClient);
2535
2536                                         /* To avoid duplicated message */
2537                                         n_badrcpts++;
2538                                 }
2539                                 NBADRCPTS;
2540
2541                                 /*
2542                                 **  Don't use exponential backoff for now.
2543                                 **  Some servers will open more connections
2544                                 **  and actually overload the receiver even
2545                                 **  more.
2546                                 */
2547
2548                                 (void) sleep(1);
2549                         }
2550                         if (!smtp.sm_gotmail)
2551                         {
2552                                 usrerr("503 5.0.0 Need MAIL before RCPT");
2553                                 break;
2554                         }
2555                         SmtpPhase = "server RCPT";
2556                     SM_TRY
2557                     {
2558                         QuickAbort = true;
2559                         LogUsrErrs = true;
2560
2561                         /* limit flooding of our machine */
2562                         if (MaxRcptPerMsg > 0 &&
2563                             smtp.sm_nrcpts >= MaxRcptPerMsg)
2564                         {
2565                                 /* sleep(1); / * slow down? */
2566                                 usrerr("452 4.5.3 Too many recipients");
2567                                 goto rcpt_done;
2568                         }
2569
2570                         if (e->e_sendmode != SM_DELIVER
2571 #if _FFR_DM_ONE
2572                             && (NotFirstDelivery || SM_DM_ONE != e->e_sendmode)
2573 #endif /* _FFR_DM_ONE */
2574                            )
2575                                 e->e_flags |= EF_VRFYONLY;
2576
2577 #if MILTER
2578                         /*
2579                         **  Do not expand recipients at RCPT time (in the call
2580                         **  to recipient()) if a milter can delete or reject
2581                         **  a RCPT.  If they are expanded, it is impossible
2582                         **  for removefromlist() to figure out the expanded
2583                         **  members of the original recipient and mark them
2584                         **  as QS_DONTSEND.
2585                         */
2586
2587                         if (!(smtp.sm_milterlist && smtp.sm_milterize &&
2588                               !bitset(EF_DISCARD, e->e_flags)) &&
2589                             (smtp.sm_milters.mis_flags &
2590                              (MIS_FL_DEL_RCPT|MIS_FL_REJ_RCPT)) != 0)
2591                                 e->e_flags |= EF_VRFYONLY;
2592                         milter_cmd_done = false;
2593                         milter_cmd_safe = false;
2594 #endif /* MILTER */
2595
2596                         p = skipword(p, "to");
2597                         if (p == NULL)
2598                                 goto rcpt_done;
2599                         macdefine(&e->e_macro, A_PERM,
2600                                 macid("{addr_type}"), "e r");
2601                         a = parseaddr(p, NULLADDR, RF_COPYALL, ' ', &delimptr,
2602                                       e, true);
2603                         macdefine(&e->e_macro, A_PERM,
2604                                 macid("{addr_type}"), NULL);
2605                         if (Errors > 0)
2606                                 goto rcpt_done;
2607                         if (a == NULL)
2608                         {
2609                                 usrerr("501 5.0.0 Missing recipient");
2610                                 goto rcpt_done;
2611                         }
2612
2613                         if (delimptr != NULL && *delimptr != '\0')
2614                                 *delimptr++ = '\0';
2615
2616                         /* put resulting triple from parseaddr() into macros */
2617                         if (a->q_mailer != NULL)
2618                                 macdefine(&e->e_macro, A_PERM,
2619                                         macid("{rcpt_mailer}"),
2620                                         a->q_mailer->m_name);
2621                         else
2622                                 macdefine(&e->e_macro, A_PERM,
2623                                         macid("{rcpt_mailer}"), NULL);
2624                         if (a->q_host != NULL)
2625                                 macdefine(&e->e_macro, A_PERM,
2626                                         macid("{rcpt_host}"), a->q_host);
2627                         else
2628                                 macdefine(&e->e_macro, A_PERM,
2629                                         macid("{rcpt_host}"), "localhost");
2630                         if (a->q_user != NULL)
2631                                 macdefine(&e->e_macro, A_PERM,
2632                                         macid("{rcpt_addr}"), a->q_user);
2633                         else
2634                                 macdefine(&e->e_macro, A_PERM,
2635                                         macid("{rcpt_addr}"), NULL);
2636                         if (Errors > 0)
2637                                 goto rcpt_done;
2638
2639                         /* now parse ESMTP arguments */
2640                         addr = p;
2641                         parse_esmtp_args(e, a, p, delimptr, "RCPT", args,
2642                                         rcpt_esmtp_args);
2643                         if (Errors > 0)
2644                                 goto rcpt_done;
2645
2646 #if MILTER
2647                         /*
2648                         **  rscheck() can trigger an "exception"
2649                         **  in which case the execution continues at
2650                         **  SM_EXCEPT(exc, "[!F]*")
2651                         **  This means milter_cmd_safe is not set
2652                         **  and hence milter is not invoked.
2653                         **  Would it be "safe" to change that, i.e., use
2654                         **  milter_cmd_safe = true;
2655                         **  here so a milter is informed (if requested)
2656                         **  about RCPTs that are rejected by check_rcpt?
2657                         */
2658 # if _FFR_MILTER_CHECK_REJECTIONS_TOO
2659                         milter_cmd_safe = true;
2660 # endif
2661 #endif
2662
2663                         /* do config file checking of the recipient */
2664                         macdefine(&e->e_macro, A_PERM,
2665                                 macid("{addr_type}"), "e r");
2666                         if (rscheck("check_rcpt", addr,
2667                                     NULL, e, RSF_RMCOMM|RSF_COUNT, 3,
2668                                     NULL, e->e_id, p_addr_st) != EX_OK ||
2669                             Errors > 0)
2670                                 goto rcpt_done;
2671                         macdefine(&e->e_macro, A_PERM,
2672                                 macid("{addr_type}"), NULL);
2673
2674                         /* If discarding, don't bother to verify user */
2675                         if (bitset(EF_DISCARD, e->e_flags))
2676                                 a->q_state = QS_VERIFIED;
2677 #if MILTER
2678                         milter_cmd_safe = true;
2679 #endif
2680
2681                         /* save in recipient list after ESMTP mods */
2682                         a = recipient(a, &e->e_sendqueue, 0, e);
2683                         /* may trigger exception... */
2684
2685 #if MILTER
2686                         milter_rcpt_added = true;
2687 #endif
2688
2689                         if(!(Errors > 0) && QS_IS_BADADDR(a->q_state))
2690                         {
2691                                 /* punt -- should keep message in ADDRESS.... */
2692                                 usrerr("550 5.1.1 Addressee unknown");
2693                         }
2694
2695 #if MILTER
2696                 rcpt_done:
2697                         if (smtp.sm_milterlist && smtp.sm_milterize &&
2698                             !bitset(EF_DISCARD, e->e_flags))
2699                         {
2700                                 char state;
2701                                 char *response;
2702
2703                                 /* how to get the error codes? */
2704                                 if (Errors > 0)
2705                                 {
2706                                         macdefine(&e->e_macro, A_PERM,
2707                                                 macid("{rcpt_mailer}"),
2708                                                 "error");
2709                                         if (a != NULL &&
2710                                             a->q_status != NULL &&
2711                                             a->q_rstatus != NULL)
2712                                         {
2713                                                 macdefine(&e->e_macro, A_PERM,
2714                                                         macid("{rcpt_host}"),
2715                                                         a->q_status);
2716                                                 macdefine(&e->e_macro, A_PERM,
2717                                                         macid("{rcpt_addr}"),
2718                                                         a->q_rstatus);
2719                                         }
2720                                         else
2721                                         {
2722                                                 if (addr_st.q_host != NULL)
2723                                                         macdefine(&e->e_macro,
2724                                                                 A_PERM,
2725                                                                 macid("{rcpt_host}"),
2726                                                                 addr_st.q_host);
2727                                                 if (addr_st.q_user != NULL)
2728                                                         macdefine(&e->e_macro,
2729                                                                 A_PERM,
2730                                                                 macid("{rcpt_addr}"),
2731                                                                 addr_st.q_user);
2732                                         }
2733                                 }
2734
2735                                 response = milter_envrcpt(args, e, &state,
2736                                                         Errors > 0);
2737                                 milter_cmd_done = true;
2738                                 MILTER_REPLY("to");
2739                         }
2740 #endif /* MILTER */
2741
2742                         /* no errors during parsing, but might be a duplicate */
2743                         e->e_to = a->q_paddr;
2744                         if (!(Errors > 0) && !QS_IS_BADADDR(a->q_state))
2745                         {
2746                                 if (smtp.sm_nrcpts == 0)
2747                                         initsys(e);
