diff options
Diffstat (limited to '')
| -rw-r--r-- | src/receive.c | 4528 |
1 files changed, 4528 insertions, 0 deletions
diff --git a/src/receive.c b/src/receive.c new file mode 100644 index 0000000..0a27c79 --- /dev/null +++ b/src/receive.c @@ -0,0 +1,4528 @@ +/************************************************* +* Exim - an Internet mail transport agent * +*************************************************/ + +/* Copyright (c) The Exim Maintainers 2020 - 2022 */ +/* Copyright (c) University of Cambridge 1995 - 2018 */ +/* See the file NOTICE for conditions of use and distribution. */ + +/* Code for receiving a message and setting up spool files. */ + +#include "exim.h" +#include <setjmp.h> + +#ifdef EXPERIMENTAL_DCC +extern int dcc_ok; +#endif + +#ifdef SUPPORT_DMARC +# include "dmarc.h" +#endif + +/************************************************* +* Local static variables * +*************************************************/ + +static int data_fd = -1; +static uschar *spool_name = US""; + +enum CH_STATE {LF_SEEN, MID_LINE, CR_SEEN}; + +#ifdef HAVE_LOCAL_SCAN +jmp_buf local_scan_env; /* error-handling context for local_scan */ +unsigned had_local_scan_crash; +unsigned had_local_scan_timeout; +#endif + + +/************************************************* +* Non-SMTP character reading functions * +*************************************************/ + +/* These are the default functions that are set up in the variables such as +receive_getc initially. They just call the standard functions, passing stdin as +the file. (When SMTP input is occurring, different functions are used by +changing the pointer variables.) */ + +uschar stdin_buf[4096]; +uschar * stdin_inptr = stdin_buf; +uschar * stdin_inend = stdin_buf; + +static BOOL +stdin_refill(void) +{ +size_t rc = fread(stdin_buf, 1, sizeof(stdin_buf), stdin); +if (rc <= 0) + { + if (had_data_timeout) + { + fprintf(stderr, "exim: timed out while reading - message abandoned\n"); + log_write(L_lost_incoming_connection, + LOG_MAIN, "timed out while reading local message"); + receive_bomb_out(US"data-timeout", NULL); /* Does not return */ + } + if (had_data_sigint) + { + if (filter_test == FTEST_NONE) + { + fprintf(stderr, "\nexim: %s received - message abandoned\n", + had_data_sigint == SIGTERM ? "SIGTERM" : "SIGINT"); + log_write(0, LOG_MAIN, "%s received while reading local message", + had_data_sigint == SIGTERM ? "SIGTERM" : "SIGINT"); + } + receive_bomb_out(US"signal-exit", NULL); /* Does not return */ + } + return FALSE; + } +stdin_inend = stdin_buf + rc; +stdin_inptr = stdin_buf; +return TRUE; +} + +int +stdin_getc(unsigned lim) +{ +if (stdin_inptr >= stdin_inend) + if (!stdin_refill()) + return EOF; +return *stdin_inptr++; +} + + +BOOL +stdin_hasc(void) +{ +return stdin_inptr < stdin_inend; +} + +int +stdin_ungetc(int c) +{ +if (stdin_inptr <= stdin_buf) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "buffer underflow in stdin_ungetc"); + +*--stdin_inptr = c; +return c; +} + +int +stdin_feof(void) +{ +return stdin_hasc() ? FALSE : feof(stdin); +} + +int +stdin_ferror(void) +{ +return ferror(stdin); +} + + + + +/************************************************* +* Check that a set sender is allowed * +*************************************************/ + +/* This function is called when a local caller sets an explicit sender address. +It checks whether this is permitted, which it is for trusted callers. +Otherwise, it must match the pattern(s) in untrusted_set_sender. + +Arguments: the proposed sender address +Returns: TRUE for a trusted caller + TRUE if the address has been set, untrusted_set_sender has been + set, and the address matches something in the list + FALSE otherwise +*/ + +BOOL +receive_check_set_sender(uschar *newsender) +{ +uschar *qnewsender; +if (f.trusted_caller) return TRUE; +if (!newsender || !untrusted_set_sender) return FALSE; +qnewsender = Ustrchr(newsender, '@') + ? newsender : string_sprintf("%s@%s", newsender, qualify_domain_sender); +return match_address_list_basic(qnewsender, CUSS &untrusted_set_sender, 0) == OK; +} + + + + +/************************************************* +* Read space info for a partition * +*************************************************/ + +/* This function is called by receive_check_fs() below, and also by string +expansion for variables such as $spool_space. The field names for the statvfs +structure are macros, because not all OS have F_FAVAIL and it seems tidier to +have macros for F_BAVAIL and F_FILES as well. Some kinds of file system do not +have inodes, and they return -1 for the number available. + +Later: It turns out that some file systems that do not have the concept of +inodes return 0 rather than -1. Such systems should also return 0 for the total +number of inodes, so we require that to be greater than zero before returning +an inode count. + +Arguments: + isspool TRUE for spool partition, FALSE for log partition + inodeptr address of int to receive inode count; -1 if there isn't one + +Returns: available on-root space, in kilobytes + -1 for log partition if there isn't one + +All values are -1 if the STATFS functions are not available. +*/ + +int_eximarith_t +receive_statvfs(BOOL isspool, int *inodeptr) +{ +#ifdef HAVE_STATFS +struct STATVFS statbuf; +struct stat dummy; +uschar *path; +uschar *name; +uschar buffer[1024]; + +/* The spool directory must always exist. */ + +if (isspool) + { + path = spool_directory; + name = US"spool"; + } + +/* Need to cut down the log file path to the directory, and to ignore any +appearance of "syslog" in it. */ + +else + { + int sep = ':'; /* Not variable - outside scripts use */ + const uschar *p = log_file_path; + name = US"log"; + + /* An empty log_file_path means "use the default". This is the same as an + empty item in a list. */ + + if (*p == 0) p = US":"; + /* should never be a tainted list */ + while ((path = string_nextinlist(&p, &sep, buffer, sizeof(buffer)))) + if (Ustrcmp(path, "syslog") != 0) + break; + + if (path == NULL) /* No log files */ + { + *inodeptr = -1; + return -1; + } + + /* An empty string means use the default, which is in the spool directory. + But don't just use the spool directory, as it is possible that the log + subdirectory has been symbolically linked elsewhere. */ + + if (path[0] == 0) + { + sprintf(CS buffer, CS"%s/log", CS spool_directory); + path = buffer; + } + else + { + uschar *cp; + if ((cp = Ustrrchr(path, '/')) != NULL) *cp = 0; + } + } + +/* We now have the path; do the business */ + +memset(&statbuf, 0, sizeof(statbuf)); + +if (STATVFS(CS path, &statbuf) != 0) + if (stat(CS path, &dummy) == -1 && errno == ENOENT) + { /* Can happen on first run after installation */ + *inodeptr = -1; + return -1; + } + else + { + log_write(0, LOG_MAIN|LOG_PANIC, "cannot accept message: failed to stat " + "%s directory %s: %s", name, path, strerror(errno)); + smtp_closedown(US"spool or log directory problem"); + exim_exit(EXIT_FAILURE); + } + +*inodeptr = (statbuf.F_FILES > 0)? statbuf.F_FAVAIL : -1; + +/* Disks are getting huge. Take care with computing the size in kilobytes. */ + +return (int_eximarith_t)(((double)statbuf.F_BAVAIL * (double)statbuf.F_FRSIZE)/1024.0); + +#else +/* Unable to find partition sizes in this environment. */ + +*inodeptr = -1; +return -1; +#endif +} + + + + +/************************************************* +* Check space on spool and log partitions * +*************************************************/ + +/* This function is called before accepting a message; if any thresholds are +set, it checks them. If a message_size is supplied, it checks that there is +enough space for that size plus the threshold - i.e. that the message won't +reduce the space to the threshold. Not all OS have statvfs(); for those that +don't, this function always returns TRUE. For some OS the old function and +struct name statfs is used; that is handled by a macro, defined in exim.h. + +Arguments: + msg_size the (estimated) size of an incoming message + +Returns: FALSE if there isn't enough space, or if the information cannot + be obtained + TRUE if no check was done or there is enough space +*/ + +BOOL +receive_check_fs(int msg_size) +{ +int_eximarith_t space; +int inodes; + +if (check_spool_space > 0 || msg_size > 0 || check_spool_inodes > 0) + { + space = receive_statvfs(TRUE, &inodes); + + DEBUG(D_receive) + debug_printf("spool directory space = " PR_EXIM_ARITH "K inodes = %d " + "check_space = " PR_EXIM_ARITH "K inodes = %d msg_size = %d\n", + space, inodes, check_spool_space, check_spool_inodes, msg_size); + + if ( space >= 0 && space + msg_size / 1024 < check_spool_space + || inodes >= 0 && inodes < check_spool_inodes) + { + log_write(0, LOG_MAIN, "spool directory space check failed: space=" + PR_EXIM_ARITH " inodes=%d", space, inodes); + return FALSE; + } + } + +if (check_log_space > 0 || check_log_inodes > 0) + { + space = receive_statvfs(FALSE, &inodes); + + DEBUG(D_receive) + debug_printf("log directory space = " PR_EXIM_ARITH "K inodes = %d " + "check_space = " PR_EXIM_ARITH "K inodes = %d\n", + space, inodes, check_log_space, check_log_inodes); + + if ( space >= 0 && space < check_log_space + || inodes >= 0 && inodes < check_log_inodes) + { + log_write(0, LOG_MAIN, "log directory space check failed: space=" PR_EXIM_ARITH + " inodes=%d", space, inodes); + return FALSE; + } + } + +return TRUE; +} + + + +/************************************************* +* Bomb out while reading a message * +*************************************************/ + +/* The common case of wanting to bomb out is if a SIGTERM or SIGINT is +received, or if there is a timeout. A rarer case might be if the log files are +screwed up and Exim can't open them to record a message's arrival. Handling +that case is done by setting a flag to cause the log functions to call this +function if there is an ultimate disaster. That is why it is globally +accessible. + +Arguments: + reason text reason to pass to the not-quit ACL + msg default SMTP response to give if in an SMTP session +Returns: it doesn't +*/ + +void +receive_bomb_out(uschar *reason, uschar *msg) +{ + static BOOL already_bombing_out; +/* The smtp_notquit_exit() below can call ACLs which can trigger recursive +timeouts, if someone has something slow in their quit ACL. Since the only +things we should be doing are to close down cleanly ASAP, on the second +pass we also close down stuff that might be opened again, before bypassing +the ACL call and exiting. */ + +/* If spool_name is set, it contains the name of the data file that is being +written. Unlink it before closing so that it cannot be picked up by a delivery +process. Ensure that any header file is also removed. */ + +if (spool_name[0] != '\0') + { + Uunlink(spool_name); + spool_name[Ustrlen(spool_name) - 1] = 'H'; + Uunlink(spool_name); + spool_name[0] = '\0'; + } + +/* Now close the file if it is open, either as a fd or a stream. */ + +if (spool_data_file) + { + (void)fclose(spool_data_file); + spool_data_file = NULL; + } +else if (data_fd >= 0) + { + (void)close(data_fd); + data_fd = -1; + } + +/* Attempt to close down an SMTP connection tidily. For non-batched SMTP, call +smtp_notquit_exit(), which runs the NOTQUIT ACL, if present, and handles the +SMTP response. */ + +if (!already_bombing_out) + { + already_bombing_out = TRUE; + if (smtp_input) + { + if (smtp_batched_input) + moan_smtp_batch(NULL, "421 %s - message abandoned", msg); /* No return */ + smtp_notquit_exit(reason, US"421", US"%s %s - closing connection.", + smtp_active_hostname, msg); + } + } + +/* Exit from the program (non-BSMTP cases) */ + +exim_exit(EXIT_FAILURE); +} + + +/************************************************* +* Data read timeout * +*************************************************/ + +/* Handler function for timeouts that occur while reading the data that +comprises a message. + +Argument: the signal number +Returns: nothing +*/ + +static void +data_timeout_handler(int sig) +{ +had_data_timeout = sig; +} + + + +#ifdef HAVE_LOCAL_SCAN +/************************************************* +* local_scan() timeout * +*************************************************/ + +/* Handler function for timeouts that occur while running a local_scan() +function. Posix recommends against calling longjmp() from a signal-handler, +but the GCC manual says you can so we will, and trust that it's better than +calling probably non-signal-safe funxtions during logging from within the +handler, even with other compilers. + +See also https://cwe.mitre.org/data/definitions/745.html which also lists +it as unsafe. + +This is all because we have no control over what might be written for a +local-scan function, so cannot sprinkle had-signal checks after each +call-site. At least with the default "do-nothing" function we won't +ever get here. + +Argument: the signal number +Returns: nothing +*/ + +static void +local_scan_timeout_handler(int sig) +{ +had_local_scan_timeout = sig; +siglongjmp(local_scan_env, 1); +} + + + +/************************************************* +* local_scan() crashed * +*************************************************/ + +/* Handler function for signals that occur while running a local_scan() +function. + +Argument: the signal number +Returns: nothing +*/ + +static void +local_scan_crash_handler(int sig) +{ +had_local_scan_crash = sig; +siglongjmp(local_scan_env, 1); +} + +#endif /*HAVE_LOCAL_SCAN*/ + + +/************************************************* +* SIGTERM or SIGINT received * +*************************************************/ + +/* Handler for SIGTERM or SIGINT signals that occur while reading the +data that comprises a message. + +Argument: the signal number +Returns: nothing +*/ + +static void +data_sigterm_sigint_handler(int sig) +{ +had_data_sigint = sig; +} + + + +/************************************************* +* Add new recipient to list * +*************************************************/ + +/* This function builds a list of recipient addresses in argc/argv +format. + +Arguments: + recipient the next address to add to recipients_list + pno parent number for fixed aliases; -1 otherwise + +Returns: nothing +*/ + +void +receive_add_recipient(uschar *recipient, int pno) +{ +if (recipients_count >= recipients_list_max) + { + recipient_item *oldlist = recipients_list; + int oldmax = recipients_list_max; + + const int safe_recipients_limit = INT_MAX / 2 / sizeof(recipient_item); + if (recipients_list_max < 0 || recipients_list_max >= safe_recipients_limit) + { + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Too many recipients: %d", recipients_list_max); + } + + recipients_list_max = recipients_list_max ? 2*recipients_list_max : 50; + recipients_list = store_get(recipients_list_max * sizeof(recipient_item), GET_UNTAINTED); + if (oldlist) + memcpy(recipients_list, oldlist, oldmax * sizeof(recipient_item)); + } + +recipients_list[recipients_count].address = recipient; +recipients_list[recipients_count].pno = pno; +#ifdef EXPERIMENTAL_BRIGHTMAIL +recipients_list[recipients_count].bmi_optin = bmi_current_optin; +/* reset optin string pointer for next recipient */ +bmi_current_optin = NULL; +#endif +recipients_list[recipients_count].orcpt = NULL; +recipients_list[recipients_count].dsn_flags = 0; +recipients_list[recipients_count++].errors_to = NULL; +} + + + + +/************************************************* +* Send user response message * +*************************************************/ + +/* This function is passed a default response code and a user message. It calls +smtp_message_code() to check and possibly modify the response code, and then +calls smtp_respond() to transmit the response. I put this into a function +just to avoid a lot of repetition. + +Arguments: + code the response code + user_msg the user message + +Returns: nothing +*/ + +#ifndef DISABLE_PRDR +static void +smtp_user_msg(uschar *code, uschar *user_msg) +{ +int len = 3; +smtp_message_code(&code, &len, &user_msg, NULL, TRUE); +smtp_respond(code, len, TRUE, user_msg); +} +#endif + + + + + +/************************************************* +* Remove a recipient from the list * +*************************************************/ + +/* This function is provided for local_scan() to use. + +Argument: + recipient address to remove + +Returns: TRUE if it did remove something; FALSE otherwise +*/ + +BOOL +receive_remove_recipient(uschar *recipient) +{ +DEBUG(D_receive) debug_printf("receive_remove_recipient(\"%s\") called\n", + recipient); +for (int count = 0; count < recipients_count; count++) + if (Ustrcmp(recipients_list[count].address, recipient) == 0) + { + if ((--recipients_count - count) > 0) + memmove(recipients_list + count, recipients_list + count + 1, + (recipients_count - count)*sizeof(recipient_item)); + return TRUE; + } +return FALSE; +} + + + + + +/* Pause for a while waiting for input. If none received in that time, +close the logfile, if we had one open; then if we wait for a long-running +datasource (months, in one use-case) log rotation will not leave us holding +the file copy. */ + +static void +log_close_chk(void) +{ +if (!receive_timeout && !receive_hasc()) + { + struct timeval t; + timesince(&t, &received_time); + if (t.tv_sec > 30*60) + mainlog_close(); + else + if (poll_one_fd(0, POLLIN, (30*60 - t.tv_sec) * 1000) == 0) + mainlog_close(); + } +} + +/************************************************* +* Read data portion of a non-SMTP message * +*************************************************/ + +/* This function is called to read the remainder of a message (following the +header) when the input is not from SMTP - we are receiving a local message on +a standard input stream. The message is always terminated by EOF, and is also +terminated by a dot on a line by itself if the flag dot_ends is TRUE. Split the +two cases for maximum efficiency. + +Ensure that the body ends with a newline. This will naturally be the case when +the termination is "\n.