[people/ms/dma.git] / net.c

/*
 * Copyright (c) 2008 The DragonFly Project.  All rights reserved.
 *
 * This code is derived from software contributed to The DragonFly Project
 * by Matthias Schmidt <matthias@dragonflybsd.org>, University of Marburg,
 * Germany.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 * 3. Neither the name of The DragonFly Project nor the names of its
 *    contributors may be used to endorse or promote products derived
 *    from this software without specific, prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $DragonFly: src/libexec/dma/net.c,v 1.9 2008/09/30 17:47:21 swildner Exp $
 */

#include <sys/param.h>
#include <sys/queue.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#ifdef HAVE_CRYPTO
#include <openssl/ssl.h>
#endif /* HAVE_CRYPTO */

#include <err.h>
#include <errno.h>
#include <netdb.h>
#include <setjmp.h>
#include <signal.h>
#include <syslog.h>
#include <unistd.h>

#include "dma.h"

extern struct config *config;
extern struct authusers authusers;
static jmp_buf timeout_alarm;
char neterr[BUF_SIZE];

static void
sig_alarm(int signo __unused)
{
	longjmp(timeout_alarm, 1);
}

ssize_t
send_remote_command(int fd, const char* fmt, ...)
{
	va_list va;
	char cmd[4096];
	size_t len, pos;
	int s;
	ssize_t n;

	va_start(va, fmt);
	s = vsnprintf(cmd, sizeof(cmd) - 2, fmt, va);
	va_end(va);
	if (s == sizeof(cmd) - 2 || s < 0)
		errx(1, "Internal error: oversized command string");
	/* We *know* there are at least two more bytes available */
	strcat(cmd, "\r\n");
	len = strlen(cmd);

	if (((config->features & SECURETRANS) != 0) &&
	    ((config->features & NOSSL) == 0)) {
		while ((s = SSL_write(config->ssl, (const char*)cmd, len)) <= 0) {
			s = SSL_get_error(config->ssl, s);
			if (s != SSL_ERROR_WANT_READ &&
			    s != SSL_ERROR_WANT_WRITE)
				return (-1);
		}
	}
	else {
		pos = 0;
		while (pos < len) {
			n = write(fd, cmd + pos, len - pos);
			if (n < 0)
				return (-1);
			pos += n;
		}
	}

	return (len);
}

int
read_remote(int fd, int extbufsize, char *extbuf)
{
	ssize_t rlen = 0;
	size_t pos, len;
	char buff[BUF_SIZE];
	int done = 0, status = 0, extbufpos = 0;

	if (signal(SIGALRM, sig_alarm) == SIG_ERR) {
		snprintf(neterr, sizeof(neterr), "SIGALRM error: %s",
		    strerror(errno));
		return (1);
	}
	if (setjmp(timeout_alarm) != 0) {
		snprintf(neterr, sizeof(neterr), "Timeout reached");
		return (1);
	}
	alarm(CON_TIMEOUT);

	/*
	 * Remote reading code from femail.c written by Henning Brauer of
	 * OpenBSD and released under a BSD style license.
	 */
	for (len = pos = 0; !done; ) {
		rlen = 0;
		if (pos == 0 ||
		    (pos > 0 && memchr(buff + pos, '\n', len - pos) == NULL)) {
			memmove(buff, buff + pos, len - pos);
			len -= pos;
			pos = 0;
			if (((config->features & SECURETRANS) != 0) &&
			    (config->features & NOSSL) == 0) {
				if ((rlen = SSL_read(config->ssl, buff + len,
				    sizeof(buff) - len)) == -1)
					err(1, "read");
			} else {
				if ((rlen = read(fd, buff + len,
				    sizeof(buff) - len)) == -1)
					err(1, "read");
			}
			len += rlen;
		}
		/*
		 * If there is an external buffer with a size bigger than zero
		 * and as long as there is space in the external buffer and
		 * there are new characters read from the mailserver
		 * copy them to the external buffer
		 */
		if (extbufpos <= (extbufsize - 1) && rlen && extbufsize > 0 
		    && extbuf != NULL) {
			/* do not write over the bounds of the buffer */
			if(extbufpos + rlen > (extbufsize - 1)) {
				rlen = extbufsize - extbufpos;
			}
			memcpy(extbuf + extbufpos, buff + len - rlen, rlen);
			extbufpos += rlen;
		}
		for (; pos < len && buff[pos] >= '0' && buff[pos] <= '9'; pos++)
			; /* Do nothing */

		if (pos == len)
			return (0);

		if (buff[pos] == ' ')
			done = 1;
		else if (buff[pos] != '-')
			syslog(LOG_ERR, "invalid syntax in reply from server");

