smtp-client-connection.c

/* Copyright (c) 2013-2018 Dovecot authors, see the included COPYING file */

#include "lib.h"
#include "llist.h"
#include "array.h"
#include "safe-memset.h"
#include "ioloop.h"
#include "net.h"
#include "base64.h"
#include "istream.h"
#include "ostream.h"
#include "ostream-dot.h"
#include "iostream-rawlog.h"
#include "iostream-ssl.h"
#include "str.h"
#include "dsasl-client.h"
#include "dns-lookup.h"
#include "smtp-syntax.h"
#include "smtp-reply-parser.h"
#include "smtp-client-private.h"

#include <ctype.h>

const char *const smtp_client_connection_state_names[] = {
	"disconnected",
	"connecting",
	"handshaking",
	"authenticating",
	"ready",
	"transaction"
};

static int
smtp_client_connection_ssl_init(struct smtp_client_connection *conn,
				const char **error_r);
static void
smtp_client_connection_handshake(struct smtp_client_connection *conn);
static void
smtp_client_connection_established(struct smtp_client_connection *conn);
static void
smtp_client_connection_start_transaction(struct smtp_client_connection *conn);

/*
 * Capabilities
 */

enum smtp_capability
smtp_client_connection_get_capabilities(struct smtp_client_connection *conn)
{
	return conn->capabilities;
}

uoff_t smtp_client_connection_get_size_capability(
	struct smtp_client_connection *conn)
{
	return conn->cap_size;
}

/*
 * Logging
 */

const char *
smpt_client_connection_label(struct smtp_client_connection *conn)
{
	if (conn->label == NULL) {
		conn->label = i_strdup_printf("%s:%u [%u]",
			conn->host, conn->port, conn->id);
	}
	return conn->label;
}

static inline void ATTR_FORMAT(2, 3)
smtp_client_connection_debug(struct smtp_client_connection *conn,
			     const char *format, ...)
{
	va_list args;

	if (conn->set.debug) {
		va_start(args, format);
		i_debug("%s-client: conn %s: %s",
			smtp_protocol_name(conn->protocol),
			smpt_client_connection_label(conn),
			t_strdup_vprintf(format, args));
		va_end(args);
	}
}

static inline void ATTR_FORMAT(2, 3)
smtp_client_connection_warning(struct smtp_client_connection *conn,
			       const char *format, ...)
{
	va_list args;

	va_start(args, format);

	i_warning("%s-client: conn %s: %s",
		smtp_protocol_name(conn->protocol),
		smpt_client_connection_label(conn),
		t_strdup_vprintf(format, args));
	va_end(args);
}

static inline void ATTR_FORMAT(2, 3)
smtp_client_connection_error(struct smtp_client_connection *conn,
			     const char *format, ...)
{
	va_list args;

	va_start(args, format);
	i_error("%s-client: conn %s: %s",
		smtp_protocol_name(conn->protocol),
		smpt_client_connection_label(conn),
		t_strdup_vprintf(format, args));
	va_end(args);
}

/*
 *
 */

static void
smtp_client_connection_commands_abort(struct smtp_client_connection *conn)
{
	struct smtp_client_command *cmd, *cmd_next = NULL;

	cmd = conn->cmd_wait_list_head;
	while (cmd != NULL) {
		i_assert(conn->cmd_wait_list_count > 0);
		cmd_next = cmd->next;
		smtp_client_command_abort(&cmd);
		cmd = cmd_next;
	}

	cmd = conn->cmd_send_queue_head;
	while (cmd != NULL) {
		i_assert(conn->cmd_send_queue_count > 0);
		cmd_next = cmd->next;
		smtp_client_command_abort(&cmd);
		cmd = cmd_next;
	}
}

static void
smtp_client_connection_commands_fail_reply(struct smtp_client_connection *conn,
	const struct smtp_reply *reply)
{
	struct smtp_client_command *cmd, *cmd_next = NULL;

	cmd = conn->cmd_wait_list_head;
	while (cmd != NULL) {
		i_assert(conn->cmd_wait_list_count > 0);
		cmd_next = cmd->next;
		smtp_client_command_fail_reply(&cmd, reply);
		cmd = cmd_next;
	}

	cmd = conn->cmd_send_queue_head;
	while (cmd != NULL) {
		i_assert(conn->cmd_send_queue_count > 0);
		cmd_next = cmd->next;
		smtp_client_command_fail_reply(&cmd, reply);
		cmd = cmd_next;
	}
}

static void
smtp_client_connection_commands_fail(struct smtp_client_connection *conn,
	unsigned int status, const char *error)
{
	struct smtp_reply reply;

	smtp_reply_init(&reply, status, error);
	reply.enhanced_code.x = 9;

	smtp_client_connection_commands_fail_reply(conn, &reply);
}

static void
smtp_client_connection_login_callback(struct smtp_client_connection *conn,
	const struct smtp_reply *reply)
{
	smtp_client_command_callback_t *callback = conn->login_callback;
	void *context = conn->login_context;

	conn->login_callback = NULL;
	conn->login_context = NULL;

	if (conn->closed)
		return;
	if (callback != NULL)
		callback(reply, context);
}

static void
smtp_client_connection_login_fail(struct smtp_client_connection *conn,
	unsigned int status, const char *error)
{
	struct smtp_reply reply;

	smtp_reply_init(&reply, status, error);
	reply.enhanced_code.x = 9;

	smtp_client_connection_login_callback(conn, &reply);
}

static void
smtp_client_connection_set_state(struct smtp_client_connection *conn,
				 enum smtp_client_connection_state state)
{
	conn->state = state;
}

void smtp_client_connection_cork(struct smtp_client_connection *conn)
{
	conn->corked = TRUE;
	if (conn->conn.output != NULL)
		o_stream_cork(conn->conn.output);
}

void smtp_client_connection_uncork(struct smtp_client_connection *conn)
{
	if (conn->conn.output != NULL) {
		smtp_client_connection_trigger_output(conn);
		o_stream_uncork(conn->conn.output);
	}
	conn->corked = FALSE;
}

enum smtp_client_connection_state
smtp_client_connection_get_state(struct smtp_client_connection *conn)
{
	return conn->state;
}

static void
smtp_client_command_timeout(struct smtp_client_connection *conn)
{
	smtp_client_connection_ref(conn);

	smtp_client_connection_error(conn,
		"Command timed out, disconnecting");
	smtp_client_connection_fail(conn,
		SMTP_CLIENT_COMMAND_ERROR_TIMED_OUT,
		"Command timed out");
	smtp_client_connection_unref(&conn);
}

void smtp_client_connection_start_cmd_timeout(
	struct smtp_client_connection *conn)
{
	unsigned int msecs = conn->set.command_timeout_msecs;

	if (conn->state != SMTP_CLIENT_CONNECTION_STATE_READY) {
		/* pre-login uses connect timeout */
		return;
	}
	if (msecs == 0) {
		/* no timeout configured */
		timeout_remove(&conn->to_commands);
		return;
	}
	if (conn->cmd_wait_list_head == NULL &&
		conn->cmd_send_queue_head == NULL) {
		/* no commands pending */
		timeout_remove(&conn->to_commands);
		return;
	}

	smtp_client_connection_debug(conn, "Start timeout");
	if (conn->to_commands == NULL) {
		conn->to_commands = timeout_add
			(msecs, smtp_client_command_timeout, conn);
	}
}

void smtp_client_connection_update_cmd_timeout(
	struct smtp_client_connection *conn)
{
	unsigned int msecs = conn->set.command_timeout_msecs;