\n" but may not be otherwise. The RFC defines messages +as "sequences of lines" - this of course strictly applies only to SMTP, but +deliveries into BSD-type mailbox files also require it. Exim used to have a +flag for doing this at delivery time, but as it was always set for all +transports, I decided to simplify things by putting the check here instead. + +There is at least one MUA (dtmail) that sends CRLF via this interface, and +other programs are known to do this as well. Exim used to have a option for +dealing with this: in July 2003, after much discussion, the code has been +changed to default to treat any of LF, CRLF, and bare CR as line terminators. + +However, for the case when a dot on a line by itself terminates a message, the +only recognized terminating sequences before and after the dot are LF and CRLF. +Otherwise, having read EOL . CR, you don't know whether to read another +character or not. + +Internally, in messages stored in Exim's spool files, LF is used as the line +terminator. Under the new regime, bare CRs will no longer appear in these +files. + +Arguments: + fout a FILE to which to write the message + +Returns: One of the END_xxx values indicating why it stopped reading +*/ + +static int +read_message_data(FILE *fout) +{ +int ch_state; +register int ch; +register int linelength = 0; + +/* Handle the case when only EOF terminates the message */ + +if (!f.dot_ends) + { + int last_ch = '\n'; + + for ( ; + log_close_chk(), (ch = (receive_getc)(GETC_BUFFER_UNLIMITED)) != EOF; + last_ch = ch) + { + if (ch == 0) body_zerocount++; + if (last_ch == '\r' && ch != '\n') + { + if (linelength > max_received_linelength) + max_received_linelength = linelength; + linelength = 0; + if (fputc('\n', fout) == EOF) return END_WERROR; + message_size++; + body_linecount++; + } + if (ch == '\r') continue; + + if (fputc(ch, fout) == EOF) return END_WERROR; + if (ch == '\n') + { + if (linelength > max_received_linelength) + max_received_linelength = linelength; + linelength = 0; + body_linecount++; + } + else linelength++; + if (++message_size > thismessage_size_limit) return END_SIZE; + } + + if (last_ch != '\n') + { + if (linelength > max_received_linelength) + max_received_linelength = linelength; + if (fputc('\n', fout) == EOF) return END_WERROR; + message_size++; + body_linecount++; + } + + return END_EOF; + } + +/* Handle the case when a dot on a line on its own, or EOF, terminates. */ + +ch_state = 1; + +while (log_close_chk(), (ch = (receive_getc)(GETC_BUFFER_UNLIMITED)) != EOF) + { + if (ch == 0) body_zerocount++; + switch (ch_state) + { + case 0: /* Normal state (previous char written) */ + if (ch == '\n') + { + body_linecount++; + if (linelength > max_received_linelength) + max_received_linelength = linelength; + linelength = -1; + ch_state = 1; + } + else if (ch == '\r') + { ch_state = 2; continue; } + break; + + case 1: /* After written "\n" */ + if (ch == '.') { ch_state = 3; continue; } + if (ch == '\r') { ch_state = 2; continue; } + if (ch == '\n') { body_linecount++; linelength = -1; } + else ch_state = 0; + break; + + case 2: + body_linecount++; /* After unwritten "\r" */ + if (linelength > max_received_linelength) + max_received_linelength = linelength; + if (ch == '\n') + { + ch_state = 1; + linelength = -1; + } + else + { + if (message_size++, fputc('\n', fout) == EOF) return END_WERROR; + if (ch == '\r') continue; + ch_state = 0; + linelength = 0; + } + break; + + case 3: /* After "\n." (\n written, dot not) */ + if (ch == '\n') return END_DOT; + if (ch == '\r') { ch_state = 4; continue; } + message_size++; + linelength++; + if (fputc('.', fout) == EOF) return END_WERROR; + ch_state = 0; + break; + + case 4: /* After "\n.\r" (\n written, rest not) */ + if (ch == '\n') return END_DOT; + message_size += 2; + body_linecount++; + if (fputs(".\n", fout) == EOF) return END_WERROR; + if (ch == '\r') { ch_state = 2; continue; } + ch_state = 0; + break; + } + + linelength++; + if (fputc(ch, fout) == EOF) return END_WERROR; + if (++message_size > thismessage_size_limit) return END_SIZE; + } + +/* Get here if EOF read. Unless we have just written "\n", we need to ensure +the message ends with a newline, and we must also write any characters that +were saved up while testing for an ending dot. */ + +if (ch_state != 1) + { + static uschar *ends[] = { US"\n", NULL, US"\n", US".\n", US".\n" }; + if (fputs(CS ends[ch_state], fout) == EOF) return END_WERROR; + message_size += Ustrlen(ends[ch_state]); + body_linecount++; + } + +return END_EOF; +} + + + + +/************************************************* +* Read data portion of an SMTP message * +*************************************************/ + +/* This function is called to read the remainder of an SMTP message (after the +headers), or to skip over it when an error has occurred. In this case, the +output file is passed as NULL. + +If any line begins with a dot, that character is skipped. The input should only +be successfully terminated by CR LF . CR LF unless it is local (non-network) +SMTP, in which case the CRs are optional, but... + +FUDGE: It seems that sites on the net send out messages with just LF +terminators, despite the warnings in the RFCs, and other MTAs handle this. So +we make the CRs optional in all cases. + +July 2003: Bare CRs cause trouble. We now treat them as line terminators as +well, so that there are no CRs in spooled messages. However, the message +terminating dot is not recognized between two bare CRs. + +Arguments: + fout a FILE to which to write the message; NULL if skipping + +Returns: One of the END_xxx values indicating why it stopped reading +*/ + +static int +read_message_data_smtp(FILE *fout) +{ +int ch_state = 0; +int ch; +int linelength = 0; + +while ((ch = (receive_getc)(GETC_BUFFER_UNLIMITED)) != EOF) + { + if (ch == 0) body_zerocount++; + switch (ch_state) + { + case 0: /* After LF or CRLF */ + if (ch == '.') + { + ch_state = 3; + continue; /* Don't ever write . after LF */ + } + ch_state = 1; + + /* Else fall through to handle as normal uschar. */ + + case 1: /* Normal state */ + if (ch == '\n') + { + ch_state = 0; + body_linecount++; + if (linelength > max_received_linelength) + max_received_linelength = linelength; + linelength = -1; + } + else if (ch == '\r') + { + ch_state = 2; + continue; + } + break; + + case 2: /* After (unwritten) CR */ + body_linecount++; + if (linelength > max_received_linelength) + max_received_linelength = linelength; + linelength = -1; + if (ch == '\n') + { + ch_state = 0; + } + else + { + message_size++; + if (fout != NULL && fputc('\n', fout) == EOF) return END_WERROR; + cutthrough_data_put_nl(); + if (ch != '\r') ch_state = 1; else continue; + } + break; + + case 3: /* After [CR] LF . */ + if (ch == '\n') + return END_DOT; + if (ch == '\r') + { + ch_state = 4; + continue; + } + /* The dot was removed at state 3. For a doubled dot, here, reinstate + it to cutthrough. The current ch, dot or not, is passed both to cutthrough + and to file below. */ + if (ch == '.') + { + uschar c= ch; + cutthrough_data_puts(&c, 1); + } + ch_state = 1; + break; + + case 4: /* After [CR] LF . CR */ + if (ch == '\n') return END_DOT; + message_size++; + body_linecount++; + if (fout != NULL && fputc('\n', fout) == EOF) return END_WERROR; + cutthrough_data_put_nl(); + if (ch == '\r') + { + ch_state = 2; + continue; + } + ch_state = 1; + break; + } + + /* Add the character to the spool file, unless skipping; then loop for the + next. */ + + message_size++; + linelength++; + if (fout) + { + if (fputc(ch, fout) == EOF) return END_WERROR; + if (message_size > thismessage_size_limit) return END_SIZE; + } + if(ch == '\n') + cutthrough_data_put_nl(); + else + { + uschar c = ch; + cutthrough_data_puts(&c, 1); + } + } + +/* Fall through here if EOF encountered. This indicates some kind of error, +since a correct message is terminated by [CR] LF . [CR] LF. */ + +return END_EOF; +} + + + + +/* Variant of the above read_message_data_smtp() specialised for RFC 3030 +CHUNKING. Accept input lines separated by either CRLF or CR or LF and write +LF-delimited spoolfile. Until we have wireformat spoolfiles, we need the +body_linecount accounting for proper re-expansion for the wire, so use +a cut-down version of the state-machine above; we don't need to do leading-dot +detection and unstuffing. + +Arguments: + fout a FILE to which to write the message; NULL if skipping; + must be open for both writing and reading. + +Returns: One of the END_xxx values indicating why it stopped reading +*/ + +static int +read_message_bdat_smtp(FILE * fout) +{ +int linelength = 0, ch; +enum CH_STATE ch_state = LF_SEEN; +BOOL fix_nl = FALSE; + +for(;;) + { + switch ((ch = bdat_getc(GETC_BUFFER_UNLIMITED))) + { + case EOF: return END_EOF; + case ERR: return END_PROTOCOL; + case EOD: + /* Nothing to get from the sender anymore. We check the last + character written to the spool. + + RFC 3030 states, that BDAT chunks are normal text, terminated by CRLF. + If we would be strict, we would refuse such broken messages. + But we are liberal, so we fix it. It would be easy just to append + the "\n" to the spool. + + But there are some more things (line counting, message size calculation and such), + that would need to be duplicated here. So we simply do some ungetc + trickery. + */ + if (fout) + { + if (fseek(fout, -1, SEEK_CUR) < 0) return END_PROTOCOL; + if (fgetc(fout) == '\n') return END_DOT; + } + + if (linelength == -1) /* \r already seen (see below) */ + { + DEBUG(D_receive) debug_printf("Add missing LF\n"); + bdat_ungetc('\n'); + continue; + } + DEBUG(D_receive) debug_printf("Add missing CRLF\n"); + bdat_ungetc('\r'); /* not even \r was seen */ + fix_nl = TRUE; + + continue; + case '\0': body_zerocount++; break; + } + switch (ch_state) + { + case LF_SEEN: /* After LF or CRLF */ + ch_state = MID_LINE; + /* fall through to handle as normal uschar. */ + + case MID_LINE: /* Mid-line state */ + if (ch == '\n') + { + ch_state = LF_SEEN; + body_linecount++; + if (linelength > max_received_linelength) + max_received_linelength = linelength; + linelength = -1; + } + else if (ch == '\r') + { + ch_state = CR_SEEN; + if (fix_nl) bdat_ungetc('\n'); + continue; /* don't write CR */ + } + break; + + case CR_SEEN: /* After (unwritten) CR */ + body_linecount++; + if (linelength > max_received_linelength) + max_received_linelength = linelength; + linelength = -1; + if (ch == '\n') + ch_state = LF_SEEN; + else + { + message_size++; + if (fout && fputc('\n', fout) == EOF) return END_WERROR; + cutthrough_data_put_nl(); + if (ch == '\r') continue; /* don't write CR */ + ch_state = MID_LINE; + } + break; + } + + /* Add the character to the spool file, unless skipping */ + + message_size++; + linelength++; + if (fout) + { + if (fputc(ch, fout) == EOF) return END_WERROR; + if (message_size > thismessage_size_limit) return END_SIZE; + } + if(ch == '\n') + cutthrough_data_put_nl(); + else + { + uschar c = ch; + cutthrough_data_puts(&c, 1); + } + } +/*NOTREACHED*/ +} + +static int +read_message_bdat_smtp_wire(FILE * fout) +{ +int ch; + +/* Remember that this message uses wireformat. */ + +DEBUG(D_receive) debug_printf("CHUNKING: %s\n", + fout ? "writing spoolfile in wire format" : "flushing input"); +f.spool_file_wireformat = TRUE; + +for (;;) + { + if (chunking_data_left > 0) + { + unsigned len = MAX(chunking_data_left, thismessage_size_limit - message_size + 1); + uschar * buf = bdat_getbuf(&len); + + if (!buf) return END_EOF; + message_size += len; + if (fout && fwrite(buf, len, 1, fout) != 1) return END_WERROR; + } + else switch (ch = bdat_getc(GETC_BUFFER_UNLIMITED)) + { + case EOF: return END_EOF; + case EOD: return END_DOT; + case ERR: return END_PROTOCOL; + + default: + message_size++; + /*XXX not done: + linelength + max_received_linelength + body_linecount + body_zerocount + */ + if (fout && fputc(ch, fout) == EOF) return END_WERROR; + break; + } + if (message_size > thismessage_size_limit) return END_SIZE; + } +/*NOTREACHED*/ +} + + + + +/************************************************* +* Swallow SMTP message * +*************************************************/ + +/* This function is called when there has been some kind of error while reading +an SMTP message, and the remaining data may need to be swallowed. It is global +because it is called from smtp_closedown() to shut down an incoming call +tidily. + +Argument: a FILE from which to read the message +Returns: nothing +*/ + +void +receive_swallow_smtp(void) +{ +if (message_ended >= END_NOTENDED) + message_ended = chunking_state <= CHUNKING_OFFERED + ? read_message_data_smtp(NULL) + : read_message_bdat_smtp_wire(NULL); +} + + + +/************************************************* +* Handle lost SMTP connection * +*************************************************/ + +/* This function logs connection loss incidents and generates an appropriate +SMTP response. + +Argument: additional data for the message +Returns: the SMTP response +*/ + +static uschar * +handle_lost_connection(uschar *s) +{ +log_write(L_lost_incoming_connection | L_smtp_connection, LOG_MAIN, + "%s lost while reading message data%s", smtp_get_connection_info(), s); +smtp_notquit_exit(US"connection-lost", NULL, NULL); +return US"421 Lost incoming connection"; +} + + + + +/************************************************* +* Handle a non-smtp reception error * +*************************************************/ + +/* This function is called for various errors during the reception of non-SMTP +messages. It either sends a message to the sender of the problem message, or it +writes to the standard error stream. + +Arguments: + errcode code for moan_to_sender(), identifying the error + text1 first message text, passed to moan_to_sender() + text2 second message text, used only for stderrr + error_rc code to pass to exim_exit if no problem + f FILE containing body of message (may be stdin) + hptr pointer to instore headers or NULL + +Returns: calls exim_exit(), which does not return +*/ + +static void +give_local_error(int errcode, uschar *text1, uschar *text2, int error_rc, + FILE *f, header_line *hptr) +{ +if (error_handling == ERRORS_SENDER) + { + error_block eblock; + eblock.next = NULL; + eblock.text1 = text1; + eblock.text2 = US""; + if (!moan_to_sender(errcode, &eblock, hptr, f, FALSE)) + error_rc = EXIT_FAILURE; + } +else + fprintf(stderr, "exim: %s%s\n", text2, text1); /* Sic */ +(void)fclose(f); +exim_exit(error_rc); +} + + + +/************************************************* +* Add header lines set up by ACL * +*************************************************/ + +/* This function is called to add the header lines that were set up by +statements in an ACL to the list of headers in memory. It is done in two stages +like this, because when the ACL for RCPT is running, the other headers have not +yet been received. This function is called twice; once just before running the +DATA ACL, and once after. This is so that header lines added by MAIL or RCPT +are visible to the DATA ACL. + +Originally these header lines were added at the end. Now there is support for +three different places: top, bottom, and after the Received: header(s). There +will always be at least one Received: header, even if it is marked deleted, and +even if something else has been put in front of it. + +Arguments: + acl_name text to identify which ACL + +Returns: nothing +*/ + +static void +add_acl_headers(int where, uschar *acl_name) +{ +header_line *last_received = NULL; + +switch(where) + { + case ACL_WHERE_DKIM: + case ACL_WHERE_MIME: + case ACL_WHERE_DATA: + if ( cutthrough.cctx.sock >= 0 && cutthrough.delivery + && (acl_removed_headers || acl_added_headers)) + { + log_write(0, LOG_MAIN|LOG_PANIC, "Header modification in data ACLs" + " will not take effect on cutthrough deliveries"); + return; + } + } + +if (acl_removed_headers) + { + DEBUG(D_receive|D_acl) debug_printf_indent(">>Headers removed by %s ACL:\n", acl_name); + + for (header_line * h = header_list; h; h = h->next) if (h->type != htype_old) + { + const uschar * list = acl_removed_headers; + int sep = ':'; /* This is specified as a colon-separated list */ + uschar *s; + + while ((s = string_nextinlist(&list, &sep, NULL, 0))) + if (header_testname(h, s, Ustrlen(s), FALSE)) + { + h->type = htype_old; + DEBUG(D_receive|D_acl) debug_printf_indent(" %s", h->text); + } + } + acl_removed_headers = NULL; + DEBUG(D_receive|D_acl) debug_printf_indent(">>\n"); + } + +if (!acl_added_headers) return; +DEBUG(D_receive|D_acl) debug_printf_indent(">>Headers added by %s ACL:\n", acl_name); + +for (header_line * h = acl_added_headers, * next; h; h = next) + { + next = h->next; + + switch(h->type) + { + case htype_add_top: + h->next = header_list; + header_list = h; + DEBUG(D_receive|D_acl) debug_printf_indent(" (at top)"); + break; + + case htype_add_rec: + if (!last_received) + { + last_received = header_list; + while (!header_testname(last_received, US"Received", 8, FALSE)) + last_received = last_received->next; + while (last_received->next && + header_testname(last_received->next, US"Received", 8, FALSE)) + last_received = last_received->next; + } + h->next = last_received->next; + last_received->next = h; + DEBUG(D_receive|D_acl) debug_printf_indent(" (after Received:)"); + break; + + case htype_add_rfc: + /* add header before any header which is NOT Received: or Resent- */ + last_received = header_list; + while ( last_received->next && + ( (header_testname(last_received->next, US"Received", 8, FALSE)) || + (header_testname_incomplete(last_received->next, US"Resent-", 7, FALSE)) ) ) + last_received = last_received->next; + /* last_received now points to the last Received: or Resent-* header + in an uninterrupted chain of those header types (seen from the beginning + of all headers. Our current header must follow it. */ + h->next = last_received->next; + last_received->next = h; + DEBUG(D_receive|D_acl) debug_printf_indent(" (before any non-Received: or Resent-*: header)"); + break; + + default: + h->next = NULL; + header_last->next = h; + DEBUG(D_receive|D_acl) debug_printf_indent(" "); + break; + } + + if (!h->next) header_last = h; + + /* Check for one of the known header types (From:, To:, etc.) though in + practice most added headers are going to be "other". Lower case + identification letters are never stored with the header; they are used + for existence tests when messages are received. So discard any lower case + flag values. */ + + h->type = header_checkname(h, FALSE); + if (h->type >= 'a') h->type = htype_other; + + DEBUG(D_receive|D_acl) debug_printf("%s", h->text); + } + +acl_added_headers = NULL; +DEBUG(D_receive|D_acl) debug_printf_indent(">>\n"); +} + + + +/************************************************* +* Add host information for log line * +*************************************************/ + +/* Called for acceptance and rejecting log lines. This adds information about +the calling host to a string that is being built dynamically. + +Arguments: + s the dynamic string + +Returns: the extended string +*/ + +static gstring * +add_host_info_for_log(gstring * g) +{ +if (sender_fullhost) + { + if (LOGGING(dnssec) && sender_host_dnssec) /*XXX sender_helo_dnssec? */ + g = string_catn(g, US" DS", 3); + g = string_append(g, 2, US" H=", sender_fullhost); + if (LOGGING(incoming_interface) && interface_address) + g = string_fmt_append(g, " I=[%s]:%d", interface_address, interface_port); + } +if (f.tcp_in_fastopen && !f.tcp_in_fastopen_logged) + { + g = string_catn(g, US" TFO*", f.tcp_in_fastopen_data ? 