2748                                 message("250 2.1.5 Recipient ok%s",
2749                                         QS_IS_QUEUEUP(a->q_state) ?
2750                                                 " (will queue)" : "");
2751                                 smtp.sm_nrcpts++;
2752                         }
2753
2754                         /* Is this needed? */
2755 #if !MILTER
2756                 rcpt_done:
2757 #endif /* !MILTER */
2758                         macdefine(&e->e_macro, A_PERM,
2759                                 macid("{rcpt_mailer}"), NULL);
2760                         macdefine(&e->e_macro, A_PERM,
2761                                 macid("{rcpt_host}"), NULL);
2762                         macdefine(&e->e_macro, A_PERM,
2763                                 macid("{rcpt_addr}"), NULL);
2764                         macdefine(&e->e_macro, A_PERM,
2765                                 macid("{dsn_notify}"), NULL);
2766
2767                         if (Errors > 0)
2768                         {
2769                                 ++n_badrcpts;
2770                                 NBADRCPTS;
2771                         }
2772                     }
2773                     SM_EXCEPT(exc, "[!F]*")
2774                     {
2775                         /* An exception occurred while processing RCPT */
2776                         e->e_flags &= ~(EF_FATALERRS|EF_PM_NOTIFY);
2777                         ++n_badrcpts;
2778                         NBADRCPTS;
2779 #if MILTER
2780                         if (smtp.sm_milterlist && smtp.sm_milterize &&
2781                             !bitset(EF_DISCARD, e->e_flags) &&
2782                             !milter_cmd_done && milter_cmd_safe)
2783                         {
2784                                 char state;
2785                                 char *response;
2786
2787                                 macdefine(&e->e_macro, A_PERM,
2788                                         macid("{rcpt_mailer}"), "error");
2789
2790                                 /* how to get the error codes? */
2791                                 if (addr_st.q_host != NULL)
2792                                         macdefine(&e->e_macro, A_PERM,
2793                                                 macid("{rcpt_host}"),
2794                                                 addr_st.q_host);
2795                                 else if (a != NULL && a->q_status != NULL)
2796                                         macdefine(&e->e_macro, A_PERM,
2797                                                 macid("{rcpt_host}"),
2798                                                 a->q_status);
2799
2800                                 if (addr_st.q_user != NULL)
2801                                         macdefine(&e->e_macro, A_PERM,
2802                                                 macid("{rcpt_addr}"),
2803                                                 addr_st.q_user);
2804                                 else if (a != NULL && a->q_rstatus != NULL)
2805                                         macdefine(&e->e_macro, A_PERM,
2806                                                 macid("{rcpt_addr}"),
2807                                                 a->q_rstatus);
2808
2809                                 response = milter_envrcpt(args, e, &state,
2810                                                         true);
2811                                 milter_cmd_done = true;
2812                                 MILTER_REPLY("to");
2813                                 macdefine(&e->e_macro, A_PERM,
2814                                         macid("{rcpt_mailer}"), NULL);
2815                                 macdefine(&e->e_macro, A_PERM,
2816                                         macid("{rcpt_host}"), NULL);
2817                                 macdefine(&e->e_macro, A_PERM,
2818                                         macid("{rcpt_addr}"), NULL);
2819                         }
2820                         if (smtp.sm_milterlist && smtp.sm_milterize &&
2821                             milter_rcpt_added && milter_cmd_done &&
2822                             milter_cmd_fail)
2823                         {
2824                                 (void) removefromlist(addr, &e->e_sendqueue, e);
2825                                 milter_cmd_fail = false;
2826                                 if (smtp.sm_e_nrcpts_orig < e->e_nrcpts)
2827                                         e->e_nrcpts = smtp.sm_e_nrcpts_orig;
2828                         }
2829 #endif /* MILTER */
2830                     }
2831                     SM_END_TRY
2832                         break;
2833
2834                   case CMDDATA:         /* data -- text of mail */
2835                         DELAY_CONN("DATA");
2836                         if (!smtp_data(&smtp, e))
2837                                 goto doquit;
2838                         break;
2839
2840                   case CMDRSET:         /* rset -- reset state */
2841                         if (tTd(94, 100))
2842                                 message("451 4.0.0 Test failure");
2843                         else
2844                                 message("250 2.0.0 Reset state");
2845                         CLEAR_STATE(cmdbuf);
2846                         break;
2847
2848                   case CMDVRFY:         /* vrfy -- verify address */
2849                   case CMDEXPN:         /* expn -- expand address */
2850                         vrfy = c->cmd_code == CMDVRFY;
2851                         DELAY_CONN(vrfy ? "VRFY" : "EXPN");
2852                         if (tempfail)
2853                         {
2854                                 if (LogLevel > 9)
2855                                         sm_syslog(LOG_INFO, e->e_id,
2856                                                   "SMTP %s command (%.100s) from %s tempfailed (due to previous checks)",
2857                                                   vrfy ? "VRFY" : "EXPN",
2858                                                   p, CurSmtpClient);
2859
2860                                 /* RFC 821 doesn't allow 4xy reply code */
2861                                 usrerr("550 5.7.1 Please try again later");
2862                                 break;
2863                         }
2864                         wt = checksmtpattack(&n_verifies, MAXVRFYCOMMANDS,
2865                                              false, vrfy ? "VRFY" : "EXPN", e);
2866                         STOP_IF_ATTACK(wt);
2867                         previous = curtime();
2868                         if ((vrfy && bitset(PRIV_NOVRFY, PrivacyFlags)) ||
2869                             (!vrfy && !bitset(SRV_OFFER_EXPN, features)))
2870                         {
2871                                 if (vrfy)
2872                                         message("252 2.5.2 Cannot VRFY user; try RCPT to attempt delivery (or try finger)");
2873                                 else
2874                                         message("502 5.7.0 Sorry, we do not allow this operation");
2875                                 if (LogLevel > 5)
2876                                         sm_syslog(LOG_INFO, e->e_id,
2877                                                   "%s: %s [rejected]",
2878                                                   CurSmtpClient,
2879                                                   shortenstring(inp, MAXSHORTSTR));
2880                                 break;
2881                         }
2882                         else if (!gothello &&
2883                                  bitset(vrfy ? PRIV_NEEDVRFYHELO : PRIV_NEEDEXPNHELO,
2884                                                 PrivacyFlags))
2885                         {
2886                                 usrerr("503 5.0.0 I demand that you introduce yourself first");
2887                                 break;
2888                         }
2889                         if (Errors > 0)
2890                                 break;
2891                         if (LogLevel > 5)
2892                                 sm_syslog(LOG_INFO, e->e_id, "%s: %s",
2893                                           CurSmtpClient,
2894                                           shortenstring(inp, MAXSHORTSTR));
2895                     SM_TRY
2896                     {
2897                         QuickAbort = true;
2898                         vrfyqueue = NULL;
2899                         if (vrfy)
2900                                 e->e_flags |= EF_VRFYONLY;
2901                         while (*p != '\0' && isascii(*p) && isspace(*p))
2902                                 p++;
2903                         if (*p == '\0')
2904                         {
2905                                 usrerr("501 5.5.2 Argument required");
2906                         }
2907                         else
2908                         {
2909                                 /* do config file checking of the address */
2910                                 if (rscheck(vrfy ? "check_vrfy" : "check_expn",
2911                                             p, NULL, e, RSF_RMCOMM,
2912                                             3, NULL, NOQID, NULL) != EX_OK ||
2913                                     Errors > 0)
2914                                         sm_exc_raisenew_x(&EtypeQuickAbort, 1);
2915                                 (void) sendtolist(p, NULLADDR, &vrfyqueue, 0, e);
2916                         }
2917                         if (wt > 0)
2918                         {
2919                                 time_t t;
2920
2921                                 t = wt - (curtime() - previous);
2922                                 if (t > 0)
2923                                         (void) sleep(t);
2924                         }
2925                         if (Errors > 0)
2926                                 sm_exc_raisenew_x(&EtypeQuickAbort, 1);
2927                         if (vrfyqueue == NULL)
2928                         {
2929                                 usrerr("554 5.5.2 Nothing to %s", vrfy ? "VRFY" : "EXPN");
2930                         }
2931                         while (vrfyqueue != NULL)
2932                         {
2933                                 if (!QS_IS_UNDELIVERED(vrfyqueue->q_state))
2934                                 {
2935                                         vrfyqueue = vrfyqueue->q_next;
2936                                         continue;
2937                                 }
2938
2939                                 /* see if there is more in the vrfy list */
2940                                 a = vrfyqueue;
2941                                 while ((a = a->q_next) != NULL &&
2942                                        (!QS_IS_UNDELIVERED(a->q_state)))
2943                                         continue;
2944                                 printvrfyaddr(vrfyqueue, a == NULL, vrfy);
2945                                 vrfyqueue = a;
2946                         }
2947                     }
2948                     SM_EXCEPT(exc, "[!F]*")
2949                     {
2950                         /*
2951                         **  An exception occurred while processing VRFY/EXPN
2952                         */
2953
2954                         sm_exc_free(exc);
2955                         goto undo;
2956                     }
2957                     SM_END_TRY
2958                         break;
2959
2960                   case CMDETRN:         /* etrn -- force queue flush */
2961                         DELAY_CONN("ETRN");
2962
2963                         /* Don't leak queue information via debug flags */
2964                         if (!bitset(SRV_OFFER_ETRN, features) || UseMSP ||
2965                             (RealUid != 0 && RealUid != TrustedUid &&
2966                              OpMode == MD_SMTP))
2967                         {
2968                                 /* different message for MSA ? */
2969                                 message("502 5.7.0 Sorry, we do not allow this operation");
2970                                 if (LogLevel > 5)
2971                                         sm_syslog(LOG_INFO, e->e_id,
2972                                                   "%s: %s [rejected]",
2973                                                   CurSmtpClient,
2974                                                   shortenstring(inp, MAXSHORTSTR));
2975                                 break;
2976                         }
2977                         if (tempfail)
2978                         {
2979                                 if (LogLevel > 9)
2980                                         sm_syslog(LOG_INFO, e->e_id,
2981                                                   "SMTP ETRN command (%.100s) from %s tempfailed (due to previous checks)",
2982                                                   p, CurSmtpClient);
2983                                 usrerr(MSG_TEMPFAIL);
2984                                 break;
2985                         }
2986
2987                         if (strlen(p) <= 0)
2988                         {
2989                                 usrerr("500 5.5.2 Parameter required");
2990                                 break;
2991                         }
2992
2993                         /* crude way to avoid denial-of-service attacks */
2994                         STOP_IF_ATTACK(checksmtpattack(&n_etrn, MAXETRNCOMMANDS,
2995                                                         true, "ETRN", e));
2996
2997                         /*
2998                         **  Do config file checking of the parameter.
2999                         **  Even though we have srv_features now, we still
3000                         **  need this ruleset because the former is called
3001                         **  when the connection has been established, while
3002                         **  this ruleset is called when the command is
3003                         **  actually issued and therefore has all information
3004                         **  available to make a decision.
3005                         */
3006
3007                         if (rscheck("check_etrn", p, NULL, e,
3008                                     RSF_RMCOMM, 3, NULL, NOQID, NULL)
3009                                                                 != EX_OK ||
3010                             Errors > 0)
3011                                 break;
3012
3013                         if (LogLevel > 5)
3014                                 sm_syslog(LOG_INFO, e->e_id,
3015                                           "%s: ETRN %s", CurSmtpClient,
3016                                           shortenstring(p, MAXSHORTSTR));
3017
3018                         id = p;
3019                         if (*id == '#')
3020                         {
3021                                 int i, qgrp;
3022
3023                                 id++;
3024                                 qgrp = name2qid(id);
3025                                 if (!ISVALIDQGRP(qgrp))
3026                                 {
3027                                         usrerr("459 4.5.4 Queue %s unknown",
3028                                                id);
3029                                         break;
3030                                 }
3031                                 for (i = 0; i < NumQueue && Queue[i] != NULL;
3032                                      i++)
3033                                         Queue[i]->qg_nextrun = (time_t) -1;
3034                                 Queue[qgrp]->qg_nextrun = 0;
3035                                 ok = run_work_group(Queue[qgrp]->qg_wgrp,
3036                                                     RWG_FORK|RWG_FORCE);
3037                                 if (ok && Errors == 0)
3038                                         message("250 2.0.0 Queuing for queue group %s started", id);
3039                                 break;
3040                         }
3041
3042                         if (*id == '@')
3043                                 id++;
3044                         else
3045                                 *--id = '@';
3046
3047                         new = (QUEUE_CHAR *) sm_malloc(sizeof(QUEUE_CHAR));
3048                         if (new == NULL)
3049                         {
3050                                 syserr("500 5.5.0 ETRN out of memory");
3051                                 break;
3052                         }
3053                         new->queue_match = id;
3054                         new->queue_negate = false;
3055                         new->queue_next = NULL;
3056                         QueueLimitRecipient = new;
3057                         ok = runqueue(true, false, false, true);
3058                         sm_free(QueueLimitRecipient); /* XXX */
3059                         QueueLimitRecipient = NULL;
3060                         if (ok && Errors == 0)
3061                                 message("250 2.0.0 Queuing for node %s started", p);
3062                         break;
3063
3064                   case CMDHELP:         /* help -- give user info */
3065                         DELAY_CONN("HELP");
3066                         help(p, e);
3067                         break;
3068
3069                   case CMDNOOP:         /* noop -- do nothing */
3070                         DELAY_CONN("NOOP");
3071                         STOP_IF_ATTACK(checksmtpattack(&n_noop, MaxNOOPCommands,
3072                                                         true, "NOOP", e));
3073                         message("250 2.0.0 OK");
3074                         break;
3075
3076                   case CMDQUIT:         /* quit -- leave mail */
3077                         message("221 2.0.0 %s closing connection", MyHostName);
3078 #if PIPELINING
3079                         (void) sm_io_flush(OutChannel, SM_TIME_DEFAULT);
3080 #endif /* PIPELINING */
3081
3082                         if (smtp.sm_nrcpts > 0)
3083                                 logundelrcpts(e, "aborted by sender", 9, false);
3084
3085                         /* arrange to ignore any current send list */
3086                         e->e_sendqueue = NULL;
3087
3088 #if STARTTLS
3089                         /* shutdown TLS connection */
3090                         if (tls_active)
3091                         {
3092                                 (void) endtls(srv_ssl, "server");
3093                                 tls_active = false;
3094                         }
3095 #endif /* STARTTLS */
3096 #if SASL
3097                         if (authenticating == SASL_IS_AUTH)
3098                         {
3099                                 sasl_dispose(&conn);
3100                                 authenticating = SASL_NOT_AUTH;
3101                                 /* XXX sasl_done(); this is a child */
3102                         }
3103 #endif /* SASL */
3104
3105 doquit:
3106                         /* avoid future 050 messages */
3107                         disconnect(1, e);
3108
3109 #if MILTER
3110                         /* close out milter filters */
3111                         milter_quit(e);
3112 #endif /* MILTER */
3113
3114                         if (LogLevel > 4 && bitset(EF_LOGSENDER, e->e_flags))
3115                                 logsender(e, NULL);
3116                         e->e_flags &= ~EF_LOGSENDER;
3117
3118                         if (lognullconnection && LogLevel > 5 &&
3119                             nullserver == NULL)
3120                         {
3121                                 char *d;
3122
3123                                 d = macvalue(macid("{daemon_name}"), e);
3124                                 if (d == NULL)
3125                                         d = "stdin";
3126
3127                                 /*
3128                                 **  even though this id is "bogus", it makes
3129                                 **  it simpler to "grep" related events, e.g.,
3130                                 **  timeouts for the same connection.