	if (conn->state != SMTP_CLIENT_CONNECTION_STATE_READY) {
		/* pre-login uses connect timeout */
		return;
	}
	if (msecs == 0) {
		/* no timeout configured */
		timeout_remove(&conn->to_commands);
		return;
	}

	if (conn->cmd_wait_list_head == NULL &&
		conn->cmd_send_queue_head == NULL) {
		if (conn->to_commands != NULL) {
			smtp_client_connection_debug(conn,
				"No commands pending; stop timeout");
		}
		timeout_remove(&conn->to_commands);
	} else if (conn->to_commands != NULL)  {
		smtp_client_connection_debug(conn,
			"Reset timeout");
		timeout_reset(conn->to_commands);
	} else {
		smtp_client_connection_start_cmd_timeout(conn);
	}
}

static void
smtp_client_connection_fail_reply(struct smtp_client_connection *conn,
				  const struct smtp_reply *reply)
{
	struct smtp_client_transaction *trans;

	smtp_client_connection_debug(conn,
		"Connection failed: %s", smtp_reply_log(reply));

	smtp_client_connection_ref(conn);

	smtp_client_connection_login_callback(conn, reply);
	smtp_client_connection_commands_fail_reply(conn, reply);
	smtp_client_connection_disconnect(conn);

	trans = conn->transactions_head;
	while (trans != NULL) {
		struct smtp_client_transaction *trans_next = trans->next;
		smtp_client_transaction_connection_result(trans, reply);
		trans = trans_next;
	}

	smtp_client_connection_unref(&conn);
}

void smtp_client_connection_fail(struct smtp_client_connection *conn,
				 unsigned int status, const char *error)
{
	struct smtp_reply reply;
	const char *text_lines[] = {error, NULL};

	i_zero(&reply);
	reply.status = status;
	reply.text_lines = text_lines;
	reply.enhanced_code.x = 9;

	smtp_client_connection_fail_reply(conn, &reply);
}

static void stmp_client_connection_ready(struct smtp_client_connection *conn,
					 const struct smtp_reply *reply)
{
	timeout_remove(&conn->to_connect);

	smtp_client_connection_set_state(conn,
		SMTP_CLIENT_CONNECTION_STATE_READY);
	conn->reset_needed = FALSE;

	smtp_client_connection_debug(conn, "Connection ready");

	smtp_client_connection_login_callback(conn, reply);

	smtp_client_connection_update_cmd_timeout(conn);

	smtp_client_connection_start_transaction(conn);
}

static void
smtp_client_connection_clear_password(struct smtp_client_connection *conn)
{
	if (conn->set.remember_password)
		return;
	if (conn->password == NULL)
		return;
	safe_memset(conn->password, 0, strlen(conn->password));
	conn->set.password = NULL;
	conn->password = NULL;
}

static void
smtp_client_connection_auth_cb(const struct smtp_reply *reply,
			       struct smtp_client_connection *conn)
{
	if (reply->status == 334) {
		const unsigned char *sasl_output;
		size_t sasl_output_len, input_len;
		buffer_t *buf;
		const char *error;

		if (reply->text_lines[1] != NULL) {
			smtp_client_connection_error(conn,
				"Authentication failed: "
				"Server returned multi-line reply: %s",
				smtp_reply_log(reply));
			smtp_client_connection_fail(conn,
				SMTP_CLIENT_COMMAND_ERROR_AUTH_FAILED,
				"Authentication protocol error");
			return;
		}

		input_len = strlen(reply->text_lines[0]);
		buf = buffer_create_dynamic(pool_datastack_create(),
			MAX_BASE64_DECODED_SIZE(input_len));
		if (base64_decode
			(reply->text_lines[0], input_len, NULL, buf) < 0) {
			smtp_client_connection_error(conn,
				"Authentication failed: "
				"Server sent non-base64 input for AUTH: %s",
				reply->text_lines[0]);
		} else if (dsasl_client_input(conn->sasl_client,
			buf->data, buf->used,	&error) < 0) {
			smtp_client_connection_error(conn,
				"Authentication failed: %s", error);
		} else if (dsasl_client_output(conn->sasl_client,
			&sasl_output, &sasl_output_len, &error) < 0) {
			smtp_client_connection_error(conn,
				"Authentication failed: %s", error);
		} else {
			string_t *smtp_output = t_str_new(
				MAX_BASE64_ENCODED_SIZE(sasl_output_len)+2);
			base64_encode(sasl_output,
				sasl_output_len, smtp_output);
			str_append(smtp_output, "\r\n");
			o_stream_nsend(conn->conn.output,
				str_data(smtp_output), str_len(smtp_output));
			return;
		}

		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_AUTH_FAILED,
			"Authentication failed");
		return;
	}

	if ((reply->status / 100) != 2) {
		smtp_client_connection_error(conn,
			"Authentication failed: %s",
			smtp_reply_log(reply));
		smtp_client_connection_fail_reply(conn, reply);
		return;
	}

	smtp_client_connection_clear_password(conn);

	if (conn->set.debug) {
		smtp_client_connection_debug(conn,
			"Authenticated successfully");
	}
	dsasl_client_free(&conn->sasl_client);

	if (conn->to_connect != NULL)
		timeout_reset(conn->to_connect);
	conn->authenticated = TRUE;
	smtp_client_connection_handshake(conn);
}

static int
smtp_client_connection_get_sasl_mech(struct smtp_client_connection *conn,
				     const struct dsasl_client_mech **mech_r,
				     const char **error_r)
{
	const struct smtp_client_settings *set = &conn->set;
	const char *const *mechanisms;

	if (set->sasl_mech != NULL) {
		const char *mech = dsasl_client_mech_get_name(set->sasl_mech);

		if (!str_array_icase_find(conn->cap_auth_mechanisms, mech)) {
			*error_r = t_strdup_printf(
				"Server doesn't support `%s' SASL mechanism",
				mech);
			return -1;
		}
		*mech_r = set->sasl_mech;
		return 0;
	}
	if (set->sasl_mechanisms == NULL ||
		set->sasl_mechanisms[0] == '\0') {
		*mech_r = &dsasl_client_mech_plain;
		return 0;
	}		

	/* find one of the specified SASL mechanisms */
	mechanisms = t_strsplit_spaces(set->sasl_mechanisms, ", ");
	for (; *mechanisms != NULL; mechanisms++) {
		if (str_array_icase_find(conn->cap_auth_mechanisms,
			*mechanisms)) {
			*mech_r = dsasl_client_mech_find(*mechanisms);
			if (*mech_r != NULL)
				return 0;