5 : 4); + f.tcp_in_fastopen_logged = TRUE; + } +if (sender_ident) + g = string_append(g, 2, US" U=", sender_ident); +if (received_protocol) + g = string_append(g, 2, US" P=", received_protocol); +if (LOGGING(pipelining) && f.smtp_in_pipelining_advertised) + { + g = string_catn(g, US" L", 2); +#ifndef DISABLE_PIPE_CONNECT + if (f.smtp_in_early_pipe_used) + g = string_catn(g, US"*", 1); + else if (f.smtp_in_early_pipe_advertised) + g = string_catn(g, US".", 1); +#endif + if (!f.smtp_in_pipelining_used) + g = string_catn(g, US"-", 1); + } +return g; +} + + + +#ifdef WITH_CONTENT_SCAN + +/************************************************* +* Run the MIME ACL on a message * +*************************************************/ + +/* This code is in a subroutine so that it can be used for both SMTP +and non-SMTP messages. It is called with a non-NULL ACL pointer. + +Arguments: + acl The ACL to run (acl_smtp_mime or acl_not_smtp_mime) + smtp_yield_ptr Set FALSE to kill messages after dropped connection + smtp_reply_ptr Where SMTP reply is being built + blackholed_by_ptr Where "blackholed by" message is being built + +Returns: TRUE to carry on; FALSE to abandon the message +*/ + +static BOOL +run_mime_acl(uschar *acl, BOOL *smtp_yield_ptr, uschar **smtp_reply_ptr, + uschar **blackholed_by_ptr) +{ +FILE *mbox_file; +uschar * rfc822_file_path = NULL; +unsigned long mbox_size; +uschar *user_msg, *log_msg; +int mime_part_count_buffer = -1; +uschar * mbox_filename; +int rc = OK; + +/* check if it is a MIME message */ + +for (header_line * my_headerlist = header_list; my_headerlist; + my_headerlist = my_headerlist->next) + if ( my_headerlist->type != '*' /* skip deleted headers */ + && strncmpic(my_headerlist->text, US"Content-Type:", 13) == 0 + ) + { + DEBUG(D_receive) debug_printf("Found Content-Type: header - executing acl_smtp_mime.\n"); + goto DO_MIME_ACL; + } + +DEBUG(D_receive) debug_printf("No Content-Type: header - presumably not a MIME message.\n"); +return TRUE; + +DO_MIME_ACL: + +/* make sure the eml mbox file is spooled up */ +if (!(mbox_file = spool_mbox(&mbox_size, NULL, &mbox_filename))) + { /* error while spooling */ + log_write(0, LOG_MAIN|LOG_PANIC, + "acl_smtp_mime: error while creating mbox spool file, message temporarily rejected."); + Uunlink(spool_name); + unspool_mbox(); +#ifdef EXPERIMENTAL_DCC + dcc_ok = 0; +#endif + smtp_respond(US"451", 3, TRUE, US"temporary local problem"); + message_id[0] = 0; /* Indicate no message accepted */ + *smtp_reply_ptr = US""; /* Indicate reply already sent */ + return FALSE; /* Indicate skip to end of receive function */ + } + +mime_is_rfc822 = 0; + +MIME_ACL_CHECK: +mime_part_count = -1; +rc = mime_acl_check(acl, mbox_file, NULL, &user_msg, &log_msg); +(void)fclose(mbox_file); + +if (rfc822_file_path) + { + mime_part_count = mime_part_count_buffer; + + if (unlink(CS rfc822_file_path) == -1) + { + log_write(0, LOG_PANIC, + "acl_smtp_mime: can't unlink RFC822 spool file, skipping."); + goto END_MIME_ACL; + } + rfc822_file_path = NULL; + } + +/* check if we must check any message/rfc822 attachments */ +if (rc == OK) + { + uschar * scandir = string_copyn(mbox_filename, + Ustrrchr(mbox_filename, '/') - mbox_filename); + struct dirent * entry; + DIR * tempdir; + + for (tempdir = exim_opendir(scandir); entry = readdir(tempdir); ) + if (strncmpic(US entry->d_name, US"__rfc822_", 9) == 0) + { + rfc822_file_path = string_sprintf("%s/%s", scandir, entry->d_name); + DEBUG(D_receive) + debug_printf("RFC822 attachment detected: running MIME ACL for '%s'\n", + rfc822_file_path); + break; + } + closedir(tempdir); + + if (rfc822_file_path) + { + if ((mbox_file = Ufopen(rfc822_file_path, "rb"))) + { + /* set RFC822 expansion variable */ + mime_is_rfc822 = 1; + mime_part_count_buffer = mime_part_count; + goto MIME_ACL_CHECK; + } + log_write(0, LOG_PANIC, + "acl_smtp_mime: can't open RFC822 spool file, skipping."); + unlink(CS rfc822_file_path); + } + } + +END_MIME_ACL: +add_acl_headers(ACL_WHERE_MIME, US"MIME"); +if (rc == DISCARD) + { + recipients_count = 0; + *blackholed_by_ptr = US"MIME ACL"; + cancel_cutthrough_connection(TRUE, US"mime acl discard"); + } +else if (rc != OK) + { + Uunlink(spool_name); + cancel_cutthrough_connection(TRUE, US"mime acl not ok"); + unspool_mbox(); +#ifdef EXPERIMENTAL_DCC + dcc_ok = 0; +#endif + if (smtp_input) + { + if (smtp_handle_acl_fail(ACL_WHERE_MIME, rc, user_msg, log_msg) != 0) + *smtp_yield_ptr = FALSE; /* No more messages after dropped connection */ + *smtp_reply_ptr = US""; /* Indicate reply already sent */ + } + message_id[0] = 0; /* Indicate no message accepted */ + return FALSE; /* Cause skip to end of receive function */ + } + +return TRUE; +} + +#endif /* WITH_CONTENT_SCAN */ + + + +void +received_header_gen(void) +{ +uschar * received; +uschar * timestamp = expand_string(US"${tod_full}"); +header_line * received_header= header_list; + +if (recipients_count == 1) received_for = recipients_list[0].address; +received = expand_string(received_header_text); +received_for = NULL; + +if (!received) + { + if(spool_name[0] != 0) + Uunlink(spool_name); /* Lose the data file */ + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Expansion of \"%s\" " + "(received_header_text) failed: %s", string_printing(received_header_text), + expand_string_message); + } + +/* The first element on the header chain is reserved for the Received header, +so all we have to do is fill in the text pointer, and set the type. However, if +the result of the expansion is an empty string, we leave the header marked as +"old" so as to refrain from adding a Received header. */ + +if (!received[0]) + { + received_header->text = string_sprintf("Received: ; %s\n", timestamp); + received_header->type = htype_old; + } +else + { + received_header->text = string_sprintf("%s;\n\t%s\n", received, timestamp); + received_header->type = htype_received; + } + +received_header->slen = Ustrlen(received_header->text); + +DEBUG(D_receive) debug_printf(">>Generated Received: header line\n%c %s", + received_header->type, received_header->text); +} + + + +/************************************************* +* Receive message * +*************************************************/ + +/* Receive a message on the given input, and put it into a pair of spool files. +Either a non-null list of recipients, or the extract flag will be true, or +both. The flag sender_local is true for locally generated messages. The flag +submission_mode is true if an ACL has obeyed "control = submission". The flag +suppress_local_fixups is true if an ACL has obeyed "control = +suppress_local_fixups" or -G was passed on the command-line. +The flag smtp_input is true if the message is to be +handled using SMTP conventions about termination and lines starting with dots. +For non-SMTP messages, dot_ends is true for dot-terminated messages. + +If a message was successfully read, message_id[0] will be non-zero. + +The general actions of this function are: + + . Read the headers of the message (if any) into a chain of store + blocks. + + . If there is a "sender:" header and the message is locally originated, + throw it away, unless the caller is trusted, or unless + active_local_sender_retain is set - which can only happen if + active_local_from_check is false. + + . If recipients are to be extracted from the message, build the + recipients list from the headers, removing any that were on the + original recipients list (unless extract_addresses_remove_arguments is + false), and at the same time, remove any bcc header that may be present. + + . Get the spool file for the data, sort out its unique name, open + and lock it (but don't give it the name yet). + + . Generate a "Message-Id" header if the message doesn't have one, for + locally-originated messages. + + . Generate a "Received" header. + + . Ensure the recipients list is fully qualified and rewritten if necessary. + + . If there are any rewriting rules, apply them to the sender address + and also to the headers. + + . If there is no from: header, generate one, for locally-generated messages + and messages in "submission mode" only. + + . If the sender is local, check that from: is correct, and if not, generate + a Sender: header, unless message comes from a trusted caller, or this + feature is disabled by active_local_from_check being false. + + . If there is no "date" header, generate one, for locally-originated + or submission mode messages only. + + . Copy the rest of the input, or up to a terminating "." if in SMTP or + dot_ends mode, to the data file. Leave it open, to hold the lock. + + . Write the envelope and the headers to a new file. + + . Set the name for the header file; close it. + + . Set the name for the data file; close it. + +Because this function can potentially be called many times in a single +SMTP connection, all store should be got by store_get(), so that it will be +automatically retrieved after the message is accepted. + +FUDGE: It seems that sites on the net send out messages with just LF +terminators, despite the warnings in the RFCs, and other MTAs handle this. So +we make the CRs optional in all cases. + +July 2003: Bare CRs in messages, especially in header lines, cause trouble. A +new regime is now in place in which bare CRs in header lines are turned into LF +followed by a space, so as not to terminate the header line. + +February 2004: A bare LF in a header line in a message whose first line was +terminated by CRLF is treated in the same way as a bare CR. + +Arguments: + extract_recip TRUE if recipients are to be extracted from the message's + headers + +Returns: TRUE there are more messages to be read (SMTP input) + FALSE there are no more messages to be read (non-SMTP input + or SMTP connection collapsed, or other failure) + +When reading a message for filter testing, the returned value indicates +whether the headers (which is all that is read) were terminated by '.' or +not. */ + +BOOL +receive_msg(BOOL extract_recip) +{ +int rc = FAIL; +int msg_size = 0; +int process_info_len = Ustrlen(process_info); +int error_rc = error_handling == ERRORS_SENDER + ? errors_sender_rc : EXIT_FAILURE; +int header_size = 256; +int had_zero = 0; +int prevlines_length = 0; +const int id_resolution = BASE_62 == 62 ? 5000 : 10000; + +int ptr = 0; + +BOOL contains_resent_headers = FALSE; +BOOL extracted_ignored = FALSE; +BOOL first_line_ended_crlf = TRUE_UNSET; +BOOL smtp_yield = TRUE; +BOOL yield = FALSE; + +BOOL resents_exist = FALSE; +uschar *resent_prefix = US""; +uschar *blackholed_by = NULL; +uschar *blackhole_log_msg = US""; +enum {NOT_TRIED, TMP_REJ, PERM_REJ, ACCEPTED} cutthrough_done = NOT_TRIED; + +flock_t lock_data; +error_block *bad_addresses = NULL; + +uschar *frozen_by = NULL; +uschar *queued_by = NULL; + +uschar *errmsg; +rmark rcvd_log_reset_point; +gstring * g; +struct stat statbuf; + +/* Final message to give to SMTP caller, and messages from ACLs */ + +uschar *smtp_reply = NULL; +uschar *user_msg, *log_msg; + +/* Working header pointers */ + +rmark reset_point; +header_line *next; + +/* Flags for noting the existence of certain headers (only one left) */ + +BOOL date_header_exists = FALSE; + +/* Pointers to receive the addresses of headers whose contents we need. */ + +header_line *from_header = NULL; +header_line *subject_header = NULL; +header_line *msgid_header = NULL; +header_line *received_header; +BOOL msgid_header_newly_created = FALSE; + +/* Variables for use when building the Received: header. */ + +uschar *timestamp; +int tslen; + +/* Time of creation of message_id */ + +static struct timeval message_id_tv = { 0, 0 }; + + +/* Release any open files that might have been cached while preparing to +accept the message - e.g. by verifying addresses - because reading a message +might take a fair bit of real time. */ + +search_tidyup(); + +/* Extracting the recipient list from an input file is incompatible with +cutthrough delivery with the no-spool option. It shouldn't be possible +to set up the combination, but just in case kill any ongoing connection. */ +if (extract_recip || !smtp_input) + cancel_cutthrough_connection(TRUE, US"not smtp input"); + +/* Initialize the chain of headers by setting up a place-holder for Received: +header. Temporarily mark it as "old", i.e. not to be used. We keep header_last +pointing to the end of the chain to make adding headers simple. */ + +received_header = header_list = header_last = store_get(sizeof(header_line), GET_UNTAINTED); +header_list->next = NULL; +header_list->type = htype_old; +header_list->text = NULL; +header_list->slen = 0; + +/* Control block for the next header to be read. +The data comes from the message, so is tainted. */ + +reset_point = store_mark(); +next = store_get(sizeof(header_line), GET_UNTAINTED); +next->text = store_get(header_size, GET_TAINTED); + +/* Initialize message id to be null (indicating no message read), and the +header names list to be the normal list. Indicate there is no data file open +yet, initialize the size and warning count, and deal with no size limit. */ + +message_id[0] = 0; +spool_data_file = NULL; +data_fd = -1; +spool_name = US""; +message_size = 0; +warning_count = 0; +received_count = 1; /* For the one we will add */ + +if (thismessage_size_limit <= 0) thismessage_size_limit = INT_MAX; + +/* While reading the message, the following counts are computed. */ + +message_linecount = body_linecount = body_zerocount = + max_received_linelength = 0; + +#ifdef WITH_CONTENT_SCAN +/* reset non-per-part mime variables */ +mime_is_coverletter = 0; +mime_is_rfc822 = 0; +mime_part_count = -1; +#endif + +#ifndef DISABLE_DKIM +/* Call into DKIM to set up the context. In CHUNKING mode +we clear the dot-stuffing flag */ +if (smtp_input && !smtp_batched_input && !f.dkim_disable_verify) + dkim_exim_verify_init(chunking_state <= CHUNKING_OFFERED); +#endif + +#ifdef SUPPORT_DMARC +if (sender_host_address) dmarc_init(); /* initialize libopendmarc */ +#endif + +/* In SMTP sessions we may receive several messages in one connection. Before +each subsequent one, we wait for the clock to tick at the level of message-id +granularity. +This is so that the combination of time+pid is unique, even on systems where the +pid can be re-used within our time interval. We can't shorten the interval +without re-designing the message-id. See comments above where the message id is +created. This is Something For The Future. +Do this wait any time we have previously created a message-id, even if we +rejected the message. This gives unique IDs for logging done by ACLs. +The initial timestamp must have been obtained via exim_gettime() to avoid +issues on Linux with suspend/resume. */ + +if (message_id_tv.tv_sec) + { + message_id_tv.tv_usec = (message_id_tv.tv_usec/id_resolution) * id_resolution; + exim_wait_tick(&message_id_tv, id_resolution); + } + +/* Remember the time of reception. Exim uses time+pid for uniqueness of message +ids, and fractions of a second are required. See the comments that precede the +message id creation below. +We use a routine that if possible uses a monotonic clock, and can be used again +after reception for the tick-wait even under the Linux non-Posix behaviour. */ + +else + exim_gettime(&message_id_tv); + +/* For other uses of the received time we can operate with granularity of one +second, and for that we use the global variable received_time. This is for +things like ultimate message timeouts. +For this we do not care about the Linux suspend/resume problem, so rather than +use exim_gettime() everywhere we use a plain gettimeofday() here. */ + +gettimeofday(&received_time, NULL); + +/* If SMTP input, set the special handler for timeouts. The alarm() calls +happen in the smtp_getc() function when it refills its buffer. */ + +had_data_timeout = 0; +if (smtp_input) + os_non_restarting_signal(SIGALRM, data_timeout_handler); + +/* If not SMTP input, timeout happens only if configured, and we just set a +single timeout for the whole message. */ + +else if (receive_timeout > 0) + { + os_non_restarting_signal(SIGALRM, data_timeout_handler); + ALARM(receive_timeout); + } + +/* SIGTERM and SIGINT are caught always. */ + +had_data_sigint = 0; +signal(SIGTERM, data_sigterm_sigint_handler); +signal(SIGINT, data_sigterm_sigint_handler); + +/* Header