		/* skip up to \n */
		for (; pos < len && buff[pos - 1] != '\n'; pos++)
			; /* Do nothing */

	}
	alarm(0);

	buff[len] = '\0';
	while (len > 0 && (buff[len - 1] == '\r' || buff[len - 1] == '\n'))
		buff[--len] = '\0';
	snprintf(neterr, sizeof(neterr), "%s", buff);
	status = atoi(buff);
	return (status/100);
}

/*
 * Handle SMTP authentication
 */
static int
smtp_login(struct qitem *it, int fd, char *login, char* password)
{
	char *temp;
	int len, res = 0;

#ifdef HAVE_CRYPTO
	res = smtp_auth_md5(it, fd, login, password);
	if (res == 0) {
		return (0);
	} else if (res == -2) {
	/*
	 * If the return code is -2, then then the login attempt failed, 
	 * do not try other login mechanisms
	 */
		return (-1);
	}
#endif /* HAVE_CRYPTO */

	if ((config->features & INSECURE) != 0) {
		/* Send AUTH command according to RFC 2554 */
		send_remote_command(fd, "AUTH LOGIN");
		if (read_remote(fd, 0, NULL) != 3) {
			syslog(LOG_ERR, "%s: remote delivery deferred:"
					" AUTH login not available: %s",
					it->queueid, neterr);
			return (1);
		}

		len = base64_encode(login, strlen(login), &temp);
		if (len <= 0)
			return (-1);

		send_remote_command(fd, "%s", temp);
		if (read_remote(fd, 0, NULL) != 3) {
			syslog(LOG_ERR, "%s: remote delivery deferred:"
					" AUTH login failed: %s", it->queueid,
					neterr);
			return (-1);
		}

		len = base64_encode(password, strlen(password), &temp);
		if (len <= 0)
			return (-1);

		send_remote_command(fd, "%s", temp);
		res = read_remote(fd, 0, NULL);
		if (res == 5) {
			syslog(LOG_ERR, "%s: remote delivery failed:"
					" Authentication failed: %s",
					it->queueid, neterr);
			return (-1);
		} else if (res != 2) {
			syslog(LOG_ERR, "%s: remote delivery failed:"
					" AUTH password failed: %s",
					it->queueid, neterr);
			return (-1);
		}
	} else {
		syslog(LOG_ERR, "%s: non-encrypted SMTP login is disabled in config, so skipping it. ",
				it->queueid);
		return (1);
	}

	return (0);
}

static int
open_connection(struct qitem *it, const char *host)
{
	struct addrinfo hints, *res, *res0;
	char servname[128];
	const char *errmsg = NULL;
	int fd, error = 0, port;

	if (config->port != 0)
		port = config->port;
	else
		port = SMTP_PORT;

	/* FIXME get MX record of host */
	/* Shamelessly taken from getaddrinfo(3) */
	memset(&hints, 0, sizeof(hints));
	hints.ai_family = PF_UNSPEC;
	hints.ai_socktype = SOCK_STREAM;
	hints.ai_protocol = IPPROTO_TCP;

	snprintf(servname, sizeof(servname), "%d", port);
	error = getaddrinfo(host, servname, &hints, &res0);
	if (error) {
		syslog(LOG_ERR, "%s: remote delivery deferred: "
		       "%s: %m", it->queueid, gai_strerror(error));
		return (-1);
	}
	fd = -1;
	for (res = res0; res; res = res->ai_next) {
		fd=socket(res->ai_family, res->ai_socktype, res->ai_protocol);
		if (fd < 0) {
			errmsg = "socket failed";
			continue;
		}
		if (connect(fd, res->ai_addr, res->ai_addrlen) < 0) {
			errmsg = "connect failed";
			close(fd);
			fd = -1;
			continue;
		}
		break;
	}
	if (fd < 0) {
		syslog(LOG_ERR, "%s: remote delivery deferred: %s (%s:%s)",
			it->queueid, errmsg, host, servname);
		freeaddrinfo(res0);
		return (-1);
	}
	freeaddrinfo(res0);
	return (fd);
}

int
deliver_remote(struct qitem *it, const char **errmsg)
{
	struct authuser *a;
	char *host, line[1000];
	int fd, error = 0, do_auth = 0, res = 0;
	size_t linelen;
	/* asprintf can't take const */
	void *errmsgc = __DECONST(char **, errmsg);

	host = strrchr(it->addr, '@');
	/* Should not happen */
	if (host == NULL) {
		asprintf(errmsgc, "Internal error: badly formed address %s",
		    it->addr);
		return(-1);
	} else {
		/* Step over the @ */
		host++;
	}