			*error_r = t_strdup_printf(
				"Support for SASL mechanism `%s' is missing",
				*mechanisms);
			return -1;
		}
	}
	*error_r = t_strdup_printf(
		"Server doesn't support any of "
		"the requested SASL mechanisms: %s",
		set->sasl_mechanisms);
	return -1;
}

static bool
smtp_client_connection_authenticate(struct smtp_client_connection *conn)
{
	const struct smtp_client_settings *set = &conn->set;
	struct dsasl_client_settings sasl_set;
	const struct dsasl_client_mech *sasl_mech = NULL;
	struct smtp_client_command *cmd;
	const unsigned char *sasl_output;
	size_t sasl_output_len;
	string_t *sasl_output_base64;
	const char *init_resp, *error;

	if (conn->authenticated)
		return TRUE;
	if (set->username == NULL && set->sasl_mech == NULL)
		return TRUE;

	if ((conn->capabilities & SMTP_CAPABILITY_AUTH) == 0) {
		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_AUTH_FAILED,
			"Authentication not supported");
		return FALSE;
	}

	if (conn->set.debug) {
		if (set->master_user != NULL) {
			smtp_client_connection_debug(conn,
				"Authenticating as %s for user %s",
				set->master_user, set->username);
		} else if (set->username == NULL) {
			smtp_client_connection_debug(conn,
				"Authenticating");
		} else {
			smtp_client_connection_debug(conn,
				"Authenticating as %s", set->username);
		}
	}

	if (smtp_client_connection_get_sasl_mech(conn,
		&sasl_mech, &error) < 0) {
		smtp_client_connection_error(conn,
			"Authentication failed: %s", error);
		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_AUTH_FAILED,
			"Server authentication mechanisms incompatible");
		return FALSE;
	}

	i_zero(&sasl_set);
	if (set->master_user == NULL)
		sasl_set.authid = set->username;
	else {
		sasl_set.authid = set->master_user;
		sasl_set.authzid = set->username;
	}
	sasl_set.password = set->password;

	conn->sasl_client = dsasl_client_new(sasl_mech, &sasl_set);

	if (dsasl_client_output(conn->sasl_client, &sasl_output,
				&sasl_output_len, &error) < 0) {
		smtp_client_connection_error(conn,
			"Failed to create initial %s SASL reply: %s",
			dsasl_client_mech_get_name(sasl_mech), error);
		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_AUTH_FAILED,
			"Internal authentication failure");
		return FALSE;
	}

	sasl_output_base64 = t_str_new(
		MAX_BASE64_ENCODED_SIZE(sasl_output_len));
	base64_encode(sasl_output, sasl_output_len, sasl_output_base64);

	/* RFC 4954, Section 4:

	   If the client is transmitting an initial response of zero
	   length, it MUST instead transmit the response as a single
	   equals sign ("=").  This indicates that the response is
	   present, but contains no data. */
	init_resp = (str_len(sasl_output_base64) == 0 ?
		     "=" : str_c(sasl_output_base64));

	cmd = smtp_client_command_new(conn,
		SMTP_CLIENT_COMMAND_FLAG_PRELOGIN,
		smtp_client_connection_auth_cb, conn);
	smtp_client_command_printf(cmd, "AUTH %s %s",
		dsasl_client_mech_get_name(sasl_mech), init_resp);
	smtp_client_command_submit(cmd);

	smtp_client_connection_set_state(conn,
		SMTP_CLIENT_CONNECTION_STATE_AUTHENTICATING);
	return FALSE;
}

static void
smtp_client_connection_xclient_cb(const struct smtp_reply *reply,
				  struct smtp_client_connection *conn)
{
	if (conn->set.debug) {
		smtp_client_connection_debug(conn,
			"Received XCLIENT handshake reply: %s",
			smtp_reply_log(reply));
	}

	if (reply->status == 421) {
		smtp_client_connection_fail_reply(conn, reply);
		return;
	}
	if (conn->state == SMTP_CLIENT_CONNECTION_STATE_DISCONNECTED)
		return;

	if (conn->to_connect != NULL)
		timeout_reset(conn->to_connect);
	smtp_client_connection_handshake(conn);
}

void
smtp_client_connection_send_xclient(struct smtp_client_connection *conn,
	struct smtp_proxy_data *xclient)
{
	const char **xclient_args = conn->cap_xclient_args;
	unsigned int empty_len;
	string_t *str;

	if (!conn->set.peer_trusted)
		return;
	if (conn->cap_xclient_args == NULL)
		return;

	str = t_str_new(64);
	str_append(str, "XCLIENT");
	empty_len = str_len(str);

	if (xclient->source_ip.family != 0 &&
	    str_array_icase_find(xclient_args, "ADDR")) {
		/* Older versions of Dovecot LMTP don't quite follow Postfix'
		   specification of the XCLIENT command regarding IPv6
		   addresses: the "IPV6:" prefix is omitted. For now, we
		   maintain this deviation for LMTP. Newer versions of Dovecot
		   LMTP can work with or without the prefix. */
		if (conn->protocol != SMTP_PROTOCOL_LMTP &&
			xclient->source_ip.family == AF_INET6)
			str_append(str, " ADDR=IPV6:");
		else
			str_append(str, " ADDR=");
		str_append(str, net_ip2addr(&xclient->source_ip));
	}
	if (xclient->source_port != 0 &&
	    str_array_icase_find(xclient_args, "PORT"))
		str_printfa(str, " PORT=%u", xclient->source_port);
	if (xclient->helo != NULL &&
	    str_array_icase_find(xclient_args, "HELO")) {
		str_append(str, " HELO=");
		smtp_xtext_encode_cstr(str, xclient->helo);
	}
	if (str_array_icase_find(xclient_args, "PROTO")) {
		switch (xclient->proto) {
		case SMTP_PROXY_PROTOCOL_SMTP:
			str_printfa(str, " PROTO=SMTP");
			break;
		case SMTP_PROXY_PROTOCOL_ESMTP:
			str_printfa(str, " PROTO=ESMTP");
			break;
		case SMTP_PROXY_PROTOCOL_LMTP:
			str_printfa(str, " PROTO=LMTP");
			break;
		default:
			break;
		}
	}
	if (xclient->login != NULL &&
	    str_array_icase_find(xclient_args, "LOGIN")) {
		str_append(str, " LOGIN=");
		smtp_xtext_encode_cstr(str, xclient->login);
	}
	if (xclient->ttl_plus_1 > 0 &&
	    str_array_icase_find(xclient_args, "TTL"))
		str_printfa(str, " TTL=%u", xclient->ttl_plus_1-1);
	if (xclient->timeout_secs > 0 &&
	    str_array_icase_find(xclient_args, "TIMEOUT"))
		str_printfa(str, " TIMEOUT=%u", xclient->timeout_secs);

	if (str_len(str) > empty_len) {
		struct smtp_client_command *cmd;
		enum smtp_client_command_flags flags;

		smtp_client_connection_debug(conn,
			"Sending XCLIENT handshake");

		flags = SMTP_CLIENT_COMMAND_FLAG_PRELOGIN |
			SMTP_CLIENT_COMMAND_FLAG_PRIORITY;

		cmd = smtp_client_command_new(conn, flags,
			smtp_client_connection_xclient_cb, conn);
		smtp_client_command_write(cmd, str_c(str));
		smtp_client_command_submit(cmd);
	}
}

static bool
smtp_client_connection_init_xclient(struct smtp_client_connection *conn)
{
	if (!conn->initial_xclient_sent) {
		conn->initial_xclient_sent = TRUE;
		smtp_client_connection_send_xclient(conn,
			&conn->set.proxy_data);
	}

	return smtp_client_connection_authenticate(conn);
}

static void
smtp_client_connection_starttls_cb(const struct smtp_reply *reply,
				   struct smtp_client_connection *conn)
{
	const char *error;

	if (conn->set.debug) {
		smtp_client_connection_debug(conn,
			"Received STARTTLS reply: %s",
			smtp_reply_log(reply));
	}

	if ((reply->status / 100) != 2) {
		smtp_client_connection_fail_reply(conn, reply);
		return;
	}

	if (smtp_client_connection_ssl_init(conn, &error) < 0) {
		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_CONNECT_FAILED, error);
	} else {
		if (conn->to_connect != NULL)
			timeout_reset(conn->to_connect);
		smtp_client_connection_handshake(conn);
	}
}

static bool
smtp_client_connection_starttls(struct smtp_client_connection *conn)
{
	struct smtp_client_command *cmd;

	if (conn->ssl_mode == SMTP_CLIENT_SSL_MODE_STARTTLS &&
	    conn->ssl_iostream == NULL) {
		if ((conn->capabilities & SMTP_CAPABILITY_STARTTLS) == 0) {
			smtp_client_connection_error(conn,
				"Requested STARTTLS, "
				"but server doesn't support it");
			smtp_client_connection_fail(conn,
				SMTP_CLIENT_COMMAND_ERROR_CONNECT_FAILED,
				"STARTTLS not supported");
			return FALSE;
		}

		smtp_client_connection_debug(conn, "Starting TLS");

		cmd = smtp_client_command_new(conn,
			SMTP_CLIENT_COMMAND_FLAG_PRELOGIN,
			smtp_client_connection_starttls_cb, conn);
		smtp_client_command_write(cmd, "STARTTLS");
		smtp_client_command_submit(cmd);
		return FALSE;
	}

	return smtp_client_connection_init_xclient(conn);
}

static void
smtp_client_connection_handshake_cb(const struct smtp_reply *reply,
				    struct smtp_client_connection *conn)
{
	const char *const *lines;
	unsigned int j;

	smtp_client_connection_debug(conn, "Received handshake reply");

