[exim-cvs] SOCKS: support option expansion result for no-pro…

Pàgina inicial
Delete this message
Reply to this message
Autor: Exim Git Commits Mailing List
Data:  
A: exim-cvs
Assumpte: [exim-cvs] SOCKS: support option expansion result for no-proxy. Bug 3118
Gitweb: https://git.exim.org/exim.git/commitdiff/7b505d28898cadb14eebded54b255d22541caaa6
Commit:     7b505d28898cadb14eebded54b255d22541caaa6
Parent:     cf4659b914328be054abb5706fd7f2649db9a8ac
Author:     Jeremy Harris <jgh146exb@???>
AuthorDate: Tue Oct 8 13:56:25 2024 +0100
Committer:  Jeremy Harris <jgh146exb@???>
CommitDate: Tue Oct 8 13:56:25 2024 +0100


    SOCKS: support option expansion result for no-proxy.  Bug 3118
---
 doc/doc-docbook/spec.xfpt       |  7 +++--
 doc/doc-txt/NewStuff            |  3 +++
 src/src/smtp_out.c              | 48 +++++++++++----------------------
 src/src/transports/smtp.h       |  3 +--
 src/src/transports/smtp_socks.c | 59 ++++++++++++++++++++++++++---------------
 test/confs/4020                 |  4 +++
 test/log/4020                   |  4 +++
 test/runtest                    |  3 +++
 test/scripts/4020-socks/4020    | 30 +++++++++++++++++++++
 test/stdout/4020                | 41 ++++++++++++++++++++++++++++
 10 files changed, 145 insertions(+), 57 deletions(-)


diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index dc41146b3..76bdd1396 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -43122,13 +43122,16 @@ Local/Makefile.

Use of a proxy is enabled by setting the &%socks_proxy%& option
on an smtp transport.
-The option value is expanded and should then be a list
+.new
+If unset (or empty after expansion) then proxying is not done.
+.wen
+Otherwise, expansion should result in a list
(colon-separated by default) of proxy specifiers.
Each proxy specifier is a list
(space-separated by default) where the initial element
is an IP address and any subsequent elements are options.

-Options are a string <name>=<value>.
+Each option is a string of form <name>=<value>.
 The list of options is in the following table:
 .itable none 0 0 2 10* left 90* left
 .irow &'auth'&    "authentication method"
diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index 0a83c294a..86c5dad83 100644
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -21,6 +21,9 @@ Version 4.98
     and all the transport drivers except smtp, can now be built as loadable
     modules


+ 6. A transport "socks_proxy" may expand to an empty string, specifying no
+    proxying.
+
 Version 4.98
 ------------
  1. The dkim_status ACL condition may now be used in data ACLs
diff --git a/src/src/smtp_out.c b/src/src/smtp_out.c
index 2ea29a7e4..4d31ff39e 100644
--- a/src/src/smtp_out.c
+++ b/src/src/smtp_out.c
@@ -319,12 +319,8 @@ return sock;



 /* Arguments:
-  host        host item containing name and address and port
-  host_af     AF_INET or AF_INET6
-  port          TCP port number
-  interface   outgoing interface address or NULL
-  tb          transport
-  timeout     timeout value or 0
+  sc        details for making connection: host, af, interface, transport
+  timeout    timeout value or 0
   early_data    if non-NULL, idempotent data to be sent -
         preferably in the TCP SYN segment
           Special case: non-NULL but with NULL blob.data - caller is
@@ -484,48 +480,36 @@ Returns:      connected socket number, or -1 with errno set
 int
 smtp_connect(smtp_connect_args * sc, const blob * early_data)
 {
-int port = sc->host->port;
 smtp_transport_options_block * ob = sc->ob;


-callout_address = string_sprintf("[%s]:%d", sc->host->address, port);
+callout_address = string_sprintf("[%s]:%d", sc->host->address, sc->host->port);

 HDEBUG(D_transport|D_acl|D_v)
   {
-  uschar * s = US" ";
-  if (sc->interface) s = string_sprintf(" from %s ", sc->interface);
+  gstring * g = sc->interface
+    ? string_fmt_append(NULL, " from %s", sc->interface)
+    : string_get(10);
 #ifdef SUPPORT_SOCKS
-  if (ob->socks_proxy) s = string_sprintf("%svia proxy ", s);
+  if (ob->socks_proxy) g = string_catn(g, US"via proxy", 9);
 #endif
-  debug_printf_indent("Connecting to %s %s%s...\n", sc->host->name, callout_address, s);
+  debug_printf_indent("Connecting to %s %s%Y ...\n",
+              sc->host->name, callout_address, g);
   }