3131                                 */
3132
3133                                 sm_syslog(LOG_INFO, e->e_id,
3134                                           "%s did not issue MAIL/EXPN/VRFY/ETRN during connection to %s",
3135                                           CurSmtpClient, d);
3136                         }
3137                         if (tTd(93, 100))
3138                         {
3139                                 /* return to handle next connection */
3140                                 return;
3141                         }
3142                         finis(true, true, ExitStat);
3143                         /* NOTREACHED */
3144
3145                         /* just to avoid bogus warning from some compilers */
3146                         exit(EX_OSERR);
3147
3148                   case CMDVERB:         /* set verbose mode */
3149                         DELAY_CONN("VERB");
3150                         if (!bitset(SRV_OFFER_EXPN, features) ||
3151                             !bitset(SRV_OFFER_VERB, features))
3152                         {
3153                                 /* this would give out the same info */
3154                                 message("502 5.7.0 Verbose unavailable");
3155                                 break;
3156                         }
3157                         STOP_IF_ATTACK(checksmtpattack(&n_noop, MaxNOOPCommands,
3158                                                         true, "VERB", e));
3159                         Verbose = 1;
3160                         set_delivery_mode(SM_DELIVER, e);
3161                         message("250 2.0.0 Verbose mode");
3162                         break;
3163
3164 #if SMTPDEBUG
3165                   case CMDDBGQSHOW:     /* show queues */
3166                         (void) sm_io_fprintf(smioout, SM_TIME_DEFAULT,
3167                                              "Send Queue=");
3168                         printaddr(smioout, e->e_sendqueue, true);
3169                         break;
3170
3171                   case CMDDBGDEBUG:     /* set debug mode */
3172                         tTsetup(tTdvect, sizeof(tTdvect), "0-99.1");
3173                         tTflag(p);
3174                         message("200 2.0.0 Debug set");
3175                         break;
3176
3177 #else /* SMTPDEBUG */
3178                   case CMDDBGQSHOW:     /* show queues */
3179                   case CMDDBGDEBUG:     /* set debug mode */
3180 #endif /* SMTPDEBUG */
3181                   case CMDLOGBOGUS:     /* bogus command */
3182                         DELAY_CONN("Bogus");
3183                         if (LogLevel > 0)
3184                                 sm_syslog(LOG_CRIT, e->e_id,
3185                                           "\"%s\" command from %s (%.100s)",
3186                                           c->cmd_name, CurSmtpClient,
3187                                           anynet_ntoa(&RealHostAddr));
3188                         /* FALLTHROUGH */
3189
3190                   case CMDERROR:        /* unknown command */
3191 #if MAXBADCOMMANDS > 0
3192                         if (++n_badcmds > MAXBADCOMMANDS)
3193                         {
3194   stopattack:
3195                                 message("421 4.7.0 %s Too many bad commands; closing connection",
3196                                         MyHostName);
3197
3198                                 /* arrange to ignore any current send list */
3199                                 e->e_sendqueue = NULL;
3200                                 goto doquit;
3201                         }
3202 #endif /* MAXBADCOMMANDS > 0 */
3203
3204 #if MILTER && SMFI_VERSION > 2
3205                         if (smtp.sm_milterlist && smtp.sm_milterize &&
3206                             !bitset(EF_DISCARD, e->e_flags))
3207                         {
3208                                 char state;
3209                                 char *response;
3210
3211                                 if (MilterLogLevel > 9)
3212                                         sm_syslog(LOG_INFO, e->e_id,
3213                                                 "Sending \"%s\" to Milter", inp);
3214                                 response = milter_unknown(inp, e, &state);
3215                                 MILTER_REPLY("unknown");
3216                                 if (state == SMFIR_REPLYCODE ||
3217                                     state == SMFIR_REJECT ||
3218                                     state == SMFIR_TEMPFAIL ||
3219                                     state == SMFIR_SHUTDOWN)
3220                                 {
3221                                         /* MILTER_REPLY already gave an error */
3222                                         break;
3223                                 }
3224                         }
3225 #endif /* MILTER && SMFI_VERSION > 2 */
3226
3227                         usrerr("500 5.5.1 Command unrecognized: \"%s\"",
3228                                shortenstring(inp, MAXSHORTSTR));
3229                         break;
3230
3231                   case CMDUNIMPL:
3232                         DELAY_CONN("Unimpl");
3233                         usrerr("502 5.5.1 Command not implemented: \"%s\"",
3234                                shortenstring(inp, MAXSHORTSTR));
3235                         break;
3236
3237                   default:
3238                         DELAY_CONN("default");
3239                         errno = 0;
3240                         syserr("500 5.5.0 smtp: unknown code %d", c->cmd_code);
3241                         break;
3242                 }
3243 #if SASL
3244                 }
3245 #endif /* SASL */
3246             }
3247             SM_EXCEPT(exc, "[!F]*")
3248             {
3249                 /*
3250                 **  The only possible exception is "E:mta.quickabort".
3251                 **  There is nothing to do except fall through and loop.
3252                 */
3253             }
3254             SM_END_TRY
3255         }
3256 }
3257 /*
3258 **  SMTP_DATA -- implement the SMTP DATA command.
3259 **
3260 **      Parameters:
3261 **              smtp -- status of SMTP connection.
3262 **              e -- envelope.
3263 **
3264 **      Returns:
3265 **              true iff SMTP session can continue.
3266 **
3267 **      Side Effects:
3268 **              possibly sends message.
3269 */
3270
3271 static bool
3272 smtp_data(smtp, e)
3273         SMTP_T *smtp;
3274         ENVELOPE *e;
3275 {
3276 #if MILTER
3277         bool milteraccept;
3278 #endif /* MILTER */
3279         bool aborting;
3280         bool doublequeue;
3281         bool rv = true;
3282         ADDRESS *a;
3283         ENVELOPE *ee;
3284         char *id;
3285         char *oldid;
3286         unsigned int features;
3287         char buf[32];
3288
3289         SmtpPhase = "server DATA";
3290         if (!smtp->sm_gotmail)
3291         {
3292                 usrerr("503 5.0.0 Need MAIL command");
3293                 return true;
3294         }
3295         else if (smtp->sm_nrcpts <= 0)
3296         {
3297                 usrerr("503 5.0.0 Need RCPT (recipient)");
3298                 return true;
3299         }
3300         (void) sm_snprintf(buf, sizeof(buf), "%u", smtp->sm_nrcpts);
3301         if (rscheck("check_data", buf, NULL, e,
3302                     RSF_RMCOMM|RSF_UNSTRUCTURED|RSF_COUNT, 3, NULL,
3303                     e->e_id, NULL) != EX_OK)
3304                 return true;
3305
3306 #if MILTER && SMFI_VERSION > 3
3307         if (smtp->sm_milterlist && smtp->sm_milterize &&
3308             !bitset(EF_DISCARD, e->e_flags))
3309         {
3310                 char state;
3311                 char *response;
3312                 int savelogusrerrs = LogUsrErrs;
3313
3314                 response = milter_data_cmd(e, &state);
3315                 switch (state)
3316                 {
3317                   case SMFIR_REPLYCODE:
3318                         if (MilterLogLevel > 3)
3319                         {
3320                                 sm_syslog(LOG_INFO, e->e_id,
3321                                           "Milter: cmd=data, reject=%s",
3322                                           response);
3323                                 LogUsrErrs = false;
3324                         }
3325                         usrerr(response);
3326                         if (strncmp(response, "421 ", 4) == 0
3327                             || strncmp(response, "421-", 4) == 0)
3328                         {
3329                                 e->e_sendqueue = NULL;
3330                                 return false;
3331                         }
3332                         return true;
3333
3334                   case SMFIR_REJECT:
3335                         if (MilterLogLevel > 3)
3336                         {
3337                                 sm_syslog(LOG_INFO, e->e_id,
3338                                           "Milter: cmd=data, reject=550 5.7.1 Command rejected");
3339                                 LogUsrErrs = false;
3340                         }
3341                         usrerr("550 5.7.1 Command rejected");
3342                         return true;
3343
3344                   case SMFIR_DISCARD:
3345                         if (MilterLogLevel > 3)
3346                                 sm_syslog(LOG_INFO, e->e_id,
3347                                           "Milter: cmd=data, discard");
3348                         e->e_flags |= EF_DISCARD;
3349                         break;
3350
3351                   case SMFIR_TEMPFAIL:
3352                         if (MilterLogLevel > 3)
3353                         {
3354                                 sm_syslog(LOG_INFO, e->e_id,
3355                                           "Milter: cmd=data, reject=%s",
3356                                           MSG_TEMPFAIL);
3357                                 LogUsrErrs = false;
3358                         }
3359                         usrerr(MSG_TEMPFAIL);
3360                         return true;
3361
3362                   case SMFIR_SHUTDOWN:
3363                         if (MilterLogLevel > 3)
3364                         {
3365                                 sm_syslog(LOG_INFO, e->e_id,
3366                                           "Milter: cmd=data, reject=421 4.7.0 %s closing connection",
3367                                           MyHostName);
3368                                 LogUsrErrs = false;
3369                         }
3370                         usrerr("421 4.7.0 %s closing connection", MyHostName);
3371                         e->e_sendqueue = NULL;
3372                         return false;
3373                 }
3374                 LogUsrErrs = savelogusrerrs;
3375                 if (response != NULL)
3376                         sm_free(response); /* XXX */
3377         }
3378 #endif /* MILTER && SMFI_VERSION > 3 */
3379
3380         /* put back discard bit */
3381         if (smtp->sm_discard)
3382                 e->e_flags |= EF_DISCARD;
3383
3384         /* check to see if we need to re-expand aliases */
3385         /* also reset QS_BADADDR on already-diagnosted addrs */
3386         doublequeue = false;
3387         for (a = e->e_sendqueue; a != NULL; a = a->q_next)
3388         {
3389                 if (QS_IS_VERIFIED(a->q_state) &&
3390                     !bitset(EF_DISCARD, e->e_flags))
3391                 {
3392                         /* need to re-expand aliases */
3393                         doublequeue = true;
3394                 }
3395                 if (QS_IS_BADADDR(a->q_state))
3396                 {
3397                         /* make this "go away" */
3398                         a->q_state = QS_DONTSEND;
3399                 }
3400         }
3401
3402         /* collect the text of the message */
3403         SmtpPhase = "collect";
3404         buffer_errors();
3405
3406         collect(InChannel, true, NULL, e, true);
3407
3408         /* redefine message size */
3409         (void) sm_snprintf(buf, sizeof(buf), "%ld", e->e_msgsize);
3410         macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"), buf);
3411
3412         /* rscheck() will set Errors or EF_DISCARD if it trips */
3413         (void) rscheck("check_eom", buf, NULL, e, RSF_UNSTRUCTURED|RSF_COUNT,
3414                        3, NULL, e->e_id, NULL);
3415
3416 #if MILTER
3417         milteraccept = true;
3418         if (smtp->sm_milterlist && smtp->sm_milterize &&
3419             Errors <= 0 &&
3420             !bitset(EF_DISCARD, e->e_flags))
3421         {
3422                 char state;
3423                 char *response;
3424
3425                 response = milter_data(e, &state);
3426                 switch (state)
3427                 {
3428                   case SMFIR_REPLYCODE:
3429                         if (MilterLogLevel > 3)
3430                                 sm_syslog(LOG_INFO, e->e_id,
3431                                           "Milter: data, reject=%s",
3432                                           response);
3433                         milteraccept = false;