	/* check reply status */
	if ((reply->status / 100) != 2) {
		/* RFC 5321, Section 3.2:
		   For a particular connection attempt, if the server returns a
		   "command not recognized" response to EHLO, the client SHOULD
		   be able to fall back and send HELO. */
		if (conn->protocol == SMTP_PROTOCOL_SMTP && !conn->old_smtp &&
			(reply->status == 500 || reply->status == 502)) {
			/* try HELO */
			conn->old_smtp = TRUE;
			smtp_client_connection_handshake(conn);
			return;
		}
		/* failed */
		smtp_client_connection_fail_reply(conn, reply);
		return;
	}

	/* reset capabilities */
	p_clear(conn->cap_pool);
	conn->capabilities = 0;
	conn->cap_xclient_args = NULL;
	conn->cap_auth_mechanisms = NULL;
	conn->cap_size = 0;

	lines = reply->text_lines;
	if (*lines == NULL) {
		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_BAD_REPLY,
			"Invalid handshake reply");
		return;
	}

	/* greeting line */
	lines++;

	/* capability lines */
	while (*lines != NULL) {
		const struct smtp_capability_name *cap = NULL;
		const char *const *params;
		const char *cap_name, *error;

		if (smtp_ehlo_line_parse(*lines,
			&cap_name, &params, &error) <= 0) {
			smtp_client_connection_warning(conn,
				"Received invalid EHLO response line: %s",
				error);
			lines++;
			continue;
		}

		for (j = 0; smtp_capability_names[j].name != NULL; j++) {
			cap = &smtp_capability_names[j];

			if (strcasecmp(cap_name, cap->name) == 0)
				break;
			cap = NULL;
		}

		if (cap != NULL) {
			switch (cap->capability) {
			case SMTP_CAPABILITY_AUTH:
				conn->cap_auth_mechanisms =
					p_strarray_dup(conn->cap_pool, params);
				break;
			case SMTP_CAPABILITY_SIZE:
				if (params == NULL || *params == NULL)
					break;
				if (str_to_uoff(*params, &conn->cap_size) < 0) {
					smtp_client_connection_warning(conn,
						"Received invalid SIZE capability "
						"in EHLO response line");
					cap = NULL;
				}
				break;
			case SMTP_CAPABILITY_XCLIENT:
				conn->cap_xclient_args =
					p_strarray_dup(conn->cap_pool, params);
				break;
			default:
				break;
			}
		}

		if (cap != NULL)
			conn->capabilities |= cap->capability;

		lines++;
	}

	smtp_client_connection_debug(conn, "Received server capabilities");

	if (conn->to_connect != NULL)
		timeout_reset(conn->to_connect);
	if (smtp_client_connection_starttls(conn)) {
		stmp_client_connection_ready(conn, reply);
	}
}

static void
smtp_client_connection_handshake(struct smtp_client_connection *conn)
{
	struct smtp_client_command *cmd;
	enum smtp_client_command_flags flags;
	const char *command;

	flags = SMTP_CLIENT_COMMAND_FLAG_PRELOGIN |
		SMTP_CLIENT_COMMAND_FLAG_PRIORITY;

	switch (conn->protocol) {
	case SMTP_PROTOCOL_SMTP:
		command = (conn->old_smtp ? "HELO" : "EHLO");
		break;
	case SMTP_PROTOCOL_LMTP:
		command = "LHLO";
		break;
	default:
		i_unreached();
	}

	smtp_client_connection_debug(conn,
		"Sending %s handshake", command);

	cmd = smtp_client_command_new(conn, flags,
		smtp_client_connection_handshake_cb, conn);
	smtp_client_command_write(cmd, command);
	smtp_client_command_write(cmd, " ");
	smtp_client_command_write(cmd, conn->set.my_hostname);
	smtp_client_command_submit(cmd);
	smtp_client_connection_set_state(conn,
		SMTP_CLIENT_CONNECTION_STATE_HANDSHAKING);
}

static int
smtp_client_connection_input_reply(struct smtp_client_connection *conn,
				   const struct smtp_reply *reply)
{
	int ret;

	/* initial greeting? */
	if (conn->state == SMTP_CLIENT_CONNECTION_STATE_CONNECTING) {
		if (conn->set.debug) {
			smtp_client_connection_debug(conn,
				"Received greeting from server: %s",
				smtp_reply_log(reply));
		}
		if (reply->status != 220) {
			if (smtp_reply_is_success(reply)) {
				smtp_client_connection_fail(conn,
					SMTP_CLIENT_COMMAND_ERROR_BAD_REPLY,
					"Received inappropriate greeting");
			} else {
				smtp_client_connection_fail_reply(conn, reply);
			}
			return -1;
		}
		smtp_client_connection_handshake(conn);
		return 1;
	}

	/* unexpected reply? */
	if (conn->cmd_wait_list_head == NULL) {
		smtp_client_connection_debug(conn,
			"Unexpected reply: %s", smtp_reply_log(reply));

		if (reply->status ==
			SMTP_CLIENT_COMMAND_ERROR_CONNECTION_CLOSED) {
			smtp_client_connection_fail_reply(conn, reply);
		} else {
			smtp_client_connection_fail(conn,
				SMTP_CLIENT_COMMAND_ERROR_BAD_REPLY,
				"Got unexpected reply");
		}
		return -1;
	}

	/* command reply */
	ret = smtp_client_command_input_reply(conn->cmd_wait_list_head, reply);

	if (conn->state == SMTP_CLIENT_CONNECTION_STATE_DISCONNECTED ||
		conn->conn.output == NULL)
		return -1;

	return ret;
}

static void smtp_client_connection_input(struct connection *_conn)
{
	struct smtp_client_connection *conn =
		(struct smtp_client_connection *)_conn;
	bool enhanced_codes = ((conn->capabilities &
		SMTP_CAPABILITY_ENHANCEDSTATUSCODES) != 0);
	struct smtp_reply *reply;
	const char *error = NULL;
	int ret;

	if (conn->ssl_iostream != NULL &&
		!ssl_iostream_is_handshaked(conn->ssl_iostream)) {
		/* finish SSL negotiation by reading from input stream */
		while ((ret=i_stream_read(conn->conn.input)) > 0 || ret == -2) {
			if (ssl_iostream_is_handshaked(conn->ssl_iostream))
				break;
		}
		if (ret < 0) {
			/* failed somehow */
			i_assert(ret != -2);
			error = t_strdup_printf(
				"SSL handshaking with %s failed: "
				"read(%s) failed: %s", _conn->name,
				i_stream_get_name(conn->conn.input),
				i_stream_get_error(conn->conn.input));
			smtp_client_connection_debug(conn,
				"connect(%s) failed: %s", _conn->name, error);
			smtp_client_connection_fail(conn,
				SMTP_CLIENT_COMMAND_ERROR_CONNECT_FAILED, error);
			return;
		}

		if (!ssl_iostream_is_handshaked(conn->ssl_iostream)) {
			/* not finished */
			i_assert(ret == 0);
			return;
		}