/* Create and connect the socket */

 #ifdef SUPPORT_SOCKS
+GET_OPTION("socks_proxy");
 if (ob->socks_proxy)
   {
-  int sock = socks_sock_connect(sc->host, sc->host_af, port, sc->interface,
-                sc->tblock, ob->connect_timeout);
-  
-  if (sock >= 0)
+  if (!(ob->socks_proxy = expand_string(ob->socks_proxy)))
     {
-    if (early_data && early_data->data && early_data->len)
-      if (send(sock, early_data->data, early_data->len, 0) < 0)
-    {
-    int save_errno = errno;
-    HDEBUG(D_transport|D_acl|D_v)
-      {
-      debug_printf_indent("failed: %s", CUstrerror(save_errno));
-      if (save_errno == ETIMEDOUT)
-        debug_printf(" (timeout=%s)", readconf_printtime(ob->connect_timeout));
-      debug_printf("\n");
-      }
-    (void)close(sock);
-    sock = -1;
-    errno = save_errno;
-    }
+    log_write(0, LOG_MAIN|LOG_PANIC, "Bad expansion for socks_proxy in %s",
+      sc->tblock->drinst.name);
+    return -1;
     }
-  return sock;
+  if (*ob->socks_proxy)
+    return socks_sock_connect(sc, early_data);
   }
 #endif


diff --git a/src/src/transports/smtp.h b/src/src/transports/smtp.h
index 9fc95444b..fe4b1c17a 100644
--- a/src/src/transports/smtp.h
+++ b/src/src/transports/smtp.h
@@ -247,8 +247,7 @@ extern void smtp_transport_closedown(transport_instance *);


 #ifdef SUPPORT_SOCKS
-extern int     socks_sock_connect(host_item *, int, int, uschar *,
-             transport_instance *, int);
+extern int     socks_sock_connect(smtp_connect_args *, const blob *);
 #endif


/* End of transports/smtp.h */
diff --git a/src/src/transports/smtp_socks.c b/src/src/transports/smtp_socks.c
index a626a00d3..8d4beb39a 100644
--- a/src/src/transports/smtp_socks.c
+++ b/src/src/transports/smtp_socks.c
@@ -196,23 +196,21 @@ return -1;
/* Make a connection via a socks proxy

 Arguments:
- host        smtp target host
- host_af    address family
- port        remote tcp port number
- interface    local interface
- tb        transport
- timeout    connection timeout (zero for indefinite)
+ sc        details for making connection: host, af, interface, transport
+ early_data    data to send down the smtp channel (once proxied)


Return value:
0 on success; -1 on failure, with errno set
*/

 int
-socks_sock_connect(host_item * host, int host_af, int port, uschar * interface,
-  transport_instance * tb, int timeout)
+socks_sock_connect(smtp_connect_args * sc, const blob * early_data)
 {
+transport_instance * tb = sc->tblock;
 smtp_transport_options_block * ob = tb->drinst.options_block;
-const uschar * proxy_list, * proxy_spec;
+int timeout = ob->connect_timeout;
+const uschar * proxy_list = ob->socks_proxy,    /* already expanded */
+          * proxy_spec;
 int sep = 0;
 int fd;
 time_t tmo;
@@ -222,7 +220,7 @@ socks_opts proxies[32];            /* max #proxies handled */
 unsigned nproxies;
 socks_opts * sob = NULL;
 unsigned size;
-blob early_data;
+blob proxy_early_data;


 if (!timeout) timeout = 24*60*60;    /* use 1 day for "indefinite" */
 tmo = time(NULL) + timeout;
@@ -265,8 +263,8 @@ for sending on connection */


state = US"method select";
buf[0] = 5; buf[1] = 1; buf[2] = sob->auth_type;
-early_data.data = buf;
-early_data.len = 3;
+proxy_early_data.data = buf;
+proxy_early_data.len = 3;