	/* Smarthost support? */
	if (config->smarthost != NULL && strlen(config->smarthost) > 0) {
		syslog(LOG_INFO, "%s: using smarthost (%s:%i)",
		       it->queueid, config->smarthost, config->port);
		host = config->smarthost;
	}

	fd = open_connection(it, host);
	if (fd < 0)
		return (1);

	/* Check first reply from remote host */
	config->features |= NOSSL;
	res = read_remote(fd, 0, NULL);
	if (res != 2) {
		syslog(LOG_INFO, "%s: Invalid initial response: %i",
			it->queueid, res);
		return(1);
	}
	config->features &= ~NOSSL;

#ifdef HAVE_CRYPTO
	if ((config->features & SECURETRANS) != 0) {
		error = smtp_init_crypto(it, fd, config->features);
		if (error >= 0)
			syslog(LOG_INFO, "%s: SSL initialization successful",
				it->queueid);
		else
			goto out;
	}

	/*
	 * If the user doesn't want STARTTLS, but SSL encryption, we
	 * have to enable SSL first, then send EHLO
	 */
	if (((config->features & STARTTLS) == 0) &&
	    ((config->features & SECURETRANS) != 0)) {
		send_remote_command(fd, "EHLO %s", hostname());
		if (read_remote(fd, 0, NULL) != 2) {
			syslog(LOG_ERR, "%s: remote delivery deferred: "
			       " EHLO failed: %s", it->queueid, neterr);
			asprintf(errmsgc, "%s did not like our EHLO:\n%s",
			    host, neterr);
			return (-1);
		}
	}
#endif /* HAVE_CRYPTO */
	if (((config->features & SECURETRANS) == 0)) {
		send_remote_command(fd, "EHLO %s", hostname());
		if (read_remote(fd, 0, NULL) != 2) {
			syslog(LOG_ERR, "%s: remote delivery deferred: "
			       " EHLO failed: %s", it->queueid, neterr);
			asprintf(errmsgc, "%s did not like our EHLO:\n%s",
			    host, neterr);
			return (-1);
		}
	}

	/*
	 * Use SMTP authentication if the user defined an entry for the remote
	 * or smarthost
	 */
	SLIST_FOREACH(a, &authusers, next) {
		if (strcmp(a->host, host) == 0) {
			do_auth = 1;
			break;
		}
	}

	if (do_auth == 1) {
		/*
		 * Check if the user wants plain text login without using
		 * encryption.
		 */
		syslog(LOG_INFO, "%s: Use SMTP authentication",
				it->queueid);
		error = smtp_login(it, fd, a->login, a->password);
		if (error < 0) {
			syslog(LOG_ERR, "%s: remote delivery failed:"
					" SMTP login failed: %m", it->queueid);
			asprintf(errmsgc, "SMTP login to %s failed", host);
			return (-1);
		}
		/* SMTP login is not available, so try without */
		else if (error > 0)
			syslog(LOG_ERR, "%s: SMTP login not available."
					" Try without", it->queueid);
	}

#define READ_REMOTE_CHECK(c, exp)	\
	res = read_remote(fd, 0, NULL); \
	if (res == 5) { \
		syslog(LOG_ERR, "%s: remote delivery failed: " \
		       c " failed: %s", it->queueid, neterr); \
		asprintf(errmsgc, "%s did not like our " c ":\n%s", \
		    host, neterr); \
		return (-1); \
	} else if (res != exp) { \
		syslog(LOG_ERR, "%s: remote delivery deferred: " \
		       c " failed: %s", it->queueid, neterr); \
		return (1); \
	}

	send_remote_command(fd, "MAIL FROM:<%s>", it->sender);
	READ_REMOTE_CHECK("MAIL FROM", 2);

	send_remote_command(fd, "RCPT TO:<%s>", it->addr);
	READ_REMOTE_CHECK("RCPT TO", 2);

	send_remote_command(fd, "DATA");
	READ_REMOTE_CHECK("DATA", 3);

	if (fseek(it->queuef, it->hdrlen, SEEK_SET) != 0) {
		syslog(LOG_ERR, "%s: remote delivery deferred: cannot seek: %s",
		       it->queueid, neterr);
		return (1);
	}

	while (!feof(it->queuef)) {
		if (fgets(line, sizeof(line), it->queuef) == NULL)
			break;
		linelen = strlen(line);
		if (linelen == 0 || line[linelen - 1] != '\n') {
			syslog(LOG_CRIT, "%s: remote delivery failed:"
				"corrupted queue file", it->queueid);
			*errmsg = "corrupted queue file";
			error = -1;
			goto out;
		}