		/* ready for SMTP handshake */
		smtp_client_connection_established(conn);
	}

	smtp_client_connection_ref(conn);
	o_stream_cork(conn->conn.output);
	for (;;) {
		if (conn->cmd_wait_list_head != NULL &&
		    conn->cmd_wait_list_head->ehlo) {
			if ((ret=smtp_reply_parse_ehlo(conn->reply_parser,
				&reply, &error)) <= 0)
				break;
		} else {
			if ((ret=smtp_reply_parse_next(conn->reply_parser,
				enhanced_codes, &reply, &error)) <= 0)
				break;
		}

		T_BEGIN {
			ret = smtp_client_connection_input_reply(conn, reply);
		} T_END;
		if (ret < 0) {
			if (conn->conn.output != NULL && !conn->corked)
				o_stream_uncork(conn->conn.output);
			smtp_client_connection_unref(&conn);
			return;
		}
	}

	if (ret < 0 || (ret == 0 && conn->conn.input->eof)) {
		if (conn->conn.input->stream_errno == ENOBUFS) {
			smtp_client_connection_fail(conn,
				SMTP_CLIENT_COMMAND_ERROR_BAD_REPLY,
				"Command reply line too long");
		} else if (conn->conn.input->stream_errno != 0) {
			smtp_client_connection_error(conn,
				"read(%s) failed: %s",
				i_stream_get_name(conn->conn.input),
				i_stream_get_error(conn->conn.input));
			smtp_client_connection_fail(conn,
				SMTP_CLIENT_COMMAND_ERROR_CONNECTION_LOST,
				"Lost connection to remote server "
				"(read failure)");
		} else if (!i_stream_have_bytes_left(conn->conn.input)) {
			smtp_client_connection_fail(conn,
				SMTP_CLIENT_COMMAND_ERROR_CONNECTION_LOST,
				"Lost connection to remote server "
				"(disconnected in input)");
		} else {
			i_assert(error != NULL);
			smtp_client_connection_fail(conn,
				SMTP_CLIENT_COMMAND_ERROR_BAD_REPLY,
				t_strdup_printf("Invalid command reply: %s",
						error));
		}
	}
	if (conn->conn.output != NULL && !conn->corked)
		o_stream_uncork(conn->conn.output);
	smtp_client_connection_unref(&conn);
}

static int smtp_client_connection_output(struct smtp_client_connection *conn)
{
	const char *error;
	int ret;

	if (conn->to_connect != NULL)
		timeout_reset(conn->to_connect);

	if ((ret=o_stream_flush(conn->conn.output)) <= 0) {
		if (ret < 0) {
			smtp_client_connection_error(conn,
				"Connection lost: write(%s) failed: %s",
				o_stream_get_name(conn->conn.output),
				o_stream_get_error(conn->conn.output));
			smtp_client_connection_fail(conn,
				SMTP_CLIENT_COMMAND_ERROR_CONNECTION_LOST,
				"Lost connection to remote server "
				"(write failure)");
		}
		return ret;
	}

	smtp_client_connection_ref(conn);
	if (smtp_client_command_send_more(conn, &error) < 0) {
		smtp_client_connection_error(conn,
			"Connection lost: %s", error);
		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_CONNECTION_LOST,
			"Lost connection to remote server "
			"(failed to send command)");
		ret = -1;
	}
	smtp_client_connection_unref(&conn);
	return ret;
}

void smtp_client_connection_trigger_output(struct smtp_client_connection *conn)
{
	if (conn->conn.output != NULL)
		o_stream_set_flush_pending(conn->conn.output, TRUE);
}

static void smtp_client_connection_destroy(struct connection *_conn)
{
	struct smtp_client_connection *conn =
		(struct smtp_client_connection *)_conn;
	const char *error;

	switch (_conn->disconnect_reason) {
	case CONNECTION_DISCONNECT_NOT:
		break;
	case CONNECTION_DISCONNECT_DEINIT:
		smtp_client_connection_debug(conn,
			"Connection deinit");
		smtp_client_connection_commands_abort(conn);
		smtp_client_connection_close(&conn);
		break;
	case CONNECTION_DISCONNECT_CONNECT_TIMEOUT:
		smtp_client_connection_error(conn,
			"connect(%s) failed: Connection timed out",
			_conn->name);
		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_CONNECT_FAILED,
			"Connect timed out");
		break;
	default:
	case CONNECTION_DISCONNECT_CONN_CLOSED:
		if (conn->connect_failed)
			break;
		error = _conn->input == NULL ? "Connection lost" :
			t_strdup_printf("Connection lost: %s",
					i_stream_get_error(_conn->input));
		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_CONNECTION_LOST, error);
		break;
	}
}

static void
smtp_client_connection_established(struct smtp_client_connection *conn)
{
	struct stat st;

	if (conn->to_connect != NULL)
		timeout_reset(conn->to_connect);

	/* (re-)initialize rawlog */
	if (conn->set.rawlog_dir != NULL &&
	    stat(conn->set.rawlog_dir, &st) == 0) {
		iostream_rawlog_create(conn->set.rawlog_dir,
				       &conn->conn.input, &conn->conn.output);
	}

	/* create/update reply parser */
	if (conn->reply_parser == NULL) {
		conn->reply_parser = smtp_reply_parser_init(
			conn->conn.input, conn->set.max_reply_size);
	} else {
		smtp_reply_parser_set_stream(conn->reply_parser,
					     conn->conn.input);
	}

	/* set flush callback */
	o_stream_set_flush_callback(conn->conn.output,
		smtp_client_connection_output, conn);
}

static int
smtp_client_connection_ssl_handshaked(const char **error_r, void *context)
{
	struct smtp_client_connection *conn = context;
	const char *error, *host = conn->host;

	if (ssl_iostream_check_cert_validity(conn->ssl_iostream,
					     host, &error) == 0) {
		smtp_client_connection_debug(conn,
			"SSL handshake successful");
	} else if (conn->set.ssl->allow_invalid_cert) {
		smtp_client_connection_debug(conn,
			"SSL handshake successful, "
			"ignoring invalid certificate: %s", error);
	} else {
		*error_r = error;
		return -1;
	}
	return 0;
}

static int
smtp_client_connection_init_ssl_ctx(struct smtp_client_connection *conn,
				    const char **error_r)
{
	struct smtp_client *client = conn->client;
	const char *error;

	if (conn->ssl_ctx != NULL)
		return 0;

	if (conn->set.ssl == client->set.ssl) {
		if (smtp_client_init_ssl_ctx(client, error_r) < 0)
			return -1;
		conn->ssl_ctx = client->ssl_ctx;
		ssl_iostream_context_ref(conn->ssl_ctx);
		return 0;
	}

	if (conn->set.ssl == NULL) {
		*error_r = "Requested SSL connection, but no SSL settings given";
		return -1;
	}
	if (ssl_iostream_client_context_cache_get(conn->set.ssl,
		&conn->ssl_ctx, &error) < 0) {
		*error_r = t_strdup_printf("Couldn't initialize SSL context: %s",
					   error);
		return -1;
	}
	return 0;
}