lines in messages are not supposed to be very long, though when +unfolded, to: and cc: headers can take up a lot of store. We must also cope +with the possibility of junk being thrown at us. Start by getting 256 bytes for +storing the header, and extend this as necessary using string_cat(). + +To cope with total lunacies, impose an upper limit on the length of the header +section of the message, as otherwise the store will fill up. We must also cope +with the possibility of binary zeros in the data. Hence we cannot use fgets(). +Folded header lines are joined into one string, leaving the '\n' characters +inside them, so that writing them out reproduces the input. + +Loop for each character of each header; the next structure for chaining the +header is set up already, with ptr the offset of the next character in +next->text. */ + +for (;;) + { + int ch = (receive_getc)(GETC_BUFFER_UNLIMITED); + + /* If we hit EOF on a SMTP connection, it's an error, since incoming + SMTP must have a correct "." terminator. */ + + if (smtp_input /* && !smtp_batched_input */) + if (ch == EOF) + { + smtp_reply = handle_lost_connection(US" (header)"); + smtp_yield = FALSE; + goto TIDYUP; /* Skip to end of function */ + } + else if (ch == ERR) + goto TIDYUP; + + /* See if we are at the current header's size limit - there must be at least + four bytes left. This allows for the new character plus a zero, plus two for + extra insertions when we are playing games with dots and carriage returns. If + we are at the limit, extend the text buffer. This could have been done + automatically using string_cat() but because this is a tightish loop storing + only one character at a time, we choose to do it inline. Normally + store_extend() will be able to extend the block; only at the end of a big + store block will a copy be needed. To handle the case of very long headers + (and sometimes lunatic messages can have ones that are 100s of K long) we + call store_release() for strings that have been copied - if the string is at + the start of a block (and therefore the only thing in it, because we aren't + doing any other gets), the block gets freed. We can only do this release if + there were no allocations since the once that we want to free. */ + + if (ptr >= header_size - 4) + { + int oldsize = header_size; + + if (header_size >= INT_MAX/2) + goto OVERSIZE; + header_size *= 2; + + if (!store_extend(next->text, oldsize, header_size)) + next->text = store_newblock(next->text, header_size, ptr); + } + + /* Cope with receiving a binary zero. There is dispute about whether + these should be allowed in RFC 822 messages. The middle view is that they + should not be allowed in headers, at least. Exim takes this attitude at + the moment. We can't just stomp on them here, because we don't know that + this line is a header yet. Set a flag to cause scanning later. */ + + if (ch == 0) had_zero++; + + /* Test for termination. Lines in remote SMTP are terminated by CRLF, while + those from data files use just LF. Treat LF in local SMTP input as a + terminator too. Treat EOF as a line terminator always. */ + + if (ch < 0) goto EOL; + + /* FUDGE: There are sites out there that don't send CRs before their LFs, and + other MTAs accept this. We are therefore forced into this "liberalisation" + too, so we accept LF as a line terminator whatever the source of the message. + However, if the first line of the message ended with a CRLF, we treat a bare + LF specially by inserting a white space after it to ensure that the header + line is not terminated. */ + + if (ch == '\n') + { + if (first_line_ended_crlf == TRUE_UNSET) first_line_ended_crlf = FALSE; + else if (first_line_ended_crlf) receive_ungetc(' '); + goto EOL; + } + + /* This is not the end of the line. If this is SMTP input and this is + the first character in the line and it is a "." character, ignore it. + This implements the dot-doubling rule, though header lines starting with + dots aren't exactly common. They are legal in RFC 822, though. If the + following is CRLF or LF, this is the line that that terminates the + entire message. We set message_ended to indicate this has happened (to + prevent further reading), and break out of the loop, having freed the + empty header, and set next = NULL to indicate no data line. */ + + if (f.dot_ends && ptr == 0 && ch == '.') + { + ch = (receive_getc)(GETC_BUFFER_UNLIMITED); + if (ch == '\r') + { + ch = (receive_getc)(GETC_BUFFER_UNLIMITED); + if (ch != '\n') + { + if (ch >= 0) receive_ungetc(ch); + ch = '\r'; /* Revert to CR */ + } + } + if (ch == '\n') + { + message_ended = END_DOT; + reset_point = store_reset(reset_point); + next = NULL; + break; /* End character-reading loop */ + } + + /* For non-SMTP input, the dot at the start of the line was really a data + character. What is now in ch is the following character. We guaranteed + enough space for this above. */ + + if (!smtp_input) + { + next->text[ptr++] = '.'; + message_size++; + } + } + + /* If CR is immediately followed by LF, end the line, ignoring the CR, and + remember this case if this is the first line ending. */ + + if (ch == '\r') + { + ch = (receive_getc)(GETC_BUFFER_UNLIMITED); + if (ch == '\n') + { + if (first_line_ended_crlf == TRUE_UNSET) first_line_ended_crlf = TRUE; + goto EOL; + } + + /* Otherwise, put back the character after CR, and turn the bare CR + into LF SP. */ + + if (ch >= 0) (receive_ungetc)(ch); + next->text[ptr++] = '\n'; + message_size++; + ch = ' '; + } + + /* We have a data character for the header line. */ + + next->text[ptr++] = ch; /* Add to buffer */ + message_size++; /* Total message size so far */ + + /* Handle failure due to a humungously long header section. The >= allows + for the terminating \n. Add what we have so far onto the headers list so + that it gets reflected in any error message, and back up the just-read + character. */ + + if (message_size >= header_maxsize) + { +OVERSIZE: + next->text[ptr] = 0; + next->slen = ptr; + next->type = htype_other; + next->next = NULL; + header_last->next = next; + header_last = next; + + log_write(0, LOG_MAIN, "ridiculously long message header received from " + "%s (more than %d characters): message abandoned", + f.sender_host_unknown ? sender_ident : sender_fullhost, header_maxsize); + + if (smtp_input) + { + smtp_reply = US"552 Message header is ridiculously long"; + receive_swallow_smtp(); + goto TIDYUP; /* Skip to end of function */ + } + + else + { + give_local_error(ERRMESS_VLONGHEADER, + string_sprintf("message header longer than %d characters received: " + "message not accepted", header_maxsize), US"", error_rc, stdin, + header_list->next); + /* Does not return */ + } + } + + continue; /* With next input character */ + + /* End of header line reached */ + + EOL: + + /* Keep track of lines for BSMTP errors and overall message_linecount. */ + + receive_linecount++; + message_linecount++; + + /* Keep track of maximum line length */ + + if (ptr - prevlines_length > max_received_linelength) + max_received_linelength = ptr - prevlines_length; + prevlines_length = ptr + 1; + + /* Now put in the terminating newline. There is always space for + at least two more characters. */ + + next->text[ptr++] = '\n'; + message_size++; + + /* A blank line signals the end of the headers; release the unwanted + space and set next to NULL to indicate this. */ + + if (ptr == 1) + { + reset_point = store_reset(reset_point); + next = NULL; + break; + } + + /* There is data in the line; see if the next input character is a + whitespace character. If it is, we have a continuation of this header line. + There is always space for at least one character at this point. */ + + if (ch >= 0) + { + int nextch = (receive_getc)(GETC_BUFFER_UNLIMITED); + if (nextch == ' ' || nextch == '\t') + { + next->text[ptr++] = nextch; + if (++message_size >= header_maxsize) + goto OVERSIZE; + continue; /* Iterate the loop */ + } + else if (nextch >= 0) /* not EOF, ERR etc */ + (receive_ungetc)(nextch); /* For next time */ + else ch = nextch; /* Cause main loop to exit at end */ + } + + /* We have got to the real line end. Terminate the string and release store + beyond it. If it turns out to be a real header, internal binary zeros will + be squashed later. */ + + next->text[ptr] = 0; + next->slen = ptr; + store_release_above(next->text + ptr + 1); + + /* Check the running total size against the overall message size limit. We + don't expect to fail here, but if the overall limit is set less than MESSAGE_ + MAXSIZE and a big header is sent, we want to catch it. Just stop reading + headers - the code to read the body will then also hit the buffer. */ + + if (message_size > thismessage_size_limit) break; + + /* A line that is not syntactically correct for a header also marks + the end of the headers. In this case, we leave next containing the + first data line. This might actually be several lines because of the + continuation logic applied above, but that doesn't matter. + + It turns out that smail, and presumably sendmail, accept leading lines + of the form + + From ph10 Fri Jan 5 12:35 GMT 1996 + + in messages. The "mail" command on Solaris 2 sends such lines. I cannot + find any documentation of this, but for compatibility it had better be + accepted. Exim restricts it to the case of non-smtp messages, and + treats it as an alternative to the -f command line option. Thus it is + ignored except for trusted users or filter testing. Otherwise it is taken + as the sender address, unless -f was used (sendmail compatibility). + + It further turns out that some UUCPs generate the From_line in a different + format, e.g. + + From ph10 Fri, 7 Jan 97 14:00:00 GMT + + The regex for matching these things is now capable of recognizing both + formats (including 2- and 4-digit years in the latter). In fact, the regex + is now configurable, as is the expansion string to fish out the sender. + + Even further on it has been discovered that some broken clients send + these lines in SMTP messages. There is now an option to ignore them from + specified hosts or networks. Sigh. */ + + if ( header_last == header_list + && ( !smtp_input + || ( sender_host_address + && verify_check_host(&ignore_fromline_hosts) == OK + ) + || (!sender_host_address && ignore_fromline_local) + ) + && regex_match_and_setup(regex_From, next->text, 0, -1) + ) + { + if (!f.sender_address_forced) + { + uschar *uucp_sender = expand_string(uucp_from_sender); + if (!uucp_sender) + log_write(0, LOG_MAIN|LOG_PANIC, + "expansion of \"%s\" failed after matching " + "\"From \" line: %s", uucp_from_sender, expand_string_message); + else + { + int start, end, domain; + uschar *errmess; + uschar *newsender = parse_extract_address(uucp_sender, &errmess, + &start, &end, &domain, TRUE); + if (newsender) + { + if (domain == 0 && newsender[0] != 0) + /* deconst ok as newsender was not const */ + newsender = US rewrite_address_qualify(newsender, FALSE); + + if (filter_test != FTEST_NONE || receive_check_set_sender(newsender)) + { + sender_address = newsender; + + if (f.trusted_caller || filter_test != FTEST_NONE) + { + authenticated_sender = NULL; + originator_name = US""; + f.sender_local = FALSE; + } + + if (filter_test != FTEST_NONE) + printf("Sender taken from \"From \" line\n"); + } + } + } + } + } + + /* Not a leading "From " line. Check to see if it is a valid header line. + Header names may contain any non-control characters except space and colon, + amazingly. */ + + else + { + uschar * p = next->text; + + /* If not a valid header line, break from the header reading loop, leaving + next != NULL, indicating that it holds the first line of the body. */ + + if (isspace(*p)) break; + while (mac_isgraph(*p) && *p != ':') p++; + while (isspace(*p)) p++; + if (*p != ':') + { + body_zerocount = had_zero; + break; + } + + /* We have a valid header line. If there were any binary zeroes in + the line, stomp on them here. */ + + if (had_zero > 0) + for (uschar * p = next->text; p < next->text + ptr; p++) if (*p == 0) + *p = '?'; + + /* It is perfectly legal to have an empty continuation line + at the end of a header, but it is confusing to humans + looking at such messages, since it looks like a blank line. + Reduce confusion by removing redundant white space at the + end. We know that there is at least one printing character + (the ':' tested for above) so there is no danger of running + off the end. */ + + p = next->text + ptr - 2; + for (;;) + { + while (*p == ' ' || *p == '\t') p--; + if (*p != '\n') break; + ptr = (p--) - next->text + 1; + message_size -= next->slen - ptr; + next->text[ptr] = 0; + next->slen = ptr; + } + + /* Add the header to the chain */ + + next->type = htype_other; + next->next = NULL; + header_last->next = next; + header_last = next; + + /* Check the limit for individual line lengths. This comes after adding to + the chain so that the failing line is reflected if a bounce is generated + (for a local message). */ + + if (header_line_maxsize > 0 && next->slen > header_line_maxsize) + { + log_write(0, LOG_MAIN, "overlong message header line received from " + "%s (more than %d characters): message abandoned", + f.sender_host_unknown ? sender_ident : sender_fullhost, + header_line_maxsize); + + if (smtp_input) + { + smtp_reply = US"552 A message header line is too long"; + receive_swallow_smtp(); + goto TIDYUP; /* Skip to end of function */ + } + + else + give_local_error(ERRMESS_VLONGHDRLINE, + string_sprintf("message header line longer than %d characters " + "received: message not accepted", header_line_maxsize), US"", + error_rc, stdin, header_list->next); + /* Does not return */ + } + + /* Note if any resent- fields exist. */ + + if (!resents_exist && strncmpic(next->text, US"resent-", 7) == 0) + { + resents_exist = TRUE; + resent_prefix = US"Resent-"; + } + } + + /* Reject CHUNKING messages that do not CRLF their first header line */ + + if (!first_line_ended_crlf && chunking_state > CHUNKING_OFFERED) + { + log_write(L_size_reject, LOG_MAIN|LOG_REJECT, "rejected from <%s>%s%s%s%s: " + "Non-CRLF-terminated header, under CHUNKING: message abandoned", + sender_address, + sender_fullhost ? " H=" : "", sender_fullhost ? sender_fullhost : US"", + sender_ident ? " U=" : "", sender_ident ? sender_ident : US""); + smtp_printf("552 Message header not CRLF terminated\r\n", FALSE); + bdat_flush_data(); + smtp_reply = US""; + goto TIDYUP; /* Skip to end of function */ + } + + /* The line has been handled. If we have hit EOF, break out of the loop, + indicating no pending data line and no more data for the message */ + + if (ch < 0) + { + next = NULL; + if (ch == EOF) message_ended = END_DOT; + else if (ch == ERR) message_ended = END_PROTOCOL; + break; + } + + /* Set up for the next header */ + + reset_point = store_mark(); + header_size = 256; + next = store_get(sizeof(header_line), GET_UNTAINTED); + next->text = store_get(header_size, GET_TAINTED); + ptr = 0; + had_zero = 0; + prevlines_length = 0; + } /* Continue, starting to read the next header */ + +/* At this point, we have read all the headers into a data structure in main +store. The first header is still the dummy placeholder for the Received: header +we are going to generate a bit later on. If next != NULL, it contains the first +data line - which terminated the headers before reaching a blank line (not the +normal case). */ + +DEBUG(D_receive) + { + debug_printf(">>Headers received:\n"); + for (header_line * h = header_list->next; h; h = h->next) + debug_printf("%s", h->text); + debug_printf("\n"); + } + +/* End of file on any SMTP connection is an error. If an incoming SMTP call +is dropped immediately after valid headers, the next thing we will see is EOF. +We must test for this specially, as further down the reading of the data is +skipped if already at EOF. +In CHUNKING mode, a protocol error makes us give up on the message. */ + +if (smtp_input) + if ((receive_feof)()) + { + smtp_reply = handle_lost_connection(US" (after header)"); + smtp_yield = FALSE; + goto TIDYUP; /* Skip to end of function */ + } + else if (message_ended == END_PROTOCOL) + { + smtp_reply = US""; /* no reply needed */ + goto TIDYUP; + } + +/* If this is a filter test run and no headers were read, output a warning +in case there is a mistake in the test message. */ + +if (filter_test != FTEST_NONE && header_list->next == NULL) + printf("Warning: no message headers read\n"); + + +/* Scan the headers to identify them. Some are merely marked for later +processing; some are dealt with here. */ + +for (header_line * h = header_list->next; h; h = h->next) + { + BOOL is_resent = strncmpic(h->text, US"resent-", 7) == 0; + if (is_resent) contains_resent_headers = TRUE; + + switch (header_checkname(h, is_resent)) + { + case htype_bcc: + h->type = htype_bcc; /* Both Bcc: and Resent-Bcc: */ + break; + + case htype_cc: + h->type = htype_cc; /* Both Cc: and Resent-Cc: */ + break; + + /* Record whether a Date: or Resent-Date: header exists, as appropriate. */ + + case htype_date: + if (!resents_exist || is_resent) date_header_exists = TRUE; + break; + + /* Same comments as about Return-Path: below. */ + + case htype_delivery_date: + if (delivery_date_remove) h->type = htype_old; + break; + + /* Same comments as about Return-Path: below. */ + + case htype_envelope_to: + if (envelope_to_remove) h->type = htype_old; + break; + + /* Mark all "From:" headers so they get rewritten. Save the one that is to + be used for Sender: checking. For Sendmail compatibility, if the "From:" + header consists of just the login id of the user who called Exim, rewrite + it with the gecos field first. Apply this rule to Resent-From: if there + are resent- fields. */ + + case htype_from: + h->type = htype_from; + if (!resents_exist || is_resent) + { + from_header = h; + if (!smtp_input) + { + int len; + uschar *s = Ustrchr(h->text, ':') + 1; + while (isspace(*s)) s++; + len = h->slen - (s - h->text) - 1; + if (Ustrlen(originator_login) == len && + strncmpic(s, originator_login, len) == 0) + { + uschar *name = is_resent? US"Resent-From" : US"From"; + header_add(htype_from, "%s: %s <%s@%s>\n", name, originator_name, + originator_login, qualify_domain_sender); + from_header = header_last; + h->type = htype_old; + DEBUG(D_receive|D_rewrite) + debug_printf("rewrote \"%s:\" header using gecos\n", name); + } + } + } + break; + + /* Identify the Message-id: header for generating "in-reply-to" in the + autoreply transport. For incoming logging, save any resent- value. In both + cases, take just the first of any multiples. */ + + case htype_id: + if (!msgid_header && (!resents_exist || is_resent)) + { + msgid_header = h; + h->type = htype_id; + } + break; + + /* Flag all Received: headers */ + + case htype_received: + h->type = htype_received; + received_count++; + break; + + /* "Reply-to:" is just noted (there is no resent-reply-to field) */ + + case htype_reply_to: + h->type = htype_reply_to; + break; + + /* The Return-path: header is supposed to be added to messages when + they leave the SMTP system. We shouldn't receive messages that already + contain Return-path. However, since Exim generates Return-path: on + local delivery, resent messages may well contain it. We therefore + provide an option (which defaults on) to remove any Return-path: headers + on input. Removal actually means flagging as "old", which prevents the + header being transmitted with the message. */ + + case htype_return_path: + if (return_path_remove) h->type = htype_old; + + /* If we are testing a mail filter file, use the value of the + Return-Path: header to set up the return_path variable, which is not + otherwise set. However, remove any <> that surround the address + because the variable doesn't have these. */ + + if (filter_test != FTEST_NONE) + { + uschar *start = h->text + 12; + uschar *end = start + Ustrlen(start); + while (isspace(*start)) start++; + while (end > start && isspace(end[-1])) end--; + if (*start == '<' && end[-1] == '>') + { + start++; + end--; + } + return_path = string_copyn(start, end - start); + printf("Return-path taken from \"Return-path:\" header line\n"); + } + break; + + /* If there is a "Sender:" header and the message is locally originated, + and from an untrusted caller and suppress_local_fixups is not set, or if we + are in submission mode for a remote message, mark it "old" so that it will + not be transmitted with the message, unless active_local_sender_retain is + set. (This can only be true if active_local_from_check is false.) If there + are any resent- headers in the message, apply this rule to Resent-Sender: + instead of Sender:. Messages with multiple resent- header sets cannot be + tidily handled. (For this reason, at least one MUA - Pine - turns old + resent- headers into X-resent- headers when resending, leaving just one + set.) */ + + case htype_sender: + h->type = !f.active_local_sender_retain + && ( f.sender_local && !f.trusted_caller && !f.suppress_local_fixups + || f.submission_mode + ) + && (!resents_exist || is_resent) + ? htype_old : htype_sender; + break; + + /* Remember the Subject: header for logging. There is no Resent-Subject */ + + case htype_subject: + subject_header = h; + break; + + /* "To:" gets flagged, and the existence of a recipient header is noted, + whether it's resent- or not. */ + + case htype_to: + h->type = htype_to; + /**** + to_or_cc_header_exists = TRUE; + ****/ + break; + } + } + +/* Extract recipients from the headers if that is required (the -t option). +Note that this is documented as being done *before* any address rewriting takes +place. There are two possibilities: + +(1) According to sendmail documentation for Solaris, IRIX, and HP-UX, any +recipients already listed are to be REMOVED from the message. Smail 3 works +like this. We need to build a non-recipients tree for that list, because in +subsequent processing this data is held in a tree and that's what the +spool_write_header() function expects. Make sure that non-recipient addresses +are fully qualified and rewritten if necessary. + +(2) According to other sendmail documentation, -t ADDS extracted recipients to +those in the command line arguments (and it is rumoured some other MTAs do +this). Therefore, there is an option to make Exim behave this way. + +*** Notes on "Resent-" header lines *** + +The presence of resent-headers in the message makes -t horribly ambiguous. +Experiments with sendmail showed that it uses recipients for all resent- +headers, totally ignoring the concept of "sets of resent- headers" as described +in RFC 2822 section 3.6.6. Sendmail also amalgamates them into a single set +with all the addresses in one instance of each header. + +This seems to me not to be at all sensible. Before release 4.20, Exim 4 gave an +error for -t if there were resent- headers in the message. However, after a +discussion on the mailing list, I've learned that there are MUAs that use +resent- headers with -t, and also that the stuff about sets of resent- headers +and their ordering in RFC 2822 is generally ignored. An MUA that submits a +message with -t and resent- header lines makes sure that only *its* resent- +headers are present; previous ones are often renamed as X-resent- for example. + +Consequently, Exim has been changed so that, if any resent- header lines are +present, the recipients are taken from all of the appropriate resent- lines, +and not from the ordinary To:, Cc:, etc. */ + +if (extract_recip) + { + int rcount = 0; + error_block **bnext = &bad_addresses; + + if (extract_addresses_remove_arguments) + { + while (recipients_count-- > 0) + { + const uschar * s = rewrite_address(recipients_list[recipients_count].address, + TRUE, TRUE, global_rewrite_rules, rewrite_existflags); + tree_add_nonrecipient(s); + } + recipients_list = NULL; + recipients_count = recipients_list_max = 0; + } + + /* Now scan the headers */ + + for (header_line * h = header_list->next; h; h = h->next) + { + if ((h->type == htype_to || h->type == htype_cc || h->type == htype_bcc) && + (!contains_resent_headers || strncmpic(h->text, US"resent-", 7) == 0)) + { + uschar *s = Ustrchr(h->text, ':') + 1; + while (isspace(*s)) s++; + + f.parse_allow_group = TRUE; /* Allow address group syntax */ + + while (*s != 0) + { + uschar *ss = parse_find_address_end(s, FALSE); + uschar *recipient, *errmess, *pp; + int start, end, domain; + + /* Check on maximum */ + + if (recipients_max > 0 && ++rcount > recipients_max) + give_local_error(ERRMESS_TOOMANYRECIP, US"too many recipients", + US"message rejected: ", error_rc, stdin, NULL); + /* Does not return */ + + /* Make a copy of the address, and remove any internal newlines. These + may be present as a result of continuations of the header line. The + white space that follows the newline must not be removed - it is part + of the header. */ + + pp = recipient = store_get(ss - s + 1, s); + for (uschar * p = s; p < ss; p++) if (*p != '\n') *pp++ = *p; + *pp = 0; + +#ifdef SUPPORT_I18N + { + BOOL b = allow_utf8_domains; + allow_utf8_domains = TRUE; +#endif + recipient = parse_extract_address(recipient, &errmess, &start, &end, + &domain, FALSE); + +#ifdef SUPPORT_I18N + if (recipient) + if (string_is_utf8(recipient)) message_smtputf8 = TRUE; + else allow_utf8_domains = b; + } +#else + ; +#endif + + /* Keep a list of all the bad addresses so we can send a single + error message at the end. However, an empty address is not an error; + just ignore it. This can come from an empty group list like + + To: Recipients of list:; + + If there are no recipients at all, an error will occur later. */ + + if (!recipient && Ustrcmp(errmess, "empty address") != 0) + { + int len = Ustrlen(s); + error_block * b = store_get(sizeof(error_block), GET_UNTAINTED); + while (len > 0 && isspace(s[len-1])) len--; + b->next = NULL; + b->text1 = string_printing(string_copyn(s, len)); + b->text2 = errmess; + *bnext = b; + bnext = &(b->next); + } + + /* If the recipient is already in the nonrecipients tree, it must + have appeared on the command line with the option extract_addresses_ + remove_arguments set. Do not add it to the recipients, and keep a note + that this has happened, in order to give a better error if there are + no recipients left. */ + + else if (recipient != NULL) + { + if (tree_search(tree_nonrecipients, recipient) == NULL) + receive_add_recipient(recipient, -1); + else + extracted_ignored = TRUE; + } + + /* Move on past this address */ + + s = ss + (*ss? 1:0); + while (isspace(*s)) s++; + } /* Next address */ + + f.parse_allow_group = FALSE; /* Reset group syntax flags */ + f.parse_found_group = FALSE; + + /* If this was the bcc: header, mark it "old", which means it + will be kept on the spool, but not transmitted as part of the + message. */ + + if (h->type == htype_bcc) h->type = htype_old; + } /* For appropriate header line */ + } /* For each header line */ + + } + +/* Now build the unique message id. This has changed several times over the +lifetime of Exim. This description was rewritten for Exim 4.14 (February 2003). +Retaining all the history in the comment has become too unwieldy - read +previous release sources if you want it. + +The message ID has 3 parts: tttttt-pppppp-ss. Each part is a number in base 62. +The first part is the current time, in seconds. The second part is the current +pid. Both are large enough to hold 32-bit numbers in base 62. The third part +can hold a number in the range 0-3843. It used to be a computed sequence +number, but is now the fractional component of the current time in units of +1/2000 of a second (i.e. a value in the range 0-1999). After a message has been +received, Exim ensures that the timer has ticked at the appropriate level +before proceeding, to avoid duplication if the pid happened to be re-used +within the same time period. It seems likely that most messages will take at +least half a millisecond to be received, so no delay will normally be +necessary. At least for some time... + +There is a modification when localhost_number is set. Formerly this was allowed +to be as large as 255. Now it is restricted to the range 0-16, and the final +component of the message id becomes (localhost_number * 200) + fractional time +in units of 1/200 of a second (i.e. a value in the range 0-3399). + +Some not-really-Unix operating systems use case-insensitive file names (Darwin, +Cygwin). For these, we have to use base 36 instead of base 62. Luckily, this +still allows the tttttt field to hold a large enough number to last for some +more decades, and the final two-digit field can hold numbers up to 1295, which +is enough for milliseconds (instead of 1/2000 of a second). + +However, the pppppp field cannot hold a 32-bit pid, but it can hold a 31-bit +pid, so it is probably safe because pids have to be positive. The +localhost_number is restricted to 0-10 for these hosts, and when it is set, the +final field becomes (localhost_number * 100) + fractional time in centiseconds. + +Note that string_base62() returns its data in a static storage block, so it +must be copied before calling string_base62() again. It always returns exactly +6 characters. + +There doesn't seem to be anything in the RFC which requires a message id to +start with a letter, but Smail was changed to ensure this. The external form of +the message id (as supplied by string expansion) therefore starts with an +additional leading 'E'. The spool file names do not include this leading +letter and it is not used internally. + +NOTE: If ever the format of message ids is changed, the regular expression for +checking that a string is in this format must be updated in a corresponding +way. It appears in the initializing code in exim.c. The macro MESSAGE_ID_LENGTH +must also be changed to reflect the correct string length. The queue-sort code +needs to know the layout. Then, of course, other programs that rely on the +message id format will need updating too. */ + +Ustrncpy(message_id, string_base62((long int)(message_id_tv.tv_sec)), 6); +message_id[6] = '-'; +Ustrncpy(message_id + 7, string_base62((long int)getpid()), 6); + +/* Deal with the case where the host number is set. The value of the number was +checked when it was read, to ensure it isn't too big. */ + +if (host_number_string) + sprintf(CS(message_id + MESSAGE_ID_LENGTH - 3), "-%2s", + string_base62((long int)( + host_number * (1000000/id_resolution) + + message_id_tv.tv_usec/id_resolution)) + 4); + +/* Host number not set: final field is just the fractional time at an +appropriate resolution. */ + +else + sprintf(CS(message_id + MESSAGE_ID_LENGTH - 3), "-%2s", + string_base62((long int)(message_id_tv.tv_usec/id_resolution)) + 4); + +/* Add the current message id onto the current process info string if +it will fit. */ + +(void)string_format(process_info + process_info_len, + PROCESS_INFO_SIZE - process_info_len, " id=%s", message_id); + +/* If we are using multiple input directories, set up the one for this message +to be the least significant base-62 digit of the time of arrival. Otherwise +ensure that it is an empty string. */ + +set_subdir_str(message_subdir, message_id, 0); + +/* Now that we have the message-id, if there is no message-id: header, generate +one, but only for local (without suppress_local_fixups) or submission mode +messages. This can be user-configured if required, but we had better flatten +any illegal characters therein. */ + +if ( !msgid_header + && ((!sender_host_address && !f.suppress_local_fixups) || f.submission_mode)) + { + uschar *id_text = US""; + uschar *id_domain = primary_hostname; + header_line * h; + + /* Permit only letters, digits, dots, and hyphens in the domain */ + + if (message_id_domain) + { + uschar *new_id_domain = expand_string(message_id_domain); + if (!new_id_domain) + { + if (!f.expand_string_forcedfail) + log_write(0, LOG_MAIN|LOG_PANIC, + "expansion of \"%s\" (message_id_header_domain) " + "failed: %s", message_id_domain, expand_string_message); + } + else if (*new_id_domain) + { + id_domain = new_id_domain; + for (uschar * p = id_domain; *p; p++) + if (!isalnum(*p) && *p != '.') *p = '-'; /* No need to test '-' ! */ + } + } + + /* Permit all characters except controls and RFC 2822 specials in the + additional text part. */ + + if (message_id_text) + { + uschar *new_id_text = expand_string(message_id_text); + if (!new_id_text) + { + if (!f.expand_string_forcedfail) + log_write(0, LOG_MAIN|LOG_PANIC, + "expansion of \"%s\" (message_id_header_text) " + "failed: %s", message_id_text, expand_string_message); + } + else if (*new_id_text) + { + id_text = new_id_text; + for (uschar * p = id_text; *p; p++) if (mac_iscntrl_or_special(*p)) *p = '-'; + } + } + + /* Add the header line. + Resent-* headers are prepended, per RFC 5322 3.6.6. Non-Resent-* are + appended, to preserve classical expectations of header ordering. */ + + h = header_add_at_position_internal(!resents_exist, NULL, FALSE, htype_id, + "%sMessage-Id: <%s%s%s@%s>\n", resent_prefix, message_id_external, + *id_text == 0 ? "" : ".", id_text, id_domain); + + /* Arrange for newly-created Message-Id to be logged */ + + if (!resents_exist) + { + msgid_header_newly_created = TRUE; + msgid_header = h; + } + } + +/* If we are to log recipients, keep a copy of the raw ones before any possible +rewriting. Must copy the count, because later ACLs and the local_scan() +function may mess with the real recipients. */ + +if (LOGGING(received_recipients)) + { + raw_recipients = store_get(recipients_count * sizeof(uschar *), GET_UNTAINTED); + for (int i = 0; i < recipients_count; i++) + raw_recipients[i] = string_copy(recipients_list[i].address); + raw_recipients_count = recipients_count; + } + +/* Ensure the recipients list is fully qualified and rewritten. Unqualified +recipients will get here only if the conditions were right (allow_unqualified_ +recipient is TRUE). */ + +DEBUG(D_rewrite) + { debug_printf_indent("qualify & rewrite recipients list\n"); acl_level++; } +for (int i = 0; i < recipients_count; i++) + recipients_list[i].address = /* deconst ok as src was not cont */ + US rewrite_address(recipients_list[i].address, TRUE, TRUE, + global_rewrite_rules, rewrite_existflags); +DEBUG(D_rewrite) acl_level--; + +/* If there is no From: header, generate one for local (without +suppress_local_fixups) or submission_mode messages. If there is no sender +address, but the sender is local or this is a local delivery error, use the +originator login. This shouldn't happen for genuine bounces, but might happen +for autoreplies. The addition of From: must be done *before* checking for the +possible addition of a Sender: header, because untrusted_set_sender allows an +untrusted user to set anything in the envelope (which might then get info +From:) but we still want to ensure a valid Sender: if it is required. */ + +if ( !from_header + && ((!sender_host_address && !f.suppress_local_fixups) || f.submission_mode)) + { + const uschar * oname = US""; + + /* Use the originator_name if this is a locally submitted message and the + caller is not trusted. For trusted callers, use it only if -F was used to + force its value or if we have a non-SMTP message for which -f was not used + to set the sender. */ + + if (!sender_host_address) + { + if (!f.trusted_caller || f.sender_name_forced || + (!smtp_input && !f.sender_address_forced)) + oname = originator_name; + } + + /* For non-locally submitted messages, the only time we use the originator + name is when it was forced by the /name= option on control=submission. */ + + else if (submission_name) oname = submission_name; + + /* Envelope sender is empty */ + + if (!