3434                         usrerr(response);
3435                         break;
3436
3437                   case SMFIR_REJECT:
3438                         milteraccept = false;
3439                         if (MilterLogLevel > 3)
3440                                 sm_syslog(LOG_INFO, e->e_id,
3441                                           "Milter: data, reject=554 5.7.1 Command rejected");
3442                         usrerr("554 5.7.1 Command rejected");
3443                         break;
3444
3445                   case SMFIR_DISCARD:
3446                         if (MilterLogLevel > 3)
3447                                 sm_syslog(LOG_INFO, e->e_id,
3448                                           "Milter: data, discard");
3449                         milteraccept = false;
3450                         e->e_flags |= EF_DISCARD;
3451                         break;
3452
3453                   case SMFIR_TEMPFAIL:
3454                         if (MilterLogLevel > 3)
3455                                 sm_syslog(LOG_INFO, e->e_id,
3456                                           "Milter: data, reject=%s",
3457                                           MSG_TEMPFAIL);
3458                         milteraccept = false;
3459                         usrerr(MSG_TEMPFAIL);
3460                         break;
3461
3462                   case SMFIR_SHUTDOWN:
3463                         if (MilterLogLevel > 3)
3464                                 sm_syslog(LOG_INFO, e->e_id,
3465                                           "Milter: data, reject=421 4.7.0 %s closing connection",
3466                                           MyHostName);
3467                         milteraccept = false;
3468                         usrerr("421 4.7.0 %s closing connection", MyHostName);
3469                         rv = false;
3470                         break;
3471                 }
3472                 if (response != NULL)
3473                         sm_free(response);
3474         }
3475
3476         /* Milter may have changed message size */
3477         (void) sm_snprintf(buf, sizeof(buf), "%ld", e->e_msgsize);
3478         macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"), buf);
3479
3480         /* abort message filters that didn't get the body & log msg is OK */
3481         if (smtp->sm_milterlist && smtp->sm_milterize)
3482         {
3483                 milter_abort(e);
3484                 if (milteraccept && MilterLogLevel > 9)
3485                         sm_syslog(LOG_INFO, e->e_id, "Milter accept: message");
3486         }
3487
3488         /*
3489         **  If SuperSafe is SAFE_REALLY_POSTMILTER, and we don't have milter or
3490         **  milter accepted message, sync it now
3491         **
3492         **  XXX This is almost a copy of the code in collect(): put it into
3493         **      a function that is called from both places?
3494         */
3495
3496         if (milteraccept && SuperSafe == SAFE_REALLY_POSTMILTER)
3497         {
3498                 int afd;
3499                 SM_FILE_T *volatile df;
3500                 char *dfname;
3501
3502                 df = e->e_dfp;
3503                 dfname = queuename(e, DATAFL_LETTER);
3504                 if (sm_io_setinfo(df, SM_BF_COMMIT, NULL) < 0
3505                     && errno != EINVAL)
3506                 {
3507                         int save_errno;
3508
3509                         save_errno = errno;
3510                         if (save_errno == EEXIST)
3511                         {
3512                                 struct stat st;
3513                                 int dfd;
3514
3515                                 if (stat(dfname, &st) < 0)
3516                                         st.st_size = -1;
3517                                 errno = EEXIST;
3518                                 syserr("@collect: bfcommit(%s): already on disk, size=%ld",
3519                                        dfname, (long) st.st_size);
3520                                 dfd = sm_io_getinfo(df, SM_IO_WHAT_FD, NULL);
3521                                 if (dfd >= 0)
3522                                         dumpfd(dfd, true, true);
3523                         }
3524                         errno = save_errno;
3525                         dferror(df, "bfcommit", e);
3526                         flush_errors(true);
3527                         finis(save_errno != EEXIST, true, ExitStat);
3528                 }
3529                 else if ((afd = sm_io_getinfo(df, SM_IO_WHAT_FD, NULL)) < 0)
3530                 {
3531                         dferror(df, "sm_io_getinfo", e);
3532                         flush_errors(true);
3533                         finis(true, true, ExitStat);
3534                         /* NOTREACHED */
3535                 }
3536                 else if (fsync(afd) < 0)
3537                 {
3538                         dferror(df, "fsync", e);
3539                         flush_errors(true);
3540                         finis(true, true, ExitStat);
3541                         /* NOTREACHED */
3542                 }
3543                 else if (sm_io_close(df, SM_TIME_DEFAULT) < 0)
3544                 {
3545                         dferror(df, "sm_io_close", e);
3546                         flush_errors(true);
3547                         finis(true, true, ExitStat);
3548                         /* NOTREACHED */
3549                 }
3550
3551                 /* Now reopen the df file */
3552                 e->e_dfp = sm_io_open(SmFtStdio, SM_TIME_DEFAULT, dfname,
3553                                         SM_IO_RDONLY, NULL);
3554                 if (e->e_dfp == NULL)
3555                 {
3556                         /* we haven't acked receipt yet, so just chuck this */
3557                         syserr("@Cannot reopen %s", dfname);
3558                         finis(true, true, ExitStat);
3559                         /* NOTREACHED */
3560                 }
3561         }
3562 #endif /* MILTER */
3563
3564         /* Check if quarantining stats should be updated */
3565         if (e->e_quarmsg != NULL)
3566                 markstats(e, NULL, STATS_QUARANTINE);
3567
3568         /*
3569         **  If a header/body check (header checks or milter)
3570         **  set EF_DISCARD, don't queueup the message --
3571         **  that would lose the EF_DISCARD bit and deliver
3572         **  the message.
3573         */
3574
3575         if (bitset(EF_DISCARD, e->e_flags))
3576                 doublequeue = false;
3577
3578         aborting = Errors > 0;
3579         if (!(aborting || bitset(EF_DISCARD, e->e_flags)) &&
3580             (QueueMode == QM_QUARANTINE || e->e_quarmsg == NULL) &&
3581             !split_by_recipient(e))
3582                 aborting = bitset(EF_FATALERRS, e->e_flags);
3583
3584         if (aborting)
3585         {
3586                 ADDRESS *q;
3587
3588                 /* Log who the mail would have gone to */
3589                 logundelrcpts(e, e->e_message, 8, false);
3590
3591                 /*
3592                 **  If something above refused the message, we still haven't
3593                 **  accepted responsibility for it.  Don't send DSNs.
3594                 */
3595
3596                 for (q = e->e_sendqueue; q != NULL; q = q->q_next)
3597                         q->q_flags &= ~Q_PINGFLAGS;
3598
3599                 flush_errors(true);
3600                 buffer_errors();
3601                 goto abortmessage;
3602         }
3603
3604         /* from now on, we have to operate silently */
3605         buffer_errors();
3606
3607 #if 0
3608         /*
3609         **  Clear message, it may contain an error from the SMTP dialogue.
3610         **  This error must not show up in the queue.
3611         **      Some error message should show up, e.g., alias database
3612         **      not available, but others shouldn't, e.g., from check_rcpt.
3613         */
3614
3615         e->e_message = NULL;
3616 #endif /* 0 */
3617
3618         /*
3619         **  Arrange to send to everyone.
3620         **      If sending to multiple people, mail back
3621         **              errors rather than reporting directly.
3622         **      In any case, don't mail back errors for
3623         **              anything that has happened up to
3624         **              now (the other end will do this).
3625         **      Truncate our transcript -- the mail has gotten
3626         **              to us successfully, and if we have
3627         **              to mail this back, it will be easier
3628         **              on the reader.
3629         **      Then send to everyone.
3630         **      Finally give a reply code.  If an error has
3631         **              already been given, don't mail a
3632         **              message back.
3633         **      We goose error returns by clearing error bit.
3634         */
3635
3636         SmtpPhase = "delivery";
3637         (void) sm_io_setinfo(e->e_xfp, SM_BF_TRUNCATE, NULL);
3638         id = e->e_id;
3639
3640 #if NAMED_BIND
3641         _res.retry = TimeOuts.res_retry[RES_TO_FIRST];
3642         _res.retrans = TimeOuts.res_retrans[RES_TO_FIRST];
3643 #endif /* NAMED_BIND */
3644
3645         for (ee = e; ee != NULL; ee = ee->e_sibling)
3646         {
3647                 /* make sure we actually do delivery */
3648                 ee->e_flags &= ~EF_CLRQUEUE;
3649
3650                 /* from now on, operate silently */
3651                 ee->e_errormode = EM_MAIL;
3652
3653                 if (doublequeue)
3654                 {
3655                         /* make sure it is in the queue */
3656                         queueup(ee, false, true);
3657                 }
3658                 else
3659                 {
3660                         int mode;
3661
3662                         /* send to all recipients */
3663                         mode = SM_DEFAULT;
3664 #if _FFR_DM_ONE
3665                         if (SM_DM_ONE == e->e_sendmode)
3666                         {
3667                                 if (NotFirstDelivery)
3668                                 {
3669                                         mode = SM_QUEUE;
3670                                         e->e_sendmode = SM_QUEUE;
3671                                 }
3672                                 else
3673                                 {
3674                                         mode = SM_FORK;
3675                                         NotFirstDelivery = true;
3676                                 }
3677                         }
3678 #endif /* _FFR_DM_ONE */
3679                         sendall(ee, mode);
3680                 }
3681                 ee->e_to = NULL;
3682         }
3683
3684         /* put back id for SMTP logging in putoutmsg() */
3685         oldid = CurEnv->e_id;
3686         CurEnv->e_id = id;
3687
3688         /* issue success message */
3689 #if _FFR_MSG_ACCEPT
3690         if (MessageAccept != NULL && *MessageAccept != '\0')
3691         {
3692                 char msg[MAXLINE];
3693
3694                 expand(MessageAccept, msg, sizeof(msg), e);
3695                 message("250 2.0.0 %s", msg);
3696         }
3697         else
3698 #endif /* _FFR_MSG_ACCEPT */
3699         message("250 2.0.0 %s Message accepted for delivery", id);
3700         CurEnv->e_id = oldid;
3701
3702         /* if we just queued, poke it */
3703         if (doublequeue)
3704         {
3705                 bool anything_to_send = false;
3706
3707                 sm_getla();
3708                 for (ee = e; ee != NULL; ee = ee->e_sibling)
3709                 {
3710                         if (WILL_BE_QUEUED(ee->e_sendmode))
3711                                 continue;
3712                         if (shouldqueue(ee->e_msgpriority, ee->e_ctime))
3713                         {
3714                                 ee->e_sendmode = SM_QUEUE;
3715                                 continue;
3716                         }
3717                         else if (QueueMode != QM_QUARANTINE &&
3718                                  ee->e_quarmsg != NULL)
3719                         {
3720                                 ee->e_sendmode = SM_QUEUE;
3721                                 continue;
3722                         }
3723                         anything_to_send = true;
3724
3725                         /* close all the queue files */
3726                         closexscript(ee);
3727                         if (ee->e_dfp != NULL)
3728                         {
3729                                 (void) sm_io_close(ee->e_dfp, SM_TIME_DEFAULT);
3730                                 ee->e_dfp = NULL;
3731                         }
3732                         unlockqueue(ee);
3733                 }
3734                 if (anything_to_send)
3735                 {
3736 #if PIPELINING
3737                         /*
3738                         **  XXX if we don't do this, we get 250 twice
3739                         **      because it is also flushed in the child.