static int
smtp_client_connection_ssl_init(struct smtp_client_connection *conn,
				const char **error_r)
{
	struct ssl_iostream_settings ssl_set;
	const char *error;

	if (smtp_client_connection_init_ssl_ctx(conn, &error) < 0) {
		*error_r = t_strdup_printf(
			"Failed to initialize SSL: %s", error);
		return -1;
	}

	i_zero(&ssl_set);
	if (!conn->set.ssl->allow_invalid_cert) {
		ssl_set.verbose_invalid_cert = TRUE;
	}

	if (conn->set.debug)
		smtp_client_connection_debug(conn, "Starting SSL handshake");

	if (conn->raw_input != conn->conn.input) {
		/* recreate rawlog after STARTTLS */
		i_stream_ref(conn->raw_input);
		o_stream_ref(conn->raw_output);
		i_stream_destroy(&conn->conn.input);
		o_stream_destroy(&conn->conn.output);
		conn->conn.input = conn->raw_input;
		conn->conn.output = conn->raw_output;
	}

	if (io_stream_create_ssl_client(conn->ssl_ctx,
		conn->host, &ssl_set,
		&conn->conn.input, &conn->conn.output,
		&conn->ssl_iostream, &error) < 0) {
		*error_r = t_strdup_printf(
			"Couldn't initialize SSL client for %s: %s",
			conn->conn.name, error);
		return -1;
	}
	ssl_iostream_set_handshake_callback(conn->ssl_iostream,
		smtp_client_connection_ssl_handshaked, conn);
	if (ssl_iostream_handshake(conn->ssl_iostream) < 0) {
		*error_r = t_strdup_printf("SSL handshake to %s failed: %s",
			conn->conn.name,
			ssl_iostream_get_last_error(conn->ssl_iostream));
		return -1;
	}

	if (ssl_iostream_is_handshaked(conn->ssl_iostream)) {
		smtp_client_connection_established(conn);
	} else {
		/* wait for handshake to complete; connection input handler
		   does the rest by reading from the input stream */
		o_stream_set_flush_callback(conn->conn.output,
			smtp_client_connection_output, conn);
	}
	return 0;
}

static void
smtp_client_connection_delayed_connect_failure(
	struct smtp_client_connection *conn)
{
	smtp_client_connection_debug(conn, "Delayed connect failure");

	i_assert(conn->to_connect != NULL);
	timeout_remove(&conn->to_connect);
	smtp_client_connection_fail(conn,
		SMTP_CLIENT_COMMAND_ERROR_CONNECT_FAILED,
		"Failed to connect to remote server");
}

static void
smtp_client_connection_connected(struct connection *_conn, bool success)
{
	struct smtp_client_connection *conn =
		(struct smtp_client_connection *)_conn;
	const struct smtp_client_settings *set = &conn->set;
	const char *error;

	if (!success) {
		smtp_client_connection_error(conn,
			"connect(%s) failed: %m", _conn->name);
		conn->connect_failed = TRUE;
		timeout_remove(&conn->to_connect);
		conn->to_connect = timeout_add_short(0,
			smtp_client_connection_delayed_connect_failure, conn);
		return;
	}

	smtp_client_connection_debug(conn, "Connected");

	(void)net_set_tcp_nodelay(_conn->fd_out, TRUE);
	if (set->socket_send_buffer_size > 0) {
		if (net_set_send_buffer_size(_conn->fd_out,
			set->socket_send_buffer_size) < 0)
			i_error("net_set_send_buffer_size(%"PRIuSIZE_T") failed: %m",
				set->socket_send_buffer_size);
	}
	if (set->socket_recv_buffer_size > 0) {
		if (net_set_recv_buffer_size(_conn->fd_in,
			set->socket_recv_buffer_size) < 0)
			i_error("net_set_recv_buffer_size(%"PRIuSIZE_T") failed: %m",
				set->socket_recv_buffer_size);
	}

	conn->raw_input = conn->conn.input;
	conn->raw_output = conn->conn.output;

	if (conn->ssl_mode == SMTP_CLIENT_SSL_MODE_IMMEDIATE) {
		if (smtp_client_connection_ssl_init(conn, &error) < 0) {
			smtp_client_connection_error(conn,
				"connect(%s) failed: %s", _conn->name, error);
			timeout_remove(&conn->to_connect);
			conn->to_connect = timeout_add_short(0,
				smtp_client_connection_delayed_connect_failure,
				conn);
		}
	} else {
		smtp_client_connection_established(conn);
		smtp_client_connection_input(_conn);
	}
}

static void
smtp_client_connection_connect_timeout(struct smtp_client_connection *conn)
{
	switch (conn->state) {
	case SMTP_CLIENT_CONNECTION_STATE_CONNECTING:
		smtp_client_connection_error(conn,
			"connect(%s) failed: "
			"Connection timed out after %u seconds",
			conn->conn.name,
			conn->set.connect_timeout_msecs/1000);
		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_CONNECT_FAILED,
			"Connect timed out");
		break;
	case SMTP_CLIENT_CONNECTION_STATE_HANDSHAKING:
		smtp_client_connection_error(conn,
			"SMTP handshake timed out after %u seconds",
			conn->set.connect_timeout_msecs/1000);
		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_CONNECT_FAILED,
			"Handshake timed out");
		break;
	case SMTP_CLIENT_CONNECTION_STATE_AUTHENTICATING:
		smtp_client_connection_error(conn,
			"Authentication timed out after %u seconds",
			conn->set.connect_timeout_msecs/1000);
		smtp_client_connection_fail(conn,
			SMTP_CLIENT_COMMAND_ERROR_AUTH_FAILED,
			"Authentication timed out");
		break;
	default:
		i_unreached();
	}
}

static void
smtp_client_connection_do_connect(struct smtp_client_connection *conn)
{
	unsigned int msecs;

	conn->connect_failed = FALSE;
	conn->handshake_failed = FALSE;
	if (connection_client_connect(&conn->conn) < 0) {
		smtp_client_connection_connected(&conn->conn, FALSE);
		return;
	}

	/* don't use connection.h timeout because we want this timeout
	   to include also the SSL handshake */
	msecs = conn->set.connect_timeout_msecs;
	if (msecs == 0)
		msecs = conn->set.command_timeout_msecs;
	i_assert(conn->to_connect == NULL);
	if (msecs > 0) {
		conn->to_connect = timeout_add(msecs,
			smtp_client_connection_connect_timeout, conn);
	}
}

static void
smtp_client_connection_connect_next_ip(struct smtp_client_connection *conn)
{
	const struct ip_addr *ip;

	timeout_remove(&conn->to_connect);

	conn->prev_connect_idx = (conn->prev_connect_idx+1) % conn->ips_count;
	ip = &conn->ips[conn->prev_connect_idx];

	smtp_client_connection_debug(conn,
		"Connecting to %s:%u",
		net_ip2addr(ip), conn->port);

	connection_init_client_ip
		(conn->client->conn_list, &conn->conn, ip, conn->port);

	smtp_client_connection_do_connect(conn);
}

static void
smtp_client_connection_delayed_host_lookup_failure(
	struct smtp_client_connection *conn)
{
	smtp_client_connection_debug(conn,
		"Delayed host lookup failure");

	i_assert(conn->to_connect != NULL);
	timeout_remove(&conn->to_connect);
	smtp_client_connection_fail(conn,
		SMTP_CLIENT_COMMAND_ERROR_HOST_LOOKUP_FAILED,
		"Failed to lookup remote server");
}

static void
smtp_client_connection_dns_callback(const struct dns_lookup_result *result,
	struct smtp_client_connection *conn)
{
	conn->dns_lookup = NULL;