*sender_address) + { + uschar *fromstart, *fromend; + + fromstart = string_sprintf("%sFrom: %s%s", + resent_prefix, oname, *oname ? " <" : ""); + fromend = *oname ? US">" : US""; + + if (f.sender_local || f.local_error_message) + header_add(htype_from, "%s%s@%s%s\n", fromstart, + local_part_quote(originator_login), qualify_domain_sender, + fromend); + + else if (f.submission_mode && authenticated_id) + { + if (!submission_domain) + header_add(htype_from, "%s%s@%s%s\n", fromstart, + local_part_quote(authenticated_id), qualify_domain_sender, + fromend); + + else if (!*submission_domain) /* empty => whole address set */ + header_add(htype_from, "%s%s%s\n", fromstart, authenticated_id, + fromend); + + else + header_add(htype_from, "%s%s@%s%s\n", fromstart, + local_part_quote(authenticated_id), submission_domain, fromend); + + from_header = header_last; /* To get it checked for Sender: */ + } + } + + /* There is a non-null envelope sender. Build the header using the original + sender address, before any rewriting that might have been done while + verifying it. */ + + else + { + header_add(htype_from, "%sFrom: %s%s%s%s\n", resent_prefix, + oname, + *oname ? " <" : "", + sender_address_unrewritten ? sender_address_unrewritten : sender_address, + *oname ? ">" : ""); + + from_header = header_last; /* To get it checked for Sender: */ + } + } + + +/* If the sender is local (without suppress_local_fixups), or if we are in +submission mode and there is an authenticated_id, check that an existing From: +is correct, and if not, generate a Sender: header, unless disabled. Any +previously-existing Sender: header was removed above. Note that sender_local, +as well as being TRUE if the caller of exim is not trusted, is also true if a +trusted caller did not supply a -f argument for non-smtp input. To allow +trusted callers to forge From: without supplying -f, we have to test explicitly +here. If the From: header contains more than one address, then the call to +parse_extract_address fails, and a Sender: header is inserted, as required. */ + +if ( from_header + && ( f.active_local_from_check + && ( f.sender_local && !f.trusted_caller && !f.suppress_local_fixups + || f.submission_mode && authenticated_id + ) ) ) + { + BOOL make_sender = TRUE; + int start, end, domain; + uschar *errmess; + uschar *from_address = + parse_extract_address(Ustrchr(from_header->text, ':') + 1, &errmess, + &start, &end, &domain, FALSE); + uschar *generated_sender_address; + + generated_sender_address = f.submission_mode + ? !submission_domain + ? string_sprintf("%s@%s", + local_part_quote(authenticated_id), qualify_domain_sender) + : !*submission_domain /* empty => full address */ + ? string_sprintf("%s", authenticated_id) + : string_sprintf("%s@%s", + local_part_quote(authenticated_id), submission_domain) + : string_sprintf("%s@%s", + local_part_quote(originator_login), qualify_domain_sender); + + /* Remove permitted prefixes and suffixes from the local part of the From: + address before doing the comparison with the generated sender. */ + + if (from_address) + { + int slen; + uschar *at = domain ? from_address + domain - 1 : NULL; + + if (at) *at = 0; + from_address += route_check_prefix(from_address, local_from_prefix, NULL); + if ((slen = route_check_suffix(from_address, local_from_suffix, NULL)) > 0) + { + memmove(from_address+slen, from_address, Ustrlen(from_address)-slen); + from_address += slen; + } + if (at) *at = '@'; + + if ( strcmpic(generated_sender_address, from_address) == 0 + || (!domain && strcmpic(from_address, originator_login) == 0)) + make_sender = FALSE; + } + + /* We have to cause the Sender header to be rewritten if there are + appropriate rewriting rules. */ + + if (make_sender) + if (f.submission_mode && !submission_name) + header_add(htype_sender, "%sSender: %s\n", resent_prefix, + generated_sender_address); + else + header_add(htype_sender, "%sSender: %s <%s>\n", + resent_prefix, + f.submission_mode ? submission_name : originator_name, + generated_sender_address); + + /* Ensure that a non-null envelope sender address corresponds to the + submission mode sender address. */ + + if (f.submission_mode && *sender_address) + { + if (!sender_address_unrewritten) + sender_address_unrewritten = sender_address; + sender_address = generated_sender_address; + if (Ustrcmp(sender_address_unrewritten, generated_sender_address) != 0) + log_write(L_address_rewrite, LOG_MAIN, + "\"%s\" from env-from rewritten as \"%s\" by submission mode", + sender_address_unrewritten, generated_sender_address); + } + } + +/* If there are any rewriting rules, apply them to the sender address, unless +it has already been rewritten as part of verification for SMTP input. */ + +DEBUG(D_rewrite) + { debug_printf("global rewrite rules\n"); acl_level++; } +if (global_rewrite_rules && !sender_address_unrewritten && *sender_address) + { + /* deconst ok as src was not const */ + sender_address = US rewrite_address(sender_address, FALSE, TRUE, + global_rewrite_rules, rewrite_existflags); + DEBUG(D_receive|D_rewrite) + debug_printf("rewritten sender = %s\n", sender_address); + } +DEBUG(D_rewrite) acl_level--; + + +/* The headers must be run through rewrite_header(), because it ensures that +addresses are fully qualified, as well as applying any rewriting rules that may +exist. + +Qualification of header addresses in a message from a remote host happens only +if the host is in sender_unqualified_hosts or recipient_unqualified hosts, as +appropriate. For local messages, qualification always happens, unless -bnq is +used to explicitly suppress it. No rewriting is done for an unqualified address +that is left untouched. + +We start at the second header, skipping our own Received:. This rewriting is +documented as happening *after* recipient addresses are taken from the headers +by the -t command line option. An added Sender: gets rewritten here. */ + +DEBUG(D_rewrite) + { debug_printf("rewrite headers\n"); acl_level++; } +for (header_line * h = header_list->next, * newh; h; h = h->next) + if ((newh = rewrite_header(h, NULL, NULL, global_rewrite_rules, + rewrite_existflags, TRUE))) + h = newh; +DEBUG(D_rewrite) acl_level--; + + +/* An RFC 822 (sic) message is not legal unless it has at least one of "to", +"cc", or "bcc". Note that although the minimal examples in RFC 822 show just +"to" or "bcc", the full syntax spec allows "cc" as well. If any resent- header +exists, this applies to the set of resent- headers rather than the normal set. + +The requirement for a recipient header has been removed in RFC 2822. At this +point in the code, earlier versions of Exim added a To: header for locally +submitted messages, and an empty Bcc: header for others. In the light of the +changes in RFC 2822, this was dropped in November 2003. */ + + +/* If there is no date header, generate one if the message originates locally +(i.e. not over TCP/IP) and suppress_local_fixups is not set, or if the +submission mode flag is set. Messages without Date: are not valid, but it seems +to be more confusing if Exim adds one to all remotely-originated messages. +As per Message-Id, we prepend if resending, else append. +*/ + +if ( !date_header_exists + && ((!sender_host_address && !f.suppress_local_fixups) || f.submission_mode)) + header_add_at_position(!resents_exist, NULL, FALSE, htype_other, + "%sDate: %s\n", resent_prefix, tod_stamp(tod_full)); + +search_tidyup(); /* Free any cached resources */ + +/* Show the complete set of headers if debugging. Note that the first one (the +new Received:) has not yet been set. */ + +DEBUG(D_receive) + { + debug_printf(">>Headers after rewriting and local additions:\n"); + for (header_line * h = header_list->next; h; h = h->next) + debug_printf("%c %s", h->type, h->text); + debug_printf("\n"); + } + +/* The headers are now complete in store. If we are running in filter +testing mode, that is all this function does. Return TRUE if the message +ended with a dot. */ + +if (filter_test != FTEST_NONE) + { + process_info[process_info_len] = 0; + return message_ended == END_DOT; + } + +/*XXX CHUNKING: need to cancel cutthrough under BDAT, for now. In future, +think more if it could be handled. Cannot do onward CHUNKING unless +inbound is, but inbound chunking ought to be ok with outbound plain. +Could we do onward CHUNKING given inbound CHUNKING? +*/ +if (chunking_state > CHUNKING_OFFERED) + cancel_cutthrough_connection(FALSE, US"chunking active"); + +/* Cutthrough delivery: +We have to create the Received header now rather than at the end of reception, +so the timestamp behaviour is a change to the normal case. +Having created it, send the headers to the destination. */ + +if (cutthrough.cctx.sock >= 0 && cutthrough.delivery) + { + if (received_count > received_headers_max) + { + cancel_cutthrough_connection(TRUE, US"too many headers"); + if (smtp_input) receive_swallow_smtp(); /* Swallow incoming SMTP */ + log_write(0, LOG_MAIN|LOG_REJECT, "rejected from <%s>%s%s%s%s: " + "Too many \"Received\" headers", + sender_address, + sender_fullhost ? "H=" : "", sender_fullhost ? sender_fullhost : US"", + sender_ident ? "U=" : "", sender_ident ? sender_ident : US""); + message_id[0] = 0; /* Indicate no message accepted */ + smtp_reply = US"550 Too many \"Received\" headers - suspected mail loop"; + goto TIDYUP; /* Skip to end of function */ + } + received_header_gen(); + add_acl_headers(ACL_WHERE_RCPT, US"MAIL or RCPT"); + (void) cutthrough_headers_send(); + } + + +/* Open a new spool file for the data portion of the message. We need +to access it both via a file descriptor and a stream. Try to make the +directory if it isn't there. */ + +spool_name = spool_fname(US"input", message_subdir, message_id, US"-D"); +DEBUG(D_receive) debug_printf("Data file name: %s\n", spool_name); + +if ((data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE)) < 0) + { + if (errno == ENOENT) + { + (void) directory_make(spool_directory, + spool_sname(US"input", message_subdir), + INPUT_DIRECTORY_MODE, TRUE); + data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE); + } + if (data_fd < 0) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Failed to create spool file %s: %s", + spool_name, strerror(errno)); + } + +/* Make sure the file's group is the Exim gid, and double-check the mode +because the group setting doesn't always get set automatically. */ + +if (0 != exim_fchown(data_fd, exim_uid, exim_gid, spool_name)) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, + "Failed setting ownership on spool file %s: %s", + spool_name, strerror(errno)); +(void)fchmod(data_fd, SPOOL_MODE); + +/* We now have data file open. Build a stream for it and lock it. We lock only +the first line of the file (containing the message ID) because otherwise there +are problems when Exim is run under Cygwin (I'm told). See comments in +spool_in.c, where the same locking is done. */ + +spool_data_file = fdopen(data_fd, "w+"); +lock_data.l_type = F_WRLCK; +lock_data.l_whence = SEEK_SET; +lock_data.l_start = 0; +lock_data.l_len = SPOOL_DATA_START_OFFSET; + +if (fcntl(data_fd, F_SETLK, &lock_data) < 0) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Cannot lock %s (%d): %s", spool_name, + errno, strerror(errno)); + +/* We have an open, locked data file. Write the message id to it to make it +self-identifying. Then read the remainder of the input of this message and +write it to the data file. If the variable next != NULL, it contains the first +data line (which was read as a header but then turned out not to have the right +format); write it (remembering that it might contain binary zeros). The result +of fwrite() isn't inspected; instead we call ferror() below. */ + +fprintf(spool_data_file, "%s-D\n", message_id); +if (next) + { + uschar *s = next->text; + int len = next->slen; + if (fwrite(s, 1, len, spool_data_file) == len) /* "if" for compiler quietening */ + body_linecount++; /* Assumes only 1 line */ + } + +/* Note that we might already be at end of file, or the logical end of file +(indicated by '.'), or might have encountered an error while writing the +message id or "next" line. */ + +if (!ferror(spool_data_file) && !(receive_feof)() && message_ended != END_DOT) + { + if (smtp_input) + { + message_ended = chunking_state <= CHUNKING_OFFERED + ? read_message_data_smtp(spool_data_file) + : spool_wireformat + ? read_message_bdat_smtp_wire(spool_data_file) + : read_message_bdat_smtp(spool_data_file); + receive_linecount++; /* The terminating "." line */ + } + else + message_ended = read_message_data(spool_data_file); + + receive_linecount += body_linecount; /* For BSMTP errors mainly */ + message_linecount += body_linecount; + + switch (message_ended) + { + /* Handle premature termination of SMTP */ + + case END_EOF: + if (smtp_input) + { + Uunlink(spool_name); /* Lose data file when closed */ + cancel_cutthrough_connection(TRUE, US"sender closed connection"); + message_id[0] = 0; /* Indicate no message accepted */ + smtp_reply = handle_lost_connection(US""); + smtp_yield = FALSE; + goto TIDYUP; /* Skip to end of function */ + } + break; + + /* Handle message that is too big. Don't use host_or_ident() in the log + message; we want to see the ident value even for non-remote messages. */ + + case END_SIZE: + Uunlink(spool_name); /* Lose the data file when closed */ + cancel_cutthrough_connection(TRUE, US"mail too big"); + if (smtp_input) receive_swallow_smtp(); /* Swallow incoming SMTP */ + + log_write(L_size_reject, LOG_MAIN|LOG_REJECT, "rejected from <%s>%s%s%s%s: " + "message too big: read=%d max=%d", + sender_address, + sender_fullhost ? " H=" : "", + sender_fullhost ? sender_fullhost : US"", + sender_ident ? " U=" : "", + sender_ident ? sender_ident : US"", + message_size, + thismessage_size_limit); + + if (smtp_input) + { + smtp_reply = US"552 Message size exceeds maximum permitted"; + message_id[0] = 0; /* Indicate no message accepted */ + goto TIDYUP; /* Skip to end of function */ + } + else + { + fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET); + give_local_error(ERRMESS_TOOBIG, + string_sprintf("message too big (max=%d)", thismessage_size_limit), + US"message rejected: ", error_rc, spool_data_file, header_list); + /* Does not return */ + } + break; + + /* Handle bad BDAT protocol sequence */ + + case END_PROTOCOL: + Uunlink(spool_name); /* Lose the data file when closed */ + cancel_cutthrough_connection(TRUE, US"sender protocol error"); + smtp_reply = US""; /* Response already sent */ + message_id[0] = 0; /* Indicate no message accepted */ + goto TIDYUP; /* Skip to end of function */ + } + } + +/* Restore the standard SIGALRM handler for any subsequent processing. (For +example, there may be some expansion in an ACL that uses a timer.) */ + +os_non_restarting_signal(SIGALRM, sigalrm_handler); + +/* The message body has now been read into the data file. Call fflush() to +empty the buffers in C, and then call fsync() to get the data written out onto +the disk, as fflush() doesn't do this (or at least, it isn't documented as +having to do this). If there was an I/O error on either input or output, +attempt to send an error message, and unlink the spool file. For non-SMTP input +we can then give up. Note that for SMTP input we must swallow the remainder of +the input in cases of output errors, since the far end doesn't expect to see +anything until the terminating dot line is sent. */ + +if (fflush(spool_data_file) == EOF || ferror(spool_data_file) || + EXIMfsync(fileno(spool_data_file)) < 0 || (receive_ferror)()) + { + uschar *msg_errno = US strerror(errno); + BOOL input_error = (receive_ferror)() != 0; + uschar *msg = string_sprintf("%s error (%s) while receiving message from %s", + input_error? "Input read" : "Spool write", + msg_errno, + sender_fullhost ? sender_fullhost : sender_ident); + + log_write(0, LOG_MAIN, "Message abandoned: %s", msg); + Uunlink(spool_name); /* Lose the data file */ + cancel_cutthrough_connection(TRUE, US"error writing spoolfile"); + + if (smtp_input) + { + if (input_error) + smtp_reply = US"451 Error while reading input data"; + else + { + smtp_reply = US"451 Error while writing spool file"; + receive_swallow_smtp(); + } + message_id[0] = 0; /* Indicate no message accepted */ + goto TIDYUP; /* Skip to end of function */ + } + + else + { + fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET); + give_local_error(ERRMESS_IOERR, msg, US"", error_rc, spool_data_file, + header_list); + /* Does not return */ + } + } + + +/* No I/O errors were encountered while writing the data file. */ + +DEBUG(D_receive) debug_printf("Data file written for message %s\n", message_id); +gettimeofday(&received_time_complete, NULL); + + +/* If there were any bad addresses extracted by -t, or there were no recipients +left after -t, send a message to the sender of this message, or write it to +stderr if the error handling option is set that way. Note that there may +legitimately be no recipients for an SMTP message if they have all been removed +by "discard". + +We need to rewind the data file in order to read it. In the case of no +recipients or stderr error writing, throw the data file away afterwards, and +exit. (This can't be SMTP, which always ensures there's at least one +syntactically good recipient address.) */ + +if (extract_recip && (bad_addresses || recipients_count == 0)) + { + DEBUG(D_receive) + { + if (recipients_count == 0) debug_printf("*** No recipients\n"); + if (bad_addresses) + { + debug_printf("*** Bad address(es)\n"); + for (error_block * eblock = bad_addresses; eblock; eblock = eblock->next) + debug_printf(" %s: %s\n", eblock->text1, eblock->text2); + } + } + + log_write(0, LOG_MAIN|LOG_PANIC, "%s %s found in headers", + message_id, bad_addresses ? "bad addresses" : "no recipients"); + + fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET); + + /* If configured to send errors to the sender, but this fails, force + a failure error code. We use a special one for no recipients so that it + can be detected by the autoreply transport. Otherwise error_rc is set to + errors_sender_rc, which is EXIT_FAILURE unless -oee was given, in which case + it is