		/* Remove trailing \n's and escape leading dots */
		trim_line(line);

		/*
		 * If the first character is a dot, we escape it so the line
		 * length increases
		*/
		if (line[0] == '.')
			linelen++;

		if (send_remote_command(fd, "%s", line) != (ssize_t)linelen+1) {
			syslog(LOG_ERR, "%s: remote delivery deferred: "
				"write error", it->queueid);
			error = 1;
			goto out;
		}
	}

	send_remote_command(fd, ".");
	READ_REMOTE_CHECK("final DATA", 2);

	send_remote_command(fd, "QUIT");
	if (read_remote(fd, 0, NULL) != 2)
		syslog(LOG_WARNING, "%s: remote delivery succeeded but "
		       "QUIT failed: %s", it->queueid, neterr);
out:

	close(fd);
	return (error);
}
Commit	Line	Data
86e4d161 MS	1	/*
	2	* Copyright (c) 2008 The DragonFly Project. All rights reserved.
	3	*
	4	* This code is derived from software contributed to The DragonFly Project
	5	* by Matthias Schmidt <matthias@dragonflybsd.org>, University of Marburg,
	6	* Germany.
	7	*
	8	* Redistribution and use in source and binary forms, with or without
	9	* modification, are permitted provided that the following conditions
	10	* are met:
	11	*
	12	* 1. Redistributions of source code must retain the above copyright
	13	* notice, this list of conditions and the following disclaimer.
	14	* 2. Redistributions in binary form must reproduce the above copyright
	15	* notice, this list of conditions and the following disclaimer in
	16	* the documentation and/or other materials provided with the
	17	* distribution.
	18	* 3. Neither the name of The DragonFly Project nor the names of its
	19	* contributors may be used to endorse or promote products derived
	20	* from this software without specific, prior written permission.
	21	*
	22	* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	23	* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	24	* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
	25	* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
	26	* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
	27	* INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
	28	* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
	29	* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
	30	* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
	31	* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
	32	* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	33	* SUCH DAMAGE.
	34	*
c507d897	35	* $DragonFly: src/libexec/dma/net.c,v 1.9 2008/09/30 17:47:21 swildner Exp $
86e4d161 MS	36	*/
	37
	38	#include <sys/param.h>
	39	#include <sys/queue.h>
	40	#include <sys/stat.h>
	41	#include <sys/types.h>
	42	#include <sys/socket.h>
	43	#include <netinet/in.h>
	44	#include <arpa/inet.h>
	45
	46	#ifdef HAVE_CRYPTO
	47	#include <openssl/ssl.h>
	48	#endif /* HAVE_CRYPTO */
	49
c507d897	50	#include <err.h>
7a73c463	51	#include <errno.h>
86e4d161 MS	52	#include <netdb.h>
	53	#include <setjmp.h>
	54	#include <signal.h>
	55	#include <syslog.h>
	56	#include <unistd.h>
	57
	58	#include "dma.h"
	59
	60	extern struct config *config;
	61	extern struct authusers authusers;
	62	static jmp_buf timeout_alarm;
7a73c463	63	char neterr[BUF_SIZE];
86e4d161 MS	64
86e4d161 MS	65	static void
65bec70e	66	sig_alarm(int signo __unused)
86e4d161 MS	67	{
	68	longjmp(timeout_alarm, 1);
	69	}
	70
	71	ssize_t
	72	send_remote_command(int fd, const char* fmt, ...)
	73	{
	74	va_list va;