/* Try proxies until a connection succeeds */

@@ -274,7 +272,7 @@ for(;;)
{
int idx;
host_item proxy;
- smtp_connect_args sc = {.sock = -1};
+ smtp_connect_args proxy_sc = {.sock = -1};

   if ((idx = socks_get_proxy(proxies, nproxies)) < 0)
     {
@@ -288,14 +286,14 @@ for(;;)
   proxy.address = proxy.name = sob->proxy_host;
   proxy.port = sob->port;


- sc.tblock = tb;
- sc.ob = ob;
- sc.host = &proxy;
- sc.host_af = Ustrchr(sob->proxy_host, ':') ? AF_INET6 : AF_INET;
- sc.interface = interface;
+ proxy_sc.tblock = tb;
+ proxy_sc.ob = ob;
+ proxy_sc.host = &proxy;
+ proxy_sc.host_af = Ustrchr(sob->proxy_host, ':') ? AF_INET6 : AF_INET;
+ proxy_sc.interface = sc->interface;

   /*XXX we trust that the method-select command is idempotent */
-  if ((fd = smtp_sock_connect(&sc, sob->timeout, &early_data)) >= 0)
+  if ((fd = smtp_sock_connect(&proxy_sc, sob->timeout, &proxy_early_data)) >= 0)
     {
     proxy_local_address = string_copy(proxy.address);
     proxy_local_port = sob->port;
@@ -308,7 +306,8 @@ for(;;)


/* Do the socks protocol stuff */

-HDEBUG(D_transport|D_acl|D_v) debug_printf_indent(" SOCKS>> 05 01 %02x\n", sob->auth_type);
+HDEBUG(D_transport|D_acl|D_v)
+ debug_printf_indent(" SOCKS>> 05 01 %02x\n", sob->auth_type);

/* expect method response */

@@ -328,8 +327,10 @@ if ( buf[0] != 5
goto proxy_err;

{
+ int host_af = sc->host_af;
+ host_item * host = sc->host;
union sockaddr_46 sin;
- (void) ip_addr(&sin, host_af, host->address, port);
+ (void) ip_addr(&sin, host_af, host->address, host->port);

/* send connect (ipver, ipaddr, port) */

@@ -388,6 +389,22 @@ proxy_session = TRUE;
HDEBUG(D_transport|D_acl|D_v)
debug_printf_indent(" proxy farside: [%s]:%d\n", proxy_external_address, proxy_external_port);

+if (early_data && early_data->data && early_data->len)
+  if (send(fd, early_data->data, early_data->len, 0) < 0)
+    {
+    int save_errno = errno;
+    HDEBUG(D_transport|D_acl|D_v)
+      {
+      debug_printf_indent("failed: %s", CUstrerror(save_errno));
+      if (save_errno == ETIMEDOUT)
+    debug_printf(" (timeout=%s)", readconf_printtime(ob->connect_timeout));
+      debug_printf("\n");
+      }
+    (void)close(fd);
+    fd= -1;
+    errno = save_errno;
+    }
+
 return fd;


 snd_err:
diff --git a/test/confs/4020 b/test/confs/4020
index 6702dcd68..763acc15a 100644
--- a/test/confs/4020
+++ b/test/confs/4020
@@ -43,7 +43,11 @@ my_smtp:
   driver =        smtp
   interface =        HOSTIPV4
   port =        PORT_S
+.ifdef FALLBACK
+  socks_proxy =        ${if eq {1}{1} {}}
+.else
   hide socks_proxy =    HOSTIPV4 port=PORT_D OPT
+.endif
   hosts_try_fastopen =    ${if eq {$local_part}{user_tfo} {*}}
   debug_print =        transport_name <$transport_name>
 .ifdef _HAVE_EVENT
diff --git a/test/log/4020 b/test/log/4020
index d56b922f2..d547e9611 100644
--- a/test/log/4020
+++ b/test/log/4020
@@ -6,3 +6,7 @@
 1999-03-02 09:44:33 10HmaY-000000005vi-0000 pla ip4.ip4.ip4.ip4 plp 1225 pea 127.0.0.1 pep 48879
 1999-03-02 09:44:33 10HmaY-000000005vi-0000 => userx@??? R=my_main_router T=my_smtp H=127.0.0.1 [127.0.0.1]:PORT_S PRX=[ip4.ip4.ip4.ip4]:PORT_D C="250 accepted OK"
 1999-03-02 09:44:33 10HmaY-000000005vi-0000 Completed
+1999-03-02 09:44:33 10HmaZ-000000005vi-0000 <= CALLER@??? U=CALLER P=local-esmtp S=sss
+1999-03-02 09:44:33 10HmaZ-000000005vi-0000 pla  plp 0 pea  pep 0
+1999-03-02 09:44:33 10HmaZ-000000005vi-0000 => userx@??? R=my_main_router T=my_smtp H=127.0.0.1 [127.0.0.1]:PORT_S C="250 accepted OK"
+1999-03-02 09:44:33 10HmaZ-000000005vi-0000 Completed
diff --git a/test/runtest b/test/runtest
index bb9b1ceee..a178659f9 100755
--- a/test/runtest
+++ b/test/runtest
@@ -1560,6 +1560,9 @@ RESET_AFTER_EXTRA_LINE_READ:
     # Not all platforms build with DKIM enabled
     next if /^DKIM >> Body data for hash, canonicalized/;