EXIT_SUCCESS. */ + + if (error_handling == ERRORS_SENDER) + { + if (!moan_to_sender( + bad_addresses + ? recipients_list ? ERRMESS_BADADDRESS : ERRMESS_BADNOADDRESS + : extracted_ignored ? ERRMESS_IGADDRESS : ERRMESS_NOADDRESS, + bad_addresses, header_list, spool_data_file, FALSE + ) ) + error_rc = bad_addresses ? EXIT_FAILURE : EXIT_NORECIPIENTS; + } + else + { + if (!bad_addresses) + if (extracted_ignored) + fprintf(stderr, "exim: all -t recipients overridden by command line\n"); + else + fprintf(stderr, "exim: no recipients in message\n"); + else + { + fprintf(stderr, "exim: invalid address%s", + bad_addresses->next ? "es:\n" : ":"); + for ( ; bad_addresses; bad_addresses = bad_addresses->next) + fprintf(stderr, " %s: %s\n", bad_addresses->text1, + bad_addresses->text2); + } + } + + if (recipients_count == 0 || error_handling == ERRORS_STDERR) + { + Uunlink(spool_name); + (void)fclose(spool_data_file); + exim_exit(error_rc); + } + } + +/* Data file successfully written. Generate text for the Received: header by +expanding the configured string, and adding a timestamp. By leaving this +operation till now, we ensure that the timestamp is the time that message +reception was completed. However, this is deliberately done before calling the +data ACL and local_scan(). + +This Received: header may therefore be inspected by the data ACL and by code in +the local_scan() function. When they have run, we update the timestamp to be +the final time of reception. + +If there is just one recipient, set up its value in the $received_for variable +for use when we generate the Received: header. + +Note: the checking for too many Received: headers is handled by the delivery +code. */ +/*XXX eventually add excess Received: check for cutthrough case back when classifying them */ + +if (!received_header->text) /* Non-cutthrough case */ + { + received_header_gen(); + + /* Set the value of message_body_size for the DATA ACL and for local_scan() */ + + message_body_size = (fstat(data_fd, &statbuf) == 0)? + statbuf.st_size - SPOOL_DATA_START_OFFSET : -1; + + /* If an ACL from any RCPT commands set up any warning headers to add, do so + now, before running the DATA ACL. */ + + add_acl_headers(ACL_WHERE_RCPT, US"MAIL or RCPT"); + } +else + message_body_size = (fstat(data_fd, &statbuf) == 0)? + statbuf.st_size - SPOOL_DATA_START_OFFSET : -1; + +/* If an ACL is specified for checking things at this stage of reception of a +message, run it, unless all the recipients were removed by "discard" in earlier +ACLs. That is the only case in which recipients_count can be zero at this +stage. Set deliver_datafile to point to the data file so that $message_body and +$message_body_end can be extracted if needed. Allow $recipients in expansions. +*/ + +deliver_datafile = data_fd; +user_msg = NULL; + +f.enable_dollar_recipients = TRUE; + +if (recipients_count == 0) + blackholed_by = f.recipients_discarded ? US"MAIL ACL" : US"RCPT ACL"; + +else + { + /* Handle interactive SMTP messages */ + + if (smtp_input && !smtp_batched_input) + { + +#ifndef DISABLE_DKIM + if (!f.dkim_disable_verify) + { + /* Finish verification */ + dkim_exim_verify_finish(); + + /* Check if we must run the DKIM ACL */ + if (acl_smtp_dkim && dkim_verify_signers && *dkim_verify_signers) + { + uschar * dkim_verify_signers_expanded = + expand_string(dkim_verify_signers); + gstring * results = NULL; + int signer_sep = 0; + const uschar * ptr; + uschar * item; + gstring * seen_items = NULL; + int old_pool = store_pool; + + store_pool = POOL_PERM; /* Allow created variables to live to data ACL */ + + if (!(ptr = dkim_verify_signers_expanded)) + log_write(0, LOG_MAIN|LOG_PANIC, + "expansion of dkim_verify_signers option failed: %s", + expand_string_message); + + /* Default to OK when no items are present */ + rc = OK; + while ((item = string_nextinlist(&ptr, &signer_sep, NULL, 0))) + { + /* Prevent running ACL for an empty item */ + if (!item || !*item) continue; + + /* Only run ACL once for each domain or identity, + no matter how often it appears in the expanded list. */ + if (seen_items) + { + uschar * seen_item; + const uschar * seen_items_list = string_from_gstring(seen_items); + int seen_sep = ':'; + BOOL seen_this_item = FALSE; + + while ((seen_item = string_nextinlist(&seen_items_list, &seen_sep, + NULL, 0))) + if (Ustrcmp(seen_item,item) == 0) + { + seen_this_item = TRUE; + break; + } + + if (seen_this_item) + { + DEBUG(D_receive) + debug_printf("acl_smtp_dkim: skipping signer %s, " + "already seen\n", item); + continue; + } + + seen_items = string_catn(seen_items, US":", 1); + } + seen_items = string_cat(seen_items, item); + + rc = dkim_exim_acl_run(item, &results, &user_msg, &log_msg); + if (rc != OK) + { + DEBUG(D_receive) + debug_printf("acl_smtp_dkim: acl_check returned %d on %s, " + "skipping remaining items\n", rc, item); + cancel_cutthrough_connection(TRUE, US"dkim acl not ok"); + break; + } + } + dkim_verify_status = string_from_gstring(results); + store_pool = old_pool; + add_acl_headers(ACL_WHERE_DKIM, US"DKIM"); + if (rc == DISCARD) + { + recipients_count = 0; + blackholed_by = US"DKIM ACL"; + if (log_msg) + blackhole_log_msg = string_sprintf(": %s", log_msg); + } + else if (rc != OK) + { + Uunlink(spool_name); + if (smtp_handle_acl_fail(ACL_WHERE_DKIM, rc, user_msg, log_msg) != 0) + smtp_yield = FALSE; /* No more messages after dropped connection */ + smtp_reply = US""; /* Indicate reply already sent */ + message_id[0] = 0; /* Indicate no message accepted */ + goto TIDYUP; /* Skip to end of function */ + } + } + else + dkim_exim_verify_log_all(); + } +#endif /* DISABLE_DKIM */ + +#ifdef WITH_CONTENT_SCAN + if ( recipients_count > 0 + && acl_smtp_mime + && !run_mime_acl(acl_smtp_mime, &smtp_yield, &smtp_reply, &blackholed_by) + ) + goto TIDYUP; +#endif /* WITH_CONTENT_SCAN */ + +#ifdef SUPPORT_DMARC + dmarc_store_data(from_header); +#endif + +#ifndef DISABLE_PRDR + if (prdr_requested && recipients_count > 1 && acl_smtp_data_prdr) + { + int all_pass = OK; + int all_fail = FAIL; + + smtp_printf("353 PRDR content analysis beginning\r\n", TRUE); + /* Loop through recipients, responses must be in same order received */ + for (unsigned int c = 0; recipients_count > c; c++) + { + uschar * addr= recipients_list[c].address; + uschar * msg= US"PRDR R=<%s> %s"; + uschar * code; + DEBUG(D_receive) + debug_printf("PRDR processing recipient %s (%d of %d)\n", + addr, c+1, recipients_count); + rc = acl_check(ACL_WHERE_PRDR, addr, + acl_smtp_data_prdr, &user_msg, &log_msg); + + /* If any recipient rejected content, indicate it in final message */ + all_pass |= rc; + /* If all recipients rejected, indicate in final message */ + all_fail &= rc; + + switch (rc) + { + case OK: case DISCARD: code = US"250"; break; + case DEFER: code = US"450"; break; + default: code = US"550"; break; + } + if (user_msg != NULL) + smtp_user_msg(code, user_msg); + else + { + switch (rc) + { + case OK: case DISCARD: + msg = string_sprintf(CS msg, addr, "acceptance"); break; + case DEFER: + msg = string_sprintf(CS msg, addr, "temporary refusal"); break; + default: + msg = string_sprintf(CS msg, addr, "refusal"); break; + } + smtp_user_msg(code, msg); + } + if (log_msg) log_write(0, LOG_MAIN, "PRDR %s %s", addr, log_msg); + else if (user_msg) log_write(0, LOG_MAIN, "PRDR %s %s", addr, user_msg); + else log_write(0, LOG_MAIN, "%s", CS msg); + + if (rc != OK) { receive_remove_recipient(addr); c--; } + } + /* Set up final message, used if data acl gives OK */ + smtp_reply = string_sprintf("%s id=%s message %s", + all_fail == FAIL ? US"550" : US"250", + message_id, + all_fail == FAIL + ? US"rejected for all recipients" + : all_pass == OK + ? US"accepted" + : US"accepted for some recipients"); + if (recipients_count == 0) + { + message_id[0] = 0; /* Indicate no message accepted */ + goto TIDYUP; + } + } + else + prdr_requested = FALSE; +#endif /* !DISABLE_PRDR */ + + /* Check the recipients count again, as the MIME ACL might have changed + them. */ + + if (acl_smtp_data != NULL && recipients_count > 0) + { + rc = acl_check(ACL_WHERE_DATA, NULL, acl_smtp_data, &user_msg, &log_msg); + add_acl_headers(ACL_WHERE_DATA, US"DATA"); + if (rc == DISCARD) + { + recipients_count = 0; + blackholed_by = US"DATA ACL"; + if (log_msg) + blackhole_log_msg = string_sprintf(": %s", log_msg); + cancel_cutthrough_connection(TRUE, US"data acl discard"); + } + else if (rc != OK) + { + Uunlink(spool_name); + cancel_cutthrough_connection(TRUE, US"data acl not ok"); +#ifdef WITH_CONTENT_SCAN + unspool_mbox(); +#endif +#ifdef EXPERIMENTAL_DCC + dcc_ok = 0; +#endif + if (smtp_handle_acl_fail(ACL_WHERE_DATA, rc, user_msg, log_msg) != 0) + smtp_yield = FALSE; /* No more messages after dropped connection */ + smtp_reply = US""; /* Indicate reply already sent */ + message_id[0] = 0; /* Indicate no message accepted */ + goto TIDYUP; /* Skip to end of function */ + } + } + } + + /* Handle non-SMTP and batch SMTP (i.e. non-interactive) messages. Note that + we cannot take different actions for permanent and temporary rejections. */ + + else + { + +#ifdef WITH_CONTENT_SCAN + if ( acl_not_smtp_mime + && !run_mime_acl(acl_not_smtp_mime, &smtp_yield, &smtp_reply, + &blackholed_by) + ) + goto TIDYUP; +#endif /* WITH_CONTENT_SCAN */ + + if (acl_not_smtp) + { + uschar *user_msg, *log_msg; + f.authentication_local = TRUE; + rc = acl_check(ACL_WHERE_NOTSMTP, NULL, acl_not_smtp, &user_msg, &log_msg); + if (rc == DISCARD) + { + recipients_count = 0; + blackholed_by = US"non-SMTP ACL"; + if (log_msg) + blackhole_log_msg = string_sprintf(": %s", log_msg); + } + else if (rc != OK) + { + Uunlink(spool_name); +#ifdef WITH_CONTENT_SCAN + unspool_mbox(); +#endif +#ifdef EXPERIMENTAL_DCC + dcc_ok = 0; +#endif + /* The ACL can specify where rejections are to be logged, possibly + nowhere. The default is main and reject logs. */ + + if (log_reject_target) + log_write(0, log_reject_target, "F=<%s> rejected by non-SMTP ACL: %s", + sender_address, log_msg); + + if (!user_msg) user_msg = US"local configuration problem"; + if (smtp_batched_input) + moan_smtp_batch(NULL, "%d %s", 550, user_msg); + /* Does not return */ + else + { + fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET); + give_local_error(ERRMESS_LOCAL_ACL, user_msg, + US"message rejected by non-SMTP ACL: ", error_rc, spool_data_file, + header_list); + /* Does not return */ + } + } + add_acl_headers(ACL_WHERE_NOTSMTP, US"non-SMTP"); + } + } + + /* The applicable ACLs have been run */ + + if (f.deliver_freeze) frozen_by = US"ACL"; /* for later logging */ + if (f.queue_only_policy) queued_by = US"ACL"; + } + +#ifdef WITH_CONTENT_SCAN +unspool_mbox(); +#endif + +#ifdef EXPERIMENTAL_DCC +dcc_ok = 0; +#endif + + +#ifdef HAVE_LOCAL_SCAN +/* The final check on the message is to run the scan_local() function. The +version supplied with Exim always accepts, but this is a hook for sysadmins to +supply their own checking code. The local_scan() function is run even when all +the recipients have been discarded. */ + +lseek(data_fd, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET); + +/* Arrange to catch crashes in local_scan(), so that the -D file gets +deleted, and the incident gets logged. */ + +if (sigsetjmp(local_scan_env, 1) == 0) + { + had_local_scan_crash = 0; + os_non_restarting_signal(SIGSEGV, local_scan_crash_handler); + os_non_restarting_signal(SIGFPE, local_scan_crash_handler); + os_non_restarting_signal(SIGILL, local_scan_crash_handler); + os_non_restarting_signal(SIGBUS, local_scan_crash_handler); + + DEBUG(D_receive) debug_printf("calling local_scan(); timeout=%d\n", + local_scan_timeout); + local_scan_data = NULL; + + had_local_scan_timeout = 0; + os_non_restarting_signal(SIGALRM, local_scan_timeout_handler); + if (local_scan_timeout > 0) ALARM(local_scan_timeout); + rc = local_scan(data_fd, &local_scan_data); + ALARM_CLR(0); + os_non_restarting_signal(SIGALRM, sigalrm_handler); + + f.enable_dollar_recipients = FALSE; + + store_pool = POOL_MAIN; /* In case changed */ + DEBUG(D_receive) debug_printf("local_scan() returned %d %s\n", rc, + local_scan_data); + + os_non_restarting_signal(SIGSEGV, SIG_DFL); + os_non_restarting_signal(SIGFPE, SIG_DFL); + os_non_restarting_signal(SIGILL, SIG_DFL); + os_non_restarting_signal(SIGBUS, SIG_DFL); + } +else + { + if (had_local_scan_crash) + { + log_write(0, LOG_MAIN|LOG_REJECT, "local_scan() function crashed with " + "signal %d - message temporarily rejected (size %d)", + had_local_scan_crash, message_size); + receive_bomb_out(US"local-scan-error", US"local verification problem"); + /* Does not return */ + } + if (had_local_scan_timeout) + { + log_write(0, LOG_MAIN|LOG_REJECT, "local_scan() function timed out - " + "message temporarily rejected (size %d)", message_size); + receive_bomb_out(US"local-scan-timeout", US"local verification problem"); + /* Does not return */ + } + } + +/* The length check is paranoia against some runaway code, and also because +(for a success return) lines in the spool file are read into big_buffer. */ + +if (local_scan_data) + { + int len = Ustrlen(local_scan_data); + if (len > LOCAL_SCAN_MAX_RETURN) len = LOCAL_SCAN_MAX_RETURN; + local_scan_data = string_copyn(local_scan_data, len); + } + +if (rc == LOCAL_SCAN_ACCEPT_FREEZE) + { + if (!f.deliver_freeze) /* ACL might have already frozen */ + { + f.deliver_freeze = TRUE; + deliver_frozen_at = time(NULL); + frozen_by = US"local_scan()"; + } + rc = LOCAL_SCAN_ACCEPT; + } +else if (rc == LOCAL_SCAN_ACCEPT_QUEUE) + { + if (!f.queue_only_policy) /* ACL might have already queued */ + { + f.queue_only_policy = TRUE; + queued_by = US"local_scan()"; + } + rc = LOCAL_SCAN_ACCEPT; + } + +/* Message accepted: remove newlines in local_scan_data because otherwise +the spool file gets corrupted. Ensure that all recipients are qualified. */ + +if (rc == LOCAL_SCAN_ACCEPT) + { + if (local_scan_data) + for (uschar * s = local_scan_data; *s != 0; s++) if (*s == '\n') *s = ' '; + for (int i = 0; i < recipients_count; i++) + { + recipient_item *r = recipients_list + i; + r->address = rewrite_address_qualify(r->address, TRUE); + if (r->errors_to) + r->errors_to = rewrite_address_qualify(r->errors_to, TRUE); + } + if (recipients_count == 0 && !blackholed_by) + blackholed_by = US"local_scan"; + } + +/* Message rejected: newlines permitted in local_scan_data to generate +multiline SMTP responses. */ + +else + { + uschar *istemp = US""; + uschar *smtp_code; + gstring * g; + + errmsg = local_scan_data; + + Uunlink(spool_name); /* Cancel this message */ + switch(rc) + { + default: + log_write(0, LOG_MAIN, "invalid return %d from local_scan(). Temporary " + "rejection given", rc); + goto TEMPREJECT; + + case LOCAL_SCAN_REJECT_NOLOGHDR: + BIT_CLEAR(log_selector, log_selector_size, Li_rejected_header); + /* Fall through */ + + case LOCAL_SCAN_REJECT: + smtp_code = US"550"; + if (!errmsg) errmsg = US"Administrative prohibition"; + break; + + case LOCAL_SCAN_TEMPREJECT_NOLOGHDR: + BIT_CLEAR(log_selector, log_selector_size, Li_rejected_header); + /* Fall through */ + + case LOCAL_SCAN_TEMPREJECT: + TEMPREJECT: + smtp_code = US"451"; + if (!errmsg) errmsg = US"Temporary local problem"; + istemp = US"temporarily "; + break; + } + + g = string_append(NULL, 2, US"F=", + sender_address[0] == 0 ? US"<>" : sender_address); + g = add_host_info_for_log(g); + + log_write(0, LOG_MAIN|LOG_REJECT, "%s %srejected by local_scan(): %.256s", + string_from_gstring(g), istemp, string_printing(errmsg)); + + if (smtp_input) + if (!smtp_batched_input) + { + smtp_respond(smtp_code, 3, TRUE, errmsg); + message_id[0] = 0; /* Indicate no message accepted */ + smtp_reply = US""; /* Indicate reply already sent */ + goto TIDYUP; /* Skip to end of function */ + } + else + moan_smtp_batch(NULL, "%s %s", smtp_code, errmsg); + /* Does not return */ + else + { + fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET); + give_local_error(ERRMESS_LOCAL_SCAN, errmsg, + US"message rejected by local scan code: ", error_rc, spool_data_file, + header_list); + /* Does not return */ + } + } + +/* Reset signal handlers to ignore signals that previously would have caused +the message to be abandoned. */ + +signal(SIGTERM, SIG_IGN); +signal(SIGINT, SIG_IGN); +#endif /* HAVE_LOCAL_SCAN */ + + +/* Ensure the first time flag is set in the newly-received message. */ + +f.deliver_firsttime = TRUE; + +#ifdef EXPERIMENTAL_BRIGHTMAIL +if (bmi_run == 1) + { /* rewind data file */ + lseek(data_fd, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET); + bmi_verdicts = bmi_process_message(header_list, data_fd); + } +#endif + +/* Update the timestamp in our Received: header to account for any time taken by +an ACL or by local_scan(). The new time is the time that all reception +processing is complete. */ + +timestamp = expand_string(US"${tod_full}"); +tslen = Ustrlen(timestamp); + +memcpy(received_header->text + received_header->slen - tslen - 1, + timestamp, tslen); + +/* In MUA wrapper mode, ignore queueing actions set by ACL or local_scan() */ + +if (mua_wrapper) + { + f.deliver_freeze = FALSE; + f.queue_only_policy = FALSE; + } + +/* Keep the data file open until we have written the header file, in order to +hold onto the lock. In a -bh run, or if the message is to be blackholed, we +don't write the header file, and we unlink the data file. If writing the header +file fails, we have failed to accept this message. */ + +if (host_checking || blackholed_by) + { + Uunlink(spool_name); + msg_size = 0; /* Compute size for log line */ + for (header_line * h = header_list; h; h = h->next) + if (h->type != '*') msg_size += h->slen; + } + +/* Write the -H file */ + +else + if ((msg_size = spool_write_header(message_id, SW_RECEIVING, &errmsg)) < 0) + { + log_write(0, LOG_MAIN, "Message abandoned: %s", errmsg); + Uunlink(spool_name); /* Lose the data file */ + + if (smtp_input) + { + smtp_reply = US"451 Error in writing spool file"; + message_id[0] = 