	if (result->ret != 0) {
		smtp_client_connection_error(conn,
			"dns_lookup(%s) failed: %s",
			conn->host, result->error);
		timeout_remove(&conn->to_connect);
		conn->to_connect = timeout_add_short(0,
			smtp_client_connection_delayed_host_lookup_failure, conn);
		return;
	}

	smtp_client_connection_debug(conn,
		"DNS lookup successful; got %d IPs",
		result->ips_count);

	i_assert(result->ips_count > 0);
	conn->ips_count = result->ips_count;
	conn->ips = i_new(struct ip_addr, conn->ips_count);
	memcpy(conn->ips, result->ips, sizeof(*conn->ips) * conn->ips_count);
	conn->prev_connect_idx = conn->ips_count - 1;

	smtp_client_connection_connect_next_ip(conn);
}

void smtp_client_connection_connect(struct smtp_client_connection *conn,
	smtp_client_command_callback_t login_callback, void *login_context)
{
	struct dns_lookup_settings dns_set;
	struct ip_addr ip, *ips;
	unsigned int ips_count;
	int ret;

	if (conn->state != SMTP_CLIENT_CONNECTION_STATE_DISCONNECTED) {
		i_assert(login_callback == NULL);
		return;
	}
	i_assert(conn->login_callback == NULL);
	conn->login_callback = login_callback;
	conn->login_context = login_context;

	smtp_client_connection_debug(conn, "Looking up IP address");

	smtp_client_connection_set_state(conn,
		SMTP_CLIENT_CONNECTION_STATE_CONNECTING);
	if (conn->ips_count == 0 &&
	    net_addr2ip(conn->host, &ip) == 0) {
		/* IP address */
		conn->ips_count = 1;
		conn->ips = i_new(struct ip_addr, conn->ips_count);
		conn->ips[0] = ip;
	} else if (conn->set.dns_client != NULL) {
		smtp_client_connection_debug(conn,
			"Performing asynchronous DNS lookup");
		(void)dns_client_lookup(conn->set.dns_client, conn->host,
			smtp_client_connection_dns_callback, conn,
			&conn->dns_lookup);
	} else if (conn->set.dns_client_socket_path != NULL) {
		i_zero(&dns_set);
		dns_set.dns_client_socket_path =
			conn->set.dns_client_socket_path;
		dns_set.timeout_msecs = conn->set.connect_timeout_msecs;
		smtp_client_connection_debug(conn,
			"Performing asynchronous DNS lookup");
		(void)dns_lookup(conn->host, &dns_set,
			smtp_client_connection_dns_callback, conn,
			&conn->dns_lookup);
	} else {
		/* no dns-conn, use blocking lookup */
		ret = net_gethostbyname(conn->host, &ips, &ips_count);
		if (ret != 0) {
			smtp_client_connection_error(conn,
				"net_gethostbyname(%s) failed: %s",
				conn->host, net_gethosterror(ret));
			timeout_remove(&conn->to_connect);
			conn->to_connect = timeout_add_short(0,
				smtp_client_connection_delayed_host_lookup_failure, conn);
			return;
		}

		smtp_client_connection_debug(conn,
			"DNS lookup successful; got %d IPs", ips_count);

		conn->ips_count = ips_count;
		conn->ips = i_new(struct ip_addr, ips_count);
		memcpy(conn->ips, ips, ips_count * sizeof(*ips));
	}

	if (conn->ips_count == 0)
		return;

	/* always work asynchronously */
	timeout_remove(&conn->to_connect);
	conn->to_connect = timeout_add(0,
		smtp_client_connection_connect_next_ip, conn);
}

static const struct connection_settings smtp_client_connection_set = {
	.input_max_size = (size_t)-1,
	.output_max_size = (size_t)-1,
	.client = TRUE
};

static const struct connection_vfuncs smtp_client_connection_vfuncs = {
	.destroy = smtp_client_connection_destroy,
	.input = smtp_client_connection_input,
	.client_connected = smtp_client_connection_connected
};

struct connection_list *
smtp_client_connection_list_init(void)
{
	return connection_list_init
		(&smtp_client_connection_set, &smtp_client_connection_vfuncs);
}

void smtp_client_connection_disconnect(struct smtp_client_connection *conn)
{
	if (conn->state == SMTP_CLIENT_CONNECTION_STATE_DISCONNECTED)
		return;

	smtp_client_connection_debug(conn, "Disconnected");

	smtp_client_connection_clear_password(conn);

	if (conn->conn.output != NULL && !conn->sent_quit &&
		!conn->sending_command) {
		/* Close the connection gracefully if possible */
		o_stream_uncork(conn->conn.output);
		o_stream_send_str(conn->conn.output, "QUIT\r\n");
	}

	if (conn->dns_lookup != NULL)
		dns_lookup_abort(&conn->dns_lookup);
	timeout_remove(&conn->to_connect);
	timeout_remove(&conn->to_trans);
	timeout_remove(&conn->to_commands);

	if (conn->ssl_iostream != NULL)
		ssl_iostream_unref(&conn->ssl_iostream);
	if (conn->ssl_ctx != NULL)
		ssl_iostream_context_unref(&conn->ssl_ctx);
	if (conn->sasl_client != NULL)
		dsasl_client_free(&conn->sasl_client);

	o_stream_destroy(&conn->dot_output);

	connection_disconnect(&conn->conn);

	smtp_client_connection_set_state(conn,
		SMTP_CLIENT_CONNECTION_STATE_DISCONNECTED);
	smtp_client_connection_login_fail(conn,
		SMTP_CLIENT_COMMAND_ERROR_ABORTED,
		"Disconnected from server");
	smtp_client_connection_commands_fail(conn,
		SMTP_CLIENT_COMMAND_ERROR_ABORTED,
		"Disconnected from server");
}

struct smtp_client_connection *
smtp_client_connection_create(struct smtp_client *client,
	enum smtp_protocol protocol, const char *host, in_port_t port,
	enum smtp_client_connection_ssl_mode ssl_mode,
	const struct smtp_client_settings *set)
{
	static unsigned int id = 0;
	struct smtp_client_connection *conn;
	pool_t pool;

	pool = pool_alloconly_create("smtp client connection", 512);
	conn = p_new(pool, struct smtp_client_connection, 1);
	conn->refcount = 1;
	conn->pool = pool;

	conn->client = client;
	conn->id = id++;
	conn->protocol = protocol;
	conn->host = p_strdup(conn->pool, host);
	conn->port = port;
	conn->ssl_mode = ssl_mode;
	conn->conn.name = p_strdup_printf(conn->pool, "%s:%u", host, port);

	conn->set = client->set;
	if (set != NULL) {
		if (set->my_hostname != NULL && *set->my_hostname != '\0')
			conn->set.my_hostname = p_strdup(pool, set->my_hostname);

		if (set->rawlog_dir != NULL && *set->rawlog_dir != '\0')
			conn->set.rawlog_dir = p_strdup_empty(pool, set->rawlog_dir);

		if (set->ssl != NULL)
			conn->set.ssl = ssl_iostream_settings_dup(pool, set->ssl);

		if (set->master_user != NULL && *set->master_user != '\0')
			conn->set.master_user = p_strdup_empty(pool, set->master_user);
		if (set->username != NULL && *set->username != '\0')
			conn->set.username = p_strdup_empty(pool, set->username);
		if (set->password != NULL && *set->password != '\0') {
			conn->password = p_strdup(pool, set->password);
			conn->set.password = conn->password;
		}
		if (set->sasl_mech != NULL)
			conn->set.sasl_mech = set->sasl_mech;
		else if (set->sasl_mechanisms != NULL &&
			 *set->sasl_mechanisms != '\0') {
			conn->set.sasl_mechanisms =
				p_strdup(pool, set->sasl_mechanisms);
		}
		conn->set.remember_password = set->remember_password;