	75	char cmd[4096];
5b84c25b SS	76	size_t len, pos;
	77	int s;
	78	ssize_t n;
86e4d161 MS	79
86e4d161 MS	80	va_start(va, fmt);
5b84c25b SS	81	s = vsnprintf(cmd, sizeof(cmd) - 2, fmt, va);
	82	va_end(va);
	83	if (s == sizeof(cmd) - 2 \|\| s < 0)
	84	errx(1, "Internal error: oversized command string");
	85	/* We know there are at least two more bytes available */
	86	strcat(cmd, "\r\n");
	87	len = strlen(cmd);
86e4d161 MS	88
86e4d161 MS	89	if (((config->features & SECURETRANS) != 0) &&
50c8e68a	90	((config->features & NOSSL) == 0)) {
5b84c25b SS	91	while ((s = SSL_write(config->ssl, (const char*)cmd, len)) <= 0) {
	92	s = SSL_get_error(config->ssl, s);
	93	if (s != SSL_ERROR_WANT_READ &&
	94	s != SSL_ERROR_WANT_WRITE)
	95	return (-1);
	96	}
86e4d161 MS	97	}
86e4d161 MS	98	else {
5b84c25b SS	99	pos = 0;
	100	while (pos < len) {
	101	n = write(fd, cmd + pos, len - pos);
	102	if (n < 0)
	103	return (-1);
	104	pos += n;
	105	}
86e4d161	106	}
86e4d161	107
5b84c25b	108	return (len);
86e4d161 MS	109	}
86e4d161 MS	110
50c8e68a	111	int
bf28fcc6	112	read_remote(int fd, int extbufsize, char *extbuf)
86e4d161	113	{
50c8e68a MS	114	ssize_t rlen = 0;
	115	size_t pos, len;
	116	char buff[BUF_SIZE];
bf28fcc6	117	int done = 0, status = 0, extbufpos = 0;
86e4d161 MS	118
86e4d161 MS	119	if (signal(SIGALRM, sig_alarm) == SIG_ERR) {
7a73c463 SS	120	snprintf(neterr, sizeof(neterr), "SIGALRM error: %s",
	121	strerror(errno));
	122	return (1);
86e4d161 MS	123	}
86e4d161 MS	124	if (setjmp(timeout_alarm) != 0) {
7a73c463	125	snprintf(neterr, sizeof(neterr), "Timeout reached");
86e4d161 MS	126	return (1);
	127	}
	128	alarm(CON_TIMEOUT);
	129
	130	/*
50c8e68a MS	131	* Remote reading code from femail.c written by Henning Brauer of
50c8e68a MS	132	* OpenBSD and released under a BSD style license.
86e4d161	133	*/
50c8e68a	134	for (len = pos = 0; !done; ) {
bf28fcc6	135	rlen = 0;
50c8e68a MS	136	if (pos == 0 \|\|
	137	(pos > 0 && memchr(buff + pos, '\n', len - pos) == NULL)) {
	138	memmove(buff, buff + pos, len - pos);
	139	len -= pos;
	140	pos = 0;
	141	if (((config->features & SECURETRANS) != 0) &&
	142	(config->features & NOSSL) == 0) {
	143	if ((rlen = SSL_read(config->ssl, buff + len,
	144	sizeof(buff) - len)) == -1)
	145	err(1, "read");
	146	} else {
	147	if ((rlen = read(fd, buff + len,
	148	sizeof(buff) - len)) == -1)
	149	err(1, "read");
	150	}
	151	len += rlen;
	152	}
bf28fcc6 MS	153	/*
	154	* If there is an external buffer with a size bigger than zero
	155	* and as long as there is space in the external buffer and
	156	* there are new characters read from the mailserver
	157	* copy them to the external buffer
	158	*/
	159	if (extbufpos <= (extbufsize - 1) && rlen && extbufsize > 0
	160	&& extbuf != NULL) {
	161	/* do not write over the bounds of the buffer */
	162	if(extbufpos + rlen > (extbufsize - 1)) {
	163	rlen = extbufsize - extbufpos;
	164	}
	165	memcpy(extbuf + extbufpos, buff + len - rlen, rlen);
	166	extbufpos += rlen;
	167	}
50c8e68a MS	168	for (; pos < len && buff[pos] >= '0' && buff[pos] <= '9'; pos++)
50c8e68a MS	169	; /* Do nothing */
86e4d161	170
50c8e68a MS	171	if (pos == len)
50c8e68a MS	172	return (0);
86e4d161	173
50c8e68a MS	174	if (buff[pos] == ' ')
	175	done = 1;
	176	else if (buff[pos] != '-')
	177	syslog(LOG_ERR, "invalid syntax in reply from server");
86e4d161	178
50c8e68a MS	179	/* skip up to \n */