3740                         */
3741
3742                         (void) sm_io_flush(OutChannel, SM_TIME_DEFAULT);
3743 #endif /* PIPELINING */
3744                         (void) doworklist(e, true, true);
3745                 }
3746         }
3747
3748   abortmessage:
3749         if (LogLevel > 4 && bitset(EF_LOGSENDER, e->e_flags))
3750                 logsender(e, NULL);
3751         e->e_flags &= ~EF_LOGSENDER;
3752
3753         /* clean up a bit */
3754         smtp->sm_gotmail = false;
3755
3756         /*
3757         **  Call dropenvelope if and only if the envelope is *not*
3758         **  being processed by the child process forked by doworklist().
3759         */
3760
3761         if (aborting || bitset(EF_DISCARD, e->e_flags))
3762                 dropenvelope(e, true, false);
3763         else
3764         {
3765                 for (ee = e; ee != NULL; ee = ee->e_sibling)
3766                 {
3767                         if (!doublequeue &&
3768                             QueueMode != QM_QUARANTINE &&
3769                             ee->e_quarmsg != NULL)
3770                         {
3771                                 dropenvelope(ee, true, false);
3772                                 continue;
3773                         }
3774                         if (WILL_BE_QUEUED(ee->e_sendmode))
3775                                 dropenvelope(ee, true, false);
3776                 }
3777         }
3778         sm_rpool_free(e->e_rpool);
3779
3780         /*
3781         **  At this point, e == &MainEnvelope, but if we did splitting,
3782         **  then CurEnv may point to an envelope structure that was just
3783         **  freed with the rpool.  So reset CurEnv *before* calling
3784         **  newenvelope.
3785         */
3786
3787         CurEnv = e;
3788         features = e->e_features;
3789         newenvelope(e, e, sm_rpool_new_x(NULL));
3790         e->e_flags = BlankEnvelope.e_flags;
3791         e->e_features = features;
3792
3793         /* restore connection quarantining */
3794         if (smtp->sm_quarmsg == NULL)
3795         {
3796                 e->e_quarmsg = NULL;
3797                 macdefine(&e->e_macro, A_PERM, macid("{quarantine}"), "");
3798         }
3799         else
3800         {
3801                 e->e_quarmsg = sm_rpool_strdup_x(e->e_rpool, smtp->sm_quarmsg);
3802                 macdefine(&e->e_macro, A_PERM,
3803                           macid("{quarantine}"), e->e_quarmsg);
3804         }
3805         return rv;
3806 }
3807 /*
3808 **  LOGUNDELRCPTS -- log undelivered (or all) recipients.
3809 **
3810 **      Parameters:
3811 **              e -- envelope.
3812 **              msg -- message for Stat=
3813 **              level -- log level.
3814 **              all -- log all recipients.
3815 **
3816 **      Returns:
3817 **              none.
3818 **
3819 **      Side Effects:
3820 **              logs undelivered (or all) recipients
3821 */
3822
3823 void
3824 logundelrcpts(e, msg, level, all)
3825         ENVELOPE *e;
3826         char *msg;
3827         int level;
3828         bool all;
3829 {
3830         ADDRESS *a;
3831
3832         if (LogLevel <= level || msg == NULL || *msg == '\0')
3833                 return;
3834
3835         /* Clear $h so relay= doesn't get mislogged by logdelivery() */
3836         macdefine(&e->e_macro, A_PERM, 'h', NULL);
3837
3838         /* Log who the mail would have gone to */
3839         for (a = e->e_sendqueue; a != NULL; a = a->q_next)
3840         {
3841                 if (!QS_IS_UNDELIVERED(a->q_state) && !all)
3842                         continue;
3843                 e->e_to = a->q_paddr;
3844                 logdelivery(NULL, NULL, a->q_status, msg, NULL,
3845                             (time_t) 0, e);
3846         }
3847         e->e_to = NULL;
3848 }
3849 /*
3850 **  CHECKSMTPATTACK -- check for denial-of-service attack by repetition
3851 **
3852 **      Parameters:
3853 **              pcounter -- pointer to a counter for this command.
3854 **              maxcount -- maximum value for this counter before we
3855 **                      slow down.
3856 **              waitnow -- sleep now (in this routine)?
3857 **              cname -- command name for logging.
3858 **              e -- the current envelope.
3859 **
3860 **      Returns:
3861 **              time to wait,
3862 **              STOP_ATTACK if twice as many commands as allowed and
3863 **                      MaxChildren > 0.
3864 **
3865 **      Side Effects:
3866 **              Slows down if we seem to be under attack.
3867 */
3868
3869 static time_t
3870 checksmtpattack(pcounter, maxcount, waitnow, cname, e)
3871         volatile unsigned int *pcounter;
3872         unsigned int maxcount;
3873         bool waitnow;
3874         char *cname;
3875         ENVELOPE *e;
3876 {
3877         if (maxcount <= 0)      /* no limit */
3878                 return (time_t) 0;
3879
3880         if (++(*pcounter) >= maxcount)
3881         {
3882                 unsigned int shift;
3883                 time_t s;
3884
3885                 if (*pcounter == maxcount && LogLevel > 5)
3886                 {
3887                         sm_syslog(LOG_INFO, e->e_id,
3888                                   "%s: possible SMTP attack: command=%.40s, count=%u",
3889                                   CurSmtpClient, cname, *pcounter);
3890                 }
3891                 shift = *pcounter - maxcount;
3892                 s = 1 << shift;
3893                 if (shift > MAXSHIFT || s >= MAXTIMEOUT || s <= 0)
3894                         s = MAXTIMEOUT;
3895
3896 #define IS_ATTACK(s)    ((MaxChildren > 0 && *pcounter >= maxcount * 2) \
3897                                 ? STOP_ATTACK : (time_t) s)
3898
3899                 /* sleep at least 1 second before returning */
3900                 (void) sleep(*pcounter / maxcount);
3901                 s -= *pcounter / maxcount;
3902                 if (s >= MAXTIMEOUT || s < 0)
3903                         s = MAXTIMEOUT;
3904                 if (waitnow && s > 0)
3905                 {
3906                         (void) sleep(s);
3907                         return IS_ATTACK(0);
3908                 }
3909                 return IS_ATTACK(s);
3910         }
3911         return (time_t) 0;
3912 }
3913 /*
3914 **  SETUP_SMTPD_IO -- setup I/O fd correctly for the SMTP server
3915 **
3916 **      Parameters:
3917 **              none.
3918 **
3919 **      Returns:
3920 **              nothing.
3921 **
3922 **      Side Effects:
3923 **              may change I/O fd.
3924 */
3925
3926 static void
3927 setup_smtpd_io()
3928 {
3929         int inchfd, outchfd, outfd;
3930
3931         inchfd = sm_io_getinfo(InChannel, SM_IO_WHAT_FD, NULL);
3932         outchfd  = sm_io_getinfo(OutChannel, SM_IO_WHAT_FD, NULL);
3933         outfd = sm_io_getinfo(smioout, SM_IO_WHAT_FD, NULL);
3934         if (outchfd != outfd)
3935         {
3936                 /* arrange for debugging output to go to remote host */
3937                 (void) dup2(outchfd, outfd);
3938         }
3939
3940         /*
3941         **  if InChannel and OutChannel are stdin/stdout
3942         **  and connected to ttys
3943         **  and fcntl(STDIN, F_SETFL, O_NONBLOCKING) also changes STDOUT,
3944         **  then "chain" them together.
3945         */
3946
3947         if (inchfd == STDIN_FILENO && outchfd == STDOUT_FILENO &&
3948             isatty(inchfd) && isatty(outchfd))
3949         {
3950                 int inmode, outmode;
3951
3952                 inmode = fcntl(inchfd, F_GETFL, 0);
3953                 if (inmode == -1)
3954                 {
3955                         if (LogLevel > 11)
3956                                 sm_syslog(LOG_INFO, NOQID,
3957                                         "fcntl(inchfd, F_GETFL) failed: %s",
3958                                         sm_errstring(errno));
3959                         return;
3960                 }
3961                 outmode = fcntl(outchfd, F_GETFL, 0);
3962                 if (outmode == -1)
3963                 {
3964                         if (LogLevel > 11)
3965                                 sm_syslog(LOG_INFO, NOQID,
3966                                         "fcntl(outchfd, F_GETFL) failed: %s",
3967                                         sm_errstring(errno));
3968                         return;
3969                 }
3970                 if (bitset(O_NONBLOCK, inmode) ||
3971                     bitset(O_NONBLOCK, outmode) ||
3972                     fcntl(inchfd, F_SETFL, inmode | O_NONBLOCK) == -1)
3973                         return;
3974                 outmode = fcntl(outchfd, F_GETFL, 0);
3975                 if (outmode != -1 && bitset(O_NONBLOCK, outmode))
3976                 {
3977                         /* changing InChannel also changes OutChannel */
3978                         sm_io_automode(OutChannel, InChannel);
3979                         if (tTd(97, 4) && LogLevel > 9)
3980                                 sm_syslog(LOG_INFO, NOQID,
3981                                           "set automode for I (%d)/O (%d) in SMTP server",
3982                                           inchfd, outchfd);
3983                 }
3984
3985                 /* undo change of inchfd */
3986                 (void) fcntl(inchfd, F_SETFL, inmode);
3987         }
3988 }
3989 /*
3990 **  SKIPWORD -- skip a fixed word.
3991 **
3992 **      Parameters:
3993 **              p -- place to start looking.
3994 **              w -- word to skip.
3995 **
3996 **      Returns:
3997 **              p following w.
3998 **              NULL on error.
3999 **
4000 **      Side Effects:
4001 **              clobbers the p data area.
4002 */
4003
4004 static char *
4005 skipword(p, w)
4006         register char *volatile p;
4007         char *w;
4008 {
4009         register char *q;
4010         char *firstp = p;
4011
4012         /* find beginning of word */
4013         SKIP_SPACE(p);
4014         q = p;
4015
4016         /* find end of word */
4017         while (*p != '\0' && *p != ':' && !(isascii(*p) && isspace(*p)))
4018                 p++;
4019         while (isascii(*p) && isspace(*p))
4020                 *p++ = '\0';
4021         if (*p != ':')
4022         {
4023           syntax:
4024                 usrerr("501 5.5.2 Syntax error in parameters scanning \"%s\"",
4025                         shortenstring(firstp, MAXSHORTSTR));
4026                 return NULL;
4027         }
4028         *p++ = '\0';
4029         SKIP_SPACE(p);
4030
4031         if (*p == '\0')
4032                 goto syntax;
4033
4034         /* see if the input word matches desired word */
4035         if (sm_strcasecmp(q, w))
4036                 goto syntax;
4037
4038         return p;
4039 }
4040
4041 /*
4042 **  RESET_MAIL_ESMTP_ARGS -- process ESMTP arguments from MAIL line
4043 **
4044 **      Parameters:
4045 **              e -- the envelope.