		if (set->command_timeout_msecs > 0)
			conn->set.command_timeout_msecs = set->command_timeout_msecs;
		if (set->connect_timeout_msecs > 0)
			conn->set.connect_timeout_msecs = set->connect_timeout_msecs;
		if (set->max_reply_size > 0)
			client->set.max_reply_size = set->max_reply_size;	
		if (set->max_data_chunk_size > 0)
			client->set.max_data_chunk_size = set->max_data_chunk_size;
		if (set->max_data_chunk_pipeline > 0)
			client->set.max_data_chunk_pipeline = set->max_data_chunk_pipeline;

		if (set->socket_send_buffer_size > 0)
			conn->set.socket_send_buffer_size = set->socket_send_buffer_size;
		if (set->socket_recv_buffer_size > 0)
			conn->set.socket_recv_buffer_size = set->socket_recv_buffer_size;
		conn->set.debug = conn->set.debug || set->debug;

		if (set->proxy_data.source_ip.family != 0) {
			conn->set.proxy_data.source_ip = set->proxy_data.source_ip;
			conn->set.proxy_data.source_port = set->proxy_data.source_port;
			conn->set.proxy_data.ttl_plus_1 = set->proxy_data.ttl_plus_1;
			conn->set.proxy_data.timeout_secs = set->proxy_data.timeout_secs;
			conn->set.proxy_data.helo =
				p_strdup_empty(pool, set->proxy_data.helo);
			conn->set.proxy_data.login =
				p_strdup_empty(pool, set->proxy_data.login);
		}
		conn->set.peer_trusted = set->peer_trusted;
	}

	i_assert(conn->set.my_hostname != NULL &&
		*conn->set.my_hostname != '\0');

	conn->cap_pool = pool_alloconly_create
		("smtp client connection capabilities", 128);

	connection_init(conn->client->conn_list, &conn->conn);

	smtp_client_connection_debug(conn, "Connection created");

	return conn;
}

void smtp_client_connection_ref(struct smtp_client_connection *conn)
{
	i_assert(conn->refcount >= 0);
	conn->refcount++;
}

void smtp_client_connection_unref(struct smtp_client_connection **_conn)
{
	struct smtp_client_connection *conn = *_conn;

	*_conn = NULL;

	i_assert(conn->refcount > 0);
	if (--conn->refcount > 0)
		return;
	if (conn->destroying)
		return;

	conn->destroying = TRUE;

	smtp_client_connection_clear_password(conn);
	smtp_client_connection_disconnect(conn);

	/* could have been created while already disconnected */
	timeout_remove(&conn->to_commands);

	smtp_client_connection_debug(conn, "Destroy");

	if (conn->reply_parser != NULL)
		smtp_reply_parser_deinit(&conn->reply_parser);

	connection_deinit(&conn->conn);

	i_free(conn->ips);
	i_free(conn->label);
	pool_unref(&conn->cap_pool);
	pool_unref(&conn->pool);
}

void smtp_client_connection_close(struct smtp_client_connection **_conn)
{
	struct smtp_client_connection *conn = *_conn;

	*_conn = NULL;

	if (conn->closed)
		return;
	conn->closed = TRUE;

	smtp_client_connection_disconnect(conn);

	/* could have been created while already disconnected */
	timeout_remove(&conn->to_commands);

	smtp_client_connection_unref(&conn);
}

void smtp_client_connection_switch_ioloop(struct smtp_client_connection *conn)
{
	struct smtp_client_transaction *trans;

	if (conn->to_connect != NULL)
		conn->to_connect = io_loop_move_timeout(&conn->to_connect);
	if (conn->to_trans != NULL)
		conn->to_trans = io_loop_move_timeout(&conn->to_trans);
	if (conn->to_commands != NULL)
		conn->to_commands = io_loop_move_timeout(&conn->to_commands);
	connection_switch_ioloop(&conn->conn);

	trans = conn->transactions_head;
	while (trans != NULL) {
		smtp_client_transaction_switch_ioloop(trans);
		trans = trans->next;
	}
}

static void
smtp_client_connection_rset_dummy_cb(
	const struct smtp_reply *reply ATTR_UNUSED,
	struct smtp_client_connection *conn ATTR_UNUSED)
{
	/* nothing */
}

static void
smtp_client_connection_reset(struct smtp_client_connection *conn)
{
	smtp_client_connection_debug(conn,
		"Submitting RSET command");

	conn->reset_needed = FALSE;

	(void)smtp_client_command_rset_submit(conn,
		SMTP_CLIENT_COMMAND_FLAG_PRIORITY,
		smtp_client_connection_rset_dummy_cb, conn);
}

static void
smtp_client_connection_start_transaction(struct smtp_client_connection *conn)
{
	struct smtp_reply reply;

	timeout_remove(&conn->to_trans);

	if (conn->transactions_head == NULL)
		return;
	if (conn->state != SMTP_CLIENT_CONNECTION_STATE_READY)
		return;

	if (conn->reset_needed)
		smtp_client_connection_reset(conn);

	smtp_client_connection_set_state(conn,
		SMTP_CLIENT_CONNECTION_STATE_TRANSACTION);
	smtp_client_connection_debug(conn, "Start next transaction");

	smtp_reply_init(&reply, 200, "Connection ready");
	smtp_client_transaction_connection_result(
		conn->transactions_head, &reply);
}

void smtp_client_connection_add_transaction(
	struct smtp_client_connection *conn,
	struct smtp_client_transaction *trans)
{
	DLLIST2_APPEND(&conn->transactions_head,
	       &conn->transactions_tail, trans);

	smtp_client_connection_connect(conn, NULL, NULL);

	if (conn->state == SMTP_CLIENT_CONNECTION_STATE_READY) {
		conn->to_trans = timeout_add_short(0,
			smtp_client_connection_start_transaction, conn);
	}
}

void smtp_client_connection_abort_transaction(
	struct smtp_client_connection *conn,
	struct smtp_client_transaction *trans)
{
	bool was_first = (trans == conn->transactions_head);

	DLLIST2_REMOVE(&conn->transactions_head,
		&conn->transactions_tail, trans);

	if (!was_first)
		return;
	i_assert(conn->state != SMTP_CLIENT_CONNECTION_STATE_READY);
	if (conn->state != SMTP_CLIENT_CONNECTION_STATE_TRANSACTION)
		return;

	/* transaction messed up; protocol state needs to be reset for
	   next transaction */
	conn->reset_needed = TRUE;

	smtp_client_connection_set_state(conn,
		SMTP_CLIENT_CONNECTION_STATE_READY);
	conn->to_trans = timeout_add_short(0,
		smtp_client_connection_start_transaction, conn);
}

void smtp_client_connection_next_transaction(
	struct smtp_client_connection *conn,
	struct smtp_client_transaction *trans)
{
	i_assert(trans == conn->transactions_head);

	DLLIST2_REMOVE(&conn->transactions_head,
		&conn->transactions_tail, trans);

	i_assert(conn->state != SMTP_CLIENT_CONNECTION_STATE_READY);
	if (conn->state != SMTP_CLIENT_CONNECTION_STATE_TRANSACTION)
		return;

	smtp_client_connection_set_state(conn,
		SMTP_CLIENT_CONNECTION_STATE_READY);
	conn->to_trans = timeout_add_short(0,
		smtp_client_connection_start_transaction, conn);
}