	180	for (; pos < len && buff[pos - 1] != '\n'; pos++)
	181	; /* Do nothing */
86e4d161	182
86e4d161	183	}
50c8e68a MS	184	alarm(0);
50c8e68a MS	185
7a73c463 SS	186	buff[len] = '\0';
	187	while (len > 0 && (buff[len - 1] == '\r' \|\| buff[len - 1] == '\n'))
	188	buff[--len] = '\0';
	189	snprintf(neterr, sizeof(neterr), "%s", buff);
50c8e68a MS	190	status = atoi(buff);
50c8e68a MS	191	return (status/100);
86e4d161 MS	192	}
	193
	194	/*
	195	* Handle SMTP authentication
86e4d161 MS	196	*/
	197	static int
	198	smtp_login(struct qitem it, int fd, char login, char* password)
	199	{
86e4d161	200	char *temp;
50c8e68a	201	int len, res = 0;
86e4d161	202
bf28fcc6 MS	203	#ifdef HAVE_CRYPTO
	204	res = smtp_auth_md5(it, fd, login, password);
	205	if (res == 0) {
	206	return (0);
	207	} else if (res == -2) {
	208	/*
	209	* If the return code is -2, then then the login attempt failed,
	210	* do not try other login mechanisms
	211	*/
	212	return (-1);
86e4d161	213	}
bf28fcc6	214	#endif /* HAVE_CRYPTO */
86e4d161	215
bf28fcc6 MS	216	if ((config->features & INSECURE) != 0) {
	217	/* Send AUTH command according to RFC 2554 */
	218	send_remote_command(fd, "AUTH LOGIN");
	219	if (read_remote(fd, 0, NULL) != 3) {
	220	syslog(LOG_ERR, "%s: remote delivery deferred:"
7a73c463 SS	221	" AUTH login not available: %s",
7a73c463 SS	222	it->queueid, neterr);
bf28fcc6 MS	223	return (1);
bf28fcc6 MS	224	}
86e4d161	225
bf28fcc6 MS	226	len = base64_encode(login, strlen(login), &temp);
	227	if (len <= 0)
	228	return (-1);
86e4d161	229
bf28fcc6 MS	230	send_remote_command(fd, "%s", temp);
	231	if (read_remote(fd, 0, NULL) != 3) {
	232	syslog(LOG_ERR, "%s: remote delivery deferred:"
7a73c463 SS	233	" AUTH login failed: %s", it->queueid,
7a73c463 SS	234	neterr);
bf28fcc6 MS	235	return (-1);
bf28fcc6 MS	236	}
86e4d161	237
bf28fcc6 MS	238	len = base64_encode(password, strlen(password), &temp);
	239	if (len <= 0)
	240	return (-1);
	241
	242	send_remote_command(fd, "%s", temp);
	243	res = read_remote(fd, 0, NULL);
	244	if (res == 5) {
	245	syslog(LOG_ERR, "%s: remote delivery failed:"
7a73c463 SS	246	" Authentication failed: %s",
7a73c463 SS	247	it->queueid, neterr);
bf28fcc6 MS	248	return (-1);
	249	} else if (res != 2) {
	250	syslog(LOG_ERR, "%s: remote delivery failed:"
7a73c463 SS	251	" AUTH password failed: %s",
7a73c463 SS	252	it->queueid, neterr);
bf28fcc6 MS	253	return (-1);
	254	}
	255	} else {
	256	syslog(LOG_ERR, "%s: non-encrypted SMTP login is disabled in config, so skipping it. ",
	257	it->queueid);
	258	return (1);
86e4d161 MS	259	}
	260
	261	return (0);
	262	}
	263
	264	static int
	265	open_connection(struct qitem it, const char host)
	266	{
86e4d161 MS	267	struct addrinfo hints, res, res0;
	268	char servname[128];
	269	const char *errmsg = NULL;
86e4d161 MS	270	int fd, error = 0, port;
86e4d161 MS	271
65bec70e	272	if (config->port != 0)
86e4d161 MS	273	port = config->port;
	274	else
	275	port = SMTP_PORT;
	276
bf28fcc6	277	/* FIXME get MX record of host */
86e4d161 MS	278	/* Shamelessly taken from getaddrinfo(3) */
	279	memset(&hints, 0, sizeof(hints));
	280	hints.ai_family = PF_UNSPEC;
	281	hints.ai_socktype = SOCK_STREAM;
	282	hints.ai_protocol = IPPROTO_TCP;
	283
	284	snprintf(servname, sizeof(servname), "%d", port);
	285	error = getaddrinfo(host, servname, &hints, &res0);
	286	if (error) {
	287	syslog(LOG_ERR, "%s: remote delivery deferred: "