0; /* Indicate no message accepted */ + goto TIDYUP; + } + else + { + fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET); + give_local_error(ERRMESS_IOERR, errmsg, US"", error_rc, spool_data_file, + header_list); + /* Does not return */ + } + } + + +/* The message has now been successfully received. */ + +receive_messagecount++; + +/* Add data size to written header size. We do not count the initial file name +that is in the file, but we do add one extra for the notional blank line that +precedes the data. This total differs from message_size in that it include the +added Received: header and any other headers that got created locally. */ + +if (fflush(spool_data_file)) + { + errmsg = string_sprintf("Spool write error: %s", strerror(errno)); + log_write(0, LOG_MAIN, "%s\n", errmsg); + Uunlink(spool_name); /* Lose the data file */ + + if (smtp_input) + { + smtp_reply = US"451 Error in writing spool file"; + message_id[0] = 0; /* Indicate no message accepted */ + goto TIDYUP; + } + else + { + fseek(spool_data_file, (long int)SPOOL_DATA_START_OFFSET, SEEK_SET); + give_local_error(ERRMESS_IOERR, errmsg, US"", error_rc, spool_data_file, + header_list); + /* Does not return */ + } + } +fstat(data_fd, &statbuf); + +msg_size += statbuf.st_size - SPOOL_DATA_START_OFFSET + 1; + +/* Generate a "message received" log entry. We do this by building up a dynamic +string as required. We log the arrival of a new message while the +file is still locked, just in case the machine is *really* fast, and delivers +it first! Include any message id that is in the message - since the syntax of a +message id is actually an addr-spec, we can use the parse routine to canonicalize +it. */ + +rcvd_log_reset_point = store_mark(); +g = string_get(256); + +g = string_append(g, 2, + fake_response == FAIL ? US"(= " : US"<= ", + sender_address[0] == 0 ? US"<>" : sender_address); +if (message_reference) + g = string_append(g, 2, US" R=", message_reference); + +g = add_host_info_for_log(g); + +#ifndef DISABLE_TLS +if (LOGGING(tls_cipher) && tls_in.cipher) + { + g = string_append(g, 2, US" X=", tls_in.cipher); +# ifndef DISABLE_TLS_RESUME + if (LOGGING(tls_resumption) && tls_in.resumption & RESUME_USED) + g = string_catn(g, US"*", 1); +# endif + } +if (LOGGING(tls_certificate_verified) && tls_in.cipher) + g = string_append(g, 2, US" CV=", tls_in.certificate_verified ? "yes":"no"); +if (LOGGING(tls_peerdn) && tls_in.peerdn) + g = string_append(g, 3, US" DN=\"", string_printing(tls_in.peerdn), US"\""); +if (LOGGING(tls_sni) && tls_in.sni) + g = string_append(g, 2, US" SNI=", string_printing2(tls_in.sni, SP_TAB|SP_SPACE)); +#endif + +if (sender_host_authenticated) + { + g = string_append(g, 2, US" A=", sender_host_authenticated); + if (authenticated_id) + { + g = string_append(g, 2, US":", authenticated_id); + if (LOGGING(smtp_mailauth) && authenticated_sender) + g = string_append(g, 2, US":", authenticated_sender); + } + } + +#ifndef DISABLE_PRDR +if (prdr_requested) + g = string_catn(g, US" PRDR", 5); +#endif + +#ifdef SUPPORT_PROXY +if (proxy_session && LOGGING(proxy)) + g = string_append(g, 2, US" PRX=", proxy_local_address); +#endif + +if (chunking_state > CHUNKING_OFFERED) + g = string_catn(g, US" K", 2); + +g = string_fmt_append(g, " S=%d", msg_size); + +/* log 8BITMIME mode announced in MAIL_FROM + 0 ... no BODY= used + 7 ... 7BIT + 8 ... 8BITMIME */ +if (LOGGING(8bitmime)) + g = string_fmt_append(g, " M8S=%d", body_8bitmime); + +#ifndef DISABLE_DKIM +if (LOGGING(dkim) && dkim_verify_overall) + g = string_append(g, 2, US" DKIM=", dkim_verify_overall); +# ifdef EXPERIMENTAL_ARC +if (LOGGING(dkim) && arc_state && Ustrcmp(arc_state, "pass") == 0) + g = string_catn(g, US" ARC", 4); +# endif +#endif + +if (LOGGING(receive_time)) + { + struct timeval diff = received_time_complete; + timediff(&diff, &received_time); + g = string_append(g, 2, US" RT=", string_timediff(&diff)); + } + +if (*queue_name) + g = string_append(g, 2, US" Q=", queue_name); + +/* If an addr-spec in a message-id contains a quoted string, it can contain +any characters except " \ and CR and so in particular it can contain NL! +Therefore, make sure we use a printing-characters only version for the log. +Also, allow for domain literals in the message id. */ + +if ( LOGGING(msg_id) && msgid_header + && (LOGGING(msg_id_created) || !msgid_header_newly_created) + ) + { + uschar * old_id; + BOOL save_allow_domain_literals = allow_domain_literals; + allow_domain_literals = TRUE; + int start, end, domain; + + old_id = parse_extract_address(Ustrchr(msgid_header->text, ':') + 1, + &errmsg, &start, &end, &domain, FALSE); + allow_domain_literals = save_allow_domain_literals; + if (old_id) + g = string_append(g, 2, + msgid_header_newly_created ? US" id*=" : US" id=", + string_printing(old_id)); + } + +/* If subject logging is turned on, create suitable printing-character +text. By expanding $h_subject: we make use of the MIME decoding. */ + +if (LOGGING(subject) && subject_header) + { + uschar *p = big_buffer; + uschar *ss = expand_string(US"$h_subject:"); + + /* Backslash-quote any double quotes or backslashes so as to make a + a C-like string, and turn any non-printers into escape sequences. */ + + *p++ = '\"'; + if (*ss != 0) for (int i = 0; i < 100 && ss[i] != 0; i++) + { + if (ss[i] == '\"' || ss[i] == '\\') *p++ = '\\'; + *p++ = ss[i]; + } + *p++ = '\"'; + *p = 0; + g = string_append(g, 2, US" T=", string_printing(big_buffer)); + } + +/* Terminate the string: string_cat() and string_append() leave room, but do +not put the zero in. */ + +(void) string_from_gstring(g); + +/* Create a message log file if message logs are being used and this message is +not blackholed. Write the reception stuff to it. We used to leave message log +creation until the first delivery, but this has proved confusing for some +people. */ + +if (message_logs && !blackholed_by) + { + int fd; + uschar * m_name = spool_fname(US"msglog", message_subdir, message_id, US""); + + if ( (fd = Uopen(m_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE)) < 0 + && errno == ENOENT + ) + { + (void)directory_make(spool_directory, + spool_sname(US"msglog", message_subdir), + MSGLOG_DIRECTORY_MODE, TRUE); + fd = Uopen(m_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE); + } + + if (fd < 0) + log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't open message log %s: %s", + m_name, strerror(errno)); + else + { + FILE *message_log = fdopen(fd, "a"); + if (!message_log) + { + log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't fdopen message log %s: %s", + m_name, strerror(errno)); + (void)close(fd); + } + else + { + uschar *now = tod_stamp(tod_log); + fprintf(message_log, "%s Received from %s\n", now, g->s+3); + if (f.deliver_freeze) fprintf(message_log, "%s frozen by %s\n", now, + frozen_by); + if (f.queue_only_policy) fprintf(message_log, + "%s no immediate delivery: queued%s%s by %s\n", now, + *queue_name ? " in " : "", *queue_name ? CS queue_name : "", + queued_by); + (void)fclose(message_log); + } + } + } + +/* Everything has now been done for a successful message except logging its +arrival, and outputting an SMTP response. While writing to the log, set a flag +to cause a call to receive_bomb_out() if the log cannot be opened. */ + +f.receive_call_bombout = TRUE; + +/* Before sending an SMTP response in a TCP/IP session, we check to see if the +connection has gone away. This can only be done if there is no unconsumed input +waiting in the local input buffer. We can test for this by calling +receive_hasc(). RFC 2920 (pipelining) explicitly allows for additional +input to be sent following the final dot, so the presence of following input is +not an error. + +If the connection is still present, but there is no unread input for the +socket, the result of a select() call will be zero. If, however, the connection +has gone away, or if there is pending input, the result of select() will be +non-zero. The two cases can be distinguished by trying to read the next input +character. If we succeed, we can unread it so that it remains in the local +buffer for handling later. If not, the connection has been lost. + +Of course, since TCP/IP is asynchronous, there is always a chance that the +connection will vanish between the time of this test and the sending of the +response, but the chance of this happening should be small. */ + +if ( smtp_input && sender_host_address && !f.sender_host_notsocket + && !receive_hasc()) + { + if (poll_one_fd(fileno(smtp_in), POLLIN, 0) != 0) + { + int c = (receive_getc)(GETC_BUFFER_UNLIMITED); + if (c != EOF) (receive_ungetc)(c); + else + { + smtp_notquit_exit(US"connection-lost", NULL, NULL); + smtp_reply = US""; /* No attempt to send a response */ + smtp_yield = FALSE; /* Nothing more on this connection */ + + /* Re-use the log line workspace */ + + g->ptr = 0; + g = string_cat(g, US"SMTP connection lost after final dot"); + g = add_host_info_for_log(g); + log_write(0, LOG_MAIN, "%s", string_from_gstring(g)); + + /* Delete the files for this aborted message. */ + + Uunlink(spool_name); + Uunlink(spool_fname(US"input", message_subdir, message_id, US"-H")); + Uunlink(spool_fname(US"msglog", message_subdir, message_id, US"")); + + goto TIDYUP; + } + } + } + +/* The connection has not gone away; we really are going to take responsibility +for this message. */ + +/* Cutthrough - had sender last-dot; assume we've sent (or bufferred) all + data onward by now. + + Send dot onward. If accepted, wipe the spooled files, log as delivered and accept + the sender's dot (below). + If rejected: copy response to sender, wipe the spooled files, log appropriately. + If temp-reject: normally accept to sender, keep the spooled file - unless defer=pass + in which case pass temp-reject back to initiator and dump the files. + + Having the normal spool files lets us do data-filtering, and store/forward on temp-reject. + + XXX We do not handle queue-only, freezing, or blackholes. +*/ +if(cutthrough.cctx.sock >= 0 && cutthrough.delivery) + { + uschar * msg = cutthrough_finaldot(); /* Ask the target system to accept the message */ + /* Logging was done in finaldot() */ + switch(msg[0]) + { + case '2': /* Accept. Do the same to the source; dump any spoolfiles. */ + cutthrough_done = ACCEPTED; + break; /* message_id needed for SMTP accept below */ + + case '4': /* Temp-reject. Keep spoolfiles and accept, unless defer-pass mode. + ... for which, pass back the exact error */ + if (cutthrough.defer_pass) smtp_reply = string_copy_perm(msg, TRUE); + cutthrough_done = TMP_REJ; /* Avoid the usual immediate delivery attempt */ + break; /* message_id needed for SMTP accept below */ + + default: /* Unknown response, or error. Treat as temp-reject. */ + if (cutthrough.defer_pass) smtp_reply = US"450 Onward transmission not accepted"; + cutthrough_done = TMP_REJ; /* Avoid the usual immediate delivery attempt */ + break; /* message_id needed for SMTP accept below */ + + case '5': /* Perm-reject. Do the same to the source. Dump any spoolfiles */ + smtp_reply = string_copy_perm(msg, TRUE); /* Pass on the exact error */ + cutthrough_done = PERM_REJ; + break; + } + } + +#ifndef DISABLE_PRDR +if(!smtp_reply || prdr_requested) +#else +if(!smtp_reply) +#endif + { + log_write(0, LOG_MAIN | + (LOGGING(received_recipients) ? LOG_RECIPIENTS : 0) | + (LOGGING(received_sender) ? LOG_SENDER : 0), + "%s", g->s); + + /* Log any control actions taken by an ACL or local_scan(). */ + + if (f.deliver_freeze) log_write(0, LOG_MAIN, "frozen by %s", frozen_by); + if (f.queue_only_policy) log_write(L_delay_delivery, LOG_MAIN, + "no immediate delivery: queued%s%s by %s", + *queue_name ? " in " : "", *queue_name ? CS queue_name : "", + queued_by); + } +f.receive_call_bombout = FALSE; + +/* The store for the main log message can be reused */ +rcvd_log_reset_point = store_reset(rcvd_log_reset_point); + +/* If the message is frozen, and freeze_tell is set, do the telling. */ + +if (f.deliver_freeze && freeze_tell && freeze_tell[0]) + moan_tell_someone(freeze_tell, NULL, US"Message frozen on arrival", + "Message %s was frozen on arrival by %s.\nThe sender is <%s>.\n", + message_id, frozen_by, sender_address); + + +/* Either a message has been successfully received and written to the two spool +files, or an error in writing the spool has occurred for an SMTP message, or +an SMTP message has been rejected for policy reasons, or a message was passed on +by cutthrough delivery. (For a non-SMTP message we will have already given up +because there's no point in carrying on!) For non-cutthrough we must now close +(and thereby unlock) the data file. In the successful case, this leaves the +message on the spool, ready for delivery. In the error case, the spool file will +be deleted. Then tidy up store, interact with an SMTP call if necessary, and +return. + +For cutthrough we hold the data file locked until we have deleted it, otherwise +a queue-runner could grab it in the window. + +A fflush() was done earlier in the expectation that any write errors on the +data file will be flushed(!) out thereby. Nevertheless, it is theoretically +possible for fclose() to fail - but what to do? What has happened to the lock +if this happens? We can at least log it; if it is observed on some platform +then we can think about properly declaring the message not-received. */ + + +TIDYUP: +process_info[process_info_len] = 0; /* Remove message id */ +if (spool_data_file && cutthrough_done == NOT_TRIED) + { + if (fclose(spool_data_file)) /* Frees the lock */ + log_write(0, LOG_MAIN|LOG_PANIC, + "spoolfile error on close: %s", strerror(errno)); + spool_data_file = NULL; + } + +/* Now reset signal handlers to their defaults */ + +signal(SIGTERM, SIG_DFL); +signal(SIGINT, SIG_DFL); + +/* Tell an SMTP caller the state of play, and arrange to return the SMTP return +value, which defaults TRUE - meaning there may be more incoming messages from +this connection. For non-SMTP callers (where there is only ever one message), +the default is FALSE. */ + +if (smtp_input) + { + yield = smtp_yield; + + /* Handle interactive SMTP callers. After several kinds of error, smtp_reply + is set to the response that should be sent. When it is NULL, we generate + default responses. After an ACL error or local_scan() error, the response has + already been sent, and smtp_reply is an empty string to indicate this. */ + + if (!smtp_batched_input) + { + if (!smtp_reply) + { + if (fake_response != OK) + smtp_respond(fake_response == DEFER ? US"450" : US"550", + 3, TRUE, fake_response_text); + + /* An OK response is required; use "message" text if present. */ + + else if (user_msg) + { + uschar *code = US"250"; + int len = 3; + smtp_message_code(&code, &len, &user_msg, NULL, TRUE); + smtp_respond(code, len, TRUE, user_msg); + } + + /* Default OK response */ + + else if (chunking_state > CHUNKING_OFFERED) + { + /* If there is more input waiting, no need to flush (probably the client + pipelined QUIT after data). We check only the in-process buffer, not + the socket. */ + + smtp_printf("250- %u byte chunk, total %d\r\n250 OK id=%s\r\n", + receive_hasc(), + chunking_datasize, message_size+message_linecount, message_id); + chunking_state = CHUNKING_OFFERED; + } + else + smtp_printf("250 OK id=%s\r\n", receive_hasc(), message_id); + + if (host_checking) + fprintf(stdout, + "\n**** SMTP testing: that is not a real message id!\n\n"); + } + + /* smtp_reply is set non-empty */ + + else if (smtp_reply[0] != 0) + if (fake_response != OK && smtp_reply[0] == '2') + smtp_respond(fake_response == DEFER ? US"450" : US"550", 3, TRUE, + fake_response_text); + else + smtp_printf("%.1024s\r\n", FALSE, smtp_reply); + + switch (cutthrough_done) + { + case ACCEPTED: + log_write(0, LOG_MAIN, "Completed");/* Delivery was done */ + case PERM_REJ: + /* Delete spool files */ + Uunlink(spool_name); + Uunlink(spool_fname(US"input", message_subdir, message_id, US"-H")); + Uunlink(spool_fname(US"msglog", message_subdir, message_id, US"")); + break; + + case TMP_REJ: + if (cutthrough.defer_pass) + { + Uunlink(spool_name); + Uunlink(spool_fname(US"input", message_subdir, message_id, US"-H")); + Uunlink(spool_fname(US"msglog", message_subdir, message_id, US"")); + } + default: + break; + } + if (cutthrough_done != NOT_TRIED) + { + if (spool_data_file) + { + (void) fclose(spool_data_file); /* Frees the lock; do not care if error */ + spool_data_file = NULL; + } + message_id[0] = 0; /* Prevent a delivery from starting */ + cutthrough.delivery = cutthrough.callout_hold_only = FALSE; + cutthrough.defer_pass = FALSE; + } + } + + /* For batched SMTP, generate an error message on failure, and do + nothing on success. The function moan_smtp_batch() does not return - + it exits from the program with a non-zero return code. */ + + else if (smtp_reply) + moan_smtp_batch(NULL, "%s", smtp_reply); + } + + +/* If blackholing, we can immediately log this message's sad fate. The data +file has already been unlinked, and the header file was never written to disk. +We must now indicate that nothing was received, to prevent a delivery from +starting. */ + +if (blackholed_by) + { + const uschar *detail = +#ifdef HAVE_LOCAL_SCAN + local_scan_data ? string_printing(local_scan_data) : +#endif + string_sprintf("(%s discarded recipients)", blackholed_by); + log_write(0, LOG_MAIN, "=> blackhole %s%s", detail, blackhole_log_msg); + log_write(0, LOG_MAIN, "Completed"); + message_id[0] = 0; + } + +/* Reset headers so that logging of rejects for a subsequent message doesn't +include them. It is also important to set header_last = NULL before exiting +from this function, as this prevents certain rewrites that might happen during +subsequent verifying (of another incoming message) from trying to add headers +when they shouldn't. */ + +header_list = header_last = NULL; + +return yield; /* TRUE if more messages (SMTP only) */ +} + +/* End of receive.c */ |