4046 **
4047 **      Returns:
4048 **              none.
4049 */
4050
4051 void
4052 reset_mail_esmtp_args(e)
4053         ENVELOPE *e;
4054 {
4055         /* "size": no reset */
4056
4057         /* "body" */
4058         SevenBitInput = SevenBitInput_Saved;
4059         e->e_bodytype = NULL;
4060
4061         /* "envid" */
4062         e->e_envid = NULL;
4063         macdefine(&e->e_macro, A_PERM, macid("{dsn_envid}"), NULL);
4064
4065         /* "ret" */
4066         e->e_flags &= ~(EF_RET_PARAM|EF_NO_BODY_RETN);
4067         macdefine(&e->e_macro, A_TEMP, macid("{dsn_ret}"), NULL);
4068
4069 #if SASL
4070         /* "auth" */
4071         macdefine(&e->e_macro, A_TEMP, macid("{auth_author}"), NULL);
4072         e->e_auth_param = "";
4073 # if _FFR_AUTH_PASSING
4074         macdefine(&BlankEnvelope.e_macro, A_PERM,
4075                                   macid("{auth_author}"), NULL);
4076 # endif /* _FFR_AUTH_PASSING */
4077 #endif /* SASL */
4078
4079         /* "by" */
4080         e->e_deliver_by = 0;
4081         e->e_dlvr_flag = 0;
4082 }
4083
4084 /*
4085 **  MAIL_ESMTP_ARGS -- process ESMTP arguments from MAIL line
4086 **
4087 **      Parameters:
4088 **              a -- address (unused, for compatibility with rcpt_esmtp_args)
4089 **              kp -- the parameter key.
4090 **              vp -- the value of that parameter.
4091 **              e -- the envelope.
4092 **
4093 **      Returns:
4094 **              none.
4095 */
4096
4097 void
4098 mail_esmtp_args(a, kp, vp, e)
4099         ADDRESS *a;
4100         char *kp;
4101         char *vp;
4102         ENVELOPE *e;
4103 {
4104         if (sm_strcasecmp(kp, "size") == 0)
4105         {
4106                 if (vp == NULL)
4107                 {
4108                         usrerr("501 5.5.2 SIZE requires a value");
4109                         /* NOTREACHED */
4110                 }
4111                 macdefine(&e->e_macro, A_TEMP, macid("{msg_size}"), vp);
4112                 errno = 0;
4113                 e->e_msgsize = strtol(vp, (char **) NULL, 10);
4114                 if (e->e_msgsize == LONG_MAX && errno == ERANGE)
4115                 {
4116                         usrerr("552 5.2.3 Message size exceeds maximum value");
4117                         /* NOTREACHED */
4118                 }
4119                 if (e->e_msgsize < 0)
4120                 {
4121                         usrerr("552 5.2.3 Message size invalid");
4122                         /* NOTREACHED */
4123                 }
4124         }
4125         else if (sm_strcasecmp(kp, "body") == 0)
4126         {
4127                 if (vp == NULL)
4128                 {
4129                         usrerr("501 5.5.2 BODY requires a value");
4130                         /* NOTREACHED */
4131                 }
4132                 else if (sm_strcasecmp(vp, "8bitmime") == 0)
4133                 {
4134                         SevenBitInput = false;
4135                 }
4136                 else if (sm_strcasecmp(vp, "7bit") == 0)
4137                 {
4138                         SevenBitInput = true;
4139                 }
4140                 else
4141                 {
4142                         usrerr("501 5.5.4 Unknown BODY type %s", vp);
4143                         /* NOTREACHED */
4144                 }
4145                 e->e_bodytype = sm_rpool_strdup_x(e->e_rpool, vp);
4146         }
4147         else if (sm_strcasecmp(kp, "envid") == 0)
4148         {
4149                 if (!bitset(SRV_OFFER_DSN, e->e_features))
4150                 {
4151                         usrerr("504 5.7.0 Sorry, ENVID not supported, we do not allow DSN");
4152                         /* NOTREACHED */
4153                 }
4154                 if (vp == NULL)
4155                 {
4156                         usrerr("501 5.5.2 ENVID requires a value");
4157                         /* NOTREACHED */
4158                 }
4159                 if (!xtextok(vp))
4160                 {
4161                         usrerr("501 5.5.4 Syntax error in ENVID parameter value");
4162                         /* NOTREACHED */
4163                 }
4164                 if (e->e_envid != NULL)
4165                 {
4166                         usrerr("501 5.5.0 Duplicate ENVID parameter");
4167                         /* NOTREACHED */
4168                 }
4169                 e->e_envid = sm_rpool_strdup_x(e->e_rpool, vp);
4170                 macdefine(&e->e_macro, A_PERM,
4171                         macid("{dsn_envid}"), e->e_envid);
4172         }
4173         else if (sm_strcasecmp(kp, "ret") == 0)
4174         {
4175                 if (!bitset(SRV_OFFER_DSN, e->e_features))
4176                 {
4177                         usrerr("504 5.7.0 Sorry, RET not supported, we do not allow DSN");
4178                         /* NOTREACHED */
4179                 }
4180                 if (vp == NULL)
4181                 {
4182                         usrerr("501 5.5.2 RET requires a value");
4183                         /* NOTREACHED */
4184                 }
4185                 if (bitset(EF_RET_PARAM, e->e_flags))
4186                 {
4187                         usrerr("501 5.5.0 Duplicate RET parameter");
4188                         /* NOTREACHED */
4189                 }
4190                 e->e_flags |= EF_RET_PARAM;
4191                 if (sm_strcasecmp(vp, "hdrs") == 0)
4192                         e->e_flags |= EF_NO_BODY_RETN;
4193                 else if (sm_strcasecmp(vp, "full") != 0)
4194                 {
4195                         usrerr("501 5.5.2 Bad argument \"%s\" to RET", vp);
4196                         /* NOTREACHED */
4197                 }
4198                 macdefine(&e->e_macro, A_TEMP, macid("{dsn_ret}"), vp);
4199         }
4200 #if SASL
4201         else if (sm_strcasecmp(kp, "auth") == 0)
4202         {
4203                 int len;
4204                 char *q;
4205                 char *auth_param;       /* the value of the AUTH=x */
4206                 bool saveQuickAbort = QuickAbort;
4207                 bool saveSuprErrs = SuprErrs;
4208                 bool saveExitStat = ExitStat;
4209
4210                 if (vp == NULL)
4211                 {
4212                         usrerr("501 5.5.2 AUTH= requires a value");
4213                         /* NOTREACHED */
4214                 }
4215                 if (e->e_auth_param != NULL)
4216                 {
4217                         usrerr("501 5.5.0 Duplicate AUTH parameter");
4218                         /* NOTREACHED */
4219                 }
4220                 if ((q = strchr(vp, ' ')) != NULL)
4221                         len = q - vp + 1;
4222                 else
4223                         len = strlen(vp) + 1;
4224                 auth_param = xalloc(len);
4225                 (void) sm_strlcpy(auth_param, vp, len);
4226                 if (!xtextok(auth_param))
4227                 {
4228                         usrerr("501 5.5.4 Syntax error in AUTH parameter value");
4229                         /* just a warning? */
4230                         /* NOTREACHED */
4231                 }
4232
4233                 /* XXX define this always or only if trusted? */
4234                 macdefine(&e->e_macro, A_TEMP, macid("{auth_author}"),
4235                           auth_param);
4236
4237                 /*
4238                 **  call Strust_auth to find out whether
4239                 **  auth_param is acceptable (trusted)
4240                 **  we shouldn't trust it if not authenticated
4241                 **  (required by RFC, leave it to ruleset?)
4242                 */
4243
4244                 SuprErrs = true;
4245                 QuickAbort = false;
4246                 if (strcmp(auth_param, "<>") != 0 &&
4247                      (rscheck("trust_auth", auth_param, NULL, e, RSF_RMCOMM,
4248                               9, NULL, NOQID, NULL) != EX_OK || Errors > 0))
4249                 {
4250                         if (tTd(95, 8))
4251                         {
4252                                 q = e->e_auth_param;
4253                                 sm_dprintf("auth=\"%.100s\" not trusted user=\"%.100s\"\n",
4254                                         auth_param, (q == NULL) ? "" : q);
4255                         }
4256
4257                         /* not trusted */
4258                         e->e_auth_param = "<>";
4259 # if _FFR_AUTH_PASSING
4260                         macdefine(&BlankEnvelope.e_macro, A_PERM,
4261                                   macid("{auth_author}"), NULL);
4262 # endif /* _FFR_AUTH_PASSING */
4263                 }
4264                 else
4265                 {
4266                         if (tTd(95, 8))
4267                                 sm_dprintf("auth=\"%.100s\" trusted\n", auth_param);
4268                         e->e_auth_param = sm_rpool_strdup_x(e->e_rpool,
4269                                                             auth_param);
4270                 }
4271                 sm_free(auth_param); /* XXX */
4272
4273                 /* reset values */
4274                 Errors = 0;
4275                 QuickAbort = saveQuickAbort;
4276                 SuprErrs = saveSuprErrs;
4277                 ExitStat = saveExitStat;
4278         }
4279 #endif /* SASL */
4280 #define PRTCHAR(c)      ((isascii(c) && isprint(c)) ? (c) : '?')
4281
4282         /*
4283         **  "by" is only accepted if DeliverByMin >= 0.
4284         **  We maybe could add this to the list of server_features.
4285         */
4286
4287         else if (sm_strcasecmp(kp, "by") == 0 && DeliverByMin >= 0)
4288         {
4289                 char *s;
4290
4291                 if (vp == NULL)
4292                 {
4293                         usrerr("501 5.5.2 BY= requires a value");
4294                         /* NOTREACHED */
4295                 }
4296                 errno = 0;
4297                 e->e_deliver_by = strtol(vp, &s, 10);
4298                 if (e->e_deliver_by == LONG_MIN ||
4299                     e->e_deliver_by == LONG_MAX ||
4300                     e->e_deliver_by > 999999999l ||
4301                     e->e_deliver_by < -999999999l)
4302                 {
4303                         usrerr("501 5.5.2 BY=%s out of range", vp);
4304                         /* NOTREACHED */
4305                 }
4306                 if (s == NULL || *s != ';')
4307                 {
4308                         usrerr("501 5.5.2 BY= missing ';'");
4309                         /* NOTREACHED */
4310                 }
4311                 e->e_dlvr_flag = 0;
4312                 ++s;    /* XXX: spaces allowed? */
4313                 SKIP_SPACE(s);
4314                 switch (tolower(*s))
4315                 {
4316                   case 'n':
4317                         e->e_dlvr_flag = DLVR_NOTIFY;
4318                         break;
4319                   case 'r':
4320                         e->e_dlvr_flag = DLVR_RETURN;
4321                         if (e->e_deliver_by <= 0)
4322                         {
4323                                 usrerr("501 5.5.4 mode R requires BY time > 0");
4324                                 /* NOTREACHED */
4325                         }
4326                         if (DeliverByMin > 0 && e->e_deliver_by > 0 &&
4327                             e->e_deliver_by < DeliverByMin)
4328                         {
4329                                 usrerr("555 5.5.2 time %ld less than %ld",
4330                                         e->e_deliver_by, (long) DeliverByMin);
4331                                 /* NOTREACHED */
4332                         }
4333                         break;
4334                   default:
4335                         usrerr("501 5.5.2 illegal by-mode '%c'", PRTCHAR(*s));
4336                         /* NOTREACHED */
4337                 }
4338                 ++s;    /* XXX: spaces allowed? */
4339                 SKIP_SPACE(s);
4340                 switch (tolower(*s))
4341                 {
4342                   case 't':
4343                         e->e_dlvr_flag |= DLVR_TRACE;
4344                         break;
4345                   case '\0':
4346                         break;
4347                   default:
4348                         usrerr("501 5.5.2 illegal by-trace '%c'", PRTCHAR(*s));
4349                         /* NOTREACHED */
4350                 }
4351
4352                 /* XXX: check whether more characters follow? */
4353         }
4354         else
4355         {
4356                 usrerr("555 5.5.4 %s parameter unrecognized", kp);
4357                 /* NOTREACHED */
4358         }
4359 }
4360
4361 /*
4362 **  RCPT_ESMTP_ARGS -- process ESMTP arguments from RCPT line
4363 **
4364 **      Parameters:
4365 **              a -- the address corresponding to the To: parameter.