	288	"%s: %m", it->queueid, gai_strerror(error));
	289	return (-1);
	290	}
	291	fd = -1;
	292	for (res = res0; res; res = res->ai_next) {
	293	fd=socket(res->ai_family, res->ai_socktype, res->ai_protocol);
	294	if (fd < 0) {
	295	errmsg = "socket failed";
	296	continue;
	297	}
	298	if (connect(fd, res->ai_addr, res->ai_addrlen) < 0) {
	299	errmsg = "connect failed";
	300	close(fd);
	301	fd = -1;
	302	continue;
	303	}
	304	break;
	305	}
	306	if (fd < 0) {
	307	syslog(LOG_ERR, "%s: remote delivery deferred: %s (%s:%s)",
	308	it->queueid, errmsg, host, servname);
	309	freeaddrinfo(res0);
	310	return (-1);
	311	}
	312	freeaddrinfo(res0);
86e4d161 MS	313	return (fd);
	314	}
	315
	316	int
09da7b5e	317	deliver_remote(struct qitem it, const char *errmsg)
86e4d161 MS	318	{
86e4d161 MS	319	struct authuser *a;
50c8e68a MS	320	char *host, line[1000];
50c8e68a MS	321	int fd, error = 0, do_auth = 0, res = 0;
86e4d161	322	size_t linelen;
09da7b5e SS	323	/* asprintf can't take const */
09da7b5e SS	324	void errmsgc = __DECONST(char *, errmsg);
86e4d161 MS	325
	326	host = strrchr(it->addr, '@');
	327	/* Should not happen */
a43346d5	328	if (host == NULL) {
09da7b5e	329	asprintf(errmsgc, "Internal error: badly formed address %s",
a43346d5	330	it->addr);
86e4d161	331	return(-1);
a43346d5	332	} else {
86e4d161 MS	333	/* Step over the @ */
86e4d161 MS	334	host++;
a43346d5	335	}
86e4d161 MS	336
	337	/* Smarthost support? */
	338	if (config->smarthost != NULL && strlen(config->smarthost) > 0) {
e0a95d28 MS	339	syslog(LOG_INFO, "%s: using smarthost (%s:%i)",
e0a95d28 MS	340	it->queueid, config->smarthost, config->port);
86e4d161 MS	341	host = config->smarthost;
	342	}
	343
	344	fd = open_connection(it, host);
	345	if (fd < 0)
e0a95d28	346	return (1);
86e4d161	347
50c8e68a MS	348	/* Check first reply from remote host */
50c8e68a MS	349	config->features \|= NOSSL;
bf28fcc6	350	res = read_remote(fd, 0, NULL);
50c8e68a MS	351	if (res != 2) {
	352	syslog(LOG_INFO, "%s: Invalid initial response: %i",
	353	it->queueid, res);
	354	return(1);
	355	}
	356	config->features &= ~NOSSL;
	357
86e4d161 MS	358	#ifdef HAVE_CRYPTO
	359	if ((config->features & SECURETRANS) != 0) {
	360	error = smtp_init_crypto(it, fd, config->features);
	361	if (error >= 0)
40234162	362	syslog(LOG_INFO, "%s: SSL initialization successful",
86e4d161 MS	363	it->queueid);
	364	else
	365	goto out;
	366	}
	367
	368	/*
	369	* If the user doesn't want STARTTLS, but SSL encryption, we
	370	* have to enable SSL first, then send EHLO
	371	*/
	372	if (((config->features & STARTTLS) == 0) &&
	373	((config->features & SECURETRANS) != 0)) {
	374	send_remote_command(fd, "EHLO %s", hostname());
bf28fcc6	375	if (read_remote(fd, 0, NULL) != 2) {
86e4d161	376	syslog(LOG_ERR, "%s: remote delivery deferred: "
7a73c463	377	" EHLO failed: %s", it->queueid, neterr);
09da7b5e	378	asprintf(errmsgc, "%s did not like our EHLO:\n%s",
a43346d5	379	host, neterr);
86e4d161 MS	380	return (-1);
	381	}
	382	}
	383	#endif /* HAVE_CRYPTO */
	384	if (((config->features & SECURETRANS) == 0)) {
	385	send_remote_command(fd, "EHLO %s", hostname());
bf28fcc6	386	if (read_remote(fd, 0, NULL) != 2) {
86e4d161	387	syslog(LOG_ERR, "%s: remote delivery deferred: "
7a73c463	388	" EHLO failed: %s", it->queueid, neterr);
09da7b5e	389	asprintf(errmsgc, "%s did not like our EHLO:\n%s",
a43346d5	390	host, neterr);