+    # Not all platforms build with SOCKS enabled
+    next if /^try option socks_proxy$/;
+
     # Not all platforms build with SPF enabled
     next if /(^$time_pid?spf_conn_init|spf_compile\.c)/;
     next if /try option spf_smtp_comment_template$/;
diff --git a/test/scripts/4020-socks/4020 b/test/scripts/4020-socks/4020
index 4a0ac0893..2ba57ba52 100644
--- a/test/scripts/4020-socks/4020
+++ b/test/scripts/4020-socks/4020
@@ -80,5 +80,35 @@ via name/pwd-auth proxy
 quit
 ****
 #
+# sock_proxy option set but expands to empty string
+server PORT_S
+220 Connected OK
+EHLO
+250-server id
+250
+MAIL FROM
+250
+RCPT TO
+250
+DATA
+354 hit me
+.
+250 accepted OK
+QUIT
+250 bye
+****
+#
+exim -odi -bs -DFALLBACK=yes
+ehlo test.ex
+mail from:<>
+rcpt to:<userx@???>
+data
+Date: Fri, 17 Dec 2004 14:35:01 +0100
+Subject: message should be sent
+
+direct, not via proxy
+.
+quit
+****
 #
 # Ends
diff --git a/test/stdout/4020 b/test/stdout/4020
index 47dc6e92b..b5bbaf34d 100644
--- a/test/stdout/4020
+++ b/test/stdout/4020
@@ -22,6 +22,18 @@
 354 Enter message, ending with "." on a line by itself
 250 OK id=10HmaY-000000005vi-0000
 221 myhost.test.ex closing connection
+220 myhost.test.ex ESMTP Exim x.yz Tue, 2 Mar 1999 09:44:33 +0000
+250-myhost.test.ex Hello CALLER at test.ex
+250-SIZE 52428800
+250-LIMITS MAILMAX=1000 RCPTMAX=50000
+250-8BITMIME
+250-PIPELINING
+250 HELP
+250 OK
+250 Accepted
+354 Enter message, ending with "." on a line by itself
+250 OK id=10HmaZ-000000005vi-0000
+221 myhost.test.ex closing connection


 ******** SERVER ********
 Listening on port 1225 ... 
@@ -68,3 +80,32 @@ R
 QUIT
 250 bye
 End of script
+Listening on port 1224 ... 
+Connection request from [ip4.ip4.ip4.ip4]
+220 Connected OK
+EHLO myhost.test.ex
+250-server id
+250
+MAIL FROM:<CALLER@???>
+250
+RCPT TO:<userx@???>
+250
+DATA
+354 hit me
+Received: from CALLER (helo=test.ex)
+    by myhost.test.ex with local-esmtp (Exim x.yz)
+    (envelope-from <CALLER@???>)
+    id 10HmaZ-000000005vi-0000
+    for userx@???;
+    Tue, 2 Mar 1999 09:44:33 +0000
+Date: Tue, 2 Mar 1999 09:44:33 +0000
+Subject: message should be sent
+Message-Id: <E10HmaZ-000000005vi-0000@???>
+From: CALLER_NAME <CALLER@???>
+
+direct, not via proxy
+.
+250 accepted OK
+QUIT
+250 bye
+End of script


--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-cvs.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-cvs-unsubscribe@???
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/