4366 **              kp -- the parameter key.
4367 **              vp -- the value of that parameter.
4368 **              e -- the envelope.
4369 **
4370 **      Returns:
4371 **              none.
4372 */
4373
4374 void
4375 rcpt_esmtp_args(a, kp, vp, e)
4376         ADDRESS *a;
4377         char *kp;
4378         char *vp;
4379         ENVELOPE *e;
4380 {
4381         if (sm_strcasecmp(kp, "notify") == 0)
4382         {
4383                 char *p;
4384
4385                 if (!bitset(SRV_OFFER_DSN, e->e_features))
4386                 {
4387                         usrerr("504 5.7.0 Sorry, NOTIFY not supported, we do not allow DSN");
4388                         /* NOTREACHED */
4389                 }
4390                 if (vp == NULL)
4391                 {
4392                         usrerr("501 5.5.2 NOTIFY requires a value");
4393                         /* NOTREACHED */
4394                 }
4395                 a->q_flags &= ~(QPINGONSUCCESS|QPINGONFAILURE|QPINGONDELAY);
4396                 a->q_flags |= QHASNOTIFY;
4397                 macdefine(&e->e_macro, A_TEMP, macid("{dsn_notify}"), vp);
4398
4399                 if (sm_strcasecmp(vp, "never") == 0)
4400                         return;
4401                 for (p = vp; p != NULL; vp = p)
4402                 {
4403                         char *s;
4404
4405                         s = p = strchr(p, ',');
4406                         if (p != NULL)
4407                                 *p++ = '\0';
4408                         if (sm_strcasecmp(vp, "success") == 0)
4409                                 a->q_flags |= QPINGONSUCCESS;
4410                         else if (sm_strcasecmp(vp, "failure") == 0)
4411                                 a->q_flags |= QPINGONFAILURE;
4412                         else if (sm_strcasecmp(vp, "delay") == 0)
4413                                 a->q_flags |= QPINGONDELAY;
4414                         else
4415                         {
4416                                 usrerr("501 5.5.4 Bad argument \"%s\"  to NOTIFY",
4417                                         vp);
4418                                 /* NOTREACHED */
4419                         }
4420                         if (s != NULL)
4421                                 *s = ',';
4422                 }
4423         }
4424         else if (sm_strcasecmp(kp, "orcpt") == 0)
4425         {
4426                 if (!bitset(SRV_OFFER_DSN, e->e_features))
4427                 {
4428                         usrerr("504 5.7.0 Sorry, ORCPT not supported, we do not allow DSN");
4429                         /* NOTREACHED */
4430                 }
4431                 if (vp == NULL)
4432                 {
4433                         usrerr("501 5.5.2 ORCPT requires a value");
4434                         /* NOTREACHED */
4435                 }
4436                 if (strchr(vp, ';') == NULL || !xtextok(vp))
4437                 {
4438                         usrerr("501 5.5.4 Syntax error in ORCPT parameter value");
4439                         /* NOTREACHED */
4440                 }
4441                 if (a->q_orcpt != NULL)
4442                 {
4443                         usrerr("501 5.5.0 Duplicate ORCPT parameter");
4444                         /* NOTREACHED */
4445                 }
4446                 a->q_orcpt = sm_rpool_strdup_x(e->e_rpool, vp);
4447         }
4448         else
4449         {
4450                 usrerr("555 5.5.4 %s parameter unrecognized", kp);
4451                 /* NOTREACHED */
4452         }
4453 }
4454 /*
4455 **  PRINTVRFYADDR -- print an entry in the verify queue
4456 **
4457 **      Parameters:
4458 **              a -- the address to print.
4459 **              last -- set if this is the last one.
4460 **              vrfy -- set if this is a VRFY command.
4461 **
4462 **      Returns:
4463 **              none.
4464 **
4465 **      Side Effects:
4466 **              Prints the appropriate 250 codes.
4467 */
4468 #define OFFF    (3 + 1 + 5 + 1) /* offset in fmt: SMTP reply + enh. code */
4469
4470 static void
4471 printvrfyaddr(a, last, vrfy)
4472         register ADDRESS *a;
4473         bool last;
4474         bool vrfy;
4475 {
4476         char fmtbuf[30];
4477
4478         if (vrfy && a->q_mailer != NULL &&
4479             !bitnset(M_VRFY250, a->q_mailer->m_flags))
4480                 (void) sm_strlcpy(fmtbuf, "252", sizeof(fmtbuf));
4481         else
4482                 (void) sm_strlcpy(fmtbuf, "250", sizeof(fmtbuf));
4483         fmtbuf[3] = last ? ' ' : '-';
4484         (void) sm_strlcpy(&fmtbuf[4], "2.1.5 ", sizeof(fmtbuf) - 4);
4485         if (a->q_fullname == NULL)
4486         {
4487                 if ((a->q_mailer == NULL ||
4488                      a->q_mailer->m_addrtype == NULL ||
4489                      sm_strcasecmp(a->q_mailer->m_addrtype, "rfc822") == 0) &&
4490                     strchr(a->q_user, '@') == NULL)
4491                         (void) sm_strlcpy(&fmtbuf[OFFF], "<%s@%s>",
4492                                        sizeof(fmtbuf) - OFFF);
4493                 else
4494                         (void) sm_strlcpy(&fmtbuf[OFFF], "<%s>",
4495                                        sizeof(fmtbuf) - OFFF);
4496                 message(fmtbuf, a->q_user, MyHostName);
4497         }
4498         else
4499         {
4500                 if ((a->q_mailer == NULL ||
4501                      a->q_mailer->m_addrtype == NULL ||
4502                      sm_strcasecmp(a->q_mailer->m_addrtype, "rfc822") == 0) &&
4503                     strchr(a->q_user, '@') == NULL)
4504                         (void) sm_strlcpy(&fmtbuf[OFFF], "%s <%s@%s>",
4505                                        sizeof(fmtbuf) - OFFF);
4506                 else
4507                         (void) sm_strlcpy(&fmtbuf[OFFF], "%s <%s>",
4508                                        sizeof(fmtbuf) - OFFF);
4509                 message(fmtbuf, a->q_fullname, a->q_user, MyHostName);
4510         }
4511 }
4512
4513 #if SASL
4514 /*
4515 **  SASLMECHS -- get list of possible AUTH mechanisms
4516 **
4517 **      Parameters:
4518 **              conn -- SASL connection info.
4519 **              mechlist -- output parameter for list of mechanisms.
4520 **
4521 **      Returns:
4522 **              number of mechs.
4523 */
4524
4525 static int
4526 saslmechs(conn, mechlist)
4527         sasl_conn_t *conn;
4528         char **mechlist;
4529 {
4530         int len, num, result;
4531
4532         /* "user" is currently unused */
4533 # if SASL >= 20000
4534         result = sasl_listmech(conn, NULL,
4535                                "", " ", "", (const char **) mechlist,
4536                                (unsigned int *)&len, &num);
4537 # else /* SASL >= 20000 */
4538         result = sasl_listmech(conn, "user", /* XXX */
4539                                "", " ", "", mechlist,
4540                                (unsigned int *)&len, (unsigned int *)&num);
4541 # endif /* SASL >= 20000 */
4542         if (result != SASL_OK)
4543         {
4544                 if (LogLevel > 9)
4545                         sm_syslog(LOG_WARNING, NOQID,
4546                                   "AUTH error: listmech=%d, num=%d",
4547                                   result, num);
4548                 num = 0;
4549         }
4550         if (num > 0)
4551         {
4552                 if (LogLevel > 11)
4553                         sm_syslog(LOG_INFO, NOQID,
4554                                   "AUTH: available mech=%s, allowed mech=%s",
4555                                   *mechlist, AuthMechanisms);
4556                 *mechlist = intersect(AuthMechanisms, *mechlist, NULL);
4557         }
4558         else
4559         {
4560                 *mechlist = NULL;       /* be paranoid... */
4561                 if (result == SASL_OK && LogLevel > 9)
4562                         sm_syslog(LOG_WARNING, NOQID,
4563                                   "AUTH warning: no mechanisms");
4564         }
4565         return num;
4566 }
4567
4568 # if SASL >= 20000
4569 /*
4570 **  PROXY_POLICY -- define proxy policy for AUTH
4571 **
4572 **      Parameters:
4573 **              conn -- unused.
4574 **              context -- unused.
4575 **              requested_user -- authorization identity.
4576 **              rlen -- authorization identity length.
4577 **              auth_identity -- authentication identity.
4578 **              alen -- authentication identity length.
4579 **              def_realm -- default user realm.
4580 **              urlen -- user realm length.
4581 **              propctx -- unused.
4582 **
4583 **      Returns:
4584 **              ok?
4585 **
4586 **      Side Effects:
4587 **              sets {auth_authen} macro.
4588 */
4589
4590 int
4591 proxy_policy(conn, context, requested_user, rlen, auth_identity, alen,
4592              def_realm, urlen, propctx)
4593         sasl_conn_t *conn;
4594         void *context;
4595         const char *requested_user;
4596         unsigned rlen;
4597         const char *auth_identity;
4598         unsigned alen;
4599         const char *def_realm;
4600         unsigned urlen;
4601         struct propctx *propctx;
4602 {
4603         if (auth_identity == NULL)
4604                 return SASL_FAIL;
4605
4606         macdefine(&BlankEnvelope.e_macro, A_TEMP,
4607                   macid("{auth_authen}"), (char *) auth_identity);
4608
4609         return SASL_OK;
4610 }
4611 # else /* SASL >= 20000 */
4612
4613 /*
4614 **  PROXY_POLICY -- define proxy policy for AUTH
4615 **
4616 **      Parameters:
4617 **              context -- unused.
4618 **              auth_identity -- authentication identity.
4619 **              requested_user -- authorization identity.
4620 **              user -- allowed user (output).
4621 **              errstr -- possible error string (output).
4622 **
4623 **      Returns:
4624 **              ok?
4625 */
4626
4627 int
4628 proxy_policy(context, auth_identity, requested_user, user, errstr)
4629         void *context;
4630         const char *auth_identity;
4631         const char *requested_user;
4632         const char **user;
4633         const char **errstr;
4634 {
4635         if (user == NULL || auth_identity == NULL)
4636                 return SASL_FAIL;
4637         *user = newstr(auth_identity);
4638         return SASL_OK;
4639 }
4640 # endif /* SASL >= 20000 */
4641 #endif /* SASL */
4642
4643 #if STARTTLS
4644 /*
4645 **  INITSRVTLS -- initialize server side TLS
4646 **
4647 **      Parameters:
4648 **              tls_ok -- should tls initialization be done?