86e4d161 MS	391	return (-1);
	392	}
	393	}
	394
	395	/*
	396	* Use SMTP authentication if the user defined an entry for the remote
	397	* or smarthost
	398	*/
	399	SLIST_FOREACH(a, &authusers, next) {
	400	if (strcmp(a->host, host) == 0) {
	401	do_auth = 1;
	402	break;
	403	}
	404	}
	405
	406	if (do_auth == 1) {
dfce7456 MS	407	/*
	408	* Check if the user wants plain text login without using
	409	* encryption.
	410	*/
bf28fcc6	411	syslog(LOG_INFO, "%s: Use SMTP authentication",
86e4d161	412	it->queueid);
bf28fcc6 MS	413	error = smtp_login(it, fd, a->login, a->password);
	414	if (error < 0) {
	415	syslog(LOG_ERR, "%s: remote delivery failed:"
dfce7456	416	" SMTP login failed: %m", it->queueid);
09da7b5e	417	asprintf(errmsgc, "SMTP login to %s failed", host);
e0a95d28	418	return (-1);
dfce7456	419	}
bf28fcc6 MS	420	/* SMTP login is not available, so try without */
	421	else if (error > 0)
	422	syslog(LOG_ERR, "%s: SMTP login not available."
	423	" Try without", it->queueid);
86e4d161 MS	424	}
86e4d161 MS	425
c68aff7a SS	426	#define READ_REMOTE_CHECK(c, exp) \
	427	res = read_remote(fd, 0, NULL); \
	428	if (res == 5) { \
	429	syslog(LOG_ERR, "%s: remote delivery failed: " \
	430	c " failed: %s", it->queueid, neterr); \
09da7b5e	431	asprintf(errmsgc, "%s did not like our " c ":\n%s", \
a43346d5	432	host, neterr); \
c68aff7a SS	433	return (-1); \
	434	} else if (res != exp) { \
	435	syslog(LOG_ERR, "%s: remote delivery deferred: " \
	436	c " failed: %s", it->queueid, neterr); \
	437	return (1); \
86e4d161 MS	438	}
86e4d161 MS	439
c68aff7a SS	440	send_remote_command(fd, "MAIL FROM:<%s>", it->sender);
	441	READ_REMOTE_CHECK("MAIL FROM", 2);
	442
e0a95d28	443	send_remote_command(fd, "RCPT TO:<%s>", it->addr);
c68aff7a	444	READ_REMOTE_CHECK("RCPT TO", 2);
86e4d161 MS	445
86e4d161 MS	446	send_remote_command(fd, "DATA");
c68aff7a	447	READ_REMOTE_CHECK("DATA", 3);
86e4d161 MS	448
86e4d161 MS	449	if (fseek(it->queuef, it->hdrlen, SEEK_SET) != 0) {
7a73c463 SS	450	syslog(LOG_ERR, "%s: remote delivery deferred: cannot seek: %s",
7a73c463 SS	451	it->queueid, neterr);
86e4d161 MS	452	return (1);
	453	}
	454
	455	while (!feof(it->queuef)) {
	456	if (fgets(line, sizeof(line), it->queuef) == NULL)
	457	break;
	458	linelen = strlen(line);
	459	if (linelen == 0 \|\| line[linelen - 1] != '\n') {
	460	syslog(LOG_CRIT, "%s: remote delivery failed:"
	461	"corrupted queue file", it->queueid);
09da7b5e	462	*errmsg = "corrupted queue file";
86e4d161 MS	463	error = -1;
	464	goto out;
	465	}
	466
	467	/* Remove trailing \n's and escape leading dots */
	468	trim_line(line);
	469
	470	/*
	471	* If the first character is a dot, we escape it so the line
	472	* length increases
	473	*/
	474	if (line[0] == '.')
	475	linelen++;
	476
	477	if (send_remote_command(fd, "%s", line) != (ssize_t)linelen+1) {
	478	syslog(LOG_ERR, "%s: remote delivery deferred: "
	479	"write error", it->queueid);
	480	error = 1;
	481	goto out;
	482	}
	483	}
	484
	485	send_remote_command(fd, ".");
c68aff7a	486	READ_REMOTE_CHECK("final DATA", 2);
86e4d161 MS	487
86e4d161 MS	488	send_remote_command(fd, "QUIT");
83f3cc40 SS	489	if (read_remote(fd, 0, NULL) != 2)
83f3cc40 SS	490	syslog(LOG_WARNING, "%s: remote delivery succeeded but "
7a73c463	491	"QUIT failed: %s", it->queueid, neterr);
86e4d161 MS	492	out:
	493
	494	close(fd);
	495	return (error);
	496	}
	497