4649 **
4650 **      Returns:
4651 **              succeeded?
4652 **
4653 **      Side Effects:
4654 **              sets tls_ok_srv which is a static variable in this module.
4655 **              Do NOT remove assignments to it!
4656 */
4657
4658 bool
4659 initsrvtls(tls_ok)
4660         bool tls_ok;
4661 {
4662         if (!tls_ok)
4663                 return false;
4664
4665         /* do NOT remove assignment */
4666         tls_ok_srv = inittls(&srv_ctx, TLS_Srv_Opts, true, SrvCertFile,
4667                              SrvKeyFile, CACertPath, CACertFile, DHParams);
4668         return tls_ok_srv;
4669 }
4670 #endif /* STARTTLS */
4671 /*
4672 **  SRVFEATURES -- get features for SMTP server
4673 **
4674 **      Parameters:
4675 **              e -- envelope (should be session context).
4676 **              clientname -- name of client.
4677 **              features -- default features for this invocation.
4678 **
4679 **      Returns:
4680 **              server features.
4681 */
4682
4683 /* table with options: it uses just one character, how about strings? */
4684 static struct
4685 {
4686         char            srvf_opt;
4687         unsigned int    srvf_flag;
4688 } srv_feat_table[] =
4689 {
4690         { 'A',  SRV_OFFER_AUTH  },
4691         { 'B',  SRV_OFFER_VERB  },
4692         { 'C',  SRV_REQ_SEC     },
4693         { 'D',  SRV_OFFER_DSN   },
4694         { 'E',  SRV_OFFER_ETRN  },
4695         { 'L',  SRV_REQ_AUTH    },
4696 #if PIPELINING
4697 # if _FFR_NO_PIPE
4698         { 'N',  SRV_NO_PIPE     },
4699 # endif /* _FFR_NO_PIPE */
4700         { 'P',  SRV_OFFER_PIPE  },
4701 #endif /* PIPELINING */
4702         { 'R',  SRV_VRFY_CLT    },      /* same as V; not documented */
4703         { 'S',  SRV_OFFER_TLS   },
4704 /*      { 'T',  SRV_TMP_FAIL    },      */
4705         { 'V',  SRV_VRFY_CLT    },
4706         { 'X',  SRV_OFFER_EXPN  },
4707 /*      { 'Y',  SRV_OFFER_VRFY  },      */
4708         { '\0', SRV_NONE        }
4709 };
4710
4711 static unsigned int
4712 srvfeatures(e, clientname, features)
4713         ENVELOPE *e;
4714         char *clientname;
4715         unsigned int features;
4716 {
4717         int r, i, j;
4718         char **pvp, c, opt;
4719         char pvpbuf[PSBUFSIZE];
4720
4721         pvp = NULL;
4722         r = rscap("srv_features", clientname, "", e, &pvp, pvpbuf,
4723                   sizeof(pvpbuf));
4724         if (r != EX_OK)
4725                 return features;
4726         if (pvp == NULL || pvp[0] == NULL || (pvp[0][0] & 0377) != CANONNET)
4727                 return features;
4728         if (pvp[1] != NULL && sm_strncasecmp(pvp[1], "temp", 4) == 0)
4729                 return SRV_TMP_FAIL;
4730
4731         /*
4732         **  General rule (see sendmail.h, d_flags):
4733         **  lower case: required/offered, upper case: Not required/available
4734         **
4735         **  Since we can change some features per daemon, we have both
4736         **  cases here: turn on/off a feature.
4737         */
4738
4739         for (i = 1; pvp[i] != NULL; i++)
4740         {
4741                 c = pvp[i][0];
4742                 j = 0;
4743                 for (;;)
4744                 {
4745                         if ((opt = srv_feat_table[j].srvf_opt) == '\0')
4746                         {
4747                                 if (LogLevel > 9)
4748                                         sm_syslog(LOG_WARNING, e->e_id,
4749                                                   "srvfeatures: unknown feature %s",
4750                                                   pvp[i]);
4751                                 break;
4752                         }
4753                         if (c == opt)
4754                         {
4755                                 features &= ~(srv_feat_table[j].srvf_flag);
4756                                 break;
4757                         }
4758                         if (c == tolower(opt))
4759                         {
4760                                 features |= srv_feat_table[j].srvf_flag;
4761                                 break;
4762                         }
4763                         ++j;
4764                 }
4765         }
4766         return features;
4767 }
4768
4769 /*
4770 **  HELP -- implement the HELP command.
4771 **
4772 **      Parameters:
4773 **              topic -- the topic we want help for.
4774 **              e -- envelope.
4775 **
4776 **      Returns:
4777 **              none.
4778 **
4779 **      Side Effects:
4780 **              outputs the help file to message output.
4781 */
4782 #define HELPVSTR        "#vers  "
4783 #define HELPVERSION     2
4784
4785 void
4786 help(topic, e)
4787         char *topic;
4788         ENVELOPE *e;
4789 {
4790         register SM_FILE_T *hf;
4791         register char *p;
4792         int len;
4793         bool noinfo;
4794         bool first = true;
4795         long sff = SFF_OPENASROOT|SFF_REGONLY;
4796         char buf[MAXLINE];
4797         char inp[MAXLINE];
4798         static int foundvers = -1;
4799         extern char Version[];
4800
4801         if (DontLockReadFiles)
4802                 sff |= SFF_NOLOCK;
4803         if (!bitnset(DBS_HELPFILEINUNSAFEDIRPATH, DontBlameSendmail))
4804                 sff |= SFF_SAFEDIRPATH;
4805
4806         if (HelpFile == NULL ||
4807             (hf = safefopen(HelpFile, O_RDONLY, 0444, sff)) == NULL)
4808         {
4809                 /* no help */
4810                 errno = 0;
4811                 message("502 5.3.0 Sendmail %s -- HELP not implemented",
4812                         Version);
4813                 return;
4814         }
4815
4816         if (topic == NULL || *topic == '\0')
4817         {
4818                 topic = "smtp";
4819                 noinfo = false;
4820         }
4821         else
4822         {
4823                 makelower(topic);
4824                 noinfo = true;
4825         }
4826
4827         len = strlen(topic);
4828
4829         while (sm_io_fgets(hf, SM_TIME_DEFAULT, buf, sizeof(buf)) != NULL)
4830         {
4831                 if (buf[0] == '#')
4832                 {
4833                         if (foundvers < 0 &&
4834                             strncmp(buf, HELPVSTR, strlen(HELPVSTR)) == 0)
4835                         {
4836                                 int h;
4837
4838                                 if (sm_io_sscanf(buf + strlen(HELPVSTR), "%d",
4839                                                  &h) == 1)
4840                                         foundvers = h;
4841                         }
4842                         continue;
4843                 }
4844                 if (strncmp(buf, topic, len) == 0)
4845                 {
4846                         if (first)
4847                         {
4848                                 first = false;
4849
4850                                 /* print version if no/old vers# in file */
4851                                 if (foundvers < 2 && !noinfo)
4852                                         message("214-2.0.0 This is Sendmail version %s", Version);
4853                         }
4854                         p = strpbrk(buf, " \t");
4855                         if (p == NULL)
4856                                 p = buf + strlen(buf) - 1;
4857                         else
4858                                 p++;
4859                         fixcrlf(p, true);
4860                         if (foundvers >= 2)
4861                         {
4862                                 char *lbp;
4863                                 int lbs = sizeof(buf) - (p - buf);
4864
4865                                 lbp = translate_dollars(p, p, &lbs);
4866                                 expand(lbp, inp, sizeof(inp), e);
4867                                 if (p != lbp)
4868                                         sm_free(lbp);
4869                                 p = inp;
4870                         }
4871                         message("214-2.0.0 %s", p);
4872                         noinfo = false;
4873                 }
4874         }
4875
4876         if (noinfo)
4877                 message("504 5.3.0 HELP topic \"%.10s\" unknown", topic);
4878         else
4879                 message("214 2.0.0 End of HELP info");
4880
4881         if (foundvers != 0 && foundvers < HELPVERSION)
4882         {
4883                 if (LogLevel > 1)
4884                         sm_syslog(LOG_WARNING, e->e_id,
4885                                   "%s too old (require version %d)",
4886                                   HelpFile, HELPVERSION);
4887
4888                 /* avoid log next time */
4889                 foundvers = 0;
4890         }
4891
4892         (void) sm_io_close(hf, SM_TIME_DEFAULT);
4893 }
4894
4895 #if SASL
4896 /*
4897 **  RESET_SASLCONN -- reset SASL connection data
4898 **
4899 **      Parameters:
4900 **              conn -- SASL connection context
4901 **              hostname -- host name
4902 **              various connection data
4903 **
4904 **      Returns:
4905 **              SASL result
4906 */
4907
4908 static int
4909 reset_saslconn(sasl_conn_t **conn, char *hostname,
4910 # if SASL >= 20000
4911                char *remoteip, char *localip,
4912                char *auth_id, sasl_ssf_t * ext_ssf)
4913 # else /* SASL >= 20000 */
4914                struct sockaddr_in *saddr_r, struct sockaddr_in *saddr_l,
4915                sasl_external_properties_t * ext_ssf)
4916 # endif /* SASL >= 20000 */
4917 {
4918         int result;
4919
4920         sasl_dispose(conn);
4921 # if SASL >= 20000
4922         result = sasl_server_new("smtp", hostname, NULL, NULL, NULL,
4923                                  NULL, 0, conn);
4924 # elif SASL > 10505
4925         /* use empty realm: only works in SASL > 1.5.5 */
4926         result = sasl_server_new("smtp", hostname, "", NULL, 0, conn);
4927 # else /* SASL >= 20000 */
4928         /* use no realm -> realm is set to hostname by SASL lib */
4929         result = sasl_server_new("smtp", hostname, NULL, NULL, 0,
4930                                  conn);
4931 # endif /* SASL >= 20000 */
4932         if (result != SASL_OK)
4933                 return result;
4934
4935 # if SASL >= 20000
4936 #  if NETINET || NETINET6
4937         if (remoteip != NULL && *remoteip != '\0')
4938                 result = sasl_setprop(*conn, SASL_IPREMOTEPORT, remoteip);
4939         if (result != SASL_OK)
4940                 return result;
4941
4942         if (localip != NULL && *localip != '\0')
4943                 result = sasl_setprop(*conn, SASL_IPLOCALPORT, localip);
4944         if (result != SASL_OK)
4945                 return result;
4946 #  endif /* NETINET || NETINET6 */
4947
4948         result = sasl_setprop(*conn, SASL_SSF_EXTERNAL, ext_ssf);
4949         if (result != SASL_OK)
4950                 return result;
4951
4952         result = sasl_setprop(*conn, SASL_AUTH_EXTERNAL, auth_id);
4953         if (result != SASL_OK)
4954                 return result;
4955 # else /* SASL >= 20000 */
4956 #  if NETINET
4957         if (saddr_r != NULL)
4958                 result = sasl_setprop(*conn, SASL_IP_REMOTE, saddr_r);
4959         if (result != SASL_OK)
4960                 return result;
4961
4962         if (saddr_l != NULL)
4963                 result = sasl_setprop(*conn, SASL_IP_LOCAL, saddr_l);
4964         if (result != SASL_OK)
4965                 return result;
4966 #  endif /* NETINET */
4967
4968         result = sasl_setprop(*conn, SASL_SSF_EXTERNAL, ext_ssf);
4969         if (result != SASL_OK)
4970                 return result;
4971 # endif /* SASL >= 20000 */
4972         return SASL_OK;
4973 }
4974 #endif /* SASL */